pg: add --from-now to start a new push target at the join point

A target's first push has no watermark, so it backfills the entire local
archive. Pushing into a database shared with other people therefore discloses
every session on the machine, including unrelated local work, and there was no
way to ask for "only what happens from here on".

Add SyncOptions.PushFromNow, exposed as `pg push --from-now`, which seeds the
watermark with the push cutoff when a target has no history yet. It is applied
after the existing reset checks rather than before: those treat a watermark
with no matching target fingerprint or PG-side push marker as corrupt local
state and clear it, so a watermark seeded earlier (or from outside the process)
is wiped and the push falls back to a full backfill. It is also ignored for an
explicitly requested full push and for a target that already has history, so it
can only bound a first push, never open a gap in an established one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Technophobe01

cmd/agentsview/archive_write_backend.go

@@ -623,7 +623,7 @@ func (b *localArchiveWriteBackend) PGPush(
 	ps, err := postgres.New(
 		target.PG.URL, target.PG.Schema, b.database,
 		target.PG.MachineName, target.PG.AllowInsecure,
-		target.syncOptions(projects, excludeProjects, vectorSource),
+		target.syncOptions(projects, excludeProjects, vectorSource, cfg.FromNow),
 	)
 	if err != nil {
 		return postgres.PushResult{}, err
@@ -870,7 +870,7 @@ func (b *localArchiveWriteBackend) PGPushWatch(
 				s, cErr := postgres.New(
 					target.PG.URL, target.PG.Schema, b.database,
 					target.PG.MachineName, target.PG.AllowInsecure,
-					target.syncOptions(projects, exclude, vectorSource),
+					target.syncOptions(projects, exclude, vectorSource, cfg.FromNow),
 				)
 				if cErr != nil {
 					return nil, cErr

cmd/agentsview/cli.go

@@ -652,6 +652,7 @@ func newPGPushCommand() *cobra.Command {
 	cmd.Flags().DurationVar(&cfg.Debounce, "debounce", defaultWatchDebounce, "Coalesce window after a change before pushing (--watch only)")
 	cmd.Flags().DurationVar(&cfg.Interval, "interval", defaultWatchInterval, "Periodic floor push interval (--watch only)")
 	cmd.Flags().BoolVar(&cfg.NoVectors, "no-vectors", false, "Skip pushing semantic-search vectors")
+	cmd.Flags().BoolVar(&cfg.FromNow, "from-now", false, "On a target's FIRST push, start from now instead of backfilling local history (ignored with --full)")
 	return cmd
 }
 

cmd/agentsview/pg.go

@@ -29,6 +29,10 @@ type PGPushConfig struct {
 	Debounce        time.Duration
 	Interval        time.Duration
 	NoVectors       bool
+	// FromNow starts a target that has no watermark yet at the current time
+	// instead of backfilling the whole local archive. Ignored with --full and
+	// on a target that already has push history.
+	FromNow bool
 	// ScopeVectorsToChangedSessions is set internally by the watch
 	// loop for change-triggered pushes; it has no CLI flag.
 	ScopeVectorsToChangedSessions bool
@@ -66,13 +70,15 @@ func (s pgTargetSelection) label() string {
 func (s pgTargetSelection) syncOptions(
 	projects, excludeProjects []string,
 	vectorSource postgres.VectorPushSource,
+	pushFromNow bool,
 ) postgres.SyncOptions {
 	return postgres.SyncOptions{
 		Projects:               projects,
 		ExcludeProjects:        excludeProjects,
 		SyncStateTarget:        s.SyncStateTarget,
 		MigrateLegacySyncState: s.MigrateLegacySyncState,
 		VectorSource:           vectorSource,
+		PushFromNow:            pushFromNow,
 	}
 }
 

internal/postgres/push.go

@@ -134,6 +134,10 @@ func (s *Sync) PushWithOptions(
 ) (PushResult, error) {
 	full := opts.Full
 	start := time.Now()
+	// The caller's own --full intent, kept because `full` is reassigned below
+	// when reset detection forces a rebuild; PushFromNow must never override an
+	// explicitly requested full push.
+	requestedFull := full
 	var result PushResult
 	state := s.effectiveSyncState()
 	aliasBackfillState := s.aliasBackfillSyncStateOrDefault()
@@ -302,6 +306,24 @@ func (s *Sync) PushWithOptions(
 	}
 	cutoff := time.Now().UTC().Format(LocalSyncTimestampLayout)
 
