testeiya 0.2.1 → 0.3.9

package/src/prompt/index.ts

@@ -1,62 +0,0 @@
-import { getSystemPrompt } from "./system-prompt.js";
-import {
-  testomatioTms,
-  testomatioConnection,
-  testomatioNotConnected,
-  projectSettings,
-} from "./testomatio.js";
-import { appUiGuidance } from "./app-ui.js";
-import { browserControl } from "./browser.js";
-import {
-  contextPromptSection,
-  type ContextEntry,
-  type ContextFolder,
-} from "../context-store.js";
-import type { TestomatioProjectInfo } from "../project-info.js";
-
-export function buildSystemPrompt(options?: SystemPromptOptions): string {
-  // The base prompt (role, workspace, tools, goals) comes first — it defines who
-  // the agent is. Specialized rules layer on after it, dynamic context goes last.
-  const parts: string[] = [getSystemPrompt(options?.cwd)];
-
-  const tokenSlugs = options?.tokens ? Object.keys(options.tokens) : [];
-  // The TUI passes no `connection`, so it keeps the managed-tokens gating.
-  const tokenAvailable = options?.connection?.tokenAvailable ?? tokenSlugs.length > 0;
-  if (tokenSlugs.length > 0) parts.push(testomatioTms);
-  if (options?.mode === "web") parts.push(appUiGuidance);
-  if (options?.browser) parts.push(browserControl);
-
-  if (options?.promptContext) {
-    parts.push(`## Project Test Context\n\n${options.promptContext}`);
-  }
-  if (options?.contextEntries?.length || options?.contextFolders?.length) {
-    parts.push(
-      contextPromptSection(options.contextEntries ?? [], options.contextFolders ?? [])
-    );
-  }
-  if (options?.projectInfo) {
-    parts.push(projectSettings(options.projectInfo));
-  }
-  if (tokenAvailable || tokenSlugs.length > 0) {
-    parts.push(testomatioConnection(tokenSlugs, options?.backendUrl, options?.connection));
-  } else if (options?.mode === "web") {
-    parts.push(testomatioNotConnected());
-  }
-
-  return parts.join("\n\n");
-}
-
-export interface SystemPromptOptions {
-  cwd?: string;
-  promptContext?: string;
-  backendUrl?: string;
-  tokens?: Record<string, string>;
-  connection?: { tokenAvailable?: boolean; projectId?: string; title?: string };
-  mode?: "tui" | "web";
-  browser?: boolean;
-  projectInfo?: TestomatioProjectInfo | null;
-  /** User-added context (linked folders, cloned repos, uploaded docs). */
-  contextEntries?: ContextEntry[];
-  /** Non-empty predefined `.testeiya` context folders (manual-tests, code, …). */
-  contextFolders?: ContextFolder[];
-}

package/src/server-info.ts

@@ -1,62 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { HOME_DIR } from "./project-dir.js";
-
-/*
- * Publishes where the running app-server is reachable so an out-of-band tool
- * (the `testeiya-debug` skill, `scripts/debug-snapshot.ts`) can find it — the
- * desktop app binds a random free port (`port: 0`) that is otherwise written
- * nowhere. `writeServerInfo` is called once the port is known; the file is
- * best-effort removed on exit. Only the latest instance is recorded.
- */
-
-export const SERVER_INFO_FILE = join(HOME_DIR, "server.json");
-
-export function writeServerInfo(info: ServerInfo): void {
-  try {
-    if (!existsSync(HOME_DIR)) mkdirSync(HOME_DIR, { recursive: true });
-    writeFileSync(SERVER_INFO_FILE, JSON.stringify(info, null, 2));
-  } catch {}
-  for (const signal of ["exit", "SIGINT", "SIGTERM"] as const) {
-    process.once(signal, clearServerInfo);
-  }
-}
-
-export function readServerInfo(): ServerInfo | null {
-  let info: ServerInfo;
-  try {
-    if (!existsSync(SERVER_INFO_FILE)) return null;
-    info = JSON.parse(readFileSync(SERVER_INFO_FILE, "utf8")) as ServerInfo;
-  } catch {
-    return null;
-  }
-  // A server killed with SIGKILL (or a crash) never runs the exit cleanup, so a
-  // stale file can point at a dead port. Ignore it unless its pid is alive.
