@dsh-cc/session-forensics 0.7.1-rc.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm check:readme --write
+README.md: fd31e59dc49c6287ec58a96f1bc92d104181bc06
+README.zh.md: b923647682c2c03e6bfc59e90762ee1dc58992ca

package/README.md

@@ -0,0 +1,26 @@
+# @dsh-cc/session-forensics
+
+English | [中文](README.zh.md)
+
+Pure analysis library behind the `/learn` feature: it walks the durable session JSONL store and distills recurring failure→success corrections. It has no cordis dependency and no runtime dependencies at all — hosts inject a `decompress(file): Promise<string>` seam (a default `decompressJsonl` shells out to the `zstd` binary, mirroring the audit-scripts precedent) so unit tests run on plain fixture text.
+
+## What it does
+
+- **Scanner** (`scan.ts`): walks `<DSH_HOME>/sessions/<projectKey>/<sessionId>/session.jsonl.zstd`, reads the session header (`origin`, `delegationDepth`, `parentSession`), and normalizes `tool/call` + `tool/result` events into records. `tool/call` arguments arrive as a JSON-encoded string and are parsed with tolerance for parse failures. Truncated live-tail lines are ignored; corrupt middle lines are skipped and counted — never thrown. A `days` recency filter uses directory mtime first and falls back to the header timestamp only when mtime is missing or unreasonable; a session inside the window is decompressed exactly once.
+- **Approval pairing**: `approval/asked` events are paired with `approval/decided` by `data.id`; `approval/policy` events (e.g. `policy: "never"`) mark sessions excluded from denial analysis.
+- **Analyzers** (`analyze/`), all deterministic — no LLM in v1:
+  1. `path-correlation` — same-tool failures (path-shaped error gate: ENOENT / "No such file" / "not found") correlated with the first later success in line order sharing a basename in a different directory; bash pairs require the same first token plus ≥1 differing path-ish token.
+  2. `env-facts` — same first-token commands failing vs succeeding with distinct error signatures (e.g. `python3` ModuleNotFoundError vs `uv run python` success).
+  3. `search-scope` — failed narrow-root greps followed by successful broader-root greps on similar patterns.
+  4. `permission-denials` — `rejected` approval outcomes only (`cancelled` and `unavailable` are not denials); `approval/policy: never` sessions excluded from the denominator.
+  5. `large-files` — read results above a size threshold → "always use offset/limit".
+- **Aggregation** (`runForensics`): findings merge by `(kind, title)`, rank by occurrence count, and pass a `minOccurrences` gate (default 2). Every finding carries `session:<id>#turn=<n>` evidence anchors.
+
+## Composition
+
+This is a library, not a plugin — import it. The consumer that mounts it as a user-facing command is [`@dsh-cc/command-learn`](../command-learn/README.md).
+
+## Known Limitations and Deferred Work
+
+- Deterministic analyzers only — an optional LLM summarization pass over the findings is deliberately out of v1.
+- The bash path-ish token rule is intentionally simple (`/`-containing or file-extension-shaped tokens); `minOccurrences` is the actual precision mechanism. Upgrading the rule is future work.

package/README.zh.md

@@ -0,0 +1,26 @@
+# @dsh-cc/session-forensics
+
+[English](README.md) | 中文
+
+`/learn` 特性背后的纯分析库：遍历持久化会话 JSONL 存储，蒸馏反复出现的 失败→成功 修正。它不依赖 cordis，也没有任何运行时依赖 —— 宿主注入 `decompress(file): Promise<string>` 缝（默认的 `decompressJsonl` 通过子进程调用 `zstd` 二进制，沿用审计脚本的先例），因此单元测试可以直接跑普通 fixture 文本。
+
+## 它做什么
+
+- **扫描器**（`scan.ts`）：遍历 `<DSH_HOME>/sessions/<projectKey>/<sessionId>/session.jsonl.zstd`，读取会话头（`origin`、`delegationDepth`、`parentSession`），并将 `tool/call` + `tool/result` 事件归一化为记录。`tool/call` 的 arguments 以 JSON 编码字符串到达，解析时容忍解析失败。截断的实时尾行被忽略；损坏的中间行被跳过并计数 —— 绝不抛异常。`days` 新近度过滤优先使用目录 mtime，仅在 mtime 缺失或不合理时回退到头时间戳；窗口内的会话只解压一次。
+- **审批配对**：`approval/asked` 事件按 `data.id` 与 `approval/decided` 配对；`approval/policy` 事件（如 `policy: "never"`）标记被排除在拒绝分析之外的会话。
+- **分析器**（`analyze/`），全部确定性 —— v1 无 LLM：
+  1. `path-correlation` —— 同工具失败（路径形态错误门：ENOENT / "No such file" / "not found"）与行序上首个后继成功共享同名文件但目录不同进行相关；bash 对要求相同首 token 且 ≥1 个不同的路径形态 token。
+  2. `env-facts` —— 相同首 token 的命令失败与成功且错误签名不同（如 `python3` 下 ModuleNotFoundError，`uv run python` 下成功）。
+  3. `search-scope` —— 窄根 grep 失败后紧跟相似 pattern 的更宽根 grep 成功。
+  4. `permission-denials` —— 只计 `rejected` 审批结果（`cancelled` 与 `unavailable` 不算拒绝）；`approval/policy: never` 的会话排除在分母之外。
+  5. `large-files` —— 超过大小阈值的读取结果 → "对 X 始终使用 offset/limit"。
+- **聚合**（`runForensics`）：findings 按 `(kind, title)` 合并，按出现次数排序，并过 `minOccurrences` 门（默认 2）。每个 finding 携带 `session:<id>#turn=<n>` 证据锚点。
+
+## 组合
+
+这是一个库而非插件 —— 直接 import。把它挂载为用户可见命令的消费者是 [`@dsh-cc/command-learn`](../command-learn/README.md)。
+
+## 已知限制与暂缓事项
+
+- 仅确定性分析器 —— 对 findings 的可选 LLM 摘要 pass 刻意排除在 v1 之外。
+- bash 路径形态 token 规则刻意保持简单（含 `/` 或文件扩展名形态的 token）；`minOccurrences` 才是真正的精度机制。升级该规则是后续工作。

