@bli-cockpit/cli 0.1.8 → 0.1.11

package/README.md

@@ -4,8 +4,9 @@ Public BLI Cockpit command-line interface for approved operators and interns.
 
 The npm package is public; the Cockpit backend and admin tooling are not. The
 CLI pairs a local laptop with the private Cockpit dashboard, records safe
-work context, uploads consented raw Codex/diff evidence to durable private
-storage, and uploads metadata refs after dashboard-approved
+work context, uploads consented raw Codex/Claude/diff evidence and explicit
+images attached into agent sessions to durable private storage, and uploads
+metadata refs after dashboard-approved
 device pairing.
 
 ## One-paste install
@@ -109,11 +110,14 @@ Remote dashboard:
 - durable private Storage objects accepted by the chunked
   `/api/ambient/evidence/upload/begin|chunk|commit` endpoints, tracked in a
   durable per-object upload ledger;
+- attached image artifact metadata accepted by `/api/ambient/agent-artifacts`
+  for screenshots/images explicitly attached into Codex or Claude sessions;
 - Codex session attribution records (session id, file hash, attribution state
   and reason labels, scores) accepted by `/api/ambient/codex-sessions`.
 
 Never provide Supabase service-role keys, raw DB URLs, root env files, cookies,
-or deployment tokens to this CLI. The collector must never read env files.
+or deployment tokens to this CLI. The collector must never read env files and
+does not collect random desktop screenshots or screen recordings.
 
 ## Public package boundary
 

package/dist/adapters/agent-image-evidence.js

@@ -0,0 +1,97 @@
+import { SECRET_FILE_SEGMENT_PATTERN } from "@bli-cockpit/telemetry-core";
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { AGENT_IMAGE_MAX_BYTES, validateAgentImageBytes, } from "./agent-image-validation.js";
+import { imageCandidatesFromRecord, } from "./agent-image-records.js";
+export async function collectAgentImageEvidenceFromJsonlFile(options) {
+    const stat = await fs.stat(options.filePath).catch(() => null);
+    if (!stat?.isFile())
+        return { images: [], skipped: [] };
+    if (stat.size > AGENT_IMAGE_MAX_BYTES) {
+        return {
+            images: [],
+            skipped: [{ label: "transcript", reason: "file_too_large" }],
+        };
+    }
+    const content = await fs.readFile(options.filePath, "utf8").catch(() => null);
+    if (content === null)
+        return { images: [], skipped: [] };
+    const images = [];
+    const skipped = [];
+    let lineIndex = 0;
+    for (const line of content.split("\n")) {
+        if (!line.trim())
+            continue;
+        lineIndex += 1;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        for (const candidate of imageCandidatesFromRecord(record, {
+            source: options.source,
+            sessionId: options.sessionId,
+            sidecarId: options.sidecarId,
+            fallbackOccurredAt: new Date(stat.mtimeMs).toISOString(),
+            lineIndex,
+        })) {
+            const result = await loadCandidate(candidate, path.dirname(options.filePath));
+            if ("reason" in result) {
+                skipped.push({ label: candidate.label, reason: result.reason });
+            }
+            else {
+                images.push(result);
+            }
+        }
+    }
+    return { images, skipped };
+}
+async function loadCandidate(candidate, transcriptDir) {
+    let bytes;
+    if (candidate.dataValue) {
+        bytes = Buffer.from(candidate.dataValue, "base64");
+    }
+    else if (candidate.pathValue) {
+        const imagePath = path.isAbsolute(candidate.pathValue)
+            ? candidate.pathValue
+            : path.resolve(transcriptDir, candidate.pathValue);
+        if (SECRET_FILE_SEGMENT_PATTERN.test(imagePath)) {
+            return { reason: "secret_like_file_name" };
+        }
+        bytes = await fs.readFile(imagePath).catch(() => Buffer.alloc(0));
+        if (bytes.byteLength === 0)
+            return { reason: "file_read_failed" };
+    }
+    else {
+        return { reason: "missing_image_bytes" };
+    }
+    const validation = validateAgentImageBytes(bytes, candidate.declaredMediaType);
+    if ("reason" in validation)
+        return validation;
+    return {
+        bytes,
+        extension: validation.extension,
+        label: candidate.label,
+        metadata: {
+            agent_source: candidate.source,
+            source_session_id: candidate.sessionId,
+            ...(candidate.sourceMessageId ? { source_message_id: candidate.sourceMessageId } : {}),
+            ...(candidate.sidecarId ? { source_sidecar_id: candidate.sidecarId } : {}),
+            ...(candidate.turnIndex !== undefined ? { turn_index: candidate.turnIndex } : {}),
+            occurred_at: candidate.occurredAt,
+            artifact_kind: candidate.artifactKind,
+            capture_origin: "agent_session_attachment",
+            width: validation.width,
+            height: validation.height,
+            media_type: validation.mediaType,
+            content_hash_sha256: sha256(bytes),
+            byte_size: bytes.byteLength,
+        },
+    };
+}
+function sha256(value) {
+    return crypto.createHash("sha256").update(value).digest("hex");
+}

