@bli-cockpit/cli 0.1.11 → 0.1.14

package/README.md

@@ -15,8 +15,8 @@ Run this from the repo where work will happen:
 
 ```bash
 COCKPIT_DEVICE_NAME="$(scutil --get ComputerName 2>/dev/null || hostname -s)"
-npm exec --yes --package=@bli-cockpit/cli@latest -- cockpit onboard \
-  --dashboard-url <DASHBOARD_URL> \
+npm install -g @bli-cockpit/cli@latest
+cockpit onboard \
   --email <APPROVED_EMAIL> \
   --device-name "$COCKPIT_DEVICE_NAME" \
   --repo "$PWD"
@@ -27,13 +27,20 @@ If a work folder contains multiple repos, run the same command from the parent:
 ```bash
 cd ~/Downloads/bluepearl-workspace
 COCKPIT_DEVICE_NAME="$(scutil --get ComputerName 2>/dev/null || hostname -s)"
-npm exec --yes --package=@bli-cockpit/cli@latest -- cockpit onboard \
-  --dashboard-url <DASHBOARD_URL> \
+npm install -g @bli-cockpit/cli@latest
+cockpit onboard \
   --email <APPROVED_EMAIL> \
   --device-name "$COCKPIT_DEVICE_NAME" \
   --repo "$PWD"
 ```
 
+The CLI defaults to the production dashboard. Normal intern/operator setup,
+updates, and syncs omit `--dashboard-url`. Pass `--dashboard-url` only for
+staging, a custom dashboard, or deliberately forcing a different dashboard
+pairing. Already-onboarded users update with
+`npm install -g @bli-cockpit/cli@latest`, then run
+`cockpit sync --repo "$PWD" --json`.
+
 Parent mode scans child git repos/worktrees (3 folder levels deep, up to 50
 repos by default — tune with `--max-depth` / `--max-repos`; a warning prints
 if the repo cap truncates discovery), creates one stable work context per
@@ -48,7 +55,7 @@ being duplicated across repos or dropped.
 
 What happens:
 
-1. npm downloads the public `@bli-cockpit/cli` package.
+1. npm installs or updates the public `@bli-cockpit/cli` package.
 2. `cockpit onboard` writes local user config.
 3. Cockpit prints a dashboard pairing URL and code.
 4. Admin approves the pending request from Ambient -> Collector approvals, or
@@ -63,8 +70,8 @@ What happens:
 `"Savina MacBook"`, `"Box VM 42"`, or the auto-filled macOS computer name.
 On reused laptops or VMs, keep `--email <APPROVED_EMAIL>` in the command.
 `cockpit onboard` skips pairing only when the existing valid session belongs to
-that same email and dashboard URL; a different email or dashboard forces a new
-approval.
+that same email and dashboard URL (the production default unless overridden); a
+different email or dashboard forces a new approval.
 
 Before the command runs, an Admin must create or approve the email in the
 private dashboard. Default launch path is email + temporary password, handed
@@ -75,12 +82,11 @@ separate invite acceptance step.
 When ticket work starts later:
 
 ```bash
-npm exec --yes --package=@bli-cockpit/cli@latest -- cockpit start \
+cockpit start \
   --ticket <ticket-id> \
   --repo "$PWD"
 
-npm exec --yes --package=@bli-cockpit/cli@latest -- cockpit sync \
-  --dashboard-url <DASHBOARD_URL> \
+cockpit sync \
   --repo "$PWD" \
   --json
 ```
@@ -92,7 +98,8 @@ Only pass `--ticket` when the work really belongs to a visible ticket.
 
 Local files:
 
-- `~/.config/bli-cockpit/config.json`: dashboard URL and local install config.
+- `~/.config/bli-cockpit/config.json`: dashboard URL (production default unless
+  overridden) and local install config.
 - `~/.config/bli-cockpit/session.json`: normal paired device session.
 - `~/.local/state/bli-cockpit/spool/`: safe retry records when upload fails.
 - `~/.local/state/bli-cockpit/cursors/raw-evidence.json`: hashes and labels of
@@ -115,6 +122,35 @@ Remote dashboard:
 - Codex session attribution records (session id, file hash, attribution state
   and reason labels, scores) accepted by `/api/ambient/codex-sessions`.
