@bli-cockpit/cli 0.2.112 → 0.2.114

package/dist/adapters/claude-attribution-score.js

@@ -1,3 +1,4 @@
+import { finalizeSessionFacts, newSessionFactsAccumulator, observeSessionFactsContent, observeSessionFactsFile, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
@@ -11,9 +12,15 @@ import { CLAUDE_SESSION_MAX_FILE_BYTES, } from "./claude-attribution-types.js";
  * Turns one discovered session into an attribution verdict: read (or, for an
  * oversized main, stream) its signals, score them against the known
  * worktrees, and validate its sidecars against the winning worktree.
+ *
+ * The same pass counts the session's deterministic facts (BLI-4341) so the
+ * upload carries its own token totals. Only files that belong to this session
+ * are counted: a sidecar rejected for a cwd mismatch is another worktree's
+ * work and must not inflate this session's numbers.
  */
 export async function attributeOneSession(session, worktrees, collectionRoots) {
     const fileName = path.basename(session.mainFile);
+    const factsAcc = newSessionFactsAccumulator("claude_code");
     const base = {
         file_path: session.mainFile,
         file_name: fileName,
@@ -29,6 +36,7 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
         oversized_lines_skipped: 0,
         sidecars_capped: session.sidecarsCapped,
         sidecar_files: [],
+        session_facts: null,
     };
     if (session.mainByteSize === 0) {
         return skippedResult(base, "empty_file");
@@ -40,7 +48,7 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
         // bytes themselves are not uploaded until the collection ceiling changes.
         let streamed;
         try {
-            streamed = await streamMainSignals(session.mainFile);
+            streamed = await streamMainSignals(session.mainFile, factsAcc);
         }
         catch (error) {
             // A read race on one oversized main must not abort the whole scan; honor
@@ -55,6 +63,10 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
             return skippedResult(base, "file_read_failed");
         }
         signals = streamed.signals;
+        observeSessionFactsFile(factsAcc, {
+            bytes: streamed.byteSize,
+            lines: streamed.signals.line_count,
+        });
         base.content_hash_sha256 = streamed.contentHash;
         base.byte_size = streamed.byteSize;
         base.main_file_oversized = true;
@@ -80,7 +92,11 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
         if (content.trim() === "") {
             return skippedResult(base, "empty_file");
         }
-        signals = extractClaudeSessionSignals(content);
+        signals = extractClaudeSessionSignals(content, factsAcc);
+        observeSessionFactsFile(factsAcc, {
+            bytes: raw.byteLength,
+            lines: signals.line_count,
+        });
     }
     const metaSessionId = sanitizeSessionId(signals.session_ids[0]);
     if (metaSessionId) {
@@ -116,7 +132,7 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
     if (isSchemaDriftSuspected(signals))
         extraSignals.push("schema_drift_suspected");
     const sidecarFiles = isRawEvidenceUploadableAttributionState(outcome.state, outcome.worktree !== null) && outcome.worktree
-        ? await collectSidecarDiagnostics(session.sidecars, outcome.worktree)
+        ? await collectSidecarDiagnostics(session.sidecars, outcome.worktree, factsAcc)
         : session.sidecars.map((sidecar) => ({
             local_path: sidecar.local_path,
             file_name: sidecar.file_name,
@@ -126,6 +142,7 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
         }));
     return {
         ...base,
+        session_facts: finalizeSessionFacts(factsAcc),
         state: outcome.state,
         reason: outcome.reason,
         signals: [...outcome.signals, ...extraSignals],
@@ -143,7 +160,7 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
  * oversized sidecar is recorded with a reason and the session stays
  * harvestable.
  */
-async function collectSidecarDiagnostics(sidecars, worktree) {
+async function collectSidecarDiagnostics(sidecars, worktree, facts) {
     const out = [];
     for (const sidecar of sidecars) {
         const entry = {
@@ -181,6 +198,9 @@ async function collectSidecarDiagnostics(sidecars, worktree) {
             out.push({ ...entry, skipped_reason: "sidecar_cwd_mismatch" });
             continue;
         }
+        // Accepted: this subagent's turns are part of this session, so its tokens
+        // are too. Counted only now, after the cwd check has cleared it.
+        observeSessionFactsContent(facts, content);
         out.push({
             ...entry,
             byte_size: raw.byteLength,

