heyiam 0.1.4 → 0.1.6

package/dist/server.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { listSessions, parseSession } from './parsers/index.js';
-import { bridgeToAnalyzer, bridgeChildSessions, aggregateChildStats } from './bridge.js';
+import { bridgeToAnalyzer, bridgeChildSessions, aggregateChildStats, toAgentChild } from './bridge.js';
 import { analyzeSession } from './analyzer.js';
 import { checkAuthStatus, getAuthToken, saveAuthToken } from './auth.js';
 import { API_URL } from './config.js';
@@ -12,6 +12,8 @@ import { getProvider, getEnhanceMode } from './llm/index.js';
 import { triageSessions } from './llm/triage.js';
 import { enhanceProject, refineNarrative } from './llm/project-enhance.js';
 import { saveAnthropicApiKey, clearAnthropicApiKey, getAnthropicApiKey, saveEnhancedData, loadEnhancedData, deleteEnhancedData, loadFreshProjectEnhanceResult, saveProjectEnhanceResult, loadProjectEnhanceResult, buildProjectFingerprint, savePublishedState, getPublishedState } from './settings.js';
+import { captureScreenshot } from './screenshot.js';
+import { redactSession, redactText, scanTextSync, formatFindings, stripHomePathsInText } from './redact.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // Derive a human-readable project name from the encoded directory name.
 // "-Users-ben-Dev-heyi-am" → "heyi-am"
@@ -73,12 +75,12 @@ function mergeEnhancedData(session) {
 }
 // ── Persistent stats cache ────────────────────────────────────
 // Survives server restarts by writing to disk.
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 const STATS_CACHE_PATH = join(homedir(), '.config', 'heyiam', 'stats-cache.json');
 // Bump this when parser logic changes to auto-invalidate stale cache entries.
-const STATS_CACHE_VERSION = 6;
+const STATS_CACHE_VERSION = 7;
 function loadStatsCache() {
     try {
         if (!existsSync(STATS_CACHE_PATH))
@@ -132,6 +134,14 @@ export function createApp(sessionsBasePath) {
             return cached;
         try {
             const session = await loadSession(meta.path, projectName, meta.sessionId);
+            // Compute end time: prefer endTime, fall back to date + wallClock or duration
+            let endTime = session.endTime;
+            if (!endTime && session.date) {
+                const mins = session.wallClockMinutes ?? session.durationMinutes ?? 0;
+                if (mins > 0) {
+                    endTime = new Date(new Date(session.date).getTime() + mins * 60_000).toISOString();
+                }
+            }
             const stats = {
                 loc: session.linesOfCode ?? 0,
                 duration: session.durationMinutes ?? 0,
@@ -139,6 +149,7 @@ export function createApp(sessionsBasePath) {
                 turns: session.turns ?? 0,
                 skills: session.skills ?? [],
                 date: session.date ?? '',
+                endTime,
             };
             statsCache.set(meta.sessionId, stats);
             statsCacheDirty = true;
@@ -148,11 +159,68 @@ export function createApp(sessionsBasePath) {
             return { loc: 0, duration: 0, files: 0, turns: 0, skills: [], date: '' };
         }
     }
+    /**
+     * Merge overlapping session time intervals to compute real wall-clock developer time.
+     * If two sessions overlap (running concurrently), that time is counted once.
+     * Falls back to simple sum if timestamps are missing.
+     */
+    function mergeSessionIntervals(stats) {
+        // Build [start, end] intervals from sessions that have timestamps
+        const intervals = [];
+        let fallbackSum = 0;
+        for (const st of stats) {
+            if (st.date && st.endTime) {
+                const start = new Date(st.date).getTime();
+                const end = new Date(st.endTime).getTime();
+                if (!isNaN(start) && !isNaN(end) && end > start) {
+                    intervals.push([start, end]);
+                    continue;
+                }
+            }
+            // No valid interval — add duration to fallback sum
+            fallbackSum += st.duration;
+        }
+        if (intervals.length === 0)
+            return fallbackSum;
+        // Sort by start time
+        intervals.sort((a, b) => a[0] - b[0]);
+        // Merge overlapping intervals
+        let totalMs = 0;
+        let [curStart, curEnd] = intervals[0];
+        for (let i = 1; i < intervals.length; i++) {
+            const [start, end] = intervals[i];
+            if (start <= curEnd) {
+                // Overlapping — extend current interval
+                curEnd = Math.max(curEnd, end);
+            }
+            else {
+                // Gap — flush current interval
+                totalMs += curEnd - curStart;
+                curStart = start;
+                curEnd = end;
+            }
+        }
+        totalMs += curEnd - curStart;
+        return Math.round(totalMs / 60_000) + fallbackSum;
+    }
     async function getProjectWithStats(proj) {
         const allStats = await Promise.all(proj.sessions.map((m) => getSessionStats(m, proj.name)));
         const totalLoc = allStats.reduce((s, st) => s + st.loc, 0);
-        const totalDuration = allStats.reduce((s, st) => s + st.duration, 0);
         const totalFiles = allStats.reduce((s, st) => s + st.files, 0);
+        // Developer active time: sum of durationMinutes (already excludes idle gaps >5min).
+        // We don't merge overlapping intervals here because durationMinutes is active time,
+        // not wall-clock — if you're actively working two sessions concurrently, both count.
+        const totalDuration = allStats.reduce((s, st) => s + st.duration, 0);
+        // Agent time = every session's duration (the AI was working the whole time)
+        // + child/subagent durations on top (additional parallel agent work).
+        // Use raw sum, not merged intervals — each agent's work is real work.
+        let totalAgentDuration = allStats.reduce((s, st) => s + st.duration, 0);
+        for (const meta of proj.sessions) {
+            for (const child of meta.children ?? []) {
+                const childStats = await getSessionStats(child, proj.name);
+                totalAgentDuration += childStats.duration;
+            }
+        }
         // Deduplicated skills across all sessions
         const skillSet = new Set();
         for (const st of allStats) {
@@ -180,6 +248,7 @@ export function createApp(sessionsBasePath) {
             publishedSessionCount: published?.publishedSessions.length ?? 0,
             publishedSessions: published?.publishedSessions ?? [],
             enhancedAt: enhanceCache?.enhancedAt ?? null,
+            totalAgentDuration,
         };
     }
     app.use(cors({ origin: ['http://localhost:17845', 'http://127.0.0.1:17845'] }));
@@ -195,6 +264,93 @@ export function createApp(sessionsBasePath) {
             res.status(500).json({ error: { code: 'SCAN_FAILED', message: err.message } });
         }
     });
+    // ── Time stats — rich per-project agent breakdown ──────────
+    app.get('/api/time-stats', async (_req, res) => {
+        try {
+            const projects = await getProjects(sessionsBasePath);
+            const projectStats = await Promise.all(projects.map(async (proj) => {
+                const parents = proj.sessions.filter(s => !s.isSubagent);
+                let yourMinutes = 0;
+                let agentMinutes = 0;
+                let orchestratedCount = 0;
+                let maxParallelAgents = 0;
+                let totalChildAgents = 0;
+                const roleSet = new Set();
+                for (const meta of parents) {
+                    const stats = await getSessionStats(meta, proj.name);
+                    const dur = stats.duration;
+                    yourMinutes += dur;
+                    agentMinutes += dur; // primary agent present every session
+                    const children = meta.children ?? [];
+                    if (children.length > 0) {
+                        orchestratedCount++;
+                        maxParallelAgents = Math.max(maxParallelAgents, children.length);
+                        totalChildAgents += children.length;
+                    }
+                    for (const child of children) {
+                        const childStats = await getSessionStats(child, proj.name);
+                        agentMinutes += childStats.duration;
+                        if (child.agentRole)
+                            roleSet.add(child.agentRole);
+                    }
+                }
+                if (yourMinutes === 0)
+                    return null;
+                return {
+                    name: proj.name,
+                    dirName: proj.dirName,
+                    sessions: parents.length,
+                    yourMinutes,
+                    agentMinutes,
+                    orchestratedSessions: orchestratedCount,
+                    maxParallelAgents,
+                    avgAgentsPerSession: parents.length > 0
+                        ? +((totalChildAgents / parents.length) + 1).toFixed(1) // +1 for primary agent
+                        : 1,
+                    uniqueRoles: [...roleSet],
+                };
+            }));
+            const results = projectStats.filter(Boolean);
+            results.sort((a, b) => b.agentMinutes - a.agentMinutes);
+            const totalYou = results.reduce((s, p) => s + p.yourMinutes, 0);
+            const totalAgent = results.reduce((s, p) => s + p.agentMinutes, 0);
+            const totalSessions = results.reduce((s, p) => s + p.sessions, 0);
+            res.json({
+                projects: results,
+                totals: {
+                    yourMinutes: totalYou,
+                    agentMinutes: totalAgent,
+                    sessions: totalSessions,
+                },
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: { code: 'STATS_FAILED', message: err.message } });
+        }
+    });
+    // Proxy publish time stats to Phoenix
+    app.post('/api/publish-time-stats', async (req, res) => {
+        const auth = getAuthToken();
+        if (!auth) {
+            res.status(401).json({ error: 'Authentication required. Run heyiam login first.' });
+            return;
+        }
+        try {
+            const phoenixRes = await fetch(`${API_URL}/api/time-stats`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${auth.token}`,
+                },
+                body: JSON.stringify(req.body),
+            });
+            const result = await phoenixRes.json();
+            res.status(phoenixRes.status).json(result);
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
     app.get('/api/projects/:project/sessions', async (req, res) => {
         try {
             const { project } = req.params;
@@ -206,34 +362,59 @@ export function createApp(sessionsBasePath) {
             }
             // Return parent sessions with enriched child summaries.
             // Children get stats via the cached getSessionStats — no redundant parsing.
+            // If full parsing fails, fall back to a minimal session from stats.
             const sessions = await Promise.all(proj.sessions.map(async (meta) => {
+                // Build child summaries (used by both full and fallback paths)
+                // Deduplicate by sessionId (true duplicates), not by role
+                const seenIds = new Set();
+                const children = [];
+                for (const c of meta.children ?? []) {
+                    if (seenIds.has(c.sessionId))
+                        continue;
+                    seenIds.add(c.sessionId);
+                    const childStats = await getSessionStats(c, proj.name);
+                    children.push({
+                        sessionId: c.sessionId,
+                        role: c.agentRole ?? 'agent',
+                        durationMinutes: childStats.duration,
+                        linesOfCode: childStats.loc,
+                        date: childStats.date,
+                    });
+                }
+                const childCount = children.length;
                 try {
                     const session = await loadSession(meta.path, proj.name, meta.sessionId);
-                    // Deduplicate children by role (worktree agents create duplicates)
-                    const seenRoles = new Set();
-                    const children = [];
-                    for (const c of meta.children ?? []) {
-                        const role = c.agentRole ?? c.sessionId;
-                        if (seenRoles.has(role))
-                            continue;
-                        seenRoles.add(role);
-                        const childStats = await getSessionStats(c, proj.name);
-                        children.push({
-                            sessionId: c.sessionId,
-                            role: c.agentRole,
-                            durationMinutes: childStats.duration,
-                            linesOfCode: childStats.loc,
-                            date: childStats.date,
-                        });
-                    }
-                    const childCount = children.length;
                     return { ...session, childCount, children: childCount > 0 ? children : undefined };
                 }
                 catch {
-                    return null;
+                    // Full parse failed — build minimal session from stats so it still appears.
+                    // Use file mtime as fallback date so the session isn't filtered out.
