opencode-sesh 0.1.4 → 0.1.5

package/AGENTS.md

@@ -50,9 +50,12 @@ the schema below. Keystrokes never touch the database:
 
 - `--refresh` (expensive): bulk-reads session metadata and per-session text
   parts, validates the persistent extraction cache
-  (`$SESH_CACHE_DIR/extractions/<ses_*.json>`) against `time_updated` + part
-  count, re-extracts only changed sessions, prunes vanished ones, and atomically
-  publishes `STATE_DIR/snapshot.jsonl` with `status = fresh`. Scope
+  (`$SESH_CACHE_DIR/extractions/<ses_*.json>`, schema 2) against `time_updated`,
+  part count and the latest part timestamp, re-extracts only changed sessions,
+  prunes vanished ones, and atomically publishes `STATE_DIR/snapshot.jsonl`.
+  Extraction moves transcripts through files, never argv (no ARG_MAX limit); if
+  any session fails, the published status is `stale` and that session stays
+  uncached so the next refresh retries, otherwise `status = fresh`. Scope
   (`--cwd`/toggle) and `--limit` apply at assembly, so metadata always covers
   the whole DB and pruning is always safe.
 - render (cheap, pure `jq`): reads the snapshot only. Filters on `searchText`
@@ -78,7 +81,7 @@ Resume happens in place (`exec` after `cd` to the session's cwd).
 - **Text parts only** in search/preview; reasoning and tool payloads are
   excluded (asserted in tests).
 - Validate session ids (`^ses_[A-Za-z0-9]+$`) before SQL interpolation — never
-  interpolate unvalidated input.
+  interpolate unvalidated input. Open SQLite read-only (`sqlite3 -readonly`).
 - Prefer direct `sqlite3` over `opencode db` (startup latency). Never parse
   `sqlite3 -json` in `-R` mode; it pretty-prints — parse as JSON.
 - `jq -R` output stays JSON-quoted: use `-Rr` when a shell variable needs the

package/CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-09-13
+
+### Fixed
+
+- Transcript indexing no longer puts the whole conversation on the command line,
+  so large sessions (over a megabyte of text) are indexed instead of silently
+  dropped. A failed extraction now reports the snapshot as `stale` and retries
+  on the next refresh rather than certifying an incomplete index as fresh.
+- Transcript preview renders text parts even when newer tool parts outnumber
+  them, and a long message no longer blanks the preview when the output pipe
+  closes early.
+- Warm extraction caches are invalidated on any part change (text or timestamp),
+  not only when the session timestamp or part count moves.
+- The installer refuses to replace a symlinked `sesh` launcher that is not a
+  sesh install, and uninstall leaves foreign launcher symlinks untouched.
+
+### Security
+
+- Session ids are validated with the anchored `^ses_[A-Za-z0-9]+$` pattern at
+  the preview and deletion boundaries before any SQL, and the local SQLite store
+  is opened read-only.
+
+### Added
+
+- Regression coverage for large transcripts, part-only cache invalidation,
+  preview text/tool ordering and long previews, malformed session ids, empty
+  stores, and installer launcher ownership.
+
 ## [0.1.4] - 2026-09-13
 
 ### Fixed
@@ -74,7 +102,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fixture-database regression suite, TypeScript typechecking, and ShellCheck in
   CI.
 
-[Unreleased]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.4...HEAD
+[Unreleased]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.5...HEAD
+[0.1.5]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.4...v0.1.5
 [0.1.4]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.3...v0.1.4
 [0.1.3]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.1...v0.1.2

package/bin/sesh-delete.sh

@@ -37,7 +37,7 @@ acquire_lock() {
 # fzf passes an empty second field for headers and notices. They are never
 # actions, and should not surface a misleading failure prompt.
 [ -n "$session_id" ] || exit 0
-case "$session_id" in ses_[A-Za-z0-9]*) ;; *) echo "Invalid session identity."; pause; exit 0;; esac
+[[ "$session_id" =~ ^ses_[A-Za-z0-9]+$ ]] || { echo "Invalid session identity."; pause; exit 0; }
 [ -n "$state_dir" ] && [ -f "$snapshot" ] || { echo "No session snapshot available."; pause; exit 0; }
 
