@bli-cockpit/telemetry-core 0.1.1 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/common.d.ts +8 -0
- package/dist/common.js +7 -0
- package/dist/evidence-upload.d.ts +399 -0
- package/dist/evidence-upload.js +194 -0
- package/dist/index.d.ts +1 -0
- package/dist/index.js +1 -0
- package/dist/ingest-dto.d.ts +51 -1
- package/dist/local-config.d.ts +1 -0
- package/dist/local-config.js +4 -0
- package/dist/risk-flags.d.ts +7 -0
- package/dist/secret-guards.d.ts +25 -0
- package/dist/secret-guards.js +59 -7
- package/dist/source-adapter.d.ts +10 -1
- package/dist/work-context.d.ts +14 -0
- package/dist/work-context.js +7 -0
- package/package.json +1 -1
package/dist/common.d.ts
CHANGED
|
@@ -15,6 +15,7 @@ export declare const CaptureSourceSchema: z.ZodEnum<{
|
|
|
15
15
|
github_state: "github_state";
|
|
16
16
|
linear_state: "linear_state";
|
|
17
17
|
mcp_local: "mcp_local";
|
|
18
|
+
claude_jsonl: "claude_jsonl";
|
|
18
19
|
claude_hooks: "claude_hooks";
|
|
19
20
|
manual_event: "manual_event";
|
|
20
21
|
collector_runtime: "collector_runtime";
|
|
@@ -30,6 +31,7 @@ export declare const CaptureProvenanceSchema: z.ZodObject<{
|
|
|
30
31
|
github_state: "github_state";
|
|
31
32
|
linear_state: "linear_state";
|
|
32
33
|
mcp_local: "mcp_local";
|
|
34
|
+
claude_jsonl: "claude_jsonl";
|
|
33
35
|
claude_hooks: "claude_hooks";
|
|
34
36
|
manual_event: "manual_event";
|
|
35
37
|
collector_runtime: "collector_runtime";
|
|
@@ -38,6 +40,12 @@ export declare const CaptureProvenanceSchema: z.ZodObject<{
|
|
|
38
40
|
collector_version: z.ZodString;
|
|
39
41
|
repo: z.ZodString;
|
|
40
42
|
branch: z.ZodString;
|
|
43
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
44
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
45
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
46
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
47
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
48
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
41
49
|
operator_id: z.ZodString;
|
|
42
50
|
session_id: z.ZodString;
|
|
43
51
|
work_context_id: z.ZodString;
|
package/dist/common.js
CHANGED
|
@@ -22,6 +22,7 @@ export const CaptureSourceSchema = z.enum([
|
|
|
22
22
|
"github_state",
|
|
23
23
|
"linear_state",
|
|
24
24
|
"mcp_local",
|
|
25
|
+
"claude_jsonl",
|
|
25
26
|
"claude_hooks",
|
|
26
27
|
"manual_event",
|
|
27
28
|
"collector_runtime",
|
|
@@ -34,6 +35,12 @@ export const CaptureProvenanceSchema = z
|
|
|
34
35
|
collector_version: VersionStringSchema,
|
|
35
36
|
repo: NonEmptyStringSchema,
|
|
36
37
|
branch: NonEmptyStringSchema,
|
|
38
|
+
repo_label: NonEmptyStringSchema.optional(),
|
|
39
|
+
repo_fingerprint: NonEmptyStringSchema.optional(),
|
|
40
|
+
repo_origin_url: NonEmptyStringSchema.optional(),
|
|
41
|
+
worktree_label: NonEmptyStringSchema.optional(),
|
|
42
|
+
worktree_fingerprint: NonEmptyStringSchema.optional(),
|
|
43
|
+
worktree_is_primary: z.boolean().optional(),
|
|
37
44
|
operator_id: NonEmptyStringSchema,
|
|
38
45
|
session_id: NonEmptyStringSchema,
|
|
39
46
|
work_context_id: NonEmptyStringSchema,
|
|
@@ -0,0 +1,399 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
/**
|
|
3
|
+
* Chunked raw-evidence upload wire contract.
|
|
4
|
+
*
|
|
5
|
+
* Raw evidence bytes move in chunks small enough to clear serverless
|
|
6
|
+
* request-body limits (Vercel rejects bodies around 4.5MB). The server keeps a
|
|
7
|
+
* durable per-object ledger so interrupted uploads resume instead of
|
|
8
|
+
* re-sending bytes, and identical content is acknowledged without re-upload.
|
|
9
|
+
*/
|
|
10
|
+
export declare const RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES: number;
|
|
11
|
+
export declare const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES: number;
|
|
12
|
+
export declare const RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES: number;
|
|
13
|
+
export declare const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT = 64;
|
|
14
|
+
export declare const RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN = 25;
|
|
15
|
+
export declare const CODEX_SESSION_REPORT_MAX_SESSIONS = 200;
|
|
16
|
+
export declare const RawEvidenceUploadBeginObjectSchema: z.ZodObject<{
|
|
17
|
+
pointer: z.ZodObject<{
|
|
18
|
+
raw_evidence_pointer_id: z.ZodString;
|
|
19
|
+
privacy_classification: z.ZodEnum<{
|
|
20
|
+
local_only_raw_evidence: "local_only_raw_evidence";
|
|
21
|
+
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
22
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
23
|
+
}>;
|
|
24
|
+
retention_policy: z.ZodObject<{
|
|
25
|
+
mode: z.ZodEnum<{
|
|
26
|
+
local_only: "local_only";
|
|
27
|
+
remote_short_retention: "remote_short_retention";
|
|
28
|
+
remote_durable: "remote_durable";
|
|
29
|
+
}>;
|
|
30
|
+
privacy_classification: z.ZodEnum<{
|
|
31
|
+
local_only_raw_evidence: "local_only_raw_evidence";
|
|
32
|
+
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
33
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
34
|
+
}>;
|
|
35
|
+
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
36
|
+
expires_at: z.ZodOptional<z.ZodString>;
|
|
37
|
+
}, z.core.$strict>;
|
|
38
|
+
storage_scope: z.ZodEnum<{
|
|
39
|
+
local_file: "local_file";
|
|
40
|
+
remote_object: "remote_object";
|
|
41
|
+
}>;
|
|
42
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
43
|
+
local_path: z.ZodOptional<z.ZodString>;
|
|
44
|
+
object_key: z.ZodOptional<z.ZodString>;
|
|
45
|
+
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
46
|
+
byte_size: z.ZodOptional<z.ZodNumber>;
|
|
47
|
+
media_type: z.ZodOptional<z.ZodString>;
|
|
48
|
+
redacted_summary: z.ZodOptional<z.ZodString>;
