@bli-cockpit/cli 0.2.48 → 0.2.49

package/dist/adapters/raw-evidence.js

@@ -6,12 +6,12 @@ import path from "node:path";
 import { makeSourceAdapterIdentity, } from "./common.js";
 import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
 import { defaultCodexSessionDirs, } from "./codex-attribution.js";
-import { isLiveRawEvidenceSyncAttribution } from "../raw-evidence-attribution-policy.js";
+import { recordClaudeAttributionCompleteness, recordCodexAttributionCompleteness, } from "./raw-evidence-attribution-gaps.js";
 import { describeError } from "../health-detail.js";
 import { contentKeyedRawEvidencePackId, DELIVERY_BACKOFF_BYPASS_REASON, DELIVERY_BACKOFF_HOLDING_REASON, deliveryBackoffApplies, evidenceSourceKey, heldSourceKeys, readRawEvidenceStagingState, recordStagedObject, resolveStagedObject, } from "../raw-evidence-staging.js";
 import { isSecretLikePath, safeKeySegment, sha256, shortHash, } from "./raw-evidence-keys.js";
-import { sanitizeTextEvidenceForUpload } from "./raw-evidence-sanitize.js";
-import { countEvidenceEntries, makeEvidenceCompleteness, markBudgetCapApplied, markCapApplied, recordScanned, recordSkipCount, recordTruncationCount, } from "./raw-evidence-completeness.js";
+import { sanitizeTextEvidenceForUpload, } from "./raw-evidence-sanitize.js";
+import { countEvidenceEntries, makeEvidenceCompleteness, markBudgetCapApplied, markCapApplied, recordScanned, } from "./raw-evidence-completeness.js";
 import { evidenceEntry, pointerFromEntry, RAW_EVIDENCE_BUCKET, } from "./raw-evidence-manifest.js";
 import { chmodPrivate, ensurePrivateDir, persistStagingState, promoteStagedPack, stageManifest, } from "./raw-evidence-pack-store.js";
 import { GIT_DIFF_TIMEOUT_MS, MAX_GIT_DIFF_BYTES, REPO_ROOT_MISSING_REASON, RepoRootMissingError, repoRootExists, runGitDiff, } from "./raw-evidence-git-diff.js";
@@ -30,59 +30,68 @@ const CLAUDE_MAX_COLLECT_FILE_BYTES = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES;
 // ---------------------------------------------------------------------------
 // The pass
 // ---------------------------------------------------------------------------
+/**
+ * Decide which bytes on this laptop are allowed to become durable evidence for
+ * one repo, and put exactly those into one private, content-keyed pack.
+ *
+ * Never throws: a crash mid-pass still returns facts and a `failed` scan, so a
+ * broken sync is reported rather than silently absent.
+ */
 export async function collectRawEvidencePack(context, options) {
-    const startedAt = context.now.toISOString();
     const rawEvidenceRoot = path.join(options.stateDir, "raw-evidence");
-    // Staging first, promotion second (BLI-3066). The pack id cannot be known
-    // until the content is, so bytes land in a private staging directory and the
-    // directory is then renamed to its content-keyed name — or dropped, when an
-    // identical pack is already there.
-    const stagingDir = path.join(rawEvidenceRoot, `.staging-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
+    const stagingDir = newStagingDir(rawEvidenceRoot);
     const sinceMinutes = options.sinceMinutes ?? DEFAULT_SINCE_MINUTES;
     const collection = await openCollection(context, options, {
         rawEvidenceRoot,
         stagingDir,
     });
     const scanWindow = {
-        startedAt,
+        startedAt: context.now.toISOString(),
         finishedAt: () => context.now.toISOString(),
         sinceMinutes,
     };
+    const run = { stagingDir, window: scanWindow };
     try {
         await ensurePrivateDir(stagingDir);
         await ensurePrivateDir(collection.filesDir);
         recordAttributionCompleteness(collection, options);
-        if (options.includeCodexJsonl !== false) {
-            await collectCodexJsonlFiles(collection, {
-                codexSessionFiles: options.codexSessionFiles,
-                sessionsDir: options.sessionsDir,
-                sessionsDirs: options.sessionsDirs,
-                sinceMinutes,
-                limit: options.sessionLimit ?? DEFAULT_SESSION_LIMIT,
-            });
-        }
-        if (options.includeClaudeJsonl !== false && options.claudeSessionFiles) {
-            await collectClaudeJsonlFiles(collection, options.claudeSessionFiles);
-        }
-        await collectGitDiffFiles(collection, options.repoRoot);
-        if (collection.entries.length === 0) {
-            return await finishWithEmptyPack(collection, options, {
-                stagingDir,
-                window: scanWindow,
-            });
-        }
-        return await finishWithPromotedPack(collection, options, {
-            stagingDir,
-            window: scanWindow,
-        });
+        await collectEverySource(collection, options, sinceMinutes);
+        return collection.entries.length === 0
+            ? await finishWithEmptyPack(collection, options, run)
+            : await finishWithPromotedPack(collection, options, run);
     }
     catch (error) {
-        return await finishWithFailedPack(collection, {
-            stagingDir,
-            window: scanWindow,
-            error,
+        return await finishWithFailedPack(collection, { ...run, error });
+    }
+}
+/**
+ * Staging first, promotion second (BLI-3066). The pack id cannot be known until
+ * the content is, so bytes land in a private per-attempt directory, and that
+ * directory is then renamed to its content-keyed name — or dropped, when an
+ * identical pack is already there.
