@bli-cockpit/cli 0.1.25 → 0.1.27

package/README.md

@@ -191,6 +191,10 @@ Remote dashboard:
   for screenshots/images explicitly attached into Codex or Claude sessions;
 - Codex session attribution records (session id, file hash, attribution state
   and reason labels, scores) accepted by `/api/ambient/codex-sessions`.
+  The local collector scans both active `~/.codex/sessions` files and archived
+  `~/.codex/archived_sessions` files, using only `session_meta` and
+  `turn_context` metadata for attribution. Transcript bytes are sanitized or
+  blocked later by raw evidence collection before upload.
 
 New raw evidence object keys are readable from the Storage browser:
 
@@ -212,6 +216,9 @@ Local attribution preview:
 cockpit sessions --workspace "$PWD" --json
 ```
 
+This preview includes both active and archived Codex sessions in the bounded
+backfill window, plus Claude Code sessions when Claude collection is enabled.
+
 Remote metadata path:
 
 1. Query `ambient_evidence_refs` by `operator_user_id`, `received_at`, and

package/dist/adapters/codex-attribution.js

@@ -1,8 +1,11 @@
-import { SECRET_FILE_SEGMENT_PATTERN, containsSecretLikeContent, } from "@bli-cockpit/telemetry-core";
+import { SECRET_FILE_SEGMENT_PATTERN, } from "@bli-cockpit/telemetry-core";
+import { createReadStream } from "node:fs";
+import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { normalizeGitOrigin } from "../repo-identity.js";
-import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, sha256, shortHash, } from "./attribution-core.js";
+import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
 /**
  * Deterministic Codex session JSONL -> repo/worktree attribution.
  *
@@ -18,12 +21,24 @@ import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName,
 export { sanitizeSessionId, sessionIdFromFileName };
 export const CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES = 24 * 60;
 export const CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT = 50;
+export const CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES = 14 * 24 * 60;
+export const CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT = 500;
+// Compatibility export only. Codex attribution streams full files for metadata
+// and no longer rejects sessions by file size; raw evidence collection enforces
+// upload budgets and content guards later.
 export const CODEX_SESSION_MAX_FILE_BYTES = 10 * 1024 * 1024;
+const CODEX_ATTRIBUTION_MAX_LINE_BYTES = 2 * 1024 * 1024;
+export function defaultCodexSessionDirs(homeDir) {
+    return [
+        path.join(homeDir, ".codex", "sessions"),
+        path.join(homeDir, ".codex", "archived_sessions"),
+    ];
+}
 export async function scanAndAttributeCodexSessions(options) {
     const sinceMinutes = options.sinceMinutes ?? CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES;
     const limit = options.limit ?? CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT;
     const cutoffMs = options.now.getTime() - sinceMinutes * 60 * 1000;
-    const discovery = await discoverCodexJsonlFiles(options.sessionsDir, cutoffMs);
+    const discovery = await discoverCodexJsonlFiles(codexSessionDirsFromOptions(options), cutoffMs);
     const files = discovery.files.slice(0, limit);
     const results = [];
     for (const file of files) {
@@ -36,7 +51,7 @@ export async function scanAndAttributeCodexSessions(options) {
         since_minutes: sinceMinutes,
         session_limit: limit,
         session_limit_applied: discovery.files.length > limit,
-        max_file_bytes: CODEX_SESSION_MAX_FILE_BYTES,
+        max_file_bytes: 0,
         directory_read_failed_count: discovery.directoryReadFailedCount,
         stat_failed_count: discovery.statFailedCount,
         secret_path_skipped_count: discovery.secretPathSkippedCount,
@@ -57,7 +72,8 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
     let directoryReadFailedCount = 0;
     let statFailedCount = 0;
     let secretPathSkippedCount = 0;
-    const stack = [dir];
+    const stack = Array.isArray(dir) ? [...dir] : [dir];
+    const seenFiles = new Set();
     while (stack.length > 0) {
         const current = stack.pop();
         if (!current)
@@ -100,7 +116,11 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
                 continue;
             }
             if (stat.mtimeMs >= cutoffMs) {
-                out.push({ file: full, mtimeMs: stat.mtimeMs, byteSize: stat.size });
+                const dedupeKey = await fs.realpath(full).catch(() => path.resolve(full));
