osborn 0.9.249 → 0.9.251

package/dist/content/lens-quotes.js

@@ -0,0 +1,186 @@
+/**
+ * lens-quotes.ts — the DETERMINISTIC anti-hallucination guard (no model).
+ *
+ * Every quote the model returns must be an exact (whitespace-normalized)
+ * substring of a sanitized session.db conversation row carrying the SAME
+ * timestamp (rows the model actually saw). Items (angles or capabilities) with
+ * any unverifiable quote are dropped wholesale. The speaker and row id written
+ * to disk are taken from the matched row, never from the model.
+ */
+const MIN_QUOTE_CHARS = 12;
+const MAX_QUOTE_CHARS = 400;
+export const normalizeWs = (s) => s.replace(/\s+/g, ' ').trim();
+/** Strip wrapping quote marks the model may add; nothing else is altered. */
+function unwrapQuote(s) {
+    return s.trim().replace(/^["“”'`]+/, '').replace(/["“”'`]+$/, '').trim();
+}
+/**
+ * Formatting-only normalization applied identically to quote AND row: markdown
+ * emphasis/code marks, typographic quotes/ellipsis, whitespace, letter case. Words, digits and
+ * punctuation that carry meaning are untouched, so this is still a substring check.
+ */
+export const looseText = (s) => normalizeWs(s
+    .replace(/\*\*|__|`+/g, '')
+    .replace(/(^|[\s(])\*(?=\S)|(?<=\S)\*(?=[\s).,;:!?]|$)/g, '$1')
+    .replace(/[‘’]/g, "'")
+    .replace(/[“”]/g, '"')
+    .replace(/…/g, '...')).toLowerCase();
+/** A cited timestamp may slip (neighbouring row, one digit); beyond this it's a different moment. */
+export const TS_TOLERANCE_MS = 3 * 60 * 60_000;
+/** timestamp → rows carrying it (normalized + loose text, row id, parsed time). */
+export function buildRecordIndex(records) {
+    const idx = new Map();
+    for (const r of records) {
+        const list = idx.get(r.timestamp) ?? [];
+        const text = normalizeWs(r.text);
+        list.push({ text, loose: looseText(text), speaker: r.speaker, row: r.id ?? 0, ts: r.timestamp, ms: Date.parse(r.timestamp) });
+        idx.set(r.timestamp, list);
+    }
+    return idx;
+}
+/**
+ * Verified quote or null. Pure + deterministic. The quote text must be a
+ * substring (whitespace/markdown-normalized) of a SOURCE row. Exact timestamp
+ * match is preferred; otherwise the nearest row containing the text is accepted
+ * only if the cited timestamp is within TS_TOLERANCE_MS, or the cited row id is
+ * that row. The timestamp, speaker and row written out are ALWAYS the source
+ * row's, never the model's (tsCorrected marks a fixed citation).
+ */
+export function verifyQuote(q, idx) {
+    if (typeof q?.text !== 'string' || typeof q?.timestamp !== 'string')
+        return null;
+    const text = normalizeWs(unwrapQuote(q.text));
+    if (text.length < MIN_QUOTE_CHARS || text.length > MAX_QUOTE_CHARS)
+        return null;
+    const loose = looseText(text);
+    if (loose.length < MIN_QUOTE_CHARS)
+        return null;
+    const ts = q.timestamp.trim();
+    const hint = Number(String(q.row ?? '').replace(/^#/, ''));
+    const hit = (c) => c.text.includes(text) || c.loose.includes(loose);
+    const exact = (idx.get(ts) ?? []).filter(hit).sort((a, b) => Number(b.row === hint) - Number(a.row === hint));
+    if (exact.length)
+        return { text, timestamp: exact[0].ts, speaker: exact[0].speaker, row: exact[0].row };
+    const cited = Date.parse(ts);
+    let best = null;
+    let bestDiff = Infinity;
+    for (const list of idx.values()) {
+        for (const c of list) {
+            if (!hit(c))
+                continue;
+            const diff = c.row === hint ? 0 : Number.isFinite(cited) && Number.isFinite(c.ms) ? Math.abs(c.ms - cited) : Infinity;
+            if (diff < bestDiff) {
+                best = c;
+                bestDiff = diff;
+            }
+        }
+    }
+    if (!best || bestDiff > TS_TOLERANCE_MS)
+        return null;
+    return { text, timestamp: best.ts, speaker: best.speaker, row: best.row, tsCorrected: true };
+}
+/** Why a quote failed (debug only; same rules as verifyQuote). */
+export function explainQuote(q, idx) {
+    if (verifyQuote(q, idx))
+        return 'ok';
+    if (typeof q?.text !== 'string' || typeof q?.timestamp !== 'string')
+        return 'malformed';
+    const text = normalizeWs(unwrapQuote(q.text));
+    if (text.length < MIN_QUOTE_CHARS || text.length > MAX_QUOTE_CHARS)
+        return `length ${text.length}`;
+    const cands = idx.get(q.timestamp.trim());
+    if (!cands) {
+        for (const [ts, list] of idx)
+            if (list.some(c => c.text.includes(text)))
+                return `wrong-timestamp (text is in ${ts})`;
+        return 'unknown-timestamp, text not found anywhere';
+    }
+    for (const [ts, list] of idx)
+        if (ts !== q.timestamp && list.some(c => c.text.includes(text)))
+            return `text belongs to ${ts}`;
+    return 'timestamp ok, text not a substring (paraphrased/edited)';
+}
+/**
+ * Keep items whose quotes ALL verify (1..maxQuotes required). Returns the kept
+ * items with verified quotes substituted, plus the drop count.