package/dist/adapters/claude-attribution-signals.js

@@ -1,3 +1,4 @@
+import { observeSessionFactsRecord, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import { createReadStream } from "node:fs";
 import { StringDecoder } from "node:string_decoder";
@@ -7,15 +8,18 @@ import { CONTENT_RECORD_TYPES, MAX_LINE_BUFFER_BYTES, SCHEMA_DRIFT_MIN_HIT_RATE,
  * `cwd`, `gitBranch`, `sessionId`, and `prRepository` (pr-link records).
  * Structurally identical to the Codex extractor, with the allowlist enforced
  * by construction — no generic record walk that could surface message bodies.
+ *
+ * Pass a session-facts accumulator to have the SAME parse feed the upload-time
+ * deterministic count (BLI-4341); without one the pass is unchanged.
  */
-export function extractClaudeSessionSignals(content) {
-    const accumulator = createSignalAccumulator();
+export function extractClaudeSessionSignals(content, facts) {
+    const accumulator = createSignalAccumulator(facts);
     for (const line of content.split("\n")) {
         accumulator.processLine(line);
     }
     return accumulator.finalize();
 }
-function createSignalAccumulator() {
+function createSignalAccumulator(facts) {
     const sessionIds = new Set();
     const cwds = new Set();
     const branches = new Set();
@@ -41,9 +45,12 @@ function createSignalAccumulator() {
                 parseErrorCount += 1;
                 return;
             }
-            if (!record || typeof record !== "object")
+            if (!record || typeof record !== "object" || Array.isArray(record))
                 return;
             const entry = record;
+            // Counting is not reading: the facts module returns totals, never text.
+            if (facts)
+                observeSessionFactsRecord(facts, entry);
             const type = typeof entry["type"] === "string" ? entry["type"] : "";
             const cwd = stringOrNull(entry["cwd"]);
             const sessionId = stringOrNull(entry["sessionId"]);
@@ -96,8 +103,8 @@ export function isSchemaDriftSuspected(signals) {
         return true;
     return signals.envelope_field_hit_rate < SCHEMA_DRIFT_MIN_HIT_RATE;
 }
-export async function streamMainSignals(filePath) {
-    const accumulator = createSignalAccumulator();
+export async function streamMainSignals(filePath, facts) {
+    const accumulator = createSignalAccumulator(facts);
     const hash = crypto.createHash("sha256");
     let oversizedLinesSkipped = 0;
     let byteSize = 0;

package/dist/adapters/claude-attribution-types.js

@@ -1,4 +1,4 @@
-import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core";
+import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, } from "@bli-cockpit/telemetry-core";
 /**
  * The shapes and tuning constants `claude-attribution.ts` and its siblings
  * (discovery, score, signals) all agree on. Kept in one module so none of

