@aiwg/cli 2026.7.24 → 2026.8.0

package/dist/src/sessions/analytics.js

@@ -0,0 +1,303 @@
+import { z } from 'zod';
+import { sha256 } from './contracts.js';
+export const SESSION_ANALYTICS_VERSION = '1.0.0';
+export const SessionAnalyticsCategorySchema = z.enum([
+    'tool-call',
+    'tool-result',
+    'escalation',
+    'hitl',
+    'boundary',
+    'indicator',
+]);
+export const SessionAnalyticsStatusSchema = z.enum([
+    'requested',
+    'running',
+    'succeeded',
+    'failed',
+    'granted',
+    'denied',
+    'timed-out',
+    'unsupported',
+    'provider-unknown',
+    'observed',
+]);
+export const SessionAnalyticsFactSchema = z.object({
+    analyticsVersion: z.literal(SESSION_ANALYTICS_VERSION),
+    factId: z.string().min(1),
+    category: SessionAnalyticsCategorySchema,
+    status: SessionAnalyticsStatusSchema,
+    provider: z.string().min(1),
+    workspaceId: z.string().min(1),
+    sessionId: z.string().min(1),
+    eventId: z.string().min(1),
+    sourceId: z.string().min(1),
+    importRunId: z.string().min(1),
+    occurredAt: z.string().datetime({ offset: true }).nullable(),
+    sequence: z.number().int().nonnegative(),
+    actor: z.string().min(1).nullable(),
+    participant: z.string().min(1).nullable(),
+    toolName: z.string().min(1).nullable(),
+    toolCallId: z.string().min(1).nullable(),
+    retryGroupId: z.string().min(1).nullable(),
+    retryOrdinal: z.number().int().positive().nullable(),
+    errorClass: z.string().min(1).nullable(),
+    capability: z.string().min(1).nullable(),
+    decision: z.string().min(1).nullable(),
+    promptType: z.string().min(1).nullable(),
+    latencyMs: z.number().int().nonnegative().nullable(),
+    transition: z.string().min(1).nullable(),
+    indicator: z.string().min(1).nullable(),
+    sensitivity: z.enum(['none', 'sensitive']),
+    extractionState: z.string().min(1).nullable(),
+    sourceCitation: z.object({
+        provider: z.string().min(1),
+        sessionId: z.string().min(1),
+        eventId: z.string().min(1),
+        importRunId: z.string().min(1),
+        sourceId: z.string().min(1),
+        locatorClass: z.string().min(1),
+        sequence: z.number().int().nonnegative(),
+    }).strict(),
+}).strict();
+/**
+ * Derive content-free analytics facts from normalized session events.
+ *
+ * Historical text is deliberately excluded. Classification uses the canonical
+ * event shape and already-sanitized native extension metadata only; commands,
+ * URLs, and provider payloads are never executed or copied into the index.
+ */
+export function deriveSessionAnalytics(session, events) {
+    const ordered = [...events].sort((left, right) => left.sequence - right.sequence || left.eventId.localeCompare(right.eventId));
+    const facts = [];
+    const retries = new Map();
+    const calls = new Map();
+    for (const event of ordered) {
+        const metadata = flattenMetadata(event.extensions);
+        const normalizedKind = event.kind.toLowerCase();
+        const status = classifyStatus(normalizedKind, metadata);
+        const common = baseFact(session, event);
+        if (isToolCall(event, normalizedKind)) {
+            const retryKey = `${event.toolName ?? 'unknown'}\0${metadata.input_hash ?? metadata.arguments_digest ?? ''}`;
+            const prior = retries.get(retryKey);
+            const sameGroup = prior && event.sequence - prior.lastSequence <= 4;
+            const retry = sameGroup
+                ? { ...prior, count: prior.count + 1, lastSequence: event.sequence }
+                : {
+                    groupId: sha256(['session-tool-retry', session.sessionId, retryKey, event.sequence].join('\0')),
+                    count: 1,
+                    lastSequence: event.sequence,
+                };
+            retries.set(retryKey, retry);
+            if (event.toolCallId) {
+                calls.set(event.toolCallId, { occurredAt: event.occurredAt, sequence: event.sequence });