+                    const stats = await getSessionStats(meta, proj.name);
+                    let fallbackDate = stats.date || '';
+                    if (!fallbackDate) {
+                        try {
+                            fallbackDate = statSync(meta.path).mtime.toISOString();
+                        }
+                        catch { /* file gone — will be filtered */ }
+                    }
+                    return {
+                        id: meta.sessionId,
+                        title: 'Untitled session',
+                        date: fallbackDate,
+                        durationMinutes: stats.duration,
+                        turns: stats.turns,
+                        linesOfCode: stats.loc,
+                        status: 'draft',
+                        projectName: proj.name,
+                        rawLog: [],
+                        skills: stats.skills,
+                        source: meta.source,
+                        childCount,
+                        children: childCount > 0 ? children : undefined,
+                    };
                 }
             }));
-            res.json({ sessions: sessions.filter(Boolean) });
+            res.json({ sessions: sessions.filter((s) => s.date) });
         }
         catch (err) {
             res.status(500).json({ error: { code: 'LIST_FAILED', message: err.message } });
@@ -254,13 +435,14 @@ export function createApp(sessionsBasePath) {
                 return;
             }
             const session = await loadSession(meta.path, proj.name, meta.sessionId);
-            // Fully parse and attach child sessions
-            const childSessions = await bridgeChildSessions(meta, proj.name);
-            const aggregated = childSessions.length > 0 ? aggregateChildStats(childSessions) : undefined;
+            // Fully parse child sessions and map to canonical AgentChild shape
+            const parsedChildren = await bridgeChildSessions(meta, proj.name);
+            const children = parsedChildren.map(toAgentChild);
+            const aggregated = children.length > 0 ? aggregateChildStats(parsedChildren) : undefined;
             res.json({
                 session: {
                     ...session,
-                    ...(childSessions.length > 0 ? { childSessions, isOrchestrated: true } : {}),
+                    ...(children.length > 0 ? { children, isOrchestrated: true } : {}),
                     ...(aggregated ? { aggregatedStats: aggregated } : {}),
                 },
             });
@@ -336,28 +518,36 @@ export function createApp(sessionsBasePath) {
                 res.status(404).json({ error: { code: 'PROJECT_NOT_FOUND', message: 'Project not found' } });
                 return;
             }
-            // Derive the project filesystem path from the dirName.
-            // Claude Code encodes "/Users/ben/Dev/heyi-am" as "-Users-ben-Dev-heyi-am"
-            // (replaces "/" with "-"). Reverse: replace leading "-" with "/".
-            const projectPath = proj.dirName.replace(/^-/, '/').replace(/-/g, '/');
+            // C2: The dirName encoding is lossy (both / and . become -), so we
+            // can't decode it back to the original path. Instead, find the real
+            // path by checking session cwd fields from parsed sessions.
+            let projectPath = null;
+            for (const meta of proj.sessions) {
+                try {
+                    const parsed = await loadSession(meta.path, proj.name, meta.sessionId);
+                    if (parsed.cwd) {
+                        projectPath = parsed.cwd;
+                        break;
+                    }
+                }
+                catch { /* skip unparseable sessions */ }
+            }
             let remoteUrl = null;
-            try {
-                // Use execFileSync to avoid shell injection — fixed args, no interpolation
-                const raw = execFileSync('git', ['-C', projectPath, 'remote', 'get-url', 'origin'], {
-                    timeout: 5000,
-                    encoding: 'utf-8',
-                    stdio: ['pipe', 'pipe', 'pipe'],
-                }).trim();
-                // Clean the URL:
-                // git@github.com:user/repo.git → github.com/user/repo
-                // https://github.com/user/repo.git → github.com/user/repo
-                remoteUrl = raw
-                    .replace(/\.git$/, '')
-                    .replace(/^git@([^:]+):/, '$1/')
-                    .replace(/^https?:\/\//, '');
-            }
-            catch {
-                // No git remote or not a git repo — return null
+            if (projectPath) {
+                try {
+                    const raw = execFileSync('git', ['-C', projectPath, 'remote', 'get-url', 'origin'], {
+                        timeout: 5000,
+                        encoding: 'utf-8',
+                        stdio: ['pipe', 'pipe', 'pipe'],
+                    }).trim();
+                    remoteUrl = raw
+                        .replace(/\.git$/, '')
+                        .replace(/^git@([^:]+):/, '$1/')
+                        .replace(/^https?:\/\//, '');
+                }
+                catch {
+                    // No git remote or not a git repo — return null
+                }
             }