+ */
+export function verifyItems(items, idx, maxQuotes = 3) {
+    const kept = [];
+    let dropped = 0;
+    for (const it of items) {
+        const qs = Array.isArray(it.quotes) ? it.quotes.slice(0, maxQuotes) : [];
+        const verified = qs.map(q => verifyQuote(q, idx));
+        if (qs.length === 0 || verified.some(v => v === null)) {
+            dropped++;
+            continue;
+        }
+        kept.push({ ...it, quotes: verified });
+    }
+    return { kept, dropped };
+}
+/** Tolerant JSON-object parse: accepts fences or leading prose. */
+export function parseJsonObject(raw) {
+    if (!raw)
+        return null;
+    const s = raw.trim().replace(/^```(?:json)?\s*/i, '').replace(/```\s*$/, '').trim();
+    const start = s.indexOf('{');
+    const end = s.lastIndexOf('}');
+    if (start === -1 || end <= start)
+        return null;
+    try {
+        const o = JSON.parse(s.slice(start, end + 1));
+        return o && typeof o === 'object' && !Array.isArray(o) ? o : null;
+    }
+    catch {
+        return null;
+    }
+}
+const str = (v) => (typeof v === 'string' ? v.trim() : '');
+/** Done-vs-planned gate: only shipped/verified or proven-root-cause items count. */
+export function normalizeEvidence(v) {
+    const s = str(v).toLowerCase().replace(/[\s_]+/g, '-');
+    if (s === 'shipped' || s === 'verified' || s === 'done')
+        return 'shipped';
+    if (s === 'root-caused' || s === 'rootcaused' || s === 'root-cause')
+        return 'root-caused';
+    return '';
+}
+export function splitByEvidence(caps) {
+    const done = caps.filter(c => c.evidence !== '');
+    return { done, notDone: caps.length - done.length };
+}
+export function readAngles(v, max) {
+    if (!Array.isArray(v))
+        return [];
+    const out = [];
+    for (const o of v) {
+        const title = str(o?.title);
+        if (!title)
+            continue;
+        const queries = Array.isArray(o?.queries) ? o.queries.map(str).filter(Boolean).slice(0, 2) : [];
+        out.push({ title, why: str(o?.why), quotes: Array.isArray(o?.quotes) ? o.quotes : [], queries });
+        if (out.length >= max)
+            break;
+    }
+    return out;
+}
+export function readCapabilities(v, max) {
+    if (!Array.isArray(v))
+        return [];
+    const out = [];
+    for (const o of v) {
+        const name = str(o?.name);
+        if (!name)
+            continue;
+        out.push({
+            name,
+            did: str(o?.did),
+            evidence: normalizeEvidence(o?.evidence),
+            proof: str(o?.proof),
+            quotes: Array.isArray(o?.quotes) ? o.quotes : [],
+        });
+        if (out.length >= max)
+            break;
+    }
+    return out;
+}

package/dist/content/lens-redact.d.ts

@@ -0,0 +1,61 @@
+/**
+ * lens-redact.ts — CLIENT/CUSTOMER redaction for the content lens.
+ *
+ * Content may draw on client work (ads-API lessons etc.) but never on who the
+ * client is. Applied twice: (1) to every conversation row BEFORE it is sent to
+ * the model (after the secret sanitizer), (2) to the final entry written to the
+ * profile / sample file. Replacements are generic role tags ([client],
+ * [founder], [ad account], [amount] …) so the technical lesson stays readable.