package/lib/analyze/env-facts.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Analyzer 2 — environment facts. Same first-token command failing, then a
+ * different invocation with that first token succeeding: record the working
+ * incantation. Error signatures are normalized result text, not prose parsing.
+ */
+import type { Finding, ToolRecord } from "../types.ts";
+export declare function findEnvFacts(records: ToolRecord[]): Finding[];
+//# sourceMappingURL=env-facts.d.ts.map

package/lib/analyze/env-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-facts.d.ts","sourceRoot":"","sources":["../../src/analyze/env-facts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAoBvD,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CA+B7D"}

package/lib/analyze/env-facts.js

@@ -0,0 +1,52 @@
+import { anchor } from "../types.js";
+function firstToken(record) {
+    const command = record.args?.command;
+    if (typeof command !== "string")
+        return undefined;
+    const token = command.split(/\s+/).find(Boolean);
+    return token;
+}
+function errorSignature(text) {
+    const line = text
+        .split("\n")
+        .map((l) => l.trim())
+        .find((l) => l.length > 0);
+    // ponytail: naive signature — first non-empty error line. Good enough to
+    // distinguish ModuleNotFoundError from exit codes; upgrade if noisy.
+    return (line ?? text.slice(0, 120)).slice(0, 160);
+}
+export function findEnvFacts(records) {
+    const findings = [];
+    const bash = records.filter((r) => r.name.toLowerCase() === "bash" && typeof r.args?.command === "string");
+    for (let i = 0; i < bash.length; i++) {
+        const failure = bash[i];
+        if (!failure.isError || failure.resultText === "")
+            continue;
+        const first = firstToken(failure);
+        if (first === undefined)
+            continue;
+        const failureSig = errorSignature(failure.resultText);
+        for (let j = i + 1; j < bash.length; j++) {
+            const success = bash[j];
+            if (success.isError || firstToken(success) !== first)
+                continue;
+            const successSig = errorSignature(success.resultText);
+            if (successSig === failureSig)
+                continue; // no distinct signature: nothing learned
+            const failedCmd = failure.args
+                .command;
+            const goodCmd = success.args
+                .command;
+            findings.push({
+                kind: "env-fact",
+                title: `use \`${goodCmd}\` instead of plain \`${first}\``,
+                detail: `\`${failedCmd}\` failed with "${failureSig}"; \`${goodCmd}\` succeeded.`,
+                occurrences: 1,
+                evidence: [anchor(failure.sessionId, failure.turn)],
+            });
+            break;
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=env-facts.js.map

package/lib/analyze/env-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-facts.js","sourceRoot":"","sources":["../../src/analyze/env-facts.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,OAAO,GAAI,MAAM,CAAC,IAAgC,EAAE,OAAO,CAAC;IAClE,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,IAAI;SACd,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7B,yEAAyE;IACzE,qEAAqE;IACrE,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAqB;IAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,OAAQ,CAAC,CAAC,IAAgC,EAAE,OAAO,KAAK,QAAQ,CAC3G,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;YAAE,SAAS;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACzB,IAAI,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,KAAK;gBAAE,SAAS;YAC/D,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,UAAU,KAAK,UAAU;gBAAE,SAAS,CAAC,yCAAyC;YAClF,MAAM,SAAS,GAAI,OAAO,CAAC,IAAgC;iBACxD,OAAiB,CAAC;YACrB,MAAM,OAAO,GAAI,OAAO,CAAC,IAAgC;iBACtD,OAAiB,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,SAAS,OAAO,yBAAyB,KAAK,IAAI;gBACzD,MAAM,EAAE,KAAK,SAAS,mBAAmB,UAAU,QAAQ,OAAO,eAAe;gBACjF,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;aACpD,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/lib/analyze/large-files.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Analyzer 5 — large read results. A read that dumped a huge file should
+ * become "always page with offset/limit" guidance for that path.
+ */
+import type { Finding, ToolRecord } from "../types.ts";
+export declare const LARGE_FILE_THRESHOLD = 200000;
+export declare function findLargeFiles(records: ToolRecord[]): Finding[];
+//# sourceMappingURL=large-files.d.ts.map

package/lib/analyze/large-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"large-files.d.ts","sourceRoot":"","sources":["../../src/analyze/large-files.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGvD,eAAO,MAAM,oBAAoB,SAAU,CAAC;AAE5C,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAyB/D"}

package/lib/analyze/large-files.js

@@ -0,0 +1,33 @@
+import { anchor } from "../types.js";
+export const LARGE_FILE_THRESHOLD = 200_000;
+export function findLargeFiles(records) {
+    const groups = new Map();
+    for (const record of records) {
+        if (record.name.toLowerCase() !== "read")
+            continue;
+        if (record.resultChars <= LARGE_FILE_THRESHOLD)
+            continue;
+        const path = record.args?.file_path;
+        if (typeof path !== "string")
+            continue;
+        const existing = groups.get(path);
+        if (existing === undefined) {
+            groups.set(path, { count: 1, session: record.sessionId, turn: record.turn });
+        }
+        else {
+            existing.count++;
+        }
+    }
+    const findings = [];
+    for (const [path, group] of groups) {
+        findings.push({
+            kind: "large-file",
+            title: `always use offset/limit on ${path}`,
+            detail: `Reading it whole returned ${group.count} oversized result(s) (>${LARGE_FILE_THRESHOLD} chars).`,
+            occurrences: group.count,
+            evidence: [anchor(group.session, group.turn)],
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=large-files.js.map

