@bli-cockpit/cli 0.1.2 → 0.1.5

package/README.md

@@ -4,8 +4,8 @@ Public BLI Cockpit command-line interface for approved operators and interns.
 
 The npm package is public; the Cockpit backend and admin tooling are not. The
 CLI pairs a local laptop with the private Cockpit dashboard, records safe
-work context, uploads consented raw Codex/diff evidence to private
-durable private storage, and uploads metadata refs after dashboard-approved
+work context, uploads consented raw Codex/diff evidence to durable private
+storage, and uploads metadata refs after dashboard-approved
 device pairing.
 
 ## One-paste install
@@ -21,15 +21,38 @@ npm exec --yes --package=@bli-cockpit/cli@latest -- cockpit onboard \
   --repo "$PWD"
 ```
 
+If a work folder contains multiple repos, run the same command from the parent:
+
+```bash
+cd ~/Downloads/bluepearl-workspace
+COCKPIT_DEVICE_NAME="$(scutil --get ComputerName 2>/dev/null || hostname -s)"
+npm exec --yes --package=@bli-cockpit/cli@latest -- cockpit onboard \
+  --dashboard-url <DASHBOARD_URL> \
+  --email <APPROVED_EMAIL> \
+  --device-name "$COCKPIT_DEVICE_NAME" \
+  --repo "$PWD"
+```
+
+Parent mode scans child git repos/worktrees, creates one stable work context per
+worktree, and the dashboard rolls them up under one repo row with worktree
+drilldown. Device approval is still one time per laptop/dashboard/email. Codex
+JSONL transcripts are attributed to a repo/worktree deterministically (session
+cwd, workspace roots, git origin/branch/commit signals) and upload only into
+that repo's evidence lane; transcripts that cannot be attributed to exactly one
+worktree are reported as ambiguous/unattributed with reason labels instead of
+being duplicated across repos or dropped.
+
 What happens:
 
 1. npm downloads the public `@bli-cockpit/cli` package.
 2. `cockpit onboard` writes local user config.
 3. Cockpit prints a dashboard pairing URL and code.
-4. The signed-in intern approves that exact code, or an Admin approves it while
-   watching the same code.
+4. Admin approves the pending request from Ambient -> Collector approvals, or
+   pastes the printed code there. The signed-in intern can still use the
+   printed URL.
 5. The CLI starts general ambient capture, uploads private raw evidence objects
-   when present, then uploads one safe metadata/ref envelope.
+   when present (chunked and resumable, with identical content acknowledged
+   instead of re-uploaded), then uploads one safe metadata/ref envelope.
 6. The CLI prints `PASS: Cockpit collector is ready for harvest.`
 
 `--device-name` is just a readable label in Cockpit. It can be
@@ -68,17 +91,23 @@ Local files:
 - `~/.config/bli-cockpit/config.json`: dashboard URL and local install config.
 - `~/.config/bli-cockpit/session.json`: normal paired device session.
 - `~/.local/state/bli-cockpit/spool/`: safe retry records when upload fails.
+- `~/.local/state/bli-cockpit/cursors/raw-evidence.json`: hashes and labels of
+  already-durable evidence so repeated syncs skip re-uploading the same
+  content (no raw content is stored in the cursor).
 - `.codex-autorunner/contextspace/active_context.md` in the work repo when a
   work context is active.
 
 Remote dashboard:
 
 - approved user and device identity;
-- repo, branch, optional ticket, source availability, risk flags, and upload
-  timestamps;
+- repo/worktree fingerprints, branch, head SHA, optional ticket, source
+  availability, risk flags, and upload timestamps;
 - raw evidence refs accepted by `/api/ambient/ingest`;
-- durable private Storage objects accepted by
-  `/api/ambient/evidence/upload`.
+- durable private Storage objects accepted by the chunked
+  `/api/ambient/evidence/upload/begin|chunk|commit` endpoints, tracked in a
+  durable per-object upload ledger;
+- Codex session attribution records (session id, file hash, attribution state
+  and reason labels, scores) accepted by `/api/ambient/codex-sessions`.
 
 Never provide Supabase service-role keys, raw DB URLs, root env files, cookies,
 or deployment tokens to this CLI. The collector must never read env files.

package/dist/adapters/codex-attribution.js

@@ -0,0 +1,344 @@
+import { containsSecretLikeContent } from "@bli-cockpit/telemetry-core";
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { normalizeGitOrigin } from "../repo-identity.js";
+/**
+ * Deterministic Codex session JSONL -> repo/worktree attribution.
