@bli-cockpit/cli 0.2.49 → 0.2.50

package/dist/adapters/raw-evidence.js

@@ -1,35 +1,71 @@
-import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, SourceScanResultSchema, } from "@bli-cockpit/telemetry-core";
-import crypto from "node:crypto";
-import fs from "node:fs/promises";
-import os from "node:os";
+/**
+ * Collect one repo's raw evidence into a private, content-keyed pack.
+ *
+ * This is the content guard between "a transcript exists on this laptop" and
+ * "these bytes may become durable evidence". Attribution before it only reads
+ * metadata; the server commit after it is the second guard.
+ *
+ * The pass, in order:
+ *
+ * 1. **Open a staging directory.** The pack's id comes from its content, so it
+ *    cannot be known yet (BLI-3066). Bytes land in `.staging-<pid>-<rand>`.
+ * 2. **Record what attribution already knew** — every session it scanned and
+ *    every one it could not name, as completeness records, before a single byte
+ *    is read.
+ * 3. **Collect** every source: Codex transcripts, Claude transcripts and their
+ *    subagent sidecars, images explicitly attached to either, and the two git
+ *    diffs.
+ * 4. **Finish** one of three ways — empty, promoted, or failed — each reporting
+ *    the same facts, pointers and scan.
+ *
+ * Three doctrines hold everywhere in this family:
+ *
+ * - **Nothing gets in the way of collecting a session.** Redaction masks and
+ *   continues; it never drops a file.
+ * - **A failure must name itself.** Every path that declines a file records a
+ *   reason label in the gap ledger.
+ * - **Never succeed silently either.** Staging, reuse, holds and failures all
+ *   log metadata — ids, sizes, counts, reason labels. Never content, never a
+ *   local path.
+ *
+ * Who owns what (BLI-3586 moved the bodies out; every public name is still
+ * exported from this file, so no consumer's import changed):
+ *
+ * | module                          | owns                                    |
+ * | ------------------------------- | --------------------------------------- |
+ * | `raw-evidence-collection-state` | what a pass carries, its budget, staging bytes |
+ * | `raw-evidence-codex-reader`     | Codex transcripts, and the capped fallback walk |
+ * | `raw-evidence-claude-reader`    | Claude mains, sidecars, the D7/D9 outcomes |
+ * | `raw-evidence-image-reader`     | images attached to either transcript    |
+ * | `raw-evidence-git-diff-reader`  | the unstaged and staged diffs           |
+ * | `raw-evidence-transcript-file`  | one transcript, end to end              |
+ * | `raw-evidence-sanitize`         | masking, and the receipt it leaves      |
+ * | `raw-evidence-facts`            | the three endings, the pointers, the scan |
+ * | `raw-evidence-completeness`     | the gap ledger                          |
+ * | `raw-evidence-manifest`         | what we say about a file                |
+ * | `raw-evidence-pack-store`       | where the bytes live                    |
+ * | `raw-evidence-keys`             | naming                                  |
+ * | `raw-evidence-git-diff`         | running git                             |
+ * | `raw-evidence-attribution-gaps` | step 2's scan results as ledger records |
+ *
+ * The readers deliberately share one shape — derive the names, guard, mask and
+ * record, hash, check reuse, check budget, then a single `write…ToPack` that
+ * puts the bytes down and adds the manifest entry. They do NOT share one
+ * implementation, because each pushes a different ledger row and logs a
+ * different line, and merging them would change what an operator reads.
+ */
 import path from "node:path";
-import { makeSourceAdapterIdentity, } from "./common.js";
-import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
-import { defaultCodexSessionDirs, } from "./codex-attribution.js";
 import { recordClaudeAttributionCompleteness, recordCodexAttributionCompleteness, } from "./raw-evidence-attribution-gaps.js";
-import { describeError } from "../health-detail.js";
-import { contentKeyedRawEvidencePackId, DELIVERY_BACKOFF_BYPASS_REASON, DELIVERY_BACKOFF_HOLDING_REASON, deliveryBackoffApplies, evidenceSourceKey, heldSourceKeys, readRawEvidenceStagingState, recordStagedObject, resolveStagedObject, } from "../raw-evidence-staging.js";
-import { isSecretLikePath, safeKeySegment, sha256, shortHash, } from "./raw-evidence-keys.js";
-import { sanitizeTextEvidenceForUpload, } from "./raw-evidence-sanitize.js";
-import { countEvidenceEntries, makeEvidenceCompleteness, markBudgetCapApplied, markCapApplied, recordScanned, } from "./raw-evidence-completeness.js";
-import { evidenceEntry, pointerFromEntry, RAW_EVIDENCE_BUCKET, } from "./raw-evidence-manifest.js";
-import { chmodPrivate, ensurePrivateDir, persistStagingState, promoteStagedPack, stageManifest, } from "./raw-evidence-pack-store.js";
-import { GIT_DIFF_TIMEOUT_MS, MAX_GIT_DIFF_BYTES, REPO_ROOT_MISSING_REASON, RepoRootMissingError, repoRootExists, runGitDiff, } from "./raw-evidence-git-diff.js";
+import { ensurePrivateDir } from "./raw-evidence-pack-store.js";
+import { DEFAULT_SESSION_LIMIT, DEFAULT_SINCE_MINUTES, newStagingDir, openCollection, } from "./raw-evidence-collection-state.js";
+import { finishWithEmptyPack, finishWithFailedPack, finishWithPromotedPack, } from "./raw-evidence-facts.js";
+import { collectCodexJsonlFiles } from "./raw-evidence-codex-reader.js";
+import { collectClaudeJsonlFiles } from "./raw-evidence-claude-reader.js";
+import { collectGitDiffFiles } from "./raw-evidence-git-diff-reader.js";
 // Re-exported so every consumer keeps importing from `adapters/raw-evidence`.
 export { RAW_EVIDENCE_BUCKET, RAW_EVIDENCE_RETENTION_MODE, } from "./raw-evidence-manifest.js";
 export { sanitizeTextEvidenceForUpload } from "./raw-evidence-sanitize.js";
-const DEFAULT_SINCE_MINUTES = 24 * 60;
-const DEFAULT_SESSION_LIMIT = 50;
-// Per-sync upload budgets enforced at COLLECTION time (D7b). A single marathon
-// transcript can approach the 500 MiB wire cap (RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES),
-// so 2 GiB leaves room for several files without starving the sync; overflow
-// still defers and converges.