package/lib/analyze/large-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"large-files.js","sourceRoot":"","sources":["../../src/analyze/large-files.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyE,CAAC;IAChG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,SAAS;QACnD,IAAI,MAAM,CAAC,WAAW,IAAI,oBAAoB;YAAE,SAAS;QACzD,MAAM,IAAI,GAAI,MAAM,CAAC,IAAuC,EAAE,SAAS,CAAC;QACxE,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,8BAA8B,IAAI,EAAE;YAC3C,MAAM,EAAE,6BAA6B,KAAK,CAAC,KAAK,0BAA0B,oBAAoB,UAAU;YACxG,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/lib/analyze/path-correlation.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Analyzer 1 — success correlation on path-ish tools.
+ *
+ * Finds failures where a later, same-tool success recovered by pointing at a
+ * different directory (same basename). Gated: the failure's error text must be
+ * path-shaped, otherwise logic/test failures leak in.
+ */
+import type { Finding, ToolRecord } from "../types.ts";
+export declare const CORRELATION_TOOLS: Set<string>;
+/** Extract path-like strings from a tool's parsed args object. */
+export declare function extractPaths(args: unknown): string[];
+/** Emit "prefer <goodDir>/ over <badDir> for <file>" findings for one session. */
+export declare function correlatePaths(records: ToolRecord[]): Finding[];
+//# sourceMappingURL=path-correlation.d.ts.map

package/lib/analyze/path-correlation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-correlation.d.ts","sourceRoot":"","sources":["../../src/analyze/path-correlation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGvD,eAAO,MAAM,iBAAiB,aAM5B,CAAC;AASH,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAiBpD;AAiCD,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CA4E/D"}

package/lib/analyze/path-correlation.js

@@ -0,0 +1,130 @@
+import { anchor } from "../types.js";
+export const CORRELATION_TOOLS = new Set([
+    "read",
+    "edit",
+    "glob",
+    "grep",
+    "bash",
+]);
+/** Path-shaped failure markers (case-insensitive). */
+const PATH_ERROR = /enoent|no such file|not found/i;
+function norm(name) {
+    return name.toLowerCase();
+}
+/** Extract path-like strings from a tool's parsed args object. */
+export function extractPaths(args) {
+    if (typeof args !== "object" || args === null)
+        return [];
+    const paths = [];
+    for (const [key, value] of Object.entries(args)) {
+        if (typeof value === "string") {
+            if (key === "file_path" ||
+                key === "notebook_path" ||
+                key === "path" ||
+                key === "directory" ||
+                key === "cwd") {
+                paths.push(value);
+            }
+        }
+    }
+    return paths;
+}
+/** Split a bash command into tokens, stripping trailing punctuation. */
+function bashTokens(command) {
+    return command
+        .split(/\s+/)
+        .filter(Boolean)
+        .map((token) => token.replace(/[.,;:)'"`]+$/, ""));
+}
+const PATHISH_TOKEN = /\/[^\s/]+\.[a-z]{1,4}$/i;
+function pathishTokens(command) {
+    const tokens = bashTokens(command);
+    const paths = new Set();
+    for (const token of tokens) {
+        if (token.includes("/") || PATHISH_TOKEN.test(token)) {
+            paths.add(token.toLowerCase());
+        }
+    }
+    return [...paths];
+}
+function basename(p) {
+    const idx = p.lastIndexOf("/");
+    return idx === -1 ? p : p.slice(idx + 1);
+}
+function dir(p) {
+    const idx = p.lastIndexOf("/");
+    return idx === -1 ? p : p.slice(0, idx);
+}
+/** Emit "prefer <goodDir>/ over <badDir> for <file>" findings for one session. */
+export function correlatePaths(records) {
+    const findings = [];
+    const tools = [...records].filter((r) => CORRELATION_TOOLS.has(norm(r.name)));
+    for (let i = 0; i < tools.length; i++) {
+        const failure = tools[i];
+        if (!failure.isError || !PATH_ERROR.test(failure.resultText))
+            continue;
+        const nName = norm(failure.name);
+        if (nName === "bash") {
+            const cmd = typeof failure.args?.command === "string"
+                ? failure.args.command
+                : "";
+            const first = bashTokens(cmd)[0];
+            // ponytail: bare first-token comparison ("pnpm", "node" alone are noise)
+            // and raw token sets — a real argv/shell parser would cut false
+            // positives; upgrade when the 20-finding manual gate says so.
+            if (first === undefined)
+                continue;
+            const failedPaths = pathishTokens(cmd);
+            for (let j = i + 1; j < tools.length; j++) {
+                const success = tools[j];
+                if (norm(success.name) !== nName || success.isError)
+                    continue;
+                const cmd2 = typeof success.args?.command === "string"
+                    ? success.args.command
+                    : "";
+                if (bashTokens(cmd2)[0] !== first)
+                    continue;
+                const good = pathishTokens(cmd2).find((t) => !failedPaths.some((f) => f === t));
+                if (good === undefined)
+                    continue;
+                const token = basename(good);
+                if (!success.resultText.toLowerCase().includes(token.toLowerCase()))
+                    continue;
+                findings.push({
+                    kind: "path-correlation",
+                    title: `prefer corrected path for \`${token}\` in \`${first}\` commands`,
+                    detail: `\`${cmd}\` failed; \`${cmd2}\` succeeded. Reuse the working path.`,
+                    occurrences: 1,
+                    evidence: [anchor(failure.sessionId, failure.turn)],
+                });
+                break;
+            }
+            continue;
+        }
+        const failedPaths = extractPaths(failure.args);
+        for (let j = i + 1; j < tools.length; j++) {
+            const success = tools[j];
+            if (norm(success.name) !== nName || success.isError)
+                continue;
+            const goodPaths = extractPaths(success.args);
+            const match = goodPaths.find((good) => failedPaths.some((bad) => basename(bad) === basename(good) &&
+                dir(bad) !== dir(good) &&
+                success.resultText.includes(basename(good))));
+            if (match === undefined)
+                continue;
+            const bad = failedPaths.find((p) => basename(p) === basename(match) && dir(p) !== dir(match));
+            if (bad === undefined)
+                continue;
+            findings.push({
+                kind: "path-correlation",
+                title: `prefer ${dir(match)}/ over ${dir(bad)} for ${basename(match)}`,
+                detail: `${failure.name} failed on ${bad}, succeeded on ${match}.`,
+                occurrences: 1,
+                evidence: [anchor(failure.sessionId, failure.turn)],
+            });
+            break;
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=path-correlation.js.map