-  if (!isProcessAlive(info.pid)) return null;
-  return info;
-}
-
-function isProcessAlive(pid: number): boolean {
-  if (!pid) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return (err as { code?: string })?.code === "EPERM";
-  }
-}
-
-function clearServerInfo(): void {
-  try {
-    rmSync(SERVER_INFO_FILE, { force: true });
-  } catch {}
-}
-
-export interface ServerInfo {
-  port: number;
-  pid: number;
-  url: string;
-  mode: string;
-  startedAt: string;
-  logFile?: string | null;
-}

package/src/session-factory.ts

@@ -1,442 +0,0 @@
-import { join } from "node:path";
-import { mkdirSync } from "node:fs";
-
-import {
-  createAgentSession,
-  AuthStorage,
-  ModelRegistry,
-  Settings,
-  SessionManager,
-} from "@oh-my-pi/pi-coding-agent";
-import type { ExtensionFactory } from "@oh-my-pi/pi-coding-agent";
-import { hasPlaywrightCli, loadBundledSkills, loadCustomSkills, dedupeSkillsByName } from "./skills.js";
-import { SOURCE_PATHS } from "@oh-my-pi/pi-coding-agent/discovery/helpers";
-import { DEFAULT_MODEL_PER_PROVIDER } from "@oh-my-pi/pi-ai";
-import { PROJECT_DIR, HOME_DIR, ensureProjectDirGuards } from "./project-dir.js";
-
-// Rebrand the SDK's project-level config dir from `.omp` to `.testeiya`.
-// The SDK has no supported override for this (PI_CONFIG_DIR only affects the
-// user-level config root; `SOURCE_PATHS.native.projectDir` is a static const
-// with no env/option hook). This is a deliberate in-process monkey patch:
-//   - `SOURCE_PATHS` is a plain object (`as const` is TS-only, not frozen),
-//   - the builtin discovery provider holds a *live reference* via
-//     `const PATHS = SOURCE_PATHS.native` and reads `.projectDir` at call time,
-//   - so mutating it once at module load (before any createAgentSession() runs)
-//     redirects MCP/skills/rules/AGENTS discovery to `<cwd>/.testeiya/*`.
-// No node_modules edits; survives reinstalls. If an SDK upgrade changes these
-// internals, the MCP-connectivity check in our session smoke test is the guard.
-if (SOURCE_PATHS.native.projectDir !== PROJECT_DIR) {
-  (SOURCE_PATHS.native as { projectDir: string }).projectDir = PROJECT_DIR;
-}
-
-// Companion monkey patch: overlay the live TESTOMATIO* env vars onto the SDK's
-// (frozen-after-first-use) shell env so agent bash commands always run with the
-// current session's Testomat.io credentials. See shell-env.ts.
-import "./shell-env.js";
-
-// Every discovery provider that loads MCP configs from another tool
-// (Cursor, Claude, VSCode, etc.) or from arbitrary project-root files.
-// We keep only `builtin` — it reads our per-session `<cwd>/.testeiya/mcp.json`.
-const OTHER_MCP_PROVIDERS = [
-  "mcp-json",
-  "cursor",
-  "claude",
-  "claude-plugins",
-  "codex",
-  "gemini",
-  "opencode",
-  "vscode",
-  "windsurf",
-];
-
-// The SDK's bash tool runs on the brush shell, where a heredoc inside $(...)
-// intermittently fails with a bogus "syntax error near token" — and
-// `playwright-cli run-code` snippets have no Node globals. Both failures are
-// cryptic and cost the model several retries; intercept them with an
-// actionable message instead. Replaces the SDK's default rules (cat/grep/find
-// redirects), which we don't want.
