wendkeep 0.68.0 → 0.68.5

package/packages/integrations/src/prompt-content.mjs

@@ -8,6 +8,18 @@ export function isBootstrapPrompt(text = '') {
     || clean.startsWith('## Memory');
 }
 
+const SYNTHETIC_EVENT_TAG = /^<\/?(?:task-notification|system-reminder|local-command-stdout|local-command-stderr|local-command-caveat|command-message|command-name|command-args|user-prompt-submit-hook|subagent_notification|subagent-notification|ide_[A-Za-z0-9_-]+|environment_context)\b/i;
+
+// Shared by transcript and token-usage parsers. These wrappers are harness metadata, not human
+// prompts; keeping the filter here prevents the two import paths from drifting.
+export function isSyntheticTranscriptText(text = '') {
+  const trimmed = String(text || '').trim();
+  return SYNTHETIC_EVENT_TAG.test(trimmed)
+    || isBootstrapPrompt(trimmed)
+    || /^Generate a concise( UI)? title/i.test(trimmed)
+    || /^You are a helpful assistant\. You will be presented with a user prompt/i.test(trimmed);
+}
+
 export function redactSecrets(text) {
   if (!text) return '';
   return String(text)

package/packages/integrations/src/transcripts.mjs

@@ -1,5 +1,5 @@
 import {
-  isBootstrapPrompt,
+  isSyntheticTranscriptText,
   redactSecrets,
   sanitizeAssistantMessage,
 } from './prompt-content.mjs';
@@ -20,14 +20,8 @@ function extractContentText(content) {
     .trim();
 }
 
-const SYNTHETIC_EVENT_TAG = /^<\/?(?:task-notification|system-reminder|local-command-stdout|local-command-stderr|command-message|command-name|command-args|user-prompt-submit-hook|ide_selection|ide_opened_file|environment_context)\b/i;
-
 function shouldIgnoreUserText(text) {
-  const trimmed = String(text || '').trim();
-  return SYNTHETIC_EVENT_TAG.test(trimmed)
-    || isBootstrapPrompt(trimmed)
-    || /^Generate a concise( UI)? title/i.test(trimmed)
-    || /^You are a helpful assistant\. You will be presented with a user prompt/i.test(trimmed);
+  return isSyntheticTranscriptText(text);
 }
 
 function addUnique(list, value) {
@@ -180,6 +174,16 @@ export function completedCodexTurnIdsContent(content = '') {
   return completed;
 }
 
+export function abortedCodexTurnIdsContent(content = '') {
+  const aborted = new Set();
+  for (const event of jsonLines(content)) {
+    if (event.type !== 'event_msg' || event.payload?.type !== 'turn_aborted') continue;
+    const turnId = String(event.payload?.turn_id || event.turn_id || '').trim();
+    if (turnId) aborted.add(turnId);
+  }
+  return aborted;
+}
+
 export function parseCodexTranscriptContent(content, options = {}) {
   const result = createResult('codex');
   const eventUserPrompts = [];
@@ -208,6 +212,11 @@ export function parseCodexTranscriptContent(content, options = {}) {
       ensureTurn(result.latestTurnId, event.timestamp);
       continue;
     }
+    if (event.type === 'event_msg' && event.payload?.type === 'turn_aborted') {
+      const turn = ensureTurn(event.payload.turn_id || event.turn_id || result.latestTurnId, event.timestamp);
+      turn.status = 'aborted';
+      continue;
+    }
     if (event.type === 'turn_context') {
       result.latestTurnId = event.payload?.turn_id || result.latestTurnId;
       result.model = event.payload?.model || result.model;
@@ -280,6 +289,26 @@ export function parseCodexTranscriptContent(content, options = {}) {
         }
       }
     }
+    if (payload.type === 'custom_tool_call') {
+      const name = payload.name || payload.tool_name || payload.tool || 'custom_tool_call';
+      const turn = ensureTurn(payload.turn_id || event.turn_id || result.latestTurnId, event.timestamp);
+      addUnique(result.tools, name);
+      addUnique(turn.tools, name);
+      const parsed = parseToolArguments(payload.arguments ?? payload.input ?? payload.parameters);
+      const combined = typeof parsed.raw === 'string' ? parsed.raw : toolArgumentText(parsed);
+      for (const path of extractPaths(combined, paths)) {
+        addUnique(result.consultedFiles, path);
+        addUnique(turn.consultedFiles, path);
+      }
+      for (const path of extractPatchFiles(combined)) {
+        addUnique(result.changedFiles, path);
+        addUnique(turn.changedFiles, path);
+      }
+    }
+    if (payload.type === 'custom_tool_call_output') {
+      // A custom tool output closes an existing call; it is deliberately not a second tool.
+      ensureTurn(payload.turn_id || event.turn_id || result.latestTurnId, event.timestamp);
+    }
     if (payload.type === 'tool_search_call') {
       const turn = ensureTurn(payload.turn_id || event.turn_id || result.latestTurnId, event.timestamp);
       addUnique(result.tools, 'tool_search');