package/lib/analyze/path-correlation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-correlation.js","sourceRoot":"","sources":["../../src/analyze/path-correlation.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,UAAU,GAAG,gCAAgC,CAAC;AAEpD,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IACE,GAAG,KAAK,WAAW;gBACnB,GAAG,KAAK,eAAe;gBACvB,GAAG,KAAK,MAAM;gBACd,GAAG,KAAK,WAAW;gBACnB,GAAG,KAAK,KAAK,EACb,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO;SACX,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAAE,SAAS;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,GAAG,GACP,OAAQ,OAAO,CAAC,IAAgC,EAAE,OAAO,KAAK,QAAQ;gBACpE,CAAC,CAAG,OAAO,CAAC,IAAgC,CAAC,OAAkB;gBAC/D,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,yEAAyE;YACzE,gEAAgE;YAChE,8DAA8D;YAC9D,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YACvC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO;oBAAE,SAAS;gBAC9D,MAAM,IAAI,GACR,OAAQ,OAAO,CAAC,IAAgC,EAAE,OAAO,KAAK,QAAQ;oBACpE,CAAC,CAAG,OAAO,CAAC,IAAgC,CAAC,OAAkB;oBAC/D,CAAC,CAAC,EAAE,CAAC;gBACT,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;oBAAE,SAAS;gBAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC;gBACF,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAS;gBACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;oBACjE,SAAS;gBACX,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,KAAK,EAAE,+BAA+B,KAAK,WAAW,KAAK,aAAa;oBACxE,MAAM,EAAE,KAAK,GAAG,gBAAgB,IAAI,uCAAuC;oBAC3E,WAAW,EAAE,CAAC;oBACd,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;iBACpD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO;gBAAE,SAAS;YAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACpC,WAAW,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CACN,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC;gBAChC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC;gBACtB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9C,CACF,CAAC;YACF,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAChE,CAAC;YACF,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,UAAU,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,QAAQ,QAAQ,CAAC,KAAK,CAAC,EAAE;gBACtE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,cAAc,GAAG,kBAAkB,KAAK,GAAG;gBAClE,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;aACpD,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/lib/analyze/permission-denials.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Analyzer 4 — permission denials, driven by approval/asked|decided pairs.
+ * Only outcome `rejected` counts as a denial: `cancelled` is user
+ * abandonment, `unavailable` is infra. Sessions whose stream carried an
+ * `approval/policy` event with `policy: "never"` are excluded (their tools
+ * are never asked, so they poison the denominator).
+ */
+import type { ApprovalPair, Finding, SessionMeta } from "../types.ts";
+export declare function findPermissionDenials(approvals: ApprovalPair[], sessions: SessionMeta[]): Finding[];
+//# sourceMappingURL=permission-denials.d.ts.map

package/lib/analyze/permission-denials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-denials.d.ts","sourceRoot":"","sources":["../../src/analyze/permission-denials.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtE,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,YAAY,EAAE,EACzB,QAAQ,EAAE,WAAW,EAAE,GACtB,OAAO,EAAE,CAsCX"}

package/lib/analyze/permission-denials.js

@@ -0,0 +1,40 @@
+export function findPermissionDenials(approvals, sessions) {
+    const excluded = new Set(sessions.filter((s) => s.policyNever).map((s) => s.sessionId));
+    const groups = new Map();
+    for (const pair of approvals) {
+        if (pair.outcome !== "rejected")
+            continue;
+        if (excluded.has(pair.sessionId))
+            continue;
+        const tool = pair.toolName ?? "unknown";
+        const reason = pair.reason ?? "";
+        const key = `${tool}\u0000${reason}`;
+        const existing = groups.get(key);
+        if (existing === undefined) {
+            groups.set(key, {
+                count: 1,
+                tool,
+                reason,
+                session: pair.sessionId,
+                sample: pair,
+            });
+        }
+        else {
+            existing.count++;
+        }
+    }
+    const findings = [];
+    for (const group of groups.values()) {
+        findings.push({
+            kind: "permission-denial",
+            title: `user keeps rejecting \`${group.tool}\``,
+            detail: group.reason === ""
+                ? `Rejected ${group.count}×; ask before invoking or stop proposing it.`
+                : `Rejected ${group.count}× (reason: ${group.reason}); ask before invoking or stop proposing it.`,
+            occurrences: group.count,
+            evidence: [`session:${group.session}`],
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=permission-denials.js.map

package/lib/analyze/permission-denials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-denials.js","sourceRoot":"","sources":["../../src/analyze/permission-denials.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,qBAAqB,CACnC,SAAyB,EACzB,QAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAC9D,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkG,CAAC;IACzH,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU;YAAE,SAAS;QAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,MAAM,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;gBACd,KAAK,EAAE,CAAC;gBACR,IAAI;gBACJ,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,SAAS;gBACvB,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,0BAA0B,KAAK,CAAC,IAAI,IAAI;YAC/C,MAAM,EACJ,KAAK,CAAC,MAAM,KAAK,EAAE;gBACjB,CAAC,CAAC,YAAY,KAAK,CAAC,KAAK,8CAA8C;gBACvE,CAAC,CAAC,YAAY,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,MAAM,8CAA8C;YACrG,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,QAAQ,EAAE,CAAC,WAAW,KAAK,CAAC,OAAO,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/lib/analyze/search-scope.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Analyzer 3 — search scope. A failed grep whose root is narrow, followed by
+ * a successful grep with a similar pattern on a broader (ancestor) root.
+ */
+import type { Finding, ToolRecord } from "../types.ts";
+export declare function findSearchScope(records: ToolRecord[]): Finding[];
+//# sourceMappingURL=search-scope.d.ts.map

package/lib/analyze/search-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-scope.d.ts","sourceRoot":"","sources":["../../src/analyze/search-scope.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0BvD,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CA6BhE"}

