@bli-cockpit/telemetry-core 0.1.3 → 0.1.4

package/dist/common.d.ts

@@ -15,6 +15,7 @@ export declare const CaptureSourceSchema: z.ZodEnum<{
     github_state: "github_state";
     linear_state: "linear_state";
     mcp_local: "mcp_local";
+    claude_jsonl: "claude_jsonl";
     claude_hooks: "claude_hooks";
     manual_event: "manual_event";
     collector_runtime: "collector_runtime";
@@ -30,6 +31,7 @@ export declare const CaptureProvenanceSchema: z.ZodObject<{
         github_state: "github_state";
         linear_state: "linear_state";
         mcp_local: "mcp_local";
+        claude_jsonl: "claude_jsonl";
         claude_hooks: "claude_hooks";
         manual_event: "manual_event";
         collector_runtime: "collector_runtime";

package/dist/common.js

@@ -22,6 +22,7 @@ export const CaptureSourceSchema = z.enum([
     "github_state",
     "linear_state",
     "mcp_local",
+    "claude_jsonl",
     "claude_hooks",
     "manual_event",
     "collector_runtime",

package/dist/evidence-upload.d.ts

@@ -64,6 +64,7 @@ export declare const RawEvidenceUploadBeginRequestSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -172,6 +173,7 @@ export declare const RawEvidenceUploadChunkRequestSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -218,6 +220,7 @@ export declare const RawEvidenceUploadCommitRequestSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -275,8 +278,23 @@ export declare const CodexSessionUploadStateSchema: z.ZodEnum<{
     not_uploaded: "not_uploaded";
 }>;
 export type CodexSessionUploadState = z.infer<typeof CodexSessionUploadStateSchema>;
+/**
+ * The agent that produced a session transcript. `codex_session_id` keeps its
+ * historical name across sources; `source` disambiguates. Defaulting to
+ * `"codex"` keeps already-published CLI versions (which never send the field)
+ * working unchanged after this schema lands.
+ */
+export declare const AgentSessionSourceSchema: z.ZodDefault<z.ZodEnum<{
+    codex: "codex";
+    claude_code: "claude_code";
+}>>;
+export type AgentSessionSource = z.infer<typeof AgentSessionSourceSchema>;
 export declare const CodexSessionAttributionSchema: z.ZodObject<{
     codex_session_id: z.ZodString;
+    source: z.ZodDefault<z.ZodEnum<{
+        codex: "codex";
+        claude_code: "claude_code";
+    }>>;
     observed_at: z.ZodString;
     attribution_state: z.ZodEnum<{
         attributed: "attributed";
@@ -319,6 +337,7 @@ export declare const CodexSessionAttributionReportRequestSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -339,6 +358,10 @@ export declare const CodexSessionAttributionReportRequestSchema: z.ZodObject<{
     }, z.core.$strict>;
     sessions: z.ZodArray<z.ZodObject<{
         codex_session_id: z.ZodString;
+        source: z.ZodDefault<z.ZodEnum<{
+            codex: "codex";
+            claude_code: "claude_code";
+        }>>;
         observed_at: z.ZodString;
         attribution_state: z.ZodEnum<{
             attributed: "attributed";

package/dist/evidence-upload.js

@@ -140,9 +140,19 @@ export const CodexSessionUploadStateSchema = z.enum([
     "upload_failed",
     "not_uploaded",
 ]);
+/**
+ * The agent that produced a session transcript. `codex_session_id` keeps its
+ * historical name across sources; `source` disambiguates. Defaulting to
+ * `"codex"` keeps already-published CLI versions (which never send the field)
+ * working unchanged after this schema lands.
+ */
+export const AgentSessionSourceSchema = z
+    .enum(["codex", "claude_code"])
+    .default("codex");
 export const CodexSessionAttributionSchema = z
     .object({
     codex_session_id: NonEmptyStringSchema.max(120),
+    source: AgentSessionSourceSchema,
     observed_at: IsoDateTimeSchema,
     attribution_state: CodexSessionAttributionStateSchema,
     attribution_reason: SafeLabelSchema,

package/dist/ingest-dto.d.ts

@@ -39,6 +39,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -154,6 +155,7 @@ export declare const TelemetryIngestEventDtoSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";
@@ -314,6 +316,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";
@@ -359,6 +362,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";
@@ -474,6 +478,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                     github_state: "github_state";
                     linear_state: "linear_state";
                     mcp_local: "mcp_local";
+                    claude_jsonl: "claude_jsonl";
                     claude_hooks: "claude_hooks";
                     manual_event: "manual_event";
                     collector_runtime: "collector_runtime";
@@ -575,6 +580,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";
@@ -717,6 +723,7 @@ export declare const TelemetryIngestEnvelopeSchema: z.ZodObject<{
                     github_state: "github_state";
                     linear_state: "linear_state";
                     mcp_local: "mcp_local";
+                    claude_jsonl: "claude_jsonl";
                     claude_hooks: "claude_hooks";
                     manual_event: "manual_event";
                     collector_runtime: "collector_runtime";

