@bli-cockpit/cli 0.2.111 → 0.2.113

package/dist/adapters/codex-attribution.js

@@ -1,10 +1,8 @@
-import { createReadStream, existsSync } from "node:fs";
-import crypto from "node:crypto";
+import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { StringDecoder } from "node:string_decoder";
-import { normalizeGitOrigin } from "../repo-identity.js";
 import { describeError } from "../health-detail.js";
+import { extractCodexSessionSignals, readCodexMetadataSignals, } from "./codex-session-signals.js";
 import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
 /**
  * Deterministic Codex session JSONL -> repo/worktree attribution.
@@ -17,8 +15,10 @@ import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName,
  * attribute identically.
  */
 // Re-exported for callers (and tests) that historically imported these from
-// the codex adapter; the single implementation lives in attribution-core.
+// the codex adapter; the single implementation lives in attribution-core, and
+// the signal reading in codex-session-signals.
 export { sanitizeSessionId, sessionIdFromFileName };
+export { extractCodexSessionSignals };
 export const CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES = 24 * 60;
 export const CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT = 50;
 export const CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES = 14 * 24 * 60;
@@ -27,7 +27,6 @@ export const CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT = 500;
 // and no longer rejects sessions by file size; raw evidence collection enforces
 // upload budgets and content guards later.
 export const CODEX_SESSION_MAX_FILE_BYTES = 10 * 1024 * 1024;
-const CODEX_ATTRIBUTION_MAX_LINE_BYTES = 2 * 1024 * 1024;
 export function defaultCodexSessionDirs(homeDir) {
     return [
         path.join(homeDir, ".codex", "sessions"),
@@ -223,139 +222,6 @@ async function attributeOneSession(file, worktrees, collectionRoots) {
     }, worktrees, { collectionRoots, pathExists: existsSync });
     return { ...base, ...outcome };
 }
-async function readCodexMetadataSignals(filePath) {
-    const hash = crypto.createHash("sha256");
-    const decoder = new StringDecoder("utf8");
-    const state = makeSignalExtractionState();
-    const stream = createReadStream(filePath);
-    let byteSize = 0;
-    let lineBuffer = "";
-    let discardingOversizedLine = false;
-    for await (const chunk of stream) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        byteSize += buffer.byteLength;
-        hash.update(buffer);
-        const text = decoder.write(buffer);
-        const segments = text.split("\n");
-        for (let index = 0; index < segments.length; index += 1) {
-            const segment = segments[index] ?? "";
-            const lineEnded = index < segments.length - 1;
-            if (discardingOversizedLine) {
-                if (lineEnded)
-                    discardingOversizedLine = false;
-                continue;
-            }
-            lineBuffer += segment;
-            if (Buffer.byteLength(lineBuffer, "utf8") > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
-                state.lineCount += 1;
-                state.parseErrorCount += 1;
-                lineBuffer = "";
-                discardingOversizedLine = !lineEnded;
-                continue;
-            }
-            if (lineEnded) {
-                absorbCodexSessionLine(state, lineBuffer);
-                lineBuffer = "";
-            }
-        }
-    }
-    const rest = decoder.end();
-    if (rest)
-        lineBuffer += rest;
-    if (lineBuffer.trim())
-        absorbCodexSessionLine(state, lineBuffer);
