@bli-cockpit/cli 0.2.292 → 0.2.294

package/dist/adapters/claude-attribution-discovery.js

@@ -208,4 +208,26 @@ function isMissingPathError(error) {
     return (error instanceof Error &&
         "code" in error &&
         error.code === "ENOENT");
+}
+/** Multiple native homes use the same reader and aggregate every read failure. */
+export async function discoverClaudeSessionHomes(projectsDirs, cutoffMs) {
+    const combined = {
+        sessions: [], projectDirsSkipped: 0, projectDirReadFailedCount: 0,
+        sessionStatFailedCount: 0, sidecarDirReadFailedCount: 0, sidecarStatFailedCount: 0,
+    };
+    const seenHomes = new Set();
+    for (const root of projectsDirs) {
+        const identity = await fs.realpath(root).catch(() => path.resolve(root));
+        if (seenHomes.has(identity))
+            continue;
+        seenHomes.add(identity);
+        const discovered = await discoverClaudeSessions(root, cutoffMs);
+        combined.sessions.push(...discovered.sessions);
+        combined.projectDirsSkipped += discovered.projectDirsSkipped;
+        combined.projectDirReadFailedCount += discovered.projectDirReadFailedCount;
+        combined.sessionStatFailedCount += discovered.sessionStatFailedCount;
+        combined.sidecarDirReadFailedCount += discovered.sidecarDirReadFailedCount;
+        combined.sidecarStatFailedCount += discovered.sidecarStatFailedCount;
+    }
+    return combined;
 }

package/dist/adapters/claude-attribution-memoized-reads.js

@@ -1,4 +1,4 @@
-import { captureSessionFactsDelta, observeSessionFactsContent, observeSessionFactsFile, parseSessionFactsDelta, SESSION_FACTS_VERSION, SKILL_USE_VERSION, } from "@bli-cockpit/telemetry-core";
+import { captureSessionFactsDelta, HANDS_ON_RULE_ID, observeSessionFactsContent, observeSessionFactsFile, parseSessionFactsDelta, SESSION_FACTS_VERSION, SKILL_USE_VERSION, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import { extractClaudeSessionSignals } from "./claude-attribution-signals.js";
@@ -9,8 +9,8 @@ import { statSourceForMemo } from "./transcript-read-memo.js";
  * opened or recalled, so a recalled file leaves the session's facts exactly as a fresh read does by construction
  * (`session-facts-delta.ts`). Bump SIGNALS_VERSION when `claude-attribution-signals.ts` changes what it extracts.
  */
-const SIGNALS_VERSION = "signals.v1";
-export const ATTRIBUTION_READ_RECIPE = ["attribution-reads.v1", SIGNALS_VERSION, SESSION_FACTS_VERSION, SKILL_USE_VERSION].join("|");
+const SIGNALS_VERSION = "signals.v2-hands-on";
+export const ATTRIBUTION_READ_RECIPE = ["attribution-reads.v1", SIGNALS_VERSION, SESSION_FACTS_VERSION, SKILL_USE_VERSION, HANDS_ON_RULE_ID].join("|");
 const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
 const isStrings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
 const isNum = (v) => typeof v === "number" && Number.isFinite(v);

package/dist/adapters/claude-attribution.js

@@ -21,7 +21,8 @@
  *   -score      reads/streams one session's signals and scores it
  *   -signals    allowlisted JSONL signal extraction, in-memory and streamed
  */
-import { discoverClaudeSessions } from "./claude-attribution-discovery.js";
+import { summarizeHandsOn } from "@bli-cockpit/telemetry-core";
+import { discoverClaudeSessionHomes } from "./claude-attribution-discovery.js";
 import { attributeOneSession } from "./claude-attribution-score.js";
 import { CLAUDE_ATTRIBUTION_DEFAULT_SINCE_MINUTES, CLAUDE_ATTRIBUTION_DEFAULT_SESSION_LIMIT, CLAUDE_SESSION_MAX_FILE_BYTES, CLAUDE_SESSION_MAX_SIDECAR_FILES, MAX_LINE_BUFFER_BYTES, } from "./claude-attribution-types.js";
 // Re-exports: this module's public surface is unchanged by the split above.
@@ -31,7 +32,7 @@ export async function scanAndAttributeClaudeSessions(options) {
     const sinceMinutes = options.sinceMinutes ?? CLAUDE_ATTRIBUTION_DEFAULT_SINCE_MINUTES;
     const limit = options.limit ?? CLAUDE_ATTRIBUTION_DEFAULT_SESSION_LIMIT;
     const cutoffMs = options.now.getTime() - sinceMinutes * 60 * 1000;
-    const discovery = await discoverClaudeSessions(options.projectsDir, cutoffMs);
+    const discovery = await discoverClaudeSessionHomes(options.projectsDirs ?? [options.projectsDir], cutoffMs);
     const sessions = discovery.sessions
         .sort((a, b) => b.recencyMs - a.recencyMs)
         .slice(0, limit);
@@ -41,6 +42,8 @@ export async function scanAndAttributeClaudeSessions(options) {
     }
     const sumBy = (pick) => results.reduce((total, result) => total + pick(result), 0);
     const countState = (state) => results.filter((result) => result.state === state).length;
+    // Collector stdout is `--json`, so the line goes to stderr; counts only (BLI-23623).
+    console.error("[hands-on] claude scan", JSON.stringify({ client: "claude_code", ...summarizeHandsOn(results.map((r) => r.session_facts)) }));
     return {
         results,
         discovered_session_count: discovery.sessions.length,

