om-memory-system 3.3.0-next.17 → 3.3.1

package/dist/importer/auto-backfill.js

@@ -0,0 +1,165 @@
+import { CONFIG, refreshConfigIfChanged } from "../config.js";
+import { log } from "../services/logger.js";
+import { tryAcquireBackfillLock } from "./backfill-lock.js";
+import { getBackfillCutoff, updateBackfillStatus, } from "../services/backfill-state.js";
+import { runHistoryImport, } from "./run-import.js";
+import { isManualImportRunning } from "./manual-import-guard.js";
+const zero = () => ({ imported: 0, skipped: 0, failed: 0, pending: 0, unresolved: 0 });
+function counts(report) {
+    return {
+        imported: report.unitsImported,
+        skipped: report.unitsSkipped,
+        failed: report.unitsFailed,
+        pending: report.unitsWouldImport,
+        unresolved: (report.unresolvedProjects?.length ?? 0) + report.unresolvableSessions.length,
+    };
+}
+const delay = (signal) => new Promise((resolve) => {
+    if (signal?.aborted)
+        return resolve();
+    const done = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", done);
+        resolve();
+    };
+    const timer = setTimeout(done, 30_000);
+    signal?.addEventListener("abort", done, { once: true });
+});
+/** Schedule one host's history import after startup; callers do not await it. */
+export async function scheduleAutoBackfill(options) {
+    await (options.wait ?? (() => delay(options.signal)))();
+    if (options.signal?.aborted)
+        return;
+    if (!(options.enabled ??
+        (() => CONFIG.autoBackfill && process.env.OMMS_DISABLE_AUTO_BACKFILL !== "1"))())
+        return;
+    if (isManualImportRunning(options.host))
+        return;
+    const release = await tryAcquireBackfillLock(options.host);
+    if (!release)
+        return;
+    const clock = options.now ?? Date.now;
+    const run = options.run ?? runHistoryImport;
+    const controller = new AbortController();
+    const onAbort = () => controller.abort();
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    if (options.signal?.aborted)
+        controller.abort();
+    let state = "failed";
+    let model = null;
+    let current = zero();
+    let lastError;
+    try {
+        if (controller.signal.aborted) {
+            state = "stopped";
+            return;
+        }
+        const cutoff = await getBackfillCutoff(options.host, clock());
+        const args = {
+            help: false,
+            dryRun: true,
+            force: false,
+            skipMemories: false,
+            skipProfile: false,
+            scope: "all-projects",
+            pathMaps: [],
+            until: cutoff,
+            errors: [],
+        };
+        const dry = await run(options.host, args, {
+            cwd: options.cwd,
+            models: {},
+            signal: controller.signal,
+        });
+        current = counts(dry);
+        if (controller.signal.aborted) {
+            state = "stopped";
+            return;
+        }
+        if (!current.pending) {
+            state = "done";
+            return;
+        }
+        const resolved = await options.resolveModels();
+        if (controller.signal.aborted) {
+            state = "stopped";
+            return;
+        }
+        model = resolved.model;
+        options.notify(`${options.host} automatic import: ${current.pending} exchanges with ${model}. Set autoBackfill to false to stop it.`);
+        state = "running";
+        await updateBackfillStatus(options.host, { state, model, counts: current });
+        if (controller.signal.aborted) {
+            state = "stopped";
+            return;
+        }
+        let failures = 0;
+        const capture = resolved.models.capture;
+        const models = capture
+            ? {
+                ...resolved.models,
+                capture: {
+                    summarize: async (request) => {
+                        try {
+                            const result = await capture.summarize(request);
+                            failures = 0;
+                            return result;
+                        }
+                        catch (error) {
+                            lastError = error;
+                            if (++failures >= 5)
+                                controller.abort();
+                            throw error;
+                        }
+                    },
+                },
+            }
+            : resolved.models;
+        let checkedAt = clock();
+        let processed = 0;
+        let pendingWrite = Promise.resolve();
+        const real = await run(options.host, { ...args, dryRun: false }, {
+            cwd: options.cwd,
+            models,
+            signal: controller.signal,
+            onProgress: (done, total) => {
+                processed = done;
+                const now = clock();
+                if (now - checkedAt < 5_000)
+                    return;
+                checkedAt = now;
+                refreshConfigIfChanged(options.cwd);
+                if (!CONFIG.autoBackfill)
+                    controller.abort();
+                current = { ...current, pending: Math.max(0, total - done) };
+                pendingWrite = pendingWrite
+                    .then(() => updateBackfillStatus(options.host, { state: "running", model, counts: current }))
+                    .catch((error) => {
+                    log("Backfill status write failed", {
+                        host: options.host,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            },
+        });
+        await pendingWrite;
+        current = { ...counts(real), pending: Math.max(0, dry.unitsWouldImport - processed) };
+        state = controller.signal.aborted ? "stopped" : real.unitsFailed ? "failed" : "done";
+        if (!options.signal?.aborted) {
+            options.notify(`${options.host} automatic import ${state}: ${current.imported} imported, ${current.failed} failed. autoBackfill controls the next run.`);
+        }
+    }
+    catch (error) {
+        lastError = error;
+        state = controller.signal.aborted ? "stopped" : "failed";
+    }
+    finally {
+        try {
+            await updateBackfillStatus(options.host, { state, model, counts: current, error: lastError });
+        }
+        finally {
+            options.signal?.removeEventListener("abort", onAbort);
+            await release();
+        }
+    }
+}