+            }
+            facts.push({
+                ...common,
+                category: 'tool-call',
+                status: status === 'failed' ? 'failed' : 'requested',
+                retryGroupId: retry.groupId,
+                retryOrdinal: retry.count,
+            });
+        }
+        if (normalizedKind.includes('tool-result')) {
+            const call = event.toolCallId ? calls.get(event.toolCallId) : undefined;
+            facts.push({
+                ...common,
+                category: 'tool-result',
+                status: status === 'failed' ? 'failed' : 'succeeded',
+                latencyMs: elapsedMs(call?.occurredAt, event.occurredAt),
+                errorClass: status === 'failed'
+                    ? (metadata.error_class ?? metadata.error_code ?? 'provider-error')
+                    : null,
+            });
+        }
+        if (isEscalation(normalizedKind, metadata)) {
+            const decision = escalationDecision(status, metadata);
+            facts.push({
+                ...common,
+                category: 'escalation',
+                status: decision,
+                capability: metadata.capability ?? metadata.permission ?? metadata.scope ?? 'provider-unknown',
+                decision,
+            });
+        }
+        if (isHitl(normalizedKind, metadata)) {
+            facts.push({
+                ...common,
+                category: 'hitl',
+                status,
+                promptType: metadata.prompt_type ?? metadata.input_type ?? 'provider-unknown',
+                transition: metadata.transition ?? metadata.task_state ?? metadata.session_state ?? null,
+                latencyMs: integerMetadata(metadata.latency_ms),
+            });
+        }
+        if (event.activityBoundary) {
+            facts.push({
+                ...common,
+                category: 'boundary',
+                status: 'observed',
+                transition: event.activityBoundary,
+            });
+        }
+        const indicators = eventIndicators(event, normalizedKind, status, metadata);
+        for (const indicator of indicators) {
+            facts.push({
+                ...common,
+                category: 'indicator',
+                status: 'observed',
+                indicator,
+                errorClass: status === 'failed'
+                    ? (metadata.error_class ?? metadata.error_code ?? 'provider-error')
+                    : null,
+            });
+        }
+    }
+    for (const retry of retries.values()) {
+        if (retry.count < 3)
+            continue;
+        const anchor = facts.find((fact) => fact.retryGroupId === retry.groupId);
+        if (!anchor)
+            continue;
+        facts.push({
+            ...anchor,
+            category: 'indicator',
+            status: 'observed',
+            indicator: 'tool-quota-pressure',
+            factId: undefined,
+        });
+    }
+    return facts.map((fact) => SessionAnalyticsFactSchema.parse({
+        ...fact,
+        factId: sha256([
+            'session-analytics',
+            SESSION_ANALYTICS_VERSION,
+            fact.category,
+            fact.eventId,
+            fact.indicator ?? '',
+        ].join('\0')),
+    }));
+}
+function baseFact(session, event) {
+    return {
+        analyticsVersion: SESSION_ANALYTICS_VERSION,
+        category: 'indicator',
+        status: 'observed',
+        provider: session.provider,
+        workspaceId: session.workspaceId,
+        sessionId: session.sessionId,
+        eventId: event.eventId,
+        sourceId: event.sourceId,
+        importRunId: event.importRunId,
+        occurredAt: event.occurredAt,
+        sequence: event.sequence,
+        actor: event.role,
+        participant: event.participant,
+        toolName: event.toolName,
+        toolCallId: event.toolCallId,
+        retryGroupId: null,
+        retryOrdinal: null,
+        errorClass: null,
+        capability: null,
