@bli-cockpit/cli 0.2.293 → 0.2.294

package/dist/commands/sessions.js

@@ -9,6 +9,8 @@
  */
 import os from "node:os";
 import path from "node:path";
+import { readOpenCodeInventory } from "../opencode-inventory.js";
+import { scoreSignalsAgainstWorktrees } from "../adapters/attribution-core.js";
 import { writeLine } from "./cli-io.js";
 import { discoverCommandWorktrees } from "./local-discovery.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
@@ -30,19 +32,35 @@ export async function runSessions(command, io) {
     const window = await sessionsScanWindow(command, now);
     const { codex, claude } = await scanSessionSources(command, homeDir, worktrees, now, window);
     const { codexRows, claudeRows } = sessionRows(codex, claude);
+    const native = !command.source || command.source === "opencode" ? await readOpenCodeInventory({ homeDir,
+        stateDir: getCollectorRuntimePaths(homeDir).state_dir, metadataOnly: true,
+        sinceMs: window.since_minutes === null ? undefined : now.getTime() - window.since_minutes * 60_000 }) : null;
+    const opencode = native && (!native.absent || native.failures.length) ? { counts: { observed_count: native.discovered, read_failed: native.failures.length },
+        reasons: [...new Set(native.failures.map(failure => failure.reason))], sessions: native.sessions.map(session => {
+            const attributed = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, worktrees);
+            return { source: "opencode", session_id: session.id, state: attributed.state, reason: attributed.reason, attribution_score: attributed.attribution_score,
+                path_score: attributed.path_score, signals: attributed.signals, repo_label: attributed.worktree?.repo_label ?? null };
+        }) } : null;
     // BLI-3483: the scanners have always counted the folders and files they
     // could not read, and this command has always thrown those counts away
     // except for one field in `--json`. So "No sessions observed" was printed on
     // a machine where the scan had been blocked from looking — the operator's
     // one diagnostic tool answering the question with the failure removed.
     const readFailures = countReadFailures(codex, claude);
+    readFailures.total += native?.failures.length ?? 0;
     if (command.json) {
-        return writeSessionJson(io, window, readFailures, codex, claude, codexRows, claudeRows);
+        return writeSessionJson(io, window, readFailures, codex, claude, codexRows, claudeRows, opencode);
     }
-    return writeSessionText(io, window, readFailures, codexRows, claudeRows);
+    if (opencode) {
+        for (const row of opencode.sessions)
+            writeLine(io.stdout, sessionRowLine(row));
+        for (const reason of opencode.reasons)
+            writeLine(io.stdout, `OpenCode read incomplete: ${reason}`);
+    }
+    return writeSessionText(io, window, readFailures, codexRows, claudeRows, opencode?.sessions.length ?? 0);
 }
-function writeSessionText(io, window, readFailures, codexRows, claudeRows) {
-    writeLine(io.stdout, "Tower sessions (read-only attribution)");
+function writeSessionText(io, window, readFailures, codexRows, claudeRows, nativeCount = 0) {
+    writeLine(io.stdout, "TOWER sessions (read-only attribution)");
     writeLine(io.stdout, `window: ${sessionsWindowLine(window)}`);
     for (const row of codexRows) {
         writeLine(io.stdout, sessionRowLine(row));
@@ -53,7 +71,7 @@ function writeSessionText(io, window, readFailures, codexRows, claudeRows) {
             writeLine(io.stdout, `    sidecar ${sidecar.file_name}: ${sidecar.reason}`);
         }
     }
-    if (codexRows.length === 0 && claudeRows.length === 0) {
+    if (codexRows.length === 0 && claudeRows.length === 0 && nativeCount === 0) {
         writeLine(io.stdout, readFailures.total > 0
             ? `No sessions listed, but ${readFailures.total} read failure(s) mean the scan could not see everywhere — this is not proof there were none.`
             : "No sessions observed in the scan window.");
@@ -66,7 +84,7 @@ function writeSessionText(io, window, readFailures, codexRows, claudeRows) {
     return 0;
 }
 async function scanSessionSources(command, homeDir, worktrees, now, window) {
-    const codex = command.source !== "claude"
+    const codex = command.source !== "claude" && command.source !== "opencode"
         ? await scanAndAttributeCodexSessions({
             sessionsDirs: defaultCodexSessionDirs(homeDir),
             worktrees,
@@ -75,7 +93,7 @@ async function scanSessionSources(command, homeDir, worktrees, now, window) {
             limit: window.limit,
         })
         : null;
-    const claude = command.source !== "codex"
+    const claude = command.source !== "codex" && command.source !== "opencode"
         ? await scanAndAttributeClaudeSessions({
             projectsDir: path.join(homeDir, ".claude", "projects"),
             worktrees,
@@ -86,10 +104,11 @@ async function scanSessionSources(command, homeDir, worktrees, now, window) {
         : null;
     return { codex, claude };
 }
-function writeSessionJson(io, window, readFailures, codex, claude, codexRows, claudeRows) {
+function writeSessionJson(io, window, readFailures, codex, claude, codexRows, claudeRows, opencode) {
     writeLine(io.stdout, JSON.stringify({
         window,
         read_failures: readFailures,
+        ...(opencode ? { opencode } : {}),
         ...(codex ? { codex: { counts: codex.counts, sessions: codexRows } } : {}),
         ...(claude
             ? {