+ *
+ * Only metadata-bearing records are inspected (session_meta, turn_context):
+ * cwd, workspace roots, and git branch/commit/origin. Prompt, response,
+ * reasoning, and tool payload fields are never extracted, printed, or
+ * summarized. A session is attributed only when exactly one worktree clearly
+ * wins; close calls stay ambiguous instead of being duplicated across repos.
+ */
+export const CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES = 24 * 60;
+export const CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT = 50;
+export const CODEX_SESSION_MAX_FILE_BYTES = 10 * 1024 * 1024;
+const SECRET_FILE_SEGMENT_PATTERN = /(^|[/\\])(?:\.env(?:\..*)?|.*(?:secret|credential|private[_-]?key|service[_-]?role).*)$/i;
+const SESSION_FILE_UUID_PATTERN = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i;
+const SCORE_CWD_MATCH = 0.5;
+const SCORE_WORKSPACE_ROOT_MATCH = 0.1;
+const SCORE_ORIGIN_MATCH = 0.3;
+const SCORE_BRANCH_MATCH = 0.15;
+const SCORE_HEAD_SHA_MATCH = 0.05;
+const ATTRIBUTION_MIN_SCORE = 0.4;
+const ATTRIBUTION_MIN_MARGIN = 0.15;
+export async function scanAndAttributeCodexSessions(options) {
+    const sinceMinutes = options.sinceMinutes ?? CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES;
+    const limit = options.limit ?? CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT;
+    const cutoffMs = options.now.getTime() - sinceMinutes * 60 * 1000;
+    const files = (await walkCodexJsonlFiles(options.sessionsDir, cutoffMs)).slice(0, limit);
+    const results = [];
+    for (const file of files) {
+        results.push(await attributeOneSession(file, options.worktrees));
+    }
+    return {
+        results,
+        scanned_file_count: files.length,
+        counts: {
+            attributed: results.filter((entry) => entry.state === "attributed").length,
+            ambiguous: results.filter((entry) => entry.state === "ambiguous").length,
+            unattributed: results.filter((entry) => entry.state === "unattributed")
+                .length,
+            skipped: results.filter((entry) => entry.state === "skipped").length,
+        },
+    };
+}
+export async function walkCodexJsonlFiles(dir, cutoffMs) {
+    const out = [];
+    const stack = [dir];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (!current || isSecretLikePath(current))
+            continue;
+        let entries;
+        try {
+            entries = await fs.readdir(current, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const full = path.join(current, entry.name);
+            if (entry.isDirectory()) {
+                // Never descend into secret-like directories.
+                if (!isSecretLikePath(full))
+                    stack.push(full);
+                continue;
+            }
+            // Secret-like file NAMES stay in the list so attribution can record a
+            // "skipped" observation with a reason label (the content is never read)
+            // instead of silently dropping the session.
+            if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
+                continue;
+            const stat = await fs.stat(full);
+            if (stat.mtimeMs >= cutoffMs) {
+                out.push({ file: full, mtimeMs: stat.mtimeMs, byteSize: stat.size });
+            }
+        }
+    }
+    out.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    return out;
+}
+async function attributeOneSession(file, worktrees) {
+    const fileName = path.basename(file.file);
+    const base = {
+        file_path: file.file,
+        file_name: fileName,
+        codex_session_id: sessionIdFromFileName(fileName) ?? shortHash(file.file),
+        cwd_basename: null,
+        cwd_hash: null,
+        session_file_mtime: new Date(file.mtimeMs).toISOString(),
+        session_file_mtime_ms: file.mtimeMs,
+        byte_size: file.byteSize,
+        content_hash_sha256: null,
+    };
+    if (isSecretLikePath(fileName)) {
+        return skippedResult(base, "secret_like_file_name");
+    }
+    if (file.byteSize > CODEX_SESSION_MAX_FILE_BYTES) {
+        return skippedResult(base, "file_too_large");
+    }
+    let raw;
+    try {
+        raw = await fs.readFile(file.file);
+    }
+    catch {
+        return skippedResult(base, "file_read_failed");
+    }
+    const content = raw.toString("utf8");
+    base.content_hash_sha256 = sha256(raw);
+    base.byte_size = raw.byteLength;
+    if (containsSecretLikeContent(content)) {
+        return skippedResult(base, "secret_like_content_guard");
+    }
+    const signals = extractCodexSessionSignals(content);
+    const metaSessionId = sanitizeSessionId(signals.session_ids[0]);