package/dist/adapters/codex-attribution.js

@@ -1,10 +1,8 @@
-import { createReadStream, existsSync } from "node:fs";
-import crypto from "node:crypto";
+import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { StringDecoder } from "node:string_decoder";
-import { normalizeGitOrigin } from "../repo-identity.js";
 import { describeError } from "../health-detail.js";
+import { extractCodexSessionSignals, readCodexMetadataSignals, } from "./codex-session-signals.js";
 import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
 /**
  * Deterministic Codex session JSONL -> repo/worktree attribution.
@@ -17,8 +15,10 @@ import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName,
  * attribute identically.
  */
 // Re-exported for callers (and tests) that historically imported these from
-// the codex adapter; the single implementation lives in attribution-core.
+// the codex adapter; the single implementation lives in attribution-core, and
+// the signal reading in codex-session-signals.
 export { sanitizeSessionId, sessionIdFromFileName };
+export { extractCodexSessionSignals };
 export const CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES = 24 * 60;
 export const CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT = 50;
 export const CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES = 14 * 24 * 60;
@@ -27,7 +27,6 @@ export const CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT = 500;
 // and no longer rejects sessions by file size; raw evidence collection enforces
 // upload budgets and content guards later.
 export const CODEX_SESSION_MAX_FILE_BYTES = 10 * 1024 * 1024;
-const CODEX_ATTRIBUTION_MAX_LINE_BYTES = 2 * 1024 * 1024;
 export function defaultCodexSessionDirs(homeDir) {
     return [
         path.join(homeDir, ".codex", "sessions"),
@@ -174,6 +173,7 @@ async function attributeOneSession(file, worktrees, collectionRoots) {
         session_file_mtime_ms: file.mtimeMs,
         byte_size: file.byteSize,
         content_hash_sha256: null,
+        session_facts: null,
     };
     let read;
     try {
@@ -192,6 +192,7 @@ async function attributeOneSession(file, worktrees, collectionRoots) {
     }
     base.content_hash_sha256 = read.contentHashSha256;
     base.byte_size = read.byteSize;
+    base.session_facts = read.facts;
     const signals = read.signals;
     const metaSessionId = sanitizeSessionId(signals.session_ids[0]);
     if (metaSessionId) {
@@ -223,139 +224,6 @@ async function attributeOneSession(file, worktrees, collectionRoots) {
     }, worktrees, { collectionRoots, pathExists: existsSync });
     return { ...base, ...outcome };
 }
-async function readCodexMetadataSignals(filePath) {
-    const hash = crypto.createHash("sha256");
-    const decoder = new StringDecoder("utf8");
-    const state = makeSignalExtractionState();
-    const stream = createReadStream(filePath);
-    let byteSize = 0;
-    let lineBuffer = "";
-    let discardingOversizedLine = false;
-    for await (const chunk of stream) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        byteSize += buffer.byteLength;
-        hash.update(buffer);
-        const text = decoder.write(buffer);
-        const segments = text.split("\n");
-        for (let index = 0; index < segments.length; index += 1) {
-            const segment = segments[index] ?? "";
-            const lineEnded = index < segments.length - 1;
-            if (discardingOversizedLine) {
-                if (lineEnded)
-                    discardingOversizedLine = false;
-                continue;
-            }
-            lineBuffer += segment;
-            if (Buffer.byteLength(lineBuffer, "utf8") > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
-                state.lineCount += 1;
-                state.parseErrorCount += 1;
-                lineBuffer = "";
-                discardingOversizedLine = !lineEnded;
-                continue;
-            }