package/dist/importer/backfill-lock.d.ts

@@ -0,0 +1,3 @@
+import type { BackfillHost } from "./backfill-model.js";
+/** Claim one host's import without holding a database transaction during the run. */
+export declare function tryAcquireBackfillLock(host: BackfillHost, storagePath?: string): Promise<(() => Promise<void>) | null>;

package/dist/importer/backfill-lock.js

@@ -0,0 +1,44 @@
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { CONFIG } from "../config.js";
+import { tursoConnectionManager } from "../services/turso/connection-manager.js";
+function live(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+/** Claim one host's import without holding a database transaction during the run. */
+export async function tryAcquireBackfillLock(host, storagePath = CONFIG.storagePath) {
+    const db = await tursoConnectionManager.getConnection(join(storagePath, "import-ledger.db"));
+    await db.run(`CREATE TABLE IF NOT EXISTS backfill_locks (
+    host TEXT PRIMARY KEY, pid INTEGER NOT NULL, token TEXT NOT NULL
+  )`);
+    const state = { pid: process.pid, token: randomUUID() };
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const inserted = await db.run("INSERT OR IGNORE INTO backfill_locks (host, pid, token) VALUES (?, ?, ?)", [host, state.pid, state.token]);
+        if (!inserted) {
+            const holder = await db.get("SELECT pid, token FROM backfill_locks WHERE host = ?", [host]);
+            if (!holder)
+                continue;
+            if (live(holder.pid))
+                return null;
+            const replaced = await db.run("UPDATE backfill_locks SET pid = ?, token = ? WHERE host = ? AND pid = ? AND token = ?", [state.pid, state.token, host, holder.pid, holder.token]);
+            if (!replaced)
+                continue;
+        }
+        let released = false;
+        return async () => {
+            if (released)
+                return;
+            released = true;
+            await db.run("DELETE FROM backfill_locks WHERE host = ? AND token = ?", [host, state.token]);
+        };
+    }
+    return null;
+}

package/dist/importer/backfill-model.d.ts

@@ -0,0 +1,10 @@
+export type BackfillHost = "pi" | "opencode";
+export type BackfillModel = "inherit" | {
+    provider: string;
+    model: string;
+};
+/** Parse the global backfill model without importing the runtime config. */
+export declare function parseBackfillModel(config: {
+    piBackfillModel?: unknown;
+    opencodeBackfillModel?: unknown;
+}, host: BackfillHost): BackfillModel;