 
+New raw evidence object keys are readable from the Storage browser:
+
+```text
+operators/<operator-slug>-<operator-short>/repos/<repo-slug>/worktrees/<worktree-slug>/tickets/<ticket-id-or-unbound>/dates/<YYYY-MM-DD>/sessions/<session-slug>/ids/<operator_user_id>/<work_context_id>/<source>/<source-path>
+```
+
+The readable folders are for humans. The canonical join still lives in
+`ambient_evidence_refs.raw_evidence_pointer_id`, `storage_bucket`, and
+`object_key`. For SQL recipes that reconstruct a day of work by operator, date,
+repo, ticket, and raw JSONL object, see
+[`docs/runbooks/cockpit-data-traceability.md`](../../docs/runbooks/cockpit-data-traceability.md).
+
+## Read or debug captured data
+
+Local attribution preview:
+
+```bash
+cockpit sessions --repo "$PWD" --json
+```
+
+Remote metadata path:
+
+1. Query `ambient_evidence_refs` by `operator_user_id`, `received_at`, and
+   optional `ticket_id`.
+2. Join `ambient_work_sessions` only for current labels such as repo, worktree,
+   branch, and collector version.
+3. Open the `ambient-raw-evidence` object only after SQL identifies the exact
+   row and `object_key`.
+
 Never provide Supabase service-role keys, raw DB URLs, root env files, cookies,
 or deployment tokens to this CLI. The collector must never read env files and
 does not collect random desktop screenshots or screen recordings.

package/dist/adapters/common.js

@@ -14,6 +14,8 @@ export function makeCaptureProvenance(context, captureSource) {
         collector_version: LOCAL_COLLECTOR_VERSION,
         repo: context.repoRoot,
         branch: context.branch,
+        repo_label: context.repoLabel,
+        worktree_label: context.worktreeLabel,
         operator_id: context.operatorId,
         session_id: context.sessionId,
         work_context_id: context.workContextId,

package/dist/adapters/local-sources.js

@@ -8,10 +8,14 @@ import { resolveTicketBinding, } from "./ticket-binding.js";
 export async function runLocalSourceCollectors(options) {
     const context = {
         repoRoot: options.repoRoot,
+        repoLabel: options.activeWorkContext?.repo_label,
+        worktreeLabel: options.activeWorkContext?.worktree_label,
         branch: options.branch,
         operatorId: options.operatorId,
+        operatorLabel: options.operatorLabel,
         sessionId: options.sessionId,
         workContextId: options.workContextId,
+        activeTicketId: options.activeWorkContext?.active_ticket_id ?? null,
         now: options.now ?? new Date(),
     };
     const git = await collectGitState(context);

package/dist/adapters/raw-evidence.js

@@ -99,10 +99,9 @@ export async function collectRawEvidencePack(context, options) {
         await fs.writeFile(manifestPath, manifestBytes, { mode: 0o600 });
         await chmodPrivate(manifestPath, 0o600);
         const manifestEntry = evidenceEntry({
+            context,
             kind: "manifest",
             packId,
-            operatorId: context.operatorId,
-            workContextId: context.workContextId,
             localPath: manifestPath,
             relativePath: "manifest.json",
             mediaType: "application/json",
@@ -350,10 +349,9 @@ async function collectOneAgentImageFile(collection, options) {
     await fs.writeFile(destination, raw, { mode: 0o600 });
     await chmodPrivate(destination, 0o600);
     collection.entries.push(evidenceEntry({
+        context: collection.context,
         kind: options.kind,
         packId: collection.packId,
-        operatorId: collection.context.operatorId,
-        workContextId: collection.context.workContextId,
         localPath: destination,
         relativePath,
         mediaType: metadata.media_type,
@@ -434,10 +432,9 @@ async function collectOneEvidenceFile(collection, options) {
     await fs.writeFile(destination, raw, { mode: 0o600 });
     await chmodPrivate(destination, 0o600);
     collection.entries.push(evidenceEntry({
+        context: collection.context,
         kind: options.kind,
         packId: collection.packId,
-        operatorId: collection.context.operatorId,
-        workContextId: collection.context.workContextId,
         localPath: destination,
         relativePath,
         mediaType: options.mediaType,
@@ -504,10 +501,9 @@ async function collectGitDiffFiles(collection, repoRoot) {
         await fs.writeFile(destination, raw, { mode: 0o600 });