package/dist/adapters/agent-image-records.js

@@ -0,0 +1,147 @@
+export function imageCandidatesFromRecord(record, context) {
+    if (!isRecord(record))
+        return [];
+    const payload = recordOf(record["payload"]);
+    const message = recordOf(record["message"]) ?? recordOf(payload?.["message"]);
+    const sourceMessageId = stringFrom(record, ["id", "message_id", "messageId", "uuid"]) ??
+        stringFrom(payload, ["id", "message_id", "messageId", "uuid"]);
+    const turnIndex = numberFrom(record, ["turn_index", "turnIndex"]) ??
+        numberFrom(payload, ["turn_index", "turnIndex"]);
+    const occurredAt = isoFrom(stringFrom(record, ["timestamp", "created_at", "createdAt", "time"]) ??
+        stringFrom(payload, ["timestamp", "created_at", "createdAt", "time"])) ?? context.fallbackOccurredAt;
+    const candidates = [];
+    const base = {
+        source: context.source,
+        sessionId: context.sessionId,
+        sidecarId: context.sidecarId,
+        sourceMessageId,
+        turnIndex,
+        occurredAt,
+        lineIndex: context.lineIndex,
+    };
+    for (const value of explicitAttachmentObjects(record, payload, message)) {
+        const candidate = candidateFromObject(value, base, true);
+        if (candidate)
+            candidates.push(candidate);
+    }
+    for (const value of explicitImageBlocks(record, payload, message)) {
+        const candidate = candidateFromObject(value, base, false);
+        if (candidate)
+            candidates.push(candidate);
+    }
+    return candidates;
+}
+function explicitAttachmentObjects(record, payload, message) {
+    const out = [];
+    if (isAttachmentRecord(record))
+        out.push(record);
+    if (payload && isAttachmentRecord(payload))
+        out.push(payload);
+    for (const holder of [record, payload, message]) {
+        if (!holder)
+            continue;
+        const single = holder["attachment"];
+        if (isRecord(single))
+            out.push(single);
+        const attachments = holder["attachments"];
+        if (Array.isArray(attachments))
+            out.push(...attachments);
+    }
+    return out;
+}
+function explicitImageBlocks(record, payload, message) {
+    const out = [];
+    for (const holder of [record, payload, message]) {
+        const content = holder?.["content"];
+        if (Array.isArray(content))
+            out.push(...content.filter((value) => isRecord(value)));
+    }
+    return out;
+}
+function candidateFromObject(value, base, attachmentEnvelope) {
+    if (!isRecord(value))
+        return null;
+    const nestedSource = recordOf(value["source"]);
+    const imageUrl = recordOf(value["image_url"]);
+    const typeValue = stringFrom(value, ["type", "kind", "artifact_kind"]);
+    const declaredMediaType = stringFrom(value, ["media_type", "mime_type", "mimeType"]) ??
+        stringFrom(nestedSource, ["media_type", "mime_type", "mimeType"]);
+    const parsedDataUrl = parseDataUrl(stringFrom(imageUrl, ["url"]));
+    const pathValue = stringFrom(value, ["path", "local_path", "file_path", "filePath"]) ??
+        stringFrom(nestedSource, ["path", "local_path", "file_path", "filePath"]);
+    const dataValue = parsedDataUrl?.data ??
+        stringFrom(value, ["data_base64", "base64", "content_base64", "data"]) ??
+        stringFrom(nestedSource, ["data_base64", "base64", "content_base64", "data"]);
+    const mediaType = parsedDataUrl?.mediaType ?? declaredMediaType;
+    if (!pathValue && !dataValue)
+        return null;
+    if (!attachmentEnvelope && !isImageBlockType(typeValue))
+        return null;
+    if (attachmentEnvelope && !isImageish(typeValue, mediaType))
+        return null;
+    const objectId = stringFrom(value, ["id", "attachment_id", "attachmentId", "uuid"]);
+    return {
+        source: base.source,
+        sessionId: base.sessionId,
+        sidecarId: base.sidecarId,
+        sourceMessageId: objectId ?? base.sourceMessageId,
+        turnIndex: base.turnIndex,
+        occurredAt: base.occurredAt,
+        artifactKind: isScreenshot(typeValue) ? "screenshot" : "image_attachment",
+        declaredMediaType: mediaType,
+        pathValue,
+        dataValue,
+        label: objectId ?? base.sourceMessageId ?? `line-${base.lineIndex}`,
+    };
+}
+function parseDataUrl(value) {
+    const match = value?.match(/^data:([^;,]+);base64,(.+)$/i);
+    return match ? { mediaType: match[1] ?? "", data: match[2] ?? "" } : null;
+}
+function isAttachmentRecord(value) {
+    return ["attachment", "image_attachment", "screenshot"].includes(String(value["type"] ?? "").toLowerCase());
+}
+function isImageBlockType(value) {
+    return ["image", "input_image", "image_attachment", "screenshot"].includes(value?.toLowerCase() ?? "");
+}
+function isImageish(typeValue, mediaType) {
+    return isImageBlockType(typeValue) || Boolean(normalizeMediaType(mediaType));
+}
+function isScreenshot(typeValue) {
+    return typeValue?.toLowerCase().includes("screenshot") ?? false;
+}
+function normalizeMediaType(value) {
+    return ["image/png", "image/jpeg", "image/jpg"].includes(value?.trim().toLowerCase() ?? "");
+}
+function isoFrom(value) {
+    if (!value)
+        return null;
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+function stringFrom(record, keys) {
+    if (!record)
+        return undefined;
+    for (const key of keys) {
+        const value = record[key];
+        if (typeof value === "string" && value.trim())
+            return value.trim();
+    }
+    return undefined;
+}
+function numberFrom(record, keys) {
+    if (!record)
+        return undefined;
+    for (const key of keys) {
+        const value = record[key];
+        if (Number.isInteger(value))
+            return value;
+    }
+    return undefined;
+}
+function recordOf(value) {
+    return isRecord(value) ? value : undefined;
+}
+function isRecord(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}

