failproofai 1.0.3 → 1.0.4-beta.1

package/lib/ori-sessions.ts

@@ -0,0 +1,221 @@
+/**
+ * Ori (OpenRouter's ori) session transcript loader + parser.
+ *
+ * AUDIT-ONLY (Pillar 2). Where ori keeps a transcript is not obvious, and three
+ * plausible places are dead ends worth naming so nobody re-derives them:
+ *
+ *   • `<cwd>/.ori/logs/sessions/<uuid>/metadata.json` holds ONLY a summary —
+ *     harness, `runIds[{cwd, model, prompt, runId}]`, token `usage`, turn
+ *     counts, timestamps. Verified on a successful tool-using session: no
+ *     messages, no tool calls.
+ *   • `<cwd>/.ori/logs/code-<ISO>.jsonl` is runtime LIFECYCLE logging —
+ *     formatted log lines, zero tool records (grepped a full session: 0 hits).
+ *   • The rich `AgentRuntimeEvent` stream exists only transiently on
+ *     `ori code --output jsonl` stdout; nothing persists it.
+ *
+ * The real transcript is SQLite, in ori's GLOBAL workspace at
+ * `~/.ori/global/.ori/state.sqlite` (bare `ori` boots the global workspace, not
+ * the project's, so one DB holds every project's sessions):
+ *
+ *   ori_agent_loop_sessions(session_id TEXT PK, title, cwd, model, turns,
+ *                           cost_usd REAL, cost_known INT, archived INT,
+ *                           first_prompt, parent_session_id, updated_at TEXT ISO)
+ *   ori_agent_loop_history(session_id TEXT PK, prompt TEXT = the whole
+ *                          serialized conversation as JSON, revision, updated_at)
+ *
+ * `ori_agent_loop_history.prompt` is misnamed — it is not the prompt, it is the
+ * full conversation: `{"content":[{role, content}, …]}` with Claude-style typed
+ * blocks on the assistant side (`{type:"reasoning"|"text"}`,
+ * `{type:"tool-call", id, name, params}`) and results in `role:"tool"` messages
+ * (`{type:"tool-result", id, name, isFailure, result:[{type:"input_text",text}]}`).
+ * `oriMessagesToLogEntries` pairs each tool-call with its tool-result by id and
+ * is a PURE function of the parsed JSON, so it is unit-testable without a DB.
+ *
+ * LIMITATION, and it is inherent rather than a shortcut: ori stores NO
+ * per-message timestamp. Every entry in a session therefore carries the
+ * session's own `updated_at`, so relative ordering within a session is the
+ * array order and per-message timing is not recoverable.
+ *
+ * Home override: `ORI_HOME` (the dir containing `global/`), or `ORI_DB_PATH` to
+ * point straight at a state.sqlite.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { openSqliteReadonly } from "./sqlite-reader";
+import { runtimeCache } from "./runtime-cache";
+import {
+  baseEntry,
+  formatTimestamp,
+  type LogEntry,
+  type UserEntry,
+  type AssistantEntry,
+  type ContentBlock,
+  type ToolUseBlock,
+  type LogSource,
+} from "./log-entries";
+import { formatDuration } from "./format-duration";
+
+/** Absolute path to ori's home (override with ORI_HOME). */
+export function oriHome(): string {
+  return process.env.ORI_HOME || join(homedir(), ".ori");
+}
+
+/** Absolute path to ori's state DB (override with ORI_DB_PATH). */
+export function oriDbPath(): string {
+  return process.env.ORI_DB_PATH || join(oriHome(), "global", ".ori", "state.sqlite");
+}
+
+/** ori writes ISO-8601 strings; return epoch ms, 0 when absent or unparseable. */
+export function oriTimestampToMs(value: string | null | undefined): number {
+  if (!value) return 0;
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? 0 : ms;
+}
+
+interface OriBlock {
+  type?: string;
+  text?: string;
+  id?: string;
+  name?: string;
+  params?: Record<string, unknown>;
+  isFailure?: boolean;
+  result?: Array<{ type?: string; text?: string }>;
+}
+
+interface OriMessage {
+  role?: string;
+  content?: string | OriBlock[];
+}
+
+/** Flatten a tool-result's `result` array into display text. */
+function toolResultText(block: OriBlock): string {
+  if (!Array.isArray(block.result)) return "";
+  return block.result
+    .map((r) => (typeof r.text === "string" ? r.text : ""))
+    .filter((t) => t.length > 0)
+    .join("\n");
+}
+
+/**
+ * Parse ori's serialized conversation into the shared LogEntry[] shape.