+ */
+function newStagingDir(rawEvidenceRoot) {
+    return path.join(rawEvidenceRoot, `.staging-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
+}
+/**
+ * Every kind of evidence this repo can offer, in the order it is read. Codex and
+ * Claude transcripts are each switchable off by the caller; the git diffs are
+ * not, because they are half the evidence of what someone actually changed.
+ */
+async function collectEverySource(collection, options, sinceMinutes) {
+    if (options.includeCodexJsonl !== false) {
+        await collectCodexJsonlFiles(collection, {
+            codexSessionFiles: options.codexSessionFiles,
+            sessionsDir: options.sessionsDir,
+            sessionsDirs: options.sessionsDirs,
+            sinceMinutes,
+            limit: options.sessionLimit ?? DEFAULT_SESSION_LIMIT,
         });
     }
+    if (options.includeClaudeJsonl !== false && options.claudeSessionFiles) {
+        await collectClaudeJsonlFiles(collection, options.claudeSessionFiles);
+    }
+    await collectGitDiffFiles(collection, options.repoRoot);
 }
 async function openCollection(context, options, places) {
     const byteBudget = options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET;
@@ -225,20 +234,64 @@ async function finishWithPromotedPack(collection, options, run) {
         workContextId: context.workContextId,
         entries,
     });
-    const evidenceDir = promotion.evidenceDir;
-    rebaseStagedEntriesOntoPack(collection, evidenceDir);
-    const manifestPath = path.join(evidenceDir, "manifest.json");
+    rebaseStagedEntriesOntoPack(collection, promotion.evidenceDir);
+    const manifestPath = await addManifestToPack(collection, promotion, packId);
+    await persistStagingState(options.stateDir, collection.staging, context.now.toISOString());
+    logPackStaged(collection, promotion, packId);
+    const facts = makePromotedPackFacts(collection, {
+        packId,
+        manifestPath,
+        promotion,
+        window: run.window,
+    });
+    return {
+        facts,
+        scan: makeRawEvidenceScan({
+            context,
+            startedAt: run.window.startedAt,
+            // A pack of nothing but its own manifest carries no evidence, so it
+            // reports partial however cleanly it was written.
+            status: entries.length > 1 ? "ok" : "partial",
+            facts,
+        }),
+    };
+}
+/** A pack with files: the same shell as an empty one, plus what is in it. */
+function makePromotedPackFacts(collection, place) {
+    const entries = collection.entries;
+    return {
+        ...packFactsShell(collection, {
+            packId: place.packId,
+            manifestPath: place.manifestPath,
+            evidenceDir: place.promotion.evidenceDir,
+            window: place.window,
+        }),
+        stage_state: place.promotion.state,
+        file_count: entries.length,
+        byte_size: totalByteSize(entries),
+        content_kinds: [...new Set(entries.map((entry) => entry.kind))],
+        pointers: entries.map(pointerFromEntry),
+        upload_files: entries.map(uploadFileFromEntry),
+    };
+}
+/**
+ * Write the manifest and make it an object of the pack like any other file, so
+ * the uploader has one list to walk. Returns where it landed.
+ */
+async function addManifestToPack(collection, promotion, packId) {
+    const context = collection.context;
+    const manifestPath = path.join(promotion.evidenceDir, "manifest.json");
     const manifestBytes = await stageManifest({
         context,
         packId,
         manifestPath,
-        entries,
+        entries: collection.entries,
         skipped: collection.skipped,
         redacted: collection.redacted,
         reused: collection.reused,
         reusePack: promotion.state === "reused",
     });
-    entries.push(evidenceEntry({
+    collection.entries.push(evidenceEntry({
         context,
         kind: "manifest",
         packId,
@@ -261,42 +314,22 @@ async function finishWithPromotedPack(collection, options, run) {
         // now a nice-to-have rather than the only thing between us and a loop.