+        decision: null,
+        promptType: null,
+        latencyMs: null,
+        transition: null,
+        indicator: null,
+        sensitivity: event.sensitivity.classification,
+        extractionState: event.extractionState,
+        sourceCitation: {
+            provider: session.provider,
+            sessionId: session.sessionId,
+            eventId: event.eventId,
+            importRunId: event.importRunId,
+            sourceId: event.sourceId,
+            locatorClass: event.rawReference.locatorClass,
+            sequence: event.sequence,
+        },
+    };
+}
+function flattenMetadata(value) {
+    const output = {};
+    const visit = (input, depth) => {
+        if (depth > 3 || !input || typeof input !== 'object' || Array.isArray(input))
+            return;
+        for (const [key, child] of Object.entries(input)) {
+            const normalized = key.toLowerCase().replace(/[^a-z0-9]+/g, '_');
+            if (typeof child === 'string' || typeof child === 'number' || typeof child === 'boolean') {
+                if (!(normalized in output))
+                    output[normalized] = String(child).slice(0, 160);
+            }
+            else {
+                visit(child, depth + 1);
+            }
+        }
+    };
+    visit(value, 0);
+    return output;
+}
+function classifyStatus(kind, metadata) {
+    const value = `${kind} ${metadata.status ?? ''} ${metadata.decision ?? ''}`.toLowerCase();
+    if (/(timeout|timed.out)/.test(value))
+        return 'timed-out';
+    if (/(unsupported|unavailable)/.test(value))
+        return 'unsupported';
+    if (/(deny|denied|reject|rejected)/.test(value))
+        return 'denied';
+    if (/(grant|granted|approve|approved|allow|allowed)/.test(value))
+        return 'granted';
+    if (/(fail|failed|error|errored)/.test(value))
+        return 'failed';
+    if (/(success|succeeded|complete|completed)/.test(value))
+        return 'succeeded';
+    if (/(request|requested|input.required|prompt)/.test(value))
+        return 'requested';
+    if (/(running|started|pending)/.test(value))
+        return 'running';
+    return 'provider-unknown';
+}
+function isToolCall(event, kind) {
+    return kind.includes('tool-call') || kind.includes('tool_use')
+        || Boolean(event.toolName && !kind.includes('tool-result'));
+}
+function isEscalation(kind, metadata) {
+    return /(escalat|permission|approval|sandbox|capability.required)/.test(kind)
+        || ['permission', 'capability', 'approval', 'scope'].some((key) => key in metadata);
+}
+function isHitl(kind, metadata) {
+    return /(hitl|human|input.required|input_required|operator.prompt)/.test(kind)
+        || ['prompt_type', 'input_type', 'reviewer'].some((key) => key in metadata);
+}
+function escalationDecision(status, metadata) {
+    if (['granted', 'denied', 'timed-out', 'unsupported'].includes(status))
+        return status;
+    if (metadata.decision)
+        return classifyStatus('', { decision: metadata.decision });
+    return status === 'requested' ? 'requested' : 'provider-unknown';
+}
+function eventIndicators(event, kind, status, metadata) {
+    const indicators = new Set();
+    if (event.opaque || /(unknown|malformed|unsupported)/.test(kind)) {
+        indicators.add('provider-schema-drift');
+    }
+    if (status === 'failed')
+        indicators.add('failed-operation');
+    if (event.sensitivity.classification === 'sensitive')
+        indicators.add('sensitive-field-redaction');
+    if (metadata.redaction_hit === 'true' || metadata.redacted === 'true') {
+        indicators.add('sensitive-field-redaction');
+    }
+    return [...indicators].sort();
+}
+function elapsedMs(start, end) {
+    if (!start || !end)
+        return null;
+    const value = Date.parse(end) - Date.parse(start);
+    return Number.isFinite(value) && value >= 0 ? value : null;
+}
+function integerMetadata(value) {
+    if (!value || !/^\d+$/.test(value))
