@bli-cockpit/cli 0.2.293 → 0.2.295

package/dist/commands/sources-verdict.js

@@ -164,7 +164,7 @@ upload = {}) {
     const describedKeys = upload.describedKeys ?? new Set();
     const slimAware = upload.slimAware ?? modeDropsImages(mode);
     if (file.segment_paths)
-        return codexRevisionFacts(file.segment_paths, mode, describedKeys, slimAware);
+        return codexRevisionFacts(file.segment_paths, mode, describedKeys, slimAware, file.t3_projection);
     const redactForUpload = (text, original) => redactTranscriptForm(file, text, original);
     let split = null;
     let whole = null;
@@ -186,7 +186,7 @@ upload = {}) {
                 if (!buffer)
                     return null;
                 // Compare against what the uploader sends: in drop mode that is the slim form, not the disk bytes.
-                const uploadText = uploadFormOfTranscript(buffer.toString("utf8"), file.source === "codex" ? "codex" : "claude_code", mode, describedKeys);
+                const uploadText = (file.source === "opencode" || file.source === "pi") ? buffer.toString("utf8") : uploadFormOfTranscript(buffer.toString("utf8"), file.source, mode, describedKeys);
                 return redactForUpload(uploadText, buffer);
             });
             return sanitized;
@@ -202,7 +202,7 @@ upload = {}) {
                 if (!buffer)
                     return null;
                 const text = buffer.toString("utf8");
-                const slimText = uploadFormOfTranscript(text, file.source === "codex" ? "codex" : "claude_code", "describe_and_drop", describedKeys);
+                const slimText = uploadFormOfTranscript(text, file.source, "describe_and_drop", describedKeys);
                 // Slimming changes nothing: one form, and `sanitized()` is the answer.
                 if (slimText === text)
                     return null;

package/dist/local-state-status.js

@@ -1,3 +1,4 @@
+import { readFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { readStagingInventory } from "./disk-usage.js";
@@ -18,7 +19,38 @@ import { readLocalWorkContextForRepo, workDisplayLabel, } from "./local-state-wo
 export async function inspectLocalCollectorStatus(options = {}) {
     const now = options.now ?? new Date();
     const reading = await readCollectorStatus(options, now);
-    return collectorStatusFromReading(reading, now);
+    const status = collectorStatusFromReading(reading, now);
+    try {
+        const native = JSON.parse(await readFile(path.join(reading.paths.state_dir, "opencode-collection-status.json"), "utf8"));
+        if (native.source === "opencode" && ["complete", "partial", "absent", "withheld"].includes(native.coverage)
+            && [native.discovered, native.eligible, native.delivered, native.pending, native.withheld, native.unique].every(value => typeof value === "number" && Number.isFinite(value) && value >= 0)) {
+            const at = typeof native.observed_at === "string" && Number.isFinite(Date.parse(native.observed_at)) ? new Date(native.observed_at).toISOString() : "unknown";
+            const reasons = Array.isArray(native.reasons) ? native.reasons.filter((reason) => typeof reason === "string" && /^[a-z0-9_:-]{1,100}$/.test(reason)).join(", ") : "";
+            status.details.push(`OpenCode: ${native.coverage}; discovered ${native.discovered}, eligible ${native.eligible}, delivered ${native.delivered}, pending ${native.pending}, withheld ${native.withheld}, unique ${native.unique}; as of ${at}${reasons ? ` (${reasons})` : ""}.`);
+        }
+        else
+            status.details.push("OpenCode coverage unavailable: opencode_status_invalid.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            status.details.push("OpenCode coverage unavailable: opencode_status_unreadable.");
+    }
+    try {
+        const native = JSON.parse(await readFile(path.join(reading.paths.state_dir, "pi-collection-status.json"), "utf8"));
+        if (native.source === "pi" && ["complete", "partial", "absent", "withheld"].includes(native.coverage)
+            && [native.discovered, native.eligible, native.delivered, native.pending, native.withheld, native.unique].every(value => typeof value === "number" && Number.isFinite(value) && value >= 0)) {
+            const at = typeof native.observed_at === "string" && Number.isFinite(Date.parse(native.observed_at)) ? new Date(native.observed_at).toISOString() : "unknown";
+            const reasons = Array.isArray(native.reasons) ? native.reasons.filter((reason) => typeof reason === "string" && /^[a-z0-9_:-]{1,100}$/.test(reason)).join(", ") : "";
+            status.details.push(`Pi: ${native.coverage}; discovered ${native.discovered}, eligible ${native.eligible}, delivered ${native.delivered}, pending ${native.pending}, withheld ${native.withheld}, unique ${native.unique}; as of ${at}${reasons ? ` (${reasons})` : ""}.`);
+        }
+        else
+            status.details.push("Pi coverage unavailable: pi_status_invalid.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            status.details.push("Pi coverage unavailable: pi_status_unreadable.");
+    }
+    return status;
 }
 function collectorStatusFromReading(reading, now) {
     const { paths, config, session, identity, context, branch } = reading;

