harborloop 0.3.0 → 0.4.1

package/hooks/_shared.mjs

@@ -1,1610 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import { createHash, randomUUID } from 'node:crypto';
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync, } from 'node:fs';
-import { homedir } from 'node:os';
-import { basename, dirname, join, resolve, sep } from 'node:path';
-import { StringDecoder } from 'node:string_decoder';
-export const HOME = homedir();
-const HARBOR_HOME_ENV = process.env.HARBOR_HOME && process.env.HARBOR_HOME.trim() !== ''
-    ? process.env.HARBOR_HOME
-    : process.env.ALEF0_HOME && process.env.ALEF0_HOME.trim() !== ''
-        ? process.env.ALEF0_HOME
-        : '';
-export const HARBOR_DIR = HARBOR_HOME_ENV !== '' ? HARBOR_HOME_ENV : join(HOME, '.harbor');
-export const LEGACY_DIRS = [join(HOME, '.alef0'), join(HOME, '.milestone')];
-export const CLI_SESSIONS_DIR = join(HARBOR_DIR, 'cli-sessions');
-export const LEGACY_CLI_SESSIONS_DIRS = LEGACY_DIRS.map((d) => join(d, 'cli-sessions'));
-export const CAPTURE_DIR = join(HARBOR_DIR, 'capture');
-export const SYNCED_ORIGINS_PATH = join(HARBOR_DIR, 'synced-origins.json');
-export const LEGACY_SYNCED_ORIGINS_PATHS = LEGACY_DIRS.map((d) => join(d, 'synced-origins.json'));
-export const ORIGINS_REFRESH_STAMP_PATH = join(HARBOR_DIR, 'origins-refreshed-at');
-export const CLAUDE_SETTINGS_PATH = join(HOME, '.claude', 'settings.json');
-export const CLAUDE_MCP_CONFIG_PATH = join(HOME, '.claude.json');
-export const CODEX_CONFIG_PATH = join(process.env.CODEX_HOME && process.env.CODEX_HOME.trim() !== ''
-    ? process.env.CODEX_HOME
-    : join(HOME, '.codex'), 'config.toml');
-export const CURSOR_MCP_PATH = join(HOME, '.cursor', 'mcp.json');
-const HARBOR_MCP_KEY = 'harbor';
-function isOurCodexHeadersTable(trimmed) {
-    return (trimmed === `[mcp_servers.${HARBOR_MCP_KEY}.http_headers]` ||
-        trimmed === `[mcp_servers."${HARBOR_MCP_KEY}".http_headers]`);
-}
-export const REQUEST_TIMEOUT_MS = 4000;
-export const ORIGINS_REFRESH_INTERVAL_MS = 10 * 60 * 1000;
-export const MAX_DRAIN = 20;
-export const MARKER_TTL_MS = 3 * 24 * 60 * 60 * 1000;
-export const DRAIN_IDLE_MS = 30 * 60 * 1000;
-export const MAX_SCRAPE_PER_DRAIN = 5;
-const LINE_READ_CHUNK_BYTES = 1024 * 1024;
-function forEachLineSync(path, onLine) {
-    let fd;
-    try {
-        fd = openSync(path, 'r');
-    }
-    catch {
-        return false;
-    }
-    try {
-        const decoder = new StringDecoder('utf8');
-        const buf = Buffer.allocUnsafe(LINE_READ_CHUNK_BYTES);
-        let carry = '';
-        for (;;) {
-            const read = readSync(fd, buf, 0, LINE_READ_CHUNK_BYTES, null);
-            if (read <= 0)
-                break;
-            carry += decoder.write(buf.subarray(0, read));
-            let start = 0;
-            let nl = carry.indexOf('\n', start);
-            while (nl !== -1) {
-                onLine(carry.slice(start, nl));
-                start = nl + 1;
-                nl = carry.indexOf('\n', start);
-            }
-            if (start > 0)
-                carry = carry.slice(start);
-        }
-        carry += decoder.end();
-        if (carry !== '')
-            onLine(carry);
-        return true;
-    }
-    catch {
-        return false;
-    }
-    finally {
-        try {
-            closeSync(fd);
-        }
-        catch {
-        }
-    }
-}
-export async function readStdin() {
-    if (process.stdin.isTTY)
-        return '';
-    const chunks = [];
-    try {
-        for await (const chunk of process.stdin)
-            chunks.push(chunk);
-    }
-    catch {
-        return '';
-    }
-    return Buffer.concat(chunks).toString('utf8');
-}
-export function readJsonFile(path) {
-    try {
-        if (!existsSync(path))
-            return null;
-        return JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-let agentHint = null;
-export function hookAgent() {
-    return agentHint;
-}
-export function adoptHookInput(input) {
-    agentHint =
-        typeof input?.cursor_version === 'string' && input.cursor_version !== ''
-            ? 'cursor'
-            : null;
-    return {
-        agent: agentHint,
-        sessionId: typeof input?.session_id === 'string' ? input.session_id : '',
-        cwd: hookCwd(input),
-        event: canonicalEvent(input?.hook_event_name),
-        toolName: canonicalTool(input?.tool_name),
-        transcriptPath: typeof input?.transcript_path === 'string' ? input.transcript_path : '',
-    };
-}
-function hookCwd(input) {
-    if (typeof input?.cwd === 'string' && input.cwd.trim() !== '')
-        return fromUriPath(input.cwd);
-    const roots = input?.workspace_roots;
-    if (Array.isArray(roots) && typeof roots[0] === 'string' && roots[0].trim() !== '') {
-        return fromUriPath(roots[0]);
-    }
-    return '';
-}
-function fromUriPath(path) {
-    if (!/^\/[A-Za-z]:\//.test(path))
-        return path;
-    return path.slice(1).replace(/\//g, '\\');
-}
-const EVENT_ALIASES = {
-    sessionStart: 'SessionStart',
-    sessionEnd: 'SessionEnd',
-    stop: 'Stop',
-    beforeSubmitPrompt: 'UserPromptSubmit',
-    preToolUse: 'PreToolUse',
-    postToolUse: 'PostToolUse',
-};
-export function canonicalEvent(raw) {
-    if (typeof raw !== 'string' || raw === '')
-        return '';
-    return EVENT_ALIASES[raw] ?? raw;
-}
-const TOOL_ALIASES = { Shell: 'Bash' };
-export function canonicalTool(raw) {
-    if (typeof raw !== 'string' || raw === '')
-        return '';
-    return TOOL_ALIASES[raw] ?? raw;
-}
-export function readAuthHeader() {
-    return readActiveCredential().header;
-}
-function readActiveCredential() {
-    if (agentHint === 'cursor') {
-        const hinted = asBearer(readCursorAuthHeader());
-        if (hinted !== null)
-            return { agent: 'cursor', header: hinted };
-    }
-    const claude = asBearer(readClaudeAuthHeader());
-    if (claude !== null)
-        return { agent: 'claude', header: claude };
-    const codex = asBearer(readCodexAuthHeader());
-    if (codex !== null)
-        return { agent: 'codex', header: codex };
-    const cursor = asBearer(readCursorAuthHeader());
-    if (cursor !== null)
-        return { agent: 'cursor', header: cursor };
-    return { agent: null, header: null };
-}
-function readUsableAuth() {
-    const auth = readJsonFile(join(HARBOR_DIR, 'auth.json'));
-    if (!auth ||
-        typeof auth.runnerToken !== 'string' ||
-        typeof auth.workspaceId !== 'string' ||
-        auth.workspaceId === '' ||
-        typeof auth.apiUrl !== 'string') {
-        return null;
-    }
-    return auth;
-}
-function asBearer(raw) {
-    if (typeof raw !== 'string' || raw.trim() === '')
-        return null;
-    return raw.startsWith('Bearer ') ? raw : `Bearer ${raw}`;
-}
-function readClaudeAuthHeader() {
-    for (const path of [CLAUDE_MCP_CONFIG_PATH, CLAUDE_SETTINGS_PATH]) {
-        const root = readJsonFile(path);