-    return {
-        signals: codexSignalsFromState(state),
-        contentHashSha256: hash.digest("hex"),
-        byteSize,
-    };
-}
-export function extractCodexSessionSignals(content) {
-    const state = makeSignalExtractionState();
-    for (const line of content.split("\n")) {
-        absorbCodexSessionLine(state, line);
-    }
-    return codexSignalsFromState(state);
-}
-function makeSignalExtractionState() {
-    return {
-        sessionIds: new Set(),
-        cwds: new Set(),
-        workspaceRoots: new Set(),
-        branches: new Set(),
-        commitHashes: new Set(),
-        repositoryUrls: new Set(),
-        lineCount: 0,
-        parseErrorCount: 0,
-    };
-}
-function absorbCodexSessionLine(state, line) {
-    if (!line.trim())
-        return;
-    state.lineCount += 1;
-    let record;
-    try {
-        record = JSON.parse(line);
-    }
-    catch {
-        // Deliberately silent (BLI-3238). Per LINE, in files with hundreds of
-        // thousands of them, and the last line of a live session is routinely
-        // half-written — this is expected, not a failure. The count travels in
-        // `parseErrorCount` on the scan result, which is the right grain, and the
-        // error object would carry a fragment of the transcript.
-        state.parseErrorCount += 1;
-        return;
-    }
-    if (!record || typeof record !== "object")
-        return;
-    const type = record.type;
-    if (type !== "session_meta" && type !== "turn_context")
-        return;
-    const payload = record.payload;
-    if (!payload || typeof payload !== "object")
-        return;
-    const payloadRecord = payload;
-    if (type === "session_meta") {
-        addString(state.sessionIds, payloadRecord["id"]);
-        addString(state.cwds, payloadRecord["cwd"]);
-        const git = payloadRecord["git"];
-        if (git && typeof git === "object") {
-            const gitRecord = git;
-            addString(state.branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
-            addString(state.commitHashes, gitRecord["commit_hash"]);
-            const repositoryUrl = gitRecord["repository_url"];
-            if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
-                state.repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
-            }
-        }
-    }
-    else if (type === "turn_context") {
-        addString(state.cwds, payloadRecord["cwd"]);
-        const roots = payloadRecord["workspace_roots"];
-        if (Array.isArray(roots)) {
-            for (const root of roots) {
-                if (typeof root === "string") {
-                    addString(state.workspaceRoots, root);
-                }
-                else if (root && typeof root === "object") {
-                    addString(state.workspaceRoots, root["path"]);
-                }
-            }
-        }
-    }
-}
-function codexSignalsFromState(state) {
-    return {
-        session_ids: [...state.sessionIds],
-        cwds: [...state.cwds],
-        workspace_roots: [...state.workspaceRoots],
-        branches: [...state.branches],
-        commit_hashes: [...state.commitHashes],
-        repository_urls: [...state.repositoryUrls],
-        line_count: state.lineCount,
-        parse_error_count: state.parseErrorCount,
-    };
-}
 function skippedResult(base, reason) {
     return {
         ...base,
@@ -366,8 +232,4 @@ function skippedResult(base, reason) {
         path_score: 0,
         worktree: null,
     };
-}
-function addString(target, value) {
-    if (typeof value === "string" && value.trim())
-        target.add(value.trim());
 }

