honestweek 0.2.0 → 0.3.0

package/lib/replay/index.mjs

@@ -20,7 +20,7 @@ import { AGENT_ADDRESS_RE } from '../redaction-patterns.mjs';
 import { attributionRoots } from '../worktrees.mjs';
 import { localDateRangeInstants } from '../resolve-week.mjs';
 import { hostTimezone } from '../config.mjs';
-import { assemble, compareEvents } from './assemble.mjs';
+import { assemble, compareEvents, threadsOf } from './assemble.mjs';
 import { parseClaudeSource } from './claude.mjs';
 import { codexOrigin, parseCodexSource } from './codex.mjs';
 import { isBuiltinToolName, LOOKUP_RULES, RULES, UPDATE_RULES } from './classify.mjs';
@@ -35,6 +35,7 @@ import { collapse, createWatch, LIMITS, redactClip, redactThenCut } from './pars
 import { defaultRoots, enumerateClaudeSources, enumerateCodexSources } from './sources.mjs';
 import { buildTimeline } from './timeline.mjs';
 import { createViews } from './views.mjs';
+import { exportSession, fileFingerprint, honestweekVersion, idHash, labelHash, logIdHash, redactionPrint, restoreSaved, SAVED_SESSION_SCHEMA, savedAsParsed, tokenHash } from './saved-sessions.mjs';
 
 export { parseLookup } from './lookup.mjs';
 