package/dist/adapters/agent-image-validation.js

@@ -0,0 +1,88 @@
+export const AGENT_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+export const AGENT_IMAGE_MAX_DIMENSION_PX = 16_384;
+export const AGENT_IMAGE_MAX_PIXELS = 50_000_000;
+export function validateAgentImageBytes(bytes, declaredMediaType) {
+    if (bytes.byteLength > AGENT_IMAGE_MAX_BYTES)
+        return { reason: "file_too_large" };
+    if (declaredMediaType && !normalizeMediaType(declaredMediaType)) {
+        return { reason: "unsupported_media_type" };
+    }
+    const detected = detectImage(bytes);
+    if (!detected)
+        return { reason: "invalid_image_magic" };
+    if (detected.width <= 0 ||
+        detected.height <= 0 ||
+        detected.width > AGENT_IMAGE_MAX_DIMENSION_PX ||
+        detected.height > AGENT_IMAGE_MAX_DIMENSION_PX ||
+        detected.width * detected.height > AGENT_IMAGE_MAX_PIXELS) {
+        return { reason: "image_pixel_limit_exceeded" };
+    }
+    return {
+        ...detected,
+        extension: detected.mediaType === "image/png" ? "png" : "jpg",
+    };
+}
+function detectImage(bytes) {
+    const png = parsePngDimensions(bytes);
+    if (png)
+        return { mediaType: "image/png", ...png };
+    const jpeg = parseJpegDimensions(bytes);
+    if (jpeg)
+        return { mediaType: "image/jpeg", ...jpeg };
+    return null;
+}
+function parsePngDimensions(bytes) {
+    const signature = "89504e470d0a1a0a";
+    if (bytes.byteLength < 24 || bytes.subarray(0, 8).toString("hex") !== signature) {
+        return null;
+    }
+    if (bytes.subarray(12, 16).toString("ascii") !== "IHDR")
+        return null;
+    return { width: bytes.readUInt32BE(16), height: bytes.readUInt32BE(20) };
+}
+function parseJpegDimensions(bytes) {
+    if (bytes.byteLength < 4 || bytes[0] !== 0xff || bytes[1] !== 0xd8)
+        return null;
+    let offset = 2;
+    while (offset + 3 < bytes.byteLength) {
+        while (offset < bytes.byteLength && bytes[offset] === 0xff)
+            offset += 1;
+        if (offset + 2 > bytes.byteLength)
+            return null;
+        const marker = bytes[offset];
+        if (marker === undefined)
+            return null;
+        offset += 1;
+        if (marker === 0xd9 || marker === 0xda)
+            break;
+        if (marker !== undefined && marker >= 0xd0 && marker <= 0xd7)
+            continue;
+        if (offset + 2 > bytes.byteLength)
+            return null;
+        const length = bytes.readUInt16BE(offset);
+        if (length < 2 || offset + length > bytes.byteLength)
+            return null;
+        if (isJpegSofMarker(marker) && offset + 7 <= bytes.byteLength) {
+            return {
+                height: bytes.readUInt16BE(offset + 3),
+                width: bytes.readUInt16BE(offset + 5),
+            };
+        }
+        offset += length;
+    }
+    return null;
+}
+function isJpegSofMarker(marker) {
+    return (marker !== undefined &&
+        marker >= 0xc0 &&
+        marker <= 0xcf &&
+        ![0xc4, 0xc8, 0xcc].includes(marker));
+}
+function normalizeMediaType(value) {
+    const normalized = value?.trim().toLowerCase();
+    if (normalized === "image/png")
+        return "image/png";
+    if (normalized === "image/jpeg" || normalized === "image/jpg")
+        return "image/jpeg";
+    return null;
+}