         contentAddress: `manifest/${sha256(manifestBytes).slice(0, 16)}.json`,
     }));
-    await persistStagingState(options.stateDir, collection.staging, context.now.toISOString());
+    return manifestPath;
+}
+/** The success line. A sync that staged nothing new still has to say so. */
+function logPackStaged(collection, promotion, packId) {
     console.error("[raw-evidence] pack staged", JSON.stringify({
         pack_id: packId,
         stage_state: promotion.state,
         reason: stageReasonLabel(promotion.state, promotion.priorPackCount),
         prior_pack_count: promotion.priorPackCount,
         refilled_file_count: promotion.refilledFileCount,
-        file_count: entries.length,
-        byte_size: totalByteSize(entries),
+        file_count: collection.entries.length,
+        byte_size: totalByteSize(collection.entries),
         staged_new: collection.stagedNewCount,
         staged_reused: collection.stagedReusedCount,
         delivery_held: collection.deliveryHeldCount,
     }));
-    const facts = {
-        ...packFactsShell(collection, {
-            packId,
-            manifestPath,
-            evidenceDir,
-            window: run.window,
-        }),
-        stage_state: promotion.state,
-        file_count: entries.length,
-        byte_size: totalByteSize(entries),
-        content_kinds: [...new Set(entries.map((entry) => entry.kind))],
-        pointers: entries.map(pointerFromEntry),
-        upload_files: entries.map(uploadFileFromEntry),
-    };
-    return {
-        facts,
-        scan: makeRawEvidenceScan({
-            context,
-            startedAt: run.window.startedAt,
-            status: entries.length > 1 ? "ok" : "partial",
-            facts,
-        }),
-    };
 }
 /**
  * A crashed pass. The staged-object index is deliberately NOT written: this
@@ -484,108 +517,23 @@ function recordAttributionCompleteness(collection, options) {
         recordClaudeAttributionCompleteness(collection, options.claudeAttributionScan, new Set(options.claudeSessionFiles?.map((file) => file.local_path) ?? []));
     }
 }
-function recordCodexAttributionCompleteness(collection, scan, selectedPaths) {
-    recordScanned(collection, "codex_attribution", scan.scanned_file_count);
-    collection.caps.push({
-        source: "codex_attribution",
-        cap_type: "scan_window_minutes",
-        limit: scan.since_minutes,
-        observed: scan.since_minutes,
-        applied: false,
-    }, {
-        source: "codex_attribution",
-        cap_type: "session_limit",
-        limit: scan.session_limit,
-        observed: scan.discovered_file_count,
-        applied: scan.session_limit_applied,
-    });
-    recordSkipCount(collection, "codex_attribution", "session_limit_overflow", Math.max(0, scan.discovered_file_count - scan.scanned_file_count));
-    recordSkipCount(collection, "codex_attribution", "directory_read_failed", scan.directory_read_failed_count);
-    recordSkipCount(collection, "codex_attribution", "file_stat_failed", scan.stat_failed_count);
-    recordSkipCount(collection, "codex_attribution", "secret_like_directory", scan.secret_path_skipped_count);
-    recordAttributionResultSkips(collection, "codex_attribution", scan.results, selectedPaths);
-}
-function recordClaudeAttributionCompleteness(collection, scan, selectedPaths) {
-    recordScanned(collection, "claude_attribution", scan.scanned_session_count);
-    if (scan.disabled_reason) {
-        recordSkipCount(collection, "claude_attribution", scan.disabled_reason, 1);
-    }
-    collection.caps.push({
-        source: "claude_attribution",
-        cap_type: "scan_window_minutes",
-        limit: scan.since_minutes,
-        observed: scan.since_minutes,
-        applied: false,
-    }, {
-        source: "claude_attribution",
-        cap_type: "session_limit",
-        limit: scan.session_limit,
-        observed: scan.discovered_session_count,
-        applied: scan.session_limit_applied,
-    }, {
-        source: "claude_attribution",
-        cap_type: "max_file_bytes",
-        limit: scan.max_file_bytes,
-        applied: scan.counts.mains_oversized > 0 ||
-            scan.results.some((result) => result.reason === "file_too_large"),
-    }, {
-        source: "claude_attribution",
-        cap_type: "max_sidecar_files",
-        limit: scan.max_sidecar_files,
-        observed: scan.max_sidecar_files + scan.counts.sidecars_capped,
-        applied: scan.counts.sidecars_capped > 0,
-    }, {
-        source: "claude_attribution",
-        cap_type: "max_line_buffer_bytes",
-        limit: scan.max_line_buffer_bytes,
-        applied: scan.counts.oversized_lines_skipped > 0,
-    });
-    recordSkipCount(collection, "claude_attribution", "session_limit_overflow", Math.max(0, scan.discovered_session_count - scan.scanned_session_count));
-    recordSkipCount(collection, "claude_attribution", "secret_like_project_dir", scan.project_dirs_skipped);
-    recordSkipCount(collection, "claude_attribution", "project_dir_read_failed", scan.project_dir_read_failed_count);
-    recordSkipCount(collection, "claude_attribution", "session_stat_failed", scan.session_stat_failed_count);
-    recordSkipCount(collection, "claude_attribution", "sidecar_dir_read_failed", scan.sidecar_dir_read_failed_count);
-    recordSkipCount(collection, "claude_attribution", "sidecar_stat_failed", scan.sidecar_stat_failed_count);
-    recordSkipCount(collection, "claude_attribution", "sidecar_limit_overflow", scan.counts.sidecars_capped);
-    recordTruncationCount(collection, "claude_attribution", "oversized_jsonl_line", scan.counts.oversized_lines_skipped, { max_bytes: scan.max_line_buffer_bytes });
-    recordAttributionResultSkips(collection, "claude_attribution", scan.results, selectedPaths);
-    for (const result of scan.results) {
-        for (const sidecar of result.sidecar_files) {
-            if (!sidecar.skipped_reason)
-                continue;
-            recordSkipCount(collection, "claude_attribution", `sidecar_${sidecar.skipped_reason}`, 1);
-        }
-    }
-}
-function recordAttributionResultSkips(collection, source, results, selectedPaths) {
-    for (const result of results) {
-        if (isAttributionAccountedFor(result, selectedPaths))
-            continue;
-        const reason = result.state === "skipped"
-            ? result.reason
-            : `attribution_${result.state}:${result.reason}`;
-        recordSkipCount(collection, source, reason, 1);
-    }
-}
-/**
- * Not every unattributed result is a gap. A selected session is being collected
- * by this pass, and a live-sync-safe synthetic target is owned by another
- * workspace's pack — neither is missing evidence.
