throughline 0.6.0 → 0.6.2

package/src/cli/factory-diagnostics.test.mjs

@@ -0,0 +1,201 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { DatabaseSync } from 'node:sqlite';
+import { existsSync, mkdtempSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  collectFactoryDiagnostics,
+  inspectFactoryDatabase,
+  inspectFactoryHooks,
+  parseArgs,
+  run,
+} from './factory-diagnostics.mjs';
+
+test('factory-diagnostics CLI: JSON-only contract and schema fixture', () => {
+  const output = [];
+  const exitCode = run(['--json'], {
+    stdout: { write(value) { output.push(value); } },
+    version: '0.6.1',
+    inspectThread: () => ({ status: 'ready', rolloutAvailable: true }),
+    inspectDatabase: () => ({ status: 'ready', schemaVersion: 8, handoffMemory: true }),
+    inspectHooks: () => ({
+      status: 'ready',
+      claudeStatus: 'ready',
+      events: { userPromptSubmit: 'ready', postToolUse: 'ready', stop: 'ready' },
+    }),
+  });
+
+  assert.equal(exitCode, 0);
+  assert.equal(output.length, 1);
+  const parsed = JSON.parse(output[0]);
+  assert.equal(parsed.schema, 'throughline.native_factory_diagnostics.v1');
+  assert.equal(parsed.version, '0.6.1');
+  assert.equal(parsed.readiness.restore.status, 'ready');
+  assert.equal(parsed.evidence.restoreSmoke.status, 'unverified');
+});
+
+test('factory-diagnostics CLI: invalid request is a fixed JSON error', () => {
+  const output = [];
+  const exitCode = run(['--project', '/secret/path'], {
+    stdout: { write(value) { output.push(value); } },
+  });
+
+  assert.equal(exitCode, 2);
+  assert.equal(output.length, 1);
+  const parsed = JSON.parse(output[0]);
+  assert.equal(parsed.error, 'invalid_diagnostics_request');
+  assert.doesNotMatch(output[0], /secret\/path/);
+  assert.throws(() => parseArgs([]), /usage error/);
+  assert.throws(() => parseArgs(['--json', '--json']), /usage error/);
+});
+
+test('factory-diagnostics CLI: internal failure is not reported as a usage error', () => {
+  const output = [];
+  const exitCode = run(['--json'], {
+    stdout: { write(value) { output.push(value); } },
+    inspectThread: () => { throw new Error('/secret/internal'); },
+  });
+
+  assert.equal(exitCode, 1);
+  assert.equal(JSON.parse(output[0]).error, 'diagnostics_internal_error');
+  assert.doesNotMatch(output[0], /secret|internal\//);
+});
+
+test('factory-diagnostics CLI: unverified inspection remains unverified', () => {
+  const result = collectFactoryDiagnostics({
+    version: '0.6.1',
+    inspectThread: () => ({ status: 'unverified', rolloutAvailable: false }),
+    inspectDatabase: () => ({ status: 'unverified', schemaVersion: null, handoffMemory: false }),
+    inspectHooks: () => ({ status: 'unverified', claudeStatus: 'unverified', events: {} }),
+  });
+
+  assert.equal(result.overall.status, 'unverified');
+  assert.equal(result.readiness.capture.status, 'unverified');
+  assert.equal(result.readiness.handoff.status, 'unverified');
+  assert.throws(() => parseArgs(['--bad']), /usage error/);
+});
+
+test('factory-diagnostics DB inspection is read-only and does not create an absent DB', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'tl-factory-diagnostics-'));
+  const dbPath = join(dir, 'throughline.db');
+  const missingPath = join(dir, 'missing.db');
+  try {
+    const db = new DatabaseSync(dbPath);
+    createFactorySchema(db);
+    db.close();
+    const before = statSync(dbPath).mtimeMs;
+
+    const result = inspectFactoryDatabase({ dbPath, threadId: 'thread-1' });
+    assert.equal(result.status, 'ready');
+    assert.equal(result.handoffMemory, false);
+    assert.equal(statSync(dbPath).mtimeMs, before);
+
+    const writer = new DatabaseSync(dbPath);
+    writer.exec(`
+      INSERT INTO sessions VALUES ('codex:thread-1', '/project/a', 'active', 1, 1, NULL);
+      INSERT INTO skeletons VALUES (1, 'codex:thread-1', 1, 'assistant', 'safe', 1, 'codex:thread-1');
+    `);
+    writer.close();
+    const matching = inspectFactoryDatabase({ dbPath, threadId: 'thread-1', projectPath: '/project/a' });