|
|
49
|
+
}, z.core.$strict>;
|
|
50
|
+
chunk_size_bytes: z.ZodNumber;
|
|
51
|
+
chunk_count: z.ZodNumber;
|
|
52
|
+
}, z.core.$strict>;
|
|
53
|
+
export type RawEvidenceUploadBeginObject = z.infer<typeof RawEvidenceUploadBeginObjectSchema>;
|
|
54
|
+
export declare const RawEvidenceUploadBeginRequestSchema: z.ZodObject<{
|
|
55
|
+
schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-begin.v1">;
|
|
56
|
+
generated_at: z.ZodString;
|
|
57
|
+
provenance: z.ZodObject<{
|
|
58
|
+
capture_source: z.ZodEnum<{
|
|
59
|
+
unknown: "unknown";
|
|
60
|
+
codex_jsonl: "codex_jsonl";
|
|
61
|
+
codex_otel: "codex_otel";
|
|
62
|
+
car_state: "car_state";
|
|
63
|
+
git_state: "git_state";
|
|
64
|
+
github_state: "github_state";
|
|
65
|
+
linear_state: "linear_state";
|
|
66
|
+
mcp_local: "mcp_local";
|
|
67
|
+
claude_jsonl: "claude_jsonl";
|
|
68
|
+
claude_hooks: "claude_hooks";
|
|
69
|
+
manual_event: "manual_event";
|
|
70
|
+
collector_runtime: "collector_runtime";
|
|
71
|
+
}>;
|
|
72
|
+
capture_adapter_version: z.ZodString;
|
|
73
|
+
collector_version: z.ZodString;
|
|
74
|
+
repo: z.ZodString;
|
|
75
|
+
branch: z.ZodString;
|
|
76
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
77
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
78
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
79
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
80
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
81
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
82
|
+
operator_id: z.ZodString;
|
|
83
|
+
session_id: z.ZodString;
|
|
84
|
+
work_context_id: z.ZodString;
|
|
85
|
+
}, z.core.$strict>;
|
|
86
|
+
objects: z.ZodArray<z.ZodObject<{
|
|
87
|
+
pointer: z.ZodObject<{
|
|
88
|
+
raw_evidence_pointer_id: z.ZodString;
|
|
89
|
+
privacy_classification: z.ZodEnum<{
|
|
90
|
+
local_only_raw_evidence: "local_only_raw_evidence";
|
|
91
|
+
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
92
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
93
|
+
}>;
|
|
94
|
+
retention_policy: z.ZodObject<{
|
|
95
|
+
mode: z.ZodEnum<{
|
|
96
|
+
local_only: "local_only";
|
|
97
|
+
remote_short_retention: "remote_short_retention";
|
|
98
|
+
remote_durable: "remote_durable";
|
|
99
|
+
}>;
|
|
100
|
+
privacy_classification: z.ZodEnum<{
|
|
101
|
+
local_only_raw_evidence: "local_only_raw_evidence";
|
|
102
|
+
remote_short_retention_raw_evidence: "remote_short_retention_raw_evidence";
|
|
103
|
+
remote_durable_raw_evidence: "remote_durable_raw_evidence";
|
|
104
|
+
}>;
|
|
105
|
+
remote_retention_days: z.ZodOptional<z.ZodNumber>;
|
|
106
|
+
expires_at: z.ZodOptional<z.ZodString>;
|
|
107
|
+
}, z.core.$strict>;
|
|
108
|
+
storage_scope: z.ZodEnum<{
|
|
109
|
+
local_file: "local_file";
|
|
110
|
+
remote_object: "remote_object";
|
|
111
|
+
}>;
|
|
112
|
+
storage_bucket: z.ZodOptional<z.ZodString>;
|
|
113
|
+
local_path: z.ZodOptional<z.ZodString>;
|
|
114
|
+
object_key: z.ZodOptional<z.ZodString>;
|
|
115
|
+
content_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
116
|
+
byte_size: z.ZodOptional<z.ZodNumber>;
|
|
117
|
+
media_type: z.ZodOptional<z.ZodString>;
|
|
118
|
+
redacted_summary: z.ZodOptional<z.ZodString>;
|
|
119
|
+
}, z.core.$strict>;
|
|
120
|
+
chunk_size_bytes: z.ZodNumber;
|
|
121
|
+
chunk_count: z.ZodNumber;
|
|
122
|
+
}, z.core.$strict>>;
|
|
123
|
+
}, z.core.$strict>;
|
|
124
|
+
export type RawEvidenceUploadBeginRequest = z.infer<typeof RawEvidenceUploadBeginRequestSchema>;
|
|
125
|
+
export declare const RawEvidenceUploadDispositionSchema: z.ZodEnum<{
|
|
126
|
+
new: "new";
|
|
127
|
+
resume: "resume";
|
|
128
|
+
already_committed: "already_committed";
|
|
129
|
+
conflict: "conflict";
|
|
130
|
+
}>;
|
|
131
|
+
export type RawEvidenceUploadDisposition = z.infer<typeof RawEvidenceUploadDispositionSchema>;
|
|
132
|
+
export declare const RawEvidenceUploadBeginResponseObjectSchema: z.ZodObject<{
|
|
133
|
+
object_key: z.ZodString;
|
|
134
|
+
raw_evidence_pointer_id: z.ZodString;
|
|
135
|
+
disposition: z.ZodEnum<{
|
|
136
|
+
new: "new";
|
|
137
|
+
resume: "resume";
|
|
138
|
+
already_committed: "already_committed";
|
|
139
|
+
conflict: "conflict";
|
|
140
|
+
}>;
|
|
141
|
+
upload_id: z.ZodOptional<z.ZodString>;
|
|
142
|
+
received_chunk_indexes: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
|
|
143
|
+
reason: z.ZodOptional<z.ZodString>;
|
|
144
|
+
}, z.core.$strict>;
|
|
145
|
+
export type RawEvidenceUploadBeginResponseObject = z.infer<typeof RawEvidenceUploadBeginResponseObjectSchema>;
|
|
146
|
+
export declare const RawEvidenceUploadBeginResponseSchema: z.ZodObject<{
|
|
147
|
+
ok: z.ZodLiteral<true>;
|
|
148
|
+
objects: z.ZodArray<z.ZodObject<{
|
|
149
|
+
object_key: z.ZodString;
|
|
150
|
+
raw_evidence_pointer_id: z.ZodString;
|
|
151
|
+
disposition: z.ZodEnum<{
|
|
152
|
+
new: "new";
|
|
153
|
+
resume: "resume";
|
|
154
|
+
already_committed: "already_committed";
|
|
155
|
+
conflict: "conflict";
|
|
156
|
+
}>;
|
|
157
|
+
upload_id: z.ZodOptional<z.ZodString>;
|
|
158
|
+
received_chunk_indexes: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
|
|
159
|
+
reason: z.ZodOptional<z.ZodString>;
|
|
160
|
+
}, z.core.$strict>>;
|
|
161
|
+
}, z.core.$strict>;
|
|
162
|
+
export type RawEvidenceUploadBeginResponse = z.infer<typeof RawEvidenceUploadBeginResponseSchema>;
|
|
163
|
+
export declare const RawEvidenceUploadChunkRequestSchema: z.ZodObject<{
|
|
164
|
+
schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-chunk.v1">;
|
|
165
|
+
generated_at: z.ZodString;
|
|
166
|
+
provenance: z.ZodObject<{
|
|
167
|
+
capture_source: z.ZodEnum<{
|
|
168
|
+