@@ -49,8 +50,9 @@ export const HISTORY_SCHEMA_VERSION = 1;
  *   scope      'configured' (default) or 'all'
  *   quietMs    shortest gap reported as a quiet interval (default 20 minutes)
  *   git        false skips the git outcome lookups (tests of parsing alone)
- *   signal     an optional { aborted } checked between files and before any git read: once
- *              aborted, the build stops with an error and runs no git at all
+ *   signal     an optional { aborted } checked between files, before any git read, and once
+ *              more after reading Codex's thread names: once aborted, the build stops with an
+ *              error at the next check and runs no more git (none at all if it hadn't begun)
  *   goals      an optional goal record, { goals: [{ id, title, state?, source?,
  *              observations?, results?, decisions? }], events?: [{ eventId, goalId,
  *              type, at }] }. With it, the history gains `goals` (which sessions did
@@ -101,8 +103,23 @@ export const HISTORY_SCHEMA_VERSION = 1;
  *              sessions get none, and spans, quiet intervals and end states read as without
  *              it. Only `honestweek view` asks for it, for its own screen. Without it the
  *              history doesn't change.
+ *   saved      sessions an earlier run saved (lib/replay/saved-sessions.mjs), each with
+ *              `savedAt`, `version`, `redaction` (the private-word settings' fingerprint) and
+ *              `log` ('gone' when none of its log files is on disk). One saved by this version
+ *              with this config's private words would come out of the redactor unchanged, so it
+ *              isn't redacted again; any other is:
+ *              each one the build doesn't read from a log joins the history as if it had, with
+ *              `saved: { at, by, log }` on its session record. Its steps can't be checked against
+ *              their log lines. Without it the history doesn't change.
+ *   saving     true for a redacted build whose sessions will be saved: the history gains
+ *              exportSession(key), not enumerable, so no output changes.
+ *   reuse      keys of sessions in `saved` whose logs are on disk and unchanged since they were
+ *              saved: each comes back from `saved` instead of being read again, its steps still
+ *              checked against its log lines. One that may have launched a session this build
+ *              reads (it was running in the two minutes before) is read after all, since the
+ *              launch is matched by a command's text, which isn't saved.
  */
-export async function buildWorkHistory({ config, from, to, timezone, roots, scope = 'configured', quietMs, git = true, goals: goalInput, privateText = false, hiddenSessions = 'skeleton', usage = false, keepRaw = false, updates = false, signal = null, onProgress = null } = {}) {
+export async function buildWorkHistory({ config, from, to, timezone, roots, scope = 'configured', quietMs, git = true, goals: goalInput, privateText = false, hiddenSessions = 'skeleton', usage = false, keepRaw = false, updates = false, signal = null, onProgress = null, saved = null, saving = false, reuse = null } = {}) {
   if (!config?.identity) throw new Error('replay: a normalized config is required.');
   if (hiddenSessions !== 'skeleton' && hiddenSessions !== 'redacted') throw new Error(`replay: hiddenSessions is 'skeleton' or 'redacted', not ${JSON.stringify(hiddenSessions)}.`);
   // Private sessions keep their content: on this screen only (privateText), or redacted.
@@ -147,7 +164,42 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
   // One file reachable through two roots (overlapping or repeated roots) is one source.
   const seenKeys = new Set();
   const all = [...claude.sources, ...codex.sources].filter((s) => !seenKeys.has(s.key) && seenKeys.add(s.key));
+  // Saved sessions (lib/replay/saved-sessions.mjs): each one this build doesn't read from a log
+  // comes back with its strings redacted again with this build's settings; its step facts pass
+  // the backstop below with everything else.
+  let savedList = [];
+  // Sessions given back unchanged rather than read again: only ones `saved` holds.
+  // A session with a log file its saved copy doesn't name (a sub-agent or child thread that came
+  // later) has changed, and is read.
+  const reusable = new Set();
+  // A build that shows private text reads every log: a saved copy is redacted.
+  if (Array.isArray(saved) && reuse && privateText !== true) {
+    const wanted = new Set(reuse);
+    const onDisk = new Map();
+    for (const s of all) onDisk.set(s.sessionKey, [...(onDisk.get(s.sessionKey) ?? []), s.key]);
+    for (const x of saved) {
+      if (!x || typeof x.key !== 'string' || !wanted.has(x.key) || !Array.isArray(x.sources)) continue;
+      const savedKeys = new Set(x.sources.map((s) => s.key));
+      if ((onDisk.get(x.key) ?? []).every((k) => savedKeys.has(k))) reusable.add(x.key);
+    }
+  }
+  if (Array.isArray(saved) && saved.length) {
+    const readKeys = new Set(all.filter((s) => !reusable.has(s.sessionKey)).map((s) => s.sessionKey));
+    const print = redactionPrint(config);
+    const sameRedaction = (x) => x.version === honestweekVersion() && typeof x.redaction === 'string' && x.redaction === print;
+    const deepSaved = (x) => ({ ...deep({ ...x, events: [] }), events: x.events.map((e) => ({ ...deep({ ...e, facts: null }), facts: e.facts ?? {} })) });
+    for (const x of saved) {
+      if (x?.schema !== SAVED_SESSION_SCHEMA || typeof x.key !== 'string' || !Array.isArray(x.events) || !Array.isArray(x.sources) || readKeys.has(x.key) || savedList.some((y) => y.key === x.key)) continue;
+      // One saved by this version with these private words would come out of the redactor the same,
+      // so it isn't passed through it again; any other is.
+      savedList.push(sameRedaction(x) ? { ...x, redacted: true } : { ...deepSaved(x), redacted: false });
+    }
+  }
+  // With saved sessions in the build, ids two sessions share are compared as the hashes saved.
+  let hashIds = savedList.length > 0;
+  const repoOfSaved = (x) => (x.repo?.label ? config.repos.find((c) => labelHash(c.label) === x.repo.label) ?? null : null);
   const sessionRepo = new Map();
+  for (const x of savedList) sessionRepo.set(x.key, repoOfSaved(x));
   for (const s of all) {
     if (s.role !== 'session') continue;
     sessionRepo.set(s.sessionKey, matchRepo(s.cwd, config));
@@ -161,8 +213,12 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
     return true;
   });
   keep.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+  // The sources of sessions given back unchanged are set aside, unread; their files stay known, so
+  // a step is still checked against its log line.
+  const setAside = keep.filter((s) => reusable.has(s.sessionKey));
+  if (setAside.length) for (let i = keep.length - 1; i >= 0; i -= 1) if (reusable.has(keep[i].sessionKey)) keep.splice(i, 1);
 