+ *
+ * Configurable, no names in source:
+ *   - DEFAULT_PATTERNS below: shape-based (emails, act_…, platform IDs, UUIDs,
+ *     phones, billing amounts).
+ *   - <projectDir>/content-lens-denylist.json (or OSBORN_LENS_DENYLIST=<path>):
+ *       { "terms":    { "[founder]": ["Name", ...], "[client]": [...], "[brand]": [...] },
+ *         "patterns": [ { "re": "regex source", "flags": "gi", "replace": "[tag]" } ] }
+ *     terms match whole words, case-insensitive (incl. possessive 's).
+ *   Client company names are redacted BY DEFAULT (denylist "[client]" terms +
+ *   any legal-suffixed company name). There is no per-project allowlist: the
+ *   only override is the per-piece `reveal` option at draft/render time.
+ */
+export declare const DENYLIST_FILE = "content-lens-denylist.json";
+export interface RedactRule {
+    re: RegExp;
+    replace: string | ((m: string, ...a: any[]) => string);
+}
+/** Shape-based defaults. Order matters: specific shapes first. */
+export declare const DEFAULT_PATTERNS: RedactRule[];
+export interface ClientRedactor {
+    rules: RedactRule[];
+    terms: number;
+    source: string | null;
+    redact: (text: string) => string;
+}
+export interface RedactorOptions {
+    /**
+     * PER-PIECE opt-in un-redaction: denylisted terms to leave visible for ONE
+     * named draft/render (e.g. reveal: ["Audos"]). Never used by extraction —
+     * the profile and samples are always stored fully redacted. A renderer that
+     * reveals re-pulls the quote rows from session.db by row # and redacts them
+     * with this option, in memory, for that piece only.
+     */
+    reveal?: string[];
+}
+/** Load the denylist (project dir or OSBORN_LENS_DENYLIST) + defaults. Never throws. */
+export declare function loadClientRedactor(projectDir: string | null, opts?: RedactorOptions): ClientRedactor;
+/** True for personal billing talk; ambiguous billing words pass only with technical context (in `text` or `context`). */
+export declare function isBillingText(text: string, context?: string): boolean;
+export declare const isBillingAngle: (a: {
+    title: string;
+    why: string;
+}) => boolean;
+/** Same billing gate for capabilities: name, did and proof. */
+export declare const isBillingCapability: (c: {
+    name: string;
+    did: string;
+    proof: string;
+}) => boolean;
+/** True when any (verified) quote's text talks billing (the item's own fields count as technical context). */
+export declare const hasBillingQuote: (it: {
+    quotes: unknown[];
+}) => boolean;

package/dist/content/lens-redact.js

@@ -0,0 +1,187 @@
+/**
+ * lens-redact.ts — CLIENT/CUSTOMER redaction for the content lens.
+ *
+ * Content may draw on client work (ads-API lessons etc.) but never on who the
+ * client is. Applied twice: (1) to every conversation row BEFORE it is sent to
+ * the model (after the secret sanitizer), (2) to the final entry written to the
+ * profile / sample file. Replacements are generic role tags ([client],
+ * [founder], [ad account], [amount] …) so the technical lesson stays readable.
+ *
+ * Configurable, no names in source:
+ *   - DEFAULT_PATTERNS below: shape-based (emails, act_…, platform IDs, UUIDs,
+ *     phones, billing amounts).
+ *   - <projectDir>/content-lens-denylist.json (or OSBORN_LENS_DENYLIST=<path>):
+ *       { "terms":    { "[founder]": ["Name", ...], "[client]": [...], "[brand]": [...] },
+ *         "patterns": [ { "re": "regex source", "flags": "gi", "replace": "[tag]" } ] }
+ *     terms match whole words, case-insensitive (incl. possessive 's).
