@bli-cockpit/cli 0.1.9 → 0.1.12

package/dist/adapters/raw-evidence.js

@@ -6,6 +6,7 @@ import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 import { makeSourceAdapterIdentity, } from "./common.js";
+import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
 const execFileAsync = promisify(execFile);
 const DEFAULT_SINCE_MINUTES = 24 * 60;
 const DEFAULT_SESSION_LIMIT = 50;
@@ -127,6 +128,9 @@ export async function collectRawEvidencePack(context, options) {
                 local_path: entry.local_path,
                 kind: entry.kind,
                 codex_session_id: entry.codex_session_id ?? null,
+                ...(entry.artifact_metadata
+                    ? { artifact_metadata: entry.artifact_metadata }
+                    : {}),
             })),
             reused,
         };
@@ -197,7 +201,7 @@ async function collectCodexJsonlFiles(collection, options) {
             .map((filePath) => ({ filePath, codexSessionId: null }));
     for (const candidate of candidates) {
         const codexSessionId = candidate.codexSessionId ?? shortHash(candidate.filePath);
-        await collectOneEvidenceFile(collection, {
+        const transcriptAccepted = await collectOneEvidenceFile(collection, {
             filePath: candidate.filePath,
             kind: "codex_jsonl",
             sessionId: codexSessionId,
@@ -205,6 +209,15 @@ async function collectCodexJsonlFiles(collection, options) {
             redactedSummary: "Raw Codex JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
             contentAddress: (hash16) => `codex/${safeKeySegment(codexSessionId)}/${hash16}.jsonl`,
         });
+        if (transcriptAccepted) {
+            await collectAgentImagesFromTranscript(collection, {
+                filePath: candidate.filePath,
+                source: "codex",
+                sessionId: codexSessionId,
+                kind: "codex_image_attachment",
+                contentAddress: (hash16, extension) => `codex/${safeKeySegment(codexSessionId)}/images/${hash16}.${extension}`,
+            });
+        }
     }
 }
 async function collectClaudeJsonlFiles(collection, sessions) {
@@ -226,7 +239,7 @@ async function collectClaudeJsonlFiles(collection, sessions) {
             // skipped entry is recorded here.
         }
         else {
-            await collectOneEvidenceFile(collection, {
+            const mainAccepted = await collectOneEvidenceFile(collection, {
                 filePath: session.local_path,
                 kind: "claude_jsonl",
                 sessionId,
@@ -238,10 +251,28 @@ async function collectClaudeJsonlFiles(collection, sessions) {
                 redactedSummary: "Raw Claude Code JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
                 contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/${hash16}.jsonl`,
             });
+            if (mainAccepted) {
+                await collectAgentImagesFromTranscript(collection, {
+                    filePath: session.local_path,
+                    source: "claude_code",
+                    sessionId,
+                    kind: "claude_image_attachment",
+                    contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
+                });
+            }
+        }
+        if (session.skip_main && !session.main_file_oversized) {
+            await collectAgentImagesFromTranscript(collection, {
+                filePath: session.local_path,
+                source: "claude_code",
+                sessionId,
+                kind: "claude_image_attachment",
+                contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
+            });
         }
         for (const sidecar of session.sidecar_files) {
             const stem = path.basename(sidecar.local_path).replace(/\.jsonl$/i, "");
-            await collectOneEvidenceFile(collection, {
+            const sidecarAccepted = await collectOneEvidenceFile(collection, {
                 filePath: sidecar.local_path,
                 kind: "claude_jsonl_sidecar",
                 sessionId,
@@ -250,9 +281,89 @@ async function collectClaudeJsonlFiles(collection, sessions) {
                 redactedSummary: "Raw Claude Code subagent transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
                 contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/subagents/${safeKeySegment(stem)}-${hash16}.jsonl`,
             });
+            if (sidecarAccepted) {
+                await collectAgentImagesFromTranscript(collection, {
+                    filePath: sidecar.local_path,
+                    source: "claude_code",
+                    sessionId,
+                    sidecarId: stem,
+                    kind: "claude_image_attachment",
+                    contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/subagents/${safeKeySegment(stem)}/images/${hash16}.${extension}`,
+                });
+            }
         }
     }
 }
+async function collectAgentImagesFromTranscript(collection, options) {
+    const result = await collectAgentImageEvidenceFromJsonlFile({
+        filePath: options.filePath,
+        source: options.source,
+        sessionId: options.sessionId,
+        sidecarId: options.sidecarId,
+    });
+    for (const skipped of result.skipped) {
+        collection.skipped.push({
+            kind: options.kind,
+            label: skipped.label,
+            reason: skipped.reason,
+        });
+    }
+    for (const image of result.images) {
+        await collectOneAgentImageFile(collection, {
+            image,
+            kind: options.kind,
+            sessionId: options.sessionId,
+            contentAddress: options.contentAddress,
+        });
+    }
+}
+async function collectOneAgentImageFile(collection, options) {
+    const raw = options.image.bytes;
+    const contentHash = sha256(raw);
+    const metadata = {
+        ...options.image.metadata,
+        content_hash_sha256: contentHash,
+        byte_size: raw.byteLength,
+    };
+    if (collection.skipContentHashes.has(contentHash)) {
+        collection.reused.push({
+            kind: options.kind,
+            label: options.image.label,
+            content_hash_sha256: contentHash,
+            codex_session_id: options.sessionId,
+            artifact_metadata: metadata,
+        });