package/dist/importer/backfill-model.js

@@ -0,0 +1,13 @@
+/** Parse the global backfill model without importing the runtime config. */
+export function parseBackfillModel(config, host) {
+    const value = host === "pi" ? config.piBackfillModel : config.opencodeBackfillModel;
+    if (value === undefined || value === "inherit")
+        return "inherit";
+    if (typeof value !== "string")
+        throw new Error(`Invalid ${host}BackfillModel config`);
+    const slash = value.indexOf("/");
+    if (slash <= 0 || slash === value.length - 1) {
+        throw new Error(`Invalid ${host}BackfillModel config`);
+    }
+    return { provider: value.slice(0, slash), model: value.slice(slash + 1) };
+}

package/dist/importer/importer.js

@@ -1,6 +1,7 @@
 import { existsSync, realpathSync } from "node:fs";
 import { captureConversation } from "../core/capture.js";
 import { memoryClient } from "../services/client.js";
+import { findLiveCapturedEntryIds } from "../services/live-captured-entries.js";
 import { extractScopeFromContainerTag } from "../services/memory-scope.js";
 import { getTags } from "../services/tags.js";
 import { tursoConnectionManager } from "../services/turso/connection-manager.js";
@@ -171,6 +172,19 @@ export async function importHistorySource(source, host, deps, filters, report) {
             report.units.push(unit);
             continue;
         }
+        const liveEntryIds = await findLiveCapturedEntryIds(hash, host, sessionId);
+        if (liveEntryIds.has(window.userEntryId)) {
+            if (!dryRun) {
+                await ledger.begin({ key, sessionId, sourceFile, projectHash: hash });
+                await ledger.skip(key, "live-captured");
+            }
+            unit.status = "skipped";
+            unit.reason = "live-captured";
+            report.unitsSkipped++;
+            report.skipReasons["live-captured"] = (report.skipReasons["live-captured"] ?? 0) + 1;
+            report.units.push(unit);
+            continue;
+        }
         // Crash reconciliation: the memory landed but the ledger never committed.
         const storedMemoryId = await lookupExistingMemory(hash, key, { storageAccessible });
         if (storedMemoryId) {

package/dist/importer/manual-import-guard.d.ts

@@ -0,0 +1,4 @@
+import type { BackfillHost } from "./backfill-model.js";
+/** Keep an automatic run from starting during a manual session import. */
+export declare function beginManualImport(host: BackfillHost): () => void;
+export declare function isManualImportRunning(host: BackfillHost): boolean;

package/dist/importer/manual-import-guard.js

@@ -0,0 +1,9 @@
+const running = new Set();
+/** Keep an automatic run from starting during a manual session import. */
+export function beginManualImport(host) {
+    running.add(host);
+    return () => running.delete(host);
+}
+export function isManualImportRunning(host) {
+    return running.has(host);
+}

package/dist/importer/settings-health.d.ts

@@ -1,10 +1,9 @@
+export { safeHealthError } from "../services/safe-health-error.js";
 export type HealthRow = {
     check: string;
     status: "pass" | "warn" | "fail";
     reason: string;
 };
-/** Remove configured credentials before returning a model error to the browser. */
-export declare function safeHealthError(error: unknown, secrets: Array<string | undefined>): string;
 export declare function captureFailureHealth(byModel: Array<{
     total: number;
     failed: number;

package/dist/importer/settings-health.js

@@ -1,18 +1,9 @@
 import { CONFIG } from "../config.js";
 import { getAutoCaptureProviderStatus, resolvePiLiveModel, } from "../services/ai/live-model-choice.js";
 import { isLoopbackHost } from "../services/web-api-auth.js";
+import { safeHealthError } from "../services/safe-health-error.js";
+export { safeHealthError } from "../services/safe-health-error.js";
 const PROBE = "Reply with a short acknowledgement.";
-/** Remove configured credentials before returning a model error to the browser. */
-export function safeHealthError(error, secrets) {
-    let message = error instanceof Error ? error.message : String(error);
-    for (const secret of secrets) {
-        if (secret && secret.length > 2)
-            message = message.replaceAll(secret, "[redacted]");
-    }
-    return message
-        .replace(/(Bearer\s+)[^\s]+/gi, "$1[redacted]")
-        .replace(/(api[_-]?key[=:]\s*)[^\s&]+/gi, "$1[redacted]");
-}
 export function captureFailureHealth(byModel, byReason) {
     const total = byModel.reduce((count, row) => count + row.total, 0);
     const failed = byModel.reduce((count, row) => count + row.failed, 0);