+ *
+ * PURE — takes already-parsed JSON so tests need no SQLite. `system` messages
+ * are dropped: ori's is a static multi-kilobyte agent prompt, identical in
+ * every session, and carrying it would swamp the audit with boilerplate.
+ */
+export function oriMessagesToLogEntries(
+  messages: OriMessage[],
+  sessionId: string,
+  timestampMs: number,
+  source: LogSource = "session",
+): LogEntry[] {
+  const date = new Date(timestampMs);
+  const timestamp = date.toISOString();
+  const entries: LogEntry[] = [];
+  // tool-call id → the block awaiting its result, so a later `role:"tool"`
+  // message can attach onto the assistant turn that made the call.
+  const pending = new Map<string, ToolUseBlock>();
+
+  messages.forEach((msg, i) => {
+    const role = msg.role;
+    if (role === "system") return;
+
+    const raw = { uuid: `${sessionId}:${i}`, parentUuid: null } as Record<string, unknown>;
+    const base = baseEntry(raw, timestamp, date, source);
+
+    if (role === "user") {
+      const text = typeof msg.content === "string"
+        ? msg.content
+        : (msg.content ?? []).map((b) => b.text ?? "").join("");
+      entries.push({ ...base, type: "user", message: { role: "user", content: text } } as UserEntry);
+      return;
+    }
+
+    if (role === "assistant") {
+      const blocks: ContentBlock[] = [];
+      for (const b of Array.isArray(msg.content) ? msg.content : []) {
+        if (b.type === "reasoning" && typeof b.text === "string") {
+          blocks.push({ type: "thinking", thinking: b.text });
+        } else if (b.type === "text" && typeof b.text === "string") {
+          blocks.push({ type: "text", text: b.text });
+        } else if (b.type === "tool-call" && typeof b.id === "string") {
+          const block: ToolUseBlock = {
+            type: "tool_use",
+            id: b.id,
+            name: b.name ?? "",
+            input: b.params ?? {},
+          };
+          pending.set(b.id, block);
+          blocks.push(block);
+        }
+      }
+      if (blocks.length > 0) {
+        entries.push({ ...base, type: "assistant", message: { role: "assistant", content: blocks } } as AssistantEntry);
+      }
+      return;
+    }
+
+    if (role === "tool") {
+      for (const b of Array.isArray(msg.content) ? msg.content : []) {
+        if (b.type !== "tool-result" || typeof b.id !== "string") continue;
+        const target = pending.get(b.id);
+        if (!target) continue;
+        // No per-message timestamp exists, so duration is unknowable — 0 rather
+        // than a fabricated span.