package/dist/adapters/codex-session-signals.js

@@ -0,0 +1,161 @@
+/**
+ * What a Codex session file says about WHERE it ran, and nothing else.
+ *
+ * Only metadata-bearing records are inspected (session_meta, turn_context):
+ * cwd, workspace roots, and git branch/commit/origin. Prompt, response,
+ * reasoning and tool payload fields are never extracted, printed or
+ * summarized. Split out of codex-attribution.ts so the file that DECIDES a
+ * session's repo reads as the decision, and this one as the reading.
+ *
+ * Two doors, same extraction: `readCodexMetadataSignals` streams a file off
+ * disk (sessions run to hundreds of megabytes, so the file is never held in
+ * memory and its sha256 is taken on the way past), and
+ * `extractCodexSessionSignals` takes content already in hand.
+ */
+import { createReadStream } from "node:fs";
+import crypto from "node:crypto";
+import { StringDecoder } from "node:string_decoder";
+import { normalizeGitOrigin } from "../repo-identity.js";
+/** A line this long is not a session record; it is counted as a parse error and dropped. */
+const CODEX_ATTRIBUTION_MAX_LINE_BYTES = 2 * 1024 * 1024;
+/**
+ * One session file, streamed: the metadata signals, the sha256 of every byte
+ * that went past, and the size the walk should believe.
+ */
+export async function readCodexMetadataSignals(filePath) {
+    const hash = crypto.createHash("sha256");
+    const decoder = new StringDecoder("utf8");
+    const state = makeSignalExtractionState();
+    const stream = createReadStream(filePath);
+    let byteSize = 0;
+    let lineBuffer = "";
+    let discardingOversizedLine = false;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        byteSize += buffer.byteLength;
+        hash.update(buffer);
+        const text = decoder.write(buffer);
+        const segments = text.split("\n");
+        for (let index = 0; index < segments.length; index += 1) {
+            const segment = segments[index] ?? "";
+            const lineEnded = index < segments.length - 1;
+            if (discardingOversizedLine) {
+                if (lineEnded)
+                    discardingOversizedLine = false;
+                continue;
+            }
+            lineBuffer += segment;
+            if (Buffer.byteLength(lineBuffer, "utf8") > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
+                state.lineCount += 1;
+                state.parseErrorCount += 1;
+                lineBuffer = "";
+                discardingOversizedLine = !lineEnded;
+                continue;
+            }
+            if (lineEnded) {
+                absorbCodexSessionLine(state, lineBuffer);
+                lineBuffer = "";
+            }
+        }
+    }
+    const rest = decoder.end();
+    if (rest)
+        lineBuffer += rest;
+    if (lineBuffer.trim())
+        absorbCodexSessionLine(state, lineBuffer);
+    return {
+        signals: codexSignalsFromState(state),
+        contentHashSha256: hash.digest("hex"),
+        byteSize,
+    };
+}
+export function extractCodexSessionSignals(content) {
+    const state = makeSignalExtractionState();
+    for (const line of content.split("\n")) {
+        absorbCodexSessionLine(state, line);
+    }
+    return codexSignalsFromState(state);
+}
+function makeSignalExtractionState() {
+    return {
+        sessionIds: new Set(),
+        cwds: new Set(),
+        workspaceRoots: new Set(),
+        branches: new Set(),
+        commitHashes: new Set(),
+        repositoryUrls: new Set(),
+        lineCount: 0,
+        parseErrorCount: 0,
+    };
+}
+function absorbCodexSessionLine(state, line) {
+    if (!line.trim())
+        return;
+    state.lineCount += 1;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        // Deliberately silent (BLI-3238). Per LINE, in files with hundreds of
+        // thousands of them, and the last line of a live session is routinely
+        // half-written — this is expected, not a failure. The count travels in
+        // `parseErrorCount` on the scan result, which is the right grain, and the
+        // error object would carry a fragment of the transcript.
+        state.parseErrorCount += 1;
+        return;
+    }
+    if (!record || typeof record !== "object")
+        return;
+    const type = record.type;
+    if (type !== "session_meta" && type !== "turn_context")
+        return;
+    const payload = record.payload;
+    if (!payload || typeof payload !== "object")
+        return;
+    const payloadRecord = payload;
+    if (type === "session_meta") {
+        addString(state.sessionIds, payloadRecord["id"]);
+        addString(state.cwds, payloadRecord["cwd"]);
+        const git = payloadRecord["git"];
+        if (git && typeof git === "object") {
+            const gitRecord = git;
+            addString(state.branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
+            addString(state.commitHashes, gitRecord["commit_hash"]);
+            const repositoryUrl = gitRecord["repository_url"];
+            if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
+                state.repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
+            }
+        }
+    }
+    else if (type === "turn_context") {
+        addString(state.cwds, payloadRecord["cwd"]);
+        const roots = payloadRecord["workspace_roots"];
+        if (Array.isArray(roots)) {
+            for (const root of roots) {
+                if (typeof root === "string") {
+                    addString(state.workspaceRoots, root);
+                }
+                else if (root && typeof root === "object") {
+                    addString(state.workspaceRoots, root["path"]);
+                }
+            }
+        }
+    }
+}
+function codexSignalsFromState(state) {
+    return {
+        session_ids: [...state.sessionIds],
+        cwds: [...state.cwds],
+        workspace_roots: [...state.workspaceRoots],
+        branches: [...state.branches],
+        commit_hashes: [...state.commitHashes],
+        repository_urls: [...state.repositoryUrls],
+        line_count: state.lineCount,
+        parse_error_count: state.parseErrorCount,
+    };
+}
+function addString(target, value) {
+    if (typeof value === "string" && value.trim())
+        target.add(value.trim());
+}