package/dist/adapters/raw-evidence.js

@@ -6,6 +6,7 @@ import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 import { makeSourceAdapterIdentity, } from "./common.js";
+import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
 const execFileAsync = promisify(execFile);
 const DEFAULT_SINCE_MINUTES = 24 * 60;
 const DEFAULT_SESSION_LIMIT = 50;
@@ -127,6 +128,9 @@ export async function collectRawEvidencePack(context, options) {
                 local_path: entry.local_path,
                 kind: entry.kind,
                 codex_session_id: entry.codex_session_id ?? null,
+                ...(entry.artifact_metadata
+                    ? { artifact_metadata: entry.artifact_metadata }
+                    : {}),
             })),
             reused,
         };
@@ -197,7 +201,7 @@ async function collectCodexJsonlFiles(collection, options) {
             .map((filePath) => ({ filePath, codexSessionId: null }));
     for (const candidate of candidates) {
         const codexSessionId = candidate.codexSessionId ?? shortHash(candidate.filePath);
-        await collectOneEvidenceFile(collection, {
+        const transcriptAccepted = await collectOneEvidenceFile(collection, {
             filePath: candidate.filePath,
             kind: "codex_jsonl",
             sessionId: codexSessionId,
@@ -205,6 +209,15 @@ async function collectCodexJsonlFiles(collection, options) {
             redactedSummary: "Raw Codex JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
             contentAddress: (hash16) => `codex/${safeKeySegment(codexSessionId)}/${hash16}.jsonl`,
         });
+        if (transcriptAccepted) {
+            await collectAgentImagesFromTranscript(collection, {
+                filePath: candidate.filePath,
+                source: "codex",
+                sessionId: codexSessionId,
+                kind: "codex_image_attachment",
+                contentAddress: (hash16, extension) => `codex/${safeKeySegment(codexSessionId)}/images/${hash16}.${extension}`,
+            });
+        }
     }
 }
 async function collectClaudeJsonlFiles(collection, sessions) {
@@ -226,7 +239,7 @@ async function collectClaudeJsonlFiles(collection, sessions) {
             // skipped entry is recorded here.
         }
         else {
-            await collectOneEvidenceFile(collection, {
+            const mainAccepted = await collectOneEvidenceFile(collection, {
                 filePath: session.local_path,
                 kind: "claude_jsonl",
                 sessionId,
@@ -238,10 +251,28 @@ async function collectClaudeJsonlFiles(collection, sessions) {
                 redactedSummary: "Raw Claude Code JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
                 contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/${hash16}.jsonl`,
             });
+            if (mainAccepted) {
+                await collectAgentImagesFromTranscript(collection, {
+                    filePath: session.local_path,
+                    source: "claude_code",
+                    sessionId,
+                    kind: "claude_image_attachment",
+                    contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
+                });
+            }
+        }
+        if (session.skip_main && !session.main_file_oversized) {
+            await collectAgentImagesFromTranscript(collection, {
+                filePath: session.local_path,
+                source: "claude_code",
+                sessionId,
+                kind: "claude_image_attachment",
+                contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
+            });
         }
         for (const sidecar of session.sidecar_files) {
             const stem = path.basename(sidecar.local_path).replace(/\.jsonl$/i, "");
-            await collectOneEvidenceFile(collection, {
+            const sidecarAccepted = await collectOneEvidenceFile(collection, {
                 filePath: sidecar.local_path,
                 kind: "claude_jsonl_sidecar",
