@bli-cockpit/cli 0.2.294 → 0.2.295

package/dist/adapters/raw-evidence-transcript-body.js

@@ -19,7 +19,7 @@ import { roomToStreamToStaging } from "./raw-evidence-budget-admission.js";
 import { readTranscriptWhole, streamTranscriptBody, volatilityOf } from "./raw-evidence-transcript-stream.js";
 /** Which agent's transcript rules apply to this evidence kind; null for anything the image step does not know. */
 export function agentOfKind(kind) {
-    return kind === "opencode_jsonl" ? "opencode" : kind.startsWith("codex") ? "codex" : kind.startsWith("claude") ? "claude_code" : null;
+    return kind === "pi_jsonl" ? "pi" : kind === "opencode_jsonl" ? "opencode" : kind.startsWith("codex") ? "codex" : kind.startsWith("claude") ? "claude_code" : null;
 }
 /** Decode once and release the bytes, unless the decoding was lossy and the bytes are the only exact copy. */
 export function holdDecodedText(source) {
@@ -56,7 +56,7 @@ function releaseBackingStore(bytes) {
  * the caller turns into the `file_read_failed` and `file_too_large` skips.
  */
 export async function prepareTranscriptBody(collection, file) {
-    if (file.kind === "opencode_jsonl" && file.source.stream) {
+    if ((file.kind === "opencode_jsonl" || file.kind === "pi_jsonl") && file.source.stream) {
         const source = file.source.stream;
         source.openSource ??= () => openPinnedTranscript(source.filePath, { maxFileBytes: source.maxFileBytes });
     }

package/dist/adapters/raw-evidence-transcript-file.js

@@ -311,7 +311,7 @@ function logDeliveryBackoffHold(kind, sourceKey) {
 }
 /** The size from which this pass streams a transcript instead of reading it whole; null when its image session cannot (BLI-23317). */
 function streamMinBytesFor(collection, kind) {
-    if (kind === "opencode_jsonl")
+    if ((kind === "opencode_jsonl" || kind === "pi_jsonl"))
         return 1024 * 1024;
     const session = collection.budget.images;
     if (!session?.prepareTranscriptFile || !agentOfKind(kind))

package/dist/adapters/raw-evidence.js

@@ -145,12 +145,12 @@ async function collectEverySource(collection, options, sinceMinutes) {
         await collectClaudeJsonlFiles(collection, options.claudeSessionFiles);
     }
     for (const file of options.nativeSessionFiles ?? []) {
-        recordScanned(collection, "opencode_jsonl");
+        recordScanned(collection, file.source === "pi" ? "pi_jsonl" : "opencode_jsonl");
         await collectOneEvidenceFile(collection, {
-            filePath: file.local_path, kind: "opencode_jsonl", sessionId: file.session_id, priorRedaction: file.redaction,
+            filePath: file.local_path, kind: file.source === "pi" ? "pi_jsonl" : "opencode_jsonl", sessionId: file.session_id, priorRedaction: file.redaction,
             mediaType: "application/jsonl", maxFileBytes: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
-            redactedSummary: "OpenCode native session with retained messages, tools, usage and unknown records.",
-            contentAddress: (hash16) => `opencode/${safeKeySegment(file.session_id)}/${hash16}.jsonl`,
+            redactedSummary: "Native coding session with retained messages, tools, usage and unknown records.",
+            contentAddress: (hash16) => `${file.source}/${safeKeySegment(file.session_id)}/${hash16}.jsonl`,
         });
     }
     await collectGitDiffFiles(collection, options.repoRoot);

package/dist/commands/backfill-output.js

@@ -16,6 +16,12 @@ export function writeDryRunSummary(io, options) {
     writeLine(io.stdout, `Verify after upload: ${options.dashboardUrl}/my-work`);
 }
 export function writeHumanBackfillResult(result, io) {
+    if (result.pi) {
+        const source = result.pi;
+        writeLine(io.stdout, `Pi: ${source.discovered} discovered, ${source.eligible} eligible, ${source.delivered} delivered, ${source.pending} pending, ${source.withheld} withheld (${source.coverage}).`);
+        for (const reason of source.reasons)
+            writeLine(io.stderr, `Pi: ${reason}`);
+    }
     if (result.opencode) {
         const source = result.opencode;
         writeLine(io.stdout, `OpenCode: ${source.discovered} discovered, ${source.eligible} eligible, ${source.delivered} delivered, ${source.pending} pending, ${source.withheld} withheld (${source.coverage}).`);

package/dist/commands/backfill-scope.js

@@ -98,7 +98,7 @@ async function discoverBackfillWorktrees(roots, command) {
     });
 }
 export function selectedSources(source) {
-    if (source === "opencode")
+    if (source === "opencode" || source === "pi")
         return []; // Native inventory and cursor are handled by the shared native pass.
     if (source === "codex")
         return ["codex"];

package/dist/commands/backfill.js

@@ -38,6 +38,7 @@
  * misjudged "resolved" loses that history for good.
  */
 import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET } from "../adapters/raw-evidence.js";
+import { syncPiSessions } from "./pi-sync.js";
 import { syncOpenCodeSessions } from "./opencode-sync.js";
 import { acquireBackfillLock } from "../backfill-lock.js";
 import { writeBackfillCursor } from "../cursors/backfill-cursor.js";
@@ -115,6 +116,12 @@ export async function runBackfill(command, io) {
             if (plan.result.opencode.coverage === "partial")
                 plan.result.status = "partial";
         }
+        if (command.dryRun && (!command.source || command.source === "pi") && plan.result.status !== "blocked") {
+            plan.result.pi = await syncPiSessions({ homeDir: scanned.paths.home_dir, worktrees: scanned.worktrees, collectionRoots: scanned.collectionRoots, dashboardUrl: scanned.dashboardUrl, fetchImpl: io.fetch ?? globalThis.fetch, dryRun: true,
+                sinceMs: command.all ? undefined : now.getTime() - (command.sinceDays ?? DEFAULT_BACKFILL_SINCE_DAYS) * 86400000 });
+            if (plan.result.pi.coverage === "partial")
+                plan.result.status = "partial";
+        }
         return plan.result;
     }
     const { paths } = scanned;
@@ -159,9 +166,17 @@ export async function runBackfill(command, io) {
         const opencode = (!command.source || command.source === "opencode") ? await syncOpenCodeSessions({ homeDir: paths.home_dir, worktrees: scanned.worktrees, collectionRoots: scanned.collectionRoots,
             dashboardUrl: scanned.dashboardUrl, fetchImpl: io.fetch ?? globalThis.fetch, budget, deadlineMs: command.deadlineMs,
             sinceMs: command.all ? undefined : now.getTime() - (command.sinceDays ?? DEFAULT_BACKFILL_SINCE_DAYS) * 86400000 }) : undefined;
-        const result = await reportBackfillOutcome(command, io, scanned, upload, opencode?.coverage === "partial");
+        const pi = (!command.source || command.source === "pi") ? await syncPiSessions({ homeDir: paths.home_dir, worktrees: scanned.worktrees, collectionRoots: scanned.collectionRoots,
+            dashboardUrl: scanned.dashboardUrl, fetchImpl: io.fetch ?? globalThis.fetch, budget, deadlineMs: command.deadlineMs,
+            sinceMs: command.all ? undefined : now.getTime() - (command.sinceDays ?? DEFAULT_BACKFILL_SINCE_DAYS) * 86400000 }) : null;
+        const result = await reportBackfillOutcome(command, io, scanned, upload, opencode?.coverage === "partial" || pi?.coverage === "partial");
         if (opencode)
             result.opencode = opencode;
+        if (pi) {
+            result.pi = pi;
+            if (pi.coverage === "partial" && opencode?.coverage !== "partial" && result.failure_reason === "opencode_backfill_pending")
+                result.failure_reason = pi.reasons[0] ?? "pi_backfill_pending";
+        }
         return result;
     }
     finally {