package/dist/commands/sources-check.js

@@ -28,6 +28,7 @@ import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-e
 import { fetchTranscriptObjects } from "../evidence-transcripts-client.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
 import { discoverLocalTranscripts } from "./sources-discovery.js";
+import { OPENCODE_CURSOR_FILENAME } from "../opencode-inventory.js";
 import { fileFacts, judgeSource } from "./sources-verdict.js";
 const VERDICTS = ["stored_full", "stored_slim", "stored_partial", "not_stored"];
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -55,60 +56,66 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     const switches = await readSourceSwitches(config, paths, "sources_check", { fetch: io.fetch });
     const optOutClaude = command.reconcile === true && !switches.claude;
     const optOutCodex = command.reconcile === true && !switches.codex;
-    const optOutAll = optOutClaude && optOutCodex;
+    const optOutAll = optOutClaude && optOutCodex && !switches.opencode;
     if (optOutClaude || optOutCodex) {
         console.error("[collector sources] reconcile skips opted-out sources", JSON.stringify({ codex_reason: optOutCodex ? switches.codexReason : null, claude_reason: optOutClaude ? switches.claudeReason : null }));
     }
-    const local = await discoverLocalTranscripts({ homeDir, olderThanMs, skipAll: optOutAll, skipClaude: optOutClaude, skipCodex: optOutCodex });
-    const cursors = {
-        codex: await readRawEvidenceCursor(paths),
-        claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),
-    };
-    const describedKeys = new Set(await readDescribedImageKeys(paths.state_dir));
-    // BLI-17273: judge against THIS machine's mode (the cache the sync-start receipt wrote, else the
-    // fleet default), never the bare constant. A machine that runs or ever ran slim holds slim server
-    // copies, which must never read as safe to delete.
-    const imageMode = await resolveImageHandlingMode(paths.state_dir);
-    console.error("[collector sources] judging against this machine's image mode", JSON.stringify({ reason: `image_mode_from_${imageMode.source}`, mode: imageMode.mode, slim_aware: imageMode.slimAware }));
-    const report = emptyReport(command, remote, local.newer_count, local.file_read_failed + local.directory_read_failed);
-    await judgeLocalTranscripts(local.files, remote, cursors, imageMode, describedKeys, report);
-    if (command.reconcile) {
-        const inventory = await fetchSourceInventory({ dashboardUrl, deviceToken: session.device_token, fetchImpl: io.fetch });
-        const { rows: _rows, ...inventoryCounts } = inventory;
-        const counts = { missing_row: 0, missing_pointer: 0, stale_revision: 0, unavailable_evidence: 0, explicit_opt_out: 0, unverifiable: 0, revision_verified: 0 };
-        const optOutSources = optOutAll ? ["codex", "claude_code"] : optOutClaude ? ["claude_code"] : [];
-        counts.explicit_opt_out = optOutSources.length;
-        for (const file of local.files) {
-            const finding = await reconcileSource({ file, inventory, remote,
-                cursor: file.kind === "claude_subagent" ? null : cursors[file.source].sessions[file.session_id] ?? null,
-                facts: fileFacts(file, undefined, { mode: imageMode.mode, describedKeys, slimAware: imageMode.slimAware }),
-            }).catch(() => ({ state: "unavailable_evidence", reason: "local_revision_unreadable" }));
-            counts[finding.state]++;
-            const entry = report.files.find(entry => entry.path === file.file_path);
-            if (entry)
-                entry.reconciliation = finding;
-        }
-        report.reconciliation = { counts, inventory: inventoryCounts,
-            scan: { started_at: new Date(startedAt).toISOString(), finished_at: new Date().toISOString(),
-                roots: ["codex/sessions", "codex/archived_sessions", "claude/projects"], older_than_days: command.olderThanDays, opt_out_sources: optOutSources },
-            limitations: ["Snapshot scan, not a live completeness guarantee; absent local sources cannot be discovered.", "Missing historical source identifiers remain unverifiable.", "Pointer metadata does not prove bucket bytes are readable; no storage bodies fetched.", "explicit_opt_out counts sources, not undiscovered files; opted-out stores are not scanned."],
+    const local = await discoverLocalTranscripts({ homeDir, olderThanMs, skipAll: optOutAll, skipClaude: optOutClaude, skipCodex: optOutCodex, skipOpenCode: !switches.opencode });
+    try {
+        const cursors = {
+            opencode: await readRawEvidenceCursor(paths, { filename: OPENCODE_CURSOR_FILENAME, sessionsOnly: true }),
+            codex: await readRawEvidenceCursor(paths),
+            claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),
         };
