@agentguard-run/burn 0.2.3 → 0.2.6

package/dist/src/insights/sessions.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoverInsightTranscripts = discoverInsightTranscripts;
+exports.selectInsightTranscript = selectInsightTranscript;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+/** Local locators only. Never follows directory symlinks or reads message content. */
+function discoverInsightTranscripts(roots = {
+    claude: (0, node_path_1.join)((0, node_os_1.homedir)(), '.claude', 'projects'),
+    codex: (0, node_path_1.join)((0, node_os_1.homedir)(), '.codex', 'sessions'),
+}) {
+    const found = [];
+    function visit(directory, host, depth) {
+        if (depth > 8)
+            return;
+        let entries;
+        try {
+            entries = (0, node_fs_1.readdirSync)(directory, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const path = (0, node_path_1.join)(directory, entry.name);
+            if (entry.isDirectory())
+                visit(path, host, depth + 1);
+            else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
+                try {
+                    found.push({ path, host, sessionId: (0, node_path_1.basename)(path, '.jsonl'), modifiedAt: (0, node_fs_1.statSync)(path).mtimeMs });
+                }
+                catch { /* concurrently removed */ }
+            }
+        }
+    }
+    visit(roots.claude, 'claude', 0);
+    visit(roots.codex, 'codex', 0);
+    return found.sort((a, b) => b.modifiedAt - a.modifiedAt || a.path.localeCompare(b.path));
+}
+function selectInsightTranscript(session, locations) {
+    const requested = session || process.env.AGENTGUARD_SESSION_ID || process.env.CLAUDE_SESSION_ID || process.env.CODEX_THREAD_ID;
+    if (requested && (0, node_fs_1.existsSync)(requested) && (0, node_fs_1.statSync)(requested).isFile()) {
+        const path = (0, node_path_1.resolve)(requested);
+        return { path, host: /(?:rollout-|[\\/]\.codex[\\/])/.test(path) ? 'codex' : 'claude', sessionId: (0, node_path_1.basename)(path, '.jsonl'), modifiedAt: (0, node_fs_1.statSync)(path).mtimeMs };
+    }
+    const candidates = locations ?? discoverInsightTranscripts();
+    const selected = requested ? candidates.find(item => item.sessionId === requested || item.sessionId.endsWith(`-${requested}`)) : candidates[0];
+    if (!selected)
+        throw new Error(requested ? 'Session transcript not found. Pass its local JSONL path.' : 'No local Claude Code or Codex transcript found.');
+    return selected;
+}

package/dist/src/insights/transcript.d.ts

@@ -0,0 +1,14 @@
+import type { InsightHost, InsightParseOptions, InsightTranscript, InsightTurn } from './types';
+/** Provider response identity is shared by reporting and enforcement readers. */
+export declare const providerResponseIdentity: (host: InsightHost, id: unknown) => string;
+/**
+ * Parse complete JSONL records. Pass returned state when parsing appended lines.
+ * `updatedTurns` replaces rows with the same id; it must never be blindly added
+ * to previous totals because an assistant message can gain output usage later.
