onadit 0.0.1 → 0.1.0-beta.45

package/dist/src/diagnostics/notify.js

@@ -0,0 +1,217 @@
+/**
+ * Native failure notifications for daemon-observed problems.
+ *
+ * A running daemon can see capture failures, expired Codex login, an
+ * invalid/failing Voyage key, and index-write failures. When one of
+ * those crosses into a failing state, the friend should get one calm
+ * macOS notification that points at the repair surface — not a wall of
+ * logs, and not a notification on every poll.
+ *
+ * What this module does NOT cover: a fully dead daemon cannot notify
+ * about itself. That needs a separate watchdog and is explicitly Slice D
+ * (see docs/feedback/2026-05-20-friend-onboarding-status-surface.md).
+ *
+ * Rate-limiting rules (status-surface plan + the 2026-06 flood fix):
+ *   - Only user-ACTIONABLE kinds (FRIEND_NOTIFY_KINDS) ever reach a friend;
+ *     transient/infra failures (probe timeouts, index/save errors) are
+ *     operator-only — visible in `onadit doctor`/`status`, never a banner.
+ *   - Notify on state transition, not every poll.
+ *   - Do not repeat the same unresolved issue more than once per day — and the
+ *     dedup memory SURVIVES a healthy run, so an intermittent failure
+ *     (fail → heal → fail within 24h) notifies once, not on every recurrence.
+ *   - After the cooldown elapses, a genuine later recurrence notifies fresh.
+ *
+ * The planning logic (`planNotifications`) is pure and fully tested; the
+ * IO (reading/writing dedup state, sending via osascript) is thin and
+ * best-effort so a notification failure can never break capture.
+ */
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+/** Re-notify cadence for an issue that stays unresolved. */
+export const RENOTIFY_INTERVAL_MS = 24 * 60 * 60 * 1000;
+/**
+ * The only issue kinds that ever raise a friend-facing macOS banner — the
+ * user-ACTIONABLE failures, where the friend can sign in or add a key and the
+ * problem clears. Everything else (a transient codex/claude probe failure, an
+ * index-write or save error, a backend timeout) is operator-only: surfaced in
+ * `onadit doctor` / `onadit status` and the logs, never a banner, because a
+ * non-technical friend cannot act on it and Onadit retries it on its own.
+ *
+ * New kinds default to operator-only (fail-closed): add a kind here only when
+ * there is a safe, concrete action the friend can take.
+ */
+export const FRIEND_NOTIFY_KINDS = new Set([
+    "codex_auth_expired",
+    "claude_auth_expired",
+    "voyage_key_missing",
+    // NOT voyage_embed_errors: "key present but embedding failed" is not cleanly
+    // friend-actionable — it spans an invalid key AND a network/provider flake.
+    // It stays operator-only until the cause is split into its own kind
+    // (voyage_key_invalid → friend banner, voyage_embed_errors → operator).
+]);
+/** Cause identity for an issue: explicit fingerprint, else its kind. */
+function issueFingerprint(issue) {
+    return issue.fingerprint ?? issue.kind;
+}
+/**
+ * Build the friend-facing notification for an issue. Pure. The title is
+ * intentionally constant ("Onadit needs attention") so the friend learns
+ * to recognise it; the subtitle and body carry the specifics.
+ */
+export function buildNotificationPayload(issue) {
+    return {
+        title: "Onadit needs attention",
+        subtitle: issue.title,
+        message: issue.nextAction,
+    };
+}
+/**
+ * Decide which notifications to send this tick and what state to persist.
+ * Pure: no IO, no clock except the injected `now`.
+ *
+ * Eligible issues are the intersection of `daemonObservable` (the daemon can
+ * see them) and `FRIEND_NOTIFY_KINDS` (the friend can act on them) — so a
+ * transient probe/index/save failure never reaches a banner.
+ *
+ * The dedup memory survives a healthy run: a record is retained until its 24h
+ * cooldown elapses, even on ticks where the issue is absent. That is the flood
+ * fix — without it, one healthy poll wiped the "already warned you" memory and
+ * the next recurrence re-notified, defeating the daily limit.
+ */
+export function planNotifications(input) {
+    const { issues, state, now } = input;
+    const eligible = issues.filter((i) => i.daemonObservable && FRIEND_NOTIFY_KINDS.has(i.kind));
+    const presentKinds = new Set(eligible.map((i) => i.kind));
+    const notifications = [];
+    const nextActive = {};
+    // Carry over prior records for kinds NOT failing this tick, as long as their
+    // cooldown window has not elapsed. This keeps the "already warned" memory
+    // alive across a healthy run, so an intermittent failure notifies once per
+    // day rather than on every recurrence. Expired records are dropped, so a
+    // genuine later recurrence notifies fresh.