+    if (metaSessionId) {
+        base.codex_session_id = metaSessionId;
+    }
+    const primaryCwd = signals.cwds[0] ?? null;
+    if (primaryCwd) {
+        base.cwd_basename = path.basename(primaryCwd) || null;
+        base.cwd_hash = shortHash(primaryCwd);
+    }
+    if (signals.line_count === 0 || signals.parse_error_count === signals.line_count) {
+        return {
+            ...base,
+            state: "unattributed",
+            reason: "jsonl_parse_failed",
+            signals: [],
+            attribution_score: 0,
+            path_score: 0,
+            worktree: null,
+        };
+    }
+    return scoreSessionAgainstWorktrees(base, signals, worktrees);
+}
+export function extractCodexSessionSignals(content) {
+    const sessionIds = new Set();
+    const cwds = new Set();
+    const workspaceRoots = new Set();
+    const branches = new Set();
+    const commitHashes = new Set();
+    const repositoryUrls = new Set();
+    let lineCount = 0;
+    let parseErrorCount = 0;
+    for (const line of content.split("\n")) {
+        if (!line.trim())
+            continue;
+        lineCount += 1;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            parseErrorCount += 1;
+            continue;
+        }
+        if (!record || typeof record !== "object")
+            continue;
+        const type = record.type;
+        const payload = record.payload;
+        if (!payload || typeof payload !== "object")
+            continue;
+        const payloadRecord = payload;
+        if (type === "session_meta") {
+            addString(sessionIds, payloadRecord["id"]);
+            addString(cwds, payloadRecord["cwd"]);
+            const git = payloadRecord["git"];
+            if (git && typeof git === "object") {
+                const gitRecord = git;
+                addString(branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
+                addString(commitHashes, gitRecord["commit_hash"]);
+                const repositoryUrl = gitRecord["repository_url"];
+                if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
+                    repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
+                }
+            }
+        }
+        else if (type === "turn_context") {
+            addString(cwds, payloadRecord["cwd"]);
+            const roots = payloadRecord["workspace_roots"];
+            if (Array.isArray(roots)) {
+                for (const root of roots) {
+                    if (typeof root === "string") {
+                        addString(workspaceRoots, root);
+                    }
+                    else if (root && typeof root === "object") {
+                        addString(workspaceRoots, root["path"]);
+                    }
+                }
+            }
+        }
+    }
+    return {
+        session_ids: [...sessionIds],
+        cwds: [...cwds],
+        workspace_roots: [...workspaceRoots],
+        branches: [...branches],
+        commit_hashes: [...commitHashes],
+        repository_urls: [...repositoryUrls],
+        line_count: lineCount,
+        parse_error_count: parseErrorCount,
+    };
+}
+function scoreSessionAgainstWorktrees(base, signals, worktrees) {
+    const hasAnySignal = signals.cwds.length > 0 ||
+        signals.workspace_roots.length > 0 ||
+        signals.repository_urls.length > 0 ||
+        signals.branches.length > 0 ||
+        signals.commit_hashes.length > 0;
+    if (!hasAnySignal) {
+        return {
+            ...base,
+            state: "unattributed",
+            reason: "no_repo_signals",
+            signals: [],
+            attribution_score: 0,
+            path_score: 0,
+            worktree: null,
+        };
+    }
+    const scored = worktrees.map((worktree) => {
+        const matched = [];
+        let score = 0;
+        let pathScore = 0;
+        if (signals.cwds.some((cwd) => isPathWithin(cwd, worktree.repo_root))) {
+            score += SCORE_CWD_MATCH;
+            pathScore += SCORE_CWD_MATCH;
+            matched.push("cwd_match");
+        }
+        if (signals.workspace_roots.some((root) => isPathWithin(root, worktree.repo_root))) {
+            score += SCORE_WORKSPACE_ROOT_MATCH;
+            pathScore += SCORE_WORKSPACE_ROOT_MATCH;
+            matched.push("workspace_root_match");
+        }
+        if (worktree.repo_origin_url &&
+            signals.repository_urls.includes(worktree.repo_origin_url)) {
+            score += SCORE_ORIGIN_MATCH;
+            matched.push("origin_url_match");
+        }
+        if (signals.branches.includes(worktree.branch)) {
+            score += SCORE_BRANCH_MATCH;
+            matched.push("branch_match");