package/dist/commands/collection-report.js

@@ -38,6 +38,12 @@ export function writeAgentSessionSummary(io, summary) {
         for (const reason of source.reasons)
             writeLine(io.stdout, `OpenCode: ${reason}`);
     }
+    if (summary.pi) {
+        const source = summary.pi;
+        writeLine(io.stdout, `Pi sessions: ${source.discovered} discovered, ${source.eligible} eligible, ${source.delivered} delivered, ${source.pending} pending, ${source.withheld} withheld (${source.coverage}).`);
+        for (const reason of source.reasons)
+            writeLine(io.stdout, `Pi: ${reason}`);
+    }
     const claudeDiagnostics = claudeDiagnosticsLine(summary);
     if (claudeDiagnostics)
         writeLine(io.stdout, claudeDiagnostics);

package/dist/commands/local-args-collector-status.js

@@ -69,8 +69,8 @@ export function parseSessionsArgs(args) {
     });
     assertNoPositionals(values.positionals, "sessions");
     const source = values.flags.get("--source");
-    if (source !== undefined && source !== "codex" && source !== "claude" && source !== "opencode") {
-        throw new Error("--source must be 'codex', 'claude' or 'opencode'. Omit it to scan all sources.");
+    if (source !== undefined && source !== "codex" && source !== "claude" && source !== "opencode" && source !== "pi") {
+        throw new Error("--source must be 'codex', 'claude', 'opencode' or 'pi'. Omit it to scan all sources.");
     }
     const sinceDays = optionalPositiveInteger(values.flags.get("--since-days"), "--since-days");
     const all = values.booleans.has("--all");

package/dist/commands/local-args-collector-work.js

@@ -151,8 +151,8 @@ export function parseBackfillArgs(args) {
     });
     assertNoPositionals(values.positionals, "backfill");
     const source = values.flags.get("--source");
-    if (source !== undefined && source !== "codex" && source !== "claude" && source !== "opencode") {
-        throw new Error("--source must be 'codex', 'claude' or 'opencode'. Omit it to scan all sources.");
+    if (source !== undefined && source !== "codex" && source !== "claude" && source !== "opencode" && source !== "pi") {
+        throw new Error("--source must be 'codex', 'claude', 'opencode' or 'pi'. Omit it to scan all sources.");
     }
     const sinceDays = optionalPositiveInteger(values.flags.get("--since-days"), "--since-days");
     const all = values.booleans.has("--all");

package/dist/commands/local-help.js

@@ -146,9 +146,9 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
     "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|summarize <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
     "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|connect --provider wisprflow|recordings <note-id>|recording <id>|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
-    "  cockpit backfill (--since-days <n>|--all) [--source codex|claude|opencode] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--lock-wait <seconds>] [--yes] [--workspace <path>] [--json]",
+    "  cockpit backfill (--since-days <n>|--all) [--source codex|claude|opencode|pi] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--lock-wait <seconds>] [--yes] [--workspace <path>] [--json]",
     "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
-    "  cockpit sessions [--source codex|claude|opencode] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
+    "  cockpit sessions [--source codex|claude|opencode|pi] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
     "  cockpit serve [--port <port>] [--workspace <path>]",
     "  cockpit autostart [install|uninstall|status] [--workspace <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
     "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",