package/lib/analyze/search-scope.js

@@ -0,0 +1,59 @@
+import { anchor } from "../types.js";
+function grepArgs(record) {
+    const args = record.args;
+    if (record.name.toLowerCase() !== "grep" || args === null)
+        return undefined;
+    if (typeof args.pattern !== "string")
+        return undefined;
+    return {
+        pattern: args.pattern,
+        path: typeof args.path === "string" ? args.path : "",
+    };
+}
+/**
+ * True when `broader` is strictly wider than `narrow`: either the default
+ * (empty path = whole cwd) or a strict ancestor directory of it.
+ */
+function isBroaderRoot(broader, narrow) {
+    if (broader === "")
+        return narrow !== "";
+    if (broader === narrow || narrow === "")
+        return false;
+    const b = broader.endsWith("/") ? broader : broader + "/";
+    return narrow.startsWith(b);
+}
+export function findSearchScope(records) {
+    const findings = [];
+    const greps = records.filter((r) => r.name.toLowerCase() === "grep");
+    for (let i = 0; i < greps.length; i++) {
+        const failure = greps[i];
+        if (!failure.isError)
+            continue;
+        const failed = grepArgs(failure);
+        if (failed === undefined || failed.path === "")
+            continue;
+        for (let j = i + 1; j < greps.length; j++) {
+            const success = greps[j];
+            if (success.isError)
+                continue;
+            const good = grepArgs(success);
+            if (good === undefined)
+                continue;
+            const similar = good.pattern === failed.pattern ||
+                good.pattern.includes(failed.pattern) ||
+                failed.pattern.includes(good.pattern);
+            if (!similar || !isBroaderRoot(good.path, failed.path))
+                continue;
+            findings.push({
+                kind: "search-scope",
+                title: `search from ${good.path} for \`${failed.pattern}\``,
+                detail: `Grep for \`${failed.pattern}\` under ${failed.path} found nothing; the same pattern under ${good.path} succeeded.`,
+                occurrences: 1,
+                evidence: [anchor(failure.sessionId, failure.turn)],
+            });
+            break;
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=search-scope.js.map

package/lib/analyze/search-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-scope.js","sourceRoot":"","sources":["../../src/analyze/search-scope.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,SAAS,QAAQ,CAAC,MAAkB;IAGlC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAsC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,MAAc;IACpD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,MAAM,KAAK,EAAE,CAAC;IACzC,IAAI,OAAO,KAAK,MAAM,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;IAC1D,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IACrE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,SAAS;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;YAAE,SAAS;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,OAAO;gBAAE,SAAS;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,MAAM,OAAO,GACX,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;gBACrC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,eAAe,IAAI,CAAC,IAAI,UAAU,MAAM,CAAC,OAAO,IAAI;gBAC3D,MAAM,EAAE,cAAc,MAAM,CAAC,OAAO,YAAY,MAAM,CAAC,IAAI,0CAA0C,IAAI,CAAC,IAAI,aAAa;gBAC3H,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;aACpD,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * session-forensics — pure analysis library for /learn.
+ * Deterministic analyzers over dsh-cc session JSONL stores; no cordis,
+ * no @deepseek-ai runtime dependencies.
+ */
+export { APPROVAL_OUTCOMES, decompressJsonl, parseStream, scanSessions, } from "./scan.ts";
+export type { ApprovalOutcome, ParsedStream } from "./scan.ts";
+export { correlatePaths } from "./analyze/path-correlation.ts";
+export { findEnvFacts } from "./analyze/env-facts.ts";
+export { findSearchScope } from "./analyze/search-scope.ts";
+export { findPermissionDenials } from "./analyze/permission-denials.ts";
+export { LARGE_FILE_THRESHOLD, findLargeFiles } from "./analyze/large-files.ts";
+export { anchor } from "./types.ts";
+export type { ApprovalPair, Finding, ForensicsOptions, ForensicsResult, ScanStats, SessionMeta, ToolRecord, } from "./types.ts";
+import type { ForensicsOptions, ForensicsResult } from "./types.ts";
+/** Default seam injected from the host (zstd CLI child process). */
+export type Decompress = (file: string) => Promise<string>;
+/**
+ * Full pipeline: scan the sessions store, run every analyzer, aggregate raw
+ * findings by (kind, title), rank by occurrences, apply the minOccurrences
+ * filter (default 2).
+ */
+export declare function runForensics(sessionsRoot: string, options?: ForensicsOptions & {
+    decompress?: Decompress;
+}): Promise<ForensicsResult>;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,YAAY,EACV,YAAY,EACZ,OAAO,EACP,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EAEhB,MAAM,YAAY,CAAC;AAEpB,oEAAoE;AACpE,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE3D;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,gBAAgB,GAAG;IAAE,UAAU,CAAC,EAAE,UAAU,CAAA;CAAO,GAC3D,OAAO,CAAC,eAAe,CAAC,CAsC1B"}

package/lib/index.js

@@ -0,0 +1,62 @@
+/**
+ * session-forensics — pure analysis library for /learn.
+ * Deterministic analyzers over dsh-cc session JSONL stores; no cordis,
+ * no @deepseek-ai runtime dependencies.
+ */
+export { APPROVAL_OUTCOMES, decompressJsonl, parseStream, scanSessions, } from "./scan.js";
+export { correlatePaths } from "./analyze/path-correlation.js";
+export { findEnvFacts } from "./analyze/env-facts.js";
+export { findSearchScope } from "./analyze/search-scope.js";
+export { findPermissionDenials } from "./analyze/permission-denials.js";
+export { LARGE_FILE_THRESHOLD, findLargeFiles } from "./analyze/large-files.js";
+export { anchor } from "./types.js";
+import { scanSessions } from "./scan.js";
+import { correlatePaths } from "./analyze/path-correlation.js";
+import { findEnvFacts } from "./analyze/env-facts.js";
+import { findSearchScope } from "./analyze/search-scope.js";
+import { findPermissionDenials } from "./analyze/permission-denials.js";
+import { findLargeFiles } from "./analyze/large-files.js";
+/**
+ * Full pipeline: scan the sessions store, run every analyzer, aggregate raw
+ * findings by (kind, title), rank by occurrences, apply the minOccurrences
+ * filter (default 2).
+ */
+export async function runForensics(sessionsRoot, options = {}) {
+    const minOccurrences = options.minOccurrences ?? 2;
+    const scan = await scanSessions(sessionsRoot, options);
+    const findings = [
+        ...scan.sessions.flatMap((s) => [
+            ...correlatePaths(s.records),
+            ...findEnvFacts(s.records),
+            ...findSearchScope(s.records),
+        ]),
+        ...findPermissionDenials(scan.approvals, scan.sessions.map((s) => s.meta)),
+        ...findLargeFiles(scan.sessions.flatMap((s) => s.records)),
+    ];
+    // Aggregate identical findings across sessions/occurrences.
+    const merged = new Map();
+    for (const finding of findings) {
+        const key = `${finding.kind}\u0000${finding.title}`;
+        const existing = merged.get(key);
+        if (existing === undefined) {
+            merged.set(key, { ...finding });
+        }
+        else {
+            existing.occurrences += finding.occurrences;
+            existing.evidence.push(...finding.evidence);
+        }
+    }
+    const ranked = [...merged.values()]
+        .filter((f) => f.occurrences >= minOccurrences)
+        .sort((a, b) => b.occurrences - a.occurrences);
+    const stats = {
+        sessionsScanned: scan.sessions.length,
+        linesParsed: scan.linesParsed,
+        corruptLinesSkipped: scan.corruptLinesSkipped,
+        truncatedTails: scan.truncatedTails,
+        sessionsByPolicyNever: scan.sessions.filter((s) => s.meta.policyNever)
+            .length,
+    };
+    return { findings: ranked, stats };
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAUpC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAU1D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,UAA0D,EAAE;IAE5D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC9B,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5B,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1B,GAAG,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;SAC9B,CAAC;QACF,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1E,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;KAC3D,CAAC;IAEF,4DAA4D;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC5D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,SAAS,OAAO,CAAC,KAAK,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC;YAC5C,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,cAAc,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAc;QACvB,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;aACnE,MAAM;KACV,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC"}

