evrex-mcp 0.3.0 → 0.5.0

package/dist/import.js

@@ -0,0 +1,1667 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/client.ts
+var client_exports = {};
+__export(client_exports, {
+  evrexApi: () => evrexApi
+});
+function headers() {
+  const base = { "Content-Type": "application/json" };
+  if (EVREX_TOKEN) base.Authorization = `Bearer ${EVREX_TOKEN}`;
+  return base;
+}
+function describeFailure(method, path, status, statusText) {
+  if (status === 401 || status === 403) {
+    return EVREX_TOKEN ? `${method} ${path} -> ${status}: the EVREX_TOKEN this server was started with was rejected. It may be revoked or expired.` : `${method} ${path} -> ${status}: this evrex backend requires a credential, but no EVREX_TOKEN is set for this MCP server.`;
+  }
+  return `${method} ${path} -> ${status} ${statusText}`;
+}
+async function request(method, path, { body, absentIsAnswer } = {}) {
+  const res = await fetch(`${API_BASE_URL}${path}`, {
+    method,
+    headers: headers(),
+    ...body === void 0 ? {} : { body: JSON.stringify(body) }
+  });
+  if (res.status === 404 && absentIsAnswer) return null;
+  if (!res.ok) throw new Error(describeFailure(method, path, res.status, res.statusText));
+  return await res.json();
+}
+var DEFAULT_API_BASE_URL, API_BASE_URL, EVREX_TOKEN, get, getOrNull, post, evrexApi;
+var init_client = __esm({
+  "src/client.ts"() {
+    "use strict";
+    DEFAULT_API_BASE_URL = "https://api.evrex.ai";
+    API_BASE_URL = (process.env.EVREX_API_BASE_URL ?? process.env.EVREX_API_URL ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+    EVREX_TOKEN = process.env.EVREX_TOKEN ?? process.env.EVREX_API_TOKEN ?? null;
+    get = (path) => request("GET", path);
+    getOrNull = (path) => request("GET", path, { absentIsAnswer: true });
+    post = (path, body) => request("POST", path, { body });
+    evrexApi = {
+      baseUrl: API_BASE_URL,
+      repos: () => get("/repos"),
+      commits: (repoPath) => get(`/commits?repoPath=${encodeURIComponent(repoPath)}`),
+      // Abbreviated shas resolve server-side, so a value pasted from `git log`
+      // works here (apps/backend/src/reads/reads.service.ts#resolveSha).
+      commit: (sha) => getOrNull(`/commits/${encodeURIComponent(sha)}`),
+      sessions: (repoPath) => get(`/sessions?repoPath=${encodeURIComponent(repoPath)}`),
+      session: (id) => getOrNull(`/sessions/${encodeURIComponent(id)}`),
+      ask: (repoPath, text, filePaths) => post("/ask", { repoPath, text, filePaths }),
+      // Evidence-only retrieval (BM25 + embedding), no LLM synthesis call — see
+      // apps/backend/src/query/query.service.ts#search. Used by evrex_search,
+      // which wants ranked hits fast, not a synthesized paragraph.
+      search: (repoPath, text, filePaths) => post("/search", { repoPath, text, filePaths })
+    };
+  }
+});
+
+// src/credential-store.ts
+var credential_store_exports = {};
+__export(credential_store_exports, {
+  CredentialStore: () => CredentialStore,
+  NoKeychainError: () => NoKeychainError,
+  systemRunner: () => systemRunner
+});
+import { spawn } from "node:child_process";
+var SERVICE, ACCOUNT, systemRunner, NoKeychainError, CredentialStore, WINDOWS_PATH, WINDOWS_STORE, WINDOWS_RETRIEVE, WINDOWS_REMOVE;
+var init_credential_store = __esm({
+  "src/credential-store.ts"() {
+    "use strict";
+    SERVICE = "evrex-capture";
+    ACCOUNT = "evrex";
+    systemRunner = {
+      platform: process.platform,
+      run(command, args, stdin) {
+        return new Promise((resolve2) => {
+          const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+          let stdout = "";
+          let stderr = "";
+          child.stdout.on("data", (d) => stdout += d.toString());
+          child.stderr.on("data", (d) => stderr += d.toString());
+          child.on("error", () => resolve2({ code: 127, stdout: "", stderr: "" }));
+          child.on("close", (code) => resolve2({ code: code ?? 1, stdout, stderr }));
+          if (stdin !== void 0) child.stdin.write(stdin);
+          child.stdin.end();
+        });
+      }
+    };
+    NoKeychainError = class extends Error {
+      constructor(platform) {
+        super(
+          `evrex could not find a credential store on this machine (${platform}).
+  macOS   needs \`security\`, which ships with the system.
+  Linux   needs \`secret-tool\` \u2014 install libsecret-tools (Debian/Ubuntu)
+          or libsecret (Fedora/Arch), and make sure a keyring daemon is running.
+  Windows needs PowerShell.
+evrex will not fall back to writing the credential in a plain file.`
+        );
+        this.name = "NoKeychainError";
+      }
+    };
+    CredentialStore = class {
+      constructor(runner = systemRunner) {
+        this.runner = runner;
+      }
+      async available() {
+        switch (this.runner.platform) {
+          case "darwin":
+            return (await this.runner.run("security", ["help"])).code !== 127;
+          case "win32":
+            return (await this.runner.run("powershell", ["-Command", "$PSVersionTable.PSVersion.Major"])).code !== 127;
+          default:
+            return (await this.runner.run("secret-tool", ["--version"])).code !== 127;
+        }
+      }
+      /**
+       * Replaces any existing credential rather than adding a second one. A
+       * machine that re-enrols after expiry must end up with exactly one entry, or
+       * the next read is a coin flip between the live credential and a dead one.