-        if (inventory.status !== "exhausted" || report.local.unreadable > 0 || counts.unavailable_evidence > 0) {
+        const describedKeys = new Set(await readDescribedImageKeys(paths.state_dir));
+        // BLI-17273: judge against THIS machine's mode (the cache the sync-start receipt wrote, else the
+        // fleet default), never the bare constant. A machine that runs or ever ran slim holds slim server
+        // copies, which must never read as safe to delete.
+        const imageMode = await resolveImageHandlingMode(paths.state_dir);
+        console.error("[collector sources] judging against this machine's image mode", JSON.stringify({ reason: `image_mode_from_${imageMode.source}`, mode: imageMode.mode, slim_aware: imageMode.slimAware }));
+        const report = emptyReport(command, remote, local.newer_count, local.file_read_failed + local.directory_read_failed);
+        await judgeLocalTranscripts(local.files, remote, cursors, imageMode, describedKeys, report);
+        if (command.reconcile) {
+            const inventory = await fetchSourceInventory({ dashboardUrl, deviceToken: session.device_token, fetchImpl: io.fetch });
+            const { rows: _rows, ...inventoryCounts } = inventory;
+            const counts = { missing_row: 0, missing_pointer: 0, stale_revision: 0, unavailable_evidence: 0, explicit_opt_out: 0, unverifiable: 0, revision_verified: 0 };
+            const optOutSources = optOutAll ? ["codex", "claude_code", "opencode"] : optOutClaude ? ["claude_code"] : [];
+            counts.explicit_opt_out = optOutSources.length;
+            for (const file of local.files) {
+                const finding = await reconcileSource({ file, inventory, remote,
+                    cursor: file.kind === "claude_subagent" ? null : cursors[file.source].sessions[file.session_id] ?? null,
+                    facts: fileFacts(file, undefined, { mode: imageMode.mode, describedKeys, slimAware: imageMode.slimAware }),
+                }).catch(() => ({ state: "unavailable_evidence", reason: "local_revision_unreadable" }));
+                counts[finding.state]++;
+                const entry = report.files.find(entry => entry.path === file.file_path);
+                if (entry)
+                    entry.reconciliation = finding;
+            }
+            report.reconciliation = { counts, inventory: inventoryCounts,
+                scan: { started_at: new Date(startedAt).toISOString(), finished_at: new Date().toISOString(),
+                    roots: ["codex/sessions", "codex/archived_sessions", "claude/projects", "opencode/opencode.db"], older_than_days: command.olderThanDays, opt_out_sources: optOutSources },
+                limitations: ["Snapshot scan, not a live completeness guarantee; absent local sources cannot be discovered.", "Missing historical source identifiers remain unverifiable.", "Pointer metadata does not prove bucket bytes are readable; no storage bodies fetched.", "explicit_opt_out counts sources, not undiscovered files; opted-out stores are not scanned."],
+            };
+            if (inventory.status !== "exhausted" || report.local.unreadable > 0 || counts.unavailable_evidence > 0) {
+                report.status = "incomplete";
+                report.reason = "reconciliation_partial";
+            }
+        }
+        if (report.local.unreadable > 0) {
             report.status = "incomplete";
-            report.reason = "reconciliation_partial";
+            report.reason = "local_scan_incomplete";
         }
+        reportSourcesCheck(report, remote, startedAt);
+        if (command.json)
+            writeLine(io.stdout, JSON.stringify(report, null, 2));
+        else
+            for (const line of sourcesCheckLines(report))
+                writeLine(io.stdout, line);
+        return 0;
     }
-    if (report.local.unreadable > 0) {
-        report.status = "incomplete";
-        report.reason = "local_scan_incomplete";
+    finally {
+        await local.cleanup?.();
     }
-    reportSourcesCheck(report, remote, startedAt);
-    if (command.json)
-        writeLine(io.stdout, JSON.stringify(report, null, 2));
-    else
-        for (const line of sourcesCheckLines(report))
-            writeLine(io.stdout, line);
-    return 0;
 }
 async function judgeLocalTranscripts(files, remote, cursors, imageMode, describedKeys, report) {
     for (const file of files) {
@@ -129,7 +136,7 @@ async function judgeLocalTranscripts(files, remote, cursors, imageMode, describe
         report.counts[judged.verdict].bytes += file.byte_size;
         report.reasons[judged.reason] = (report.reasons[judged.reason] ?? 0) + 1;
         report.files.push({
-            path: file.file_path,
+            path: file.source_locator ?? file.file_path,
             source: file.source,
             kind: file.kind,
             session_id: file.session_id,

