@bli-cockpit/cli 0.2.28 → 0.2.29

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.28");
+    writeLine(io?.stdout ?? process.stdout, "0.2.29");
     return 0;
   }
 

package/dist/commands/sessions.js

@@ -0,0 +1,162 @@
+/**
+ * `cockpit sessions` — the operator's local answer to "why is session X
+ * missing?".
+ *
+ * Read-only: re-runs attribution, uploads nothing, writes no cursor. Per-session
+ * reasons otherwise live only in a service-role table with no UI (B.4 §6).
+ * Counts and labels only — the project-dir slug encodes a local path and is
+ * never printed. Split out of commands/local.ts (BLI-3104); moved verbatim.
+ */
+import os from "node:os";
+import path from "node:path";
+import { writeLine } from "./cli-io.js";
+import { discoverCommandWorktrees } from "./local-discovery.js";
+import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
+import { CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
+import { getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "../local-state.js";
+const ALL_SESSION_SCAN_WINDOW_MINUTES = 20 * 365 * 24 * 60;
+const SESSION_SCAN_OVERRIDE_LIMIT = 10_000;
+export async function runSessions(command, io) {
+    const now = new Date();
+    const homeDir = command.homeDir ?? os.homedir();
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
+    const window = await sessionsScanWindow(command, now);
+    const wantCodex = command.source !== "claude";
+    const wantClaude = command.source !== "codex";
+    const codex = wantCodex
+        ? await scanAndAttributeCodexSessions({
+            sessionsDirs: defaultCodexSessionDirs(homeDir),
+            worktrees,
+            now,
+            sinceMinutes: window.since_minutes ?? CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES,
+            limit: window.limit,
+        })
+        : null;
+    const claude = wantClaude
+        ? await scanAndAttributeClaudeSessions({
+            projectsDir: path.join(homeDir, ".claude", "projects"),
+            worktrees,
+            now,
+            sinceMinutes: window.since_minutes ?? undefined,
+            limit: window.mode === "default" ? undefined : window.limit,
+        })
+        : null;
+    // Safe output contract (B.4 §6): id, state, reason, scores, signals, sidecar
+    // skip reasons, plus the repo_label basename. Branch is intentionally omitted
+    // — branch names can carry operator-authored task/customer text.
+    const codexRows = (codex?.results ?? []).map((result) => ({
+        source: "codex",
+        session_id: result.codex_session_id,
+        state: result.state,
+        reason: result.reason,
+        attribution_score: result.attribution_score,
+        path_score: result.path_score,
+        signals: result.signals,
+        repo_label: result.worktree?.repo_label ?? null,
+    }));
+    const claudeRows = (claude?.results ?? []).map((result) => ({
+        source: "claude_code",
+        session_id: result.claude_session_id,
+        state: result.state,
+        reason: result.reason,
+        attribution_score: result.attribution_score,
+        path_score: result.path_score,
+        signals: result.signals,
+        repo_label: result.worktree?.repo_label ?? null,
+        main_file_oversized: result.main_file_oversized,
+        sidecar_skips: result.sidecar_files
+            .filter((sidecar) => sidecar.skipped_reason)
+            .map((sidecar) => ({
+            file_name: sidecar.file_name,
+            reason: sidecar.skipped_reason,
+        })),
+    }));
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({
+            window,
+            ...(codex
+                ? { codex: { counts: codex.counts, sessions: codexRows } }
+                : {}),
+            ...(claude
+                ? {
+                    claude: {
+                        counts: claude.counts,
+                        project_dirs_skipped: claude.project_dirs_skipped,
+                        sessions: claudeRows,
+                    },
+                }
+                : {}),
+        }, null, 2));
+        return 0;
+    }
+    writeLine(io.stdout, "Cockpit sessions (read-only attribution)");
+    writeLine(io.stdout, `window: ${sessionsWindowLine(window)}`);
+    for (const row of codexRows) {
+        writeLine(io.stdout, sessionRowLine(row));
+    }
+    for (const row of claudeRows) {
+        writeLine(io.stdout, sessionRowLine(row));
+        for (const sidecar of row.sidecar_skips) {
+            writeLine(io.stdout, `    sidecar ${sidecar.file_name}: ${sidecar.reason}`);
+        }
+    }
+    if (codexRows.length === 0 && claudeRows.length === 0) {
+        writeLine(io.stdout, "No sessions observed in the scan window.");
+    }
+    return 0;
+}
+/** `--all`, an explicit `--since-days` capped at pairing, or the default window. */
+async function sessionsScanWindow(command, now) {
+    if (command.all) {
+        return {
+            mode: "all",
+            since_days: null,
+            started_at: new Date(now.getTime() - ALL_SESSION_SCAN_WINDOW_MINUTES * 60_000)
+                .toISOString(),
+            paired_at: await readPairedAt(command.homeDir),
+            since_minutes: ALL_SESSION_SCAN_WINDOW_MINUTES,
+            limit: SESSION_SCAN_OVERRIDE_LIMIT,
+        };
+    }
+    if (command.sinceDays !== undefined) {
+        const requestedMs = now.getTime() - command.sinceDays * 24 * 60 * 60_000;
+        const pairedAt = await readPairedAt(command.homeDir);
+        const pairedMs = pairedAt ? Date.parse(pairedAt) : Number.NaN;
+        const startedAtMs = Number.isFinite(pairedMs)
+            ? Math.max(requestedMs, pairedMs)
+            : requestedMs;
+        return {
+            mode: "since_days",
+            since_days: command.sinceDays,
+            started_at: new Date(startedAtMs).toISOString(),
+            paired_at: pairedAt,
+            since_minutes: Math.max(1, Math.ceil((now.getTime() - startedAtMs) / 60_000)),
+            limit: SESSION_SCAN_OVERRIDE_LIMIT,
+        };
+    }
+    return {
+        mode: "default",
+        since_days: null,
+        started_at: null,
+        paired_at: await readPairedAt(command.homeDir),
+        since_minutes: null,
+        limit: CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT,
+    };
+}
+async function readPairedAt(homeDir) {
+    const session = await readLocalCollectorSessionFile(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    return typeof session?.paired_at === "string" ? session.paired_at : null;
+}
+function sessionsWindowLine(window) {
+    if (window.mode === "all")
+        return "all local history";
+    if (window.mode === "since_days") {
+        return `since ${window.started_at} (${window.since_days} day request, paired_at cap ${window.paired_at ?? "unavailable"})`;
+    }
+    return "default scan window";
+}
+function sessionRowLine(row) {
+    const repo = row.repo_label ? ` repo:${row.repo_label}` : "";
+    const signals = row.signals.length > 0 ? ` signals:${row.signals.join("|")}` : "";
+    return `- [${row.source}] ${row.session_id} ${row.state} (${row.reason}) score:${row.attribution_score} path:${row.path_score}${repo}${signals}`;
+}

