session-steward 0.9.0 → 0.10.0

package/lib/providers/claude-code/events.mjs

@@ -31,6 +31,8 @@ const RECORD_CLASSIFICATION = Object.freeze({
 const SKIPPED_CONTENT_TYPES = new Set(["attachment", "image", "thinking"]);
 const SKIPPED_RECORD_TYPES = new Set([
   "attachment",
+  "atis-latch",
+  "bridge-session",
   "custom-title",
   "file-history-snapshot",
   "frame-link",

package/lib/providers/claude-code/store.mjs

@@ -18,7 +18,7 @@ const COMPATIBILITY_PROFILE = Object.freeze({
   id: "claude-local-store-2026-08",
   builtFor: {
     claudeCli: ["2.1.199", "2.1.220", "2.1.228", "2.1.237"],
-    claudeDesktop: ["1.24012.9", "1.28929.0", "1.32885.1"],
+    claudeDesktop: ["1.24012.9", "1.28929.0", "1.32885.1", "1.40609.0"],
   },
 });
 const SUPPORTED_ENTRYPOINTS = new Set(["cli", "claude-desktop"]);
@@ -831,10 +831,18 @@ async function createBackup(plan, store, scope) {
 
 export async function executeSessionDeletion({ onProgress = () => {}, plan, scope, shouldCancel = () => false, store }) {
   onProgress({ canCancel: true, message: "Creating recovery backup", phase: "backup", progress: 8 });
-  const backupDirectory = await createBackup(plan, store, scope);
+  let backupDirectory;
   try {
-    if (shouldCancel()) { const error = new Error("Cleanup cancelled."); error.cancelled = true; error.backupDirectory = backupDirectory; throw error; }
+    backupDirectory = await createBackup(plan, store, scope);
+  } catch (error) {
+    error.mutationStarted = false;
+    throw error;
+  }
+  let mutationStarted = false;
+  try {
+    if (shouldCancel()) { const error = new Error("Cleanup cancelled."); error.cancelled = true; error.backupDirectory = backupDirectory; error.mutationStarted = false; throw error; }
     onProgress({ canCancel: false, message: "Removing selected session data", phase: "cleanup", progress: 55 });
+    mutationStarted = true;
     if (plan.historyMatchCount && await exists(store.paths.historyPath)) {
       const ids = new Set(plan.ids);
       await rewriteJsonlFile(store.paths.historyPath, (entry) => !entry.parsed || !ids.has(entry.parsed.sessionId ?? entry.parsed.session_id));
@@ -852,6 +860,7 @@ export async function executeSessionDeletion({ onProgress = () => {}, plan, scop
     };
   } catch (error) {
     error.backupDirectory = backupDirectory;
+    error.mutationStarted ??= mutationStarted;
     throw error;
   }
 }

package/lib/providers/codex/database-families.mjs

@@ -8,7 +8,7 @@ const CACHE_TTL_MS = 2_000;
 export const CODEX_DATABASE_PROFILE = Object.freeze({
   id: "codex-local-store-2026-08",
   builtFor: {
-    chatgptDesktop: ["26.727.40816", "26.803.61601", "26.818.21641", "26.818.22352"],
+    chatgptDesktop: ["26.727.40816", "26.803.61601", "26.818.21641", "26.818.22352", "26.825.41651"],
     codexCli: ["0.144.1", "0.146.0", "0.147.0", "0.148.0"],
   },
 });

package/lib/providers/codex/store.mjs

@@ -1515,6 +1515,7 @@ export async function loadDeletionStore({ codexHome, recordIds }) {
     stateDatabasePath: paths.stateDatabasePath,
     stateDatabasePaths: paths.stateDatabasePaths,
     stateDatabases: paths.stateDatabases,
+    threadWriterLocksDirectory: paths.threadWriterLocksDirectory,
     resolvedDatabases: paths.resolvedDatabases,
     logsDatabasePaths: paths.logsDatabasePaths,
     memoryDatabasePaths: paths.memoryDatabasePaths,
@@ -2457,13 +2458,14 @@ async function createOperationBackup({ onProgress, plan, scope, store }) {
   return backupDirectory;
 }
 