+        return null;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : null;
+}
+//# sourceMappingURL=analytics.js.map

package/dist/src/sessions/importer.js

@@ -237,7 +237,7 @@ function normalizeBatch(request, records, importRunId, sourceObservedAt) {
                     ? 'sensitive' : 'none',
                 classes: [...new Set([...redacted.classes, ...native.classes])].sort(),
             },
-            opaque: !KNOWN_EVENT_KINDS.has(record.kind),
+            opaque: !isKnownEventKind(record.kind),
             extensions,
         });
         if (!sessions.has(sessionId)) {
@@ -281,6 +281,12 @@ function normalizeBatch(request, records, importRunId, sourceObservedAt) {
     return { sessions: [...sessions.values()], events };
 }
 const KNOWN_EVENT_KINDS = new Set(['message', 'tool-call', 'tool-result', 'artifact', 'attachment', 'summary']);
+function isKnownEventKind(kind) {
+    const normalized = kind.toLowerCase();
+    return KNOWN_EVENT_KINDS.has(normalized)
+        || /^(?:tool-call|tool-result)(?:[._-]|$)/.test(normalized)
+        || /^(?:sandbox|permission|approval|hitl|human|lifecycle)(?:[._-]|$)/.test(normalized);
+}
 function earlierTimestamp(left, right) {
     if (!left)
         return right;

package/dist/src/sessions/index.js

@@ -16,6 +16,7 @@ export * from './batch-import.js';
 export * from './workspace-discovery.js';
 export * from './timeline.js';
 export * from './origin.js';
+export * from './analytics.js';
 export * from './adapters/generic.js';
 export * from './adapters/claude.js';
 export * from './adapters/codex.js';

package/dist/src/sessions/policy.js

@@ -70,7 +70,7 @@ const SECRET_PATTERNS = [
 const SENSITIVE_KEY = /(?:authorization|auth[_-]?header|cookie|credential|password|passwd|secret|token|api[_-]?key|private[_-]?key|connection[_-]?string)/i;
 const CONTENT_KEY = /(?:^|[_-])(?:text|content|prompt|command|arguments?|args|result|output|body|request|response|source|code|query)(?:$|[_-])/i;
 const PATH_KEY = /(?:^|[_-])(?:path|cwd|directory|filename|file)(?:$|[_-])/i;
-const SAFE_STRING_KEY = /(?:^|[_-])(?:id|kind|type|role|status|state|lifecycle|reason|name|product|provider|version|schema|model|format|class|mode|event|operation|tool|method|language|scope|consistency|disposition|phase|visibility|protocol|category|classification)(?:$|[_-])/i;
+const SAFE_STRING_KEY = /(?:^|[_-])(?:id|kind|type|role|status|state|lifecycle|reason|name|product|provider|version|schema|model|format|class|mode|event|operation|tool|method|language|scope|consistency|disposition|phase|visibility|protocol|category|classification|decision|capability|permission|transition|hash|digest)(?:$|[_-])/i;
 const CONTROL_CHARACTERS = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g;
 const DEFAULT_NATIVE_LIMITS = {
     maxDepth: 8,

package/dist/src/sessions/repository.js

@@ -2,6 +2,7 @@ import { createRequire } from 'node:module';
 import { CandidateReviewReceiptSchema, DeletionReceiptSchema, IntelligenceCandidateSchema, PromotionDependencyDecisionSchema, PromotionReceiptSchema, SessionContractError, sha256, } from './contracts.js';
 import { coverageFromBatchRun, } from './batch-contracts.js';
 import { redactSessionText, sanitizeNativeExtensions } from './policy.js';
+import { deriveSessionAnalytics, } from './analytics.js';
 const require = createRequire(import.meta.url);
 const POLICY_PROVIDER_MIGRATION = 'policy-provider-identity:v2';
 const EVENT_ORIGIN_INTENT_MIGRATION = 'event-origin-intent:v1';
@@ -103,10 +104,23 @@ export class SessionRepository {
       CREATE TABLE IF NOT EXISTS session_catalog_meta (
         key TEXT PRIMARY KEY, value TEXT NOT NULL
       );
+      CREATE TABLE IF NOT EXISTS session_analytics_facts (
+        fact_id TEXT PRIMARY KEY, workspace_id TEXT NOT NULL,
+        session_id TEXT NOT NULL, event_id TEXT NOT NULL,
+        category TEXT NOT NULL, status TEXT NOT NULL,
+        provider TEXT NOT NULL, tool_name TEXT, occurred_at TEXT,
+        data TEXT NOT NULL,
+        FOREIGN KEY(session_id) REFERENCES sessions(session_id) ON DELETE CASCADE,
+        FOREIGN KEY(event_id) REFERENCES session_events(event_id) ON DELETE CASCADE
+      );
       CREATE INDEX IF NOT EXISTS idx_session_workspace_provider
         ON sessions(workspace_id, source_id, lifecycle);
       CREATE INDEX IF NOT EXISTS idx_event_session_sequence
         ON session_events(session_id, sequence_no);
+      CREATE INDEX IF NOT EXISTS idx_session_analytics_scope
+        ON session_analytics_facts(
+          workspace_id, category, provider, status, occurred_at, fact_id
+        );
       CREATE VIRTUAL TABLE IF NOT EXISTS session_event_fts USING fts5(
         event_id UNINDEXED, searchable_text, tokenize='unicode61'
       );
@@ -139,6 +153,23 @@ export class SessionRepository {
         this.alignSessionFtsRowids();
         this.migrateSessionPolicyAndProviderIdentity();
         this.migrateEventOriginAndIntent();
+        this.alignSessionAnalytics();
+    }
+    alignSessionAnalytics() {
+        const eventCount = Number(this.db.prepare(`SELECT COUNT(*) AS count
+       FROM session_events e
+       JOIN import_runs r ON r.import_run_id=e.import_run_id
+       JOIN sessions s ON s.session_id=e.session_id
+       WHERE r.status='committed' AND s.lifecycle!='tombstoned'`).get()?.count ?? 0);
+        const factSessions = Number(this.db.prepare('SELECT COUNT(DISTINCT session_id) AS count FROM session_analytics_facts').get()?.count ?? 0);
+        const sourceSessions = Number(this.db.prepare(`SELECT COUNT(DISTINCT e.session_id) AS count
+       FROM session_events e
+       JOIN import_runs r ON r.import_run_id=e.import_run_id
+       JOIN sessions s ON s.session_id=e.session_id
+       WHERE r.status='committed' AND s.lifecycle!='tombstoned'`).get()?.count ?? 0);
+        if (eventCount === 0 || factSessions === sourceSessions)
+            return;
+        this.rebuildAnalytics();
     }
     alignSessionFtsRowids() {
         const eventCount = Number(this.db.prepare('SELECT COUNT(*) AS count FROM session_events').get()?.count ?? 0);
@@ -470,6 +501,11 @@ export class SessionRepository {
             }
             const outcome = publish ? 'committed' : 'staged';
             this.db.prepare(`UPDATE import_runs SET status=?, checkpoint=? WHERE import_run_id=?`).run(outcome, JSON.stringify(checkpoint), batch.run.importRunId);
+            if (publish) {
+                for (const session of batch.sessions) {
+                    this.rebuildAnalytics(session.workspaceId, session.sessionId);
+                }
+            }
             const counts = { sessions: sessionsInserted, events: eventsInserted };
             this.db.prepare(`INSERT INTO import_receipts(operation_id, import_run_id, outcome, counts, checkpoint)
          VALUES (?, ?, ?, ?, ?)`).run(batch.run.importRunId, batch.run.importRunId, outcome, JSON.stringify(counts), JSON.stringify(checkpoint));
@@ -525,6 +561,8 @@ export class SessionRepository {
                 this.db.prepare(`UPDATE mutation_audit SET outcome='committed', occurred_at=?, data=?
            WHERE operation_id=?`).run(updated.observedAt, JSON.stringify(updated), operationId);
             }
+            if (result.changes > 0)
+                this.rebuildAnalytics();
             return result.changes;
         });
         return commit();
@@ -561,6 +599,8 @@ export class SessionRepository {
                 this.db.prepare(`UPDATE mutation_audit SET outcome='committed', occurred_at=?, data=?
            WHERE operation_id=?`).run(updated.observedAt, JSON.stringify(updated), operationId);
             }
+            if (result.changes > 0)
+                this.rebuildAnalytics();
             return result.changes;
         });
         return commit();
@@ -876,6 +916,163 @@ export class SessionRepository {
             snapshotRowid,
         };
     }
+    rebuildAnalytics(workspaceId, sessionId) {
+        const where = [
+            `r.status='committed'`,
+            `s.lifecycle!='tombstoned'`,
+        ];
+        const params = [];
+        if (workspaceId) {
+            where.push('s.workspace_id=?');
+            params.push(workspaceId);
+        }
+        if (sessionId) {
+            where.push('s.session_id=?');
+            params.push(sessionId);
+        }
+        const sessions = this.db.prepare(`SELECT s.session_id, s.data
+       FROM sessions s
+       WHERE s.lifecycle!='tombstoned'
+       ${workspaceId ? 'AND s.workspace_id=?' : ''}
+       ${sessionId ? 'AND s.session_id=?' : ''}
+       AND EXISTS (
+         SELECT 1 FROM session_events e
+         JOIN import_runs r ON r.import_run_id=e.import_run_id
+         WHERE e.session_id=s.session_id AND r.status='committed'
+       )
+       ORDER BY s.session_id`).all(...[
+            ...(workspaceId ? [workspaceId] : []),
+            ...(sessionId ? [sessionId] : []),
+        ]);
+        if (!workspaceId && !sessionId) {
+            this.db.exec('DELETE FROM session_analytics_facts');
+        }
+        else if (sessionId) {
+            this.db.prepare('DELETE FROM session_analytics_facts WHERE session_id=?').run(sessionId);
+        }
+        else {
+            this.db.prepare('DELETE FROM session_analytics_facts WHERE workspace_id=?').run(workspaceId);
+        }
+        const eventQuery = this.db.prepare(`SELECT e.data
+       FROM session_events e
+       JOIN import_runs r ON r.import_run_id=e.import_run_id
+       JOIN sessions s ON s.session_id=e.session_id
+       WHERE e.session_id=? AND ${where.join(' AND ')}
+       ORDER BY e.sequence_no, e.event_id`);
+        const insert = this.db.prepare(`INSERT OR REPLACE INTO session_analytics_facts(
+         fact_id, workspace_id, session_id, event_id, category, status,
+         provider, tool_name, occurred_at, data
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+        let inserted = 0;
+        for (const row of sessions) {
+            const session = JSON.parse(String(row.data));
+            const events = eventQuery.all(session.sessionId, ...params)
+                .map((eventRow) => JSON.parse(String(eventRow.data)));
+            for (const fact of deriveSessionAnalytics(session, events)) {
+                inserted += insert.run(fact.factId, fact.workspaceId, fact.sessionId, fact.eventId, fact.category, fact.status, fact.provider, fact.toolName, fact.occurredAt, JSON.stringify(fact)).changes;
+            }
+        }
+        return inserted;
+    }
+    listAnalyticsFacts(options) {
+        const where = [
+            'f.workspace_id=?',
+            `s.lifecycle!='tombstoned'`,
+            `r.status='committed'`,
+        ];
+        const params = [options.workspaceId];
+        if (options.categories?.length) {
+            where.push(`f.category IN (${options.categories.map(() => '?').join(', ')})`);
+            params.push(...options.categories);
+        }
+        const scalar = [
+            ['f.provider', options.provider],
+            ['f.session_id', options.sessionId],
+            ['f.tool_name', options.tool],
+            ['f.status', options.status],
+            [`json_extract(f.data, '$.actor')`, options.actor],
+            [`json_extract(f.data, '$.sensitivity')`, options.sensitivity],
+            [`json_extract(f.data, '$.extractionState')`, options.extractionState],
+        ];
+        for (const [column, value] of scalar) {
+            if (value === undefined)
+                continue;
+            where.push(`${column}=?`);
+            params.push(value);
+        }
+        if (options.dateFrom) {
+            where.push('f.occurred_at>=?');
+            params.push(options.dateFrom);
+        }
+        if (options.dateTo) {
+            where.push('f.occurred_at<=?');
+            params.push(options.dateTo);
+        }
+        if (options.tag) {
+            where.push(`EXISTS (
+        SELECT 1 FROM session_tags t
+        WHERE t.session_id=f.session_id AND t.tag=?