package/dist/commands/status.js

@@ -0,0 +1,191 @@
+/**
+ * `cockpit status` — what this machine believes about itself: install, pairing,
+ * active work, upload state, retry backlog, and how far historical backfill
+ * has got.
+ *
+ * Read-only. Split out of commands/local.ts (BLI-3104); moved verbatim, since
+ * every line here is what an intern pastes into Slack when something looks
+ * wrong.
+ */
+import { readdir, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { writeLine } from "./cli-io.js";
+import { displayTicketId, displayWorkLabel, shortSha, stuckEvidenceLine, } from "./collection-report.js";
+import { discoverCommandWorktrees } from "./local-discovery.js";
+import { defaultCodexSessionDirs } from "../adapters/codex-attribution.js";
+import { backfillCompletionCovers, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
+import { getCollectorRuntimePaths, inspectLocalCollectorStatus, readLocalCollectorConfig, } from "../local-state.js";
+import { normalizeCollectionRoots } from "../root-normalization.js";
+export async function runStatus(command, io) {
+    const backfillCursor = await inspectBackfillCursor(command.homeDir);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
+    if (worktrees.length > 1) {
+        const statuses = await Promise.all(worktrees.map(async (worktree) => ({
+            ...(await inspectLocalCollectorStatus({
+                homeDir: command.homeDir,
+                repoRoot: worktree.repo_root,
+            })),
+            head_sha: worktree.head_sha,
+        })));
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({ mode: "multi_repo", statuses, backfill_cursor: backfillCursor }, null, 2));
+            return 0;
+        }
+        writeLine(io.stdout, "Cockpit parent status");
+        writeLine(io.stdout, `backfill: ${backfillCursorLine(backfillCursor)}`);
+        for (const status of statuses) {
+            writeLine(io.stdout, `- ${status.repo_label ?? status.repo}/${status.worktree_label ?? "worktree"} · ${status.branch} · head:${shortSha(status.head_sha)} · ${status.upload_state}`);
+        }
+        return 0;
+    }
+    const status = await inspectLocalCollectorStatus(command);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ...status, backfill_cursor: backfillCursor }, null, 2));
+        return 0;
+    }
+    writeLine(io.stdout, "Cockpit local status");
+    writeLine(io.stdout, `installed: ${status.installed}`);
+    writeLine(io.stdout, `session_state: ${status.session_state}`);
+    writeLine(io.stdout, `repo: ${status.repo}`);
+    writeLine(io.stdout, `branch: ${status.branch}`);
+    writeLine(io.stdout, `ticket: ${displayTicketId(status.active_ticket_id)}`);
+    writeLine(io.stdout, `work: ${displayWorkLabel(status)}`);
+    writeLine(io.stdout, `collector_freshness: ${status.collector_freshness}`);
+    writeLine(io.stdout, `collector_version: ${status.collector_version}`);
+    writeLine(io.stdout, `upload_state: ${status.upload_state}`);
+    writeLine(io.stdout, `last_upload_attempt: ${status.last_upload_attempt_at ?? "never"}`);
+    writeLine(io.stdout, `last_upload_success: ${status.last_upload_success_at ?? "never"}`);
+    writeLine(io.stdout, `last_upload_failure: ${status.last_upload_failure_reason ?? "none"}`);
+    writeLine(io.stdout, `pending_uploads: ${status.pending_upload_count}`);
+    writeLine(io.stdout, `pending_health_receipts: ${status.pending_health_receipt_count}`);
+    writeLine(io.stdout, `last_health_receipt_failure: ${status.last_health_receipt_failure_reason ?? "none"}`);
+    writeLine(io.stdout, `backfill: ${backfillCursorLine(backfillCursor)}`);
+    writeLine(io.stdout, `stuck_evidence: ${stuckEvidenceLine(status)}`);
+    for (const detail of status.details)
+        writeLine(io.stdout, `- ${detail}`);
+    return 0;
+}
+/**
+ * Done, still working, or never started — and when it is still working, how
+ * many session files sit older than the cursor.
+ */
+async function inspectBackfillCursor(homeDir) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    const roots = await currentBackfillRoots(homeDir);
+    const marker = await readBackfillCompletionMarker(paths);
+    if (backfillCompletionCovers(marker, roots, ["codex", "claude_code"])) {