             res.json({ url: remoteUrl });
         }
@@ -680,6 +870,105 @@ export function createApp(sessionsBasePath) {
             res.status(500).json({ error: { code: 'CACHE_READ_FAILED', message: err.message } });
         }
     });
+    // Upload screenshot manually (base64 image from browser)
+    app.post('/api/projects/:project/screenshot-upload', async (req, res) => {
+        const { project } = req.params;
+        const auth = getAuthToken();
+        if (!auth) {
+            res.status(401).json({ error: 'Auth required' });
+            return;
+        }
+        const { image, slug } = req.body;
+        if (!image) {
+            res.status(400).json({ error: 'No image data' });
+            return;
+        }
+        const projectSlug = slug || String(project);
+        try {
+            // image is "data:image/png;base64,..." or raw base64
+            const base64 = image.includes(',') ? image.split(',')[1] : image;
+            const buffer = Buffer.from(base64, 'base64');
+            const ext = image.startsWith('data:image/jpeg') || image.startsWith('data:image/jpg') ? 'jpg' : 'png';
+            // Get presigned PUT URL
+            const ssUrlRes = await fetch(`${API_URL}/api/projects/${projectSlug}/screenshot-url`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${auth.token}` },
+                body: JSON.stringify({ ext }),
+            });
+            if (!ssUrlRes.ok) {
+                res.status(502).json({ error: 'Presign failed' });
+                return;
+            }
+            const { upload_url, key } = await ssUrlRes.json();
+            // Upload to S3
+            await fetch(upload_url, {
+                method: 'PUT',
+                body: buffer,
+                headers: { 'Content-Type': `image/${ext}` },
+            });
+            // Update screenshot key in DB
+            await fetch(`${API_URL}/api/projects/${projectSlug}/screenshot-key`, {
+                method: 'PATCH',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${auth.token}` },
+                body: JSON.stringify({ key }),
+            });
+            res.json({ ok: true, key });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    // Auto-capture screenshot from URL using headless Chrome
+    app.post('/api/projects/:project/screenshot-capture', async (req, res) => {
+        const { project } = req.params;
+        const auth = getAuthToken();
+        if (!auth) {
+            res.status(401).json({ error: 'Auth required' });
+            return;
+        }
+        const { url, slug } = req.body;
+        if (!url) {
+            res.status(400).json({ error: 'No URL provided' });
+            return;
+        }
+        const projectSlug = slug || String(project);
+        try {
+            const screenshotPath = await captureScreenshot(url, projectSlug);
+            if (!screenshotPath) {
+                res.status(422).json({ error: 'Chrome not available or capture failed' });
+                return;
+            }
+            // Get presigned PUT URL
+            const ssUrlRes = await fetch(`${API_URL}/api/projects/${projectSlug}/screenshot-url`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${auth.token}` },
+                body: JSON.stringify({ ext: 'png' }),
+            });
+            if (!ssUrlRes.ok) {
+                res.status(502).json({ error: 'Presign failed' });
+                return;
+            }
+            const { upload_url, key } = await ssUrlRes.json();
+            const imageData = readFileSync(screenshotPath);
+            await fetch(upload_url, {
+                method: 'PUT',
+                body: imageData,
+                headers: { 'Content-Type': 'image/png' },
+            });
+            // Update screenshot key
+            await fetch(`${API_URL}/api/projects/${projectSlug}/screenshot-key`, {
+                method: 'PATCH',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${auth.token}` },
+                body: JSON.stringify({ key }),
+            });
+            // Return the screenshot as base64 for preview
+            const base64 = imageData.toString('base64');
+            res.json({ ok: true, key, preview: `data:image/png;base64,${base64}` });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
     // Publish project — SSE stream with per-session progress
     app.post('/api/projects/:project/publish', async (req, res) => {
         const { project } = req.params;
@@ -688,7 +977,7 @@ export function createApp(sessionsBasePath) {
             res.status(401).json({ error: { message: 'Authentication required' } });
             return;
         }
-        const { title, slug, narrative, repoUrl, projectUrl, timeline, skills, totalSessions, totalLoc, totalDurationMinutes, totalFilesChanged, skippedSessions, selectedSessionIds, } = req.body;
+        const { title, slug, narrative, repoUrl, projectUrl, timeline, skills, totalSessions, totalLoc, totalDurationMinutes, totalAgentDurationMinutes, totalFilesChanged, skippedSessions, selectedSessionIds, } = req.body;
         // Set up SSE
         res.writeHead(200, {
             'Content-Type': 'text/event-stream',
@@ -716,6 +1005,7 @@ export function createApp(sessionsBasePath) {
                         total_sessions: totalSessions,
                         total_loc: totalLoc,