package/dist/index.js

@@ -183,6 +183,13 @@ export const OmmsPlugin = async (ctx) => {
     initConfigWithLegacyMigration(directory);
     // Runs even with tracing off, so turning it off does not leave old traces behind.
     pruneTraces(CONFIG);
+    if (CONFIG.webServerAutoStart !== undefined && process.env.OMMS_DISABLE_WEB_AUTOSTART !== "1") {
+        void import("./services/web-autostart.js")
+            .then(({ reconcileWebAutostart }) => reconcileWebAutostart(CONFIG))
+            .catch((error) => log("OpenCode login item reconciliation failed", {
+            code: error instanceof Error ? error.name : "unknown",
+        }));
+    }
     logAutoCaptureProviderStatus();
     const tags = getTags(directory);
     const autoCaptureHost = createOpenCodeAutoCaptureHost(ctx);
@@ -203,9 +210,11 @@ export const OmmsPlugin = async (ctx) => {
     }
     await configureOpencodeHostTransport(ctx);
     (async () => {
+        let connected = [];
         try {
             const providerResult = await ctx.client.provider.list();
             if (providerResult.data?.connected) {
+                connected = providerResult.data.connected;
                 const { setConnectedProviders } = await loadOpencodeProvider();
                 setConnectedProviders(providerResult.data.connected);
                 log("opencode providers connected", {
@@ -222,6 +231,27 @@ export const OmmsPlugin = async (ctx) => {
         catch (error) {
             log("Failed to initialize opencode provider state", { error: String(error) });
         }
+        if (CONFIG.autoBackfill && process.env.OMMS_DISABLE_AUTO_BACKFILL !== "1" && isConfigured()) {
+            void import("./adapters/opencode/backfill-startup.js")
+                .then(({ startOpencodeBackfill }) => startOpencodeBackfill({
+                connected,
+                directory,
+                configModel: async () => {
+                    const response = await ctx.client.config.get();
+                    return unwrapSdkData(response)?.model ?? null;
+                },
+                notify: (message) => {
+                    void ctx.client.tui
+                        ?.showToast({
+                        body: { title: "Automatic import", message, variant: "info", duration: 5000 },
+                    })
+                        .catch(() => { });
+                },
+            }))
+                .catch((error) => log("OpenCode backfill failed", {
+                error: error instanceof Error ? error.message : String(error),
+            }));
+        }
     })();
     let tursoReadyForWeb = !isConfigured();
     if (CONFIG.webServerEnabled && isConfigured()) {

package/dist/services/backfill-state.d.ts

@@ -0,0 +1,25 @@
+type BackfillHost = "pi" | "opencode";
+export type BackfillStatus = {
+    host: BackfillHost;
+    cutoff: number;
+    state: "not-started" | "running" | "stopped" | "done" | "failed";
+    model: string | null;
+    counts: {
+        imported: number;
+        skipped: number;
+        failed: number;
+        pending: number;
+        unresolved: number;
+    };
+    error: string | null;
+    updatedAt: number;
+};
+/** Record a fixed per-host cutoff before the first import. */
+export declare function getBackfillCutoff(host: BackfillHost, now?: number): Promise<number>;
+/** Read progress without creating a store or a ledger table. */
+export declare function readBackfillStatus(host: BackfillHost): Promise<BackfillStatus | null>;
+/** Save only numeric counts and a redacted error, never report units or prompts. */
+export declare function updateBackfillStatus(host: BackfillHost, update: Pick<BackfillStatus, "state" | "model" | "counts"> & {
+    error?: unknown;
+}): Promise<void>;
+export {};