-const BASH_GUARD_RULES = [
-  {
-    pattern: "\\$\\((?!\\()[^)\\n]*<<",
-    tool: "write",
-    message:
-      "Heredocs inside $(...) command substitution are unreliable in this shell. " +
-      "Write the script to a file with the write tool and run it, or use a " +
-      "single-line node -e / node -p. Top-level heredocs (not inside $(...)) work fine.",
-  },
-  {
-    pattern: "playwright-cli\\s+run-code[\\s\\S]*process\\.env",
-    tool: "bash",
-    message:
-      "playwright-cli run-code executes in a browser sandbox — process.env and " +
-      "other Node globals are not available there. Read the values in bash first " +
-      "and interpolate them into the snippet.",
-  },
-];
-
-import { loadConfig, type TesteiyaConfig } from "./config.js";
-import { listContext, listContextFolders } from "./context-store.js";
-import { resolveProjectInfo } from "./project-info.js";
-import { buildSystemPrompt } from "./prompt/index.js";
-import { createPermissionExtension } from "./permissions.js";
-import type { AskChannel } from "./extensions/webui/ask-channel.js";
-import type { WidgetCommandChannel } from "./extensions/webui/widget-channel.js";
-import { createCommandsExtension, type CommandsRuntime } from "./commands.js";
-import { createToolGateExtension, type ToolGateRuntime } from "./extensions/tool-gate.js";
-import { createTelemetryExtension, isTelemetryEnabled } from "./telemetry.js";
-
-/** Derive API key env var name from provider name (e.g., "openrouter" -> "OPENROUTER_API_KEY") */
-function getApiKeyEnvVar(providerName: string): string {
-  return `${providerName.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_API_KEY`;
-}
-
-export interface SessionOptions {
-  cwd?: string;
-  projectIds?: string[];
-  promptContext?: string;
-  backendUrl?: string;
-  tokens?: Record<string, string>;
-  /**
-   * How this workspace's Testomat.io credentials were resolved (connection.ts):
-   * whether a token is exported to the shell env, and the linked project's
-   * id/title when known. Drives the system-prompt guidance for sessions that
-   * have no managed `tokens` (linked folders, `.env`, mcp.json).
-   */
-  connection?: { tokenAvailable?: boolean; projectId?: string; title?: string };
-  /** The session's Testomat.io projects (from the session store), when managed. */
-  projects?: { slug: string; title: string; status: "ok" | "error" }[];
-  /**
-   * Which frontend is driving this session.
-   *   - "tui"  → activates Pi's built-in `ask` tool via `hasUI: true`; no
-   *             web-UI tools are registered.
-   *   - "web"  → loads the `webui` extension (render_list / render_tree /
-   *             render_item / ask_question + tool_result UI notices) and
-   *             leaves `hasUI` off so the built-in `ask` isn't created.
-   * Default: "tui".
-   */
-  mode?: "tui" | "web";
-  /**
-   * Resume an existing SDK conversation transcript (by its `SessionManager` id)
-   * so new turns append to that file with full prior context. When omitted, a
-   * fresh conversation is created.
-   */
-  resumeConversationId?: string;
-  /**
-   * The user deliberately opened this workspace (folder picker,
-   * `TESTEIYA_WORKSPACE`, or the terminal CLI cwd), so the agent gets full
-   * read/write/bash access instead of the default read-only gating.
-   */
-  trusted?: boolean;
-  [key: string]: unknown;
-}
-
-export async function createTesteiyaSession(options?: SessionOptions) {
-  const config = loadConfig();
-  const cwd = options?.cwd ?? process.cwd();
-  const agentDir = HOME_DIR;
-
-  mkdirSync(agentDir, { recursive: true });
-
-  const settings = await Settings.init({ cwd, agentDir });
-  const existing = new Set((settings.get("disabledProviders") ?? []) as string[]);
-  for (const id of OTHER_MCP_PROVIDERS) existing.add(id);
-  settings.set("disabledProviders", Array.from(existing));
-
-  // Per-project autonomous memory: the SDK extracts durable signal from this
-  // workspace's past session transcripts, consolidates it under
-  // `~/.testeiya/memories/state/--<cwd>--/`, and auto-injects a summary into the
-  // system prompt of future sessions for the same `cwd`. On by default; the user
-  // toggles it in Settings (persisted to config.json). Our sessions are persisted
-  // and run at taskDepth 0, so this flag is all that gates activation.
-  settings.set("memories.enabled", config.memoryEnabled);
-
-  settings.set("bashInterceptor.enabled", true);
-  settings.set("bashInterceptor.patterns", BASH_GUARD_RULES);
-
-  // Resolve the active model via the SDK's ModelRegistry. The provider + model
-  // are chosen in the Providers & Models UI and persisted to
-  // ~/.testeiya/config.json; for dev/CI we still honor the provider's env var
-  // (e.g. OPENROUTER_API_KEY). The registry knows each provider's real
-  // transport (anthropic-messages, openai-codex-responses, google-gemini-cli,
-  // openai-completions, …) and discovers models live — so we no longer hardcode
-  // a single provider/api here.
-  const providerName = config.provider.name;
-  const apiKeyEnvVar = getApiKeyEnvVar(providerName);
-
-  const authStorage = await AuthStorage.create(join(agentDir, "auth.json"));
-  // `create()` doesn't load persisted credentials into memory — reload so a
-  // signed-in subscription / saved API key is actually visible (otherwise only
-  // env-var keys resolve).
-  await authStorage.reload();
-  const envKey = process.env[apiKeyEnvVar];
-  if (envKey) {
-    authStorage.setRuntimeApiKey(providerName, envKey);
-  }
-
-  const modelRegistry = new ModelRegistry(authStorage);
-
-  // Resolution: (1) bundled lookup, (2) after live discovery, (3) the provider's
-  // SDK default model, (4) legacy custom OpenAI-compatible provider via baseUrl.
-  let model =
-    modelRegistry.find(providerName, config.provider.model) ?? undefined;
-  if (!model) {
-    try {
-      await modelRegistry.refreshProvider(providerName, "online-if-uncached");
-    } catch {
-      // Discovery is best-effort; fall through to the remaining strategies.
-    }
-    model =
-      modelRegistry.find(providerName, config.provider.model) ?? undefined;
-  }
-  if (!model) {
-    const fallbackId = (
-      DEFAULT_MODEL_PER_PROVIDER as Record<string, string>
-    )[providerName];
-    if (fallbackId) {
-      model = modelRegistry.find(providerName, fallbackId) ?? undefined;
-    }
-  }
-  const isKnownProvider =
-    providerName in (DEFAULT_MODEL_PER_PROVIDER as Record<string, unknown>);
-  if (!model && config.provider.baseUrl && !isKnownProvider) {
-    // Back-compat: a custom OpenAI-compatible provider defined purely via
-    // config.baseUrl (not one the SDK ships). Guarded to known providers so a
-    // stale baseUrl can't mis-register e.g. openai-codex as openai-completions.
-    const apiKey = await authStorage.getApiKey(providerName);
-    if (apiKey) {
-      modelRegistry.registerProvider(providerName, {
-        baseUrl: config.provider.baseUrl,
-        api: "openai-completions",
-        apiKey,
-        models: [
-          {
-            id: config.provider.model,
-            name: config.provider.model,
-            reasoning: false,
-            input: ["text"] as ("text" | "image")[],
-            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-            contextWindow: config.provider.contextWindow,
-            maxTokens: config.provider.maxTokens,
-          },
-        ],
-      });
-      model =
-        modelRegistry.find(providerName, config.provider.model) ?? undefined;
-    }
-  }
-  if (!model) {
-    throw new Error(
-      `Could not resolve model "${config.provider.model}" for provider ` +
-      `"${providerName}". Pick a model in the Providers & Models dialog.`
-    );
-  }
-
-  // Pre-flight credential check so we surface a clean "add a key / sign in"
-  // message instead of failing on the first prompt. Keyless providers (ollama,
-  // lm-studio, …) return the SDK's no-auth sentinel, so they pass.
-  const credential = await modelRegistry.getApiKeyForProvider(providerName);
-  if (!credential) {
-    throw new Error(
-      `Missing API key for "${providerName}". Open the Providers & Models ` +
-      `dialog and add your ${providerName} API key or sign in, or set the ` +
-      `${apiKeyEnvVar} environment variable.`
-    );
-  }
-
-  // The linked project's settings (framework, labels, tags, CI profiles, …) —
-  // the `.testeiya/project-info.json` cache written on project select, refreshed
-  // here when stale and credentials resolve. Best-effort: null just omits the
-  // prompt section.
-  const projectInfo = await resolveProjectInfo(cwd, {
-    tokens: options?.tokens,
-    backendUrl: options?.backendUrl,
-    projects: options?.projects ?? [],
-  });
-
-  // Backfill the `.gitignore`/`.ignore` guard pair for workspaces whose
-  // `.testeiya` predates the `.ignore` search whitelist.
-  ensureProjectDirGuards(cwd);
-
-  // Gate the browser-automation guidance on whether the @playwright/cli tool is
-  // actually installed (the playwright-cli skill itself is vendored from GitHub).
-  const systemPrompt = buildSystemPrompt({
-    cwd,
-    promptContext: options?.promptContext,
-    tokens: options?.tokens,
-    backendUrl: options?.backendUrl,
-    connection: options?.connection,
-    mode: options?.mode,
-    browser: hasPlaywrightCli(),
-    projectInfo,
-    contextEntries: listContext(cwd),
-    contextFolders: listContextFolders(cwd),
-  });
-
-  // Load skills: the prebuilt skills vendored from GitHub into cli/skills
-  // (Testomat.io, CodeceptJS, Playwright) + the user's custom skills (global
-  // ~/.testeiya/skills and this workspace's .testeiya/skills). Deduped by name
-  // so a custom skill can override a bundled one and the SDK never receives two
-  // skills of one name.
-  const skills = dedupeSkillsByName([
-    ...loadBundledSkills(),
-    ...loadCustomSkills(cwd),
-  ]);
-
-  const mode = options?.mode ?? "tui";
-
-  // The commands extension needs the MCP manager (created below with the
-  // session) to live-connect servers from /connect — pass a mutable runtime
-  // and fill it in after createAgentSession returns.
-  const commandsRuntime: CommandsRuntime = { cwd };
-  const toolGateRuntime: ToolGateRuntime = {};
-  const extensions: ExtensionFactory[] = [
-    createPermissionExtension(config, cwd, options?.trusted) as ExtensionFactory,
-    createCommandsExtension(commandsRuntime),
-    createToolGateExtension(toolGateRuntime, config.toolGate),
-  ];
-  let askChannel: AskChannel | undefined;
-  let widgetChannel: WidgetCommandChannel | undefined;
-  if (mode === "web") {
-    const { createWebUIExtension, AskChannel, WidgetCommandChannel } = await import(
-      "./extensions/webui/index.js"
-    );
-    askChannel = new AskChannel();
-    widgetChannel = new WidgetCommandChannel();
-    extensions.push(createWebUIExtension(askChannel, widgetChannel));
-  }
-
-  if (isTelemetryEnabled()) {
-    extensions.push(
-      createTelemetryExtension({
-        cwd,
-        mode,
-        modelId: model.id,
-        provider: model.provider,
-        projectIds: options?.projectIds,
-      }),
-    );
-  }
-
-  // Own the SessionManager so we control the conversation id (returned to the
-  // UI) and can resume a chosen transcript. Same default dir the SDK would pick.
-  const sessionDir = SessionManager.getDefaultSessionDir(cwd, agentDir);
-  const sessionManager = await resolveSessionManager(
-    cwd,
-    sessionDir,
-    options?.resumeConversationId,
-  );
-
-  // Create session
-  const result = await createAgentSession({
-    cwd,
-    agentDir,
-    settings,
-    model,
-    sessionManager,
-    // Cast to the SDK's ThinkingLevel: its non-"off" members are nominal
-    // `const enum Effort` values, but the runtime strings are identical to our
-    // config union, so this is safe (and self-maintaining via Parameters<>).
-    thinkingLevel: config.thinkingLevel as NonNullable<
-      Parameters<typeof createAgentSession>[0]
-    >["thinkingLevel"],
-    authStorage,
-    modelRegistry,
-    systemPrompt,
-    skills,
-    extensions,
-    hasUI: mode === "tui",
-    disableExtensionDiscovery: true,
-    enableMCP: true,
-    enableLsp: false,
-    // Intentionally no `toolNames` filter — pi-coding-agent treats it as a
-    // whitelist and would hide all discovered MCP tools. We rely on MCP server
-    // configs in `<cwd>/.testeiya/mcp.json` and the permission extension to gate
-    // dangerous calls instead.
-  });
-
-  commandsRuntime.mcpManager = result.mcpManager;
-  toolGateRuntime.mcpManager = result.mcpManager;
-  initExtensionRunner(result.session);
-
-  return {
-    ...result,
-    model,
-    config,
-    agentDir,
-    params: options,
-    askChannel,
-    widgetChannel,
-    conversationId: sessionManager.getSessionId(),
-  };
-}
-
-async function resolveSessionManager(
-  cwd: string,
-  sessionDir: string,
-  resumeConversationId?: string,
-): Promise<SessionManager> {
-  if (!resumeConversationId) return SessionManager.create(cwd, sessionDir);
-  const infos = await SessionManager.list(cwd, sessionDir);
-  const match = infos.find((i) => i.id === resumeConversationId);
-  if (!match) return SessionManager.create(cwd, sessionDir);
-  return SessionManager.open(match.path, sessionDir);
-}
-
-// The SDK wires extension runtime *actions* (setActiveTools, sendMessage, …)
-// only from its own mode controllers (print/interactive/rpc). Testeiya drives
-// the session directly, so without this call every action method throws
-// ExtensionRuntimeNotInitializedError forever. Mirrors print-mode.ts.
-function initExtensionRunner(sessionValue: unknown): void {
-  const session = sessionValue as any;
-  const runner = session?.extensionRunner;
-  if (!runner) return;
-  runner.initialize(
-    {
-      sendMessage: (message: unknown, options: unknown) => {
-        session.sendCustomMessage(message, options).catch((e: any) => {
-          console.warn("[ext] sendMessage failed:", e?.message ?? e);
-        });
-      },
-      sendUserMessage: (content: unknown, options: unknown) => {
-        session.sendUserMessage(content, options).catch((e: any) => {
-          console.warn("[ext] sendUserMessage failed:", e?.message ?? e);
-        });
-      },
-      appendEntry: (customType: string, data: unknown) =>
-        session.sessionManager.appendCustomEntry(customType, data),
-      setLabel: (targetId: string, label: unknown) =>
-        session.sessionManager.appendLabelChange(targetId, label),
-      getActiveTools: () => session.getActiveToolNames(),
-      getAllTools: () => session.getAllToolNames(),
-      setActiveTools: (toolNames: string[]) => session.setActiveToolsByName(toolNames),
-      getCommands: () => [],
-      setModel: async (model: unknown) => {
-        const key = await session.modelRegistry.getApiKey(model);
-        if (!key) return false;
-        await session.setModel(model);
-        return true;
-      },
-      getThinkingLevel: () => session.thinkingLevel,
-      setThinkingLevel: (level: unknown) => session.setThinkingLevel(level),
-    },
-    {
-      getModel: () => session.model,
-      getSearchDb: () => session.searchDb,
-      isIdle: () => !session.isStreaming,
-      abort: () => session.abort(),
-      hasPendingMessages: () => session.queuedMessageCount > 0,
-      shutdown: () => {},
-      getContextUsage: () => session.getContextUsage(),
-      getSystemPrompt: () => session.systemPrompt,
-      compact: async (instructionsOrOptions: unknown) => {
-        const instructions =
-          typeof instructionsOrOptions === "string" ? instructionsOrOptions : undefined;
-        const options =
-          instructionsOrOptions && typeof instructionsOrOptions === "object"
-            ? instructionsOrOptions
-            : undefined;
-        await session.compact(instructions, options);
-      },
-    }
-  );
-}

package/src/session-store.ts

@@ -1,115 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
-import { HOME_DIR } from "./project-dir.js";
-
-const SESSIONS_FILE = path.join(HOME_DIR, "sessions.json");
-const MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours
-
-export interface StoredSession {
-  sessionId: string;
-  cwd: string;
-  promptContext: string;
-  backendUrl?: string;
-  tokens?: Record<string, string>;
-  /** The user explicitly opened this folder, so the agent may write to it. */
-  trusted?: boolean;
-  projects: {
-    slug: string;
-    title: string;
-    status: "ok" | "error";
-    fileCount?: number;
-    error?: string;
-  }[];
-  createdAt: number;
-}
-
-// The server is single-process, so the parsed array lives in module memory and
-// each exported mutation is one synchronous read→modify→write with no `await`
-// between — that makes it an atomic critical section. If you ever add an `await`
-// inside a mutation, reintroduce serialization (an in-process async mutex).
-let cache: StoredSession[] | null = null;
-
-function readAll(): StoredSession[] {
-  if (cache) return cache;
-  try {
-    cache = JSON.parse(fs.readFileSync(SESSIONS_FILE, "utf-8"));
-  } catch {
-    cache = [];
-  }
-  return cache!;
-}
-
-function writeAll(sessions: StoredSession[]): void {
-  cache = sessions;
-  const dir = path.dirname(SESSIONS_FILE);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
-  const tmp = `${SESSIONS_FILE}.${process.pid}.tmp`;
-  // 0600 — holds plaintext project API tokens; rename preserves the mode.
-  fs.writeFileSync(tmp, JSON.stringify(sessions, null, 2), { mode: 0o600 });
-  fs.renameSync(tmp, SESSIONS_FILE);
-}
-
-export function createSession(
-  data: Omit<StoredSession, "createdAt">
-): StoredSession {
-  const session: StoredSession = { ...data, createdAt: Date.now() };
-  const sessions = pruneExpired(readAll());
-  sessions.push(session);
-  writeAll(sessions);
-  return session;
-}
-
-export function getSession(sessionId: string): StoredSession | null {
-  const sessions = readAll();
-  return sessions.find((s) => s.sessionId === sessionId) ?? null;
-}
-
-/** Most-recent live session rooted at `cwd`, if any (used to reuse a workspace). */
-export function getSessionByCwd(cwd: string): StoredSession | null {
-  cleanExpiredSessions();
-  const sessions = readAll();
-  const match = sessions.filter((s) => s.cwd === cwd);
-  if (match.length === 0) return null;
-  return match.reduce((a, b) => (b.createdAt > a.createdAt ? b : a));
-}
-
-export function deleteSession(sessionId: string): void {
-  const sessions = readAll();
-  writeAll(sessions.filter((s) => s.sessionId !== sessionId));
-}
-
-export function cleanExpiredSessions(maxAgeMs = MAX_AGE_MS): void {
-  const sessions = readAll();
-  const alive = pruneExpired(sessions, maxAgeMs);
-  if (alive.length !== sessions.length) writeAll(alive);
-}
-
-// Returns the still-alive sessions, deleting on disk ONLY Testeiya's own
-// ephemeral temp workspaces. Persistent per-project dirs (~/.testeiya/workspaces)
-// and folders the user opened are NOT ours to remove — wiping them on a 24h TTL
-// would destroy data.
-function pruneExpired(
-  sessions: StoredSession[],
-  maxAgeMs = MAX_AGE_MS
-): StoredSession[] {
-  const now = Date.now();
-  const alive: StoredSession[] = [];
-  const tmpRoot = os.tmpdir() + path.sep;
-  for (const session of sessions) {
-    if (now - session.createdAt <= maxAgeMs) {
-      alive.push(session);
-      continue;
-    }
-    if (session.cwd.startsWith(tmpRoot)) {
-      try {
-        fs.rmSync(session.cwd, { recursive: true, force: true });
-      } catch {
-        // ignore cleanup errors
-      }
-    }
-  }
-  return alive;
-}