onadit 0.0.1 → 1.0.0

package/dist/src/main.js

@@ -0,0 +1,683 @@
+import fs from "node:fs";
+import path from "node:path";
+import { loadConfig } from "./config/loader.js";
+import { buildApp } from "./server/app.js";
+import { registerShutdownHandlers } from "./server/lifecycle.js";
+import { macKeychain } from "./auth/keychain.js";
+import { TokenManager } from "./auth/rotation.js";
+import { JobQueue } from "./jobs/queue.js";
+import { WorkerPool, createWorkerHandler, resolveWorkerEntryPoint, } from "./jobs/worker-process.js";
+import { createCodexOverrideAwareHandler } from "./jobs/codex-override-handler.js";
+import { createIngestHandler } from "./jobs/handlers/ingest.js";
+import { createTriageHandler } from "./jobs/handlers/triage.js";
+import { ProjectIndex, recordSavedSessionProject, setProjectIndex } from "./retrieval/project-index.js";
+import { startMaintenanceScheduler } from "./jobs/maintenance-scheduler.js";
+import { initTables, closeTables } from "./storage/tables.js";
+import { writeServingMarker } from "./server/serving-marker.js";
+import { recheckStoredUserStatements } from "./capture/user-statements-recheck.js";
+import { createAssistantTextLookup, sessionRoots } from "./capture/assistant-text-lookup.js";
+import { ownsPassage } from "./capture/user-statements.js";
+import { checkIntegrity } from "./storage/integrity.js";
+import { Watcher } from "./ingestion/watcher.js";
+import { Indexer } from "./ingestion/indexer.js";
+import { Scanner } from "./ingestion/scanner.js";
+import { buildIgnoredPaths } from "./ingestion/ignored-paths.js";
+import { createInboxWatcher } from "./ingestion/inbox-watcher.js";
+import { watcherStartupDisabled as watcherStartupDisabledFromEnv } from "./runtime/watcher-startup.js";
+import { loadRiftEnv } from "./runtime/rift-env.js";
+import { runLegacyMigration } from "./runtime/legacy-migration.js";
+import { VoyageEmbeddingProvider, voyageEndpoint } from "./providers/voyage.js";
+import { backfillPending, clearBackfillPending } from "./onboarding/search-by-meaning.js";
+import { OllamaEmbeddingProvider } from "./providers/ollama-embed.js";
+import { checkOllamaHealth } from "./providers/ollama.js";
+import { createDaemonConversationGenerationProviders } from "./providers/conversation-generation.js";
+import { setDefaultTriageProvider } from "./capture/triage.js";
+import { resolveTriageProviderName, setConfiguredTriageProviderName, createConfiguredTriageProvider, } from "./capture/triage-provider-factory.js";
+import { configureCodexModel } from "./providers/codex-cli-model.js";
+import { generateCapabilityMap, getCapabilityCounts, writeRiftContext, } from "./observability/rift-context.js";
+import { getBuildInfo } from "./server/build-info.js";
+const configPath = process.argv[2];
+if (!configPath) {
+    process.stderr.write("Usage: onadit <config-path>\n");
+    process.exit(1);
+}
+const absoluteConfigPath = path.resolve(configPath);
+const config = loadConfig(absoluteConfigPath);
+// Pin the Codex model for every codex exec (triage/metadata/digest/recovery).
+// Resolution: this override → source ~/.codex/config.toml → persisted → probe.
+configureCodexModel({
+    model: config.codex_cli?.model,
+    dataDir: config.data_paths.data_dir,
+});
+// Record the configured triage worker process-wide (default codex_cli) so the
+// per-session triage default, the lazy fallback, and the auto-capture preflight
+// all probe/route through the same selected CLI.
+setConfiguredTriageProviderName(resolveTriageProviderName(config));
+// Anchor for failure-notification recency gating. Captured here (rather
+// than reusing buildApp's internal startTime) so the capture loop can
+// distinguish "failing during this uptime" from "stale error from a
+// prior process" without threading startTime out of buildApp.
+const daemonStartTime = Date.now();
+// Run hidden legacy migration BEFORE loadRiftEnv so the env loader never
+// resolves to the legacy path on a machine carrying pre-rename state.
+// Idempotent — no-op on a clean Mac, and on second boot.
+try {
+    await runLegacyMigration({ dataDir: config.data_paths.data_dir });
+}
+catch (err) {
+    process.stderr.write(`Legacy migration failed (non-fatal): ${err instanceof Error ? err.message : String(err)}\n`);
+}
+const envLoadResult = loadRiftEnv();
+if (envLoadResult.loadedKeys.length > 0) {
+    process.stderr.write(`Loaded ${envLoadResult.loadedKeys.length} runtime secret(s).\n`);
+}
+const tokenManager = new TokenManager(macKeychain);
+await tokenManager.load();
+const queuePath = path.join(config.data_paths.jobs_dir, "queue.json");
+const jobQueue = new JobQueue(queuePath);
+await jobQueue.load();
+// Hold processing so recovered jobs don't execute before the startup
+// integrity check completes. Released after initTables + rebuild enqueue.
+jobQueue.hold();
+// --- Cloud embedding provider (needed for search + cloud watchers) ---
+const hasCloudSources = config.sources.some((s) => s.extraction !== "local");
+const voyageApiKey = process.env["VOYAGE_API_KEY"];
+// First-boot path: install.sh writes a config with cloud sources, but the
+// VOYAGE_API_KEY only lands in ~/.rift.env after `onadit onboard` runs.
+// Booting in degraded mode lets /health respond so onboard's kickstart can
+// reach the daemon and supply the key. On the next launchd respawn the env
+// loader picks up ~/.rift.env and the cloud provider initializes normally.
+let embeddingProvider;
+if (voyageApiKey) {
+    const cachePath = path.join(config.data_paths.data_dir, "embeddings");
+    embeddingProvider = new VoyageEmbeddingProvider({
+        apiKey: voyageApiKey,
+        ...voyageEndpoint(config.embedding),
+        cachePath,
+    });
+}
+else if (hasCloudSources) {
+    process.stderr.write("Cloud sources configured but VOYAGE_API_KEY missing — booting in degraded mode " +
+        "(cloud embeds disabled). Run `onadit onboard` to set the key, or `onadit status` to inspect.\n");
+}
+else {
+    process.stderr.write("Running in local-only mode (no VOYAGE_API_KEY — cloud features disabled)\n");
+}
+// --- Ollama providers (for extraction: "local" sources) ---
+const localSources = config.sources.filter((s) => s.extraction === "local");
+let ollamaEmbedding;
+if (localSources.length > 0) {
+    await checkOllamaHealth();
+    ollamaEmbedding = new OllamaEmbeddingProvider({
+        cachePath: path.join(config.data_paths.data_dir, "embeddings-local"),
+    });
+    process.stderr.write(`Ollama providers initialized for ${localSources.length} local source(s)\n`);
+}
+const conversationProviders = await createDaemonConversationGenerationProviders(config);
+const metadataExtractor = conversationProviders.metadataExtractor;
+const digestSummarizer = conversationProviders.digestSummarizer;
+// Log the extractor actually selected, keyed off the explicit
+// `metadataProvider` discriminator (not `digestSummarizer` presence — Claude
+// metadata ships no digest, so inferring from digests would misreport an active
+// Claude config as AI-free Basic).
+const metadataStartupLine = {
+    ollama: "Local generation enabled for conversation metadata extraction and digests\n",
+    codex_cli: "Cloud generation routed through Codex CLI for metadata extraction and digests\n",
+    claude_code: "Cloud generation routed through Claude Code for metadata extraction (digests/compaction off until Claude digest support ships)\n",
+    basic: "AI-free metadata enabled (BasicMetadataExtractor) — AI enrichment off, no AI-worker calls\n",
+};
+process.stderr.write(metadataStartupLine[conversationProviders.metadataProvider]);
+// --- Worker pool (heavy jobs run in child processes) ---
+const workerEntryPoint = resolveWorkerEntryPoint(import.meta.url);
+const workerPool = new WorkerPool(workerEntryPoint, absoluteConfigPath);
+// Declare watchers + scanner early so buildApp can capture the reference.
