mulmoclaude 0.9.2 → 0.9.3

package/server/remoteHost/handlers/getRemoteView.ts

@@ -0,0 +1,37 @@
+// getRemoteView command handler (remote-host phase 3 —
+// plans/feat-remote-custom-view.md).
+//
+// Returns one mobile (`target: "mobile"`) custom view wrapped HOST-side into
+// its sandboxed srcdoc (CSP + postMessage bootstrap), so the phone renders the
+// artifact verbatim — the same builder the desktop phone-frame preview reads
+// over HTTP, keeping preview === phone structural. The srcdoc travels inside
+// the Firestore command document; the builder enforces the 1 MiB budget.
+//
+// Factory (createGetRemoteView) keeps the mapping unit-testable with the
+// engine stubbed; the default export wires the real functions.
+import { loadCollection } from "../../workspace/collections/index.js";
+import { buildRemoteView, remoteViewFailureMessage } from "../../workspace/collections/remoteView.js";
+import type { CommandHandler, JsonObject } from "../commandChannel.js";
+
+export interface GetRemoteViewDeps {
+  loadCollection: typeof loadCollection;
+  buildRemoteView: typeof buildRemoteView;
+}
+
+export const createGetRemoteView =
+  (deps: GetRemoteViewDeps): CommandHandler =>
+  async (params: JsonObject) => {
+    const slug = String(params.slug ?? "");
+    const viewId = String(params.viewId ?? "");
+    const locale = typeof params.locale === "string" ? params.locale : "";
+    const collection = await deps.loadCollection(slug);
+    if (!collection) throw new Error(`collection '${slug}' not found`);
+    const result = await deps.buildRemoteView(collection, viewId, locale);
+    if (result.kind !== "ok") throw new Error(remoteViewFailureMessage(result, slug));
+    const { view, srcdoc, bytes } = result;
+    // Plain JSON, but the interface lacks an index signature — cast like the
+    // phase-2 handlers.
+    return { view, srcdoc, bytes } as unknown as JsonObject;
+  };
+
+export const getRemoteView = createGetRemoteView({ loadCollection, buildRemoteView });

package/server/remoteHost/handlers/getRemoteViewItems.ts

@@ -0,0 +1,38 @@
+// getRemoteViewItems command handler (remote-host phase 5 —
+// plans/feat-remote-view-images.md).
+//
+// One page of a mobile view's records, view-aware so the host can inline the
+// view's declared `imageFields` as `data:` URL thumbnails (a phone can't reach
+// the workspace to render an image path). Same builder the desktop phone-frame
+// preview reads over HTTP, so preview === phone. Supersedes the phase-2
+// getCollection for a custom view's getItems: the page is already projected +
+// image-inlined, so the mulmoserver client passes it straight to the view.
+//
+// Factory (createGetRemoteViewItems) keeps the mapping unit-testable with the
+// engine stubbed; the default export wires the real functions.
+import { clampLimit, clampOffset, normalizeFields } from "@mulmoclaude/core/remote-view";
+import { loadCollection } from "../../workspace/collections/index.js";
+import { remoteViewItems, remoteViewItemsFailureMessage } from "../../workspace/collections/remoteView.js";
+import type { CommandHandler, JsonObject } from "../commandChannel.js";
+
+export interface GetRemoteViewItemsDeps {
+  loadCollection: typeof loadCollection;
+  remoteViewItems: typeof remoteViewItems;
+}
+
+export const createGetRemoteViewItems =
+  (deps: GetRemoteViewItemsDeps): CommandHandler =>
+  async (params: JsonObject) => {
+    const slug = String(params.slug ?? "");
+    const viewId = String(params.viewId ?? "");
+    const request = { offset: clampOffset(params.offset), limit: clampLimit(params.limit), fields: normalizeFields(params.fields) };
+    const collection = await deps.loadCollection(slug);
+    if (!collection) throw new Error(`collection '${slug}' not found`);
+    const result = await deps.remoteViewItems(collection, viewId, request);
+    if (result.kind !== "ok") throw new Error(remoteViewItemsFailureMessage(result, slug));
+    // Plain JSON, but the interface lacks an index signature — cast like the
+    // phase-2/3 handlers.
+    return { page: result.page, inlined: result.inlined, omitted: result.omitted } as unknown as JsonObject;
+  };
+
+export const getRemoteViewItems = createGetRemoteViewItems({ loadCollection, remoteViewItems });