+	// Start a brand-new target at "now" instead of backfilling the archive.
+	// Applied HERE, after every reset check above has run: those checks key on
+	// lastPush being non-empty and treat a watermark with no matching target
+	// fingerprint or PG-side marker as corrupt local state, so a watermark
+	// seeded any earlier (or from outside this process) would be wiped and the
+	// push would fall back to a full backfill. finalizePushState records cutoff
+	// at the end, so every later push for the target is normally incremental.
+	if boundary, applied := pushFromNowBoundary(
+		s.pushFromNow, requestedFull, lastPush, cutoff,
+	); applied {
+		log.Printf(
+			"pgsync: first push for this target starts at %s "+
+				"(from-now); local history before it is not uploaded",
+			cutoff,
+		)
+		lastPush = boundary
+	}
+
 	// Candidate selection shares ListSessionsForMirrorWindow with the
 	// DuckDB mirror push: sync_marker >= lastPush, inclusive below and
 	// deliberately unbounded above. An upper bound at cutoff would let a
@@ -1353,6 +1375,20 @@ func persistPushTargetFingerprint(
 	return nil
 }
 
+// pushFromNowBoundary decides the lower bound of a from-now push. It applies
+// only to a target with NO watermark yet, and never overrides an explicitly
+// requested full push: narrowing an established target would silently create a
+// gap in what the hub has, whereas bounding a target's very first push just
+// means its history starts at the join point.
+func pushFromNowBoundary(
+	enabled, requestedFull bool, lastPush, cutoff string,
+) (string, bool) {
+	if !enabled || requestedFull || lastPush != "" {
+		return lastPush, false
+	}
+	return cutoff, true
+}
+
 func pushTargetState(
 	lastPush, boundaryState,
 	storedTargetFingerprint, currentTargetFingerprint string,

internal/postgres/push_test.go

@@ -1822,3 +1822,34 @@ func TestShouldSkipSessionMessagesInBatchedPush(t *testing.T) {
 		sessionID, 2, unchangedFP, true, baseComparisons,
 	), "full mode should not skip by fingerprint check")
 }
+
+// A from-now push must bound only a target's FIRST push, and must never
+// silently narrow an established target or override an explicit full push.
+func TestPushFromNowBoundary(t *testing.T) {
+	const cutoff = "2026-07-24 12:00:00"
+	const established = "2026-07-01 00:00:00"
+	cases := []struct {
+		name          string
+		enabled       bool
+		requestedFull bool
+		lastPush      string
+		want          string
+		wantApplied   bool
+	}{
+		{"fresh target starts at now", true, false, "", cutoff, true},
+		{"disabled backfills as before", false, false, "", "", false},
+		{"explicit full push wins", true, true, "", "", false},
+		{"established target is untouched", true, false, established, established, false},
+		{"established target with full push is untouched", true, true, established, established, false},
+		{"disabled and established is untouched", false, false, established, established, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, applied := pushFromNowBoundary(
+				tc.enabled, tc.requestedFull, tc.lastPush, cutoff,
+			)
+			assert.Equal(t, tc.want, got)
+			assert.Equal(t, tc.wantApplied, applied)
+		})
+	}
+}

internal/postgres/sync.go

@@ -173,6 +173,10 @@ type Sync struct {
 	// vectorSource, when set, supplies the local vectors.db active generation
 	// pushed as a phase at the end of Push. Nil disables the phase.
 	vectorSource VectorPushSource
+
+	// pushFromNow starts a fresh target at the current time rather than
+	// backfilling the local archive. See SyncOptions.PushFromNow.
+	pushFromNow bool
 	// afterVectorApply is a full/scoped post-apply test hook.
 	afterVectorApply func()
 	// beforeVectorWitnessRecord is a generation-wide pre-witness test hook.
@@ -219,6 +223,13 @@ type SyncOptions struct {
 	// VectorSource, when non-nil, enables the vector push phase, replicating
 	// the local vectors.db active generation into PG. Nil skips the phase.
 	VectorSource VectorPushSource
+	// PushFromNow starts a target's history at the moment of its FIRST push
+	// instead of backfilling the whole local archive. It applies only when the
+	// target has no watermark yet and the caller did not ask for a full push,
+	// so it cannot silently narrow an established target. Intended for pushing
+	// into a SHARED database, where uploading a machine's entire history would
+	// disclose unrelated local work to everyone with read access.
+	PushFromNow bool
 }
 
 // New creates a Sync instance and verifies the PG connection.
@@ -297,6 +308,7 @@ func New(
 		projects:               opts.Projects,
 		excludeProjects:        opts.ExcludeProjects,
 		vectorSource:           opts.VectorSource,
+		pushFromNow:            opts.PushFromNow,
 	}, nil
 }