@bli-cockpit/cli 0.1.31 → 0.1.33

package/dist/adapters/attribution-core.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import path from "node:path";
+import { normalizeGitOrigin, repoFingerprintFromLocalRoot, repoFingerprintFromOrigin, repoLabelFromOrigin, stableWorktreeFingerprint, } from "../repo-identity.js";
 /**
  * Shared deterministic attribution core for agent session transcripts (Codex
  * and Claude Code). Both adapters extract source-shaped signals, normalize them
@@ -72,8 +73,21 @@ export function scoreSignalsAgainstWorktrees(signals, worktrees, options = {}) {
     const best = scored[0];
     const secondBestScore = scored[1]?.score ?? 0;
     if (!best || best.score === 0) {
-        if (repoPathAbsentFromDisk([...signals.cwds, ...signals.workspaceRoots], options.collectionRoots ?? [])) {
-            return skipped("repo_not_on_disk");
+        const recordedPaths = [...signals.cwds, ...signals.workspaceRoots];
+        if (repoPathAbsentFromDisk(recordedPaths, options.collectionRoots ?? [])) {
+            const folderFallback = fallbackToFolderWorkspaceForContainerCwd({
+                signals,
+                worktrees,
+            });
+            if (folderFallback)
+                return folderFallback;
+            const transcriptFallback = fallbackToTranscriptOriginForDeletedRepo({
+                originLabel,
+                signals,
+            });
+            if (transcriptFallback)
+                return transcriptFallback;
+            return skipped(terminalReasonForRecordedPaths(recordedPaths, options.pathExists));
         }
         const reason = signals.cwds.length > 0 || signals.workspaceRoots.length > 0
             ? "cwd_outside_scanned_worktrees"
@@ -135,6 +149,63 @@ function skipped(reason) {
         worktree: null,
     };
 }
+/**
+ * Handles sessions launched from wrapper folders that intentionally contain
+ * several repos. The wrapper path is the user's working context even though it
+ * is not itself a git repo, and the consent boundary is unchanged because this
+ * only runs after the recorded path was proven under an approved collection
+ * root.
+ */
+function fallbackToFolderWorkspaceForContainerCwd(options) {
+    const recordedPaths = [...options.signals.cwds, ...options.signals.workspaceRoots];
+    let bestFolder = null;
+    for (const recordedPath of recordedPaths) {
+        const resolvedPath = path.resolve(recordedPath);
+        const containedWorktrees = options.worktrees.filter((worktree) => isPathStrictlyWithin(worktree.repo_root, resolvedPath));
+        if (containedWorktrees.length === 0)
+            continue;
+        const depth = pathDepth(resolvedPath);
+        if (!bestFolder || depth > bestFolder.depth) {
+            bestFolder = { resolvedPath, depth, containedWorktrees };
+        }
+    }
+    if (!bestFolder)
+        return null;
+    const repoFingerprints = new Set(bestFolder.containedWorktrees.map((worktree) => worktree.repo_fingerprint));
+    if (repoFingerprints.size === 1) {
+        const primary = sortWorktreesForFolderFallback(bestFolder.containedWorktrees)[0];
+        if (!primary)
+            return null;
+        return {
+            state: "attributed_fallback",
+            reason: "single_repo_folder_fallback",
+            signals: ["single_repo_folder_fallback"],
+            attribution_score: clampScore(Math.min(SCORE_CWD_MATCH, ATTRIBUTED_FALLBACK_MAX_SCORE)),
+            path_score: 0,
+            worktree: primary,
+        };
+    }
+    const repoLabel = path.basename(bestFolder.resolvedPath);
+    return {
+        state: "attributed_fallback",
+        reason: "multi_repo_folder_workspace",
+        signals: ["multi_repo_folder_workspace"],
+        attribution_score: clampScore(ATTRIBUTED_FALLBACK_MAX_SCORE),
+        path_score: 0,
+        worktree: {
+            requested_path: bestFolder.resolvedPath,
+            repo_root: bestFolder.resolvedPath,
+            repo_label: repoLabel,
+            repo_fingerprint: repoFingerprintFromLocalRoot(bestFolder.resolvedPath),
+            repo_origin_url: null,
+            branch: options.signals.branches[0] ?? "unknown",
+            head_sha: options.signals.headShas[0] ?? null,
+            worktree_label: repoLabel,
+            worktree_fingerprint: stableWorktreeFingerprint(bestFolder.resolvedPath),
+            worktree_is_primary: true,
+        },
+    };
+}