package/server/remoteHost/handlers/index.ts

@@ -4,9 +4,12 @@
 import type { CommandHandlers } from "../commandChannel.js";
 import { getCollection } from "./getCollection.js";
 import { getFeed } from "./getFeed.js";
+import { getRemoteView } from "./getRemoteView.js";
+import { getRemoteViewItems } from "./getRemoteViewItems.js";
 import { listCollections } from "./listCollections.js";
 import { listFeeds } from "./listFeeds.js";
 import { listShortcuts } from "./listShortcuts.js";
+import { mutateRemoteViewItem } from "./mutateRemoteView.js";
 import { startChat } from "./startChat.js";
 
 export const handlers: CommandHandlers = {
@@ -15,5 +18,8 @@ export const handlers: CommandHandlers = {
   listShortcuts,
   listFeeds,
   getFeed,
+  getRemoteView,
+  getRemoteViewItems,
+  mutateRemoteViewItem,
   startChat,
 };

package/server/remoteHost/handlers/mutateRemoteView.ts

@@ -0,0 +1,40 @@
+// mutateRemoteViewItem command handler (remote-host phase 4 —
+// plans/feat-remote-writable-view.md).
+//
+// Applies one update/delete requested by a `target: "mobile"` custom view on
+// the phone, authorized by that view's OWN declared surface
+// (editableFields / allowDelete) and enforced HOST-side (createMutateRemoteView)
+// — the sandboxed view is never trusted. The parent (mulmoserver) supplies the
+// `viewId` it mounted; the sandboxed document cannot spoof a different view's
+// policy. Shares the builder with the desktop preview's HTTP route so both
+// transports apply identical policy.
+//
+// Factory (createMutateRemoteView-backed) keeps the mapping unit-testable with
+// the engine stubbed; the default export wires the real functions.
+import { normalizeMutate } from "@mulmoclaude/core/remote-view";
+import { loadCollection } from "../../workspace/collections/index.js";
+import { mutateRemoteView, mutateRemoteViewFailureMessage } from "../../workspace/collections/remoteView.js";
+import type { CommandHandler, JsonObject } from "../commandChannel.js";
+
+export interface MutateRemoteViewHandlerDeps {
+  loadCollection: typeof loadCollection;
+  mutateRemoteView: typeof mutateRemoteView;
+}
+
+export const createMutateRemoteViewHandler =
+  (deps: MutateRemoteViewHandlerDeps): CommandHandler =>
+  async (params: JsonObject) => {
+    const slug = String(params.slug ?? "");
+    const viewId = String(params.viewId ?? "");
+    const request = normalizeMutate({ op: params.op, id: params.id, patch: params.patch });
+    if (!request) throw new Error("invalid mutate request — expected { op: 'update'|'delete', id, patch? }");
+    const collection = await deps.loadCollection(slug);
+    if (!collection) throw new Error(`collection '${slug}' not found`);
+    const result = await deps.mutateRemoteView(collection, viewId, request);
+    if (result.kind !== "ok") throw new Error(mutateRemoteViewFailureMessage(result, slug));
+    // Plain JSON, but the interface lacks an index signature — cast like the
+    // other phase-2/3 handlers.
+    return (result.op === "delete" ? { op: "delete", id: result.id } : { op: "update", item: result.item }) as unknown as JsonObject;
+  };
+
+export const mutateRemoteViewItem = createMutateRemoteViewHandler({ loadCollection, mutateRemoteView });