-        const header = root?.mcpServers?.[HARBOR_MCP_KEY]?.headers?.Authorization;
-        if (typeof header === 'string' && header.trim() !== '')
-            return header;
-    }
-    return null;
-}
-function readCursorAuthHeader() {
-    let raw;
-    try {
-        if (!existsSync(CURSOR_MCP_PATH))
-            return null;
-        raw = readFileSync(CURSOR_MCP_PATH, 'utf8');
-    }
-    catch {
-        return null;
-    }
-    let root;
-    try {
-        root = JSON.parse(stripJsonComments(raw));
-    }
-    catch {
-        return null;
-    }
-    const header = root?.mcpServers?.[HARBOR_MCP_KEY]?.headers?.Authorization;
-    return typeof header === 'string' && header.trim() !== '' ? header : null;
-}
-export function stripJsonComments(raw) {
-    let out = '';
-    let i = 0;
-    while (i < raw.length) {
-        const ch = raw[i];
-        if (ch === '"') {
-            out += ch;
-            i += 1;
-            while (i < raw.length) {
-                const c = raw[i];
-                out += c;
-                i += 1;
-                if (c === '\\') {
-                    if (i < raw.length) {
-                        out += raw[i];
-                        i += 1;
-                    }
-                    continue;
-                }
-                if (c === '"')
-                    break;
-            }
-            continue;
-        }
-        if (ch === '/' && raw[i + 1] === '/') {
-            while (i < raw.length && raw[i] !== '\n')
-                i += 1;
-            continue;
-        }
-        if (ch === '/' && raw[i + 1] === '*') {
-            i += 2;
-            while (i < raw.length && !(raw[i] === '*' && raw[i + 1] === '/'))
-                i += 1;
-            i += 2;
-            continue;
-        }
-        out += ch;
-        i += 1;
-    }
-    return out;
-}
-function scanTomlMultilineState(line, state) {
-    const BASIC = '"""';
-    const LITERAL = "'''";
-    let open = state;
-    let i = 0;
-    while (i < line.length) {
-        if (open !== null) {
-            if (line.startsWith(open, i)) {
-                open = null;
-                i += 3;
-                continue;
-            }
-            i += 1;
-            continue;
-        }
-        if (line.startsWith(BASIC, i)) {
-            open = BASIC;
-            i += 3;
-            continue;
-        }
-        if (line.startsWith(LITERAL, i)) {
-            open = LITERAL;
-            i += 3;
-            continue;
-        }
-        const ch = line[i];
-        if (ch === '#')
-            break;
-        if (ch === '"' || ch === "'") {
-            const quote = ch;
-            i += 1;
-            while (i < line.length) {
-                if (quote === '"' && line[i] === '\\') {
-                    i += 2;
-                    continue;
-                }
-                if (line[i] === quote) {
-                    i += 1;
-                    break;
-                }
-                i += 1;
-            }
-            continue;
-        }
-        i += 1;
-    }
-    return open;
-}
-function readCodexAuthHeader() {
-    let raw;
-    try {
-        if (!existsSync(CODEX_CONFIG_PATH))
-            return null;
-        raw = readFileSync(CODEX_CONFIG_PATH, 'utf8');
-    }
-    catch {
-        return null;
-    }
-    const lines = raw.split('\n');
-    let inTable = false;
-    let multiline = null;
-    for (const line of lines) {
-        const startedInsideString = multiline !== null;
-        multiline = scanTomlMultilineState(line, multiline);
-        if (startedInsideString)
-            continue;
-        const trimmed = line.trim();
-        if (trimmed.startsWith('[')) {
-            inTable = isOurCodexHeadersTable(trimmed);
-            continue;
-        }
-        if (!inTable || trimmed === '' || trimmed.startsWith('#'))
-            continue;
-        const match = /^Authorization\s*=\s*"((?:[^"\\]|\\.)*)"/.exec(trimmed);
-        if (match)
-            return match[1].replace(/\\"/g, '"').replace(/\\\\/g, '\\');
-    }
-    return null;
-}
-function tomlQuote(value) {
-    return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
-}
-export function setCodexAuthorization(content, headerValue) {
-    const lines = content.split('\n');
-    let inTable = false;
-    let multiline = null;
-    for (let i = 0; i < lines.length; i += 1) {
-        const startedInsideString = multiline !== null;
-        multiline = scanTomlMultilineState(lines[i] ?? '', multiline);
-        if (startedInsideString)
-            continue;
-        const trimmed = (lines[i] ?? '').trim();
-        if (trimmed.startsWith('[')) {
-            inTable = isOurCodexHeadersTable(trimmed);
-            continue;
-        }
-        if (!inTable || trimmed === '' || trimmed.startsWith('#'))
-            continue;
-        if (!/^Authorization\s*=/.test(trimmed))
-            continue;
-        lines[i] = `Authorization = ${tomlQuote(headerValue)}`;
-        return lines.join('\n');
-    }
-    return null;
-}
-export function resolveMintProvider(hasClaude = readClaudeAuthHeader() !== null, hasCodex = readCodexAuthHeader() !== null, hasCursor = readCursorAuthHeader() !== null) {
-    if (hasClaude)
-        return 'claude_code';
-    if (hasCodex)
-        return 'codex';
-    if (hasCursor)
-        return 'cursor';
-    return 'claude_code';
-}
-export function readSyncedConfig() {
-    let cfg = readJsonFile(SYNCED_ORIGINS_PATH);
-    for (const legacy of LEGACY_SYNCED_ORIGINS_PATHS) {
-        if (cfg)
-            break;
-        cfg = readJsonFile(legacy);
-    }
-    if (!cfg || typeof cfg.apiBase !== 'string' || !Array.isArray(cfg.origins)) {
-        return null;
-    }
-    const apiBase = cfg.apiBase.replace(/\/+$/, '');
-    const origins = new Set(cfg.origins.map((o) => normalizeOriginUrl(String(o))).filter(Boolean));
-    return {
-        apiBase,
-        origins,
-        pause: readPause(cfg),
-        toolGuard: cfg.toolGuard === true,
-        receipt: cfg.receipt !== false,
-    };
-}
-export async function refreshSyncedOrigins() {
-    try {
-        const age = Date.now() - statSync(ORIGINS_REFRESH_STAMP_PATH).mtimeMs;
-        if (age < ORIGINS_REFRESH_INTERVAL_MS)
-            return null;
-    }
-    catch {
-    }
-    const auth = readUsableAuth();
-    if (!auth)
-        return null;
-    try {
-        mkdirSync(HARBOR_DIR, { recursive: true, mode: 0o700 });
-        writeFileSync(ORIGINS_REFRESH_STAMP_PATH, '', { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-    const apiUrl = auth.apiUrl.replace(/\/+$/, '');
-    const fetched = await getJsonRaw(`${apiUrl}/workspaces/${encodeURIComponent(auth.workspaceId)}/context/repo-bindings`, `Bearer ${auth.runnerToken}`);
-    if (fetched?.status !== 200)
-        return null;
-    const rows = Array.isArray(fetched.body?.data)
-        ? fetched.body.data
-        : Array.isArray(fetched.body)