package/dist/opencode-inventory.js

@@ -0,0 +1,203 @@
+/** OpenCode's one inventory for sync, history and reconciliation, exported through shared secret guards. */
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import { newSessionFactsAccumulator, observeSessionFactsFile, observeSessionFactsRecord, finalizeSessionFacts, nativeObject, openCodeProviderIdentity } from "@bli-cockpit/telemetry-core";
+import { openCodeDatabasePath, openOpenCodeStore, OpenCodeReadError } from "./adapters/opencode-store.js";
+import { openStagingAllowance, roomToStageUpTo, admitToStaging } from "./staging-gate.js";
+import { sanitizeTextEvidenceForUpload } from "./adapters/raw-evidence-sanitize.js";
+import { readJsonFile, writeJsonFileAtomic } from "./local-state-files.js";
+export const OPENCODE_CURSOR_FILENAME = "opencode-raw-evidence.json";
+/** Policy is decided from native directory metadata before exporting any conversation body. */
+export async function readOpenCodeInventory(options) {
+    const result = { discovered: 0, sessions: [], eligible: 0, withheld: 0, files: [], shelved: [], failures: [], absent: false };
+    let store = null;
+    try {
+        const databasePath = options.databasePath ?? process.env.OPENCODE_DB ?? openCodeDatabasePath(options.homeDir, process.env.XDG_DATA_HOME);
+        store = await openOpenCodeStore(databasePath);
+        if (!store) {
+            result.absent = true;
+            console.error("[opencode inventory] source path absent", JSON.stringify({ source: "opencode", reason: "opencode_source_path_absent" }));
+            return result;
+        }
+        const sessions = [];
+        let afterId = "";
+        while (true) {
+            const page = store.list(afterId);
+            if (!page.length)
+                break;
+            sessions.push(...page.filter(session => options.sinceMs === undefined || session.updated_at_ms >= options.sinceMs));
+            afterId = page.at(-1).id;
+        }
+        result.discovered = sessions.length;
+        result.sessions = sessions;
+        if (options.metadataOnly) {
+            for (const session of sessions) {
+                if (!options.include || options.include(session))
+                    result.eligible += 1;
+                else
+                    result.withheld += 1;
+            }
+            console.error("[opencode inventory] metadata-only scan complete", JSON.stringify({ discovered: result.discovered, eligible: result.eligible, withheld: result.withheld }));
+            return result;
+        }
+        const owners = { ...await readUsageOwners(options.stateDir, "opencode-usage-tentative.json"), ...await readUsageOwners(options.stateDir, "opencode-usage-owners.json") };
+        const allowance = await openStagingAllowance(options.stateDir, process.env);
+        for (const session of sessions.sort((a, b) => Number(options.deliveredSessionIds?.has(a.id) ?? false) - Number(options.deliveredSessionIds?.has(b.id) ?? false) || a.created_at_ms - b.created_at_ms || a.id.localeCompare(b.id))) {
+            if (options.include && !options.include(session)) {
+                result.withheld += 1;
+                if (options.countOnly?.(session)) {
+                    try {
+                        result.shelved.push(await exportNativeSession(store, session, options.stateDir, owners, false));
+                    }
+                    catch (error) {
+                        result.failures.push({ session_id: session.id, reason: readReason(error) });
+                    }
+                }
+                continue;
+            }
+            result.eligible += 1;
+            try {
+                result.files.push(await exportNativeSession(store, session, options.stateDir, owners, true, allowance, options.exportDirectory));
+            }
+            catch (error) {
+                result.failures.push({ session_id: session.id, reason: readReason(error) });
+            }
+        }
+        if (!options.readOnlyAccounting)
+            await writeJsonFileAtomic(path.join(options.stateDir, "opencode-usage-tentative.json"), owners);
+    }
+    catch (error) {
+        result.failures.push({ session_id: null, reason: readReason(error) });
+    }
+    finally {
+        store?.close();
+    }
+    console.error("[opencode inventory] scan finished", JSON.stringify({ source: "opencode", discovered: result.discovered, exported: result.files.length, withheld: result.withheld, failed: result.failures.length, reason: result.absent ? "opencode_source_path_absent" : result.failures.length ? "opencode_inventory_partial" : "opencode_inventory_complete" }));
+    return result;
+}
+async function exportNativeSession(store, session, stateDir, owners, retainContent = true, allowance, exportDirectory) {
+    const directory = exportDirectory ?? path.join(stateDir, "opencode-transcripts");
+    if (retainContent)
+        await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const temporary = path.join(directory, `.export-${crypto.randomUUID()}`);
+    const output = retainContent ? await fs.open(temporary, "wx", 0o600) : null;
+    const hash = crypto.createHash("sha256");
+    const factsAccumulator = newSessionFactsAccumulator("opencode");
+    let lines = 0;
+    let bytes = 0;
+    let message = null;
+    let identities = [];
+    let redactedRecords = 0;
+    const redactionRules = new Map();
+    let secretMatches = 0;
+    const write = async (record) => {
+        const part = record.type === "opencode_part" ? nativeObject(record.part) : {};
+        if (part.type === "file" && typeof part.url === "string")
+            record = { ...record, attachment_source: {
+                    representation: part.url.startsWith("data:") ? "inline_data_url" : "reference_only",
+                    referenced_bytes_read: false,
+                    reason: part.url.startsWith("data:") ? "native_inline_payload_available" : "external_attachment_bytes_not_read",
+                } };
+        const masked = sanitizeTextEvidenceForUpload({ text: JSON.stringify(record) + "\n", redactedFields: ["opencode_native_record"] });
+        if (masked.status === "redacted" && masked.completenessLabel === "redaction_crashed_stubbed")