+ *   Client company names are redacted BY DEFAULT (denylist "[client]" terms +
+ *   any legal-suffixed company name). There is no per-project allowlist: the
+ *   only override is the per-piece `reveal` option at draft/render time.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const DENYLIST_FILE = 'content-lens-denylist.json';
+const BILLING_WORDS = /\b(invoice[ds]?|invoicing|billing|billed|bill|retainer|payment|paid|refund(?:ed)?|deposit|owe[ds]?|payout|receivable|net[- ]?30)\b/i;
+const ID_CONTEXT = '(?:act_|ad[ _-]?account|account|customer|client[ _-]?customer|mcc|cid|business(?:[ _-]?manager)?|bm|page|ig|instagram|' +
+    'pixel|dataset|catalog|app|sponsoredAccount|organization|campaign|adset|ad[ _-]?set|creative|login[ _-]?customer)';
+/** Shape-based defaults. Order matters: specific shapes first. */
+export const DEFAULT_PATTERNS = [
+    { re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, replace: '[email]' },
+    { re: /\bact_\d{5,}\b/g, replace: '[ad account]' },
+    { re: /\burn:li:(?:sponsoredAccount|sponsoredCampaign|organization|person|company):[A-Za-z0-9_-]+/g, replace: '[linkedin account]' },
+    { re: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi, replace: '[workspace id]' },
+    // Google Ads customer / MCC ids (123-456-7890) when an account word is nearby; otherwise a phone.
+    {
+        re: new RegExp(`(${ID_CONTEXT}[^\\n]{0,30}?)\\b\\d{3}-\\d{3}-\\d{4}\\b`, 'gi'),
+        replace: (_m, pre) => `${pre}[ad account]`,
+    },
+    // Labelled platform ids: "page id 1234567890", "pixel: 123…", "IG 1784…", "customer_id=…".
+    {
+        re: new RegExp(`(${ID_CONTEXT}[\\s_-]*(?:id|ids|#|number)?["'\`]?\\s*[:=#]?\\s*["'\`]?)\\d{6,20}\\b`, 'gi'),
+        replace: (_m, pre) => `${pre}[account id]`,
+    },
+    // Bare long numeric ids (Meta business/page/IG/pixel ids are 15-17 digits).
+    { re: /(?<![\d.:-])\d{15,20}(?![\d.])/g, replace: '[account id]' },
+    // Phone numbers: +country forms and (555) 555-5555 / 555-555-5555 / 555.555.5555.
+    { re: /\+\d{1,3}[\s.-]?\(?\d{2,4}\)?[\s.-]?\d{3,4}[\s.-]?\d{3,4}\b/g, replace: '[phone]' },
+    { re: /(?<![\d-])\(?\b\d{3}\)?[\s.-]\d{3}[.-]\d{4}\b(?![\d-])/g, replace: '[phone]' },
+];
+/** $ amounts only on lines that talk about invoices/billing/payments (API pricing stays). */
+function redactBillingAmounts(text) {
+    if (!BILLING_WORDS.test(text))
+        return text;
+    return text
+        .split('\n')
+        .map(line => (BILLING_WORDS.test(line) ? line.replace(/(?:US)?\$\s?\d[\d,]*(?:\.\d+)?(?:[kKmM]\b)?/g, '[amount]') : line))
+        .join('\n');
+}
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+function termRule(term, tag) {
+    const t = term.trim();
+    if (t.length < 2)
+        return null;
+    return { re: new RegExp(`(?<![A-Za-z0-9_])${escapeRe(t)}(?:'s|’s)?(?![A-Za-z0-9_])`, 'gi'), replace: tag };
+}
+/** Load the denylist (project dir or OSBORN_LENS_DENYLIST) + defaults. Never throws. */
+export function loadClientRedactor(projectDir, opts = {}) {
+    const reveal = new Set((opts.reveal ?? []).map(s => s.trim().toLowerCase()).filter(Boolean));
+    const rules = [];
+    let terms = 0;
+    let source = null;
+    const path = process.env.OSBORN_LENS_DENYLIST || (projectDir ? join(projectDir, DENYLIST_FILE) : '');
+    if (path && existsSync(path)) {
+        try {
+            const cfg = JSON.parse(readFileSync(path, 'utf-8'));
+            source = path;
+            // Longest terms first so "Acme Labs" wins over "Acme".