package/dist/local-config.d.ts

@@ -14,6 +14,7 @@ export declare const LocalCollectorConfigSchema: z.ZodObject<{
         remote_short_retention_opt_in: "remote_short_retention_opt_in";
         remote_durable_opt_in: "remote_durable_opt_in";
     }>>;
+    collect_claude_jsonl: z.ZodDefault<z.ZodBoolean>;
     session_file_path: z.ZodOptional<z.ZodString>;
     state_dir_path: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;

package/dist/local-config.js

@@ -18,6 +18,10 @@ export const LocalCollectorConfigSchema = z
         "remote_durable_opt_in",
     ])
         .default("remote_durable_opt_in"),
+    // Per-machine escape hatch (D31): promoting the CLI to `latest` enables
+    // Claude transcript harvesting fleet-wide, so an operator can opt a single
+    // machine out without a version pin. Defaults on.
+    collect_claude_jsonl: z.boolean().default(true),
     session_file_path: NonEmptyStringSchema.optional(),
     state_dir_path: NonEmptyStringSchema.optional(),
 })

package/dist/risk-flags.d.ts

@@ -86,6 +86,7 @@ export declare const RiskFlagSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";

package/dist/secret-guards.d.ts

@@ -1 +1,26 @@
+/**
+ * Secret-like content + file-name guards shared by the local collector
+ * (attribution, collection) and the dashboard commit-time guard. Keeping a
+ * single home means the client and server agree on exactly which transcripts
+ * are skipped.
+ *
+ * D13 precision: prose-shaped credential NAMES (SERVICE_ROLE, SUPABASE_ANON_KEY,
+ * LANGFUSE_*_KEY, api_key, ...) only trip the content guard when they carry an
+ * assignment + a value. A bare keyword in source code, a SQL grant, a migration
+ * comment, or a runbook is not a leak — and flagging it would skip every session
+ * that merely READ a cockpit source file, which is differential censoring
+ * correlated with repo and task type (the cockpit-development sessions the
+ * harvest cares most about). Value-shaped tokens (JWT, sk-, ghp_, PEM blocks,
+ * AWS key ids, Slack/Linear/Langfuse tokens) are self-identifying and stay
+ * blocked regardless of surrounding context.
+ */
+/**
+ * File-path / file-name segments that must never be read at all. This is a
+ * NAME matcher (it never reads file content), so it stays broad: a file called
+ * `service-role.json` or a dotenv file is skipped on its name alone. The
+ * collector imports this instead of re-declaring it, so attribution,
+ * collection, and the path walk share one definition.
+ */
+export declare const SECRET_FILE_SEGMENT_PATTERN: RegExp;
+export declare function isSecretLikePathSegment(value: string): boolean;
 export declare function containsSecretLikeContent(value: string): boolean;