package/lib/scan.d.ts

@@ -0,0 +1,40 @@
+import type { ApprovalPair, ForensicsOptions, SessionMeta, ToolRecord } from "./types.ts";
+/** Event outcome strings observed on approval/decided events. */
+export type ApprovalOutcome = "allowed-once" | "rejected" | "cancelled" | "unavailable";
+export declare const APPROVAL_OUTCOMES: readonly ApprovalOutcome[];
+/** Default zstd seam: shell out to the `zstd` CLI (precedent: scripts/audit-subagent-children.mjs). */
+export declare function decompressJsonl(file: string): Promise<string>;
+export interface ParsedStream {
+    meta: SessionMeta;
+    records: ToolRecord[];
+    approvals: ApprovalPair[];
+    linesParsed: number;
+    corruptLinesSkipped: number;
+    truncatedTail: boolean;
+    headerTs?: number | undefined;
+}
+/**
+ * Parse one decompressed JSONL session stream. Tolerant by design:
+ * a JSON.parse failure on the LAST non-empty line is a truncated live tail
+ * (ignored); failures anywhere else are skipped and counted, never thrown.
+ */
+export declare function parseStream(project: string, sessionId: string, text: string): ParsedStream;
+/**
+ * Walk the sessions root and return every in-window stream's parsed form.
+ * Recency: directory mtime is primary; when missing/unreasonable the header
+ * timestamp is used instead. Each stream is decompressed at most once.
+ */
+export declare function scanSessions(sessionsRoot: string, options?: ForensicsOptions & {
+    decompress?: (file: string) => Promise<string>;
+}): Promise<{
+    sessions: Array<{
+        meta: SessionMeta;
+        records: ToolRecord[];
+    }>;
+    approvals: ApprovalPair[];
+    linesParsed: number;
+    corruptLinesSkipped: number;
+    truncatedTails: number;
+    sessionsScanned: number;
+}>;
+//# sourceMappingURL=scan.d.ts.map

package/lib/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,UAAU,EACX,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,UAAU,GACV,WAAW,GACX,aAAa,CAAC;AAElB,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAKvD,CAAC;AAKF,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO7D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAyBD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,YAAY,CAkHd;AAID;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C,GACL,OAAO,CAAC;IACT,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC,CAAC;IAC9D,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CA0DD"}