+const watchers = [];
+const scanSources = config.sources.filter((s) => s.mode === "scheduled_scan");
+const scanner = scanSources.length > 0
+    ? new Scanner(config.data_paths.data_dir)
+    : null;
+const watcherStartupDisabled = watcherStartupDisabledFromEnv();
+// --- Register worker-wrapped handlers BEFORE buildApp ---
+// Heavy jobs run in child processes; parent handles queue + watcher
+// coordination. Registering before buildApp ensures:
+// 1. buildApp's hasHandler() checks see worker handlers, skip fallbacks
+// 2. Recovered jobs from queue.load() don't execute in-process
+const projectIndex = new ProjectIndex(config.data_paths.data_dir);
+setProjectIndex(projectIndex);
+const saveWorkerHandler = createWorkerHandler(workerPool, "save", absoluteConfigPath, watchers, scanner, jobQueue);
+jobQueue.registerHandler("save", async (job) => {
+    await saveWorkerHandler(job);
+    // Link the session to its project on every save path, not just the daemon's.
+    recordSavedSessionProject(projectIndex, job.payload);
+});
+// Ingest is always available in the queue. Worker-side provider selection is
+// config-driven, and VOYAGE_API_KEY is still validated at job execution time.
+const workerIngestHandler = createWorkerHandler(workerPool, "ingest", absoluteConfigPath, watchers, scanner, jobQueue);
+const codexOverrideIngestHandler = embeddingProvider
+    ? createIngestHandler({
+        embeddingProvider,
+        metadataExtractor,
+        dataDir: config.data_paths.data_dir,
+        queue: jobQueue,
+    })
+    : null;
+jobQueue.registerHandler("ingest", codexOverrideIngestHandler
+    ? createCodexOverrideAwareHandler(workerIngestHandler, codexOverrideIngestHandler)
+    : workerIngestHandler);
+if (digestSummarizer) {
+    jobQueue.registerHandler("compact", createWorkerHandler(workerPool, "compact", absoluteConfigPath, watchers, scanner, jobQueue));
+}
+jobQueue.registerHandler("reindex", createWorkerHandler(workerPool, "reindex", absoluteConfigPath, watchers, scanner, jobQueue));
+jobQueue.registerHandler("reconcile", createWorkerHandler(workerPool, "reconcile", absoluteConfigPath, watchers, scanner, jobQueue));
+jobQueue.registerHandler("optimize", createWorkerHandler(workerPool, "optimize", absoluteConfigPath, watchers, scanner, jobQueue));
+const workerTriageHandler = createWorkerHandler(workerPool, "triage", absoluteConfigPath, watchers, scanner, jobQueue);
+jobQueue.registerHandler("triage", createCodexOverrideAwareHandler(workerTriageHandler, createTriageHandler({
+    dataDir: config.data_paths.data_dir,
+    openai: config.openai,
+})));
+// Auto-capture (in-process) calls triageConversation() directly. Install the
+// configured triage worker (codex_cli by default, claude_code when selected)
+// — the operator's own authenticated CLI runtime, no Onadit-held API key.
+setDefaultTriageProvider(createConfiguredTriageProvider());
+const { server, markReady } = await buildApp(config, tokenManager, jobQueue, embeddingProvider, watchers, scanner, digestSummarizer, metadataExtractor, ollamaEmbedding, absoluteConfigPath);
+registerShutdownHandlers(server, {
+    onShutdown: () => workerPool.shutdown(),
+});
+// SIGHUP reloads tokens from Keychain so CLI-issued tokens become
+// usable without a full daemon restart. noGrace ensures the new token
+// is the sole active credential (PRD: no grace overlap on token issue).
+process.on("SIGHUP", () => {
+    tokenManager
+        .reload({ noGrace: true })
+        .then(() => {
+        process.stderr.write("Reloaded auth tokens from Keychain\n");
+    })
+        .catch((err) => {
+        process.stderr.write(`Failed to reload tokens: ${err instanceof Error ? err.message : String(err)}\n`);
+    });
+});
+await server.listen({ host: config.server.host, port: config.server.port });
+// --- Startup integrity check (runs BEFORE initTables to detect corruption) ---
+const integrity = await checkIntegrity(config.data_paths.data_dir);
+// Close the connection used by integrity check so initTables gets a fresh state.
+const { closeConnection: closeConn, resetConnectionRef: resetConn } = await import("./storage/db.js");
+closeConn();
+resetConn();
+// --- Initialize storage and ingestion pipeline ---
+await initTables(config.data_paths.data_dir);
+// Stamp the serving-build capability marker: records that THIS build (and its
+// chunk capabilities) last served this data dir. Offline tools that run with the
+// daemon stopped read it to gate destructive schema-touching writes. Best-effort
+// — never breaks boot. Written only here, by the serving daemon, never by a CLI.
