feat(sessions): hardened opencode exact-id lookup — direct by-id row query (archived+child included, errors propagate)

Ports opencode-by-id-query.ts, replacing the #583 parent-walk. Full row
(title/timestamps) feeds the resolve match; a missing/locked/corrupt DB
is Err — provider unavailable ≠ not found. (SYNC-06)

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <[email protected]>

Author: danshapiro

crates/freshell-server/src/main.rs

@@ -1229,30 +1229,34 @@ async fn main() -> ExitCode {
             // `session-indexer.ts:1159-1161`).
             session_metadata: session_metadata_store.clone(),
             // opencode `ses_*` exact-id fallback: the SAME data home the
-            // OpencodeSource uses. KNOWN DIVERGENCE (see resolve.rs module
-            // doc): still the retired parent-walk (Task 4 replaces it with
-            // the direct row query) and read errors are still mapped to an
-            // `Ok(None)` miss instead of `Err(ProviderFailure)` — the full
-            // health channel is wired in Task 6.
+            // OpencodeSource uses, answered by the hardened direct by-id row
+            // query (`opencode_session_row_by_id`, Node's
+            // `opencode-by-id-query.ts`) — archived + child sessions
+            // included, full row (title/lastActivityAt) returned. KNOWN
+            // DIVERGENCE (see resolve.rs module doc): read errors are still
+            // mapped to an `Ok(None)` miss instead of `Err(ProviderFailure)`
+            // — the full health channel is wired in Task 6.
             opencode_session_by_id: Some(std::sync::Arc::new(
                 |session_id: &str| -> Result<
                     Option<freshell_sessions::resume_resolve::OpencodeByIdHit>,
                     freshell_sessions::resume_resolve::ProviderFailure,
                 > {
+                    use freshell_sessions::resume_resolve::OpencodeByIdHit;
                     let data_home = freshell_sessions::parse::default_opencode_data_home();
-                    Ok(freshell_sessions::parse::opencode_session_directory_by_id(
+                    match freshell_sessions::parse::opencode_session_row_by_id(
                         &data_home, session_id,
-                    )
-                    .ok()
-                    .flatten()
-                    .map(|hit| {
-                        freshell_sessions::resume_resolve::OpencodeByIdHit {
-                            session_id: session_id.to_string(),
-                            cwd: hit.directory,
-                            title: None,
-                            last_activity_at: None,
-                        }
-                    }))
+                    ) {
+                        Ok(row) => Ok(row.map(|r| OpencodeByIdHit {
+                            session_id: r.session_id,
+                            cwd: r.cwd,
+                            title: r.title,
+                            last_activity_at: r.last_activity_at,
+                        })),
+                        // TASK-6 upgrades this to Err(ProviderFailure{..})
+                        // once the wire carries providerErrors; until then a
+                        // read failure stays a miss.
+                        Err(_) => Ok(None),
+                    }
                 },
             )),
             // claude transcript exact-id fallback: the SAME ordered-roots scan

