onadit 0.0.1 → 1.0.0

package/dist/src/server/routes/friend-status.js

@@ -0,0 +1,675 @@
+/**
+ * GET /status/friend — structured payload for the `onadit status` header.
+ *
+ * The existing `/status` route returns the capability-map markdown and
+ * stays untouched (it's part of the MCP-tool contract). This route
+ * collects only the signals a friend-readable header needs:
+ *   - build + daemon: from getBuildInfo() + uptime + config.server.port +
+ *     env(VOYAGE_API_KEY) presence
+ *   - voyage: optional `project_label` from config + real last successful
+ *     embedding timestamp from `data/observability/embedding-events.jsonl`
+ *     filtered to ingest pipelines (search-time embedding calls are
+ *     intentionally excluded so a user search cannot mask an ingest
+ *     outage), plus the most recent error in the last 24h with a short
+ *     reason class
+ *   - codex: latest auto-capture-runs.jsonl row's preflight_ok + ts
+ *   - capture: latest auto-capture-runs.jsonl row's totals
+ *   - feedback: relay enabled flag from feedback-config.json
+ *
+ * Friend's username and key bytes never appear in the payload.
+ * `daemon.data_dir` is the one exception: operators need it to confirm
+ * which data root the daemon is actually reading (the launchd config in
+ * Application Support can redirect to a repo-local data dir, and
+ * inspecting the wrong one produces stale-state false alarms). The
+ * /status/friend route is auth-gated, so this only reaches callers who
+ * already have the daemon token.
+ * MCP-client presence detection is intentionally CLI-side (the friend's
+ * client config files are local, and the renderer needs to print client
+ * names anyway).
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { getBuildInfo } from "../build-info.js";
+import { autoCaptureRunFailed, readAutoCaptureRunSummary, } from "../../capture/observability.js";
+import { classifyParkedOversizedSessions } from "../../capture/auto-repair.js";
+import { cursorStoreAvailable } from "../../capture/cursor-capture.js";
+import { CLAUDE_DESKTOP_CAPTURE_SOURCE, CURSOR_CAPTURE_SOURCE, } from "../../capture/sources.js";
+import { loadFeedbackConfig } from "../../cli/feedback/feedback-config.js";
+import { installedAsPreviousPackage, selfUpdateSupported } from "../../diagnostics/install-layout.js";
+import { classifyCodexPreflightError, extractCodexModelFromError, summarizeCodexPreflightClass, } from "../../diagnostics/codex-preflight.js";
+import { classifyClaudePreflightError, summarizeClaudePreflightClass, } from "../../diagnostics/claude-preflight.js";
+import { sanitizeProjectLabel } from "../../runtime/legacy-name-guard.js";
+import { readCodexModelSwitch, } from "../../providers/codex-cli-model.js";
+import { readEmbeddingEvents, } from "../../observability/embedding-events.js";
+import { readIndexEvents, } from "../../observability/index-events.js";
+import { compareBetaVersions, readVersionCheck, } from "../../observability/version-check.js";
+import { buildMemoryCoverageDiagnostics, } from "../../diagnostics/memory-coverage.js";
+import { computeOnboardingState, isUsefulStateReached, readOnboardingMetric, stampUsefulStateIfReady, } from "../../observability/onboarding-metric.js";
+import { getCapabilityCounts } from "../../observability/rift-context.js";
+const VOYAGE_ERROR_LOOKBACK_MS = 24 * 60 * 60 * 1000;
+const INDEX_ERROR_LOOKBACK_MS = 24 * 60 * 60 * 1000;
+const INBOX_ERROR_LOOKBACK_MS = 24 * 60 * 60 * 1000;
+const INBOX_IDEMPOTENCY_PREFIX = "inbox:";
+const CLAUDE_DESKTOP_SESSIONS_DIR = path.join("Library", "Application Support", "Claude", "local-agent-mode-sessions");
+/**
+ * Cheap presence probe for Claude Desktop agent/Cowork sessions. This only
+ * checks that the store directory exists and can be listed; transcript parsing
+ * remains in the capture pipeline.
