feat: pull child spawn history back to parent for spawn tree

[AhmedTMM]

Summary

• After the interactive session ends, the parent downloads the child VM's history.json via downloadFile and merges records into local history using mergeChildHistory (which already existed but was never called)
• All saveSpawnRecord calls now include parent_id and depth from SPAWN_PARENT_ID/SPAWN_DEPTH env vars, so child VMs properly link back to their parent
• spawn tree now shows the full recursive hierarchy across VMs instead of flat unrelated entries

How it works

1. Parent spawns child VM, sets SPAWN_PARENT_ID=<parentId> and SPAWN_DEPTH=N+1 in child's env
2. Child VM runs agent, agent uses spawn to create grandchildren — those records are saved with parent_id pointing to the child
3. When the parent's interactive session ends, pullChildHistory() downloads the child's history.json and merges it into the parent's local history
4. spawn tree reads local history, builds the tree using parent_id links

Test plan

• bun test src/__tests__/recursive-spawn.test.ts — 29 pass
• bunx @biomejs/biome check src/ — zero errors
• spawn claude sprite --beta recursive → agent creates a child → exit → spawn tree shows parent-child relationship

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: dd498f4

Summary

This PR adds functionality to pull child spawn history back to the parent VM for spawn tree visualization. The implementation is secure and follows all security best practices.

Findings

No security issues found.

Security Analysis

✅ Command Injection: SAFE

• Remote command (line 776) uses only static paths with no user input
• Fallback chain with || contains only literal strings

✅ Path Traversal: SAFE

• Temp file path uses controlled location (getTmpDir()) + UUID spawn ID
• No user-controlled path components

✅ Input Validation: SAFE

• JSON parsing with valibot schema validation (lines 786-790)
• Explicit field whitelisting and filtering (lines 797-825)
• Uses safe parseJsonWith() helper (returns null on invalid input)

✅ Credential Leaks: SAFE

• Downloads spawn history metadata only, not credentials
• Uses existing safe runner.downloadFile() abstraction

✅ Error Handling: SAFE

• Wrapped in asyncTryCatch - all errors caught and logged
• Graceful failure with debug logging (non-fatal)
• Temp file cleanup wrapped in tryCatch

✅ Type Safety: EXCELLENT

• Zero as type assertions (compliant with codebase rules)
• Valibot schema validation for all parsed data
• Proper type guards (if (r.id)) for narrowing

Tests

• ✅ bun test: 1953 pass, 0 fail
• ✅ biome lint: Clean (0 issues)

Code Quality

• Clean implementation following existing patterns
• Proper error handling throughout
• Non-blocking operation (fails gracefully)
• Good separation of concerns

Recommendation: Merge immediately.

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: HEAD (current)

Summary

Re-reviewed PR after dismissal. This PR adds functionality to pull child spawn history back to the parent VM for spawn tree visualization. The implementation remains secure and follows all security best practices.

Findings

No security issues found.

Security Analysis

✅ Command Injection: SAFE

• Remote command (line 776) uses only static paths with no user input
• Fallback chain with || contains only literal strings

✅ Path Traversal: SAFE

• Temp file path uses controlled location (getTmpDir()) + UUID spawn ID
• No user-controlled path components

✅ Input Validation: SAFE

• JSON parsing with valibot schema validation
• Explicit field whitelisting and filtering
• Uses safe parseJsonWith() helper (returns null on invalid input)

✅ Credential Leaks: SAFE

• Downloads spawn history metadata only, not credentials
• Uses existing safe runner.downloadFile() abstraction

✅ Error Handling: SAFE

• Wrapped in asyncTryCatch - all errors caught and logged
• Graceful failure with debug logging (non-fatal)

✅ Type Safety: EXCELLENT

• Zero as type assertions (compliant with codebase rules)
• Valibot schema validation for all parsed data
• Proper type guards for narrowing

Tests

• ✅ bun test: 1953 pass, 0 fail
• ✅ biome lint: Clean (0 issues)

Recommendation: Merge immediately.

---

-- security/pr-reviewer