+        return;
+    }
+    const deferReason = admitToBudget(collection.budget, raw.byteLength);
+    if (deferReason) {
+        collection.skipped.push({
+            kind: options.kind,
+            label: options.image.label,
+            reason: deferReason,
+        });
+        return;
+    }
+    collection.index.value += 1;
+    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-agent-image-${contentHash.slice(0, 16)}.${options.image.extension}`);
+    const destination = path.join(collection.filesDir, path.basename(relativePath));
+    await fs.writeFile(destination, raw, { mode: 0o600 });
+    await chmodPrivate(destination, 0o600);
+    collection.entries.push(evidenceEntry({
+        kind: options.kind,
+        packId: collection.packId,
+        operatorId: collection.context.operatorId,
+        workContextId: collection.context.workContextId,
+        localPath: destination,
+        relativePath,
+        mediaType: metadata.media_type,
+        redactedSummary: "Raw image explicitly attached to an agent session, preserved in private durable storage.",
+        bytes: raw,
+        codexSessionId: options.sessionId,
+        contentAddress: options.contentAddress(contentHash.slice(0, 16), options.image.extension),
+        artifactMetadata: metadata,
+    }));
+}
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
  * attributed transcript into the pack. The secret guard runs again here even
@@ -268,7 +379,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: "secret_like_file_name",
         });
-        return;
+        return false;
     }
     let raw;
     try {
@@ -280,7 +391,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: "file_read_failed",
         });
-        return;
+        return false;
     }
     if (options.maxFileBytes && raw.byteLength > options.maxFileBytes) {
         collection.skipped.push({
@@ -288,7 +399,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: "file_too_large",
         });
-        return;
+        return false;
     }
     if (containsSecretLikeContent(raw.toString("utf8"))) {
         collection.skipped.push({
@@ -296,7 +407,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: "secret_like_content_guard",
         });
-        return;
+        return false;
     }
     const contentHash = sha256(raw);
     if (collection.skipContentHashes.has(contentHash)) {
@@ -306,7 +417,7 @@ async function collectOneEvidenceFile(collection, options) {
             content_hash_sha256: contentHash,
             codex_session_id: options.sessionId,
         });
-        return;
+        return true;
     }
     const deferReason = admitToBudget(collection.budget, raw.byteLength);
     if (deferReason) {
@@ -315,7 +426,7 @@ async function collectOneEvidenceFile(collection, options) {
             label: fileName,
             reason: deferReason,
         });
-        return;
+        return false;
     }
     collection.index.value += 1;
     const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-${shortHash(options.filePath)}-${fileName}`);
@@ -335,6 +446,7 @@ async function collectOneEvidenceFile(collection, options) {
         codexSessionId: options.sessionId,
         contentAddress: options.contentAddress(contentHash.slice(0, 16)),
     }));
+    return true;
 }
 /**
  * Decrements the per-sync budget when a file fits, or returns a deferred-skip
@@ -475,6 +587,7 @@ function makeManifest(options) {
             claude_transcripts: "preserved_private_durable_remote",
             tool_payloads: "preserved_private_durable_remote",
             git_diffs: "preserved_private_durable_remote_env_secret_paths_excluded",
+            agent_image_attachments: "preserved_private_durable_remote_explicit_agent_session_attachment_only",
             env_files: "never_read",
             stdout: "manifest_only_no_raw_content",
         },
@@ -485,22 +598,35 @@ function makeManifest(options) {
 }
 function evidenceEntry(options) {
     const digest = sha256(options.bytes);
+    const objectKey = remoteObjectKey({
+        operatorId: options.operatorId,
+        workContextId: options.workContextId,
+        packId: options.packId,
+        relativePath: options.relativePath,
+        contentAddress: options.contentAddress,
+    });
     return {
         kind: options.kind,
         local_path: options.localPath,
         relative_path: options.relativePath,
-        object_key: remoteObjectKey({
-            operatorId: options.operatorId,
-            workContextId: options.workContextId,
-            packId: options.packId,
-            relativePath: options.relativePath,
-            contentAddress: options.contentAddress,
-        }),
+        object_key: objectKey,
         content_hash_sha256: digest,
         byte_size: options.bytes.byteLength,
         media_type: options.mediaType,
         redacted_summary: options.redactedSummary,
         codex_session_id: options.codexSessionId ?? null,
+        ...(options.artifactMetadata
+            ? {
+                artifact_metadata: {
+                    ...options.artifactMetadata,
+                    raw_evidence_pointer_id: objectKey,
+                    storage_bucket: RAW_EVIDENCE_BUCKET,
+                    object_key: objectKey,
+                    content_hash_sha256: digest,
+                    byte_size: options.bytes.byteLength,
+                },
+            }
+            : {}),
     };
 }
 function redactManifestEntry(entry) {
@@ -512,6 +638,9 @@ function redactManifestEntry(entry) {
         byte_size: entry.byte_size,
         media_type: entry.media_type,
         redacted_summary: entry.redacted_summary,
+        ...(entry.artifact_metadata
+            ? { artifact_metadata: entry.artifact_metadata }
+            : {}),
     };
 }
 function pointerFromEntry(entry) {

package/dist/autostart.js

@@ -36,6 +36,10 @@ export async function installAutostartAgent(options) {
     const plistPath = plistPathFor(homeDir);
     const stdoutPath = path.join(paths.state_dir, "sync.log");
     const stderrPath = path.join(paths.state_dir, "sync.err.log");
+    // launchd will not reliably watch a path that does not exist at load time, so
+    // only feed it the transcript dirs that are present right now. A missing dir
+    // is fine — the StartInterval floor still covers it.
