mirror-mind 0.36.1 → 0.36.2

package/docs/releases/index.md

@@ -12,6 +12,7 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.36.2 — Clearing Out What Another Home Copied](v0.36.2.md) — patch release of one Change Request, CR154, finishing what v0.36.1 began: `mirror conversations imported` lists the Pi conversations an earlier version imported, by the folder each session came from and beside how many sessions the home logged live there, and `remove` deletes the ones you name, only on `--apply` and after a verified backup. `discard-current` no longer fails on a conversation a Soul Mode integration names. No migration.
 - [v0.36.1 — A Home Keeps Only Its Own Pi Sessions](v0.36.1.md) — patch release of one Change Request, CR153: session maintenance imports no Pi session, so the Mirror homes on one machine no longer copy each other's Pi conversations; a home's Pi conversations are the ones the Pi extension logged into it. `PI_SESSIONS_DIR` is inert. Conversations an earlier version imported stay, and the note shows how to list them. Update every install that has a home. No migration.
 - [v0.36.0 — Five Runtimes, and a Home's Extensions on Every One](v0.36.0.md) — minor release closing CV21.DS10: Grok Build is the fifth runtime, at its honest L3 through the canonical plugin in two printed steps, measured live on grok 1.0.62. With it, CV21.DS5.US2: a home's installed extensions reach Claude Code, Codex, Antigravity, and Grok Build as one generated plugin per home, chosen by measurement on all four. Three Change Requests found by use: an extension's settings file (`extensions/<id>.env`, merged under the environment for the one spawned process), a quiet exit on a closed pipe, and a `bind` that refuses what it cannot bind. No migration.
 - [v0.35.0 — Four Runtimes, One Successor](v0.35.0.md) — minor release closing CV21.DS8: the Gemini CLI integration no longer ships and Antigravity stands in its place, the gate met by DS7's live L4 on agy 1.4.2. Four runtimes — Pi, Claude Code, Codex, Antigravity — named everywhere; the cutoff recorded in full, with the four hook entries a Gemini CLI user deletes and v0.34.0 as the last release that carries the integration; a retired-surface guard keeps it removed. No migration.

package/docs/releases/v0.36.2.md

@@ -0,0 +1,130 @@
+---
+digest: >
+  v0.36.2 is a patch release of one Change Request, CR154, which finishes what
+  v0.36.1 began. v0.36.1 stopped Mirror importing Pi sessions, but the
+  conversations an earlier version had imported stayed, and the only way to
+  see them was a SQL query. `mirror conversations imported` now lists them by
+  the folder each session came from, beside how many Pi sessions the home
+  logged live there, and `remove` deletes the ones you name, only on
+  `--apply` and only after a verified backup. With it, `discard-current` no
+  longer fails on a conversation a Soul Mode integration names. No migration.
+---
+
+# v0.36.2 — Clearing Out What Another Home Copied
+
+**Date:** 2026-10-21
+
+## Highlights
+
+- **`mirror conversations imported` shows what an earlier version imported**
+  ([CR154](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr154-a-home-cannot-list-or-remove-the-pi-conversations-it-imported.md)):
+  one line per folder the session came from, with how many conversations were imported
+  from it and how many Pi sessions this home logged live there. A folder where the home
+  logged nothing live is most likely another home's work. `--project <text>` lists a
+  folder's conversations.
+- **`remove` deletes what you name, and nothing else.** Ids, or every import of one
+  folder, written exactly as the listing prints it. It is a dry run until `--apply`;
+  `--apply` takes a dated backup, verifies it, and removes in one transaction. Memories
+  and provider-call records that named a removed conversation are kept, unlinked, and
+  the report names the backups that still hold copies.
+- **A typo cannot widen a removal.** Every option is declared, and one the command does
+  not know is refused before the database opens.
+- **`discard-current` works on a Soul Mode conversation.** It failed with `FOREIGN KEY
+  constraint failed` on any conversation a Soul Mode integration named. Deleting a
+  conversation now decides every table that references one, and a test reads the
+  schema so the next such table cannot be missed.
+
+## Where We Started
+
+v0.36.1 stopped session maintenance from importing Pi sessions, the defect that let the
+Mirror homes on one machine copy each other's conversations. It removed the cause and
+said so: the copies stayed, and the note gave a SQL query to list them. Deleting them
+was the person's decision, and no command could carry it out — `discard-current`
+removes only the current conversation.
+
+## What Changed
+
+**One command, folders first.** A home can hold hundreds of imports, and the decision a
+person makes is about where they came from, so the listing leads with folders. The
+folder is the directory the Pi session file lived in, read from the path the home
+stored; Mirror reads no Pi file to learn it. Beside each folder, the number of Pi
+sessions the home logged live from it. On the maintainer's production home, 96 imports
+came from one development worktree and 76 from the development checkout, where it had
+logged none live, and 3 from its own workspace, where it had logged 714. In a home made
+by copying another, the copied rows count as its own, which blurs the number.
+
+**Removal is careful by construction.** A dry run first, with the exact command that
+applies it to the same home. On `--apply`, the set is decided read-only; a refusal or
+an empty set stops there, with no backup. Then the dated archive, verified; then one
+transaction that decides the set again and refuses if it moved. An id must name exactly
+one imported conversation, by its full id or by a prefix of at least eight characters:
+a live conversation, an unknown id, or an ambiguous prefix refuses the whole command.
+
+**A review before any code.** Five personas reviewed the plan. The database architect
+found that the deletion `discard-current` used, the one this command meant to reuse,
+missed one of the six tables that reference a conversation, so with foreign keys on, a
+conversation a Soul Mode integration named could not be deleted at all — measured on a
+scratch home, then fixed for both commands. The security engineer found that under the
+listing's lenient parser, a typo such as `--projet` would drop the folder filter and
+remove every import in the home; the command parses strictly, with the parser `backup`
+and `repair-encoding` already used.
+
+**Validated on a copy of the real thing.** On a scratch home made from a fresh backup of
+the maintainer's development home, the command listed 515 imports from 22 folders
+and 5 of unknown origin, refused the typo, and removed the 418 from the production workspace's folder with their
+21,901 messages. Live conversations, memories, and provider-call records kept their
+counts.
+
+### What you will notice
+
+- A new command, `mirror conversations imported`, and its `remove`.
+- `discard-current` deletes a conversation that a Soul Mode integration names.
+
+## Upgrading
+
+```bash
+mirror runtime update          # or: npm install -g mirror-mind
+```
+
+There is no database migration, and no runtime wiring changes. Then, if you ran more
+than one home:
+
+```bash
+mirror conversations imported
+mirror conversations imported --project <text>
+mirror conversations imported remove --all --project <folder>
+mirror conversations imported remove --all --project <folder> --apply
+```
+
+Start with the folders where "logged live here" is 0, and look at a folder's
+conversations before removing them. The dated backups made since the import, and the
+pre-write backup, keep copies until you delete them or they age out (30 days for an
+archive).
+
+## Conscious Exclusions
+
+- **Telling another home's copy from a gap this home filled for itself.** That takes
+  both homes' databases, and no home reads another's. The folders and the logged-live
+  counts are the evidence a person decides on.
+- **Removing anything from backups.**
+- **Options before the subcommand.** `mirror conversations --db-path X imported` shows
+  the plain listing and removes nothing; that is
+  [CR096](../project/refinement/rs009-cv22-front-door-routing-correctness/cr096-conversations-lists-instead-of-appending-when-options-come-first.md)'s
+  class.
+- **A tool for models.** No MCP tool and no skill runs this command: a person does.
+
+## What We Learned
+
+Reusing a routine is a claim about it. The deletion `discard-current` used was correct
+for the tables it knew, and wrong the day another table began to reference a
+conversation. The question that found it — which tables reference a conversation? — is
+now a test that asks the schema, not a person's memory.
+
+A lenient parser is harmless in a listing and dangerous in a deletion: the same ignored
+token is a no-op in one and a wider removal in the other.
+
+## Next Horizon
+
+CV21.DS5.TS4, then DS11 and CV21's own release. Captured and open: CR155, `runtime
+diagnose` reading the Pi extension's error lines; CR156, what copying a home makes;
+CR157, three settings `REFERENCE.md` lists that nothing reads.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "description": "Mirror Mind: a local-first memory and identity framework for agentic AI runtimes (Pi, Claude Code, Codex, Antigravity)",
   "license": "MIT",
   "repository": {