+       */
+      async store(secret) {
+        if (!await this.available()) throw new NoKeychainError(this.runner.platform);
+        switch (this.runner.platform) {
+          case "darwin": {
+            const result = await this.runner.run(
+              "security",
+              ["add-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-U", "-w"],
+              `${secret}
+${secret}
+`
+            );
+            if (result.code !== 0) throw new Error(`Keychain write failed: ${result.stderr.trim()}`);
+            return;
+          }
+          case "win32": {
+            const result = await this.runner.run(
+              "powershell",
+              ["-NoProfile", "-Command", WINDOWS_STORE],
+              secret
+            );
+            if (result.code !== 0) throw new Error(`DPAPI write failed: ${result.stderr.trim()}`);
+            return;
+          }
+          default: {
+            const result = await this.runner.run(
+              "secret-tool",
+              ["store", "--label=evrex capture credential", "service", SERVICE, "account", ACCOUNT],
+              secret
+            );
+            if (result.code !== 0) throw new Error(`secret-tool write failed: ${result.stderr.trim()}`);
+            return;
+          }
+        }
+      }
+      /** Null when there is nothing stored, which is the normal pre-enrolment state. */
+      async retrieve() {
+        if (!await this.available()) throw new NoKeychainError(this.runner.platform);
+        switch (this.runner.platform) {
+          case "darwin": {
+            const r = await this.runner.run("security", [
+              "find-generic-password",
+              "-a",
+              ACCOUNT,
+              "-s",
+              SERVICE,
+              "-w"
+            ]);
+            return r.code === 0 ? r.stdout.trim() || null : null;
+          }
+          case "win32": {
+            const r = await this.runner.run("powershell", ["-NoProfile", "-Command", WINDOWS_RETRIEVE]);
+            return r.code === 0 ? r.stdout.trim() || null : null;
+          }
+          default: {
+            const r = await this.runner.run("secret-tool", [
+              "lookup",
+              "service",
+              SERVICE,
+              "account",
+              ACCOUNT
+            ]);
+            return r.code === 0 ? r.stdout.trim() || null : null;
+          }
+        }
+      }
+      /** Idempotent: removing a credential that is not there is not an error. */
+      async remove() {
+        if (!await this.available()) return;
+        switch (this.runner.platform) {
+          case "darwin":
+            await this.runner.run("security", [
+              "delete-generic-password",
+              "-a",
+              ACCOUNT,
+              "-s",
+              SERVICE
+            ]);
+            return;
+          case "win32":
+            await this.runner.run("powershell", ["-NoProfile", "-Command", WINDOWS_REMOVE]);
+            return;
+          default:
+            await this.runner.run("secret-tool", [
+              "clear",
+              "service",
+              SERVICE,
+              "account",
+              ACCOUNT
+            ]);
+            return;
+        }
+      }
+    };
+    WINDOWS_PATH = "$env:APPDATA\\evrex\\capture.cred";
+    WINDOWS_STORE = `
+$ErrorActionPreference = 'Stop'
+$p = "${WINDOWS_PATH}"
+New-Item -ItemType Directory -Force -Path (Split-Path $p) | Out-Null
+$secret = [Console]::In.ReadToEnd().Trim()
+ConvertTo-SecureString $secret -AsPlainText -Force | ConvertFrom-SecureString | Set-Content -Path $p
+`.trim();
+    WINDOWS_RETRIEVE = `
+$ErrorActionPreference = 'Stop'
+$p = "${WINDOWS_PATH}"
+if (-not (Test-Path $p)) { exit 1 }
+$sec = Get-Content $p | ConvertTo-SecureString
+[Runtime.InteropServices.Marshal]::PtrToStringAuto(
+  [Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec))
+`.trim();
+    WINDOWS_REMOVE = `
+$p = "${WINDOWS_PATH}"
+if (Test-Path $p) { Remove-Item $p -Force }
+`.trim();
+  }
+});
+
+// src/import.ts
+import { realpathSync } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
+
+// ../../packages/ingest-core/src/index.ts
+import { userInfo } from "node:os";
+
+// ../../packages/ingest-core/src/git-history.ts
+import { execFileSync } from "node:child_process";
+var DIFF_CAP = 2e4;
+var FIELD_SEP = "";
+var EVREX_SESSION_TRAILER_KEY = "Evrex-Session";
+function git(repoPath, args, input) {
+  return execFileSync("git", args, {
+    cwd: repoPath,
+    maxBuffer: 1024 * 1024 * 64,
+    input
+  }).toString("utf-8");
+}
+function gitQuiet(repoPath, args) {
+  return execFileSync("git", args, {
+    cwd: repoPath,
+    maxBuffer: 1024 * 1024 * 8,
+    stdio: ["ignore", "pipe", "ignore"]
+  }).toString("utf-8");
+}
+function normalizeRepoRemote(url) {
+  const trimmed = url.trim();
+  if (!trimmed) return null;
+  let host;
+  let path;
+  const scpLike = /^(?:[^/@]+@)?([^/:@]+\.[^/:@]+):(?!\/)(.+)$/.exec(trimmed);
+  if (scpLike?.[1] && scpLike[2]) {
+    host = scpLike[1];
+    path = scpLike[2];
+  } else {
+    let parsed;
+    try {
+      parsed = new URL(trimmed);
+    } catch {
+      return null;
+    }
+    if (parsed.protocol === "file:" || !parsed.hostname) return null;
+    host = parsed.hostname;
+    path = parsed.pathname;
+  }
+  const cleanedPath = path.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/i, "");
+  if (!cleanedPath) return null;
+  return `${host}/${cleanedPath}`.toLowerCase();
+}
+function repoIdFromRemote(url) {
+  const normalized = normalizeRepoRemote(url);
+  return normalized ? `remote:${normalized}` : null;
+}
+function repoIdFromRootCommit(sha) {
+  return `root:${sha}`;
+}
+function repoIdFromPath(repoPath) {
+  return `path:${repoPath}`;
+}
+function firstRemoteUrl(repoPath) {
+  try {
+    const origin = gitQuiet(repoPath, ["remote", "get-url", "origin"]).trim();
+    if (origin) return origin;
+  } catch {
+  }
+  try {
+    const names = gitQuiet(repoPath, ["remote"]).split("\n").map((n) => n.trim()).filter(Boolean).sort();
+    for (const name of names) {
+      const url = gitQuiet(repoPath, ["remote", "get-url", name]).trim();
+      if (url) return url;
+    }
+  } catch {
+  }
+  return null;
+}
+function rootCommitSha(repoPath) {
+  try {
+    const shas = gitQuiet(repoPath, ["rev-list", "--max-parents=0", "HEAD"]).split("\n").map((s) => s.trim()).filter(Boolean).sort();
+    return shas[0] ?? null;
+  } catch {
+    return null;
+  }
+}
+function deriveRepoId(repoPath) {
+  const remote = firstRemoteUrl(repoPath);
+  if (remote) {
+    const fromRemote = repoIdFromRemote(remote);
+    if (fromRemote) return fromRemote;
+  }
+  const root = rootCommitSha(repoPath);
+  if (root) return repoIdFromRootCommit(root);
+  return repoIdFromPath(repoPath);
+}
+function getGitUserName(repoPath) {
+  try {
+    const name = git(repoPath, ["config", "user.name"]).trim();
+    return name || null;
+  } catch {
+    return null;
+  }
+}
+function listShas(repoPath) {
+  const out = git(repoPath, ["rev-list", "--reverse", "HEAD"]).trim();
+  return out.length ? out.split("\n") : [];
+}
+function commitMeta(repoPath, sha) {
+  const line = git(repoPath, [
+    "show",
+    "-s",