 # Serialize this action with the sole snapshot publisher. A short collision

package/bin/sesh-list.sh

@@ -95,7 +95,9 @@ fi
 # would make every preview keystroke laggy.
 db_json() {
   if [ -n "$SQLITE_BIN" ]; then
-    "$SQLITE_BIN" -json "$DB_PATH" "$1"
+    # Read-only: sesh never writes the store directly (deletes go through
+    # `opencode session delete`).
+    "$SQLITE_BIN" -json -readonly "$DB_PATH" "$1"
   else
     "$OPENCODE_BIN" db "$1" --format json
   fi
@@ -243,11 +245,11 @@ refresh() {
     | ($parts[0] | map({key:.session_id, value:.}) | from_entries) as $stats
     | [$sessions[0][] | . + {partCount: ($stats[.id].n // 0), partMax: ($stats[.id].m // 0)}] as $meta
     | ($meta | map({key:.id, value:.}) | from_entries) as $byId
-    | [$caches[0][]? | select(.cacheSchema == 1 and (.sessionId | type) == "string")
-       | select($byId[.sessionId] as $m | $m != null and .cacheUpdated == $m.time_updated and .cacheParts == $m.partCount)] as $cached
-    | ($cached | map({key:.sessionId, value:true}) | from_entries) as $cachedIds
+    | [$caches[0][]? | select(.cacheSchema == 2 and (.sessionId | type) == "string")
+       | select($byId[.sessionId] as $m | $m != null and .cacheUpdated == $m.time_updated and .cacheParts == $m.partCount and .cacheMax == $m.partMax)] as $cached
+    | ($cached | map({key: .sessionId, value:true}) | from_entries) as $cachedIds
     | {cached: $cached,
-       stale: [$meta[] | select($cachedIds[.id] != true) | {id, directory, title, time_created, time_updated, archived, partCount}],
+       stale: [$meta[] | select($cachedIds[.id] != true) | {id, directory, title, time_created, time_updated, archived, partCount, partMax}],
        prune: [$caches[0][]? | select(.sessionId? as $s | $byId[$s] == null) | .cachePath],
        meta: $meta}
   ' "$cache_records" > "$cache_state" || {
@@ -258,7 +260,8 @@ refresh() {
   "$JQ_BIN" -c '.stale[]?' "$cache_state" > "$needs_extract"
   while IFS= read -r cache; do [ -n "$cache" ] && rm -f "$cache"; done < <("$JQ_BIN" -r '.prune[]?' "$cache_state")
 
-  local sid dir title created updated archived partCount text fulltext record cache
+  local sid dir title created updated partCount partMax raw_file text_file record cache
+  local extract_failed=0
   while IFS= read -r row; do
     [ -n "$row" ] || continue
     sid=$(printf '%s' "$row" | "$JQ_BIN" -r '.id')
@@ -268,28 +271,40 @@ refresh() {
     created=$(printf '%s' "$row" | "$JQ_BIN" -r '.time_created // 0')
     updated=$(printf '%s' "$row" | "$JQ_BIN" -r '.time_updated // 0')
     partCount=$(printf '%s' "$row" | "$JQ_BIN" -r '.partCount // 0')
+    partMax=$(printf '%s' "$row" | "$JQ_BIN" -r '.partMax // 0')
     cache="$EXTRACTIONS/$sid.json"
-    # Text parts only: reasoning blobs and tool payloads would bloat the
-    # search index without helping anyone find a session.
-    text=$(db_json "SELECT data FROM part WHERE session_id = '$sid' AND json_extract(data, '\$.type') = 'text' ORDER BY time_created;" 2>/dev/null \
-      | "$JQ_BIN" -r '[.[]? | (.data? // empty) | (try fromjson catch empty) | select(type == "object" and .type == "text") | .text // empty] | join(" ")' 2>/dev/null) || text=''
-    fulltext=$(printf '%s' "$title $text" | "$JQ_BIN" -Rrs 'ascii_downcase' 2>/dev/null) || fulltext=''
+    raw_file="$scratch/$sid.parts.json"
+    text_file="$scratch/$sid.text"
+    # Text parts only: reasoning blobs and tool payloads would bloat the search
+    # index. The transcript travels through files, never argv, so a large
+    # conversation cannot hit ARG_MAX; a failure leaves the session uncached so
+    # the next refresh retries instead of certifying it fresh.
+    if db_json "SELECT data FROM part WHERE session_id = '$sid' AND json_extract(data, '\$.type') = 'text' ORDER BY time_created;" > "$raw_file" 2>/dev/null \
+      && "$JQ_BIN" -r '[.[]? | (.data? // empty) | (try fromjson catch empty) | select(type == "object" and .type == "text") | .text // empty] | join(" ")' "$raw_file" > "$text_file" 2>/dev/null; then
+      :
+    else
+      extract_failed=1
+      continue
+    fi
     if [ -z "$title" ]; then
-      title=$(printf '%s' "$text" | "$JQ_BIN" -Rrs 'gsub("[\r\n]+"; " ") | if length > 70 then .[0:67] + "..." else . end | select(length > 0) // "(untitled)"' 2>/dev/null) || title='(untitled)'
+      title=$("$JQ_BIN" -Rrs 'gsub("[\r\n]+"; " ") | if length > 70 then .[0:67] + "..." else . end | select(length > 0) // "(untitled)"' "$text_file" 2>/dev/null) || title='(untitled)'
       [ -n "$title" ] || title='(untitled)'
     fi
     record=$("$JQ_BIN" -cn --arg sid "$sid" --arg cwd "$dir" --arg title "$title" \
-      --argjson created "$created" --argjson updated "$updated" --argjson parts "$partCount" --arg fulltext "$fulltext" '
-      {cacheSchema: 1, cacheSession: $sid, cacheUpdated: $updated, cacheParts: $parts,
+      --argjson created "$created" --argjson updated "$updated" --argjson parts "$partCount" --argjson maxpart "$partMax" \
+      --rawfile text "$text_file" '
+      {cacheSchema: 2, cacheSession: $sid, cacheUpdated: $updated, cacheParts: $parts, cacheMax: $maxpart,
        sessionId: $sid, transcriptPath: "", source: "opencode",
        cwd: $cwd, title: ($title | gsub("[\r\n]+"; " ") | if length > 70 then .[0:67] + "..." else . end),
        updatedEpoch: (($updated / 1000 | floor) | if . > 0 then . else ($created / 1000 | floor) end),
-       fulltextLower: $fulltext}') || record=''
+       fulltextLower: (($title + " " + $text) | sub("\n$"; "") | ascii_downcase)}') || record=''
     if [ -n "$record" ]; then
       cache_tmp=$(mktemp "$EXTRACTIONS/$sid.json.XXXXXX")
       printf '%s\n' "$record" > "$cache_tmp"
       mv "$cache_tmp" "$cache"
       printf '%s\n' "$record" >> "$historical"
+    else
+      extract_failed=1
     fi
   done < "$needs_extract"
 