         await chmodPrivate(destination, 0o600);
         collection.entries.push(evidenceEntry({
+            context: collection.context,
             kind: "git_diff",
             packId: collection.packId,
-            operatorId: collection.context.operatorId,
-            workContextId: collection.context.workContextId,
             localPath: destination,
             relativePath,
             mediaType: "text/x-diff",
@@ -577,6 +573,10 @@ function makeManifest(options) {
         work_context_id: options.context.workContextId,
         session_id: options.context.sessionId,
         operator_id: options.context.operatorId,
+        operator_label: options.context.operatorLabel,
+        repo_label: options.context.repoLabel ?? path.basename(options.context.repoRoot),
+        worktree_label: options.context.worktreeLabel,
+        active_ticket_id: options.context.activeTicketId ?? null,
         repo_basename: path.basename(options.context.repoRoot),
         branch: options.context.branch,
         storage_bucket: RAW_EVIDENCE_BUCKET,
@@ -599,8 +599,7 @@ function makeManifest(options) {
 function evidenceEntry(options) {
     const digest = sha256(options.bytes);
     const objectKey = remoteObjectKey({
-        operatorId: options.operatorId,
-        workContextId: options.workContextId,
+        context: options.context,
         packId: options.packId,
         relativePath: options.relativePath,
         contentAddress: options.contentAddress,
@@ -661,26 +660,63 @@ function pointerFromEntry(entry) {
     };
 }
 /**
- * Codex/Claude JSONL and git diff objects are content-addressed (kind/id/hash)
- * so the same content maps to the same remote key across syncs: interrupted
- * uploads resume and repeated syncs dedupe server-side. Pack-scoped keys remain
- * for the per-sync manifest.
+ * Raw evidence keys start with human-readable context, then end in immutable
+ * content addresses or pack-relative manifest paths. The local cursor reuses
+ * prior content hashes across syncs; the readable date/session folders are for
+ * operator debugging and incident response.
  */
 function remoteObjectKey(options) {
+    const namespace = readableEvidenceNamespace(options.context);
     if (options.contentAddress) {
         return posixPath([
-            options.operatorId,
-            options.workContextId,
+            ...namespace,
             options.contentAddress,
         ]);
     }
     return posixPath([
-        options.operatorId,
-        options.workContextId,
+        ...namespace,
         options.packId,
         options.relativePath,
     ]);
 }
+function readableEvidenceNamespace(context) {
+    return [
+        "operators",
+        operatorSlug(context),
+        "repos",
+        readableKeySegment(context.repoLabel ?? path.basename(context.repoRoot), "repo"),
+        "worktrees",
+        readableKeySegment(context.worktreeLabel ?? path.basename(context.repoRoot), "worktree"),
+        "tickets",
+        readableKeySegment(context.activeTicketId ?? "unbound", "unbound", {
+            lowercase: false,
+        }),
+        "dates",
+        context.now.toISOString().slice(0, 10),
+        "sessions",
+        readableKeySegment(context.sessionId, "session"),
+        "ids",
+        safeKeySegment(context.operatorId),
+        safeKeySegment(context.workContextId),
+    ];
+}
+function operatorSlug(context) {
+    const labelBeforeDomain = (context.operatorLabel ?? context.operatorId)
+        .split("@", 1)[0]
+        .trim();
+    const readable = readableKeySegment(labelBeforeDomain, "operator");
+    return `${readable}-${shortHash(context.operatorId).slice(0, 6)}`;
+}
+function readableKeySegment(value, fallback, options = {}) {
+    const base = options.lowercase === false ? value : value.toLowerCase();
+    const slug = base
+        .trim()
+        .replace(/[^A-Za-z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .replace(/-{2,}/g, "-")
+        .slice(0, 80);
+    return slug || fallback;
+}
 function posixPath(parts) {
     return parts.join("/").replace(/\\/g, "/").replace(/\/+/g, "/");
 }

package/dist/autostart.js

@@ -128,7 +128,10 @@ async function existingWatchPaths(homeDir) {
 function renderPlist(options) {
     // The repo path is shell-quoted because it lands inside a `/bin/zsh -lc "…"`
     // command string; the whole command is then XML-escaped for the <string>.