package/dist/commands/sources-discovery.js

@@ -1,5 +1,6 @@
 import { openCodexSessionRevision } from "../adapters/codex-session-revision.js";
 import { nativeSessionRoots } from "../native-session-roots.js";
+import { t3CodexProjectionSessionIds } from "../adapters/t3-projection-source.js";
 /**
  * Every agent transcript on this machine, named the way the collector names
  * its upload (BLI-11122).
@@ -23,7 +24,12 @@ import { nativeSessionRoots } from "../native-session-roots.js";
  * This module reads files and never writes, moves or deletes one.
  */
 import fs from "node:fs/promises";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { openCodeCollectionPolicy } from "../opencode-policy.js";
+import { readOpenCodeInventory } from "../opencode-inventory.js";
 import path from "node:path";
+import os from "node:os";
+import { openCodeDatabasePath } from "../adapters/opencode-store.js";
 import { createReadStream } from "node:fs";
 import readline from "node:readline";
 import { transcriptFileKey } from "@bli-cockpit/telemetry-core";
@@ -140,7 +146,24 @@ export async function discoverLocalTranscripts(options) {
     const recordFailure = (error) => { firstFailure ??= describeError(error); };
     const found = await findTranscriptFiles(options, roots, result, recordFailure);
     await nameTranscriptFiles(found, result, recordFailure);
-    await groupCodexRevisions(result);
+    if (!options.skipAll && !options.skipOpenCode) {
+        const policy = await openCodeCollectionPolicy({ homeDir: options.homeDir });
+        const scratch = policy.enabled ? await fs.mkdtemp(path.join(os.tmpdir(), "tower-opencode-reconcile-")) : null;
+        if (scratch)
+            result.cleanup = () => fs.rm(scratch, { recursive: true, force: true });
+        const inventory = policy.enabled ? await readOpenCodeInventory({ homeDir: options.homeDir, stateDir: getCollectorRuntimePaths(options.homeDir).state_dir,
+            include: policy.include, readOnlyAccounting: true, exportDirectory: scratch }) : { files: [], failures: [] };
+        result.directory_read_failed += inventory.failures.length;
+        for (const file of inventory.files) {
+            if (options.olderThanMs !== null && file.session.updated_at_ms >= options.olderThanMs) {
+                result.newer_count += 1;
+                continue;
+            }
+            result.files.push({ source: "opencode", kind: "opencode_main", source_locator: `${process.env.OPENCODE_DB ?? openCodeDatabasePath(options.homeDir, process.env.XDG_DATA_HOME)}#${file.session.id}`, file_path: file.local_path, byte_size: file.byte_size, mtime_ms: file.session.updated_at_ms,
+                session_id: file.session.id, session_id_source: "content", key: transcriptFileKey({ source: "opencode", session_id: file.session.id, sidecar: null }) });
+        }
+    }
+    await groupCodexRevisions(result, options.homeDir);
     result.files = result.files.filter(f => options.olderThanMs === null || f.mtime_ms < options.olderThanMs);
     if (result.directory_read_failed > 0 || result.file_read_failed > 0) {
         console.error("[collector sources] some transcripts could not be read; they are left out of the answer", JSON.stringify({
@@ -247,7 +270,14 @@ async function nameTranscriptFiles(found, result, recordFailure) {
     }
 }
 /** One source row/pointer names the complete native session revision, never an arbitrary segment. */
-async function groupCodexRevisions(result) {
+async function groupCodexRevisions(result, homeDir) {
+    let projectionIds = new Set();
+    try {
+        projectionIds = t3CodexProjectionSessionIds(homeDir);
+    }
+    catch {
+        result.file_read_failed++;
+    } // The reader logs the exact capped/unavailable reason; native files remain available.
     const groups = new Map();
     for (const file of result.files)
         if (file.source === "codex") {
@@ -257,14 +287,15 @@ async function groupCodexRevisions(result) {
         }
     const replacements = new Map();
     for (const [id, files] of groups) {
-        if (files.length < 2)
+        if (files.length < 2 && !projectionIds.has(id))
             continue;
         const representative = [...files].sort((a, b) => a.file_path.localeCompare(b.file_path))[0];
         const combined = { ...representative, segment_paths: files.map(f => f.file_path).sort(),
+            ...(projectionIds.has(id) ? { t3_projection: true } : {}),
             segment_stamps: files.map(f => ({ path: f.file_path, size: f.byte_size, mtime: f.mtime_ms })),
             byte_size: files.reduce((n, f) => n + f.byte_size, 0), mtime_ms: Math.max(...files.map(f => f.mtime_ms)) };
         try {
-            const source = await openCodexSessionRevision(combined.segment_paths);
+            const source = await openCodexSessionRevision(combined.segment_paths, { t3Projection: combined.t3_projection });
             try {
                 combined.byte_size = source.length;
             }

