@aiwg/cli 2026.7.25 → 2026.8.1

package/dist/src/sessions/analytics.js

@@ -0,0 +1,303 @@
+import { z } from 'zod';
+import { sha256 } from './contracts.js';
+export const SESSION_ANALYTICS_VERSION = '1.0.0';
+export const SessionAnalyticsCategorySchema = z.enum([
+    'tool-call',
+    'tool-result',
+    'escalation',
+    'hitl',
+    'boundary',
+    'indicator',
+]);
+export const SessionAnalyticsStatusSchema = z.enum([
+    'requested',
+    'running',
+    'succeeded',
+    'failed',
+    'granted',
+    'denied',
+    'timed-out',
+    'unsupported',
+    'provider-unknown',
+    'observed',
+]);
+export const SessionAnalyticsFactSchema = z.object({
+    analyticsVersion: z.literal(SESSION_ANALYTICS_VERSION),
+    factId: z.string().min(1),
+    category: SessionAnalyticsCategorySchema,
+    status: SessionAnalyticsStatusSchema,
+    provider: z.string().min(1),
+    workspaceId: z.string().min(1),
+    sessionId: z.string().min(1),
+    eventId: z.string().min(1),
+    sourceId: z.string().min(1),
+    importRunId: z.string().min(1),
+    occurredAt: z.string().datetime({ offset: true }).nullable(),
+    sequence: z.number().int().nonnegative(),
+    actor: z.string().min(1).nullable(),
+    participant: z.string().min(1).nullable(),
+    toolName: z.string().min(1).nullable(),
+    toolCallId: z.string().min(1).nullable(),
+    retryGroupId: z.string().min(1).nullable(),
+    retryOrdinal: z.number().int().positive().nullable(),
+    errorClass: z.string().min(1).nullable(),
+    capability: z.string().min(1).nullable(),
+    decision: z.string().min(1).nullable(),
+    promptType: z.string().min(1).nullable(),
+    latencyMs: z.number().int().nonnegative().nullable(),
+    transition: z.string().min(1).nullable(),
+    indicator: z.string().min(1).nullable(),
+    sensitivity: z.enum(['none', 'sensitive']),
+    extractionState: z.string().min(1).nullable(),
+    sourceCitation: z.object({
+        provider: z.string().min(1),
+        sessionId: z.string().min(1),
+        eventId: z.string().min(1),
+        importRunId: z.string().min(1),
+        sourceId: z.string().min(1),
+        locatorClass: z.string().min(1),
+        sequence: z.number().int().nonnegative(),
+    }).strict(),
+}).strict();
+/**
+ * Derive content-free analytics facts from normalized session events.
+ *
+ * Historical text is deliberately excluded. Classification uses the canonical
+ * event shape and already-sanitized native extension metadata only; commands,
+ * URLs, and provider payloads are never executed or copied into the index.
+ */
+export function deriveSessionAnalytics(session, events) {
+    const ordered = [...events].sort((left, right) => left.sequence - right.sequence || left.eventId.localeCompare(right.eventId));
+    const facts = [];
+    const retries = new Map();
+    const calls = new Map();
+    for (const event of ordered) {
+        const metadata = flattenMetadata(event.extensions);
+        const normalizedKind = event.kind.toLowerCase();
+        const status = classifyStatus(normalizedKind, metadata);
+        const common = baseFact(session, event);
+        if (isToolCall(event, normalizedKind)) {
+            const retryKey = `${event.toolName ?? 'unknown'}\0${metadata.input_hash ?? metadata.arguments_digest ?? ''}`;
+            const prior = retries.get(retryKey);
+            const sameGroup = prior && event.sequence - prior.lastSequence <= 4;
+            const retry = sameGroup
+                ? { ...prior, count: prior.count + 1, lastSequence: event.sequence }
+                : {
+                    groupId: sha256(['session-tool-retry', session.sessionId, retryKey, event.sequence].join('\0')),
+                    count: 1,
+                    lastSequence: event.sequence,
+                };
+            retries.set(retryKey, retry);
+            if (event.toolCallId) {
+                calls.set(event.toolCallId, { occurredAt: event.occurredAt, sequence: event.sequence });
+            }
+            facts.push({
+                ...common,
+                category: 'tool-call',
+                status: status === 'failed' ? 'failed' : 'requested',
+                retryGroupId: retry.groupId,
+                retryOrdinal: retry.count,
+            });
+        }
+        if (normalizedKind.includes('tool-result')) {
