* feat(cli): orca search over the agent session index
`orca search <query>` calls PR 5's `aiVault.searchSessions` over the CLI's
existing runtime RPC, against the host `--environment` / `--pairing-code`
selects and no other. `orca search --index-status` calls `aiVault.searchStatus`.
It is the proof the contract works with no panel.
Every flag maps onto a contract field and nothing else: `--scope`, `--fresh`,
`--limit`, `--cursor`, repeatable `--agent` and `--path`, `--since`, `--sort`,
`--debug`, `--json`. No fan-out, no merged output, no `--host`.
One command rather than a `search status` subcommand: the query is a bare
positional, so `orca search status` could not be told apart from searching for
the word "status". `--status` is unavailable because `orchestration task-list
--status <state>` already owns the name as a valued flag.
No new runtime capability. PR 5 decided an explicit `method_not_found` refusal
maps to `unavailable/no-service`, so reusing `createSessionSearchClient` gives
an old host a plain "this host runs no session search service" answer at exit 0
instead of a raw JSON-RPC error.
`CommandSpec.repeatableFlags` scopes repeatability per command, because
`--agent` must repeat for search and stay single-valued for `worktree create`.
`help.ts` sat exactly at max-lines, so `skills-command-flag-help.ts` becomes
`command-scoped-flag-help.ts` carrying both tables at the same call-site size.
* refactor(cli): drop the search type assertions main's casting gate now rejects
Main gained a `consistent-type-assertions: never` scan in the changed-code gate
after this branch was cut, and it reported twelve assertions in the new files.
The four in the argument parser were avoidable. `readEnum` now keeps the value
`find` returns, which already carries the narrow type, and the agent filter goes
through an `isAiVaultAgent` predicate over a `Set<string>` instead of widening
the agent tuple.
The test now narrows the printed envelope by shape and re-reads the printed
result through `AiVaultSearchResponseSchema`, so the JSON assertions are checked
rather than claimed, and the flag table is typed so its callback needs no cast.
One assertion is left, for the structural fake client, with the SAFETY rationale
AGENTS.md requires.
* fix(cli): sanitize host strings and scope pre-command repeatable flags
Route every host-supplied string the search formatter prints through the
escape stripper, and resolve the repeatable-flag set from the command
tokens ahead when a flag sits before the command.
* refactor(cli): resolve repeatable flag rules once per command
* fix(cli): clarify session search availability and SSH scope
* feat(cli): hide orca search until the settings toggle ships
`orca search` stays dispatchable but leaves every discovery surface: root
help, group help, unknown-command suggestions, and `agent-context --json`.
`buildAgentContext` did not filter hidden specs, so it also stops leaking
the hidden `terminal stop`.
* feat(session-history): add local search settings and index controls
* Use shared local host identifier for session index status
* feat(settings): live index status, enable confirm, advanced delete
* fix(settings): let Button and Collapsible own their spacing and type
* feat(ai-vault-search): define public contract and service seam
* feat(ai-vault-search): add IPC runtime relay and web transports
* fix(ai-vault-search): register search IPC at the core handler site
ai-vault.ts was two lines over the 300-line max-lines limit; the search
handlers belong with the other register*Handlers calls anyway.
* fix(ai-vault-search): withhold degraded-root paths from relay status
Status carried local filesystem paths over the relay while hits redact
theirs. redactStatusForTransport applies the same policy at the same
boundary: relay callers keep each root's reason and the array length as
the count, so the type only makes root optional.
* fix(ai-vault-search): close diagnostic path leak and remove test casts
* feat(ai-vault-search): carry an execution host id and per-host outcomes on hits
* feat(ai-vault-search): route desktop search by execution host scope, including runtimes
* feat(preload): accept an execution host scope on session search
* feat(web): answer only for the paired runtime on session search
* docs(ai-vault-search): describe execution-host routing and the all-hosts merge
* test(ai-vault-search): cover every host scope, the all-hosts merge and wire compat
* fix(ai-vault-search): resume every host mid-page so a merged page never drops a hit
* fix(ai-vault-search): decode the merged cursor with a schema instead of casts
CI's type-aware audit refuses type assertions; a zod record validates the
per-host entries and yields the typed map without one.
* refactor(ai-vault-search): defer cross-host merged search
Jinwoo Hong