-    const command = `npm exec --yes --package=@bli-cockpit/cli@latest -- cockpit sync --repo ${shellQuote(options.workDir)} --dashboard-url ${shellQuote(options.dashboardUrl)} --json`;
+    const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
+        ? ""
+        : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
+    const command = `cockpit sync --repo ${shellQuote(options.workDir)}${dashboardArg} --json`;
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
         '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',

package/dist/commands/local.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { createCollectorServer } from "../server.js";
 import { parseLocalArgs, normalizeUrl } from "./local-args.js";
 import { autostartStatus, installAutostartAgent, uninstallAutostartAgent } from "../autostart.js";
-import { getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext } from "../local-state.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext } from "../local-state.js";
 import { scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
 import { acquireSyncLock } from "../sync-lock.js";
@@ -82,6 +82,8 @@ export function localCommandHelp(command) {
         "  cockpit sessions [--source codex|claude] [--repo <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit serve [--port <port>] [--repo <path>]",
         "  cockpit autostart [install|uninstall|status] [--repo <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
+        "",
+        `Default dashboard: ${DEFAULT_DASHBOARD_URL}. Omit --dashboard-url for normal production use; pass it only for staging/custom dashboards or to force a different pairing.`,
     ].join("\n");
 }
 function localSubcommandHelp(command) {
@@ -93,6 +95,8 @@ function localSubcommandHelp(command) {
                 "",
                 "Installs, pairs, starts work context(s), syncs once, and prints readiness proof.",
                 "If --repo is a parent folder, scans child git repos/worktrees and rolls them up by repo.",
+                `Omit --dashboard-url for normal production setup (${DEFAULT_DASHBOARD_URL}).`,
+                "Pass --dashboard-url only for staging/custom dashboards or to force a different pairing.",
                 "Run with no flags in a terminal and it prompts for the dashboard email; pass --email to skip the prompt (and on shared/reused machines, where mismatched sessions are re-paired).",
             ],
         ],
@@ -102,6 +106,7 @@ function localSubcommandHelp(command) {
                 "Usage: cockpit install [--dashboard-url <url>] [--repo <path>] [--json]",
                 "",
                 "Writes local collector config. Pair with `cockpit login`, then run `cockpit start` when work begins.",
+                "Omit --dashboard-url for the production dashboard; pass it only for staging/custom dashboards.",
             ],
         ],
         [
@@ -110,6 +115,7 @@ function localSubcommandHelp(command) {
                 "Usage: cockpit login [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--json]",
                 "",
                 "Starts dashboard device pairing and stores the approved local session.",
+                "Omit --dashboard-url for the production dashboard; pass it only for staging/custom dashboards.",
             ],
         ],
         [
@@ -136,6 +142,7 @@ function localSubcommandHelp(command) {
                 "Usage: cockpit sync [--repo <path>] [--dashboard-url <url>] [--json]",
                 "",
                 "Uploads latest local ambient envelope(s), or spools safe retries if blocked.",
+                "Omit --dashboard-url for normal production sync; pass it only for staging/custom dashboards or forced re-pairing.",
                 "Parent folders sync each child git worktree; Codex AND Claude Code JSONL",
                 "transcripts (and Claude subagent sidecars) are attributed to repos",
                 "deterministically and ambiguous transcripts are retained as unattributed",