- */
-function isAttributionAccountedFor(result, selectedPaths) {
-    if (result.state === "attributed")
-        return true;
-    if (selectedPaths.has(result.file_path))
-        return true;
-    return (result.worktree !== null &&
-        isLiveRawEvidenceSyncAttribution(result.state, result.reason, true));
-}
 // ---------------------------------------------------------------------------
 // Codex transcripts
 // ---------------------------------------------------------------------------
 async function collectCodexJsonlFiles(collection, options) {
+    for (const candidate of await chooseCodexCandidates(collection, options)) {
+        recordScanned(collection, "codex_jsonl");
+        await collectOneCodexSession(collection, candidate);
+    }
+}
+/**
+ * Which Codex transcripts this pass will look at, and the record of how many it
+ * had to leave out. Attribution's own list is never trimmed — the session limit
+ * only guards the fallback walk, which can turn up every session on the machine.
+ */
+async function chooseCodexCandidates(collection, options) {
     const attributed = Boolean(options.codexSessionFiles);
-    const resolvedCandidates = options.codexSessionFiles
+    const candidates = options.codexSessionFiles
         ? options.codexSessionFiles.map((file) => ({
             filePath: file.local_path,
             codexSessionId: file.codex_session_id,
@@ -595,36 +543,34 @@ async function collectCodexJsonlFiles(collection, options) {
         source: "codex_jsonl",
         cap_type: "session_limit",
         limit: options.limit,
-        observed: resolvedCandidates.length,
-        applied: !attributed && resolvedCandidates.length > options.limit,
+        observed: candidates.length,
+        applied: !attributed && candidates.length > options.limit,
+    });
+    return attributed ? candidates : candidates.slice(0, options.limit);
+}
+/** The transcript, then the images it explicitly attached — never the reverse. */
+async function collectOneCodexSession(collection, candidate) {
+    const codexSessionId = candidate.codexSessionId ?? shortHash(candidate.filePath);
+    const transcriptAccepted = await collectOneEvidenceFile(collection, {
+        filePath: candidate.filePath,
+        kind: "codex_jsonl",
+        sessionId: codexSessionId,
+        mediaType: "application/jsonl",
+        // Guard before read/toString: Codex files can exceed the buffered commit
+        // ceiling just like Claude mains.
+        maxFileBytes: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
+        redactedSummary: "Raw Codex JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
+        contentAddress: (hash16) => `codex/${safeKeySegment(codexSessionId)}/${hash16}.jsonl`,
+    });
+    if (!transcriptAccepted)
+        return;
+    await collectAgentImagesFromTranscript(collection, {
+        filePath: candidate.filePath,
+        source: "codex",
+        sessionId: codexSessionId,
+        kind: "codex_image_attachment",
+        contentAddress: (hash16, extension) => `codex/${safeKeySegment(codexSessionId)}/images/${hash16}.${extension}`,
     });
-    const candidates = attributed
-        ? resolvedCandidates
-        : resolvedCandidates.slice(0, options.limit);
-    for (const candidate of candidates) {
-        recordScanned(collection, "codex_jsonl");
-        const codexSessionId = candidate.codexSessionId ?? shortHash(candidate.filePath);
-        const transcriptAccepted = await collectOneEvidenceFile(collection, {
-            filePath: candidate.filePath,
-            kind: "codex_jsonl",
-            sessionId: codexSessionId,
-            mediaType: "application/jsonl",
-            // Guard before read/toString: Codex files can exceed the buffered commit
-            // ceiling just like Claude mains.
-            maxFileBytes: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
-            redactedSummary: "Raw Codex JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-            contentAddress: (hash16) => `codex/${safeKeySegment(codexSessionId)}/${hash16}.jsonl`,
-        });
-        if (!transcriptAccepted)
-            continue;
-        await collectAgentImagesFromTranscript(collection, {
-            filePath: candidate.filePath,
-            source: "codex",
-            sessionId: codexSessionId,
-            kind: "codex_image_attachment",
-            contentAddress: (hash16, extension) => `codex/${safeKeySegment(codexSessionId)}/images/${hash16}.${extension}`,
-        });
-    }
 }
 /** The unattributed fallback: every recent Codex transcript on this machine. */
 function walkRecentCodexJsonlFiles(collection, options) {
@@ -779,34 +725,43 @@ async function collectOneAgentImageFile(collection, options) {
         });
         return;
     }
+    await writeAgentImageToPack(collection, {
+        ...options,
+        contentHash,
+        metadata,
+    });
+}
+/** Put an accepted image's bytes on disk and add its manifest entry. */
+async function writeAgentImageToPack(collection, image) {
+    const raw = image.image.bytes;
     collection.index.value += 1;
-    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-agent-image-${contentHash.slice(0, 16)}.${options.image.extension}`);
+    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-agent-image-${image.contentHash.slice(0, 16)}.${image.image.extension}`);
     const imageSourceKey = evidenceSourceKey({
-        kind: options.kind,
-        sessionId: options.sessionId,
-        label: options.image.label,
+        kind: image.kind,
+        sessionId: image.sessionId,
+        label: image.image.label,
     });
     const staged = await stageEvidenceBytes(collection, {
-        contentHash,
+        contentHash: image.contentHash,
         bytes: raw,
         fileName: path.basename(relativePath),
-        kind: options.kind,
+        kind: image.kind,
         sourceKey: imageSourceKey,
     });
     collection.entries.push(evidenceEntry({
         context: collection.context,
-        kind: options.kind,
+        kind: image.kind,
         packId: collection.packId,
         localPath: staged.local_path,
         relativePath,
         stagedInPack: staged.staged_in_pack,
         sourceKey: imageSourceKey,
-        mediaType: metadata.media_type,
+        mediaType: image.metadata.media_type,
         redactedSummary: "Raw image explicitly attached to an agent session, preserved in private durable storage.",
         bytes: raw,
-        codexSessionId: options.sessionId,
-        contentAddress: options.contentAddress(contentHash.slice(0, 16), options.image.extension),
-        artifactMetadata: metadata,
+        codexSessionId: image.sessionId,
+        contentAddress: image.contentAddress(image.contentHash.slice(0, 16), image.image.extension),
+        artifactMetadata: image.metadata,
     }));
 }
 // ---------------------------------------------------------------------------
@@ -822,19 +777,11 @@ async function collectOneAgentImageFile(collection, options) {
  * collecting. Every false return has pushed a named skip first.
  */
 async function collectOneEvidenceFile(collection, options) {
-    const fileName = path.basename(options.filePath);
-    const secretLikeFileName = isSecretLikePath(fileName);
-    const evidenceLabel = secretLikeFileName ? "[REDACTED_FILE_NAME]" : fileName;
-    const packedFileName = secretLikeFileName ? "redacted-file.jsonl" : fileName;
-    const sourceKey = evidenceSourceKey({
-        kind: options.kind,
-        sessionId: options.sessionId,
-        sourcePath: options.filePath,
-    });
+    const names = nameEvidenceFile(options);
     const skip = (reason) => {
         collection.skipped.push({
             kind: options.kind,
-            label: evidenceLabel,
+            label: names.evidenceLabel,
             reason,
         });
         return false;
@@ -843,14 +790,10 @@ async function collectOneEvidenceFile(collection, options) {
     // has failed repeatedly costs nothing at all this cycle — no read, no hash,
     // no copy, no request — and the hold is a named, retryable gap so a held
     // session cannot make the sync look clean (BLI-3066).
-    if (collection.heldSources.has(sourceKey)) {
+    if (collection.heldSources.has(names.sourceKey)) {
         collection.deliveryHeldCount += 1;
         skip(DELIVERY_BACKOFF_HOLDING_REASON);
-        console.error("[raw-evidence] delivery backoff holding source", JSON.stringify({
-            reason: DELIVERY_BACKOFF_HOLDING_REASON,
-            kind: options.kind,
-            source_key: sourceKey,
-        }));
+        logDeliveryBackoffHold(options.kind, names.sourceKey);
         return false;
     }
     const read = await readEvidenceFileWithinCap(options.filePath, options.maxFileBytes);
@@ -860,74 +803,114 @@ async function collectOneEvidenceFile(collection, options) {
         markCapApplied(collection, options.kind, "max_file_bytes");
         return skip("file_too_large");
     }
-    const raw = read.bytes;
+    const sanitized = maskSecretsInTranscript(collection, {
+        raw: read.bytes,
+        kind: options.kind,
+        evidenceLabel: names.evidenceLabel,
+        secretLikeFileName: names.secretLikeFileName,
+    });
+    const contentHash = sha256(sanitized.bytes);
+    if (collection.skipContentHashes.has(contentHash)) {
+        collection.reused.push({
+            kind: options.kind,
+            label: names.evidenceLabel,
+            content_hash_sha256: contentHash,
+            codex_session_id: options.sessionId,
+        });
+        return true;
+    }
+    const deferReason = admitToBudget(collection.budget, sanitized.bytes.byteLength);
+    if (deferReason) {
+        markBudgetCapApplied(collection, deferReason);
+        return skip(deferReason);
+    }
+    await stageOneTranscript(collection, {
+        ...options,
+        names,
+        sanitized,
+        contentHash,
+    });
+    return true;
+}
+function nameEvidenceFile(options) {
+    const fileName = path.basename(options.filePath);
+    const secretLikeFileName = isSecretLikePath(fileName);
+    return {
+        secretLikeFileName,
+        evidenceLabel: secretLikeFileName ? "[REDACTED_FILE_NAME]" : fileName,
+        packedFileName: secretLikeFileName ? "redacted-file.jsonl" : fileName,
+        sourceKey: evidenceSourceKey({
+            kind: options.kind,
+            sessionId: options.sessionId,
+            sourcePath: options.filePath,
+        }),
+    };
+}
+function logDeliveryBackoffHold(kind, sourceKey) {
+    console.error("[raw-evidence] delivery backoff holding source", JSON.stringify({
+        reason: DELIVERY_BACKOFF_HOLDING_REASON,
+        kind,
+        source_key: sourceKey,
+    }));
+}
+/**
+ * Mask secret-like values in a transcript and record that it happened, because
+ * masking is invisible in the uploaded bytes and an operator has to be able to
+ * see that this file went up altered.