+    for (const [kind, record] of Object.entries(state.active)) {
+        if (presentKinds.has(kind))
+            continue;
+        const lastMs = Date.parse(record.last_notified_at);
+        const fresh = !Number.isNaN(lastMs) && now - lastMs < RENOTIFY_INTERVAL_MS;
+        if (fresh)
+            nextActive[kind] = record;
+    }
+    for (const issue of eligible) {
+        const prior = state.active[issue.kind];
+        const fingerprint = issueFingerprint(issue);
+        const notify = () => {
+            notifications.push(buildNotificationPayload(issue));
+            nextActive[issue.kind] = {
+                last_notified_at: new Date(now).toISOString(),
+                fingerprint,
+            };
+        };
+        if (!prior) {
+            // First transition into failure → notify.
+            notify();
+            continue;
+        }
+        // The cause changed under the same subsystem (e.g. a Voyage network
+        // blip became a provider rejection). The action and risk differ, so
+        // treat it as a fresh failure rather than a still-unresolved repeat.
+        if ((prior.fingerprint ?? issue.kind) !== fingerprint) {
+            notify();
+            continue;
+        }
+        const priorMs = Date.parse(prior.last_notified_at);
+        const stale = Number.isNaN(priorMs) || now - priorMs >= RENOTIFY_INTERVAL_MS;
+        if (stale) {
+            // Still failing, same cause, a day later → re-notify once.
+            notify();
+        }
+        else {
+            // Already notified within the window → stay quiet, keep the record.
+            nextActive[issue.kind] = prior;
+        }
+    }
+    return { notifications, nextState: { active: nextActive } };
+}
+/** Absolute path to the dedup-state file under the data dir. */
+export function notifyStatePath(dataDir) {
+    return path.join(dataDir, "observability", "notifications.json");
+}
+/** Read dedup state; returns empty state on any read/parse failure. */
+export function readNotifyState(dataDir) {
+    try {
+        const raw = fs.readFileSync(notifyStatePath(dataDir), "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object" && parsed.active) {
+            return { active: parsed.active };
+        }
+    }
+    catch {
+        // fall through
+    }
+    return { active: {} };
+}
+/** Persist dedup state best-effort; swallows IO errors. */
+export function writeNotifyState(dataDir, state) {
+    try {
+        const file = notifyStatePath(dataDir);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(state, null, 2) + "\n", "utf8");
+    }
+    catch {
+        // best-effort: a failed write just means we may re-notify next tick.
+    }
+}
+/**
+ * Send a single notification via macOS `osascript`. Best-effort and
+ * fire-and-forget — any failure (non-macOS, osascript missing, user has
+ * notifications disabled) is swallowed so capture is never affected.
+ *
+ * Strings are passed as argv to `execFile` (not interpolated into a
+ * shell), and AppleScript string literals are escaped, so notification
+ * text cannot inject shell or AppleScript.
+ */
+export function sendNotification(payload, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    if (platform !== "darwin")
+        return;
+    const script = `display notification ${asAppleScriptString(payload.message)} ` +
+        `with title ${asAppleScriptString(payload.title)} ` +
+        `subtitle ${asAppleScriptString(payload.subtitle)}`;
+    try {
+        execFile("osascript", ["-e", script], () => {
+            // ignore stdout/stderr/exit — best-effort.
+        });
+    }
+    catch {
+        // ignore spawn errors entirely.
+    }
+}
+/** Escape a string into an AppleScript double-quoted literal. */
+export function asAppleScriptString(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+/**
+ * End-to-end daemon helper: given the diagnosed issues, send any due
+ * notifications and persist updated dedup state. Best-effort throughout
+ * — wired into the capture loop, so it must never throw.
+ */
+export function notifyDaemonFailures(dataDir, issues, opts = {}) {
+    try {
+        const now = opts.now ?? Date.now();
+        const state = readNotifyState(dataDir);
+        const { notifications, nextState } = planNotifications({
+            issues,
+            state,
+            now,
+        });
+        for (const payload of notifications) {
+            sendNotification(payload, opts.platform ? { platform: opts.platform } : {});
+        }
+        writeNotifyState(dataDir, nextState);
+    }
+    catch {
+        // best-effort: never let notification logic break the daemon.