+ */
+export declare function parseInsightTranscript(text: string, options?: InsightParseOptions): InsightTranscript;
+export declare function readInsightTranscript(filename: string, options?: InsightParseOptions): InsightTranscript;
+/** Read one Claude session plus its explicitly stored child transcripts. */
+export declare function readInsightSession(filename: string, options?: InsightParseOptions): InsightTranscript;
+/** Forked transcript copies can repeat provider response ids across files. */
+export declare function deduplicateTurns(turns: InsightTurn[]): InsightTurn[];

package/dist/src/insights/transcript.js

@@ -0,0 +1,505 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.providerResponseIdentity = void 0;
+exports.parseInsightTranscript = parseInsightTranscript;
+exports.readInsightTranscript = readInsightTranscript;
+exports.readInsightSession = readInsightSession;
+exports.deduplicateTurns = deduplicateTurns;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const count = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+const hasCount = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+const digest = (value) => (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(value)).digest('hex');
+/** Provider response identity is shared by reporting and enforcement readers. */
+const providerResponseIdentity = (host, id) => digest(['provider-response', host, id]);
+exports.providerResponseIdentity = providerResponseIdentity;
+const identifier = (value) => typeof value === 'string' && /^[A-Za-z0-9_.:/-]{1,128}$/.test(value) ? value : undefined;
+const modelName = identifier;
+function millis(value) {
+    if (typeof value === 'string') {
+        const parsed = Date.parse(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    if (typeof value === 'number' && Number.isFinite(value) && value > 0)
+        return value < 100_000_000_000 ? value * 1000 : value;
+    return undefined;
+}
+const DETAIL_BUCKETS = {
+    instruction_tokens: 'instruction_stack', system_tokens: 'instruction_stack',
+    history_tokens: 'history_resent', history_resent_tokens: 'history_resent',
+    reread_file_tokens: 'reread_files', repeated_file_tokens: 'reread_files',
+    subagent_tokens: 'subagent_fanout', tool_output_tokens: 'tool_output',
+};
+/** Optional numeric host instrumentation is evidence; content length is not. */
+function explicitAttribution(usage) {
+    const result = [];
+    const details = [
+        [usage.input_tokens_details ?? usage.prompt_tokens_details, 'input'],
+        [usage.cache_creation_input_tokens_details, 'cacheCreation'],
+        [usage.cache_read_input_tokens_details, 'cacheRead'],
+    ];
+    for (const [value, category] of details) {
+        for (const [key, tokens] of Object.entries(object(value))) {
+            const bucket = DETAIL_BUCKETS[key];
+            if (bucket && hasCount(tokens) && count(tokens) > 0)
+                result.push({ bucket, category, tokens: count(tokens) });
+        }
+    }
+    return result;
+}
+function emptyState(options) {
+    return { host: options.host ?? 'unknown', sessionId: identifier(options.sessionId) ?? 'unknown', compactionPending: false,
+        spawnedSession: Boolean(options.spawnedSession), seen: {}, recordsSeen: 0, codexEpoch: 0, intervalStateVersion: 1 };
+}
+function detectHost(raw, usage, fallback) {
+    if (raw.type === 'session_meta' || raw.type === 'turn_context' || raw.type === 'event_msg' || raw.type === 'response_item' || raw.type === 'compacted')
+        return 'codex';
+    if ('cache_creation_input_tokens' in usage || 'cache_read_input_tokens' in usage || raw.type === 'assistant' || raw.type === 'user' || raw.type === 'system')
+        return 'claude';
+    return fallback;
+}
+function usageOf(raw) {
+    const payload = object(raw.payload);
+    if (raw.type === 'event_msg' && payload.type === 'token_count') {
+        const info = object(payload.info);
+        return { usage: object(info.last_token_usage), total: Object.keys(object(info.total_token_usage)).length ? object(info.total_token_usage) : undefined, codex: true };
+    }
+    const usage = raw.usage ?? object(raw.message).usage ?? object(raw.response).usage ?? raw.token_usage;
+    return { usage: object(usage), codex: false };
+}
+function totalDigest(total) {
+    return digest([count(total.input_tokens), count(total.cached_input_tokens), count(total.cache_write_input_tokens), count(total.output_tokens), count(total.total_tokens)]);
+}
+function observeTools(raw, state) {
