lossless-openclaw-orchestrator 1.2.2 → 1.2.4

package/README.md

@@ -23,7 +23,7 @@ safe action without rereading raw transcripts.
 | Approval-gated boundaries | Dry-run Codex actions and verify matching audit ids before any live control. |
 | OpenClaw/MCP tools | Use the same local-first recall and approval-bounded surfaces from agent workflows. |
 
-[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.2.2.md) · [1.2.1 Notes](docs/RELEASE_NOTES_1.2.1.md) · [1.2.0 Notes](docs/RELEASE_NOTES_1.2.0.md) · [1.1.4 Notes](docs/RELEASE_NOTES_1.1.4.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
+[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.2.4.md) · [1.2.3 Notes](docs/RELEASE_NOTES_1.2.3.md) · [1.2.2 Notes](docs/RELEASE_NOTES_1.2.2.md) · [1.2.1 Notes](docs/RELEASE_NOTES_1.2.1.md) · [1.2.0 Notes](docs/RELEASE_NOTES_1.2.0.md) · [1.1.4 Notes](docs/RELEASE_NOTES_1.1.4.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
 
 ## Why It Matters
 
@@ -325,7 +325,7 @@ The stable public product is Codex-first local orchestration: index, search,
 describe, expand, prepared-state recall, OpenClaw/MCP tools, and
 approval-gated dry-run/control boundaries.
 
-The 1.2 prepared-state and summary-leaves lane is shipped in stable `1.2.2`.
+The 1.2 prepared-state and summary-leaves lane is shipped in stable `1.2.4`.
 Current launch work is the M11 GA assurance sprint, tracked in GitHub and
 summarized in [VISION.md](VISION.md). Keep sprint and agent-operator details
 there, in [AGENTS.md](AGENTS.md), and in the packaged

package/VISION.md

@@ -12,11 +12,11 @@ The stable product should feel like a local orchestration cockpit: OpenClaw can
 
 The current release-readiness lane is Milestone 11: LCO 1.2.0 GA Assurance And Global Launch Readiness. GitHub tracker [#478](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/478) and children [#479](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/479)-[#493](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/493) own implementation truth; this file owns the product and eval boundary.
 
-The stable 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2.0, 1.2.1, and 1.2.2 packages have shipped on npm `latest` and their GitHub Releases are published. The post-GA Desktop claim-validation lane [#306](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/306) records that Desktop-visible classification and fallback readiness/status are proven, while actual Codex GUI mutation remains excluded. Desktop parity [#307](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/307) added the coherence classifier; desktop fallback [#308](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/308) added the CUA-first and Peekaboo-secondary readiness report. The 1.1 collaboration cockpit [#309](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/309) is completed proof for read-only collaboration summaries and execute-false next steps, not the current active child-work list.
+The stable 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2.0, 1.2.1, 1.2.2, and 1.2.3 packages have shipped on npm `latest` and their GitHub Releases are published. The 1.2.4 package is the current stable patch candidate; npm `latest` and GitHub Release finalization must be proven by release evidence before any global-ready claim treats it as published. The post-GA Desktop claim-validation lane [#306](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/306) records that Desktop-visible classification and fallback readiness/status are proven, while actual Codex GUI mutation remains excluded. Desktop parity [#307](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/307) added the coherence classifier; desktop fallback [#308](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/308) added the CUA-first and Peekaboo-secondary readiness report. The 1.1 collaboration cockpit [#309](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/309) is completed proof for read-only collaboration summaries and execute-false next steps, not the current active child-work list.
 
 The Codex Autonomy Cockpit [#254](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/254) and Eva Operating Picture [#255](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/255) P0 lanes are completed beta foundation, not the current active child-work list. Completed P0 children include shared contracts [#256](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/256), source authority [#258](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/258), watcher/resume requests [#259](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/259), visible Codex map joins [#260](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/260), deterministic GitHub operating inputs [#264](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/264)/[#265](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/265), current-lane source balancing [#269](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/269), GitHub check-state fidelity [#270](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/270), cockpit card cleanup [#271](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/271), and end-to-end Eva cockpit dogfood [#272](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/272). The sprint brief remains the historical handoff for that P0 work: [docs/sprints/brief-lco-codex-autonomy-cockpit-sprint-2026-07-01.md](docs/sprints/brief-lco-codex-autonomy-cockpit-sprint-2026-07-01.md).
 
-The core Codex recall, M9 handoff paths, Codex Autonomy Cockpit, Eva Operating Picture P0 paths, 1.1 Desktop collaboration cockpit paths, 1.2 prepared-state and summary-leaf paths, release metadata, package/gateway setup proof, docs truth, release gates, public-safe scorecards, post-publish fresh npm `@latest` install proof, and stable publication lanes are no longer the main product gap. The current gap is no-bug-left-behind launch assurance: prove the published `1.2.2` package is installable, discoverable, public-safe, and honest for global users before broad rollout.
+The core Codex recall, M9 handoff paths, Codex Autonomy Cockpit, Eva Operating Picture P0 paths, 1.1 Desktop collaboration cockpit paths, 1.2 prepared-state and summary-leaf paths, release metadata, package/gateway setup proof, docs truth, release gates, and public-safe scorecards are no longer the main product gap. The current gap is no-bug-left-behind launch assurance: prove the `1.2.4` stable candidate is published, installable from npm `@latest`, discoverable, public-safe, and honest for global users before broad rollout.
 
 The current target is:
 
@@ -38,7 +38,7 @@ The current target is:
 - Keep P1 source adapters, including Notion, support-control, Company Brain, Stripe, dashboard/export, and model summarization, behind separate adapters and proof gates; P0 tools report those sources as `not_configured` instead of fabricating summaries.
 - Use the [source authority profile](docs/SOURCE_AUTHORITY_PROFILE.md) to distinguish "this source returned data" from "this source owns the current truth"; unavailable or cache-only sources must degrade claims to `unknown` or low confidence.
 
-The sprint remains Codex-first, local-first, read-only-first, and public-safe by default. It does not claim full business truth, customer readiness, Claude Code parity, remote sync, generic GUI mutation, unattended desktop control, permission bypass, or enterprise/customer-ready security. npm `latest` promotion and GitHub Release creation are complete for 1.2.2. Desktop-visible classification and fallback readiness/status are proven by #307/#308; actual Codex GUI mutation remains excluded until a future action-bound proof gate records the exact backend, target, action hash, approval, and observation.
+The sprint remains Codex-first, local-first, read-only-first, and public-safe by default. It does not claim full business truth, customer readiness, Claude Code parity, remote sync, generic GUI mutation, unattended desktop control, permission bypass, or enterprise/customer-ready security. npm `latest` promotion and GitHub Release creation for 1.2.4 are release gates, not assumptions. Desktop-visible classification and fallback readiness/status are proven by #307/#308; actual Codex GUI mutation remains excluded until a future action-bound proof gate records the exact backend, target, action hash, approval, and observation.
 