+    `--format=%H${FIELD_SEP}%an${FIELD_SEP}%ae${FIELD_SEP}%aI`,
+    sha
+  ]).trim();
+  const parts = line.split(FIELD_SEP);
+  const message = git(repoPath, ["show", "-s", "--format=%B", sha]).replace(/\n+$/, "");
+  return {
+    sha: parts[0] ?? sha,
+    author: parts[1] ?? "",
+    authorEmail: parts[2] ?? "",
+    ts: parts[3] ?? (/* @__PURE__ */ new Date()).toISOString(),
+    message
+  };
+}
+function extractTrailer(repoPath, message, key) {
+  try {
+    const out = git(
+      repoPath,
+      ["interpret-trailers", "--parse", "--no-divider"],
+      message
+    ).trim();
+    for (const line of out.split("\n")) {
+      const idx = line.indexOf(":");
+      if (idx === -1) continue;
+      const trailerKey = line.slice(0, idx).trim();
+      if (trailerKey.toLowerCase() === key.toLowerCase()) {
+        return line.slice(idx + 1).trim();
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function commitBranch(repoPath, sha) {
+  try {
+    const out = git(repoPath, ["branch", "--contains", sha, "--format=%(refname:short)"]).trim();
+    const first = out.split("\n").find((b) => b.length > 0);
+    return first ?? null;
+  } catch {
+    return null;
+  }
+}
+function numstat(repoPath, sha) {
+  const out = git(repoPath, ["show", "--numstat", "--format=", sha]).trim();
+  const map = /* @__PURE__ */ new Map();
+  if (!out) return map;
+  for (const line of out.split("\n")) {
+    const [ins, del, path] = line.split("	");
+    if (!path) continue;
+    map.set(path, {
+      insertions: !ins || ins === "-" ? 0 : Number.parseInt(ins, 10) || 0,
+      deletions: !del || del === "-" ? 0 : Number.parseInt(del, 10) || 0
+    });
+  }
+  return map;
+}
+function parseDiffBlocks(diff) {
+  const map = /* @__PURE__ */ new Map();
+  if (!diff.trim()) return map;
+  const blocks = diff.split(/^diff --git /m).filter(Boolean);
+  for (const block of blocks) {
+    const full = `diff --git ${block}`;
+    const pathMatch = block.match(/^a\/(.+?) b\/(.+?)\n/);
+    const path = pathMatch?.[2] ?? block.match(/^\S+/)?.[0] ?? "unknown";
+    const hunkHeaders = [...full.matchAll(/^@@ .+? @@.*$/gm)].map((m) => m[0]);
+    map.set(path, {
+      hunkHeaders,
+      diffText: full.length > DIFF_CAP ? full.slice(0, DIFF_CAP) : full
+    });
+  }
+  return map;
+}
+function commitFiles(repoPath, sha) {
+  const stats = numstat(repoPath, sha);
+  const diff = git(repoPath, ["show", "--unified=0", "--format=", sha]);
+  const blocks = parseDiffBlocks(diff);
+  const paths = /* @__PURE__ */ new Set([...stats.keys(), ...blocks.keys()]);
+  const files = [];
+  for (const path of paths) {
+    const stat = stats.get(path) ?? { insertions: 0, deletions: 0 };
+    const block = blocks.get(path) ?? { hunkHeaders: [], diffText: "" };
+    files.push({
+      path,
+      insertions: stat.insertions,
+      deletions: stat.deletions,
+      hunkHeaders: block.hunkHeaders,
+      diffText: block.diffText,
+      diffTruncated: block.diffText.length >= DIFF_CAP
+    });
+  }
+  return files;
+}
+function parseGitLog(repoPath, repoId, known) {
+  const shas = listShas(repoPath).filter((sha) => !known?.has(sha));
+  const id = repoId ?? deriveRepoId(repoPath);
+  return shas.map((sha) => {
+    const meta = commitMeta(repoPath, sha);
+    return {
+      sha: meta.sha,
+      repoId: id,
+      repoPath,
+      author: meta.author,
+      authorEmail: meta.authorEmail,
+      ts: meta.ts,
+      message: meta.message,
+      branch: commitBranch(repoPath, sha),
+      evrexSessionTrailer: extractTrailer(repoPath, meta.message, EVREX_SESSION_TRAILER_KEY),
+      files: commitFiles(repoPath, sha)
+    };
+  });
+}
+
+// ../../packages/ingest-core/src/claude-sessions.ts
+import { existsSync, readdirSync, readFileSync, statSync as statSync2 } from "node:fs";
+
+// ../../packages/ingest-core/src/incremental.ts
+import { statSync } from "node:fs";
+function planRead(path, cursor) {
+  let size;
+  let modifiedAt;
+  if (cursor && (cursor.parserVersion ?? 0) < PARSER_VERSION) {
+    cursor = void 0;
+  }
+  try {
+    const stat = statSync(path);
+    size = stat.size;
+    modifiedAt = stat.mtimeMs;
+  } catch {
+    return { path, from: 0, reason: "unchanged" };
+  }
+  if (!cursor) return { path, from: 0, reason: "new" };
+  if (size < cursor.size) return { path, from: 0, reason: "rewritten" };
+  if (size === cursor.size && modifiedAt <= cursor.modifiedAt) {
+    return { path, from: cursor.offset, reason: "unchanged" };
+  }
+  if (size === cursor.offset) return { path, from: cursor.offset, reason: "unchanged" };
+  return { path, from: cursor.offset, reason: "appended" };
+}
+function advanceCursor(path, consumedTo) {
+  let size = consumedTo;
+  let modifiedAt = Date.now();
+  try {
+    const stat = statSync(path);
+    size = stat.size;
+    modifiedAt = stat.mtimeMs;
+  } catch {
+  }
+  return { offset: consumedTo, size, modifiedAt, parserVersion: PARSER_VERSION };
+}
+var PARSER_VERSION = 4;
+
+// ../../packages/ingest-core/src/claude-sessions.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// ../../packages/ingest-core/src/redact.ts
+var PATTERNS = [
+  { type: "private_key", regex: /-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z]+)? PRIVATE KEY-----/g },
+  { type: "aws_access_key", regex: /AKIA[0-9A-Z]{16}/g },
+  { type: "github_token", regex: /gh[pousr]_[A-Za-z0-9]{36,}/g },
+  { type: "slack_token", regex: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+  { type: "stripe_key", regex: /sk_(live|test)_[A-Za-z0-9]{24,}/g },
+  { type: "openai_key", regex: /sk-[A-Za-z0-9]{20,}/g },
+  { type: "anthropic_key", regex: /sk-ant-[A-Za-z0-9-_]{20,}/g },
+  { type: "jwt", regex: /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g },
+  { type: "bearer_token", regex: /Bearer\s+[A-Za-z0-9\-_.]{20,}/g },
+  {
+    type: "env_secret",
+    regex: /\b([A-Z0-9_]*(?:_KEY|_SECRET|_TOKEN|_PASSWORD|PASSWD)[A-Z0-9_]*)\s*[:=]\s*["']?[^\s"'\n]{6,}["']?/g
+  }
+];
+function redactJsonValue(value) {
+  let count = 0;
+  const walk = (v) => {
+    if (typeof v === "string") {
+      const r = redactSecrets(v);
+      count += r.count;
+      return r.text;
+    }
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        out[k] = walk(val);
+      }
+      return out;
+    }
+    return v;
+  };
+  return { value: walk(value), count };
+}
+function redactSecrets(input) {
+  let text = input;
+  let count = 0;
+  for (const { type, regex } of PATTERNS) {
+    text = text.replace(regex, (match, group1) => {
+      count += 1;
+      if (type === "env_secret" && group1) {
+        return `${group1}=[REDACTED:${type}]`;
+      }
+      return `[REDACTED:${type}]`;
+    });
+  }
+  return { text, count };
+}
+
+// ../../packages/ingest-core/src/subject-linking.ts
+function committedSubjects(command) {
+  const out = [];
+  const invocation = /\bgit\s+(?:-C\s+\S+\s+)?commit\b/g;
+  for (let found = invocation.exec(command); found !== null; found = invocation.exec(command)) {
+    const rest = command.slice(found.index + found[0].length);
+    const heredoc = /^[^\n]*<<-?\s*(['"]?)(\w+)\1[^\n]*\r?\n([^\n]*)/.exec(rest);
+    if (heredoc) {
+      const subject = heredoc[3].trim();