-function cleanupErrorWithBackup(error, backupDirectory) {
+function cleanupErrorWithBackup(error, backupDirectory, { mutationStarted = false } = {}) {
   const detail = error instanceof Error ? error.message : "The cleanup could not be completed.";
   const wrappedError = new Error(
     `Cleanup stopped after the backup was created. Backup: ${backupDirectory}. ${detail}`,
     { cause: error },
   );
   wrappedError.backupDirectory = backupDirectory;
+  wrappedError.mutationStarted = mutationStarted;
   return wrappedError;
 }
 
@@ -2655,7 +2657,7 @@ export async function executeSessionDeletion({
       skippedTranscriptPaths,
     };
   } catch (error) {
-    throw cleanupErrorWithBackup(error, backupDirectory);
+    throw cleanupErrorWithBackup(error, backupDirectory, { mutationStarted: true });
   }
 }
 

package/lib/server.mjs

@@ -1,18 +1,23 @@
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { execFileSync } from "node:child_process";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { getProvider, listProviders } from "./providers/index.mjs";
+import { getInstalledProductVersions } from "./installed-products.mjs";
 import {
   DEFAULT_SESSION_EVENT_LIMIT,
   MAX_SESSION_EVENT_LIMIT,
 } from "./session-event-reader.mjs";
 import { createProviderSettings } from "./settings.mjs";
 import { classifyInstalledVersion } from "./version-support.mjs";
-import { getCommandInvocation } from "./platform.mjs";
+import {
+  acquireSessionMutationLock,
+  executePreparedSessionCleanup,
+  prepareSessionCleanup,
+  SESSION_CLEANUP_REVIEW_REQUIRED,
+} from "./session-cleanup.mjs";
 
 const MAX_BODY_BYTES = 64 * 1024;
 const ALLOWED_SCOPES = new Set(["core", "deep"]);
@@ -21,9 +26,9 @@ const OPERATION_TTL_MS = 60 * 60 * 1000;
 const MAX_SAVED_PLANS = 20;
 const MAX_SAVED_OPERATIONS = 50;
 const PLAN_RECORD_SAMPLE_LIMIT = 20;
-const PLAN_REVIEW_REQUIRED = "DELETION_PLAN_REVIEW_REQUIRED";
+const PLAN_REVIEW_REQUIRED = SESSION_CLEANUP_REVIEW_REQUIRED;
 const SESSION_OVERVIEW_TTL_MS = 45 * 1000;
-const ALLOWED_INACTIVE_DAYS = new Set([30, 60, 90]);
+const MAX_INACTIVE_DAYS = 3_650;
 const ALLOWED_ARCHIVE_STATUSES = new Set(["all", "active", "archived"]);
 const ALLOWED_SORTS = new Set(["created", "cwd", "name", "size", "updated"]);
 const publicDirectory = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "dist");
@@ -31,47 +36,6 @@ const staticAssets = new Map([
   ["/", { fileName: "index.html", contentType: "text/html; charset=utf-8" }],
 ]);
 
-function readCommandVersion(command, args) {
-  try {
-    const invocation = getCommandInvocation(command, args);
-    return execFileSync(invocation.command, invocation.args, {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      windowsHide: invocation.windowsHide,
-    }).trim() || null;
-  } catch {
-    return null;
-  }
-}
-
-async function getInstalledProductVersions() {
-  const versions = {
-    chatgptDesktop: null,
-    claudeCli: readCommandVersion("claude", ["--version"]),
-    claudeDesktop: null,
-    codexCli: readCommandVersion("codex", ["--version"]),
-  };
-
-  if (process.platform !== "darwin") {
-    return versions;
-  }
-
-  const chatGptInfoPath = "/Applications/ChatGPT.app/Contents/Info.plist";
-  const claudeInfoPath = "/Applications/Claude.app/Contents/Info.plist";
-  try {
-    await fs.access(chatGptInfoPath);
-    versions.chatgptDesktop = readCommandVersion("/usr/libexec/PlistBuddy", ["-c", "Print :CFBundleShortVersionString", chatGptInfoPath]);
-  } catch {
-  }
-  try {
-    await fs.access(claudeInfoPath);
-    versions.claudeDesktop = readCommandVersion("/usr/libexec/PlistBuddy", ["-c", "Print :CFBundleShortVersionString", claudeInfoPath]);
-  } catch {
-  }
-
-  return versions;
-}
-
 function providerOptions(providerId, home) {
   return providerId === "codex" ? { codexHome: home } : { claudeHome: home };
 }
@@ -220,8 +184,8 @@ function getInactiveBeforeMs(value) {
 
   const days = Number(value);
 