package/dist/commands/sources-verdict.js

@@ -164,7 +164,7 @@ upload = {}) {
     const describedKeys = upload.describedKeys ?? new Set();
     const slimAware = upload.slimAware ?? modeDropsImages(mode);
     if (file.segment_paths)
-        return codexRevisionFacts(file.segment_paths, mode, describedKeys, slimAware);
+        return codexRevisionFacts(file.segment_paths, mode, describedKeys, slimAware, file.t3_projection);
     const redactForUpload = (text, original) => redactTranscriptForm(file, text, original);
     let split = null;
     let whole = null;
@@ -186,7 +186,7 @@ upload = {}) {
                 if (!buffer)
                     return null;
                 // Compare against what the uploader sends: in drop mode that is the slim form, not the disk bytes.
-                const uploadText = uploadFormOfTranscript(buffer.toString("utf8"), file.source === "codex" ? "codex" : "claude_code", mode, describedKeys);
+                const uploadText = file.source === "opencode" ? buffer.toString("utf8") : uploadFormOfTranscript(buffer.toString("utf8"), file.source, mode, describedKeys);
                 return redactForUpload(uploadText, buffer);
             });
             return sanitized;
@@ -202,7 +202,7 @@ upload = {}) {
                 if (!buffer)
                     return null;
                 const text = buffer.toString("utf8");
-                const slimText = uploadFormOfTranscript(text, file.source === "codex" ? "codex" : "claude_code", "describe_and_drop", describedKeys);
+                const slimText = uploadFormOfTranscript(text, file.source, "describe_and_drop", describedKeys);
                 // Slimming changes nothing: one form, and `sanitized()` is the answer.
                 if (slimText === text)
                     return null;

package/dist/local-state-status.js

@@ -1,3 +1,4 @@
+import { readFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { readStagingInventory } from "./disk-usage.js";
@@ -18,7 +19,23 @@ import { readLocalWorkContextForRepo, workDisplayLabel, } from "./local-state-wo
 export async function inspectLocalCollectorStatus(options = {}) {
     const now = options.now ?? new Date();
     const reading = await readCollectorStatus(options, now);
-    return collectorStatusFromReading(reading, now);
+    const status = collectorStatusFromReading(reading, now);
+    try {
+        const native = JSON.parse(await readFile(path.join(reading.paths.state_dir, "opencode-collection-status.json"), "utf8"));
+        if (native.source === "opencode" && ["complete", "partial", "absent", "withheld"].includes(native.coverage)
+            && [native.discovered, native.eligible, native.delivered, native.pending, native.withheld, native.unique].every(value => typeof value === "number" && Number.isFinite(value) && value >= 0)) {
+            const at = typeof native.observed_at === "string" && Number.isFinite(Date.parse(native.observed_at)) ? new Date(native.observed_at).toISOString() : "unknown";
+            const reasons = Array.isArray(native.reasons) ? native.reasons.filter((reason) => typeof reason === "string" && /^[a-z0-9_:-]{1,100}$/.test(reason)).join(", ") : "";
+            status.details.push(`OpenCode: ${native.coverage}; discovered ${native.discovered}, eligible ${native.eligible}, delivered ${native.delivered}, pending ${native.pending}, withheld ${native.withheld}, unique ${native.unique}; as of ${at}${reasons ? ` (${reasons})` : ""}.`);
+        }
+        else
+            status.details.push("OpenCode coverage unavailable: opencode_status_invalid.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            status.details.push("OpenCode coverage unavailable: opencode_status_unreadable.");
+    }
+    return status;
 }
 function collectorStatusFromReading(reading, now) {
     const { paths, config, session, identity, context, branch } = reading;