@@ -181,6 +188,7 @@ function localSubcommandHelp(command) {
                 "Installs a macOS launchd LaunchAgent that runs `cockpit sync` at login and",
                 "every 30 min (default), surviving reboots — so machines never drift to Stale.",
                 "Action defaults to `install`. `--repo` is the parent work folder to sync.",
+                "Omit --dashboard-url for production; pass it only for staging/custom dashboards.",
                 "macOS-only for now; see docs/runbooks/cockpit-launchd-sync.md.",
             ],
         ],
@@ -854,7 +862,9 @@ async function runStatus(command, io) {
     writeLine(io.stdout, `repo: ${status.repo}`);
     writeLine(io.stdout, `branch: ${status.branch}`);
     writeLine(io.stdout, `ticket: ${displayTicketId(status.active_ticket_id)}`);
+    writeLine(io.stdout, `work: ${displayWorkLabel(status)}`);
     writeLine(io.stdout, `collector_freshness: ${status.collector_freshness}`);
+    writeLine(io.stdout, `collector_version: ${status.collector_version}`);
     writeLine(io.stdout, `upload_state: ${status.upload_state}`);
     writeLine(io.stdout, `last_upload_attempt: ${status.last_upload_attempt_at ?? "never"}`);
     writeLine(io.stdout, `last_upload_success: ${status.last_upload_success_at ?? "never"}`);
@@ -867,6 +877,11 @@ async function runStatus(command, io) {
 function displayTicketId(ticketId) {
     return ticketId ?? "general ambient";
 }
+function displayWorkLabel(status) {
+    if (status.work_label && status.work_id)
+        return `${status.work_label} (${status.work_id})`;
+    return status.work_label ?? status.work_id ?? "no active work context";
+}
 /**
  * Read-only diagnostic: re-runs attribution (no upload, no cursor writes) and
  * prints why each session is or is not collected. Per-session reasons otherwise

package/dist/commands/public-root.js

@@ -22,7 +22,10 @@ function cockpitHelp() {
     "Usage:",
     localCommandHelp(),
     "",
+    "Install/update: `npm install -g @bli-cockpit/cli@latest`.",
     "Intern path: run `cockpit onboard` from the repo root; add `--ticket <id>` only when work already has a ticket.",
+    "Already onboarded: run `cockpit sync --repo \"$PWD\" --json`.",
+    "Dashboard URL is optional for normal production use; pass `--dashboard-url` only for staging/custom dashboards or forced re-pairing.",
     "Manual collector path: `install`, `login`, `start [--ticket <id>]`, `sync`, `status`.",
   ].join("\n");
 }

package/dist/local-state.js

@@ -1,11 +1,15 @@
 import { getUserLocalCockpitPaths, LocalCollectorSessionFileSchema, LocalCollectorConfigSchema, LocalUserSessionReferenceSchema, LocalWorkContextSchema, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
+import { readFileSync } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { resolveRepoWorktreeIdentity, } from "./repo-identity.js";
 import { summarizeLocalUploadSpool } from "./spool/local-spool.js";
-export const LOCAL_COLLECTOR_VERSION = "0.1.10";
+const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+export const LOCAL_COLLECTOR_VERSION = typeof localCollectorPackage.version === "string"
+    ? localCollectorPackage.version
+    : "0.0.0";
 export const DEFAULT_DASHBOARD_URL = "https://bli-cockpit-dashboard.vercel.app";
 export function getCollectorRuntimePaths(homeDir = os.homedir()) {
     const paths = getUserLocalCockpitPaths(homeDir);
@@ -83,7 +87,7 @@ export async function pairLocalCollector(options = {}) {
         device_id: deviceId,
         device_name: deviceName,
         claimed_owner_email: claimedOwnerEmail,
-        collector_version: config.collector_version ?? LOCAL_COLLECTOR_VERSION,
+        collector_version: LOCAL_COLLECTOR_VERSION,
     });
     options.onPairStarted?.(startResponse);
     const sessionFile = await pollPairRequest(fetchImpl, dashboardUrl, {
@@ -218,7 +222,7 @@ export async function inspectLocalCollectorStatus(options = {}) {
         ? "Local user session is valid."