+writeServingMarker(config.data_paths.data_dir);
+// Attribution rules changed since some entries were stored: drop the "said by
+// the user" entries the current rules refuse. Once per rules version, no model
+// call, never breaks boot.
+try {
+    // Entries were captured over the last days: look that far back for the
+    // assistant messages a forwarded report came from.
+    const recheckAssistantText = createAssistantTextLookup({
+        ownedBy: ownsPassage,
+        roots: sessionRoots({ sources: config.capture.sources }),
+        windowMs: 14 * 24 * 60 * 60 * 1000,
+    });
+    const rechecked = await recheckStoredUserStatements(config.data_paths.data_dir, recheckAssistantText);
+    if (rechecked) {
+        process.stderr.write(`User statements re-checked: ${rechecked.conversations} conversation(s), ${rechecked.removed} entry(ies) no longer attributed to the user, ${rechecked.skipped} left for the next start\n`);
+    }
+}
+catch (err) {
+    process.stderr.write(`User statement re-check failed (non-fatal): ${err instanceof Error ? err.message : String(err)}\n`);
+}
+if (!integrity.healthy) {
+    process.stderr.write(`Startup integrity check: corruption detected in [${integrity.corruptTables.join(", ")}]. Auto-triggering rebuild.\n`);
+    // Use createUrgent to bypass the exclusivity gate and insert at
+    // the front of the queue. Other queued exclusive jobs (recovered or
+    // legitimate) naturally wait — one-at-a-time processing means they
+    // run after the rebuild against healthy storage.
+    const rebuildResult = await jobQueue.createUrgent("reindex", {
+        payload: { scope: "all", rebuild: true },
+    });
+    process.stderr.write(`Startup rebuild enqueued as job ${rebuildResult.job.id}\n`);
+}
+else {
+    process.stderr.write("Startup integrity check: all tables healthy\n");
+}
+// Integrity check done + tables initialized — safe to process jobs.
+jobQueue.releaseHold();
+// --- Source ownership helper (longest-prefix match) ---
+// Used by watcher + scan loops to route files to the correct provider
+// when source roots overlap or nest (e.g., cloud=/docs + local=/docs/private).
+function findOwningSource(filePath) {
+    let best;
+    let bestLen = 0;
+    for (const s of config.sources) {
+        if (filePath.startsWith(s.path) && s.path.length > bestLen) {
+            best = s;
+            bestLen = s.path.length;
+        }
+    }
+    return best;
+}
+function buildWatcherIgnoredPaths(source) {
+    return buildIgnoredPaths(source, config.data_paths);
+}
+// --- File watchers (mode: "watch") ---
+const watchSources = config.sources.filter((s) => s.mode === "watch");
+if (watcherStartupDisabled) {
+    process.stderr.write("Watcher startup disabled by RIFT_DISABLE_WATCHERS=1\n");
+}
+else {
+    for (const source of watchSources) {
+        // Select embedding provider based on extraction mode.
+        const embedding = source.extraction === "local" && ollamaEmbedding
+            ? ollamaEmbedding
+            : embeddingProvider;
+        if (!embedding) {
+            process.stderr.write(`Skipping watcher for ${source.path}: no embedding provider available\n`);
+            continue;
+        }
+        const indexer = new Indexer(embedding, {
+            sourceType: "filesystem_watched",
+            sourceScope: source.scope,
+            clientName: source.client_name ?? "",
+            allowedRoots: [source.path],
+            dataDir: config.data_paths.data_dir,
+            ...(source.extraction === "local" ? { tableName: "structured_docs_local" } : {}),
+        });
+        // Wrap handler to skip files owned by a more-specific source root.
+        // Without this, a cloud watcher on /docs would also index files under
+        // /docs/private (a nested local source), leaking local content to cloud.