-  const files = new Map(keep.map((s) => [s.key, s.file]));
+  const files = new Map([...keep, ...setAside].map((s) => [s.key, s.file]));
   const privateSources = new Set();
   // Sources whose content is cut to a skeleton: the private ones, unless privateText or
   // hiddenSessions 'redacted' keeps it.
@@ -178,7 +234,11 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
     }
   };
   progress(0);
-  for (const s of keep) {
+  // Each log file's fingerprint as it was before this build read it, for a session to be saved
+  // with: one that grows while the build runs then reads as changed next time, not as saved.
+  const readPrints = new Map();
+  const readSource = async (s) => {
+    if (saving === true) readPrints.set(s.file, fileFingerprint(s.file));
     const repo = sessionRepo.get(s.sessionKey) ?? null;
     const isPrivate = !repo || repo.role === 'display';
     if (isPrivate) privateSources.add(s.key);
@@ -207,12 +267,87 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
     }
     parsed.push({ source: s, ctx, result });
     progress(parsed.length);
+  };
+  for (const s of keep) {
+    await readSource(s);
     if (signal?.aborted) break;
   }
-  // Everything from here on runs without a pause, so this is the last point a stop can land.
+  // A session a program started is matched to the step that launched it by that step's command,
+  // which a saved session doesn't keep. A session given back unchanged that was running in the two
+  // minutes before one this build read began is read from its log after all.
+  if (setAside.length && !signal?.aborted) {
+    const starts = parsed.filter((q) => q.source.role === 'session' && q.result.joins?.programStart).map((q) => Date.parse(q.result.stats.firstAt ?? '')).filter(Number.isFinite);
+    const pull = new Set();
+    for (const x of savedList) {
+      if (!reusable.has(x.key)) continue;
+      const first = Date.parse(x.record?.firstAt ?? '');
+      const last = Date.parse(x.record?.lastAt ?? x.record?.firstAt ?? '');
+      if (starts.some((t0) => Number.isFinite(first) && first <= t0 + LAUNCH_SLACK_MS && (Number.isFinite(last) ? last : first) >= t0 - LAUNCH_LOOKBACK_MS)) pull.add(x.key);
+    }
+    for (const s of setAside) if (pull.has(s.sessionKey)) await readSource(s);
+    if (pull.size) {
+      savedList = savedList.filter((x) => !pull.has(x.key));
+      // With none left, the shared ids aren't hashed after all, and the sessions saved from this
+      // build say so.
+      hashIds = savedList.length > 0;
+    }
+  }
+  if (savedList.length) {
+    const savedSlugs = new Map();
+    // The goal ids and goal-event ids a saved session's text named, by their hashes.
+    const tokens = new Map([...(goalRecord?.entries ?? []).map((x) => x.eventId), ...(goalRecord?.goals ?? []).map((g) => g.id)].map((x) => [tokenHash(x), x]));
+    for (const x of savedList) {
+      const repo = sessionRepo.get(x.key) ?? null;
+      if (!repo && scope !== 'all') {
+        skipped.outsideConfiguredRepos += 1;
+        continue;
+      }
+      const isPrivate = !repo || repo.role === 'display';
+      const entries = savedAsParsed(x, {
+        resolveToken: (h) => (isPrivate ? null : tokens.get(h) ?? null),
+        // The session's repository's name on GitHub, read from git only for one git may read.
+        // Asked once per repository in a build, however many saved sessions name its pull requests.
+        repoSlug: () => {
+          if (!git || !repo || repo.role === 'display') return null;
+          if (!savedSlugs.has(repo.label)) {
+            let slug = null;
+            try {
+              slug = originSlug(repo.resolvedPath ?? repo.path);
+            } catch {
+              slug = null;
+            }
+            savedSlugs.set(repo.label, slug);
+          }
+          return savedSlugs.get(repo.label);
+        },
+        ctxOf: (source, s) => ({ redact, isPrivate, privateText: privateText === true, hiddenSessions, usage: usage === true, keepRaw: false, updates: updates === true, cwd: null, repo: repo ? { label: repo.label, role: repo.role, path: repo.resolvedPath ?? repo.path } : null, agentKey: s.agent ?? (source.role === 'session' ? `${source.key}:main` : source.key), sidechainAgentKey: null, parentAgentKey: null, watch: null }),
+      });
+      for (const e of entries) {
+        if (isPrivate) privateSources.add(e.source.key);
+        if (x.log !== 'gone' && files.has(e.source.key)) e.source.file = files.get(e.source.key);
+        parsed.push(e);
+      }
+    }
+    // In the order a build that read every one of them would have.
+    parsed.sort((x, y) => (x.source.key < y.source.key ? -1 : x.source.key > y.source.key ? 1 : 0));
+    for (const q of parsed) {
+      if (q.source.saved) continue;
+      const j = q.result.joins ?? {};
+      for (const u of j.uuids ?? []) u.uuid = idHash(u.uuid);
+      for (const m of [...(j.sentMessages ?? []), ...(j.receivedMessages ?? [])]) m.msgId = idHash(m.msgId);
+    }
+  }
+  // A stop lands here, before git is read, and once more after reading Codex's thread names,
+  // the one pause left: everything after that runs without one.
   if (signal?.aborted) throw Object.assign(new Error('replay: the build was stopped.'), { code: 'ABORTED' });
 