package/server/utils/files/thumbnail-store.ts

@@ -0,0 +1,97 @@
+// Downscaled `data:` URL thumbnails for remote (mobile) custom views
+// (plans/feat-remote-view-images.md). A phone can't reach the host's localhost,
+// so an `image`-type field's workspace path is unrenderable there; a view that
+// lists the field in `imageFields` gets it inlined as a small JPEG data URL the
+// host produces here. Kept a leaf util (no collection/remote-view imports) so
+// the builder in remoteView.ts is the only wiring point.
+//
+// Reads are workspace-containment-guarded (resolveWithinRoot, same discipline as
+// image-store.ts). Results are cached by (path, mtime, maxEdge) so repeated
+// pages / "load more" scrolls never re-decode the same source.
+import { readFile, realpath, stat } from "fs/promises";
+import { workspacePath } from "../../workspace/paths.js";
+import { resolveWithinRoot } from "./safe.js";
+import { log } from "../../system/logger/index.js";
+
+/** Decode → downscale to fit `maxEdge` (never enlarge) → re-encode JPEG.
+ *  Injected so tests exercise the resolver without the native `sharp` binary. */
+export type ResizeToJpeg = (input: Buffer, maxEdge: number) => Promise<Buffer>;
+
+// JPEG quality for inlined thumbnails — a size/fidelity knob; 72 keeps a
+// 512px thumbnail in the low tens of KB, well within the page budget.
+const THUMBNAIL_JPEG_QUALITY = 72;
+
+const sharpResize: ResizeToJpeg = async (input, maxEdge) => {
+  // Dynamic import: only the default resolver pulls the native binary, so tests
+  // (which inject their own resize) and code paths that never make a thumbnail
+  // don't load it.
+  const sharp = (await import("sharp")).default;
+  // `.rotate()` bakes in EXIF orientation so portrait phone photos aren't sideways.
+  return sharp(input).rotate().resize(maxEdge, maxEdge, { fit: "inside", withoutEnlargement: true }).jpeg({ quality: THUMBNAIL_JPEG_QUALITY }).toBuffer();
+};
+
+interface CacheEntry {
+  mtimeMs: number;
+  maxEdge: number;
+  dataUrl: string;
+}
+
+// In-memory, per host process. Bounded LRU (Map keeps insertion order; a get
+// re-inserts to mark recency, a set past the cap evicts the oldest).
+const MAX_CACHE_ENTRIES = 256;
+const cache = new Map<string, CacheEntry>();
+
+function cacheGet(relPath: string, mtimeMs: number, maxEdge: number): string | null {
+  const entry = cache.get(relPath);
+  if (!entry || entry.mtimeMs !== mtimeMs || entry.maxEdge !== maxEdge) return null;
+  cache.delete(relPath);
+  cache.set(relPath, entry);
+  return entry.dataUrl;
+}
+
+function cacheSet(relPath: string, entry: CacheEntry): void {
+  cache.set(relPath, entry);
+  if (cache.size > MAX_CACHE_ENTRIES) {
+    const oldest = cache.keys().next().value;
+    if (oldest !== undefined) cache.delete(oldest);
+  }
+}
+
+/** Test-only: drop the cache so a spy on the resize fn sees a fresh encode. */
+export function clearThumbnailCache(): void {
+  cache.clear();
+}
+
+/** Resolve a workspace-relative image path to a downscaled JPEG `data:` URL, or
+ *  `null` when the path escapes the workspace, is missing, or can't be decoded —
+ *  the caller then leaves the field as its original path (rendered as a
+ *  placeholder by the view). `maxEdge` should already be clamped by the caller
+ *  (`clampImageMaxEdge`). */
+export function createThumbnailResolver(resize: ResizeToJpeg = sharpResize) {
+  return async function resolveThumbnail(relPath: string, maxEdge: number): Promise<string | null> {
+    if (typeof relPath !== "string" || relPath.length === 0) return null;
+    let root: string;
+    try {
+      root = await realpath(workspacePath);
+    } catch {
+      return null;
+    }
+    const abs = resolveWithinRoot(root, relPath);
+    if (!abs) return null;
+    const info = await stat(abs).catch(() => null);
+    if (!info?.isFile()) return null;
+    const cached = cacheGet(relPath, info.mtimeMs, maxEdge);
+    if (cached) return cached;
+    try {
+      const out = await resize(await readFile(abs), maxEdge);
+      const dataUrl = `data:image/jpeg;base64,${out.toString("base64")}`;
+      cacheSet(relPath, { mtimeMs: info.mtimeMs, maxEdge, dataUrl });
+      return dataUrl;
+    } catch (err) {
+      log.warn("thumbnail", "resolve failed", { relPath, error: String(err) });
+      return null;
+    }
+  };
+}
+
+export const resolveThumbnail = createThumbnailResolver();