+        return {
+            state: "done",
+            remaining_count: 0,
+            updated_at: marker?.cursor.updated_at ?? null,
+            completed_at: marker?.completed_at ?? null,
+            sources: summarizeBackfillCursorSources(marker?.cursor ?? emptyBackfillCursorState()),
+        };
+    }
+    const cursor = (prepareBackfillCursorForScope(await readBackfillCursor(paths), roots, ["codex", "claude_code"])).cursor;
+    if (!cursor.updated_at) {
+        return {
+            state: "never_run",
+            remaining_count: 0,
+            updated_at: null,
+            completed_at: null,
+            sources: summarizeBackfillCursorSources(cursor),
+        };
+    }
+    return {
+        state: "remaining",
+        remaining_count: await countRemainingBackfillSessionFiles(homeDir ?? os.homedir(), cursor),
+        updated_at: cursor.updated_at,
+        completed_at: null,
+        sources: summarizeBackfillCursorSources(cursor),
+    };
+}
+async function currentBackfillRoots(homeDir) {
+    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    return normalizeCollectionRoots(config?.default_repo_paths ?? []);
+}
+function summarizeBackfillCursorSources(cursor) {
+    return {
+        codex: summarizeBackfillSource(cursor.sources.codex),
+        claude_code: summarizeBackfillSource(cursor.sources.claude_code),
+    };
+}
+function summarizeBackfillSource(source) {
+    return {
+        oldest_mtime_processed: source.oldest_mtime_processed,
+        observed_count: Object.values(source.state_counts).reduce((total, count) => total + count, 0),
+        state_counts: source.state_counts,
+        reason_counts: source.reason_counts,
+    };
+}
+function backfillCursorLine(status) {
+    switch (status.state) {
+        case "done":
+            return `done (${status.completed_at ?? "completion marker present"})`;
+        case "never_run":
+            return "never run";
+        case "remaining":
+            return `${status.remaining_count} remaining`;
+    }
+}
+async function countRemainingBackfillSessionFiles(homeDir, cursor) {
+    const codex = await countJsonlFilesBeforeCursor(defaultCodexSessionDirs(homeDir), cursor.sources.codex.oldest_mtime_ms_processed);
+    const claude = await countClaudeMainFilesBeforeCursor(path.join(homeDir, ".claude", "projects"), cursor.sources.claude_code.oldest_mtime_ms_processed);
+    return codex + claude;
+}
+async function countJsonlFilesBeforeCursor(roots, oldestProcessedMs) {
+    let count = 0;
+    await walkFiles(roots, async (filePath, entryName) => {
+        if (!entryName.endsWith(".jsonl"))
+            return;
+        const info = await stat(filePath).catch(() => null);
+        if (!info?.isFile())
+            return;
+        if (oldestProcessedMs === null || info.mtimeMs < oldestProcessedMs)
+            count += 1;
+    });
+    return count;
+}
+async function countClaudeMainFilesBeforeCursor(projectsDir, oldestProcessedMs) {
+    let count = 0;
+    await walkFiles([projectsDir], async (filePath, entryName) => {
+        if (!entryName.endsWith(".jsonl"))
+            return;
+        if (filePath.includes(`${path.sep}subagents${path.sep}`))
+            return;
+        const info = await stat(filePath).catch(() => null);
+        if (!info?.isFile())
+            return;
+        if (oldestProcessedMs === null || info.mtimeMs < oldestProcessedMs)
+            count += 1;
+    });
+    return count;
+}
+/** Unreadable folders are skipped rather than failing the walk. */
+async function walkFiles(roots, onFile, shouldStop = () => false) {
+    const stack = [...roots];
+    while (stack.length > 0 && !shouldStop()) {
+        const current = stack.pop();
+        if (!current)
+            continue;
+        let entries;
+        try {
+            entries = await readdir(current, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (shouldStop())
+                return;
+            const full = path.join(current, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(full);
+            }
+            else if (entry.isFile()) {
+                await onFile(full, entry.name);
+            }
+        }
+    }
+}