package/dist/opencode-inventory.js

@@ -0,0 +1,203 @@
+/** OpenCode's one inventory for sync, history and reconciliation, exported through shared secret guards. */
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import { newSessionFactsAccumulator, observeSessionFactsFile, observeSessionFactsRecord, finalizeSessionFacts, nativeObject, openCodeProviderIdentity } from "@bli-cockpit/telemetry-core";
+import { openCodeDatabasePath, openOpenCodeStore, OpenCodeReadError } from "./adapters/opencode-store.js";
+import { openStagingAllowance, roomToStageUpTo, admitToStaging } from "./staging-gate.js";
+import { sanitizeTextEvidenceForUpload } from "./adapters/raw-evidence-sanitize.js";
+import { readJsonFile, writeJsonFileAtomic } from "./local-state-files.js";
+export const OPENCODE_CURSOR_FILENAME = "opencode-raw-evidence.json";
+/** Policy is decided from native directory metadata before exporting any conversation body. */
+export async function readOpenCodeInventory(options) {
+    const result = { discovered: 0, sessions: [], eligible: 0, withheld: 0, files: [], shelved: [], failures: [], absent: false };
+    let store = null;
+    try {
+        const databasePath = options.databasePath ?? process.env.OPENCODE_DB ?? openCodeDatabasePath(options.homeDir, process.env.XDG_DATA_HOME);
+        store = await openOpenCodeStore(databasePath);
+        if (!store) {
+            result.absent = true;
+            console.error("[opencode inventory] source path absent", JSON.stringify({ source: "opencode", reason: "opencode_source_path_absent" }));
+            return result;
+        }
+        const sessions = [];
+        let afterId = "";
+        while (true) {
+            const page = store.list(afterId);
+            if (!page.length)
+                break;
+            sessions.push(...page.filter(session => options.sinceMs === undefined || session.updated_at_ms >= options.sinceMs));
+            afterId = page.at(-1).id;
+        }
+        result.discovered = sessions.length;
+        result.sessions = sessions;
+        if (options.metadataOnly) {
+            for (const session of sessions) {
+                if (!options.include || options.include(session))
+                    result.eligible += 1;
+                else
+                    result.withheld += 1;
+            }
+            console.error("[opencode inventory] metadata-only scan complete", JSON.stringify({ discovered: result.discovered, eligible: result.eligible, withheld: result.withheld }));
+            return result;
+        }
+        const owners = { ...await readUsageOwners(options.stateDir, "opencode-usage-tentative.json"), ...await readUsageOwners(options.stateDir, "opencode-usage-owners.json") };
+        const allowance = await openStagingAllowance(options.stateDir, process.env);
+        for (const session of sessions.sort((a, b) => Number(options.deliveredSessionIds?.has(a.id) ?? false) - Number(options.deliveredSessionIds?.has(b.id) ?? false) || a.created_at_ms - b.created_at_ms || a.id.localeCompare(b.id))) {
+            if (options.include && !options.include(session)) {
+                result.withheld += 1;
+                if (options.countOnly?.(session)) {
+                    try {
+                        result.shelved.push(await exportNativeSession(store, session, options.stateDir, owners, false));
+                    }
+                    catch (error) {
+                        result.failures.push({ session_id: session.id, reason: readReason(error) });
+                    }
+                }
+                continue;
+            }
+            result.eligible += 1;
+            try {
+                result.files.push(await exportNativeSession(store, session, options.stateDir, owners, true, allowance, options.exportDirectory));
+            }
+            catch (error) {
+                result.failures.push({ session_id: session.id, reason: readReason(error) });
+            }
+        }
+        if (!options.readOnlyAccounting)
+            await writeJsonFileAtomic(path.join(options.stateDir, "opencode-usage-tentative.json"), owners);
+    }
+    catch (error) {
+        result.failures.push({ session_id: null, reason: readReason(error) });
+    }
+    finally {
+        store?.close();
+    }
+    console.error("[opencode inventory] scan finished", JSON.stringify({ source: "opencode", discovered: result.discovered, exported: result.files.length, withheld: result.withheld, failed: result.failures.length, reason: result.absent ? "opencode_source_path_absent" : result.failures.length ? "opencode_inventory_partial" : "opencode_inventory_complete" }));
+    return result;
+}
+async function exportNativeSession(store, session, stateDir, owners, retainContent = true, allowance, exportDirectory) {
+    const directory = exportDirectory ?? path.join(stateDir, "opencode-transcripts");
+    if (retainContent)
+        await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const temporary = path.join(directory, `.export-${crypto.randomUUID()}`);
+    const output = retainContent ? await fs.open(temporary, "wx", 0o600) : null;
+    const hash = crypto.createHash("sha256");
+    const factsAccumulator = newSessionFactsAccumulator("opencode");
+    let lines = 0;
+    let bytes = 0;
+    let message = null;
+    let identities = [];
+    let redactedRecords = 0;
+    const redactionRules = new Map();
+    let secretMatches = 0;
+    const write = async (record) => {
+        const part = record.type === "opencode_part" ? nativeObject(record.part) : {};
+        if (part.type === "file" && typeof part.url === "string")
+            record = { ...record, attachment_source: {
+                    representation: part.url.startsWith("data:") ? "inline_data_url" : "reference_only",
+                    referenced_bytes_read: false,
+                    reason: part.url.startsWith("data:") ? "native_inline_payload_available" : "external_attachment_bytes_not_read",
+                } };
+        const masked = sanitizeTextEvidenceForUpload({ text: JSON.stringify(record) + "\n", redactedFields: ["opencode_native_record"] });
+        if (masked.status === "redacted" && masked.completenessLabel === "redaction_crashed_stubbed")