package/dist/services/backfill-state.js

@@ -0,0 +1,68 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { CONFIG } from "../config.js";
+import { tursoConnectionManager } from "./turso/connection-manager.js";
+import { safeHealthError } from "./safe-health-error.js";
+const importLedgerDbPath = () => join(CONFIG.storagePath, "import-ledger.db");
+const emptyCounts = () => ({ imported: 0, skipped: 0, failed: 0, pending: 0, unresolved: 0 });
+async function table() {
+    const db = await tursoConnectionManager.getConnection(importLedgerDbPath());
+    await db.run(`CREATE TABLE IF NOT EXISTS backfill_state (
+    host TEXT PRIMARY KEY, cutoff INTEGER NOT NULL, state TEXT,
+    model TEXT, counts TEXT, error TEXT, updated_at INTEGER
+  )`);
+    return db;
+}
+/** Record a fixed per-host cutoff before the first import. */
+export async function getBackfillCutoff(host, now = Date.now()) {
+    const db = await table();
+    await db.run(`INSERT OR IGNORE INTO backfill_state (host, cutoff, state, counts, updated_at)
+     VALUES (?, ?, 'not-started', ?, ?)`, [host, now, JSON.stringify(emptyCounts()), now]);
+    const row = await db.get("SELECT cutoff FROM backfill_state WHERE host = ?", [
+        host,
+    ]);
+    return Number(row.cutoff);
+}
+/** Read progress without creating a store or a ledger table. */
+export async function readBackfillStatus(host) {
+    if (!existsSync(importLedgerDbPath()))
+        return null;
+    const db = await tursoConnectionManager.getConnection(importLedgerDbPath());
+    const exists = await db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'backfill_state'");
+    if (!exists)
+        return null;
+    const row = await db.get("SELECT * FROM backfill_state WHERE host = ?", [
+        host,
+    ]);
+    if (!row)
+        return null;
+    return {
+        host,
+        cutoff: Number(row.cutoff),
+        state: row.state,
+        model: row.model === null ? null : String(row.model),
+        counts: row.counts
+            ? JSON.parse(String(row.counts))
+            : emptyCounts(),
+        error: row.error === null ? null : String(row.error),
+        updatedAt: Number(row.updated_at),
+    };
+}
+/** Save only numeric counts and a redacted error, never report units or prompts. */
+export async function updateBackfillStatus(host, update) {
+    const counts = Object.fromEntries(Object.keys(emptyCounts()).map((key) => [
+        key,
+        Number.isSafeInteger(update.counts[key]) && update.counts[key] >= 0 ? update.counts[key] : 0,
+    ]));
+    const db = await table();
+    await db.run(`UPDATE backfill_state SET state = ?, model = ?, counts = ?, error = ?, updated_at = ? WHERE host = ?`, [
+        update.state,
+        update.model,
+        JSON.stringify(counts),
+        update.error == null
+            ? null
+            : safeHealthError(update.error, [CONFIG.memoryApiKey]).slice(0, 500),
+        Date.now(),
+        host,
+    ]);
+}

package/dist/services/capture-diagnostics.d.ts

@@ -52,6 +52,14 @@ export declare function getTraceDirectory(): string;
  * that do not match the trace name pattern are never touched.
  */
 export declare function pruneTraces(config: CaptureDiagnosticsConfig, now?: Date): number;
+type WindowsAclRunner = (command: string, args: string[], options: {
+    env: NodeJS.ProcessEnv;
+    timeout: number;
+    windowsHide: boolean;
+    stdio: "ignore";
+}) => void;
+/** Restrict a trace path to the current user on both Windows and POSIX. */
+export declare function protectTracePath(path: string, mode: number, platform?: NodeJS.Platform, run?: WindowsAclRunner): void;
 /**
  * Append one trace entry to the day's JSON Lines file. A single append per
  * entry keeps lines whole when Pi and OpenCode write at the same time.
@@ -64,3 +72,4 @@ export declare function writeTraceEntry(record: CaptureAttemptRecord, diagnostic
 export declare function emitCaptureAttempt(record: CaptureAttemptRecord, diagnostics: CaptureAttemptDiagnostics, config: CaptureDiagnosticsConfig, now?: Date): void;
 /** Test hook: forget which day the last trace was written. */
 export declare function resetTraceStateForTests(): void;
+export {};

