onadit 0.0.1 → 0.1.0-beta.45

package/dist/src/capture/batch-budget.js

@@ -0,0 +1,148 @@
+/**
+ * Per-batch cost ceiling and parallelism guard.
+ *
+ * Concurrency-safe by construction:
+ *   - the budget reserves an estimate up-front (acquire), so two parallel
+ *     callers can't both pass the cap by reading a stale "spent" total
+ *   - each call returns its actual cost to its own reservation token;
+ *     no shared mutable cost bucket on the provider
+ *   - failed/aborted calls refund the reservation
+ *
+ * Cost-cap policy: fail-closed. Once a reservation pushes the running
+ * total past the cap, the budget is marked exceeded and refuses every
+ * subsequent reservation, even if currently-in-flight calls would have
+ * trued-up to less than reserved. Already-running calls finish.
+ *
+ * Concurrency policy: at most `maxParallel` triage calls are in flight.
+ * Excess callers wait FIFO.
+ */
+import { BatchCostExceededError, BilledOpenAIError, } from "./triage-provider.js";
+export class BatchBudget {
+    capUsd;
+    /** Reserved + actually spent. Never negative. */
+    accounted = 0;
+    exceeded = false;
+    constructor(capUsd) {
+        this.capUsd = capUsd;
+        if (capUsd <= 0) {
+            throw new Error("BatchBudget capUsd must be positive");
+        }
+    }
+    /**
+     * Reserve `estimateUsd` against the cap and return a finalize token.
+     *
+     * Throws BatchCostExceededError if the budget is already busted, or if
+     * adding this estimate would exceed the cap. Subsequent reservations
+     * after a breach are also refused (fail-closed).
+     */
+    reserve(estimateUsd) {
+        if (this.exceeded) {
+            throw new BatchCostExceededError(`Batch cost cap exceeded — no new triage admitted (accounted $${this.accounted.toFixed(4)}, cap $${this.capUsd.toFixed(2)})`, this.accounted, this.capUsd);
+        }
+        const requested = Math.max(0, estimateUsd);
+        if (this.accounted + requested > this.capUsd) {
+            this.exceeded = true;
+            throw new BatchCostExceededError(`Batch cost cap would be exceeded (accounted $${this.accounted.toFixed(4)} + estimate $${requested.toFixed(4)} > cap $${this.capUsd.toFixed(2)})`, this.accounted, this.capUsd);
+        }
+        this.accounted += requested;
+        let finalized = false;
+        return (actualUsd) => {
+            if (finalized)
+                return;
+            finalized = true;
+            const delta = Math.max(0, actualUsd) - requested;
+            this.accounted += delta;
+            if (this.accounted < 0)
+                this.accounted = 0;
+            if (this.accounted > this.capUsd)
+                this.exceeded = true;
+        };
+    }
+    get spent() {
+        return this.accounted;
+    }
+    get isExceeded() {
+        return this.exceeded;
+    }
+}
+/**
+ * FIFO semaphore. acquire() resolves when a slot is free; release()
+ * hands the slot to the next waiter.
+ */
+export class Semaphore {
+    maxParallel;
+    inFlight = 0;
+    waiters = [];
+    /** Peak concurrent in-flight count, for test assertions. */
+    peakInFlight = 0;
+    constructor(maxParallel) {
+        this.maxParallel = maxParallel;
+        if (maxParallel <= 0) {
+            throw new Error("Semaphore maxParallel must be positive");
+        }
+    }
+    async acquire() {
+        if (this.inFlight < this.maxParallel) {
+            this.inFlight++;
+            if (this.inFlight > this.peakInFlight)
+                this.peakInFlight = this.inFlight;
+            return;
+        }
+        await new Promise((resolve) => this.waiters.push(resolve));
+        this.inFlight++;
+        if (this.inFlight > this.peakInFlight)
+            this.peakInFlight = this.inFlight;
+    }
+    release() {
+        this.inFlight--;
+        const next = this.waiters.shift();
+        if (next)
+            next();
+    }
+    get current() {
+        return this.inFlight;
+    }
+}
+/**
+ * Wrap a CostReportingTriageProvider with a per-batch budget and
+ * parallelism cap. Returns a TriageProvider that reserves budget
+ * up-front, true-ups to actual cost on completion, and refunds on
+ * failure.
+ */
+export function withBatchGuards(provider, budget, semaphore) {
+    return {
+        async triage(input) {
+            // Reserve before launching: prevents over-admission under concurrency.
+            const finalize = budget.reserve(provider.estimateMaxCostUsd(input));
+            let actualUsd = 0;
+            try {
+                await semaphore.acquire();
+                try {
+                    const { result, cost } = await provider.triageWithCost(input);
+                    actualUsd = cost.usd;
+                    return result;
+                }
+                finally {
+                    semaphore.release();
+                }
+            }
+            catch (err) {
+                // BilledOpenAIError carries a cost the upstream API already
+                // charged us (200 + bad JSON). Retain that cost in the budget;
+                // refunding would silently let a malformed-response loop escape
+                // the cap. All other failures refund the full reservation.
+                if (err instanceof BilledOpenAIError) {
+                    actualUsd = err.costUsd;
+                }
+                else {
+                    actualUsd = 0;
+                }
+                throw err;
+            }
+            finally {
+                finalize(actualUsd);
+            }
+        },
+    };
+}
+//# sourceMappingURL=batch-budget.js.map