+    }
+}
+//# sourceMappingURL=notify.js.map

package/dist/src/diagnostics/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../../src/diagnostics/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAiC,IAAI,GAAG,CAAC;IACvE,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,6EAA6E;IAC7E,4EAA4E;IAC5E,oEAAoE;IACpE,wEAAwE;CACzE,CAAC,CAAC;AAkCH,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,KAAkB;IAC1C,OAAO,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC;AACzC,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAkB;IAElB,OAAO;QACL,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,KAAK,CAAC,KAAK;QACrB,OAAO,EAAE,KAAK,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA6B;IAE7B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7D,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1D,MAAM,aAAa,GAA0B,EAAE,CAAC;IAChD,MAAM,UAAU,GAA0B,EAAE,CAAC;IAE7C,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,2CAA2C;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAEvD,EAAE,CAAC;QACF,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,MAAM,GAAG,oBAAoB,CAAC;QAC3E,IAAI,KAAK;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACvC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,aAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;gBACvB,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC7C,WAAW;aACZ,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,0CAA0C;YAC1C,MAAM,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,MAAM,KAAK,GACT,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,OAAO,IAAI,oBAAoB,CAAC;QACjE,IAAI,KAAK,EAAE,CAAC;YACV,2DAA2D;YAC3D,MAAM,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;AACnE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACxB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAkB;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA4B,EAC5B,OAAuC,EAAE;IAEzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAClC,MAAM,MAAM,GACV,wBAAwB,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;QAC/D,cAAc,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;QACnD,YAAY,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE;YACzC,2CAA2C;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,MAAqB,EACrB,OAAqD,EAAE;IAEvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC;YACrD,MAAM;YACN,KAAK;YACL,GAAG;SACJ,CAAC,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,gBAAgB,CACd,OAAO,EACP,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC"}

package/dist/src/diagnostics/repair-prompt.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Redacted repair-prompt generator for `onadit doctor --copy-prompt`.
+ *
+ * The output is designed to be pasted straight into Claude or Codex and
+ * be safe to do so. It carries enough state to debug Onadit but never
+ * leaks a secret, and it forbids destructive repair so an over-eager
+ * assistant cannot wipe the user's memory.
+ *
+ * Redaction contract (see the friend-onboarding status-surface plan):
+ *   - Never include full Voyage keys, auth tokens, bearer tokens, or raw
+ *     private conversation content.
+ *   - Voyage keys appear only as a last-4 fingerprint, and only when one
+ *     is known locally.
+ *   - Local paths are allowed only when they help repair (data + log
+ *     locations), because they are not secrets and the assistant needs
+ *     them to inspect the right folder.
+ *
+ * Safety contract:
+ *   - Tell the assistant to inspect before changing anything.
+ *   - Prefer commands that inspect/repair over commands that reset.
+ *   - Explicitly forbid destructive resets and
+ *     `onadit uninstall --purge-data`.
+ *
+ * This module is pure (no IO). Centralizing prompt generation here —
+ * rather than in the SwiftBar script or the CLI command — keeps
+ * redaction, status interpretation, and future issue classes in one
+ * place (Slice C's menu bar will call this same generator).
+ */
+import type { FriendStatusPayload } from "../server/routes/friend-status.js";
+import type { DoctorLocalSignals, DoctorReport } from "./doctor.js";
+export type RepairTarget = "claude" | "codex";
+export interface RepairPromptInput {
+    report: DoctorReport;
+    status: FriendStatusPayload | null;
+    localSignals: DoctorLocalSignals;
+}
+/**
+ * Commands the assistant must never run from this prompt. Kept as data
+ * so the test suite can assert every one is named in the rendered
+ * "Constraints" block.
+ */
+export declare const FORBIDDEN_COMMANDS: readonly string[];
+/**
+ * Build the repair prompt. `target` only changes which assistant the
+ * prompt addresses; the state and safety rules are identical so neither
+ * tool can be talked into something the other forbids.
+ */
+export declare function buildRepairPrompt(input: RepairPromptInput, target: RepairTarget): string;
+//# sourceMappingURL=repair-prompt.d.ts.map

package/dist/src/diagnostics/repair-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repair-prompt.d.ts","sourceRoot":"","sources":["../../../src/diagnostics/repair-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAI/C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,YAAY,GACnB,MAAM,CAsER"}

package/dist/src/diagnostics/repair-prompt.js

@@ -0,0 +1,223 @@
+/**
+ * Commands the assistant must never run from this prompt. Kept as data
+ * so the test suite can assert every one is named in the rendered
+ * "Constraints" block.