+                if (!seenFiles.has(dedupeKey)) {
+                    seenFiles.add(dedupeKey);
+                    out.push({ file: full, mtimeMs: stat.mtimeMs, byteSize: stat.size });
+                }
             }
         }
     }
@@ -112,6 +132,22 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
         secretPathSkippedCount,
     };
 }
+function codexSessionDirsFromOptions(options) {
+    const dirs = options.sessionsDirs ?? (options.sessionsDir ? [options.sessionsDir] : []);
+    return dedupePaths(dirs);
+}
+function dedupePaths(values) {
+    const seen = new Set();
+    const out = [];
+    for (const value of values) {
+        const resolved = path.resolve(value);
+        if (seen.has(resolved))
+            continue;
+        seen.add(resolved);
+        out.push(resolved);
+    }
+    return out;
+}
 async function attributeOneSession(file, worktrees) {
     const fileName = path.basename(file.file);
     const base = {
@@ -128,23 +164,16 @@ async function attributeOneSession(file, worktrees) {
     if (isSecretLikePath(fileName)) {
         return skippedResult(base, "secret_like_file_name");
     }
-    if (file.byteSize > CODEX_SESSION_MAX_FILE_BYTES) {
-        return skippedResult(base, "file_too_large");
-    }
-    let raw;
+    let read;
     try {
-        raw = await fs.readFile(file.file);
+        read = await readCodexMetadataSignals(file.file);
     }
     catch {
         return skippedResult(base, "file_read_failed");
     }
-    const content = raw.toString("utf8");
-    base.content_hash_sha256 = sha256(raw);
-    base.byte_size = raw.byteLength;
-    if (containsSecretLikeContent(content)) {
-        return skippedResult(base, "secret_like_content_guard");
-    }
-    const signals = extractCodexSessionSignals(content);
+    base.content_hash_sha256 = read.contentHashSha256;
+    base.byte_size = read.byteSize;
+    const signals = read.signals;
     const metaSessionId = sanitizeSessionId(signals.session_ids[0]);
     if (metaSessionId) {
         base.codex_session_id = metaSessionId;
@@ -174,72 +203,132 @@ async function attributeOneSession(file, worktrees) {
     }, worktrees);
     return { ...base, ...outcome };
 }
+async function readCodexMetadataSignals(filePath) {
+    const hash = crypto.createHash("sha256");
+    const decoder = new StringDecoder("utf8");
+    const state = makeSignalExtractionState();
+    const stream = createReadStream(filePath);
+    let byteSize = 0;
+    let lineBuffer = "";
+    let discardingOversizedLine = false;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        byteSize += buffer.byteLength;
+        hash.update(buffer);
+        const text = decoder.write(buffer);
+        const segments = text.split("\n");
+        for (let index = 0; index < segments.length; index += 1) {
+            const segment = segments[index] ?? "";
+            const lineEnded = index < segments.length - 1;
+            if (discardingOversizedLine) {
+                if (lineEnded)
+                    discardingOversizedLine = false;
+                continue;
+            }
+            lineBuffer += segment;
+            if (Buffer.byteLength(lineBuffer, "utf8") > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
+                state.lineCount += 1;
+                state.parseErrorCount += 1;
+                lineBuffer = "";
+                discardingOversizedLine = !lineEnded;
+                continue;
+            }
+            if (lineEnded) {
+                absorbCodexSessionLine(state, lineBuffer);
+                lineBuffer = "";
+            }
+        }
+    }
+    const rest = decoder.end();
+    if (rest)
+        lineBuffer += rest;
+    if (lineBuffer.trim())
+        absorbCodexSessionLine(state, lineBuffer);
+    return {
+        signals: codexSignalsFromState(state),
+        contentHashSha256: hash.digest("hex"),
+        byteSize,
+    };
+}
 export function extractCodexSessionSignals(content) {
-    const sessionIds = new Set();
-    const cwds = new Set();
-    const workspaceRoots = new Set();
-    const branches = new Set();
-    const commitHashes = new Set();
-    const repositoryUrls = new Set();
-    let lineCount = 0;
-    let parseErrorCount = 0;
+    const state = makeSignalExtractionState();
     for (const line of content.split("\n")) {
-        if (!line.trim())
-            continue;
-        lineCount += 1;
-        let record;
-        try {
-            record = JSON.parse(line);
-        }
-        catch {