package/plugins/mirror-mind/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
   "author": {
     "name": "Mirror Mind"

package/plugins/mirror-mind/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mirror-mind",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "mcpServers": {
     "mirror-mind": {
       "command": "/bin/sh",

package/ts/src/conversation/conversationDeletion.ts

@@ -0,0 +1,45 @@
+// What deleting a conversation means, in one place (CR154, review findings D1
+// and E2).
+//
+// Ported as Python's `ConversationService.delete_conversations` for one id, and
+// private to `logger.ts` while `discard-current` was its only caller. CR154's
+// removal of imported Pi conversations is the second, so it lives here now.
+//
+// Six tables reference a conversation, and each gets a decision: what is only
+// the conversation's own is deleted with it, and what outlives it is kept with
+// its link cleared -- a memory extracted from the conversation is still a
+// memory, a provider call still happened, a session row still names its
+// session, an identity integration is still part of the identity. Foreign keys
+// are on (`database.ts`), so a table without a decision makes the conversation
+// undeletable: before CR154 the routine missed `identity_integrations`, and
+// `discard-current` failed with `FOREIGN KEY constraint failed` on any
+// conversation a Soul Mode integration named. `conversationDeletion.test.ts`
+// reads the schema's foreign keys and fails when a table appears that the
+// lists below do not decide.
+
+import type { WritableDatabase } from "#db/database.ts";
+
+/** Every table that references `conversations(id)`, by what deletion does to its rows. */
+export const CONVERSATION_REFERENCES = {
+  /** The conversation's own rows: deleted with it. */
+  deleted: ["conversation_embeddings", "messages"],
+  /** Rows that outlive it: kept, their `conversation_id` set to null. */
+  unlinked: ["identity_integrations", "llm_calls", "memories", "runtime_sessions"],
+} as const;
+
+/**
+ * Delete one conversation: its own rows first, then the links that outlive
+ * it, then the conversation. Runs no transaction of its own -- every caller
+ * wraps it in one with whatever else must move together.
+ */
+export function deleteConversation(db: WritableDatabase, conversationId: string): void {
+  for (const table of CONVERSATION_REFERENCES.deleted) {
+    db.prepare(`DELETE FROM ${table} WHERE conversation_id = ?`).run(conversationId);
+  }
+  for (const table of CONVERSATION_REFERENCES.unlinked) {
+    db.prepare(`UPDATE ${table} SET conversation_id = NULL WHERE conversation_id = ?`).run(
+      conversationId,
+    );
+  }
+  db.prepare("DELETE FROM conversations WHERE id = ?").run(conversationId);
+}