package/dist/adapters/codex-attribution-memoized-reads.js

@@ -1,4 +1,4 @@
-import { SESSION_FACTS_VERSION, SKILL_USE_VERSION } from "@bli-cockpit/telemetry-core";
+import { HANDS_ON_RULE_ID, SESSION_FACTS_VERSION, SKILL_USE_VERSION } from "@bli-cockpit/telemetry-core";
 import { readCodexMetadataSignals } from "./codex-session-signals.js";
 import { statSourceForMemo } from "./transcript-read-memo.js";
 /**
@@ -11,8 +11,8 @@ import { statSourceForMemo } from "./transcript-read-memo.js";
  * worktrees and the cwd-exists check run after the read, on every tick, so a repo that appears or vanishes is
  * seen at once. Bump SIGNALS_VERSION when `codex-session-signals.ts` changes what it extracts.
  */
-const SIGNALS_VERSION = "codex-signals.v1";
-export const CODEX_READ_RECIPE = ["codex-reads.v1", SIGNALS_VERSION, SESSION_FACTS_VERSION, SKILL_USE_VERSION].join("|");
+const SIGNALS_VERSION = "codex-signals.v2-hands-on";
+export const CODEX_READ_RECIPE = ["codex-reads.v1", SIGNALS_VERSION, SESSION_FACTS_VERSION, SKILL_USE_VERSION, HANDS_ON_RULE_ID].join("|");
 const isStrings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
 const isNum = (v) => typeof v === "number" && Number.isFinite(v);
 const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);