-            if (lineEnded) {
-                absorbCodexSessionLine(state, lineBuffer);
-                lineBuffer = "";
-            }
-        }
-    }
-    const rest = decoder.end();
-    if (rest)
-        lineBuffer += rest;
-    if (lineBuffer.trim())
-        absorbCodexSessionLine(state, lineBuffer);
-    return {
-        signals: codexSignalsFromState(state),
-        contentHashSha256: hash.digest("hex"),
-        byteSize,
-    };
-}
-export function extractCodexSessionSignals(content) {
-    const state = makeSignalExtractionState();
-    for (const line of content.split("\n")) {
-        absorbCodexSessionLine(state, line);
-    }
-    return codexSignalsFromState(state);
-}
-function makeSignalExtractionState() {
-    return {
-        sessionIds: new Set(),
-        cwds: new Set(),
-        workspaceRoots: new Set(),
-        branches: new Set(),
-        commitHashes: new Set(),
-        repositoryUrls: new Set(),
-        lineCount: 0,
-        parseErrorCount: 0,
-    };
-}
-function absorbCodexSessionLine(state, line) {
-    if (!line.trim())
-        return;
-    state.lineCount += 1;
-    let record;
-    try {
-        record = JSON.parse(line);
-    }
-    catch {
-        // Deliberately silent (BLI-3238). Per LINE, in files with hundreds of
-        // thousands of them, and the last line of a live session is routinely
-        // half-written — this is expected, not a failure. The count travels in
-        // `parseErrorCount` on the scan result, which is the right grain, and the
-        // error object would carry a fragment of the transcript.
-        state.parseErrorCount += 1;
-        return;
-    }
-    if (!record || typeof record !== "object")
-        return;
-    const type = record.type;
-    if (type !== "session_meta" && type !== "turn_context")
-        return;
-    const payload = record.payload;
-    if (!payload || typeof payload !== "object")
-        return;
-    const payloadRecord = payload;
-    if (type === "session_meta") {
-        addString(state.sessionIds, payloadRecord["id"]);
-        addString(state.cwds, payloadRecord["cwd"]);
-        const git = payloadRecord["git"];
-        if (git && typeof git === "object") {
-            const gitRecord = git;
-            addString(state.branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
-            addString(state.commitHashes, gitRecord["commit_hash"]);
-            const repositoryUrl = gitRecord["repository_url"];
-            if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
-                state.repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
-            }
-        }
-    }
-    else if (type === "turn_context") {
-        addString(state.cwds, payloadRecord["cwd"]);
-        const roots = payloadRecord["workspace_roots"];
-        if (Array.isArray(roots)) {
-            for (const root of roots) {
-                if (typeof root === "string") {
-                    addString(state.workspaceRoots, root);
-                }
-                else if (root && typeof root === "object") {
-                    addString(state.workspaceRoots, root["path"]);
-                }
-            }
-        }
-    }
-}
-function codexSignalsFromState(state) {
-    return {
-        session_ids: [...state.sessionIds],
-        cwds: [...state.cwds],
-        workspace_roots: [...state.workspaceRoots],
-        branches: [...state.branches],
-        commit_hashes: [...state.commitHashes],
-        repository_urls: [...state.repositoryUrls],
-        line_count: state.lineCount,
-        parse_error_count: state.parseErrorCount,
-    };
-}
 function skippedResult(base, reason) {
     return {
         ...base,
@@ -366,8 +234,4 @@ function skippedResult(base, reason) {
         path_score: 0,
         worktree: null,
     };
-}
-function addString(target, value) {
-    if (typeof value === "string" && value.trim())
-        target.add(value.trim());
 }