+ */
+export const FORBIDDEN_COMMANDS = [
+    "onadit uninstall --purge-data",
+    "onadit rebuild --reset",
+    "rm -rf",
+];
+/**
+ * Build the repair prompt. `target` only changes which assistant the
+ * prompt addresses; the state and safety rules are identical so neither
+ * tool can be talked into something the other forbids.
+ */
+export function buildRepairPrompt(input, target) {
+    const { report, status, localSignals } = input;
+    const assistant = target === "claude" ? "Claude" : "Codex";
+    // Open with the right severity. "Onadit is not healthy" is correct only
+    // when something is actually broken; a warning-only state (e.g. large
+    // sessions parked, an available update) must not tell the user their
+    // Onadit is broken — that copy erodes trust on a working install.
+    const hasBroken = report.issues.some((i) => i.severity === "broken");
+    const onlyParked = !hasBroken &&
+        report.issues.some((i) => i.kind === "capture_quarantined" || i.kind === "capture_repairing");
+    const opener = hasBroken
+        ? `Onadit is not healthy on this Mac. Please help me fix it, ${assistant}.`
+        : onlyParked
+            ? `Onadit is working, but some large Codex sessions are not searchable yet. ` +
+                `Please help me recover them, ${assistant}.`
+            : `Onadit is working, but a few things could use attention. ` +
+                `Please help me sort them out, ${assistant}.`;
+    const lines = [];
+    lines.push(opener);
+    lines.push("");
+    // --- Symptoms: the diagnosed issues, plain-language, no secrets. ---
+    lines.push("Symptoms:");
+    if (report.issues.length === 0) {
+        lines.push("- onadit doctor found no specific broken signal, but I think something " +
+            "is off. Please investigate.");
+    }
+    else {
+        for (const issue of report.issues) {
+            lines.push(`- ${issue.title}. ${issue.detail}`);
+        }
+    }
+    lines.push("");
+    // --- State: redacted, debug-useful facts. ---
+    lines.push("Current state:");
+    for (const line of renderStateLines(report, status, localSignals)) {
+        lines.push(`- ${line}`);
+    }
+    lines.push("");
+    // --- Inspect-first checklist, ordered by the primary issue. ---
+    lines.push("Start by inspecting, in this order:");
+    let step = 1;
+    lines.push(`${step++}. \`onadit status\` — confirm the current state for yourself.`);
+    lines.push(`${step++}. \`onadit doctor\` — read the plain-language diagnosis.`);
+    for (const cmd of inspectionCommandsFor(report)) {
+        lines.push(`${step++}. ${cmd}`);
+    }
+    lines.push(`${step++}. Onadit logs only if the above is not enough.`);
+    lines.push("");
+    // --- Hard constraints. ---
+    lines.push("Constraints:");
+    lines.push("- Explain the failure to me in plain English BEFORE changing anything.");
+    lines.push("- Inspect first; prefer commands that inspect and repair over commands that reset.");
+    lines.push("- Do not print or echo secrets (Voyage key, tokens).");
+    lines.push("- Do not delete or reset my Onadit data.");
+    for (const forbidden of FORBIDDEN_COMMANDS) {
+        lines.push(`- Do not run \`${forbidden}\`.`);
+    }
+    lines.push("- If a fix is risky or irreversible, stop and ask me first.");
+    return lines.join("\n");
+}
+/**
+ * Render the redacted "Current state" facts. Every value here is either
+ * non-sensitive (versions, ports, booleans, ages) or already reduced to
+ * a safe fingerprint (Voyage last-4). Raw keys, tokens, and conversation
+ * content never reach this function.
+ */
+function renderStateLines(report, status, localSignals) {
+    const out = [];
+    if (!status) {
+        // The reason /status/friend could not be read drives the state copy:
+        // "not responding" is only true for a genuinely down daemon, not for
+        // an auth/config failure where the daemon may be perfectly alive.
+        switch (report.primary?.kind) {
+            case "config_missing":
+                out.push("Onadit config: missing (could not resolve the daemon URL).");
+                out.push("This Mac looks like onboarding never completed.");
+                break;
+            case "daemon_auth_failed":
+                out.push("Onadit daemon: reachable, but this command could not authenticate " +
+                    "to it (missing or rejected token). The daemon itself may be fine.");
+                break;
+            default:
+                out.push("Onadit daemon: not responding (could not reach /status/friend).");
+                break;
+        }
+        out.push("Expected daemon label: com.getrift.daemon (managed by launchd on port 3577).");
+        out.push(voyageFingerprintLine(localSignals));
+        out.push(mcpLine(localSignals));
+        return out;
+    }
+    out.push(`Onadit version: ${status.build.version} (node ${status.build.node}).`);
+    out.push(`Daemon: running on port ${status.daemon.port}, up ${formatSeconds(status.daemon.uptime_seconds)}.`);
+    // data_dir is a local path, not a secret, and the assistant needs it
+    // to inspect the right data root (a stale Application Support copy is
+    // a real false-alarm source).
+    out.push(`Data directory: ${status.daemon.data_dir}`);
+    out.push(`Voyage key present in daemon env: ${status.daemon.voyage_key_present ? "yes" : "no"}.`);
+    out.push(voyageFingerprintLine(localSignals));
+    if (status.voyage.last_embed_at) {
+        out.push(`Last successful embed: ${status.voyage.last_embed_at}.`);
+    }
+    if (status.voyage.last_error_at) {
+        out.push(`Last Voyage error: ${status.voyage.last_error_at} (${status.voyage.last_error_reason ?? "unknown"}).`);
+    }
+    if (status.index.last_update_at) {
+        out.push(`Last index write: ${status.index.last_update_at}.`);
+    }
+    if (status.index.last_error_at) {
+        out.push(`Last index error: ${status.index.last_error_at} (${status.index.last_error_reason ?? "unknown"}).`);
+    }
+    out.push(`Codex CLI auth: ${codexAuthLabel(status.codex.last_preflight_ok)}${status.codex.last_preflight_at
+        ? ` (last checked ${status.codex.last_preflight_at})`
+        : ""}.`);
+    if (status.capture.last_run_at) {
+        out.push(`Last capture run: ${status.capture.last_run_at} — ${status.capture.last_saved} saved, ` +
+            `${status.capture.last_review} for review, ${status.capture.last_errors} errors.`);
+    }
+    else {
+        out.push("Last capture run: none yet.");
+    }
+    out.push(mcpLine(localSignals));
+    return out;
+}
+function voyageFingerprintLine(localSignals) {
+    return localSignals.voyageLast4
+        ? `Voyage key fingerprint (last 4 only): …${localSignals.voyageLast4}.`
+        : "Voyage key fingerprint: not found locally.";
+}
+function mcpLine(localSignals) {
+    if (localSignals.mcpClients.length === 0) {
+        return "MCP clients: none detected.";
+    }
+    const parts = localSignals.mcpClients.map((c) => `${c.client}=${c.installed ? "connected" : "not connected"}`);
+    return `MCP clients: ${parts.join(", ")}.`;
+}
+function codexAuthLabel(ok) {
+    if (ok === null)
+        return "unknown (not checked yet)";
+    return ok ? "looks authenticated" : "appears expired";
+}
+/**
+ * Issue-specific inspection commands, deduped and ordered by the issues
+ * present. Inspection/repair only — nothing here resets state.
+ */
+function inspectionCommandsFor(report) {
+    const cmds = [];
+    const seen = new Set();
+    const add = (cmd) => {
+        if (!seen.has(cmd)) {
+            seen.add(cmd);
+            cmds.push(cmd);
+        }
+    };
+    for (const issue of report.issues) {
+        switch (issue.kind) {
+            case "daemon_unreachable":
+                add("`launchctl print gui/$UID/com.getrift.daemon` — check the daemon is loaded and not crash-looping.");
+                break;
+            case "daemon_auth_failed":
+                add("`onadit token issue` — re-issue an access token (the existing one is missing or rejected); do not restart the daemon for this.");
+                break;
+            case "config_missing":
+                add("`onadit onboard` — finish setup; there is no config for this command to read yet.");
+                break;
+            case "codex_auth_expired":
+                add("`codex login` — re-authenticate the codex CLI, then `onadit capture`.");
+                break;
+            case "codex_preflight_failed":
+                add("Codex capture probe failed (NOT an auth problem — do not re-run `codex login`). If it mentions a rejected model, set `codex_cli.model` in the Onadit config to a supported model; otherwise it is usually a transient backend/timeout — re-run `onadit capture`.");
+                break;
+            case "voyage_key_missing":
+            case "voyage_embed_errors":
+                add("`onadit onboard --reconfigure-voyage` — re-check the Voyage key (it will not be printed).");
+                break;
+            case "index_write_errors":
+                add("`onadit reindex` — only after confirming the cause; this rebuilds the index, it does not delete data.");
+                break;
+            case "capture_failed":
+                add("`onadit capture` — re-run capture and read the per-session output.");
+                break;
+            case "capture_quarantined":
+            case "capture_repairing":
+                // Onadit self-repairs these in the background, but a user who is
+                // explicitly assembling a repair prompt wants the manual escape hatch
+                // named — it is idempotent and non-destructive, so it is safe to run
+                // even while a background pass is in flight.