package/server/workspace/chat-index/index.ts

@@ -99,6 +99,12 @@ export async function backfillAllSessions(
   opts: {
     workspaceRoot?: string;
     deps?: IndexerDeps;
+    // Opt-in to "regenerate every summary, even those still current".
+    // Default false — the scheduled tick uses that so unchanged
+    // sessions cost only a stat + entry read, not a Claude CLI call.
+    // The manual rebuild endpoint and CHAT_INDEX_FORCE_RUN_ON_STARTUP
+    // opt in explicitly, matching their debug / rollout intent (#1929).
+    force?: boolean;
   } = {},
 ): Promise<BackfillResult> {
   const workspaceRoot = opts.workspaceRoot ?? defaultWorkspacePath;
@@ -108,6 +114,7 @@ export async function backfillAllSessions(
     indexed: 0,
     skipped: 0,
   };
+  const force = opts.force === true;
   for (const sessionId of ids) {
     if (disabled) {
       result.skipped++;
@@ -116,7 +123,7 @@ export async function backfillAllSessions(
     try {
       const entry = await indexSession(workspaceRoot, sessionId, {
         ...(opts.deps ?? {}),
-        force: true,
+        ...(force ? { force: true } : {}),
       });
       if (entry) {
         result.indexed++;

package/server/workspace/chat-index/indexer.ts

@@ -8,7 +8,8 @@
 // at a `mkdtempSync` directory without touching the real
 // ~/mulmoclaude.
 
-import { readdir, readFile, rm } from "node:fs/promises";
+import { readdir, readFile, rm, stat } from "node:fs/promises";
+import path from "node:path";
 import { defaultSummarize, loadJsonlInput, type SummarizeFn } from "./summarizer.js";
 import { chatDirFor, indexEntryPathFor, manifestPathFor, sessionJsonlPathFor, sessionMetaPathFor } from "./paths.js";
 import type { ChatIndexEntry, ChatIndexManifest } from "./types.js";
@@ -22,6 +23,12 @@ import { isRecord } from "../../utils/types.js";
 // — long enough that a single conversation doesn't re-summarize
 // every turn, short enough that a user who leaves for lunch and
 // comes back sees the title refresh.
+//
+// Complementary to the content-change gate below: `isFresh` says
+// "we JUST indexed, don't retry mid-conversation", while
+// `sessionJsonlChangedSinceIndex` says "the jsonl hasn't been
+// touched since we last indexed, no work to do". Both run when
+// `force` is false; `force: true` bypasses both.
 export const MIN_INDEX_INTERVAL_MS = 15 * ONE_MINUTE_MS;
 
 // Injection points for tests. Defaults are the production spawn +
@@ -30,10 +37,13 @@ export interface IndexerDeps {
   summarize?: SummarizeFn;
   now?: () => number;
   minIntervalMs?: number;
-  // Bypass the `isFresh` freshness throttle. Used by the
-  // backfill helper and the debug trigger endpoint so a manual
-  // "rebuild everything" run doesn't silently skip entries that
-  // happen to be within the 15-minute window.
+  // Bypass both the `isFresh` freshness throttle AND the content-
+  // changed gate (`sessionJsonlChangedSinceIndex`). Used by the
+  // manual rebuild endpoint and the `CHAT_INDEX_FORCE_RUN_ON_STARTUP`
+  // startup path so "regenerate everything" semantics keep working
+  // even when the summariser is unchanged — e.g. the summariser
+  // prompt was edited and existing summaries are stale by design,
+  // not by content.
   force?: boolean;
 }
 
