feat(overseer): inbox substrate + v0 prioritizer (Step 2.5)

[heavygee]

Stacked on the events substrate (Step 2). Adds the inbox_items table + promotion job + v0 hand-tuned priority scorer + explain_priority provenance string + read-only inbox viewer. This is the Step 2.5 layer in the Overseer build sequence; it builds on Step 2 (events) and is built on by fix/overseer-inbox-stale-noise (PR #54) and the Step 2.75 replay harness. Soup integrates the full stack; clean upstream PR awaits the stack-wide rebase onto upstream/main (drops garden) via the integration soup process.

Made with Cursor

[chatgpt-codex-connector]

💡 Codex Review

hapi/hub/src/web/routes/systemEvents.ts

Lines 33 to 36 in 20efb03

	const events = engine.getSystemEvents({
	limit: parsed.data.limit ?? 50,
	beforeId: parsed.data.beforeId ?? null,
	sessionId: parsed.data.sessionId ?? null,

Scope system event queries by namespace

When an authenticated token belongs to another namespace, this endpoint still calls engine.getSystemEvents without using c.get('namespace') or checking access to sessionId; the store query reads the global events table. That lets any authenticated namespace enumerate event summaries/payloads for other namespaces, or pass another namespace's session id directly. Filter via sessions.namespace or validate the requested session with the existing session access guard before listing.

---

hapi/hub/src/web/routes/inboxItems.ts

Lines 35 to 39 in 20efb03

	const items = engine.getInboxItems({
	limit: parsed.data.limit ?? 50,
	activeOnly,
	sessionId: parsed.data.sessionId ?? null
	})

Scope inbox item access by namespace

In a multi-namespace hub, this endpoint lists inbox_items globally and the action endpoint below mutates items by global numeric id with no namespace ownership check. Since inbox rows contain titles/summaries and actions change status, a user in one namespace can see or resolve another namespace's attention items. List through the related session's namespace and validate item ownership before recording actions.

---

hapi/web/src/hooks/useSSE.ts

Lines 395 to 397 in 20efb03

	metadata: Object.prototype.hasOwnProperty.call(patch, 'metadata')
	? toSummaryMetadata(patch.metadata ?? null)
	: current.metadata,

Keep summary metadata behind the version gate

After an SSE reconnect, if a REST refetch has already populated the detail cache with a newer metadataVersion, a buffered older metadata patch still reaches patchSessionSummary; these lines replace the list row's metadata before the version check below rejects the stale patch. The result is a corrupted/missing name/path/flavor in the session list until a full refetch. Leave current.metadata here and only assign metadata inside the version-gated block.

---

hapi/hub/src/cursor/cursorImporter.ts

Line 318 in 20efb03

path: args.workspacePath ?? '',

Refuse cursor imports without a resume path

When a Cursor import cannot infer workspacePath (for example a legacy chat with no reverse lookup candidate, or an ACP meta without cwd), this writes metadata.path as an empty string and still creates the HAPI row. That row cannot be opened or resumed afterward because SyncEngine.resolveLocalResumeTarget rejects empty paths as Session metadata missing path, leaving the imported Cursor session unusable. Refuse the import until a path is supplied, or persist a real workspace path.

---

hapi/shared/src/sessionSummary.ts

Lines 151 to 155 in 20efb03

	?? metadata.geminiSessionId
	?? metadata.opencodeSessionId
	?? metadata.cursorSessionId
	?? metadata.kimiSessionId
	?? undefined,

Preserve Pi session ids in summaries

Pi sessions store their native resume id as metadata.piSessionId, but this summary flattener stops at Kimi. Inactive Pi rows that do not yet have a name or summary therefore have no agentSessionId, so the sidebar's empty-stub filter can hide real resumable Pi sessions and duplicate Pi rows bypass the list dedupe. Include piSessionId in this chain, and mirror it in the SSE summary patch helper.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".