+ */
+export function claudeDesktopSessionStoreAvailable(homeDir = os.homedir()) {
+    const root = path.join(homeDir, CLAUDE_DESKTOP_SESSIONS_DIR);
+    try {
+        const stat = fs.statSync(root);
+        if (!stat.isDirectory())
+            return false;
+        fs.readdirSync(root);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Legacy-row fallback ONLY: infer which worker a preflight ran from the recorded
+ * error, for rows written before `preflight_worker` was persisted. Newer rows
+ * never reach here — `codexBlock` prefers the persisted worker.
+ *
+ * We override the configured worker to `claude` ONLY when the text carries a
+ * Onadit-generated Claude SIGNATURE — phrasing the CLAUDE RUNNER emits about itself
+ * and Codex never does: `Claude CLI` / `Claude Code CLI` / `RIFT_CLAUDE_CLI_PATH`
+ * / `--safe-mode` (a Claude-only flag). A bare `claude` word match is unsafe: a
+ * Codex preflight error can quote project paths, model names, or MCP noise
+ * containing "claude" and would then render Claude repair copy for a Codex
+ * failure — violating the "Codex output unchanged" bar. We deliberately do NOT
+ * treat a `claude_code` provider token as a signature: that token also appears in
+ * Codex's OWN "switch to the Claude worker (provider = claude_code)" remedy text,
+ * so it marks a Codex failure, not a Claude one. The kept signatures are
+ * Claude-runner-exclusive, so their presence is authoritative even when the same
+ * message also mentions Codex (e.g. the runner's "No compatible Claude Code CLI …
+ * use the Codex worker" aggregate names both). Absent a Claude signature we defer
+ * to the configured worker, the best signal for a pre-persistence row.
+ */
+function detectPreflightWorker(error, configured) {
+    const text = (error ?? "").toLowerCase();
+    const claudeSignature = /claude code cli|claude cli|rift_claude_cli_path|--safe-mode/.test(text);
+    if (claudeSignature)
+        return "claude";
+    return configured;
+}
+/**
+ * Build the preflight block, classifying the last failure into a leak-free,
+ * honest, WORKER-SPECIFIC diagnosis. Codex output is unchanged; a `claude_code`
+ * triage worker gets Claude classes + Claude summaries. On success (or no run)
+ * the failure fields are null but the worker is still reported from config.
+ */
+function codexBlock(last, configuredWorker) {
+    if (!last || last.preflight_ok) {
+        return {
+            last_preflight_at: last?.timestamp ?? null,
+            last_preflight_ok: last ? last.preflight_ok : null,
+            // A healthy run reports the worker it actually ran when recorded; only
+            // fall back to the configured worker when there's no run or it predates
+            // the persisted field.
+            last_preflight_worker: last?.preflight_worker ?? configuredWorker,
+            last_preflight_error_class: null,
+            last_preflight_model: null,
+            last_preflight_error_summary: null,
+        };
+    }
+    // Prefer the worker PERSISTED on the run that actually failed. Only fall back
+    // to inferring it (error text, then current config) for legacy rows written
+    // before the worker was recorded — that heuristic can otherwise misattribute a
+    // failure if `capture.triage.provider` was flipped after the run, or if the
+    // error text happens to mention the other worker.
+    const worker = last.preflight_worker ??
+        detectPreflightWorker(last.preflight_error, configuredWorker);
+    if (worker === "claude") {
+        const errorClass = classifyClaudePreflightError(last.preflight_error);
+        return {
+            last_preflight_at: last.timestamp,
+            last_preflight_ok: false,
+            last_preflight_worker: "claude",
+            last_preflight_error_class: errorClass,
+            last_preflight_model: null,
+            last_preflight_error_summary: summarizeClaudePreflightClass(errorClass),
+        };
+    }
+    const errorClass = classifyCodexPreflightError(last.preflight_error);
+    const model = extractCodexModelFromError(last.preflight_error);
+    return {
+        last_preflight_at: last.timestamp,
+        last_preflight_ok: false,
+        last_preflight_worker: "codex",
+        last_preflight_error_class: errorClass,
+        last_preflight_model: model,
+        last_preflight_error_summary: summarizeCodexPreflightClass(errorClass, model),
+    };
+}
+export function buildFriendStatusPayload(deps, opts = {}) {
+    const build = getBuildInfo();
+    const voyageKey = process.env["VOYAGE_API_KEY"];
+    const voyageKeyPresent = typeof voyageKey === "string" && voyageKey.length > 0;
+    const dataDir = deps.config.data_paths.data_dir;
+    let summary;
+    try {
+        summary = readAutoCaptureRunSummary(dataDir, deps.config.capture.sources);
+    }
+    catch {
+        summary = {
+            last_run: null,
+            last_daemon_run: null,
+            last_success_by_source: {},
+            last_cursor_discovery: null,
+            last_claude_desktop_discovery: null,
+        };
+    }
+    const last = summary.last_run;
+    const lastDaemon = summary.last_daemon_run;
+    let captureTotals = { saved: 0, review: 0, quarantined: 0 };
+    if (last) {
+        for (const counts of Object.values(last.counts_by_source)) {
+            if (!counts)
+                continue;
+            captureTotals.saved += counts.saved;
+            captureTotals.review += counts.review;
+            captureTotals.quarantined += counts.quarantined ?? 0;
+        }
+    }
+    let parkedClassification = { parked: 0, repairing: 0, failed: 0 };
+    try {
+        parkedClassification = classifyParkedOversizedSessions({ dataDir });
+    }
+    catch {
+        parkedClassification = { parked: 0, repairing: 0, failed: 0 };
+    }
+    const voyageHealth = computeVoyageHealth(dataDir, Date.now());
+    const indexHealth = computeIndexHealth(dataDir, Date.now());
+    const inboxHealth = computeInboxHealth(deps.jobQueue, Date.now());
+    // `enabled` covers both opt-in shapes (contact email and/or operator
+    // relay), so a relay is "on" only when an endpoint URL also exists —
+    // otherwise an email-only opt-in would falsely read as a Clem-side relay.
+    let relayEnabled = false;
+    let contactOptedIn = false;
+    try {
+        const fb = loadFeedbackConfig(dataDir);
+        relayEnabled = fb.enabled === true && typeof fb.url === "string" && fb.url.length > 0;
+        contactOptedIn = fb.enabled === true && typeof fb.email === "string" && fb.email.length > 0;
+    }
+    catch {
+        relayEnabled = false;
+        contactOptedIn = false;
+    }
+    return {
+        build,
+        daemon: {
+            uptime_seconds: Math.floor((Date.now() - deps.startTime) / 1000),
+            port: deps.config.server.port,
+            voyage_key_present: voyageKeyPresent,
+            capture_enabled: deps.config.capture.enabled === true,
+            data_dir: dataDir,
+            config_path: deps.configPath ?? null,
+        },
+        voyage: {
+            project_label: sanitizeProjectLabel(deps.config.voyage?.project_label),
+            last_embed_at: voyageHealth.last_embed_at,
+            last_error_at: voyageHealth.last_error_at,
+            last_error_reason: voyageHealth.last_error_reason,
+        },
+        index: {
+            last_update_at: indexHealth.last_update_at,
+            last_error_at: indexHealth.last_error_at,
+            last_error_reason: indexHealth.last_error_reason,
+        },
+        inbox: inboxHealth,
+        codex: {
+            ...codexBlock(last, deps.config.capture.triage?.provider === "claude_code"
+                ? "claude"
+                : "codex"),
+            model_switch: readCodexModelSwitch(dataDir),
+        },
+        capture: {
+            last_run_at: last?.timestamp ?? null,
+            last_run_ok: last ? last.run_ok : null,
+            last_run_trigger: last ? (last.trigger ?? "daemon") : null,
+            last_saved: captureTotals.saved,
+            last_review: captureTotals.review,
+            last_errors: last?.errors.length ?? 0,
+            last_quarantined: captureTotals.quarantined,
+            oversized_parked: parkedClassification.parked,
+            oversized_repairing: parkedClassification.repairing,
+            oversized_repair_failed: parkedClassification.failed,
+            next_run_at: computeNextCaptureRunAt({
+                captureEnabled: deps.config.capture.enabled,
+                intervalSeconds: deps.config.capture.interval_seconds,
+                startTime: deps.startTime,
+                now: Date.now(),
+            }),
+            last_daemon_run_at: lastDaemon?.timestamp ?? null,
+            last_daemon_failed: lastDaemon ? autoCaptureRunFailed(lastDaemon) : null,
+            cursor: {
+                scheduled: deps.config.capture.sources.includes(CURSOR_CAPTURE_SOURCE),
+                available: cursorStoreAvailable(),
+                ...(summary.last_cursor_discovery
+                    ? { last_discovery_ok: summary.last_cursor_discovery.ok }
+                    : {}),
+            },
+            grok_cli: { scheduled: deps.config.capture.sources.includes("grok_cli") },
+            claude_desktop: {
+                scheduled: deps.config.capture.sources.includes(CLAUDE_DESKTOP_CAPTURE_SOURCE),
+                available: claudeDesktopSessionStoreAvailable(),
+                ...(summary.last_claude_desktop_discovery
+                    ? { last_discovery_ok: summary.last_claude_desktop_discovery.ok }
+                    : {}),
+            },
+        },
+        feedback: { relay_enabled: relayEnabled, contact_opted_in: contactOptedIn },
+        // `process.argv[1]` is the daemon's own running entrypoint — the
+        // authoritative signal for whether this install is the packaged (.pkg)
+        // bundle `onadit update` cannot upgrade. More direct than re-reading the
+        // launchd plist: it is literally the code path the daemon loaded.
+        update: computeUpdateProjection(dataDir, build.version, selfUpdateSupported(process.argv[1] ?? null), installedAsPreviousPackage(build.name)),
+        onboarding: projectOnboardingState(dataDir),
+        memory: buildMemoryCoverageDiagnostics({
+            config: deps.config,
+            counts: opts.capabilityCounts ?? null,
+            voyageKeyPresent,
+            compactAvailable: deps.jobQueue?.hasHandler("compact") === true,
+        }),
+    };
+}
+/**
+ * Read the persisted metric and return its projection. Pure read — start
+ * stamping happens in the async `stampOnboardingStartIfReady` helper so
+ * the sync builder (and its test surface) stay sync. The route awaits
+ * the stamper before calling `buildFriendStatusPayload`, so a freshly
+ * stamped start is visible in the same response.
+ *
+ * Exported for tests.
+ */
+export function projectOnboardingState(dataDir) {
+    const metric = readOnboardingMetric(dataDir);
+    const projection = computeOnboardingState(metric);
+    if (projection.state === "hidden") {
+        return {
+            state: "hidden",
+            install_id: metric.install_id,
+            useful_state_reached_at: null,
+            first_useful_recall_at: null,
+            first_useful_recall_tool: null,
+            duration_seconds: null,
+        };
+    }
+    if (projection.state === "pending") {
+        return {
+            state: "pending",
+            install_id: metric.install_id,
+            useful_state_reached_at: projection.useful_state_reached_at,
+            first_useful_recall_at: null,
+            first_useful_recall_tool: null,
+            duration_seconds: null,
+        };
+    }
+    return {
+        state: "completed",
+        install_id: metric.install_id,
+        useful_state_reached_at: projection.useful_state_reached_at,
+        first_useful_recall_at: projection.first_useful_recall_at,
+        first_useful_recall_tool: projection.first_useful_recall_tool,
+        duration_seconds: projection.duration_seconds,
+    };
+}
+/**
+ * Async readiness evaluation + write-once start stamping. Pulled out of
+ * `buildFriendStatusPayload` so the sync builder stays sync; the route
+ * awaits this before assembling the payload, so a stamp written here
+ * is visible in the same response.
+ *
+ * Readiness signals for v1:
+ *   - daemon healthy: trivially true (this code is running inside the
+ *     daemon process that is serving the request).
+ *   - Voyage key valid: VOYAGE_API_KEY env present AND at least one
+ *     successful Voyage embedding has been recorded on the ingest lane
+ *     (a real round-trip with this key, not just "env var is set").
+ *   - indexed count >= 1: `getCapabilityCounts()` reports at least one
+ *     conversations_hot/cold or structured_docs row. Digest count is
+ *     intentionally excluded — the bar is "conversations + structured
+ *     docs" per the v1 spec.
+ *
+ * Never throws. A capability-counts failure (LanceDB not initialised,
+ * IO error) is treated as "not ready" rather than a 500, so a partial
+ * daemon never surfaces a misleading start timestamp.
+ *
+ * Exported for tests.