+    const message = object(raw.message), payload = object(raw.payload);
+    const blocks = Array.isArray(message.content) ? [...message.content] : [];
+    if (raw.type === 'response_item' && ['function_call', 'function_call_output', 'custom_tool_call', 'custom_tool_call_output'].includes(String(payload.type)))
+        blocks.push(payload);
+    state.observedCalls ??= {};
+    for (let index = 0; index < blocks.length; index++) {
+        const block = object(blocks[index]);
+        const toolId = block.id ?? block.call_id ?? block.tool_use_id ?? [message.id ?? raw.uuid ?? state.recordsSeen, index];
+        const isResult = block.type === 'tool_result' || block.type === 'function_call_output' || block.type === 'custom_tool_call_output';
+        if (isResult) {
+            state.observedCalls[digest(['result', toolId])] = { kind: 'tool_result' };
+            continue;
+        }
+        if (block.type !== 'tool_use' && block.type !== 'function_call' && block.type !== 'custom_tool_call')
+            continue;
+        const name = typeof block.name === 'string' ? block.name : '';
+        const isRead = /^(?:(?:functions\.)?Read|(?:functions\.)?read_file)$/.test(name);
+        const isSpawn = /^(?:(?:functions\.)?(?:Agent|Task|spawn_agent))$/.test(name);
+        if (!isRead && !isSpawn)
+            continue;
+        const id = digest(['tool', toolId]);
+        if (isSpawn) {
+            state.observedCalls[id] = { kind: 'spawn' };
+            continue;
+        }
+        let input = object(block.input ?? block.arguments);
+        if (typeof block.arguments === 'string') {
+            try {
+                input = object(JSON.parse(block.arguments));
+            }
+            catch {
+                continue;
+            }
+        }
+        const filename = input.file_path ?? input.path;
+        if (typeof filename === 'string' && filename.length) {
+            const fileKey = digest(filename);
+            state.observedCalls[id] = { kind: 'read', fileKey };
+            state.readPathsSeen ??= {};
+            state.readToolCalls ??= {};
+            if (!state.readToolCalls[id]) {
+                state.readToolCalls[id] = { fileKey, repeated: Boolean(state.readPathsSeen[fileKey]) };
+                state.readPathsSeen[fileKey] = true;
+            }
+        }
+    }
+}
+function emptyInterval() {
+    return { toolOutputBytes: 0, reReadBytes: 0, conversationBytes: 0, toolResults: 0, userMessages: 0, shared: false };
+}
+/** UTF-8 payload bytes are weights only. No content survives this call. */
+function contentBytes(value) {
+    if (typeof value === 'string')
+        return Buffer.byteLength(value, 'utf8');
+    if (Array.isArray(value))
+        return value.reduce((sum, item) => sum + contentBytes(item), 0);
+    if (value === undefined || value === null)
+        return 0;
+    const record = object(value);
+    if (typeof record.text === 'string')
+        return Buffer.byteLength(record.text, 'utf8');
+    return Buffer.byteLength(JSON.stringify(value), 'utf8');
+}
+function observeInputEvents(raw, state) {
+    state.pendingInterval ??= emptyInterval();
+    state.inputEventsSeen ??= {};
+    const interval = state.pendingInterval;
+    const message = object(raw.message), payload = object(raw.payload);
+    const seen = (key) => {
+        const hash = digest(key);
+        if (state.inputEventsSeen[hash])
+            return true;
+        state.inputEventsSeen[hash] = true;
+        return false;
+    };
+    const toolResult = (block, fallback) => {
+        const toolId = block.tool_use_id ?? block.call_id ?? block.id;
+        if (seen(['tool-result', toolId ?? fallback]))
+            return;
+        const bytes = contentBytes(block.content ?? block.output);
+        const repeated = toolId !== undefined && state.readToolCalls?.[digest(['tool', toolId])]?.repeated;
+        if (repeated) {
+            interval.reReadBytes += bytes;
+            interval.reReadResults = (interval.reReadResults ?? 0) + 1;
+        }
+        else
+            interval.toolOutputBytes += bytes;
+        interval.toolResults++;
+    };
+    const userMessage = (content, key, source) => {
+        if (content === undefined || content === null)
+            return;
+        if (seen(['user-message', key]))
+            return;
+        const bytes = contentBytes(content);
+        // Codex records the same submitted message as both a response item and a
+        // user_message event. Equal text in separate same-source messages is real.