-  if (!ALLOWED_INACTIVE_DAYS.has(days)) {
-    throw new Error("Last activity must be 30, 60, or 90 days.");
+  if (!Number.isSafeInteger(days) || days < 1 || days > MAX_INACTIVE_DAYS) {
+    throw new Error(`Last activity must be a whole number between 1 and ${MAX_INACTIVE_DAYS} days.`);
   }
 
   return Date.now() - days * 24 * 60 * 60 * 1000;
@@ -490,72 +454,26 @@ export async function startLocalServer({ claudeHome, codexHome, configDirectory,
     operation.phase = "preflight";
     operation.progress = 2;
 
+    let releaseMutationLock;
     try {
       const provider = getProvider(savedPlan.providerId);
       const options = providerOptions(savedPlan.providerId, savedPlan.home);
-      let currentStore;
-
-      try {
-        currentStore = await provider.loadDeletionStore({
-          ...options,
-          recordIds: savedPlan.requestedIds,
-        });
-      } catch (error) {
-        if (error?.message === "One or more selected sessions are no longer available.") {
-          throw codedError(
-            "The selected sessions changed after this preview. Review the selection again.",
-            PLAN_REVIEW_REQUIRED,
-          );
-        }
-        throw error;
-      }
-
-      const currentPlan = await provider.planSessionDeletion({
-        recordIds: savedPlan.requestedIds,
-        store: currentStore,
-      });
-      const currentFingerprint = await provider.fingerprintSessionDeletion({
-        plan: currentPlan,
-        scope: savedPlan.scope,
-        store: currentStore,
-      });
-
-      if (currentFingerprint !== savedPlan.fingerprint) {
-        throw codedError(
-          "Session data changed after this preview. Review the selection again.",
-          PLAN_REVIEW_REQUIRED,
-        );
-      }
-
-      await provider.preflightSessionDeletion({
-        plan: currentPlan,
-        scope: savedPlan.scope,
-        store: currentStore,
-      });
-
-      if (savedPlan.scope === "deep") {
-        await provider.assertDeepCleanupSupported(options);
-      }
-
-      const result = await provider.executeSessionDeletion({
+      releaseMutationLock = await acquireSessionMutationLock({ options, provider });
+      const execution = await executePreparedSessionCleanup({
+        expectedFingerprint: savedPlan.fingerprint,
         onProgress: (update) => Object.assign(operation, update),
-        plan: currentPlan,
+        options,
+        provider,
+        recordIds: savedPlan.requestedIds,
         scope: savedPlan.scope,
         shouldCancel: () => operation.cancelRequested,
-        store: currentStore,
       });
+      const result = execution.deletion;
       operation.backupDirectory = result.backupDirectory;
       operation.backupDirectories = [result.backupDirectory];
       operation.result = summarizeDeletionResult(result);
       operation.canCancel = false;
-      operation.message = "Checking that cleanup completed";
-      operation.phase = "verification";
-      operation.progress = 94;
-      const verification = await provider.verifySessionDeletion({
-        plan: currentPlan,
-        scope: savedPlan.scope,
-        store: currentStore,
-      });
+      const verification = execution.verification;
       operation.verification = summarizeVerification(verification);
       operation.progress = 100;
 
@@ -596,6 +514,9 @@ export async function startLocalServer({ claudeHome, codexHome, configDirectory,
         operation.status = "failed";
       }
     } finally {
+      const terminalStatus = operation.status;
+      operation.status = "running";
+      await releaseMutationLock?.().catch(() => {});
       getProvider(savedPlan.providerId).invalidateSessionCache?.(
         providerOptions(savedPlan.providerId, savedPlan.home),
       );
@@ -604,6 +525,7 @@ export async function startLocalServer({ claudeHome, codexHome, configDirectory,
       deletionPlans.delete(savedPlan.id);
       operation.finishedAtMs = Date.now();
       if (activeOperationId === operation.id) activeOperationId = null;
+      operation.status = terminalStatus;
     }
   }
 
