worktrust 0.6.16 → 0.6.17

package/README.md

@@ -79,6 +79,8 @@ yourself run a command that sends. See [Keep your history](#keep-your-history).
 
 ```
 npx worktrust@latest history       send this computer's earlier sessions later (asks first)
+npx worktrust@latest history --rebuild   re-measure them with the current rules; WorkTrust replaces this computer's
+                                   earlier lines day by day, never counting a day twice (shows the plan, asks first)
 npx worktrust codex         let Codex wake the session hook (asks first)
 npx worktrust antigravity   let Antigravity wake the session hook (asks first)
 npx worktrust@latest status        what is coupled here
@@ -179,6 +181,36 @@ and counts, exactly as the session hook reads it.
   [worktrust.io/preserve](https://worktrust.io/preserve) is this package plus a guideline, for teams
   that want the same record without WorkTrust.
 
+## Rebuild the history
+
+A newer version of this command measures a session differently from an older one: what the seconds were (the model
+answering, tools running, your own turns, pauses), your own turns rather than every message, tokens with the cache,
+and more AI apps (Cursor, Copilot, Hermes, Goose, OpenCode, OpenClaw, Codex, Antigravity). Lines an earlier version
+sent stand as they were measured then, and sending the sessions again would count those days twice: an old line
+does not name its stretch, so WorkTrust cannot tell it from the one that arrives.
+
+`npx worktrust@latest history --rebuild` re-measures every session still on this computer with the current rules and
+sends them with one difference: WorkTrust **replaces** this computer's earlier lines, day by day.
+
+- **What it does.** It shows the plan first: per AI app, the days and the measured hours it would send, and the first
+  and last day. It asks once; Enter is No. `--dry-run` shows the plan and stops. Nothing is sent before a typed `y`.
+  For every day and AI app it carries, WorkTrust withdraws this computer's earlier lines (sent by this key or by an
+  earlier key of the same computer, live or as history), each with a correction row that says why, and then stores the
+  re-measured lines. A line that arrives unchanged is kept as it is. A day is counted once, and the same rebuild sent
+  twice changes nothing.
+- **What it never does.** A replaced line is withdrawn and kept, never deleted: it stays in your record and the record shows
+  each replacement; deleting your account still removes all of it. Never touched: another computer's lines, what a web
+  connector (Claude or ChatGPT on the web) brought in, an AI app the batch does not carry, a day it does not carry, a line
+  you made private, a line less than 48 hours old (the session hook's own window), and a line received in the last 12
+  hours (the batches of one run never replace each other). It sends what `history` sends and nothing more: durations,
+  token counts, model names, a layer keyword, counts; never text.
+- **Only from this computer's own key.** A connector (an AI signed in on the web) cannot ask for a rebuild; WorkTrust
+  refuses it at the door.
+- **Offered once by `update`.** When this computer's earlier lines were made by an earlier version (the copy in
+  `~/.worktrust` says which), `npx worktrust@latest update` says so in plain words and offers the rebuild; Enter is No,
+  and the same version updated again offers nothing. The command cannot read your record, so it is an offer, not a
+  finding.
+
 ## Where the key lives, and why it only works here
 
 The key is kept in **one file only you can read**: `~/.worktrust/key.json` (mode 600, in a folder of

package/log-session.mjs

@@ -23,7 +23,8 @@
  *   node log-session.mjs --uninstall [--purge] take it out again (--purge also deletes the copies)
  *   node log-session.mjs --dry-run            show what the current transcripts would send
  *   node log-session.mjs --history [--dry-run] send the months already on this machine, as HISTORY
- *   node log-session.mjs --history --summary   one JSON line: sessions, hours, first and last month (sends nothing)
+ *   node log-session.mjs --history --rebuild   the same, re-measured: the door REPLACES this computer's earlier lines, day by day
+ *   node log-session.mjs --history --summary   one JSON line: sessions, hours, first and last month, per client (sends nothing)
  *   (as a hook)                                reads the hook's JSON on stdin, logs, exits
  *   (from Codex)                               notify = ["node", "~/.worktrust/log-session.mjs", "--codex-notify"]
  *                                              in ~/.codex/config.toml: Codex calls it at every turn's end and
@@ -61,11 +62,9 @@ import { fileURLToPath } from "node:url";
 import { createHash, randomBytes, sign as cryptoSign } from "node:crypto";
 
 const args = process.argv.slice(2);
-const flag = (name) => args.includes(`--${name}`);
+const flag = (name) => args.includes(`--${name}`), value = (name) => { const i = args.indexOf(`--${name}`); return i >= 0 ? args[i + 1] : undefined; }, DRY = flag("dry-run");
 // Exit once stdout is written: to a pipe it is asynchronous and process.exit drops what is queued (0.6.13 cut --archive-lines).