+                add("`onadit doctor repair capture-large-sessions` — summarize and save the oversized sessions Onadit had to skip; it reads them in safe chunks and does not delete or modify the originals.");
+                break;
+            default:
+                break;
+        }
+    }
+    return cmds;
+}
+function formatSeconds(seconds) {
+    if (seconds < 60)
+        return `${seconds}s`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.floor(minutes / 60);
+    const remMin = minutes % 60;
+    if (hours < 24)
+        return remMin > 0 ? `${hours}h ${remMin}m` : `${hours}h`;
+    const days = Math.floor(hours / 24);
+    return `${days}d`;
+}
+//# sourceMappingURL=repair-prompt.js.map

package/dist/src/diagnostics/repair-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repair-prompt.js","sourceRoot":"","sources":["../../../src/diagnostics/repair-prompt.ts"],"names":[],"mappings":"AAuCA;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,+BAA+B;IAC/B,wBAAwB;IACxB,QAAQ;CACT,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,MAAoB;IAEpB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3D,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,CAAC,SAAS;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAC1E,CAAC;IACJ,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,6DAA6D,SAAS,GAAG;QAC3E,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,2EAA2E;gBAC3E,gCAAgC,SAAS,GAAG;YAC9C,CAAC,CAAC,2DAA2D;gBAC3D,iCAAiC,SAAS,GAAG,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sEAAsE;IACtE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,yEAAyE;YACvE,6BAA6B,CAChC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,+CAA+C;IAC/C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,iEAAiE;IACjE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,+DAA+D,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,gDAAgD,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,4BAA4B;IAC5B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;IACjG,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACvD,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,kBAAkB,SAAS,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAE1E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,MAAoB,EACpB,MAAkC,EAClC,YAAgC;IAEhC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,qEAAqE;QACrE,qEAAqE;QACrE,kEAAkE;QAClE,QAAQ,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7B,KAAK,gBAAgB;gBACnB,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;gBAC5D,MAAM;YACR,KAAK,oBAAoB;gBACvB,GAAG,CAAC,IAAI,CACN,oEAAoE;oBAClE,mEAAmE,CACtE,CAAC;gBACF,MAAM;YACR;gBACE,GAAG,CAAC,IAAI,CACN,iEAAiE,CAClE,CAAC;gBACF,MAAM;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CACN,8EAA8E,CAC/E,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IACjF,GAAG,CAAC,IAAI,CACN,2BAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,aAAa,CAChE,MAAM,CAAC,MAAM,CAAC,cAAc,CAC7B,GAAG,CACL,CAAC;IACF,qEAAqE;IACrE,sEAAsE;IACtE,8BAA8B;IAC9B,GAAG,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtD,GAAG,CAAC,IAAI,CACN,qCAAqC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CACxF,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CACN,sBAAsB,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,iBAAiB,IAAI,SAAS,IAAI,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CACN,qBAAqB,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,SAAS,IAAI,CACpG,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,IAAI,CACN,mBAAmB,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAC/D,MAAM,CAAC,KAAK,CAAC,iBAAiB;QAC5B,CAAC,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,iBAAiB,GAAG;QACrD,CAAC,CAAC,EACN,GAAG,CACJ,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CACN,qBAAqB,MAAM,CAAC,OAAO,CAAC,WAAW,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,UAAU;YACtF,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,gBAAgB,MAAM,CAAC,OAAO,CAAC,WAAW,UAAU,CACpF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1C,