+            const pairs = [];
+            for (const [tag, list] of Object.entries(cfg?.terms ?? {})) {
+                if (!Array.isArray(list))
+                    continue;
+                const label = /^\[.*\]$/.test(tag) ? tag : `[${tag}]`;
+                for (const term of list)
+                    if (typeof term === 'string')
+                        pairs.push([term, label]);
+            }
+            pairs.sort((a, b) => b[0].length - a[0].length);
+            for (const [term, label] of pairs) {
+                if (reveal.has(term.trim().toLowerCase()))
+                    continue;
+                const r = termRule(term, label);
+                if (r) {
+                    rules.push(r);
+                    terms++;
+                }
+            }
+            for (const p of Array.isArray(cfg?.patterns) ? cfg.patterns : []) {
+                try {
+                    const flags = String(p?.flags ?? 'gi');
+                    rules.push({ re: new RegExp(String(p.re), flags.includes('g') ? flags : flags + 'g'), replace: String(p?.replace ?? '[redacted]') });
+                }
+                catch {
+                    /* skip a bad pattern, keep the rest */
+                }
+            }
+        }
+        catch {
+            /* unreadable denylist → defaults only */
+        }
+    }
+    rules.push(...DEFAULT_PATTERNS);
+    // Default-on: legal-suffixed company names ("Acme Labs Inc", "Foo LLC") are clients
+    // unless revealed for this piece. Named clients without a suffix live in the denylist.
+    rules.push({
+        re: /\b(?:[A-Z][A-Za-z0-9&'-]+\s){1,3}(?:Inc|LLC|L\.L\.C|Ltd|Limited|Corp|Corporation|GmbH|S\.A|SAS|BV|PLC|Pty)\b\.?/g,
+        replace: (m) => (reveal.has(m.replace(/\s+(Inc|LLC|L\.L\.C|Ltd|Limited|Corp|Corporation|GmbH|S\.A|SAS|BV|PLC|Pty)\.?$/, '').trim().toLowerCase()) ? m : '[client]'),
+    });
+    const redact = (text) => {
+        let out = text;
+        for (const r of rules)
+            out = out.replace(r.re, r.replace);
+        return redactBillingAmounts(out);
+    };
+    return { rules, terms, source, redact };
+}
+/**
+ * Billing gate. PERSONAL money talk is never content material; billing as an
+ * ENGINEERING topic is.
+ *   - BILLING_PERSONAL: always dropped, whatever the context: personal invoicing,
+ *     retainers, refunds owed, overdue / unpaid / late fees, contract or rate
+ *     negotiation, money owed to or by the user.
+ *   - BILLING_AMBIGUOUS words (invoice, billing, payment, refund …): dropped UNLESS
+ *     the same item carries technical context (BILLING_TECH): Stripe/payment
+ *     webhook or API integration, billing API, payment gateway, ads-API billed
+ *     spend / budget / spend caps / pricing, token pricing, rate limits, wallet holds.
+ */
+const BILLING_PERSONAL = new RegExp([
+    'retainers?',
+    'accounts? receivable',
+    'late fees?',
+    'overdue',
+    'unpaid',
+    'past[- ]due',
+    'outstanding (?:balance|invoices?|payments?)',
+    'net[- ]?(?:15|30|45|60)\\b',
+    'refunds? (?:owed|due)',
+    '(?:owe[sd]?|owing) (?:me|us|you|him|her|them)\\b',
+    '(?:i|we|they|he|she|you) (?:still )?owe\\b',
+    'money (?:owed|due)',
+    '(?:get|gets|getting|got) paid',
+    '(?:pay|pays|paying|paid) (?:me|us)\\b(?! back)',
+    "(?:hasn['’]t|haven['’]t|didn['’]t|never|not) (?:been )?paid",
+    'send(?:s|ing)? (?:the |an |my |our |this )?invoices? to\\b',
+    '(?:invoic\\w*|bill(?:ed|ing)?|charg(?:e|ed|ing)) (?:the |my |our |a |this |that |each )?clients?\\b',
+    'invoic\\w* (?:them|him|her)\\b',
+    'client (?:billing|invoices?|invoicing|payments?)\\b',
+    '(?:hourly|day|daily|consulting|freelance|my|our) rates?\\b(?![- ]?limit)',
+    'rate card',
+    '(?:my|our|consulting|freelance) fees?\\b',
+    'negotiat\\w* (?:the |my |our |a |their |his |her )?(?:rates?|contract|fees?|price|pricing|deal|retainer|terms|salary)\\b(?![- ]?limit)',
+    '(?:rate|contract|fee|price|pricing|salary) negotiations?',
+    'contract (?:rate|terms|renewal|value)',
+    'statement of work',
+].map(s => `\\b${s}`).join('|'), 'i');
+const BILLING_AMBIGUOUS = /\b(invoice[ds]?|invoicing|billing|billed|bill|payments?|paid|refunds?|refunded|chargebacks?|payouts?)\b/i;
+const BILLING_TECH = new RegExp([