-            parseErrorCount += 1;
-            continue;
-        }
-        if (!record || typeof record !== "object")
-            continue;
-        const type = record.type;
-        const payload = record.payload;
-        if (!payload || typeof payload !== "object")
-            continue;
-        const payloadRecord = payload;
-        if (type === "session_meta") {
-            addString(sessionIds, payloadRecord["id"]);
-            addString(cwds, payloadRecord["cwd"]);
-            const git = payloadRecord["git"];
-            if (git && typeof git === "object") {
-                const gitRecord = git;
-                addString(branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
-                addString(commitHashes, gitRecord["commit_hash"]);
-                const repositoryUrl = gitRecord["repository_url"];
-                if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
-                    repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
-                }
+        absorbCodexSessionLine(state, line);
+    }
+    return codexSignalsFromState(state);
+}
+function makeSignalExtractionState() {
+    return {
+        sessionIds: new Set(),
+        cwds: new Set(),
+        workspaceRoots: new Set(),
+        branches: new Set(),
+        commitHashes: new Set(),
+        repositoryUrls: new Set(),
+        lineCount: 0,
+        parseErrorCount: 0,
+    };
+}
+function absorbCodexSessionLine(state, line) {
+    if (!line.trim())
+        return;
+    state.lineCount += 1;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        state.parseErrorCount += 1;
+        return;
+    }
+    if (!record || typeof record !== "object")
+        return;
+    const type = record.type;
+    if (type !== "session_meta" && type !== "turn_context")
+        return;
+    const payload = record.payload;
+    if (!payload || typeof payload !== "object")
+        return;
+    const payloadRecord = payload;
+    if (type === "session_meta") {
+        addString(state.sessionIds, payloadRecord["id"]);
+        addString(state.cwds, payloadRecord["cwd"]);
+        const git = payloadRecord["git"];
+        if (git && typeof git === "object") {
+            const gitRecord = git;
+            addString(state.branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
+            addString(state.commitHashes, gitRecord["commit_hash"]);
+            const repositoryUrl = gitRecord["repository_url"];
+            if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
+                state.repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
             }
         }
-        else if (type === "turn_context") {
-            addString(cwds, payloadRecord["cwd"]);
-            const roots = payloadRecord["workspace_roots"];
-            if (Array.isArray(roots)) {
-                for (const root of roots) {
-                    if (typeof root === "string") {
-                        addString(workspaceRoots, root);
-                    }
-                    else if (root && typeof root === "object") {
-                        addString(workspaceRoots, root["path"]);
-                    }
+    }
+    else if (type === "turn_context") {
+        addString(state.cwds, payloadRecord["cwd"]);
+        const roots = payloadRecord["workspace_roots"];
+        if (Array.isArray(roots)) {
+            for (const root of roots) {
+                if (typeof root === "string") {
+                    addString(state.workspaceRoots, root);
+                }
+                else if (root && typeof root === "object") {
+                    addString(state.workspaceRoots, root["path"]);
                 }
             }
         }
     }
+}
+function codexSignalsFromState(state) {
     return {
-        session_ids: [...sessionIds],
-        cwds: [...cwds],
-        workspace_roots: [...workspaceRoots],
-        branches: [...branches],
-        commit_hashes: [...commitHashes],
-        repository_urls: [...repositoryUrls],
-        line_count: lineCount,
-        parse_error_count: parseErrorCount,
+        session_ids: [...state.sessionIds],
+        cwds: [...state.cwds],
+        workspace_roots: [...state.workspaceRoots],
+        branches: [...state.branches],
+        commit_hashes: [...state.commitHashes],
+        repository_urls: [...state.repositoryUrls],
+        line_count: state.lineCount,
+        parse_error_count: state.parseErrorCount,
     };
 }
 function skippedResult(base, reason) {

package/dist/adapters/local-sources.js