unknown: "unknown";
|
|
169
|
+
codex_jsonl: "codex_jsonl";
|
|
170
|
+
codex_otel: "codex_otel";
|
|
171
|
+
car_state: "car_state";
|
|
172
|
+
git_state: "git_state";
|
|
173
|
+
github_state: "github_state";
|
|
174
|
+
linear_state: "linear_state";
|
|
175
|
+
mcp_local: "mcp_local";
|
|
176
|
+
claude_jsonl: "claude_jsonl";
|
|
177
|
+
claude_hooks: "claude_hooks";
|
|
178
|
+
manual_event: "manual_event";
|
|
179
|
+
collector_runtime: "collector_runtime";
|
|
180
|
+
}>;
|
|
181
|
+
capture_adapter_version: z.ZodString;
|
|
182
|
+
collector_version: z.ZodString;
|
|
183
|
+
repo: z.ZodString;
|
|
184
|
+
branch: z.ZodString;
|
|
185
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
186
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
187
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
188
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
189
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
190
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
191
|
+
operator_id: z.ZodString;
|
|
192
|
+
session_id: z.ZodString;
|
|
193
|
+
work_context_id: z.ZodString;
|
|
194
|
+
}, z.core.$strict>;
|
|
195
|
+
upload_id: z.ZodString;
|
|
196
|
+
object_key: z.ZodString;
|
|
197
|
+
chunk_index: z.ZodNumber;
|
|
198
|
+
chunk_count: z.ZodNumber;
|
|
199
|
+
chunk_hash_sha256: z.ZodString;
|
|
200
|
+
content_base64: z.ZodString;
|
|
201
|
+
}, z.core.$strict>;
|
|
202
|
+
export type RawEvidenceUploadChunkRequest = z.infer<typeof RawEvidenceUploadChunkRequestSchema>;
|
|
203
|
+
export declare const RawEvidenceUploadChunkResponseSchema: z.ZodObject<{
|
|
204
|
+
ok: z.ZodLiteral<true>;
|
|
205
|
+
upload_id: z.ZodString;
|
|
206
|
+
chunk_index: z.ZodNumber;
|
|
207
|
+
received_chunk_count: z.ZodNumber;
|
|
208
|
+
}, z.core.$strict>;
|
|
209
|
+
export type RawEvidenceUploadChunkResponse = z.infer<typeof RawEvidenceUploadChunkResponseSchema>;
|
|
210
|
+
export declare const RawEvidenceUploadCommitRequestSchema: z.ZodObject<{
|
|
211
|
+
schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-commit.v1">;
|
|
212
|
+
generated_at: z.ZodString;
|
|
213
|
+
provenance: z.ZodObject<{
|
|
214
|
+
capture_source: z.ZodEnum<{
|
|
215
|
+
unknown: "unknown";
|
|
216
|
+
codex_jsonl: "codex_jsonl";
|
|
217
|
+
codex_otel: "codex_otel";
|
|
218
|
+
car_state: "car_state";
|
|
219
|
+
git_state: "git_state";
|
|
220
|
+
github_state: "github_state";
|
|
221
|
+
linear_state: "linear_state";
|
|
222
|
+
mcp_local: "mcp_local";
|
|
223
|
+
claude_jsonl: "claude_jsonl";
|
|
224
|
+
claude_hooks: "claude_hooks";
|
|
225
|
+
manual_event: "manual_event";
|
|
226
|
+
collector_runtime: "collector_runtime";
|
|
227
|
+
}>;
|
|
228
|
+
capture_adapter_version: z.ZodString;
|
|
229
|
+
collector_version: z.ZodString;
|
|
230
|
+
repo: z.ZodString;
|
|
231
|
+
branch: z.ZodString;
|
|
232
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
233
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
234
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
235
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
236
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
237
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
238
|
+
operator_id: z.ZodString;
|
|
239
|
+
session_id: z.ZodString;
|
|
240
|
+
work_context_id: z.ZodString;
|
|
241
|
+
}, z.core.$strict>;
|
|
242
|
+
upload_id: z.ZodString;
|
|
243
|
+
object_key: z.ZodString;
|
|
244
|
+
}, z.core.$strict>;
|
|
245
|
+
export type RawEvidenceUploadCommitRequest = z.infer<typeof RawEvidenceUploadCommitRequestSchema>;
|
|
246
|
+
export declare const RawEvidenceUploadCommitResponseSchema: z.ZodObject<{
|
|
247
|
+
ok: z.ZodLiteral<true>;
|
|
248
|
+
status: z.ZodEnum<{
|
|
249
|
+
already_committed: "already_committed";
|
|
250
|
+
committed: "committed";
|
|
251
|
+
}>;
|
|
252
|
+
object_key: z.ZodString;
|
|
253
|
+
content_hash_sha256: z.ZodString;
|
|
254
|
+
byte_size: z.ZodNumber;
|
|
255
|
+
chunk_count: z.ZodNumber;
|
|
256
|
+
}, z.core.$strict>;
|
|
257
|
+
export type RawEvidenceUploadCommitResponse = z.infer<typeof RawEvidenceUploadCommitResponseSchema>;
|
|
258
|
+
/**
|
|
259
|
+
* Codex session attribution report.
|
|
260
|
+
*
|
|
261
|
+
* The collector attributes Codex session JSONL files to repos/worktrees with
|
|
262
|
+
* deterministic metadata signals. Sessions that cannot be attributed are
|
|
263
|
+
* reported here with reason labels and safe pointers (session id, file hash,
|
|
264
|
+
* cwd basename/hash) instead of being duplicated into every repo's evidence
|
|
265
|
+
* pack or silently dropped. No content-bearing fields are allowed.
|
|
266
|
+
*/
|
|
267
|
+
export declare const CodexSessionAttributionStateSchema: z.ZodEnum<{
|
|
268
|
+
attributed: "attributed";
|
|
269
|
+
ambiguous: "ambiguous";
|
|
270
|
+
unattributed: "unattributed";
|
|
271
|
+
skipped: "skipped";
|
|
272
|
+
}>;
|
|
273
|
+
export type CodexSessionAttributionState = z.infer<typeof CodexSessionAttributionStateSchema>;
|
|
274
|
+
export declare const CodexSessionUploadStateSchema: z.ZodEnum<{
|
|
275
|
+
uploaded: "uploaded";
|
|
276
|
+
reused_existing: "reused_existing";
|
|
277
|
+
upload_failed: "upload_failed";
|
|
278
|
+
not_uploaded: "not_uploaded";
|
|
279
|
+
}>;
|
|
280
|
+
export type CodexSessionUploadState = z.infer<typeof CodexSessionUploadStateSchema>;
|
|
281
|
+
/**
|
|
282
|
+
* The agent that produced a session transcript. `codex_session_id` keeps its
|
|
283
|
+
* historical name across sources; `source` disambiguates. Defaulting to
|
|
284
|
+
* `"codex"` keeps already-published CLI versions (which never send the field)
|
|
285
|
+
* working unchanged after this schema lands.