         : "Local user session missing or not paired; upload remains local-only.");
     details.push(context
-        ? `Active context ${context.work_context_id} last updated ${context.updated_at ?? context.started_at}.`
+        ? `Active work ${workDisplayLabel(context)} (${context.work_context_id}) last updated ${context.updated_at ?? context.started_at}.`
         : "Active work context missing. Run `cockpit start`.");
     details.push(uploadSpool.last_upload_attempt_at
         ? `Last upload attempt: ${uploadSpool.last_upload_attempt_at}.`
@@ -236,10 +240,14 @@ export async function inspectLocalCollectorStatus(options = {}) {
         installed: Boolean(config),
         config_file: paths.config_file,
         session_file: paths.session_file,
+        collector_version: LOCAL_COLLECTOR_VERSION,
+        config_collector_version: config?.collector_version ?? null,
         session_state: session.session_state,
         repo: context?.repo ?? identity.repo_root,
         branch,
         active_ticket_id: context?.active_ticket_id ?? null,
+        work_label: context ? workDisplayLabel(context) : null,
+        work_id: context?.work_context_id ?? null,
         work_context_id: context?.work_context_id ?? null,
         repo_label: context?.repo_label ?? identity.repo_label,
         repo_fingerprint: context?.repo_fingerprint ?? identity.repo_fingerprint,
@@ -256,6 +264,11 @@ export async function inspectLocalCollectorStatus(options = {}) {
         details,
     };
 }
+function workDisplayLabel(context) {
+    const repoLabel = (context.repo_label ?? path.basename(context.repo)) || "workspace";
+    const worktreeLabel = context.worktree_label ?? repoLabel;
+    return `${repoLabel}/${worktreeLabel}`;
+}
 export async function readLocalCollectorConfig(paths) {
     return LocalCollectorConfigSchema.parse(await readJsonFile(paths.config_file));
 }

package/dist/upload.js

@@ -19,7 +19,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
     const now = options.now ?? new Date();
     const paths = getCollectorRuntimePaths(options.homeDir);
     const config = await readLocalCollectorConfig(paths).catch(() => {
-        throw new LocalUploadBlockedError("not_installed", "Local collector config missing. Run `cockpit install` before `cockpit sync`.", "cockpit install --dashboard-url <dashboard-url>");
+        throw new LocalUploadBlockedError("not_installed", "Local collector config missing. Install/update the CLI, then run `cockpit onboard` before `cockpit sync`.", "npm install -g @bli-cockpit/cli@latest && cockpit onboard --email <email> --repo \"$PWD\"");
     });
     const sessionFile = await readLocalCollectorSessionFile(paths).catch(() => {
         throw new LocalUploadBlockedError("unpaired", "No paired collector session found. Run `cockpit login` or `cockpit pair` before `cockpit sync`.", "cockpit login");
@@ -41,15 +41,18 @@ export async function buildLocalAmbientEnvelope(options = {}) {
         repoLabel,
         now,
     });
-    const contextNamespacePrefix = `${session.operator_id}/${uploadContext.work_context_id}/`;
     const skipContentHashes = options.skipContentHashes ??
         new Set(Object.entries(options.cursorObjects ?? {})
-            .filter(([, entry]) => entry.object_key.startsWith(contextNamespacePrefix))
+            .filter(([, entry]) => rawEvidenceObjectKeyBelongsToWorkContext(entry.object_key, {
+            operatorId: session.operator_id,
+            workContextId: uploadContext.work_context_id,
+        }))
             .map(([hash]) => hash));
     const sourceCollection = await runLocalSourceCollectors({
         repoRoot,
         branch: uploadContext.branch,
         operatorId: session.operator_id,
+        operatorLabel: session.email ?? session.auth_subject_id,
         sessionId: session.session_id,
         workContextId: uploadContext.work_context_id,
         activeWorkContext: activeContext,
@@ -92,7 +95,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
     const envelope = TelemetryIngestEnvelopeSchema.parse({
         envelope_version: "telemetry-ingest.v1",
         generated_at: now.toISOString(),
-        collector_version: config.collector_version ?? LOCAL_COLLECTOR_VERSION,
+        collector_version: LOCAL_COLLECTOR_VERSION,
         session_reference: sanitizeSessionReference(session),
         work_context: uploadWorkContext,
         source_scan_results: sanitizeSourceScanResults(sourceCollection.scans, repoLabel),
@@ -767,4 +770,10 @@ function normalizeDashboardUrl(value) {
 function safeRepoLabel(repoRoot) {
     const basename = path.basename(repoRoot.replace(/[\\/]+$/, ""));
     return basename || "repo";
+}
+function rawEvidenceObjectKeyBelongsToWorkContext(objectKey, context) {
+    const legacyPrefix = `${context.operatorId}/${context.workContextId}/`;
+    const readableIdGuard = `/ids/${context.operatorId}/${context.workContextId}/`;
+    return (objectKey.startsWith(legacyPrefix) ||
+        (objectKey.startsWith("operators/") && objectKey.includes(readableIdGuard)));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.1.11",
+  "version": "0.1.14",
   "private": false,
   "type": "module",
   "bin": {