package/dist/adapters/codex-session-signals.js

@@ -0,0 +1,173 @@
+/**
+ * What a Codex session file says about WHERE it ran, and nothing else.
+ *
+ * Only metadata-bearing records are inspected (session_meta, turn_context):
+ * cwd, workspace roots, and git branch/commit/origin. Prompt, response,
+ * reasoning and tool payload fields are never extracted, printed or
+ * summarized. Split out of codex-attribution.ts so the file that DECIDES a
+ * session's repo reads as the decision, and this one as the reading.
+ *
+ * Two doors, same extraction: `readCodexMetadataSignals` streams a file off
+ * disk (sessions run to hundreds of megabytes, so the file is never held in
+ * memory and its sha256 is taken on the way past), and
+ * `extractCodexSessionSignals` takes content already in hand.
+ *
+ * The same streaming pass also counts the session's deterministic facts
+ * (BLI-4341): token totals per model, turn and tool counts, timestamps, size.
+ * The bytes are already in hand and already parsed, so counting them here
+ * costs one function call per record and saves the server a download.
+ */
+import { finalizeSessionFacts, newSessionFactsAccumulator, observeSessionFactsFile, observeSessionFactsRecord, } from "@bli-cockpit/telemetry-core";
+import { createReadStream } from "node:fs";
+import crypto from "node:crypto";
+import { StringDecoder } from "node:string_decoder";
+import { normalizeGitOrigin } from "../repo-identity.js";
+/** A line this long is not a session record; it is counted as a parse error and dropped. */
+const CODEX_ATTRIBUTION_MAX_LINE_BYTES = 2 * 1024 * 1024;
+/**
+ * One session file, streamed: the metadata signals, the sha256 of every byte
+ * that went past, and the size the walk should believe.
+ */
+export async function readCodexMetadataSignals(filePath) {
+    const hash = crypto.createHash("sha256");
+    const decoder = new StringDecoder("utf8");
+    const state = makeSignalExtractionState();
+    const stream = createReadStream(filePath);
+    let byteSize = 0;
+    let lineBuffer = "";
+    let discardingOversizedLine = false;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        byteSize += buffer.byteLength;
+        hash.update(buffer);
+        const text = decoder.write(buffer);
+        const segments = text.split("\n");
+        for (let index = 0; index < segments.length; index += 1) {
+            const segment = segments[index] ?? "";
+            const lineEnded = index < segments.length - 1;
+            if (discardingOversizedLine) {
+                if (lineEnded)
+                    discardingOversizedLine = false;
+                continue;
+            }
+            lineBuffer += segment;
+            if (Buffer.byteLength(lineBuffer, "utf8") > CODEX_ATTRIBUTION_MAX_LINE_BYTES) {
+                state.lineCount += 1;
+                state.parseErrorCount += 1;
+                lineBuffer = "";
+                discardingOversizedLine = !lineEnded;
+                continue;
+            }
+            if (lineEnded) {
+                absorbCodexSessionLine(state, lineBuffer);
+                lineBuffer = "";
+            }
+        }
+    }
+    const rest = decoder.end();
+    if (rest)
+        lineBuffer += rest;
+    if (lineBuffer.trim())
+        absorbCodexSessionLine(state, lineBuffer);
+    observeSessionFactsFile(state.facts, { bytes: byteSize, lines: state.lineCount });
+    return {
+        signals: codexSignalsFromState(state),
+        facts: finalizeSessionFacts(state.facts),
+        contentHashSha256: hash.digest("hex"),
+        byteSize,
+    };
+}
+export function extractCodexSessionSignals(content) {
+    const state = makeSignalExtractionState();
+    for (const line of content.split("\n")) {
+        absorbCodexSessionLine(state, line);
+    }
+    return codexSignalsFromState(state);
+}
+function makeSignalExtractionState() {
+    return {
+        sessionIds: new Set(),
+        cwds: new Set(),
+        workspaceRoots: new Set(),
+        branches: new Set(),
+        commitHashes: new Set(),
+        repositoryUrls: new Set(),
+        lineCount: 0,
+        parseErrorCount: 0,
+        facts: newSessionFactsAccumulator("codex"),
+    };
+}
+function absorbCodexSessionLine(state, line) {
+    if (!line.trim())
+        return;
+    state.lineCount += 1;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        // Deliberately silent (BLI-3238). Per LINE, in files with hundreds of
+        // thousands of them, and the last line of a live session is routinely
+        // half-written — this is expected, not a failure. The count travels in
+        // `parseErrorCount` on the scan result, which is the right grain, and the
+        // error object would carry a fragment of the transcript.
+        state.parseErrorCount += 1;
+        return;
+    }
+    if (!record || typeof record !== "object" || Array.isArray(record))
+        return;
+    // Every record feeds the facts count; only the two metadata types below feed
+    // attribution.
+    observeSessionFactsRecord(state.facts, record);
+    const type = record.type;
+    if (type !== "session_meta" && type !== "turn_context")
+        return;
+    const payload = record.payload;
+    if (!payload || typeof payload !== "object")
+        return;
+    const payloadRecord = payload;
+    if (type === "session_meta") {
+        addString(state.sessionIds, payloadRecord["id"]);
+        addString(state.cwds, payloadRecord["cwd"]);
+        const git = payloadRecord["git"];
+        if (git && typeof git === "object") {
+            const gitRecord = git;
+            addString(state.branches, gitRecord["branch"] ?? gitRecord["current_branch"]);
+            addString(state.commitHashes, gitRecord["commit_hash"]);
+            const repositoryUrl = gitRecord["repository_url"];
+            if (typeof repositoryUrl === "string" && repositoryUrl.trim()) {
+                state.repositoryUrls.add(normalizeGitOrigin(repositoryUrl));
+            }
+        }
+    }
+    else if (type === "turn_context") {
+        addString(state.cwds, payloadRecord["cwd"]);
+        const roots = payloadRecord["workspace_roots"];
+        if (Array.isArray(roots)) {
+            for (const root of roots) {
+                if (typeof root === "string") {
+                    addString(state.workspaceRoots, root);
+                }
+                else if (root && typeof root === "object") {
+                    addString(state.workspaceRoots, root["path"]);
+                }
+            }
+        }
+    }
+}
+function codexSignalsFromState(state) {
+    return {
+        session_ids: [...state.sessionIds],
+        cwds: [...state.cwds],
+        workspace_roots: [...state.workspaceRoots],
+        branches: [...state.branches],
+        commit_hashes: [...state.commitHashes],
+        repository_urls: [...state.repositoryUrls],
+        line_count: state.lineCount,
+        parse_error_count: state.parseErrorCount,
+    };
+}
+function addString(target, value) {
+    if (typeof value === "string" && value.trim())
+        target.add(value.trim());
+}