@@ -25,6 +25,7 @@ export async function runLocalSourceCollectors(options) {
             stateDir: options.rawEvidenceStateDir,
             repoRoot: options.repoRoot,
             sessionsDir: options.rawEvidenceSessionsDir,
+            sessionsDirs: options.rawEvidenceSessionsDirs,
             includeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
             includeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
             codexSessionFiles: options.rawEvidenceCodexSessionFiles,

package/dist/adapters/raw-evidence.js

@@ -6,6 +6,7 @@ import os from "node:os";
 import path from "node:path";
 import { makeSourceAdapterIdentity, } from "./common.js";
 import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
+import { defaultCodexSessionDirs, } from "./codex-attribution.js";
 const DEFAULT_SINCE_MINUTES = 24 * 60;
 const DEFAULT_SESSION_LIMIT = 50;
 const MAX_GIT_DIFF_BYTES = 2 * 1024 * 1024;
@@ -104,6 +105,7 @@ export async function collectRawEvidencePack(context, options) {
             await collectCodexJsonlFiles(collection, {
                 codexSessionFiles: options.codexSessionFiles,
                 sessionsDir: options.sessionsDir,
+                sessionsDirs: options.sessionsDirs,
                 sinceMinutes,
                 limit: sessionLimit,
             });
@@ -311,11 +313,6 @@ function recordCodexAttributionCompleteness(collection, scan) {
         limit: scan.session_limit,
         observed: scan.discovered_file_count,
         applied: scan.session_limit_applied,
-    }, {
-        source: "codex_attribution",
-        cap_type: "max_file_bytes",
-        limit: scan.max_file_bytes,
-        applied: scan.results.some((result) => result.reason === "file_too_large"),
     });
     recordSkipCount(collection, "codex_attribution", "session_limit_overflow", Math.max(0, scan.discovered_file_count - scan.scanned_file_count));
     recordSkipCount(collection, "codex_attribution", "directory_read_failed", scan.directory_read_failed_count);
@@ -391,7 +388,10 @@ async function collectCodexJsonlFiles(collection, options) {
             filePath: file.local_path,
             codexSessionId: file.codex_session_id,
         }))
-        : (await walkJsonlFiles(options.sessionsDir ?? path.join(os.homedir(), ".codex", "sessions"), collection.context.now.getTime() - options.sinceMinutes * 60 * 1000))
+        : (await walkJsonlFiles(options.sessionsDirs ??
+            (options.sessionsDir
+                ? [options.sessionsDir]
+                : defaultCodexSessionDirs(os.homedir())), collection.context.now.getTime() - options.sinceMinutes * 60 * 1000))
             .map((filePath) => ({ filePath, codexSessionId: null }));
     collection.caps.push({
         source: "codex_jsonl",
@@ -573,10 +573,9 @@ async function collectOneAgentImageFile(collection, options) {
 }
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
- * attributed transcript into the pack. The secret guard runs again here even
- * though attribution already guarded — three reads per file (attribution,
- * collection, server commit) is the accepted defense-in-depth cost; do not
- * "optimize" a layer away.
+ * attributed transcript into the pack. Attribution only reads metadata records;
+ * this collection layer and the server commit layer are the two content guards
+ * that decide whether transcript bytes can become durable evidence.
  */
 async function collectOneEvidenceFile(collection, options) {
     const fileName = path.basename(options.filePath);
@@ -1075,7 +1074,8 @@ function makeEvidenceCompleteness(collection, options) {
 }
 async function walkJsonlFiles(dir, cutoffMs) {
     const out = [];
-    const stack = [dir];
+    const stack = Array.isArray(dir) ? [...dir] : [dir];
+    const seen = new Set();
     while (stack.length > 0) {
         const current = stack.pop();
         if (!current || isSecretLikePath(current))
@@ -1098,8 +1098,13 @@ async function walkJsonlFiles(dir, cutoffMs) {
             if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
                 continue;
             const stat = await fs.stat(full);
-            if (stat.mtimeMs >= cutoffMs)
-                out.push({ file: full, mtimeMs: stat.mtimeMs });
+            if (stat.mtimeMs >= cutoffMs) {
+                const dedupeKey = await fs.realpath(full).catch(() => path.resolve(full));
+                if (!seen.has(dedupeKey)) {
+                    seen.add(dedupeKey);
+                    out.push({ file: full, mtimeMs: stat.mtimeMs });