+      if (subject) out.push(subject);
+      continue;
+    }
+    const inline = /^[^\n]*?-m\s+(['"])([\s\S]*?)\1/.exec(rest);
+    if (inline) {
+      const subject = inline[2].split("\n")[0].trim();
+      if (subject) out.push(subject);
+    }
+  }
+  return out;
+}
+
+// ../../packages/ingest-core/src/types.ts
+var CONVERSATION_KINDS = [
+  "claude-code",
+  "cursor",
+  "codex",
+  "gemini",
+  "slack"
+];
+var REFERENCE_KINDS = ["linear", "jira", "confluence"];
+var SOURCE_KINDS = [
+  ...CONVERSATION_KINDS,
+  ...REFERENCE_KINDS
+];
+var EMPTY_USAGE = {
+  inputTokens: null,
+  outputTokens: null,
+  cacheReadTokens: null,
+  cacheWriteTokens: null,
+  model: null
+};
+
+// ../../packages/ingest-core/src/claude-sessions.ts
+var MIN_MEANINGFUL_LINE_LENGTH = 6;
+function meaningfulLines(lines) {
+  return lines.map((l) => l.trim()).filter((l) => l.length >= MIN_MEANINGFUL_LINE_LENGTH);
+}
+function extractEditedLines(toolUseResult) {
+  if (!toolUseResult || typeof toolUseResult !== "object") return null;
+  const r = toolUseResult;
+  if (!r.filePath) return null;
+  const added = [];
+  const removed = [];
+  if (Array.isArray(r.structuredPatch) && r.structuredPatch.length > 0) {
+    for (const hunk of r.structuredPatch) {
+      for (const line of hunk.lines ?? []) {
+        if (line.startsWith("+")) added.push(line.slice(1));
+        else if (line.startsWith("-")) removed.push(line.slice(1));
+      }
+    }
+  } else if (r.type === "create" && typeof r.content === "string") {
+    added.push(...r.content.split("\n"));
+  } else {
+    return null;
+  }
+  const meaningfulAdded = meaningfulLines(added);
+  const meaningfulRemoved = meaningfulLines(removed);
+  if (meaningfulAdded.length === 0 && meaningfulRemoved.length === 0) return null;
+  return { path: r.filePath, added: meaningfulAdded, removed: meaningfulRemoved };
+}
+var MAX_TURN_TEXT_LENGTH = 4e3;
+function slugifyCwd(repoPath) {
+  return repoPath.replace(/\//g, "-");
+}
+function claudeProjectsDir() {
+  return join(homedir(), ".claude", "projects");
+}
+function findSessionFiles(repoPath) {
+  const dir = join(claudeProjectsDir(), slugifyCwd(repoPath));
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).filter((name) => name.endsWith(".jsonl")).map((name) => join(dir, name));
+}
+var FILE_PATH_TOOLS = /* @__PURE__ */ new Set(["Read", "Edit", "Write", "NotebookEdit"]);
+var PATH_TOKEN_RE = /(?:[.~]?\/)?(?:[\w-]+\/)+[\w.-]+/g;
+function extractPathsFromText(text) {
+  const matches = text.match(PATH_TOKEN_RE) ?? [];
+  return [...new Set(matches)].filter((p) => p.length > 3 && p.length < 300);
+}
+function blockText(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map((c) => typeof c === "string" ? c : c?.text ?? "").filter(Boolean).join("\n");
+  }
+  return "";
+}
+function extractFromAssistantContent(content) {
+  const textParts = [];
+  const filesTouched = [];
+  for (const block of content) {
+    if (block.type === "text" && block.text) {
+      textParts.push(block.text);
+      for (const p of extractPathsFromText(block.text)) {
+        filesTouched.push({ path: p, source: "prose" });
+      }
+    } else if (block.type === "tool_use") {
+      const name = block.name ?? "tool";
+      const input = block.input ?? {};
+      if (FILE_PATH_TOOLS.has(name) && typeof input.file_path === "string") {
+        textParts.push(`[tool_call: ${name}] ${input.file_path}`);
+        filesTouched.push({ path: input.file_path, source: "tool_path", tool: name });
+      } else if (name === "Bash" && typeof input.command === "string") {
+        const desc = typeof input.description === "string" ? input.description : input.command;
+        textParts.push(`[tool_call: Bash] ${desc}`);
+        for (const p of extractPathsFromText(input.command)) {
+          filesTouched.push({ path: p, source: "tool_bash", tool: "Bash" });
+        }
+      } else {
+        textParts.push(`[tool_call: ${name}]`);
+      }
+    }
+  }
+  return { text: textParts.join("\n"), filesTouched };
+}
+var SYNTHETIC_CONTENT_RE = /^\s*(<task-notification>|<system-reminder>|\[SYSTEM NOTIFICATION)/;
+function extractFromUserContent(content) {
+  if (typeof content === "string") {
+    return {
+      text: content,
+      filesTouched: extractPathsFromText(content).map((path) => ({ path, source: "prose" })),
+      isSyntheticInput: SYNTHETIC_CONTENT_RE.test(content)
+    };
+  }
+  if (Array.isArray(content)) {
+    const toolParts = [];
+    const textParts = [];
+    for (const block of content) {
+      if (block.type === "tool_result") {
+        toolParts.push(blockText(block.content));
+      } else if (block.type === "text" && typeof block.text === "string") {
+        textParts.push(block.text);
+      }
+    }
+    if (toolParts.length > 0) {
+      return {
+        text: toolParts.join("\n"),
+        filesTouched: [],
+        isSyntheticInput: true
+      };
+    }
+    const text = textParts.join("\n");
+    return {
+      text,
+      // Same treatment the string branch gives prose, so a path a person
+      // names in a block-formatted message is found too.
+      filesTouched: extractPathsFromText(text).map((path) => ({
+        path,
+        source: "prose"
+      })),
+      isSyntheticInput: SYNTHETIC_CONTENT_RE.test(text)
+    };
+  }
+  return { text: "", filesTouched: [], isSyntheticInput: false };
+}
+function usageOnce(record, billed) {
+  const message = record.message;
+  const raw = message?.usage;
+  if (!raw || typeof raw !== "object") return { ...EMPTY_USAGE };
+  const messageId = message?.id;
+  if (!messageId || billed.has(messageId)) return { ...EMPTY_USAGE };
+  billed.add(messageId);
+  const num = (key) => {
+    const value = raw[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+  };
+  return {
+    inputTokens: num("input_tokens"),
+    outputTokens: num("output_tokens"),
+    cacheReadTokens: num("cache_read_input_tokens"),
+    cacheWriteTokens: num("cache_creation_input_tokens"),
+    model: typeof message?.model === "string" ? message.model : null
+  };
+}
+function parseSessionFile(filePath, repoPath, repoId = deriveRepoId(repoPath)) {
+  const raw = readFileSync(filePath, "utf-8");
+  const lines = raw.split("\n").filter((l) => l.trim().length > 0);
+  const turns = [];
+  const billedMessages = /* @__PURE__ */ new Set();
+  let sessionId = null;
+  const cwd = repoPath;
+  let aiTitle = null;
+  let totalRedactions = 0;
+  for (const line of lines) {
+    let record;
+    try {
+      record = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (record.type === "ai-title" && typeof record.aiTitle === "string") {
+      aiTitle = record.aiTitle;
+      continue;
+    }
+    if (record.type !== "user" && record.type !== "assistant") continue;
+    const id = record.uuid;
+    const ts = record.timestamp;
+    if (!id || !ts) continue;
+    sessionId ??= record.sessionId ?? record.session_id ?? null;
+    let text = "";
+    let filesTouched = [];
+    let editedLines = [];
+    let isSyntheticInput = false;
+    if (record.type === "assistant") {
+      const content = record.message?.content;
+      if (Array.isArray(content)) {
+        const extracted = extractFromAssistantContent(content);