package/dist/commands/pi-sync.js

@@ -0,0 +1,167 @@
+/** Route Pi's third native format through the existing evidence pack, spool, report queue and durable cursor. */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, startLocalWorkContext, startLocalWorkContextForAttributedTarget } from "../local-state.js";
+import { writeJsonFileAtomic } from "../local-state-files.js";
+import { reportShelvedSessions } from "../shelf-reports.js";
+import { piCollectionPolicy } from "../pi-policy.js";
+import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET } from "../adapters/raw-evidence.js";
+import { cwdInsideRoots } from "../collection-scope.js";
+import { scoreSignalsAgainstWorktrees, sha256 } from "../adapters/attribution-core.js";
+import { outsideRootsWorkspace, isOutsideRootsWorkspace } from "./backfill-outside-roots.js";
+import { syncLocalAmbientEnvelope } from "../upload.js";
+import { readRawEvidenceCursor, writeRawEvidenceCursor } from "../cursors/raw-evidence-cursor.js";
+import { readPiInventory, acknowledgePiUsage, PI_CURSOR_FILENAME } from "../pi-inventory.js";
+import { queueCodexSessionReport, flushPendingCodexSessionReports } from "../upload-session-reports.js";
+import { recordSourceRetryFailure, clearSourceRetryFailure } from "../spool/local-spool.js";
+import { describeError } from "../health-detail.js";
+/** The all-history inventory is resumable through existing per-object acknowledgments, never a second delivery engine. */
+export async function syncPiSessions(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const now = new Date();
+    const summary = { source: "pi", new_since_last_scan: 0, outside_roots: 0, discovered: 0, eligible: 0, delivered: 0, pending: 0, withheld: 0, unique: 0, coverage: "complete", reasons: [] };
+    try {
+        const policy = await piCollectionPolicy(options);
+        if (!policy.enabled) {
+            const held = await readPiInventory({ homeDir: options.homeDir, stateDir: paths.state_dir, metadataOnly: true, include: () => false, sinceMs: options.sinceMs });
+            summary.discovered = held.discovered;
+            summary.unique = held.discovered;
+            summary.withheld = held.withheld;
+            summary.coverage = held.failures.length || policy.reason === "owner_check_unavailable" ? "partial" : held.absent ? "absent" : "withheld";
+            summary.reasons.push(policy.reason, ...held.failures.map(failure => failure.reason));
+            if (summary.coverage === "partial")
+                await recordSourceRetryFailure(paths, { source: "pi", attemptedAt: now.toISOString(), reason: held.failures[0]?.reason ?? policy.reason });
+            console.error("[pi sync] source withheld", JSON.stringify(summary));
+            return summary;
+        }
+        const attributed = (directory) => scoreSignalsAgainstWorktrees({ cwds: [directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees, { collectionRoots: options.collectionRoots });
+        const cursor = await readRawEvidenceCursor(paths, { filename: PI_CURSOR_FILENAME, sessionsOnly: true });
+        const inventory = await readPiInventory({ homeDir: options.homeDir, stateDir: paths.state_dir, metadataOnly: options.dryRun, sinceMs: options.sinceMs, deliveredSessionIds: new Set(Object.entries(cursor.sessions).filter(([, entry]) => entry.uploaded_object_key).map(([id]) => id)), include: policy.include, countOnly: policy.drawer });
+        summary.discovered = inventory.discovered;
+        summary.withheld = inventory.withheld;
+        summary.eligible = inventory.eligible;
+        summary.pending = inventory.eligible - inventory.files.length;
+        summary.unique = inventory.discovered;
+        summary.reasons.push(...new Set(inventory.failures.map((failure) => failure.reason)), ...new Set(inventory.files.flatMap(file => file.pending_reasons)));
+        if (inventory.absent)
+            summary.coverage = "absent";
+        if (options.dryRun) {
+            summary.pending = inventory.eligible;
+            if (inventory.failures.length)
+                summary.coverage = "partial";
+            return summary;
+        }
+        if (inventory.shelved.length) {
+            const [device, config] = await Promise.all([readLocalCollectorSessionFile(paths), readLocalCollectorConfig(paths)]);
+            const shelfReport = await reportShelvedSessions({ paths, dashboardUrl: options.dashboardUrl ?? config?.dashboard_url ?? null,
+                deviceToken: device?.device_token ?? null, fetchImpl: options.fetchImpl, allow: config?.shelf_metrics_allow ?? [], now,
+                shelved: inventory.shelved.map(file => ({ key: `pi:${file.session.id}`, source: "pi", reason: "drawer_shelf", facts: file.facts, recencyMs: file.session.updated_at_ms })) });
+            if (shelfReport.failed || shelfReport.not_counted)
+                summary.reasons.push("pi_shelf_metrics_pending");
+        }
+        summary.new_since_last_scan = inventory.files.filter((file) => !cursor.sessions[file.session.id]).length;
+        summary.outside_roots = inventory.files.filter((file) => !cwdInsideRoots(file.session.directory, options.collectionRoots)).length;
+        const durableSessions = new Set();
+        const groups = new Map();
+        for (const file of inventory.files) {
+            const worktree = attributed(file.session.directory).worktree ?? outsideRootsWorkspace(options.homeDir);
+            const group = groups.get(worktree.worktree_fingerprint) ?? { worktree, files: [] };
+            group.files.push(file);
+            groups.set(worktree.worktree_fingerprint, group);
+        }
+        const budget = options.budget ?? { remainingBytes: RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, remainingObjects: RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET };
+        for (const { worktree, files } of groups.values()) {
+            if (options.deadlineMs && Date.now() >= options.deadlineMs) {
+                summary.reasons.push("pi_deadline_deferred");
+                summary.pending = summary.eligible - summary.delivered;
+                break;
+            }
+            if (isOutsideRootsWorkspace(worktree))
+                await fs.mkdir(worktree.repo_root, { recursive: true, mode: 0o700 });
+            const contextOptions = { homeDir: options.homeDir, repoRoot: worktree.repo_root, branch: worktree.branch, leaveActiveContext: true };
+            const context = isOutsideRootsWorkspace(worktree) ? await startLocalWorkContextForAttributedTarget(contextOptions, worktree) : await startLocalWorkContext(contextOptions);
+            const sync = await syncLocalAmbientEnvelope({ homeDir: options.homeDir, repoRoot: worktree.repo_root, dashboardUrl: options.dashboardUrl,
+                rawEvidenceBudget: budget, codexSessionFiles: [], claudeSessionFiles: [], nativeSessionFiles: files.map((file) => ({ local_path: file.local_path, session_id: file.session.id, source: "pi", redaction: file.redaction })), fetch: options.fetchImpl });
+            if (sync.status !== "uploaded")
+                summary.reasons.push(sync.failure_reason);
+            const rows = files.map((file) => {
+                const attribution = attributed(file.session.directory);
+                const outcome = sync.raw_evidence_outcomes.find((item) => item.kind === "pi_jsonl" && item.codex_session_id === file.session.id);
+                const pointer = outcome && (outcome.upload_state === "uploaded" || outcome.upload_state === "reused_existing") ? outcome.raw_evidence_pointer_id : null;
+                if (!pointer)
+                    summary.reasons.push(outcome?.reason ?? "pi_delivery_pending");
+                return { source: "pi", codex_session_id: file.session.id, observed_at: now.toISOString(), attribution_state: attribution.state,
+                    attribution_reason: attribution.reason, attribution_score: attribution.attribution_score, path_score: attribution.path_score, signals: attribution.signals,
+                    session_file_hash_sha256: file.revision, session_file_byte_size: file.byte_size, session_file_mtime: new Date(file.session.updated_at_ms).toISOString(), session_facts: file.facts,
+                    repo_fingerprint: attribution.worktree?.repo_fingerprint, worktree_fingerprint: attribution.worktree?.worktree_fingerprint,
+                    repo_label: attribution.worktree?.repo_label, branch: attribution.worktree?.branch, cwd_basename: path.basename(file.session.directory), cwd_hash: sha256(Buffer.from(file.session.directory)),
+                    root_scope: cwdInsideRoots(file.session.directory, options.collectionRoots) ? "inside" : "outside",
+                    raw_evidence_pointer_id: pointer ?? undefined, upload_state: pointer ? "uploaded" : "not_uploaded", upload_reason: pointer ? "durable_evidence_acknowledged" : outcome?.reason ?? "pi_delivery_pending" };
+            });
+            // Durable metadata queue precedes cursor movement; an unavailable report endpoint cannot age sessions out.
+            await queueCodexSessionReport({ homeDir: options.homeDir, dashboardUrl: sync.dashboard_url, generatedAt: now.toISOString(), workContextId: context.work_context_id,
+                repoLabel: worktree.repo_label, branch: worktree.branch, repoFingerprint: worktree.repo_fingerprint, repoOriginUrl: worktree.repo_origin_url,
+                worktreeLabel: worktree.worktree_label, worktreeFingerprint: worktree.worktree_fingerprint, worktreeIsPrimary: worktree.worktree_is_primary, sessions: rows });
+            for (const [index, file] of files.entries()) {
+                const row = rows[index];
+                const pointer = row.raw_evidence_pointer_id ?? null;
+                if (pointer) {
+                    summary.delivered += 1;
+                    durableSessions.add(file.session.id);
+                }
+                else
+                    summary.pending += 1;
+                // Acknowledged bytes can be retained while a partial or racing native observation stays retryable.
+                if (file.pending_reasons.some(reason => reason === "pi_source_changed_during_read" || reason === "pi_partial_native_record"))
+                    continue;
+                cursor.sessions[file.session.id] = { file_hash_sha256: file.revision, file_mtime_ms: file.session.updated_at_ms, byte_size: file.byte_size, byte_offset: pointer ? file.byte_size : 0,
+                    state: row.attribution_state, reason: row.attribution_reason, worktree_fingerprint: row.worktree_fingerprint ?? null, uploaded_object_key: pointer,
+                    uploaded_at: pointer ? now.toISOString() : null, uploaded_byte_size: pointer ? file.byte_size : null, last_seen_at: now.toISOString() };
+            }
+            cursor.updated_at = now.toISOString();
+            // Metadata acknowledgment below owns cursor promotion.
+        }
+        const report = await flushPendingCodexSessionReports({ homeDir: options.homeDir, fetch: options.fetchImpl });
+        if (report.posted && report.failed_count === 0) {
+            await writeRawEvidenceCursor(paths, cursor, { filename: PI_CURSOR_FILENAME, sessionsOnly: true });
+            await acknowledgePiUsage(paths.state_dir, durableSessions);
+            // The shared pack/spool owns acknowledged bytes now; these are disposable redacted reader derivatives.
+            for (const file of inventory.files)
+                if (durableSessions.has(file.session.id))
+                    await fs.unlink(file.local_path).catch(() => undefined);
+        }
+        if (inventory.files.length && (!report.posted || report.failed_count > 0)) {
+            summary.reasons.push(report.reason);
+            summary.pending += summary.delivered;
+            summary.delivered = 0;
+        }
+        summary.reasons = [...new Set(summary.reasons)];
+        if (summary.pending || summary.reasons.length)
+            summary.coverage = "partial";
+        if (summary.coverage === "partial")
+            await recordSourceRetryFailure(paths, { source: "pi", attemptedAt: now.toISOString(), reason: summary.reasons[0] ?? "pi_delivery_pending" });
+        else
+            await clearSourceRetryFailure(paths, "pi", now.toISOString());
+    }
+    catch (error) {
+        summary.pending = Math.max(summary.pending, summary.eligible - summary.delivered);
+        summary.coverage = "partial";
+        summary.reasons.push("pi_sync_failed");
+        await recordSourceRetryFailure(paths, { source: "pi", attemptedAt: now.toISOString(), reason: "pi_sync_failed" });
+        console.error("[pi sync] pass failed; native sessions remain retryable", JSON.stringify({ reason: "pi_sync_failed", ...describeError(error) }));
+    }
+    finally {
+        if (!options.dryRun) {
+            try {
+                await writeJsonFileAtomic(path.join(paths.state_dir, "pi-collection-status.json"), { observed_at: now.toISOString(), ...summary });
+            }
+            catch (error) {
+                summary.coverage = "partial";
+                summary.reasons.push("pi_coverage_receipt_write_failed");
+                console.error("[pi sync] coverage receipt not written", JSON.stringify({ reason: "pi_coverage_receipt_write_failed", ...describeError(error) }));
+            }
+        }
+    }
+    console.error("[pi sync] pass finished", JSON.stringify(summary));
+    return summary;
+}