+                }
+            }
         }
     }
     out.sort((a, b) => b.mtimeMs - a.mtimeMs);

package/dist/commands/local.js

@@ -6,7 +6,7 @@ import { inspectAgentRules, installAgentRules, uninstallAgentRules, } from "../a
 import { parseLocalArgs, normalizeUrl } from "./local-args.js";
 import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext, } from "../local-state.js";
-import { scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
+import { CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT, CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
 import { acquireSyncLock } from "../sync-lock.js";
 import { discoverGitWorktrees } from "../repo-identity.js";
@@ -1143,9 +1143,11 @@ async function runSessions(command, io) {
     const wantClaude = command.source !== "codex";
     const codex = wantCodex
         ? await scanAndAttributeCodexSessions({
-            sessionsDir: path.join(homeDir, ".codex", "sessions"),
+            sessionsDirs: defaultCodexSessionDirs(homeDir),
             worktrees,
             now,
+            sinceMinutes: CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES,
+            limit: CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT,
         })
         : null;
     const claude = wantClaude

package/dist/commands/session-sync.js

@@ -7,7 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { getCollectorRuntimePaths, startLocalWorkContext, readLocalCollectorConfig } from "../local-state.js";
 import { LocalUploadBlockedError, postCodexSessionReport, syncLocalAmbientEnvelope } from "../upload.js";
-import { scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
+import { CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT, CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
 import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET } from "../adapters/raw-evidence.js";
 import { CLAUDE_CURSOR_FILENAME, countStaleSessions, emptyRawEvidenceCursorState, readRawEvidenceCursor, recordSessionObservation, writeRawEvidenceCursor } from "../cursors/raw-evidence-cursor.js";
@@ -30,9 +30,11 @@ export async function runAttributedWorktreeSync(options) {
     const paths = getCollectorRuntimePaths(options.homeDir);
     const claudeEnabled = await isClaudeCollectionEnabled(paths);
     const codexAttribution = await scanAndAttributeCodexSessions({
-        sessionsDir: path.join(homeDir, ".codex", "sessions"),
+        sessionsDirs: defaultCodexSessionDirs(homeDir),
         worktrees: options.worktrees,
         now,
+        sinceMinutes: CODEX_ATTRIBUTION_BACKFILL_SINCE_MINUTES,
+        limit: CODEX_ATTRIBUTION_BACKFILL_SESSION_LIMIT,
     });
     // First run (D B.4 §8): without a Claude cursor yet, widen the window to 14
     // days so the first sync captures retroactive history instead of only 24h.

package/dist/local-state.js

@@ -5,6 +5,7 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { resolveRepoWorktreeIdentity, } from "./repo-identity.js";
+import { normalizeCollectionRoots } from "./root-normalization.js";
 import { summarizeLocalUploadSpool } from "./spool/local-spool.js";
 const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 export const LOCAL_COLLECTOR_VERSION = typeof localCollectorPackage.version === "string"
@@ -26,10 +27,10 @@ export async function installLocalCollector(options = {}) {
     const paths = getCollectorRuntimePaths(homeDir);
     await ensureRuntimeDirectories(paths);
     const existingConfig = await readLocalCollectorConfig(paths).catch(() => null);
-    const defaultRepoPaths = new Set(options.replaceRepoRoots ? [] : (existingConfig?.default_repo_paths ?? []));
-    for (const root of repoRoots.length > 0 ? repoRoots : [repoRoot]) {
-        defaultRepoPaths.add(root);
-    }
+    const defaultRepoPaths = normalizeRepoRoots([
+        ...(options.replaceRepoRoots ? [] : (existingConfig?.default_repo_paths ?? [])),
+        ...(repoRoots.length > 0 ? repoRoots : [repoRoot]),
+    ]);
     const rawEvidenceUpload = existingConfig?.raw_evidence_upload === "disabled" ||
         existingConfig?.raw_evidence_upload === "remote_short_retention_opt_in"
         ? "remote_durable_opt_in"
@@ -45,7 +46,7 @@ export async function installLocalCollector(options = {}) {
             defaultDeviceName(),
         claimed_owner_email: existingConfig?.claimed_owner_email,
         operator_id: existingConfig?.operator_id,
-        default_repo_paths: [...defaultRepoPaths],
+        default_repo_paths: defaultRepoPaths,