 const exitFlushed = (code) => new Promise((resolve) => process.stdout.write("", resolve)).then(() => process.exit(code));
-const value = (name) => { const i = args.indexOf(`--${name}`); return i >= 0 ? args[i + 1] : undefined; };
-const DRY = flag("dry-run");
 
 /**
  * THE OTHER HALF OF A SESSION: HOW IT WAS ASKED.
@@ -136,8 +135,7 @@ const DAY_SECONDS = 86400;
 const TOOL_CAP = 1800;
 /** Tools whose result waits for the person: the gap to it is the person's time. Names only; nothing of the call is read. */
 const WAITS_FOR_PERSON = new Set(["AskUserQuestion", "ExitPlanMode"]);
-const AGENT_RUNS_MAX = 10000;
-const AGENT_SECONDS_MAX = 2592000;
+const AGENT_RUNS_MAX = 10000, AGENT_SECONDS_MAX = 2592000;
 
 /**
  * WHEN THE HOOK RUNS. SessionEnd alone was a bet that sessions end, and a session that stays open
@@ -151,8 +149,7 @@ const AGENT_SECONDS_MAX = 2592000;
 const HOOK_EVENTS = ["SessionEnd", "SessionStart", "PreCompact"];
 
 const STATE = join(homedir(), ".worktrust", "sessions.json");
-const readState = () => { try { return JSON.parse(readFileSync(STATE, "utf8")); } catch { return {}; } };
-const writeState = (state) => { mkdirSync(dirname(STATE), { recursive: true }); writeFileSync(STATE, JSON.stringify(state, null, 1)); };
+const readState = () => { try { return JSON.parse(readFileSync(STATE, "utf8")); } catch { return {}; } }, writeState = (state) => { mkdirSync(dirname(STATE), { recursive: true }); writeFileSync(STATE, JSON.stringify(state, null, 1)); };
 /**
  * THE FLOORS (owner, 2026-10-04: "history is never sent silently"). `__from` is the moment this
  * computer was coupled: the hook sends nothing measured before it, so a fresh coupling (or one after
@@ -580,7 +577,7 @@ function payloadFor(stretch) {
  * exactly what landed. `announce` because one caller is a person watching a terminal and the other
  * is a hook holding a session's exit open.
  */
-async function sendHistory(door, entries, announce = false) {
+async function sendHistory(door, entries, announce = false, rebuild = false) {
   let accepted = 0;
   // A Codex entry goes through Codex's own coupling where one exists (see codexDoor), the rest
   // through the door given: the record files a line under the coupling that sent it. Antigravity's
@@ -590,9 +587,10 @@ async function sendHistory(door, entries, announce = false) {
   if (group.length === 0 || !target) continue;
   for (let i = 0; i < group.length; i += 200) {
     const batch = group.slice(i, i + 200);
-    // History carries no shas: an imported line forms no session, and the join is the live route's.
-    const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "import_history", arguments: { entries: batch.map((entry) => { const { commits, ...rest } = entry; void commits; return rest; }) } } });
-    const response = await fetch(target.url, { method: "POST", headers: { "content-type": "application/json", accept: "application/json, text/event-stream", authorization: `Bearer ${target.token}`, ...clientOf(source), ...proofFor(target.url, body) }, body });
+    // History carries no shas: an imported line forms no session, and the join is the live route's. REBUILD (owner, 2026-10-07): `rebuild: true`
+    // tells the door to replace this computer's earlier lines on the days and for the client the batch carries, and every group names its client.