   const a = assemble({ parsed, quietMs });
+  if (savedList.length) {
+    restoreSaved(a, savedList.filter((x) => a.sessionsByKey.has(x.key)));
+    // A link between sessions that came back as saved can join threads assembly kept apart.
+    a.threads = threadsOf(a.sessionsByKey, a.links, new Map(parsed.map((p) => [p.source.key, p.source.sessionKey])));
+  }
+  const savedOf = new Map(savedList.map((x) => [x.key, x]));
 
   // Git: only for sessions in featured or reference repos.
   let gitPart = { events: [], sources: [], notes: [] };
@@ -232,6 +367,7 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
   // redacted one by one where it was read (lib/replay/codex.mjs), so the home-path rule doesn't
   // take it here.
   const codexSources = new Set(parsed.filter((p) => p.source.tool === 'codex').map((p) => p.source.key));
+  const alreadyRedacted = new Set(savedList.filter((x) => x.redacted === true).flatMap((x) => x.sources.map((s) => s.key)));
   for (const e of a.events) {
     if (hiddenSources.has(e.source)) {
       e.facts = pick(e.facts, PRIVATE_FACTS);
@@ -248,7 +384,7 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
       for (const key of PRIVATE_HASHES) delete e.facts[key];
     }
     const addresses = codexSources.has(e.source) ? ADDRESS_FACTS.filter((k) => typeof e.facts[k] === 'string' && AGENT_ADDRESS_RE.test(e.facts[k])).map((k) => [k, e.facts[k]]) : [];
-    e.facts = deep(e.facts);
+    if (!alreadyRedacted.has(e.source)) e.facts = deep(e.facts);
     for (const [k, v] of addresses) e.facts[k] = v;
   }
   // The progress-update rule labels events only with the updates option.
@@ -267,7 +403,9 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
 