+    const mismatch = inspectFactoryDatabase({ dbPath, threadId: 'thread-1', projectPath: '/project/b' });
+    assert.equal(matching.handoffMemory, true);
+    assert.equal(mismatch.handoffMemory, false);
+
+    const missing = inspectFactoryDatabase({ dbPath: missingPath });
+    assert.equal(missing.status, 'not_applicable');
+    assert.equal(existsSync(missingPath), false);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('factory-diagnostics DB inspection rejects version-only fake schema', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'tl-factory-fake-schema-'));
+  const dbPath = join(dir, 'throughline.db');
+  try {
+    const db = new DatabaseSync(dbPath);
+    db.exec('PRAGMA user_version = 8; CREATE TABLE sessions (session_id TEXT)');
+    db.close();
+    assert.equal(inspectFactoryDatabase({ dbPath }).status, 'not_ready');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('factory-diagnostics DB inspection rejects missing runtime constraints', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'tl-factory-fake-constraint-'));
+  const dbPath = join(dir, 'throughline.db');
+  try {
+    const db = new DatabaseSync(dbPath);
+    createFactorySchema(db);
+    db.exec(`
+      DROP TABLE handoff_batons;
+      CREATE TABLE handoff_batons (project_path TEXT, session_id TEXT NOT NULL, created_at INTEGER NOT NULL);
+    `);
+    db.close();
+    assert.equal(inspectFactoryDatabase({ dbPath }).status, 'not_ready');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('factory-diagnostics hook inspection rejects corrupt and false-ready shapes', () => {
+  const corrupt = inspectFactoryHooks({
+    readHooks: () => ({ configExists: true, configReadable: false, hooksExists: true, hooksReadable: false }),
+  });
+  assert.equal(corrupt.status, 'unverified');
+
+  const malformed = inspectFactoryHooks({
+    readHooks: () => ({
+      configExists: true,
+      configReadable: true,
+      hooksExists: true,
+      hooksReadable: true,
+      featureEnabled: true,
+      expectedPromptCommand: 'prompt',
+      expectedPostToolUseCommand: 'post',
+      expectedStopCommand: 'stop',
+      managedPromptHooks: [{ type: 'command', command: 'prompt', timeoutSec: 30, async: true }],
+      legacyManagedPromptHooks: [],
+      managedPostToolUseHooks: [{ type: 'command', command: 'post', timeoutSec: 30, async: false }],
+      legacyManagedPostToolUseHooks: [],
+      managedStopHooks: [{ type: 'command', command: 'stop', timeoutSec: 300, async: false }],
+      legacyManagedStopHooks: [],
+    }),
+  });
+  assert.equal(malformed.status, 'not_ready');
+});
+
+function createFactorySchema(db) {
+  db.exec(`
+    PRAGMA user_version = 8;
+    CREATE TABLE sessions (
+      session_id TEXT PRIMARY KEY, project_path TEXT NOT NULL, status TEXT NOT NULL,
+      created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, merged_into TEXT
+    );
+    CREATE TABLE skeletons (
+      id INTEGER, session_id TEXT, turn_number INTEGER, role TEXT, summary TEXT,
+      created_at INTEGER, origin_session_id TEXT
+    );
+    CREATE TABLE bodies (
+      id INTEGER, session_id TEXT, origin_session_id TEXT, turn_number INTEGER,
+      role TEXT, text TEXT, token_count INTEGER, created_at INTEGER,
+      UNIQUE(session_id, origin_session_id, turn_number, role)
+    );
+    CREATE TABLE details (
+      id INTEGER, session_id TEXT, turn_number INTEGER, tool_name TEXT,
+      input_text TEXT, output_text TEXT, token_count INTEGER, created_at INTEGER,
+      origin_session_id TEXT, kind TEXT, source_id TEXT
+    );
+    CREATE TABLE handoff_batons (
+      project_path TEXT PRIMARY KEY, session_id TEXT NOT NULL, created_at INTEGER NOT NULL
+    );
+    CREATE UNIQUE INDEX uq_skeletons_turn_v3
+      ON skeletons(session_id, origin_session_id, turn_number, role);
+    CREATE UNIQUE INDEX uq_details_source
+      ON details(session_id, origin_session_id, source_id)
+      WHERE source_id IS NOT NULL;
+  `);
+}