+        const handler = (event) => {
+            const owner = findOwningSource(event.path);
+            if (owner && owner.path !== source.path)
+                return Promise.resolve();
+            return indexer.handleEvent(event);
+        };
+        const watcher = new Watcher([source.path], handler, {
+            ignoredPaths: buildWatcherIgnoredPaths(source),
+        });
+        await watcher.start();
+        watchers.push(watcher);
+    }
+    if (watchers.length > 0) {
+        process.stderr.write(`Started ${watchers.length} file watcher(s)\n`);
+    }
+    // --- Inbox watcher ---
+    if (jobQueue.hasHandler("ingest")) {
+        const inboxWatcher = createInboxWatcher({
+            dataDir: config.data_paths.data_dir,
+            queue: jobQueue,
+        });
+        await inboxWatcher.start();
+        watchers.push(inboxWatcher);
+        process.stderr.write("Inbox watcher started\n");
+    }
+}
+// --- Scheduled scan (mode: "scheduled_scan") ---
+let scanInterval = null;
+const scanIntervalSeconds = config.scan.interval_seconds;
+const scanIntervalMs = scanIntervalSeconds * 1000;
+if (config.cron.cron_enabled && scanSources.length > 0 && scanner) {
+    const scanDirs = scanSources.map((s) => s.path);
+    // Union ignored paths across all scheduled_scan sources. `walkDirectory`
+    // uses prefix matching, so paths outside a given root are no-ops for
+    // that root — the flat list is safe across sources.
+    const scanIgnoredPaths = Array.from(new Set(scanSources.flatMap((s) => buildIgnoredPaths(s, config.data_paths))));
+    const runScan = async () => {
+        if (scanner.isPaused)
+            return;
+        try {
+            const result = await scanner.scan(scanDirs, { ignoredPaths: scanIgnoredPaths });
+            for (const event of result.events) {
+                // Use longest-prefix match across ALL sources so files under a
+                // nested source root (e.g., local=/docs/private under cloud=/docs)
+                // are attributed to the most-specific owner.
+                const owner = findOwningSource(event.path);
+                if (!owner || owner.mode !== "scheduled_scan")
+                    continue;
+                const embedding = owner.extraction === "local" && ollamaEmbedding
+                    ? ollamaEmbedding
+                    : embeddingProvider;
+                if (!embedding)
+                    continue;
+                const indexer = new Indexer(embedding, {
+                    sourceType: "filesystem_scheduled_scan",
+                    sourceScope: owner.scope,
+                    clientName: owner.client_name ?? "",
+                    allowedRoots: [owner.path],
+                    dataDir: config.data_paths.data_dir,
+                    ...(owner.extraction === "local" ? { tableName: "structured_docs_local" } : {}),
+                });
+                await indexer.handleEvent(event);
+            }
+            scanner.setNextScan(new Date(Date.now() + scanIntervalMs).toISOString());
+        }
+        catch (err) {
+            process.stderr.write(`Scan error: ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+    };
+    if (scanner.isDue(scanIntervalSeconds)) {
+        process.stderr.write("Scheduled scan overdue — running catch-up scan\n");
+        void runScan();
+    }
+    scanInterval = setInterval(() => void runScan(), scanIntervalMs);
+    scanner.setNextScan(new Date(Date.now() + scanIntervalMs).toISOString());
+    process.stderr.write(`Scheduled scan enabled for ${scanSources.length} source(s) (interval: ${scanIntervalSeconds}s)\n`);
+}
+// --- Automatic capture (local CLI conversations) ---
+let captureInterval = null;
+if (config.capture.enabled && !voyageApiKey) {
+    // Capture is enabled in config but this daemon process loaded no
+    // VOYAGE_API_KEY (e.g. ~/.rift.env not yet written, or onboarding not
+    // finished before launchd booted us). Capture is the off-device path: both
+    // triage and background self-repair send parsed conversation content to Codex
+    // and then save the result. Without a key the save would fail, so we hold the
+    // ENTIRE loop (triage + self-repair) until a key is loaded — the daemon-side
+    // equivalent of the manual `onadit capture` gate. The next launchd respawn that
+    // picks up the key from ~/.rift.env starts capture normally.
+    process.stderr.write("Auto-capture is enabled but no VOYAGE_API_KEY is loaded — capture disabled " +
+        "until a Voyage key is loaded (no Codex triage or self-repair will run). " +
+        "Run `onadit onboard --reconfigure-voyage`, then restart the daemon.\n");
+}
+if (config.capture.enabled && voyageApiKey) {
+    const { runAutoCapture, zeroCounts, buildDaemonAutoCaptureDeps } = await import("./capture/auto-capture.js");
+    const { appendAutoCaptureRunRecord, buildAutoCaptureRunRecord, } = await import("./capture/observability.js");
+    const { maybeRunAutoRepair, clearSaveFailureCooldown, autoRepairAllowed } = await import("./capture/auto-repair.js");
+    const { CodexCliChunkSummarizer } = await import("./capture/recover-quarantine.js");
+    const captureIntervalMs = config.capture.interval_seconds * 1000;
+    // Block a save through the job queue and wait for it to reach a terminal
+    // state. Shared by auto-capture and background large-session repair so both
+    // confirm the save landed before marking their work done.