 function fallbackToKnownRepoPrimaryWorkContext(options) {
     const originCandidates = options.worktrees.filter((worktree) => worktree.repo_origin_url &&
         options.signals.originUrls.includes(worktree.repo_origin_url));
@@ -173,6 +244,66 @@ function fallbackToKnownRepoPrimaryWorkContext(options) {
         worktree: primary,
     };
 }
+/**
+ * Reconstructs a repo/worktree identity from transcript origin metadata only
+ * after the caller has already proven a recorded cwd/workspace root sits under
+ * an operator-approved collection root. The origin is never allowed to widen
+ * consent by itself: it only rescues sessions for repos that were once inside
+ * the approved scan boundary but have since been deleted from disk, where the
+ * transcript is still durable enough to carry the normalized remote identity.
+ */
+function fallbackToTranscriptOriginForDeletedRepo(options) {
+    const origins = [
+        ...new Set(options.signals.originUrls
+            .map((origin) => normalizeGitOrigin(origin))
+            .filter(Boolean)),
+    ];
+    if (origins.length === 0)
+        return null;
+    if (origins.length > 1)
+        return skipped("multiple_transcript_origins");
+    const recordedPath = options.signals.workspaceRoots[0] ?? options.signals.cwds[0] ?? null;
+    if (!recordedPath)
+        return null;
+    const resolvedPath = path.resolve(recordedPath);
+    const origin = origins[0] ?? "";
+    return {
+        state: "attributed_fallback",
+        reason: "transcript_origin_fallback",
+        signals: ["transcript_origin_fallback", options.originLabel],
+        attribution_score: clampScore(SCORE_ORIGIN_MATCH),
+        path_score: 0,
+        worktree: {
+            requested_path: resolvedPath,
+            repo_root: resolvedPath,
+            repo_label: repoLabelFromOrigin(origin),
+            repo_fingerprint: repoFingerprintFromOrigin(origin),
+            repo_origin_url: origin,
+            branch: options.signals.branches[0] ?? "unknown",
+            head_sha: options.signals.headShas[0] ?? null,
+            worktree_label: path.basename(resolvedPath),
+            worktree_fingerprint: stableWorktreeFingerprint(resolvedPath),
+            worktree_is_primary: false,
+        },
+    };
+}
+function terminalReasonForRecordedPaths(paths, pathExists) {
+    // A recorded path under a collection root can mean two different things:
+    // deleted/missing repo (retryable) or an existing non-repo folder. The latter
+    // is common with wrapper-folder workflows, so adapters inject existence only
+    // at the boundary and the pure scorer keeps the old label when no hook exists.
+    if (!pathExists)
+        return "repo_not_on_disk";
+    const anyRecordedPathExists = paths.some((value) => {
+        try {
+            return pathExists(value);
+        }
+        catch {
+            return false;
+        }
+    });
+    return anyRecordedPathExists ? "cwd_not_a_repo" : "repo_not_on_disk";
+}
 /**
  * For each path signal, the single worktree whose root most specifically
  * contains it (the longest containing root). Returns the set of worktree
@@ -204,12 +335,26 @@ export function isPathWithin(candidate, root) {
     return (normalizedCandidate === normalizedRoot ||
         normalizedCandidate.startsWith(normalizedRoot + path.sep));
 }
+function isPathStrictlyWithin(candidate, root) {
+    const normalizedCandidate = path.resolve(candidate);
+    const normalizedRoot = path.resolve(root);
+    return (normalizedCandidate !== normalizedRoot &&
+        normalizedCandidate.startsWith(normalizedRoot + path.sep));
+}
 function repoPathAbsentFromDisk(paths, collectionRoots) {
     if (paths.length === 0 || collectionRoots.length === 0)
         return false;
     const roots = collectionRoots.map((root) => path.resolve(root));
     return paths.some((value) => roots.some((root) => isPathWithin(value, root)));
 }
+function sortWorktreesForFolderFallback(worktrees) {
+    return [...worktrees].sort((a, b) => Number(b.worktree_is_primary) - Number(a.worktree_is_primary) ||
+        path.resolve(a.repo_root).localeCompare(path.resolve(b.repo_root)) ||
+        a.worktree_fingerprint.localeCompare(b.worktree_fingerprint));
+}
+function pathDepth(value) {
+    return path.resolve(value).split(path.sep).filter(Boolean).length;
+}
 export function clampScore(value) {
     return Math.min(1, Math.max(0, Number(value.toFixed(4))));
 }