package/dist/agent-rules-unmanaged-block.js

@@ -0,0 +1,97 @@
+/**
+ * A ticket-binding section somebody wrote by hand, and whether it already says
+ * what our managed block says.
+ *
+ * Split out of agent-rules.ts (BLI-10108), which writes the block; this file
+ * only READS what is already in a person's rules file and answers two
+ * questions: is this good enough to leave alone (`equivalent`), or is it the
+ * older vocabulary we should replace (`stale`)?
+ *
+ * The matching is deliberately loose. These sections were typed by people and
+ * by other agents over months, so the test is a handful of cues plus a score,
+ * not equality, and every cue is lowercased, unquoted and whitespace-flattened
+ * first so formatting never decides the answer.
+ */
+import path from "node:path";
+export function hasEquivalentUnmanagedTicketBinding(contents, scopePaths = []) {
+    const text = normalizeRuleText(contents);
+    if (!hasTicketBindingCues(text))
+        return false;
+    if (!hasRepoScopeGuard(text))
+        return false;
+    if (scopePaths.some((scopePath) => !hasScopePath(text, scopePath)))
+        return false;
+    if (!hasTicketLookupOrCreationCue(text))
+        return false;
+    // Contents without the QA-receipts rule are the older vocabulary and must
+    // read as stale — otherwise machines with a hand-written ticket-binding
+    // section never receive the definition-of-done rule.
+    if (!hasQaReceiptsCue(text))
+        return false;
+    const signals = [
+        /cockpit\s+start\s+--ticket\b/u,
+        /before\s+(?:the\s+)?first\s+code\s+edit|before\s+ticketed\s+implementation/u,
+        /general\s+ambient/u,
+        /cockpit\s+sync\s+--repo|cockpit\s+sync\s+--workspace|fresh\s+ticket\/session\s+binding\s+metadata/u,
+        /use\s+--ticket|the\s+flag\s+is\s+--ticket|do\s+not\s+invent\s+--ticketid/u,
+    ];
+    const score = signals.filter((signal) => signal.test(text)).length;
+    return score >= 4;
+}
+function hasQaReceiptsCue(text) {
+    return /computer-use\s+qa\s+pass/u.test(text)
+        && /receipts/u.test(text);
+}
+function hasTicketLookupOrCreationCue(text) {
+    return /search\s+linear|create\s+(?:a\s+)?(?:narrow\s+)?linear\s+ticket|new\s+linear\s+ticket/u.test(text);
+}
+function hasScopePath(text, scopePath) {
+    return text.includes(normalizeRuleText(path.resolve(scopePath)));
+}
+function hasRepoScopeGuard(text) {
+    return (/only\s+applies\s+when\s+the\s+current\s+working\s+directory\s+is\s+inside/u.test(text) ||
+        /outside\s+that\s+(?:folder|workspace|repo).*(?:do\s+not|dont)\s+run\s+cockpit/u.test(text) ||
+        /private\s+chats\s+or\s+unrelated\s+repos/u.test(text));
+}
+export function findStaleUnmanagedTicketBindingBlock(contents, scopePaths = []) {
+    const lines = contents.split("\n");
+    for (let index = 0; index < lines.length; index += 1) {
+        if (!/^#{1,6}\s+.*(?:cockpit\s+)?ticket\s+binding\b/iu.test(lines[index] ?? "")) {
+            continue;
+        }
+        let endLine = lines.length;
+        for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
+            if (/^#{1,6}\s+\S/u.test(lines[cursor] ?? "")) {
+                endLine = cursor;
+                break;
+            }
+        }
+        const candidate = lines.slice(index, endLine).join("\n");
+        const normalized = normalizeRuleText(candidate);
+        if (hasTicketBindingCues(normalized) &&
+            !hasEquivalentUnmanagedTicketBinding(candidate, scopePaths)) {
+            return { startLine: index, endLine };
+        }
+    }
+    return null;
+}
+export function replaceLineSpan(contents, startLine, endLine, replacement) {
+    const lines = contents.split("\n");
+    const before = lines.slice(0, startLine).join("\n").trimEnd();
+    const after = lines.slice(endLine).join("\n").trimStart();
+    return [before, replacement, after]
+        .filter((part) => part.trim().length > 0)
+        .join("\n\n")
+        .replace(/\n{3,}/gu, "\n\n")
+        .trimEnd() + "\n";
+}
+function hasTicketBindingCues(text) {
+    return /\bcockpit\b/u.test(text) && /\bticket\b/u.test(text) && /binding|agent|linear/u.test(text);
+}
+function normalizeRuleText(contents) {
+    return contents
+        .toLowerCase()
+        .replace(/[`"'<>]/gu, "")
+        .replace(/\s+/gu, " ")
+        .trim();
+}