|
|
286
|
+
*/
|
|
287
|
+
export declare const AgentSessionSourceSchema: z.ZodDefault<z.ZodEnum<{
|
|
288
|
+
codex: "codex";
|
|
289
|
+
claude_code: "claude_code";
|
|
290
|
+
}>>;
|
|
291
|
+
export type AgentSessionSource = z.infer<typeof AgentSessionSourceSchema>;
|
|
292
|
+
export declare const CodexSessionAttributionSchema: z.ZodObject<{
|
|
293
|
+
codex_session_id: z.ZodString;
|
|
294
|
+
source: z.ZodDefault<z.ZodEnum<{
|
|
295
|
+
codex: "codex";
|
|
296
|
+
claude_code: "claude_code";
|
|
297
|
+
}>>;
|
|
298
|
+
observed_at: z.ZodString;
|
|
299
|
+
attribution_state: z.ZodEnum<{
|
|
300
|
+
attributed: "attributed";
|
|
301
|
+
ambiguous: "ambiguous";
|
|
302
|
+
unattributed: "unattributed";
|
|
303
|
+
skipped: "skipped";
|
|
304
|
+
}>;
|
|
305
|
+
attribution_reason: z.ZodString;
|
|
306
|
+
attribution_score: z.ZodOptional<z.ZodNumber>;
|
|
307
|
+
path_score: z.ZodOptional<z.ZodNumber>;
|
|
308
|
+
signals: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
309
|
+
session_file_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
310
|
+
session_file_byte_size: z.ZodOptional<z.ZodNumber>;
|
|
311
|
+
session_file_mtime: z.ZodOptional<z.ZodString>;
|
|
312
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
313
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
314
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
315
|
+
branch: z.ZodOptional<z.ZodString>;
|
|
316
|
+
cwd_basename: z.ZodOptional<z.ZodString>;
|
|
317
|
+
cwd_hash: z.ZodOptional<z.ZodString>;
|
|
318
|
+
raw_evidence_pointer_id: z.ZodOptional<z.ZodString>;
|
|
319
|
+
upload_state: z.ZodOptional<z.ZodEnum<{
|
|
320
|
+
uploaded: "uploaded";
|
|
321
|
+
reused_existing: "reused_existing";
|
|
322
|
+
upload_failed: "upload_failed";
|
|
323
|
+
not_uploaded: "not_uploaded";
|
|
324
|
+
}>>;
|
|
325
|
+
}, z.core.$strict>;
|
|
326
|
+
export type CodexSessionAttribution = z.infer<typeof CodexSessionAttributionSchema>;
|
|
327
|
+
export declare const CodexSessionAttributionReportRequestSchema: z.ZodObject<{
|
|
328
|
+
schema_version: z.ZodLiteral<"ambient-codex-session-attributions.v1">;
|
|
329
|
+
generated_at: z.ZodString;
|
|
330
|
+
provenance: z.ZodObject<{
|
|
331
|
+
capture_source: z.ZodEnum<{
|
|
332
|
+
unknown: "unknown";
|
|
333
|
+
codex_jsonl: "codex_jsonl";
|
|
334
|
+
codex_otel: "codex_otel";
|
|
335
|
+
car_state: "car_state";
|
|
336
|
+
git_state: "git_state";
|
|
337
|
+
github_state: "github_state";
|
|
338
|
+
linear_state: "linear_state";
|
|
339
|
+
mcp_local: "mcp_local";
|
|
340
|
+
claude_jsonl: "claude_jsonl";
|
|
341
|
+
claude_hooks: "claude_hooks";
|
|
342
|
+
manual_event: "manual_event";
|
|
343
|
+
collector_runtime: "collector_runtime";
|
|
344
|
+
}>;
|
|
345
|
+
capture_adapter_version: z.ZodString;
|
|
346
|
+
collector_version: z.ZodString;
|
|
347
|
+
repo: z.ZodString;
|
|
348
|
+
branch: z.ZodString;
|
|
349
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
350
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
351
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
352
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
353
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
354
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
355
|
+
operator_id: z.ZodString;
|
|
356
|
+
session_id: z.ZodString;
|
|
357
|
+
work_context_id: z.ZodString;
|
|
358
|
+
}, z.core.$strict>;
|
|
359
|
+
sessions: z.ZodArray<z.ZodObject<{
|
|
360
|
+
codex_session_id: z.ZodString;
|
|
361
|
+
source: z.ZodDefault<z.ZodEnum<{
|
|
362
|
+
codex: "codex";
|
|
363
|
+
claude_code: "claude_code";
|
|
364
|
+
}>>;
|
|
365
|
+
observed_at: z.ZodString;
|
|
366
|
+
attribution_state: z.ZodEnum<{
|
|
367
|
+
attributed: "attributed";
|
|
368
|
+
ambiguous: "ambiguous";
|
|
369
|
+
unattributed: "unattributed";
|
|
370
|
+
skipped: "skipped";
|
|
371
|
+
}>;
|
|
372
|
+
attribution_reason: z.ZodString;
|
|
373
|
+
attribution_score: z.ZodOptional<z.ZodNumber>;
|
|
374
|
+
path_score: z.ZodOptional<z.ZodNumber>;
|
|
375
|
+
signals: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
376
|
+
session_file_hash_sha256: z.ZodOptional<z.ZodString>;
|
|
377
|
+
session_file_byte_size: z.ZodOptional<z.ZodNumber>;
|
|
378
|
+
session_file_mtime: z.ZodOptional<z.ZodString>;
|
|
379
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
380
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
381
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
382
|
+
branch: z.ZodOptional<z.ZodString>;
|
|
383
|
+
cwd_basename: z.ZodOptional<z.ZodString>;
|
|
384
|
+
cwd_hash: z.ZodOptional<z.ZodString>;
|
|
385
|
+
raw_evidence_pointer_id: z.ZodOptional<z.ZodString>;
|
|
386
|
+
upload_state: z.ZodOptional<z.ZodEnum<{
|
|
387
|
+
uploaded: "uploaded";
|
|
388
|
+
reused_existing: "reused_existing";
|
|
389
|
+
upload_failed: "upload_failed";
|
|
390
|
+
not_uploaded: "not_uploaded";
|
|
391
|
+
}>>;
|
|
392
|
+
}, z.core.$strict>>;
|
|
393
|
+
}, z.core.$strict>;
|
|
394
|
+
export type CodexSessionAttributionReportRequest = z.infer<typeof CodexSessionAttributionReportRequestSchema>;
|
|
395
|
+
export declare const CodexSessionAttributionReportResponseSchema: z.ZodObject<{
|
|
396
|
+
ok: z.ZodLiteral<true>;
|
|
397
|
+
recorded_count: z.ZodNumber;
|
|
398
|
+
}, z.core.$strict>;
|
|
399
|
+
export type CodexSessionAttributionReportResponse = z.infer<typeof CodexSessionAttributionReportResponseSchema>;
|
|
@@ -0,0 +1,194 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
import { CaptureProvenanceSchema, IsoDateTimeSchema, NonEmptyStringSchema, Sha256Schema, } from "./common.js";
|
|
3
|
+
import { RawEvidencePointerSchema } from "./privacy.js";
|
|
4
|
+
/**
|
|
5
|
+
* Chunked raw-evidence upload wire contract.
|
|
6
|
+
*
|
|
7
|
+
* Raw evidence bytes move in chunks small enough to clear serverless
|
|
8
|
+
* request-body limits (Vercel rejects bodies around 4.5MB). The server keeps a
|
|
9
|
+
* durable per-object ledger so interrupted uploads resume instead of
|
|
10
|
+
* re-sending bytes, and identical content is acknowledged without re-upload.
|
|
11
|
+
*/
|
|
12
|
+
export const RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES = 10 * 1024 * 1024;
|
|
13
|
+
export const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES = 3 * 1024 * 1024;
|
|
14
|
+
export const RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES = 2 * 1024 * 1024;
|
|
15
|
+
export const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT = 64;
|
|
16
|
+
export const RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN = 25;
|
|
17
|
+
export const CODEX_SESSION_REPORT_MAX_SESSIONS = 200;
|
|
18
|
+
const SafeLabelSchema = z
|
|
19
|
+
.string()
|
|
20
|
+
.trim()
|
|
21
|
+
.min(1)
|
|
22
|
+
.max(120)
|
|
23
|
+
.regex(/^[a-z0-9_:.-]+$/i);
|
|
24
|
+
const BasenameSchema = z
|
|
25
|
+
.string()
|
|
26
|
+
.trim()
|
|
27
|
+
.min(1)
|
|
28
|
+
.max(160)
|
|
29
|
+
.regex(/^[^/\\]+$/);
|
|
30
|
+
export const RawEvidenceUploadBeginObjectSchema = z
|
|
31
|
+
.object({
|
|
32
|
+
pointer: RawEvidencePointerSchema,
|
|
33
|
+
chunk_size_bytes: z
|
|
34
|
+
.number()
|
|
35
|
+
.int()
|
|
36
|
+
.positive()
|
|
37
|
+
.max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_BYTES),
|
|
38
|
+
chunk_count: z
|
|
39
|
+
.number()
|
|
40
|
+
.int()
|
|
41
|
+
.positive()
|
|
42
|
+
.max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT),
|
|
43
|
+
})
|
|
44
|
+
.strict();
|
|
45
|
+
export const RawEvidenceUploadBeginRequestSchema = z
|
|
46
|
+
.object({
|
|
47
|
+