package/lib/scan.js

@@ -0,0 +1,248 @@
+/**
+ * Scanner: walk the dsh-cc sessions store and normalize events into records.
+ *
+ * Layout: `<sessionsRoot>/<projectKey>/<sessionId>/session.jsonl.zstd`.
+ * Child sessions are separate directories; they are distinguished only by
+ * the `type: "session"` header line (`origin`, `delegationDepth`,
+ * `parentSession`), never by file naming.
+ */
+import { execFileSync } from "node:child_process";
+import { readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+export const APPROVAL_OUTCOMES = [
+    "allowed-once",
+    "rejected",
+    "cancelled",
+    "unavailable",
+];
+/** How much result text to keep on each record (analyzers only need signatures/anchors). */
+const RESULT_TEXT_CAP = 4096;
+/** Default zstd seam: shell out to the `zstd` CLI (precedent: scripts/audit-subagent-children.mjs). */
+export function decompressJsonl(file) {
+    const zstdBin = process.env.DSH_ZSTD_BIN ?? "zstd";
+    return Promise.resolve(execFileSync(zstdBin, ["-d", "-c", file], {
+        maxBuffer: 256 * 1024 * 1024,
+    }).toString("utf8"));
+}
+function toTs(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    if (typeof value === "string") {
+        const n = Date.parse(value);
+        return Number.isNaN(n) ? undefined : n;
+    }
+    return undefined;
+}
+function resultCharsOf(content) {
+    let chars = 0;
+    let text = "";
+    if (Array.isArray(content)) {
+        for (const block of content) {
+            if (block?.type === "text" && typeof block.text === "string") {
+                chars += block.text.length;
+                if (text.length < RESULT_TEXT_CAP)
+                    text += block.text;
+            }
+        }
+    }
+    return { chars, text: text.slice(0, RESULT_TEXT_CAP) };
+}
+/**
+ * Parse one decompressed JSONL session stream. Tolerant by design:
+ * a JSON.parse failure on the LAST non-empty line is a truncated live tail
+ * (ignored); failures anywhere else are skipped and counted, never thrown.
+ */
+export function parseStream(project, sessionId, text) {
+    const meta = { project, sessionId, policyNever: false };
+    let headerTs;
+    const records = [];
+    const approvals = [];
+    const pending = new Map();
+    const lines = text.split("\n").filter((line) => line.length > 0);
+    const stats = { linesParsed: 0, corruptLinesSkipped: 0, truncatedTail: false };
+    for (const [i, line] of lines.entries()) {
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            if (i === lines.length - 1)
+                stats.truncatedTail = true;
+            else
+                stats.corruptLinesSkipped++;
+            continue;
+        }
+        stats.linesParsed++;
+        const type = entry?.type;
+        const data = entry?.data;
+        if (type === "session" && meta.origin === undefined) {
+            if (typeof data?.origin === "string")
+                meta.origin = data.origin;
+            if (typeof data?.delegationDepth === "number")
+                meta.delegationDepth = data.delegationDepth;
+            headerTs = toTs(entry.ts ?? entry.timestamp);
+            continue;
+        }
+        if (type === "approval/policy") {
+            if (data?.policy === "never")
+                meta.policyNever = true;
+            continue;
+        }
+        if (type === "approval/asked") {
+            if (typeof data?.id === "string") {
+                // Decided may already have arrived (out-of-order streams): merge.
+                let pair = approvals.find((a) => a.id === data.id);
+                if (pair === undefined) {
+                    pair = { project, sessionId, id: data.id };
+                    approvals.push(pair);
+                }
+                if (typeof data.toolName === "string")
+                    pair.toolName = data.toolName;
+                if (typeof data.callId === "string")
+                    pair.callId = data.callId;
+                if (typeof data.reason === "string")
+                    pair.reason = data.reason;
+            }
+            continue;
+        }
+        if (type === "approval/decided") {
+            if (typeof data?.id === "string") {
+                let pair = approvals.find((a) => a.id === data.id);
+                if (pair === undefined) {
+                    pair = { project, sessionId, id: data.id };
+                    approvals.push(pair);
+                }
+                if (typeof data.outcome === "string")
+                    pair.outcome = data.outcome;
+            }
+            continue;
+        }
+        if (type === "tool/call") {
+            const name = typeof data?.name === "string" ? data.name : "";
+            if (name === "")
+                continue;
+            const argsRaw = typeof data?.arguments === "string" ? data.arguments : undefined;
+            let args = null;
+            if (argsRaw !== undefined) {
+                try {
+                    args = JSON.parse(argsRaw);
+                }
+                catch {
+                    args = null;
+                }
+            }
+            const record = {
+                project,
+                sessionId,
+                origin: meta.origin,
+                delegationDepth: meta.delegationDepth,
+                turn: typeof data?.turn === "number" ? data.turn : undefined,
+                step: typeof data?.step === "number" ? data.step : undefined,
+                name,
+                argsRaw,
+                args,
+                resultChars: 0,
+                resultText: "",
+                isError: false,
+                ts: toTs(entry.ts ?? entry.timestamp),
+            };
+            records.push(record);
+            if (typeof data?.callId === "string")
+                pending.set(data.callId, record);
+            continue;
+        }
+        if (type === "tool/result") {
+            const callId = data?.message?.source?.callId;
+            const record = typeof callId === "string" ? pending.get(callId) : undefined;
+            if (record === undefined)
+                continue;
+            const payload = Array.isArray(data?.message?.content)
+                ? data.message.content[0]
+                : undefined;
+            if (payload?.type !== "tool-result")
+                continue;
+            const { chars, text: resultText } = resultCharsOf(payload.content);
+            record.resultChars = chars;
+            record.resultText = resultText;
+            record.isError = payload.isError === true;
+            continue;
+        }
+    }
+    return {
+        meta,
+        records,
+        approvals,
+        headerTs,
+        ...stats,
+    };
+}
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Walk the sessions root and return every in-window stream's parsed form.
+ * Recency: directory mtime is primary; when missing/unreasonable the header
+ * timestamp is used instead. Each stream is decompressed at most once.
+ */
+export async function scanSessions(sessionsRoot, options = {}) {
+    const decompress = options.decompress ?? decompressJsonl;
+    const days = options.days ?? 14;
+    const cutoff = Date.now() - days * DAY_MS;
+    const sessions = [];
+    const approvals = [];
+    let linesParsed = 0;
+    let corruptLinesSkipped = 0;
+    let truncatedTails = 0;
+    let projectKeys;
+    try {
+        projectKeys = readdirSync(sessionsRoot);
+    }
+    catch {
+        // Missing/empty sessions root: zero findings, no throw.
+        projectKeys = [];
+    }
+    for (const projectKey of projectKeys) {
+        if (options.project !== undefined && projectKey !== options.project)
+            continue;
+        const projectDir = join(sessionsRoot, projectKey);
+        for (const sessionId of readdirSync(projectDir)) {
+            const dir = join(projectDir, sessionId);
+            const file = join(dir, "session.jsonl.zstd");
+            let mtimeMs;
+            try {
+                mtimeMs = statSync(dir).mtimeMs;
+            }
+            catch {
+                mtimeMs = undefined;
+            }
+            const mtimeReasonable = mtimeMs !== undefined && Number.isFinite(mtimeMs) && mtimeMs > 0;
+            if (mtimeReasonable && mtimeMs < cutoff)
+                continue; // mtime out of window: skip without decompressing
+            let text;
+            try {
+                text = await decompress(file);
+            }
+            catch {
+                continue;
+            }
+            const parsed = parseStream(projectKey, sessionId, text);
+            // mtime unreliable (or absent): fall back to the header timestamp.
+            const headerTs = parsed.headerTs;
+            if (!mtimeReasonable && headerTs !== undefined && headerTs < cutoff)
+                continue;
+            sessions.push({ meta: parsed.meta, records: parsed.records });
+            approvals.push(...parsed.approvals);
+            linesParsed += parsed.linesParsed;
+            corruptLinesSkipped += parsed.corruptLinesSkipped;
+            if (parsed.truncatedTail)
+                truncatedTails++;
+        }
+    }
+    return {
+        sessions,
+        approvals,
+        sessionsScanned: sessions.length,
+        linesParsed,
+        corruptLinesSkipped,
+        truncatedTails,
+    };
+}
+//# sourceMappingURL=scan.js.map