package/dist/src/capture/batch-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-budget.js","sourceRoot":"","sources":["../../../src/capture/batch-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAIlB,MAAM,sBAAsB,CAAC;AAoC9B,MAAM,OAAO,WAAW;IAKM;IAJ5B,iDAAiD;IACzC,SAAS,GAAG,CAAC,CAAC;IACd,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAA4B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACxC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAmB;QACzB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAC9B,gEAAgE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAC5H,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,IAAI,sBAAsB,CAC9B,gDAAgD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EACjJ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;QAC5B,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,SAAiB,EAAE,EAAE;YAC3B,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;YACxB,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3C,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzD,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,SAAS;IAMQ;IALpB,QAAQ,GAAG,CAAC,CAAC;IACb,OAAO,GAAmB,EAAE,CAAC;IACrC,4DAA4D;IACrD,YAAY,GAAG,CAAC,CAAC;IAExB,YAA4B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;QAC7C,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAqC,EACrC,MAAmB,EACnB,SAAoB;IAEpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,uEAAuE;YACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YACpE,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;oBAC9D,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;oBACrB,OAAO,MAAM,CAAC;gBAChB,CAAC;wBAAS,CAAC;oBACT,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4DAA4D;gBAC5D,+DAA+D;gBAC/D,gEAAgE;gBAChE,2DAA2D;gBAC3D,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,CAAC,CAAC;gBAChB,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/capture/claude-cli-triage-provider.d.ts

@@ -0,0 +1,28 @@
+import { type TriageInput, type TriageResult } from "./triage-provider.js";
+import type { CostReportingTriageProvider, TriageCost } from "./batch-budget.js";
+/**
+ * Triage provider backed by the Claude Code (`claude`) CLI — the Claude-Code
+ * sibling of CodexCliTriageProvider. Same classification contract (shared
+ * prompt + schema), same TriageResult shape, same cost model (0 — the run is
+ * on the operator's own subscription, like Codex). Only the runtime differs,
+ * so selecting it changes who classifies, never how the result is scored.
+ */
+/** Provider tag minted into TriageResult.provider for the Claude worker. */
+export declare const CLAUDE_CODE_TRIAGE_PROVIDER = "claude-code";
+export declare class ClaudeCliTriageProvider implements CostReportingTriageProvider {
+    private readonly options;
+    constructor(options?: {
+        cwd?: string;
+        timeoutMs?: number;
+        /** Override the pinned `--model`. Defaults to a fast classifier. */
+        model?: string;
+    });
+    estimateMaxCostUsd(_input: TriageInput): number;
+    triage(input: TriageInput): Promise<TriageResult>;
+    triageWithCost(input: TriageInput): Promise<{
+        result: TriageResult;
+        cost: TriageCost;
+    }>;
+    private runPrompt;
+}
+//# sourceMappingURL=claude-cli-triage-provider.d.ts.map

package/dist/src/capture/claude-cli-triage-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-cli-triage-provider.d.ts","sourceRoot":"","sources":["../../../src/capture/claude-cli-triage-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EACV,2BAA2B,EAC3B,UAAU,EACX,MAAM,mBAAmB,CAAC;AAc3B;;;;;;GAMG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,gBAAgB,CAAC;AAczD,qBAAa,uBAAwB,YAAW,2BAA2B;IAEvE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE;QACxB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,oEAAoE;QACpE,KAAK,CAAC,EAAE,MAAM,CAAC;KACX;IAGR,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM;IAIzC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjD,cAAc,CAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;YAiCxC,SAAS;CAmDxB"}