package/packages/vault/src/memory-store.mjs

@@ -446,6 +446,27 @@ function currentEventFromRecord(record) {
   return { ...record.source, value: record.value, revision: record.revision };
 }
 
+function supersededTransitively(superseded, sourceEventId, finalEventId) {
+  if (!sourceEventId || !finalEventId || sourceEventId === finalEventId) return false;
+  const edges = new Map();
+  for (const item of superseded) {
+    if (!edges.has(item.event_id)) edges.set(item.event_id, []);
+    edges.get(item.event_id).push(item.by_event_id);
+  }
+  const pending = [sourceEventId];
+  const visited = new Set();
+  while (pending.length) {
+    const current = pending.shift();
+    if (visited.has(current)) continue;
+    visited.add(current);
+    for (const next of edges.get(current) || []) {
+      if (next === finalEventId) return true;
+      if (!visited.has(next)) pending.push(next);
+    }
+  }
+  return false;
+}
+
 function isCausallyOlder(event, current) {
   if (!current) return false;
   if (sameCausalActivation(event, current)) {
@@ -636,6 +657,24 @@ export function reduceMemoryEvents(inputEvents = [], {
     }
     records.set(item.memory_key, { value: item.value, revision: current.revision + 1, source: item });
     tombstones.delete(item.memory_key);
+    const explicitlySupersededIds = new Set(
+      Array.isArray(item.supersedes)
+        ? item.supersedes
+        : (item.supersedes_event_id ? [item.supersedes_event_id] : []),
+    );
+    if (item.candidate_decision?.action === 'promote' && explicitlySupersededIds.size) {
+      for (const candidate of candidates) {
+        if (candidate.reason !== 'conflict' || !candidate.event_ids?.length) continue;
+        if (candidate.event_ids.every((eventId) => explicitlySupersededIds.has(eventId))) {
+          resolvedCandidateIds.add(candidate.candidate_id);
+        }
+      }
+      for (const pending of pendingAssertConflicts) {
+        if (explicitlySupersededIds.has(pending.event.event_id)) {
+          resolvedCandidateIds.add(pending.candidate.candidate_id);
+        }
+      }
+    }
     revision += 1;
     appliedEventIds.push(item.event_id);
   }
@@ -680,13 +719,36 @@ export function reduceMemoryEvents(inputEvents = [], {
     }
   }
 
+  const pendingByCandidateId = new Map(
+    pendingAssertConflicts.map((pending) => [pending.candidate.candidate_id, pending]),
+  );
+  const reanchoredCandidates = candidates
+    .map((candidate) => {
+      const pending = pendingByCandidateId.get(candidate.candidate_id);
+      if (!pending) return candidate;
+      const finalSource = currentEventFromRecord(records.get(candidate.memory_key));
+      const previousSource = candidate.events?.find(
+        (event) => event.event_id !== pending.event.event_id,
+      );
+      if (!finalSource || !previousSource || finalSource.event_id === previousSource.event_id) {
+        return candidate;
+      }
+      if (!sameCompleteCausalLineage(previousSource, finalSource)
+          || !supersededTransitively(superseded, previousSource.event_id, finalSource.event_id)) {
+        return candidate;
+      }
+      if (hashMemoryValue(finalSource.value) === hashMemoryValue(pending.event.value)) return null;
+      return conflictCandidate(candidate.memory_key, [finalSource, pending.event], finalSource);
+    })
+    .filter(Boolean);
+
   const stateEntries = [...records].map(([key, record]) => [key, record.value]);
   const recordEntries = [...records].map(([key, record]) => [key, record]);
   const tombstoneEntries = [...tombstones];
   const state = sortedObject(stateEntries);
   const recordObject = sortedObject(recordEntries);
   const tombstoneObject = sortedObject(tombstoneEntries);
-  const unresolvedCandidates = candidates
+  const unresolvedCandidates = reanchoredCandidates
     .filter((item) => !candidateDecisions.has(item.candidate_id)
       && !resolvedCandidateIds.has(item.candidate_id));
   unresolvedCandidates.sort((left, right) => left.candidate_id.localeCompare(right.candidate_id));

package/packages/vault/src/vault-path-safety.mjs

@@ -335,19 +335,36 @@ function waitBriefly(ms) {
   Atomics.wait(signal, 0, 0, ms);
 }
 