+ */
+export async function stampOnboardingStartIfReady(dataDir, opts = {}) {
+    const voyageKey = process.env["VOYAGE_API_KEY"];
+    const voyageKeyPresent = typeof voyageKey === "string" && voyageKey.length > 0;
+    const voyageHealth = opts.voyageHealth ?? computeVoyageHealth(dataDir, opts.now ?? Date.now());
+    const voyageKeyValid = voyageKeyPresent && voyageHealth.last_embed_at !== null;
+    // No-key installs are a first-class useful state: keyword (lexical) search is
+    // fully on without a Voyage key. We treat "no key present" as intentional
+    // lexical mode. A key that's present but not yet round-tripped (valid=false)
+    // is a setup-in-progress, NOT lexical mode — so it counts as neither and
+    // does not stamp useful, preserving the "env present but never embedded →
+    // not useful" contract.
+    const lexicalModeAvailable = !voyageKeyPresent;
+    let indexedCount = 0;
+    if (opts.capabilityCounts) {
+        indexedCount =
+            opts.capabilityCounts.structured_docs +
+                opts.capabilityCounts.conversations_hot +
+                opts.capabilityCounts.conversations_cold;
+    }
+    else {
+        try {
+            const counts = await getCapabilityCounts();
+            indexedCount =
+                counts.structured_docs +
+                    counts.conversations_hot +
+                    counts.conversations_cold;
+        }
+        catch {
+            indexedCount = 0;
+        }
+    }
+    const ready = isUsefulStateReached({
+        daemonHealthy: true,
+        voyageKeyValid,
+        lexicalModeAvailable,
+        indexedCount,
+    });
+    stampUsefulStateIfReady(dataDir, {
+        ready,
+        now: new Date(opts.now ?? Date.now()).toISOString(),
+    });
+}
+/**
+ * Project the version-check snapshot to the three fields the renderer
+ * needs. A missing snapshot, a failed probe, or an up-to-date install
+ * all return `available: false` — the renderer prints nothing in those
+ * cases, so an unreachable npm registry can never make Onadit look broken.
+ *
+ * Exported for tests.
+ */
+export function computeUpdateProjection(dataDir, installedVersion, selfUpdate = true, reinstallNeeded = false) {
+    const reinstall = reinstallNeeded ? { reinstall_needed: true } : {};
+    const snapshot = readVersionCheck(dataDir);
+    if (!snapshot || snapshot.latest_beta === null) {
+        return {
+            available: false,
+            installed: installedVersion,
+            latest_beta: snapshot?.latest_beta ?? null,
+            checked_at: snapshot?.checked_at ?? null,
+            self_update_supported: selfUpdate,
+            ...reinstall,
+        };
+    }
+    // Use the installedVersion from the live build, not the snapshot, so a
+    // post-update daemon restart immediately reports `available: false`
+    // even before the next probe writes a fresh snapshot.
+    const available = compareBetaVersions(installedVersion, snapshot.latest_beta) < 0;
+    return {
+        available,
+        installed: installedVersion,
+        latest_beta: snapshot.latest_beta,
+        checked_at: snapshot.checked_at,
+        self_update_supported: selfUpdate,
+        ...reinstall,
+    };
+}
+/**
+ * Compute the next auto-capture tick.
+ *
+ * The daemon registers `setInterval(runCapture, intervalMs)` at startup
+ * (`src/main.ts`), so ticks land at `startTime + N * intervalMs` for
+ * N ≥ 1 (N = 0 is the eager startup call). We deliberately anchor to
+ * `startTime` rather than `last_run_at` because:
+ *   - `setInterval` does, so this matches what will actually fire.
+ *   - `last_run_at` lags by hundreds of ms (save-job wait), and could
+ *     be stale from a prior daemon process for the first interval after
+ *     a restart.
+ *
+ * Returns null when auto-capture is disabled in config.
+ *
+ * Exported for tests.
+ */
+export function computeNextCaptureRunAt(opts) {
+    if (!opts.captureEnabled)
+        return null;
+    if (opts.intervalSeconds <= 0)
+        return null;
+    const intervalMs = opts.intervalSeconds * 1000;
+    const elapsed = Math.max(0, opts.now - opts.startTime);
+    const ticksElapsed = Math.floor(elapsed / intervalMs);
+    return new Date(opts.startTime + (ticksElapsed + 1) * intervalMs).toISOString();
+}
+/**
+ * Reduce the embedding-events lane to the three voyage health fields the
+ * friend-status route needs.
+ *
+ * Exported for tests so we can verify the pipeline-filter and 24h-window
+ * logic without booting Fastify or stubbing the route layer.
