cli-mem 0.3.4__tar.gz → 0.3.6__tar.gz

{cli_mem-0.3.4 → cli_mem-0.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cli-mem
-Version: 0.3.4
+Version: 0.3.6
 Summary: Privacy-first CLI that turns shell history into searchable memory
 Project-URL: GitHub, https://github.com/matinsaurralde/mem
 Author: Matias Insaurralde

{cli_mem-0.3.4 → cli_mem-0.3.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cli-mem"
-version = "0.3.4"
+version = "0.3.6"
 description = "Privacy-first CLI that turns shell history into searchable memory"
 license = "MIT"
 readme = "README.md"

{cli_mem-0.3.4 → cli_mem-0.3.6}/src/mem/__init__.py

@@ -1,3 +1,3 @@
 """mem — your shell history, understood."""
 
-__version__ = "0.3.4"
+__version__ = "0.3.6"

{cli_mem-0.3.4 → cli_mem-0.3.6}/src/mem/capture.py

@@ -70,6 +70,32 @@ def capture_command(raw: str, directory: str, exit_code: int, duration_ms: int)
     except Exception:
         pass  # Session tracking failure should never block capture
 
+    # Auto-sync: trigger background pattern extraction every N captures
+    try:
+        count = storage.increment_sync_counter()
+        if count >= storage.SYNC_THRESHOLD:
+            storage.reset_sync_counter()
+            _spawn_background_sync()
+    except Exception:
+        pass  # Auto-sync failure should never block capture
+
+
+def _spawn_background_sync() -> None:
+    """Spawn `mem _sync` as a fully detached background process.
+
+    The subprocess inherits nothing from the parent — no stdout, no stderr,
+    no wait. It runs and exits silently.
+    """
+    import sys as _sys
+
+    mem_exe = _sys.executable
+    subprocess.Popen(
+        [mem_exe, "-m", "mem.cli", "_sync"],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        start_new_session=True,
+    )
+
 
 class SessionTracker:
     """Tracks work sessions across shell commands.

{cli_mem-0.3.4 → cli_mem-0.3.6}/src/mem/cli.py

@@ -209,29 +209,21 @@ add-zsh-hook precmd _mem_precmd
 """
 
 
-@cli.command()
-@click.option("--keep-commands", type=int, default=90, help="Days to retain commands")
-@click.option("--keep-sessions", type=int, default=30, help="Days to retain sessions")
-def sync(keep_commands: int, keep_sessions: int) -> None:
-    """Extract patterns and rotate old data."""
-    from rich.progress import Progress
-
-    from mem.patterns import sync_all_patterns
-    from mem import storage
-
-    # Pattern extraction
-    with Progress(console=console) as progress:
-        task = progress.add_task("Extracting patterns...", total=None)
-        new, updated = sync_all_patterns()
-        progress.update(task, completed=100, total=100)
+@cli.command(name="_sync", hidden=True)
+def sync_cmd() -> None:
+    """Internal: background pattern extraction and data rotation.
 
-    console.print(f"Patterns: {new} new, {updated} updated\n")
+    Triggered automatically every 20 captured commands. Runs silently —
+    no output, no errors. Never called by the user directly.
+    """
+    try:
+        from mem.patterns import sync_all_patterns
+        from mem import storage
 
-    # Rotation
-    cmd_removed, sess_removed = storage.rotate(keep_commands, keep_sessions)
-    console.print("Rotation:")
-    console.print(f"  Commands older than {keep_commands}d: {cmd_removed} removed")
-    console.print(f"  Sessions older than {keep_sessions}d: {sess_removed} removed")
+        sync_all_patterns(silent=True)
+        storage.rotate()
+    except Exception:
+        pass  # Background task — never surface errors
 
 
 @cli.command()

{cli_mem-0.3.4 → cli_mem-0.3.6}/src/mem/models.py

@@ -44,6 +44,7 @@ class PatternFile(BaseModel):
     tool: str = Field(min_length=1)
     patterns: list[CommandPattern]
     last_updated: int
+    processed_commands: list[str] = []
 
 
 class WorkSession(BaseModel):

{cli_mem-0.3.4 → cli_mem-0.3.6}/src/mem/patterns.py

@@ -118,24 +118,56 @@ async def _generalize_commands(tool: str, unique_commands: list[str]) -> dict[st
 
 
 async def extract_patterns_for_tool(
-    tool: str, commands: list[str]
+    tool: str,
+    commands: list[str],
+    already_processed: set[str] | None = None,
 ) -> PatternExtractionResult:
     """Extract abstract patterns from a list of concrete commands.
 