-export const RAW_EVIDENCE_DEFAULT_BYTE_BUDGET = 2 * 1024 * 1024 * 1024;
-export const RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET = 300;
-const CLAUDE_MAX_COLLECT_FILE_BYTES = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES;
-// ---------------------------------------------------------------------------
-// The pass
-// ---------------------------------------------------------------------------
+export { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET, } from "./raw-evidence-collection-state.js";
 /**
  * Decide which bytes on this laptop are allowed to become durable evidence for
  * one repo, and put exactly those into one private, content-keyed pack.
@@ -64,15 +100,6 @@ export async function collectRawEvidencePack(context, options) {
         return await finishWithFailedPack(collection, { ...run, error });
     }
 }
-/**
- * Staging first, promotion second (BLI-3066). The pack id cannot be known until
- * the content is, so bytes land in a private per-attempt directory, and that
- * directory is then renamed to its content-keyed name — or dropped, when an
- * identical pack is already there.
- */
-function newStagingDir(rawEvidenceRoot) {
-    return path.join(rawEvidenceRoot, `.staging-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
-}
 /**
  * Every kind of evidence this repo can offer, in the order it is read. Codex and
  * Claude transcripts are each switchable off by the caller; the git diffs are
@@ -93,414 +120,6 @@ async function collectEverySource(collection, options, sinceMinutes) {
     }
     await collectGitDiffFiles(collection, options.repoRoot);
 }
-async function openCollection(context, options, places) {
-    const byteBudget = options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET;
-    const objectBudget = options.objectBudget ?? RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET;
-    const staging = await readRawEvidenceStagingState(options.stateDir);
-    return {
-        context,
-        filesDir: path.join(places.stagingDir, "files"),
-        rawEvidenceRoot: places.rawEvidenceRoot,
-        packId: "",
-        staging,
-        heldSources: collectionHeldSources(staging, context.now, options),
-        stagedReusedCount: 0,
-        stagedNewCount: 0,
-        deliveryHeldCount: 0,
-        entries: [],
-        skipped: [],
-        truncated: [],
-        failed: [],
-        redacted: [],
-        reused: [],
-        scanned: new Map(),
-        caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
-        skipContentHashes: options.skipContentHashes ?? new Set(),
-        budget: options.budget ?? {
-            remainingBytes: byteBudget,
-            remainingObjects: objectBudget,
-        },
-        index: { value: 0 },
-    };
-}
-/**
- * Which sources this pass refuses to even read because their delivery is inside
- * a backoff window — none of them, when a person asked for this pass.
- *
- * The bypass is logged rather than assumed: an operator retry that quietly
- * ignored a hold would be as unreadable as the hold that quietly blocked it.
- */
-function collectionHeldSources(staging, now, options) {
-    const held = heldSourceKeys(staging, now);
-    if (deliveryBackoffApplies(options.deliveryMode))
-        return held;
-    if (held.size > 0) {
-        console.error("[raw-evidence] delivery backoff bypassed for operator retry", JSON.stringify({
-            reason: DELIVERY_BACKOFF_BYPASS_REASON,
-            source_count: held.size,
-        }));
-    }
-    return new Set();
-}
-/** Every cap this pass could hit, declared up front and flipped when applied. */
-function startingCaps(options) {
-    return [
-        {
-            source: "raw_evidence",
-            cap_type: "byte_budget",
-            limit: options.byteBudget,
-            observed: options.budget?.remainingBytes ?? options.byteBudget,
-            applied: false,
-        },
-        {
-            source: "raw_evidence",
-            cap_type: "object_budget",
-            limit: options.objectBudget,
-            observed: options.budget?.remainingObjects ?? options.objectBudget,
-            applied: false,
-        },
-        {
-            source: "git_diff",
-            cap_type: "max_bytes_per_diff",
-            limit: MAX_GIT_DIFF_BYTES,
-            applied: false,
-        },
-        {
-            source: "git_diff",
-            cap_type: "timeout_ms",
-            limit: GIT_DIFF_TIMEOUT_MS,
-            applied: false,
-        },
-        {
-            source: "codex_jsonl",
-            cap_type: "max_file_bytes",
-            limit: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
-            applied: false,
-        },
-        {
-            source: "claude_jsonl",
-            cap_type: "max_file_bytes",
-            limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
-            applied: false,
-        },
-        {
-            source: "claude_jsonl_sidecar",
-            cap_type: "max_file_bytes",
-            limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
-            applied: false,
-        },
-    ];
-}
-// ---------------------------------------------------------------------------
-// The three ways a pass ends
-// ---------------------------------------------------------------------------
-/**
- * Nothing collected: drop the staging directory instead of leaving an empty
- * pack behind. This used to leave one empty `work-*` dir per sync.
- */
-async function finishWithEmptyPack(collection, options, run) {
-    await discardStagingDir(run.stagingDir);
-    collection.packId = contentKeyedRawEvidencePackId({
-        workContextId: collection.context.workContextId,
-        contentHashes: [],
-    });
-    await persistStagingState(options.stateDir, collection.staging, collection.context.now.toISOString());
-    const facts = makeEmptyPackFacts(collection, run.window);
-    return {
-        facts,
-        scan: makeRawEvidenceScan({
-            context: collection.context,
-            startedAt: run.window.startedAt,
-            status: "partial",
-            facts,
-        }),
-    };
-}
-async function finishWithPromotedPack(collection, options, run) {
-    const context = collection.context;
-    const entries = collection.entries;
-    // The pack is named by what is in it, never by when it was made. Identical
-    // content on the next sync resolves to the identical directory, which is
-    // the whole fix for BLI-3066.
-    const packId = contentKeyedRawEvidencePackId({
-        workContextId: context.workContextId,
-        contentHashes: entries.map((entry) => entry.content_hash_sha256),
-    });
-    collection.packId = packId;
-    const promotion = await promoteStagedPack({
-        rawEvidenceRoot: collection.rawEvidenceRoot,
-        stagingDir: run.stagingDir,
-        packId,
-        workContextId: context.workContextId,
-        entries,
-    });
-    rebaseStagedEntriesOntoPack(collection, promotion.evidenceDir);
-    const manifestPath = await addManifestToPack(collection, promotion, packId);
-    await persistStagingState(options.stateDir, collection.staging, context.now.toISOString());
-    logPackStaged(collection, promotion, packId);
-    const facts = makePromotedPackFacts(collection, {
-        packId,
-        manifestPath,
-        promotion,
-        window: run.window,
-    });
-    return {
-        facts,
-        scan: makeRawEvidenceScan({
-            context,
-            startedAt: run.window.startedAt,
-            // A pack of nothing but its own manifest carries no evidence, so it
-            // reports partial however cleanly it was written.