 What 1.2 should let a local OpenClaw agent do next:
 
@@ -294,7 +294,7 @@ Release candidates follow [docs/BETA_RELEASE_RUNBOOK.md](docs/BETA_RELEASE_RUNBO
 
 ## Proof Boundary
 
-Allowed stable 1.2.2 claim:
+Allowed stable 1.2.4 claim:
 
 > Collaborate with local Codex sessions through OpenClaw using local indexing, prepared-state recall, bounded expansion, and approval-gated dry-run/control boundaries.
 

package/dist/packages/cli/src/release-preflight.js

@@ -1,8 +1,9 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { basename, dirname, extname, join, resolve, sep } from "node:path";
+import { dirname, extname, join, relative, resolve, sep } from "node:path";
 import { excludedClaimsForScope, liveControlExcludedDetail, normalizeReleaseClaimScope, releaseClaimScopeRequiresLiveControl, releaseClaimScopeRequiresWorkingAppRuntimeProof } from "./release-claim-scope.js";
 import { validateWorkingAppRuntimeProof } from "./runtime-proof-gate.js";
+const EVIDENCE_SCAN_MAX_DEPTH = 40;
 const forbiddenClaims = [
     "Full Claude Code parity",
     "cloud sync",
@@ -68,14 +69,18 @@ export function runReleasePreflight(options = {}) {
     const workingAppRuntimeProof = workingAppRuntimeProofRequired
         ? validateWorkingAppRuntimeProof(options.runtimeProofDir)
         : null;
-    const rawSessionArtifacts = scanRawSessionArtifacts(options.evidenceDir);
+    const evidenceScan = scanEvidenceArtifacts(options.evidenceDir);
+    const rawSessionArtifacts = evidenceScan.rawSessionArtifacts;
+    const evidenceScanDepthExceeded = evidenceScan.depthLimitExceeded;
     const checks = {
         packageJson: check(Boolean(!packageJsonRead.error && packageJson?.name && packageJson.version && packageJson.description?.match(/local Codex sessions/i)), packageJsonRead.error ?? "package metadata keeps Codex-first beta positioning"),
         readme: check(Boolean(readme && readmePublicDocsRequiredPatterns.every((pattern) => pattern.test(readme))), "README includes public setup path, OpenClaw/MCP entrypoints, safety boundaries, and forbidden claims"),
         openclawManifest: check(Boolean(!openclawManifestRead.error && openclawPackageMetadataOk && openclawManifest?.id === "lossless-openclaw-orchestrator" && openclawManifest.mcp?.command === "loo-mcp-server" && openclawManifest.mcp.transport === "stdio" && openclawManifest.tools?.prefix === "loo_" && openclawManifest.safety?.localOnlyByDefault === true), openclawManifestRead.error ?? "root OpenClaw manifest and package runtime entry are packageable and local-only by default"),
         claimAudit: check(Boolean(claimAudit?.match(/Forbidden Beta Claims/i) && claimAudit.match(/approved_live_control_smoke_missing/i)), "claim audit records forbidden claims and the live-control blocker code"),
         betaDemo: check(Boolean(betaDemo?.match(/100\+ local Codex sessions/i) && betaDemo.match(/does not run live control/i)), "demo workflow covers 100+ Codex sessions and dry-run-only control boundary"),
-        rawArtifacts: check(rawSessionArtifacts.length === 0, rawSessionArtifacts.length === 0 ? "no raw session/private DB/screenshot artifacts found" : "raw session/private DB/screenshot artifacts are present"),
+        rawArtifacts: check(rawSessionArtifacts.length === 0 && evidenceScanDepthExceeded.length === 0, rawSessionArtifacts.length === 0 && evidenceScanDepthExceeded.length === 0
+            ? "no raw session/private DB/screenshot artifacts found"
+            : "raw artifacts or unsafe evidence tree shape are present"),
         liveControlSmoke: liveControlProof,
         workingAppRuntimeProof: workingAppRuntimeProof
             ? check(workingAppRuntimeProof.ok, workingAppRuntimeProof.ok
@@ -88,6 +93,8 @@ export function runReleasePreflight(options = {}) {
         .map(([key]) => `${key}_failed`);
     if (rawSessionArtifacts.length > 0)
         blockers.push("raw_session_artifacts_present");
+    if (evidenceScanDepthExceeded.length > 0)
+        blockers.push("evidence_scan_depth_exceeded");
     if (liveControlRequired && !checks.liveControlSmoke?.ok)
         blockers.push("approved_live_control_smoke_missing");
     if (workingAppRuntimeProofRequired && workingAppRuntimeProof && !workingAppRuntimeProof.ok) {
@@ -105,7 +112,8 @@ export function runReleasePreflight(options = {}) {
         checks,
         blockers,
         forbiddenClaims,
-        rawSessionArtifacts
+        rawSessionArtifacts,
+        evidenceScanDepthExceeded
     };
     if (report.artifactManifestPath) {
         mkdirSync(options.evidenceDir, { recursive: true });
@@ -190,27 +198,60 @@ function findPackageRoot(start) {
         cursor = parent;
     }
 }
-function scanRawSessionArtifacts(evidenceDir) {
-    if (!evidenceDir || !existsSync(evidenceDir))
-        return [];
-    return readdirSync(evidenceDir, { withFileTypes: true })
-        .filter((entry) => entry.isFile())
-        .map((entry) => rawArtifactForName(entry.name))
-        .filter((entry) => entry !== null)
-        .sort((left, right) => left.name.localeCompare(right.name));
+function scanEvidenceArtifacts(evidenceDir) {
+    if (!evidenceDir || !existsSync(evidenceDir)) {
+        return { rawSessionArtifacts: [], depthLimitExceeded: [] };
+    }
+    const root = resolve(evidenceDir);
+    const rawSessionArtifacts = [];
+    const depthLimitExceeded = [];
+    const visit = (dir, depth) => {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const absolutePath = join(dir, entry.name);
+            const relativePath = normalizePackagePath(relative(root, absolutePath));
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                if (depth >= EVIDENCE_SCAN_MAX_DEPTH) {
+                    depthLimitExceeded.push(relativePath);
+                    continue;
+                }
+                visit(absolutePath, depth + 1);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const artifact = rawArtifactForName(relativePath);
+            if (artifact)
+                rawSessionArtifacts.push(artifact);
+        }
+    };
+    visit(root, 0);
+    return {
+        rawSessionArtifacts: rawSessionArtifacts
+            .filter((entry) => entry !== null)
+            .sort((left, right) => left.name.localeCompare(right.name)),
+        depthLimitExceeded: depthLimitExceeded.sort((left, right) => left.localeCompare(right))
+    };
 }
 function rawArtifactForName(name) {
     if (name === "release-preflight.json")
         return null;
-    const extension = extname(name).toLowerCase();
+    const normalizedName = normalizePackagePath(name);
+    const extension = extname(normalizedName).toLowerCase();
+    const lowerName = normalizedName.toLowerCase();
     if (extension === ".jsonl")
-        return { name: basename(name), reason: "raw_codex_jsonl" };
-    if (extension === ".sqlite" || extension === ".sqlite3" || extension === ".db")
-        return { name: basename(name), reason: "sqlite_database" };
+        return { name: normalizedName, reason: "raw_codex_jsonl" };
+    if (extension === ".sqlite" || extension === ".sqlite3" || extension === ".db"
+        || lowerName.endsWith(".sqlite-wal") || lowerName.endsWith(".sqlite-shm")
+        || lowerName.endsWith(".sqlite3-wal") || lowerName.endsWith(".sqlite3-shm")
+        || lowerName.endsWith(".db-wal") || lowerName.endsWith(".db-shm")) {
+        return { name: normalizedName, reason: "sqlite_database" };
+    }
     if (extension === ".png" || extension === ".jpg" || extension === ".jpeg" || extension === ".heic" || extension === ".webp")
-        return { name: basename(name), reason: "screenshot_or_image" };
+        return { name: normalizedName, reason: "screenshot_or_image" };
     if (extension === ".mov" || extension === ".mp4" || extension === ".webm")
-        return { name: basename(name), reason: "video_capture" };
+        return { name: normalizedName, reason: "video_capture" };
     return null;
 }
 function validateApprovedLiveControlProof(path) {

package/dist/packages/core/src/index.js

@@ -4004,13 +4004,13 @@ function formatClaudeSessionInventoryMetadata(description) {
     return [
         `Claude session ID: ${description.sessionId}`,
         `Ref: ${description.sourceRef}`,
-        description.title ? `Title: ${description.title}` : null,
-        description.project ? `Project: ${description.project}` : null,
-        description.workspaceHint ? `Workspace: ${description.workspaceHint}` : null,
+        description.title ? `Title: ${publicSafeText(description.title, 500)}` : null,
+        description.project ? `Project: ${publicSafeText(description.project, 500)}` : null,
+        description.workspaceHint ? `Workspace: ${publicSafeText(description.workspaceHint, 500)}` : null,
         description.status ? `Status: ${description.status}` : null,
         description.updatedAt ? `Updated: ${description.updatedAt}` : null,
-        `Source path: ${description.sourcePath}`,
-        description.sourceRefs.length ? `Source refs: ${description.sourceRefs.join(", ")}` : null,
+        `Source ref: ${publicSourcePathRef(description.sourcePath)}`,
+        description.sourceRefs.length ? `Source refs: ${description.sourceRefs.map((ref) => publicSafeText(ref, 180)).join(", ")}` : null,
         "Proof boundary: read-only Claude metadata fixture inventory only; no private transcript content, live control, GUI mutation, parity, or cloud sync proof."
     ].filter(Boolean).join("\n");
 }
@@ -8623,15 +8623,15 @@ export function expandSession(db, options) {
             `Thread: ${description.title ?? description.threadId}`,
             `Ref: ${description.sourceRef}`,
             `ID: ${description.threadId}`,
-            description.cwd ? `CWD: ${description.cwd}` : null,
+            description.cwd ? `CWD: ${publicSafeText(description.cwd, 500)}` : null,
             description.branch ? `Branch: ${description.branch}` : null,
             description.gitSha ? `Git SHA: ${description.gitSha}` : null,
-            description.summary ? `Summary: ${description.summary}` : null,
+            description.summary ? `Summary: ${publicSafeText(description.summary, 2000)}` : null,
             formatSessionMetadata(description.metadata),
             `Plans: ${description.planCount}`,
             `Touched files: ${description.touchedFiles.length}`,
             `Tool calls: ${description.toolCallCount}`,
-            `Source path: ${description.sourcePath}`
+            `Source ref: ${publicSourcePathRef(description.sourcePath)}`
         ].filter(Boolean).join("\n");
         return {
             sourceKind: "codex_thread",
@@ -8645,13 +8645,13 @@ export function expandSession(db, options) {
     const text = [
         `Thread: ${description.title ?? description.threadId}`,
         `ID: ${description.threadId}`,
-        description.cwd ? `CWD: ${description.cwd}` : null,
+        description.cwd ? `CWD: ${publicSafeText(description.cwd, 500)}` : null,
         description.branch ? `Branch: ${description.branch}` : null,
         description.gitSha ? `Git SHA: ${description.gitSha}` : null,
-        description.summary ? `Summary: ${description.summary}` : null,
-        description.finalMessage ? `Final message: ${truncate(description.finalMessage, profile.name === "evidence" ? 3200 : 900)}` : null,
+        description.summary ? `Summary: ${publicSafeText(description.summary, profile.name === "evidence" ? 3200 : 1600)}` : null,
+        description.finalMessage ? `Final message: ${publicSafeText(description.finalMessage, profile.name === "evidence" ? 3200 : 900)}` : null,
         description.touchedFiles.length ? `Touched files:\n${formatTouchedFiles(description.touchedFiles, profile.name === "evidence" ? 50 : 12, profile.name === "evidence" ? 3200 : 900)}` : null,
-        plans.length ? `Plans:\n${plans.map((plan) => truncate(plan, profile.name === "evidence" ? 3200 : 1200)).join("\n\n")}` : null
+        plans.length ? `Plans:\n${plans.map((plan) => publicSafeText(plan, profile.name === "evidence" ? 3200 : 1200)).join("\n\n")}` : null
     ].filter(Boolean).join("\n\n");
     return {
         sourceKind: "codex_thread",
@@ -8666,7 +8666,7 @@ function formatTouchedFiles(files, limit, maxChars) {
     const perPathLimit = maxChars > 1000 ? 180 : 120;
     const visible = [];
     for (const file of files.slice(0, limit)) {
-        const next = `- ${truncate(file, perPathLimit)}`;
+        const next = `- ${publicSafeText(file, perPathLimit)}`;
         const hiddenIfAccepted = files.length - (visible.length + 1);
         const markerIfAccepted = hiddenIfAccepted > 0 ? `- ... ${hiddenIfAccepted} more touched files omitted` : null;
         const visibleMaxChars = markerIfAccepted ? Math.max(0, maxChars - markerIfAccepted.length - 1) : maxChars;
@@ -8760,7 +8760,7 @@ export function expandRecallRef(db, options) {
         const metadata = formatClaudeSessionInventoryMetadata(description);
         const text = profile.name === "metadata"
             ? metadata
-            : truncateByApproxTokens(`${metadata}\n\nSafe summary:\n${description.summary ?? ""}`, profile.tokenBudget);
+            : truncateByApproxTokens(`${metadata}\n\nSafe summary:\n${publicSafeText(description.summary ?? "", profile.tokenBudget * 6)}`, profile.tokenBudget);
         return {
             sourceKind: "claude_session",
             sourceRef: description.sourceRef,
@@ -8777,18 +8777,18 @@ export function expandRecallRef(db, options) {
     const metadata = [
         `Summary ID: ${summary.summaryId}`,
         `Ref: ${lcmSummaryRef(summary.sourcePath, summary.summaryId)}`,
-        `Conversation: ${summary.conversationTitle ?? summary.conversationId}`,
+        `Conversation: ${publicSafeText(summary.conversationTitle ?? String(summary.conversationId), 500)}`,
         `Conversation ID: ${summary.conversationId}`,
         summary.kind ? `Kind: ${summary.kind}` : null,
         summary.depth !== null ? `Depth: ${summary.depth}` : null,
         summary.tokenCount !== null ? `Token count: ${summary.tokenCount}` : null,
-        summary.model ? `Model: ${summary.model}` : null,
+        summary.model ? `Model: ${publicSafeText(summary.model, 120)}` : null,
         summary.updatedAt ? `Updated: ${summary.updatedAt}` : null,
-        `Source path: ${summary.sourcePath}`
+        `Source ref: ${publicSourcePathRef(summary.sourcePath)}`
     ].filter(Boolean).join("\n");
     const text = profile.name === "metadata"
         ? metadata
-        : truncateByApproxTokens(`${metadata}\n\nContent:\n${summary.content}`, profile.tokenBudget);
+        : truncateByApproxTokens(`${metadata}\n\nContent:\n${publicSafeText(summary.content, profile.tokenBudget * 6)}`, profile.tokenBudget);
     return {
         sourceKind: "lcm_summary",
         sourceRef: lcmSummaryRef(summary.sourcePath, summary.summaryId),
@@ -9055,7 +9055,7 @@ function lcmSummaryRecord(path, row) {
         conversationTitle: nullableString(row.conversationTitle),
         kind: nullableString(row.kind),
         depth: row.depth === null || row.depth === undefined ? null : Number(row.depth),
-        content: redactSafeString(String(row.content ?? "")),
+        content: redactPublicSafeString(String(row.content ?? "")),
         tokenCount: row.tokenCount === null || row.tokenCount === undefined ? null : Number(row.tokenCount),
         createdAt: nullableString(row.createdAt),
         updatedAt: nullableString(row.updatedAt),
@@ -9160,13 +9160,17 @@ function publicSourcePathRef(sourcePath) {
     return `codex_source:${stableId(sourcePath).slice(0, 16)}`;
 }
 function publicSafeText(value, maxChars = 500) {
-    const redacted = redactSafeString(value)
-        .replace(/\/Volumes\/[^\s"'`)]+/g, "<redacted-path>")
-        .replace(/\/(?:Users|home)\/[^/\s"'`)]+\/\.codex\/[^\s"'`)]+/g, "<redacted-path>")
-        .replace(/\/root\/\.codex\/[^\s"'`)]+/g, "<redacted-path>")
-        .replace(/\/(?:private\/)?(?:tmp|var)\/[^\s"'`)]+/g, "<redacted-path>")
-        .replace(/~\/\.codex\/[^\s"'`)]+/g, "<redacted-path>");
-    return truncate(redacted, maxChars);
+    return truncate(redactPublicSafeString(value), maxChars);
+}
+function redactPublicSafeString(value) {
+    const localPathRootPattern = "(?:\\/Volumes\\/|\\/(?:Users|home|root)\\/|\\/(?:private\\/)?(?:tmp|var)\\/|~\\/|(?<![A-Za-z])[A-Za-z]:[\\\\/])";
+    const structuredLabelPattern = "[A-Za-z][A-Za-z0-9 _-]{0,32}:";
+    const relativePathStartPattern = "(?:\\.{1,2}\\/|[A-Za-z0-9_.-]+\\/)";
+    const omissionMarkerPattern = "\\+\\d+\\s+more\\b";
+    const localPathTerminatorPattern = `(?=$|[\\r\\n"'\\\`)\\]}]|\\s+(?:${localPathRootPattern}|${relativePathStartPattern}|${omissionMarkerPattern}|${structuredLabelPattern}))`;
+    const localPathPattern = new RegExp(`${localPathRootPattern}(?:(?!${localPathTerminatorPattern}).)+`, "g");
+    const pathRedacted = value.replace(localPathPattern, "<redacted-path>");
+    return redactSafeString(pathRedacted).replace(localPathPattern, "<redacted-path>");
 }
 function publicSafeSearchText(value, maxChars = 500) {
     return publicSafeText(value, maxChars);

package/docs/BETA_RELEASE_RUNBOOK.md

@@ -384,10 +384,10 @@ Record `npm dist-tag ls lossless-openclaw-orchestrator` in the release evidence
 after every npm publication. Stable releases publish with
 `npm publish --tag latest`; public betas publish with `npm publish --tag beta`;
 release candidates publish with `npm publish --tag next`. The stable channel
-currently points at `1.2.2`; future stable releases move `latest` only after the
-separate stable-promotion gate proves the exact candidate. Keep beta and other
-prereleases on prerelease tags. Do not publish a fake stable package just to
-move a dist-tag. Release candidates must publish with `npm publish --tag next`;
+target for this package version is `1.2.4`; npm `latest` must move only after
+the separate stable-promotion gate proves the exact candidate. Keep beta and
+other prereleases on prerelease tags. Do not publish a fake stable package just
+to move a dist-tag. Release candidates must publish with `npm publish --tag next`;
 RC branches also carry `package.json` `publishConfig.tag` set to `next` as a
 fail-closed guard against accidental untagged publication. Stable branches carry
 `package.json` `publishConfig.tag` set to `latest`. Do not run untagged

package/docs/CLAIM_AUDIT.md

@@ -1,6 +1,6 @@
 # Public Claim Audit
 
-## Allowed Stable 1.2.2 Claim
+## Allowed Stable 1.2.4 Claim
 
 Collaborate with local Codex sessions through OpenClaw using local indexing, prepared-state recall, bounded expansion, and approval-gated dry-run/control boundaries.
 
@@ -75,10 +75,10 @@ blockers instead of allowing a working-app claim.
 
 Install stable releases through the `latest` dist-tag, public betas through the
 `beta` dist-tag, and release candidates through `next`. The stable channel
-currently points at `1.2.2`; future stable releases move `latest` only after the
-separate stable-promotion gate proves the exact candidate. Keep beta and other
-prereleases on prerelease tags. Do not publish a fake stable package just to
-move a dist-tag.
+target for this package version is `1.2.4`; npm `latest` must move only after
+the separate stable-promotion gate proves the exact candidate. Keep beta and
+other prereleases on prerelease tags. Do not publish a fake stable package just
+to move a dist-tag.
 