package/dist/agent-rules-unmanaged-block.js

@@ -0,0 +1,97 @@
+/**
+ * A ticket-binding section somebody wrote by hand, and whether it already says
+ * what our managed block says.
+ *
+ * Split out of agent-rules.ts (BLI-10108), which writes the block; this file
+ * only READS what is already in a person's rules file and answers two
+ * questions: is this good enough to leave alone (`equivalent`), or is it the
+ * older vocabulary we should replace (`stale`)?
+ *
+ * The matching is deliberately loose. These sections were typed by people and
+ * by other agents over months, so the test is a handful of cues plus a score,
+ * not equality, and every cue is lowercased, unquoted and whitespace-flattened
+ * first so formatting never decides the answer.
+ */
+import path from "node:path";
+export function hasEquivalentUnmanagedTicketBinding(contents, scopePaths = []) {
+    const text = normalizeRuleText(contents);
+    if (!hasTicketBindingCues(text))
+        return false;
+    if (!hasRepoScopeGuard(text))
+        return false;
+    if (scopePaths.some((scopePath) => !hasScopePath(text, scopePath)))
+        return false;
+    if (!hasTicketLookupOrCreationCue(text))
+        return false;
+    // Contents without the QA-receipts rule are the older vocabulary and must
+    // read as stale — otherwise machines with a hand-written ticket-binding
+    // section never receive the definition-of-done rule.
+    if (!hasQaReceiptsCue(text))
+        return false;
+    const signals = [
+        /cockpit\s+start\s+--ticket\b/u,
+        /before\s+(?:the\s+)?first\s+code\s+edit|before\s+ticketed\s+implementation/u,
+        /general\s+ambient/u,
+        /cockpit\s+sync\s+--repo|cockpit\s+sync\s+--workspace|fresh\s+ticket\/session\s+binding\s+metadata/u,
+        /use\s+--ticket|the\s+flag\s+is\s+--ticket|do\s+not\s+invent\s+--ticketid/u,
+    ];
+    const score = signals.filter((signal) => signal.test(text)).length;
+    return score >= 4;
+}
+function hasQaReceiptsCue(text) {
+    return /computer-use\s+qa\s+pass/u.test(text)
+        && /receipts/u.test(text);
+}
+function hasTicketLookupOrCreationCue(text) {
+    return /search\s+linear|create\s+(?:a\s+)?(?:narrow\s+)?linear\s+ticket|new\s+linear\s+ticket/u.test(text);
+}
+function hasScopePath(text, scopePath) {
+    return text.includes(normalizeRuleText(path.resolve(scopePath)));
+}
+function hasRepoScopeGuard(text) {
+    return (/only\s+applies\s+when\s+the\s+current\s+working\s+directory\s+is\s+inside/u.test(text) ||
+        /outside\s+that\s+(?:folder|workspace|repo).*(?:do\s+not|dont)\s+run\s+cockpit/u.test(text) ||
+        /private\s+chats\s+or\s+unrelated\s+repos/u.test(text));
+}
+export function findStaleUnmanagedTicketBindingBlock(contents, scopePaths = []) {
+    const lines = contents.split("\n");
+    for (let index = 0; index < lines.length; index += 1) {
+        if (!/^#{1,6}\s+.*(?:cockpit\s+)?ticket\s+binding\b/iu.test(lines[index] ?? "")) {
+            continue;
+        }
+        let endLine = lines.length;
+        for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
+            if (/^#{1,6}\s+\S/u.test(lines[cursor] ?? "")) {
+                endLine = cursor;
+                break;
+            }
+        }
+        const candidate = lines.slice(index, endLine).join("\n");
+        const normalized = normalizeRuleText(candidate);
+        if (hasTicketBindingCues(normalized) &&
+            !hasEquivalentUnmanagedTicketBinding(candidate, scopePaths)) {
+            return { startLine: index, endLine };
+        }
+    }
+    return null;
+}
+export function replaceLineSpan(contents, startLine, endLine, replacement) {
+    const lines = contents.split("\n");
+    const before = lines.slice(0, startLine).join("\n").trimEnd();
+    const after = lines.slice(endLine).join("\n").trimStart();
+    return [before, replacement, after]
+        .filter((part) => part.trim().length > 0)
+        .join("\n\n")
+        .replace(/\n{3,}/gu, "\n\n")
+        .trimEnd() + "\n";
+}
+function hasTicketBindingCues(text) {
+    return /\bcockpit\b/u.test(text) && /\bticket\b/u.test(text) && /binding|agent|linear/u.test(text);
+}
+function normalizeRuleText(contents) {
+    return contents
+        .toLowerCase()
+        .replace(/[`"'<>]/gu, "")
+        .replace(/\s+/gu, " ")
+        .trim();
+}