+            const call = event.toolCallId ? calls.get(event.toolCallId) : undefined;
+            facts.push({
+                ...common,
+                category: 'tool-result',
+                status: status === 'failed' ? 'failed' : 'succeeded',
+                latencyMs: elapsedMs(call?.occurredAt, event.occurredAt),
+                errorClass: status === 'failed'
+                    ? (metadata.error_class ?? metadata.error_code ?? 'provider-error')
+                    : null,
+            });
+        }
+        if (isEscalation(normalizedKind, metadata)) {
+            const decision = escalationDecision(status, metadata);
+            facts.push({
+                ...common,
+                category: 'escalation',
+                status: decision,
+                capability: metadata.capability ?? metadata.permission ?? metadata.scope ?? 'provider-unknown',
+                decision,
+            });
+        }
+        if (isHitl(normalizedKind, metadata)) {
+            facts.push({
+                ...common,
+                category: 'hitl',
+                status,
+                promptType: metadata.prompt_type ?? metadata.input_type ?? 'provider-unknown',
+                transition: metadata.transition ?? metadata.task_state ?? metadata.session_state ?? null,
+                latencyMs: integerMetadata(metadata.latency_ms),
+            });
+        }
+        if (event.activityBoundary) {
+            facts.push({
+                ...common,
+                category: 'boundary',
+                status: 'observed',
+                transition: event.activityBoundary,
+            });
+        }
+        const indicators = eventIndicators(event, normalizedKind, status, metadata);
+        for (const indicator of indicators) {
+            facts.push({
+                ...common,
+                category: 'indicator',
+                status: 'observed',
+                indicator,
+                errorClass: status === 'failed'
+                    ? (metadata.error_class ?? metadata.error_code ?? 'provider-error')
+                    : null,
+            });
+        }
+    }
+    for (const retry of retries.values()) {
+        if (retry.count < 3)
+            continue;
+        const anchor = facts.find((fact) => fact.retryGroupId === retry.groupId);
+        if (!anchor)
+            continue;
+        facts.push({
+            ...anchor,
+            category: 'indicator',
+            status: 'observed',
+            indicator: 'tool-quota-pressure',
+            factId: undefined,
+        });
+    }
+    return facts.map((fact) => SessionAnalyticsFactSchema.parse({
+        ...fact,
+        factId: sha256([
+            'session-analytics',
+            SESSION_ANALYTICS_VERSION,
+            fact.category,
+            fact.eventId,
+            fact.indicator ?? '',
+        ].join('\0')),
+    }));
+}
+function baseFact(session, event) {
+    return {
+        analyticsVersion: SESSION_ANALYTICS_VERSION,
+        category: 'indicator',
+        status: 'observed',
+        provider: session.provider,
+        workspaceId: session.workspaceId,
+        sessionId: session.sessionId,
+        eventId: event.eventId,
+        sourceId: event.sourceId,
+        importRunId: event.importRunId,
+        occurredAt: event.occurredAt,
+        sequence: event.sequence,
+        actor: event.role,
+        participant: event.participant,
+        toolName: event.toolName,
+        toolCallId: event.toolCallId,
+        retryGroupId: null,
+        retryOrdinal: null,
+        errorClass: null,
+        capability: null,
+        decision: null,
+        promptType: null,
+        latencyMs: null,
+        transition: null,
+        indicator: null,
+        sensitivity: event.sensitivity.classification,
+        extractionState: event.extractionState,
+        sourceCitation: {
+            provider: session.provider,
+            sessionId: session.sessionId,
+            eventId: event.eventId,
+            importRunId: event.importRunId,
+            sourceId: event.sourceId,
+            locatorClass: event.rawReference.locatorClass,
+            sequence: event.sequence,
+        },
+    };
+}
+function flattenMetadata(value) {
+    const output = {};
+    const visit = (input, depth) => {