crates/freshell-server/src/resolve.rs

@@ -19,13 +19,11 @@
 //!   merge yet. The fallbacks wired in `main.rs` also still map read errors
 //!   to an `Ok(None)` MISS, never an `Err(ProviderFailure)`, so `degraded`
 //!   is unreachable in production until Task 6 rewires them.
-//! - opencode by-id fallback runs the RETIRED parent-walk
-//!   (`resolveOpencodeSessionRoots` port), not Node's hardened direct row
-//!   query (`providers/opencode-by-id-query.ts`) — plan Task 4: orphaned/
-//!   cyclic child rows miss where Node hits, a legacy-schema DB universally
-//!   hits any full-shape `ses_*` id where Node hits only real rows, and the
-//!   wired hits omit Node's `title`/`lastActivityAt` (the core's
-//!   `OpencodeByIdHit` already carries them).
+//! - the opencode by-id fallback now runs Node's hardened direct row query
+//!   (`opencode_session_row_by_id`, `providers/opencode-by-id-query.ts` —
+//!   archived + child rows hit, `title`/`lastActivityAt` returned), but its
+//!   read errors are still mapped to an `Ok(None)` miss (see above) — the
+//!   `Err(ProviderFailure)` rewire is plan Task 6.
 //! - the claude fallback's `locate_transcript` never probes Node's
 //!   `<project>/<parent>/subagents/<id>.jsonl` layout (subagent child
 //!   transcripts miss) — the checked locator is plan Task 6; its cwd read IS
@@ -720,8 +718,8 @@ mod tests {
             Ok(Some(freshell_sessions::resume_resolve::OpencodeByIdHit {
                 session_id: id.to_string(),
                 cwd: Some("/repo/beta".to_string()),
-                title: None,
-                last_activity_at: None,
+                title: Some("beta".to_string()),
+                last_activity_at: Some(1234),
             }))
         }));
         let (status, body) = post(st, serde_json::json!({ "input": unknown }), true).await;
@@ -733,6 +731,8 @@ mod tests {
                 "sessionId": unknown,
                 "cwd": "/repo/beta",
                 "sessionType": "opencode",
+                "title": "beta",
+                "lastActivityAt": 1234,
                 "matchKind": "exact"
             }])
         );

crates/freshell-sessions/src/parse/mod.rs

@@ -11,8 +11,8 @@ pub mod opencode;
 pub use claude::{parse_session_content, ParseSessionOptions};
 pub use codex::parse_codex_session_content;
 pub use opencode::{
-    default_opencode_data_home, opencode_session_directory_by_id, run_opencode_listing_query,
-    session_exists_by_id, OpencodeDegrade, OpencodeListing, OpencodeListingResult,
-    OpencodeProvider, OpencodeReadError, OpencodeSession, OpencodeSessionDirectory,
+    default_opencode_data_home, opencode_session_row_by_id, run_opencode_listing_query,
+    session_exists_by_id, OpencodeByIdError, OpencodeByIdRow, OpencodeDegrade, OpencodeListing,
+    OpencodeListingResult, OpencodeProvider, OpencodeReadError, OpencodeSession,
     OpencodeSessionRow, THREE_VIEWS_MARKER_SQL_PATTERN,
 };

crates/freshell-sessions/src/parse/opencode.rs

@@ -424,133 +424,122 @@ pub fn session_exists_by_id(data_home: &Path, session_id: &str) -> Result<bool,
     }
 }
 
-/// A resume-resolve by-id fallback HIT: Node's `resolveOpencodeSessionRoots`
-/// walk resolved the requested id.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct OpencodeSessionDirectory {
-    /// The requested row's OWN `directory` column — the SPAWN cwd opencode
-    /// resumes in (`resolve-session.ts:77-84`: NOT the project root) — kept
-    /// only when TRUTHY (`opencode.ts:265-267, 281`). `None` for an empty or
-    /// NULL `directory` and for EVERY legacy-schema hit (Node's early return
-    /// never reads the row). `None` ⇒ the wire match OMITS `cwd`.
-    pub directory: Option<String>,
+/// SHORT busy timeout (`opencode-by-id-query.ts:12`): a locked DB must fail
+/// FAST — the failure surfaces as provider-unavailable, never "not found".
+const OPENCODE_BYID_BUSY_TIMEOUT_MS: u64 = 500;
+
+/// Code-PRESERVING error for the by-id query (the plain `OpencodeReadError`
+/// stays for its other consumers). Node's thrown sqlite errors carry a
+/// `.code` like `SQLITE_CANTOPEN` at the QUERY layer — but Node's production
+/// worker boundary then STRIPS it (`opencode-by-id.worker.ts:41-42`
+/// serializes only `{name, message}`; `opencode-by-id-runner.ts:103-106`
+/// rebuilds the Error without `.code`), so the code never reaches the wire.
+/// We keep the code HERE for structured logging and precise messages; the
+/// production closure (Task 6 Step 3b) deliberately maps it to
+/// `ProviderFailure { code: None, .. }` — wire parity is message-only for
+/// opencode.
+#[derive(Debug, Clone, PartialEq)]
+pub struct OpencodeByIdError {
+    pub code: Option<String>,
+    pub message: String,
 }
 