package/src/cli/runtime-errors.mjs

@@ -0,0 +1,85 @@
+import {
+  acknowledgeRuntimeErrors,
+  compactRuntimeErrors,
+  getRuntimeErrorDiagnostics,
+  readRuntimeErrorSnapshot,
+  reopenRuntimeError,
+  resolveRuntimeError,
+} from '../runtime-error-store.mjs';
+
+const USAGE = 'usage: throughline runtime-errors <snapshot|diagnostics|ack|resolve|reopen|compact> [arguments] --json';
+
+export function parseArgs(argv = []) {
+  const command = argv[0];
+  if (!['snapshot', 'diagnostics', 'ack', 'resolve', 'reopen', 'compact'].includes(command)) {
+    throw new TypeError(USAGE);
+  }
+  const options = { command, json: false, afterCursor: 0, limit: 256, value: null };
+  for (let index = 1; index < argv.length; index++) {
+    const arg = argv[index];
+    if (arg === '--json' && !options.json) {
+      options.json = true;
+    } else if (command === 'snapshot' && arg === '--after-cursor' && argv[index + 1]) {
+      options.afterCursor = parseInteger(argv[++index], '--after-cursor');
+    } else if (command === 'snapshot' && arg === '--limit' && argv[index + 1]) {
+      options.limit = parseInteger(argv[++index], '--limit');
+    } else if (['ack', 'resolve', 'reopen'].includes(command) && options.value === null && !arg.startsWith('-')) {
+      options.value = arg;
+    } else {
+      throw new TypeError(USAGE);
+    }
+  }
+  if (!options.json || (['ack', 'resolve', 'reopen'].includes(command) && options.value === null)) {
+    throw new TypeError(USAGE);
+  }
+  return options;
+}
+
+export function run(argv = [], dependencies = {}) {
+  let options;
+  try {
+    options = parseArgs(argv);
+  } catch {
+    process.stderr.write(`[runtime-errors] ${USAGE}\n`);
+    return 2;
+  }
+
+  try {
+    const env = dependencies.env ?? process.env;
+    let result;
+    if (options.command === 'snapshot') {
+      result = (dependencies.readSnapshot ?? readRuntimeErrorSnapshot)({
+        env,
+        afterCursor: options.afterCursor,
+        limit: options.limit,
+      });
+    } else if (options.command === 'diagnostics') {
+      result = (dependencies.getDiagnostics ?? getRuntimeErrorDiagnostics)({ env });
+    } else if (options.command === 'ack') {
+      result = (dependencies.acknowledge ?? acknowledgeRuntimeErrors)(
+        parseInteger(options.value, 'cursor'),
+        { env },
+      );
+    } else if (options.command === 'resolve') {
+      result = (dependencies.resolve ?? resolveRuntimeError)(options.value, { env });
+    } else if (options.command === 'reopen') {
+      result = (dependencies.reopen ?? reopenRuntimeError)(options.value, { env });
+    } else {
+      result = (dependencies.compact ?? compactRuntimeErrors)({ env });
+    }
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    return 0;
+  } catch {
+    process.stderr.write('[runtime-errors] operation_failed\n');
+    return 1;
+  }
+}
+
+function parseInteger(value, name) {
+  if (typeof value !== 'string' || !/^\d+$/.test(value)) throw new TypeError(`${name} invalid`);
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed)) throw new TypeError(`${name} invalid`);
+  return parsed;
+}
+
+export const _internal = { USAGE };