+        if (depth > 3 || !input || typeof input !== 'object' || Array.isArray(input))
+            return;
+        for (const [key, child] of Object.entries(input)) {
+            const normalized = key.toLowerCase().replace(/[^a-z0-9]+/g, '_');
+            if (typeof child === 'string' || typeof child === 'number' || typeof child === 'boolean') {
+                if (!(normalized in output))
+                    output[normalized] = String(child).slice(0, 160);
+            }
+            else {
+                visit(child, depth + 1);
+            }
+        }
+    };
+    visit(value, 0);
+    return output;
+}
+function classifyStatus(kind, metadata) {
+    const value = `${kind} ${metadata.status ?? ''} ${metadata.decision ?? ''}`.toLowerCase();
+    if (/(timeout|timed.out)/.test(value))
+        return 'timed-out';
+    if (/(unsupported|unavailable)/.test(value))
+        return 'unsupported';
+    if (/(deny|denied|reject|rejected)/.test(value))
+        return 'denied';
+    if (/(grant|granted|approve|approved|allow|allowed)/.test(value))
+        return 'granted';
+    if (/(fail|failed|error|errored)/.test(value))
+        return 'failed';
+    if (/(success|succeeded|complete|completed)/.test(value))
+        return 'succeeded';
+    if (/(request|requested|input.required|prompt)/.test(value))
+        return 'requested';
+    if (/(running|started|pending)/.test(value))
+        return 'running';
+    return 'provider-unknown';
+}
+function isToolCall(event, kind) {
+    return kind.includes('tool-call') || kind.includes('tool_use')
+        || Boolean(event.toolName && !kind.includes('tool-result'));
+}
+function isEscalation(kind, metadata) {
+    return /(escalat|permission|approval|sandbox|capability.required)/.test(kind)
+        || ['permission', 'capability', 'approval', 'scope'].some((key) => key in metadata);
+}
+function isHitl(kind, metadata) {
+    return /(hitl|human|input.required|input_required|operator.prompt)/.test(kind)
+        || ['prompt_type', 'input_type', 'reviewer'].some((key) => key in metadata);
+}
+function escalationDecision(status, metadata) {
+    if (['granted', 'denied', 'timed-out', 'unsupported'].includes(status))
+        return status;
+    if (metadata.decision)
+        return classifyStatus('', { decision: metadata.decision });
+    return status === 'requested' ? 'requested' : 'provider-unknown';
+}
+function eventIndicators(event, kind, status, metadata) {
+    const indicators = new Set();
+    if (event.opaque || /(unknown|malformed|unsupported)/.test(kind)) {
+        indicators.add('provider-schema-drift');
+    }
+    if (status === 'failed')
+        indicators.add('failed-operation');
+    if (event.sensitivity.classification === 'sensitive')
+        indicators.add('sensitive-field-redaction');
+    if (metadata.redaction_hit === 'true' || metadata.redacted === 'true') {
+        indicators.add('sensitive-field-redaction');
+    }
+    return [...indicators].sort();
+}
+function elapsedMs(start, end) {
+    if (!start || !end)
+        return null;
+    const value = Date.parse(end) - Date.parse(start);
+    return Number.isFinite(value) && value >= 0 ? value : null;
+}
+function integerMetadata(value) {
+    if (!value || !/^\d+$/.test(value))
+        return null;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : null;
+}
+//# sourceMappingURL=analytics.js.map

package/dist/src/sessions/importer.js

@@ -237,7 +237,7 @@ function normalizeBatch(request, records, importRunId, sourceObservedAt) {
                     ? 'sensitive' : 'none',
                 classes: [...new Set([...redacted.classes, ...native.classes])].sort(),
             },
-            opaque: !KNOWN_EVENT_KINDS.has(record.kind),
+            opaque: !isKnownEventKind(record.kind),
             extensions,
         });
         if (!sessions.has(sessionId)) {
@@ -281,6 +281,12 @@ function normalizeBatch(request, records, importRunId, sourceObservedAt) {
     return { sessions: [...sessions.values()], events };
 }
 const KNOWN_EVENT_KINDS = new Set(['message', 'tool-call', 'tool-result', 'artifact', 'attachment', 'summary']);
+function isKnownEventKind(kind) {
+    const normalized = kind.toLowerCase();
+    return KNOWN_EVENT_KINDS.has(normalized)