package/lib/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAejC,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D,cAAc;IACd,UAAU;IACV,WAAW;IACX,aAAa;CACd,CAAC;AAEF,4FAA4F;AAC5F,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;IACnD,OAAO,OAAO,CAAC,OAAO,CACpB,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACxC,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;KAC7B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACpB,CAAC;AACJ,CAAC;AAYD,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7D,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe;oBAAE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,SAAiB,EACjB,IAAY;IAEZ,MAAM,IAAI,GAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrE,IAAI,QAA4B,CAAC;IACjC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAE/E,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACxC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;;gBAClD,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QACD,KAAK,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC;QAEzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpD,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAChE,IAAI,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ;gBAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC9C,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,IAAI,IAAI,EAAE,MAAM,KAAK,OAAO;gBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,IAAI,OAAO,IAAI,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACjC,kEAAkE;gBAClE,IAAI,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,IAAI,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;oBAC3C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACrE,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;oBAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC/D,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;oBAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACjE,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,IAAI,OAAO,IAAI,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,IAAI,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;oBAC3C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;oBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACpE,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1B,MAAM,OAAO,GACX,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,IAAI,IAAI,GAAY,IAAI,CAAC;YACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAe;gBACzB,OAAO;gBACP,SAAS;gBACT,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC5D,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC5D,IAAI;gBACJ,OAAO;gBACP,IAAI;gBACJ,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC;aACtC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;YAC7C,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,OAAO,EAAE,IAAI,KAAK,aAAa;gBAAE,SAAS;YAC9C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;YAC3B,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;YAC/B,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;YAC1C,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,OAAO;QACP,SAAS;QACT,QAAQ;QACR,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,UAEI,EAAE;IASN,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1C,MAAM,QAAQ,GAAwD,EAAE,CAAC;IACzE,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,WAAW,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO,CAAC,OAAO;YAAE,SAAS;QAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAClD,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC7C,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,SAAS,CAAC;YACtB,CAAC;YACD,MAAM,eAAe,GACnB,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;YACnE,IAAI,eAAe,IAAK,OAAkB,GAAG,MAAM;gBAAE,SAAS,CAAC,kDAAkD;YACjH,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YACxD,mEAAmE;YACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,IAAI,CAAC,eAAe,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,MAAM;gBACjE,SAAS;YACX,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YACpC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;YAClC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,CAAC;YAClD,IAAI,MAAM,CAAC,aAAa;gBAAE,cAAc,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ;QACR,SAAS;QACT,eAAe,EAAE,QAAQ,CAAC,MAAM;QAChC,WAAW;QACX,mBAAmB;QACnB,cAAc;KACf,CAAC;AACJ,CAAC"}

package/lib/types.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Shared types for the session-forensics analysis library.
+ */
+/** One normalized tool call, paired with its result when present. */
+export interface ToolRecord {
+    project: string;
+    sessionId: string;
+    origin?: string | undefined;
+    delegationDepth?: number | undefined;
+    turn?: number | undefined;
+    step?: number | undefined;
+    /** Tool name as written in the event (lowercased copy is used for matching). */
+    name: string;
+    /** Raw JSON-encoded `arguments` string from the tool/call event. */
+    argsRaw?: string | undefined;
+    /** JSON.parse of argsRaw, or null when absent/unparseable. */
+    args: unknown;
+    /** Total length of text content in the paired tool result. */
+    resultChars: number;
+    /** First chunk of the paired result text (bounded) for gates/signatures. */
+    resultText: string;
+    isError: boolean;
+    ts?: number | undefined;
+}
+/** An approval/asked event paired with its approval/decided outcome by `data.id`. */
+export interface ApprovalPair {
+    project: string;
+    sessionId: string;
+    id: string;
+    toolName?: string | undefined;
+    callId?: string | undefined;
+    reason?: string | undefined;
+    outcome?: string | undefined;
+}
+/** Per-session header facts the analyzers need. */
+export interface SessionMeta {
+    project: string;
+    sessionId: string;
+    origin?: string | undefined;
+    delegationDepth?: number | undefined;
+    /** True when the stream carried an `approval/policy` event with `policy: "never"`. */
+    policyNever: boolean;
+}
+export interface Finding {
+    kind: "path-correlation" | "env-fact" | "search-scope" | "permission-denial" | "large-file";
+    title: string;
+    detail: string;
+    occurrences: number;
+    /** Anchors of the form `session:<sessionId>#turn=<n>`. */
+    evidence: string[];
+}
+export interface ScanStats {
+    sessionsScanned: number;
+    linesParsed: number;
+    corruptLinesSkipped: number;
+    truncatedTails: number;
+    sessionsByPolicyNever: number;
+}
+export interface ForensicsResult {
+    findings: Finding[];
+    stats: ScanStats;
+}
+export interface ForensicsOptions {
+    /** Only include sessions whose (mtime or header) timestamp is within the last N days. */
+    days?: number | undefined;
+    /** Restrict to one project key; omit for all projects. */
+    project?: string | undefined;
+    /** Drop findings seen fewer than this many times (default 2). */
+    minOccurrences?: number | undefined;
+}
+/** Anchor string for evidence lists. */
+export declare function anchor(sessionId: string, turn?: number): string;
+//# sourceMappingURL=types.d.ts.map

package/lib/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,sFAAsF;IACtF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EACA,kBAAkB,GAClB,UAAU,GACV,cAAc,GACd,mBAAmB,GACnB,YAAY,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,wCAAwC;AACxC,wBAAgB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/D"}

package/lib/types.js

@@ -0,0 +1,10 @@
+/**
+ * Shared types for the session-forensics analysis library.
+ */
+/** Anchor string for evidence lists. */
+export function anchor(sessionId, turn) {
+    return turn === undefined
+        ? `session:${sessionId}`
+        : `session:${sessionId}#turn=${turn}`;
+}
+//# sourceMappingURL=types.js.map

package/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAiFH,wCAAwC;AACxC,MAAM,UAAU,MAAM,CAAC,SAAiB,EAAE,IAAa;IACrD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,WAAW,SAAS,EAAE;QACxB,CAAC,CAAC,WAAW,SAAS,SAAS,IAAI,EAAE,CAAC;AAC1C,CAAC"}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@dsh-cc/session-forensics",
+  "description": "Pure analysis library distilling session failure patterns (used by /learn)",
+  "version": "0.7.1-rc.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dsh-cc/dsh-cc.git",
+    "directory": "packages/session/session-forensics"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib"
+  ],
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  }
+}