+ */
+export function computeVoyageHealth(dataDir, now) {
+    let events;
+    try {
+        events = readEmbeddingEvents(dataDir);
+    }
+    catch {
+        events = [];
+    }
+    let lastSuccessTs = null;
+    let lastErrorTs = null;
+    let lastErrorReason = null;
+    const errorCutoff = now - VOYAGE_ERROR_LOOKBACK_MS;
+    for (const event of events) {
+        // The `voyage.*` projection must reflect Voyage health only. The lane
+        // itself is provider-agnostic so a future Ollama-only install reuses
+        // the same writer, but on a mixed cloud+local install an Ollama
+        // success would otherwise refresh `voyage.last_embed_at` and mask a
+        // Voyage outage. Filter at projection time, not write time.
+        if (event.provider !== "voyage")
+            continue;
+        if (event.outcome === "success") {
+            if (!lastSuccessTs || event.ts > lastSuccessTs) {
+                lastSuccessTs = event.ts;
+            }
+            continue;
+        }
+        // outcome === "error"
+        const eventTime = Date.parse(event.ts);
+        if (Number.isNaN(eventTime) || eventTime < errorCutoff)
+            continue;
+        if (!lastErrorTs || event.ts > lastErrorTs) {
+            lastErrorTs = event.ts;
+            lastErrorReason = event.error_class ?? "unknown";
+        }
+    }
+    return {
+        last_embed_at: lastSuccessTs,
+        last_error_at: lastErrorTs,
+        last_error_reason: lastErrorReason,
+    };
+}
+/**
+ * Reduce the index-events lane to the three index health fields the
+ * friend-status route needs. Provider-agnostic and table-agnostic: an
+ * embed can succeed but the subsequent `table.add(...)` can fail, and
+ * `index.*` is what makes that visible. No 24h filter on `last_update_at`
+ * (a daemon that has not indexed in 7 days should still surface the
+ * stale timestamp); errors are filtered to the 24h window so old
+ * resolved incidents don't sit on the dashboard forever.
+ */
+export function computeIndexHealth(dataDir, now) {
+    let events;
+    try {
+        events = readIndexEvents(dataDir);
+    }
+    catch {
+        events = [];
+    }
+    let lastSuccessTs = null;
+    let lastErrorTs = null;
+    let lastErrorReason = null;
+    const errorCutoff = now - INDEX_ERROR_LOOKBACK_MS;
+    for (const event of events) {
+        if (event.outcome === "success") {
+            // Shadow-phase successes do NOT credit `last_update_at`: a row
+            // written to a shadow table is "prepared", not "searchable",
+            // until `commitAllSwaps` runs. If the swap rolls back, those
+            // rows stay invisible — so claiming a fresh index from them
+            // would lie. The post-commit "live" event is what credits the
+            // real update timestamp.
+            const phase = event.phase ?? "live";
+            if (phase !== "live")
+                continue;
+            if (!lastSuccessTs || event.ts > lastSuccessTs) {
+                lastSuccessTs = event.ts;
+            }
+            continue;
+        }
+        // Errors at any phase (including shadow) count toward
+        // `last_error_at` — a per-row LanceDB write failure during shadow
+        // population is a real failure regardless of the eventual swap.
+        const eventTime = Date.parse(event.ts);
+        if (Number.isNaN(eventTime) || eventTime < errorCutoff)
+            continue;
+        if (!lastErrorTs || event.ts > lastErrorTs) {
+            lastErrorTs = event.ts;
+            lastErrorReason = event.error_class ?? "unknown";
+        }
+    }
+    return {
+        last_update_at: lastSuccessTs,
+        last_error_at: lastErrorTs,
+        last_error_reason: lastErrorReason,
+    };
+}
+/**
+ * Reduce the inbox-keyed job set to the four fields the friend-status
+ * route needs. Pure over the queue's snapshot (no I/O), so tests can
+ * pass an in-memory `JobQueue` without booting Fastify.
+ *
+ * When the queue isn't wired up (deps.jobQueue undefined), this
+ * returns the empty / idle shape — the renderer treats it the same
+ * as "nothing dropped yet."
+ *
+ * Exported for tests.