package/dist/src/capture/claude-cli-triage-provider.js

@@ -0,0 +1,101 @@
+import { TRIAGE_VERSION, } from "./triage-provider.js";
+import { scoreHistoricalTriage, } from "./triage-lane.js";
+import { TRIAGE_PROMPT, TRIAGE_OUTPUT_SCHEMA, TriageOutputSchema, } from "./triage-classification.js";
+import { runClaudeCliJson } from "../providers/claude-cli-runner.js";
+import { truncateToBytes } from "../providers/codex-input-limit.js";
+import { CLAUDE_MAX_INPUT_BYTES, CLAUDE_INPUT_SAFETY_MARGIN, CLAUDE_TRUNCATION_MARKER, } from "../providers/claude-input-limit.js";
+/**
+ * Triage provider backed by the Claude Code (`claude`) CLI — the Claude-Code
+ * sibling of CodexCliTriageProvider. Same classification contract (shared
+ * prompt + schema), same TriageResult shape, same cost model (0 — the run is
+ * on the operator's own subscription, like Codex). Only the runtime differs,
+ * so selecting it changes who classifies, never how the result is scored.
+ */
+/** Provider tag minted into TriageResult.provider for the Claude worker. */
+export const CLAUDE_CODE_TRIAGE_PROVIDER = "claude-code";
+export class ClaudeCliTriageProvider {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    estimateMaxCostUsd(_input) {
+        return 0;
+    }
+    async triage(input) {
+        const { result } = await this.triageWithCost(input);
+        return result;
+    }
+    async triageWithCost(input) {
+        const parsed = await this.runPrompt(input);
+        const scoring = scoreHistoricalTriage({
+            content: input.content,
+            decision: parsed.decision,
+            confidence: parsed.confidence,
+            summary: parsed.summary,
+            rationale: parsed.rationale,
+            topics: parsed.topics,
+            ...(input.source ? { source: input.source } : {}),
+        });
+        return {
+            result: {
+                decision: parsed.decision,
+                lane: scoring.lane,
+                confidence: parsed.confidence,
+                score: scoring.score,
+                summary: parsed.summary,
+                topics: parsed.topics,
+                user_decisions: parsed.user_decisions,
+                user_constraints: parsed.user_constraints,
+                rationale: parsed.rationale,
+                model: parsed.model,
+                provider: CLAUDE_CODE_TRIAGE_PROVIDER,
+                version: TRIAGE_VERSION,
+                score_breakdown: scoring.debug.score_breakdown,
+                debug: scoring.debug,
+            },
+            cost: { usd: 0 },
+        };
+    }
+    async runPrompt(input) {
+        // Same oversized-session jam class the Codex cap fixed: here the ceiling
+        // is the pinned model's context, not a CLI parser limit — see
+        // claude-input-limit.ts. Triage still saves the FULL transcript; only the
+        // classifier reads a head+tail sample.
+        const content = truncateToBytes(input.content, CLAUDE_MAX_INPUT_BYTES -
+            Buffer.byteLength(TRIAGE_PROMPT, "utf8") -
+            CLAUDE_INPUT_SAFETY_MARGIN, CLAUDE_TRUNCATION_MARKER);
+        const prompt = `${TRIAGE_PROMPT}${content}`;
+        const { output, model } = await runClaudeCliJson({
+            prompt,
+            schema: TRIAGE_OUTPUT_SCHEMA,
+            ...(this.options.cwd ? { cwd: this.options.cwd } : {}),
+            ...(this.options.timeoutMs ? { timeoutMs: this.options.timeoutMs } : {}),
+            ...(this.options.model ? { model: this.options.model } : {}),
+        });
+        // Validate the WHOLE parsed object against the shared contract — including
+        // the `result`-text fallback path, where a model could omit fields. A
+        // missing/typed-wrong field is a malformed classification (throw), never a
+        // silently-coerced blank. The error names only the offending FIELDS, never
+        // their model-produced values, so conversation content can't leak to logs.
+        const parsed = TriageOutputSchema.safeParse(output);
+        if (!parsed.success) {
+            const fields = [
+                ...new Set(parsed.error.issues.map((i) => i.path.join(".") || "(root)")),
+            ];
+            throw new Error(`Claude CLI returned a triage object that failed schema validation (invalid fields: ${fields.join(", ")})`);
+        }
+        return {
+            decision: parsed.data.decision,
+            confidence: parsed.data.confidence,
+            summary: parsed.data.summary,
+            topics: parsed.data.topics,
+            rationale: parsed.data.rationale,
+            user_decisions: parsed.data.user_decisions,
+            user_constraints: parsed.data.user_constraints,
+            // The CLI does not echo the resolved model in the envelope; record the
+            // model we pinned (honest: that is what we requested it run under).
+            model: model,
+        };
+    }
+}
+//# sourceMappingURL=claude-cli-triage-provider.js.map