+        || /^(?:tool-call|tool-result)(?:[._-]|$)/.test(normalized)
+        || /^(?:sandbox|permission|approval|hitl|human|lifecycle)(?:[._-]|$)/.test(normalized);
+}
 function earlierTimestamp(left, right) {
     if (!left)
         return right;

package/dist/src/sessions/index.js

@@ -9,6 +9,7 @@ export * from './optional-backends.js';
 export * from './knowledge-shard.js';
 export * from './candidates.js';
 export * from './promotion.js';
+export * from './output-registration.js';
 export * from './importer.js';
 export * from './import-lease.js';
 export * from './batch-contracts.js';
@@ -16,6 +17,7 @@ export * from './batch-import.js';
 export * from './workspace-discovery.js';
 export * from './timeline.js';
 export * from './origin.js';
+export * from './analytics.js';
 export * from './adapters/generic.js';
 export * from './adapters/claude.js';
 export * from './adapters/codex.js';

package/dist/src/sessions/output-registration.js

@@ -0,0 +1,338 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { dirname, relative, resolve, sep } from 'node:path';
+import { z } from 'zod';
+import { SessionContractError, sha256 } from './contracts.js';
+const DigestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const ReferenceSchema = z.string().min(1).max(512).refine(value => !/[\r\n\0]/.test(value), 'references must be single-line inert locators');
+export const OutputSourceReferenceSchema = z.object({
+    kind: z.enum(['file', 'url', 'note', 'session', 'artifact', 'context-pack']),
+    ref: ReferenceSchema,
+    digest: DigestSchema.nullable().default(null),
+    span: z.object({
+        start: z.number().int().nonnegative(),
+        end: z.number().int().positive(),
+        quoteDigest: DigestSchema,
+    }).strict().nullable().default(null),
+}).strict().superRefine((value, context) => {
+    if (value.span && value.span.end <= value.span.start) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'source span end must exceed start' });
+    }
+});
+export const OutputRegistrationRequestSchema = z.object({
+    outputPath: z.string().min(1),
+    mediaType: z.string().min(1).max(128),
+    contextPack: z.object({
+        id: ReferenceSchema,
+        digest: DigestSchema,
+        sources: z.array(OutputSourceReferenceSchema).min(1).max(256),
+    }).strict(),
+    supersedes: z.array(ReferenceSchema).max(128).default([]),
+    conflictsWith: z.array(ReferenceSchema).max(128).default([]),
+}).strict();
+/**
+ * Minimal incremental index sink. Each registration is independently atomic,
+ * discoverable, and replay-safe; corpus-wide index builders can consume these
+ * bounded records without rescanning output bodies.
+ */
+export class FilesystemDerivedOutputIndex {
+    root;
+    constructor(projectRoot) {
+        this.root = resolve(projectRoot, '.aiwg/memory/output-registration/index');
+        assertStorageRootInsideProject(projectRoot, this.root);
+    }
+    register(registration) {
+        if (!/^sha256:[0-9a-f]{64}$/.test(registration.registrationId)) {
+            throw new Error('invalid output registration identity');
+        }
+        const filePath = resolve(this.root, `${registration.registrationId.replace(':', '_')}.json`);
+        const existing = readJsonIfPresent(filePath);
+        if (existing) {
+            if (JSON.stringify(existing) !== JSON.stringify(registration)) {
+                throw new SessionContractError('IMPORT_CONFLICT', 'derived output index identity already has different content');
+            }
+            return;
+        }
+        writeJsonAtomic(filePath, registration);
+    }
+    registrations() {
+        if (!existsSync(this.root))
+            return [];
+        return readdirSync(this.root)
+            .filter(name => /^sha256_[0-9a-f]{64}\.json$/.test(name))
+            .sort()
+            .map(name => JSON.parse(readFileSync(resolve(this.root, name), 'utf8')));
+    }
+}
+function canonicalReference(value) {
+    try {
+        const parsed = new URL(value);
+        if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
+            parsed.username = '';
+            parsed.password = '';
+            parsed.search = '';
+            parsed.hash = '';
+            return parsed.toString();
+        }
+    }
+    catch {
+        // Non-URL references are opaque inert identifiers.