+        if (source) {
+            const fingerprint = digest(content);
+            if (state.conversationEcho?.digest === fingerprint && state.conversationEcho.source !== source) {
+                state.conversationEcho = undefined;
+                return;
+            }
+            state.conversationEcho = { digest: fingerprint, source };
+        }
+        interval.conversationBytes += bytes;
+        interval.userMessages++;
+    };
+    if (raw.type === 'user') {
+        const content = message.content;
+        const identity = raw.uuid ?? message.id ?? raw.id ?? ['line', state.recordsSeen];
+        if (Array.isArray(content)) {
+            const conversational = [];
+            content.forEach((value, index) => {
+                const block = object(value);
+                if (block.type === 'tool_result')
+                    toolResult(block, [identity, index]);
+                else
+                    conversational.push(value);
+            });
+            if (conversational.length)
+                userMessage(conversational, identity);
+        }
+        else if (content !== undefined)
+            userMessage(content, identity);
+    }
+    else if (raw.type === 'response_item') {
+        if (payload.type === 'function_call_output' || payload.type === 'custom_tool_call_output')
+            toolResult(payload, raw.id ?? ['line', state.recordsSeen]);
+        else if (payload.type === 'message' && payload.role === 'user') {
+            const content = Array.isArray(payload.content) ? payload.content.map(value => {
+                const block = object(value);
+                return typeof block.text === 'string' ? block.text : value;
+            }) : payload.content;
+            // Normalize text blocks for pairing with Codex's plain-string event echo.
+            const normalized = Array.isArray(content) && content.every(value => typeof value === 'string') ? content.join('') : content;
+            userMessage(normalized, payload.id ?? raw.id ?? ['line', state.recordsSeen], 'response');
+        }
+    }
+    else if (raw.type === 'event_msg' && payload.type === 'user_message') {
+        userMessage(payload.message, payload.id ?? raw.id ?? ['line', state.recordsSeen], 'event');
+    }
+    interval.shared = interval.toolResults > 0 && interval.userMessages > 0;
+}
+function observations(calls) {
+    const files = new Map();
+    const result = { readCalls: 0, repeatedReadCalls: 0, uniqueReadFiles: 0, spawnCalls: 0, toolResultRecords: 0 };
+    for (const call of Object.values(calls)) {
+        if (call.kind === 'spawn')
+            result.spawnCalls++;
+        else if (call.kind === 'tool_result')
+            result.toolResultRecords++;
+        else if (call.fileKey) {
+            result.readCalls++;
+            files.set(call.fileKey, (files.get(call.fileKey) ?? 0) + 1);
+        }
+    }
+    result.uniqueReadFiles = files.size;
+    result.repeatedReadCalls = [...files.values()].reduce((sum, total) => sum + Math.max(0, total - 1), 0);
+    return result;
+}
+/**
+ * Parse complete JSONL records. Pass returned state when parsing appended lines.
+ * `updatedTurns` replaces rows with the same id; it must never be blindly added
+ * to previous totals because an assistant message can gain output usage later.