schema_version: z.literal("ambient-raw-evidence-upload-begin.v1"),
|
|
48
|
+
generated_at: IsoDateTimeSchema,
|
|
49
|
+
provenance: CaptureProvenanceSchema,
|
|
50
|
+
objects: z
|
|
51
|
+
.array(RawEvidenceUploadBeginObjectSchema)
|
|
52
|
+
.min(1)
|
|
53
|
+
.max(RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN),
|
|
54
|
+
})
|
|
55
|
+
.strict();
|
|
56
|
+
export const RawEvidenceUploadDispositionSchema = z.enum([
|
|
57
|
+
"new",
|
|
58
|
+
"resume",
|
|
59
|
+
"already_committed",
|
|
60
|
+
"conflict",
|
|
61
|
+
]);
|
|
62
|
+
export const RawEvidenceUploadBeginResponseObjectSchema = z
|
|
63
|
+
.object({
|
|
64
|
+
object_key: NonEmptyStringSchema,
|
|
65
|
+
raw_evidence_pointer_id: NonEmptyStringSchema,
|
|
66
|
+
disposition: RawEvidenceUploadDispositionSchema,
|
|
67
|
+
upload_id: NonEmptyStringSchema.optional(),
|
|
68
|
+
received_chunk_indexes: z.array(z.number().int().nonnegative()).default([]),
|
|
69
|
+
reason: SafeLabelSchema.optional(),
|
|
70
|
+
})
|
|
71
|
+
.strict();
|
|
72
|
+
export const RawEvidenceUploadBeginResponseSchema = z
|
|
73
|
+
.object({
|
|
74
|
+
ok: z.literal(true),
|
|
75
|
+
objects: z.array(RawEvidenceUploadBeginResponseObjectSchema),
|
|
76
|
+
})
|
|
77
|
+
.strict();
|
|
78
|
+
export const RawEvidenceUploadChunkRequestSchema = z
|
|
79
|
+
.object({
|
|
80
|
+
schema_version: z.literal("ambient-raw-evidence-upload-chunk.v1"),
|
|
81
|
+
generated_at: IsoDateTimeSchema,
|
|
82
|
+
provenance: CaptureProvenanceSchema,
|
|
83
|
+
upload_id: NonEmptyStringSchema,
|
|
84
|
+
object_key: NonEmptyStringSchema,
|
|
85
|
+
chunk_index: z.number().int().nonnegative(),
|
|
86
|
+
chunk_count: z
|
|
87
|
+
.number()
|
|
88
|
+
.int()
|
|
89
|
+
.positive()
|
|
90
|
+
.max(RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT),
|
|
91
|
+
chunk_hash_sha256: Sha256Schema,
|
|
92
|
+
content_base64: z.string().min(1),
|
|
93
|
+
})
|
|
94
|
+
.strict();
|
|
95
|
+
export const RawEvidenceUploadChunkResponseSchema = z
|
|
96
|
+
.object({
|
|
97
|
+
ok: z.literal(true),
|
|
98
|
+
upload_id: NonEmptyStringSchema,
|
|
99
|
+
chunk_index: z.number().int().nonnegative(),
|
|
100
|
+
received_chunk_count: z.number().int().nonnegative(),
|
|
101
|
+
})
|
|
102
|
+
.strict();
|
|
103
|
+
export const RawEvidenceUploadCommitRequestSchema = z
|
|
104
|
+
.object({
|
|
105
|
+
schema_version: z.literal("ambient-raw-evidence-upload-commit.v1"),
|
|
106
|
+
generated_at: IsoDateTimeSchema,
|
|
107
|
+
provenance: CaptureProvenanceSchema,
|
|
108
|
+
upload_id: NonEmptyStringSchema,
|
|
109
|
+
object_key: NonEmptyStringSchema,
|
|
110
|
+
})
|
|
111
|
+
.strict();
|
|
112
|
+
export const RawEvidenceUploadCommitResponseSchema = z
|
|
113
|
+
.object({
|
|
114
|
+
ok: z.literal(true),
|
|
115
|
+
status: z.enum(["committed", "already_committed"]),
|
|
116
|
+
object_key: NonEmptyStringSchema,
|
|
117
|
+
content_hash_sha256: Sha256Schema,
|
|
118
|
+
byte_size: z.number().int().nonnegative(),
|
|
119
|
+
chunk_count: z.number().int().nonnegative(),
|
|
120
|
+
})
|
|
121
|
+
.strict();
|
|
122
|
+
/**
|
|
123
|
+
* Codex session attribution report.
|
|
124
|
+
*
|
|
125
|
+
* The collector attributes Codex session JSONL files to repos/worktrees with
|
|
126
|
+
* deterministic metadata signals. Sessions that cannot be attributed are
|
|
127
|
+
* reported here with reason labels and safe pointers (session id, file hash,
|
|
128
|
+
* cwd basename/hash) instead of being duplicated into every repo's evidence
|
|
129
|
+
* pack or silently dropped. No content-bearing fields are allowed.
|
|
130
|
+
*/
|
|
131
|
+
export const CodexSessionAttributionStateSchema = z.enum([
|
|
132
|
+
"attributed",
|
|
133
|
+
"ambiguous",
|
|
134
|
+
"unattributed",
|
|
135
|
+
"skipped",
|
|
136
|
+
]);
|
|
137
|
+
export const CodexSessionUploadStateSchema = z.enum([
|
|
138
|
+
"uploaded",
|
|
139
|
+
"reused_existing",
|
|
140
|
+
"upload_failed",
|
|
141
|
+
"not_uploaded",
|
|
142
|
+
]);
|
|
143
|
+
/**
|
|
144
|
+
* The agent that produced a session transcript. `codex_session_id` keeps its
|
|
145
|
+
* historical name across sources; `source` disambiguates. Defaulting to
|
|
146
|
+
* `"codex"` keeps already-published CLI versions (which never send the field)
|
|
147
|
+
* working unchanged after this schema lands.
|
|
148
|
+
*/
|
|
149
|
+
export const AgentSessionSourceSchema = z
|
|
150
|
+
.enum(["codex", "claude_code"])
|
|
151
|
+
.default("codex");
|
|
152
|
+
export const CodexSessionAttributionSchema = z
|
|
153
|
+
.object({
|
|
154
|
+
codex_session_id: NonEmptyStringSchema.max(120),
|
|
155
|
+
source: AgentSessionSourceSchema,
|
|
156
|
+
observed_at: IsoDateTimeSchema,
|
|
157
|
+
attribution_state: CodexSessionAttributionStateSchema,
|
|
158
|
+
attribution_reason: SafeLabelSchema,
|
|
159
|
+
attribution_score: z.number().min(0).max(1).optional(),
|
|
160
|
+
path_score: z.number().min(0).max(1).optional(),
|
|
161
|
+
signals: z.array(SafeLabelSchema).max(20).default([]),
|
|
162
|
+
session_file_hash_sha256: Sha256Schema.optional(),
|
|
163
|
+
session_file_byte_size: z.number().int().nonnegative().optional(),
|
|
164
|
+
session_file_mtime: IsoDateTimeSchema.optional(),
|
|
165
|
+
repo_fingerprint: SafeLabelSchema.optional(),
|
|
166
|
+
worktree_fingerprint: SafeLabelSchema.optional(),
|
|
167
|
+
repo_label: BasenameSchema.optional(),
|
|
168
|
+
branch: z.string().trim().min(1).max(200).optional(),
|
|
169
|
+
cwd_basename: BasenameSchema.optional(),
|
|
170
|
+
cwd_hash: z
|
|
171
|
+
.string()
|
|
172
|
+
.regex(/^[a-f0-9]{16,64}$/)
|
|
173
|
+
.optional(),
|
|
174
|
+
raw_evidence_pointer_id: NonEmptyStringSchema.optional(),
|
|
175
|
+
upload_state: CodexSessionUploadStateSchema.optional(),
|
|
176
|
+
})
|
|
177
|
+
.strict();
|
|
178
|
+
export const CodexSessionAttributionReportRequestSchema = z
|
|
179
|
+
.object({
|
|
180
|
+
schema_version: z.literal("ambient-codex-session-attributions.v1"),
|
|
181
|
+
generated_at: IsoDateTimeSchema,
|
|
182
|
+
provenance: CaptureProvenanceSchema,
|
|
183
|
+
sessions: z
|
|
184
|
+
.array(CodexSessionAttributionSchema)
|
|
185
|
+
.min(1)
|
|
186
|
+
.max(CODEX_SESSION_REPORT_MAX_SESSIONS),
|
|
187
|
+
})
|
|
188
|
+
.strict();
|
|
189
|
+
export const CodexSessionAttributionReportResponseSchema = z
|
|
190
|
+
.object({
|
|
191
|
+
ok: z.literal(true),
|
|
192
|
+
recorded_count: z.number().int().nonnegative(),
|
|
193
|
+
})
|
|
194
|
+
.strict();
|
package/dist/index.d.ts
CHANGED
package/dist/index.js
CHANGED
package/dist/ingest-dto.d.ts
CHANGED
|
@@ -39,6 +39,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
39
39
|
github_state: "github_state";
|
|
40
40
|
linear_state: "linear_state";
|
|
41
41
|
mcp_local: "mcp_local";
|
|
42
|
+
claude_jsonl: "claude_jsonl";
|
|
42
43
|
claude_hooks: "claude_hooks";
|
|
43
44
|
manual_event: "manual_event";
|
|
44
45
|
collector_runtime: "collector_runtime";
|
|
@@ -47,6 +48,12 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
47
48
|
collector_version: z.ZodString;
|
|
48
49
|
repo: z.ZodString;
|
|
49
50
|
branch: z.ZodString;
|
|
51
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
52
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
53
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
54
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
55
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
56
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
50
57
|
operator_id: z.ZodString;
|
|
51
58
|
session_id: z.ZodString;
|
|
52
59
|
work_context_id: z.ZodString;
|
|