+    }
+    return value;
+}
+function assertStorageRootInsideProject(projectRoot, storageRoot) {
+    const root = realpathSync(projectRoot);
+    const candidate = resolve(projectRoot, storageRoot);
+    if (candidate !== resolve(projectRoot) && !candidate.startsWith(`${resolve(projectRoot)}${sep}`)) {
+        throw new SessionContractError('SOURCE_OUTSIDE_ALLOWED_ROOT', 'memory storage must be inside the project');
+    }
+    let ancestor = candidate;
+    while (!existsSync(ancestor)) {
+        const parent = dirname(ancestor);
+        if (parent === ancestor)
+            break;
+        ancestor = parent;
+    }
+    const actualAncestor = realpathSync(ancestor);
+    if (actualAncestor !== root && !actualAncestor.startsWith(`${root}${sep}`)) {
+        throw new SessionContractError('SOURCE_OUTSIDE_ALLOWED_ROOT', 'memory storage cannot traverse a link outside the project');
+    }
+}
+function assertNoSecretMaterial(value, field) {
+    const secretAssignment = /(?:^|[?&;:\s])(?:api[_-]?key|access[_-]?token|token|secret|password|passwd|authorization)\s*[:=]\s*[^\s&;]+/i;
+    const privateKey = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/;
+    const providerToken = /(?:^|[^a-z0-9])(?:ghp|github_pat|sk|xox[baprs])_[a-z0-9_-]{16,}/i;
+    if (secretAssignment.test(value) || privateKey.test(value) || providerToken.test(value)) {
+        throw new SessionContractError('SOURCE_NOT_AUTHORIZED', `${field} appears to contain secret material; store only a non-secret locator`);
+    }
+}
+function canonicalRequest(request) {
+    const canonical = {
+        ...request,
+        contextPack: {
+            ...request.contextPack,
+            id: canonicalReference(request.contextPack.id),
+            sources: request.contextPack.sources.map(source => ({
+                ...source,
+                ref: canonicalReference(source.ref),
+            })),
+        },
+        supersedes: [...new Set(request.supersedes.map(canonicalReference))].sort(),
+        conflictsWith: [...new Set(request.conflictsWith.map(canonicalReference))].sort(),
+    };
+    assertNoSecretMaterial(canonical.contextPack.id, 'context-pack identity');
+    for (const source of canonical.contextPack.sources) {
+        assertNoSecretMaterial(source.ref, 'source reference');
+    }
+    for (const value of [...canonical.supersedes, ...canonical.conflictsWith]) {
+        assertNoSecretMaterial(value, 'lifecycle reference');
+    }
+    return canonical;
+}
+function resolveImmutableOutput(projectRoot, requestedPath) {
+    if (requestedPath.includes('\0')) {
+        throw new SessionContractError('MALFORMED_SOURCE', 'output path contains a null byte');
+    }
+    const pathSegments = requestedPath.toLocaleLowerCase().split(/[\\/]+/);
+    if (pathSegments.some(segment => segment === '.env'
+        || segment === '.ssh'
+        || /^(?:credentials?|secrets?|tokens?)(?:\.|$)/.test(segment))) {
+        throw new SessionContractError('SOURCE_NOT_AUTHORIZED', 'sensitive credential/secret paths cannot be registered as ordinary outputs');
+    }
+    const root = realpathSync(projectRoot);
+    const candidate = realpathSync(resolve(root, requestedPath));
+    if (candidate !== root && !candidate.startsWith(`${root}${sep}`)) {
+        throw new SessionContractError('SOURCE_OUTSIDE_ALLOWED_ROOT', 'registered output must resolve inside the project');
+    }
+    return { absolute: candidate, locator: relative(root, candidate).split(sep).join('/') };
+}
+function registrationFor(projectRoot, raw) {
+    const request = canonicalRequest(OutputRegistrationRequestSchema.parse(raw));
+    const output = resolveImmutableOutput(projectRoot, request.outputPath);
+    const content = readFileSync(output.absolute);
+    const digest = `sha256:${createHash('sha256').update(content).digest('hex')}`;
+    const identity = {
+        output: { locator: output.locator, mediaType: request.mediaType, digest, byteLength: content.length },
+        contextPack: request.contextPack,