         raw_evidence_upload: rawEvidenceUpload,
         session_file_path: paths.session_file,
         state_dir_path: paths.state_dir,
@@ -62,15 +63,15 @@ function normalizeRepoRoots(repoRoots) {
     if (!repoRoots)
         return [];
     const seen = new Set();
-    const normalized = [];
+    const candidates = [];
     for (const root of repoRoots) {
         const resolved = path.resolve(root);
         if (seen.has(resolved))
             continue;
         seen.add(resolved);
-        normalized.push(resolved);
+        candidates.push(resolved);
     }
-    return normalized;
+    return normalizeCollectionRoots(candidates);
 }
 export async function pairLocalCollector(options = {}) {
     const homeDir = options.homeDir ?? os.homedir();

package/dist/onboarding-roots.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { normalizeCollectionRoots } from "./root-normalization.js";
 export const COLLECTION_ROOT_REQUIRED = "collection_root_required";
 export async function resolveOnboardingRoots(options) {
     const explicitRoots = normalizeRoots(options.explicitRoots ?? []);
@@ -43,7 +44,7 @@ export async function resolveOnboardingRoots(options) {
 }
 export function normalizeRoots(roots) {
     const seen = new Set();
-    const normalized = [];
+    const candidates = [];
     for (const root of roots) {
         const trimmed = root.trim();
         if (!trimmed)
@@ -57,10 +58,10 @@ export function normalizeRoots(roots) {
             if (seen.has(resolved))
                 continue;
             seen.add(resolved);
-            normalized.push(resolved);
+            candidates.push(resolved);
         }
     }
-    return normalized;
+    return normalizeCollectionRoots(candidates);
 }
 function splitRootInput(value) {
     return value

package/dist/root-normalization.js

@@ -0,0 +1,34 @@
+import path from "node:path";
+export function collapseAncestorRoots(roots) {
+    const collapsed = [];
+    for (const root of roots) {
+        const resolved = path.resolve(root);
+        if (collapsed.some((existing) => containsPath(existing, resolved)))
+            continue;
+        for (let index = collapsed.length - 1; index >= 0; index -= 1) {
+            if (containsPath(resolved, collapsed[index])) {
+                collapsed.splice(index, 1);
+            }
+        }
+        collapsed.push(resolved);
+    }
+    return collapsed;
+}
+export function normalizeCollectionRoots(roots) {
+    const collapsed = collapseAncestorRoots(roots);
+    if (!collapsed.some(isBliWorkspaceRoot))
+        return collapsed;
+    return collapsed.filter((root) => !isCodexWorktreePath(root));
+}
+function containsPath(parent, candidate) {
+    const relative = path.relative(parent, candidate);
+    return (relative === "" ||
+        (!!relative && !relative.startsWith("..") && !path.isAbsolute(relative)));
+}
+function isBliWorkspaceRoot(root) {
+    return path.basename(root) === "BLI";
+}
+function isCodexWorktreePath(root) {
+    const parts = root.split(path.sep).filter(Boolean);
+    return parts.some((part, index) => part === ".codex" && parts[index + 1] === "worktrees");
+}

package/dist/upload.js

@@ -2,6 +2,7 @@ import { AgentImageArtifactReportRequestSchema, EvidenceCompletenessPayloadSchem
 import path from "node:path";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, readLocalWorkContextForRepo, } from "./local-state.js";
 import { runLocalSourceCollectors } from "./adapters/local-sources.js";
+import { defaultCodexSessionDirs, } from "./adapters/codex-attribution.js";
 import { uploadRawEvidenceFilesChunked, } from "./evidence-upload-client.js";
 import { markObjectCommitted, readRawEvidenceCursor, writeRawEvidenceCursor, } from "./cursors/raw-evidence-cursor.js";
 import { recordUploadBlocked, recordUploadFailure, recordUploadSuccess, } from "./spool/local-spool.js";
@@ -57,7 +58,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
         workContextId: uploadContext.work_context_id,
         activeWorkContext: activeContext,
         rawEvidenceStateDir: paths.state_dir,
-        rawEvidenceSessionsDir: path.join(paths.home_dir, ".codex", "sessions"),
+        rawEvidenceSessionsDirs: defaultCodexSessionDirs(paths.home_dir),
         claudeProjectsDir: path.join(paths.home_dir, ".claude", "projects"),
         rawEvidenceIncludeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
         rawEvidenceIncludeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "private": false,
   "type": "module",
   "bin": {