package/ts/src/conversation/importedConversations.ts

@@ -0,0 +1,288 @@
+// The Pi conversations an earlier version imported rather than logged (CR154).
+//
+// Until v0.36.1, session maintenance copied Pi session files into the home and
+// imported each as a closed conversation (CR153 retired that). On a machine
+// with two homes, each took the other's sessions, along with sessions of Pi run
+// without Mirror and of scratch homes. This module lets a person see them and
+// remove the ones they choose. It reads no Pi file: everything it knows, the
+// home already holds.
+//
+// An import is told apart by construction: the import stamped `started_at` when
+// it copied the session and `ended_at` from the session's last message, so an
+// import starts at or after its own end, and a live conversation never does.
+// Both instants must carry a zone. A conversation with a zone-less timestamp is
+// never an import, whatever the order says: the comparison would be a guess,
+// and the guess would offer a live conversation for removal.
+//
+// Where an import came from is the directory of its session file, read from
+// the path its runtime-session row stored (Pi names a project's directory
+// `--<path with / as ->--`; the wrapping dashes are dropped). Beside it, how
+// many Pi sessions this home logged live from the same directory -- the one
+// number that tells another home's work (none logged live here) from this
+// home's own gaps. It blurs in a home made by copying another: the copied rows
+// count as its own.
+
+import { basename, dirname } from "node:path";
+import { deleteConversation } from "#conversation/conversationDeletion.ts";
+import { type Database, type WritableDatabase, withTransaction } from "#db/database.ts";
+
+/** The folder of an import with no runtime-session row left to say where it came from. */
+export const UNKNOWN_FOLDER = "(unknown)";
+
+/** How much of an id a person must give to name one conversation: what the listing prints. */
+export const MIN_ID_PREFIX = 8;
+
+export interface ImportedConversation {
+  id: string;
+  title: string | null;
+  /** When it was imported: the conversation's `started_at`. */
+  importedAt: string;
+  /** The session's last message: the conversation's `ended_at`. */
+  endedAt: string;
+  messageCount: number;
+  folder: string;
+}
+
+export interface FolderSummary {
+  folder: string;
+  imported: number;
+  messages: number;
+  /** Pi sessions this home logged live from the folder; null for the unknown folder. */
+  loggedLive: number | null;
+}
+
+export interface ImportsSummary {
+  conversations: number;
+  messages: number;
+  firstImportedAt: string | null;
+  lastImportedAt: string | null;
+  /** Most imported first, then by name; the unknown folder last. */
+  folders: FolderSummary[];
+}
+
+/** Ids, each a full id or a prefix of at least `MIN_ID_PREFIX`; or every import, of one folder or all. */
+export type ImportRemovalRequest =
+  | { readonly ids: readonly string[] }
+  | { readonly all: true; readonly folder: string | null };
+
+export type ImportRemovalPlan =
+  | { ok: true; conversations: ImportedConversation[] }
+  | { ok: false; refusal: string };
+
+export interface ImportRemovalResult {
+  conversations: ImportedConversation[];
+  messages: number;
+}
+
+/** The plan refused the request inside the removal's transaction. */
+export class ImportRemovalRefusedError extends Error {
+  constructor(refusal: string) {
+    super(refusal);
+    this.name = "ImportRemovalRefusedError";
+  }
+}
+
+/** The set the transaction found is not the set the person was shown. */
+export class ImportRemovalSetMovedError extends Error {
+  constructor() {
+    super("the imports to remove changed since they were listed");
+    this.name = "ImportRemovalSetMovedError";
+  }
+}
+
+const ZONED = /(?:Z|[+-]\d{2}:\d{2})$/;
+
+/** An import starts at or after its own last message; both instants carry a zone. */
+export function isImportShaped(startedAt: string, endedAt: string | null): boolean {
+  if (endedAt === null || !ZONED.test(startedAt) || !ZONED.test(endedAt)) return false;
+  const started = Date.parse(startedAt);
+  const ended = Date.parse(endedAt);
+  if (Number.isNaN(started) || Number.isNaN(ended)) return false;
+  return started >= ended;
+}
+
+/** The directory a Pi session file lived in, from its stored path; Pi's wrapping dashes dropped. */
+export function sessionFolder(sessionPath: string | null): string {
+  if (!sessionPath) return UNKNOWN_FOLDER;
+  const parent = dirname(sessionPath);
+  const name = basename(parent);
+  if (parent === "." || parent === sessionPath || !name) return UNKNOWN_FOLDER;
+  return name.length > 4 && name.startsWith("--") && name.endsWith("--") ? name.slice(2, -2) : name;
+}
+
+function nullableString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+/** Every Pi import in the home, newest import first. */
+export function listImportedPiConversations(db: Database): ImportedConversation[] {
+  // SQL narrows to the shape; `isImportShaped` decides, zones included.
+  const rows = db
+    .prepare(
+      `SELECT c.id, c.title, c.started_at, c.ended_at,
+              (SELECT COUNT(*) FROM messages m WHERE m.conversation_id = c.id) AS message_count,
+              (SELECT r.session_id FROM runtime_sessions r
+                WHERE r.conversation_id = c.id ORDER BY r.rowid LIMIT 1) AS session_path
+         FROM conversations c
+        WHERE c.interface = 'pi' AND c.ended_at IS NOT NULL
+          AND julianday(c.started_at) >= julianday(c.ended_at)
+        ORDER BY julianday(c.started_at) DESC, c.id`,
+    )
+    .all();
+  const imports: ImportedConversation[] = [];
+  for (const row of rows) {
+    const startedAt = String(row.started_at);
+    const endedAt = nullableString(row.ended_at);
+    if (endedAt === null || !isImportShaped(startedAt, endedAt)) continue;
+    imports.push({
+      id: String(row.id),
+      title: nullableString(row.title),