                         total_duration_minutes: totalDurationMinutes,
+                        total_agent_duration_minutes: totalAgentDurationMinutes || null,
                         total_files_changed: totalFilesChanged,
                         skipped_sessions: skippedSessions,
                     },
@@ -733,6 +1023,52 @@ export function createApp(sessionsBasePath) {
             }
             const projectData = await projectRes.json();
             send({ type: 'project', status: 'created', projectId: projectData.project_id, slug: projectData.slug });
+            // Step 1b: Auto-capture and upload screenshot from project URL (non-fatal)
+            if (projectUrl) {
+                try {
+                    send({ type: 'screenshot', status: 'capturing' });
+                    const screenshotPath = await captureScreenshot(projectUrl, projectData.slug);
+                    if (screenshotPath) {
+                        // Get presigned PUT URL from Phoenix
+                        const ssUrlRes = await fetch(`${API_URL}/api/projects/${projectData.slug}/screenshot-url`, {
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/json',
+                                Authorization: `Bearer ${auth.token}`,
+                            },
+                            body: JSON.stringify({ ext: 'png' }),
+                        });
+                        if (ssUrlRes.ok) {
+                            const { upload_url, key } = await ssUrlRes.json();
+                            const imageData = readFileSync(screenshotPath);
+                            await fetch(upload_url, {
+                                method: 'PUT',
+                                body: imageData,
+                                headers: { 'Content-Type': 'image/png' },
+                            });
+                            // Update the project's screenshot_key
+                            await fetch(`${API_URL}/api/projects/${projectData.slug}/screenshot-key`, {
+                                method: 'PATCH',
+                                headers: {
+                                    'Content-Type': 'application/json',
+                                    Authorization: `Bearer ${auth.token}`,
+                                },
+                                body: JSON.stringify({ key }),
+                            });
+                            send({ type: 'screenshot', status: 'uploaded' });
+                        }
+                        else {
+                            send({ type: 'screenshot', status: 'skipped', reason: 'presign failed' });
+                        }
+                    }
+                    else {
+                        send({ type: 'screenshot', status: 'skipped', reason: 'Chrome not available' });
+                    }
+                }
+                catch {
+                    send({ type: 'screenshot', status: 'skipped', reason: 'capture failed' });
+                }
+            }
             // Step 2: Publish selected sessions (non-fatal per session)
             const projects = await getProjects(sessionsBasePath);
             const proj = projects.find((p) => p.dirName === project);
@@ -770,11 +1106,15 @@ export function createApp(sessionsBasePath) {
                             }
                             return agents.length > 0 ? { is_orchestrated: true, agents } : null;
                         })();
+                        // M3: narrative and dev_take are distinct values
+                        // M4: truncate dev_take to Phoenix's 2000-char limit
+                        const devTake = (enhanced?.developerTake ?? session.developerTake ?? '').slice(0, 2000);
+                        const narrative = enhanced?.narrative ?? '';
                         // POST body: scalar/aggregate fields only
                         const sessionPayload = {
                             session: {
                                 title: enhanced?.title ?? session.title,
-                                dev_take: enhanced?.developerTake ?? session.developerTake ?? '',
+                                dev_take: devTake,
                                 context: enhanced?.context ?? '',
                                 duration_minutes: session.durationMinutes ?? 0,
                                 turns: session.turns ?? 0,
@@ -788,31 +1128,30 @@ export function createApp(sessionsBasePath) {
                                 language: null,
                                 tools: session.toolBreakdown?.map((t) => t.tool) ?? [],
                                 skills: enhanced?.skills ?? session.skills ?? [],
-                                narrative: enhanced?.developerTake ?? '',
+                                narrative,
                                 project_name: proj.name,
                                 project_id: projectData.project_id,
                                 slug: sessionSlug,
                                 status: 'listed',
                                 source_tool: session.source ?? meta.source ?? 'claude',
+                                agent_summary: agentSummary,
                             },
                         };
                         // session.json: full data including visualization fields for S3