@@ -110,34 +120,106 @@ export async function updateManifest(workspaceRoot: string, mutator: (m: ChatInd
 // disk. Both removals tolerate "missing" — sessions that were never
 // indexed have no entry to prune.
 export async function removeSessionFromIndex(workspaceRoot: string, sessionId: string): Promise<void> {
-  await rm(indexEntryPathFor(workspaceRoot, sessionId), { force: true });
+  const safeId = safeSessionIdOrNull(sessionId);
+  if (safeId === null) return;
+  await rm(indexEntryPathFor(workspaceRoot, safeId), { force: true });
   await updateManifest(workspaceRoot, (manifest) => ({
     ...manifest,
-    entries: manifest.entries.filter((entry) => entry.id !== sessionId),
+    entries: manifest.entries.filter((entry) => entry.id !== safeId),
   }));
 }
 
 // --- freshness check ------------------------------------------------
 
+// Shared parsing of `<indexDir>/<sessionId>.json` → `indexedAt` as
+// milliseconds since epoch. Returns null on any failure (file
+// missing, unreadable, JSON parse error, wrong shape, unparseable
+// timestamp) so callers can each pick their own "no entry" semantic
+// (skip vs reindex vs throttle) without duplicating the read.
+// Exported so `isFresh` / `sessionJsonlChangedSinceIndex` share one
+// canonical parse — CodeRabbit review on #1930.
+export async function readIndexedAtMs(workspaceRoot: string, sessionId: string): Promise<number | null> {
+  const safeId = safeSessionIdOrNull(sessionId);
+  if (safeId === null) return null;
+  try {
+    const raw = await readFile(indexEntryPathFor(workspaceRoot, safeId), "utf-8");
+    const entry: unknown = JSON.parse(raw);
+    if (!isRecord(entry)) return null;
+    const { indexedAt } = entry as Record<string, unknown>;
+    if (typeof indexedAt !== "string") return null;
+    const parsed = Date.parse(indexedAt);
+    return Number.isNaN(parsed) ? null : parsed;
+  } catch {
+    return null;
+  }
+}
+
 // A session is "fresh" when its per-session index file exists and
 // was written less than `minIntervalMs` ago. Fresh sessions are
 // skipped so a long conversation doesn't spam the CLI on every
-// turn.
+// turn. Delegates disk / parse work to `readIndexedAtMs` so the
+// two throttles stay in lockstep on entry-file semantics.
 export async function isFresh(workspaceRoot: string, sessionId: string, now: number, minIntervalMs: number): Promise<boolean> {
+  const indexedMs = await readIndexedAtMs(workspaceRoot, sessionId);
+  if (indexedMs === null) return false;
+  return now - indexedMs < minIntervalMs;
+}
+
+// Returns true when the session's jsonl was written / appended AFTER
+// its last index entry — i.e. there IS new content to summarize.
+//
+// Complements `isFresh`: without this gate, the hourly scheduler
+// tick re-summarizes every session even when nothing new was
+// written since the last index (issue #1929). With it, the tick's
+// per-session cost drops to O(stat + file read) for unchanged
+// sessions and only spends a Claude CLI call on the ones that
+// actually saw a new turn.
+//
+// Return-value contract, for each unknown state:
+//  - Hostile / malformed sessionId → false (skip; something upstream
+//    handed us a value that could escape the chat dir via `..`).
+//  - Entry file missing/malformed → true (we've never captured this
+//    session; index it).
+//  - Jsonl file missing → false (nothing to reindex; the caller
+//    would return null downstream anyway, but we short-circuit).
+//  - Otherwise → jsonl mtime > entry.indexedAt.
+export async function sessionJsonlChangedSinceIndex(workspaceRoot: string, sessionId: string): Promise<boolean> {
+  const safeId = safeSessionIdOrNull(sessionId);
+  if (safeId === null) return false;
+  const indexedMs = await readIndexedAtMs(workspaceRoot, safeId);
+  if (indexedMs === null) return true;
   try {
-    const raw = await readFile(indexEntryPathFor(workspaceRoot, sessionId), "utf-8");
-    const entry: unknown = JSON.parse(raw);
-    if (!isRecord(entry)) return false;
-    const { indexedAt } = entry as Record<string, unknown>;
-    if (typeof indexedAt !== "string") return false;
-    const indexedTimestamp = Date.parse(indexedAt);
-    if (Number.isNaN(indexedTimestamp)) return false;
-    return now - indexedTimestamp < minIntervalMs;
+    const info = await stat(sessionJsonlPathFor(workspaceRoot, safeId));
+    return info.mtimeMs > indexedMs;
   } catch {
     return false;
   }
 }
 