   // Sessions and agents as plain records.
   const codexNames = await codexThreadNames(r.codex ?? [], new Set(parsed.filter((p) => p.source.tool === 'codex' && p.source.role === 'session').map((p) => p.source.threadId)));
+  if (signal?.aborted) throw Object.assign(new Error('replay: the build was stopped.'), { code: 'ABORTED' });
   const titleOf = (sessKey) => {
+    if (savedOf.has(sessKey)) return savedOf.get(sessKey).record?.title ?? null;
     const main = parsed.find((p) => p.source.key === sessKey);
     if (main?.source.tool === 'codex') return redactClip(codexNames.get(main.source.threadId) ?? null, SHORT, redact);
     const titles = main?.result.stats.titles ?? [];
@@ -294,6 +432,8 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
       repoRole: s.repo?.role ?? null,
       private: s.isPrivate,
       title: s.isPrivate && !showHidden ? null : titleOf(s.key),
+      // A session that came back as saved says when, by which version, and whether its log is gone.
+      ...(savedOf.has(s.key) && savedOf.get(s.key).log === 'gone' ? { saved: savedMeta(savedOf.get(s.key)) } : {}),
       firstAt: s.firstAt ?? null,
       lastAt: s.lastAt ?? null,
       endState: s.endState ?? 'no-work-records',
@@ -351,7 +491,7 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
   };
   if (privateText === true) h.privateText = true;
   if (hiddenSessions === 'redacted') h.hiddenSessions = 'redacted';
-  if (usage === true) h.usage = { calls: usageCalls(parsed) };
+  if (usage === true) h.usage = { calls: usageCalls(parsed, { hashIds: hashIds || saving === true }) };
   const views = createViews(h);
 
   // Goal membership and reverse lookup read the raw joins the adapters kept (moved onto
@@ -425,6 +565,15 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
       const id = p.source.fileId ?? p.source.threadId;
       if (typeof id === 'string' && id) harnessIds.set(id.toLowerCase(), p.source.sessionKey);
     }
+    // A saved session's own id is saved only as a hash: the goal list's own words are hashed to
+    // find the ones that cite it.
+    const savedIds = new Map(savedList.filter((x) => x.logId && readable.has(x.key)).map((x) => [x.logId, x.key]));
+    if (savedIds.size) {
+      for (const word of new Set(JSON.stringify(goalInput).match(/[0-9A-Za-z][0-9A-Za-z_-]{7,}/g) ?? [])) {
+        const key = savedIds.get(logIdHash(word));
+        if (key && !harnessIds.has(word.toLowerCase())) harnessIds.set(word.toLowerCase(), key);
+      }
+    }
     const found = goalMembership({ record: goalRecord, index: refIndex(), watched: liveJoins('watched'), harnessIds, readable, firstAtOf, window: h.window, redact: redactor.redact });
     h.goals = redactor.deepRedact(found);
     goalByRawId = new Map(goalRecord.goals.map((g, i) => [g.id, h.goals[i]]));
@@ -462,6 +611,7 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
 