+ */
+function maskSecretsInTranscript(collection, options) {
     const sanitized = sanitizeTextEvidenceForUpload({
-        text: raw.toString("utf8"),
-        originalBytes: raw,
+        text: options.raw.toString("utf8"),
+        originalBytes: options.raw,
         redactedFields: [`${options.kind}.body`],
-        secretLikeFileName,
+        secretLikeFileName: options.secretLikeFileName,
     });
     if (sanitized.status === "redacted") {
         collection.redacted.push({
             kind: options.kind,
-            label: evidenceLabel,
+            label: options.evidenceLabel,
             redaction: sanitized.redaction,
             completenessLabel: sanitized.completenessLabel,
         });
         console.error("[raw-evidence] text evidence sanitized", JSON.stringify({
             kind: options.kind,
             mode: sanitized.completenessLabel,
-            original_bytes: raw.byteLength,
+            original_bytes: options.raw.byteLength,
             uploaded_bytes: sanitized.bytes.byteLength,
         }));
     }
-    const evidenceBytes = sanitized.bytes;
-    // Both branches carry a record now (BLI-3277), so "was anything replaced?" is
-    // the status, never the presence of `redaction`.
-    const redaction = sanitized.redaction;
-    const wasRedacted = sanitized.status === "redacted";
-    const contentHash = sha256(evidenceBytes);
-    if (collection.skipContentHashes.has(contentHash)) {
-        collection.reused.push({
-            kind: options.kind,
-            label: evidenceLabel,
-            content_hash_sha256: contentHash,
-            codex_session_id: options.sessionId,
-        });
-        return true;
-    }
-    const deferReason = admitToBudget(collection.budget, evidenceBytes.byteLength);
-    if (deferReason) {
-        markBudgetCapApplied(collection, deferReason);
-        return skip(deferReason);
-    }
+    return sanitized;
+}
+/** Put an accepted transcript's bytes on disk and add its manifest entry. */
+async function stageOneTranscript(collection, file) {
     collection.index.value += 1;
-    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-${shortHash(options.filePath)}-${packedFileName}`);
+    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-${shortHash(file.filePath)}-${file.names.packedFileName}`);
     const staged = await stageEvidenceBytes(collection, {
-        contentHash,
-        bytes: evidenceBytes,
+        contentHash: file.contentHash,
+        bytes: file.sanitized.bytes,
         fileName: path.basename(relativePath),
-        kind: options.kind,
-        sourceKey,
+        kind: file.kind,
+        sourceKey: file.names.sourceKey,
     });
     collection.entries.push(evidenceEntry({
         context: collection.context,
-        kind: options.kind,
+        kind: file.kind,
         packId: collection.packId,
         localPath: staged.local_path,
         relativePath,
-        mediaType: options.mediaType,
-        redactedSummary: wasRedacted
-            ? `${options.redactedSummary} Secret-like values were deterministically redacted before upload.`
-            : options.redactedSummary,
-        redaction,
-        bytes: evidenceBytes,
-        codexSessionId: options.sessionId,
-        contentAddress: options.contentAddress(contentHash.slice(0, 16)),
+        mediaType: file.mediaType,
+        redactedSummary: file.sanitized.status === "redacted"
+            ? `${file.redactedSummary} Secret-like values were deterministically redacted before upload.`
+            : file.redactedSummary,
+        // Both branches carry a record now (BLI-3277), so "was anything
+        // replaced?" is the status, never the presence of `redaction`.
+        redaction: file.sanitized.redaction,
+        bytes: file.sanitized.bytes,
+        codexSessionId: file.sessionId,
+        contentAddress: file.contentAddress(file.contentHash.slice(0, 16)),
         stagedInPack: staged.staged_in_pack,
-        sourceKey,
+        sourceKey: file.names.sourceKey,
     }));
-    return true;
 }
 /**
  * Size is checked twice on purpose: once by `stat` so an oversized transcript
@@ -1024,70 +1007,17 @@ const GIT_DIFF_TARGETS = [
     { label: "staged", args: ["diff", "--cached", "--no-ext-diff", "--"] },
 ];
 async function collectGitDiffFiles(collection, repoRoot) {
-    // BLI-3551: asked once per root, before either target, so a pruned worktree
-    // costs ONE line instead of one per diff target per session per tick — and
-    // the line says the folder is gone rather than accusing git of failing.