+        text = extracted.text;
+        filesTouched = extracted.filesTouched;
+      }
+    } else {
+      const extracted = extractFromUserContent(record.message?.content);
+      text = extracted.text;
+      filesTouched = extracted.filesTouched;
+      isSyntheticInput = extracted.isSyntheticInput;
+      const edited = extractEditedLines(record.toolUseResult);
+      if (edited) editedLines = [edited];
+    }
+    const redacted = redactSecrets(text);
+    totalRedactions += redacted.count;
+    turns.push({
+      id,
+      sessionId: sessionId ?? "unknown",
+      role: record.type,
+      ts,
+      text: redacted.text.slice(0, MAX_TURN_TEXT_LENGTH),
+      filesTouched,
+      editedLines,
+      parentUuid: record.parentUuid ?? null,
+      isSidechain: Boolean(record.isSidechain),
+      redacted: redacted.count > 0,
+      isSyntheticInput,
+      usage: usageOnce(record, billedMessages)
+    });
+  }
+  if (!sessionId || turns.length === 0) return null;
+  const sortedTs = turns.map((t) => t.ts).sort();
+  const rawContent = lines.map((line) => {
+    try {
+      return JSON.stringify(redactJsonValue(JSON.parse(line)).value);
+    } catch {
+      return redactSecrets(line).text;
+    }
+  }).join("\n");
+  if (totalRedactions > 0) {
+    console.log(`[ingest-core] redacted ${totalRedactions} potential secret(s) in session ${sessionId}`);
+  }
+  return {
+    id: sessionId,
+    agentKind: "claude-code",
+    repoId,
+    cwd,
+    startedAt: sortedTs[0] ?? null,
+    endedAt: sortedTs[sortedTs.length - 1] ?? null,
+    turnCount: turns.length,
+    aiTitle,
+    author: null,
+    // filled in by the caller — see getGitUserName in git-history.ts
+    sourceFile: filePath,
+    redactionCount: totalRedactions,
+    committedSubjects: collectCommittedSubjects(lines),
+    rawContent,
+    rawFormat: "jsonl",
+    turns
+  };
+}
+function collectCommittedSubjects(lines) {
+  const subjects = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    if (!line.includes("git commit")) continue;
+    let record;
+    try {
+      record = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const content = record?.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      if (block?.type !== "tool_use") continue;
+      const command = block?.input?.command;
+      if (typeof command !== "string") continue;
+      for (const subject of committedSubjects(command)) subjects.add(subject);
+    }
+  }
+  return [...subjects];
+}
+function parseAllSessions(repoPath, repoId, cursors = {}) {
+  const id = repoId ?? deriveRepoId(repoPath);
+  const next = { ...cursors };
+  const sessions = [];
+  let skipped = 0;
+  for (const file of findSessionFiles(repoPath)) {
+    const plan = planRead(file, cursors[file]);
+    if (plan.reason === "unchanged") {
+      skipped++;
+      continue;
+    }
+    const parsed = parseSessionFile(file, repoPath, id);
+    if (!parsed) continue;
+    sessions.push(parsed);
+    next[file] = advanceCursor(file, statSync2(file).size);
+  }
+  return { sessions, cursors: next, skipped };
+}
+
+// ../../packages/ingest-core/src/cursor-sessions.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join2, sep } from "node:path";
+
+// ../../packages/ingest-core/src/derive-uuid.ts
+import { createHash } from "node:crypto";
+function deriveUuid(name) {
+  const h = createHash("sha1").update(name).digest("hex");
+  const variant = (parseInt(h.slice(16, 17) || "0", 16) & 3 | 8).toString(16);
+  const s = h.slice(0, 12) + // time-low + time-mid
+  "5" + // version 5 (name-based, SHA-1)
+  h.slice(13, 16) + variant + h.slice(17, 32);
+  return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20, 32)}`;
+}
+
+// ../../packages/ingest-core/src/cursor-sessions.ts
+var MAX_TURN_TEXT_LENGTH2 = 4e3;
+var PATH_TOKEN_RE2 = /(?:[.~]?\/)?(?:[\w-]+\/)+[\w.-]+/g;
+function extractPathsFromText2(text) {
+  const matches = text.match(PATH_TOKEN_RE2) ?? [];
+  return [...new Set(matches)].filter((p) => p.length > 3 && p.length < 300);
+}
+function cursorStateDbPath() {
+  const home = homedir2();
+  if (process.platform === "darwin") {
+    return join2(home, "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+  }
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA ?? join2(home, "AppData", "Roaming");
+    return join2(appData, "Cursor", "User", "globalStorage", "state.vscdb");
+  }
+  return join2(home, ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+}
+function sqliteJson(dbPath, sql) {
+  try {
+    const out = execFileSync2("sqlite3", ["-readonly", "-json", dbPath, sql], {
+      maxBuffer: 1024 * 1024 * 256,
+      timeout: 6e4
+    }).toString("utf-8").trim();
+    if (!out) return [];
+    return JSON.parse(out);
+  } catch {
+    return [];
+  }
+}
+function sqlLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function deriveCursorSessionId(composerId, repoPath) {
+  return deriveUuid(`evrex-cursor-session\0${composerId}\0${repoPath}`);
+}
+function deriveCursorTurnId(bubbleId, repoPath) {
+  return deriveUuid(`evrex-cursor-turn\0${bubbleId}\0${repoPath}`);
+}
+function loadComposers(dbPath) {
+  return sqliteJson(
+    dbPath,
+    `SELECT
+       json_extract(value,'$.composerId')                   AS composerId,
+       json_extract(value,'$.name')                         AS name,
+       json_extract(value,'$.createdAt')                    AS createdAt,
+       json_extract(value,'$.lastUpdatedAt')                AS lastUpdatedAt,
+       json_extract(value,'$.workspaceIdentifier.uri.path') AS workspacePath,
+       json_extract(value,'$.fullConversationHeadersOnly')  AS headers
+     FROM cursorDiskKV
+     WHERE key GLOB 'composerData:*'`
+  );
+}
+function composerIdsReferencingRepo(dbPath, repoPath) {
+  const needle = sqlLiteral(`%${repoPath}%`);
+  const rows = sqliteJson(
+    dbPath,
+    `SELECT DISTINCT substr(key, 10, 36) AS composerId
+     FROM cursorDiskKV
+     WHERE key GLOB 'bubbleId:*' AND value LIKE ${needle}`
+  );
+  return rows.map((r) => r.composerId).filter((id) => !!id);
+}
+function bubbleIdsReferencingRepo(dbPath, composerId, repoPath) {
+  const prefix = sqlLiteral(`bubbleId:${composerId}:%`);
+  const needle = sqlLiteral(`%${repoPath}%`);
+  const rows = sqliteJson(
+    dbPath,
+    `SELECT substr(key, ${10 + composerId.length + 1}) AS bubbleId
+     FROM cursorDiskKV
+     WHERE key LIKE ${prefix} AND value LIKE ${needle}`
+  );
+  return new Set(rows.map((r) => r.bubbleId).filter((id) => !!id));
+}
+function loadBubbles(dbPath, composerId) {
+  const prefix = sqlLiteral(`bubbleId:${composerId}:%`);
+  const rows = sqliteJson(
+    dbPath,
+    `SELECT
+       substr(key, ${10 + composerId.length + 1}) AS bubbleId,
+       json_extract(value,'$.type')                 AS type,
+       json_extract(value,'$.text')                 AS text,
+       json_extract(value,'$.thinking.text')        AS thinking,
+       json_extract(value,'$.toolFormerData.name')  AS toolName,
+       json_extract(value,'$.toolFormerData.rawArgs') AS rawArgs,
+       json_extract(value,'$.createdAt')            AS createdAt
+     FROM cursorDiskKV
+     WHERE key LIKE ${prefix}`
+  );