+ */
+function parseInsightTranscript(text, options = {}) {
+    const state = options.state ?? emptyState(options);
+    state.intervalStateVersion = 1;
+    const diagnostics = { lines: 0, malformedLines: 0, duplicateUsageRecords: 0, unsupportedUsageRecords: 0, inheritedUsageRecords: 0 };
+    const updated = new Map();
+    let seenCount = Object.keys(state.seen).length;
+    const acceptedQuotaLineNumbers = [];
+    let lineNumber = -1;
+    for (const line of text.split('\n')) {
+        lineNumber++;
+        if (!line.trim())
+            continue;
+        diagnostics.lines++;
+        state.recordsSeen = (state.recordsSeen ?? 0) + 1;
+        let raw;
+        try {
+            raw = object(JSON.parse(line));
+        }
+        catch {
+            diagnostics.malformedLines++;
+            continue;
+        }
+        const message = object(raw.message), payload = object(raw.payload), response = object(raw.response);
+        const extracted = usageOf(raw), usage = extracted.usage;
+        const at = millis(raw.timestamp ?? raw.created_at ?? payload.timestamp);
+        if (raw.type === 'fork-context-ref') {
+            state.lineage = { ...state.lineage, forkContextRef: true, forked: true,
+                ...(identifier(raw.parentSessionId) ? { parentSessionId: identifier(raw.parentSessionId) } : {}) };
+        }
+        if (raw.type === 'session_meta' && !state.sessionMetadataSeen) {
+            state.sessionMetadataSeen = true;
+            state.host = 'codex';
+            const spawned = object(object(object(payload.source).subagent).thread_spawn);
+            state.lineage = { ...state.lineage,
+                ...(identifier(payload.id ?? payload.session_id) ? { sessionId: identifier(payload.id ?? payload.session_id) } : {}),
+                ...(identifier(payload.parent_thread_id ?? spawned.parent_thread_id) ? { parentSessionId: identifier(payload.parent_thread_id ?? spawned.parent_thread_id) } : {}),
+                ...(identifier(payload.forked_from_id) ? { forked: true } : {}) };
+            if ('subagent' in object(payload.source) || identifier(payload.parent_thread_id) || identifier(payload.agent_path))
+                state.spawnedSession = true;
+            if (hasCount(payload.subagent_history_start_ordinal))
+                state.inheritedBeforeOrdinal = count(payload.subagent_history_start_ordinal);
+            if (identifier(payload.forked_from_id)) {
+                state.forkHistoryBoundaryUnknown = true;
+                state.awaitingForkBoundary = true;
+                if (identifier(payload.id))
+                    state.forkThreadIdDigest = digest(payload.id);
+            }
+        }
+        // Modern Codex marks inherited history with ordinals. Copied legacy items
+        // can have rewritten timestamps, so wall-clock time is not a safe boundary.
+        const ordinalKnown = state.inheritedBeforeOrdinal !== undefined && hasCount(raw.ordinal);
+        const beforeOrdinal = ordinalKnown && count(raw.ordinal) < state.inheritedBeforeOrdinal;
+        const ownedSettings = raw.type === 'event_msg' && payload.type === 'thread_settings_applied' &&
+            state.forkThreadIdDigest !== undefined && identifier(payload.thread_id) !== undefined && digest(payload.thread_id) === state.forkThreadIdDigest;
+        if ((ordinalKnown && !beforeOrdinal) || (!ordinalKnown && ownedSettings)) {
+            state.awaitingForkBoundary = false;
+            state.forkHistoryBoundaryUnknown = false;
+        }
+        if (beforeOrdinal || state.awaitingForkBoundary) {
+            if (extracted.codex && extracted.total) {
+                state.inheritedTotalDigest = totalDigest(extracted.total);
+                diagnostics.inheritedUsageRecords++;
+            }
+            continue;
+        }
+        if (at !== undefined && raw.type === 'event_msg' && payload.type === 'token_count' && Object.keys(object(payload.rate_limits)).length) {
+            acceptedQuotaLineNumbers.push(lineNumber);
+        }
+        if (extracted.codex && extracted.total && state.inheritedTotalDigest === totalDigest(extracted.total)) {
+            diagnostics.inheritedUsageRecords++;
+            continue;
+        }
+        observeTools(raw, state);
+        observeInputEvents(raw, state);
+        const host = detectHost(raw, usage, state.host);
+        if (state.host === 'unknown')
+            state.host = host;
+        if (state.sessionId === 'unknown')
+            state.sessionId = identifier(raw.sessionId ?? raw.session_id ?? (raw.type === 'session_meta' ? payload.session_id ?? payload.id : undefined)) ?? 'unknown';