+        supersedes: request.supersedes,
+        conflictsWith: request.conflictsWith,
+    };
+    return {
+        schemaVersion: 'aiwg.output-registration.v1',
+        registrationId: sha256(JSON.stringify(identity)),
+        ...identity,
+    };
+}
+export class FilesystemOutputRegistrationStore {
+    root;
+    outboxRoot;
+    receiptRoot;
+    constructor(projectRoot) {
+        this.root = resolve(projectRoot, '.aiwg/memory/output-registration');
+        assertStorageRootInsideProject(projectRoot, this.root);
+        this.outboxRoot = resolve(this.root, 'outbox');
+        this.receiptRoot = resolve(this.root, 'receipts');
+    }
+    getReceipt(registrationId) {
+        return readJsonIfPresent(this.receiptPath(registrationId));
+    }
+    begin(operationId, registration) {
+        const existing = readJsonIfPresent(this.outboxPath(registration.registrationId));
+        if (existing)
+            return existing;
+        const record = {
+            schemaVersion: 'aiwg.output-registration-outbox.v1',
+            operationId,
+            registration,
+            state: 'pending',
+            attempts: 0,
+            lastError: null,
+            updatedAt: new Date().toISOString(),
+        };
+        writeJsonAtomic(this.outboxPath(registration.registrationId), record);
+        return record;
+    }
+    fail(registrationId, message) {
+        const path = this.outboxPath(registrationId);
+        const record = readJsonIfPresent(path);
+        if (!record)
+            throw new Error(`missing output-registration outbox record: ${registrationId}`);
+        const failed = {
+            ...record,
+            attempts: record.attempts + 1,
+            lastError: message.slice(0, 512),
+            updatedAt: new Date().toISOString(),
+        };
+        writeJsonAtomic(path, failed);
+        return failed;
+    }
+    complete(operationId, registration) {
+        const existing = this.getReceipt(registration.registrationId);
+        if (existing) {
+            unlinkIfPresent(this.outboxPath(registration.registrationId));
+            return { ...existing, duplicate: true };
+        }
+        const receipt = {
+            schemaVersion: 'aiwg.output-registration-receipt.v1',
+            receiptId: sha256(`${operationId}\0${registration.registrationId}`),
+            registrationId: registration.registrationId,
+            operationId,
+            outputLocator: registration.output.locator,
+            outputDigest: registration.output.digest,
+            contextPackId: registration.contextPack.id,
+            contextPackDigest: registration.contextPack.digest,
+            sourceRefs: registration.contextPack.sources.map(source => source.ref),
+            registeredAt: new Date().toISOString(),
+            duplicate: false,
+        };
+        writeJsonAtomic(this.receiptPath(registration.registrationId), receipt);
+        unlinkIfPresent(this.outboxPath(registration.registrationId));
+        return receipt;
+    }
+    pending() {
+        if (!existsSync(this.outboxRoot))
+            return [];
+        return readdirSync(this.outboxRoot)
+            .filter(name => /^sha256_[0-9a-f]{64}\.json$/.test(name))
+            .sort()
+            .map(name => JSON.parse(readFileSync(resolve(this.outboxRoot, name), 'utf8')));
+    }
+    safeName(registrationId) {
+        if (!/^sha256:[0-9a-f]{64}$/.test(registrationId)) {
+            throw new Error('invalid output registration identity');
+        }
+        return `${registrationId.replace(':', '_')}.json`;
+    }
+    outboxPath(registrationId) {
+        return resolve(this.outboxRoot, this.safeName(registrationId));
+    }
+    receiptPath(registrationId) {
+        return resolve(this.receiptRoot, this.safeName(registrationId));
+    }
+}
+export class OutputRegistrationCoordinator {
+    store;
+    index;
+    projectRoot;
+    constructor(projectRoot, store, index) {
+        this.store = store;
+        this.index = index;
+        this.projectRoot = resolve(projectRoot);
+    }
+    preview(request) {
+        const registration = registrationFor(this.projectRoot, request);
+        const operationId = sha256(JSON.stringify({
+            registrationId: registration.registrationId,
+            outputDigest: registration.output.digest,
+            contextPackDigest: registration.contextPack.digest,
+        }));
+        return {
+            ...registration,
+            operationId,
+            duplicate: Boolean(this.store.getReceipt(registration.registrationId)),
+            confirmationRequired: true,
+        };
+    }
+    async register(input) {
+        const preview = this.preview(input.request);
+        if (preview.operationId !== input.operationId) {
+            throw new SessionContractError('OPERATION_NOT_AUTHORIZED', 'output registration requires confirmation of the exact current preview');
+        }
+        const existing = this.store.getReceipt(preview.registrationId);
+        if (existing)
+            return { ...existing, duplicate: true };
+        const registration = registrationFor(this.projectRoot, input.request);
+        if (registration.registrationId !== preview.registrationId
+            || registration.output.digest !== preview.output.digest) {
+            throw new SessionContractError('IMPORT_CONFLICT', 'output changed after registration preview');
+        }
+        this.store.begin(input.operationId, registration);
+        try {
+            await this.index.register(registration);
+        }
+        catch (error) {
+            this.store.fail(registration.registrationId, error instanceof Error ? error.message : String(error));
+            throw error;
+        }
+        return this.store.complete(input.operationId, registration);
+    }
+    async replayPending() {
+        const receipts = [];
+        for (const record of this.store.pending()) {
+            try {
+                await this.index.register(record.registration);
+                receipts.push(this.store.complete(record.operationId, record.registration));
+            }
+            catch (error) {
+                this.store.fail(record.registration.registrationId, error instanceof Error ? error.message : String(error));
+            }
+        }
+        return receipts;
+    }
+}
+function readJsonIfPresent(filePath) {
+    try {
+        return JSON.parse(readFileSync(filePath, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+function writeJsonAtomic(filePath, value) {
+    mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+    const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temporary, filePath);
+}
+function unlinkIfPresent(filePath) {
+    try {
+        unlinkSync(filePath);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+}
+//# sourceMappingURL=output-registration.js.map

package/dist/src/sessions/policy.js

@@ -70,7 +70,7 @@ const SECRET_PATTERNS = [
 const SENSITIVE_KEY = /(?:authorization|auth[_-]?header|cookie|credential|password|passwd|secret|token|api[_-]?key|private[_-]?key|connection[_-]?string)/i;
 const CONTENT_KEY = /(?:^|[_-])(?:text|content|prompt|command|arguments?|args|result|output|body|request|response|source|code|query)(?:$|[_-])/i;
 const PATH_KEY = /(?:^|[_-])(?:path|cwd|directory|filename|file)(?:$|[_-])/i;
-const SAFE_STRING_KEY = /(?:^|[_-])(?:id|kind|type|role|status|state|lifecycle|reason|name|product|provider|version|schema|model|format|class|mode|event|operation|tool|method|language|scope|consistency|disposition|phase|visibility|protocol|category|classification)(?:$|[_-])/i;
+const SAFE_STRING_KEY = /(?:^|[_-])(?:id|kind|type|role|status|state|lifecycle|reason|name|product|provider|version|schema|model|format|class|mode|event|operation|tool|method|language|scope|consistency|disposition|phase|visibility|protocol|category|classification|decision|capability|permission|transition|hash|digest)(?:$|[_-])/i;
 const CONTROL_CHARACTERS = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g;
 const DEFAULT_NATIVE_LIMITS = {
     maxDepth: 8,