package/dist/src/capture/claude-cli-triage-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-cli-triage-provider.js","sourceRoot":"","sources":["../../../src/capture/claude-cli-triage-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAGf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C;;;;;;GAMG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,aAAa,CAAC;AAczD,MAAM,OAAO,uBAAuB;IAEf;IADnB,YACmB,UAKb,EAAE;QALW,YAAO,GAAP,OAAO,CAKlB;IACL,CAAC;IAEJ,kBAAkB,CAAC,MAAmB;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,2BAA2B;gBACrC,OAAO,EAAE,cAAc;gBACvB,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;gBAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;SACjB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAkB;QACxC,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,uCAAuC;QACvC,MAAM,OAAO,GAAG,eAAe,CAC7B,KAAK,CAAC,OAAO,EACb,sBAAsB;YACpB,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC;YACxC,0BAA0B,EAC5B,wBAAwB,CACzB,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,aAAa,GAAG,OAAO,EAAE,CAAC;QAC5C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAU;YACxD,MAAM;YACN,MAAM,EAAE,oBAAoB;YAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QAEH,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG;gBACb,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAC7D;aACF,CAAC;YACF,MAAM,IAAI,KAAK,CACb,sFAAsF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3G,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;YAClC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;YAChC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc;YAC1C,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;YAC9C,uEAAuE;YACvE,oEAAoE;YACpE,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;CACF"}

package/dist/src/capture/codex-cli-triage-provider.d.ts

@@ -0,0 +1,17 @@
+import { type TriageInput, type TriageResult } from "./triage-provider.js";
+import type { CostReportingTriageProvider, TriageCost } from "./batch-budget.js";
+export declare class CodexCliTriageProvider implements CostReportingTriageProvider {
+    private readonly options;
+    constructor(options?: {
+        cwd?: string;
+        timeoutMs?: number;
+    });
+    estimateMaxCostUsd(_input: TriageInput): number;
+    triage(input: TriageInput): Promise<TriageResult>;
+    triageWithCost(input: TriageInput): Promise<{
+        result: TriageResult;
+        cost: TriageCost;
+    }>;
+    private runPrompt;
+}
+//# sourceMappingURL=codex-cli-triage-provider.d.ts.map

package/dist/src/capture/codex-cli-triage-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-cli-triage-provider.d.ts","sourceRoot":"","sources":["../../../src/capture/codex-cli-triage-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EACV,2BAA2B,EAC3B,UAAU,EACX,MAAM,mBAAmB,CAAC;AAgC3B,qBAAa,sBAAuB,YAAW,2BAA2B;IAEtE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE;QACxB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;KACf;IAGR,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM;IAIzC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjD,cAAc,CAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;YAiCxC,SAAS;CA+CxB"}