package/dist/adapters/codex-attribution.js

@@ -1,7 +1,13 @@
+import { retainedCodexSegments } from "./codex-segment-discovery.js";
+import { openCodexSessionRevision, pinnedBytes } from "./codex-session-revision.js";
+import { readCodexMetadataSignals } from "./codex-session-signals.js";
+import { nativeSessionRoots } from "../native-session-roots.js";
+import { summarizeHandsOn } from "@bli-cockpit/telemetry-core";
 import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { describeError } from "../health-detail.js";
+import { TranscriptReadError } from "./transcript-text-stream.js";
 import { extractCodexSessionSignals, } from "./codex-session-signals.js";
 import { readCodexMetadataMemoized } from "./codex-attribution-memoized-reads.js";
 import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
@@ -29,31 +35,36 @@ export const CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT = 500;
 // upload budgets and content guards later.
 export const CODEX_SESSION_MAX_FILE_BYTES = 10 * 1024 * 1024;
 export function defaultCodexSessionDirs(homeDir) {
-    return [
-        path.join(homeDir, ".codex", "sessions"),
-        path.join(homeDir, ".codex", "archived_sessions"),
-    ];
+    return nativeSessionRoots(homeDir).codex;
 }
 export async function scanAndAttributeCodexSessions(options) {
     const sinceMinutes = options.sinceMinutes ?? CODEX_ATTRIBUTION_DEFAULT_SINCE_MINUTES;
     const limit = options.limit ?? CODEX_ATTRIBUTION_DEFAULT_SESSION_LIMIT;
     const cutoffMs = options.now.getTime() - sinceMinutes * 60 * 1000;
-    const discovery = await discoverCodexJsonlFiles(codexSessionDirsFromOptions(options), cutoffMs);
-    const files = discovery.files.slice(0, limit);
+    const discovery = await discoverCodexJsonlFiles(codexSessionDirsFromOptions(options), Number.NEGATIVE_INFINITY);
+    const recent = discovery.files.filter(f => f.mtimeMs >= cutoffMs);
+    const retained = await retainedCodexSegments(discovery.files, recent.slice(0, limit));
+    const files = retained.sessions;
     const results = [];
     for (const file of files) {
         results.push(await attributeOneSession(file, options.worktrees, options.collectionRoots ?? [], options.readMemo));
     }
+    if (retained.projectionFailureReason)
+        for (const result of results)
+            result.t3_projection_incomplete = true;
+    // Collector stdout is `--json`, so the line goes to stderr; counts only (BLI-23623).
+    console.error("[hands-on] codex scan", JSON.stringify({ client: "codex", ...summarizeHandsOn(results.map((r) => r.session_facts)) }));
     return {
         results,
-        discovered_file_count: discovery.files.length,
-        scanned_file_count: files.length,
+        discovered_file_count: recent.length,
+        scanned_file_count: retained.selectedFiles,
         since_minutes: sinceMinutes,
         session_limit: limit,
-        session_limit_applied: discovery.files.length > limit,
+        session_limit_applied: recent.some(f => !files.some(s => (s.segmentPaths ?? [s.file]).includes(f.file))),
         max_file_bytes: 0,
         directory_read_failed_count: discovery.directoryReadFailedCount,
-        stat_failed_count: discovery.statFailedCount,
+        stat_failed_count: discovery.statFailedCount + retained.readFailed,
+        ...(retained.projectionFailureReason ? { projection_failure_reason: retained.projectionFailureReason } : {}),
         secret_path_skipped_count: discovery.secretPathSkippedCount,
         counts: {
             attributed: results.filter((entry) => entry.state === "attributed").length,
@@ -166,10 +177,38 @@ function dedupePaths(values) {
     return out;
 }
 async function attributeOneSession(file, worktrees, collectionRoots, readMemo) {
-    const base = createSessionBase(file);
+    const base = { ...createSessionBase(file), ...(file.segmentPaths ? { segment_paths: file.segmentPaths } : {}), ...(file.t3Projection ? { t3_projection: true } : {}) };
+    const readComposite = async (includeT3) => {
+        const source = await openCodexSessionRevision(file.segmentPaths, { t3Projection: includeT3 });
+        try {
+            base.local_cwds = source.segmentCwds;
+            const metadata = await readCodexMetadataSignals(file.file, pinnedBytes(source));
+            await source.verifyUnchanged();
+            return metadata;
+        }
+        finally {
+            await source.close();
+        }
+    };
     let read;
     try {
-        read = await readCodexMetadataMemoized(readMemo, file.file);
+        if (file.segmentPaths) {
+            try {
+                read = await readComposite(file.t3Projection === true);
+            }
+            catch (error) {
+                if (!file.t3Projection || !(error instanceof TranscriptReadError) || !error.stage.startsWith("t3_"))
+                    throw error;
+                // Available native content still flows; the missing projection remains a
+                // named retry and cannot promote a partial snapshot as the full revision.
+                base.t3_projection = false;
+                base.t3_projection_incomplete = true;
+                base.t3_projection_failure_reason = error.stage;
+                read = await readComposite(false);
+            }
+        }
+        else
+            read = await readCodexMetadataMemoized(readMemo, file.file);
     }
     catch (error) {
         // One skipped session, with `file_read_failed` on its row. Logged per