package/src/cli/runtime-errors.test.mjs

@@ -0,0 +1,75 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { parseArgs, run } from './runtime-errors.mjs';
+import { defaultFactoryReporterConfigPath } from '../runtime-error-store.mjs';
+import { applyWindowsPrivateAcl } from '../windows-acl-test-helper.mjs';
+
+test('runtime-errors CLI: strict command surface accepts no raw payload options', () => {
+  assert.deepEqual(parseArgs(['snapshot', '--after-cursor', '2', '--limit', '3', '--json']), {
+    command: 'snapshot', json: true, afterCursor: 2, limit: 3, value: null,
+  });
+  assert.equal(parseArgs(['reopen', 'a'.repeat(64), '--json']).command, 'reopen');
+  for (const args of [
+    ['snapshot', '--stderr', 'secret', '--json'],
+    ['snapshot', '--path', '/Users/private', '--json'],
+    ['resolve', 'abc', '--context', 'secret', '--json'],
+    ['diagnostics'],
+  ]) assert.throws(() => parseArgs(args));
+});
+
+test('runtime-errors CLI: internal failure is fixed and does not reflect exceptions or paths', () => {
+  const writes = { stdout: '', stderr: '' };
+  const originalOut = process.stdout.write;
+  const originalErr = process.stderr.write;
+  process.stdout.write = (chunk) => { writes.stdout += chunk; return true; };
+  process.stderr.write = (chunk) => { writes.stderr += chunk; return true; };
+  try {
+    const exitCode = run(['snapshot', '--json'], {
+      readSnapshot() { throw new Error('secret /Users/private stack'); },
+    });
+    assert.equal(exitCode, 1);
+  } finally {
+    process.stdout.write = originalOut;
+    process.stderr.write = originalErr;
+  }
+  assert.equal(writes.stdout, '');
+  assert.equal(writes.stderr, '[runtime-errors] operation_failed\n');
+});
+
+test('runtime-errors CLI: snapshot and diagnostics are JSON-only and contain no state path', () => {
+  const root = mkdtempSync(join(tmpdir(), 'throughline-runtime-cli-'));
+  const env = {
+    ...process.env,
+    HOME: root,
+    USERPROFILE: root,
+    LOCALAPPDATA: root,
+    XDG_CONFIG_HOME: join(root, 'config'),
+    XDG_STATE_HOME: join(root, 'state'),
+  };
+  const configPath = defaultFactoryReporterConfigPath(env);
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, JSON.stringify({
+    schema_version: '1.0',
+    host: { id: 'test-host', profile: process.platform === 'win32' ? 'windows-native' : 'mac' },
+    collection: { enabled: true },
+    reporting: { enabled: false },
+  }));
+  applyWindowsPrivateAcl(configPath);
+  const bin = new URL('../../bin/throughline.mjs', import.meta.url);
+  for (const args of [
+    ['runtime-errors', 'snapshot', '--json'],
+    ['runtime-errors', 'diagnostics', '--json'],
+  ]) {
+    const result = spawnSync(process.execPath, [fileURLToPath(bin), ...args], { env, encoding: 'utf8' });
+    assert.equal(result.status, 0, result.stderr);
+    const json = JSON.parse(result.stdout);
+    assert.equal(typeof json.schema, 'string');
+    assert.doesNotMatch(result.stdout, new RegExp(root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+  }
+});

package/src/cli/trim.mjs

@@ -164,11 +164,11 @@ export async function run(args) {
     } else {
       process.stdout.write(renderTrimActionReport(result) + '\n');
     }
-    process.exit(
+    process.exitCode =
       result.status === 'preflight-ready' || result.status === 'execute-durable-verified'
         ? 0
-        : 1,
-    );
+        : 1;
+    return;
   }
 
   if (parsed.json) {
@@ -177,7 +177,7 @@ export async function run(args) {
     process.stdout.write(renderTrimDryRunReport(plan) + '\n');
   }
 
-  process.exit(plan.status === 'unavailable' ? 1 : 0);
+  process.exitCode = plan.status === 'unavailable' ? 1 : 0;
 }
 
 async function runExecute(parsed, plan) {

package/src/codex-handoff-model-smoke.mjs

@@ -1,4 +1,4 @@
-import { spawnSync } from 'node:child_process';
+import { spawnPortableSync } from './portable-spawn-sync.mjs';
 
 export const CODEX_HANDOFF_MODEL_SMOKE_ENV = 'THROUGHLINE_EXPERIMENTAL_CODEX_HANDOFF_MODEL_SMOKE';
 export const DEFAULT_CODEX_HANDOFF_MODEL_SMOKE_TIMEOUT_MS = 120_000;
@@ -48,7 +48,7 @@ export function runCodexHandoffModelSmoke({
   assertNonEmptyString(command, 'command');
   assertPositiveInteger(timeoutMs, 'timeoutMs');
 
-  const result = spawnSync(
+  const result = spawnPortableSync(
     command,
     [
       'exec',
@@ -65,7 +65,6 @@ export function runCodexHandoffModelSmoke({
     {
       encoding: 'utf8',
       timeout: timeoutMs,
-      shell: process.platform === 'win32',
       env,
       cwd,
     },

package/src/codex-sidecar-cli.test.mjs

@@ -8,12 +8,25 @@ import { fileURLToPath } from 'node:url';
 
 const REPO_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 
+function makeSidecarFixture(dir, body) {
+  const script = join(dir, 'fake-sidecar.mjs');
+  writeFileSync(script, body);
+  if (process.platform === 'win32') {
+    const bin = join(dir, 'fake-sidecar.cmd');
+    writeFileSync(bin, `@echo off\r\n${JSON.stringify(process.execPath)} ${JSON.stringify(script)} %*\r\n`);
+    writeFileSync(join(dir, 'fake-sidecar.ps1'), `& ${JSON.stringify(process.execPath)} ${JSON.stringify(script)} @args\nexit $LASTEXITCODE\n`);
+    return bin;
+  }
+  const bin = join(dir, 'fake-sidecar');
+  writeFileSync(bin, `#!/bin/sh\nexec ${JSON.stringify(process.execPath)} ${JSON.stringify(script)} "$@"\n`);
+  chmodSync(bin, 0o755);
+  return bin;
+}
+
 test('codex-sidecar-diagnostics CLI exits 0 only for configured diagnostics', () => {
   const dir = mkdtempSync(join(tmpdir(), 'tl-sidecar-cli-'));
   try {
-    const bin = join(dir, 'fake-sidecar');
-    writeFileSync(bin, '#!/usr/bin/env bash\nprintf "ok\\n"\nexit 0\n');
-    chmodSync(bin, 0o755);
+    const bin = makeSidecarFixture(dir, "process.stdout.write('ok\\n');\n");
 
     const result = spawnSync(
       process.execPath,
@@ -38,12 +51,10 @@ test('codex-sidecar-diagnostics CLI exits 0 only for configured diagnostics', ()
 test('codex-sidecar-dry-run CLI exits 0 for normalized dry-run request', () => {
   const dir = mkdtempSync(join(tmpdir(), 'tl-sidecar-dry-run-cli-'));
   try {
-    const bin = join(dir, 'fake-sidecar');
-    writeFileSync(
-      bin,
-      '#!/usr/bin/env bash\nprintf \'{"status":"dry-run","workflow":"risk-check","normalizedRequest":{"dryRun":true}}\\n\'\n',
+    const bin = makeSidecarFixture(
+      dir,
+      "process.stdout.write('{\"status\":\"dry-run\",\"workflow\":\"risk-check\",\"normalizedRequest\":{\"dryRun\":true}}\\n');\n",
     );
-    chmodSync(bin, 0o755);
 
     const result = spawnSync(
       process.execPath,

package/src/codex-sidecar.mjs

@@ -1,4 +1,4 @@
-import { spawnSync } from 'node:child_process';
+import { spawnPortableSync } from './portable-spawn-sync.mjs';
 
 export const CODEX_SIDECAR_WORKFLOWS = Object.freeze([
   'review',
@@ -27,10 +27,7 @@ export function shouldShellWrapSidecarCommand(platform = process.platform) {
 }
 
 export function runCodexSidecarCommand(command, args, options = {}) {
-  return spawnSync(command, args, {
-    ...options,
-    shell: shouldShellWrapSidecarCommand(),
-  });
+  return spawnPortableSync(command, args, options);
 }
 
 export function inferWorkflowForPreset(preset) {

package/src/codex-sidecar.test.mjs

@@ -12,8 +12,16 @@ import {
 } from './codex-sidecar.mjs';
 