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.294");
+    writeLine(io?.stdout ?? process.stdout, "0.2.295");
     return 0;
   }
 

package/dist/commands/session-sync-failures.js

@@ -174,4 +174,8 @@ export function recordUnexplainedFailure(ledger) {
 /** Keep native partial outcomes in the same closed failure ledger as legacy sources. */
 export function recordOpenCodeFailures(ledger, native) {
     ledger.fail(native.coverage === "partial", "opencode_scan_read_failed", native.reasons[0] ?? "opencode_delivery_pending");
+}
+/** Keep Pi's named partial outcomes inside the single failure vocabulary writer. */
+export function recordPiFailures(ledger, native) {
+    ledger.fail(native.coverage === "partial", "pi_scan_read_failed", native.reasons[0] ?? "pi_delivery_pending");
 }

package/dist/commands/session-sync.js

@@ -1,4 +1,4 @@
-import { createSyncFailureLedger, recordOpenCodeFailures } from "./session-sync-failures.js";
+import { createSyncFailureLedger, recordOpenCodeFailures, recordPiFailures } from "./session-sync-failures.js";
 import { readLocalWorkContextForRepo } from "../local-state.js";
 /**
  * One attributed sync pass: scan both session stores, attribute what they hold,
@@ -41,6 +41,7 @@ import { readLocalWorkContextForRepo } from "../local-state.js";
  */
 import os from "node:os";
 import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET } from "../adapters/raw-evidence.js";
+import { syncPiSessions } from "./pi-sync.js";
 import { syncOpenCodeSessions } from "./opencode-sync.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile } from "../local-state.js";
 import { reportShelvedSessions } from "../shelf-reports.js";
@@ -145,21 +146,23 @@ export async function runAttributedWorktreeSync(requested) {
     const shelfReports = await sendShelfReports(options, paths, shelfSplit, now);
     const run = await finishAttributedSync(options, { paths, now, plan, scan, sessions, worktreePass });
     const opencode = await syncOpenCodeSessions({ homeDir, worktrees: requested.worktrees, collectionRoots: plan.collectionRoots, dashboardUrl: requested.dashboardUrl, fetchImpl: requested.fetchImpl, budget: options.rawEvidenceBudget });
+    const pi = await syncPiSessions({ homeDir, worktrees: requested.worktrees, collectionRoots: plan.collectionRoots, dashboardUrl: requested.dashboardUrl, fetchImpl: requested.fetchImpl, budget: options.rawEvidenceBudget });
     const failures = createSyncFailureLedger();
+    recordPiFailures(failures, pi);
     for (const failure of run.failure_records)
         failures.add(failure);
     recordOpenCodeFailures(failures, opencode);
     return {
         ...run,
-        opencode,
-        summary: { ...run.summary, opencode },
-        sessions_new_this_tick: run.sessions_new_this_tick + opencode.new_since_last_scan,
-        sessions_outside_root: run.sessions_outside_root + opencode.outside_roots,
-        ok: run.ok && opencode.coverage !== "partial",
-        failure_reasons: [...run.failure_reasons, ...(opencode.coverage === "partial" ? opencode.reasons.length ? opencode.reasons : ["opencode_delivery_pending"] : [])],
+        opencode, pi,
+        summary: { ...run.summary, opencode, pi },
+        sessions_new_this_tick: run.sessions_new_this_tick + opencode.new_since_last_scan + pi.new_since_last_scan,
+        sessions_outside_root: run.sessions_outside_root + opencode.outside_roots + pi.outside_roots,
+        ok: run.ok && opencode.coverage !== "partial" && pi.coverage !== "partial",
+        failure_reasons: [...run.failure_reasons, ...(pi.coverage === "partial" ? pi.reasons : []), ...(opencode.coverage === "partial" ? opencode.reasons.length ? opencode.reasons : ["opencode_delivery_pending"] : [])],
         failure_records: failures.sortedRecords(),
-        sessions_observed: run.sessions_observed + opencode.eligible,
-        sessions_pending_upload: run.sessions_pending_upload + opencode.pending,
+        sessions_observed: run.sessions_observed + opencode.eligible + pi.eligible,
+        sessions_pending_upload: run.sessions_pending_upload + opencode.pending + pi.pending,
         sessions_shelved: shelfSplit.shelved.length,
         packs_refused: worktreePass.packsRefused ?? 0,
         shelf_reports: shelfReports,

package/dist/commands/sessions.js

@@ -9,6 +9,7 @@
  */
 import os from "node:os";
 import path from "node:path";
+import { readPiInventory } from "../pi-inventory.js";
 import { readOpenCodeInventory } from "../opencode-inventory.js";
 import { scoreSignalsAgainstWorktrees } from "../adapters/attribution-core.js";
 import { writeLine } from "./cli-io.js";
@@ -41,15 +42,30 @@ export async function runSessions(command, io) {
             return { source: "opencode", session_id: session.id, state: attributed.state, reason: attributed.reason, attribution_score: attributed.attribution_score,
                 path_score: attributed.path_score, signals: attributed.signals, repo_label: attributed.worktree?.repo_label ?? null };
         }) } : null;
+    const piNative = !command.source || command.source === "pi" ? await readPiInventory({ homeDir,
+        stateDir: getCollectorRuntimePaths(homeDir).state_dir, metadataOnly: true,
+        sinceMs: window.since_minutes === null ? undefined : now.getTime() - window.since_minutes * 60_000 }) : null;
+    const pi = piNative && (!piNative.absent || piNative.failures.length) ? { counts: { observed_count: piNative.discovered, read_failed: piNative.failures.length },
+        reasons: [...new Set(piNative.failures.map(failure => failure.reason))], sessions: piNative.sessions.map(session => {
+            const attributed = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, worktrees);
+            return { source: "pi", session_id: session.id, state: attributed.state, reason: attributed.reason, attribution_score: attributed.attribution_score,
+                path_score: attributed.path_score, signals: attributed.signals, repo_label: attributed.worktree?.repo_label ?? null };
+        }) } : null;
     // BLI-3483: the scanners have always counted the folders and files they
     // could not read, and this command has always thrown those counts away
     // except for one field in `--json`. So "No sessions observed" was printed on
     // a machine where the scan had been blocked from looking — the operator's
     // one diagnostic tool answering the question with the failure removed.
     const readFailures = countReadFailures(codex, claude);
-    readFailures.total += native?.failures.length ?? 0;
+    readFailures.total += (native?.failures.length ?? 0) + (piNative?.failures.length ?? 0);
     if (command.json) {
-        return writeSessionJson(io, window, readFailures, codex, claude, codexRows, claudeRows, opencode);
+        return writeSessionJson(io, window, readFailures, codex, claude, codexRows, claudeRows, opencode, pi);
+    }
+    if (pi) {
+        for (const row of pi.sessions)
+            writeLine(io.stdout, sessionRowLine(row));
+        for (const reason of pi.reasons)
+            writeLine(io.stdout, `Pi read incomplete: ${reason}`);
     }
     if (opencode) {
         for (const row of opencode.sessions)
@@ -57,7 +73,7 @@ export async function runSessions(command, io) {
         for (const reason of opencode.reasons)
             writeLine(io.stdout, `OpenCode read incomplete: ${reason}`);
     }
-    return writeSessionText(io, window, readFailures, codexRows, claudeRows, opencode?.sessions.length ?? 0);
+    return writeSessionText(io, window, readFailures, codexRows, claudeRows, (opencode?.sessions.length ?? 0) + (pi?.sessions.length ?? 0));
 }
 function writeSessionText(io, window, readFailures, codexRows, claudeRows, nativeCount = 0) {
     writeLine(io.stdout, "TOWER sessions (read-only attribution)");
@@ -84,7 +100,7 @@ function writeSessionText(io, window, readFailures, codexRows, claudeRows, nativ
     return 0;
 }
 async function scanSessionSources(command, homeDir, worktrees, now, window) {
-    const codex = command.source !== "claude" && command.source !== "opencode"
+    const codex = command.source !== "claude" && command.source !== "opencode" && command.source !== "pi"
         ? await scanAndAttributeCodexSessions({
             sessionsDirs: defaultCodexSessionDirs(homeDir),
             worktrees,
@@ -93,7 +109,7 @@ async function scanSessionSources(command, homeDir, worktrees, now, window) {
             limit: window.limit,
         })
         : null;
-    const claude = command.source !== "codex" && command.source !== "opencode"
+    const claude = command.source !== "codex" && command.source !== "opencode" && command.source !== "pi"
         ? await scanAndAttributeClaudeSessions({
             projectsDir: path.join(homeDir, ".claude", "projects"),
             worktrees,
@@ -104,11 +120,12 @@ async function scanSessionSources(command, homeDir, worktrees, now, window) {
         : null;
     return { codex, claude };
 }
-function writeSessionJson(io, window, readFailures, codex, claude, codexRows, claudeRows, opencode) {
+function writeSessionJson(io, window, readFailures, codex, claude, codexRows, claudeRows, opencode, pi) {
     writeLine(io.stdout, JSON.stringify({
         window,
         read_failures: readFailures,
         ...(opencode ? { opencode } : {}),
+        ...(pi ? { pi } : {}),
         ...(codex ? { codex: { counts: codex.counts, sessions: codexRows } } : {}),
         ...(claude
             ? {

package/dist/commands/sources-check.js

@@ -28,6 +28,7 @@ import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-e
 import { fetchTranscriptObjects } from "../evidence-transcripts-client.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
 import { discoverLocalTranscripts } from "./sources-discovery.js";
+import { PI_CURSOR_FILENAME } from "../pi-inventory.js";
 import { OPENCODE_CURSOR_FILENAME } from "../opencode-inventory.js";
 import { fileFacts, judgeSource } from "./sources-verdict.js";
 const VERDICTS = ["stored_full", "stored_slim", "stored_partial", "not_stored"];
@@ -63,6 +64,7 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     const local = await discoverLocalTranscripts({ homeDir, olderThanMs, skipAll: optOutAll, skipClaude: optOutClaude, skipCodex: optOutCodex, skipOpenCode: !switches.opencode });
     try {
         const cursors = {
+            pi: await readRawEvidenceCursor(paths, { filename: PI_CURSOR_FILENAME, sessionsOnly: true }),
             opencode: await readRawEvidenceCursor(paths, { filename: OPENCODE_CURSOR_FILENAME, sessionsOnly: true }),
             codex: await readRawEvidenceCursor(paths),
             claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),
@@ -79,7 +81,7 @@ export async function runSourcesCheck(command, io, now = new Date()) {
             const inventory = await fetchSourceInventory({ dashboardUrl, deviceToken: session.device_token, fetchImpl: io.fetch });
             const { rows: _rows, ...inventoryCounts } = inventory;
             const counts = { missing_row: 0, missing_pointer: 0, stale_revision: 0, unavailable_evidence: 0, explicit_opt_out: 0, unverifiable: 0, revision_verified: 0 };
-            const optOutSources = optOutAll ? ["codex", "claude_code", "opencode"] : optOutClaude ? ["claude_code"] : [];
+            const optOutSources = optOutAll ? ["codex", "claude_code", "opencode", "pi"] : optOutClaude ? ["claude_code"] : [];
             counts.explicit_opt_out = optOutSources.length;
             for (const file of local.files) {
                 const finding = await reconcileSource({ file, inventory, remote,
@@ -93,7 +95,7 @@ export async function runSourcesCheck(command, io, now = new Date()) {
             }
             report.reconciliation = { counts, inventory: inventoryCounts,
                 scan: { started_at: new Date(startedAt).toISOString(), finished_at: new Date().toISOString(),
-                    roots: ["codex/sessions", "codex/archived_sessions", "claude/projects", "opencode/opencode.db"], older_than_days: command.olderThanDays, opt_out_sources: optOutSources },
+                    roots: ["codex/sessions", "codex/archived_sessions", "claude/projects", "opencode/opencode.db", "pi/agent/sessions"], older_than_days: command.olderThanDays, opt_out_sources: optOutSources },
                 limitations: ["Snapshot scan, not a live completeness guarantee; absent local sources cannot be discovered.", "Missing historical source identifiers remain unverifiable.", "Pointer metadata does not prove bucket bytes are readable; no storage bodies fetched.", "explicit_opt_out counts sources, not undiscovered files; opted-out stores are not scanned."],
             };
             if (inventory.status !== "exhausted" || report.local.unreadable > 0 || counts.unavailable_evidence > 0) {

package/dist/commands/sources-discovery.js

@@ -25,6 +25,8 @@ import { t3CodexProjectionSessionIds } from "../adapters/t3-projection-source.js
  */
 import fs from "node:fs/promises";
 import { getCollectorRuntimePaths } from "../local-state.js";
+import { piCollectionPolicy } from "../pi-policy.js";
+import { readPiInventory } from "../pi-inventory.js";
 import { openCodeCollectionPolicy } from "../opencode-policy.js";
 import { readOpenCodeInventory } from "../opencode-inventory.js";
 import path from "node:path";
@@ -163,6 +165,25 @@ export async function discoverLocalTranscripts(options) {
                 session_id: file.session.id, session_id_source: "content", key: transcriptFileKey({ source: "opencode", session_id: file.session.id, sidecar: null }) });
         }
     }
+    if (!options.skipAll) {
+        const policy = await piCollectionPolicy({ homeDir: options.homeDir });
+        const scratch = policy.enabled ? await fs.mkdtemp(path.join(os.tmpdir(), "tower-pi-reconcile-")) : null;
+        const previousCleanup = result.cleanup;
+        if (scratch)
+            result.cleanup = async () => { await previousCleanup?.(); await fs.rm(scratch, { recursive: true, force: true }); };
+        const inventory = policy.enabled ? await readPiInventory({ homeDir: options.homeDir, stateDir: getCollectorRuntimePaths(options.homeDir).state_dir, include: policy.include, readOnlyAccounting: true, exportDirectory: scratch }) : { files: [], failures: [] };
+        result.directory_read_failed += inventory.failures.length;
+        for (const file of inventory.files) {
+            if (file.pending_reasons.length)
+                result.file_read_failed++;
+            if (options.olderThanMs !== null && file.session.updated_at_ms >= options.olderThanMs) {
+                result.newer_count++;
+                continue;
+            }
+            result.files.push({ source: "pi", kind: "pi_main", source_locator: `pi:${file.session.id}`, file_path: file.local_path, byte_size: file.byte_size, mtime_ms: file.session.updated_at_ms,
+                session_id: file.session.id, session_id_source: "content", key: transcriptFileKey({ source: "pi", session_id: file.session.id, sidecar: null }) });
+        }
+    }
     await groupCodexRevisions(result, options.homeDir);
     result.files = result.files.filter(f => options.olderThanMs === null || f.mtime_ms < options.olderThanMs);
     if (result.directory_read_failed > 0 || result.file_read_failed > 0) {

package/dist/commands/sources-verdict.js

@@ -186,7 +186,7 @@ upload = {}) {
                 if (!buffer)
                     return null;
                 // Compare against what the uploader sends: in drop mode that is the slim form, not the disk bytes.
-                const uploadText = file.source === "opencode" ? buffer.toString("utf8") : uploadFormOfTranscript(buffer.toString("utf8"), file.source, mode, describedKeys);
+                const uploadText = (file.source === "opencode" || file.source === "pi") ? buffer.toString("utf8") : uploadFormOfTranscript(buffer.toString("utf8"), file.source, mode, describedKeys);
                 return redactForUpload(uploadText, buffer);
             });
             return sanitized;

package/dist/local-state-status.js

@@ -35,6 +35,21 @@ export async function inspectLocalCollectorStatus(options = {}) {
         if (error.code !== "ENOENT")
             status.details.push("OpenCode coverage unavailable: opencode_status_unreadable.");
     }
+    try {
+        const native = JSON.parse(await readFile(path.join(reading.paths.state_dir, "pi-collection-status.json"), "utf8"));
+        if (native.source === "pi" && ["complete", "partial", "absent", "withheld"].includes(native.coverage)
+            && [native.discovered, native.eligible, native.delivered, native.pending, native.withheld, native.unique].every(value => typeof value === "number" && Number.isFinite(value) && value >= 0)) {
+            const at = typeof native.observed_at === "string" && Number.isFinite(Date.parse(native.observed_at)) ? new Date(native.observed_at).toISOString() : "unknown";
+            const reasons = Array.isArray(native.reasons) ? native.reasons.filter((reason) => typeof reason === "string" && /^[a-z0-9_:-]{1,100}$/.test(reason)).join(", ") : "";
+            status.details.push(`Pi: ${native.coverage}; discovered ${native.discovered}, eligible ${native.eligible}, delivered ${native.delivered}, pending ${native.pending}, withheld ${native.withheld}, unique ${native.unique}; as of ${at}${reasons ? ` (${reasons})` : ""}.`);
+        }
+        else
+            status.details.push("Pi coverage unavailable: pi_status_invalid.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            status.details.push("Pi coverage unavailable: pi_status_unreadable.");
+    }
     return status;
 }
 function collectorStatusFromReading(reading, now) {

package/dist/pi-inventory.js

@@ -0,0 +1,238 @@
+/** Pi's shared inventory keeps native records and fragments inside the existing redacted staging path. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { accountPiUsage, piObject, newSessionFactsAccumulator, observeSessionFactsRecord, observeSessionFactsFile, finalizeSessionFacts } from '@bli-cockpit/telemetry-core';
+import { listPiSessions, piSessionRoots, readPiSession, PiReadError } from './adapters/pi-session-reader.js';
+import { piSessionHeader } from './adapters/pi-session-facts.js';
+import { sanitizeTextEvidenceForUpload } from './adapters/raw-evidence-sanitize.js';
+import { openStagingAllowance, roomToStageUpTo, admitToStaging } from './staging-gate.js';
+export const PI_CURSOR_FILENAME = 'pi-raw-evidence.json';
+/** All consumers share roots and bounded keyset discovery; policy is applied before full body reads. */
+export async function readPiInventory(options) {
+    const result = { discovered: 0, sessions: [], eligible: 0, withheld: 0, files: [], shelved: [], failures: [], absent: true };
+    const sessions = new Map();
+    for (const root of options.sessionRoots ?? piSessionRoots(options.homeDir, { agentDir: process.env.PI_CODING_AGENT_DIR, sessionDir: process.env.PI_CODING_AGENT_SESSION_DIR })) {
+        let after = '';
+        try {
+            while (true) {
+                const page = await listPiSessions(root, after, 100);
+                if (page.state !== 'missing')
+                    result.absent = false;
+                for (const file of page.files) {
+                    try {
+                        const stamp = await fs.stat(file.filePath);
+                        if (options.sinceMs !== undefined && stamp.mtimeMs < options.sinceMs)
+                            continue;
+                        let header = null;
+                        for await (const event of readPiSession(file.filePath)) {
+                            if (event.kind === 'record') {
+                                header = piSessionHeader(event.value);
+                                break;
+                            }
+                        }
+                        const id = header?.id && /^[A-Za-z0-9._-]{1,80}$/.test(header.id) ? header.id : `pi-file-${crypto.createHash('sha256').update(file.filePath).digest('hex').slice(0, 32)}`;
+                        const existing = sessions.get(id);
+                        if (existing) {
+                            if (!existing.filePaths.includes(file.filePath))
+                                existing.filePaths.push(file.filePath);
+                            existing.directories[file.filePath] = header?.cwd ?? "";
+                            existing.updated_at_ms = Math.max(existing.updated_at_ms, stamp.mtimeMs);
+                        }
+                        else
+                            sessions.set(id, { id, directory: header?.cwd ?? '', parentSession: header?.parentSession ?? null, created_at_ms: stamp.birthtimeMs, updated_at_ms: stamp.mtimeMs, filePaths: [file.filePath], directories: { [file.filePath]: header?.cwd ?? "" } });
+                    }
+                    catch (error) {
+                        result.failures.push({ session_id: null, reason: reason(error) });
+                    }
+                }
+                if (page.state !== 'more')
+                    break;
+                after = page.next;
+            }
+        }
+        catch (error) {
+            result.failures.push({ session_id: null, reason: reason(error) });
+        }
+    }
+    result.sessions = [...sessions.values()];
+    result.discovered = sessions.size;
+    for (const session of result.sessions.sort((a, b) => Number(options.deliveredSessionIds?.has(a.id) ?? false) - Number(options.deliveredSessionIds?.has(b.id) ?? false) || a.created_at_ms - b.created_at_ms || a.id.localeCompare(b.id))) {
+        const eligiblePaths = session.filePaths.filter(filePath => !options.include || options.include({ ...session, directory: session.directories[filePath] ?? session.directory }));
+        const included = eligiblePaths.length > 0;
+        if (included)
+            result.eligible++;
+        else
+            result.withheld++;
+        if (options.metadataOnly || (!included && !options.countOnly?.(session)))
+            continue;
+        try {
+            (included ? result.files : result.shelved).push(await exportPiSession({ ...session, directory: session.directories[(eligiblePaths[0] ?? session.filePaths[0])] ?? session.directory, filePaths: included ? eligiblePaths : session.filePaths }, options, included));
+        }
+        catch (error) {
+            result.failures.push({ session_id: session.id, reason: reason(error) });
+        }
+    }
+    console.error('[pi inventory] observed native source', JSON.stringify({ discovered: result.discovered, returned: result.sessions.length, unique: sessions.size, exported: result.files.length, failed: result.failures.length, absent: result.absent }));
+    return result;
+}
+async function exportPiSession(session, options, retain) {
+    const directory = options.exportDirectory ?? path.join(options.stateDir, 'pi-transcripts');
+    if (retain) {
+        // Recompute the current policy-selected, redacted stream before trusting a retained derivative.
+        // This pass writes nothing and never buffers the aggregate session.
+        const current = await exportPiSession(session, options, false);
+        const candidate = path.join(directory, `${session.id}-${current.revision}.jsonl`);
+        if (await verifyRetainedExport(candidate, current.revision, current.byte_size)) {
+            console.error('[pi inventory] retained export reused', JSON.stringify({ reason: 'pi_retained_export_verified', bytes: current.byte_size }));
+            return { ...current, local_path: candidate };
+        }
+    }
+    if (retain)
+        await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const temporary = path.join(directory, `.export-${crypto.randomUUID()}`), output = retain ? await fs.open(temporary, 'wx', 0o600) : null;
+    const allowance = retain ? await openStagingAllowance(options.stateDir, process.env) : undefined;
+    const hash = crypto.createHash('sha256'), acc = newSessionFactsAccumulator('pi'), ledger = new Map();
+    const pending = new Set(session.id.startsWith('pi-file-') ? ['pi_session_header_identity_unavailable'] : []), seenRevisions = new Set();
+    let bytes = 0, lines = 0, secretMatches = 0;
+    const rules = new Map();
+    const write = async (text) => {
+        const masked = sanitizeTextEvidenceForUpload({ text, redactedFields: ['pi_native_record'] });
+        if (masked.status === 'redacted') {
+            if (masked.completenessLabel === 'redaction_crashed_stubbed')
+                throw new PiReadError('pi_redaction_failed');
+            secretMatches += masked.redaction.secret_like_match_count;
+            for (const rule of masked.redaction.rule_counts) {
+                const prior = rules.get(rule.rule_id) ?? { rule_id: rule.rule_id, match_count: 0, redacted_char_count: 0 };
+                prior.match_count += rule.match_count;
+                prior.redacted_char_count += rule.redacted_char_count;
+                rules.set(rule.rule_id, prior);
+            }
+        }
+        hash.update(masked.bytes);
+        bytes += masked.bytes.length;
+        lines++;
+        try {
+            observeSessionFactsRecord(acc, JSON.parse(masked.bytes.toString('utf8')));
+        }
+        catch {
+            pending.add('pi_normalization_pending');
+        }
+        if (output) {
+            const deferred = roomToStageUpTo(allowance, bytes);
+            if (deferred)
+                throw new PiReadError(`pi_staging_deferred_${deferred}`);
+            await output.write(masked.bytes);
+        }
+    };
+    try {
+        for (const filePath of [...session.filePaths].sort()) {
+            // Same-ID divergent files remain separate native segments; no text/title deduplication occurs.
+            // Deduplicate only byte-identical copies under the same exact native session ID.
+            let observed = null;
+            for await (const event of readPiSession(filePath))
+                if (event.kind === 'revision')
+                    observed = event;
+            if (observed?.stable && seenRevisions.has(observed.revision))
+                continue;
+            for await (const event of readPiSession(filePath)) {
+                if (event.kind === 'revision') {
+                    if (!event.stable)
+                        pending.add('pi_source_changed_during_read');
+                    seenRevisions.add(event.revision);
+                    continue;
+                }
+                if (event.kind === 'partial' || !event.valid) {
+                    pending.add(event.kind === 'partial' ? 'pi_partial_native_record' : 'pi_malformed_native_record');
+                    let text, encoding;
+                    try {
+                        text = new TextDecoder('utf-8', { fatal: true }).decode(event.raw);
+                        encoding = 'utf8';
+                    }
+                    catch {
+                        text = event.raw.toString('latin1');
+                        encoding = 'latin1';
+                    }
+                    await write(JSON.stringify({ type: 'pi_raw_fragment', encoding, offset: event.offset, text }) + '\n');
+                    continue;
+                }
+                await write(event.raw.toString('utf8'));
+                const record = piObject(event.value), message = piObject(record.message);
+                if (!['session', 'message', 'model_change', 'thinking_level_change', 'compaction', 'branch_summary', 'custom', 'custom_message', 'label', 'session_info'].includes(String(record.type)))
+                    pending.add('pi_unknown_native_record');
+                if (record.type !== 'session' && typeof record.id !== 'string')
+                    pending.add('pi_native_entry_identity_missing');
+                if (record.type === 'session' && record.version !== 3)
+                    pending.add('pi_format_version_unverified');
+                if (record.type === 'message' && message.role === 'assistant') {
+                    const decision = accountPiUsage(session.id, record, ledger);
+                    const identity = decision.identity ? crypto.createHash('sha256').update(decision.identity).digest('hex') : null;
+                    await write(JSON.stringify({ type: 'pi_usage', status: decision.status === 'known' ? 'known' : decision.status === 'copied' ? 'copied' : 'unknown', identity, model: decision.model, usage: decision.usage, reason: decision.reason }) + '\n');
+                }
+                if (record.type === 'compaction' || record.type === 'branch_summary' || (message.role !== 'assistant' && message.usage != null))
+                    await write(JSON.stringify({ type: 'pi_usage', status: 'unknown', reason: 'pi_auxiliary_usage_identity_unverified' }) + '\n');
+            }
+        }
+        await write(JSON.stringify({ type: 'pi_capture', native_id: session.id, native_revisions: [...seenRevisions], pending_reasons: [...pending], accounting_scope: 'pending_operator_evidence_ack' }) + '\n');
+        await output?.close();
+        const revision = hash.digest('hex'), localPath = retain ? path.join(directory, `${session.id}-${revision}.jsonl`) : '';
+        if (retain) {
+            const deferred = admitToStaging(allowance, bytes, { kind: 'pi_jsonl' });
+            if (deferred)
+                throw new PiReadError(`pi_staging_deferred_${deferred}`);
+            await fs.rename(temporary, localPath);
+        }
+        observeSessionFactsFile(acc, { bytes, lines });
+        const facts = finalizeSessionFacts(acc);
+        return { session, local_path: localPath, byte_size: bytes, revision, facts, pending_reasons: [...pending], ...(secretMatches ? { redaction: { schema_version: 'raw-evidence-redaction.v1', status: 'sanitized', mode: 'deterministic_text_replacement', applied_by: ['local_collector'], rule_counts: [...rules.values()], secret_like_match_count: secretMatches, redacted_fields: ['pi_native_record'], redacted_ranges: [], sanitized_content_hash_sha256: revision, sanitized_byte_size: bytes } } : {}) };
+    }
+    catch (error) {
+        await output?.close().catch(() => undefined);
+        if (retain)
+            await fs.unlink(temporary).catch(() => undefined);
+        throw error;
+    }
+}
+function reason(error) { return error instanceof PiReadError ? error.reason : 'pi_inventory_failed'; }
+/** Pi's server claims, not a machine-local ledger, establish acknowledged ownership. */
+export async function acknowledgePiUsage(_stateDir, sessions) { console.error('[pi accounting] metadata acknowledgment received', JSON.stringify({ sessions: sessions.size, reason: 'operator_claims_resolved_by_shared_backend' })); }
+/** A filename is only a candidate: reject links, truncation, corruption and changes during verification. */
+async function verifyRetainedExport(filePath, revision, expectedBytes) {
+    let initial;
+    try {
+        initial = await fs.lstat(filePath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw new PiReadError('pi_retained_export_unreadable');
+    }
+    if (!initial.isFile() || initial.isSymbolicLink() || initial.size !== expectedBytes)
+        throw new PiReadError('pi_retained_export_invalid');
+    const input = await fs.open(filePath, 'r').catch(() => { throw new PiReadError('pi_retained_export_unreadable'); });
+    try {
+        const before = await input.stat();
+        if (before.dev !== initial.dev || before.ino !== initial.ino || before.size !== expectedBytes)
+            throw new PiReadError('pi_retained_export_changed');
+        const hash = crypto.createHash('sha256');
+        let bytes = 0;
+        for await (const chunk of input.createReadStream({ autoClose: false })) {
+            hash.update(chunk);
+            bytes += chunk.length;
+        }
+        const after = await input.stat(), named = await fs.lstat(filePath);
+        if (named.isSymbolicLink() || named.dev !== before.dev || named.ino !== before.ino || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)
+            throw new PiReadError('pi_retained_export_changed');
+        if (bytes !== expectedBytes || hash.digest('hex') !== revision)
+            throw new PiReadError('pi_retained_export_invalid');
+        return true;
+    }
+    catch (error) {
+        if (error instanceof PiReadError)
+            throw error;
+        throw new PiReadError('pi_retained_export_unreadable');
+    }
+    finally {
+        await input.close();
+    }
+}