-            ? fetched.body
-            : null;
-    if (!rows)
-        return null;
-    const origins = [
-        ...new Set(rows
-            .map((row) => normalizeOriginUrl(String(row?.originUrl ?? '')))
-            .filter(Boolean)),
-    ];
-    if (origins.length === 0)
-        return new Set();
-    const release = tryLock(SYNCED_ORIGINS_PATH);
-    if (!release)
-        return new Set(origins);
-    try {
-        const current = readJsonFile(SYNCED_ORIGINS_PATH) ?? {};
-        const body = { ...current, apiBase: current.apiBase ?? apiUrl, origins };
-        writeAtomicSync(SYNCED_ORIGINS_PATH, `${JSON.stringify(body, null, 2)}\n`);
-    }
-    catch {
-    }
-    finally {
-        release();
-    }
-    return new Set(origins);
-}
-function readPause(cfg) {
-    const out = { global: null, repos: {} };
-    if (cfg.capture === false)
-        out.global = 'capture';
-    const raw = cfg.pause;
-    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
-        return out;
-    if (isPauseMode(raw.global))
-        out.global = raw.global;
-    if (raw.repos && typeof raw.repos === 'object' && !Array.isArray(raw.repos)) {
-        for (const [key, value] of Object.entries(raw.repos)) {
-            if (isPauseMode(value))
-                out.repos[normalizeOriginUrl(String(key))] = value;
-        }
-    }
-    return out;
-}
-const isPauseMode = (value) => value === 'off' || value === 'capture' || value === 'on';
-export function repoArms(config, originUrl) {
-    const mode = config?.pause?.repos?.[originUrl] ?? config?.pause?.global ?? null;
-    if (mode === 'off')
-        return { recall: false, capture: false };
-    if (mode === 'capture')
-        return { recall: true, capture: false };
-    return { recall: true, capture: true };
-}
-export function gitOrigin(cwd) {
-    try {
-        const out = execFileSync('git', ['-C', cwd, 'remote', 'get-url', 'origin'], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            timeout: 2000,
-        });
-        const trimmed = out.trim();
-        return trimmed.length > 0 ? trimmed : null;
-    }
-    catch {
-        return null;
-    }
-}
-export function gitRoot(cwd) {
-    try {
-        const out = execFileSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            timeout: 2000,
-        });
-        const trimmed = out.trim();
-        return trimmed.length > 0 ? trimmed : null;
-    }
-    catch {
-        return null;
-    }
-}
-function realpathBestEffort(path) {
-    const resolved = resolve(path);
-    let current = resolved;
-    const peeled = [];
-    for (let depth = 0; depth < 64; depth += 1) {
-        try {
-            const real = realpathSync(current);
-            return peeled.length === 0 ? real : join(real, ...peeled.reverse());
-        }
-        catch {
-            const parent = dirname(current);
-            if (parent === current)
-                break;
-            peeled.push(basename(current));
-            current = parent;
-        }
-    }
-    return resolved;
-}
-export function isPathInside(candidate, root, cwd) {
-    if (typeof candidate !== 'string' || candidate.trim() === '')
-        return false;
-    if (typeof root !== 'string' || root.trim() === '')
-        return false;
-    const base = realpathBestEffort(resolve(root));
-    const abs = realpathBestEffort(resolve(cwd ?? base, candidate));
-    return abs === base || abs.startsWith(base.endsWith(sep) ? base : base + sep);
-}
-export function normalizeOriginUrl(raw) {
-    let url = (raw ?? '').trim();
-    if (url === '')
-        return '';
-    const scpMatch = url.match(/^[^@/]+@([^:/]+):(.+)$/);
-    if (scpMatch) {
-        url = `https://${scpMatch[1]}/${scpMatch[2]}`;
-    }
-    else if (/^ssh:\/\//i.test(url)) {
-        url = url.replace(/^ssh:\/\//i, 'https://');
-    }
-    else if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(url)) {
-        url = `https://${url}`;
-    }
-    url = url.replace(/\.git$/i, '');
-    try {
-        const parsed = new URL(url);
-        parsed.username = '';
-        parsed.password = '';
-        parsed.hostname = parsed.hostname.toLowerCase().replace(/^www\./, '');
-        parsed.pathname = parsed.pathname.toLowerCase();
-        return parsed.toString().replace(/\/$/, '');
-    }
-    catch {
-        return url.toLowerCase().replace(/\/+$/, '');
-    }
-}
-let healAttempted = false;
-export function lockPathFor(targetPath) {
-    const digest = createHash('sha256').update(targetPath).digest('hex').slice(0, 16);
-    return join(HARBOR_DIR, 'locks', `${digest}.lock`);
-}
-export function tryLock(targetPath) {
-    const path = lockPathFor(targetPath);
-    try {
-        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    }
-    catch {
-        return null;
-    }
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-        try {
-            const token = randomUUID();
-            const fd = openSync(path, 'wx', 0o600);
-            writeSync(fd, JSON.stringify({ pid: process.pid, at: new Date().toISOString(), token }));
-            closeSync(fd);
-            return () => {
-                try {
-                    const owner = JSON.parse(readFileSync(path, 'utf8'));
-                    if (owner.token !== token)
-                        return;
-                    rmSync(path, { force: true });
-                }
-                catch {
-                }
-            };
-        }
-        catch {
-            try {
-                const age = Date.now() - statSync(path).mtimeMs;
-                if (age > 10_000)
-                    rmSync(path, { force: true });
-                else
-                    return null;
-            }
-            catch {
-            }
-        }
-    }
-    return null;
-}
-function writeAtomicSync(path, contents) {
-    const target = realpathBestEffort(path);
-    const tmp = `${target}.${process.pid}.tmp`;
-    writeFileSync(tmp, contents, { encoding: 'utf8', mode: 0o600 });
-    renameSync(tmp, target);
-}
-async function healAuthHeader() {
-    if (healAttempted)
-        return null;
-    healAttempted = true;
-    const auth = readUsableAuth();
-    if (!auth)
-        return null;
-    const apiUrl = auth.apiUrl.replace(/\/+$/, '');
-    let runnerToken = auth.runnerToken;
-    const rotated = await postJsonRaw(`${apiUrl}/auth/runner-token/refresh`, `Bearer ${runnerToken}`, {});
-    if (rotated?.status === 200 && typeof rotated.body?.token === 'string') {
-        runnerToken = rotated.body.token;
-        try {
-            const release = tryLock(join(HARBOR_DIR, 'auth.json'));
-            if (release) {
-                try {
-                    writeAtomicSync(join(HARBOR_DIR, 'auth.json'), `${JSON.stringify({ ...auth, runnerToken }, null, 2)}\n`);
-                }
-                finally {
-                    release();
-                }
-            }
-        }