+            throw new OpenCodeReadError("opencode_redaction_failed");
+        if (masked.status === "redacted") {
+            redactedRecords += 1;
+            secretMatches += masked.redaction.secret_like_match_count;
+            for (const rule of masked.redaction.rule_counts) {
+                const prior = redactionRules.get(rule.rule_id) ?? { rule_id: rule.rule_id, match_count: 0, redacted_char_count: 0 };
+                prior.match_count += rule.match_count;
+                prior.redacted_char_count += rule.redacted_char_count;
+                redactionRules.set(rule.rule_id, prior);
+            }
+        }
+        hash.update(masked.bytes);
+        bytes += masked.bytes.length;
+        lines += 1;
+        try {
+            observeSessionFactsRecord(factsAccumulator, JSON.parse(masked.bytes.toString("utf8")));
+        }
+        catch { /* Masked crash marker remains evidence, not an invented native record. */ }
+        if (output) {
+            const deferred = roomToStageUpTo(allowance, bytes);
+            if (deferred)
+                throw new OpenCodeReadError(`opencode_staging_deferred_${deferred}`);
+            await output.write(masked.bytes);
+        }
+    };
+    const settleUsage = async () => {
+        if (!message || message.role !== "assistant")
+            return;
+        const nativeIdentity = openCodeProviderIdentity(message, identities);
+        const identity = nativeIdentity ? crypto.createHash("sha256").update(nativeIdentity).digest("hex") : null;
+        const nativeTokens = nativeObject(message.tokens);
+        const hasUsage = !message.error && Number.isFinite(nativeObject(message.time).completed) && ["input", "output", "reasoning"].every((key) => typeof nativeTokens[key] === "number" && Number.isFinite(nativeTokens[key]) && Number(nativeTokens[key]) >= 0) && typeof message.modelID === "string";
+        const owner = identity ? owners[identity] : null;
+        const status = !identity || !hasUsage ? "unknown" : owner && owner !== session.id ? "copied" : "known";
+        if (identity && hasUsage && !owner)
+            owners[identity] = session.id;
+        await write({ type: "opencode_usage", status, identity, owner_session_id: identity ? owners[identity] : null, model: message.modelID ?? null, provider: message.providerID ?? null, tokens: message.tokens ?? null });
+    };
+    try {
+        for (const record of store.records(session.id)) {
+            if (record.type === "opencode_message") {
+                await settleUsage();
+                message = nativeObject(record.info);
+                identities = [];
+            }
+            if (record.type === "opencode_part") {
+                const part = nativeObject(record.part);
+                if (part.metadata)
+                    identities.push({ metadata: Object.fromEntries(Object.entries(nativeObject(part.metadata)).map(([name, value]) => [name, { itemId: nativeObject(value).itemId }])) });
+            }
+            await write(record);
+        }
+        await settleUsage();
+        await write({ type: "opencode_capture", redacted_records: redactedRecords, accounting_scope: "persistent_native_provider_item_ownership_on_this_machine" });
+        await output?.close();
+        const revision = hash.digest("hex");
+        const localPath = retainContent ? path.join(directory, `${session.id}-${revision}.jsonl`) : "";
+        if (retainContent) {
+            if (allowance) {
+                const deferred = admitToStaging(allowance, bytes, { kind: "opencode_jsonl" });
+                if (deferred)
+                    throw new OpenCodeReadError(`opencode_staging_deferred_${deferred}`);
+            }
+            await fs.rename(temporary, localPath);
+        }
+        observeSessionFactsFile(factsAccumulator, { bytes, lines });
+        const facts = finalizeSessionFacts(factsAccumulator);
+        return { session, local_path: localPath, byte_size: bytes, revision, facts,
+            ...(secretMatches ? { redaction: { schema_version: "raw-evidence-redaction.v1", status: "sanitized", mode: "deterministic_text_replacement",
+                    applied_by: ["local_collector"], rule_counts: [...redactionRules.values()], secret_like_match_count: secretMatches,
+                    redacted_fields: ["opencode_native_record"], redacted_ranges: [], sanitized_content_hash_sha256: revision, sanitized_byte_size: bytes } } : {}) };
+    }
+    catch (error) {
+        await output?.close().catch(() => undefined);
+        if (retainContent)
+            await fs.unlink(temporary).catch(() => undefined);
+        throw error;
+    }
+}
+function readReason(error) { return error instanceof OpenCodeReadError ? error.reason : "opencode_export_failed"; }
+async function readUsageOwners(stateDir, filename) {
+    const saved = await readJsonFile(path.join(stateDir, filename)).catch((error) => {
+        if (error.code === "ENOENT")
+            return {};
+        throw new OpenCodeReadError("opencode_accounting_cursor_unreadable");
+    });
+    if (!saved || typeof saved !== "object" || Array.isArray(saved) || Object.entries(saved).some(([key, owner]) => !/^[a-f0-9]{64}$/.test(key) || typeof owner !== "string" || !/^ses_[A-Za-z0-9]+$/.test(owner)))
+        throw new OpenCodeReadError("opencode_accounting_cursor_invalid");
+    return saved;
+}
+/** A local usage owner becomes durable only after both evidence and metadata were acknowledged. */
+export async function acknowledgeOpenCodeUsage(stateDir, sessions) {
+    const committed = await readUsageOwners(stateDir, "opencode-usage-owners.json");
+    const tentative = await readUsageOwners(stateDir, "opencode-usage-tentative.json");
+    for (const [identity, owner] of Object.entries(tentative))
+        if (sessions.has(owner))
+            committed[identity] ??= owner;
+    await writeJsonFileAtomic(path.join(stateDir, "opencode-usage-owners.json"), committed);
+    console.error("[opencode accounting] acknowledged native identity owners", JSON.stringify({ reason: "durable_native_usage_acknowledged", identities: Object.keys(committed).length, sessions: sessions.size }));
+}