+      importedAt: startedAt,
+      endedAt,
+      messageCount: Number(row.message_count),
+      folder: sessionFolder(nullableString(row.session_path)),
+    });
+  }
+  return imports;
+}
+
+/** Pi sessions this home logged live, by the folder their session file lived in. */
+export function countLiveSessionsByFolder(db: Database): Map<string, number> {
+  const rows = db
+    .prepare(
+      `SELECT r.session_id, c.started_at, c.ended_at
+         FROM runtime_sessions r JOIN conversations c ON c.id = r.conversation_id
+        WHERE r.interface = 'pi' AND c.interface = 'pi'`,
+    )
+    .all();
+  const counts = new Map<string, number>();
+  for (const row of rows) {
+    if (isImportShaped(String(row.started_at), nullableString(row.ended_at))) continue;
+    const folder = sessionFolder(nullableString(row.session_id));
+    counts.set(folder, (counts.get(folder) ?? 0) + 1);
+  }
+  return counts;
+}
+
+/** Totals and one line per folder, for the listing. */
+export function summarizeImports(
+  imports: readonly ImportedConversation[],
+  loggedLive: ReadonlyMap<string, number>,
+): ImportsSummary {
+  const byFolder = new Map<string, FolderSummary>();
+  let messages = 0;
+  let first: string | null = null;
+  let last: string | null = null;
+  for (const item of imports) {
+    messages += item.messageCount;
+    if (first === null || Date.parse(item.importedAt) < Date.parse(first)) first = item.importedAt;
+    if (last === null || Date.parse(item.importedAt) > Date.parse(last)) last = item.importedAt;
+    const summary = byFolder.get(item.folder) ?? {
+      folder: item.folder,
+      imported: 0,
+      messages: 0,
+      loggedLive: item.folder === UNKNOWN_FOLDER ? null : (loggedLive.get(item.folder) ?? 0),
+    };
+    summary.imported += 1;
+    summary.messages += item.messageCount;
+    byFolder.set(item.folder, summary);
+  }
+  const folders = [...byFolder.values()].sort((a, b) => {
+    if ((a.folder === UNKNOWN_FOLDER) !== (b.folder === UNKNOWN_FOLDER)) {
+      return a.folder === UNKNOWN_FOLDER ? 1 : -1;
+    }
+    return b.imported - a.imported || a.folder.localeCompare(b.folder);
+  });
+  return {
+    conversations: imports.length,
+    messages,
+    firstImportedAt: first,
+    lastImportedAt: last,
+    folders,
+  };
+}
+
+function refuse(refusal: string): ImportRemovalPlan {
+  return { ok: false, refusal };
+}
+
+/**
+ * What a request names, decided once for the dry run and again inside the
+ * removal's transaction. Any id that does not name exactly one import refuses
+ * the whole request: nothing is removed on a partial match.
+ */
+export function planImportRemoval(db: Database, request: ImportRemovalRequest): ImportRemovalPlan {
+  const imports = listImportedPiConversations(db);
+  if ("all" in request) {
+    if (request.folder === null) return { ok: true, conversations: imports };
+    const named = imports.filter((item) => item.folder === request.folder);
+    if (named.length === 0) {
+      return refuse(
+        `no imported conversations from folder '${request.folder}' in this home: the listing names the folders that have them, exactly`,
+      );
+    }
+    return { ok: true, conversations: named };
+  }
+
+  const byId = new Map(imports.map((item) => [item.id, item]));
+  const chosen = new Map<string, ImportedConversation>();
+  // `substr` rather than LIKE: an id the person types is matched as written,
+  // never as a pattern.
+  const matching = db.prepare("SELECT id FROM conversations WHERE substr(id, 1, ?) = ?");
+  for (const given of request.ids) {
+    if (given.length < MIN_ID_PREFIX) {
+      return refuse(
+        `'${given}' is too short: give at least ${MIN_ID_PREFIX} characters of a conversation id, as the listing prints them`,
+      );
+    }
+    const matches = matching.all(given.length, given).map((row) => String(row.id));
+    if (matches.length === 0) return refuse(`no conversation '${given}' in this home`);
+    if (matches.length > 1) {
+      return refuse(`'${given}' matches ${matches.length} conversations: give more of the id`);
+    }
+    const id = matches[0] as string;
+    const imported = byId.get(id);
+    if (imported === undefined) {
+      return refuse(
+        `conversation ${id.slice(0, MIN_ID_PREFIX)} is not an imported Pi conversation; this command removes only those`,
+      );
+    }
+    chosen.set(id, imported);
+  }
+  return { ok: true, conversations: imports.filter((item) => chosen.has(item.id)) };
+}
+
+function sameIds(a: readonly string[], b: readonly string[]): boolean {
+  if (a.length !== b.length) return false;
+  const sortedA = [...a].sort();
+  const sortedB = [...b].sort();
+  return sortedA.every((id, index) => id === sortedB[index]);
+}
+
+/**
+ * Remove what the request names, in one transaction: all or nothing. The set is
+ * decided again inside the transaction and must be the one the person was
+ * shown (`expectedIds`); if it moved, nothing is removed. Each import's session
+ * row goes with it -- it bound nothing but the import -- and the conversation
+ * goes through the shared deletion.
+ */
+export function removeImportedConversations(
+  db: WritableDatabase,
+  request: ImportRemovalRequest,
+  expectedIds: readonly string[],
+): ImportRemovalResult {
+  return withTransaction(db, () => {
+    const plan = planImportRemoval(db, request);
+    if (!plan.ok) throw new ImportRemovalRefusedError(plan.refusal);
+    const ids = plan.conversations.map((item) => item.id);
+    if (!sameIds(ids, expectedIds)) throw new ImportRemovalSetMovedError();
+    const removeSessionRows = db.prepare("DELETE FROM runtime_sessions WHERE conversation_id = ?");
+    let messages = 0;
+    for (const item of plan.conversations) {
+      removeSessionRows.run(item.id);
+      deleteConversation(db, item.id);
+      messages += item.messageCount;
+    }
+    return { conversations: plan.conversations, messages };
+  });
+}