                 sessionId,
@@ -250,9 +281,89 @@ async function collectClaudeJsonlFiles(collection, sessions) {
                 redactedSummary: "Raw Claude Code subagent transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
                 contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/subagents/${safeKeySegment(stem)}-${hash16}.jsonl`,
             });
+            if (sidecarAccepted) {
+                await collectAgentImagesFromTranscript(collection, {
+                    filePath: sidecar.local_path,
+                    source: "claude_code",
+                    sessionId,
+                    sidecarId: stem,
+                    kind: "claude_image_attachment",
+                    contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/subagents/${safeKeySegment(stem)}/images/${hash16}.${extension}`,
+                });
+            }
         }
     }
 }
+async function collectAgentImagesFromTranscript(collection, options) {
+    const result = await collectAgentImageEvidenceFromJsonlFile({
+        filePath: options.filePath,
+        source: options.source,
+        sessionId: options.sessionId,
+        sidecarId: options.sidecarId,
+    });
+    for (const skipped of result.skipped) {
+        collection.skipped.push({
+            kind: options.kind,
+            label: skipped.label,
+            reason: skipped.reason,
+        });
+    }
+    for (const image of result.images) {
+        await collectOneAgentImageFile(collection, {
+            image,
+            kind: options.kind,
+            sessionId: options.sessionId,
+            contentAddress: options.contentAddress,
+        });
+    }
+}
+async function collectOneAgentImageFile(collection, options) {
+    const raw = options.image.bytes;
+    const contentHash = sha256(raw);
+    const metadata = {
+        ...options.image.metadata,
+        content_hash_sha256: contentHash,
+        byte_size: raw.byteLength,
+    };
+    if (collection.skipContentHashes.has(contentHash)) {
+        collection.reused.push({
+            kind: options.kind,
+            label: options.image.label,
+            content_hash_sha256: contentHash,
+            codex_session_id: options.sessionId,
+            artifact_metadata: metadata,
+        });
+        return;
+    }
+    const deferReason = admitToBudget(collection.budget, raw.byteLength);
+    if (deferReason) {
+        collection.skipped.push({
+            kind: options.kind,
+            label: options.image.label,
+            reason: deferReason,
+        });
+        return;
+    }
+    collection.index.value += 1;
+    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-agent-image-${contentHash.slice(0, 16)}.${options.image.extension}`);
+    const destination = path.join(collection.filesDir, path.basename(relativePath));
+    await fs.writeFile(destination, raw, { mode: 0o600 });
+    await chmodPrivate(destination, 0o600);
+    collection.entries.push(evidenceEntry({
+        kind: options.kind,
+        packId: collection.packId,
+        operatorId: collection.context.operatorId,
+        workContextId: collection.context.workContextId,
+        localPath: destination,
+        relativePath,
+        mediaType: metadata.media_type,
+        redactedSummary: "Raw image explicitly attached to an agent session, preserved in private durable storage.",
+        bytes: raw,
+        codexSessionId: options.sessionId,
+        contentAddress: options.contentAddress(contentHash.slice(0, 16), options.image.extension),
+        artifactMetadata: metadata,
+    }));
+}
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
  * attributed transcript into the pack. The secret guard runs again here even
@@ -268,7 +379,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: "secret_like_file_name",
         });
-        return;
+        return false;
     }
     let raw;
     try {
@@ -280,7 +391,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: "file_read_failed",
         });
-        return;