-// A public lock may legitimately disappear while another owner releases it. Only ENOENT
-// observed by an operation explicitly scoped to that canonical lock receives bounded
-// backoff; private .pending paths and every unsafe topology fail closed.
-function retryablePublicLockError(lock, error, code, { allowRaw = true } = {}) {
+// A public lock may legitimately disappear while another owner releases it. Structural shape
+// only: which errno a concurrent removal produces is a platform detail — Windows reports
+// UNKNOWN, EBADF or EPERM where Linux reports ENOENT — so the code is merely the trigger to go
+// re-observe, never the answer. Private .pending paths are siblings, not descendants, of the
+// canonical lock and are excluded by the containment check.
+function publicLockRetryCandidate(lock, error, code, { allowRaw = true } = {}) {
   const failure = error?.[VAULT_PATH_FAILURE];
+  // A raw error carries no component to re-observe, so it stays on the narrow ENOENT path.
   if (!failure) return allowRaw && error?.code === 'ENOENT' && !error?.cause;
-  const causeCode = error?.cause?.code || failure.causeCode;
-  return causeCode === 'ENOENT'
-    && (error?.code === code || error?.code === 'VAULT_PATH_UNSAFE')
+  return (error?.code === code || error?.code === 'VAULT_PATH_UNSAFE')
     && ['component-realpath', 'component-missing'].includes(failure.kind)
     && containedBy(resolve(lock), resolve(failure.component));
 }
 
+// The decision itself. Only a fresh walk that settles as a missing suffix or the canonical
+// entry authorizes a retry; junction, symlink, reparse, a redirected component or a state that
+// is still unresolvable keeps failing closed, exactly as a first-time validation would.
+function publicLockComponentSettled(vaultBase, error, code) {
+  const component = error?.[VAULT_PATH_FAILURE]?.component;
+  if (typeof component !== 'string' || !component) return false;
+  try {
+    assertVaultPathSafe(vaultBase, component, {
+      label: 'revalidação do lock de escrita do Vault', code,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function vaultLockRenameCollision(error, pending, lock) {
   const acceptedCodes = process.platform === 'win32'
     ? ['EEXIST', 'ENOTEMPTY', 'EPERM']
@@ -374,17 +391,22 @@ function vaultLockRetryDeadlineError() {
   return error;
 }
 
-function withPublicLockRetry(lock, code, retryState, operation, initialError = null) {
+function withPublicLockRetry(vaultBase, lock, code, retryState, operation, initialError = null) {
   let error = initialError;
   while (true) {
     if (error) {
-      if (!retryablePublicLockError(lock, error, code)
+      if (!publicLockRetryCandidate(lock, error, code)
         || retryState.remaining <= 0) throw error;
       const remainingMs = retryState.deadline - Date.now();
       if (remainingMs <= 0) throw vaultLockRetryDeadlineError();
       retryState.remaining -= 1;
       waitBriefly(Math.min(VAULT_LOCK_TOPOLOGY_RETRY_MS, remainingMs));
       if (Date.now() >= retryState.deadline) throw vaultLockRetryDeadlineError();
+      // Reclassify only after the backoff, and only while the deadline still allows a retry:
+      // "settled" means observed once the concurrent owner had a chance to finish releasing.
+      // A raw error carries no component and already passed the narrow ENOENT filter above.
+      if (error[VAULT_PATH_FAILURE]
+        && !publicLockComponentSettled(vaultBase, error, code)) throw error;
     }
     try {
       return operation();
@@ -395,9 +417,11 @@ function withPublicLockRetry(lock, code, retryState, operation, initialError = n
 }
 