+            throw new OpenCodeReadError("opencode_redaction_failed");
+        if (masked.status === "redacted") {
+            redactedRecords += 1;
+            secretMatches += masked.redaction.secret_like_match_count;
+            for (const rule of masked.redaction.rule_counts) {
+                const prior = redactionRules.get(rule.rule_id) ?? { rule_id: rule.rule_id, match_count: 0, redacted_char_count: 0 };
+                prior.match_count += rule.match_count;
+                prior.redacted_char_count += rule.redacted_char_count;
+                redactionRules.set(rule.rule_id, prior);
+            }
+        }
+        hash.update(masked.bytes);
+        bytes += masked.bytes.length;
+        lines += 1;
+        try {
+            observeSessionFactsRecord(factsAccumulator, JSON.parse(masked.bytes.toString("utf8")));
+        }
+        catch { /* Masked crash marker remains evidence, not an invented native record. */ }
+        if (output) {
+            const deferred = roomToStageUpTo(allowance, bytes);
+            if (deferred)
+                throw new OpenCodeReadError(`opencode_staging_deferred_${deferred}`);
+            await output.write(masked.bytes);
+        }
+    };
+    const settleUsage = async () => {
+        if (!message || message.role !== "assistant")
+            return;
+        const nativeIdentity = openCodeProviderIdentity(message, identities);
+        const identity = nativeIdentity ? crypto.createHash("sha256").update(nativeIdentity).digest("hex") : null;
+        const nativeTokens = nativeObject(message.tokens);
+        const hasUsage = !message.error && Number.isFinite(nativeObject(message.time).completed) && ["input", "output", "reasoning"].every((key) => typeof nativeTokens[key] === "number" && Number.isFinite(nativeTokens[key]) && Number(nativeTokens[key]) >= 0) && typeof message.modelID === "string";
+        const owner = identity ? owners[identity] : null;
+        const status = !identity || !hasUsage ? "unknown" : owner && owner !== session.id ? "copied" : "known";
+        if (identity && hasUsage && !owner)
+            owners[identity] = session.id;
+        await write({ type: "opencode_usage", status, identity, owner_session_id: identity ? owners[identity] : null, model: message.modelID ?? null, provider: message.providerID ?? null, tokens: message.tokens ?? null });
+    };
+    try {
+        for (const record of store.records(session.id)) {
+            if (record.type === "opencode_message") {
+                await settleUsage();
+                message = nativeObject(record.info);
+                identities = [];
+            }
+            if (record.type === "opencode_part") {
+                const part = nativeObject(record.part);
+                if (part.metadata)
+                    identities.push({ metadata: Object.fromEntries(Object.entries(nativeObject(part.metadata)).map(([name, value]) => [name, { itemId: nativeObject(value).itemId }])) });
+            }
+            await write(record);
+        }
+        await settleUsage();
+        await write({ type: "opencode_capture", redacted_records: redactedRecords, accounting_scope: "persistent_native_provider_item_ownership_on_this_machine" });
+        await output?.close();
+        const revision = hash.digest("hex");
+        const localPath = retainContent ? path.join(directory, `${session.id}-${revision}.jsonl`) : "";
+        if (retainContent) {
+            if (allowance) {
+                const deferred = admitToStaging(allowance, bytes, { kind: "opencode_jsonl" });
+                if (deferred)
+                    throw new OpenCodeReadError(`opencode_staging_deferred_${deferred}`);
+            }
+            await fs.rename(temporary, localPath);
+        }
+        observeSessionFactsFile(factsAccumulator, { bytes, lines });
+        const facts = finalizeSessionFacts(factsAccumulator);
+        return { session, local_path: localPath, byte_size: bytes, revision, facts,
+            ...(secretMatches ? { redaction: { schema_version: "raw-evidence-redaction.v1", status: "sanitized", mode: "deterministic_text_replacement",
+                    applied_by: ["local_collector"], rule_counts: [...redactionRules.values()], secret_like_match_count: secretMatches,
+                    redacted_fields: ["opencode_native_record"], redacted_ranges: [], sanitized_content_hash_sha256: revision, sanitized_byte_size: bytes } } : {}) };
+    }
+    catch (error) {
+        await output?.close().catch(() => undefined);
+        if (retainContent)
+            await fs.unlink(temporary).catch(() => undefined);
+        throw error;
+    }
+}
+function readReason(error) { return error instanceof OpenCodeReadError ? error.reason : "opencode_export_failed"; }
+async function readUsageOwners(stateDir, filename) {
+    const saved = await readJsonFile(path.join(stateDir, filename)).catch((error) => {
+        if (error.code === "ENOENT")
+            return {};
+        throw new OpenCodeReadError("opencode_accounting_cursor_unreadable");
+    });
+    if (!saved || typeof saved !== "object" || Array.isArray(saved) || Object.entries(saved).some(([key, owner]) => !/^[a-f0-9]{64}$/.test(key) || typeof owner !== "string" || !/^ses_[A-Za-z0-9]+$/.test(owner)))
+        throw new OpenCodeReadError("opencode_accounting_cursor_invalid");
+    return saved;
+}
+/** A local usage owner becomes durable only after both evidence and metadata were acknowledged. */
+export async function acknowledgeOpenCodeUsage(stateDir, sessions) {
+    const committed = await readUsageOwners(stateDir, "opencode-usage-owners.json");
+    const tentative = await readUsageOwners(stateDir, "opencode-usage-tentative.json");
+    for (const [identity, owner] of Object.entries(tentative))
+        if (sessions.has(owner))
+            committed[identity] ??= owner;
+    await writeJsonFileAtomic(path.join(stateDir, "opencode-usage-owners.json"), committed);
+    console.error("[opencode accounting] acknowledged native identity owners", JSON.stringify({ reason: "durable_native_usage_acknowledged", identities: Object.keys(committed).length, sessions: sessions.size }));
+}