package/dist/adapters/codex-segment-discovery.js

@@ -0,0 +1,75 @@
+/** Expand a live selection to every retained rollout with the same native id. */
+import { createReadStream } from "node:fs";
+import readline from "node:readline";
+import path from "node:path";
+import { t3CodexProjectionSessionIds } from "./t3-projection-source.js";
+import { sanitizeSessionId, sessionIdFromFileName, shortHash } from "./attribution-core.js";
+export async function codexFileIdentity(file) {
+    const stream = createReadStream(file, { encoding: "utf8" });
+    const lines = readline.createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+        for await (const line of lines) {
+            try {
+                const record = JSON.parse(line);
+                if (record.type === "session_meta") {
+                    const id = sanitizeSessionId(record.payload?.id);
+                    if (id)
+                        return id;
+                }
+            }
+            catch { /* Partial records are retained by the content reader, not treated as identity. */ }
+        }
+        return sessionIdFromFileName(path.basename(file)) ?? shortHash(file);
+    }
+    finally {
+        lines.close();
+        stream.destroy();
+    }
+}
+export async function retainedCodexSegments(files, seeds) {
+    let readFailed = 0;
+    const wanted = new Map();
+    const selected = new Set(seeds.map(f => f.file));
+    for (const f of seeds) {
+        try {
+            const id = await codexFileIdentity(f.file);
+            const group = wanted.get(id) ?? [];
+            group.push(f);
+            wanted.set(id, group);
+        }
+        catch {
+            // Keep this selected file as a candidate: attribution records its read
+            // failure once. Only unreadable unselected identities hide discovery.
+            wanted.set(`unreadable:${f.file}`, [f]);
+        }
+    }
+    if (wanted.size)
+        for (const f of files) {
+            if (selected.has(f.file))
+                continue;
+            try {
+                const group = wanted.get(await codexFileIdentity(f.file));
+                if (group)
+                    group.push(f);
+            }
+            catch {
+                readFailed++;
+            }
+        }
+    let projectionIds = new Set(), projectionFailureReason;
+    try {
+        projectionIds = t3CodexProjectionSessionIds();
+    }
+    catch (error) {
+        projectionFailureReason = error instanceof Error ? error.message : "t3_projection_unreadable";
+    }
+    const sessions = [...wanted.entries()].map(([id, group]) => {
+        // A deterministic representative keeps existing cursor/source-path identity.
+        const representative = [...group].sort((a, b) => a.file.localeCompare(b.file))[0];
+        const mtimeMs = Math.max(...group.map(f => f.mtimeMs));
+        return { ...representative, mtimeMs, byteSize: group.reduce((n, f) => n + f.byteSize, 0),
+            ...(projectionIds.has(id) ? { t3Projection: true } : {}),
+            ...(group.length > 1 || projectionIds.has(id) ? { segmentPaths: group.map(f => f.file).sort() } : {}) };
+    });
+    return { sessions, readFailed, selectedFiles: [...wanted.values()].reduce((n, f) => n + f.length, 0), ...(projectionFailureReason ? { projectionFailureReason } : {}) };
+}