+        return false;
     }
     if (options.maxFileBytes && raw.byteLength > options.maxFileBytes) {
         collection.skipped.push({
@@ -288,7 +399,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: "file_too_large",
         });
-        return;
+        return false;
     }
     if (containsSecretLikeContent(raw.toString("utf8"))) {
         collection.skipped.push({
@@ -296,7 +407,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: "secret_like_content_guard",
         });
-        return;
+        return false;
     }
     const contentHash = sha256(raw);
     if (collection.skipContentHashes.has(contentHash)) {
@@ -306,7 +417,7 @@ async function collectOneEvidenceFile(collection, options) {
             content_hash_sha256: contentHash,
             codex_session_id: options.sessionId,
         });
-        return;
+        return true;
     }
     const deferReason = admitToBudget(collection.budget, raw.byteLength);
     if (deferReason) {
@@ -315,7 +426,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: deferReason,
         });
-        return;
+        return false;
     }
     collection.index.value += 1;
     const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-${shortHash(options.filePath)}-${fileName}`);
@@ -335,6 +446,7 @@ async function collectOneEvidenceFile(collection, options) {
         codexSessionId: options.sessionId,
         contentAddress: options.contentAddress(contentHash.slice(0, 16)),
     }));
+    return true;
 }
 /**
  * Decrements the per-sync budget when a file fits, or returns a deferred-skip
@@ -475,6 +587,7 @@ function makeManifest(options) {
             claude_transcripts: "preserved_private_durable_remote",
             tool_payloads: "preserved_private_durable_remote",
             git_diffs: "preserved_private_durable_remote_env_secret_paths_excluded",
+            agent_image_attachments: "preserved_private_durable_remote_explicit_agent_session_attachment_only",
             env_files: "never_read",
             stdout: "manifest_only_no_raw_content",
         },
@@ -485,22 +598,35 @@ function makeManifest(options) {
 }
 function evidenceEntry(options) {
     const digest = sha256(options.bytes);
+    const objectKey = remoteObjectKey({
+        operatorId: options.operatorId,
+        workContextId: options.workContextId,
+        packId: options.packId,
+        relativePath: options.relativePath,
+        contentAddress: options.contentAddress,
+    });
     return {
         kind: options.kind,
         local_path: options.localPath,
         relative_path: options.relativePath,
-        object_key: remoteObjectKey({
-            operatorId: options.operatorId,
-            workContextId: options.workContextId,
-            packId: options.packId,
-            relativePath: options.relativePath,
-            contentAddress: options.contentAddress,
-        }),
+        object_key: objectKey,
         content_hash_sha256: digest,
         byte_size: options.bytes.byteLength,
         media_type: options.mediaType,
         redacted_summary: options.redactedSummary,
         codex_session_id: options.codexSessionId ?? null,
+        ...(options.artifactMetadata
+            ? {
+                artifact_metadata: {
+                    ...options.artifactMetadata,
+                    raw_evidence_pointer_id: objectKey,
+                    storage_bucket: RAW_EVIDENCE_BUCKET,
+                    object_key: objectKey,
+                    content_hash_sha256: digest,
+                    byte_size: options.bytes.byteLength,
+                },
+            }
+            : {}),
     };
 }
 function redactManifestEntry(entry) {
@@ -512,6 +638,9 @@ function redactManifestEntry(entry) {
         byte_size: entry.byte_size,
         media_type: entry.media_type,
         redacted_summary: entry.redacted_summary,
+        ...(entry.artifact_metadata
+            ? { artifact_metadata: entry.artifact_metadata }
+            : {}),
     };
 }
 function pointerFromEntry(entry) {