Browse, import, continue, and search cold sessions #7

New issue

Closed

opened 2026-08-28 19:24:39 +00:00 by dikka · 1 comment

dikka commented

2026-08-28 19:24:39 +00:00

Owner

What to build

Add a project History destination that composes durable workspace records with cold Pi sessions returned on demand by the local history source. Cold sessions do not enter the normal workspace automatically. Opening one is read-only and uses the same active-branch stream without launching Pi.

Add to workspace imports the explicitly selected cold path as a stopped record. Continue imports when necessary and then uses the exact-path lifecycle established for known sessions. Copied JSONL files with the same declared Pi ID remain separate path-qualified rows with a warning; either may be inspected, while Continue is blocked when that identity already has a live owner.

Workspace search includes known records and on-demand cold metadata. Match project and session identity plus current or last-known activity. Do not build transcript full-text search or an eager parallel index.

Acceptance criteria

Every saved project exposes bounded cancellable History even when it has no active workspace session.
History includes known records and Pi-discovered cold sessions from configured session directories without duplicating exact paths.
Opening a cold session renders its active branch read-only and does not launch Pi or create a workspace record.
Add to workspace creates a stopped imported record without launch; Continue imports if needed and resumes the selected exact path.
Duplicate declared IDs remain separately inspectable by path and cannot create two concurrent owners.
Search matches project/session identity and current or last-known activity across known and on-demand cold metadata.
Transcript text is not indexed or used as a search field.
Large, cancelled, missing, malformed, and configured-directory cases have bounded behavior and focused tests.

Blocked by

#5 — Manage the complete browser-session lifecycle
#6 — Read known sessions as paged active-branch streams

Human checkpoint note: Do not request routine per-ticket approval. The implementing agent may make the internal architecture, refactoring, testing, and UI-detail decisions needed to satisfy the acceptance criteria. Pause only if implementation requires a material product or ownership change, a destructive or hard-to-reverse action, excluded security or deployment scope, credentials or spending, or a real-browser design fork with no safe default. Forgejo completion updates may be batched with the rest of the completed frontier. The user performs final hub and Pi restart steps. Agents must not start, restart, replace, or stop the user-run Pilcrow development server.

## What to build Add a project History destination that composes durable workspace records with cold Pi sessions returned on demand by the local history source. Cold sessions do not enter the normal workspace automatically. Opening one is read-only and uses the same active-branch stream without launching Pi. Add to workspace imports the explicitly selected cold path as a stopped record. Continue imports when necessary and then uses the exact-path lifecycle established for known sessions. Copied JSONL files with the same declared Pi ID remain separate path-qualified rows with a warning; either may be inspected, while Continue is blocked when that identity already has a live owner. Workspace search includes known records and on-demand cold metadata. Match project and session identity plus current or last-known activity. Do not build transcript full-text search or an eager parallel index. ## Acceptance criteria - [ ] Every saved project exposes bounded cancellable History even when it has no active workspace session. - [ ] History includes known records and Pi-discovered cold sessions from configured session directories without duplicating exact paths. - [ ] Opening a cold session renders its active branch read-only and does not launch Pi or create a workspace record. - [ ] Add to workspace creates a stopped imported record without launch; Continue imports if needed and resumes the selected exact path. - [ ] Duplicate declared IDs remain separately inspectable by path and cannot create two concurrent owners. - [ ] Search matches project/session identity and current or last-known activity across known and on-demand cold metadata. - [ ] Transcript text is not indexed or used as a search field. - [ ] Large, cancelled, missing, malformed, and configured-directory cases have bounded behavior and focused tests. ## Blocked by - #5 — Manage the complete browser-session lifecycle - #6 — Read known sessions as paged active-branch streams > **Human checkpoint note:** Do not request routine per-ticket approval. The implementing agent may make the internal architecture, refactoring, testing, and UI-detail decisions needed to satisfy the acceptance criteria. Pause only if implementation requires a material product or ownership change, a destructive or hard-to-reverse action, excluded security or deployment scope, credentials or spending, or a real-browser design fork with no safe default. Forgejo completion updates may be batched with the rest of the completed frontier. The user performs final hub and Pi restart steps. Agents must not start, restart, replace, or stop the user-run Pilcrow development server.

dikka added the

ready-for-agent

label

2026-08-28 19:24:39 +00:00

dikka referenced this issue

2026-08-28 19:24:45 +00:00

Replace the old workspace shell #16

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#5 Manage the complete browser-session lifecycle

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#6 Read known sessions as paged active-branch streams

dikka added a new dependency

2026-08-28 19:25:17 +00:00

#16 Replace the old workspace shell

dikka commented

2026-08-29 00:36:16 +00:00

Author

Owner

Implemented in jj revision 4454d8df (feat(history): add bounded project history and cold session inspection UI).

What changed:

Added a per-project History destination and request-driven global cold-session search that work for saved projects with zero workspace sessions.
Replaced Pi SessionManager.list() discovery with a Pilcrow-owned read-only metadata scanner. It has explicit file/directory/aggregate/header/line/field/concurrency/time bounds, propagates cancellation, closes streams/handles, shares safe in-flight scans, and never materializes transcript bodies for search.
Enforced canonical project scope independently for every discovered row, listing, cold open, import, Continue, and cursor continuation. Header cwd must be absolute, bounded, canonical, and equal to the requested saved/represented project.
Cold open uses the existing opaque visit/cursor and fixed-prefix active-branch reader. It does not launch Pi, create a workspace record, expose branch authority, or permit review/annotation/submission.
Add to workspace persists a stopped managed record without launch. Continue imports if needed, then uses the existing exact-path lifecycle validation and launch fencing.
Copied JSONL files with one declared Pi ID remain distinct by exact path with warnings. Either is inspectable; conflicting live ownership blocks Continue without adopting or duplicating the runtime.
Known metadata joins only on exact path plus declared Pi ID. Missing/replaced paths are explicit and never borrow or hide replacement metadata.
Import/Continue/register/Forget races are generation/tombstone fenced; retries coalesce to one durable workspace identity and persistence failures roll back cleanly.
Search matches only project/session identity and retained semantic activity. It globally sorts before exact count/encoded-byte selection, returns only cold result rows, omits transcript preview, clears stale results/errors correctly, and reconciles cold→known rows through SSE.
Project History has URL/back/refresh destination state and an independent scroll identity while preserving the previous session stage, scroll position, and draft.

Audit and regression coverage:

Fresh review found unbounded transcript-reading discovery, cross-project authority bypass, stale-path metadata leakage, import/Forget races, stale/incorrectly bounded search, missing History scroll/routing preservation, and an encoded-size boundary bug. All were fixed before closure.
Added real many/huge/abort/timeout scanner cleanup, default/custom project mismatch, copied/misplaced/malformed cwd, stale path/new ID, unsaved/cross-project cursor tampering, import/open timeout, delayed catalog and persistence failures, register/Continue/Forget races, >cap ordering/privacy/exact bytes, failed search clearing, SSE reconciliation, zero-session History refresh, draft/stage/scroll back-navigation, lost import response recovery, and no-cold-review-control tests.

Validation:

Supervisor focused verification passed: 5 files / 92 tests.
Full suite passed: 65 files / 491 tests.
TypeScript no-emit checks, hub build, production browser build, changed-file formatting, and git diff --check passed.
Whole-tree vp check remains blocked only by the unchanged pre-existing formatting issue in .dev/agents/triage-labels.md.
Real-browser QA was unavailable because no user-run Pilcrow development server was active; project policy correctly prevented starting one.

Protocol remains v8. No transcript full-text index, eager background index, Pi JSONL write/migration, branch UI, placement, or live settlement was added. No dev server was managed.

Implemented in jj revision `4454d8df` (`feat(history): add bounded project history and cold session inspection UI`). What changed: - Added a per-project History destination and request-driven global cold-session search that work for saved projects with zero workspace sessions. - Replaced Pi `SessionManager.list()` discovery with a Pilcrow-owned read-only metadata scanner. It has explicit file/directory/aggregate/header/line/field/concurrency/time bounds, propagates cancellation, closes streams/handles, shares safe in-flight scans, and never materializes transcript bodies for search. - Enforced canonical project scope independently for every discovered row, listing, cold open, import, Continue, and cursor continuation. Header cwd must be absolute, bounded, canonical, and equal to the requested saved/represented project. - Cold open uses the existing opaque visit/cursor and fixed-prefix active-branch reader. It does not launch Pi, create a workspace record, expose branch authority, or permit review/annotation/submission. - Add to workspace persists a stopped managed record without launch. Continue imports if needed, then uses the existing exact-path lifecycle validation and launch fencing. - Copied JSONL files with one declared Pi ID remain distinct by exact path with warnings. Either is inspectable; conflicting live ownership blocks Continue without adopting or duplicating the runtime. - Known metadata joins only on exact path plus declared Pi ID. Missing/replaced paths are explicit and never borrow or hide replacement metadata. - Import/Continue/register/Forget races are generation/tombstone fenced; retries coalesce to one durable workspace identity and persistence failures roll back cleanly. - Search matches only project/session identity and retained semantic activity. It globally sorts before exact count/encoded-byte selection, returns only cold result rows, omits transcript preview, clears stale results/errors correctly, and reconciles cold→known rows through SSE. - Project History has URL/back/refresh destination state and an independent scroll identity while preserving the previous session stage, scroll position, and draft. Audit and regression coverage: - Fresh review found unbounded transcript-reading discovery, cross-project authority bypass, stale-path metadata leakage, import/Forget races, stale/incorrectly bounded search, missing History scroll/routing preservation, and an encoded-size boundary bug. All were fixed before closure. - Added real many/huge/abort/timeout scanner cleanup, default/custom project mismatch, copied/misplaced/malformed cwd, stale path/new ID, unsaved/cross-project cursor tampering, import/open timeout, delayed catalog and persistence failures, register/Continue/Forget races, >cap ordering/privacy/exact bytes, failed search clearing, SSE reconciliation, zero-session History refresh, draft/stage/scroll back-navigation, lost import response recovery, and no-cold-review-control tests. Validation: - Supervisor focused verification passed: 5 files / 92 tests. - Full suite passed: 65 files / 491 tests. - TypeScript no-emit checks, hub build, production browser build, changed-file formatting, and `git diff --check` passed. - Whole-tree `vp check` remains blocked only by the unchanged pre-existing formatting issue in `.dev/agents/triage-labels.md`. - Real-browser QA was unavailable because no user-run Pilcrow development server was active; project policy correctly prevented starting one. Protocol remains v8. No transcript full-text index, eager background index, Pi JSONL write/migration, branch UI, placement, or live settlement was added. No dev server was managed.

dikka closed this issue

2026-08-29 00:36:16 +00:00