@@ -653,10 +575,14 @@ export async function startLocalServer({ claudeHome, codexHome, configDirectory,
     operation.status = "restoring";
     activeOperationId = operation.id;
     const task = (async () => {
+      let releaseMutationLock;
       try {
-        const restoreResult = await getProvider(operation.providerId).restoreSessionDeletionBackup({
+        const provider = getProvider(operation.providerId);
+        const options = providerOptions(operation.providerId, operation.home);
+        releaseMutationLock = await acquireSessionMutationLock({ options, provider });
+        const restoreResult = await provider.restoreSessionDeletionBackup({
           backupDirectory: operation.backupDirectory,
-          ...providerOptions(operation.providerId, operation.home),
+          ...options,
           onProgress: (update) => Object.assign(operation, update),
         });
         operation.restoreResult = restoreResult;
@@ -685,12 +611,16 @@ export async function startLocalServer({ claudeHome, codexHome, configDirectory,
         operation.message = "Restore could not be completed";
         operation.status = "restore-failed";
       } finally {
+        const terminalStatus = operation.status;
+        operation.status = "restoring";
+        await releaseMutationLock?.().catch(() => {});
         getProvider(operation.providerId).invalidateSessionCache?.(
           providerOptions(operation.providerId, operation.home),
         );
         invalidateSessionOverview();
         operation.finishedAtMs = Date.now();
         if (activeOperationId === operation.id) activeOperationId = null;
+        operation.status = terminalStatus;
       }
     })();
     activeTasks.add(task);
@@ -935,26 +865,23 @@ export async function startLocalServer({ claudeHome, codexHome, configDirectory,
         const home = settings.getHome(providerId);
         const options = providerOptions(providerId, home);
 
-        if (scope === "deep") {
-          await provider.assertDeepCleanupSupported(options);
-        }
-
-        const store = await provider.loadDeletionStore({
-          ...options,
+        const prepared = await prepareSessionCleanup({
+          options,
+          provider,
           recordIds: ids,
+          scope,
         });
-        const plan = await provider.planSessionDeletion({ recordIds: ids, store });
-        const preflight = await provider.preflightSessionDeletion({ plan, scope, store });
+        const { plan, preflight } = prepared;
         const id = randomBytes(18).toString("base64url");
         const expiresAtMs = Date.now() + PLAN_TTL_MS;
         const savedPlan = {
           home,
           consumed: false,
           expiresAtMs,
-          fingerprint: await provider.fingerprintSessionDeletion({ plan, scope, store }),
+          fingerprint: prepared.fingerprint,
           id,
           providerId,
-          requestedIds: ids,
+          requestedIds: prepared.requestedIds,
           scope,
         };
         removeExpiredEntries(deletionPlans, PLAN_TTL_MS, MAX_SAVED_PLANS);
@@ -1043,17 +970,24 @@ export async function startLocalServer({ claudeHome, codexHome, configDirectory,
           }
 
           mutationInProgress = true;
+          let releaseMutationLock;
+          let responsePayload;
           try {
+            const provider = getProvider(operation.providerId);
+            const options = providerOptions(operation.providerId, operation.home);
+            releaseMutationLock = await acquireSessionMutationLock({ options, provider });
             if (!(await removeOperationBackups(operation))) {
               throw new Error("The recovery backup could not be deleted.");
             }
             operation.backupDeleteError = null;
             operation.canRestore = false;
             if (operation.result) operation.result.recoveryBackupDeleted = true;
-            sendJson(response, 200, { operation: publicOperation(operation) });
+            responsePayload = { operation: publicOperation(operation) };
           } finally {
+            await releaseMutationLock?.().catch(() => {});
             mutationInProgress = false;
           }
+          sendJson(response, 200, responsePayload);
           return;
         }