+        target.result = {
+          timestamp,
+          timestampFormatted: formatTimestamp(date),
+          content: toolResultText(b),
+          durationMs: 0,
+          durationFormatted: formatDuration(0),
+        };
+        pending.delete(b.id);
+      }
+      return;
+    }
+  });
+
+  return entries;
+}
+
+export interface OriSessionLog {
+  entries: LogEntry[];
+  cwd?: string;
+}
+
+/** Load and parse one ori session. Returns null when absent or unreadable. */
+export async function getOriSessionLog(sessionId: string): Promise<OriSessionLog | null> {
+  const db = await openSqliteReadonly(oriDbPath());
+  if (!db) return null;
+  try {
+    const rows = db.query<{ prompt: string | null; updated_at: string | null; cwd: string | null }>(
+      "SELECT h.prompt AS prompt, h.updated_at AS updated_at, s.cwd AS cwd " +
+        "FROM ori_agent_loop_history h " +
+        "LEFT JOIN ori_agent_loop_sessions s ON s.session_id = h.session_id " +
+        "WHERE h.session_id = ?",
+      [sessionId],
+    );
+    const row = rows[0];
+    if (!row || !row.prompt) return null;
+    let parsed: { content?: OriMessage[] };
+    try {
+      parsed = JSON.parse(row.prompt) as { content?: OriMessage[] };
+    } catch {
+      return null;
+    }
+    return {
+      entries: oriMessagesToLogEntries(
+        parsed.content ?? [],
+        sessionId,
+        oriTimestampToMs(row.updated_at),
+      ),
+      cwd: row.cwd ?? undefined,
+    };
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+
+export const getCachedOriSessionLog = runtimeCache(getOriSessionLog, 2);

package/lib/projects.ts

@@ -16,7 +16,7 @@ import { formatDate } from "./format-date";
 export const UUID_RE = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 export const PATH_TRAVERSAL_RE = /(^|[\\/])\.\.($|[\\/])/;
 
-export type ProjectCli = "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose";
+export type ProjectCli = "claude" | "codex" | "copilot" | "cursor" | "opencode" | "pi" | "hermes" | "openclaw" | "factory" | "devin" | "antigravity" | "goose" | "grok" | "qwen" | "ori" | "cline";
 
 export interface ProjectFolder {
   name: string;
@@ -171,6 +171,10 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
     { getDevinProjects },
     { getAntigravityProjects },
     { getGooseProjects },
+    { getGrokProjects },
+    { getQwenProjects },
+    { getOriProjects },
+    { getClineProjects },
   ] = await Promise.all([
     import("./codex-projects"),
     import("./copilot-projects"),
@@ -183,8 +187,12 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
     import("./devin-projects"),
     import("./antigravity-projects"),
     import("./goose-projects"),
+    import("./grok-projects"),
+    import("./qwen-projects"),
+    import("./ori-projects"),
+    import("./cline-projects"),
   ]);
-  const [claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose] = await Promise.all([
+  const [claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose, grok, qwen, ori, cline] = await Promise.all([
     getClaudeProjectFolders(),
     getCodexProjects().catch((error) => {
       logError("Error reading Codex projects:", error);
@@ -230,8 +238,24 @@ export async function getProjectFolders(): Promise<ProjectFolder[]> {
       logError("Error reading Goose projects:", error);
       return [] as ProjectFolder[];
     }),
+    getGrokProjects().catch((error) => {
+      logError("Error reading grok projects:", error);
+      return [] as ProjectFolder[];
+    }),
+    getQwenProjects().catch((error) => {
+      logError("Error reading Qwen projects:", error);
+      return [] as ProjectFolder[];
+    }),
+    getOriProjects().catch((error) => {
+      logError("Error reading Ori projects:", error);
+      return [] as ProjectFolder[];
+    }),
+    getClineProjects().catch((error) => {
+      logError("Error reading Cline projects:", error);
+      return [] as ProjectFolder[];
+    }),
   ]);
-  return mergeProjectFolders(claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose);
+  return mergeProjectFolders(claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose, grok, qwen, ori, cline);
 }
 
 /**

package/lib/qwen-projects.ts

@@ -0,0 +1,106 @@
+/**
+ * Qwen Code project discovery.
+ *
+ * qwen stores transcripts at
+ * `~/.qwen/projects/<encoded-cwd>/chats/<uuid>.jsonl`, using the same
+ * Claude-style encoded-cwd folder names (`-home-user-project`) as Claude Code.