+    const watchPaths = await existingWatchPaths(homeDir);
     await mkdir(path.dirname(plistPath), { recursive: true });
     await mkdir(paths.state_dir, { recursive: true });
     await writeFile(plistPath, renderPlist({
@@ -44,6 +48,7 @@ export async function installAutostartAgent(options) {
         intervalSeconds,
         stdoutPath,
         stderrPath,
+        watchPaths,
     }), "utf8");
     // Unload first so a changed plist is actually picked up; a not-yet-loaded
     // agent makes unload fail harmlessly, so the error is ignored.
@@ -103,10 +108,30 @@ export async function autostartStatus(options) {
         plist_path: plistPath,
     };
 }
+/**
+ * The transcript directories whose changes should re-trigger a sync, in the
+ * order they appear in WatchPaths. Resolved from the same homeDir as the plist
+ * and log paths so `--home` redirects them together.
+ */
+function watchPathCandidates(homeDir) {
+    return [
+        path.join(homeDir, ".claude", "projects"),
+        path.join(homeDir, ".codex", "sessions"),
+    ];
+}
+/** Subset of the transcript dirs that exist now (see the WatchPaths comment). */
+async function existingWatchPaths(homeDir) {
+    const candidates = watchPathCandidates(homeDir);
+    const present = await Promise.all(candidates.map((dir) => fileExists(dir)));
+    return candidates.filter((_, i) => present[i]);
+}
 function renderPlist(options) {
     // The repo path is shell-quoted because it lands inside a `/bin/zsh -lc "…"`
     // command string; the whole command is then XML-escaped for the <string>.
-    const command = `npm exec --yes --package=@bli-cockpit/cli@latest -- cockpit sync --repo ${shellQuote(options.workDir)} --dashboard-url ${shellQuote(options.dashboardUrl)} --json`;
+    const dashboardArg = options.dashboardUrl === DEFAULT_DASHBOARD_URL
+        ? ""
+        : ` --dashboard-url ${shellQuote(options.dashboardUrl)}`;
+    const command = `cockpit sync --repo ${shellQuote(options.workDir)}${dashboardArg} --json`;
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
         '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -124,6 +149,12 @@ function renderPlist(options) {
         `  <integer>${options.intervalSeconds}</integer>`,
         "  <key>RunAtLoad</key>",
         "  <true/>",
+        // WatchPaths makes a transcript write fire `cockpit sync` within seconds, so
+        // captures land near-real-time; StartInterval above is the safety-net floor.
+        // It fires often, but launchd single-flights the job, sync holds its own
+        // lock, and growing-transcript re-upload is damped — so cost stays bounded
+        // and no extra debounce is needed.
+        ...watchPathsBlock(options.watchPaths),
         "  <key>EnvironmentVariables</key>",
         "  <dict>",
         "    <key>PATH</key>",
@@ -138,6 +169,21 @@ function renderPlist(options) {
         "",
     ].join("\n");
 }
+/**
+ * Renders the `<key>WatchPaths</key><array>…</array>` lines, or nothing when no
+ * transcript dir exists yet (an empty array would tell launchd to watch
+ * everything-and-nothing; omitting the key leaves StartInterval as the floor).
+ */
+function watchPathsBlock(watchPaths) {
+    if (watchPaths.length === 0)
+        return [];
+    return [
+        "  <key>WatchPaths</key>",
+        "  <array>",
+        ...watchPaths.map((dir) => `    <string>${xmlEscape(dir)}</string>`),
+        "  </array>",
+    ];
+}
 function shellQuote(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }