feat: stable turn ids, per-turn workspace snapshots, and conversation history that survives restart (#354)

[saucam]

Closes #354

What this does

Every turn in a session now has a stable identity, codeoid snapshots the files each turn starts from, and the conversation history survives a daemon restart.
This is the foundation for going back a turn (#355), forking from an earlier point (#356), comparing backends (#357) and per-turn diffs (#358).
It works the same on every backend, today's and future ones: nothing depends on a backend's own session format.

• Turns. Each prompt, and everything the agent does in reply, carries one turn id. A message sent while the agent is still working joins the running turn instead of starting a new one. Clients can list a session's turns with session.turns (order, a short preview of the prompt, when it started, and its snapshot).
• Snapshots. At the start of each turn, codeoid records the working directory in its own storage, one shadow git repository per session. It never touches your repository: no refs, no objects, nothing in git log --all, no hooks or filters run. It works in folders that aren't git repositories, and leaves out .gitignored files, common secret files (.env, keys, credential files) and dependency folders. If a snapshot is still being taken when the agent starts, it's marked "late".
• History survives restart. Codeoid's backend-neutral copy of the conversation is now saved to disk. Before this change, after a daemon restart:
  • forking a session, or switching its backend, silently carried no conversation;
  • a stateless backend (OpenAI, Gemini API) answered the next prompt with no memory of the session.
• Stop works while a message is still being prepared. Pressing Stop (or shutting down) while a send was preparing its turn used to stop nothing: the turn started anyway afterwards. Now it's cancelled, the user is told, and anything waiting on it (a pipeline phase, a background wake) is released.

How it was checked

Live, against a real daemon with the real Claude backend (a scratch git repo with an untracked .env):

Check	Result
Two turns that create and then edit hello.txt	Each message carries its turn's id. session.turns lists both with snapshots. Turn 1's snapshot holds only README.md (no .env), turn 2's holds hello.txt = one. The user repo has no new refs or log entries.
Restart the daemon, fork the session, ask "what is my codename?" (told in turn 1, no tools)	This branch: "Your codename is PELICAN." The fork lists the inherited snapshots.
Same on main	"I don't know your codename". The fork had no conversation.

Tests: typecheck, lint and build pass, plus 2,848 daemon tests and 577 web tests. New: checkpoints.test.ts (21), turns.test.ts (20) and canonical-log.test.ts (14).

• The checkpoint suite covers: the user repo left exactly as it was; a malicious core.fsmonitor, filter driver or hook never running; inherited GIT_* variables ignored; snapshots surviving deletion of the user's .git; planted skip-worktree / assume-unchanged / split-index entries having no effect; a .gitignore that negates .env not pulling it in; nested repositories; stale locks; storage budget; forks.
• Each guard added during the audits was mutation-checked: removing it makes a test fail.

Audits: two rounds, each with a correctness reviewer and a security reviewer. All findings were fixed in this PR.

• Round 1: running git in the user's repo let the repo's own config run commands on every turn, outside the approval gate. That is the reason for the shadow repository.
• Round 2: made the shadow repository fully self-contained, fixed a race with turns the backend starts on its own, and stopped a compaction edge case from wiping the history log.

Behaviour changes and limits

• The first snapshot of a session stores one compressed copy of the working directory. Later snapshots store only what changed.
• Snapshots are skipped, with a log line, when:
  • the first snapshot exceeds 1 GB or 100k files;
  • a later snapshot adds more than 100 MB or 20k new files.
• Each session keeps its newest 200 snapshots, capped at 2 GB. Settings live under session.checkpoints (enabled, maxPerSession, maxUntrackedBytes, waitMs).
• A turn waits at most 2 s for its snapshot.
• Nested git repositories are recorded as a pointer to their commit, not their files.
• .env.example is excluded along with .env, because the exclusions are deliberately not overridable.
• The history log caps very large fields (attachments, tool output) and keeps its newest 16–32 MB.
• Sessions created before this change get their history rebuilt from their transcript, once.
• Context rotation still starts a fresh context, but the turn list is no longer reset.

🤖 Implementation context (for agents / maintainers)

Files

• src/daemon/checkpoints.ts: shadow repo per session at <transcriptDir>/checkpoints/<id>.git, used with GIT_WORK_TREE=<workdir>.
  • Environment: allowlist (PATH, HOME, LANG, LC_ALL, TMPDIR) plus GIT_CONFIG_NOSYSTEM=1, GIT_CONFIG_GLOBAL=/dev/null, -c core.hooksPath=/dev/null -c core.fsmonitor=false.
  • Storage: self-contained, with no alternates and no copied index. Created atomically.
  • Snapshot: exclusions are :(exclude,glob) pathspecs. Then add -A, write-tree, commit-tree, refs/turns/<turnId>, and a line in the daemon-owned turns.log (order, plus the late flag).
  • Listing: only refs that match turns.log are trusted.
  • Housekeeping: prune by count and by storage budget, with batched repack -a -d + prune. Also copyCheckpoints (fork, via fetch), deleteCheckpoint(s), and sweepCheckpoints (unknown session ids, run at resume).
• src/daemon/session.ts:
  • Turn ids: #currentTurnId is stamped by #makeMessage. In #sendInner: joinsRunningTurn for mid-turn pushes; hooks, then snapshot, then stop-check, then the adopted-turn check, then runTurn; a try/catch hands attribution back.
  • Stop: SendStoppedError via #stopGen / #preparingSends (and preparingTurn for drain).
  • Turn index: #turnIndex / #indexTurn (capped at 1000).
  • History and forks: restoreTurns, fullCanonicalHistory, inheritTurns.
• src/daemon/providers/canonical.ts: CanonicalTurn gains turnId / prompt / at / background. The accumulator emits onChange (append / replace), and restore() loads without re-emitting.
• src/daemon/transcript.ts:
  • <id>.canonical.jsonl: serialized at call time, field caps plus a 1 MiB whole-turn cap, compaction at 32 MiB, tail reads that widen until they hold a prompt, 0600.
  • <id>.turns.jsonl turn index.
  • A shared #chain helper. This also fixes append()'s stored promise chain, which leaked an unhandled rejection on a failed write and never cleared itself.
• src/daemon/session-manager.ts:
  • Resume: restore from a 4 MiB canonical tail plus the turn index. Legacy sessions are rebuilt from the full transcript.
  • Fork: fullCanonicalHistory + inheritTurns.
  • New request: session.turns (attach/watch scope + ownership).
  • Stopped sends: SendStoppedError handled in #send, in the pipeline phase driver and in fleet event delivery.
  • Shutdown: drain() counts sends that are still preparing.
• Protocol: packages/protocol/src/turns.ts (session.turns / session.turns.result, TurnSummary) and SessionMessage.turnId.
• src/daemon/canonical-restore.ts: canonicalFromTranscript, turnIndexFromHistory.

Known edges

• After a stalled-run recovery, or when a prompt joins a backend-started turn, the already-broadcast user row keeps the id first minted for it.
• fsmonitor and the untracked cache are deliberately off for snapshots, so a snapshot walks the tree.

🤖 Generated with Claude Code