-                        // session.json uses camelCase keys matching the @heyiam/ui Session type
-                        // so React islands can consume it directly without transformation
+                        // M1: Use consistent snake_case keys so Phoenix doesn't need dual-variant normalization
+                        // M5: Use sessionId (CLI's local UUID), not the slug
                         const sessionData = {
                             version: 1,
-                            id: sessionSlug,
+                            id: sessionId,
                             title: enhanced?.title ?? session.title,
-                            devTake: enhanced?.developerTake ?? session.developerTake ?? '',
+                            dev_take: devTake,
                             context: enhanced?.context ?? '',
-                            durationMinutes: session.durationMinutes ?? 0,
+                            duration_minutes: session.durationMinutes ?? 0,
                             turns: session.turns ?? 0,
-                            filesChanged: (session.filesChanged ?? []).slice(0, 20).map((f) => (typeof f === 'string' ? { path: f, additions: 0, deletions: 0 } : f)),
-                            linesOfCode: session.linesOfCode ?? 0,
+                            files_changed: (session.filesChanged ?? []).slice(0, 20).map((f) => (typeof f === 'string' ? { path: f, additions: 0, deletions: 0 } : f)),
+                            loc_changed: session.linesOfCode ?? 0,
                             date: session.date ? new Date(session.date).toISOString() : new Date().toISOString(),
-                            // Only use wall-clock endTime when reasonable (≤ 3x active time)
-                            // Overnight sessions span 20+ hours which breaks timeline clustering
-                            endTime: (() => {
+                            end_time: (() => {
                                 if (!session.endTime || !session.date)
                                     return null;
                                 const wallMs = new Date(session.endTime).getTime() - new Date(session.date).getTime();
@@ -820,37 +1159,38 @@ export function createApp(sessionsBasePath) {
                                 return wallMs <= activeMs * 3 ? new Date(session.endTime).toISOString() : null;
                             })(),
                             cwd: session.cwd ?? null,
-                            wallClockMinutes: session.wallClockMinutes ?? null,
+                            wall_clock_minutes: session.wallClockMinutes ?? null,
                             template: 'editorial',
                             skills: enhanced?.skills ?? session.skills ?? [],
                             tools: session.toolBreakdown?.map((t) => t.tool) ?? [],
                             source: session.source ?? meta.source ?? 'claude',
                             slug: sessionSlug,
-                            projectName: proj.name,
-                            narrative: enhanced?.developerTake ?? '',
+                            project_name: proj.name,
+                            narrative,
                             status: 'listed',
-                            rawLog: [],
-                            executionPath: (enhanced?.executionSteps ?? session.executionPath ?? []).map((s, i) => ({
-                                stepNumber: i + 1,
-                                title: s.title,
-                                description: 'body' in s ? s.body : ('description' in s ? s.description : ''),
+                            raw_log: [],
+                            // M2: normalize execution_path steps to {label, description}
+                            execution_path: (enhanced?.executionSteps ?? session.executionPath ?? []).map((s, i) => ({
+                                label: s.title ?? `Step ${i + 1}`,
+                                description: s.description ?? s.body ?? '',
                             })),
-                            qaPairs: enhanced?.qaPairs ?? session.qaPairs ?? [],
+                            qa_pairs: enhanced?.qaPairs ?? session.qaPairs ?? [],
                             highlights: [],
-                            toolBreakdown: (session.toolBreakdown ?? []).map((t) => ({ tool: t.tool, count: t.count })),
-                            topFiles: (session.filesChanged ?? []).slice(0, 20).map((f) => (typeof f === 'string' ? { path: f, additions: 0, deletions: 0 } : f)),
-                            turnTimeline: (session.turnTimeline ?? []).map((t) => ({
+                            tool_breakdown: (session.toolBreakdown ?? []).map((t) => ({ tool: t.tool, count: t.count })),
+                            top_files: (session.filesChanged ?? []).slice(0, 20).map((f) => (typeof f === 'string' ? { path: f, additions: 0, deletions: 0 } : f)),
+                            turn_timeline: (session.turnTimeline ?? []).map((t) => ({
                                 timestamp: t.timestamp,
                                 type: t.type,
                                 content: (t.content ?? '').slice(0, 200),
                                 tools: t.tools ?? [],
                             })),
-                            transcriptExcerpt: (session.rawLog ?? []).slice(0, 10).map((line, i) => {