+        const rawModel = message.model ?? response.model ?? raw.model ?? payload.model;
+        const model = modelName(rawModel);
+        if (rawModel !== undefined)
+            state.model = model;
+        if ((raw.type === 'turn_context' || (raw.type === 'event_msg' && payload.type === 'task_started')) && identifier(payload.turn_id)) {
+            state.codexTurnIdDigest = digest(payload.turn_id);
+        }
+        if (raw.isSidechain === true || raw.is_sidechain === true ||
+            (raw.type === 'session_meta' && ('subagent' in object(payload.source) || identifier(payload.parent_thread_id) || identifier(payload.agent_path))))
+            state.spawnedSession = true;
+        if ((raw.type === 'system' && raw.subtype === 'compact_boundary') || raw.type === 'compacted' ||
+            payload.type === 'context_compacted' || payload.type === 'compaction')
+            state.compactionPending = true;
+        const prefix = raw.prompt_prefix_hash ?? raw.prefix_hash ?? message.prompt_prefix_hash ?? payload.prompt_prefix_hash ?? payload.prefix_hash;
+        const prefixDigest = typeof prefix === 'string' && prefix.length <= 256 ? digest(prefix) : undefined;
+        const changedPrefix = prefixDigest && state.prefixDigest ? prefixDigest !== state.prefixDigest : undefined;
+        if (changedPrefix !== undefined)
+            state.prefixChangedPending = Boolean(state.prefixChangedPending || changedPrefix);
+        if (prefixDigest)
+            state.prefixDigest = prefixDigest;
+        const inputRaw = usage.input_tokens ?? usage.prompt_tokens;
+        const outputRaw = usage.output_tokens ?? usage.completion_tokens;
+        if (!hasCount(inputRaw) && !hasCount(outputRaw) && !hasCount(usage.cache_creation_input_tokens) && !hasCount(usage.cache_read_input_tokens)) {
+            if (Object.keys(usage).length)
+                diagnostics.unsupportedUsageRecords++;
+            continue;
+        }
+        const details = object(usage.input_tokens_details ?? usage.prompt_tokens_details);
+        const cacheReadTokens = count(usage.cache_read_input_tokens ?? usage.cached_input_tokens ?? details.cached_tokens);
+        const cacheWriteTokens = count(usage.cache_creation_input_tokens ?? usage.cache_write_input_tokens ?? details.cache_write_tokens);
+        const includesCache = host === 'codex' || extracted.codex || (!('cache_creation_input_tokens' in usage) && !('cache_read_input_tokens' in usage) && ('cached_tokens' in details || 'cached_input_tokens' in usage));
+        if (includesCache && cacheReadTokens + cacheWriteTokens > count(inputRaw)) {
+            diagnostics.unsupportedUsageRecords++;
+            continue;
+        }
+        const inputTokens = includesCache ? Math.max(0, count(inputRaw) - cacheReadTokens - cacheWriteTokens) : count(inputRaw);
+        const outputTokens = count(outputRaw); // Reasoning output is already included.
+        if (inputTokens + cacheWriteTokens + cacheReadTokens + outputTokens === 0)
+            continue;
+        if (extracted.codex)
+            state.inheritedTotalDigest = undefined;
+        const uncertainties = [];
+        if (!model && !state.model)
+            uncertainties.push('model_unknown');
+        if (state.forkHistoryBoundaryUnknown)
+            uncertainties.push('fork_history_boundary_unknown');
+        let nativeId = message.id ?? response.id ?? raw.request_id ?? raw.requestId ?? raw.uuid ?? raw.id;
+        if (extracted.codex && extracted.total) {
+            const total = extracted.total;
+            const next = { input: count(total.input_tokens), cached: count(total.cached_input_tokens ?? object(total.input_tokens_details).cached_tokens), output: count(total.output_tokens) };
+            if (state.codexTotals && (next.input < state.codexTotals.input || next.output < state.codexTotals.output)) {
+                state.codexEpoch = (state.codexEpoch ?? 0) + 1;
+                uncertainties.push('codex_cumulative_counter_reset');
+            }
+            nativeId = ['codex-total', state.codexTurnIdDigest ?? state.codexEpoch ?? 0, next.input, next.cached, count(total.cache_write_input_tokens), next.output, count(total.total_tokens)];
+            if (!state.codexTurnIdDigest)
+                uncertainties.push('codex_turn_identity_missing');
+            state.codexTotals = next;
+        }
+        if (nativeId === undefined) {
+            nativeId = ['line', state.recordsSeen, at ?? null];
+            uncertainties.push('usage_id_missing');
+        }
+        // Provider response ids remain the same when a host copies history into a
+        // forked session. Preserve global identity instead of charging it twice.