package/dist/src/capture/codex-cli-triage-provider.js

@@ -0,0 +1,91 @@
+import { TRIAGE_VERSION, } from "./triage-provider.js";
+import { scoreHistoricalTriage, } from "./triage-lane.js";
+import { CODEX_CLI_OVERRIDE_PROVIDER } from "../providers/operator-overrides.js";
+import { runCodexCliJson } from "../providers/codex-cli-runner.js";
+import { CODEX_MAX_INPUT_BYTES, CODEX_INPUT_SAFETY_MARGIN, truncateToBytes, } from "../providers/codex-input-limit.js";
+import { TRIAGE_PROMPT, TRIAGE_OUTPUT_SCHEMA } from "./triage-classification.js";
+export class CodexCliTriageProvider {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    estimateMaxCostUsd(_input) {
+        return 0;
+    }
+    async triage(input) {
+        const { result } = await this.triageWithCost(input);
+        return result;
+    }
+    async triageWithCost(input) {
+        const parsed = await this.runPrompt(input);
+        const scoring = scoreHistoricalTriage({
+            content: input.content,
+            decision: parsed.decision,
+            confidence: parsed.confidence,
+            summary: parsed.summary,
+            rationale: parsed.rationale,
+            topics: parsed.topics,
+            ...(input.source ? { source: input.source } : {}),
+        });
+        return {
+            result: {
+                decision: parsed.decision,
+                lane: scoring.lane,
+                confidence: parsed.confidence,
+                score: scoring.score,
+                summary: parsed.summary,
+                topics: parsed.topics,
+                user_decisions: parsed.user_decisions,
+                user_constraints: parsed.user_constraints,
+                rationale: parsed.rationale,
+                model: parsed.model,
+                provider: CODEX_CLI_OVERRIDE_PROVIDER,
+                version: TRIAGE_VERSION,
+                score_breakdown: scoring.debug.score_breakdown,
+                debug: scoring.debug,
+            },
+            cost: { usd: 0 },
+        };
+    }
+    async runPrompt(input) {
+        const budgetBytes = CODEX_MAX_INPUT_BYTES -
+            Buffer.byteLength(TRIAGE_PROMPT, "utf8") -
+            CODEX_INPUT_SAFETY_MARGIN;
+        const content = truncateToBytes(input.content, budgetBytes);
+        const prompt = `${TRIAGE_PROMPT}${content}`;
+        const { output, model } = await runCodexCliJson({
+            prompt,
+            schema: TRIAGE_OUTPUT_SCHEMA,
+            ...(this.options.cwd ? { cwd: this.options.cwd } : {}),
+            ...(this.options.timeoutMs
+                ? { timeoutMs: this.options.timeoutMs }
+                : {}),
+        });
+        if (output.decision !== "save" &&
+            output.decision !== "discard" &&
+            output.decision !== "review") {
+            throw new Error(`Codex CLI returned invalid triage decision: ${String(output.decision)}`);
+        }
+        if (typeof output.confidence !== "number" ||
+            Number.isNaN(output.confidence) ||
+            output.confidence < 0 ||
+            output.confidence > 1) {
+            throw new Error(`Codex CLI returned invalid triage confidence: ${String(output.confidence)}`);
+        }
+        return {
+            decision: output.decision,
+            confidence: output.confidence,
+            summary: String(output.summary ?? ""),
+            topics: Array.isArray(output.topics) ? output.topics.map(String) : [],
+            rationale: String(output.rationale ?? ""),
+            user_decisions: Array.isArray(output.user_decisions)
+                ? output.user_decisions.map(String)
+                : [],
+            user_constraints: Array.isArray(output.user_constraints)
+                ? output.user_constraints.map(String)
+                : [],
+            model,
+        };
+    }
+}
+//# sourceMappingURL=codex-cli-triage-provider.js.map

package/dist/src/capture/codex-cli-triage-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-cli-triage-provider.js","sourceRoot":"","sources":["../../../src/capture/codex-cli-triage-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAGf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,GAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAwBjF,MAAM,OAAO,sBAAsB;IAEd;IADnB,YACmB,UAGb,EAAE;QAHW,YAAO,GAAP,OAAO,CAGlB;IACL,CAAC;IAEJ,kBAAkB,CAAC,MAAmB;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,2BAA2B;gBACrC,OAAO,EAAE,cAAc;gBACvB,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe;gBAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;SACjB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAkB;QACxC,MAAM,WAAW,GACf,qBAAqB;YACrB,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC;YACxC,yBAAyB,CAAC;QAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,GAAG,aAAa,GAAG,OAAO,EAAE,CAAC;QAC5C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAoB;YACjE,MAAM;YACN,MAAM,EAAE,oBAAoB;YAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;gBACxB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,IACE,MAAM,CAAC,QAAQ,KAAK,MAAM;YAC1B,MAAM,CAAC,QAAQ,KAAK,SAAS;YAC7B,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YAC/B,MAAM,CAAC,UAAU,GAAG,CAAC;YACrB,MAAM,CAAC,UAAU,GAAG,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACrC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;YACrE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YACzC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;gBAClD,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAC,EAAE;YACN,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBACtD,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBACrC,CAAC,CAAC,EAAE;YACN,KAAK;SACN,CAAC;IACJ,CAAC;CACF"}