package/dist/opencode-policy.js

@@ -0,0 +1,29 @@
+/** Apply existing collection choices to native directory metadata before exporting OpenCode evidence. */
+import { getCollectorRuntimePaths, readLocalCollectorConfig } from "./local-state.js";
+import { readSourceSwitches } from "./source-opt-out.js";
+import { settleCollectionScope, sessionInsideRoots } from "./collection-scope.js";
+import { decideShelfMode, sessionShelf } from "./commands/session-sync-shelf.js";
+import { scoreSignalsAgainstWorktrees } from "./adapters/attribution-core.js";
+export async function openCodeCollectionPolicy(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const config = await readLocalCollectorConfig(paths).catch((error) => { if (error.code === "ENOENT")
+        return null; throw error; });
+    const switches = await readSourceSwitches(config, paths, "opencode_inventory", { fetch: options.fetchImpl, dashboardUrl: options.dashboardUrl });
+    const shelf = await decideShelfMode({ homeDir: options.homeDir, dashboardUrl: options.dashboardUrl ?? null, fetchImpl: options.fetchImpl ?? globalThis.fetch });
+    const scope = await settleCollectionScope(paths.state_dir, config?.collection_scope);
+    const roots = options.collectionRoots ?? config?.default_repo_paths ?? [];
+    const enabled = switches.opencode && !switches.held && shelf.mode !== "hold";
+    const reason = switches.held || shelf.mode === "hold" ? "owner_check_unavailable" : !switches.opencode ? "raw_evidence_upload_disabled" : "opencode_existing_collection_policy";
+    const drawer = (session) => {
+        const attribution = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees ?? [], { collectionRoots: roots });
+        return shelf.mode === "founder" && sessionShelf({ ...attribution, local_cwd: session.directory, session_facts: null }, shelf.rules).shelf === "drawer";
+    };
+    return { enabled, reason, drawer, include: (session) => {
+            if (!enabled)
+                return false;
+            const attribution = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees ?? [], { collectionRoots: roots });
+            if (scope.scope === "roots_only" && !sessionInsideRoots({ ...attribution, local_cwd: session.directory }, roots))
+                return false;
+            return !drawer(session);
+        } };
+}