-            status: entries.length > 1 ? "ok" : "partial",
-            facts,
-        }),
-    };
-}
-/** A pack with files: the same shell as an empty one, plus what is in it. */
-function makePromotedPackFacts(collection, place) {
-    const entries = collection.entries;
-    return {
-        ...packFactsShell(collection, {
-            packId: place.packId,
-            manifestPath: place.manifestPath,
-            evidenceDir: place.promotion.evidenceDir,
-            window: place.window,
-        }),
-        stage_state: place.promotion.state,
-        file_count: entries.length,
-        byte_size: totalByteSize(entries),
-        content_kinds: [...new Set(entries.map((entry) => entry.kind))],
-        pointers: entries.map(pointerFromEntry),
-        upload_files: entries.map(uploadFileFromEntry),
-    };
-}
-/**
- * Write the manifest and make it an object of the pack like any other file, so
- * the uploader has one list to walk. Returns where it landed.
- */
-async function addManifestToPack(collection, promotion, packId) {
-    const context = collection.context;
-    const manifestPath = path.join(promotion.evidenceDir, "manifest.json");
-    const manifestBytes = await stageManifest({
-        context,
-        packId,
-        manifestPath,
-        entries: collection.entries,
-        skipped: collection.skipped,
-        redacted: collection.redacted,
-        reused: collection.reused,
-        reusePack: promotion.state === "reused",
-    });
-    collection.entries.push(evidenceEntry({
-        context,
-        kind: "manifest",
-        packId,
-        localPath: manifestPath,
-        relativePath: "manifest.json",
-        mediaType: "application/json",
-        redactedSummary: "Local raw evidence pack manifest.",
-        bytes: manifestBytes,
-        // The manifest carries its own content hash in its key, exactly like
-        // every other object in the pack (BLI-3552). Without it the key was
-        // `…/<packId>/manifest.json`, and a pack id is a function of the OTHER
-        // files' hashes — not of the manifest's bytes, which also carry
-        // `created_at`, the ordering-dependent `files[].relative_path`, `branch`,
-        // and the skipped/redacted/reused ledgers. So the same key named
-        // different bytes whenever the pack directory was not adopted verbatim
-        // (a refill, a pruned or wiped state dir, a machine that had never seen
-        // the pack). `begin` then answered `hash_mismatch_committed_object` on
-        // every sync forever, because the new manifest is stable and the old one
-        // is durable. `stageManifest`'s byte-stability trick still stands; it is
-        // now a nice-to-have rather than the only thing between us and a loop.
-        contentAddress: `manifest/${sha256(manifestBytes).slice(0, 16)}.json`,
-    }));
-    return manifestPath;
-}
-/** The success line. A sync that staged nothing new still has to say so. */
-function logPackStaged(collection, promotion, packId) {
-    console.error("[raw-evidence] pack staged", JSON.stringify({
-        pack_id: packId,
-        stage_state: promotion.state,
-        reason: stageReasonLabel(promotion.state, promotion.priorPackCount),
-        prior_pack_count: promotion.priorPackCount,
-        refilled_file_count: promotion.refilledFileCount,
-        file_count: collection.entries.length,
-        byte_size: totalByteSize(collection.entries),
-        staged_new: collection.stagedNewCount,
-        staged_reused: collection.stagedReusedCount,
-        delivery_held: collection.deliveryHeldCount,
-    }));
-}
-/**
- * A crashed pass. The staged-object index is deliberately NOT written: this
- * attempt's bookkeeping describes a directory that is about to be deleted.
- */
-async function finishWithFailedPack(collection, run) {
-    collection.failed.push({
-        kind: "raw_evidence",
-        reason: "collection_failed",
-    });
-    // Staging is per-attempt scratch: a crashed pass must not leave a partial
-    // directory behind to be counted, re-hashed or swept later.
-    await discardStagingDir(run.stagingDir);
-    collection.packId =
-        collection.packId ||
-            contentKeyedRawEvidencePackId({
-                workContextId: collection.context.workContextId,
-                contentHashes: collection.entries.map((entry) => entry.content_hash_sha256),
-            });
-    console.error("[raw-evidence] pack collection failed", JSON.stringify({
-        pack_id: collection.packId,
-        reason: "collection_failed",
-        detail: run.error instanceof Error ? run.error.name : typeof run.error,
-        collected_file_count: collection.entries.length,
-        staged_new: collection.stagedNewCount,
-        staged_reused: collection.stagedReusedCount,
-    }));
-    const facts = makeEmptyPackFacts(collection, run.window);
-    return {
-        facts,
-        scan: makeRawEvidenceScan({
-            context: collection.context,
-            startedAt: run.window.startedAt,
-            status: "failed",
-            facts,
-        }),
-    };
-}
-/**
- * A pack with no files of its own: the empty pass and the crashed pass report
- * the same shape, differing only in the scan status and the reason already
- * logged. `evidence_completeness` still carries every gap this pass recorded.
- */
-function makeEmptyPackFacts(collection, scanWindow) {
-    const evidenceDir = path.join(collection.rawEvidenceRoot, collection.packId);
-    return {
-        ...packFactsShell(collection, {
-            packId: collection.packId,
-            manifestPath: path.join(evidenceDir, "manifest.json"),
-            evidenceDir,
-            window: scanWindow,
-        }),
-        stage_state: "empty",
-        file_count: 0,
-        byte_size: 0,
-        content_kinds: [],
-        pointers: [],
-        upload_files: [],
-    };
-}
-/** The counts every ending reports identically, however the pass ended. */
-function packFactsShell(collection, place) {
-    return {
-        pack_id: place.packId,
-        manifest_path: place.manifestPath,
-        evidence_dir: place.evidenceDir,
-        storage_bucket: RAW_EVIDENCE_BUCKET,
-        skipped_count: countEvidenceEntries(collection.skipped),
-        sanitized_count: collection.redacted.length,
-        reused_count: collection.reused.length,
-        staged_reused_count: collection.stagedReusedCount,
-        staged_new_count: collection.stagedNewCount,
-        delivery_held_count: collection.deliveryHeldCount,
-        deferred_byte_budget_count: countDeferred(collection, "deferred_byte_budget"),
-        deferred_object_budget_count: countDeferred(collection, "deferred_object_budget"),
-        evidence_completeness: makeEvidenceCompleteness(collection, {
-            startedAt: place.window.startedAt,
-            finishedAt: place.window.finishedAt(),
-            sinceMinutes: place.window.sinceMinutes,
-        }),
-        reused: collection.reused,
-    };
-}
-function countDeferred(collection, reason) {
-    return countEvidenceEntries(collection.skipped, (entry) => entry.reason === reason);
-}
-function totalByteSize(entries) {
-    return entries.reduce((sum, entry) => sum + entry.byte_size, 0);
-}
-function uploadFileFromEntry(entry) {
-    return {
-        pointer: pointerFromEntry(entry),
-        local_path: entry.local_path,
-        kind: entry.kind,
-        codex_session_id: entry.codex_session_id ?? null,
-        ...(entry.artifact_metadata
-            ? { artifact_metadata: entry.artifact_metadata }
-            : {}),
-    };
-}
-function stageReasonLabel(state, priorPackCount) {
-    if (state === "reused")
-        return "staged_reused";
-    if (state === "restaged_incomplete")
-        return "restaged_incomplete";
-    return priorPackCount > 0 ? "restaged_content_changed" : "staged_new";
-}
-/**
- * Point every entry this pass staged at its home in the promoted pack, and
- * remember the content hash so the next sync can adopt the copy instead of
- * writing it again. Entries adopted from another pack keep their path.