     Strategy:
     1. Deduplicate commands and count frequencies (code)
     2. Generalize each unique command via LLM (if available)
+       — skips commands in already_processed (cache hit)
     3. Aggregate frequencies by generalized pattern (code)
 
     Falls back to simple frequency grouping if SDK is unavailable.
     """
+    if already_processed is None:
+        already_processed = set()
+
     # Step 1: Count raw frequencies (code — fast and exact)
     raw_freq = Counter(commands)
     unique_cmds = list(raw_freq.keys())
 
     if _apple_fm_available():
-        # Step 2: Generalize unique commands (LLM — semantic understanding)
-        cmd_to_pattern = await _generalize_commands(tool, unique_cmds)
+        # Step 2: Generalize only NEW unique commands (LLM)
+        new_cmds = [c for c in unique_cmds if c not in already_processed]
+
+        # Load existing patterns to reuse cached generalizations
+        existing_pf = storage.read_patterns(tool)
+        cached_map: dict[str, str] = {}
+        if existing_pf:
+            # Rebuild command->pattern map from existing data
+            for p in existing_pf.patterns:
+                cached_map[p.example] = p.pattern
+
+        if new_cmds:
+            new_map = await _generalize_commands(tool, new_cmds)
+        else:
+            new_map = {}
+
+        # Merge: cached + new
+        cmd_to_pattern: dict[str, str] = {}
+        for cmd in unique_cmds:
+            if cmd in new_map:
+                cmd_to_pattern[cmd] = new_map[cmd]
+            elif cmd in cached_map:
+                cmd_to_pattern[cmd] = cached_map[cmd]
+            else:
+                # Command was processed before but not in cache
+                # (e.g., its example was a different command for same pattern)
+                # Fall back to raw command
+                cmd_to_pattern[cmd] = cmd
 
         # Step 3: Aggregate by pattern (code — exact counting)
         pattern_freq: Counter[str] = Counter()
@@ -197,34 +229,59 @@ def run_pattern_extraction(tool: str) -> None:
 
     Reads all commands starting with the tool name from storage,
     runs extraction, and writes the result to patterns/<tool>.json.
+
+    Uses caching: only sends new (unprocessed) commands to the LLM.
+    Already-processed commands are tracked in the PatternFile.
     """
     import asyncio
 
-    commands = [
+    all_commands = [
         cmd.command
         for cmd in storage.read_all_commands()
         if cmd.command.split()[0] == tool
     ]
 
-    if len(commands) < 5:
+    if len(all_commands) < 5:
         return  # Not enough data for meaningful patterns
 
-    result = asyncio.run(extract_patterns_for_tool(tool, commands))
+    # Load existing pattern file for cache
+    existing = storage.read_patterns(tool)
+    already_processed: set[str] = set()
+    if existing and existing.processed_commands:
+        already_processed = set(existing.processed_commands)
+
+    # Only send new commands to the LLM
+    new_commands = [c for c in all_commands if c not in already_processed]
+
+    if not new_commands and existing:
+        return  # Nothing new to process
+
+    # Extract patterns from ALL commands (new + old) but only generalize new ones
+    result = asyncio.run(
+        extract_patterns_for_tool(tool, all_commands, already_processed)
+    )
+
+    # Track all unique commands as processed
+    all_unique = list(set(all_commands))
 
     pf = PatternFile(
         tool=tool,
         patterns=result.patterns,
         last_updated=int(time.time()),
+        processed_commands=all_unique,
     )
     storage.write_patterns(pf)
 
 
-def sync_all_patterns() -> tuple[int, int]:
+def sync_all_patterns(silent: bool = False) -> tuple[int, int]:
     """Extract patterns for ALL tools with sufficient command history.
 
     Detects unique tools (first token of each command), runs extraction
     for each tool with >5 commands. Skips tools with insufficient data.
 
+    Args:
+        silent: If True, suppress all output (for background auto-sync).
+
     Returns (new_patterns, updated_patterns) counts.
     """
     # Collect all commands grouped by tool (first token)
@@ -249,7 +306,7 @@ def sync_all_patterns() -> tuple[int, int]:
         else:
             updated_count += 1
 
-    if not _apple_fm_available():
+    if not silent and not _apple_fm_available():
         print(
             "Tip: install AI support for smarter pattern extraction: "
             "pip install cli-mem[ai]",

{cli_mem-0.3.4 → cli_mem-0.3.6}/src/mem/storage.py

@@ -312,6 +312,36 @@ def forget_commands(query: str) -> int:
     return removed
 
 
+# --- Sync counter ---
+
+SYNC_COUNTER_FILE = MEM_DIR / ".sync_counter"
+SYNC_THRESHOLD = 20
+
+
+def read_sync_counter() -> int:
+    """Read the number of captures since last sync."""
+    if not SYNC_COUNTER_FILE.exists():
+        return 0
+    try:
+        return int(SYNC_COUNTER_FILE.read_text(encoding="utf-8").strip())
+    except (ValueError, OSError):
+        return 0
+
+
+def increment_sync_counter() -> int:
+    """Increment capture counter and return new value."""
+    count = read_sync_counter() + 1
+    ensure_dirs()
+    SYNC_COUNTER_FILE.write_text(str(count), encoding="utf-8")
+    return count
+
+
+def reset_sync_counter() -> None:
+    """Reset capture counter after a sync."""
+    ensure_dirs()
+    SYNC_COUNTER_FILE.write_text("0", encoding="utf-8")
+
+
 # --- Named Groups storage ---
 
 

{cli_mem-0.3.4 → cli_mem-0.3.6}/src/mem/variables.py

@@ -313,6 +313,41 @@ def _normalize_var_name(name: str) -> str:
     return result.strip("_")
 
 
+def _extract_value_from_syntax(original_value: str, cmd: str) -> str:
+    """Extract the actual secret value from flag=value or KEY=value syntax.
+
+    The AI sometimes returns 'GITHUB_TOKEN=ghp_abc...' or '--password=secret'
+    as the original_value. We need just the secret part so that .replace()
+    doesn't destroy the command structure.
+    """
+    # Pattern: --flag=value or -f=value (CLI flag syntax)
+    flag_match = re.match(r"^--?[a-zA-Z][\w-]*=(.+)$", original_value)
+    if flag_match:
+        value = flag_match.group(1)
+        if value in cmd:
+            return value
+
+    # Pattern: ENV_VAR=value (environment variable assignment)
+    env_match = re.match(r"^[A-Z][A-Z0-9_]+=(.+)$", original_value)
+    if env_match:
+        value = env_match.group(1)
+        if value in cmd:
+            return value
+
+    return original_value
+
+
+def _looks_like_hostname(value: str) -> bool:
+    """Check if a value looks like a hostname or domain, not a credential."""
+    # Hostnames: words joined by dots, no special chars typical of secrets
+    if re.match(r"^[a-zA-Z0-9]([a-zA-Z0-9-]*\.)+[a-zA-Z]{2,}$", value):
+        return True
+    # IP addresses
+    if re.match(r"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$", value):
+        return True
+    return False
+
+
 def _deduplicate_detections(
     detections: list[tuple[str, str, str]],
     cmd: str,
@@ -325,30 +360,39 @@ def _deduplicate_detections(
     - Very short values (< 8 chars, not plausible secrets)
     - Duplicate original_value entries
     - Values that are substrings of other detected values
+
+    Also extracts the actual secret from flag=value syntax when the AI
+    returns the whole expression as original_value.
     """
     result: list[tuple[str, str, str]] = []
     seen_values: set[str] = set()
 
     for original_value, suggested_name, reason in detections:
+        # Extract actual value from flag=value or ENV=value syntax
+        value = _extract_value_from_syntax(original_value, cmd)
+
         # Skip hallucinated values not in the command
-        if original_value not in cmd:
+        if value not in cmd:
             continue
         # Skip URLs
-        if original_value.startswith(("http://", "https://")):
+        if value.startswith(("http://", "https://")):
+            continue
+        # Skip hostnames and IP addresses
+        if _looks_like_hostname(value):
             continue
         # Skip very short values
-        if len(original_value) < 8:
+        if len(value) < 8:
             continue
         # Skip duplicates
-        if original_value in seen_values:
+        if value in seen_values:
             continue
         # Normalize suggested name to UPPER_SNAKE_CASE
         normalized = _normalize_var_name(suggested_name)
         if not re.match(r"^[A-Z][A-Z0-9_]+$", normalized):
             continue
 
-        seen_values.add(original_value)
-        result.append((original_value, normalized, reason))
+        seen_values.add(value)
+        result.append((value, normalized, reason))
 
     # Remove values that are substrings of other detected values
     filtered: list[tuple[str, str, str]] = []
@@ -387,17 +431,26 @@ async def _detect_credentials_async(cmd: str) -> list[tuple[str, str, str]]:
     prompt = (
         "Analyze this shell command and find ONLY hardcoded sensitive values "
         "that should be replaced with environment variables.\n\n"
+        "RULES FOR original_value:\n"
+        "- Return ONLY the literal secret value, not the flag or key name.\n"
+        "- For --password=mysecret, return 'mysecret' not '--password=mysecret'.\n"
+        "- For GITHUB_TOKEN=ghp_abc, return 'ghp_abc' not 'GITHUB_TOKEN=ghp_abc'.\n"
+        "- For postgres://user:pass@host, return 'pass' not the full URL.\n\n"
+        "RULES FOR suggested_name:\n"
+        "- Derive the name from the service or tool in the command.\n"
+        "- Examples: STRIPE_API_KEY, GITHUB_TOKEN, REDIS_PASSWORD, DB_PASSWORD.\n"
+        "- NEVER use generic prefixes like ACME_.\n\n"
         "ONLY flag these types of values:\n"
-        "- API tokens or keys (long alphanumeric/base64 strings like eyJhbG..., sk-...)\n"
-        "- Passwords passed inline (after --password, -p, etc.)\n"
+        "- API tokens or keys (long alphanumeric/base64 strings)\n"
+        "- Passwords passed inline (after --password, -p, -a, etc.)\n"
         "- Bearer tokens in Authorization headers\n"
-        "- Database connection strings with embedded passwords\n\n"
+        "- Embedded passwords in connection strings\n\n"
         "DO NOT flag:\n"
-        "- URLs, hostnames, or IP addresses\n"
-        "- The command name or subcommands\n"
+        "- URLs, hostnames, IP addresses, or domain names\n"
+        "- The command name, subcommands, or usernames\n"
         "- Short strings, regular arguments, or file paths\n"
-        "- Port numbers or known constants\n\n"
-        "If the command contains NO credentials, return an EMPTY list with no entries.\n\n"
+        "- Port numbers, known constants, or registry addresses\n\n"
+        "If NO credentials found, return an EMPTY list.\n\n"
         f"Command: {cmd}"
     )
 

{cli_mem-0.3.4 → cli_mem-0.3.6}/tests/conftest.py

@@ -21,6 +21,10 @@ def tmp_mem_dir(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
     monkeypatch.setattr(
         storage, "GROUPS_GLOBAL_FILE", tmp_path / "groups" / "_global.json"
     )
+    monkeypatch.setattr(
+        storage, "SYNC_COUNTER_FILE", tmp_path / ".sync_counter"
+    )
+    monkeypatch.setattr(storage, "VARS_FILE", tmp_path / "vars.json")
     return tmp_path
 
 