package/dist/pi-inventory.js

@@ -0,0 +1,238 @@
+/** Pi's shared inventory keeps native records and fragments inside the existing redacted staging path. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { accountPiUsage, piObject, newSessionFactsAccumulator, observeSessionFactsRecord, observeSessionFactsFile, finalizeSessionFacts } from '@bli-cockpit/telemetry-core';
+import { listPiSessions, piSessionRoots, readPiSession, PiReadError } from './adapters/pi-session-reader.js';
+import { piSessionHeader } from './adapters/pi-session-facts.js';
+import { sanitizeTextEvidenceForUpload } from './adapters/raw-evidence-sanitize.js';
+import { openStagingAllowance, roomToStageUpTo, admitToStaging } from './staging-gate.js';
+export const PI_CURSOR_FILENAME = 'pi-raw-evidence.json';
+/** All consumers share roots and bounded keyset discovery; policy is applied before full body reads. */
+export async function readPiInventory(options) {
+    const result = { discovered: 0, sessions: [], eligible: 0, withheld: 0, files: [], shelved: [], failures: [], absent: true };
+    const sessions = new Map();
+    for (const root of options.sessionRoots ?? piSessionRoots(options.homeDir, { agentDir: process.env.PI_CODING_AGENT_DIR, sessionDir: process.env.PI_CODING_AGENT_SESSION_DIR })) {
+        let after = '';
+        try {
+            while (true) {
+                const page = await listPiSessions(root, after, 100);
+                if (page.state !== 'missing')
+                    result.absent = false;
+                for (const file of page.files) {
+                    try {
+                        const stamp = await fs.stat(file.filePath);
+                        if (options.sinceMs !== undefined && stamp.mtimeMs < options.sinceMs)
+                            continue;
+                        let header = null;
+                        for await (const event of readPiSession(file.filePath)) {
+                            if (event.kind === 'record') {
+                                header = piSessionHeader(event.value);
+                                break;
+                            }
+                        }
+                        const id = header?.id && /^[A-Za-z0-9._-]{1,80}$/.test(header.id) ? header.id : `pi-file-${crypto.createHash('sha256').update(file.filePath).digest('hex').slice(0, 32)}`;
+                        const existing = sessions.get(id);
+                        if (existing) {
+                            if (!existing.filePaths.includes(file.filePath))
+                                existing.filePaths.push(file.filePath);
+                            existing.directories[file.filePath] = header?.cwd ?? "";
+                            existing.updated_at_ms = Math.max(existing.updated_at_ms, stamp.mtimeMs);
+                        }
+                        else
+                            sessions.set(id, { id, directory: header?.cwd ?? '', parentSession: header?.parentSession ?? null, created_at_ms: stamp.birthtimeMs, updated_at_ms: stamp.mtimeMs, filePaths: [file.filePath], directories: { [file.filePath]: header?.cwd ?? "" } });
+                    }
+                    catch (error) {
+                        result.failures.push({ session_id: null, reason: reason(error) });
+                    }
+                }
+                if (page.state !== 'more')
+                    break;
+                after = page.next;
+            }
+        }
+        catch (error) {
+            result.failures.push({ session_id: null, reason: reason(error) });
+        }
+    }
+    result.sessions = [...sessions.values()];
+    result.discovered = sessions.size;
+    for (const session of result.sessions.sort((a, b) => Number(options.deliveredSessionIds?.has(a.id) ?? false) - Number(options.deliveredSessionIds?.has(b.id) ?? false) || a.created_at_ms - b.created_at_ms || a.id.localeCompare(b.id))) {
+        const eligiblePaths = session.filePaths.filter(filePath => !options.include || options.include({ ...session, directory: session.directories[filePath] ?? session.directory }));
+        const included = eligiblePaths.length > 0;
+        if (included)
+            result.eligible++;
+        else
+            result.withheld++;
+        if (options.metadataOnly || (!included && !options.countOnly?.(session)))
+            continue;
+        try {
+            (included ? result.files : result.shelved).push(await exportPiSession({ ...session, directory: session.directories[(eligiblePaths[0] ?? session.filePaths[0])] ?? session.directory, filePaths: included ? eligiblePaths : session.filePaths }, options, included));
+        }
+        catch (error) {
+            result.failures.push({ session_id: session.id, reason: reason(error) });
+        }
+    }
+    console.error('[pi inventory] observed native source', JSON.stringify({ discovered: result.discovered, returned: result.sessions.length, unique: sessions.size, exported: result.files.length, failed: result.failures.length, absent: result.absent }));
+    return result;
+}
+async function exportPiSession(session, options, retain) {
+    const directory = options.exportDirectory ?? path.join(options.stateDir, 'pi-transcripts');
+    if (retain) {
+        // Recompute the current policy-selected, redacted stream before trusting a retained derivative.
+        // This pass writes nothing and never buffers the aggregate session.
+        const current = await exportPiSession(session, options, false);
+        const candidate = path.join(directory, `${session.id}-${current.revision}.jsonl`);
+        if (await verifyRetainedExport(candidate, current.revision, current.byte_size)) {
+            console.error('[pi inventory] retained export reused', JSON.stringify({ reason: 'pi_retained_export_verified', bytes: current.byte_size }));
+            return { ...current, local_path: candidate };
+        }
+    }
+    if (retain)
+        await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const temporary = path.join(directory, `.export-${crypto.randomUUID()}`), output = retain ? await fs.open(temporary, 'wx', 0o600) : null;
+    const allowance = retain ? await openStagingAllowance(options.stateDir, process.env) : undefined;
+    const hash = crypto.createHash('sha256'), acc = newSessionFactsAccumulator('pi'), ledger = new Map();
+    const pending = new Set(session.id.startsWith('pi-file-') ? ['pi_session_header_identity_unavailable'] : []), seenRevisions = new Set();
+    let bytes = 0, lines = 0, secretMatches = 0;
+    const rules = new Map();
+    const write = async (text) => {
+        const masked = sanitizeTextEvidenceForUpload({ text, redactedFields: ['pi_native_record'] });
+        if (masked.status === 'redacted') {
+            if (masked.completenessLabel === 'redaction_crashed_stubbed')
+                throw new PiReadError('pi_redaction_failed');
+            secretMatches += masked.redaction.secret_like_match_count;
+            for (const rule of masked.redaction.rule_counts) {
+                const prior = rules.get(rule.rule_id) ?? { rule_id: rule.rule_id, match_count: 0, redacted_char_count: 0 };
+                prior.match_count += rule.match_count;
+                prior.redacted_char_count += rule.redacted_char_count;
+                rules.set(rule.rule_id, prior);
+            }
+        }
+        hash.update(masked.bytes);
+        bytes += masked.bytes.length;