package/dist/evidence-upload-client.js

@@ -1,4 +1,4 @@
-import { RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
+import { COMMIT_CRASHED_PLATFORM, RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 const DEFAULT_MAX_ATTEMPTS = 3;
@@ -289,6 +289,29 @@ async function uploadOneObject(options, entry, disposition, chunkSizeBytes) {
         if (permanent) {
             return failedOutcome(entry.file, permanent, uploadedChunks);
         }
+        // A 5xx whose body is not JSON did not come from the route. The commit
+        // handler always answers `{ code, message, ... }`; an HTML error page means
+        // the serverless process was killed — an out-of-memory on a large
+        // assembly, or a hard timeout — so nothing server-side ran a catch, wrote a
+        // ledger reason, or logged a line. Naming it separately is the only way an
+        // operator reading upload reasons can tell "the server refused these bytes"
+        // from "the server never survived them".
+        //
+        // The stem comes from telemetry-core so the label the collector writes and
+        // the label `classifyUploadFailure` reads are the same string by
+        // construction; the status rides on the end so a 502 gateway timeout can
+        // still be told from a 500 process kill, and core strips it back off.
+        if (commit.status >= 500 && isNonJsonResponseBody(commit.body)) {
+            console.error("[evidence-commit] the server died before it could answer; the object is still pending", JSON.stringify({
+                upload_id: disposition.upload_id,
+                http_status: commit.status,
+                byte_size: entry.bytes.byteLength,
+                chunk_count: entry.chunkCount,
+                uploaded_chunk_count: uploadedChunks,
+                reason: COMMIT_CRASHED_PLATFORM,
+            }));
+            return failedOutcome(entry.file, `${COMMIT_CRASHED_PLATFORM}_http_${commit.status}`, uploadedChunks);
+        }
         const detail = safeFailureDetail(commit.body);
         return failedOutcome(entry.file, `commit_failed_http_${commit.status}${detail ? `_${detail}` : ""}`, uploadedChunks);
     }
@@ -530,6 +553,22 @@ function summarizeOutcomes(outcomes, usedLegacyFallback) {
         used_legacy_fallback: usedLegacyFallback,
     };
 }
+/**
+ * Marks a body the server did not produce as JSON.
+ *
+ * A dashboard route always answers with a JSON envelope, so an HTML body on a
+ * 500 means the response came from the platform's error page and not from the
+ * route — the process died before any handler ran. That distinction is the
+ * whole difference between "the commit rejected these bytes" and "the commit
+ * never got to decide", and it was invisible for the nine days of BLI-3067
+ * because both collapsed into `commit_failed_http_500`.
+ */
+export const NON_JSON_RESPONSE_BODY_KEY = "__cockpit_response_body_format";
+function isNonJsonResponseBody(body) {
+    return (!!body &&
+        typeof body === "object" &&
+        body[NON_JSON_RESPONSE_BODY_KEY] === "non_json");
+}
 async function readResponseJson(response) {
     const text = await response.text();
     if (!text)
@@ -538,7 +577,9 @@ async function readResponseJson(response) {
         return JSON.parse(text);
     }
     catch {
-        return { message: text };
+        // The raw text is kept for the caller that wants to show it, never for a
+        // label or a log — it is an unbounded HTML page.
+        return { message: text, [NON_JSON_RESPONSE_BODY_KEY]: "non_json" };
     }
 }
 function batches(items, size) {