{cli_mem-0.3.4 → cli_mem-0.3.6}/tests/test_groups.py

@@ -1858,3 +1858,110 @@ class TestDeduplicateDetections:
         detections = [(token, "AcmeApiToken", "JWT")]
         result = _deduplicate_detections(detections, cmd)
         assert result[0][1] == "ACME_API_TOKEN"
+
+    def test_extracts_value_from_flag_syntax(self):
+        """Bug A: AI returns '--password=secret' instead of just 'secret'."""
+        from mem.variables import _deduplicate_detections
+
+        cmd = "mysql -u admin --password=S3cretP@ssw0rd123 mydb"
+        detections = [("--password=S3cretP@ssw0rd123", "DB_PASSWORD", "password")]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == "S3cretP@ssw0rd123"
+
+    def test_extracts_value_from_env_var_syntax(self):
+        """Bug A: AI returns 'GITHUB_TOKEN=ghp_abc...' instead of just the token."""
+        from mem.variables import _deduplicate_detections
+
+        token = "ghp_abcdefghijklmnopqrstuvwxyz123456"
+        cmd = f"GITHUB_TOKEN={token} gh pr create"
+        detections = [(f"GITHUB_TOKEN={token}", "GITHUB_TOKEN", "API token")]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == token
+
+    def test_filters_hostnames(self):
+        """Bug C: hostnames like registry.ghcr.io are not credentials."""
+        from mem.variables import _deduplicate_detections
+
+        cmd = "docker login -u deploy -p secret123456789 registry.ghcr.io"
+        detections = [
+            ("secret123456789", "REGISTRY_TOKEN", "token"),
+            ("registry.ghcr.io", "REGISTRY_URL", "hostname"),
+        ]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == "secret123456789"
+
+    def test_filters_ip_addresses(self):
+        from mem.variables import _deduplicate_detections
+
+        cmd = "redis-cli -h 10.0.1.50 -a MyR3d1sPassword123 PING"
+        detections = [
+            ("MyR3d1sPassword123", "REDIS_PASSWORD", "password"),
+            ("10.0.1.50", "REDIS_HOST", "IP address"),
+        ]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == "MyR3d1sPassword123"
+
+
+class TestExtractValueFromSyntax:
+    """Unit tests for _extract_value_from_syntax."""
+
+    def test_cli_flag_long(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "mysql --password=secret123 mydb"
+        assert _extract_value_from_syntax("--password=secret123", cmd) == "secret123"
+
+    def test_cli_flag_short(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "tool -p=myvalue123 arg"
+        assert _extract_value_from_syntax("-p=myvalue123", cmd) == "myvalue123"
+
+    def test_env_var_assignment(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "GITHUB_TOKEN=ghp_abc123 gh pr create"
+        assert _extract_value_from_syntax("GITHUB_TOKEN=ghp_abc123", cmd) == "ghp_abc123"
+
+    def test_plain_value_unchanged(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "curl -H 'Bearer eyJtoken'"
+        assert _extract_value_from_syntax("eyJtoken", cmd) == "eyJtoken"
+
+    def test_value_not_in_cmd_returns_original(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "echo hello"
+        assert _extract_value_from_syntax("--flag=nothere", cmd) == "--flag=nothere"
+
+
+class TestLooksLikeHostname:
+    def test_domain(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("registry.ghcr.io") is True
+
+    def test_subdomain(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("api.prod.internal.company.com") is True
+
+    def test_ip_address(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("10.0.1.50") is True
+
+    def test_token_not_hostname(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("eyJhbGciOiJIUzI1NiJ9") is False
+
+    def test_password_not_hostname(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("S3cretP@ssw0rd") is False

{cli_mem-0.3.4 → cli_mem-0.3.6}/tests/test_patterns.py

@@ -463,7 +463,7 @@ class TestDeduplication:
 
 class TestSyncAllPatterns:
     def test_sync_warns_without_sdk(self, tmp_mem_dir, capsys):
-        """sync_all_patterns prints warning when SDK is unavailable."""
+        """sync_all_patterns prints warning when SDK is unavailable (non-silent)."""
         now = int(time.time())
         for i in range(6):
             storage.append_command(
@@ -481,6 +481,25 @@ class TestSyncAllPatterns:
         captured = capsys.readouterr()
         assert "pip install cli-mem[ai]" in captured.err
 