@@ -297,6 +312,7 @@ refresh() {
     .meta as $meta
     | ($hist | map({key: .sessionId, value: .}) | from_entries) as $histById
     | [$meta[]
+       | select((.id | type) == "string" and (.id | test("^ses_[A-Za-z0-9]+$")))
        | select($archived == 1 or .archived == 0)
        | select($scope == "" or .directory == $scope)
        | . as $m | ($histById[$m.id] // {}) as $h
@@ -313,7 +329,13 @@ refresh() {
     return 1
   fi
   mv -f "$out" "$SNAPSHOT"
-  set_status fresh || true
+  if [ "$extract_failed" = 1 ]; then
+    # Publish what we have, but say the index is incomplete and keep the
+    # failed sessions uncached so the next refresh retries them.
+    set_status 'stale: transcript extraction incomplete; refresh to retry' || true
+  else
+    set_status fresh || true
+  fi
 }
 
 if [ "$REFRESH" = 1 ] || [ "$TOGGLE_SCOPE" = 1 ]; then refresh; fi

package/bin/sesh-preview.sh

@@ -10,7 +10,7 @@ JQ_BIN=${SESH_JQ:-jq}
 
 [ -n "$state_dir" ] && [ -n "$session_id" ] || { echo "(no session selected)"; exit 0; }
 [ -f "$snapshot" ] || { echo "(no session snapshot available)"; exit 0; }
-case "$session_id" in ses_[A-Za-z0-9]*) ;; *) echo "(no transcript for this row)"; exit 0;; esac
+[[ "$session_id" =~ ^ses_[A-Za-z0-9]+$ ]] || { echo "(no transcript for this row)"; exit 0; }
 "$JQ_BIN" -se --arg sid "$session_id" 'any(.sessionId == $sid)' "$snapshot" >/dev/null 2>&1 \
   || { echo "(selected session is no longer in this snapshot)"; exit 0; }
 
@@ -26,26 +26,31 @@ fi
 
 SQLITE_BIN=${SESH_SQLITE:-}
 if [ -z "$SQLITE_BIN" ] && command -v sqlite3 >/dev/null 2>&1; then SQLITE_BIN=sqlite3; fi
-SQL="SELECT m.data AS msg, p.data AS part FROM part p JOIN message m ON m.id = p.message_id WHERE p.session_id = '$session_id' ORDER BY p.time_created DESC LIMIT 200;"
+SQL="SELECT m.data AS msg, p.data AS part FROM part p JOIN message m ON m.id = p.message_id WHERE p.session_id = '$session_id' AND json_extract(p.data, '\$.type') = 'text' ORDER BY p.time_created DESC LIMIT 200;"
 if [ -n "$SQLITE_BIN" ]; then
-  rows=$("$SQLITE_BIN" -json "$DB_PATH" "$SQL" 2>/dev/null) || rows=''
+  rows=$("$SQLITE_BIN" -json -readonly "$DB_PATH" "$SQL" 2>/dev/null) || rows=''
 else
   OPENCODE_BIN=${SESH_OPENCODE:-opencode}
   rows=$("$OPENCODE_BIN" db "$SQL" --format json 2>/dev/null) || rows=''
 fi
 [ -n "$rows" ] || { echo "(no displayable transcript messages)"; exit 0; }
 