package/dist/src/capture/cursor-capture.d.ts

@@ -0,0 +1,89 @@
+import { type CursorRawRows } from "../ingestion/cursor/cursor-store.js";
+import { type CursorReadResult, type ReadOptions } from "../ingestion/cursor/vscdb-reader.js";
+import type { ProjectRootResolution } from "../ingestion/cursor/workspace-root.js";
+/** Env flag gating ALL native-Cursor capture. OFF unless explicitly "1". */
+export declare function cursorCaptureEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Whether discovered Cursor sessions may be PERSISTED (saved + capture-state +
+ * review-queue writes) on the ENV path. A SECOND, explicit env gate — OFF by
+ * default and read at call time — that is INDEPENDENT of `RIFT_CURSOR_CAPTURE`:
+ * discovery + triage can run as a dry-run preview with persistence still off.
+ * Set `CURSOR_CAPTURE_PERSIST=1` to allow real writes from an ad-hoc
+ * `onadit capture` run. This env gate is for the dogfood/one-off path; the
+ * scheduled path uses config membership (`cursor_composer` in
+ * `config.capture.sources`) instead, which authorizes persistence without any
+ * env flags — see `writesEnabledForSource` / `cursorConfigEnabled`.
+ */
+export declare function cursorCapturePersistEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Cheap, side-effect-free check of whether a native Cursor store is present AND
+ * READABLE on this machine (the global `state.vscdb`). Used by status to
+ * distinguish "Cursor not installed" from "installed but capture not scheduled"
+ * without opening the DB. We check read access (not mere existence) so a present
+ * but permission-locked/unreadable store reports unavailable — that keeps an
+ * explicit `cursor_composer` opt-in honest: status warns "can't run" rather than
+ * claiming "capture on" for a store capture can't actually read. Genuine sqlite
+ * corruption in an otherwise-readable file is a runtime discovery failure, out
+ * of scope for this no-open probe. Never throws — any fs error is "unavailable".
+ */
+export declare function cursorStoreAvailable(cursorDir?: string): boolean;
+/**
+ * Whether Cursor session titles may be shown in capture output. OFF by default:
+ * a Cursor title is derived from the user's session name or first prompt
+ * (`parseCursorComposerSession`), so it is private conversation text. Even the
+ * "safe" triage-only dry-run prints result titles (text + JSON), so they are
+ * redacted to a non-identifying label unless this opt-in is set.
+ */
+export declare function cursorTitlesRevealed(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Non-identifying display title for a Cursor session: `Cursor session <id8>`.
+ * Carries no conversation content, only the (already-public) composerId prefix,
+ * which is enough to correlate with `[root: <status>]` / the stable key.
+ */
+export declare function redactedCursorTitle(composerId: string): string;
+/** Injectable reader so the orchestrator is testable without sqlite3 / Cursor. */
+export type CursorReader = (options?: ReadOptions) => CursorReadResult;
+/** A native-Cursor session resolved into orchestrator-ready form. */
+export interface CursorCaptureSession {
+    /** Cursor composerId (UUID) — the stable session id. */
+    composerId: string;
+    /** Stable idempotency anchor: `cursor_composer:{composerId}`. */
+    stableKey: string;
+    /**
+     * Attribution value for downstream lanes: the resolved filesystem root when
+     * `projectRootStatus === "resolved"`, otherwise an explicit unscoped sentinel
+     * that records WHY it is unscoped (never a guessed root).
+     */
+    project: string;
+    /** Resolved root, or null when not attributable. */
+    projectRoot: string | null;
+    /** First-class resolution outcome. */
+    projectRootStatus: ProjectRootResolution["status"];
+    /** Deterministic change-detection material (ordered bubbles). */
+    fingerprintInput: string;
+}
+export interface CursorCaptureDiscovery {
+    /** Absolute path of the Cursor store that was read (informational). */
+    dbPath: string;
+    /** Raw rows (incl. bubble bodies) — reused by the parser, read once. */
+    raw: CursorRawRows;
+    /** Capture-ready sessions (drafts and empty sessions already dropped). */
+    sessions: CursorCaptureSession[];
+}
+/**
+ * Build the unscoped attribution sentinel for a non-`resolved` session. Scoping
+ * to a project root happens ONLY on `resolved`; everything else is captured
+ * unscoped, and the sentinel records the reason so attribution stays honest.
+ */
+export declare function unscopedProject(status: ProjectRootResolution["status"]): string;
+/**
+ * Discover capture-ready native Cursor sessions. Reads the global store ONCE
+ * with bubble bodies (needed for fingerprint + parse), resolves project roots
+ * (inline + on-disk workspace.json upgrade), and drops drafts and turn-less
+ * sessions. Pure aside from the injected read; never writes anything.
+ */
+export declare function discoverCursorCaptureSessions(opts: {
+    cursorDir?: string;
+    reader?: CursorReader;
+}): CursorCaptureDiscovery;
+//# sourceMappingURL=cursor-capture.d.ts.map