+        }
+        if (worktree.head_sha && signals.commit_hashes.includes(worktree.head_sha)) {
+            score += SCORE_HEAD_SHA_MATCH;
+            matched.push("head_sha_match");
+        }
+        return { worktree, score, pathScore, matched };
+    });
+    scored.sort((a, b) => b.score - a.score);
+    const best = scored[0];
+    const secondBestScore = scored[1]?.score ?? 0;
+    if (!best || best.score === 0) {
+        const reason = signals.cwds.length > 0 || signals.workspace_roots.length > 0
+            ? "cwd_outside_scanned_worktrees"
+            : "no_matching_worktree_signals";
+        return {
+            ...base,
+            state: "unattributed",
+            reason,
+            signals: [],
+            attribution_score: 0,
+            path_score: 0,
+            worktree: null,
+        };
+    }
+    const score = clampScore(best.score);
+    const pathScore = clampScore(best.pathScore);
+    if (best.score >= ATTRIBUTION_MIN_SCORE &&
+        best.score - secondBestScore >= ATTRIBUTION_MIN_MARGIN) {
+        return {
+            ...base,
+            state: "attributed",
+            reason: "deterministic_signal_match",
+            signals: best.matched,
+            attribution_score: score,
+            path_score: pathScore,
+            worktree: best.worktree,
+        };
+    }
+    return {
+        ...base,
+        state: "ambiguous",
+        reason: best.score - secondBestScore < ATTRIBUTION_MIN_MARGIN
+            ? "multiple_worktrees_close_scores"
+            : "signal_score_below_threshold",
+        signals: best.matched,
+        attribution_score: score,
+        path_score: pathScore,
+        worktree: null,
+    };
+}
+function skippedResult(base, reason) {
+    return {
+        ...base,
+        state: "skipped",
+        reason,
+        signals: [],
+        attribution_score: 0,
+        path_score: 0,
+        worktree: null,
+    };
+}
+export function sessionIdFromFileName(fileName) {
+    const match = fileName.match(SESSION_FILE_UUID_PATTERN);
+    return match?.[1]?.toLowerCase() ?? null;
+}
+/**
+ * Session ids come from file content and end up inside remote object keys, so
+ * anything outside the safe charset falls back to a hash of the raw value
+ * instead of poisoning every begin request in the batch.
+ */
+export function sanitizeSessionId(value) {
+    if (!value)
+        return null;
+    if (/^[A-Za-z0-9._-]{4,80}$/.test(value))
+        return value;
+    return shortHash(value);
+}
+function isPathWithin(candidate, root) {
+    const normalizedCandidate = path.resolve(candidate);
+    const normalizedRoot = path.resolve(root);
+    return (normalizedCandidate === normalizedRoot ||
+        normalizedCandidate.startsWith(normalizedRoot + path.sep));
+}
+function addString(target, value) {
+    if (typeof value === "string" && value.trim())
+        target.add(value.trim());
+}
+function clampScore(value) {
+    return Math.min(1, Math.max(0, Number(value.toFixed(4))));
+}
+function isSecretLikePath(value) {
+    return SECRET_FILE_SEGMENT_PATTERN.test(value);
+}
+function shortHash(value) {
+    return crypto.createHash("sha256").update(value, "utf8").digest("hex").slice(0, 16);
+}
+function sha256(value) {
+    return crypto.createHash("sha256").update(value).digest("hex");
+}

package/dist/adapters/local-sources.js

@@ -20,6 +20,9 @@ export async function runLocalSourceCollectors(options) {
             stateDir: options.rawEvidenceStateDir,
             repoRoot: options.repoRoot,
             sessionsDir: options.rawEvidenceSessionsDir,
+            includeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
+            codexSessionFiles: options.rawEvidenceCodexSessionFiles,
+            skipContentHashes: options.rawEvidenceSkipContentHashes,
         })
         : {
             scan: makeUnavailableScan(context, "codex_jsonl", "codex-jsonl", "raw_evidence_state_dir_not_configured"),

package/dist/adapters/raw-evidence.js

@@ -20,19 +20,26 @@ export async function collectRawEvidencePack(context, options) {
     const filesDir = path.join(evidenceDir, "files");
     const entries = [];
     const skipped = [];
+    const reused = [];
+    const skipContentHashes = options.skipContentHashes ?? new Set();
     try {
         await ensurePrivateDir(evidenceDir);
         await ensurePrivateDir(filesDir);
-        await collectCodexJsonlFiles({
-            context,
-            filesDir,
-            packId,
-            entries,
-            skipped,
-            sessionsDir: options.sessionsDir,
-            sinceMinutes: options.sinceMinutes ?? DEFAULT_SINCE_MINUTES,