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,YAAgC;IAC7D,OAAO,YAAY,CAAC,WAAW;QAC7B,CAAC,CAAC,0CAA0C,YAAY,CAAC,WAAW,GAAG;QACvE,CAAC,CAAC,4CAA4C,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAC,YAAgC;IAC/C,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,EAAE,CACpE,CAAC;IACF,OAAO,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,EAAkB;IACxC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,2BAA2B,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAQ,EAAE;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,oBAAoB;gBACvB,GAAG,CAAC,mGAAmG,CAAC,CAAC;gBACzG,MAAM;YACR,KAAK,oBAAoB;gBACvB,GAAG,CAAC,gIAAgI,CAAC,CAAC;gBACtI,MAAM;YACR,KAAK,gBAAgB;gBACnB,GAAG,CAAC,mFAAmF,CAAC,CAAC;gBACzF,MAAM;YACR,KAAK,oBAAoB;gBACvB,GAAG,CAAC,uEAAuE,CAAC,CAAC;gBAC7E,MAAM;YACR,KAAK,wBAAwB;gBAC3B,GAAG,CAAC,kQAAkQ,CAAC,CAAC;gBACxQ,MAAM;YACR,KAAK,oBAAoB,CAAC;YAC1B,KAAK,qBAAqB;gBACxB,GAAG,CAAC,2FAA2F,CAAC,CAAC;gBACjG,MAAM;YACR,KAAK,oBAAoB;gBACvB,GAAG,CAAC,uGAAuG,CAAC,CAAC;gBAC7G,MAAM;YACR,KAAK,gBAAgB;gBACnB,GAAG,CAAC,oEAAoE,CAAC,CAAC;gBAC1E,MAAM;YACR,KAAK,qBAAqB,CAAC;YAC3B,KAAK,mBAAmB;gBACtB,iEAAiE;gBACjE,sEAAsE;gBACtE,qEAAqE;gBACrE,6CAA6C;gBAC7C,GAAG,CAAC,yLAAyL,CAAC,CAAC;gBAC/L,MAAM;YACR;gBACE,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACpC,OAAO,GAAG,IAAI,GAAG,CAAC;AACpB,CAAC"}

package/dist/src/ingestion/bulk-ingest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Bulk-ingest — Slice 19.
+ *
+ * Re-exports from the CLI command module. The bulk-ingest feature is
+ * implemented as a CLI command (src/cli/commands/bulk-ingest.ts) that
+ * calls the daemon's POST /ingest endpoint, reusing the same secure
+ * ingest pipeline (archive security, parser validation, extraction,
+ * quarantine) rather than duplicating it.
+ */
+export { makeBulkIngestCommand } from "../cli/commands/bulk-ingest.js";
+//# sourceMappingURL=bulk-ingest.d.ts.map

package/dist/src/ingestion/bulk-ingest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulk-ingest.d.ts","sourceRoot":"","sources":["../../../src/ingestion/bulk-ingest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/src/ingestion/bulk-ingest.js

@@ -0,0 +1,11 @@
+/**
+ * Bulk-ingest — Slice 19.
+ *
+ * Re-exports from the CLI command module. The bulk-ingest feature is
+ * implemented as a CLI command (src/cli/commands/bulk-ingest.ts) that
+ * calls the daemon's POST /ingest endpoint, reusing the same secure
+ * ingest pipeline (archive security, parser validation, extraction,
+ * quarantine) rather than duplicating it.
+ */
+export { makeBulkIngestCommand } from "../cli/commands/bulk-ingest.js";
+//# sourceMappingURL=bulk-ingest.js.map

package/dist/src/ingestion/bulk-ingest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulk-ingest.js","sourceRoot":"","sources":["../../../src/ingestion/bulk-ingest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/src/ingestion/chunk-meta.d.ts

@@ -0,0 +1,85 @@
+/**
+ * The single source of truth for chunk MARKERS — how a row declares it is one
+ * piece of a larger logical document/conversation, and how readers recover the
+ * parent grouping. Every producer (indexer, save, ingest, rebuild) and every
+ * consumer (retrieval grouping, reconcile, dedup) imports from here, so there is
+ * exactly one marker contract.
+ *
+ * Representation:
+ *   - Conversations carry explicit columns `parent_id`, `chunk_index`,
+ *     `chunk_count` (all strings; empty = legacy/unchunked).
+ *   - Documents carry `chunk_index` / `chunk_count` inside the existing
+ *     `metadata` JSON; the parent key is the already-indexed `source_path`.
+ *
+ * The explicit `chunk_count` IS the marker: `chunk_count > 1` means "this row is
+ * part of a chunk set". A row WITHOUT that marker is never grouped — sharing a
+ * `source_path` or `idempotency_key` alone must not cause a collapse. Ordinals
+ * are stored explicitly (not parsed out of the row id), so completeness checks
+ * and honest "section k of N" display never treat the id as the source of truth.