 ## Release Checklist
 

package/docs/RELEASE_NOTES_1.2.3.md

@@ -0,0 +1,84 @@
+# Release Notes 1.2.3
+
+`1.2.3` is the GA-assurance hygiene patch for the LCO 1.2 stable train and Codex-first local orchestration. It fixes the recursive release-evidence scan gap found during M11 adversarial review and keeps the 1.2 claim boundary unchanged.
+
+This release is focused on local Codex sessions. Prepared state remains an advisory local derived cache, not source authority for PR, CI, release, runtime, customer, or business truth.
+
+## What Changed
+
+- Fixes `loo release preflight` raw-artifact detection so it scans nested evidence folders instead of only immediate files in `--evidence-dir`.
+- Adds recursive detection for SQLite sidecars such as `.sqlite-wal`, `.sqlite-shm`, `.sqlite3-wal`, `.sqlite3-shm`, `.db-wal`, and `.db-shm`.
+- Skips symlinked evidence entries and reports `evidence_scan_depth_exceeded`
+  when an evidence tree is too deep to scan deterministically.
+- Keeps raw artifact findings public-safe by reporting relative evidence names and blocker reasons, not raw artifact contents.
+- Sanitizes the M11 final evidence packet by removing generated clean-profile runtime HOME/prefix artifacts while preserving public-safe summary reports.
+- Carries forward the 1.2.2 readiness-smoke semantics clarification: `ok` / `packagePathOk` are package-path claims, while `publishedSmokeReady` is the clean-profile gateway-ready claim.
+- Carries forward `--gateway-ready-strict` so operators and CI can explicitly fail when a fresh published profile still needs gateway credentials or device setup.
+- Carries forward the hardened `loo release general-readiness` proof-boundary label so an unexpected package version string cannot inject uncontrolled text into the public proof boundary.
+- Carries forward the frozen `readinessSemantics` metadata object emitted by `published-smoke`, keeping machine-readable exit semantics stable for release scripts and audits.
+- Carries forward the 1.2.1 facade smoke fix for resume dry-run proof, including the distinction between resume packets and message-carrying send/steer packets.
+- Carries forward the #160 desktop proof-action release boundary:
+  `loo_desktop_proof_action` / `loo desktop proof-action` validates the
+  CUA Driver TextEdit scratch proof gate and does not prove generic GUI
+  mutation.
+  The proof action still requires exact backend, target app, target window, action hash, approval ref, permission state, scratch file path, and `execute: true` before the backend can run.
+  Generic gateway invocation without exact proof args fails closed. The desktop
+  proof action keeps the same proof boundary as beta.35.
+- Carries forward strict OpenClaw gateway result handling: plugin output with
+  `output.details.ok: false` is reported as
+  `openclaw_tool_result_not_ok:<tool>` rather than successful tool proof.
+
+## Current Claim Scope
+
+Allowed stable claim:
+
+> Collaborate with local Codex sessions through OpenClaw using local indexing,
+> prepared-state recall, bounded expansion, and approval-gated dry-run/control
+> boundaries.
+
+The stable channel means the scoped prepared-state and cockpit-management
+surface is ready as a public local-Codex release. It does not broaden the
+control, GUI, Claude, customer, or enterprise-security proof boundary.
+
+## Release Gate Notes
+
+- Parent 1.2 tracker: #405.
+- GA assurance tracker: #478.
+- Hygiene patch issue: #506.
+- Previous patch-release issue: #503.
+- Readiness-semantics issue: #494.
+- Patch PRs: #499, #505, and the 1.2.3 release PR.
+- Baseline stable release: `v1.2.2`.
+- Candidate package: `lossless-openclaw-orchestrator@1.2.3`.
+- Expected npm dist-tag: `latest`.
+- Expected git tag: `v1.2.3`.
+- Required stable gates: focused release-smoke tests, release claim audit,
+  build/typecheck, `npm pack --dry-run`, release bundle/status checks, GitHub
+  CI, CodeQL, current-head review threads clear, npm publish to `latest`,
+  GitHub Release, and post-publish finalization status.
+- Bundle/status/finalization dry-run checks do not publish to npm and will not create a GitHub Release.
+- Working-app status example:
+  `loo release status --claim-scope codex-working-app-proof --runtime-proof-dir <path> --approved-live-control-evidence <path> --npm-publish-approval-evidence <path> --github-release-approval-evidence <path> --candidate-sha <sha> --github-ci-evidence <path> --codeql-evidence <path> --evidence-dir <path> --strict`
+- Reduced-scope status example:
+  `loo release status --claim-scope codex-read-search-expand-dry-run --npm-publish-approval-evidence <path> --github-release-approval-evidence <path> --candidate-sha <sha> --github-ci-evidence <path> --codeql-evidence <path> --evidence-dir <path> --strict`
+- `approved_live_control_smoke_missing` remains the expected blocker when a
+  working-app or live-control claim is attempted without approved live-control
+  smoke evidence for the exact candidate SHA.
+
+## Explicit Non-Claims
+
+No new live Codex control smoke is run by this release.
+It does not run generic GUI mutation and does not run Codex GUI mutation.
+No automatic gateway authorization.
+No broad gateway scope approval. No prompt typing. No clicking. No arbitrary app control.
+No screenshots or videos are part of the public release evidence.
+Claude Code remains an adapter stub, not an adapter-equivalence claim.
+No true Codex compaction-summary capture.
+No raw model compaction by default and no default model access to raw transcript
+or current `safe_text`.
+No raw transcript upload and no OpenClaw LCM merge.
+No source-store mutation.
+No Notion, support-control, Stripe, or Company Brain P1 adapter proof.
+No cloud sync.
+No unattended desktop takeover.
+No release-grade enterprise security or customer-ready security claim.

package/docs/RELEASE_NOTES_1.2.4.md

@@ -0,0 +1,92 @@
+# Release Notes 1.2.4
+
+`1.2.4` is a GA-assurance privacy hygiene patch for the LCO 1.2 stable train.
+It keeps the 1.2 claim boundary unchanged and fixes a public-safe rendering gap
+found during the M11 launch packet pass.
+
+## What Changed
+
+- Redacts local absolute paths from `loo expand-query`, `loo expand-ref`, and
+  `expandSession` human-readable expansion text.
+- Keeps relative project paths visible where they are already public-safe, while
+  replacing local `/Volumes/...`, `/Users/...`, `.codex`, and tmp-style paths
+  with `<redacted-path>`.
+- Keeps exact touched-file metadata in the local index for matching and recall;
+  only the rendered expansion text is sanitized.
+- Updates bounded expansion snapshots and regression tests so future releases
+  fail if expansion evidence leaks local absolute paths.
+- Carries forward the 1.2.3 recursive evidence scanner hardening for nested raw
+  artifacts, SQLite sidecars, symlinked evidence entries, and deep evidence
+  trees.
+- Clarifies launch-truth wording from `1.2.0`/`1.2.3` to the current `1.2.4`
+  stable patch line.
+
+## Current Claim Scope
+
+Claim scope: `codex-read-search-expand-dry-run`.
+
+Allowed stable claim:
+
+> Collaborate with local Codex sessions through OpenClaw using local indexing,
+> prepared-state recall, bounded expansion, and approval-gated dry-run/control
+> boundaries.
+
+When finalization evidence proves this candidate on the stable channel, the
+scoped prepared-state and cockpit-management surface is ready as a public
+local-Codex release. It does not broaden the control, GUI, Claude, customer, or
+enterprise-security proof boundary.
+
+This remains a Codex-first local orchestration release.
+
+## Carried-Forward Desktop Proof Boundary
+
+The Desktop proof-action hardening from #160 is still included. The public tool
+surface includes `loo_desktop_proof_action` and the CLI command
+`loo desktop proof-action`, but they remain bounded to the same proof boundary as beta.35: a CUA Driver TextEdit scratch proof only. The exact tuple is:
+exact backend, target app, target window, action hash, approval ref, permission state, scratch file path, and `execute: true`.
+
+A generic gateway invocation without exact proof args fails closed. The expected
+OpenClaw failure shape is `openclaw_tool_result_not_ok:<tool>` with
+`output.details.ok: false`; it is not proof of generic GUI mutation.
+
+## Release Gate Notes
+
+- Parent 1.2 tracker: #405.
+- GA assurance tracker: #478.
+- Path-redaction issue: #508.
+- Hygiene patch issue: #506.
+- Baseline stable release: `v1.2.3`.
+- Candidate package: `lossless-openclaw-orchestrator@1.2.4`.
+- Expected npm dist-tag: `latest`.
+- Expected git tag: `v1.2.4`.
+- Example reduced-scope release preflight:
+  `loo release preflight --claim-scope codex-read-search-expand-dry-run --evidence-dir <public-safe-evidence> --strict`.
+- Example release status with all required non-GUI approvals:
+  `loo release status --candidate-sha <sha> --github-ci-evidence <ci.json> --codeql-evidence <codeql.json> --approved-live-control-evidence <live-control.json> --npm-publish-approval-evidence <npm-approval.json> --github-release-approval-evidence <github-release-approval.json> --strict`.
+- Reduced-scope release status may keep `approved_live_control_smoke_missing`
+  only when `--claim-scope codex-read-search-expand-dry-run` is explicit and
+  live Codex control is recorded as excluded.
+- Required stable gates: focused path-redaction tests, full `npm run check`,
+  release preflight/bundle/status, `npm pack --dry-run`, GitHub CI, CodeQL,
+  review threads clear, npm publish to `latest`, GitHub Release, post-publish
+  finalization status, fresh npm install, OpenClaw dogfood/tool-smoke,
+  scenario/scorecard sweeps, and privacy scan.
+- `loo release bundle` prepares public-safe local artifacts; it does not publish to npm and does not create a GitHub Release.
+
+## Explicit Non-Claims
+
+No new live Codex control smoke is run by this release.
+It does not run generic GUI mutation and does not run Codex GUI mutation.
+No automatic gateway authorization.
+No broad gateway scope approval. No prompt typing. No clicking. No arbitrary app control.
+No screenshots or videos are part of the public release evidence.
+Claude Code remains an adapter stub, not an adapter-equivalence claim.
+No true Codex compaction-summary capture.
+No raw model compaction by default and no default model access to raw transcript
+or current `safe_text`.
+No raw transcript upload and no OpenClaw LCM merge.
+No source-store mutation.
+No Notion, support-control, Stripe, or Company Brain P1 adapter proof.
+No cloud sync.
+No unattended desktop takeover.
+No release-grade enterprise security or customer-ready security claim.