package/dist/opencode-policy.js

@@ -0,0 +1,29 @@
+/** Apply existing collection choices to native directory metadata before exporting OpenCode evidence. */
+import { getCollectorRuntimePaths, readLocalCollectorConfig } from "./local-state.js";
+import { readSourceSwitches } from "./source-opt-out.js";
+import { settleCollectionScope, sessionInsideRoots } from "./collection-scope.js";
+import { decideShelfMode, sessionShelf } from "./commands/session-sync-shelf.js";
+import { scoreSignalsAgainstWorktrees } from "./adapters/attribution-core.js";
+export async function openCodeCollectionPolicy(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const config = await readLocalCollectorConfig(paths).catch((error) => { if (error.code === "ENOENT")
+        return null; throw error; });
+    const switches = await readSourceSwitches(config, paths, "opencode_inventory", { fetch: options.fetchImpl, dashboardUrl: options.dashboardUrl });
+    const shelf = await decideShelfMode({ homeDir: options.homeDir, dashboardUrl: options.dashboardUrl ?? null, fetchImpl: options.fetchImpl ?? globalThis.fetch });
+    const scope = await settleCollectionScope(paths.state_dir, config?.collection_scope);
+    const roots = options.collectionRoots ?? config?.default_repo_paths ?? [];
+    const enabled = switches.opencode && !switches.held && shelf.mode !== "hold";
+    const reason = switches.held || shelf.mode === "hold" ? "owner_check_unavailable" : !switches.opencode ? "raw_evidence_upload_disabled" : "opencode_existing_collection_policy";
+    const drawer = (session) => {
+        const attribution = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees ?? [], { collectionRoots: roots });
+        return shelf.mode === "founder" && sessionShelf({ ...attribution, local_cwd: session.directory, session_facts: null }, shelf.rules).shelf === "drawer";
+    };
+    return { enabled, reason, drawer, include: (session) => {
+            if (!enabled)
+                return false;
+            const attribution = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees ?? [], { collectionRoots: roots });
+            if (scope.scope === "roots_only" && !sessionInsideRoots({ ...attribution, local_cwd: session.directory }, roots))
+                return false;
+            return !drawer(session);
+        } };
+}

package/dist/slim/slim-transcript.js

@@ -36,7 +36,7 @@ import { LineEdits, SeenBlocks, isJsonObject } from "./slim-support.js";
  * once, which is intended: the stored bytes are no longer what the new rules would produce.
  * `slim-rules-version.test.ts` fails when a rule changes without this moving.
  */
-export const SLIM_RULES_VERSION = "slim-rules.v2";
+export const SLIM_RULES_VERSION = "slim-rules.v3";
 /** The text an image marker starts with; a line carrying one is a modified line (an image became a marker). */
 const IMAGE_MARKER_START = "[image sha256:";
 export function createSlimmer(kind, rulesForTests) {
@@ -49,8 +49,9 @@ export function createSlimmer(kind, rulesForTests) {
     const applyRules = rulesForTests ?? ((record, edits) => {
         if (kind === "claude_code")
             slimClaudeRecord(record, claude, seen, edits);
-        else
+        else if (kind === "codex")
             slimCodexRecord(record, codex, seen, edits);
+        // OpenCode keeps every native field; only the shared acknowledged-image swap changes its payload.
     });
     return {
         slimLine(line) {

package/dist/source-opt-out.js

@@ -46,7 +46,7 @@ export function resolveSourceSwitches(config, standing) {
     const labels = configOptOutLabels(config);
     const verdict = labels.length > 0 ? optOutVerdict(standing) : null;
     if (verdict && !verdict.obeyed) {
-        return { codex: true, claude: true, codexReason: null, claudeReason: null, ignored: labels, verdict: verdict.reason, held: false };
+        return { opencode: true, codex: true, claude: true, codexReason: null, claudeReason: null, ignored: labels, verdict: verdict.reason, held: false };
     }
     const all = config?.raw_evidence_upload === "disabled";
     const codexReason = config?.collect_codex_jsonl === false
@@ -56,6 +56,7 @@ export function resolveSourceSwitches(config, standing) {
         ? CLAUDE_OPT_OUT_REASON
         : all ? ALL_SOURCES_OPT_OUT_REASON : null;
     return {
+        opencode: !all,
         codex: codexReason === null,
         claude: claudeReason === null,
         codexReason,

package/dist/spool/local-spool-parse.js

@@ -100,7 +100,7 @@ export function parseMetadataOnlySessionReportRows(value, fieldPath) {
     return sessions;
 }
 function parseRetrySource(value, fieldPath) {
-    if (value === "codex" || value === "claude_code")
+    if (value === "codex" || value === "claude_code" || value === "opencode")
         return value;
     return invalidUploadSpoolState(fieldPath, '"codex" or "claude_code"');
 }