package/dist/raw-evidence-staging.js

@@ -1,3 +1,4 @@
+import { DELIVERY_BACKOFF_HOLDING } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -34,8 +35,20 @@ export const RAW_EVIDENCE_STAGING_FILENAME = "raw-evidence-staging.json";
  */
 export const EVIDENCE_DELIVERY_BACKOFF_BASE_MS = 15 * 60 * 1000;
 export const EVIDENCE_DELIVERY_BACKOFF_MAX_MS = 6 * 60 * 60 * 1000;
-/** The reason label written when an object is being held by backoff. */
-export const DELIVERY_BACKOFF_HOLDING_REASON = "delivery_backoff_holding";
+/**
+ * The reason label written when an object is being held by backoff.
+ *
+ * Aliased from telemetry-core rather than spelled again here: the label is read
+ * by `classifyUploadFailure` on the way through the ledger, and a second copy
+ * of the string is how the collector's word and the server's word drift apart.
+ */
+export const DELIVERY_BACKOFF_HOLDING_REASON = DELIVERY_BACKOFF_HOLDING;
+/** The reason label written when an operator's retry is offered anyway. */
+export const DELIVERY_BACKOFF_BYPASS_REASON = "delivery_backoff_bypassed_operator_retry";
+/** Whether the delivery-backoff window gates this pass. Default: it does. */
+export function deliveryBackoffApplies(mode) {
+    return (mode ?? "scheduled") === "scheduled";
+}
 const MAX_TRACKED_STAGED_OBJECTS = 5_000;
 const MAX_TRACKED_DELIVERY_ATTEMPTS = 5_000;
 export function emptyRawEvidenceStagingState() {