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "lossless-openclaw-orchestrator",
   "name": "Lossless OpenClaw Orchestrator",
   "description": "Collaborate with local Codex sessions through OpenClaw using local indexing, prepared-state recall, bounded expansion, and approval-gated dry-run/control boundaries.",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "kind": "tool",
   "tools": {
     "prefix": "loo_"

package/package.json

@@ -1,10 +1,18 @@
 {
   "name": "lossless-openclaw-orchestrator",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "Index, search, and prepare local Codex sessions for OpenClaw with approval-gated dry-run/control boundaries.",
   "type": "module",
   "license": "PolyForm-Noncommercial-1.0.0",
   "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO.git"
+  },
+  "homepage": "https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO#readme",
+  "bugs": {
+    "url": "https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues"
+  },
   "publishConfig": {
     "tag": "latest"
   },

package/packages/cli/src/release-preflight.ts

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { basename, dirname, extname, join, resolve, sep } from "node:path";
+import { dirname, extname, join, relative, resolve, sep } from "node:path";
 import {
   excludedClaimsForScope,
   liveControlExcludedDetail,
@@ -39,6 +39,7 @@ export type ReleasePreflightReport = {
   blockers: string[];
   forbiddenClaims: string[];
   rawSessionArtifacts: RawSessionArtifact[];
+  evidenceScanDepthExceeded: string[];
 };
 
 type ApprovedLiveControlSmokeProof = {
@@ -57,11 +58,18 @@ type RawSessionArtifact = {
   reason: "raw_codex_jsonl" | "sqlite_database" | "screenshot_or_image" | "video_capture";
 };
 
+type EvidenceScanResult = {
+  rawSessionArtifacts: RawSessionArtifact[];
+  depthLimitExceeded: string[];
+};
+
 type JsonReadResult = {
   value: unknown | null;
   error: string | null;
 };
 
+const EVIDENCE_SCAN_MAX_DEPTH = 40;
+
 const forbiddenClaims = [
   "Full Claude Code parity",
   "cloud sync",
@@ -148,14 +156,21 @@ export function runReleasePreflight(options: ReleasePreflightOptions = {}): Rele
   const workingAppRuntimeProof = workingAppRuntimeProofRequired
     ? validateWorkingAppRuntimeProof(options.runtimeProofDir)
     : null;
-  const rawSessionArtifacts = scanRawSessionArtifacts(options.evidenceDir);
+  const evidenceScan = scanEvidenceArtifacts(options.evidenceDir);
+  const rawSessionArtifacts = evidenceScan.rawSessionArtifacts;
+  const evidenceScanDepthExceeded = evidenceScan.depthLimitExceeded;
   const checks: Record<string, ReleasePreflightCheck> = {
     packageJson: check(Boolean(!packageJsonRead.error && packageJson?.name && packageJson.version && packageJson.description?.match(/local Codex sessions/i)), packageJsonRead.error ?? "package metadata keeps Codex-first beta positioning"),
     readme: check(Boolean(readme && readmePublicDocsRequiredPatterns.every((pattern) => pattern.test(readme))), "README includes public setup path, OpenClaw/MCP entrypoints, safety boundaries, and forbidden claims"),
     openclawManifest: check(Boolean(!openclawManifestRead.error && openclawPackageMetadataOk && openclawManifest?.id === "lossless-openclaw-orchestrator" && openclawManifest.mcp?.command === "loo-mcp-server" && openclawManifest.mcp.transport === "stdio" && openclawManifest.tools?.prefix === "loo_" && openclawManifest.safety?.localOnlyByDefault === true), openclawManifestRead.error ?? "root OpenClaw manifest and package runtime entry are packageable and local-only by default"),
     claimAudit: check(Boolean(claimAudit?.match(/Forbidden Beta Claims/i) && claimAudit.match(/approved_live_control_smoke_missing/i)), "claim audit records forbidden claims and the live-control blocker code"),
     betaDemo: check(Boolean(betaDemo?.match(/100\+ local Codex sessions/i) && betaDemo.match(/does not run live control/i)), "demo workflow covers 100+ Codex sessions and dry-run-only control boundary"),
-    rawArtifacts: check(rawSessionArtifacts.length === 0, rawSessionArtifacts.length === 0 ? "no raw session/private DB/screenshot artifacts found" : "raw session/private DB/screenshot artifacts are present"),
+    rawArtifacts: check(
+      rawSessionArtifacts.length === 0 && evidenceScanDepthExceeded.length === 0,
+      rawSessionArtifacts.length === 0 && evidenceScanDepthExceeded.length === 0
+        ? "no raw session/private DB/screenshot artifacts found"
+        : "raw artifacts or unsafe evidence tree shape are present"
+    ),
     liveControlSmoke: liveControlProof,
     workingAppRuntimeProof: workingAppRuntimeProof
       ? check(
@@ -171,6 +186,7 @@ export function runReleasePreflight(options: ReleasePreflightOptions = {}): Rele
     .filter(([key, value]) => !value.ok && key !== "liveControlSmoke" && key !== "rawArtifacts" && key !== "workingAppRuntimeProof")
     .map(([key]) => `${key}_failed`);
   if (rawSessionArtifacts.length > 0) blockers.push("raw_session_artifacts_present");
+  if (evidenceScanDepthExceeded.length > 0) blockers.push("evidence_scan_depth_exceeded");
   if (liveControlRequired && !checks.liveControlSmoke?.ok) blockers.push("approved_live_control_smoke_missing");
   if (workingAppRuntimeProofRequired && workingAppRuntimeProof && !workingAppRuntimeProof.ok) {
     blockers.push(...workingAppRuntimeProof.blockers);
@@ -188,7 +204,8 @@ export function runReleasePreflight(options: ReleasePreflightOptions = {}): Rele
     checks,
     blockers,
     forbiddenClaims,
-    rawSessionArtifacts
+    rawSessionArtifacts,
+    evidenceScanDepthExceeded
   };
 
   if (report.artifactManifestPath) {
@@ -272,22 +289,54 @@ function findPackageRoot(start: string): string | null {
   }
 }
 