package/ts/src/conversation/logger.ts

@@ -13,6 +13,7 @@
 import { closeSync, existsSync, mkdirSync, openSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { isCommandTurn } from "#conversation/commandTurn.ts";
+import { deleteConversation } from "#conversation/conversationDeletion.ts";
 import { markCloseTailPending } from "#conversation/deferredCloseTail.ts";
 import {
   lastAssistantMessageOf,
@@ -453,25 +454,10 @@ export async function endSession(
 }
 
 /**
- * Python `ConversationService.delete_conversations` for one resolved id:
- * extracted memories survive with a nulled FK rather than cascading away.
+ * Python `discard_current_conversation`: delete and mark the session discarded.
+ * The deletion is `conversationDeletion.ts`'s, shared with CR154's removal of
+ * imported Pi conversations.
  */
-function deleteConversation(db: WritableDatabase, conversationId: string): void {
-  db.prepare("DELETE FROM messages WHERE conversation_id = ?").run(conversationId);
-  db.prepare("DELETE FROM conversation_embeddings WHERE conversation_id = ?").run(conversationId);
-  db.prepare("UPDATE memories SET conversation_id = NULL WHERE conversation_id = ?").run(
-    conversationId,
-  );
-  db.prepare("UPDATE llm_calls SET conversation_id = NULL WHERE conversation_id = ?").run(
-    conversationId,
-  );
-  db.prepare("UPDATE runtime_sessions SET conversation_id = NULL WHERE conversation_id = ?").run(
-    conversationId,
-  );
-  db.prepare("DELETE FROM conversations WHERE id = ?").run(conversationId);
-}
-
-/** Python `discard_current_conversation`: delete and mark the session discarded. */
 export function discardCurrentConversation(
   db: WritableDatabase,
   sessionId: string | null,

package/ts/src/frontDoor/cli.ts

@@ -22,6 +22,7 @@
 import { accessSync, constants, existsSync, readFileSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { pathToFileURL } from "node:url";
+import { createZipBackup } from "#backup/zipBackup.ts";
 import {
   AppendRejectedError,
   type AppendRejectionReason,
@@ -68,6 +69,7 @@ import {
   JOURNAL_TRANSPORT,
   WEEK_PLAN_TRANSPORT,
 } from "#providers/transport.ts";
+import { verifyBackupArchive } from "#runtime/backup.ts";
 import { exitQuietlyOnBrokenPipe } from "#runtime/brokenPipe.ts";
 import {
   configFilePath,
@@ -107,6 +109,10 @@ import { runBackupRoute, runRepairEncodingRoute } from "./dbSafetyToolsRoute.ts"
 import { defaultExploreRouteDeps, runExploreRoute } from "./exploreRoute.ts";
 import { frontDoorLogPath, logFrontDoor } from "./frontDoorLog.ts";
 import { applyIdentitySet } from "./identityWrite.ts";
+import {
+  isImportedConversationsCommand,
+  runImportedConversationsRoute,
+} from "./importedConversationsRoute.ts";
 import { applyJourneySetPath } from "./journeyWriteRoute.ts";
 import { openLiveWriteDatabase } from "./liveBackup.ts";
 import {
@@ -1759,6 +1765,22 @@ async function dispatchTs(argv: readonly string[]): Promise<number | DispatchOut
   if (argv[0] === "soul") return runSoulWrite(argv);
   if (argv[0] === "explore") return runExploreWrite(argv);
   if (isConversationsAppend(argv)) return runConversationsAppend(argv);
+  // CR154: allowlisted by name, like `append`, so the listing never answers it.
+  // The listing and the dry run read; `--apply` writes behind the pre-write
+  // backup, after its own dated, verified archive.
+  if (isImportedConversationsCommand(argv)) {
+    return runImportedConversationsRoute(argv, {
+      withReadOnlyDatabase: (read) => withMirrorReadDb(argv, read),
+      withLiveWriteDatabase: (write) => {
+        const dbPath = resolveDbPathForCli(argv.slice(1));
+        if (dbPath === null) return 2;
+        return withLiveWriteDbAt(dbPath, "conversations", (db) => write(db, dbPath));
+      },
+      backup: (dbPath) =>
+        createZipBackup({ dbPath, mirrorHome: dirname(dbPath), backupDir: null, silent: true }),
+      verifyBackup: (archive) => verifyBackupArchive(archive),
+    });
+  }
   // CV22.DS7.TS1: the DB safety tools. `backup` never opens or bootstraps the
   // database; `repair-encoding --apply` rides the live-write seam.
   if (argv[0] === "backup") {

package/ts/src/frontDoor/dbSafetyToolsRoute.ts

@@ -27,6 +27,7 @@ import {
   scanDatabase,
 } from "#repair/encodingRepair.ts";
 import { expandHome } from "#util/paths.ts";
+import { parseArgs } from "#util/strictArgs.ts";
 import { MirrorHomeNotConfiguredError } from "./dbPath.ts";
 
 const BACKUP_USAGE =
@@ -34,41 +35,6 @@ const BACKUP_USAGE =
 const REPAIR_USAGE =
   "usage: repair-encoding [-h] [--mirror-home MIRROR_HOME] [--apply] [--no-backup] [--limit LIMIT]";
 