-/// One row of the walk: `(directory, parent_id)` for an id, `None` = no row.
-type SessionRow = (Option<String>, Option<String>);
-
-fn fetch_session_row(
-    conn: &Connection,
-    session_id: &str,
-) -> Result<Option<SessionRow>, OpencodeReadError> {
-    match conn.query_row(
-        "SELECT directory, parent_id FROM session WHERE id = ?1",
-        rusqlite::params![session_id],
-        |row| {
-            Ok((
-                row.get::<_, Option<String>>(0)?,
-                row.get::<_, Option<String>>(1)?,
-            ))
-        },
-    ) {
-        Ok(row) => Ok(Some(row)),
-        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),
-        Err(e) => Err(OpencodeReadError(e.to_string())),
+/// Map a rusqlite error to the Node-style `SQLITE_*` code name via
+/// `rusqlite::Error::sqlite_error_code()` (available in the pinned 0.31.0).
+fn by_id_err(e: rusqlite::Error) -> OpencodeByIdError {
+    use rusqlite::ffi::ErrorCode as C;
+    let code = e.sqlite_error_code().and_then(|c| match c {
+        C::CannotOpen => Some("SQLITE_CANTOPEN"),
+        C::DatabaseBusy => Some("SQLITE_BUSY"),
+        C::DatabaseLocked => Some("SQLITE_LOCKED"),
+        C::NotADatabase => Some("SQLITE_NOTADB"),
+        C::PermissionDenied => Some("SQLITE_PERM"),
+        C::ReadOnly => Some("SQLITE_READONLY"),
+        _ => None,
+    });
+    OpencodeByIdError {
+        code: code.map(str::to_string),
+        message: e.to_string(),
     }
 }
 
-/// Resume-resolve by-id lookup — a bug-for-bug port of Node's
-/// `OpencodeProvider.resolveOpencodeSessionRoots`
-/// (`server/coding-cli/providers/opencode.ts:239-323`). NOTE the Node
-/// consumer has since moved on: the RETIRED pre-#586 resolve consumed this
-/// walk directly; hardened Node resolves opencode ids via
-/// `resolve-session.ts` → `resolve-fallbacks.ts` → the by-id worker
-/// (`providers/opencode-by-id-query.ts`, a DIRECT row query). This walk
-/// remains the Rust resolve fallback's interim lookup — a recorded
-/// divergence, see `resume_resolve.rs`. This is deliberately NOT the attach-arm
-/// existence probe: Node walks the `parent_id` chain, and every quirk of
-/// that walk is wire-observable, so all are replicated:
-///
-/// - LEGACY schema (`session` lacks `parent_id`, detected with the same
-///   `PRAGMA table_info(session)` probe the listing uses): return a HIT with
-///   `directory: None` for ANY requested id — Node returns early
-///   (`opencode.ts:246-250`) with NO row query and NO existence check, so
-///   even nonexistent ids hit and existing directories are never read.
-/// - MODERN schema: fetch the requested row (missing row ⇒ `Ok(None)`);
-///   keep its OWN `directory` only if non-empty (truthy filter,
-///   `opencode.ts:265-267, 281`); then walk `parent_id` with a `seen` set —
-///   a missing parent row (`opencode.ts:292-295`) or a cycle
-///   (`opencode.ts:287-290`) marks the requested id unresolved ⇒ `Ok(None)`
-///   even though the row exists; reaching a root (`parent_id` NULL) ⇒ HIT.
-///
-/// Same read-only open and short busy timeout as [`session_exists_by_id`].
-/// `Err` for ANY read failure — the resolve endpoint treats `Err` as a miss
-/// (empty matches), never a 5xx (Node likewise degrades: 3 retries then all
-/// ids unresolved, `opencode.ts:239-322`).
-pub fn opencode_session_directory_by_id(
+/// The hardened exact-id row (`OpencodeSessionRow` subset the by-id query
+/// selects). `last_activity_at` floored to integer ms (REAL columns possible).
+#[derive(Debug, Clone, PartialEq)]
+pub struct OpencodeByIdRow {
+    pub session_id: String,
+    pub cwd: Option<String>,
+    pub title: Option<String>,
+    pub created_at: Option<i64>,
+    pub last_activity_at: Option<i64>,
+    pub project_path: Option<String>,
+}
+
+/// Hardened (#586) exact-id lookup — 1:1 port of
+/// `runOpencodeSessionByIdQuery` (`opencode-by-id-query.ts`). Deliberately
+/// includes ARCHIVED and CHILD sessions: an exact id pasted by the user must
+/// resolve even when the listing hides it. Errors PROPAGATE (a missing or
+/// unreadable DB file is `Err`, matching Node's throwing `DatabaseSync`
+/// open — provider unavailable ≠ not found).
+pub fn opencode_session_row_by_id(
     data_home: &Path,
     session_id: &str,
-) -> Result<Option<OpencodeSessionDirectory>, OpencodeReadError> {
+) -> Result<Option<OpencodeByIdRow>, OpencodeByIdError> {
     let db_path = data_home.join("opencode.db");
-    if !db_path.exists() {
-        return Ok(None);
-    }
     let conn = Connection::open_with_flags(
         &db_path,
         OpenFlags::SQLITE_OPEN_READ_ONLY | OpenFlags::SQLITE_OPEN_URI,
     )
-    .map_err(|e| OpencodeReadError(e.to_string()))?;
+    .map_err(by_id_err)?;
     conn.busy_timeout(std::time::Duration::from_millis(
-        EXISTENCE_BY_ID_BUSY_TIMEOUT_MS,
+        OPENCODE_BYID_BUSY_TIMEOUT_MS,
     ))
-    .map_err(|e| OpencodeReadError(e.to_string()))?;
+    .map_err(by_id_err)?;
 