package/dist/services/capture-diagnostics.js

@@ -1,4 +1,5 @@
-import { appendFileSync, chmodSync, existsSync, mkdirSync, readdirSync, unlinkSync } from "fs";
+import { execFileSync } from "node:child_process";
+import { appendFileSync, chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, unlinkSync, } from "fs";
 import { join } from "path";
 import { getLogDirPath } from "./log-path.js";
 import { log } from "./logger.js";
@@ -112,6 +113,54 @@ export function pruneTraces(config, now = new Date()) {
     return removed;
 }
 let lastTraceDate = null;
+const WINDOWS_TRACE_ACL = `$ErrorActionPreference = 'Stop'
+$path = $env:OMMS_TRACE_ACL_PATH
+$isDirectory = [System.IO.Directory]::Exists($path)
+$acl = if ($isDirectory) {
+  [System.IO.Directory]::GetAccessControl($path)
+} else {
+  [System.IO.File]::GetAccessControl($path)
+}
+$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier])
+if ($owner.Value -ne $currentUser.Value) {
+  throw 'Trace path has a different owner'
+}
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in @($acl.Access)) {
+  [void]$acl.RemoveAccessRuleSpecific($rule)
+}
+$inheritance = if ($isDirectory) {
+  [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+} else {
+  [System.Security.AccessControl.InheritanceFlags]::None
+}
+$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+  $currentUser,
+  [System.Security.AccessControl.FileSystemRights]::FullControl,
+  $inheritance,
+  [System.Security.AccessControl.PropagationFlags]::None,
+  [System.Security.AccessControl.AccessControlType]::Allow
+)
+$acl.AddAccessRule($rule)
+if ($isDirectory) {
+  [System.IO.Directory]::SetAccessControl($path, $acl)
+} else {
+  [System.IO.File]::SetAccessControl($path, $acl)
+}`;
+/** Restrict a trace path to the current user on both Windows and POSIX. */
+export function protectTracePath(path, mode, platform = process.platform, run = execFileSync) {
+    if (platform !== "win32") {
+        chmodSync(path, mode);
+        return;
+    }
+    run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_TRACE_ACL], {
+        env: { ...process.env, OMMS_TRACE_ACL_PATH: path },
+        timeout: 10_000,
+        windowsHide: true,
+        stdio: "ignore",
+    });
+}
 /**
  * Append one trace entry to the day's JSON Lines file. A single append per
  * entry keeps lines whole when Pi and OpenCode write at the same time.
@@ -125,7 +174,18 @@ export function writeTraceEntry(record, diagnostics, config, now = new Date()) {
         }
         const dir = getTraceDirectory();
         mkdirSync(dir, { recursive: true, mode: 0o700 });
-        chmodSync(dir, 0o700);
+        if (!lstatSync(dir).isDirectory())
+            throw new Error("Trace directory is not a real directory");
+        protectTracePath(dir, 0o700);
+        const dailyFile = `capture-${today}.jsonl`;
+        for (const name of readdirSync(dir)) {
+            if (!TRACE_FILE.test(name) || name === dailyFile)
+                continue;
+            const retained = join(dir, name);
+            if (!lstatSync(retained).isFile())
+                throw new Error("Trace path is not a regular file");
+            protectTracePath(retained, 0o600);
+        }
         const redact = (value) => value === undefined ? null : redactTraceText(value, config);
         const entry = {
             schemaVersion: TRACE_SCHEMA_VERSION,
@@ -135,11 +195,18 @@ export function writeTraceEntry(record, diagnostics, config, now = new Date()) {
             userPrompt: redact(diagnostics.userPrompt),
             reply: redact(diagnostics.rawReply),
         };
-        const file = join(dir, `capture-${today}.jsonl`);
+        const file = join(dir, dailyFile);
+        const existingFile = lstatSync(file, { throwIfNoEntry: false });
+        if (existingFile && !existingFile.isFile())
+            throw new Error("Trace path is not a regular file");
+        // Narrow an existing file before appending sensitive content.
+        const existingWindowsFile = process.platform === "win32" && Boolean(existingFile);
+        if (existingWindowsFile)
+            protectTracePath(file, 0o600);
         appendFileSync(file, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
-        // The mode above applies only when the append creates the file; a file
-        // that already existed with wider permissions is narrowed here.
-        chmodSync(file, 0o600);
+        // A new Windows file inherits the private directory ACL until this call.
+        if (!existingWindowsFile)
+            protectTracePath(file, 0o600);
     }
     catch (error) {
         log("Capture trace write failed", { code: errorCode(error) });