package/dist/pi-policy.js

@@ -0,0 +1,29 @@
+/** Apply existing collection choices to native directory metadata before exporting Pi evidence. */
+import { getCollectorRuntimePaths, readLocalCollectorConfig } from "./local-state.js";
+import { readSourceSwitches } from "./source-opt-out.js";
+import { settleCollectionScope, sessionInsideRoots } from "./collection-scope.js";
+import { decideShelfMode, sessionShelf } from "./commands/session-sync-shelf.js";
+import { scoreSignalsAgainstWorktrees } from "./adapters/attribution-core.js";
+export async function piCollectionPolicy(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    const config = await readLocalCollectorConfig(paths).catch((error) => { if (error.code === "ENOENT")
+        return null; throw error; });
+    const switches = await readSourceSwitches(config, paths, "pi_inventory", { fetch: options.fetchImpl, dashboardUrl: options.dashboardUrl });
+    const shelf = await decideShelfMode({ homeDir: options.homeDir, dashboardUrl: options.dashboardUrl ?? null, fetchImpl: options.fetchImpl ?? globalThis.fetch });
+    const scope = await settleCollectionScope(paths.state_dir, config?.collection_scope);
+    const roots = options.collectionRoots ?? config?.default_repo_paths ?? [];
+    const enabled = switches.pi && !switches.held && shelf.mode !== "hold";
+    const reason = switches.held || shelf.mode === "hold" ? "owner_check_unavailable" : !switches.pi ? "raw_evidence_upload_disabled" : "pi_existing_collection_policy";
+    const drawer = (session) => {
+        const attribution = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees ?? [], { collectionRoots: roots });
+        return shelf.mode === "founder" && sessionShelf({ ...attribution, local_cwd: session.directory, session_facts: null }, shelf.rules).shelf === "drawer";
+    };
+    return { enabled, reason, drawer, include: (session) => {
+            if (!enabled)
+                return false;
+            const attribution = scoreSignalsAgainstWorktrees({ cwds: [session.directory], workspaceRoots: [], originUrls: [], branches: [], headShas: [] }, options.worktrees ?? [], { collectionRoots: roots });
+            if (scope.scope === "roots_only" && !sessionInsideRoots({ ...attribution, local_cwd: session.directory }, roots))
+                return false;
+            return !drawer(session);
+        } };
+}

package/dist/source-opt-out.js

@@ -46,7 +46,7 @@ export function resolveSourceSwitches(config, standing) {
     const labels = configOptOutLabels(config);
     const verdict = labels.length > 0 ? optOutVerdict(standing) : null;
     if (verdict && !verdict.obeyed) {
-        return { opencode: true, codex: true, claude: true, codexReason: null, claudeReason: null, ignored: labels, verdict: verdict.reason, held: false };
+        return { opencode: true, pi: true, codex: true, claude: true, codexReason: null, claudeReason: null, ignored: labels, verdict: verdict.reason, held: false };
     }
     const all = config?.raw_evidence_upload === "disabled";
     const codexReason = config?.collect_codex_jsonl === false
@@ -57,6 +57,7 @@ export function resolveSourceSwitches(config, standing) {
         : all ? ALL_SOURCES_OPT_OUT_REASON : null;
     return {
         opencode: !all,
+        pi: !all,
         codex: codexReason === null,
         claude: claudeReason === null,
         codexReason,

package/dist/spool/local-spool-parse.js

@@ -100,7 +100,7 @@ export function parseMetadataOnlySessionReportRows(value, fieldPath) {
     return sessions;
 }
 function parseRetrySource(value, fieldPath) {
-    if (value === "codex" || value === "claude_code" || value === "opencode")
+    if (value === "codex" || value === "claude_code" || value === "opencode" || value === "pi")
         return value;
     return invalidUploadSpoolState(fieldPath, '"codex" or "claude_code"');
 }

package/dist/state-dir-audit.js

@@ -37,6 +37,7 @@ export const STUDIES_DIR_SUFFIX = "-studies";
  * collector name; none does today, and the test pins that.
  */
 export const STATE_DIR_RULES = [
+    { name: "pi-", match: "prefix", class: "state", bound: "native Pi derivatives and coverage, governed by the existing staging allowance" },
     { name: "opencode-transcripts", match: "exact", class: "state", bound: "redacted native reader derivatives; existing staging allowance and state ceiling govern every write; current derivatives removed after durable evidence and metadata acknowledgments" },
     { name: "opencode-", match: "prefix", class: "state", bound: "native identity cursors and metadata-only coverage receipt; overwritten by collection" },
     { name: "raw-evidence", match: "exact", class: "staging", bound: "staged copies go the tick the server commits them; 256 MiB cap; the staging gate stops new copies at the cap, on a low disk or over the 512 MiB ceiling; uncommitted evidence is never deleted, only counted" },

package/dist/sync-health-class.js

@@ -69,6 +69,7 @@ export const SYNC_FAILURE_LABELS = [
     "codex_scan_read_failed",
     "claude_scan_read_failed",
     "opencode_scan_read_failed",
+    "pi_scan_read_failed",
     /** Sessions were observed and their metadata report did not reach the door. */
     "session_report_unposted",
     /** The gate is real and this file forgot to say why — a bug, made visible. */
@@ -106,6 +107,7 @@ export const SYNC_FAILURE_LABEL_CLASSES = {
     codex_scan_read_failed: "sync_failed",
     claude_scan_read_failed: "sync_failed",
     opencode_scan_read_failed: "sync_failed",
+    pi_scan_read_failed: "sync_failed",
     session_report_unposted: "sync_failed",
     sync_failed_reason_not_recorded: "sync_failed",
 };

package/dist/upload-evidence-delivery-summary.js

@@ -9,8 +9,8 @@ import { DELIVERY_BACKOFF_HOLDING_REASON, summarizeStuckEvidence, terminalDelive
  */
 export function retrySourcesForFailedSync(options, facts) {
     const sources = new Set();
-    if (options.nativeSessionFiles?.length)
-        sources.add("opencode");
+    for (const file of options.nativeSessionFiles ?? [])
+        sources.add(file.source);
     if ((options.codexSessionFiles?.length ?? 0) > 0 ||
         (options.codexAttributionScan?.directory_read_failed_count ?? 0) > 0 ||
         (options.codexAttributionScan?.stat_failed_count ?? 0) > 0 ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.294",
+  "version": "0.2.295",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.92",
-    "@bli-cockpit/mcp": "0.1.179",
-    "@bli-cockpit/telemetry-core": "0.1.98",
+    "@bli-cockpit/memory-mcp": "0.1.93",
+    "@bli-cockpit/mcp": "0.1.180",
+    "@bli-cockpit/telemetry-core": "0.1.99",
     "unpdf": "1.8.1"
   },
   "repository": {