package/dist/secret-guards.js

@@ -1,9 +1,58 @@
-const PRIVILEGED_SUPABASE_KEY_NAME_PATTERN = new RegExp(`\\b${["SUPABASE", "SERVICE", "ROLE", "KEY"].join("_")}\\b`, "i");
-const SECRET_LIKE_CONTENT_PATTERNS = [
-    /\b(?:NEXT_PUBLIC_)?SUPABASE_ANON_KEY\b/i,
-    PRIVILEGED_SUPABASE_KEY_NAME_PATTERN,
-    /\bSERVICE[_\s-]?ROLE\b/i,
-    /\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?secret|secret[_-]?access[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_./+=-]{12,}/i,
+/**
+ * Secret-like content + file-name guards shared by the local collector
+ * (attribution, collection) and the dashboard commit-time guard. Keeping a
+ * single home means the client and server agree on exactly which transcripts
+ * are skipped.
+ *
+ * D13 precision: prose-shaped credential NAMES (SERVICE_ROLE, SUPABASE_ANON_KEY,
+ * LANGFUSE_*_KEY, api_key, ...) only trip the content guard when they carry an
+ * assignment + a value. A bare keyword in source code, a SQL grant, a migration
+ * comment, or a runbook is not a leak — and flagging it would skip every session
+ * that merely READ a cockpit source file, which is differential censoring
+ * correlated with repo and task type (the cockpit-development sessions the
+ * harvest cares most about). Value-shaped tokens (JWT, sk-, ghp_, PEM blocks,
+ * AWS key ids, Slack/Linear/Langfuse tokens) are self-identifying and stay
+ * blocked regardless of surrounding context.
+ */
+/**
+ * File-path / file-name segments that must never be read at all. This is a
+ * NAME matcher (it never reads file content), so it stays broad: a file called
+ * `service-role.json` or a dotenv file is skipped on its name alone. The
+ * collector imports this instead of re-declaring it, so attribution,
+ * collection, and the path walk share one definition.
+ */
+export const SECRET_FILE_SEGMENT_PATTERN = /(^|[/\\])(?:\.env(?:\..*)?|.*(?:secret|credential|private[_-]?key|service[_-]?role).*)$/i;
+export function isSecretLikePathSegment(value) {
+    return SECRET_FILE_SEGMENT_PATTERN.test(value);
+}
+// Constructed from parts so the literal privileged key name never appears in
+// this source file (the public-package pack scanner bans it as a content
+// pattern, just as the original guard did).
+const PRIVILEGED_SUPABASE_KEY_NAME = ["SUPABASE", "SERVICE", "ROLE", "KEY"].join("_");
+/**
+ * Credential names that are only a leak when assigned a value (D13). The value
+ * shape mirrors the long-standing generic pattern: an assignment operator
+ * followed by a 12+ char opaque value. A bare env var reference (name only) and
+ * `GRANT ... TO service_role` (no assignment) do not match; the same name with
+ * an assigned value does.
+ */
+const SECRET_NAME_WITH_VALUE_PATTERN = new RegExp(`\\b(?:${[
+    "(?:NEXT_PUBLIC_)?SUPABASE_ANON_KEY",
+    PRIVILEGED_SUPABASE_KEY_NAME,
+    "SERVICE[_\\s-]?ROLE(?:[_\\s-]?KEY)?",
+    "LANGFUSE_(?:PUBLIC|SECRET)_KEY",
+    "api[_-]?key",
+    "access[_-]?token",
+    "refresh[_-]?token",
+    "private[_-]?key",
+    "client[_-]?secret",
+    "secret[_-]?access[_-]?key",
+].join("|")})\\b\\s*[:=]\\s*["']?[A-Za-z0-9_./+=-]{12,}`, "i");
+/**
+ * Self-identifying secret values — blocked regardless of context because the
+ * token shape itself is the credential, with no benign reading.
+ */
+const SECRET_VALUE_PATTERNS = [
     /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
     /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/,
     /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
@@ -15,9 +64,12 @@ const SECRET_LIKE_CONTENT_PATTERNS = [
     /\bsb_secret_[A-Za-z0-9_]{16,}/,
     /\bxox[baprs]-[A-Za-z0-9-]{16,}/,
     /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
-    /\bLANGFUSE_(?:PUBLIC|SECRET)_KEY\b/i,
     /\b(?:pk|sk)-lf-[A-Za-z0-9_-]{16,}\b/i,
 ];
+const SECRET_LIKE_CONTENT_PATTERNS = [
+    SECRET_NAME_WITH_VALUE_PATTERN,
+    ...SECRET_VALUE_PATTERNS,
+];
 export function containsSecretLikeContent(value) {
     return SECRET_LIKE_CONTENT_PATTERNS.some((pattern) => pattern.test(value));
 }

package/dist/source-adapter.d.ts

@@ -9,6 +9,7 @@ export declare const SourceAdapterIdentitySchema: z.ZodObject<{
         github_state: "github_state";
         linear_state: "linear_state";
         mcp_local: "mcp_local";
+        claude_jsonl: "claude_jsonl";
         claude_hooks: "claude_hooks";
         manual_event: "manual_event";
         collector_runtime: "collector_runtime";
@@ -87,6 +88,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";
@@ -229,6 +231,7 @@ export declare const SourceScanResultSchema: z.ZodObject<{
                 github_state: "github_state";
                 linear_state: "linear_state";
                 mcp_local: "mcp_local";
+                claude_jsonl: "claude_jsonl";
                 claude_hooks: "claude_hooks";
                 manual_event: "manual_event";
                 collector_runtime: "collector_runtime";

package/dist/work-context.d.ts

@@ -67,6 +67,7 @@ export declare const LocalWorkContextSchema: z.ZodObject<{
             github_state: "github_state";
             linear_state: "linear_state";
             mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
             claude_hooks: "claude_hooks";
             manual_event: "manual_event";
             collector_runtime: "collector_runtime";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/telemetry-core",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",