Carry sessions when exporting a remote project (#333)

[scgopi]

Fixes #333.

Exporting loops from an ssh:// or codespace:// project produced a bundle with the graph and memory logs but no sessions: SessionTransplant.exportArtifact reads only this Mac's home directory, while a remote loop banks its session id at $HOME/.graphcode/sessions/<nodeID>.id on the host, with its transcript there too. Import already had the remote twin (restoreRemote, e3e80a5); this is the mirror.

What changes

• SessionTransplant.exportRemoteArtifact(forNode:at:) — the remote twin of exportArtifact. remoteExportScript is a pure function returning the host-side script per backend (unit-testable, like remoteInstallScript): Claude reads the banked id and finds $HOME/.claude/projects/*/<id>.jsonl; Copilot reads the banked id, else walks session-state/*/workspace.yaml for the zmx session name the way the ensure's bank fragment does; Codex takes the newest rollout whose header opened in the loop's working directory (worktree if bound, else the project folder on the host); OpenCode is nil. The script streams the session as tar to stdout, with the archive's first path component carrying the session id.
• Runner: sshCommandLine(remoteCommand:) | tar -xf - -C <staging> — the dial's stdout goes straight into a local untar, never through a PTY or a String. artifact(fromFetched:…) re-keys the result to exactly what the local export produces (transcript.jsonl, Copilot relative paths, rollout.jsonl), so restore and restoreRemote are untouched. Not wrapped in the login shell: stdout is the archive.
• ProjectPersistence.createExportBundle / createFullGraphExportBundle gain async overloads that collect sessions from wherever the project lives (concurrently per loop for a remote project; the existing disk read for a local one). The app's ProjectFeature.exportBundle and the CLI's export-node / export-graph use them; the CLI prints Sessions: N after Memory logs.
• A loop whose fetch fails is exported without a session. A fetch failure never fails the export.
• Tests in graphcode/Tests/RemoteSessionExportTests.swift (16): script shape per backend, Codex worktree-vs-project directory, OpenCode nil, the exit-cleanly-with-nothing shape, a parity test that the id file the fetch reads is exactly PresenceHooks.remoteSessionIDExpression, the pipeline for ssh and for gh codespace ssh, artifact re-keying per backend and the refusals, that the async builders match the sync ones for a local project, that an unreachable host yields no session rather than a failure, the deadline, the trap, and the fetch cap.

Transport design, from the probe findings

Mailroom #617 (RemoteExportTransportProbe, from gh v2.87.0 source): gh codespace ssh passes the remote command's stdout through untouched, writes every notice to stderr, flattens remote exit codes to 1, and can take minutes before the first byte while a stopped codespace starts. So the runner: trusts the archive, not ssh's exit status (the pipeline's status is the untar's); sets no deadline of its own (the dial's keepalives already bound a dead link); and treats an empty stream as "nothing to carry" (bsdtar exits 0 on empty stdin and extracts nothing, verified locally).

Verification scope: the codespace path is verified by source reading and the loopback ssh rig only — no codespace is reachable from this Mac (gh token lacks the codespace scope). Live codespace testing happens on another machine from a beta build. The three host-side scripts were exercised end-to-end against a fake $HOME through the same local untar (banked Claude id → transcript; unbanked Copilot → workspace.yaml walk; stale banked Copilot id → nothing; Codex newest-by-cwd; unbanked → empty stream, exit 0).

Docs

docs/09-remote-repositories.md is gitignored (/docs/*), so the one-line note that remote exports carry sessions was added to the local copy and does not ride in this PR.

Gate

Gate on 38db5ac6 (= remote head), private DerivedData under the worktree: xcodebuild test exit 0 — 1718 tests / 182 suites / 0 failures; graphcode-cli build exit 0; graphcoded build exit 0; swiftlint 0 errors; swift-format --strict clean; swift build exit 0; scripts/cli-smoke.sh against a throwaway daemon exit 0 (5/5); the built CLI's node export and graph export exit 0 printing Sessions: N; Linux pass (https://github.com/scgopi/GraphCode/actions/runs/34400371290/job/102630484589).

Since the first push, per review: the dial's exit status is recorded beside the staging directory (bytes plus a non-zero status is a partial session and is not carried; a POSIX group rather than pipefail, which /bin/sh is not guaranteed to know); a ten-minute deadline that kills the pipeline's whole process group (measured: a silent pipeline dies at the deadline with exit 143 and no orphan); a trap on INT/TERM/HUP that kills both the pipeline's and the watchdog's groups (measured: a TERM to the shell leaves no ssh, tar, subshell or sleep behind); the job's stdin is /dev/null as SIGTTIN hardening; remote fetches capped at four in flight (remoteSessionFetchConcurrency); and the RemoteProjectLocation ControlPath comment corrected (a missing socket directory is exit 255, not a warning). The verifier loop measured the built CLI against the loopback rig: graph export Sessions: 2, node export Sessions: 1, transcript and events files byte-identical to the host's, 0.5s under a real pty.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JjjrmYRrETeTY5UnsqVmeb