+        lines++;
+        try {
+            observeSessionFactsRecord(acc, JSON.parse(masked.bytes.toString('utf8')));
+        }
+        catch {
+            pending.add('pi_normalization_pending');
+        }
+        if (output) {
+            const deferred = roomToStageUpTo(allowance, bytes);
+            if (deferred)
+                throw new PiReadError(`pi_staging_deferred_${deferred}`);
+            await output.write(masked.bytes);
+        }
+    };
+    try {
+        for (const filePath of [...session.filePaths].sort()) {
+            // Same-ID divergent files remain separate native segments; no text/title deduplication occurs.
+            // Deduplicate only byte-identical copies under the same exact native session ID.
+            let observed = null;
+            for await (const event of readPiSession(filePath))
+                if (event.kind === 'revision')
+                    observed = event;
+            if (observed?.stable && seenRevisions.has(observed.revision))
+                continue;
+            for await (const event of readPiSession(filePath)) {
+                if (event.kind === 'revision') {
+                    if (!event.stable)
+                        pending.add('pi_source_changed_during_read');
+                    seenRevisions.add(event.revision);
+                    continue;
+                }
+                if (event.kind === 'partial' || !event.valid) {
+                    pending.add(event.kind === 'partial' ? 'pi_partial_native_record' : 'pi_malformed_native_record');
+                    let text, encoding;
+                    try {
+                        text = new TextDecoder('utf-8', { fatal: true }).decode(event.raw);
+                        encoding = 'utf8';
+                    }
+                    catch {
+                        text = event.raw.toString('latin1');
+                        encoding = 'latin1';
+                    }
+                    await write(JSON.stringify({ type: 'pi_raw_fragment', encoding, offset: event.offset, text }) + '\n');
+                    continue;
+                }
+                await write(event.raw.toString('utf8'));
+                const record = piObject(event.value), message = piObject(record.message);
+                if (!['session', 'message', 'model_change', 'thinking_level_change', 'compaction', 'branch_summary', 'custom', 'custom_message', 'label', 'session_info'].includes(String(record.type)))
+                    pending.add('pi_unknown_native_record');
+                if (record.type !== 'session' && typeof record.id !== 'string')
+                    pending.add('pi_native_entry_identity_missing');
+                if (record.type === 'session' && record.version !== 3)
+                    pending.add('pi_format_version_unverified');
+                if (record.type === 'message' && message.role === 'assistant') {
+                    const decision = accountPiUsage(session.id, record, ledger);
+                    const identity = decision.identity ? crypto.createHash('sha256').update(decision.identity).digest('hex') : null;
+                    await write(JSON.stringify({ type: 'pi_usage', status: decision.status === 'known' ? 'known' : decision.status === 'copied' ? 'copied' : 'unknown', identity, model: decision.model, usage: decision.usage, reason: decision.reason }) + '\n');
+                }
+                if (record.type === 'compaction' || record.type === 'branch_summary' || (message.role !== 'assistant' && message.usage != null))
+                    await write(JSON.stringify({ type: 'pi_usage', status: 'unknown', reason: 'pi_auxiliary_usage_identity_unverified' }) + '\n');
+            }
+        }
+        await write(JSON.stringify({ type: 'pi_capture', native_id: session.id, native_revisions: [...seenRevisions], pending_reasons: [...pending], accounting_scope: 'pending_operator_evidence_ack' }) + '\n');
+        await output?.close();
+        const revision = hash.digest('hex'), localPath = retain ? path.join(directory, `${session.id}-${revision}.jsonl`) : '';
+        if (retain) {
+            const deferred = admitToStaging(allowance, bytes, { kind: 'pi_jsonl' });
+            if (deferred)
+                throw new PiReadError(`pi_staging_deferred_${deferred}`);
+            await fs.rename(temporary, localPath);
+        }
+        observeSessionFactsFile(acc, { bytes, lines });
+        const facts = finalizeSessionFacts(acc);
+        return { session, local_path: localPath, byte_size: bytes, revision, facts, pending_reasons: [...pending], ...(secretMatches ? { redaction: { schema_version: 'raw-evidence-redaction.v1', status: 'sanitized', mode: 'deterministic_text_replacement', applied_by: ['local_collector'], rule_counts: [...rules.values()], secret_like_match_count: secretMatches, redacted_fields: ['pi_native_record'], redacted_ranges: [], sanitized_content_hash_sha256: revision, sanitized_byte_size: bytes } } : {}) };
+    }
+    catch (error) {
+        await output?.close().catch(() => undefined);
+        if (retain)
+            await fs.unlink(temporary).catch(() => undefined);
+        throw error;
+    }
+}
+function reason(error) { return error instanceof PiReadError ? error.reason : 'pi_inventory_failed'; }
+/** Pi's server claims, not a machine-local ledger, establish acknowledged ownership. */
+export async function acknowledgePiUsage(_stateDir, sessions) { console.error('[pi accounting] metadata acknowledgment received', JSON.stringify({ sessions: sessions.size, reason: 'operator_claims_resolved_by_shared_backend' })); }
+/** A filename is only a candidate: reject links, truncation, corruption and changes during verification. */
+async function verifyRetainedExport(filePath, revision, expectedBytes) {
+    let initial;
+    try {
+        initial = await fs.lstat(filePath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw new PiReadError('pi_retained_export_unreadable');
+    }
+    if (!initial.isFile() || initial.isSymbolicLink() || initial.size !== expectedBytes)
+        throw new PiReadError('pi_retained_export_invalid');
+    const input = await fs.open(filePath, 'r').catch(() => { throw new PiReadError('pi_retained_export_unreadable'); });
+    try {
+        const before = await input.stat();
+        if (before.dev !== initial.dev || before.ino !== initial.ino || before.size !== expectedBytes)
+            throw new PiReadError('pi_retained_export_changed');
+        const hash = crypto.createHash('sha256');
+        let bytes = 0;
+        for await (const chunk of input.createReadStream({ autoClose: false })) {
+            hash.update(chunk);
+            bytes += chunk.length;
+        }
+        const after = await input.stat(), named = await fs.lstat(filePath);
+        if (named.isSymbolicLink() || named.dev !== before.dev || named.ino !== before.ino || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)
+            throw new PiReadError('pi_retained_export_changed');
+        if (bytes !== expectedBytes || hash.digest('hex') !== revision)
+            throw new PiReadError('pi_retained_export_invalid');
+        return true;
+    }
+    catch (error) {
+        if (error instanceof PiReadError)
+            throw error;
+        throw new PiReadError('pi_retained_export_unreadable');
+    }
+    finally {
+        await input.close();
+    }
+}