-        catch {
-        }
-    }
-    else if (rotated?.status === 401) {
-        return null;
-    }
-    const active = readActiveCredential();
-    const minted = await postJsonRaw(`${apiUrl}/workspaces/${encodeURIComponent(auth.workspaceId)}/context/setup/token`, `Bearer ${runnerToken}`, {
-        provider: resolveMintProvider(active.agent === 'claude', active.agent === 'codex', active.agent === 'cursor'),
-    });
-    const token = minted?.body?.data?.token;
-    if (minted?.status !== 201 && minted?.status !== 200)
-        return null;
-    if (typeof token !== 'string' || token === '')
-        return null;
-    persistHealedBearer(`Bearer ${token}`, active.agent);
-    return `Bearer ${token}`;
-}
-function persistHealedBearer(headerValue, agent) {
-    if (agent === 'claude')
-        persistClaudeBearer(headerValue);
-    else if (agent === 'codex')
-        persistCodexBearer(headerValue);
-    else if (agent === 'cursor')
-        persistCursorBearer(headerValue);
-}
-function persistClaudeBearer(headerValue) {
-    persistClaudeBearerIn(CLAUDE_MCP_CONFIG_PATH, headerValue);
-    persistClaudeBearerIn(CLAUDE_SETTINGS_PATH, headerValue);
-}
-function persistClaudeBearerIn(path, headerValue) {
-    const release = tryLock(path);
-    if (!release)
-        return;
-    try {
-        let root = {};
-        try {
-            const raw = readFileSync(path, 'utf8');
-            if (raw.trim() !== '')
-                root = JSON.parse(raw);
-        }
-        catch {
-            root = {};
-        }
-        if (root === null || typeof root !== 'object' || Array.isArray(root))
-            return;
-        const servers = root.mcpServers && typeof root.mcpServers === 'object' && !Array.isArray(root.mcpServers)
-            ? root.mcpServers
-            : {};
-        const previous = servers[HARBOR_MCP_KEY];
-        if (!previous || typeof previous !== 'object' || typeof previous.url !== 'string') {
-            return;
-        }
-        servers[HARBOR_MCP_KEY] = {
-            ...previous,
-            headers: { ...(previous.headers ?? {}), Authorization: headerValue },
-        };
-        root.mcpServers = servers;
-        writeAtomicSync(path, `${JSON.stringify(root, null, 2)}\n`);
-    }
-    catch {
-    }
-    finally {
-        release();
-    }
-}
-function persistCodexBearer(headerValue) {
-    const release = tryLock(CODEX_CONFIG_PATH);
-    if (!release)
-        return;
-    try {
-        const raw = readFileSync(CODEX_CONFIG_PATH, 'utf8');
-        const next = setCodexAuthorization(raw, headerValue);
-        if (next === null || next === raw)
-            return;
-        writeAtomicSync(CODEX_CONFIG_PATH, next);
-    }
-    catch {
-    }
-    finally {
-        release();
-    }
-}
-function persistCursorBearer(headerValue) {
-    const release = tryLock(CURSOR_MCP_PATH);
-    if (!release)
-        return;
-    try {
-        const raw = readFileSync(CURSOR_MCP_PATH, 'utf8');
-        const stripped = stripJsonComments(raw);
-        if (stripped !== raw)
-            return;
-        const root = JSON.parse(stripped);
-        if (root === null || typeof root !== 'object' || Array.isArray(root))
-            return;
-        const servers = root.mcpServers;
-        if (!servers || typeof servers !== 'object' || Array.isArray(servers))
-            return;
-        const previous = servers[HARBOR_MCP_KEY];
-        if (!previous || typeof previous !== 'object' || typeof previous.url !== 'string') {
-            return;
-        }
-        servers[HARBOR_MCP_KEY] = {
-            ...previous,
-            headers: { ...(previous.headers ?? {}), Authorization: headerValue },
-        };
-        writeAtomicSync(CURSOR_MCP_PATH, `${JSON.stringify(root, null, 2)}\n`);
-    }
-    catch {
-    }
-    finally {
-        release();
-    }
-}
-async function getJsonRaw(url, authHeader) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
-    try {
-        const res = await fetch(url, {
-            method: 'GET',
-            headers: { authorization: authHeader },
-            signal: controller.signal,
-        });
-        let parsed = null;
-        try {
-            parsed = await res.json();
-        }
-        catch {
-            parsed = null;
-        }
-        return { status: res.status, body: parsed };
-    }
-    catch {
-        return null;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-async function postJsonRaw(url, authHeader, body) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
-    try {
-        const res = await fetch(url, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json', authorization: authHeader },
-            body: JSON.stringify(body),
-            signal: controller.signal,
-        });
-        let parsed = null;
-        try {
-            parsed = await res.json();
-        }
-        catch {
-            parsed = null;
-        }
-        return { status: res.status, body: parsed };
-    }
-    catch {
-        return null;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-export async function postJson(url, authHeader, body, timeoutMs) {
-    const first = await postJsonOnce(url, authHeader, body, timeoutMs);
-    if (first?.status !== 401)
-        return first;
-    const healed = await healAuthHeader();
-    if (!healed)
-        return first;
-    return postJsonOnce(url, healed, body, timeoutMs);
-}
-let lastRequestError = null;
-export function lastRequestFailureReason() {
-    return lastRequestError ?? 'network';
-}
-function describeFetchError(err) {
-    if (err?.name === 'AbortError' || err?.name === 'TimeoutError')
-        return 'timeout';
-    const code = err?.cause?.code ?? err?.code;
-    if (typeof code === 'string' && code !== '')
-        return code;
-    return typeof err?.name === 'string' && err.name !== '' ? err.name : 'network';
-}
-async function postJsonOnce(url, authHeader, body, timeoutMs) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs ?? REQUEST_TIMEOUT_MS);
-    lastRequestError = null;
-    try {
-        const res = await fetch(url, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                authorization: authHeader,
-            },
-            body: JSON.stringify(body),
-            signal: controller.signal,
-        });
-        let parsed = null;
-        if (res.status === 200) {
-            try {
-                parsed = await res.json();
-            }
-            catch {
-                parsed = null;
-            }
-        }
-        return { status: res.status, body: parsed };
-    }
-    catch (err) {
-        lastRequestError = describeFetchError(err);
-        return null;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-function markerFileName(sessionId) {
-    const safe = sessionId.replace(/[^A-Za-z0-9._-]/g, '_');
-    return `${safe}.json`;
-}
-export function markerPathFor(sessionId) {
-    return join(CLI_SESSIONS_DIR, markerFileName(sessionId));