+        const providerId = message.id !== undefined || response.id !== undefined;
+        const id = providerId ? (0, exports.providerResponseIdentity)(host, nativeId) : digest([extracted.codex && state.codexTurnIdDigest ? 'codex-turn' : state.sessionId, host, nativeId]);
+        const existing = state.seen[id];
+        const creation = object(usage.cache_creation);
+        const split5m = creation.ephemeral_5m_input_tokens, split1h = creation.ephemeral_1h_input_tokens;
+        const knownSplits = hasCount(split5m) && hasCount(split1h) && count(split5m) + count(split1h) === cacheWriteTokens;
+        const ttl = raw.cache_ttl_seconds ?? usage.cache_ttl_seconds ?? message.cache_ttl_seconds;
+        let cacheTtlSeconds = ttl === 300 || ttl === 3600 ? ttl : undefined;
+        let cacheTtlSource = cacheTtlSeconds ? 'explicit_metadata' : undefined;
+        if (!cacheTtlSeconds && knownSplits && cacheWriteTokens > 0 && (!count(split5m) || !count(split1h))) {
+            cacheTtlSeconds = count(split1h) ? 3600 : 300;
+            cacheTtlSource = 'usage_split';
+        }
+        if (cacheWriteTokens && !cacheTtlSeconds)
+            uncertainties.push(knownSplits ? 'cache_ttl_mixed' : 'cache_ttl_unknown');
+        if ((hasCount(split5m) || hasCount(split1h)) && !knownSplits)
+            uncertainties.push('cache_write_ttl_split_inconsistent');
+        const turn = { id, sessionId: state.sessionId, host, ...(at !== undefined ? { at } : {}),
+            ...(state.spawnedSession ? { subagent: true } : {}),
+            ...(state.model ? { model: state.model } : {}), inputTokens, cacheWriteTokens, cacheReadTokens, outputTokens,
+            ...(knownSplits ? { cacheWrite5mTokens: count(split5m), cacheWrite1hTokens: count(split1h) } : {}),
+            ...(cacheTtlSeconds ? { cacheTtlSeconds, cacheTtlSource } : {}), contextTokens: inputTokens + cacheWriteTokens + cacheReadTokens,
+            signals: existing?.signals ?? { afterCompaction: state.compactionPending, firstSpawnedTurn: state.spawnedSession && !state.forkHistoryBoundaryUnknown && seenCount === 0,
+                ...(state.lastAt !== undefined && at !== undefined && at >= state.lastAt ? { idleMs: at - state.lastAt } : {}),
+                ...(state.prefixChangedPending !== undefined ? { prefixChanged: state.prefixChangedPending } : {}) },
+            explicitAttribution: explicitAttribution(usage), uncertainties,
+            interval: existing?.interval ?? { ...state.pendingInterval } };
+        if (existing) {
+            diagnostics.duplicateUsageRecords++;
+            // Claude repeats message usage per content block and updates output counts.
+            // Take maxima for the same response, not a sum of repeated snapshots.