   // Each event by its id, built on the first record() call, so a lookup doesn't scan every
   // event. The first event with an id wins, as a search from the front would find it.
+  const savedSourceSession = new Map(savedList.flatMap((x) => x.sources.map((s) => [s.key, x.key])));
   let eventById = null;
   /** Re-read the original record behind a reference and check its digest. */
   function record(refOrEventId) {
@@ -473,6 +623,7 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
     return refs.map((ref) => {
       if (ref.sha) return { ref, verified: null, note: 'a git object; inspect it with git show', record: null };
       const file = files.get(ref.src);
+      if (!file && savedSourceSession.has(ref.src) && savedOf.get(savedSourceSession.get(ref.src))?.log === 'gone') return { ref, verified: null, note: savedNote(savedOf.get(savedSourceSession.get(ref.src))), record: null, saved: true };
       if (!file) return { ref, verified: false, note: 'source not part of this history', record: null };
       const bytes = readBytesAt(file, ref.off, ref.len);
       if (!bytes) return { ref, verified: false, note: 'the record could not be re-read (file shorter or moved)', record: null };
@@ -520,7 +671,23 @@ export async function buildWorkHistory({ config, from, to, timezone, roots, scop
   // Each Claude Code session's own id (its file's name), by session key, in memory only, so a
   // caller can find files another tool keyed by that id. Not enumerable: no output changes.
   Object.defineProperty(history, 'claudeIds', { value: new Map(parsed.filter((p) => p.source.tool === 'claude-code' && p.source.role === 'session' && typeof p.source.fileId === 'string').map((p) => [p.source.sessionKey, p.source.fileId.toLowerCase()])), enumerable: false });
+  // Each log file this history read, by source key, in memory only, so a caller can tell later
+  // whether a session's log is still on disk (lib/saved/checks.mjs keeps only a hash of the path).
+  Object.defineProperty(history, 'sourceFiles', { value: new Map(files), enumerable: false });
   // The same for each Codex session: its thread id from session_meta, in memory only.
+  // Each saved session's own id, as the hash it was saved under, in memory only.
+  // The sessions that came back unread, their logs unchanged: their saved copies stand as they are.
+  // Each log file's fingerprint from before this build read it (a build made with `saving` only).
+  Object.defineProperty(history, 'sourcePrints', { value: new Map(readPrints), enumerable: false });
+  Object.defineProperty(history, 'reusedSessions', { value: new Set(savedList.filter((x) => reusable.has(x.key)).map((x) => x.key)), enumerable: false });
+  Object.defineProperty(history, 'savedLogIds', { value: new Map(savedList.filter((x) => x.logId).map((x) => [x.key, x.logId])), enumerable: false });
+  if (saving === true && privateText !== true) {
+    const savable = new Set(parsed.filter((p) => !p.source.saved).map((p) => p.source.sessionKey));
+    Object.defineProperty(history, 'exportSession', {
+      value: (key) => (savable.has(key) ? exportSession({ key, parsed, a, sessions, links: h.links, usage: h.usage?.calls ?? [], redact, hashed: hashIds, ranOutside: (e) => typeof e._workdir === 'string' && !workdirInRepo(e.session, e._workdir), fileStat: (f) => readPrints.get(f) ?? null }) : null),
+      enumerable: false,
+    });
+  }
   Object.defineProperty(history, 'codexIds', { value: new Map(parsed.filter((p) => p.source.tool === 'codex' && p.source.role === 'session' && typeof p.source.threadId === 'string').map((p) => [p.source.sessionKey, p.source.threadId.toLowerCase()])), enumerable: false });
   return history;
 }
@@ -641,7 +808,22 @@ async function codexThreadNames(roots, ids) {
   return out;
 }
 
-function usageCalls(parsed) {
+/** How long before a session began, and after, a launch step that started it can sit. */
+const LAUNCH_LOOKBACK_MS = 2 * 60 * 1000;
+const LAUNCH_SLACK_MS = 5000;
+
+/** When and by which version a saved session was saved, and whether its log is gone. */
+function savedMeta(x) {
+  return { at: typeof x.savedAt === 'string' ? x.savedAt : null, by: typeof x.version === 'string' ? x.version : null, log: x.log === 'gone' ? 'gone' : 'on-disk' };
+}
+/** What a saved step's log line says instead of the record. */
+function savedNote(x) {
+  // The day it was saved is on the session's own label, in the page's timezone.
+  const m = x ? savedMeta(x) : { log: 'gone' };
+  return m.log === 'gone' ? "saved from a log that's no longer on disk, so this step can't be checked against its log line" : "saved; this run didn't read its log again";
+}
+
+function usageCalls(parsed, { hashIds = false } = {}) {
   const lastAt = (p) => p.result.stats?.lastAt ?? '';
   const earlier = (p, q) => lastAt(p) < lastAt(q) || (lastAt(p) === lastAt(q) && p.source.key < q.source.key);
   const byThread = new Map(parsed.filter((p) => p.source.tool === 'codex').map((p) => [p.source.threadId, p]));
@@ -671,7 +853,10 @@ function usageCalls(parsed) {
   };
   const keeps = (p, q) => (p.source.tool === 'codex' && depth(p) !== depth(q) ? depth(p) < depth(q) : earlier(p, q));
   const owner = new Map(); // tool, fork family and call id -> the parsed file that keeps it
-  const keyOf = (p, c) => (p.source.tool === 'codex' ? `codex\u0000${family(p)}\u0000${c.id}` : `${p.source.tool}\u0000${c.id}`);
+  // A saved session's call ids are hashes already; with saved sessions in the build, every other
+  // call id is compared as its hash too, so a call two files repeat still counts once.
+  const idOf = (c) => (c.hashed ? c.id : hashIds && c.id != null ? idHash(c.id) : c.id);
+  const keyOf = (p, c) => (p.source.tool === 'codex' ? `codex\u0000${family(p)}\u0000${idOf(c)}` : `${p.source.tool}\u0000${idOf(c)}`);
   for (const p of parsed) {
     for (const c of p.result.usage ?? []) {
       if (c.id == null) continue;
@@ -683,7 +868,10 @@ function usageCalls(parsed) {
   for (const p of parsed) {
     for (const c of p.result.usage ?? []) {
       if (c.id != null && owner.get(keyOf(p, c)) !== p) continue;
-      out.push({ session: p.source.sessionKey, agent: c.agent, source: p.source.key, tool: p.source.tool, lines: [...c.lines].sort((a, b) => a - b), t: c.t, input: c.input, cacheWrite: c.cacheWrite, cacheRead: c.cacheRead, output: c.output, ...(c.ttl ? { ttl: c.ttl } : {}) });
+      const row = { session: p.source.sessionKey, agent: c.agent, source: p.source.key, tool: p.source.tool, lines: [...c.lines].sort((a, b) => a - b), t: c.t, input: c.input, cacheWrite: c.cacheWrite, cacheRead: c.cacheRead, output: c.output, ...(c.ttl ? { ttl: c.ttl } : {}) };
+      // The call's id as it's saved, kept out of the row's own fields so no output changes.
+      if (hashIds && c.id != null) Object.defineProperty(row, 'idHash', { value: idOf(c), enumerable: false });
+      out.push(row);
     }
   }
   return out.sort((a, b) => (a.t ?? 0) - (b.t ?? 0) || (a.source < b.source ? -1 : a.source > b.source ? 1 : a.lines[0] - b.lines[0]));

package/lib/replay/lookup.mjs

@@ -189,11 +189,14 @@ export function createReferenceIndex({ events, readable, joins, repoSlugOf, work
   for (const e of events) {
     if (!readable.has(e.session)) continue;
     const f = e.facts ?? {};
-    if (e.kind === 'action' && f.category === 'shell' && typeof e._command === 'string' && !didNotRun(e)) {
+    // A saved step (lib/replay/saved-sessions.mjs) brings its command's pull requests as they were
+    // read when it was saved, since the command's text isn't kept.
+    const commandRefs = Array.isArray(e._prRefs) ? e._prRefs : typeof e._command === 'string' ? null : undefined;
+    if (e.kind === 'action' && f.category === 'shell' && commandRefs !== undefined && !didNotRun(e)) {
       // A Codex call that ran in a folder outside the session's repository acts on
       // whatever repository that folder holds, which the record doesn't say.
-      const ranOutside = typeof e._workdir === 'string' && !workdirInRepo(e.session, e._workdir);
-      for (const r of prRefsInCommand(e._command)) {
+      const ranOutside = commandRefs ? e._ranOutside === true : typeof e._workdir === 'string' && !workdirInRepo(e.session, e._workdir);
+      for (const r of commandRefs ?? prRefsInCommand(e._command)) {
         if (!r.repoKnown) continue;
         if (!r.repo && ranOutside) continue;
         const slug = r.repo ? repoSlug(r.repo) : repoSlugOf(e.session);