-            limit: options.sessionLimit ?? DEFAULT_SESSION_LIMIT,
-        });
+        if (options.includeCodexJsonl !== false) {
+            await collectCodexJsonlFiles({
+                context,
+                filesDir,
+                packId,
+                entries,
+                skipped,
+                reused,
+                skipContentHashes,
+                codexSessionFiles: options.codexSessionFiles,
+                sessionsDir: options.sessionsDir,
+                sinceMinutes: options.sinceMinutes ?? DEFAULT_SINCE_MINUTES,
+                limit: options.sessionLimit ?? DEFAULT_SESSION_LIMIT,
+            });
+        }
         await collectGitDiffFiles({
             context,
             filesDir,
@@ -40,6 +47,8 @@ export async function collectRawEvidencePack(context, options) {
             repoRoot: options.repoRoot,
             entries,
             skipped,
+            reused,
+            skipContentHashes,
         });
         if (entries.length === 0) {
             const facts = {
@@ -50,9 +59,11 @@ export async function collectRawEvidencePack(context, options) {
                 file_count: 0,
                 byte_size: 0,
                 skipped_count: skipped.length,
+                reused_count: reused.length,
                 content_kinds: [],
                 pointers: [],
                 upload_files: [],
+                reused,
             };
             return {
                 facts,
@@ -70,6 +81,7 @@ export async function collectRawEvidencePack(context, options) {
             evidenceDir,
             entries,
             skipped,
+            reused,
         });
         const manifestPath = path.join(evidenceDir, "manifest.json");
         const manifestBytes = Buffer.from(`${JSON.stringify(manifestWithoutSelf, null, 2)}\n`, "utf8");
@@ -95,12 +107,16 @@ export async function collectRawEvidencePack(context, options) {
             file_count: entries.length,
             byte_size: entries.reduce((sum, entry) => sum + entry.byte_size, 0),
             skipped_count: skipped.length,
+            reused_count: reused.length,
             content_kinds: [...new Set(entries.map((entry) => entry.kind))],
             pointers: entries.map(pointerFromEntry),
             upload_files: entries.map((entry) => ({
                 pointer: pointerFromEntry(entry),
                 local_path: entry.local_path,
+                kind: entry.kind,
+                codex_session_id: entry.codex_session_id ?? null,
             })),
+            reused,
         };
         return {
             facts,
@@ -153,17 +169,23 @@ function makeRawEvidenceScan(options) {
             `files:${options.facts.file_count}`,
             `bytes:${options.facts.byte_size}`,
             `skipped:${options.facts.skipped_count}`,
+            `reused:${options.facts.reused_count}`,
             ...options.facts.content_kinds.map((kind) => `kind:${kind}`),
         ],
     });
 }
 async function collectCodexJsonlFiles(options) {
-    const sessionsDir = options.sessionsDir ?? path.join(os.homedir(), ".codex", "sessions");
-    const cutoffMs = options.context.now.getTime() - options.sinceMinutes * 60 * 1000;
-    const files = (await walkJsonlFiles(sessionsDir, cutoffMs)).slice(0, options.limit);
+    const candidates = options.codexSessionFiles
+        ? options.codexSessionFiles.map((file) => ({
+            filePath: file.local_path,
+            codexSessionId: file.codex_session_id,
+        }))
+        : (await walkJsonlFiles(options.sessionsDir ?? path.join(os.homedir(), ".codex", "sessions"), options.context.now.getTime() - options.sinceMinutes * 60 * 1000))
+            .slice(0, options.limit)
+            .map((filePath) => ({ filePath, codexSessionId: null }));
     let index = 0;
-    for (const filePath of files) {
-        const fileName = path.basename(filePath);
+    for (const candidate of candidates) {
+        const fileName = path.basename(candidate.filePath);
         if (isSecretLikePath(fileName)) {
             options.skipped.push({
                 kind: "codex_jsonl",
@@ -172,7 +194,18 @@ async function collectCodexJsonlFiles(options) {
             });
             continue;
         }
-        const raw = await fs.readFile(filePath);
+        let raw;
+        try {
+            raw = await fs.readFile(candidate.filePath);
+        }
+        catch {
+            options.skipped.push({
+                kind: "codex_jsonl",
+                label: fileName,
+                reason: "file_read_failed",
+            });
+            continue;
+        }
         if (containsSecretLikeContent(raw.toString("utf8"))) {