package/dist/services/global-config-writer.js

@@ -11,6 +11,10 @@ const keys = new Set([
     "captureTrace",
     "captureTraceRetentionDays",
     "captureAttemptRetentionDays",
+    "autoBackfill",
+    "opencodeBackfillModel",
+    "piBackfillModel",
+    "webServerAutoStart",
 ]);
 export class ConfigConflictError extends Error {
     status = 409;
@@ -46,7 +50,7 @@ export async function writeGlobalConfigKeys(edits, expectedRevision) {
     for (const [key, value] of Object.entries(edits)) {
         if (!keys.has(key))
             throw new Error(`Setting ${key} cannot be edited here`);
-        if (key === "captureTrace"
+        if (key === "captureTrace" || key === "autoBackfill" || key === "webServerAutoStart"
             ? typeof value !== "boolean"
             : key.endsWith("RetentionDays")
                 ? !Number.isSafeInteger(value) || value < 1

package/dist/services/live-captured-entries.d.ts

@@ -0,0 +1,3 @@
+import type { MemoryHost } from "../types/index.js";
+/** Read user and assistant IDs saved by live capture in one project session. */
+export declare function findLiveCapturedEntryIds(projectHash: string, host: MemoryHost, sessionId: string): Promise<Set<string>>;

package/dist/services/live-captured-entries.js

@@ -0,0 +1,34 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { CONFIG } from "../config.js";
+import { tursoConnectionManager } from "./turso/connection-manager.js";
+import { tursoShardManager } from "./turso/shard-manager.js";
+/** Read user and assistant IDs saved by live capture in one project session. */
+export async function findLiveCapturedEntryIds(projectHash, host, sessionId) {
+    const entries = new Set();
+    if (!existsSync(join(CONFIG.storagePath, "metadata.db")))
+        return entries;
+    const shards = await tursoShardManager.getAllShards("project", projectHash);
+    for (const shard of shards) {
+        const db = await tursoConnectionManager.getConnection(shard.dbPath);
+        const rows = await db.all(`SELECT metadata FROM memories WHERE json_valid(metadata)
+       AND json_extract(metadata, '$.host') = ?
+       AND json_extract(metadata, '$.hostSessionId') = ?
+       AND json_extract(metadata, '$.sourceType') != 'history-import'`, [host, sessionId]);
+        for (const row of rows) {
+            const metadata = JSON.parse(row.metadata);
+            if (!metadata || typeof metadata !== "object")
+                continue;
+            const provenance = metadata;
+            if (typeof provenance.promptId === "string")
+                entries.add(provenance.promptId);
+            const ids = provenance.sourceEntryIds;
+            if (Array.isArray(ids)) {
+                for (const id of ids)
+                    if (typeof id === "string")
+                        entries.add(id);
+            }
+        }
+    }
+    return entries;
+}

package/dist/services/safe-health-error.d.ts

@@ -0,0 +1,2 @@
+/** Remove configured credentials before returning a model error to the browser. */
+export declare function safeHealthError(error: unknown, secrets: Array<string | undefined>): string;