+    const saveViaJobQueue = async (opts) => {
+        const result = await jobQueue.create("save", {
+            idempotency_key: opts.idempotency_key,
+            payload: {
+                source: opts.source,
+                summary: opts.summary,
+                content: opts.content,
+                topics: opts.topics,
+                ...(opts.decisions?.length
+                    ? { decisions: opts.decisions, user_statements_seal: opts.user_statements_seal }
+                    : {}),
+                domain: opts.domain,
+                idempotency_key: opts.idempotency_key,
+                replace_idempotency_key: opts.replace_idempotency_key,
+                ...(opts.cwd ? { cwd: opts.cwd } : {}),
+            },
+        });
+        if ("conflict" in result) {
+            throw new Error("Job queue conflict during save");
+        }
+        const jobId = result.job.id;
+        const maxWaitMs = 120_000;
+        const pollMs = 250;
+        const start = Date.now();
+        // A confirmed save proves the Voyage/save path is healthy, so clear any
+        // background-repair save cooldown — recovery can resume now instead of
+        // idling out the rest of the window. Best-effort; never blocks the save.
+        const onSaveSuccess = async () => {
+            await clearSaveFailureCooldown(config.data_paths.data_dir);
+        };
+        while (Date.now() - start < maxWaitMs) {
+            const j = jobQueue.get(jobId);
+            if (!j) {
+                await onSaveSuccess(); // Pruned — treat as success
+                return;
+            }
+            if (j.status === "completed") {
+                await onSaveSuccess();
+                return;
+            }
+            if (j.status === "failed") {
+                throw new Error(`Save job failed: ${j.error ?? "unknown"}`);
+            }
+            await new Promise((r) => setTimeout(r, pollMs));
+        }
+        throw new Error("Save job timed out");
+    };
+    // Fire-and-forget background self-repair for oversized Codex sessions that
+    // auto-capture parked. Reuses the existing recovery path (chunked summarize
+    // + /save), bounds retries per-session, and dedups concurrent runs inside
+    // `maybeRunAutoRepair`. Never awaited by capture — recovery is slow (one
+    // Codex CLI call per chunk) and must not delay the capture loop or status.
+    const triggerAutoRepair = () => {
+        const repairAssistantText = createAssistantTextLookup({
+            ownedBy: ownsPassage,
+            roots: sessionRoots({ sources: config.capture.sources }),
+        });
+        void maybeRunAutoRepair({
+            recover: {
+                dataDir: config.data_paths.data_dir,
+                summarizer: new CodexCliChunkSummarizer({ timeoutMs: 180_000 }),
+                assistantText: repairAssistantText,
+                saveFn: (input) => saveViaJobQueue({
+                    source: "codex_cli",
+                    summary: input.summary,
+                    content: input.content,
+                    topics: input.topics,
+                    ...(input.decisions
+                        ? { decisions: input.decisions, user_statements_seal: input.userStatementsSeal }
+                        : {}),
+                    idempotency_key: input.idempotencyKey,
+                    ...(input.replaceIdempotencyKey
+                        ? { replace_idempotency_key: input.replaceIdempotencyKey }
+                        : {}),
+                }),
+            },
+            log: (message) => process.stderr.write(`${message}\n`),
+        }).catch((err) => {
+            process.stderr.write(`Auto-repair error: ${err instanceof Error ? err.message : String(err)}\n`);
+        });
+    };
+    const runCapture = async () => {
+        const startedAt = new Date();
+        try {
+            const report = await runAutoCapture(buildDaemonAutoCaptureDeps({
+                config,
+                // Wait for the save job to reach a terminal state so auto-capture
+                // only marks the conversation as processed after a confirmed save.
+                // If the job fails, this throws, and auto-capture's per-session error
+                // handler skips persisting state — the conversation is retried next run.