-function scanRawSessionArtifacts(evidenceDir: string | undefined): RawSessionArtifact[] {
-  if (!evidenceDir || !existsSync(evidenceDir)) return [];
-  return readdirSync(evidenceDir, { withFileTypes: true })
-    .filter((entry) => entry.isFile())
-    .map((entry) => rawArtifactForName(entry.name))
-    .filter((entry): entry is RawSessionArtifact => entry !== null)
-    .sort((left, right) => left.name.localeCompare(right.name));
+function scanEvidenceArtifacts(evidenceDir: string | undefined): EvidenceScanResult {
+  if (!evidenceDir || !existsSync(evidenceDir)) {
+    return { rawSessionArtifacts: [], depthLimitExceeded: [] };
+  }
+  const root = resolve(evidenceDir);
+  const rawSessionArtifacts: RawSessionArtifact[] = [];
+  const depthLimitExceeded: string[] = [];
+  const visit = (dir: string, depth: number): void => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const absolutePath = join(dir, entry.name);
+      const relativePath = normalizePackagePath(relative(root, absolutePath));
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        if (depth >= EVIDENCE_SCAN_MAX_DEPTH) {
+          depthLimitExceeded.push(relativePath);
+          continue;
+        }
+        visit(absolutePath, depth + 1);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const artifact = rawArtifactForName(relativePath);
+      if (artifact) rawSessionArtifacts.push(artifact);
+    }
+  };
+  visit(root, 0);
+  return {
+    rawSessionArtifacts: rawSessionArtifacts
+      .filter((entry) => entry !== null)
+      .sort((left, right) => left.name.localeCompare(right.name)),
+    depthLimitExceeded: depthLimitExceeded.sort((left, right) => left.localeCompare(right))
+  };
 }
 
 function rawArtifactForName(name: string): RawSessionArtifact | null {
   if (name === "release-preflight.json") return null;
-  const extension = extname(name).toLowerCase();
-  if (extension === ".jsonl") return { name: basename(name), reason: "raw_codex_jsonl" };
-  if (extension === ".sqlite" || extension === ".sqlite3" || extension === ".db") return { name: basename(name), reason: "sqlite_database" };
-  if (extension === ".png" || extension === ".jpg" || extension === ".jpeg" || extension === ".heic" || extension === ".webp") return { name: basename(name), reason: "screenshot_or_image" };
-  if (extension === ".mov" || extension === ".mp4" || extension === ".webm") return { name: basename(name), reason: "video_capture" };
+  const normalizedName = normalizePackagePath(name);
+  const extension = extname(normalizedName).toLowerCase();
+  const lowerName = normalizedName.toLowerCase();
+  if (extension === ".jsonl") return { name: normalizedName, reason: "raw_codex_jsonl" };
+  if (extension === ".sqlite" || extension === ".sqlite3" || extension === ".db"
+    || lowerName.endsWith(".sqlite-wal") || lowerName.endsWith(".sqlite-shm")
+    || lowerName.endsWith(".sqlite3-wal") || lowerName.endsWith(".sqlite3-shm")
+    || lowerName.endsWith(".db-wal") || lowerName.endsWith(".db-shm")) {
+    return { name: normalizedName, reason: "sqlite_database" };
+  }
+  if (extension === ".png" || extension === ".jpg" || extension === ".jpeg" || extension === ".heic" || extension === ".webp") return { name: normalizedName, reason: "screenshot_or_image" };
+  if (extension === ".mov" || extension === ".mp4" || extension === ".webm") return { name: normalizedName, reason: "video_capture" };
   return null;
 }
 