+    const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "import_history", arguments: { ...(rebuild ? { rebuild: true } : {}), entries: batch.map((entry) => { const { commits, ...rest } = entry; void commits; return rest; }) } } });
+    const response = await fetch(target.url, { method: "POST", headers: { "content-type": "application/json", accept: "application/json, text/event-stream", authorization: `Bearer ${target.token}`, ...clientOf(source, rebuild), ...proofFor(target.url, body) }, body });
     const text = await response.text();
     if (announce) console.log(`batch ${Math.floor(i / 200) + 1}: ${response.status} ${text.slice(0, 200).replace(/\\n/g, " ")}`);
     if (!response.ok) break;
@@ -616,7 +614,7 @@ const proofFor = (url, body) => {
  * on this computer, and the door names a coupling's clients by the user-agent it hears (mcp_identify's
  * agents_seen). An Antigravity line names Antigravity: the product name, nothing of the work.
  */
-const clientOf = (source) => (source === "antigravity" || DATABASE_CLIENTS.includes(source) ? { "user-agent": `${source}/hook (worktrust-hook)` } : {});
+const clientOf = (source, always = false) => (always || source === "antigravity" || DATABASE_CLIENTS.includes(source) ? { "user-agent": `${source ?? "claude"}/hook (worktrust-hook)` } : {});
 
 async function send(door, payload) {
   const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "log_work", arguments: payload } });
@@ -870,17 +868,18 @@ if (flag("history")) {
   const entries = historyEntries(historyFloor);
   const hours = entries.reduce((sum, entry) => sum + (entry.seconds ?? 0), 0) / 3600;
   const months = [...new Set(entries.map((entry) => entry.at.slice(0, 7)))].sort();
-  // ONE LINE FOR `npx worktrust` TO ASK WITH (2026-10-03): sessions, hours, first and last month; nothing sent.
-  if (flag("summary")) { console.log(JSON.stringify({ sessions: new Set(entries.map((entry) => entryFile.get(entry).file)).size, hours: Math.round(hours * 10) / 10, first: months[0] ?? null, last: months.at(-1) ?? null })); await exitFlushed(0); }
-  console.log(`${entries.length} day-stretches · ${hours.toFixed(1)} measured hours · ${months.join(", ")}`);
+  // ONE LINE FOR `npx worktrust` TO ASK WITH (2026-10-03): sessions, hours, first and last month; per client its days and hours (the rebuild's plan, 2026-10-07); nothing sent.
+  const clients = [...entries.reduce((map, entry) => { const client = entrySource.get(entry) ?? "claude", row = map.get(client) ?? { client, days: new Set(), seconds: 0 }; row.days.add(entry.at.slice(0, 10)); row.seconds += entry.seconds ?? 0; return map.set(client, row); }, new Map()).values()].map((row) => ({ client: row.client, days: row.days.size, hours: Math.round(row.seconds / 360) / 10, first: [...row.days].sort()[0], last: [...row.days].sort().at(-1) }));
+  if (flag("summary")) { console.log(JSON.stringify({ sessions: new Set(entries.map((entry) => entryFile.get(entry).file)).size, hours: Math.round(hours * 10) / 10, first: months[0] ?? null, last: months.at(-1) ?? null, clients })); await exitFlushed(0); }
+  console.log(`${entries.length} day-stretches · ${hours.toFixed(1)} measured hours · ${months.join(", ")}${flag("rebuild") ? " · rebuild: this computer's earlier lines for these days and clients are replaced at the door" : ""}`);
   if (DRY) {
     // One example in full: the shape is the argument for trusting it, and a summary hides it.
     if (entries[0]) console.log(`\nthe oldest of them, in full:\n${JSON.stringify(entries[0], null, 1)}`);
-    console.log("\ndry run — nothing sent. Add --history without --dry-run to import them.");
+    console.log(`\ndry run — nothing sent. Add --history${flag("rebuild") ? " --rebuild" : ""} without --dry-run to ${flag("rebuild") ? "rebuild" : "import"} them.`);
     await exitFlushed(0);
   }
   // A batch the door refused is a failure the caller must see, not a quiet zero.