 function inspectVaultLock(vaultBase, lock, code, retryState, initialError = null) {
-  return withPublicLockRetry(lock, code, retryState, () => assertVaultPathSafe(vaultBase, lock, {
-    expectedType: 'directory', label: 'lock de escrita do Vault', code,
-  }), initialError);
+  return withPublicLockRetry(vaultBase, lock, code, retryState, () => assertVaultPathSafe(
+    vaultBase, lock, {
+      expectedType: 'directory', label: 'lock de escrita do Vault', code,
+    },
+  ), initialError);
 }
 
 function processIsAlive(pid) {
@@ -447,7 +471,7 @@ function vaultLockOwner(vaultBase, lock, code, retryState = null) {
     }
   };
   return retryState
-    ? withPublicLockRetry(lock, code, retryState, inspect)
+    ? withPublicLockRetry(vaultBase, lock, code, retryState, inspect)
     : inspect();
 }
 
@@ -492,7 +516,7 @@ function releaseOwnedVaultLock(vaultBase, lock, {
   // The token-specific lease is the filesystem CAS. An old finally/reaper can only
   // remove the directory after successfully unlinking the lease it originally saw;
   // a replacement lock never contains that unguessable path.
-  const leaseRemoved = withPublicLockRetry(lock, code, retryState, () => unlinkVaultFile(
+  const leaseRemoved = withPublicLockRetry(vaultBase, lock, code, retryState, () => unlinkVaultFile(
     vaultBase, vaultLockLease(lock, token), {
       label: 'lease do lock de escrita do Vault', code,
     },
@@ -503,12 +527,12 @@ function releaseOwnedVaultLock(vaultBase, lock, {
   const current = currentState.owner;
   if (current?.pid !== pid || current?.token !== token) return false;
   const ownerPath = join(lock, VAULT_LOCK_OWNER_FILE);
-  if (!withPublicLockRetry(lock, code, retryState, () => unlinkVaultFile(
+  if (!withPublicLockRetry(vaultBase, lock, code, retryState, () => unlinkVaultFile(
     vaultBase, ownerPath, {
       label: 'owner do lock de escrita do Vault', code,
     },
   ))) return false;
-  return withPublicLockRetry(lock, code, retryState, () => removeVaultLockDirectory(
+  return withPublicLockRetry(vaultBase, lock, code, retryState, () => removeVaultLockDirectory(
     vaultBase, lock, {
       missingOk: false, label: 'lock de escrita do Vault', code,
     },
@@ -516,7 +540,7 @@ function releaseOwnedVaultLock(vaultBase, lock, {
 }
 
 function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
-  const initial = withPublicLockRetry(lock, code, retryState, () => {
+  const initial = withPublicLockRetry(vaultBase, lock, code, retryState, () => {
     const checked = assertVaultPathSafe(vaultBase, lock, {
       expectedType: 'directory', label: 'lock de escrita do Vault', code,
     });
@@ -530,7 +554,7 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
   if (!observed.lockExists) return true;
   if (observed.owner) {
     if (processIsAlive(observed.owner.pid)) return false;
-    const lease = withPublicLockRetry(lock, code, retryState, () => {
+    const lease = withPublicLockRetry(vaultBase, lock, code, retryState, () => {
       const current = assertVaultPathSafe(vaultBase, lock, {
         expectedType: 'directory', label: 'lock de escrita do Vault', code,
       });
@@ -548,7 +572,7 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
     // Compatibility with owner-aware locks from 0.58.x, which predate token leases.
     // A dead PID plus byte-identical owner and directory identity is sufficient here;
     // a live legacy owner was returned above and is never reaped by age.
-    const legacy = withPublicLockRetry(lock, code, retryState, () => {
+    const legacy = withPublicLockRetry(vaultBase, lock, code, retryState, () => {
       const current = assertVaultPathSafe(vaultBase, lock, {
         expectedType: 'directory', label: 'lock legado de escrita do Vault', code,
       });
@@ -565,12 +589,12 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
     if (currentStat.birthtimeMs !== before.birthtimeMs
       || currentStat.mtimeMs !== before.mtimeMs
       || currentOwner.raw !== observed.raw) return false;
-    if (!withPublicLockRetry(lock, code, retryState, () => unlinkVaultFile(
+    if (!withPublicLockRetry(vaultBase, lock, code, retryState, () => unlinkVaultFile(
       vaultBase, currentOwner.path, {
         label: 'owner legado morto do lock de escrita do Vault', code,
       },
     ))) return false;
-    return withPublicLockRetry(lock, code, retryState, () => removeVaultLockDirectory(
+    return withPublicLockRetry(vaultBase, lock, code, retryState, () => removeVaultLockDirectory(
       vaultBase, checked.target, {
         missingOk: false, label: 'lock legado de escrita do Vault', code,
       },
@@ -580,7 +604,7 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
   // Locks are published by atomic directory rename only after owner + lease exist.
   // Thus an old empty/partial directory is legacy or crash residue, never an in-flight
   // live acquisition. Unknown children remain fail-closed.
-  const partial = withPublicLockRetry(lock, code, retryState, () => {
+  const partial = withPublicLockRetry(vaultBase, lock, code, retryState, () => {
     const current = assertVaultPathSafe(vaultBase, lock, {
       expectedType: 'directory', label: 'lock de escrita do Vault', code,
     });
@@ -604,12 +628,12 @@ function reapDeadVaultLock(vaultBase, lock, staleMs, code, retryState) {
     || currentStat.mtimeMs !== before.mtimeMs
     || currentOwner.raw !== observed.raw) return false;
   if (entries.includes(VAULT_LOCK_OWNER_FILE)
-    && !withPublicLockRetry(lock, code, retryState, () => unlinkVaultFile(
+    && !withPublicLockRetry(vaultBase, lock, code, retryState, () => unlinkVaultFile(
       vaultBase, currentOwner.path, {
         label: 'owner parcial do lock de escrita do Vault', code,
       },
     ))) return false;
-  return withPublicLockRetry(lock, code, retryState, () => removeVaultLockDirectory(
+  return withPublicLockRetry(vaultBase, lock, code, retryState, () => removeVaultLockDirectory(
     vaultBase, checked.target, {
       missingOk: false, label: 'lock de escrita do Vault', code,
     },
@@ -672,7 +696,8 @@ export function withVaultPathLock(vaultBase, path, fn, {
             });
             break;
           } catch (error) {
-            const retryableRenameRace = retryablePublicLockError(lock, error, code, {
+            // Shape check only; inspectVaultLock below re-observes through the full retry path.
+            const retryableRenameRace = publicLockRetryCandidate(lock, error, code, {
               allowRaw: false,
             });
             const nativeRenameCollision = vaultLockRenameCollision(error, pending, lock);

package/src/init.mjs

@@ -220,6 +220,7 @@ export function mergeCodexHooks(existing, { force = false } = {}) {
     const owning = groups.find((g) => (g.hooks || []).some(owns));
     if (owning) {
       const hk = owning.hooks.find(owns);
+      const matcher = CODEX_MATCHER_EVENTS.has(h.event) ? h.matcher : null;
       // `timeout` is the pre-0.46 key: Codex never read it. Migrate it even without --force,
       // otherwise the hook keeps running at the 600s default forever.
       const legacyTimeout = 'timeout' in hk;
@@ -233,6 +234,8 @@ export function mergeCodexHooks(existing, { force = false } = {}) {
           if (entry.statusMessage) hk.statusMessage = entry.statusMessage;
         }
       }
+      if (force && matcher) owning.matcher = matcher;
+      if (force && !matcher) delete owning.matcher;
       file.hooks[h.event] = groups;
       continue;
     }

package/src/memory.mjs

@@ -387,9 +387,16 @@ function promotedSupersedes(vault, candidate, selected) {
   const memberIds = new Set(Array.isArray(candidate.event_ids) ? candidate.event_ids : []);
   const ledger = readMemoryLedger(vault);
   if (ledger.status !== 'ok') throw new Error('Ledger de memória inválido durante a promoção.');
-  const current = deriveMemoryProjection(vault, ledger.events)
-    .records?.[candidate.memory_key]?.source;
-  if (!current?.event_id || memberIds.has(current.event_id)) return [...memberIds].sort();
+  const projection = deriveMemoryProjection(vault, ledger.events);
+  const current = projection.records?.[candidate.memory_key]?.source;
+  if (!current?.event_id) return [...memberIds].sort();
+  if (memberIds.has(current.event_id)) {
+    projection.superseded
+      .filter((item) => item.by_event_id === current.event_id)
+      .map((item) => item.event_id)
+      .forEach((eventId) => memberIds.add(eventId));
+    return [...memberIds].sort();
+  }
 
   const currentSelectedId = current.candidate_decision?.selected_event_id;
   const currentSelected = currentSelectedId