+  const map = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    if (r.bubbleId) map.set(r.bubbleId, r);
+  }
+  return map;
+}
+function loadRawRecords(dbPath, composerId, bubbleIds) {
+  const keys = [
+    `composerData:${composerId}`,
+    ...bubbleIds.map((b) => `bubbleId:${composerId}:${b}`)
+  ];
+  const inList = keys.map((k) => sqlLiteral(k)).join(", ");
+  const rows = sqliteJson(
+    dbPath,
+    `SELECT key, value FROM cursorDiskKV WHERE key IN (${inList})`
+  );
+  const records = {};
+  for (const { key, value } of rows) {
+    if (!key) continue;
+    try {
+      records[key] = value ? JSON.parse(value) : null;
+    } catch {
+      records[key] = value;
+    }
+  }
+  return records;
+}
+function parseHeaders(headers2) {
+  if (!headers2) return [];
+  try {
+    const parsed = JSON.parse(headers2);
+    return Array.isArray(parsed) ? parsed.filter((h) => h && h.bubbleId) : [];
+  } catch {
+    return [];
+  }
+}
+function filesFromTool(toolName, rawArgs) {
+  const files = [];
+  let label = `[tool_call: ${toolName}]`;
+  if (!rawArgs) return { label, files };
+  let args = {};
+  try {
+    args = JSON.parse(rawArgs);
+  } catch {
+    return { label, files };
+  }
+  const filePath = typeof args.target_file === "string" && args.target_file || typeof args.path === "string" && args.path || typeof args.relative_workspace_path === "string" && args.relative_workspace_path || null;
+  const command = typeof args.command === "string" ? args.command : null;
+  if (filePath) {
+    label = `[tool_call: ${toolName}] ${filePath}`;
+    files.push({ path: filePath, source: "tool_path", tool: toolName });
+  } else if (command) {
+    label = `[tool_call: ${toolName}] ${command}`;
+    for (const p of extractPathsFromText2(command)) {
+      files.push({ path: p, source: "tool_bash", tool: toolName });
+    }
+  }
+  return { label, files };
+}
+function toIso(value, fallbackMs) {
+  if (typeof value === "string" && value) {
+    const t = Date.parse(value);
+    if (!Number.isNaN(t)) return new Date(t).toISOString();
+  }
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return new Date(value).toISOString();
+  }
+  return new Date(fallbackMs).toISOString();
+}
+function parseCursorComposer(dbPath, composer, repoPath, options = { scoped: false }, repoId = deriveRepoId(repoPath)) {
+  const composerId = composer.composerId;
+  if (!composerId) return null;
+  const headers2 = parseHeaders(composer.headers);
+  if (headers2.length === 0) return null;
+  const bubbles = loadBubbles(dbPath, composerId);
+  const composerCreatedMs = typeof composer.createdAt === "number" ? composer.createdAt : Date.now();
+  const referencing = options.scoped ? bubbleIdsReferencingRepo(dbPath, composerId, repoPath) : null;
+  const built = [];
+  for (const header of headers2) {
+    const bubble = bubbles.get(header.bubbleId);
+    if (!bubble) continue;
+    const role = header.type === 1 ? "user" : "assistant";
+    const textParts = [];
+    const filesTouched = [];
+    if (bubble.text && bubble.text.trim()) {
+      textParts.push(bubble.text);
+      for (const p of extractPathsFromText2(bubble.text)) {
+        filesTouched.push({ path: p, source: "prose" });
+      }
+    }
+    if (role === "assistant" && bubble.thinking && bubble.thinking.trim()) {
+      textParts.push(bubble.thinking);
+    }
+    if (bubble.toolName) {
+      const { label, files } = filesFromTool(bubble.toolName, bubble.rawArgs);
+      textParts.push(label);
+      filesTouched.push(...files);
+    }
+    const text = textParts.join("\n");
+    if (!text.trim() && filesTouched.length === 0) continue;
+    const redacted = redactSecrets(text);
+    built.push({
+      bubbleId: header.bubbleId,
+      role,
+      referencesRepo: referencing ? referencing.has(header.bubbleId) : true,
+      redactionCount: redacted.count,
+      turn: {
+        id: header.bubbleId,
+        // rewritten to the per-repo derived id below
+        sessionId: composerId,
+        // rewritten to the per-repo derived id below
+        role,
+        ts: toIso(bubble.createdAt, composerCreatedMs),
+        text: redacted.text.slice(0, MAX_TURN_TEXT_LENGTH2),
+        filesTouched,
+        // Cursor's bubble format doesn't expose a structuredPatch-equivalent
+        // the way Claude Code's toolUseResult does — content-overlap scoring
+        // (see scoreContentOverlap in the linker) simply has no signal here
+        // yet, same tier as any other not-yet-supported evidence source.
+        editedLines: [],
+        // Cursor has no parent-pointer chain; header order is authoritative, so
+        // parentUuid is left null (the backend/linker never require it).
+        parentUuid: null,
+        isSidechain: false,
+        redacted: redacted.count > 0,
+        // Cursor's "user" bubbles (header.type === 1, see `role` above) are a
+        // structural field distinct from tool output — not the Claude Code
+        // wire-format ambiguity where a tool result also arrives as a
+        // `role: "user"` record. No synthetic-input misattribution risk here.
+        isSyntheticInput: false,
+        // Neither source reports what a turn cost, so it is unknown rather than free.
+        usage: { ...EMPTY_USAGE }
+      }
+    });
+  }
+  let kept;
+  if (referencing) {
+    const keep = /* @__PURE__ */ new Set();
+    for (let i = 0; i < built.length; i++) {
+      const cur = built[i];
+      if (!cur || !cur.referencesRepo) continue;
+      keep.add(i);
+      const prev = built[i - 1];
+      if (prev && prev.role === "user") keep.add(i - 1);
+    }
+    kept = built.filter((_, i) => keep.has(i));
+  } else {
+    kept = built;
+  }
+  if (kept.length === 0) return null;
+  const sessionId = deriveCursorSessionId(composerId, repoPath);
+  const turns = kept.map((b) => ({
+    ...b.turn,
+    id: deriveCursorTurnId(b.bubbleId, repoPath),
+    sessionId
+  }));
+  const totalRedactions = kept.reduce((sum, b) => sum + b.redactionCount, 0);
+  const sortedTs = turns.map((t) => t.ts).sort();
+  if (totalRedactions > 0) {
+    console.log(`[ingest-core] redacted ${totalRedactions} potential secret(s) in cursor session ${composerId}`);
+  }
+  const rawRecords = loadRawRecords(dbPath, composerId, kept.map((b) => b.bubbleId));
+  const rawContent = JSON.stringify(
+    redactJsonValue({ format: "cursor-composer", composerId, records: rawRecords }).value
+  );
+  return {
+    id: sessionId,
+    agentKind: "cursor",
+    repoId,
+    cwd: repoPath,
+    startedAt: sortedTs[0] ?? null,
+    endedAt: sortedTs[sortedTs.length - 1] ?? null,
+    turnCount: turns.length,
+    aiTitle: composer.name && composer.name.trim() ? composer.name : null,
+    author: null,
+    // filled in by the caller — see collectRepoData
+    // Includes repoPath so a shared composer's per-repo copies have distinct,
+    // traceable source refs (the raw composerId alone is no longer unique).
+    sourceFile: `${dbPath}#${composerId}#${repoPath}`,
+    redactionCount: totalRedactions,
+    // Read back off the turns rather than the raw records: unlike Claude Code,
+    // a Cursor tool call's label keeps the command itself, so the invocation is
+    // still there to read.