@@ -148,6 +155,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
148
155
|
github_state: "github_state";
|
|
149
156
|
linear_state: "linear_state";
|
|
150
157
|
mcp_local: "mcp_local";
|
|
158
|
+
claude_jsonl: "claude_jsonl";
|
|
151
159
|
claude_hooks: "claude_hooks";
|
|
152
160
|
manual_event: "manual_event";
|
|
153
161
|
collector_runtime: "collector_runtime";
|
|
@@ -156,6 +164,12 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
|
|
|
156
164
|
collector_version: z.ZodString;
|
|
157
165
|
repo: z.ZodString;
|
|
158
166
|
branch: z.ZodString;
|
|
167
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
168
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
169
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
170
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
171
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
172
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
159
173
|
operator_id: z.ZodString;
|
|
160
174
|
session_id: z.ZodString;
|
|
161
175
|
work_context_id: z.ZodString;
|
|
@@ -264,6 +278,13 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
264
278
|
work_context_id: z.ZodString;
|
|
265
279
|
repo: z.ZodString;
|
|
266
280
|
branch: z.ZodString;
|
|
281
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
282
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
283
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
284
|
+
head_sha: z.ZodOptional<z.ZodString>;
|
|
285
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
286
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
287
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
267
288
|
operator_id: z.ZodString;
|
|
268
289
|
session_id: z.ZodString;
|
|
269
290
|
started_at: z.ZodString;
|
|
@@ -295,6 +316,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
295
316
|
github_state: "github_state";
|
|
296
317
|
linear_state: "linear_state";
|
|
297
318
|
mcp_local: "mcp_local";
|
|
319
|
+
claude_jsonl: "claude_jsonl";
|
|
298
320
|
claude_hooks: "claude_hooks";
|
|
299
321
|
manual_event: "manual_event";
|
|
300
322
|
collector_runtime: "collector_runtime";
|
|
@@ -303,6 +325,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
303
325
|
collector_version: z.ZodString;
|
|
304
326
|
repo: z.ZodString;
|
|
305
327
|
branch: z.ZodString;
|
|
328
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
329
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
330
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
331
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
332
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
333
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
306
334
|
operator_id: z.ZodString;
|
|
307
335
|
session_id: z.ZodString;
|
|
308
336
|
work_context_id: z.ZodString;
|
|
@@ -334,6 +362,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
334
362
|
github_state: "github_state";
|
|
335
363
|
linear_state: "linear_state";
|
|
336
364
|
mcp_local: "mcp_local";
|
|
365
|
+
claude_jsonl: "claude_jsonl";
|
|
337
366
|
claude_hooks: "claude_hooks";
|
|
338
367
|
manual_event: "manual_event";
|
|
339
368
|
collector_runtime: "collector_runtime";
|
|
@@ -342,6 +371,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
342
371
|
collector_version: z.ZodString;
|
|
343
372
|
repo: z.ZodString;
|
|
344
373
|
branch: z.ZodString;
|
|
374
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
375
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
376
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
377
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
378
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
379
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
345
380
|
operator_id: z.ZodString;
|
|
346
381
|
session_id: z.ZodString;
|
|
347
382
|
work_context_id: z.ZodString;
|
|
@@ -443,6 +478,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
443
478
|
github_state: "github_state";
|
|
444
479
|
linear_state: "linear_state";
|
|
445
480
|
mcp_local: "mcp_local";
|
|
481
|
+
claude_jsonl: "claude_jsonl";
|
|
446
482
|
claude_hooks: "claude_hooks";
|
|
447
483
|
manual_event: "manual_event";
|
|
448
484
|
collector_runtime: "collector_runtime";
|
|
@@ -451,6 +487,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
451
487
|
collector_version: z.ZodString;
|
|
452
488
|
repo: z.ZodString;
|
|
453
489
|
branch: z.ZodString;
|
|
490
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
491
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
492
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
493
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
494
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
495
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
454
496
|
operator_id: z.ZodString;
|
|
455
497
|
session_id: z.ZodString;
|
|
456
498
|
work_context_id: z.ZodString;
|
|
@@ -538,6 +580,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
538
580
|
github_state: "github_state";
|
|
539
581
|
linear_state: "linear_state";
|
|
540
582
|
mcp_local: "mcp_local";
|
|
583
|
+
claude_jsonl: "claude_jsonl";
|
|
541
584
|
claude_hooks: "claude_hooks";
|
|
542
585
|
manual_event: "manual_event";
|
|
543
586
|
collector_runtime: "collector_runtime";
|
|
@@ -548,8 +591,8 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
548
591
|
work_context_id: z.ZodOptional<z.ZodString>;
|
|
549
592
|
status: z.ZodEnum<{
|
|
550
593
|
ok: "ok";
|
|
551
|
-
partial: "partial";
|
|
552
594
|
skipped: "skipped";
|
|
595
|
+
partial: "partial";
|
|
553
596
|
failed: "failed";
|
|
554
597
|
}>;
|
|
555
598
|
started_at: z.ZodString;
|
|
@@ -680,6 +723,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
680
723
|
github_state: "github_state";
|
|
681
724
|
linear_state: "linear_state";
|
|
682
725
|
mcp_local: "mcp_local";
|
|
726
|
+
claude_jsonl: "claude_jsonl";
|
|
683
727
|
claude_hooks: "claude_hooks";
|
|
684
728
|
manual_event: "manual_event";
|
|
685
729
|
collector_runtime: "collector_runtime";
|
|
@@ -688,6 +732,12 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
|
|
|
688
732
|
collector_version: z.ZodString;
|
|
689
733
|
repo: z.ZodString;
|
|
690
734
|
branch: z.ZodString;
|
|
735
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
736
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
737
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
738
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
739
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
740
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
691
741
|
operator_id: z.ZodString;
|
|
692
742
|
session_id: z.ZodString;
|
|
693
743
|
work_context_id: z.ZodString;
|
package/dist/local-config.d.ts
CHANGED
|
@@ -14,6 +14,7 @@ export declare const LocalCollectorConfigSchema: z.ZodObject<{
|
|
|
14
14
|
remote_short_retention_opt_in: "remote_short_retention_opt_in";
|
|
15
15
|
remote_durable_opt_in: "remote_durable_opt_in";
|
|
16
16
|
}>>;
|
|
17
|
+
collect_claude_jsonl: z.ZodDefault<z.ZodBoolean>;
|
|
17
18
|
session_file_path: z.ZodOptional<z.ZodString>;
|
|
18
19
|
state_dir_path: z.ZodOptional<z.ZodString>;
|
|
19
20
|
}, z.core.$strict>;
|
package/dist/local-config.js
CHANGED
|
@@ -18,6 +18,10 @@ export const LocalCollectorConfigSchema = z
|
|
|
18
18
|
"remote_durable_opt_in",
|
|
19
19
|
])
|
|
20
20
|
.default("remote_durable_opt_in"),
|
|
21
|
+
// Per-machine escape hatch (D31): promoting the CLI to `latest` enables
|
|
22
|
+
// Claude transcript harvesting fleet-wide, so an operator can opt a single
|
|
23
|
+
// machine out without a version pin. Defaults on.