package/dist/adapters/codex-session-revision.js

@@ -0,0 +1,194 @@
+/**
+ * A native Codex session can span several disjoint rollouts. This logical JSONL
+ * revision preserves every source byte (including duplicates and broken tails),
+ * separated by explicit Tower provenance records. It never writes a raw bundle.
+ *
+ * The byte address space is shared by both image passes and read(offset, size).
+ * Each native descriptor stays open at its pinned length until the whole source
+ * closes. A strict second hash catches in-place rewrites, rotation and appends;
+ * a changed snapshot remains pending instead of acknowledging mixed revisions.
+ */
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import { createNativeT3MessageIndex } from "@bli-cockpit/telemetry-core";
+import { readT3CodexProjection, t3ProjectionRevision } from "./t3-projection-source.js";
+import { openPinnedTranscript } from "./pinned-transcript.js";
+import { TranscriptNotStreamable, TranscriptReadError, TranscriptTooLargeError } from "./transcript-text-stream.js";
+const newline = Buffer.from("\n");
+const hashOf = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const stampOf = async (file) => {
+    const s = await fs.stat(file, { bigint: true });
+    return `${s.dev}:${s.ino}:${s.size}:${s.mtimeNs}:${s.ctimeNs}`;
+};
+/** A line's exact bytes, including the newline only when it existed in the source. */
+export async function* pinnedBytes(source) {
+    for await (const line of source.lines()) {
+        if (line.bytes.length)
+            yield line.bytes;
+        if (line.start + line.bytes.length < source.length)
+            yield newline;
+    }
+}
+async function digest(source) {
+    const hash = createHash("sha256");
+    for await (const bytes of pinnedBytes(source))
+        hash.update(bytes);
+    return hash.digest("hex");
+}
+export async function openCodexSessionRevision(filePaths, options = {}) {
+    const segments = [];
+    const close = async () => { await Promise.all(segments.map(s => s.source.close())); };
+    try {
+        let nativeBytes = 0;
+        const nativeMessages = createNativeT3MessageIndex();
+        const nativeIds = new Set();
+        for (const filePath of [...new Set(filePaths)]) {
+            const stamp = await stampOf(filePath);
+            const source = await openPinnedTranscript(filePath, { maxFileBytes: options.maxFileBytes });
+            const segment = { filePath, source, stamp, sha256: "", firstTimestamp: Infinity, lastTimestamp: -Infinity, terminalNewline: false, cwds: new Set(), header: Buffer.alloc(0), start: 0 };
+            segments.push(segment);
+            nativeBytes += source.length;
+            if (options.maxFileBytes && nativeBytes > options.maxFileBytes)
+                throw new TranscriptTooLargeError(options.maxFileBytes);
+            const hash = createHash("sha256");
+            for await (const line of source.lines()) {
+                hash.update(line.bytes);
+                if (line.start + line.bytes.length < source.length)
+                    hash.update(newline);
+                // Timestamp metadata only. Record bodies never leave this process.
+                try {
+                    const r = JSON.parse(line.bytes.toString("utf8"));
+                    if (options.t3Projection)
+                        nativeMessages.observe(r, hashOf(line.bytes));
+                    if (r.type === "session_meta" && typeof r.payload?.id === "string")
+                        nativeIds.add(r.payload.id);
+                    if ((r.type === "session_meta" || r.type === "turn_context") && typeof r.payload?.cwd === "string")
+                        segment.cwds.add(r.payload.cwd);
+                    const time = r.type === "session_meta" ? NaN : Date.parse(r.timestamp ?? "");
+                    if (Number.isFinite(time)) {
+                        segment.firstTimestamp = Math.min(segment.firstTimestamp, time);
+                        segment.lastTimestamp = Math.max(segment.lastTimestamp, time);
+                    }
+                }
+                catch (error) {
+                    if (error instanceof Error && error.message === "t3_native_identity_index_capped")
+                        throw error;
+                    /* Broken/partial lines stay verbatim in the logical revision. */
+                }
+            }
+            segment.sha256 = hash.digest("hex");
+            segment.terminalNewline = source.length > 0 && (await source.read(source.length - 1, 1))[0] === 10;
+        }
+        segments.sort((a, b) => a.firstTimestamp - b.firstTimestamp || a.lastTimestamp - b.lastTimestamp || hashOf(a.filePath).localeCompare(hashOf(b.filePath)));
+        let length = 0;
+        for (const [index, s] of segments.entries()) {
+            s.start = length;
+            s.header = Buffer.from(JSON.stringify({ type: "tower_codex_segment", payload: {
+                    schema_version: "codex-segments.v1", index, source_path_sha256: hashOf(s.filePath),
+                    source_content_hash_sha256: s.sha256, source_byte_size: s.source.length,
+                    terminal_newline: s.terminalNewline,
+                } }) + "\n");
+            length += s.header.length + s.source.length + (s.terminalNewline || s.source.length === 0 ? 0 : 1);
+        }
+        // Projection bytes are bounded, pinned in memory, and use the SAME governed
+        // staging/redaction stream. No native transcript aggregate or unmanaged raw copy.
+        const nativeId = options.t3Projection && nativeIds.size === 1 ? [...nativeIds][0] : null;
+        const projection = nativeId ? readT3CodexProjection(nativeId, options.projectionHomeDir) : [];
+        const projectionRevision = t3ProjectionRevision(projection);
+        const supplementalCwds = projection.flatMap(message => nativeMessages.turnCwds(message));
+        const extra = projection.map(message => {
+            const nativeCopy = nativeMessages.copyOf(message);
+            return Buffer.from(JSON.stringify({ type: "tower_t3_message", timestamp: message.created_at,
+                payload: { ...message, ...(nativeCopy ? { native_copy: nativeCopy } : {}) } }) + "\n");
+        });
+        const supplementalStart = length;
+        const extraOffsets = [];
+        for (const bytes of extra) {
+            extraOffsets.push(length);
+            length += bytes.length;
+        }
+        if (options.maxFileBytes && length > options.maxFileBytes)
+            throw new TranscriptTooLargeError(options.maxFileBytes);
+        const logical = {
+            length, sha256: "", segmentCount: segments.length, segmentCwds: [...segments.flatMap(s => s.cwds.size ? [...s.cwds] : [null]), ...supplementalCwds],
+            async *lines() {
+                for (const s of segments) {
+                    yield { start: s.start, bytes: s.header.subarray(0, -1) };
+                    for await (const line of s.source.lines()) {
+                        if (line.start === s.source.length)
+                            continue;
+                        yield { start: s.start + s.header.length + line.start, bytes: line.bytes };
+                    }
+                }
+                for (const [i, bytes] of extra.entries())
+                    yield { start: extraOffsets[i], bytes: bytes.subarray(0, -1) };
+                yield { start: length, bytes: Buffer.alloc(0) };
+            },
+            async read(offset, size) {
+                if (offset < 0 || size < 0 || offset + size > length)
+                    throw new TranscriptNotStreamable("composite_range_invalid");
+                const output = Buffer.allocUnsafe(size);
+                let done = 0;
+                for (const s of segments) {
+                    const parts = [
+                        { start: s.start, length: s.header.length, read: async (o, n) => s.header.subarray(o, o + n) },
+                        { start: s.start + s.header.length, length: s.source.length, read: (o, n) => s.source.read(o, n) },
+                        { start: s.start + s.header.length + s.source.length, length: s.terminalNewline || s.source.length === 0 ? 0 : 1, read: async () => newline },
+                    ];
+                    for (const p of parts) {
+                        const from = Math.max(offset, p.start), to = Math.min(offset + size, p.start + p.length);
+                        if (to <= from)
+                            continue;
+                        const bytes = await p.read(from - p.start, to - from);
+                        bytes.copy(output, done);
+                        done += bytes.length;
+                    }
+                }
+                if (offset + size > supplementalStart)
+                    for (const [i, bytes] of extra.entries()) {
+                        const start = extraOffsets[i], from = Math.max(offset, start), to = Math.min(offset + size, start + bytes.length);
+                        if (to <= from)
+                            continue;
+                        const part = bytes.subarray(from - start, to - start);
+                        part.copy(output, done);
+                        done += part.length;
+                    }
+                if (done !== size)
+                    throw new TranscriptNotStreamable("composite_range_invalid");
+                return output;
+            },
+            async verifyUnchanged() {
+                for (const s of segments) {
+                    await s.source.verifyUnchanged();
+                    if (await stampOf(s.filePath) !== s.stamp || await digest(s.source) !== s.sha256)
+                        throw new TranscriptNotStreamable("file_changed_during_pass");
+                }
+                if (nativeId) {
+                    let currentProjection;
+                    try {
+                        currentProjection = readT3CodexProjection(nativeId, options.projectionHomeDir);
+                    }
+                    catch (error) {
+                        if (error instanceof Error && error.message.startsWith("t3_"))
+                            throw new TranscriptReadError(error.message, error);
+                        throw error;
+                    }
+                    if (t3ProjectionRevision(currentProjection) !== projectionRevision)
+                        throw new TranscriptNotStreamable("composite_revision_changed");
+                }
+            },
+            close,
+        };
+        logical.sha256 = await digest(logical);
+        await logical.verifyUnchanged();
+        if (options.expectedHash && logical.sha256 !== options.expectedHash)
+            throw new TranscriptNotStreamable("composite_revision_changed");
+        return logical;
+    }
+    catch (error) {
+        await close();
+        if (error instanceof Error && error.message.startsWith("t3_"))
+            throw new TranscriptReadError(error.message, error);
+        throw error;
+    }
+}