+ */
+export function computeInboxHealth(queue, now) {
+    if (!queue) {
+        return {
+            last_import_at: null,
+            last_error_at: null,
+            last_error_reason: null,
+            pending: 0,
+        };
+    }
+    const jobs = queue.listByIdempotencyPrefix(INBOX_IDEMPOTENCY_PREFIX);
+    let lastImportTs = null;
+    let lastErrorTs = null;
+    let lastErrorReason = null;
+    let pending = 0;
+    const errorCutoff = now - INBOX_ERROR_LOOKBACK_MS;
+    for (const job of jobs) {
+        // Skip superseded jobs — the queue chains a retry by setting
+        // `retried_by` on the failed/completed parent and creating a fresh
+        // job with the same idempotency key. Counting both would let a
+        // long-resolved failure keep the "Inbox import errors" hint live
+        // for 24h after the retry already succeeded; the leaf is the only
+        // entry that reflects current state. (Same invariant the queue
+        // itself enforces in `findByIdempotencyKey`.)
+        if (job.retried_by !== undefined)
+            continue;
+        if (job.status === "queued" || job.status === "running") {
+            pending++;
+            continue;
+        }
+        if (job.status === "completed") {
+            if (!lastImportTs || job.updated_at > lastImportTs) {
+                lastImportTs = job.updated_at;
+            }
+            continue;
+        }
+        if (job.status === "failed") {
+            const eventTime = Date.parse(job.updated_at);
+            if (Number.isNaN(eventTime) || eventTime < errorCutoff)
+                continue;
+            if (!lastErrorTs || job.updated_at > lastErrorTs) {
+                lastErrorTs = job.updated_at;
+                lastErrorReason = classifyJobError(job);
+            }
+        }
+        // cancelled / interrupted: ignore — neither a successful import
+        // nor a real error the user can act on. A retry will be either
+        // queued (counted as pending) or completed/failed (counted above).
+    }
+    return {
+        last_import_at: lastImportTs,
+        last_error_at: lastErrorTs,
+        last_error_reason: lastErrorReason,
+        pending,
+    };
+}
+/**
+ * Best-effort short label for a failed inbox job's error. The queue
+ * stores the raw error message (`job.error`); we collapse it into a
+ * compact class keyword by substring match against the parser errors
+ * we know about, then fall back to a truncated form of the original
+ * message. Lower-cased for stability under capitalization drift.
+ *
+ * Exported for tests.
+ */
+export function classifyJobError(job) {
+    const raw = (job.error ?? "").trim();
+    if (!raw)
+        return "unknown";
+    const lower = raw.toLowerCase();
+    if (lower.includes("zip slip") || lower.includes("path traversal")) {
+        return "unsafe_archive";
+    }
+    if (lower.includes("too large") || lower.includes("max size")) {
+        return "size_limit";
+    }
+    if (lower.includes("unsupported source"))
+        return "unsupported_source";
+    if (lower.includes("no conversations"))
+        return "empty_export";
+    if (lower.includes("invalid json") || lower.includes("unexpected token")) {
+        return "invalid_json";
+    }
+    // ADM-ZIP throws strings like "ADM-ZIP: Invalid or unsupported zip
+    // format" when adm-zip can't open the archive at all (corrupt header,
+    // truncated CD). Distinct from `unsafe_archive` (security-blocked) —
+    // this is "the ZIP itself is broken before we can even look inside."
+    if (lower.includes("adm-zip") || lower.includes("invalid or unsupported zip")) {
+        return "invalid_archive";
+    }
+    if (lower.includes("parser"))
+        return "parser_error";
+    // Fallback: first ≤40 chars of the raw message, single-lined.
+    const snippet = raw.replace(/\s+/g, " ").slice(0, 40);
+    return snippet || "unknown";
+}
+export function registerFriendStatusRoute(server, deps) {
+    server.get("/status/friend", async (_request, reply) => {
+        let capabilityCounts = null;
+        try {
+            capabilityCounts = await getCapabilityCounts();
+        }
+        catch {
+            capabilityCounts = null;
+        }
+        // Stamp `useful_state_reached_at` lazily on read. The metric file
+        // lives in the shared data dir, so the MCP-side end stamper sees
+        // the same value on the next retrieval. Reuse the count snapshot
+        // computed for memory diagnostics so status polling does not count
+        // LanceDB tables twice.
+        await stampOnboardingStartIfReady(deps.config.data_paths.data_dir, {
+            capabilityCounts,
+        });
+        return reply.send(buildFriendStatusPayload(deps, { capabilityCounts }));
+    });
+}
+//# sourceMappingURL=friend-status.js.map