+// Path-traversal guard for session IDs used to derive on-disk paths.
+// Two-step check so both a static analyser (CodeQL taints
+// `sessionId` as a possible route-param input) AND a human reader
+// can convince themselves the derived path stays inside the chat
+// dir:
+//
+//   1. `path.basename()` collapses any `..` / separator to the last
+//      segment. CodeQL recognises this as a barrier — a value whose
+//      taint originates upstream is neutralised here.
+//   2. `SAFE_SESSION_ID_RE` narrows the character class further
+//      (word chars, `.`, `-`, up to 200 long) and rejects any
+//      `..` substring, mirroring `server/api/bridge/sessionRole.ts`.
+//
+// Returns the cleaned id on success (identical to the input for
+// legit ids) or `null` on any hostile / malformed input.
+const SAFE_SESSION_ID_RE = /^[\w.-]{1,200}$/;
+export function safeSessionIdOrNull(sessionId: string): string | null {
+  const basename = path.basename(sessionId);
+  if (basename !== sessionId) return null;
+  if (!SAFE_SESSION_ID_RE.test(basename)) return null;
+  if (basename.includes("..")) return null;
+  return basename;
+}
+
 // --- session metadata ----------------------------------------------
 
 interface SessionMeta {
@@ -146,8 +228,14 @@ interface SessionMeta {
 }
 
 async function readSessionMeta(workspaceRoot: string, sessionId: string): Promise<SessionMeta> {
+  // Defence-in-depth: only `indexSession` calls this (with an
+  // already-sanitized id), but a future caller wiring the helper
+  // into a new code path shouldn't be able to escape the chat dir
+  // by mistake.
+  const safeId = safeSessionIdOrNull(sessionId);
+  if (safeId === null) return {};
   try {
-    const raw = await readFile(sessionMetaPathFor(workspaceRoot, sessionId), "utf-8");
+    const raw = await readFile(sessionMetaPathFor(workspaceRoot, safeId), "utf-8");
     const parsed: unknown = JSON.parse(raw);
     if (!isRecord(parsed)) return {};
     const metaRecord = parsed as Record<string, unknown>;
@@ -161,11 +249,22 @@ async function readSessionMeta(workspaceRoot: string, sessionId: string): Promis
 }
 
 // List every session id that has a .jsonl file in the workspace
-// chat dir. Used by the backfill helper.
+// chat dir. Used by the backfill helper. Filenames from disk are
+// filtered through `safeSessionIdOrNull` so a stray file with a
+// hostile name (`.` / `..` / a slash-containing name that survived
+// readdir on some FS) can never flow through the backfill loop
+// into `indexSession`.
 export async function listSessionIds(workspaceRoot: string): Promise<string[]> {
   try {
     const files = await readdir(chatDirFor(workspaceRoot));
-    return files.filter((fileName) => fileName.endsWith(".jsonl")).map((fileName) => fileName.slice(0, -".jsonl".length));
+    const ids: string[] = [];
+    for (const fileName of files) {
+      if (!fileName.endsWith(".jsonl")) continue;
+      const stem = fileName.slice(0, -".jsonl".length);
+      const safeId = safeSessionIdOrNull(stem);
+      if (safeId !== null) ids.push(safeId);
+    }
+    return ids;
   } catch {
     return [];
   }
@@ -175,27 +274,43 @@ export async function listSessionIds(workspaceRoot: string): Promise<string[]> {
 