- */
-function rebaseStagedEntriesOntoPack(collection, evidenceDir) {
-    for (const entry of collection.entries) {
-        if (!entry.staged_in_pack)
-            continue;
-        entry.local_path = path.join(evidenceDir, "files", path.basename(entry.local_path));
-        recordStagedObject(collection.staging, entry.content_hash_sha256, {
-            pack_id: collection.packId,
-            relative_path: `files/${path.basename(entry.local_path)}`,
-            byte_size: entry.byte_size,
-            source_key: entry.source_key,
-            staged_at: collection.context.now.toISOString(),
-        });
-    }
-}
-async function discardStagingDir(stagingDir) {
-    await fs
-        .rm(stagingDir, { recursive: true, force: true })
-        .catch(() => undefined);
-}
-function makeRawEvidenceScan(options) {
-    return SourceScanResultSchema.parse({
-        adapter: makeSourceAdapterIdentity("collector_runtime", "raw-evidence-pack"),
-        work_context_id: options.context.workContextId,
-        status: options.status,
-        started_at: options.startedAt,
-        finished_at: options.context.now.toISOString(),
-        events: [
-            {
-                source_event_id: `raw-evidence-pack:${options.facts.pack_id}`,
-                event_type: "raw_evidence_pack_written",
-                occurred_at: options.context.now.toISOString(),
-                redaction: {
-                    privacy_classification: "remote_durable_raw_evidence",
-                    redaction_status: "raw_remote_durable",
-                    redacted_fields: ["local_path"],
-                    raw_evidence_pointer_ids: options.facts.pointers.map((pointer) => pointer.raw_evidence_pointer_id),
-                    redacted_summary: "Raw prompt/response/tool/session/diff evidence harvested to a private durable remote evidence pack.",
-                },
-                raw_evidence_pointers: options.facts.pointers,
-            },
-        ],
-        diagnostic_labels: [
-            `pack_id:${options.facts.pack_id}`,
-            `files:${options.facts.file_count}`,
-            `bytes:${options.facts.byte_size}`,
-            `skipped:${options.facts.skipped_count}`,
-            `reused:${options.facts.reused_count}`,
-            `stage_state:${options.facts.stage_state}`,
-            `staged_new:${options.facts.staged_new_count}`,
-            `staged_reused:${options.facts.staged_reused_count}`,
-            `delivery_held:${options.facts.delivery_held_count}`,
-            `completeness:${options.facts.evidence_completeness.status}`,
-            `truncated:${options.facts.evidence_completeness.totals.truncated_count}`,
-            `deferred:${options.facts.evidence_completeness.totals.deferred_count}`,
-            `failed:${options.facts.evidence_completeness.totals.failed_count}`,
-            ...options.facts.content_kinds.map((kind) => `kind:${kind}`),
-        ],
-    });
-}
 // ---------------------------------------------------------------------------
 // What attribution already knew
 // ---------------------------------------------------------------------------
@@ -516,743 +135,4 @@ function recordAttributionCompleteness(collection, options) {
     if (options.claudeAttributionScan) {
         recordClaudeAttributionCompleteness(collection, options.claudeAttributionScan, new Set(options.claudeSessionFiles?.map((file) => file.local_path) ?? []));
     }
-}
-// ---------------------------------------------------------------------------
-// Codex transcripts
-// ---------------------------------------------------------------------------
-async function collectCodexJsonlFiles(collection, options) {
-    for (const candidate of await chooseCodexCandidates(collection, options)) {
-        recordScanned(collection, "codex_jsonl");
-        await collectOneCodexSession(collection, candidate);
-    }
-}
-/**
- * Which Codex transcripts this pass will look at, and the record of how many it
- * had to leave out. Attribution's own list is never trimmed — the session limit
- * only guards the fallback walk, which can turn up every session on the machine.
- */
-async function chooseCodexCandidates(collection, options) {
-    const attributed = Boolean(options.codexSessionFiles);
-    const candidates = options.codexSessionFiles
-        ? options.codexSessionFiles.map((file) => ({
-            filePath: file.local_path,
-            codexSessionId: file.codex_session_id,
-        }))
-        : (await walkRecentCodexJsonlFiles(collection, options)).map((filePath) => ({ filePath, codexSessionId: null }));
-    collection.caps.push({
-        source: "codex_jsonl",
-        cap_type: "session_limit",
-        limit: options.limit,
-        observed: candidates.length,
-        applied: !attributed && candidates.length > options.limit,
-    });
-    return attributed ? candidates : candidates.slice(0, options.limit);
-}
-/** The transcript, then the images it explicitly attached — never the reverse. */
-async function collectOneCodexSession(collection, candidate) {
-    const codexSessionId = candidate.codexSessionId ?? shortHash(candidate.filePath);
-    const transcriptAccepted = await collectOneEvidenceFile(collection, {
-        filePath: candidate.filePath,
-        kind: "codex_jsonl",
-        sessionId: codexSessionId,
-        mediaType: "application/jsonl",
-        // Guard before read/toString: Codex files can exceed the buffered commit
-        // ceiling just like Claude mains.
-        maxFileBytes: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
-        redactedSummary: "Raw Codex JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-        contentAddress: (hash16) => `codex/${safeKeySegment(codexSessionId)}/${hash16}.jsonl`,
-    });
-    if (!transcriptAccepted)
-        return;
-    await collectAgentImagesFromTranscript(collection, {
-        filePath: candidate.filePath,
-        source: "codex",
-        sessionId: codexSessionId,
-        kind: "codex_image_attachment",
-        contentAddress: (hash16, extension) => `codex/${safeKeySegment(codexSessionId)}/images/${hash16}.${extension}`,
-    });
-}
-/** The unattributed fallback: every recent Codex transcript on this machine. */
-function walkRecentCodexJsonlFiles(collection, options) {
-    const dirs = options.sessionsDirs ??