-}
-export function readMarker(path) {
-    return readJsonFile(path);
-}
-export function writeMarker(sessionId, reported, signature, transcriptPath) {
-    try {
-        const existing = readMarker(markerPathFor(sessionId));
-        const marker = {
-            sessionId,
-            createdAt: existing?.createdAt ?? new Date().toISOString(),
-            lastSeenAt: new Date().toISOString(),
-            reported: Boolean(reported),
-        };
-        if (Array.isArray(signature)) {
-            marker.signature = signature;
-        }
-        else if (Array.isArray(existing?.signature)) {
-            marker.signature = existing.signature;
-        }
-        const path = typeof transcriptPath === 'string' && transcriptPath !== ''
-            ? transcriptPath
-            : existing?.transcriptPath;
-        if (typeof path === 'string' && path !== '')
-            marker.transcriptPath = path;
-        if (typeof existing?.deliveredAt === 'string') {
-            marker.deliveredAt = existing.deliveredAt;
-        }
-        if (typeof existing?.scanOffset === 'number') {
-            marker.scanOffset = existing.scanOffset;
-        }
-        if (existing?.contextReset === true)
-            marker.contextReset = true;
-        if (Array.isArray(existing?.emptyAsk))
-            marker.emptyAsk = existing.emptyAsk;
-        mkdirSync(CLI_SESSIONS_DIR, { recursive: true, mode: 0o700 });
-        writeFileSync(markerPathFor(sessionId), JSON.stringify(marker), {
-            encoding: 'utf8',
-            mode: 0o600,
-        });
-    }
-    catch {
-    }
-}
-export function updateMarkerSignature(sessionId, signature) {
-    const path = markerPathFor(sessionId);
-    const marker = readMarker(path);
-    if (!marker)
-        return;
-    try {
-        writeFileSync(path, JSON.stringify({
-            ...marker,
-            lastSeenAt: new Date().toISOString(),
-            signature: Array.isArray(signature) ? signature : [],
-        }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-}
-export function updateMarkerEmptyAsk(sessionId, emptyAsk) {
-    const path = markerPathFor(sessionId);
-    const marker = readMarker(path);
-    if (!marker)
-        return;
-    try {
-        writeFileSync(path, JSON.stringify({
-            ...marker,
-            lastSeenAt: new Date().toISOString(),
-            emptyAsk: Array.isArray(emptyAsk) ? emptyAsk : [],
-        }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-}
-export function updateMarkerRecall(sessionId, patch) {
-    const path = markerPathFor(sessionId);
-    const marker = readMarker(path);
-    if (!marker)
-        return;
-    const next = { ...marker, lastSeenAt: new Date().toISOString() };
-    if (typeof patch?.scanOffset === 'number' && Number.isFinite(patch.scanOffset)) {
-        next.scanOffset = patch.scanOffset;
-    }
-    if (typeof patch?.deliveredAt === 'string')
-        next.deliveredAt = patch.deliveredAt;
-    if (typeof patch?.contextReset === 'boolean') {
-        if (patch.contextReset)
-            next.contextReset = true;
-        else
-            delete next.contextReset;
-    }
-    try {
-        writeFileSync(path, JSON.stringify(next), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-}
-export function touchMarker(sessionId) {
-    const path = markerPathFor(sessionId);
-    const marker = readMarker(path);
-    if (!marker)
-        return;
-    try {
-        writeFileSync(path, JSON.stringify({ ...marker, lastSeenAt: new Date().toISOString() }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-}
-export function markReported(sessionId, explicitPath) {
-    const path = explicitPath || markerPathFor(sessionId);
-    const marker = readMarker(path);
-    if (!marker)
-        return;
-    try {
-        writeFileSync(path, JSON.stringify({ ...marker, reported: true }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-}
-export function listMarkers() {
-    const out = [];
-    const entries = [];
-    for (const dir of [CLI_SESSIONS_DIR, ...LEGACY_CLI_SESSIONS_DIRS]) {
-        try {
-            for (const name of readdirSync(dir))
-                entries.push([dir, name]);
-        }
-        catch {
-        }
-    }
-    if (entries.length === 0)
-        return out;
-    const now = Date.now();
-    for (const [dir, name] of entries) {
-        if (!name.endsWith('.json'))
-            continue;
-        const path = join(dir, name);
-        const marker = readMarker(path);
-        if (!marker || typeof marker.sessionId !== 'string')
-            continue;
-        const created = Date.parse(marker.createdAt ?? '');
-        if (Number.isFinite(created) && now - created > MARKER_TTL_MS) {
-            try {
-                rmSync(path, { force: true });
-            }
-            catch {
-            }
-            continue;
-        }
-        out.push({
-            sessionId: marker.sessionId,
-            path,
-            reported: Boolean(marker.reported),
-            createdAt: created,
-            lastSeenAt: Number.isFinite(Date.parse(marker.lastSeenAt ?? ''))
-                ? Date.parse(marker.lastSeenAt)
-                : created,
-            transcriptPath: typeof marker.transcriptPath === 'string' ? marker.transcriptPath : '',
-        });
-    }
-    return out;
-}
-function captureMarkerFileName(sessionId) {
-    const safe = sessionId.replace(/[^A-Za-z0-9._-]/g, '_');
-    return `${safe}.json`;
-}
-export function captureMarkerPathFor(sessionId) {
-    return join(CAPTURE_DIR, captureMarkerFileName(sessionId));
-}
-export function hasCaptureMarker(sessionId) {
-    return existsSync(captureMarkerPathFor(sessionId));
-}
-export const CAPTURE_MAX_RETRIES = 1;
-export function readCaptureMarker(sessionId) {
-    return readJsonFile(captureMarkerPathFor(sessionId));
-}
-export function writeCaptureMarker(sessionId, retries = 0) {
-    try {
-        mkdirSync(CAPTURE_DIR, { recursive: true, mode: 0o700 });
-        writeFileSync(captureMarkerPathFor(sessionId), JSON.stringify({ sessionId, createdAt: new Date().toISOString(), retries }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-}
-export function settleCaptureMarker(sessionId) {
-    const marker = readCaptureMarker(sessionId) ?? { sessionId };
-    try {
-        mkdirSync(CAPTURE_DIR, { recursive: true, mode: 0o700 });
-        writeFileSync(captureMarkerPathFor(sessionId), JSON.stringify({ ...marker, settled: true }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-}
-const CAPTURE_TRIGGER_SENTINEL = 'Capture pass: call harbor_record_learning';
-const TOOL_REJECTED_RE = /doesn't want to proceed with this tool use|tool use was rejected|Request interrupted/i;
-function carriesCaptureTrigger(entry) {
-    const content = entry?.message?.content;
-    if (typeof content === 'string' && content.includes(CAPTURE_TRIGGER_SENTINEL))
-        return true;