 // Index (or re-index) a single session. Returns the entry on
 // success, or null if the session was skipped (fresh, empty,
-// missing). The only exception that escapes is
+// missing, or hostile id). The only exception that escapes is
 // `ClaudeCliNotFoundError` — the caller uses it to disable the
 // module for the rest of the process lifetime.
+//
+// `sessionId` is sanitized at entry (`safeSessionIdOrNull`) and the
+// resulting `safeId` is threaded through every downstream file
+// access, so `force: true` — a debug / rollout knob — cannot become
+// a path-injection escape hatch (Codex review on #1930).
 export async function indexSession(workspaceRoot: string, sessionId: string, deps: IndexerDeps = {}): Promise<ChatIndexEntry | null> {
+  const safeId = safeSessionIdOrNull(sessionId);
+  if (safeId === null) return null;
   const summarize = deps.summarize ?? defaultSummarize;
   const now = (deps.now ?? Date.now)();
   const minInterval = deps.minIntervalMs ?? MIN_INDEX_INTERVAL_MS;
   const force = deps.force === true;
 
-  if (!force && (await isFresh(workspaceRoot, sessionId, now, minInterval))) {
-    return null;
+  if (!force) {
+    if (await isFresh(workspaceRoot, safeId, now, minInterval)) {
+      return null;
+    }
+    // Second gate: even past the freshness window, if the jsonl has
+    // NOT been written since the last index there's no new content
+    // to summarize. Cuts idle scheduler tick cost from O(sessions)
+    // Claude CLI calls to O(actual updates) — see #1929.
+    if (!(await sessionJsonlChangedSinceIndex(workspaceRoot, safeId))) {
+      return null;
+    }
   }
 
-  const input = await loadJsonlInput(sessionJsonlPathFor(workspaceRoot, sessionId));
+  const input = await loadJsonlInput(sessionJsonlPathFor(workspaceRoot, safeId));
   if (!input.trim()) return null;
 
   const summary = await summarize(input);
-  const meta = await readSessionMeta(workspaceRoot, sessionId);
+  const meta = await readSessionMeta(workspaceRoot, safeId);
 
   const entry: ChatIndexEntry = {
-    id: sessionId,
+    id: safeId,
     roleId: meta.roleId ?? DEFAULT_ROLE_ID,
     startedAt: meta.startedAt ?? new Date(now).toISOString(),
     indexedAt: new Date(now).toISOString(),
@@ -207,12 +322,12 @@ export async function indexSession(workspaceRoot: string, sessionId: string, dep
   // Per-session file is written first so partial progress survives
   // a crash between the two writes: the next run can still observe
   // the fresh entry via isFresh and skip it.
-  await writeJsonAtomic(indexEntryPathFor(workspaceRoot, sessionId), entry);
+  await writeJsonAtomic(indexEntryPathFor(workspaceRoot, safeId), entry);
 
   // Upsert into manifest under the in-process lock: replace any
   // prior entry with the same id, sort newest-first by startedAt.
   await updateManifest(workspaceRoot, (current) => {
-    const filtered = current.entries.filter((entryItem) => entryItem.id !== sessionId);
+    const filtered = current.entries.filter((entryItem) => entryItem.id !== safeId);
     filtered.push(entry);
     filtered.sort((leftEntry, rightEntry) => Date.parse(rightEntry.startedAt) - Date.parse(leftEntry.startedAt));
     return { version: 1, entries: filtered };

package/server/workspace/collections/index.ts

@@ -16,6 +16,7 @@ export {
   readItem,
   writeItem,
   deleteItem,
+  safeRecordId,
   generateItemId,
   resolveCreateItemId,
   readSkillTemplate,