-# Text parts only, newest first, with role headers. Control bytes are stripped
-# with tr (byte-safe for UTF-8: only 0x00-0x1F and 0x7F are removed).
+# Text parts only, newest first, with role headers. The 120-block cap is applied
+# inside jq so nothing closes the pipe early (a `head` here would trip pipefail
+# with SIGPIPE and blank the preview). Control bytes are stripped with tr
+# (byte-safe for UTF-8: only 0x00-0x1F and 0x7F are removed).
 rendered=$(printf '%s' "$rows" | "$JQ_BIN" -r '
   (if type == "array" then . else [] end)
+  | map(
+      ((.msg | try fromjson catch {}) | .role? // "") as $role
+      | (.part | try fromjson catch {}) as $p
+      | select(($p.type? // "") == "text")
+      | ($p.text? // "") | select(type == "string" and length > 0)
+      | (if $role == "user" then "# You" elif $role == "assistant" then "# Opencode" else "# Message" end) + "\n\n" + .
+    )
+  | .[0:120]
   | .[]
-  | ((.msg | try fromjson catch {}) | .role? // "") as $role
-  | (.part | try fromjson catch {}) as $p
-  | select(($p.type? // "") == "text")
-  | ($p.text? // "") | select(type == "string" and length > 0)
-  | (if $role == "user" then "# You" elif $role == "assistant" then "# Opencode" else "# Message" end) + "\n\n" + .
-' 2>/dev/null | tr -d '\000-\010\013\014\016-\037\177' | head -120) || rendered=''
+' 2>/dev/null | tr -d '\000-\010\013\014\016-\037\177') || rendered=''
 [ -n "$rendered" ] || { echo "(no displayable transcript messages)"; exit 0; }
 
 resolve_glow() {

package/install.sh

@@ -91,8 +91,33 @@ remove_tui_entry() {
   fi
 }
 
+# The launcher is a symlink we create. Treat it as ours only when it resolves to
+# a sesh launcher, so a foreign symlink is never replaced on install nor deleted
+# on uninstall. Recognized by the exact source path, a `.../bin/sesh` target, or
+# the marker in the target file (covers npm upgrades and a moved checkout).
+launcher_is_ours() {
+  local link=$1 target
+  [ -L "$link" ] || return 1
+  target=$(readlink "$link" 2>/dev/null) || return 1
+  [ -n "$target" ] || return 1
+  case "$target" in
+    /*) ;;
+    *) target="$(cd "$(dirname "$link")" && pwd -P)/$target" ;;
+  esac
+  case "$target" in
+    "$SOURCE_DIR/bin/sesh"|*/bin/sesh) return 0 ;;
+  esac
+  [ -f "$target" ] && grep -qF 'Pick an opencode session' "$target" 2>/dev/null
+}
+
 if [ "$UNINSTALL" = 1 ]; then
-  [ -L "$LAUNCHER" ] && rm -f "$LAUNCHER" && note "removed $LAUNCHER"
+  if [ -L "$LAUNCHER" ]; then
+    if launcher_is_ours "$LAUNCHER"; then
+      rm -f "$LAUNCHER" && note "removed $LAUNCHER"
+    else
+      note "left $LAUNCHER untouched (not a sesh launcher: $(readlink "$LAUNCHER" 2>/dev/null))"
+    fi
+  fi
   remove_if_marker "$COMMAND_DST" "rich interactive picker" && note "removed $COMMAND_DST"
   remove_if_marker "$TOOL_DST" "list opencode sessions for the agent" && note "removed $TOOL_DST"
   remove_if_marker "$PANEL_DST" "@jsxImportSource @opentui/solid" && note "removed $PANEL_DST"
@@ -135,6 +160,9 @@ mkdir -p "$BIN_DIR"
 if [ -e "$LAUNCHER" ] && [ ! -L "$LAUNCHER" ]; then
   fail "$LAUNCHER already exists and is not a symlink. Move it aside, then retry."
 fi
+if [ -L "$LAUNCHER" ] && ! launcher_is_ours "$LAUNCHER"; then
+  fail "$LAUNCHER is a symlink to $(readlink "$LAUNCHER" 2>/dev/null), which is not a sesh install. Move it aside, then retry."
+fi
 ln -sfn "$SOURCE_DIR/bin/sesh" "$LAUNCHER"
 note "linked $LAUNCHER -> $SOURCE_DIR/bin/sesh"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-sesh",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "description": "Browse, search, preview and resume opencode sessions from the terminal and the TUI.",
   "license": "MIT",