+    'stripe', 'webhooks?', 'apis?', 'sdk', 'endpoints?', 'gateway', 'integrations?', 'idempoten\\w*',
+    'spend(?: caps?)?', 'spending limits?', 'budgets?', 'pricing', 'per[- ]million', 'tokens?', 'rate[- ]limit\\w*',
+    'quotas?', 'wallets?', 'meta ads', 'google ads', 'linkedin ads', 'ads? accounts?', 'campaigns?',
+    'openrouter', 'schema', 'migrations?', 'cron', 'queues?',
+].map(s => `\\b${s}\\b`).join('|'), 'i');
+/** True for personal billing talk; ambiguous billing words pass only with technical context (in `text` or `context`). */
+export function isBillingText(text, context = '') {
+    if (BILLING_PERSONAL.test(text))
+        return true;
+    return BILLING_AMBIGUOUS.test(text) && !BILLING_TECH.test(`${text} ${context}`);
+}
+export const isBillingAngle = (a) => isBillingText(`${a.title} ${a.why}`);
+/** Same billing gate for capabilities: name, did and proof. */
+export const isBillingCapability = (c) => isBillingText(`${c.name} ${c.did} ${c.proof}`);
+/** True when any (verified) quote's text talks billing (the item's own fields count as technical context). */
+export const hasBillingQuote = (it) => {
+    if (!Array.isArray(it.quotes))
+        return false;
+    const o = it;
+    const ctx = ['title', 'why', 'name', 'did', 'proof'].map(k => (typeof o[k] === 'string' ? o[k] : '')).join(' ');
+    return it.quotes.some(q => typeof q?.text === 'string' && isBillingText(q.text, ctx));
+};

package/dist/content/lens-strip.d.ts

@@ -0,0 +1,33 @@
+/**
+ * lens-strip.ts — strip every INJECTED / SUMMARISED context from a raw
+ * session.db conversation row before it can reach the content lens. Pure.
+ *
+ * The lens must see only what the person and the assistant actually said.
+ * Harness injections live in USER-type rows (the SDK/pipeline prepends or
+ * appends them to the real utterance), so the block strippers run on user rows
+ * only — assistant text is never altered here (it may legitimately mention a
+ * tag name; secret/client redaction still applies to it downstream).
+ *
+ * Kinds (counted per affected row):
+ *   compaction-summary  "This session is being continued from a previous conversation…",
+ *                       or a line-start "=== HANDOFF_STATE ===" / "=== DECISIONS ===" style section header → row dropped
+ *                       (a bare mention of HANDOFF_STATE in real speech is kept)
+ *   silent-control      "[SYSTEM — SILENT CONTROL MESSAGE…]" orchestrator nudges → row dropped
+ *   session-tail        <session_tail>…</session_tail> blocks (post-compaction replay)
+ *   recalled-context    <recalled_context>…</recalled_context> blocks (recall injection)
+ *   system-reminder     <system-reminder…>…</system-reminder> blocks
+ *   turn-shape          the turn-shape reminder text (prompts/turn-shape-reminder.md)
+ *   task-notification   <task-notification>…</task-notification> blocks
+ *   hook-context        UserPromptSubmit hook additional context (<user-prompt-submit-hook>, labelled lines)
+ * [INTERRUPTED]/[CONTEXT] wrappers are unwrapped afterwards by sanitizeRecord
+ * (transcript-sanitizer.ts), which keeps only the user's own quoted words.
+ */
+export declare const STRIP_KINDS: readonly ["compaction-summary", "silent-control", "session-tail", "recalled-context", "system-reminder", "turn-shape", "task-notification", "hook-context"];
+export type StripKind = (typeof STRIP_KINDS)[number];
+export interface StripResult {
+    /** Remaining text (trimmed), or null when the whole row was injected content. */
+    text: string | null;
+    kinds: StripKind[];
+}
+/** Strip injected context from one row. Assistant rows pass through unchanged. */
+export declare function stripInjected(raw: string, speaker: 'user' | 'assistant'): StripResult;

package/dist/content/lens-strip.js

@@ -0,0 +1,132 @@
+/**
+ * lens-strip.ts — strip every INJECTED / SUMMARISED context from a raw
+ * session.db conversation row before it can reach the content lens. Pure.
+ *
+ * The lens must see only what the person and the assistant actually said.
+ * Harness injections live in USER-type rows (the SDK/pipeline prepends or
+ * appends them to the real utterance), so the block strippers run on user rows
+ * only — assistant text is never altered here (it may legitimately mention a
+ * tag name; secret/client redaction still applies to it downstream).