package/dist/src/capture/cursor-capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-capture.d.ts","sourceRoot":"","sources":["../../../src/capture/cursor-capture.ts"],"names":[],"mappings":"AAuBA,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAEnF,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAOhE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,EAAE,WAAW,KAAK,gBAAgB,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,sCAAsC;IACtC,iBAAiB,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACnD,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,GAAG,EAAE,aAAa,CAAC;IACnB,0EAA0E;IAC1E,QAAQ,EAAE,oBAAoB,EAAE,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,GACtC,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,GAAG,sBAAsB,CA6BzB"}

package/dist/src/capture/cursor-capture.js

@@ -0,0 +1,121 @@
+/**
+ * Native-Cursor auto-capture bridge.
+ *
+ * Adapts the read-only Cursor discovery layer (`src/ingestion/cursor/*`) to the
+ * shape the auto-capture orchestrator consumes. Owns three things:
+ *
+ *  1. The env feature flag (`RIFT_CURSOR_CAPTURE`) — OFF by default, read at call
+ *     time (mirrors `RIFT_CHUNKING`). The ad-hoc/dogfood discovery switch. With
+ *     it OFF (and no config opt-in), the orchestrator never reads the Cursor
+ *     store: a provable no-op.
+ *  2. The env persistence gate (`CURSOR_CAPTURE_PERSIST`, default OFF) — the
+ *     dogfood write switch. With it off, Cursor sessions are discovered,
+ *     fingerprinted, and triaged, but NEVER persisted (no save, no review-queue,
+ *     no capture-state write) — true by construction, independent of the feature
+ *     flag or --dry-run. Set it to "1" for real writes from an ad-hoc
+ *     `onadit capture` run. The SCHEDULED path does not use these env flags: adding
+ *     `cursor_composer` to `config.capture.sources` is the deliberate, persisted
+ *     opt-in that authorizes the daemon to discover + persist Cursor on its own.
+ *  3. The discovery adapter — reads the store once (with bubble bodies),
+ *     resolves project roots, drops drafts/empty sessions, and emits a stable
+ *     idempotency key + a deterministic content fingerprint per session.
+ */
+import { accessSync, constants } from "node:fs";
+import { cursorConversationFingerprintInput, cursorSessionKey, discoverCursorComposerSessions, } from "../ingestion/cursor/cursor-store.js";
+import { enrichCursorProjectRoots } from "../ingestion/cursor/enrich-roots.js";
+import { defaultCursorDir, globalStatePath, readCursorGlobalState, } from "../ingestion/cursor/vscdb-reader.js";
+/** Env flag gating ALL native-Cursor capture. OFF unless explicitly "1". */
+export function cursorCaptureEnabled(env = process.env) {
+    return env["RIFT_CURSOR_CAPTURE"] === "1";
+}
+/**
+ * Whether discovered Cursor sessions may be PERSISTED (saved + capture-state +
+ * review-queue writes) on the ENV path. A SECOND, explicit env gate — OFF by
+ * default and read at call time — that is INDEPENDENT of `RIFT_CURSOR_CAPTURE`:
+ * discovery + triage can run as a dry-run preview with persistence still off.
+ * Set `CURSOR_CAPTURE_PERSIST=1` to allow real writes from an ad-hoc
+ * `onadit capture` run. This env gate is for the dogfood/one-off path; the
+ * scheduled path uses config membership (`cursor_composer` in
+ * `config.capture.sources`) instead, which authorizes persistence without any
+ * env flags — see `writesEnabledForSource` / `cursorConfigEnabled`.
+ */
+export function cursorCapturePersistEnabled(env = process.env) {
+    return env["CURSOR_CAPTURE_PERSIST"] === "1";
+}
+/**
+ * Cheap, side-effect-free check of whether a native Cursor store is present AND
+ * READABLE on this machine (the global `state.vscdb`). Used by status to
+ * distinguish "Cursor not installed" from "installed but capture not scheduled"
+ * without opening the DB. We check read access (not mere existence) so a present
+ * but permission-locked/unreadable store reports unavailable — that keeps an
+ * explicit `cursor_composer` opt-in honest: status warns "can't run" rather than
+ * claiming "capture on" for a store capture can't actually read. Genuine sqlite
+ * corruption in an otherwise-readable file is a runtime discovery failure, out
+ * of scope for this no-open probe. Never throws — any fs error is "unavailable".
+ */
+export function cursorStoreAvailable(cursorDir) {
+    try {