package/dist/upload-agent-artifacts.js

@@ -0,0 +1,153 @@
+/**
+ * Telling the dashboard about images an agent produced or was shown.
+ *
+ * A screenshot pasted into a Codex or Claude session is already uploaded as raw
+ * evidence like any other object; this is the second, separate report that says
+ * "that object is an image, from this session, at this turn" so the dashboard
+ * can queue it for redaction and OCR.
+ *
+ * Non-fatal by design: an older dashboard without the endpoint must not fail a
+ * harvest, so every path here returns a `{ posted, reason }` label instead of
+ * throwing.
+ */
+import { AgentImageArtifactReportRequestSchema, } from "@bli-cockpit/telemetry-core";
+import { readResponseJson } from "./upload-http.js";
+export async function reportAgentImageArtifacts(options) {
+    const artifacts = agentArtifactsFromEvidence(options);
+    if (artifacts.length === 0) {
+        return {
+            posted: false,
+            reason: "no_agent_image_artifacts",
+            recorded_count: 0,
+        };
+    }
+    const payload = AgentImageArtifactReportRequestSchema.parse({
+        schema_version: "ambient-agent-image-artifacts.v1",
+        generated_at: options.generatedAt,
+        provenance: options.provenance,
+        artifacts,
+    });
+    try {
+        const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/agent-artifacts`, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${options.deviceToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(payload),
+        });
+        if (response.status === 404) {
+            return {
+                posted: false,
+                reason: "agent_artifact_api_unavailable",
+                recorded_count: 0,
+            };
+        }
+        if (!response.ok) {
+            return {
+                posted: false,
+                reason: `report_failed_http_${response.status}`,
+                recorded_count: 0,
+            };
+        }
+        const body = await readResponseJson(response);
+        const recordedCount = body && typeof body === "object"
+            ? Number(body.recorded_count ?? 0)
+            : 0;
+        return {
+            posted: true,
+            reason: "recorded",
+            recorded_count: Number.isFinite(recordedCount) ? recordedCount : 0,
+        };
+    }
+    catch {
+        return { posted: false, reason: "report_network_error", recorded_count: 0 };
+    }
+}
+/**
+ * The images this sync made durable, from both directions.
+ *
+ * Freshly uploaded objects come from the upload outcomes; images whose bytes
+ * this machine already had come from the cursor, which is the only place their
+ * object key still exists. Keyed by pointer id so a replay of the same image
+ * reports once, with the fresher outcome winning.
+ */
+function agentArtifactsFromEvidence(options) {
+    const byPointerId = new Map();
+    for (const outcome of options.outcomes) {
+        if (outcome.upload_state === "upload_failed" || !outcome.artifact_metadata) {
+            continue;
+        }
+        const artifact = agentArtifactFromMetadata({
+            metadata: outcome.artifact_metadata,
+            rawEvidencePointerId: outcome.pointer.raw_evidence_pointer_id,
+            objectKey: outcome.object_key,
+            ticketId: options.ticketId,
+            repoFingerprint: options.repoFingerprint,
+            worktreeFingerprint: options.worktreeFingerprint,
+            uploadState: outcome.upload_state,
+        });
+        byPointerId.set(artifact.raw_evidence_pointer_id, artifact);
+    }
+    for (const entry of options.reused) {
+        if (!entry.artifact_metadata)
+            continue;
+        const objectKey = options.cursorObjects[entry.content_hash_sha256]?.object_key;
+        if (!objectKey)
+            continue;
+        const artifact = agentArtifactFromMetadata({
+            metadata: entry.artifact_metadata,
+            rawEvidencePointerId: objectKey,
+            objectKey,
+            ticketId: options.ticketId,
+            repoFingerprint: options.repoFingerprint,
+            worktreeFingerprint: options.worktreeFingerprint,
+            uploadState: "reused_existing",
+        });
+        byPointerId.set(artifact.raw_evidence_pointer_id, artifact);
+    }
+    return [...byPointerId.values()];
+}
+/**
+ * One report row. Redaction and OCR both start as `not_started`: the dashboard
+ * owns those passes, and the collector must never claim an image has been
+ * cleared when nothing has looked at it yet.
+ */
+function agentArtifactFromMetadata(options) {
+    return {
+        raw_evidence_pointer_id: options.rawEvidencePointerId,
+        agent_source: options.metadata.agent_source,
+        source_session_id: options.metadata.source_session_id,
+        ...(options.metadata.source_message_id
+            ? { source_message_id: options.metadata.source_message_id }
+            : {}),
+        ...(options.metadata.turn_index !== undefined
+            ? { turn_index: options.metadata.turn_index }
+            : {}),
+        occurred_at: options.metadata.occurred_at,
+        artifact_kind: options.metadata.artifact_kind,
+        capture_origin: "agent_session_attachment",
+        ...(options.ticketId ? { ticket_id: options.ticketId } : {}),
+        ...(options.repoFingerprint
+            ? { repo_fingerprint: options.repoFingerprint }
+            : {}),
+        ...(options.worktreeFingerprint
+            ? { worktree_fingerprint: options.worktreeFingerprint }
+            : {}),
+        storage_bucket: "ambient-raw-evidence",
+        object_key: options.objectKey,
+        content_hash_sha256: options.metadata.content_hash_sha256,
+        byte_size: options.metadata.byte_size,
+        media_type: options.metadata.media_type,
+        width: options.metadata.width,
+        height: options.metadata.height,
+        redaction_status: "not_started",
+        ocr_status: "not_started",
+        labels: {
+            collector_upload_state: options.uploadState,
+            ...(options.metadata.source_sidecar_id
+                ? { source_sidecar_id: options.metadata.source_sidecar_id }
+                : {}),
+        },
+    };
+}