+ *
+ * Kinds (counted per affected row):
+ *   compaction-summary  "This session is being continued from a previous conversation…",
+ *                       or a line-start "=== HANDOFF_STATE ===" / "=== DECISIONS ===" style section header → row dropped
+ *                       (a bare mention of HANDOFF_STATE in real speech is kept)
+ *   silent-control      "[SYSTEM — SILENT CONTROL MESSAGE…]" orchestrator nudges → row dropped
+ *   session-tail        <session_tail>…</session_tail> blocks (post-compaction replay)
+ *   recalled-context    <recalled_context>…</recalled_context> blocks (recall injection)
+ *   system-reminder     <system-reminder…>…</system-reminder> blocks
+ *   turn-shape          the turn-shape reminder text (prompts/turn-shape-reminder.md)
+ *   task-notification   <task-notification>…</task-notification> blocks
+ *   hook-context        UserPromptSubmit hook additional context (<user-prompt-submit-hook>, labelled lines)
+ * [INTERRUPTED]/[CONTEXT] wrappers are unwrapped afterwards by sanitizeRecord
+ * (transcript-sanitizer.ts), which keeps only the user's own quoted words.
+ */
+export const STRIP_KINDS = [
+    'compaction-summary',
+    'silent-control',
+    'session-tail',
+    'recalled-context',
+    'system-reminder',
+    'turn-shape',
+    'task-notification',
+    'hook-context',
+];
+const COMPACTION_LEAD_RE = /^\s*(?:\[time:[^\]]*\]\s*)?(?:This session is being continued from a previous conversation|Conversation compacted\b)/i;
+/** Only a line-start `=== SECTION ===` header is compaction evidence; a bare mention of a section name is speech. */
+const COMPACTION_SECTION_RE = /^[ \t]*===[ \t]*(?:DECISIONS|GOTCHAS|LEARNINGS|HANDOFF[_ ]STATE|OPEN QUESTIONS|NEXT STEPS)[ \t]*===[ \t]*$/m;
+const SILENT_CONTROL_RE = /^\s*(?:\[time:[^\]]*\]\s*)?\[SYSTEM\s*[—–-]+\s*SILENT CONTROL MESSAGE/i;
+/**
+ * Paired blocks; open tags may carry attributes. An UNTERMINATED opening tag swallows
+ * the rest of the row only when it starts the row or a line — an inline mention
+ * ("the <system-reminder> tag is noisy") is the person's own words and is kept.
+ */
+const BLOCKS = [
+    { kind: 'session-tail', open: /<session_tail\b[^>]*>/g, close: /<\/session_tail>/ },
+    { kind: 'recalled-context', open: /<recalled_context\b[^>]*>/g, close: /<\/recalled_context>/ },
+    { kind: 'system-reminder', open: /<system-reminder\b[^>]*>/g, close: /<\/system-reminder>/ },
+    { kind: 'task-notification', open: /<task-notification\b[^>]*>/g, close: /<\/task-notification>/ },
+    { kind: 'hook-context', open: /<user-prompt-submit-hook\b[^>]*>/g, close: /<\/user-prompt-submit-hook>/ },
+];
+/** What may precede an unterminated open tag on its line for it to count as line-start. */
+const LINE_START_PREFIX_RE = /^\s*(?:\[time:[^\]]*\]\s*)?$/;
+/** Turn-shape reminder: first line of prompts/turn-shape-reminder.md (or its header) → its last line. */
+const TURN_SHAPE_START = /You are thinking with this person, not for them\.|\[TURN-SHAPE REMINDER\b[^\]]*\]/;
+const TURN_SHAPE_END = /The user is a peer thinking with you, not pressing buttons\.?/;
+/** Labelled hook-context paragraphs as Claude Code renders them in transcripts. */
+const HOOK_LINE_RE = /^[ \t]*(?:UserPromptSubmit|SessionStart|PreToolUse|PostToolUse)(?::[^\n]*)? hook additional context:[^\n]*(?:\n(?![ \t]*\n)[^\n]*)*/gim;
+function stripBlock(text, open, close) {
+    let out = text;
+    let hit = false;
+    let from = 0;
+    for (let guard = 0; guard < 50; guard++) {
+        open.lastIndex = from;
+        const o = open.exec(out);
+        if (!o)
+            break;
+        const after = o.index + o[0].length;
+        const c = close.exec(out.slice(after));
+        const lineStart = out.lastIndexOf('\n', o.index - 1) + 1;
+        const atLineStart = LINE_START_PREFIX_RE.test(out.slice(lineStart, o.index));
+        // An inline open whose "close" belongs to a later, re-opened block is a mention, not a block.