             options.skipped.push({
                 kind: "codex_jsonl",
@@ -181,8 +214,19 @@ async function collectCodexJsonlFiles(options) {
             });
             continue;
         }
+        const contentHash = sha256(raw);
+        const codexSessionId = candidate.codexSessionId ?? shortHash(candidate.filePath);
+        if (options.skipContentHashes.has(contentHash)) {
+            options.reused.push({
+                kind: "codex_jsonl",
+                label: fileName,
+                content_hash_sha256: contentHash,
+                codex_session_id: codexSessionId,
+            });
+            continue;
+        }
         index += 1;
-        const relativePath = path.join("files", `${String(index).padStart(3, "0")}-${shortHash(filePath)}-${fileName}`);
+        const relativePath = path.join("files", `${String(index).padStart(3, "0")}-${shortHash(candidate.filePath)}-${fileName}`);
         const destination = path.join(options.filesDir, path.basename(relativePath));
         await fs.writeFile(destination, raw, { mode: 0o600 });
         await chmodPrivate(destination, 0o600);
@@ -196,6 +240,8 @@ async function collectCodexJsonlFiles(options) {
             mediaType: "application/jsonl",
             redactedSummary: "Raw Codex JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
             bytes: raw,
+            codexSessionId,
+            contentAddress: `codex/${safeKeySegment(codexSessionId)}/${contentHash.slice(0, 16)}.jsonl`,
         }));
     }
 }
@@ -217,6 +263,16 @@ async function collectGitDiffFiles(options) {
             continue;
         }
         const raw = Buffer.from(diff.slice(0, MAX_GIT_DIFF_BYTES), "utf8");
+        const contentHash = sha256(raw);
+        if (options.skipContentHashes.has(contentHash)) {
+            options.reused.push({
+                kind: "git_diff",
+                label: target.label,
+                content_hash_sha256: contentHash,
+                codex_session_id: null,
+            });
+            continue;
+        }
         const relativePath = path.join("files", `git-${target.label}.diff`);
         const destination = path.join(options.filesDir, path.basename(relativePath));
         await fs.writeFile(destination, raw, { mode: 0o600 });
@@ -231,6 +287,7 @@ async function collectGitDiffFiles(options) {
             mediaType: "text/x-diff",
             redactedSummary: `Raw git ${target.label} diff preserved locally with env/secret paths excluded.`,
             bytes: raw,
+            contentAddress: `git-diff/${target.label}-${contentHash.slice(0, 16)}.diff`,
         }));
     }
 }
@@ -308,6 +365,7 @@ function makeManifest(options) {
         },
         files: options.entries.map(redactManifestEntry),
         skipped: options.skipped,
+        reused: options.reused,
     };
 }
 function evidenceEntry(options) {
@@ -321,11 +379,13 @@ function evidenceEntry(options) {
             workContextId: options.workContextId,
             packId: options.packId,
             relativePath: options.relativePath,
+            contentAddress: options.contentAddress,
         }),
         content_hash_sha256: digest,
         byte_size: options.bytes.byteLength,
         media_type: options.mediaType,
         redacted_summary: options.redactedSummary,
+        codex_session_id: options.codexSessionId ?? null,
     };
 }
 function redactManifestEntry(entry) {
@@ -356,7 +416,20 @@ function pointerFromEntry(entry) {
         redacted_summary: entry.redacted_summary,
     };
 }
+/**
+ * Codex JSONL and git diff objects are content-addressed (kind/id/hash) so the
+ * same content maps to the same remote key across syncs: interrupted uploads
+ * resume and repeated syncs dedupe server-side. Pack-scoped keys remain for
+ * the per-sync manifest.
+ */
 function remoteObjectKey(options) {
+    if (options.contentAddress) {
+        return posixPath([
+            options.operatorId,
+            options.workContextId,
+            options.contentAddress,
+        ]);
+    }
     return posixPath([
         options.operatorId,
         options.workContextId,
@@ -378,6 +451,13 @@ function rawEvidencePackId(context) {
 function shortHash(value) {
     return crypto.createHash("sha256").update(value, "utf8").digest("hex").slice(0, 12);
 }
+/**
+ * Object keys must satisfy the server's key pattern; ids derived from file
+ * content fall back to a hash rather than failing the whole upload batch.
+ */
+function safeKeySegment(value) {
+    return /^[A-Za-z0-9._-]{1,80}$/.test(value) ? value : shortHash(value);
+}
 function sha256(value) {
     return crypto.createHash("sha256").update(value).digest("hex");
 }