+ * The encoded folder doubles as the URL slug for `/project/[name]`, so a cwd
+ * present in both stores naturally produces the same `name` and merges on the
+ * Claude side (see `mergeProjectFolders` in lib/projects.ts).
+ */
+import { decodeFolderName } from "./paths";
+import { listQwenTranscripts, getQwenSessionLog } from "./qwen-sessions";
+import type { ProjectFolder, SessionFile } from "./projects";
+import { runtimeCache } from "./runtime-cache";
+import { formatDate } from "./format-date";
+import { logWarn } from "./logger";
+
+/** Returns one ProjectFolder per encoded-cwd folder discovered under
+ *  ~/.qwen/projects/. */
+export async function getQwenProjects(): Promise<ProjectFolder[]> {
+  let transcripts;
+  try {
+    transcripts = listQwenTranscripts();
+  } catch (error) {
+    logWarn("Failed to scan Qwen sessions:", error);
+    return [];
+  }
+
+  const byName = new Map<string, { latest: number; cwd: string; name: string }>();
+  for (const t of transcripts) {
+    const existing = byName.get(t.projectName);
+    if (!existing || t.mtimeMs > existing.latest) {
+      byName.set(t.projectName, { latest: t.mtimeMs, cwd: t.cwd, name: t.projectName });
+    }
+  }
+
+  const folders: ProjectFolder[] = [];
+  for (const { name, cwd, latest } of byName.values()) {
+    const lastModified = new Date(latest);
+    folders.push({
+      name,
+      path: cwd,
+      isDirectory: true,
+      lastModified,
+      lastModifiedFormatted: formatDate(lastModified),
+      cli: ["qwen"],
+    });
+  }
+  folders.sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());
+  return folders;
+}
+
+export interface QwenProjectByName {
+  /** Canonical cwd recovered from a session line (the folder decode is lossy).
+   *  Null when no session could be read. */
+  cwd: string | null;
+  sessions: SessionFile[];
+}
+
+/**
+ * Look up Qwen sessions for a project URL slug (the encoded-cwd folder name).
+ * qwen names its folders with the same encoding Claude uses, so the slug
+ * matches the folder directly. The canonical cwd is recovered from the newest
+ * session's own `cwd` field (folder decode is lossy for cwds containing `-`).
+ */
+export async function getQwenSessionsByEncodedName(name: string): Promise<QwenProjectByName> {
+  let transcripts;
+  try {
+    transcripts = listQwenTranscripts().filter((t) => t.projectName === name);
+  } catch (error) {
+    logWarn("Failed to scan Qwen sessions:", error);
+    return { cwd: null, sessions: [] };
+  }
+  if (transcripts.length === 0) return { cwd: null, sessions: [] };
+
+  const sorted = [...transcripts].sort((a, b) => b.mtimeMs - a.mtimeMs);
+
+  let cwd: string | null = null;
+  try {
+    const log = await getQwenSessionLog(sorted[0].sessionId);
+    cwd = log?.cwd ?? null;
+  } catch {
+    // best-effort — fall back to the lossy decode below
+  }
+  if (!cwd) cwd = decodeFolderName(name);
+
+  const sessions: SessionFile[] = sorted.map((t) => {
+    const lastModified = new Date(t.mtimeMs);
+    return {
+      name: t.sessionId,
+      path: t.transcriptPath,
+      lastModified,
+      lastModifiedFormatted: formatDate(lastModified),
+      sessionId: t.sessionId,
+      cli: "qwen" as const,
+    };
+  });
+  return { cwd, sessions };
+}
+
+export const getCachedQwenProjects = runtimeCache(getQwenProjects, 30);
+export const getCachedQwenSessionsByEncodedName = runtimeCache(
+  (name: string) => getQwenSessionsByEncodedName(name),
+  30,
+  { maxSize: 50 },
+);

package/lib/qwen-sessions.ts

@@ -0,0 +1,313 @@
+/**
+ * Qwen Code session transcript loader + parser.
+ *
+ * AUDIT-ONLY (Pillar 2). qwen writes one JSONL transcript per session at
+ * `~/.qwen/projects/<encoded-cwd>/chats/<sessionId>.jsonl` — Claude-style
+ * encoded-cwd folders (e.g. `-home-chetan-project`), but note the extra
+ * `chats/` level, which Claude/Factory do not have. Verified live against
+ * @qwen-code/qwen-code 0.21.12.
+ *
+ * Every line carries `{uuid, parentUuid, sessionId, cwd, timestamp, version,
+ * type}`. `type` is one of:
+ *   "user"        — message.parts, role "user"
+ *   "assistant"   — message.parts, role "model"  (Gemini's name for assistant)
+ *   "tool_result" — message.parts + a `toolCallResult` sidecar
+ *   "system"      — bookkeeping (subtype/systemPayload); skipped
+ *
+ * The message body is **Gemini-shaped, not Claude-shaped**: `message.parts[]`
+ * holds `{text}`, `{functionCall:{id,name,args}}`, and
+ * `{functionResponse:{id,name,response}}` — so this is NOT a clone of
+ * lib/factory-sessions.ts despite the similar on-disk layout. `functionCall` is
+ * paired with its later `functionResponse` by id (mirroring the tool_use /
+ * tool_result pairing elsewhere). `qwenLinesToLogEntries` is PURE, so it is
+ * unit-testable with plain line objects.
+ *
+ * Home override: set `QWEN_HOME` (used by tests / to point at a copied
+ * projects dir).
+ */
+import { readFile } from "node:fs/promises";
+import { readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { decodeFolderName } from "./paths";
+import { runtimeCache } from "./runtime-cache";
+import {
+  baseEntry,
+  formatTimestamp,
+  parseRawLines,
+  type LogEntry,
+  type UserEntry,
+  type AssistantEntry,
+  type GenericEntry,
+  type ContentBlock,
+  type ToolUseBlock,
+  type LogSource,
+} from "./log-entries";
+import { formatDuration } from "./format-duration";
+
+/** Qwen sessions are stored under UUID filenames. */
+export const QWEN_SESSION_ID_RE =
+  /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+/** Absolute path to Qwen's config home (override with QWEN_HOME). */
+export function qwenHome(): string {
+  return process.env.QWEN_HOME || join(homedir(), ".qwen");
+}
+
+/** Absolute path to the Qwen projects root. */
+export function qwenProjectsRoot(): string {
+  return join(qwenHome(), "projects");
+}
+
+// ── Parsing helpers ──
+
+function isPlainObject(v: unknown): v is Record<string, unknown> {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+
+/** Flatten a Gemini `response` payload (or any tool output) to display text. */
+function extractResponseText(response: unknown): string {
+  if (typeof response === "string") return response;
+  if (!isPlainObject(response)) return "";
+  for (const key of ["output", "result", "content", "error"]) {
+    const v = response[key];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return JSON.stringify(response);
+}
+
+function toDate(value: unknown, fallbackMs: number): Date {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    if (value > 1e12) return new Date(value);
+    if (value > 1e9) return new Date(value * 1000);
+  }
+  if (typeof value === "string") {
+    const ms = Date.parse(value);
+    if (!Number.isNaN(ms)) return new Date(ms);
+  }
+  return new Date(fallbackMs);
+}
+
+// ── Pure parser: transcript lines → LogEntry[] ──
+
+/**
+ * Convert Qwen transcript JSONL lines (parsed objects, in file order) into
+ * `LogEntry[]`. `system` lines are skipped. Assistant `functionCall` parts are
+ * paired with their later `functionResponse` by call id. Pure — unit-testable
+ * with plain line objects.