     if (!(await repoRootExists(repoRoot))) {
-        console.error("[raw-evidence] git diff skipped, repository root is no longer on disk", JSON.stringify({
-            reason: REPO_ROOT_MISSING_REASON,
-            diff_targets_skipped: GIT_DIFF_TARGETS.length,
-            next_action: "nothing to do; the diff returns when the worktree is restored or the session ages out",
-        }));
-        for (const target of GIT_DIFF_TARGETS) {
-            recordScanned(collection, "git_diff");
-            collection.skipped.push({
-                kind: "git_diff",
-                label: target.label,
-                reason: REPO_ROOT_MISSING_REASON,
-            });
-        }
+        skipEveryDiffTargetForMissingRoot(collection);
         return;
     }
     for (const target of GIT_DIFF_TARGETS) {
         recordScanned(collection, "git_diff");
-        let diff;
-        try {
-            diff = await runGitDiff(target.args, repoRoot);
-        }
-        catch (error) {
-            // The root was there a moment ago and is not now (or a second collector
-            // pruned it mid-tick). Same named outcome, still not a git failure.
-            if (error instanceof RepoRootMissingError) {
-                collection.skipped.push({
-                    kind: "git_diff",
-                    label: target.label,
-                    reason: REPO_ROOT_MISSING_REASON,
-                });
-                continue;
-            }
-            // `git_diff_failed` is the skip label and stays. It covers git not being
-            // installed, the folder not being a repo, a locked index and a diff that
-            // exceeded the child-process buffer — and the diff is half the evidence
-            // for what someone actually changed, so losing it quietly matters.
-            console.error("[raw-evidence] git diff failed", JSON.stringify({
-                reason: "git_diff_failed",
-                diff_target: target.label,
-                ...describeError(error),
-            }));
-            collection.skipped.push({
-                kind: "git_diff",
-                label: target.label,
-                reason: "git_diff_failed",
-            });
+        const diff = await runOneGitDiff(collection, target, repoRoot);
+        if (!diff)
             continue;
-        }
-        if (diff.truncated) {
-            markCapApplied(collection, "git_diff", diff.truncationCapType);
-            collection.truncated.push({
-                kind: "git_diff",
-                reason: diff.truncationReason,
-                ...(diff.truncationCapType === "max_bytes_per_diff"
-                    ? { max_bytes: MAX_GIT_DIFF_BYTES }
-                    : {}),
-                observed_bytes: diff.observedBytes,
-                included_bytes: Buffer.byteLength(diff.stdout, "utf8"),
-            });
-        }
+        if (diff.truncated)
+            recordGitDiffTruncation(collection, diff);
         // An empty diff is not a gap: there was simply nothing to record. The
         // truncation marker above still stands even when zero bytes survived.
         if (!diff.stdout.trim())
@@ -1099,28 +1029,79 @@ async function collectGitDiffFiles(collection, repoRoot) {
         });
     }
 }
-async function stageOneGitDiff(collection, target) {
-    const sanitized = sanitizeTextEvidenceForUpload({
-        text: target.diffText,
-        redactedFields: [`git_diff.${target.label}`],
-    });
-    if (sanitized.status === "redacted") {
-        collection.redacted.push({
+/**
+ * BLI-3551: the root is asked about once per pass, before either target, so a
+ * pruned worktree costs ONE line instead of one per diff target per session per
+ * tick — and the line says the folder is gone rather than accusing git of
+ * failing. Both targets still get their own named gap.
+ */
+function skipEveryDiffTargetForMissingRoot(collection) {
+    console.error("[raw-evidence] git diff skipped, repository root is no longer on disk", JSON.stringify({
+        reason: REPO_ROOT_MISSING_REASON,
+        diff_targets_skipped: GIT_DIFF_TARGETS.length,
+        next_action: "nothing to do; the diff returns when the worktree is restored or the session ages out",
+    }));
+    for (const target of GIT_DIFF_TARGETS) {
+        recordScanned(collection, "git_diff");
+        collection.skipped.push({
             kind: "git_diff",
             label: target.label,
-            redaction: sanitized.redaction,
-            completenessLabel: sanitized.completenessLabel,
+            reason: REPO_ROOT_MISSING_REASON,
         });
-        console.error("[raw-evidence] git diff sanitized", JSON.stringify({
-            mode: sanitized.completenessLabel,
-            original_bytes: Buffer.byteLength(target.diffText, "utf8"),
-            uploaded_bytes: sanitized.bytes.byteLength,
+    }
+}
+/**
+ * Run one diff, or record why it produced nothing. Null means the gap is
+ * already named in the ledger, so the caller only has to move on.
+ */
+async function runOneGitDiff(collection, target, repoRoot) {
+    try {
+        return await runGitDiff(target.args, repoRoot);
+    }
+    catch (error) {
+        // The root was there a moment ago and is not now (or a second collector
+        // pruned it mid-tick). Same named outcome, still not a git failure.