-    const blocking = entry?.attachment?.blockingError?.blockingError;
-    return typeof blocking === 'string' && blocking.includes(CAPTURE_TRIGGER_SENTINEL);
-}
-export function capturePassOutcome(transcriptPath) {
-    let verdict = 'unknown';
-    const pending = new Set();
-    for (const entry of transcriptEntries(transcriptPath)) {
-        if (carriesCaptureTrigger(entry)) {
-            verdict = 'none';
-            pending.clear();
-            continue;
-        }
-        if (verdict === 'unknown')
-            continue;
-        const content = entry?.message?.content;
-        if (!Array.isArray(content))
-            continue;
-        for (const block of content) {
-            if (block?.type === 'tool_use' && (block.name ?? '').endsWith(RECORD_TOOL_SUFFIX)) {
-                pending.add(block.id);
-                continue;
-            }
-            if (block?.type !== 'tool_result' || !pending.has(block.tool_use_id))
-                continue;
-            pending.delete(block.tool_use_id);
-            if (verdict === 'landed')
-                continue;
-            verdict = TOOL_REJECTED_RE.test(toolResultText(block.content)) ? 'rejected' : 'landed';
-        }
-    }
-    if (verdict !== 'landed' && pending.size > 0)
-        return 'rejected';
-    return verdict;
-}
-export function pruneCaptureMarkers() {
-    let names = [];
-    try {
-        names = readdirSync(CAPTURE_DIR);
-    }
-    catch {
-        return;
-    }
-    const now = Date.now();
-    for (const name of names) {
-        if (!name.endsWith('.json'))
-            continue;
-        const marker = readJsonFile(join(CAPTURE_DIR, name));
-        const created = Date.parse(marker?.createdAt ?? '');
-        if (Number.isFinite(created) && now - created > MARKER_TTL_MS) {
-            try {
-                rmSync(join(CAPTURE_DIR, name), { force: true });
-            }
-            catch {
-            }
-        }
-    }
-}
-const EDIT_TOOLS = new Set([
-    'Edit',
-    'Write',
-    'MultiEdit',
-    'NotebookEdit',
-    'StrReplace',
-    'ApplyPatch',
-]);
-const SHELL_TOOLS = new Set(['Bash', 'Shell']);
-const APPLY_PATCH_TARGET = /^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm;
-const CODEX_EXEC_CMD = /["']?cmd["']?\s*:\s*(["'])((?:\\.|(?!\1)[^\\])*)\1/g;
-const IGNORED_PATH_SEGMENTS = ['/node_modules/', '/.git/'];
-const GENERATED_PATH_SEGMENTS = [
-    '/node_modules/',
-    '/.git/',
-    '/dist/',
-    '/build/',
-    '/coverage/',
-    '/.next/',
-    '/.turbo/',
-    '/.vite/',
-];
-const BASH_WRITE = (() => {
-    const AT_COMMAND_START = String.raw `(?:^|[\n;&|(]|\bthen\b|\bdo\b|\belse\b)\s*(?:sudo\s+)?`;
-    const VERBS = 'sed\\s+-[a-zA-Z]*i|perl\\s+-[a-zA-Z]*i|tee|cp|mv|rm|mkdir|touch|ln|chmod|chown|rsync|patch|truncate|dd';
-    return new RegExp([
-        String.raw `>>?\s*(?!&|/dev/(null|stdout|stderr)\b)\S`,
-        String.raw `<<-?\s*'?[A-Za-z_]`,
-        `${AT_COMMAND_START}(?:${VERBS})\\b`,
-        String.raw `\b(npm|pnpm|yarn|bun)\s+(i|install|ci|add|remove|uninstall|link)\b`,
-        String.raw `\bgit\s+(apply|am|commit|checkout|switch|restore|revert|merge|rebase|mv|rm|stash|clean|reset|push)\b`,
-    ].join('|'));
-})();
-export const CAPTURE_BAR = '<capture_bar>\n' +
-    'When you are asked to run the capture pass, this is the bar. Record only what ' +
-    'a teammate would need MONTHS from now and could not get by reading the code, ' +
-    'the docs, or the same source you just read. An item qualifies only if ALL ' +
-    'THREE hold: (1) DURABLE — a mechanism or a decision, not a current value, a ' +
-    'status, or anything phrased "currently broken / not yet"; (2) OURS — about ' +
-    'this repo, this product, or a decision we actually made, not about your ' +
-    'tooling, your environment, or a summary of external material; (3) COSTLY — ' +
-    'without it a teammate would take the wrong path or reintroduce a bug. Do NOT ' +
-    'record: how you got a tool or a throwaway script working, anything about ' +
-    'temp/scratch files, or an idea that was only proposed rather than decided. For ' +
-    'each item that clears all three, call harbor_record_learning — do not ask ' +
-    'permission. Most sessions yield ZERO or ONE; recording nothing is the normal, ' +
-    'correct outcome. Until you are asked, this is a definition and not a task: do ' +
-    'not act on it and do not mention it.\n' +
-    '</capture_bar>';
-export const CAPTURE_TRIGGER = 'Capture pass: call harbor_record_learning for anything DURABLE + OURS + ' +
-    'COSTLY from this session (see <capture_bar>) — zero is the normal outcome; ' +
-    'if nothing qualifies, just finish.';
-function editedPaths(block) {
-    if (!block || typeof block !== 'object')
-        return [];
-    if (block.type !== 'tool_use' || !EDIT_TOOLS.has(block.name))
-        return [];
-    const input = block.input;
-    if (typeof input === 'string') {
-        return [...input.matchAll(APPLY_PATCH_TARGET)]
-            .map((match) => match[1].trim())
-            .filter((path) => path !== '');
-    }
-    if (!input || typeof input !== 'object')
-        return [];
-    const path = input.file_path ?? input.notebook_path ?? input.path;
-    return typeof path === 'string' && path !== '' ? [path] : [];
-}
-function codexPatchedPaths(entry) {
-    const payload = entry?.payload ?? entry;
-    if (payload?.type !== 'patch_apply_end' || payload.success !== true)
-        return [];
-    const changes = payload.changes;
-    return changes && typeof changes === 'object' ? Object.keys(changes) : [];
-}
-function entryEditedPaths(entry) {
-    const content = entry?.message?.content;
-    const blocks = Array.isArray(content) ? content.flatMap(editedPaths) : [];
-    return blocks.concat(codexPatchedPaths(entry));
-}
-function shellCommands(entry) {
-    const commands = [];
-    const content = entry?.message?.content;
-    if (Array.isArray(content)) {
-        for (const block of content) {
-            if (!block || block.type !== 'tool_use' || !SHELL_TOOLS.has(block.name))
-                continue;
-            const command = block.input?.command;
-            if (typeof command === 'string')
-                commands.push(command);
-        }
-    }
-    const payload = entry?.payload ?? entry;
-    if (payload?.type === 'custom_tool_call' && typeof payload.input === 'string') {
-        for (const match of payload.input.matchAll(CODEX_EXEC_CMD))
-            commands.push(match[2]);
-    }
-    return commands;
-}
-export function sessionEditedRepoFiles(transcriptPath, root, cwd) {
-    for (const entry of transcriptEntries(transcriptPath)) {
-        for (const path of entryEditedPaths(entry)) {
-            if (IGNORED_PATH_SEGMENTS.some((seg) => path.includes(seg)))
-                continue;
-            if (isPathInside(path, root, cwd))
-                return true;
-        }
-    }
-    return false;
-}
-export function sessionRanWritingCommand(transcriptPath) {
-    for (const entry of transcriptEntries(transcriptPath)) {
-        if (shellCommands(entry).some((command) => BASH_WRITE.test(command)))
-            return true;
-    }
-    return false;
-}
-function* transcriptEntries(transcriptPath) {
-    if (typeof transcriptPath !== 'string' || transcriptPath === '')
-        return;
-    let raw;
-    try {
-        raw = readFileSync(transcriptPath, 'utf8');
-    }
-    catch {
-        return;
-    }
-    for (const line of raw.split('\n')) {
-        if (line.trim() === '')
-            continue;
-        try {
-            yield JSON.parse(line);
-        }
-        catch {
-            continue;
-        }
-    }
-}
-export function repoFileChangedSince(root, sinceMs) {
-    if (typeof root !== 'string' || root === '')
-        return false;
-    if (typeof sinceMs !== 'number' || !Number.isFinite(sinceMs))
-        return false;
-    let out;
-    try {
-        out = execFileSync('git', ['-C', root, 'status', '--porcelain', '--untracked-files=all'], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            timeout: 3000,
-            maxBuffer: 8 * 1024 * 1024,
-        });
-    }
-    catch {
-        return false;
-    }
-    for (const line of out.split('\n')) {
-        if (line.length < 4)
-            continue;
-        let rel = line.slice(3);
-        const arrow = rel.indexOf(' -> ');
-        if (arrow !== -1)
-            rel = rel.slice(arrow + 4);
-        if (rel.startsWith('"') && rel.endsWith('"'))
-            rel = rel.slice(1, -1);
-        if (rel === '')
-            continue;
-        const full = join(root, rel);
-        if (GENERATED_PATH_SEGMENTS.some((seg) => `/${rel}`.includes(seg)))
-            continue;
-        try {
-            if (statSync(full).mtimeMs >= sinceMs)
-                return true;
-        }
-        catch {
-            continue;
-        }
-    }
-    return false;
-}
-export function sessionDidRepoWork(transcriptPath, root, cwd, sinceMs) {
-    if (sessionEditedRepoFiles(transcriptPath, root, cwd))
-        return true;
-    if (!sessionRanWritingCommand(transcriptPath))
-        return false;
-    const since = typeof sinceMs === 'number' ? sinceMs : transcriptStartedAt(transcriptPath);
-    if (since === null)
-        return false;
-    return repoFileChangedSince(root, since);
-}
-function transcriptStartedAt(transcriptPath) {
-    if (typeof transcriptPath !== 'string' || transcriptPath === '')
-        return null;
-    try {
-        const s = statSync(transcriptPath);
-        return s.birthtimeMs > 0 ? s.birthtimeMs : s.mtimeMs;
-    }
-    catch {
-        return null;
-    }
-}
-export const SENTINEL_NAMES = ['harbor', 'milestone', 'alef0'];
-const SENTINEL_PREFIX = `(?:${SENTINEL_NAMES.join('|')})-applied:`;
-const APPLIED_LINE = new RegExp(`${SENTINEL_PREFIX}\\s*([#\\d\\s,]+)`, 'gi');
-const MAX_APPLIED_ORDINALS = 100;
-const MARKER_MENTION = new RegExp(SENTINEL_PREFIX, 'i');
-const CODE_SPAN = /```[\s\S]*?```|``[\s\S]*?``|`[^`\n]*`/g;
-function stripQuotedMarkers(text) {
-    if (!text.includes('`'))
-        return text;
-    return text.replace(CODE_SPAN, (span) => MARKER_MENTION.test(span) ? ' ' : span);
-}
-const LEARNING_REF = /\b(lrn_[A-Za-z0-9]{1,32})\b/g;
-const RECORD_TOOL_SUFFIX = 'record_learning';
-const MAX_LEARNING_REFS = 100;
-function contentBlocks(content) {
-    if (Array.isArray(content))
-        return content;
-    if (typeof content === 'string')
-        return [{ type: 'text', text: content }];
-    return [];
-}
-function toolResultText(body) {
-    if (typeof body === 'string')
-        return body;
-    if (!Array.isArray(body))
-        return '';
-    return body.map((b) => (typeof b?.text === 'string' ? b.text : '')).join('\n');
-}
-const TEXT_BLOCK_TYPES = new Set(['text', 'output_text']);
-function normalizeEntry(entry) {
-    if (!entry || typeof entry !== 'object')
-        return null;
-    const payload = entry.payload;
-    if (payload && typeof payload === 'object') {
-        if (payload.type === 'message') {
-            return { role: payload.role, blocks: contentBlocks(payload.content) };
-        }
-        if (payload.type === 'agent_message' && typeof payload.message === 'string') {
-            return { role: 'assistant', blocks: [{ type: 'text', text: payload.message }] };
-        }
-        return null;
-    }
-    const message = entry.message;
-    if (!message || typeof message !== 'object')
-        return null;
-    const role = typeof message.role === 'string' ? message.role : entry.role;
-    return { role, blocks: contentBlocks(message.content) };
-}
-function codexMcpRefText(entry) {
-    const payload = entry?.payload;
-    if (!payload || payload.type !== 'mcp_tool_call_end')
-        return null;
-    const tool = payload.invocation?.tool;
-    if (typeof tool !== 'string' || !tool.endsWith(RECORD_TOOL_SUFFIX))
-        return '';
-    const ok = payload.result?.Ok;
-    return ok ? toolResultText(ok.content) : '';
-}
-const TRUNCATION_PROBE = /"isCompactSummary"\s*:\s*true|"compactMetadata"\s*:/;
-const TRUNCATION_BACKFILL_BYTES = 4 * 1024 * 1024;
-export function scanForContextTruncation(transcriptPath, scanOffset) {
-    const known = typeof scanOffset === 'number' && Number.isFinite(scanOffset) && scanOffset >= 0
-        ? scanOffset
-        : null;
-    const unchanged = { truncated: false, offset: known ?? 0 };
-    if (typeof transcriptPath !== 'string' || transcriptPath === '')
-        return unchanged;
-    let size;
-    try {
-        size = statSync(transcriptPath).size;
-    }
-    catch {
-        return unchanged;
-    }
-    const resumable = known !== null && known <= size;
-    const floor = Math.max(0, size - TRUNCATION_BACKFILL_BYTES);
-    const start = resumable ? Math.max(known, floor) : floor;
-    const length = size - start;
-    if (length <= 0)
-        return { truncated: false, offset: size };
-    let fd;
-    try {
-        fd = openSync(transcriptPath, 'r');
-        const buf = Buffer.allocUnsafe(length);
-        const read = readSync(fd, buf, 0, length, start);
-        return {
-            truncated: TRUNCATION_PROBE.test(buf.toString('utf8', 0, read)),
-            offset: size,
-        };
-    }
-    catch {
-        return unchanged;
-    }
-    finally {
-        if (fd !== undefined) {
-            try {
-                closeSync(fd);
-            }
-            catch {
-            }
-        }
-    }
-}
-export function scrapeSessionTranscript(transcriptPath) {
-    if (typeof transcriptPath !== 'string' || transcriptPath === '')
-        return null;
-    const ordinals = new Set();
-    const recordToolUseIds = new Set();
-    const refsByToolUse = new Map();
-    const learningRefs = new Set();
-    let understood = 0;
-    const addRefs = (text) => {
-        for (const match of text.matchAll(LEARNING_REF))