+                            // M6: Keep tool prefixes in transcript — they're informative
+                            transcript_excerpt: (session.rawLog ?? []).slice(0, 10).map((line, i) => {
                                 const role = line.startsWith('> ') ? 'dev' : 'ai';
-                                const text = role === 'dev' ? line.slice(2) : line.replace(/^\[AI\] |^\[TOOL\] /, '');
+                                const text = role === 'dev' ? line.slice(2) : line;
                                 return { role, id: `Turn ${i + 1}`, text, timestamp: null };
                             }),
-                            agentSummary: agentSummary,
+                            agent_summary: agentSummary,
                             children: agentSummary?.agents?.map((a) => ({
                                 sessionId: a.role,
                                 role: a.role,
@@ -858,13 +1198,23 @@ export function createApp(sessionsBasePath) {
                                 linesOfCode: a.loc_changed,
                             })) ?? [],
                         };
+                        // Redact secrets & PII, strip home directory paths before publishing
+                        const sessionCwd = session.cwd ?? undefined;
+                        const redactedPayload = redactSession(sessionPayload, 'high', sessionCwd);
+                        const redactedData = redactSession(sessionData, 'high', sessionCwd);
+                        // Warn about redacted content in CLI output
+                        const payloadFindings = scanTextSync(JSON.stringify(sessionPayload));
+                        if (payloadFindings.length > 0) {
+                            const summary = formatFindings(payloadFindings);
+                            send({ type: 'redaction', sessionId, message: summary });
+                        }
                         const sessionRes = await fetch(`${API_URL}/api/sessions`, {
                             method: 'POST',
                             headers: {
                                 'Content-Type': 'application/json',
                                 Authorization: `Bearer ${auth.token}`,
                             },
-                            body: JSON.stringify(sessionPayload),
+                            body: JSON.stringify(redactedPayload),
                         });
                         if (sessionRes.ok) {
                             uploadedCount++;
@@ -875,14 +1225,21 @@ export function createApp(sessionsBasePath) {
                                     const { raw: rawUrl, log: logUrl } = sesData.upload_urls;
                                     if (rawUrl && meta.path && !meta.path.startsWith('cursor://')) {
                                         try {
-                                            const rawBody = readFileSync(meta.path);
-                                            await fetch(rawUrl, { method: 'PUT', body: rawBody, headers: { 'Content-Type': 'application/octet-stream' } });
+                                            const rawText = readFileSync(meta.path, 'utf-8');
+                                            let redactedRaw = redactText(rawText);
+                                            redactedRaw = stripHomePathsInText(redactedRaw, sessionCwd);
+                                            await fetch(rawUrl, { method: 'PUT', body: Buffer.from(redactedRaw, 'utf-8'), headers: { 'Content-Type': 'application/octet-stream' } });
                                         }
                                         catch { /* S3 upload is best-effort */ }
                                     }
                                     if (logUrl && session.rawLog && session.rawLog.length > 0) {
                                         try {
-                                            await fetch(logUrl, { method: 'PUT', body: JSON.stringify(session.rawLog), headers: { 'Content-Type': 'application/json' } });
+                                            const redactedLog = session.rawLog.map((line) => {
+                                                let cleaned = redactText(line);
+                                                cleaned = stripHomePathsInText(cleaned, sessionCwd);
+                                                return cleaned;
+                                            });
+                                            await fetch(logUrl, { method: 'PUT', body: JSON.stringify(redactedLog), headers: { 'Content-Type': 'application/json' } });
                                         }
                                         catch { /* S3 upload is best-effort */ }
                                     }
@@ -890,7 +1247,7 @@ export function createApp(sessionsBasePath) {
                                         try {
                                             await fetch(sesData.upload_urls.session, {
                                                 method: 'PUT',
-                                                body: JSON.stringify(sessionData),
+                                                body: JSON.stringify(redactedData),
                                                 headers: { 'Content-Type': 'application/json' },
                                             });
                                         }