+ */
+import type { TableName } from "../storage/tables.js";
+export interface ChunkMarker {
+    /** Parent key value: `source_path` for docs, `parent_id` for conversations. */
+    parentId: string;
+    /** 0-based ordinal within the set. */
+    index: number;
+    /** Total chunks in the set (> 1 when this is genuinely chunked). */
+    count: number;
+}
+/** Separators for chunk row ids. Distinct per family for readability; ids are
+ *  unique either way and are NOT load-bearing for ordering (use chunk_index). */
+export declare const DOC_CHUNK_SEP = ":";
+export declare const CONV_CHUNK_SEP = "::";
+/** Read the chunk marker from a conversation row, or null if unchunked/legacy. */
+export declare function readConversationChunkMarker(row: Record<string, unknown>): ChunkMarker | null;
+/** Read the chunk marker from a structured-doc row, or null if unchunked/legacy. */
+export declare function readDocChunkMarker(row: Record<string, unknown>): ChunkMarker | null;
+/**
+ * Namespaced parent key for retrieval grouping, or `null` when the row carries
+ * NO explicit chunk marker (the flag-off / legacy case — never grouped).
+ *
+ * Namespacing guarantees mixed-vintage / cross-table rows can never collapse:
+ *   - docs  → `doc|<source_table>|<source_path>`  (so `structured_docs` vs
+ *     `structured_docs_local` with the same path stay separate)
+ *   - convs → `conv|<source>|<parent_id>`
+ */
+export declare function parentKeyForRow(sourceTable: TableName, row: Record<string, unknown>): string | null;
+/** True iff the row is part of a genuine chunk set (`chunk_count > 1`). */
+export declare function isChunked(sourceTable: TableName, row: Record<string, unknown>): boolean;
+/**
+ * Unified chunk-marker reader across the conversation and document families,
+ * or `null` for an unchunked/legacy row (no marker / `chunk_count <= 1`) and for
+ * digests (which never chunk). Lets the read-side (expand stitching) inspect a
+ * row's position in its set without re-deriving the per-family column vs metadata
+ * split. `parentId` is the raw column value (`parent_id` / `source_path`), not the
+ * namespaced retrieval key.
+ */
+export declare function readChunkMarker(sourceTable: TableName, row: Record<string, unknown>): ChunkMarker | null;
+/** Conversation chunk columns. count <= 1 → empty markers (matches seed/legacy). */
+export declare function conversationChunkColumns(parentId: string, index: number, count: number): {
+    parent_id: string;
+    chunk_index: string;
+    chunk_count: string;
+};
+/** Merge chunk ordinals into a doc metadata object. count <= 1 → unchanged
+ *  (NO `chunk_*` keys), so a single/legacy doc stays byte-identical. */
+export declare function docChunkMetadata(base: Record<string, unknown>, index: number, count: number): Record<string, unknown>;
+export declare function convChunkId(parentId: string, index: number): string;
+export declare function docChunkId(fileId: string, index: number): string;
+/** The largest declared `chunk_count` across a set of rows (≥ 1). */
+export declare function expectedChunkCount(rows: Record<string, unknown>[]): number;
+/**
+ * True iff the rows already indexed for a parent form a COMPLETE set. Used by
+ * save/ingest/reconcile dedup so a partially-written set (crash mid-append) is
+ * repaired rather than mistaken for "already indexed".
+ *
+ * Completeness is stricter than a row count: a chunked set is complete only when
+ * every chunk index `0 .. count-1` is present EXACTLY once and every row agrees
+ * on the same `chunk_count`. This rejects the degenerate set that a bare
+ * `rows.length >= count` check would wave through — e.g. a duplicated chunk 0
+ * with a missing chunk 1 (length 2, count 2, but broken). An unchunked set
+ * (`count <= 1`, all legacy/`/ingest`-job rows) keeps the legacy semantics: any
+ * existing row counts as complete, so this never changes flag-off behavior.
+ */
+export declare function chunkSetComplete(rows: Record<string, unknown>[]): boolean;
+//# sourceMappingURL=chunk-meta.d.ts.map

package/dist/src/ingestion/chunk-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-meta.d.ts","sourceRoot":"","sources":["../../../src/ingestion/chunk-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;iFACiF;AACjF,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,eAAO,MAAM,cAAc,OAAO,CAAC;AAgCnC,kFAAkF;AAClF,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,WAAW,GAAG,IAAI,CAMpB;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,WAAW,GAAG,IAAI,CAQpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,SAAS,EACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,MAAM,GAAG,IAAI,CAaf;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CACvB,WAAW,EAAE,SAAS,EACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,OAAO,CAET;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,SAAS,EACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,WAAW,GAAG,IAAI,CAQpB;AAID,oFAAoF;AACpF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAOjE;AAED;wEACwE;AACxE,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAID,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,MAAM,CAI1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAczE"}