|
|
24
|
+
collect_claude_jsonl: z.boolean().default(true),
|
|
21
25
|
session_file_path: NonEmptyStringSchema.optional(),
|
|
22
26
|
state_dir_path: NonEmptyStringSchema.optional(),
|
|
23
27
|
})
|
package/dist/risk-flags.d.ts
CHANGED
|
@@ -86,6 +86,7 @@ export declare const RiskFlagSchema: z.ZodObject<{
|
|
|
86
86
|
github_state: "github_state";
|
|
87
87
|
linear_state: "linear_state";
|
|
88
88
|
mcp_local: "mcp_local";
|
|
89
|
+
claude_jsonl: "claude_jsonl";
|
|
89
90
|
claude_hooks: "claude_hooks";
|
|
90
91
|
manual_event: "manual_event";
|
|
91
92
|
collector_runtime: "collector_runtime";
|
|
@@ -94,6 +95,12 @@ export declare const RiskFlagSchema: z.ZodObject<{
|
|
|
94
95
|
collector_version: z.ZodString;
|
|
95
96
|
repo: z.ZodString;
|
|
96
97
|
branch: z.ZodString;
|
|
98
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
99
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
100
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
101
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
102
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
103
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
97
104
|
operator_id: z.ZodString;
|
|
98
105
|
session_id: z.ZodString;
|
|
99
106
|
work_context_id: z.ZodString;
|
package/dist/secret-guards.d.ts
CHANGED
|
@@ -1 +1,26 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Secret-like content + file-name guards shared by the local collector
|
|
3
|
+
* (attribution, collection) and the dashboard commit-time guard. Keeping a
|
|
4
|
+
* single home means the client and server agree on exactly which transcripts
|
|
5
|
+
* are skipped.
|
|
6
|
+
*
|
|
7
|
+
* D13 precision: prose-shaped credential NAMES (SERVICE_ROLE, SUPABASE_ANON_KEY,
|
|
8
|
+
* LANGFUSE_*_KEY, api_key, ...) only trip the content guard when they carry an
|
|
9
|
+
* assignment + a value. A bare keyword in source code, a SQL grant, a migration
|
|
10
|
+
* comment, or a runbook is not a leak — and flagging it would skip every session
|
|
11
|
+
* that merely READ a cockpit source file, which is differential censoring
|
|
12
|
+
* correlated with repo and task type (the cockpit-development sessions the
|
|
13
|
+
* harvest cares most about). Value-shaped tokens (JWT, sk-, ghp_, PEM blocks,
|
|
14
|
+
* AWS key ids, Slack/Linear/Langfuse tokens) are self-identifying and stay
|
|
15
|
+
* blocked regardless of surrounding context.
|
|
16
|
+
*/
|
|
17
|
+
/**
|
|
18
|
+
* File-path / file-name segments that must never be read at all. This is a
|
|
19
|
+
* NAME matcher (it never reads file content), so it stays broad: a file called
|
|
20
|
+
* `service-role.json` or a dotenv file is skipped on its name alone. The
|
|
21
|
+
* collector imports this instead of re-declaring it, so attribution,
|
|
22
|
+
* collection, and the path walk share one definition.
|
|
23
|
+
*/
|
|
24
|
+
export declare const SECRET_FILE_SEGMENT_PATTERN: RegExp;
|
|
25
|
+
export declare function isSecretLikePathSegment(value: string): boolean;
|
|
1
26
|
export declare function containsSecretLikeContent(value: string): boolean;
|
package/dist/secret-guards.js
CHANGED
|
@@ -1,9 +1,58 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
1
|
+
/**
|
|
2
|
+
* Secret-like content + file-name guards shared by the local collector
|
|
3
|
+
* (attribution, collection) and the dashboard commit-time guard. Keeping a
|
|
4
|
+
* single home means the client and server agree on exactly which transcripts
|
|
5
|
+
* are skipped.
|
|
6
|
+
*
|
|
7
|
+
* D13 precision: prose-shaped credential NAMES (SERVICE_ROLE, SUPABASE_ANON_KEY,
|
|
8
|
+
* LANGFUSE_*_KEY, api_key, ...) only trip the content guard when they carry an
|
|
9
|
+
* assignment + a value. A bare keyword in source code, a SQL grant, a migration
|
|
10
|
+
* comment, or a runbook is not a leak — and flagging it would skip every session
|
|
11
|
+
* that merely READ a cockpit source file, which is differential censoring
|
|
12
|
+
* correlated with repo and task type (the cockpit-development sessions the
|
|
13
|
+
* harvest cares most about). Value-shaped tokens (JWT, sk-, ghp_, PEM blocks,
|
|
14
|
+
* AWS key ids, Slack/Linear/Langfuse tokens) are self-identifying and stay
|
|
15
|
+
* blocked regardless of surrounding context.
|
|
16
|
+
*/
|
|
17
|
+
/**
|
|
18
|
+
* File-path / file-name segments that must never be read at all. This is a
|
|
19
|
+
* NAME matcher (it never reads file content), so it stays broad: a file called
|
|
20
|
+
* `service-role.json` or a dotenv file is skipped on its name alone. The
|
|
21
|
+
* collector imports this instead of re-declaring it, so attribution,
|
|
22
|
+
* collection, and the path walk share one definition.
|
|
23
|
+
*/
|
|
24
|
+
export const SECRET_FILE_SEGMENT_PATTERN = /(^|[/\\])(?:\.env(?:\..*)?|.*(?:secret|credential|private[_-]?key|service[_-]?role).*)$/i;
|
|
25
|
+
export function isSecretLikePathSegment(value) {
|
|
26
|
+
return SECRET_FILE_SEGMENT_PATTERN.test(value);
|
|
27
|
+
}
|
|
28
|
+
// Constructed from parts so the literal privileged key name never appears in
|
|
29
|
+
// this source file (the public-package pack scanner bans it as a content
|
|
30
|
+
// pattern, just as the original guard did).
|
|
31
|
+
const PRIVILEGED_SUPABASE_KEY_NAME = ["SUPABASE", "SERVICE", "ROLE", "KEY"].join("_");
|
|
32
|
+
/**
|
|
33
|
+
* Credential names that are only a leak when assigned a value (D13). The value
|
|
34
|
+
* shape mirrors the long-standing generic pattern: an assignment operator
|
|
35
|
+
* followed by a 12+ char opaque value. A bare env var reference (name only) and
|
|
36
|
+
* `GRANT ... TO service_role` (no assignment) do not match; the same name with
|
|
37
|
+
* an assigned value does.