+        accessSync(globalStatePath(cursorDir ?? defaultCursorDir()), constants.R_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether Cursor session titles may be shown in capture output. OFF by default:
+ * a Cursor title is derived from the user's session name or first prompt
+ * (`parseCursorComposerSession`), so it is private conversation text. Even the
+ * "safe" triage-only dry-run prints result titles (text + JSON), so they are
+ * redacted to a non-identifying label unless this opt-in is set.
+ */
+export function cursorTitlesRevealed(env = process.env) {
+    return env["RIFT_CURSOR_SHOW_TITLES"] === "1";
+}
+/**
+ * Non-identifying display title for a Cursor session: `Cursor session <id8>`.
+ * Carries no conversation content, only the (already-public) composerId prefix,
+ * which is enough to correlate with `[root: <status>]` / the stable key.
+ */
+export function redactedCursorTitle(composerId) {
+    return `Cursor session ${composerId.slice(0, 8)}`;
+}
+/**
+ * Build the unscoped attribution sentinel for a non-`resolved` session. Scoping
+ * to a project root happens ONLY on `resolved`; everything else is captured
+ * unscoped, and the sentinel records the reason so attribution stays honest.
+ */
+export function unscopedProject(status) {
+    return `(unscoped:${status})`;
+}
+/**
+ * Discover capture-ready native Cursor sessions. Reads the global store ONCE
+ * with bubble bodies (needed for fingerprint + parse), resolves project roots
+ * (inline + on-disk workspace.json upgrade), and drops drafts and turn-less
+ * sessions. Pure aside from the injected read; never writes anything.
+ */
+export function discoverCursorCaptureSessions(opts) {
+    const cursorDir = opts.cursorDir ?? defaultCursorDir();
+    const reader = opts.reader ?? readCursorGlobalState;
+    const { dbPath, rows } = reader({ cursorDir, includeBubbles: true });
+    const candidates = enrichCursorProjectRoots(discoverCursorComposerSessions(rows), cursorDir);
+    const sessions = [];
+    for (const c of candidates) {
+        // Drafts are unsent placeholders (often non-UUID ids); turn-less sessions
+        // carry no conversation to triage. Both are skipped before any parse.
+        if (c.isDraft || c.turnCount === 0)
+            continue;
+        sessions.push({
+            composerId: c.composerId,
+            stableKey: cursorSessionKey(c.composerId),
+            project: c.projectRootStatus === "resolved" && c.projectRoot
+                ? c.projectRoot
+                : unscopedProject(c.projectRootStatus),
+            projectRoot: c.projectRootStatus === "resolved" ? c.projectRoot : null,
+            projectRootStatus: c.projectRootStatus,
+            fingerprintInput: cursorConversationFingerprintInput(rows, c.composerId),
+        });
+    }
+    return { dbPath, raw: rows, sessions };
+}
+//# sourceMappingURL=cursor-capture.js.map

package/dist/src/capture/cursor-capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-capture.js","sourceRoot":"","sources":["../../../src/capture/cursor-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EACL,kCAAkC,EAClC,gBAAgB,EAChB,8BAA8B,GAE/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GAGtB,MAAM,qCAAqC,CAAC;AAG7C,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,qBAAqB,CAAC,KAAK,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,wBAAwB,CAAC,KAAK,GAAG,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAkB;IACrD,IAAI,CAAC;QACH,UAAU,CAAC,eAAe,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,yBAAyB,CAAC,KAAK,GAAG,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,kBAAkB,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAkCD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAuC;IAEvC,OAAO,aAAa,MAAM,GAAG,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,wBAAwB,CACzC,8BAA8B,CAAC,IAAI,CAAC,EACpC,SAAS,CACV,CAAC;IAEF,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC;YAAE,SAAS;QAC7C,QAAQ,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC;YACzC,OAAO,EACL,CAAC,CAAC,iBAAiB,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW;gBACjD,CAAC,CAAC,CAAC,CAAC,WAAW;gBACf,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC1C,WAAW,EAAE,CAAC,CAAC,iBAAiB,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;YACtE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;YACtC,gBAAgB,EAAE,kCAAkC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC"}