+                saveFn: (opts) => saveViaJobQueue(opts),
+            }));
+            const durationMs = Date.now() - startedAt.getTime();
+            await appendAutoCaptureRunRecord(config.data_paths.data_dir, buildAutoCaptureRunRecord({
+                timestamp: startedAt.toISOString(),
+                enabledSources: config.capture.sources,
+                durationMs,
+                report,
+                trigger: "daemon",
+            }));
+            process.stderr.write(`Auto-capture: ${report.saved} saved, ${report.review} review, ${report.discarded} discarded, ${report.errors} errors, ${report.new_conversations} new, ${durationMs}ms\n`);
+            // Self-repair any oversized sessions this (or a prior) run parked, but
+            // only when the whole path is actually ready:
+            //   - Codex preflight passed (summarize needs the Codex CLI), and
+            //   - this run had no per-session errors, and
+            //   - a Voyage key is present (the save handler needs it).
+            // The budget no longer counts save failures, so a missed gate here is
+            // not catastrophic — but skipping the attempt entirely avoids burning
+            // Codex calls to summarize sessions we then can't save. The repair runs
+            // in the background; we don't await it.
+            // It also needs Codex to be capture's worker (see autoRepairAllowed).
+            if (autoRepairAllowed({
+                preflightOk: report.preflight_ok,
+                errors: report.errors,
+                keyPresent: Boolean(voyageApiKey),
+                worker: resolveTriageProviderName(config),
+            })) {
+                triggerAutoRepair();
+            }
+        }
+        catch (err) {
+            const error = err instanceof Error ? err.message : String(err);
+            try {
+                await appendAutoCaptureRunRecord(config.data_paths.data_dir, {
+                    timestamp: startedAt.toISOString(),
+                    enabled_sources: config.capture.sources,
+                    run_ok: false,
+                    preflight_ok: true,
+                    duration_ms: Date.now() - startedAt.getTime(),
+                    counts_by_source: Object.fromEntries(config.capture.sources.map((source) => [source, zeroCounts()])),
+                    errors: [{
+                            sessionId: "run",
+                            error,
+                        }],
+                    run_error: error,
+                    trigger: "daemon",
+                });
+            }
+            catch (observabilityErr) {
+                process.stderr.write(`Auto-capture observability append failed: ${observabilityErr instanceof Error ? observabilityErr.message : String(observabilityErr)}\n`);
+            }
+            process.stderr.write(`Auto-capture error: ${error}\n`);
+        }
+        finally {
+            // Daemon-observed failure notifications. Runs after the run record
+            // is written (both branches), so it diagnoses the freshest signals.
+            // Best-effort: a notification failure must never affect capture.
+            await notifyDaemonObservedFailures();
+        }
+    };
+    // Diagnose the live daemon signals and raise one native notification
+    // per newly-failing, daemon-observable issue (expired Codex login,
+    // missing/failing Voyage key, index-write failure, capture failure).
+    // Rate-limited inside notifyDaemonFailures (transition + once/day).
+    const notifyDaemonObservedFailures = async () => {
+        try {
+            const { buildFriendStatusPayload } = await import("./server/routes/friend-status.js");
+            const { diagnose } = await import("./diagnostics/doctor.js");
+            const { notifyDaemonFailures } = await import("./diagnostics/notify.js");
+            const payload = buildFriendStatusPayload({
+                config,
+                startTime: daemonStartTime,
+                jobQueue,
+            });
+            const report = diagnose({
+                status: payload,
+                // The notifier only acts on daemon-observable issues, none of
+                // which depend on local MCP-client config — so the daemon need
+                // not read the friend's client files here.
+                localSignals: { voyageLast4: null, mcpClients: [] },
+                now: Date.now(),
+            });
+            notifyDaemonFailures(config.data_paths.data_dir, report.issues);
+        }
+        catch (notifyErr) {
+            process.stderr.write(`Failure-notification check skipped: ${notifyErr instanceof Error ? notifyErr.message : String(notifyErr)}\n`);
+        }
+    };
+    // Run once at startup (after tables are ready)
+    void runCapture();
+    captureInterval = setInterval(() => void runCapture(), captureIntervalMs);
+    process.stderr.write(`Auto-capture enabled for ${config.capture.sources.join(", ")} (interval: ${config.capture.interval_seconds}s)\n`);
+}
+// --- npm-registry update check ---
+// One eager probe at boot, then hourly. Metadata-only — see
+// docs/feedback/PRIVACY.md and src/observability/version-check.ts.
+// Non-fatal: any failure is recorded in the snapshot and surfaced to
+// the renderer, never thrown.