package/dist/agent-rules.js

@@ -1,6 +1,7 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { findStaleUnmanagedTicketBindingBlock, hasEquivalentUnmanagedTicketBinding, replaceLineSpan, } from "./agent-rules-unmanaged-block.js";
 import { describeError, isMissingFileFailure } from "./health-detail.js";
 const MANAGED_BLOCK_START = "<!-- BLI_COCKPIT_AGENT_RULES:START -->";
 const MANAGED_BLOCK_END = "<!-- BLI_COCKPIT_AGENT_RULES:END -->";
@@ -260,88 +261,6 @@ function managedBlockPattern() {
 function extractManagedBlock(contents) {
     return contents.match(managedBlockPattern())?.[0] ?? null;
 }
-function hasEquivalentUnmanagedTicketBinding(contents, scopePaths = []) {
-    const text = normalizeRuleText(contents);
-    if (!hasTicketBindingCues(text))
-        return false;
-    if (!hasRepoScopeGuard(text))
-        return false;
-    if (scopePaths.some((scopePath) => !hasScopePath(text, scopePath)))
-        return false;
-    if (!hasTicketLookupOrCreationCue(text))
-        return false;
-    // Contents without the QA-receipts rule are the older vocabulary and must
-    // read as stale — otherwise machines with a hand-written ticket-binding
-    // section never receive the definition-of-done rule.
-    if (!hasQaReceiptsCue(text))
-        return false;
-    const signals = [
-        /cockpit\s+start\s+--ticket\b/u,
-        /before\s+(?:the\s+)?first\s+code\s+edit|before\s+ticketed\s+implementation/u,
-        /general\s+ambient/u,
-        /cockpit\s+sync\s+--repo|cockpit\s+sync\s+--workspace|fresh\s+ticket\/session\s+binding\s+metadata/u,
-        /use\s+--ticket|the\s+flag\s+is\s+--ticket|do\s+not\s+invent\s+--ticketid/u,
-    ];
-    const score = signals.filter((signal) => signal.test(text)).length;
-    return score >= 4;
-}
-function hasQaReceiptsCue(text) {
-    return /computer-use\s+qa\s+pass/u.test(text)
-        && /receipts/u.test(text);
-}
-function hasTicketLookupOrCreationCue(text) {
-    return /search\s+linear|create\s+(?:a\s+)?(?:narrow\s+)?linear\s+ticket|new\s+linear\s+ticket/u.test(text);
-}
-function hasScopePath(text, scopePath) {
-    return text.includes(normalizeRuleText(path.resolve(scopePath)));
-}
-function hasRepoScopeGuard(text) {
-    return (/only\s+applies\s+when\s+the\s+current\s+working\s+directory\s+is\s+inside/u.test(text) ||
-        /outside\s+that\s+(?:folder|workspace|repo).*(?:do\s+not|dont)\s+run\s+cockpit/u.test(text) ||
-        /private\s+chats\s+or\s+unrelated\s+repos/u.test(text));
-}
-function findStaleUnmanagedTicketBindingBlock(contents, scopePaths = []) {
-    const lines = contents.split("\n");
-    for (let index = 0; index < lines.length; index += 1) {
-        if (!/^#{1,6}\s+.*(?:cockpit\s+)?ticket\s+binding\b/iu.test(lines[index] ?? "")) {
-            continue;
-        }
-        let endLine = lines.length;
-        for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
-            if (/^#{1,6}\s+\S/u.test(lines[cursor] ?? "")) {
-                endLine = cursor;
-                break;
-            }
-        }
-        const candidate = lines.slice(index, endLine).join("\n");
-        const normalized = normalizeRuleText(candidate);
-        if (hasTicketBindingCues(normalized) &&
-            !hasEquivalentUnmanagedTicketBinding(candidate, scopePaths)) {
-            return { startLine: index, endLine };
-        }
-    }
-    return null;
-}
-function replaceLineSpan(contents, startLine, endLine, replacement) {
-    const lines = contents.split("\n");
-    const before = lines.slice(0, startLine).join("\n").trimEnd();
-    const after = lines.slice(endLine).join("\n").trimStart();
-    return [before, replacement, after]
-        .filter((part) => part.trim().length > 0)
-        .join("\n\n")
-        .replace(/\n{3,}/gu, "\n\n")
-        .trimEnd() + "\n";
-}
-function hasTicketBindingCues(text) {
-    return /\bcockpit\b/u.test(text) && /\bticket\b/u.test(text) && /binding|agent|linear/u.test(text);
-}
-function normalizeRuleText(contents) {
-    return contents
-        .toLowerCase()
-        .replace(/[`"'<>]/gu, "")
-        .replace(/\s+/gu, " ")
-        .trim();
-}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }

package/dist/commands/agent-session-report.js

@@ -139,6 +139,8 @@ function sessionReportEntry(result, context) {
         ? (context.claudePriorDurablePointers.get(result.session_id) ?? null)
         : null;
     return {
+        ticket_id: context.ticketByWorktree?.get(result.worktree?.worktree_fingerprint ?? "") ?? null,
+        ticket_binding_source: context.ticketByWorktree?.has(result.worktree?.worktree_fingerprint ?? "") ? "explicit_bind" : null,
         codex_session_id: result.session_id,
         source: result.source,
         observed_at: context.now.toISOString(),
@@ -225,6 +227,7 @@ export function buildAgentSessionReport(options) {
     const uploadOutcomes = sessionUploadOutcomesByKey(options.outcomes);
     return [...bestByKey.values()].map((result) => sessionReportEntry(result, {
         ...uploadOutcomes,
+        ticketByWorktree: options.ticketByWorktree,
         claudePriorDurablePointers: options.claudePriorDurablePointers,
         now: options.now,
     }));