+ */
+export function qwenLinesToLogEntries(
+  lines: Record<string, unknown>[],
+  source: LogSource = "session",
+): LogEntry[] {
+  const entries: LogEntry[] = [];
+  const toolUseById = new Map<string, ToolUseBlock>();
+  const toolUseStartMs = new Map<string, number>();
+  const baseMs = Date.now();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!isPlainObject(line)) continue;
+    const type = typeof line.type === "string" ? line.type : "";
+    if (type === "system") continue; // subtype/systemPayload bookkeeping
+
+    const m = isPlainObject(line.message) ? line.message : undefined;
+    if (!m) continue;
+    const parts = Array.isArray(m.parts) ? m.parts : [];
+
+    const date = toDate(line.timestamp, baseMs + i);
+    const timestamp = date.toISOString();
+    const raw: Record<string, unknown> = {
+      uuid: line.uuid != null ? String(line.uuid) : `qwen-${i}`,
+      parentUuid: line.parentUuid != null ? String(line.parentUuid) : null,
+    };
+    const base = baseEntry(raw, timestamp, date, source);
+
+    // Assistant turn: text parts and/or functionCall parts. Qwen names the
+    // assistant role "model" (Gemini lineage); accept both spellings.
+    if (type === "assistant" || m.role === "model" || m.role === "assistant") {
+      const blocks: ContentBlock[] = [];
+      for (const p of parts) {
+        if (!isPlainObject(p)) continue;
+        if (typeof p.text === "string" && p.text.length > 0) {
+          blocks.push({ type: "text", text: p.text });
+          continue;
+        }
+        const fc = isPlainObject(p.functionCall) ? p.functionCall : undefined;
+        if (fc) {
+          const id = typeof fc.id === "string" ? fc.id : `${String(fc.name ?? "tool")}-${blocks.length}`;
+          const name = typeof fc.name === "string" ? fc.name : "tool";
+          const input = isPlainObject(fc.args) ? fc.args : {};
+          const block: ToolUseBlock = { type: "tool_use", id, name, input };
+          blocks.push(block);
+          toolUseById.set(id, block);
+          toolUseStartMs.set(id, date.getTime());
+        }
+      }
+      if (blocks.length === 0) continue; // empty / failed assistant turn
+      entries.push({
+        type: "assistant",
+        ...base,
+        message: {
+          role: "assistant",
+          content: blocks,
+          model: typeof line.model === "string" ? line.model : undefined,
+        },
+      } satisfies AssistantEntry);
+      continue;
+    }
+
+    // tool_result / user: functionResponse parts attach to their call; plain
+    // text parts become a user turn.
+    let attachedAny = false;
+    const textParts: string[] = [];
+    for (const p of parts) {
+      if (!isPlainObject(p)) continue;
+      const fr = isPlainObject(p.functionResponse) ? p.functionResponse : undefined;
+      if (fr) {
+        const callId = typeof fr.id === "string" ? fr.id : undefined;
+        const block = callId ? toolUseById.get(callId) : undefined;
+        if (block) {
+          const startMs = (callId && toolUseStartMs.get(callId)) || date.getTime();
+          const durationMs = Math.max(0, date.getTime() - startMs);
+          // Prefer the sidecar's rendered text — it is what the TUI showed —
+          // and fall back to flattening the raw functionResponse payload.