package/dist/pi-policy.js

@@ -0,0 +1,29 @@
+/** Apply existing collection choices to native directory metadata before exporting Pi evidence. */
+import { getCollectorRuntimePaths, readLocalCollectorConfig } from "./local-state.js";
+import { readSourceSwitches } from "./source-opt-out.js";
+import { settleCollectionScope, sessionInsideRoots } from "./collection-scope.js";
+import { decideShelfMode, sessionShelf } from "./commands/session-sync-shelf.js";
+import { scoreSignalsAgainstWorktrees } from "./adapters/attribution-core.js";
+export async function piCollectionPolicy(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const config = await readLocalCollectorConfig(paths).catch((error) => { if (error.code === "ENOENT")
+        return null; throw error; });
+    const switches = await readSourceSwitches(config, paths, "pi_inventory", { fetch: options.fetchImpl, dashboardUrl: options.dashboardUrl });
+    const shelf = await decideShelfMode({ homeDir: options.homeDir, dashboardUrl: options.dashboardUrl ?? null, fetchImpl: options.fetchImpl ?? globalThis.fetch });
+    const scope = await settleCollectionScope(paths.state_dir, config?.collection_scope);
+    const roots = options.collectionRoots ?? config?.default_repo_paths ?? [];
+    const enabled = switches.pi && !switches.held && shelf.mode !== "hold";
+    const reason = switches.held || shelf.mode === "hold" ? "owner_check_unavailable" : !switches.pi ? "raw_evidence_upload_disabled" : "pi_existing_collection_policy";
+    const drawer = (session) => {
+        const attribution = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees ?? [], { collectionRoots: roots });
+        return shelf.mode === "founder" && sessionShelf({ ...attribution, local_cwd: session.directory, session_facts: null }, shelf.rules).shelf === "drawer";
+    };
+    return { enabled, reason, drawer, include: (session) => {
+            if (!enabled)
+                return false;
+            const attribution = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees ?? [], { collectionRoots: roots });
+            if (scope.scope === "roots_only" && !sessionInsideRoots({ ...attribution, local_cwd: session.directory }, roots))
+                return false;
+            return !drawer(session);
+        } };
+}