-    // PRAGMA table_info(session) -> hasParentId (same detection as the
-    // listing's `run_opencode_query_inner`).
-    let has_parent_id = {
+    let table_names: std::collections::HashSet<String> = {
         let mut stmt = conn
-            .prepare("PRAGMA table_info(session)")
-            .map_err(|e| OpencodeReadError(e.to_string()))?;
-        let names = stmt
-            .query_map([], |row| row.get::<_, String>(1))
-            .map_err(|e| OpencodeReadError(e.to_string()))?;
-        let mut found = false;
-        for name in names {
-            if name.map_err(|e| OpencodeReadError(e.to_string()))? == "parent_id" {
-                found = true;
-            }
+            .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+            .map_err(by_id_err)?;
+        let rows = stmt
+            .query_map([], |row| row.get::<_, String>(0))
+            .map_err(by_id_err)?;
+        let mut set = std::collections::HashSet::new();
+        for r in rows {
+            set.insert(r.map_err(by_id_err)?);
         }
-        found
+        set
     };
-    if !has_parent_id {
-        // Node's legacy early return (`opencode.ts:246-250`): every requested
-        // id resolves as its own root — no row query, no existence check, no
-        // directory read. Bug-for-bug: nonexistent ids HIT, `cwd` omitted.
-        return Ok(Some(OpencodeSessionDirectory { directory: None }));
-    }
-
-    let Some((directory, first_parent)) = fetch_session_row(&conn, session_id)? else {
+    if !table_names.contains("session") {
         return Ok(None);
+    }
+    let has_project = table_names.contains("project");
+    let project_select = if has_project { "p.worktree" } else { "NULL" };
+    let project_join = if has_project {
+        "LEFT JOIN project p ON p.id = s.project_id"
+    } else {
+        ""
     };
-    // Truthy filter (`opencode.ts:265-267, 281`): empty string ⇒ no cwd.
-    let directory = directory.filter(|d| !d.is_empty());
-
-    // Parent walk (`opencode.ts:283-303`): a missing parent or a cycle marks
-    // the REQUESTED id unresolved (`resolve-session.ts:66`) ⇒ miss, even
-    // though its own row exists and its directory was already collected.
-    let mut seen: std::collections::HashSet<String> = std::collections::HashSet::new();
-    seen.insert(session_id.to_string());
-    let mut parent = first_parent;
-    while let Some(current) = parent {
-        if !seen.insert(current.clone()) {
-            return Ok(None); // cycle guard (`opencode.ts:287-290`)
-        }
-        match fetch_session_row(&conn, &current)? {
-            None => return Ok(None), // missing parent (`opencode.ts:292-295`)
-            Some((_, next_parent)) => parent = next_parent,
-        }
+    let sql = format!(
+        "SELECT s.id, s.directory, s.title, s.time_created, s.time_updated, \
+         {project_select} FROM session s {project_join} WHERE s.id = ?1 LIMIT 1"
+    );
+    match conn.query_row(&sql, rusqlite::params![session_id], |row| {
+        Ok(OpencodeByIdRow {
+            session_id: match row.get::<_, SqlValue>(0)? {
+                SqlValue::Text(s) => s,
+                other => to_opt_string(&other).unwrap_or_default(),
+            },
+            cwd: to_opt_string(&row.get::<_, SqlValue>(1)?),
+            title: to_opt_string(&row.get::<_, SqlValue>(2)?),
+            created_at: to_opt_i64(&row.get::<_, SqlValue>(3)?),
+            last_activity_at: to_opt_i64(&row.get::<_, SqlValue>(4)?),
+            project_path: to_opt_string(&row.get::<_, SqlValue>(5)?),
+        })
+    }) {
+        Ok(row) => Ok(Some(row)),
+        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),
+        Err(e) => Err(by_id_err(e)),
     }
-    Ok(Some(OpencodeSessionDirectory { directory }))
 }
 