+        if (error instanceof RepoRootMissingError) {
+            collection.skipped.push({
+                kind: "git_diff",
+                label: target.label,
+                reason: REPO_ROOT_MISSING_REASON,
+            });
+            return null;
+        }
+        // `git_diff_failed` is the skip label and stays. It covers git not being
+        // installed, the folder not being a repo, a locked index and a diff that
+        // exceeded the child-process buffer — and the diff is half the evidence
+        // for what someone actually changed, so losing it quietly matters.
+        console.error("[raw-evidence] git diff failed", JSON.stringify({
+            reason: "git_diff_failed",
+            diff_target: target.label,
+            ...describeError(error),
         }));
+        collection.skipped.push({
+            kind: "git_diff",
+            label: target.label,
+            reason: "git_diff_failed",
+        });
+        return null;
     }
-    const raw = sanitized.bytes;
-    const redaction = sanitized.redaction;
-    const wasRedacted = sanitized.status === "redacted";
-    const contentHash = sha256(raw);
+}
+/** A diff that hit its size or time cap is partial evidence, and says so. */
+function recordGitDiffTruncation(collection, diff) {
+    markCapApplied(collection, "git_diff", diff.truncationCapType);
+    collection.truncated.push({
+        kind: "git_diff",
+        reason: diff.truncationReason,
+        ...(diff.truncationCapType === "max_bytes_per_diff"
+            ? { max_bytes: MAX_GIT_DIFF_BYTES }
+            : {}),
+        observed_bytes: diff.observedBytes,
+        included_bytes: Buffer.byteLength(diff.stdout, "utf8"),
+    });
+}
+async function stageOneGitDiff(collection, target) {
+    const sanitized = maskSecretsInGitDiff(collection, target);
+    const contentHash = sha256(sanitized.bytes);
     if (collection.skipContentHashes.has(contentHash)) {
         collection.reused.push({
             kind: "git_diff",
@@ -1130,7 +1111,7 @@ async function stageOneGitDiff(collection, target) {
         });
         return;
     }
-    const deferReason = admitToBudget(collection.budget, raw.byteLength);
+    const deferReason = admitToBudget(collection.budget, sanitized.bytes.byteLength);
     if (deferReason) {
         markBudgetCapApplied(collection, deferReason);
         collection.skipped.push({
@@ -1140,15 +1121,45 @@ async function stageOneGitDiff(collection, target) {
         });
         return;
     }
-    const relativePath = path.join("files", `git-${target.label}.diff`);
+    await writeGitDiffToPack(collection, { target, sanitized, contentHash });
+}
+/**
+ * Mask secret-like values in a diff and record that it happened. A diff carries
+ * whatever a person pasted into a config file, so this is the branch that most
+ * often fires — and an operator has to see that the bytes went up altered.
+ */
+function maskSecretsInGitDiff(collection, target) {
+    const sanitized = sanitizeTextEvidenceForUpload({
+        text: target.diffText,
+        redactedFields: [`git_diff.${target.label}`],
+    });
+    if (sanitized.status === "redacted") {
+        collection.redacted.push({
+            kind: "git_diff",
+            label: target.label,
+            redaction: sanitized.redaction,
+            completenessLabel: sanitized.completenessLabel,
+        });
+        console.error("[raw-evidence] git diff sanitized", JSON.stringify({
+            mode: sanitized.completenessLabel,
+            original_bytes: Buffer.byteLength(target.diffText, "utf8"),
+            uploaded_bytes: sanitized.bytes.byteLength,
+        }));
+    }
+    return sanitized;
+}
+/** Put an accepted diff's bytes on disk and add its manifest entry. */
+async function writeGitDiffToPack(collection, diff) {
+    const label = diff.target.label;
+    const relativePath = path.join("files", `git-${label}.diff`);
     const diffSourceKey = evidenceSourceKey({
         kind: "git_diff",
         sessionId: collection.context.workContextId,
-        label: target.label,
+        label,
     });
     const staged = await stageEvidenceBytes(collection, {
-        contentHash,
-        bytes: raw,
+        contentHash: diff.contentHash,
+        bytes: diff.sanitized.bytes,
         fileName: path.basename(relativePath),
         kind: "git_diff",
         sourceKey: diffSourceKey,
@@ -1162,13 +1173,13 @@ async function stageOneGitDiff(collection, target) {
         stagedInPack: staged.staged_in_pack,
         sourceKey: diffSourceKey,
         mediaType: "text/x-diff",
-        redactedSummary: gitDiffSummary(target.label, {
-            redacted: wasRedacted,
-            truncated: target.truncated,
+        redactedSummary: gitDiffSummary(label, {
+            redacted: diff.sanitized.status === "redacted",
+            truncated: diff.target.truncated,
         }),
-        redaction,
-        bytes: raw,
-        contentAddress: `git-diff/${target.label}-${contentHash.slice(0, 16)}.diff`,
+        redaction: diff.sanitized.redaction,
+        bytes: diff.sanitized.bytes,
+        contentAddress: `git-diff/${label}-${diff.contentHash.slice(0, 16)}.diff`,
     }));
 }
 function gitDiffSummary(label, state) {