-interface ParsedArgs {
-  flags: Set<string>;
-  values: Map<string, string>;
-  error: string | null;
-}
-
-/** argparse-shaped parsing: known flags, known valued options, nothing else. */
-function parseArgs(
-  args: readonly string[],
-  spec: { flags: readonly string[]; valued: readonly string[] },
-): ParsedArgs {
-  const flags = new Set<string>();
-  const values = new Map<string, string>();
-  const unrecognized: string[] = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] as string;
-    if (spec.flags.includes(arg)) {
-      flags.add(arg);
-    } else if (spec.valued.includes(arg)) {
-      const value = args[index + 1];
-      if (value === undefined)
-        return { flags, values, error: `argument ${arg}: expected one argument` };
-      values.set(arg, value);
-      index += 1;
-    } else {
-      unrecognized.push(arg);
-    }
-  }
-  return {
-    flags,
-    values,
-    error: unrecognized.length > 0 ? `unrecognized arguments: ${unrecognized.join(" ")}` : null,
-  };
-}
-
 function usageError(usage: string, program: string, message: string): number {
   process.stderr.write(`${usage}\n${program}: error: ${message}\n`);
   return 2;

package/ts/src/frontDoor/importedConversationsRoute.ts

@@ -0,0 +1,337 @@
+// `mirror conversations imported` (CR154): see the Pi conversations an earlier
+// version imported rather than logged, and remove the ones a person names.
+//
+//   conversations imported [--project TEXT]
+//   conversations imported remove (ID... | --all [--project FOLDER]) [--apply]
+//
+// Folders first: a home holds hundreds of imports, and the decision a person
+// makes is about where they came from. Removal is a dry run until `--apply`,
+// which decides the set first (refusals and an empty set stop there, with no
+// backup), takes the dated backup and verifies it, and only then removes, in
+// one transaction that decides the set again and refuses if it moved. Every
+// option is declared: a typo is refused before anything opens, because under a
+// lenient parser a misspelled `--project` would widen a removal to every import
+// in the home.
+//
+// The module that decides what an import is, and removes it, is
+// `#conversation/importedConversations.ts`; this file parses, opens, and
+// prints. Nothing here is offered to a model: no MCP tool, no skill.
+
+import { existsSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { parseArchiveStamp, RETENTION_DAYS } from "#backup/zipBackup.ts";
+import {
+  countLiveSessionsByFolder,
+  type ImportedConversation,
+  ImportRemovalRefusedError,
+  type ImportRemovalRequest,
+  ImportRemovalSetMovedError,
+  listImportedPiConversations,
+  planImportRemoval,
+  removeImportedConversations,
+  summarizeImports,
+} from "#conversation/importedConversations.ts";
+import type { Database, WritableDatabase } from "#db/database.ts";
+import { PROGRAM } from "#util/program.ts";
+import { shellWord } from "#util/shellWord.ts";
+import { parseArgs } from "#util/strictArgs.ts";
+import { backupPathFor } from "./liveBackup.ts";
+
+const USAGE = [
+  `usage: ${PROGRAM} conversations imported [--project TEXT] [--mirror-home PATH] [--db-path PATH]`,
+  `       ${PROGRAM} conversations imported remove (ID ... | --all [--project FOLDER]) [--apply] [--mirror-home PATH] [--db-path PATH]`,
+].join("\n");
+
+/** How argparse names the program in an error line. */
+const PROG = `${PROGRAM} conversations imported`;
+
+const WHAT_AN_IMPORT_IS =
+  "Mirror copied these from Pi's session files instead of logging them as they happened. " +
+  "Since v0.36.1 it imports none.";
+
+const HOME_OPTIONS = ["--mirror-home", "--db-path"] as const;
+
+export interface ImportedConversationsIo {
+  /** The home's database, read-only: the listing and the dry run. */
+  withReadOnlyDatabase: (read: (db: Database) => number) => number;
+  /** The home's database behind the front door's pre-write backup: `--apply` only. */
+  withLiveWriteDatabase: (write: (db: WritableDatabase, dbPath: string) => number) => number;
+  /** The dated archive `repair-journeys --apply` gates on; its path, or null on failure. */
+  backup: (dbPath: string) => string | null;
+  verifyBackup: (archivePath: string) => { valid: boolean; note: string | null };
+  stdout?: (line: string) => void;
+  stderr?: (line: string) => void;
+}
+
+export function isImportedConversationsCommand(argv: readonly string[]): boolean {
+  return argv[0] === "conversations" && argv[1] === "imported";
+}
+
+function plural(count: number, word: string): string {
+  return `${count} ${word}${count === 1 ? "" : "s"}`;
+}
+
+function day(instant: string): string {
+  return instant.slice(0, 10);
+}
+
+function localDay(date: Date): string {
+  const pad = (value: number) => String(value).padStart(2, "0");
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`;
+}
+
+function byFolder(conversations: readonly ImportedConversation[]): [string, number][] {
+  const counts = new Map<string, number>();
+  for (const item of conversations) counts.set(item.folder, (counts.get(item.folder) ?? 0) + 1);
+  return [...counts.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+}
+
+function messagesIn(conversations: readonly ImportedConversation[]): number {
+  return conversations.reduce((sum, item) => sum + item.messageCount, 0);
+}
+
+export function runImportedConversationsRoute(
+  argv: readonly string[],
+  io: ImportedConversationsIo,
+): number {
+  const out = io.stdout ?? ((line: string) => process.stdout.write(`${line}\n`));
+  const err = io.stderr ?? ((line: string) => process.stderr.write(`${line}\n`));
+  const usageError = (message: string): number => {
+    err(USAGE);
+    err(`${PROG}: error: ${message}`);
+    return 2;
+  };
+
+  const rest = argv.slice(2);
+  if (rest.includes("-h") || rest.includes("--help")) {
+    out(USAGE);
+    return 0;
+  }
+  const removing = rest[0] === "remove";
+  const parsed = parseArgs(removing ? rest.slice(1) : rest, {
+    flags: removing ? ["--all", "--apply"] : [],
+    valued: ["--project", ...HOME_OPTIONS],
+    positionals: removing,
+  });
+  if (parsed.error) return usageError(parsed.error);
+  const project = parsed.values.get("--project") ?? null;
+
+  if (!removing) return list(io, out, project);
+
+  const ids = parsed.positionals;
+  const all = parsed.flags.has("--all");
+  if (ids.length > 0 && all) return usageError("give conversation ids or --all, not both");
+  if (ids.length === 0 && !all) return usageError("give conversation ids, or --all");
+  if (project !== null && !all) {
+    return usageError("--project narrows --all; give it with --all, not with ids");
+  }
+  const request: ImportRemovalRequest = all ? { all: true, folder: project } : { ids };
+
+  if (!parsed.flags.has("--apply")) {
+    // The command that applies this dry run, to the same home, every value quoted.
+    const words = ["conversations", "imported", "remove"];
+    if (all) {
+      words.push("--all");
+      if (project !== null) words.push("--project", project);
+    } else {
+      words.push(...ids);
+    }
+    for (const option of HOME_OPTIONS) {
+      const value = parsed.values.get(option);
+      if (value !== undefined) words.push(option, value);
+    }
+    words.push("--apply");