+        const reopened = c ? new RegExp(open.source).test(out.slice(after, after + c.index)) : false;
+        let end;
+        if (c && (atLineStart || !reopened)) {
+            end = after + c.index + c[0].length;
+        }
+        else if (!c && atLineStart) {
+            end = out.length;
+        }
+        else {
+            from = after; // inline mention: keep it
+            continue;
+        }
+        hit = true;
+        out = out.slice(0, o.index) + '\n' + out.slice(end);
+        from = o.index;
+    }
+    open.lastIndex = 0;
+    return { text: out, hit };
+}
+/** Strip injected context from one row. Assistant rows pass through unchanged. */
+export function stripInjected(raw, speaker) {
+    const text0 = raw ?? '';
+    if (speaker !== 'user')
+        return { text: text0.trim() || null, kinds: [] };
+    const kinds = [];
+    // Whole-row injections first (no genuine user words in them).
+    if (SILENT_CONTROL_RE.test(text0))
+        return { text: null, kinds: ['silent-control'] };
+    let text = text0;
+    for (const b of BLOCKS) {
+        const r = stripBlock(text, b.open, b.close);
+        if (r.hit) {
+            text = r.text;
+            kinds.push(b.kind);
+        }
+    }
+    // A compaction summary is judged on what is left once replay blocks are gone.
+    // [INTERRUPTED]/[CONTEXT] wrappers quote the assistant's own recent messages, which may
+    // mention these markers — those rows are unwrapped by sanitizeRecord instead, never dropped here.
+    const wrapper = /^\s*(?:\[time:[^\]]*\]\s*)?\[(?:INTERRUPTED|CONTEXT)\]/.test(text);
+    if (COMPACTION_LEAD_RE.test(text) || (!wrapper && COMPACTION_SECTION_RE.test(text)))
+        return { text: null, kinds: [...kinds, 'compaction-summary'] };
+    if (SILENT_CONTROL_RE.test(text))
+        return { text: null, kinds: [...kinds, 'silent-control'] };
+    const ts = TURN_SHAPE_START.exec(text);
+    if (ts) {
+        const rest = text.slice(ts.index);
+        const te = TURN_SHAPE_END.exec(rest);
+        const end = te ? ts.index + te.index + te[0].length : text.length;
+        text = text.slice(0, ts.index) + '\n' + text.slice(end);
+        kinds.push('turn-shape');
+    }
+    const hooked = text.replace(HOOK_LINE_RE, '');
+    if (hooked !== text) {
+        text = hooked;
+        if (!kinds.includes('hook-context'))
+            kinds.push('hook-context');
+    }
+    const out = text.replace(/\n{3,}/g, '\n\n').trim();
+    return { text: out || null, kinds };
+}

package/dist/content/period-run.d.ts

@@ -0,0 +1,30 @@
+/**
+ * period-run.ts — run the PERIOD MAP for one session. Stages (each its own module,
+ * swappable / rerunnable alone):
+ *   1. block loader   lens-db.loadConversationRows + lens-period-block.selectBlock
+ *   2. strip/redact   lens-strip (inside loadConversationRows) + secret/client redaction
+ *   3. period map     lens-period (one OpenRouter call, quotes verified deterministically)
+ *   4. audio (opt.)   lens-audio AudioAdapter — offsets only when a recording exists
+ *   5. render         lens-period-render → review .md (redacted again)
+ * OpenRouter only. Hard cap: 1 call, $0.50. Never writes content-profile.md or the HWM.
+ *
+ * CLI: npx tsx agent/src/content/period-run.ts --session <id> --out <file.md>
+ *        [--since 24h|ISO] [--until ISO] [--from-row N] [--dry]
+ */
+import { type AudioAdapter } from './lens-audio.js';
+import { type PeriodRunReport } from './lens-period-render.js';
+export declare const PERIOD_CAP_USD = 0.5;
+export interface PeriodOptions {
+    sessionId: string;
+    outPath: string;
+    since?: string;
+    until?: string;
+    fromRowId?: number;
+    /** Inclusive end row (with fromRowId) — the library step's closed period. */
+    toRowId?: number;
+    /** Block stats only — no model call. */
+    dry?: boolean;
+    audio?: AudioAdapter;
+    log?: (m: string) => void;
+}
+export declare function runPeriodMap(o: PeriodOptions): Promise<PeriodRunReport>;