+    committedSubjects: [
+      ...new Set(turns.flatMap((t) => committedSubjects(t.text)))
+    ],
+    rawContent,
+    rawFormat: "json",
+    turns
+  };
+}
+function workspaceMatchesRepo(workspacePath, repoPath) {
+  if (!workspacePath) return false;
+  return workspacePath === repoPath || workspacePath.startsWith(`${repoPath}${sep}`);
+}
+function parseAllCursorSessions(repoPath, repoId) {
+  const dbPath = cursorStateDbPath();
+  if (!existsSync2(dbPath)) return [];
+  const composers = loadComposers(dbPath);
+  if (composers.length === 0) return [];
+  const byId = /* @__PURE__ */ new Map();
+  for (const c of composers) {
+    if (c.composerId) byId.set(c.composerId, c);
+  }
+  const workspaceDedicated = /* @__PURE__ */ new Set();
+  for (const c of composers) {
+    if (c.composerId && workspaceMatchesRepo(c.workspacePath, repoPath)) {
+      workspaceDedicated.add(c.composerId);
+    }
+  }
+  const attributed = new Set(workspaceDedicated);
+  for (const id of composerIdsReferencingRepo(dbPath, repoPath)) {
+    attributed.add(id);
+  }
+  const resolvedRepoId = repoId ?? deriveRepoId(repoPath);
+  const sessions = [];
+  for (const id of attributed) {
+    const composer = byId.get(id);
+    if (!composer) continue;
+    const scoped = !workspaceDedicated.has(id);
+    const parsed = parseCursorComposer(dbPath, composer, repoPath, { scoped }, resolvedRepoId);
+    if (parsed) sessions.push(parsed);
+  }
+  return sessions;
+}
+
+// ../../packages/ingest-core/src/codex-sessions.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join3 } from "node:path";
+var CODEX_DIR = ".codex";
+function codexSessionsDir() {
+  return join3(homedir3(), CODEX_DIR, "sessions");
+}
+function deriveUuid2(name) {
+  const h = createHash2("sha1").update(name).digest("hex");
+  const variant = (parseInt(h.slice(16, 17) || "0", 16) & 3 | 8).toString(16);
+  const s = h.slice(0, 12) + "5" + h.slice(13, 16) + variant + h.slice(17, 32);
+  return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20, 32)}`;
+}
+function deriveCodexTurnId(sessionId, ordinal) {
+  return deriveUuid2(`evrex-codex-turn\0${sessionId}\0${ordinal}`);
+}
+function findCodexSessionFiles(root = codexSessionsDir()) {
+  const found = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync2(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = join3(dir, entry);
+      let isDir = false;
+      try {
+        isDir = statSync3(full).isDirectory();
+      } catch {
+        continue;
+      }
+      if (isDir) walk(full);
+      else if (entry.endsWith(".jsonl")) found.push(full);
+    }
+  };
+  if (existsSync3(root)) walk(root);
+  return found.sort();
+}
+function parseLines(raw) {
+  const out = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      out.push(JSON.parse(line));
+    } catch {
+      continue;
+    }
+  }
+  return out;
+}
+function payloadType(line) {
+  const t = line.payload?.type;
+  return typeof t === "string" ? t : void 0;
+}
+function asString(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function conversationEvents(lines) {
+  const out = [];
+  let pending = null;
+  let model = null;
+  lines.forEach((line, index) => {
+    if (line.type === "turn_context") {
+      model = asString(line.payload?.model) ?? model;
+      return;
+    }
+    if (line.type !== "event_msg") return;
+    const kind = payloadType(line);
+    if (kind === "token_count") {
+      const delta = lastUsage(line.payload);
+      if (delta) pending = addUsage(pending, delta);
+      return;
+    }
+    if (kind !== "user_message" && kind !== "agent_message") return;
+    const text = asString(line.payload?.message);
+    if (!text) return;
+    const role = kind === "user_message" ? "user" : "assistant";
+    const usage = role === "assistant" && pending ? { ...pending, model: pending.model ?? model } : { ...EMPTY_USAGE };
+    if (role === "assistant") pending = null;
+    out.push({ role, text, ts: asString(line.timestamp), ordinal: index, usage });
+  });
+  return out;
+}
+function lastUsage(payload) {
+  const info = payload?.info;
+  const last = info?.last_token_usage;
+  if (!last) return null;
+  const num = (key) => {
+    const value = last[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : 0;
+  };
+  const cached = num("cached_input_tokens");
+  return {
+    inputTokens: Math.max(0, num("input_tokens") - cached),
+    outputTokens: num("output_tokens"),
+    cacheReadTokens: cached,
+    // Codex reports no cache-write figure; unknown rather than zero.
+    cacheWriteTokens: null,
+    model: null
+  };
+}
+function addUsage(into, next) {
+  if (!into) return { ...next };
+  const sum = (a, b) => a === null && b === null ? null : (a ?? 0) + (b ?? 0);
+  return {
+    inputTokens: sum(into.inputTokens, next.inputTokens),
+    outputTokens: sum(into.outputTokens, next.outputTokens),
+    cacheReadTokens: sum(into.cacheReadTokens, next.cacheReadTokens),
+    cacheWriteTokens: sum(into.cacheWriteTokens, next.cacheWriteTokens),
+    model: into.model ?? next.model
+  };
+}
+function committedSubjectsFromToolCalls(lines) {
+  const subjects = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    if (line.type !== "response_item") continue;
+    if (payloadType(line) !== "custom_tool_call") continue;
+    const input = asString(line.payload?.input);
+    if (!input) continue;
+    for (const subject of committedSubjects(input)) subjects.add(subject);
+  }
+  return [...subjects];
+}
+function filesFromToolCalls(lines) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const line of lines) {
+    if (line.type !== "response_item") continue;
+    if (payloadType(line) !== "custom_tool_call") continue;
+    const input = asString(line.payload?.input);
+    if (!input) continue;
+    const tool = asString(line.payload?.name) ?? "exec";
+    for (const path of extractPathsFromText(input)) {
+      if (!byPath.has(path)) byPath.set(path, { path, source: "tool_bash", tool });
+    }
+  }
+  return [...byPath.values()];
+}
+function parseCodexSessionFile(filePath, repoPath, repoId) {
+  let raw;
+  try {
+    raw = readFileSync2(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+  const lines = parseLines(raw);
+  const meta = lines.find((l) => l.type === "session_meta")?.payload;
+  if (!meta) return null;
+  const cwd = asString(meta.cwd);
+  if (!cwd) return null;
+  if (cwd.replace(/\/+$/, "") !== repoPath.replace(/\/+$/, "")) return null;
+  const sessionId = asString(meta.session_id) ?? asString(meta.id);
+  if (!sessionId) return null;
+  const events = conversationEvents(lines);
+  if (events.length === 0) return null;
+  const filesTouched = filesFromToolCalls(lines);
+  let redactionCount = 0;
+  const turns = events.map((event, i) => {
+    const { text, count } = redactSecrets(event.text);
+    redactionCount += count;
+    return {
+      id: deriveCodexTurnId(sessionId, event.ordinal),
+      sessionId,
+      role: event.role,
+      ts: event.ts ?? asString(meta.timestamp) ?? (/* @__PURE__ */ new Date()).toISOString(),
+      text,
+      // Attributed to the assistant turns, which are the ones that ran the
+      // tools; a user turn touched no files.
+      filesTouched: event.role === "assistant" && i === events.length - 1 ? filesTouched : [],
+      editedLines: [],
+      parentUuid: null,
+      isSidechain: false,
+      redacted: count > 0,
+      isSyntheticInput: false,
+      usage: event.usage
+    };
+  });
+  const { content: rawContent, count: rawRedactions } = redactRollout(raw);
+  redactionCount += rawRedactions;
+  const firstUser = events.find((e) => e.role === "user");
+  return {
+    id: sessionId,
+    agentKind: "codex",
+    // Codex records the remote itself, so identity survives a moved or deleted
+    // checkout. Falls back to the caller's derivation when it is absent.