+      )`);
+            params.push(options.tag);
+        }
+        const limit = options.limit ?? 500;
+        if (limit < 1 || limit > 5_000) {
+            throw new SessionContractError('RESOURCE_LIMIT_EXCEEDED', 'analytics limit must be between 1 and 5000');
+        }
+        return this.db.prepare(`SELECT f.data
+       FROM session_analytics_facts f
+       JOIN sessions s ON s.session_id=f.session_id
+       JOIN session_events e ON e.event_id=f.event_id
+       JOIN import_runs r ON r.import_run_id=e.import_run_id
+       WHERE ${where.join(' AND ')}
+       ORDER BY
+         CASE WHEN f.occurred_at IS NULL THEN 1 ELSE 0 END,
+         f.occurred_at, f.session_id,
+         json_extract(f.data, '$.sequence'), f.fact_id
+       LIMIT ?`).all(...params, limit)
+            .map((row) => JSON.parse(String(row.data)));
+    }
+    analyticsSummary(options) {
+        const facts = this.listAnalyticsFacts({ ...options, limit: options.limit ?? 5_000 });
+        const byCategory = countBy(facts, (fact) => fact.category);
+        const byStatus = countBy(facts, (fact) => fact.status);
+        const byProvider = countBy(facts, (fact) => fact.provider);
+        const byTool = countBy(facts.filter((fact) => fact.toolName), (fact) => fact.toolName);
+        return {
+            analyticsVersion: '1.0.0',
+            workspaceId: options.workspaceId,
+            totals: {
+                facts: facts.length,
+                sessions: new Set(facts.map((fact) => fact.sessionId)).size,
+                toolCalls: facts.filter((fact) => fact.category === 'tool-call').length,
+                toolFailures: facts.filter((fact) => fact.category === 'tool-result' && fact.status === 'failed').length,
+                escalations: facts.filter((fact) => fact.category === 'escalation').length,
+                hitlDecisions: facts.filter((fact) => fact.category === 'hitl').length,
+                indicators: facts.filter((fact) => fact.category === 'indicator').length,
+                retryGroups: new Set(facts.map((fact) => fact.retryGroupId).filter(Boolean)).size,
+            },
+            byCategory,
+            byStatus,
+            byProvider,
+            byTool,
+        };
+    }
+    getAnalyticsEvidence(id, workspaceId) {
+        const row = this.db.prepare(`SELECT f.data AS fact_data, e.data AS event_data
+       FROM session_analytics_facts f
+       JOIN sessions s ON s.session_id=f.session_id
+       JOIN session_events e ON e.event_id=f.event_id
+       JOIN import_runs r ON r.import_run_id=e.import_run_id
+       WHERE (f.fact_id=? OR f.event_id=?)
+       AND f.workspace_id=? AND s.lifecycle!='tombstoned' AND r.status='committed'
+       ORDER BY f.fact_id LIMIT 1`).get(id, id, workspaceId);
+        return row
+            ? {
+                fact: JSON.parse(String(row.fact_data)),
+                event: JSON.parse(String(row.event_data)),
+            }
+            : { fact: null, event: null };
+    }
     saveCandidates(candidates) {
         const save = this.db.transaction(() => {
             let inserted = 0;
@@ -1161,6 +1358,9 @@ export class SessionRepository {
                     counts: { sessions: 1 },
                 });
             }
+            if (changed) {
+                this.db.prepare('DELETE FROM session_analytics_facts WHERE session_id=?').run(sessionId);
+            }
             return changed;
         });
         return tombstone();
@@ -1187,6 +1387,8 @@ export class SessionRepository {
                     counts: { sessions: 1 },
                 });
             }
+            if (changed)
+                this.rebuildAnalytics(workspaceId, sessionId);
             return changed;
         });
         return restore();
@@ -1385,6 +1587,7 @@ export class SessionRepository {
                     dependencyDispositions: validatedDecisions.length,
                 },
             });
+            this.db.prepare('DELETE FROM session_analytics_facts WHERE session_id=?').run(input.preview.sessionId);
             return receipt;
         });
         return apply();
@@ -1400,6 +1603,7 @@ export class SessionRepository {
           SELECT rowid, event_id, json_extract(data, '$.searchableText') FROM session_events
         `);
                 indexed = Number(this.db.prepare('SELECT COUNT(*) AS count FROM session_events').get()?.count ?? 0);
+                this.rebuildAnalytics();
             }
             else {
                 this.db.prepare(`DELETE FROM session_event_fts WHERE rowid IN (
@@ -1412,6 +1616,7 @@ export class SessionRepository {
            FROM session_events e
            JOIN sessions s ON s.session_id=e.session_id
            WHERE s.workspace_id=?`).run(workspaceId).changes;
+                this.rebuildAnalytics(workspaceId);
             }
             this.emitRepositoryMutation({
                 operationId: sha256([
@@ -1506,6 +1711,14 @@ function canonicalDevinLocator(value) {
         ? `devin-desktop-${value.slice('windsurf-'.length)}`
         : value;
 }
+function countBy(items, key) {
+    const counts = {};
+    for (const item of items) {
+        const value = key(item);
+        counts[value] = (counts[value] ?? 0) + 1;
+    }
+    return Object.fromEntries(Object.entries(counts).sort(([left], [right]) => left.localeCompare(right)));
+}
 function encodeMutationCursor(rowid, workspaceId) {
     const unsigned = { rowid, workspaceId };
     return Buffer.from(JSON.stringify({