 function makeExecutable(dir, name, body) {
+  const script = join(dir, `${name}.mjs`);
+  writeFileSync(script, body);
+  if (process.platform === 'win32') {
+    const path = join(dir, `${name}.cmd`);
+    writeFileSync(path, `@echo off\r\n${JSON.stringify(process.execPath)} ${JSON.stringify(script)} %*\r\n`);
+    writeFileSync(join(dir, `${name}.ps1`), `& ${JSON.stringify(process.execPath)} ${JSON.stringify(script)} @args\nexit $LASTEXITCODE\n`);
+    return path;
+  }
   const path = join(dir, name);
-  writeFileSync(path, body);
+  writeFileSync(path, `#!/bin/sh\nexec ${JSON.stringify(process.execPath)} ${JSON.stringify(script)} "$@"\n`);
   chmodSync(path, 0o755);
   return path;
 }
@@ -44,7 +52,7 @@ test('diagnoseCodexSidecar: non-zero diagnostics is unavailable', () => {
     const bin = makeExecutable(
       dir,
       'fake-sidecar',
-      '#!/usr/bin/env bash\nprintf "bad config" >&2\nexit 7\n',
+      "process.stderr.write('bad config'); process.exit(7);\n",
     );
     const result = diagnoseCodexSidecar({
       projectPath: '/repo',
@@ -66,7 +74,7 @@ test('diagnoseCodexSidecar: zero diagnostics is configured', () => {
     const bin = makeExecutable(
       dir,
       'fake-sidecar',
-      '#!/usr/bin/env bash\nprintf "ok diagnostics for $*\\n"\nexit 0\n',
+      "process.stdout.write(`ok diagnostics for ${process.argv.slice(2).join(' ')}\\n`);\n",
     );
     const result = diagnoseCodexSidecar({
       projectPath: '/repo',
@@ -102,9 +110,9 @@ test('runCodexSidecarDryRun: emits a dry-run request for review preset', () => {
     const bin = makeExecutable(
       dir,
       'fake-sidecar',
-      `#!/usr/bin/env bash
-printf '%s\\n' "$@" > "${argsFile}"
-printf '{"status":"dry-run","workflow":"review","normalizedRequest":{"dryRun":true}}\\n'
+      `import { writeFileSync } from 'node:fs';
+writeFileSync(${JSON.stringify(argsFile)}, process.argv.slice(2).join('\\n') + '\\n');
+process.stdout.write('{"status":"dry-run","workflow":"review","normalizedRequest":{"dryRun":true}}\\n');
 `,
     );
     const result = runCodexSidecarDryRun({
@@ -141,9 +149,9 @@ test('runCodexSidecarDryRun: infers risk-check workflow from preset', () => {
     const bin = makeExecutable(
       dir,
       'fake-sidecar',
-      `#!/usr/bin/env bash
-printf '%s\\n' "$@" > "${argsFile}"
-printf '{"status":"dry-run","workflow":"risk-check","normalizedRequest":{"dryRun":true}}\\n'
+      `import { writeFileSync } from 'node:fs';
+writeFileSync(${JSON.stringify(argsFile)}, process.argv.slice(2).join('\\n') + '\\n');
+process.stdout.write('{"status":"dry-run","workflow":"risk-check","normalizedRequest":{"dryRun":true}}\\n');
 `,
     );
     const result = runCodexSidecarDryRun({

package/src/codex-thread-index.mjs

@@ -28,7 +28,7 @@ export function listCodexThreadCandidates({
       const meta = readSessionMeta(rollout.path);
       const indexed = index.get(rollout.threadId) ?? {};
       const cwd = meta?.cwd ?? null;
-      const matchesProject = cwd ? normalizePath(cwd) === normalizedProject : false;
+      const matchesProject = cwd ? isSameProjectOrDescendant(normalizePath(cwd), normalizedProject) : false;
       return {
         id: rollout.threadId,
         threadName: indexed.thread_name ?? null,
@@ -69,7 +69,7 @@ export function findCodexThreadCandidate({
       const meta = readSessionMeta(rollout.path);
       const indexed = index.get(rollout.threadId) ?? {};
       const cwd = meta?.cwd ?? null;
-      const matchesProject = cwd ? normalizePath(cwd) === normalizedProject : false;
+      const matchesProject = cwd ? isSameProjectOrDescendant(normalizePath(cwd), normalizedProject) : false;
       return {
         id: rollout.threadId,
         threadName: indexed.thread_name ?? null,
@@ -169,6 +169,16 @@ function compareCandidates(a, b) {
 }
 
 function normalizePath(value) {
+  const raw = String(value);
+  if (/^[A-Za-z]:[\\/]/.test(raw)) {
+    let resolved = raw;
+    try {
+      if (existsSync(raw)) resolved = realpathSync.native(raw);
+    } catch {
+      // Keep the lexical Windows path when it cannot be resolved.
+    }
+    return resolved.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+  }
   let resolved = resolve(value);
   try {
     if (existsSync(resolved)) resolved = realpathSync.native(resolved);
@@ -177,3 +187,8 @@ function normalizePath(value) {
   }
   return resolved.split(sep).join('/').replace(/\/+$/, '').toLowerCase();
 }
+
+function isSameProjectOrDescendant(candidate, root) {
+  if (!candidate || !root) return false;
+  return candidate === root || candidate.startsWith(`${root}/`);
+}

package/src/db.mjs

@@ -9,7 +9,7 @@ import { join } from 'path';
 
 const DB_DIR = join(homedir(), '.throughline');
 const DB_PATH = join(DB_DIR, 'throughline.db');
-const CURRENT_VERSION = 8;
+export const CURRENT_VERSION = 8;
 
 let _db = null;