 /// `defaultOpencodeDataHome` — `$XDG_DATA_HOME/opencode` -> win `LOCALAPPDATA/opencode`

crates/freshell-sessions/src/resume_resolve.rs

@@ -20,17 +20,14 @@
 //!   `provider_errors` are computed but DROPPED by `resolve.rs`, and there is
 //!   no `unsearchedProviders`/`homeDir` field or scan-failure/warming
 //!   readiness merge yet.
-//! - opencode by-id fallback WIRING (plan Task 4): the closure `main.rs`
-//!   supplies ports the RETIRED parent-walk
-//!   (`parse::opencode_session_directory_by_id`), not the hardened direct
-//!   row query Node's fallback now uses
-//!   (`server/coding-cli/providers/opencode-by-id-query.ts`). Consequences:
-//!   orphaned/cyclic child rows are a Rust MISS where Node HITs; a
-//!   legacy-schema DB (no `parent_id` column) is a Rust universal HIT for
-//!   any full-shape `ses_*` id where Node hits only REAL rows; the wired
-//!   hits omit the `title`/`lastActivityAt` Node's row query emits (the
-//!   [`OpencodeByIdHit`] type below already carries them); and the closure
-//!   maps read errors to `Ok(None)` misses instead of `Err(ProviderFailure)`.
+//! - opencode by-id fallback ERROR mapping (plan Task 6): the closure
+//!   `main.rs` supplies runs the hardened direct row query
+//!   (`parse::opencode_session_row_by_id`, Node's
+//!   `server/coding-cli/providers/opencode-by-id-query.ts` — archived +
+//!   child sessions included, full row with `title`/`lastActivityAt`
+//!   returned), but still maps read errors to `Ok(None)` misses instead of
+//!   `Err(ProviderFailure)` — `degraded` stays unreachable in production
+//!   until Task 6 rewires it.
 //! - claude fallback WIRING (plan Task 6): the wired `locate_transcript`
 //!   (`freshell-freshagent`) probes `<projects>/<project>/<subdir>/<id>.jsonl`
 //!   and never Node's `<projects>/<project>/<parent>/subagents/<id>.jsonl`