+    const applyCommand = [PROGRAM, ...words.map(shellWord)].join(" ");
+    return dryRun(io, out, err, request, applyCommand);
+  }
+  return apply(io, out, err, request);
+}
+
+function list(
+  io: ImportedConversationsIo,
+  out: (line: string) => void,
+  project: string | null,
+): number {
+  return io.withReadOnlyDatabase((db) => {
+    const imports = listImportedPiConversations(db);
+    if (imports.length === 0) {
+      out("No imported Pi conversations in this home.");
+      return 0;
+    }
+    const needle = project?.toLowerCase() ?? null;
+    const shown =
+      needle === null
+        ? imports
+        : imports.filter((item) => item.folder.toLowerCase().includes(needle));
+    if (shown.length === 0) {
+      out(`No imported Pi conversations from a folder matching '${project}'.`);
+      return 0;
+    }
+    const summary = summarizeImports(shown, countLiveSessionsByFolder(db));
+    const scope = project === null ? "" : `, from folders matching '${project}'`;
+    out(
+      `Imported Pi conversations: ${summary.conversations} (${plural(summary.messages, "message")}), ` +
+        `imported ${day(summary.firstImportedAt ?? "")} to ${day(summary.lastImportedAt ?? "")}${scope}.`,
+    );
+    out(WHAT_AN_IMPORT_IS);
+    out("");
+    out("  imported  logged live here  folder");
+    for (const folder of summary.folders) {
+      const live = folder.loggedLive === null ? "-" : String(folder.loggedLive);
+      out(`${String(folder.imported).padStart(10)}${live.padStart(18)}  ${folder.folder}`);
+    }
+    if (project !== null) {
+      out("");
+      for (const item of shown) {
+        out(
+          `  ${day(item.importedAt)}  ${item.id}  ${plural(item.messageCount, "msg")}  ${item.folder}  ${item.title ?? "(untitled)"}`,
+        );
+      }
+    }
+    out("");
+    out(`To see a folder's conversations:  ${PROGRAM} conversations imported --project <text>`);
+    out(
+      `To remove a folder's imports:     ${PROGRAM} conversations imported remove --all --project <folder>`,
+    );
+    out("                                  (it shows what it would remove; add --apply to remove)");
+    return 0;
+  });
+}
+
+function dryRun(
+  io: ImportedConversationsIo,
+  out: (line: string) => void,
+  err: (line: string) => void,
+  request: ImportRemovalRequest,
+  applyCommand: string,
+): number {
+  return io.withReadOnlyDatabase((db) => {
+    const plan = planImportRemoval(db, request);
+    if (!plan.ok) {
+      err(`${plan.refusal}. Nothing was removed.`);
+      return 1;
+    }
+    if (plan.conversations.length === 0) {
+      out("Nothing to remove.");
+      return 0;
+    }
+    out(
+      `Would remove ${plural(plan.conversations.length, "imported Pi conversation")} ` +
+        `(${plural(messagesIn(plan.conversations), "message")}):`,
+    );
+    for (const [folder, count] of byFolder(plan.conversations)) {
+      out(`${String(count).padStart(10)}  ${folder}`);
+    }
+    out("Nothing was removed. To remove them, run:");
+    out(`  ${applyCommand}`);
+    return 0;
+  });
+}
+
+function apply(
+  io: ImportedConversationsIo,
+  out: (line: string) => void,
+  err: (line: string) => void,
+  request: ImportRemovalRequest,
+): number {
+  // Decide first, read-only: a refusal or an empty set stops here, and takes no
+  // backup. A holder rather than a variable: it is assigned inside a callback.
+  const decided: { conversations: ImportedConversation[] | null } = { conversations: null };
+  const decidedCode = io.withReadOnlyDatabase((db) => {
+    const plan = planImportRemoval(db, request);
+    if (!plan.ok) {
+      err(`${plan.refusal}. Nothing was removed.`);
+      return 1;
+    }
+    if (plan.conversations.length === 0) {
+      out("Nothing to remove.");
+      return 0;
+    }
+    decided.conversations = plan.conversations;
+    return 0;
+  });
+  const expected = decided.conversations;
+  if (decidedCode !== 0 || expected === null) return decidedCode;
+
+  return io.withLiveWriteDatabase((db, dbPath) => {
+    let archive: string | null;
+    try {
+      archive = io.backup(dbPath);
+    } catch {
+      archive = null;
+    }
+    if (archive === null) {
+      err("The backup failed, so nothing was removed.");
+      return 1;
+    }
+    const verification = io.verifyBackup(archive);
+    if (!verification.valid) {
+      err(
+        `The backup ${archive} did not verify (${verification.note ?? "no reason given"}), so nothing was removed.`,
+      );
+      return 1;
+    }
+    let removed: { conversations: ImportedConversation[]; messages: number };
+    try {
+      removed = removeImportedConversations(
+        db,
+        request,
+        expected.map((item) => item.id),
+      );
+    } catch (error) {
+      if (error instanceof ImportRemovalSetMovedError) {
+        err(
+          "The imports changed while the backup was taken, so nothing was removed. Run it again.",
+        );
+        return 1;
+      }
+      if (error instanceof ImportRemovalRefusedError) {
+        err(`${error.message}. Nothing was removed.`);
+        return 1;
+      }
+      throw error;
+    }
+    out(`Backup: ${archive} (verified).`);
+    out(
+      `Removed ${plural(removed.conversations.length, "imported Pi conversation")} ` +
+        `(${plural(removed.messages, "message")}) from ${plural(byFolder(removed.conversations).length, "folder")}.`,
+    );
+    out("Memories and provider-call records that named them were kept, unlinked.");
+    for (const line of backupsHoldingCopies(dbPath, removed.conversations)) out(line);
+    return 0;
+  });
+}
+
+/**
+ * Where copies of what was just removed still live: the dated archives made
+ * since the earliest removed import, and the pre-write backup. Named so a person
+ * can delete them; nothing here deletes them.
+ */
+function backupsHoldingCopies(dbPath: string, removed: readonly ImportedConversation[]): string[] {
+  // An archive made before the earliest removed import cannot hold any of them.
+  const since = Math.min(...removed.map((item) => Date.parse(item.importedAt)));
+  const backupsDir = join(dirname(dbPath), "backups");
+  const archives = existsSync(backupsDir)
+    ? readdirSync(backupsDir)
+        .map((name) => ({ name, made: parseArchiveStamp(name) }))
+        .filter((entry): entry is { name: string; made: Date } => entry.made !== null)
+        .filter((entry) => entry.made.getTime() >= since)
+        .sort((a, b) => a.made.getTime() - b.made.getTime())
+    : [];
+  const preWrite = backupPathFor(dbPath);
+  const lines: string[] = [];
+  if (archives.length > 0) {
+    const oldest = localDay((archives[0] as { made: Date }).made);
+    const newest = localDay((archives[archives.length - 1] as { made: Date }).made);
+    const made = oldest === newest ? oldest : `${oldest} to ${newest}`;
+    lines.push(
+      `  ${plural(archives.length, "dated archive")} in ${backupsDir}, made ${made} ` +
+        `(archives are removed after ${RETENTION_DAYS} days);`,
+    );
+  }
+  if (existsSync(preWrite)) {
+    lines.push(`  the pre-write backup ${preWrite} (replaced by the next write).`);
+  }
+  if (lines.length === 0) return ["No backup in this home holds a copy."];
+  return ["Copies remain in this home's backups until you delete them or they age out:", ...lines];
+}