-            learningRefs.add(match[1]);
-    };
-    const readable = forEachLineSync(transcriptPath, (line) => {
-        if (line.trim() === '')
-            return;
-        let entry;
-        try {
-            entry = JSON.parse(line);
-        }
-        catch {
-            return;
-        }
-        const codexRefs = codexMcpRefText(entry);
-        if (codexRefs !== null) {
-            understood++;
-            if (codexRefs !== '')
-                addRefs(codexRefs);
-        }
-        const normalized = normalizeEntry(entry);
-        if (!normalized)
-            return;
-        understood++;
-        for (const block of normalized.blocks) {
-            if (TEXT_BLOCK_TYPES.has(block?.type) && typeof block.text === 'string') {
-                if (normalized.role !== 'assistant')
-                    continue;
-                for (const match of stripQuotedMarkers(block.text).matchAll(APPLIED_LINE)) {
-                    for (const token of match[1].split(/[\s,#]+/)) {
-                        const n = Number.parseInt(token, 10);
-                        if (Number.isInteger(n) && n > 0)
-                            ordinals.add(n);
-                    }
-                }
-                continue;
-            }
-            if (block?.type === 'tool_use' &&
-                typeof block.name === 'string' &&
-                typeof block.id === 'string' &&
-                block.name.endsWith(RECORD_TOOL_SUFFIX)) {
-                recordToolUseIds.add(block.id);
-                continue;
-            }
-            if (block?.type === 'tool_result' && typeof block.tool_use_id === 'string') {
-                const text = toolResultText(block.content);
-                if (text === '' || !text.includes('lrn_'))
-                    continue;
-                const refs = refsByToolUse.get(block.tool_use_id) ?? new Set();
-                for (const match of text.matchAll(LEARNING_REF))
-                    refs.add(match[1]);
-                refsByToolUse.set(block.tool_use_id, refs);
-            }
-        }
-    });
-    if (!readable)
-        return null;
-    if (understood === 0)
-        return null;
-    for (const [toolUseId, refs] of refsByToolUse) {
-        if (!recordToolUseIds.has(toolUseId))
-            continue;
-        for (const ref of refs)
-            learningRefs.add(ref);
-    }
-    return {
-        ordinals: [...ordinals].slice(0, MAX_APPLIED_ORDINALS),
-        learningRefs: [...learningRefs].slice(0, MAX_LEARNING_REFS),
-    };
-}
-export const REDELIVERY_LEAD = 'Your context was compacted and the team context from earlier in this ' +
-    'session was dropped with it. Re-sent in full below — treat this as what ' +
-    'you know, not as a repeat:';
-export function wrapRedelivery(block) {
-    return `<prior_knowledge>\n${REDELIVERY_LEAD}\n${block}\n</prior_knowledge>`;
-}
-export const RECALL_OUTCOMES_PATH = join(HARBOR_DIR, 'recall-outcomes.jsonl');
-const RECALL_OUTCOMES_MAX_BYTES = 512 * 1024;
-export const RECALL_OUTCOMES = Object.freeze({
-    DELIVERED: 'delivered',
-    DELIVERED_DELTA: 'delivered-delta',
-    REDELIVERED_AFTER_COMPACT: 'redelivered-after-compact',
-    CONTEXT_LOST: 'context-lost',
-    NO_CONFIG: 'no-config',
-    NO_ORIGIN: 'no-origin',
-    NOT_ALLOWLISTED: 'not-allowlisted',
-    RECALL_OFF: 'recall-off',
-    NO_AUTH: 'no-auth',
-    DESKTOP_CHAT: 'desktop-chat',
-    NO_SHIFT: 'no-shift',
-    NO_QUERY: 'no-query',
-    EMPTY_BUNDLE: 'empty-bundle',
-    REQUEST_FAILED: 'request-failed',
-    PAYMENT_REQUIRED: 'payment-required',
-});
-let recallOrigin = null;
-export function setRecallOrigin(origin) {
-    recallOrigin = typeof origin === 'string' && origin !== '' ? origin : null;
-}
-export function recordRecallOutcome(sessionId, outcome, detail) {
-    try {
-        mkdirSync(HARBOR_DIR, { recursive: true, mode: 0o700 });
-        try {
-            if (statSync(RECALL_OUTCOMES_PATH).size > RECALL_OUTCOMES_MAX_BYTES) {
-                rmSync(RECALL_OUTCOMES_PATH, { force: true });
-            }
-        }
-        catch {
-        }
-        const row = {
-            at: new Date().toISOString(),
-            sessionId: typeof sessionId === 'string' ? sessionId : '',
-            outcome,
-        };
-        if (detail !== undefined && detail !== null)
-            row.detail = String(detail);
-        if (recallOrigin !== null)
-            row.origin = recallOrigin;
-        const agent = hookAgent();
-        if (agent !== null)
-            row.agent = agent;
-        appendFileSync(RECALL_OUTCOMES_PATH, `${JSON.stringify(row)}\n`, {
-            encoding: 'utf8',
-            mode: 0o600,
-        });
-    }
-    catch {
-    }
-}
-export function summarizeRecallOutcomes(path = RECALL_OUTCOMES_PATH) {
-    const counts = {};
-    let total = 0;
-    let malformed = 0;
-    try {
-        const text = readFileSync(path, 'utf8');
-        for (const line of text.split('\n')) {
-            if (line.trim() === '')
-                continue;
-            try {
-                const row = JSON.parse(line);
-                const key = typeof row?.outcome === 'string' ? row.outcome : 'unknown';
-                counts[key] = (counts[key] ?? 0) + 1;
-                total += 1;
-            }
-            catch {
-                malformed += 1;
-            }
-        }
-    }
-    catch {
-        return { counts: {}, total: 0, malformed: 0 };
-    }
-    return { counts, total, malformed };
-}
-export function firedKeysPathFor(sessionId) {
-    const safe = String(sessionId).replace(/[^A-Za-z0-9._-]/g, '_');
-    return join(HARBOR_DIR, 'toolcontext', `${safe}.json`);
-}
-export function claimFiredKey(sessionId, key) {
-    const path = firedKeysPathFor(sessionId);
-    const existing = readJsonFile(path);
-    const keys = Array.isArray(existing?.keys) ? existing.keys : [];
-    if (keys.includes(key))
-        return false;
-    try {
-        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-        const next = [...keys, key].slice(-200);
-        writeFileSync(path, JSON.stringify({ ...(existing ?? {}), keys: next }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-    }
-    return true;
-}
-export const TOOL_MISS_BACKOFF = 3;
-export function noteToolLookup(sessionId, served) {
-    const path = firedKeysPathFor(sessionId);
-    const existing = readJsonFile(path) ?? {};
-    const misses = served ? 0 : (Number(existing.misses) || 0) + 1;
-    try {
-        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-        writeFileSync(path, JSON.stringify({ ...existing, misses }), {
-            encoding: 'utf8',
-            mode: 0o600,
-        });
-    }
-    catch {
-    }
-}
-export function toolLookupsSuspended(sessionId) {
-    const existing = readJsonFile(firedKeysPathFor(sessionId));
-    return (Number(existing?.misses) || 0) >= TOOL_MISS_BACKOFF;
-}