+          const sidecar = isPlainObject(line.toolCallResult) ? line.toolCallResult : undefined;
+          const display =
+            sidecar && typeof sidecar.resultDisplay === "string" && sidecar.resultDisplay.length > 0
+              ? sidecar.resultDisplay
+              : extractResponseText(fr.response);
+          block.result = {
+            timestamp,
+            timestampFormatted: formatTimestamp(date),
+            content: display,
+            durationMs,
+            durationFormatted: formatDuration(durationMs),
+          };
+          attachedAny = true;
+          continue;
+        }
+      }
+      if (typeof p.text === "string" && p.text.length > 0) textParts.push(p.text);
+    }
+    if (textParts.length > 0) {
+      entries.push({
+        type: "user",
+        ...base,
+        message: { role: "user", content: textParts.join("\n") },
+      } satisfies UserEntry);
+    } else if (!attachedAny) {
+      entries.push({ type: "system", ...base, raw } satisfies GenericEntry);
+    }
+  }
+
+  entries.sort((a, b) => a.timestampMs - b.timestampMs);
+  return entries;
+}
+
+// ── Discovery + file loader ──
+
+export interface QwenTranscriptFile {
+  /** Encoded folder name on disk (e.g. "-home-user-project"). */
+  projectName: string;
+  /** Decoded cwd of the project (lossy; canonical cwd lives on every line). */
+  cwd: string;
+  sessionId: string;
+  transcriptPath: string;
+  mtimeMs: number;
+  sizeBytes: number;
+}
+
+/** Enumerate `projects/<encoded-cwd>/chats/<uuid>.jsonl` transcripts. */
+export function listQwenTranscripts(): QwenTranscriptFile[] {
+  const root = qwenProjectsRoot();
+  const out: QwenTranscriptFile[] = [];
+  let projectDirs: import("node:fs").Dirent[];
+  try {
+    projectDirs = readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory());
+  } catch {
+    return out;
+  }
+  for (const dir of projectDirs) {
+    const projectName = dir.name;
+    const cwd = decodeFolderName(projectName);
+    // Transcripts live one level deeper than Claude/Factory, under `chats/`.
+    const chatsPath = join(root, projectName, "chats");
+    let files: string[];
+    try {
+      files = readdirSync(chatsPath);
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      if (!file.endsWith(".jsonl")) continue;
+      const sessionId = file.slice(0, -".jsonl".length);
+      if (!QWEN_SESSION_ID_RE.test(sessionId)) continue;
+      const transcriptPath = join(chatsPath, file);
+      try {
+        const st = statSync(transcriptPath);
+        out.push({
+          projectName,
+          cwd,
+          sessionId,
+          transcriptPath,
+          mtimeMs: st.mtimeMs,
+          sizeBytes: st.size,
+        });
+      } catch {
+        // skip unreadable
+      }
+    }
+  }
+  return out;
+}
+
+/** Resolve a session UUID to its on-disk transcript path (host-side). Guards
+ *  against traversal by requiring a UUID filename. Shared by the audit adapter,
+ *  the hook transcript resolver, and download-session. Synchronous so the hook
+ *  hot path can call it without awaits. */
+export function findQwenTranscript(sessionId: string): string | null {
+  if (!QWEN_SESSION_ID_RE.test(sessionId)) return null;
+  for (const t of listQwenTranscripts()) {
+    if (t.sessionId === sessionId) return t.transcriptPath;
+  }
+  return null;
+}
+
+export interface QwenSessionLogData {
+  entries: LogEntry[];
+  rawLines: Record<string, unknown>[];
+  cwd?: string;
+  filePath: string;
+}
+
+/** Load and parse one session transcript by UUID. Returns `null` when the file
+ *  is missing/unreadable or the id fails validation. */
+export async function getQwenSessionLog(sessionId: string): Promise<QwenSessionLogData | null> {
+  const filePath = findQwenTranscript(sessionId);
+  if (!filePath) return null;
+  let content: string;
+  try {
+    content = await readFile(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+  const rawLines = parseRawLines(content, "session");
+  const entries = qwenLinesToLogEntries(rawLines, "session");
+  // Every line carries the real cwd; take the first one rather than trusting
+  // the lossy decoded folder name.
+  let cwd: string | undefined;
+  for (const line of rawLines) {
+    if (isPlainObject(line) && typeof line.cwd === "string" && line.cwd.length > 0) {
+      cwd = line.cwd;
+      break;
+    }
+  }
+  return { entries, rawLines, cwd, filePath };
+}
+
+export const getCachedQwenSessionLog = runtimeCache(
+  (sessionId: string) => getQwenSessionLog(sessionId),
+  60,
+  { maxSize: 50 },
+);