package/dist/adapters/claude-attribution.js

@@ -1,7 +1,7 @@
 import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, SECRET_FILE_SEGMENT_PATTERN, containsSecretLikeContent, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
-import { createReadStream } from "node:fs";
+import { createReadStream, existsSync } from "node:fs";
 import path from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { SESSION_FILE_UUID_PATTERN, isPathWithin, sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
@@ -304,7 +304,7 @@ async function attributeOneSession(session, worktrees, collectionRoots) {
         originUrls: signals.repository_urls,
         branches: signals.branches,
         headShas: [],
-    }, worktrees, { collectionRoots, originLabel: "pr_repo_match" });
+    }, worktrees, { collectionRoots, originLabel: "pr_repo_match", pathExists: existsSync });
     const extraSignals = [];
     if (base.main_file_oversized)
         extraSignals.push("main_file_oversized");

package/dist/adapters/codex-attribution.js

@@ -1,5 +1,5 @@
 import { SECRET_FILE_SEGMENT_PATTERN, } from "@bli-cockpit/telemetry-core";
-import { createReadStream } from "node:fs";
+import { createReadStream, existsSync } from "node:fs";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -201,7 +201,7 @@ async function attributeOneSession(file, worktrees, collectionRoots) {
         originUrls: signals.repository_urls,
         branches: signals.branches,
         headShas: signals.commit_hashes,
-    }, worktrees, { collectionRoots });
+    }, worktrees, { collectionRoots, pathExists: existsSync });
     return { ...base, ...outcome };
 }
 async function readCodexMetadataSignals(filePath) {

package/dist/commands/backfill.js

@@ -566,6 +566,30 @@ function reasonClassification(reason) {
             note: "repo must exist on disk",
         };
     }
+    if (reason === "cwd_not_a_repo") {
+        return {
+            classification: "permanent",
+            note: "cwd exists but is not a repo or folder workspace",
+        };
+    }
+    if (reason === "multiple_transcript_origins") {
+        return {
+            classification: "permanent",
+            note: "multiple transcript origins; attribution is ambiguous",
+        };
+    }
+    if (reason === "single_repo_folder_fallback") {
+        return {
+            classification: "permanent",
+            note: "uploadable single-repo folder workspace fallback",
+        };
+    }
+    if (reason === "multi_repo_folder_workspace") {
+        return {
+            classification: "permanent",
+            note: "uploadable multi-repo folder workspace fallback",
+        };
+    }
     if (reason.startsWith("deferred_")) {
         return {
             classification: "retryable",

package/dist/repo-identity.js

@@ -32,10 +32,9 @@ export async function resolveRepoWorktreeIdentity(repoRoot) {
     const repoLabel = repoOriginUrl
         ? repoLabelFromOrigin(repoOriginUrl)
         : path.basename(resolvedRoot);
-    const repoMaterial = repoOriginUrl
-        ? `origin:${repoOriginUrl}`
-        : `local:${sha256(commonGitDir ?? resolvedRoot)}`;
-    const repoFingerprint = `repo-${sha256(repoMaterial).slice(0, 24)}`;
+    const repoFingerprint = repoOriginUrl
+        ? repoFingerprintFromOrigin(repoOriginUrl)
+        : `repo-${sha256(`local:${sha256(commonGitDir ?? resolvedRoot)}`).slice(0, 24)}`;
     const gitFilePath = path.join(resolvedRoot, ".git");
     const worktreeIsPrimary = await fs.stat(gitFilePath).then((stat) => stat.isDirectory(), () => false);
     return {
@@ -141,7 +140,7 @@ async function hasGitMarker(dir) {
 async function fallbackFilesystemIdentity(repoRoot) {
     const resolvedRoot = await stableWorktreeRoot(repoRoot);
     const repoLabel = path.basename(resolvedRoot) || "repo";
-    const repoFingerprint = `repo-${sha256(`local:${resolvedRoot}`).slice(0, 24)}`;
+    const repoFingerprint = repoFingerprintFromLocalRoot(resolvedRoot);
     return {
         requested_path: resolvedRoot,
         repo_root: resolvedRoot,
@@ -162,6 +161,13 @@ export async function stableWorktreeRoot(repoRoot) {
 export function stableWorktreeFingerprint(repoRoot) {
     return `wt-${sha256(`worktree:${normalizeFingerprintPath(repoRoot)}`).slice(0, 24)}`;
 }
+export function repoFingerprintFromLocalRoot(root) {
+    return `repo-${sha256(`local:${path.resolve(root)}`).slice(0, 24)}`;
+}
+export function repoFingerprintFromOrigin(origin) {
+    const normalizedOrigin = normalizeGitOrigin(origin);
+    return `repo-${sha256(`origin:${normalizedOrigin}`).slice(0, 24)}`;
+}
 async function resolveBranchFromHead(repoRoot) {
     try {
         const gitPath = path.join(repoRoot, ".git");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "private": false,
   "type": "module",
   "bin": {