-        (options.sessionsDir
-            ? [options.sessionsDir]
-            : defaultCodexSessionDirs(os.homedir()));
-    return walkJsonlFiles(dirs, collection.context.now.getTime() - options.sinceMinutes * 60 * 1000);
-}
-// ---------------------------------------------------------------------------
-// Claude transcripts
-// ---------------------------------------------------------------------------
-async function collectClaudeJsonlFiles(collection, sessions) {
-    recordScanned(collection, "claude_jsonl", sessions.reduce((count, session) => count + 1 + session.sidecar_files.length, 0));
-    for (const session of sessions) {
-        await collectOneClaudeSession(collection, session);
-    }
-}
-async function collectOneClaudeSession(collection, session) {
-    const sessionId = session.claude_session_id;
-    const mainOutcome = await collectClaudeMainFile(collection, session);
-    if (mainOutcome === "collected" || mainOutcome === "damped_reuse") {
-        await collectAgentImagesFromTranscript(collection, {
-            filePath: session.local_path,
-            source: "claude_code",
-            sessionId,
-            kind: "claude_image_attachment",
-            contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
-        });
-    }
-    for (const sidecar of session.sidecar_files) {
-        await collectOneClaudeSidecar(collection, session, sidecar.local_path);
-    }
-}
-/**
- * What happens to a Claude main file, as a decision table:
- *
- * | condition             | main bytes                | outcome             |
- * | --------------------- | ------------------------- | ------------------- |
- * | `main_file_oversized` | skipped `file_too_large`  | `skipped_too_large` |
- * | `skip_main` (D9)      | not re-collected          | `damped_reuse`      |
- * | otherwise             | collected, or named skip  | `collected` / `not_collected` |
- *
- * Its images are collected for every outcome except `skipped_too_large` and
- * `not_collected` — the caller decides that, this function only reports.
- *
- * D7: an oversized main was attributed via a streamed read but its bytes are
- * never uploaded (server commit assembles in memory). Its sidecars still
- * collect. D9 damped: the prior durable copy is still good enough, and the
- * session reports `reused_existing` from cursor state, so no skip is recorded.
- */
-async function collectClaudeMainFile(collection, session) {
-    if (session.main_file_oversized) {
-        collection.skipped.push({
-            kind: "claude_jsonl",
-            label: path.basename(session.local_path),
-            reason: "file_too_large",
-        });
-        return "skipped_too_large";
-    }
-    if (session.skip_main)
-        return "damped_reuse";
-    const accepted = await collectOneEvidenceFile(collection, {
-        filePath: session.local_path,
-        kind: "claude_jsonl",
-        sessionId: session.claude_session_id,
-        mediaType: "application/jsonl",
-        // Re-check size at collection: a main that grew past the cap between
-        // attribution and collection is an honest file_too_large skip, not an
-        // upload_failed at the chunk client.
-        maxFileBytes: CLAUDE_MAX_COLLECT_FILE_BYTES,
-        redactedSummary: "Raw Claude Code JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-        contentAddress: (hash16) => `claude/${safeKeySegment(session.claude_session_id)}/${hash16}.jsonl`,
-    });
-    return accepted ? "collected" : "not_collected";
-}
-async function collectOneClaudeSidecar(collection, session, sidecarPath) {
-    const sessionId = session.claude_session_id;
-    const stem = path.basename(sidecarPath).replace(/\.jsonl$/i, "");
-    const safeSidecarId = isSecretLikePath(stem)
-        ? "redacted-file-name"
-        : safeKeySegment(stem);
-    const sidecarAccepted = await collectOneEvidenceFile(collection, {
-        filePath: sidecarPath,
-        kind: "claude_jsonl_sidecar",
-        sessionId,
-        mediaType: "application/jsonl",
-        maxFileBytes: CLAUDE_MAX_COLLECT_FILE_BYTES,
-        redactedSummary: "Raw Claude Code subagent transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-        contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/subagents/${safeSidecarId}-${hash16}.jsonl`,
-    });
-    if (!sidecarAccepted)
-        return;
-    await collectAgentImagesFromTranscript(collection, {
-        filePath: sidecarPath,
-        source: "claude_code",
-        sessionId,
-        sidecarId: safeSidecarId,
-        kind: "claude_image_attachment",
-        contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/subagents/${safeSidecarId}/images/${hash16}.${extension}`,
-    });
-}
-async function collectAgentImagesFromTranscript(collection, options) {
-    const result = await collectAgentImageEvidenceFromJsonlFile({
-        filePath: options.filePath,
-        source: options.source,
-        sessionId: options.sessionId,
-        sidecarId: options.sidecarId,
-    });
-    recordScanned(collection, options.kind, result.images.length + result.skipped.length);
-    for (const skipped of result.skipped) {
-        collection.skipped.push({
-            kind: options.kind,
-            label: skipped.label,
-            reason: skipped.reason,
-        });
-    }
-    for (const image of result.images) {
-        await collectOneAgentImageFile(collection, {
-            image,
-            kind: options.kind,
-            sessionId: options.sessionId,
-            contentAddress: options.contentAddress,
-        });
-    }
-}
-async function collectOneAgentImageFile(collection, options) {
-    const raw = options.image.bytes;
-    const contentHash = sha256(raw);
-    const metadata = {
-        ...options.image.metadata,
-        content_hash_sha256: contentHash,
-        byte_size: raw.byteLength,
-    };
-    if (collection.skipContentHashes.has(contentHash)) {
-        collection.reused.push({
-            kind: options.kind,
-            label: options.image.label,
-            content_hash_sha256: contentHash,
-            codex_session_id: options.sessionId,
-            artifact_metadata: metadata,
-        });
-        return;
-    }
-    const deferReason = admitToBudget(collection.budget, raw.byteLength);
-    if (deferReason) {
-        markBudgetCapApplied(collection, deferReason);
-        collection.skipped.push({
-            kind: options.kind,
-            label: options.image.label,
-            reason: deferReason,
-        });
-        return;
-    }
-    await writeAgentImageToPack(collection, {
-        ...options,
-        contentHash,
-        metadata,
-    });
-}
-/** Put an accepted image's bytes on disk and add its manifest entry. */
-async function writeAgentImageToPack(collection, image) {
-    const raw = image.image.bytes;
-    collection.index.value += 1;
-    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-agent-image-${image.contentHash.slice(0, 16)}.${image.image.extension}`);
-    const imageSourceKey = evidenceSourceKey({
-        kind: image.kind,
-        sessionId: image.sessionId,
-        label: image.image.label,
-    });
-    const staged = await stageEvidenceBytes(collection, {
-        contentHash: image.contentHash,
-        bytes: raw,
-        fileName: path.basename(relativePath),
-        kind: image.kind,
-        sourceKey: imageSourceKey,
-    });
-    collection.entries.push(evidenceEntry({
-        context: collection.context,
-        kind: image.kind,
-        packId: collection.packId,
-        localPath: staged.local_path,
-        relativePath,
-        stagedInPack: staged.staged_in_pack,
-        sourceKey: imageSourceKey,
-        mediaType: image.metadata.media_type,
-        redactedSummary: "Raw image explicitly attached to an agent session, preserved in private durable storage.",
-        bytes: raw,
-        codexSessionId: image.sessionId,
-        contentAddress: image.contentAddress(image.contentHash.slice(0, 16), image.image.extension),
-        artifactMetadata: image.metadata,
-    }));
-}
-// ---------------------------------------------------------------------------
-// One transcript, end to end
-// ---------------------------------------------------------------------------
-/**
- * Reads, secret-guards, content-addresses, budget-checks, and copies one
- * attributed transcript into the pack.
- *
- * Returns whether this file's *content* is accounted for, which is not the same
- * as "was staged": a transcript whose bytes are already durable remotely
- * returns true without staging anything, and its images are still worth
- * collecting. Every false return has pushed a named skip first.
- */
-async function collectOneEvidenceFile(collection, options) {
-    const names = nameEvidenceFile(options);
-    const skip = (reason) => {
-        collection.skipped.push({
-            kind: options.kind,
-            label: names.evidenceLabel,
-            reason,
-        });
-        return false;
-    };
-    // Delivery backoff is checked BEFORE the file is read. An object whose commit
-    // has failed repeatedly costs nothing at all this cycle — no read, no hash,
-    // no copy, no request — and the hold is a named, retryable gap so a held
-    // session cannot make the sync look clean (BLI-3066).
-    if (collection.heldSources.has(names.sourceKey)) {
-        collection.deliveryHeldCount += 1;
-        skip(DELIVERY_BACKOFF_HOLDING_REASON);
-        logDeliveryBackoffHold(options.kind, names.sourceKey);
-        return false;
-    }
-    const read = await readEvidenceFileWithinCap(options.filePath, options.maxFileBytes);
-    if (read.status === "read_failed")
-        return skip("file_read_failed");
-    if (read.status === "too_large") {
-        markCapApplied(collection, options.kind, "max_file_bytes");
-        return skip("file_too_large");
-    }
-    const sanitized = maskSecretsInTranscript(collection, {
-        raw: read.bytes,
-        kind: options.kind,
-        evidenceLabel: names.evidenceLabel,
-        secretLikeFileName: names.secretLikeFileName,
-    });
-    const contentHash = sha256(sanitized.bytes);
-    if (collection.skipContentHashes.has(contentHash)) {
-        collection.reused.push({
-            kind: options.kind,
-            label: names.evidenceLabel,
-            content_hash_sha256: contentHash,
-            codex_session_id: options.sessionId,
-        });
-        return true;
-    }
-    const deferReason = admitToBudget(collection.budget, sanitized.bytes.byteLength);
-    if (deferReason) {
-        markBudgetCapApplied(collection, deferReason);
-        return skip(deferReason);
-    }
-    await stageOneTranscript(collection, {
-        ...options,
-        names,
-        sanitized,
-        contentHash,
-    });
-    return true;
-}
-function nameEvidenceFile(options) {
-    const fileName = path.basename(options.filePath);
-    const secretLikeFileName = isSecretLikePath(fileName);
-    return {
-        secretLikeFileName,
-        evidenceLabel: secretLikeFileName ? "[REDACTED_FILE_NAME]" : fileName,
-        packedFileName: secretLikeFileName ? "redacted-file.jsonl" : fileName,
-        sourceKey: evidenceSourceKey({
-            kind: options.kind,
-            sessionId: options.sessionId,
-            sourcePath: options.filePath,
-        }),
-    };
-}
-function logDeliveryBackoffHold(kind, sourceKey) {
-    console.error("[raw-evidence] delivery backoff holding source", JSON.stringify({
-        reason: DELIVERY_BACKOFF_HOLDING_REASON,
-        kind,
-        source_key: sourceKey,
-    }));
-}
-/**
- * Mask secret-like values in a transcript and record that it happened, because
- * masking is invisible in the uploaded bytes and an operator has to be able to
- * see that this file went up altered.
- */
-function maskSecretsInTranscript(collection, options) {
-    const sanitized = sanitizeTextEvidenceForUpload({
-        text: options.raw.toString("utf8"),
-        originalBytes: options.raw,
-        redactedFields: [`${options.kind}.body`],
-        secretLikeFileName: options.secretLikeFileName,
-    });
-    if (sanitized.status === "redacted") {
-        collection.redacted.push({
-            kind: options.kind,
-            label: options.evidenceLabel,
-            redaction: sanitized.redaction,
-            completenessLabel: sanitized.completenessLabel,
-        });
-        console.error("[raw-evidence] text evidence sanitized", JSON.stringify({
-            kind: options.kind,
-            mode: sanitized.completenessLabel,
-            original_bytes: options.raw.byteLength,
-            uploaded_bytes: sanitized.bytes.byteLength,
-        }));
-    }
-    return sanitized;
-}
-/** Put an accepted transcript's bytes on disk and add its manifest entry. */
-async function stageOneTranscript(collection, file) {
-    collection.index.value += 1;
-    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-${shortHash(file.filePath)}-${file.names.packedFileName}`);
-    const staged = await stageEvidenceBytes(collection, {
-        contentHash: file.contentHash,
-        bytes: file.sanitized.bytes,
-        fileName: path.basename(relativePath),
-        kind: file.kind,
-        sourceKey: file.names.sourceKey,
-    });
-    collection.entries.push(evidenceEntry({
-        context: collection.context,
-        kind: file.kind,
-        packId: collection.packId,
-        localPath: staged.local_path,
-        relativePath,
-        mediaType: file.mediaType,
-        redactedSummary: file.sanitized.status === "redacted"
-            ? `${file.redactedSummary} Secret-like values were deterministically redacted before upload.`
-            : file.redactedSummary,
-        // Both branches carry a record now (BLI-3277), so "was anything
-        // replaced?" is the status, never the presence of `redaction`.
-        redaction: file.sanitized.redaction,
-        bytes: file.sanitized.bytes,
-        codexSessionId: file.sessionId,
-        contentAddress: file.contentAddress(file.contentHash.slice(0, 16)),
-        stagedInPack: staged.staged_in_pack,
-        sourceKey: file.names.sourceKey,
-    }));
-}
-/**
- * Size is checked twice on purpose: once by `stat` so an oversized transcript
- * is never buffered at all, and once on the bytes actually read, because a live
- * session can grow between the two.
- */
-async function readEvidenceFileWithinCap(filePath, maxFileBytes) {
-    if (maxFileBytes) {
-        let stat;
-        try {
-            stat = await fs.stat(filePath);
-        }
-        catch (error) {
-            // The caller turns this into the `file_read_failed` skip label, which is
-            // the one label an operator can do nothing with. The file was discovered
-            // moments ago, so a failure here is a rotated session, a permission
-            // problem or a dead symlink — three different answers (BLI-3238).
-            console.error("[raw-evidence] evidence file could not be stat'd", JSON.stringify({
-                reason: "file_read_failed",
-                stage: "stat",
-                ...describeError(error),
-            }));
-            return { status: "read_failed" };
-        }
-        if (stat.size > maxFileBytes)
-            return { status: "too_large" };
-    }
-    let bytes;
-    try {
-        bytes = await fs.readFile(filePath);
-    }
-    catch (error) {
-        console.error("[raw-evidence] evidence file could not be read", JSON.stringify({
-            reason: "file_read_failed",
-            stage: "read",
-            ...describeError(error),
-        }));
-        return { status: "read_failed" };
-    }
-    if (maxFileBytes && bytes.byteLength > maxFileBytes) {
-        return { status: "too_large" };
-    }
-    return { status: "ok", bytes };
-}
-// ---------------------------------------------------------------------------
-// Staging and budgets
-// ---------------------------------------------------------------------------
-/**
- * Put these bytes on disk once.
- *
- * If an earlier sync already staged this exact content and the copy is still
- * there, that copy is used — the uploader only needs a readable path, and it
- * does not care which pack directory holds it. This is the branch that stops
- * one 334 MB rollout from becoming 559 copies while its commit keeps failing.
- */
-async function stageEvidenceBytes(collection, options) {
-    const existing = await resolveStagedObject(collection.rawEvidenceRoot, collection.staging, options.contentHash);
-    if (existing) {
-        collection.stagedReusedCount += 1;
-        console.error("[raw-evidence] staged copy reused", JSON.stringify({
-            reason: "staged_reused",
-            kind: options.kind,
-            content_hash_prefix: options.contentHash.slice(0, 16),
-            byte_size: existing.entry.byte_size,
-            pack_id: existing.entry.pack_id,
-        }));
-        return { local_path: existing.local_path, staged_in_pack: false };
-    }
-    const destination = path.join(collection.filesDir, options.fileName);
-    await fs.writeFile(destination, options.bytes, { mode: 0o600 });
-    await chmodPrivate(destination, 0o600);
-    collection.stagedNewCount += 1;
-    return { local_path: destination, staged_in_pack: true };
-}
-/**
- * Decrements the per-sync budget when a file fits, or returns a deferred-skip
- * reason when it does not. The object budget bounds request count; the byte
- * budget bounds buffered bytes.
- */
-function admitToBudget(budget, byteLength) {
-    if (budget.remainingObjects <= 0)
-        return "deferred_object_budget";
-    if (byteLength > budget.remainingBytes)
-        return "deferred_byte_budget";
-    budget.remainingObjects -= 1;
-    budget.remainingBytes -= byteLength;
-    return null;
-}
-// ---------------------------------------------------------------------------
-// Git diffs
-// ---------------------------------------------------------------------------
-const GIT_DIFF_TARGETS = [
-    { label: "unstaged", args: ["diff", "--no-ext-diff", "--"] },
-    { label: "staged", args: ["diff", "--cached", "--no-ext-diff", "--"] },
-];
-async function collectGitDiffFiles(collection, repoRoot) {
-    if (!(await repoRootExists(repoRoot))) {
-        skipEveryDiffTargetForMissingRoot(collection);
-        return;
-    }
-    for (const target of GIT_DIFF_TARGETS) {
-        recordScanned(collection, "git_diff");
-        const diff = await runOneGitDiff(collection, target, repoRoot);
-        if (!diff)
-            continue;
-        if (diff.truncated)
-            recordGitDiffTruncation(collection, diff);
-        // An empty diff is not a gap: there was simply nothing to record. The
-        // truncation marker above still stands even when zero bytes survived.
-        if (!diff.stdout.trim())
-            continue;
-        await stageOneGitDiff(collection, {
-            label: target.label,
-            diffText: diff.stdout,
-            truncated: diff.truncated,
-        });
-    }
-}
-/**
- * BLI-3551: the root is asked about once per pass, before either target, so a
- * pruned worktree costs ONE line instead of one per diff target per session per
- * tick — and the line says the folder is gone rather than accusing git of
- * failing. Both targets still get their own named gap.
- */
-function skipEveryDiffTargetForMissingRoot(collection) {
-    console.error("[raw-evidence] git diff skipped, repository root is no longer on disk", JSON.stringify({
-        reason: REPO_ROOT_MISSING_REASON,
-        diff_targets_skipped: GIT_DIFF_TARGETS.length,
-        next_action: "nothing to do; the diff returns when the worktree is restored or the session ages out",
-    }));
-    for (const target of GIT_DIFF_TARGETS) {
-        recordScanned(collection, "git_diff");
-        collection.skipped.push({
-            kind: "git_diff",
-            label: target.label,
-            reason: REPO_ROOT_MISSING_REASON,
-        });
-    }
-}
-/**
- * Run one diff, or record why it produced nothing. Null means the gap is
- * already named in the ledger, so the caller only has to move on.
- */
-async function runOneGitDiff(collection, target, repoRoot) {
-    try {
-        return await runGitDiff(target.args, repoRoot);
-    }
-    catch (error) {
-        // The root was there a moment ago and is not now (or a second collector
-        // pruned it mid-tick). Same named outcome, still not a git failure.
-        if (error instanceof RepoRootMissingError) {
-            collection.skipped.push({
-                kind: "git_diff",
-                label: target.label,
-                reason: REPO_ROOT_MISSING_REASON,
-            });
-            return null;
-        }
-        // `git_diff_failed` is the skip label and stays. It covers git not being
-        // installed, the folder not being a repo, a locked index and a diff that
-        // exceeded the child-process buffer — and the diff is half the evidence
-        // for what someone actually changed, so losing it quietly matters.