+    def test_sync_silent_no_output(self, tmp_mem_dir, capsys):
+        """sync_all_patterns(silent=True) produces no output."""
+        now = int(time.time())
+        for i in range(6):
+            storage.append_command(
+                make_command(
+                    command=f"make target-{i}",
+                    ts=now,
+                    repo="/Users/test/projects/myapp",
+                )
+            )
+
+        with patch.object(patterns, "_apple_fm_available", return_value=False):
+            new, updated = patterns.sync_all_patterns(silent=True)
+
+        assert new == 1
+        captured = capsys.readouterr()
+        assert captured.err == ""
+
     def test_sync_skips_tools_below_threshold(self, tmp_mem_dir):
         """Tools with <5 commands are skipped entirely."""
         now = int(time.time())
@@ -524,6 +543,93 @@ class TestSyncAllPatterns:
         assert storage.read_patterns("tool-c") is None
 
 
+class TestPatternCaching:
+    """Verify that already-processed commands skip the LLM."""
+
+    @pytest.mark.asyncio
+    async def test_cached_commands_skip_llm(self):
+        """Commands in already_processed set should not trigger LLM calls."""
+        call_count = 0
+
+        async def _counting_respond(prompt: str, generating=None):
+            nonlocal call_count
+            call_count += 1
+            for line in prompt.splitlines():
+                if line.startswith("Command:"):
+                    cmd = line.split("Command:", 1)[1].strip()
+                    return _make_mock_generalized(f"{cmd} <generalized>")
+            return _make_mock_generalized("unknown")
+
+        mock_session = MockSession(respond_fn=_counting_respond)
+
+        with (
+            patch.object(patterns, "_apple_fm_available", return_value=True),
+            patch("mem.patterns._get_generable_types", return_value=MagicMock()),
+            patch("apple_fm_sdk.LanguageModelSession", return_value=mock_session),
+        ):
+            # First call: 3 unique commands, all new
+            commands = ["git status", "git log", "git diff", "git status", "git log"]
+            await patterns.extract_patterns_for_tool("git", commands)
+
+        assert call_count == 3  # 3 unique commands
+
+        # Second call with cache: only 1 new command
+        call_count = 0
+        already_done = {"git status", "git log", "git diff"}
+
+        with (
+            patch.object(patterns, "_apple_fm_available", return_value=True),
+            patch("mem.patterns._get_generable_types", return_value=MagicMock()),
+            patch("apple_fm_sdk.LanguageModelSession", return_value=mock_session),
+        ):
+            commands2 = commands + ["git push"]
+            await patterns.extract_patterns_for_tool(
+                "git", commands2, already_done
+            )
+
+        assert call_count == 1  # Only "git push" is new
+
+
+class TestAutoSync:
+    """Verify the sync counter and auto-trigger logic."""
+
+    def test_counter_increment(self, tmp_mem_dir):
+        assert storage.read_sync_counter() == 0
+        assert storage.increment_sync_counter() == 1
+        assert storage.increment_sync_counter() == 2
+        assert storage.read_sync_counter() == 2
+
+    def test_counter_reset(self, tmp_mem_dir):
+        storage.increment_sync_counter()
+        storage.increment_sync_counter()
+        storage.reset_sync_counter()
+        assert storage.read_sync_counter() == 0
+
+    def test_capture_triggers_sync_at_threshold(self, tmp_mem_dir):
+        """After SYNC_THRESHOLD captures, _spawn_background_sync is called."""
+        from mem import capture
+
+        with (
+            patch.object(storage, "SYNC_THRESHOLD", 3),
+            patch.object(capture, "_spawn_background_sync") as mock_spawn,
+            patch.object(capture, "get_git_repo", return_value=None),
+        ):
+            capture.capture_command("cmd1", "/tmp", 0, 100)
+            capture.capture_command("cmd2", "/tmp", 0, 100)
+            assert mock_spawn.call_count == 0
+
+            capture.capture_command("cmd3", "/tmp", 0, 100)
+            assert mock_spawn.call_count == 1
+
+            # Counter reset, so next 3 should trigger again
+            capture.capture_command("cmd4", "/tmp", 0, 100)
+            capture.capture_command("cmd5", "/tmp", 0, 100)
+            assert mock_spawn.call_count == 1
+
+            capture.capture_command("cmd6", "/tmp", 0, 100)
+            assert mock_spawn.call_count == 2
+
+
 # ---------------------------------------------------------------------------
 # Test cases: Session summary generation
 # ---------------------------------------------------------------------------