package/dist/slim/slim-transcript.js

@@ -36,7 +36,7 @@ import { LineEdits, SeenBlocks, isJsonObject } from "./slim-support.js";
  * once, which is intended: the stored bytes are no longer what the new rules would produce.
  * `slim-rules-version.test.ts` fails when a rule changes without this moving.
  */
-export const SLIM_RULES_VERSION = "slim-rules.v2";
+export const SLIM_RULES_VERSION = "slim-rules.v3";
 /** The text an image marker starts with; a line carrying one is a modified line (an image became a marker). */
 const IMAGE_MARKER_START = "[image sha256:";
 export function createSlimmer(kind, rulesForTests) {
@@ -49,8 +49,9 @@ export function createSlimmer(kind, rulesForTests) {
     const applyRules = rulesForTests ?? ((record, edits) => {
         if (kind === "claude_code")
             slimClaudeRecord(record, claude, seen, edits);
-        else
+        else if (kind === "codex")
             slimCodexRecord(record, codex, seen, edits);
+        // OpenCode keeps every native field; only the shared acknowledged-image swap changes its payload.
     });
     return {
         slimLine(line) {

package/dist/source-opt-out.js

@@ -46,7 +46,7 @@ export function resolveSourceSwitches(config, standing) {
     const labels = configOptOutLabels(config);
     const verdict = labels.length > 0 ? optOutVerdict(standing) : null;
     if (verdict && !verdict.obeyed) {
-        return { codex: true, claude: true, codexReason: null, claudeReason: null, ignored: labels, verdict: verdict.reason, held: false };
+        return { opencode: true, pi: true, codex: true, claude: true, codexReason: null, claudeReason: null, ignored: labels, verdict: verdict.reason, held: false };
     }
     const all = config?.raw_evidence_upload === "disabled";
     const codexReason = config?.collect_codex_jsonl === false
@@ -56,6 +56,8 @@ export function resolveSourceSwitches(config, standing) {
         ? CLAUDE_OPT_OUT_REASON
         : all ? ALL_SOURCES_OPT_OUT_REASON : null;
     return {
+        opencode: !all,
+        pi: !all,
         codex: codexReason === null,
         claude: claudeReason === null,
         codexReason,

package/dist/spool/local-spool-parse.js

@@ -100,7 +100,7 @@ export function parseMetadataOnlySessionReportRows(value, fieldPath) {
     return sessions;
 }
 function parseRetrySource(value, fieldPath) {
-    if (value === "codex" || value === "claude_code")
+    if (value === "codex" || value === "claude_code" || value === "opencode" || value === "pi")
         return value;
     return invalidUploadSpoolState(fieldPath, '"codex" or "claude_code"');
 }

package/dist/state-dir-audit.js

@@ -37,6 +37,9 @@ export const STUDIES_DIR_SUFFIX = "-studies";
  * collector name; none does today, and the test pins that.
  */
 export const STATE_DIR_RULES = [
+    { name: "pi-", match: "prefix", class: "state", bound: "native Pi derivatives and coverage, governed by the existing staging allowance" },
+    { name: "opencode-transcripts", match: "exact", class: "state", bound: "redacted native reader derivatives; existing staging allowance and state ceiling govern every write; current derivatives removed after durable evidence and metadata acknowledgments" },
+    { name: "opencode-", match: "prefix", class: "state", bound: "native identity cursors and metadata-only coverage receipt; overwritten by collection" },
     { name: "raw-evidence", match: "exact", class: "staging", bound: "staged copies go the tick the server commits them; 256 MiB cap; the staging gate stops new copies at the cap, on a low disk or over the 512 MiB ceiling; uncommitted evidence is never deleted, only counted" },
     { name: "sync.log", match: "prefix", class: "logs", bound: "rotated every tick at 10 MiB, at most 2 archives (20 MB) per stream" },
     { name: "sync.err.log", match: "prefix", class: "logs", bound: "rotated every tick at 10 MiB, at most 2 archives (20 MB) per stream" },