+    repoId: repoIdFromMeta(meta) ?? repoId,
+    cwd,
+    startedAt: asString(meta.timestamp) ?? events[0]?.ts ?? null,
+    endedAt: events[events.length - 1]?.ts ?? null,
+    turnCount: turns.length,
+    committedSubjects: committedSubjectsFromToolCalls(lines),
+    aiTitle: firstUser ? firstUser.text.slice(0, 120).trim() : null,
+    author: null,
+    sourceFile: filePath,
+    redactionCount,
+    turns,
+    rawContent,
+    rawFormat: "jsonl"
+  };
+}
+function repoIdFromMeta(meta) {
+  const git2 = meta.git;
+  if (typeof git2 !== "object" || git2 === null) return null;
+  const url = asString(git2.repository_url);
+  if (!url) return null;
+  const normalized = normalizeRepoRemote(url);
+  return normalized ? `remote:${normalized}` : null;
+}
+function redactRollout(raw) {
+  let count = 0;
+  const lines = raw.split("\n").map((line) => {
+    if (!line.trim()) return line;
+    const { text, count: n } = redactSecrets(line);
+    count += n;
+    return text;
+  });
+  return { content: lines.join("\n"), count };
+}
+function parseAllCodexSessions(repoPath, repoId) {
+  const sessions = [];
+  for (const file of findCodexSessionFiles()) {
+    const parsed = parseCodexSessionFile(file, repoPath, repoId);
+    if (parsed) sessions.push(parsed);
+  }
+  return sessions;
+}
+
+// ../../packages/ingest-core/src/sanitize.ts
+var NUL = String.fromCharCode(0);
+function stripNulls(value) {
+  return value.includes(NUL) ? value.split(NUL).join("") : value;
+}
+function stripNullsDeep(value) {
+  if (typeof value === "string") return stripNulls(value);
+  if (Array.isArray(value)) return value.map((v) => stripNullsDeep(v));
+  if (value && typeof value === "object") {
+    if (value instanceof Date) return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = stripNullsDeep(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+// ../../packages/ingest-core/src/index.ts
+function resolveFallbackAuthor(repoPath, commits) {
+  const configured = getGitUserName(repoPath);
+  if (configured) return configured;
+  const counts = /* @__PURE__ */ new Map();
+  for (const c of commits) {
+    if (!c.author) continue;
+    counts.set(c.author, (counts.get(c.author) ?? 0) + 1);
+  }
+  const mostFrequent = [...counts.entries()].sort((a, b) => b[1] - a[1])[0]?.[0];
+  if (mostFrequent) return mostFrequent;
+  try {
+    return userInfo().username || null;
+  } catch {
+    return null;
+  }
+}
+function collectRepoData(repoPath, options = {}) {
+  const repoId = deriveRepoId(repoPath);
+  const commits = parseGitLog(repoPath, repoId, options.knownCommits);
+  const author = resolveFallbackAuthor(repoPath, commits);
+  const claude = parseAllSessions(repoPath, repoId, options.cursors ?? {});
+  const sessions = [
+    ...claude.sessions,
+    ...parseAllCursorSessions(repoPath, repoId),
+    ...parseAllCodexSessions(repoPath, repoId)
+  ].map((s) => ({
+    ...s,
+    author: s.author ?? author
+  }));
+  const totalRedactions = sessions.reduce((sum, s) => sum + s.redactionCount, 0);
+  return {
+    sessions: stripNullsDeep(sessions),
+    commits: stripNullsDeep(commits),
+    totalRedactions,
+    cursors: claude.cursors,
+    skippedTranscripts: claude.skipped
+  };
+}
+
+// src/batch.ts
+var MAX_BATCH_BYTES = 24 * 1024 * 1024;
+function measure(items) {
+  return items.map((item) => ({
+    item,
+    bytes: Buffer.byteLength(JSON.stringify(item), "utf8")
+  }));
+}
+function batchByBytes(items, maxBytes = MAX_BATCH_BYTES) {
+  const batches = [];
+  let current = [];
+  let size = 0;
+  for (const { item, bytes } of measure(items)) {
+    if (current.length > 0 && size + bytes > maxBytes) {
+      batches.push(current);
+      current = [];
+      size = 0;
+    }
+    current.push(item);
+    size += bytes;
+  }
+  if (current.length > 0) batches.push(current);
+  return batches;
+}
+
+// src/import-state.ts
+import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync3, renameSync, writeFileSync } from "node:fs";
+import { dirname, join as join4 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+function importStatePath(home = homedir4()) {
+  return join4(home, ".evrex", "import-state.json");
+}
+function readImportState(path) {
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    if (!parsed || typeof parsed.repos !== "object") return { repos: {} };
+    return { repos: parsed.repos ?? {} };
+  } catch {
+    return { repos: {} };
+  }
+}
+function writeImportState(path, state) {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 384 });
+  renameSync(tmp, path);
+}
+function stateFor(state, repoId) {
+  return state.repos[repoId] ?? {
+    cursors: {},
+    knownCommits: [],
+    lastImportedAt: (/* @__PURE__ */ new Date(0)).toISOString()
+  };
+}
+
+// src/import.ts
+async function importRepo(repoPath, deps) {
+  const statePath = importStatePath(deps.home);
+  const state = readImportState(statePath);
+  const repoId = deps.deriveRepoId(repoPath);
+  const known = stateFor(state, repoId);
+  const data = deps.collect(repoPath, {
+    cursors: known.cursors,
+    knownCommits: new Set(known.knownCommits)
+  });
+  const result = {
+    sessions: 0,
+    commits: 0,
+    skippedTranscripts: data.skippedTranscripts,
+    redactions: data.totalRedactions,
+    batches: 0,
+    failed: false
+  };
+  const deliveredCommits = [];
+  for (const batch of batchByBytes(data.commits)) {
+    result.batches += 1;
+    if (!await deps.post("/ingest/commits", { commits: batch })) {
+      result.failed = true;
+      break;
+    }
+    deliveredCommits.push(...batch.map((c) => c.sha));
+    result.commits += batch.length;
+    deps.log(`  commits  ${result.commits}/${data.commits.length}`);
+  }
+  const deliveredCursors = {};
+  if (!result.failed) {
+    for (const batch of batchByBytes(data.sessions)) {
+      result.batches += 1;
+      if (!await deps.post("/ingest/sessions", { sessions: batch })) {
+        result.failed = true;
+        break;
+      }
+      for (const session of batch) {
+        const cursor = data.cursors[session.sourceFile];
+        if (cursor !== void 0) deliveredCursors[session.sourceFile] = cursor;
+      }
+      result.sessions += batch.length;
+      deps.log(`  sessions ${result.sessions}/${data.sessions.length}`);
+    }
+  }
+  state.repos[repoId] = {
+    cursors: { ...known.cursors, ...deliveredCursors },
+    knownCommits: [.../* @__PURE__ */ new Set([...known.knownCommits, ...deliveredCommits])],
+    lastImportedAt: deps.now().toISOString()
+  };
+  writeImportState(statePath, state);
+  return result;
+}
+async function main() {
+  const target = resolve(process.argv[3] ?? process.cwd());
+  const { evrexApi: evrexApi2 } = await Promise.resolve().then(() => (init_client(), client_exports));
+  const { CredentialStore: CredentialStore2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
+  const token = process.env.EVREX_TOKEN ?? await new CredentialStore2().retrieve().catch(() => null);
+  if (!token) {
+    console.error(
+      "evrex: this machine is not enrolled.\n  Run `npx -y evrex-mcp enrol` first, or set EVREX_TOKEN."
+    );
+    process.exit(1);
+  }
+  console.error(`Importing ${target}`);
+  const result = await importRepo(target, {
+    collect: collectRepoData,
+    deriveRepoId,
+    home: homedir5(),
+    now: () => /* @__PURE__ */ new Date(),
+    log: (line) => console.error(line),
+    post: async (path, body) => {
+      try {
+        const res = await fetch(`${evrexApi2.baseUrl}${path}`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${token}`
+          },
+          body: JSON.stringify(body)
+        });
+        if (!res.ok) console.error(`  ${path} -> ${res.status}`);
+        return res.ok;
+      } catch (error) {
+        console.error(`  ${path} -> ${error.message}`);
+        return false;
+      }
+    }
+  });
+  console.error(
+    `
+  ${result.commits} commits, ${result.sessions} sessions` + (result.skippedTranscripts ? `, ${result.skippedTranscripts} transcripts unchanged` : "") + (result.redactions ? `, ${result.redactions} secrets redacted` : "")
+  );
+  if (result.failed) {
+    console.error("  Import stopped early. Run it again to resume.");
+  }
+  process.exit(result.failed ? 1 : 0);
+}
+function isMain() {
+  const invoked = process.argv[1];
+  if (!invoked) return false;
+  try {
+    return realpathSync(invoked) === fileURLToPath(import.meta.url);
+  } catch {
+    return false;
+  }
+}
+if (isMain()) {
+  main().catch((error) => {
+    console.error("evrex import failed:", error);
+    process.exit(1);
+  });
+}
+export {
+  importRepo
+};