-        console.error("[raw-evidence] git diff failed", JSON.stringify({
-            reason: "git_diff_failed",
-            diff_target: target.label,
-            ...describeError(error),
-        }));
-        collection.skipped.push({
-            kind: "git_diff",
-            label: target.label,
-            reason: "git_diff_failed",
-        });
-        return null;
-    }
-}
-/** A diff that hit its size or time cap is partial evidence, and says so. */
-function recordGitDiffTruncation(collection, diff) {
-    markCapApplied(collection, "git_diff", diff.truncationCapType);
-    collection.truncated.push({
-        kind: "git_diff",
-        reason: diff.truncationReason,
-        ...(diff.truncationCapType === "max_bytes_per_diff"
-            ? { max_bytes: MAX_GIT_DIFF_BYTES }
-            : {}),
-        observed_bytes: diff.observedBytes,
-        included_bytes: Buffer.byteLength(diff.stdout, "utf8"),
-    });
-}
-async function stageOneGitDiff(collection, target) {
-    const sanitized = maskSecretsInGitDiff(collection, target);
-    const contentHash = sha256(sanitized.bytes);
-    if (collection.skipContentHashes.has(contentHash)) {
-        collection.reused.push({
-            kind: "git_diff",
-            label: target.label,
-            content_hash_sha256: contentHash,
-            codex_session_id: null,
-        });
-        return;
-    }
-    const deferReason = admitToBudget(collection.budget, sanitized.bytes.byteLength);
-    if (deferReason) {
-        markBudgetCapApplied(collection, deferReason);
-        collection.skipped.push({
-            kind: "git_diff",
-            label: target.label,
-            reason: deferReason,
-        });
-        return;
-    }
-    await writeGitDiffToPack(collection, { target, sanitized, contentHash });
-}
-/**
- * Mask secret-like values in a diff and record that it happened. A diff carries
- * whatever a person pasted into a config file, so this is the branch that most
- * often fires — and an operator has to see that the bytes went up altered.
- */
-function maskSecretsInGitDiff(collection, target) {
-    const sanitized = sanitizeTextEvidenceForUpload({
-        text: target.diffText,
-        redactedFields: [`git_diff.${target.label}`],
-    });
-    if (sanitized.status === "redacted") {
-        collection.redacted.push({
-            kind: "git_diff",
-            label: target.label,
-            redaction: sanitized.redaction,
-            completenessLabel: sanitized.completenessLabel,
-        });
-        console.error("[raw-evidence] git diff sanitized", JSON.stringify({
-            mode: sanitized.completenessLabel,
-            original_bytes: Buffer.byteLength(target.diffText, "utf8"),
-            uploaded_bytes: sanitized.bytes.byteLength,
-        }));
-    }
-    return sanitized;
-}
-/** Put an accepted diff's bytes on disk and add its manifest entry. */
-async function writeGitDiffToPack(collection, diff) {
-    const label = diff.target.label;
-    const relativePath = path.join("files", `git-${label}.diff`);
-    const diffSourceKey = evidenceSourceKey({
-        kind: "git_diff",
-        sessionId: collection.context.workContextId,
-        label,
-    });
-    const staged = await stageEvidenceBytes(collection, {
-        contentHash: diff.contentHash,
-        bytes: diff.sanitized.bytes,
-        fileName: path.basename(relativePath),
-        kind: "git_diff",
-        sourceKey: diffSourceKey,
-    });
-    collection.entries.push(evidenceEntry({
-        context: collection.context,
-        kind: "git_diff",
-        packId: collection.packId,
-        localPath: staged.local_path,
-        relativePath,
-        stagedInPack: staged.staged_in_pack,
-        sourceKey: diffSourceKey,
-        mediaType: "text/x-diff",
-        redactedSummary: gitDiffSummary(label, {
-            redacted: diff.sanitized.status === "redacted",
-            truncated: diff.target.truncated,
-        }),
-        redaction: diff.sanitized.redaction,
-        bytes: diff.sanitized.bytes,
-        contentAddress: `git-diff/${label}-${diff.contentHash.slice(0, 16)}.diff`,
-    }));
-}
-function gitDiffSummary(label, state) {
-    if (state.redacted) {
-        return `Raw git ${label} diff preserved locally with env/secret paths excluded and secret-like values deterministically redacted.`;
-    }
-    if (state.truncated) {
-        return `Raw git ${label} diff truncated to the capture cap and preserved locally with env/secret paths excluded.`;
-    }
-    return `Raw git ${label} diff preserved locally with env/secret paths excluded.`;
-}
-// ---------------------------------------------------------------------------
-// Walking the session store
-// ---------------------------------------------------------------------------
-/**
- * Newest-first `.jsonl` files under these directories, modified since `cutoffMs`.
- *
- * Secret-like directory and file names are never descended into or opened;
- * symlinked duplicates are collapsed by real path so one transcript reachable
- * two ways is collected once.
- */
-async function walkJsonlFiles(dir, cutoffMs) {
-    const out = [];
-    const stack = Array.isArray(dir) ? [...dir] : [dir];
-    const seen = new Set();
-    // Counted rather than logged per directory: a wide walk can hit many, and
-    // the useful signal is "N directories in the session store were skipped and
-    // here is the first reason", not N near-identical lines (BLI-3238).
-    let unreadableDirCount = 0;
-    let firstUnreadableDir = null;
-    while (stack.length > 0) {
-        const current = stack.pop();
-        if (!current || isSecretLikePath(current))
-            continue;
-        let entries;
-        try {
-            entries = await fs.readdir(current, { withFileTypes: true });
-        }
-        catch (error) {
-            // A directory that cannot be listed hides every session under it, and
-            // the walk's only visible effect is a smaller file count.
-            unreadableDirCount += 1;
-            firstUnreadableDir ??= describeError(error);
-            continue;
-        }
-        for (const entry of entries) {
-            const full = path.join(current, entry.name);
-            if (isSecretLikePath(full))
-                continue;
-            if (entry.isDirectory()) {
-                stack.push(full);
-                continue;
-            }
-            if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
-                continue;
-            const stat = await fs.stat(full);
-            if (stat.mtimeMs < cutoffMs)
-                continue;
-            const dedupeKey = await fs.realpath(full).catch(() => path.resolve(full));
-            if (seen.has(dedupeKey))
-                continue;
-            seen.add(dedupeKey);
-            out.push({ file: full, mtimeMs: stat.mtimeMs });
-        }
-    }
-    if (unreadableDirCount > 0) {
-        console.error("[raw-evidence] session-store directories skipped during the walk", JSON.stringify({
-            reason: "session_dir_unreadable",
-            unreadable_dir_count: unreadableDirCount,
-            found_file_count: out.length,
-            ...firstUnreadableDir,
-        }));
-    }
-    out.sort((a, b) => b.mtimeMs - a.mtimeMs);
-    return out.map((entry) => entry.file);
 }