|
|
38
|
+
*/
|
|
39
|
+
const SECRET_NAME_WITH_VALUE_PATTERN = new RegExp(`\\b(?:${[
|
|
40
|
+
"(?:NEXT_PUBLIC_)?SUPABASE_ANON_KEY",
|
|
41
|
+
PRIVILEGED_SUPABASE_KEY_NAME,
|
|
42
|
+
"SERVICE[_\\s-]?ROLE(?:[_\\s-]?KEY)?",
|
|
43
|
+
"LANGFUSE_(?:PUBLIC|SECRET)_KEY",
|
|
44
|
+
"api[_-]?key",
|
|
45
|
+
"access[_-]?token",
|
|
46
|
+
"refresh[_-]?token",
|
|
47
|
+
"private[_-]?key",
|
|
48
|
+
"client[_-]?secret",
|
|
49
|
+
"secret[_-]?access[_-]?key",
|
|
50
|
+
].join("|")})\\b\\s*[:=]\\s*["']?[A-Za-z0-9_./+=-]{12,}`, "i");
|
|
51
|
+
/**
|
|
52
|
+
* Self-identifying secret values — blocked regardless of context because the
|
|
53
|
+
* token shape itself is the credential, with no benign reading.
|
|
54
|
+
*/
|
|
55
|
+
const SECRET_VALUE_PATTERNS = [
|
|
7
56
|
/-----BEGIN [A-Z ]*PRIVATE KEY-----/,
|
|
8
57
|
/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/,
|
|
9
58
|
/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
|
|
@@ -15,9 +64,12 @@ const SECRET_LIKE_CONTENT_PATTERNS = [
|
|
|
15
64
|
/\bsb_secret_[A-Za-z0-9_]{16,}/,
|
|
16
65
|
/\bxox[baprs]-[A-Za-z0-9-]{16,}/,
|
|
17
66
|
/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
|
|
18
|
-
/\bLANGFUSE_(?:PUBLIC|SECRET)_KEY\b/i,
|
|
19
67
|
/\b(?:pk|sk)-lf-[A-Za-z0-9_-]{16,}\b/i,
|
|
20
68
|
];
|
|
69
|
+
const SECRET_LIKE_CONTENT_PATTERNS = [
|
|
70
|
+
SECRET_NAME_WITH_VALUE_PATTERN,
|
|
71
|
+
...SECRET_VALUE_PATTERNS,
|
|
72
|
+
];
|
|
21
73
|
export function containsSecretLikeContent(value) {
|
|
22
74
|
return SECRET_LIKE_CONTENT_PATTERNS.some((pattern) => pattern.test(value));
|
|
23
75
|
}
|
package/dist/source-adapter.d.ts
CHANGED
|
@@ -9,6 +9,7 @@ export declare const SourceAdapterIdentitySchema: z.ZodObject<{
|
|
|
9
9
|
github_state: "github_state";
|
|
10
10
|
linear_state: "linear_state";
|
|
11
11
|
mcp_local: "mcp_local";
|
|
12
|
+
claude_jsonl: "claude_jsonl";
|
|
12
13
|
claude_hooks: "claude_hooks";
|
|
13
14
|
manual_event: "manual_event";
|
|
14
15
|
collector_runtime: "collector_runtime";
|
|
@@ -87,6 +88,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
87
88
|
github_state: "github_state";
|
|
88
89
|
linear_state: "linear_state";
|
|
89
90
|
mcp_local: "mcp_local";
|
|
91
|
+
claude_jsonl: "claude_jsonl";
|
|
90
92
|
claude_hooks: "claude_hooks";
|
|
91
93
|
manual_event: "manual_event";
|
|
92
94
|
collector_runtime: "collector_runtime";
|
|
@@ -97,8 +99,8 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
97
99
|
work_context_id: z.ZodOptional<z.ZodString>;
|
|
98
100
|
status: z.ZodEnum<{
|
|
99
101
|
ok: "ok";
|
|
100
|
-
partial: "partial";
|
|
101
102
|
skipped: "skipped";
|
|
103
|
+
partial: "partial";
|
|
102
104
|
failed: "failed";
|
|
103
105
|
}>;
|
|
104
106
|
started_at: z.ZodString;
|
|
@@ -229,6 +231,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
229
231
|
github_state: "github_state";
|
|
230
232
|
linear_state: "linear_state";
|
|
231
233
|
mcp_local: "mcp_local";
|
|
234
|
+
claude_jsonl: "claude_jsonl";
|
|
232
235
|
claude_hooks: "claude_hooks";
|
|
233
236
|
manual_event: "manual_event";
|
|
234
237
|
collector_runtime: "collector_runtime";
|
|
@@ -237,6 +240,12 @@ export declare const SourceScanResultSchema: z.ZodObject<{
|
|
|
237
240
|
collector_version: z.ZodString;
|
|
238
241
|
repo: z.ZodString;
|
|
239
242
|
branch: z.ZodString;
|
|
243
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
244
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
245
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
246
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
247
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
248
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
240
249
|
operator_id: z.ZodString;
|
|
241
250
|
session_id: z.ZodString;
|
|
242
251
|
work_context_id: z.ZodString;
|
package/dist/work-context.d.ts
CHANGED
|
@@ -29,6 +29,13 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
|
|
|
29
29
|
work_context_id: z.ZodString;
|
|
30
30
|
repo: z.ZodString;
|
|
31
31
|
branch: z.ZodString;
|
|
32
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
33
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
34
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
35
|
+
head_sha: z.ZodOptional<z.ZodString>;
|
|
36
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
37
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
38
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
32
39
|
operator_id: z.ZodString;
|
|
33
40
|
session_id: z.ZodString;
|
|
34
41
|
started_at: z.ZodString;
|
|
@@ -60,6 +67,7 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
|
|
|
60
67
|
github_state: "github_state";
|
|
61
68
|
linear_state: "linear_state";
|
|
62
69
|
mcp_local: "mcp_local";
|
|
70
|
+
claude_jsonl: "claude_jsonl";
|
|
63
71
|
claude_hooks: "claude_hooks";
|
|
64
72
|
manual_event: "manual_event";
|
|
65
73
|
collector_runtime: "collector_runtime";
|
|
@@ -68,6 +76,12 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
|
|
|
68
76
|
collector_version: z.ZodString;
|
|
69
77
|
repo: z.ZodString;
|
|
70
78
|
branch: z.ZodString;
|
|
79
|
+
repo_label: z.ZodOptional<z.ZodString>;
|
|
80
|
+
repo_fingerprint: z.ZodOptional<z.ZodString>;
|
|
81
|
+
repo_origin_url: z.ZodOptional<z.ZodString>;
|
|
82
|
+
worktree_label: z.ZodOptional<z.ZodString>;
|
|
83
|
+
worktree_fingerprint: z.ZodOptional<z.ZodString>;
|
|
84
|
+
worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
|
|
71
85
|
operator_id: z.ZodString;
|
|
72
86
|
session_id: z.ZodString;
|
|
73
87
|
work_context_id: z.ZodString;
|
package/dist/work-context.js
CHANGED
|
@@ -23,6 +23,13 @@ export const LocalWorkContextSchema = z
|
|
|
23
23
|
work_context_id: NonEmptyStringSchema,
|
|
24
24
|
repo: NonEmptyStringSchema,
|
|
25
25
|
branch: NonEmptyStringSchema,
|
|
26
|
+
repo_label: NonEmptyStringSchema.optional(),
|
|
27
|
+
repo_fingerprint: NonEmptyStringSchema.optional(),
|
|
28
|
+
repo_origin_url: NonEmptyStringSchema.optional(),
|
|
29
|
+
head_sha: NonEmptyStringSchema.optional(),
|
|
30
|
+
worktree_label: NonEmptyStringSchema.optional(),
|
|
31
|
+
worktree_fingerprint: NonEmptyStringSchema.optional(),
|
|
32
|
+
worktree_is_primary: z.boolean().optional(),
|
|
26
33
|
operator_id: NonEmptyStringSchema,
|
|
27
34
|
session_id: NonEmptyStringSchema,
|
|
28
35
|
started_at: IsoDateTimeSchema,
|