package/ts/src/frontDoor/routing.ts

@@ -579,6 +579,18 @@ export function routeByFamily(
         reason: "DS7.US10 conversations append boundary ported to TS",
       };
     }
+    // CR154: allowlisted by name for the same reason, before it shipped. Its
+    // apply is named apart, so the front-door log tells a removal from a look.
+    if (argv[1] === "imported") {
+      const applying = argv[2] === "remove" && argv.includes("--apply");
+      return {
+        command,
+        engine: "ts",
+        reason: applying
+          ? "CR154 conversations imported remove --apply"
+          : "CR154 conversations imported",
+      };
+    }
     const writeFlag = TS4_LIFECYCLE_WRITE_FLAGS.find((flag) => argv.includes(flag));
     if (writeFlag) {
       return { command, engine: "ts", reason: `DS7.TS4 ${writeFlag} ported to TS` };

package/ts/src/util/strictArgs.ts

@@ -0,0 +1,59 @@
+// argparse-shaped strict parsing: every option declared, anything else refused.
+//
+// Moved from `dbSafetyToolsRoute.ts`, where `backup` and `repair-encoding` use
+// it, when CR154 needed the same strictness for `conversations imported`. The
+// reason is the same in all three: these commands write, and a lenient parser
+// turns a typo into a different command. Under the `conversations` listing's
+// parser, which ignores what it does not know, `remove --all --projet <folder>
+// --apply` would drop the misspelled filter and remove every import in the
+// home. Here the typo is refused, and nothing runs.
+//
+// Positionals are opt-in, for a grammar that takes them (CR154's ids). A token
+// that starts with `-` is never a positional: an option nobody declared is a
+// typo, not a value.
+
+export interface StrictArgsSpec {
+  /** Options that stand alone. */
+  readonly flags: readonly string[];
+  /** Options that take the next token as their value, whatever it looks like. */
+  readonly valued: readonly string[];
+  /** Whether bare tokens are accepted, in order; otherwise they are unrecognized. */
+  readonly positionals?: boolean;
+}
+
+export interface ParsedArgs {
+  flags: Set<string>;
+  values: Map<string, string>;
+  positionals: string[];
+  /** argparse's message for the first problem, or null. */
+  error: string | null;
+}
+
+export function parseArgs(args: readonly string[], spec: StrictArgsSpec): ParsedArgs {
+  const flags = new Set<string>();
+  const values = new Map<string, string>();
+  const positionals: string[] = [];
+  const unrecognized: string[] = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] as string;
+    if (spec.flags.includes(arg)) {
+      flags.add(arg);
+    } else if (spec.valued.includes(arg)) {
+      const value = args[index + 1];
+      if (value === undefined)
+        return { flags, values, positionals, error: `argument ${arg}: expected one argument` };
+      values.set(arg, value);
+      index += 1;
+    } else if (spec.positionals === true && !arg.startsWith("-")) {
+      positionals.push(arg);
+    } else {
+      unrecognized.push(arg);
+    }
+  }
+  return {
+    flags,
+    values,
+    positionals,
+    error: unrecognized.length > 0 ? `unrecognized arguments: ${unrecognized.join(" ")}` : null,
+  };
+}