+            for (const key of ['inputTokens', 'cacheWriteTokens', 'cacheReadTokens', 'outputTokens'])
+                turn[key] = Math.max(existing[key], turn[key]);
+            turn.contextTokens = turn.inputTokens + turn.cacheWriteTokens + turn.cacheReadTokens;
+            turn.at = existing.at ?? turn.at;
+            turn.uncertainties = [...new Set([...existing.uncertainties, ...turn.uncertainties])];
+            if (existing.cacheWriteTokens > cacheWriteTokens) {
+                turn.cacheWrite5mTokens = existing.cacheWrite5mTokens;
+                turn.cacheWrite1hTokens = existing.cacheWrite1hTokens;
+                turn.cacheTtlSeconds = existing.cacheTtlSeconds;
+                turn.cacheTtlSource = existing.cacheTtlSource;
+            }
+            if (!turn.explicitAttribution.length)
+                turn.explicitAttribution = existing.explicitAttribution;
+            if (JSON.stringify(existing) === JSON.stringify(turn))
+                continue;
+        }
+        else {
+            state.pendingInterval = emptyInterval();
+            state.conversationEcho = undefined;
+            state.compactionPending = false;
+            state.prefixChangedPending = undefined;
+            seenCount++;
+            if (at !== undefined)
+                state.lastAt = at;
+        }
+        state.seen[id] = turn;
+        updated.set(id, turn);
+    }
+    return { host: state.host, sessionId: state.sessionId, turns: Object.values(state.seen), updatedTurns: [...updated.values()], diagnostics, state,
+        observations: observations(state.observedCalls ?? {}), acceptedQuotaLineNumbers };
+}
+function readInsightTranscript(filename, options = {}) {
+    return parseInsightTranscript((0, node_fs_1.readFileSync)(filename, 'utf8'), { sessionId: (0, node_path_1.basename)(filename, '.jsonl'), spawnedSession: /(?:^|[\\/])subagents[\\/]/.test(filename), ...options });
+}
+/** Read one Claude session plus its explicitly stored child transcripts. */
+function readInsightSession(filename, options = {}) {
+    const parent = readInsightTranscript(filename, options);
+    const childDirectory = (0, node_path_1.join)(filename.replace(/\.jsonl$/, ''), 'subagents');
+    let files;
+    try {
+        files = (0, node_fs_1.readdirSync)(childDirectory).filter(name => name.endsWith('.jsonl')).sort();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return parent;
+        throw error;
+    }
+    const calls = { ...parent.state.observedCalls };
+    const turns = [...parent.turns];
+    for (const name of files) {
+        const child = readInsightTranscript((0, node_path_1.join)(childDirectory, name), { host: options.host, spawnedSession: true });
+        const known = new Set(turns.map(turn => turn.id));
+        const firstOwn = child.turns.findIndex(turn => !known.has(turn.id));
+        if (firstOwn > 0 && child.turns.slice(0, firstOwn).some(turn => turn.signals.firstSpawnedTurn)) {
+            const turn = child.turns[firstOwn];
+            child.turns[firstOwn] = { ...turn, signals: { ...turn.signals, firstSpawnedTurn: true } };
+        }
+        turns.push(...child.turns);
+        Object.assign(calls, child.state.observedCalls);
+        for (const key of ['lines', 'malformedLines', 'duplicateUsageRecords', 'unsupportedUsageRecords'])
+            parent.diagnostics[key] += child.diagnostics[key];
+    }
+    // State remains the parent's cursor state; recursive session reads are for
+    // reporting. Incremental hooks call parseInsightTranscript on one file.
+    parent.turns = deduplicateTurns(turns);
+    parent.updatedTurns = parent.turns;
+    parent.observations = observations(calls);
+    return parent;
+}
+/** Forked transcript copies can repeat provider response ids across files. */
+function deduplicateTurns(turns) {
+    const unique = new Map();
+    for (const turn of turns) {
+        const previous = unique.get(turn.id);
+        if (!previous) {
+            unique.set(turn.id, turn);
+            continue;
+        }
+        // Fork copies preserve response/turn identity but may rewrite timestamps.
+        // Prefer the earlier original observation for ownership and date filtering.
+        const preferred = turn.at !== undefined && (previous.at === undefined || turn.at < previous.at) ? turn : previous;
+        const merged = { ...preferred, uncertainties: [...new Set([...previous.uncertainties, ...turn.uncertainties])] };
+        for (const key of ['inputTokens', 'cacheWriteTokens', 'cacheReadTokens', 'outputTokens'])
+            merged[key] = Math.max(turn[key], previous[key]);
+        merged.contextTokens = merged.inputTokens + merged.cacheWriteTokens + merged.cacheReadTokens;
+        unique.set(turn.id, merged);
+    }
+    return [...unique.values()];
+}