package/packages/core/src/index.ts

@@ -6531,13 +6531,13 @@ function formatClaudeSessionInventoryMetadata(description: ClaudeSessionInventor
   return [
     `Claude session ID: ${description.sessionId}`,
     `Ref: ${description.sourceRef}`,
-    description.title ? `Title: ${description.title}` : null,
-    description.project ? `Project: ${description.project}` : null,
-    description.workspaceHint ? `Workspace: ${description.workspaceHint}` : null,
+    description.title ? `Title: ${publicSafeText(description.title, 500)}` : null,
+    description.project ? `Project: ${publicSafeText(description.project, 500)}` : null,
+    description.workspaceHint ? `Workspace: ${publicSafeText(description.workspaceHint, 500)}` : null,
     description.status ? `Status: ${description.status}` : null,
     description.updatedAt ? `Updated: ${description.updatedAt}` : null,
-    `Source path: ${description.sourcePath}`,
-    description.sourceRefs.length ? `Source refs: ${description.sourceRefs.join(", ")}` : null,
+    `Source ref: ${publicSourcePathRef(description.sourcePath)}`,
+    description.sourceRefs.length ? `Source refs: ${description.sourceRefs.map((ref) => publicSafeText(ref, 180)).join(", ")}` : null,
     "Proof boundary: read-only Claude metadata fixture inventory only; no private transcript content, live control, GUI mutation, parity, or cloud sync proof."
   ].filter(Boolean).join("\n");
 }
@@ -11405,15 +11405,15 @@ export function expandSession(db: LooDatabase, options: ExpandSessionOptions): E
       `Thread: ${description.title ?? description.threadId}`,
       `Ref: ${description.sourceRef}`,
       `ID: ${description.threadId}`,
-      description.cwd ? `CWD: ${description.cwd}` : null,
+      description.cwd ? `CWD: ${publicSafeText(description.cwd, 500)}` : null,
       description.branch ? `Branch: ${description.branch}` : null,
       description.gitSha ? `Git SHA: ${description.gitSha}` : null,
-      description.summary ? `Summary: ${description.summary}` : null,
+      description.summary ? `Summary: ${publicSafeText(description.summary, 2000)}` : null,
       formatSessionMetadata(description.metadata),
       `Plans: ${description.planCount}`,
       `Touched files: ${description.touchedFiles.length}`,
       `Tool calls: ${description.toolCallCount}`,
-      `Source path: ${description.sourcePath}`
+      `Source ref: ${publicSourcePathRef(description.sourcePath)}`
     ].filter(Boolean).join("\n");
     return {
       sourceKind: "codex_thread",
@@ -11427,13 +11427,13 @@ export function expandSession(db: LooDatabase, options: ExpandSessionOptions): E
   const text = [
     `Thread: ${description.title ?? description.threadId}`,
     `ID: ${description.threadId}`,
-    description.cwd ? `CWD: ${description.cwd}` : null,
+    description.cwd ? `CWD: ${publicSafeText(description.cwd, 500)}` : null,
     description.branch ? `Branch: ${description.branch}` : null,
     description.gitSha ? `Git SHA: ${description.gitSha}` : null,
-    description.summary ? `Summary: ${description.summary}` : null,
-    description.finalMessage ? `Final message: ${truncate(description.finalMessage, profile.name === "evidence" ? 3200 : 900)}` : null,
+    description.summary ? `Summary: ${publicSafeText(description.summary, profile.name === "evidence" ? 3200 : 1600)}` : null,
+    description.finalMessage ? `Final message: ${publicSafeText(description.finalMessage, profile.name === "evidence" ? 3200 : 900)}` : null,
     description.touchedFiles.length ? `Touched files:\n${formatTouchedFiles(description.touchedFiles, profile.name === "evidence" ? 50 : 12, profile.name === "evidence" ? 3200 : 900)}` : null,
-    plans.length ? `Plans:\n${plans.map((plan) => truncate(plan, profile.name === "evidence" ? 3200 : 1200)).join("\n\n")}` : null
+    plans.length ? `Plans:\n${plans.map((plan) => publicSafeText(plan, profile.name === "evidence" ? 3200 : 1200)).join("\n\n")}` : null
   ].filter(Boolean).join("\n\n");
   return {
     sourceKind: "codex_thread",
@@ -11449,7 +11449,7 @@ function formatTouchedFiles(files: string[], limit: number, maxChars: number): s
   const perPathLimit = maxChars > 1000 ? 180 : 120;
   const visible: string[] = [];
   for (const file of files.slice(0, limit)) {
-    const next = `- ${truncate(file, perPathLimit)}`;
+    const next = `- ${publicSafeText(file, perPathLimit)}`;
     const hiddenIfAccepted = files.length - (visible.length + 1);
     const markerIfAccepted = hiddenIfAccepted > 0 ? `- ... ${hiddenIfAccepted} more touched files omitted` : null;
     const visibleMaxChars = markerIfAccepted ? Math.max(0, maxChars - markerIfAccepted.length - 1) : maxChars;
@@ -11552,7 +11552,7 @@ export function expandRecallRef(db: LooDatabase, options: {
     const metadata = formatClaudeSessionInventoryMetadata(description);
     const text = profile.name === "metadata"
       ? metadata
-      : truncateByApproxTokens(`${metadata}\n\nSafe summary:\n${description.summary ?? ""}`, profile.tokenBudget);
+      : truncateByApproxTokens(`${metadata}\n\nSafe summary:\n${publicSafeText(description.summary ?? "", profile.tokenBudget * 6)}`, profile.tokenBudget);
     return {
       sourceKind: "claude_session",
       sourceRef: description.sourceRef,
@@ -11568,18 +11568,18 @@ export function expandRecallRef(db: LooDatabase, options: {
   const metadata = [
     `Summary ID: ${summary.summaryId}`,
     `Ref: ${lcmSummaryRef(summary.sourcePath, summary.summaryId)}`,
-    `Conversation: ${summary.conversationTitle ?? summary.conversationId}`,
+    `Conversation: ${publicSafeText(summary.conversationTitle ?? String(summary.conversationId), 500)}`,
     `Conversation ID: ${summary.conversationId}`,
     summary.kind ? `Kind: ${summary.kind}` : null,
     summary.depth !== null ? `Depth: ${summary.depth}` : null,
     summary.tokenCount !== null ? `Token count: ${summary.tokenCount}` : null,
-    summary.model ? `Model: ${summary.model}` : null,
+    summary.model ? `Model: ${publicSafeText(summary.model, 120)}` : null,
     summary.updatedAt ? `Updated: ${summary.updatedAt}` : null,
-    `Source path: ${summary.sourcePath}`
+    `Source ref: ${publicSourcePathRef(summary.sourcePath)}`
   ].filter(Boolean).join("\n");
   const text = profile.name === "metadata"
     ? metadata
-    : truncateByApproxTokens(`${metadata}\n\nContent:\n${summary.content}`, profile.tokenBudget);
+    : truncateByApproxTokens(`${metadata}\n\nContent:\n${publicSafeText(summary.content, profile.tokenBudget * 6)}`, profile.tokenBudget);
   return {
     sourceKind: "lcm_summary",
     sourceRef: lcmSummaryRef(summary.sourcePath, summary.summaryId),
@@ -11855,7 +11855,7 @@ function lcmSummaryRecord(path: string, row: Record<string, unknown>): LcmSummar
     conversationTitle: nullableString(row.conversationTitle),
     kind: nullableString(row.kind),
     depth: row.depth === null || row.depth === undefined ? null : Number(row.depth),
-    content: redactSafeString(String(row.content ?? "")),
+    content: redactPublicSafeString(String(row.content ?? "")),
     tokenCount: row.tokenCount === null || row.tokenCount === undefined ? null : Number(row.tokenCount),
     createdAt: nullableString(row.createdAt),
     updatedAt: nullableString(row.updatedAt),
@@ -11969,13 +11969,20 @@ function publicSourcePathRef(sourcePath: string): string {
 }
 
 function publicSafeText(value: string, maxChars = 500): string {
-  const redacted = redactSafeString(value)
-    .replace(/\/Volumes\/[^\s"'`)]+/g, "<redacted-path>")
-    .replace(/\/(?:Users|home)\/[^/\s"'`)]+\/\.codex\/[^\s"'`)]+/g, "<redacted-path>")
-    .replace(/\/root\/\.codex\/[^\s"'`)]+/g, "<redacted-path>")
-    .replace(/\/(?:private\/)?(?:tmp|var)\/[^\s"'`)]+/g, "<redacted-path>")
-    .replace(/~\/\.codex\/[^\s"'`)]+/g, "<redacted-path>");
-  return truncate(redacted, maxChars);
+  return truncate(redactPublicSafeString(value), maxChars);
+}
+
+function redactPublicSafeString(value: string): string {
+  const localPathRootPattern =
+    "(?:\\/Volumes\\/|\\/(?:Users|home|root)\\/|\\/(?:private\\/)?(?:tmp|var)\\/|~\\/|(?<![A-Za-z])[A-Za-z]:[\\\\/])";
+  const structuredLabelPattern = "[A-Za-z][A-Za-z0-9 _-]{0,32}:";
+  const relativePathStartPattern = "(?:\\.{1,2}\\/|[A-Za-z0-9_.-]+\\/)";
+  const omissionMarkerPattern = "\\+\\d+\\s+more\\b";
+  const localPathTerminatorPattern =
+    `(?=$|[\\r\\n"'\\\`)\\]}]|\\s+(?:${localPathRootPattern}|${relativePathStartPattern}|${omissionMarkerPattern}|${structuredLabelPattern}))`;
+  const localPathPattern = new RegExp(`${localPathRootPattern}(?:(?!${localPathTerminatorPattern}).)+`, "g");
+  const pathRedacted = value.replace(localPathPattern, "<redacted-path>");
+  return redactSafeString(pathRedacted).replace(localPathPattern, "<redacted-path>");
 }
 
 function publicSafeSearchText(value: string, maxChars = 500): string {

package/packages/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "lossless-openclaw-orchestrator",
   "name": "Lossless OpenClaw Orchestrator",
   "description": "Collaborate with local Codex sessions through OpenClaw using local indexing, prepared-state recall, bounded expansion, and approval-gated dry-run/control boundaries.",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "kind": "tool",
   "tools": {
     "prefix": "loo_"