+let versionCheckInterval = null;
+{
+    const { runVersionCheck, VERSION_CHECK_INTERVAL_MS } = await import("./observability/version-check.js");
+    const installedVersion = getBuildInfo().version;
+    const runProbe = async () => {
+        try {
+            await runVersionCheck({
+                dataDir: config.data_paths.data_dir,
+                installed: installedVersion,
+            });
+        }
+        catch (err) {
+            process.stderr.write(`Version-check probe failed (non-fatal): ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+    };
+    void runProbe();
+    versionCheckInterval = setInterval(() => void runProbe(), VERSION_CHECK_INTERVAL_MS);
+}
+// --- Project identity for captured sessions (sidecar; see project-index.ts) ---
+// Backfill runs in the background: unknown sessions stay searchable, just not
+// project-scoped, so nothing waits on it.
+void projectIndex
+    .backfillFromTable()
+    .then(({ resolved, unknown }) => {
+    if (resolved || unknown) {
+        process.stderr.write(`Project index: ${resolved} sessions resolved, ${unknown} unknown\n`);
+    }
+})
+    .catch((err) => {
+    process.stderr.write(`Project index backfill failed (non-fatal): ${err instanceof Error ? err.message : String(err)}\n`);
+});
+// --- Table maintenance (compaction + full-text indexes) ---
+const stopMaintenanceScheduler = startMaintenanceScheduler({
+    queue: jobQueue,
+    log: (line) => process.stderr.write(line),
+});
+// Write PID file so the CLI can find and signal this process.
+const pidPath = path.join(config.data_paths.data_dir, "rift.pid");
+fs.writeFileSync(pidPath, String(process.pid));
+// Clean up PID file, auth timers, watchers, scan interval, and tables on exit.
+// Worker pool is shut down via registerShutdownHandlers' onShutdown hook
+// (runs before process.exit, so the 3s SIGKILL escalation works).
+process.on("exit", () => {
+    if (scanInterval)
+        clearInterval(scanInterval);
+    if (captureInterval)
+        clearInterval(captureInterval);
+    if (versionCheckInterval)
+        clearInterval(versionCheckInterval);
+    stopMaintenanceScheduler();
+    tokenManager.shutdown();
+    for (const w of watchers) {
+        void w.stop();
+    }
+    closeTables();
+    try {
+        fs.unlinkSync(pidPath);
+    }
+    catch {
+        // Best-effort — process is exiting.
+    }
+});
+const buildInfo = getBuildInfo();
+process.stderr.write(`onadit ${buildInfo.version} (commit ${buildInfo.commit.slice(0, 12)}, node ${buildInfo.node}) listening on ${config.server.host}:${config.server.port}\n`);
+// Regenerate the on-disk capability map at boot so a fresh daemon always
+// advertises the current tool surface, independent of whether /status is
+// ever hit. Before this, `data/rift-context.md` only refreshed as a side
+// effect of GET /status, leaving newly-shipped tools (e.g. onadit_context_pack)
+// missing from the map right after a deploy. Best-effort: writeRiftContext
+// already swallows and logs its own failures.
+try {
+    const counts = await getCapabilityCounts();
+    const capabilityMap = generateCapabilityMap(counts);
+    await writeRiftContext(config.data_paths.data_dir, capabilityMap);
+}
+catch (err) {
+    process.stderr.write(`Boot capability-map regeneration failed (non-fatal): ${err instanceof Error ? err.message : String(err)}\n`);
+}
+markReady();
+// "Search by meaning" was just turned on, so the archive still holds
+// placeholder vectors from keyword-only mode: re-embed it once. Another
+// repair job may hold the queue; keep trying until the re-embed is queued.
+if (embeddingProvider && backfillPending(absoluteConfigPath)) {
+    const queueBackfill = async () => {
+        const result = await jobQueue.create("reindex", { payload: { scope: "all", rebuild: false } });
+        if ("conflict" in result)
+            return false;
+        clearBackfillPending(absoluteConfigPath);
+        process.stderr.write(`Search by meaning: re-embedding the archive (job ${result.job.id})\n`);
+        return true;
+    };
+    if (!(await queueBackfill().catch(() => false))) {
+        const retry = setInterval(() => {
+            void queueBackfill()
+                .then((queued) => {
+                if (queued)
+                    clearInterval(retry);
+            })
+                .catch(() => undefined);
+        }, 10 * 60 * 1000);
+        retry.unref();
+    }
+}
+//# sourceMappingURL=main.js.map