-  await exitFlushed((await sendHistory(door, entries, true)) === entries.length ? 0 : 1);
+  await exitFlushed((await sendHistory(door, entries, true, flag("rebuild"))) === entries.length ? 0 : 1);
 }
 
 const input = hookInput();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "worktrust",
-  "version": "0.6.16",
+  "version": "0.6.17",
   "description": "Couple this computer to WorkTrust: approve a code in your browser, and every AI app here reports what you built. Metadata only, no dependencies.",
   "type": "module",
   "bin": {

package/worktrust.mjs

@@ -10,6 +10,8 @@
  *   npx worktrust@latest connect               couple again, also on a computer already coupled
  *   npx worktrust@latest update                this computer onto the newest CLI, same key, no new pairing
  *   npx worktrust@latest history               send this computer's earlier sessions as history (asks first)
+ *   npx worktrust@latest history --rebuild     re-measure them with the current rules; WorkTrust replaces this computer's
+ *                                              earlier lines day by day, never counting a day twice (shows the plan, asks first)
  *   npx worktrust@latest disconnect            show what comes out, ask, take it out again
  *   npx worktrust@latest status                what is coupled here
  *   npx worktrust@latest preserve              how long each AI app here keeps its sessions (--apply keeps them,
@@ -69,7 +71,7 @@ const command = args.find((arg, at) => !arg.startsWith("--") && !(at > 0 && VALU
 const flag = (name) => { const at = args.indexOf(`--${name}`); return at >= 0 ? args[at + 1] : undefined; };
 const has = (name) => args.includes(`--${name}`);
 /** This CLI's version, said to the door so the app can tell which computer runs an old one (check-cli-package holds it equal to package.json). */
-const CLI_VERSION = "0.6.16";
+const CLI_VERSION = "0.6.17";
 const ORIGIN = (flag("origin") ?? process.env.WORKTRUST_ORIGIN ?? "https://app.worktrust.io").replace(/\/$/, "");
 const MCP = flag("url") ?? process.env.WORKTRUST_MCP_URL ?? `${ORIGIN}/api/mcp`;
 const HOME_DIR = join(homedir(), ".worktrust");
@@ -532,6 +534,7 @@ async function update() {
   if (has("dry-run")) { say("  Dry run: nothing was written and nothing was sent."); return; }
   if (!(await ask("Continue?"))) { say("  Stopped. Nothing was written."); return; }
   ensureHome();
+  const previousVersion = stableVersion();
   copyFileSync(fileURLToPath(import.meta.url), STABLE);
   say(`  ✓ ${STABLE} is now ${CLI_VERSION}`);
   // Out first, then in: an app that held a key of its own (a hand-made entry) moves onto the bridge.
@@ -542,6 +545,7 @@ async function update() {
   // Codex installed since, or a No said at connect: the one question, asked again (or "already set").
   await offerCodex();
   await offerAntigravity();
+  await offerRebuild(previousVersion, paths, key);
   say();
   say("  Done. Quit your AI apps completely and open them again; the CLI version shows in WorkTrust");
   say("  under Sources → CLI once one of them has spoken. A key an app held by hand still works until you end it there.");
@@ -631,24 +635,52 @@ async function connect() {
  * Enter, --yes and a closed terminal all mean No; `--history` says yes in advance. What goes is hours
  * and tokens per day, filed as history (never verified hours, never text).
  */
-async function offerHistory(paths, token, devicePem, url = MCP) {
+async function offerHistory(paths, token, devicePem, url = MCP, rebuild = false) {
   const env = { WORKTRUST_MCP_URL: url, ...(devicePem ? { WORKTRUST_DEVICE_KEY: devicePem } : {}) };
   const counted = await run(paths["log-session.mjs"], ["--history", "--dry-run", "--summary"], token, true, env);
   let found = null;
   try { found = JSON.parse(counted.out.trim().split("\n").pop()); } catch { /* no line: nothing to offer */ }
   say();
-  if (!found?.sessions) { say("  Your AI apps hold no earlier sessions on this computer to send."); return; }
+  if (!found?.sessions) { say(rebuild ? "  Your AI apps hold no earlier sessions on this computer to re-measure." : "  Your AI apps hold no earlier sessions on this computer to send."); return; }
   say(`  This computer holds ${found.sessions} earlier sessions of your AI apps · ${found.hours} measured hours · ${found.first} … ${found.last}.`);
+  // REBUILD (owner, 2026-10-07): the plan per AI app, in days and hours, and what it replaces, before the one question. Enter is No.
+  if (rebuild) {
+    for (const row of found.clients ?? []) say(`    ${row.client.padEnd(12)} ${String(row.days).padStart(4)} days  ${String(row.hours).padStart(7)} h   ${row.first} … ${row.last}`);
+    say("  Re-measured with the current rules (what the seconds were, your own turns, tokens with the cache, every AI app above).");
+    say("  WorkTrust REPLACES this computer's earlier lines for those days and apps: each earlier line is withdrawn and kept,");
+    say("  never deleted, so a day is counted once. Other computers, web sources and days not listed are not touched.");
+  }
   if (has("dry-run")) { say("  Dry run: nothing was sent."); return; }
-  if (!has("history") && !(await ask("Send these as history (hours and tokens per day; never text)?", false))) { say("  Not sent. Send them later with: npx worktrust@latest history"); return; }
-  const sent = await run(paths["log-session.mjs"], ["--history"], token, true, env);
-  say(sent.code === 0 ? "  ✓ Sent as history. It shows in WorkTrust as earlier work, never as verified hours." : "  Not all of it arrived. Run npx worktrust@latest history again: a line already received is kept once.");
+  if (!has("history") && !(rebuild ? await ask("Rebuild the history (replaces this computer's earlier lines for these days)?", false) : await ask("Send these as history (hours and tokens per day; never text)?", false))) { say(rebuild ? "  Not sent. Rebuild later with: npx worktrust@latest history --rebuild" : "  Not sent. Send them later with: npx worktrust@latest history"); return; }
+  const sent = await run(paths["log-session.mjs"], ["--history", ...(rebuild ? ["--rebuild"] : [])], token, true, env);
+  if (rebuild) say(sent.code === 0 ? "  ✓ Rebuilt. This computer's earlier lines for those days were replaced; the record shows each replacement." : "  Not all of it arrived. Run npx worktrust@latest history --rebuild again: a day already rebuilt is counted once.");
+  else say(sent.code === 0 ? "  ✓ Sent as history. It shows in WorkTrust as earlier work, never as verified hours." : "  Not all of it arrived. Run npx worktrust@latest history again: a line already received is kept once.");
+}
+
+/** The version stamped in the stable copy in ~/.worktrust, the CLI this computer ran before an update; null without one. */
+const stableVersion = () => { try { return /const CLI_VERSION = "([^"]+)";/.exec(readFileSync(STABLE, "utf8"))?.[1] ?? null; } catch { return null; } };
+
+/**
+ * OFFERED ONCE, BY `update`, IN PLAIN WORDS (owner, 2026-10-07): when the computer's earlier lines were made by an earlier CLI
+ * (the version the stable copy carried before this update). The CLI cannot read the record, so it is an offer, not a
+ * finding: the plan is shown and the question asked by the same path as `history --rebuild`; Enter is No. The same
+ * version updated again offers nothing.
+ */
+async function offerRebuild(previousVersion, paths, key) {
+  if (!previousVersion || previousVersion === CLI_VERSION) return;
+  say();
+  say(`  This computer's earlier lines in WorkTrust were measured by worktrust ${previousVersion}. Version ${CLI_VERSION} measures`);
+  say("  differently (what the seconds were, your own turns, tokens with the cache, more AI apps). You can re-measure the");
+  say("  sessions still on this computer and have WorkTrust replace this computer's earlier lines, day by day, never counting");
+  say("  a day twice. Later: npx worktrust@latest history --rebuild");
+  if (!(await ask("Show the plan and rebuild now?", false))) { say("  Not now."); return; }
+  await offerHistory(paths, key.token, key.device ?? null, key.url, true);
 }
 
 async function history() {
   const key = await freshKey();
   if (!key) fail("this computer is not coupled through the key file. Run npx worktrust first.");
-  await offerHistory(await scripts(), key.token, key.device ?? null, key.url);
+  await offerHistory(await scripts(), key.token, key.device ?? null, key.url, has("rebuild"));
 }
 
 /**
@@ -843,6 +875,8 @@ function help() {
   say("    --replace            yes in advance to coupling a computer that is already coupled");
   say("  worktrust update       this computer onto the newest CLI: same key, no new pairing");
   say("  worktrust history      send this computer's earlier sessions as history (asks first)");
+  say("    --rebuild            re-measure them with the current rules; WorkTrust replaces this computer's earlier lines,");
+  say("                         day by day, never counting a day twice (shows the plan per AI app, asks first; --dry-run: the plan only)");
   say("  worktrust disconnect   take WorkTrust out of every AI app here (asks first)");
   say("  worktrust status       what is coupled here");
   say("  worktrust preserve     keep your AI history: the report, then the settings and a local archive, each on your yes");