package/dist/adapters/codex-session-signals.js

@@ -28,11 +28,11 @@ const CODEX_ATTRIBUTION_MAX_LINE_BYTES = 2 * 1024 * 1024;
  * One session file, streamed: the metadata signals, the sha256 of every byte
  * that went past, and the size the walk should believe.
  */
-export async function readCodexMetadataSignals(filePath) {
+export async function readCodexMetadataSignals(filePath, byteSource) {
     const hash = crypto.createHash("sha256");
     const decoder = new StringDecoder("utf8");
     const state = makeSignalExtractionState();
-    const stream = createReadStream(filePath);
+    const stream = byteSource ?? createReadStream(filePath);
     let byteSize = 0;
     // The line being assembled, in the pieces the chunks gave and its byte count kept as a running sum. The
     // old `lineBuffer += segment` plus `Buffer.byteLength(lineBuffer)` flattened the whole growing string on

package/dist/adapters/local-sources.js

@@ -76,6 +76,7 @@ async function collectConfiguredRawEvidence(context, options) {
             includeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
             codexSessionFiles: options.rawEvidenceCodexSessionFiles,
             codexAttributionScan: options.rawEvidenceCodexAttributionScan,
+            nativeSessionFiles: options.rawEvidenceNativeSessionFiles,
             claudeSessionFiles: options.rawEvidenceClaudeSessionFiles,
             claudeAttributionScan: options.rawEvidenceClaudeAttributionScan,
             skipContentHashes: options.rawEvidenceSkipContentHashes,