Skip to content

fix(handoff): scope the recent-files list to the latest session - #20

Merged
takashi-matsuyama merged 1 commit into
mainfrom
fix/handoff-recent-files-scope
May 31, 2026
Merged

takashi-matsuyama merged 1 commit into
mainfrom
fix/handoff-recent-files-scope

Conversation

@takashi-matsuyama

Copy link
Copy Markdown
Member

What

The handoff's 直近の変更ファイル (recent files) section unioned
related_files across every session. Once transcript imports became
the primary capture source, that turned the section into a whole-history
dump (~300 files in the author's dogfood workspace), so it no longer
reflected "recent" work.

The section's original intent was to exclude historical / foreign sessions,
but it keyed the exclusion on source.kind === "import" only.
claude-code-import sessions (the post-pivot primary source) do not match
that, so they all flowed in.

Change

Show only the most recent session's related_files (the same session
surfaced as the latest-session line), so the section reflects the latest
activity instead of the whole history. The 次に読むべきファイル section,
which intentionally reuses the same list, becomes recency-scoped too.

Adding claude-code-import to the exclusion set was rejected: in a workspace
where imports are the primary source, that would empty the section entirely.
Scoping by recency keeps it useful regardless of source.

Test plan

  • pnpm -r build && pnpm typecheck && pnpm test && pnpm lint all green
    (sdk 1 / core 655 / cli 375).
  • core + cli handoff case 3 updated: an older session's files no longer
    appear once a newer session supersedes it.
  • Verified on real data: the dogfood workspace's section went from ~300
    files to the latest session's 13.

Out of scope

The live/imported session-table split semantics (now that
claude-code-import is the primary source) are left for a separate change.

🤖 Generated with Claude Code

The recent-files section unioned related_files across every session,
which turned into a whole-history dump once transcript imports became
the primary capture source (each import carries a full day of file
changes). The section's original intent was to exclude historical /
foreign data and show recent work, but it keyed the exclusion on
source.kind === "import" only, so claude-code-import sessions (the
post-pivot primary source) all flowed in.

Show only the most recent session's related_files, the same session
surfaced as the latest-session line, so the section reflects the
latest activity. The next-to-read section, which reuses the same
list, becomes recency-scoped too.

Update the core and cli handoff tests to assert that an older
session's files no longer appear once a newer session supersedes it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@takashi-matsuyama
takashi-matsuyama merged commit 3abe92e into main May 31, 2026
7 checks passed
@takashi-matsuyama
takashi-matsuyama deleted the fix/handoff-recent-files-scope branch May 31, 2026 16:01
takashi-matsuyama added a commit that referenced this pull request Sep 3, 2026
…204)

Eight Dependabot alerts were open against pnpm-lock.yaml, all of them in
the dev dependency tree. Each package moves inside its existing range, so
no manifest changes:

  fast-uri         3.1.2 -> 3.1.7   (#24 GHSA-fph4-wmhf-6fwf,
                                     #20 GHSA-7p8r-x3mc-p8w7,
                                     #11 GHSA-v2hh-gcrm-f6hx,
                                     #10 GHSA-4c8g-83qw-93j6)
  postcss         8.5.13 -> 8.5.27  (#19 GHSA-fxqj-rqcc-2cmp,
                                     #13 GHSA-r28c-9q8g-f849)
  brace-expansion  2.1.1 -> 2.1.4   (#12 GHSA-3jxr-9vmj-r5cp)
  brace-expansion  5.0.6 -> 5.0.9   (#9  GHSA-3jxr-9vmj-r5cp)

nanoid 3.3.12 -> 3.3.18 comes along as postcss's own dependency.

The published packages were never affected. Dependabot labels the four
fast-uri alerts `runtime`, but its only path into the tree is
packages/core's devDependencies (ajv / ajv-formats); the published
@basou/core declares simple-git, ulid, yaml and zod alone.

That is also why CI stayed green while eight alerts sat open: the audit
job runs `pnpm audit --prod` by design, so a dev-only advisory never
reaches it. Whether to widen that gate, and whether to enable Dependabot
security updates (currently off, which is why none of these alerts opened
a PR of its own), are separate calls left untouched here.

One low advisory stays out of scope: esbuild 0.27.7 via tsup
(GHSA-g7r4-m6w7-qqqr, a Windows dev-server file read) is patched in
0.28.1, which needs a tsup bump rather than a lockfile refresh.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant