@herbertgao/pi-extensions 2026.8.9 → 2026.8.11

package/node_modules/@herbertgao/resume-from/dist/adapters/claude-code/writer.js

@@ -0,0 +1,306 @@
+/**
+ * Writing a canonical session into a new Claude Code session file.
+ *
+ * C-9 measured that a file holding one `user` entry and one `assistant` entry is listed by the
+ * native resume list and opened by `claude --resume <id>` as native turns. This module writes
+ * exactly those two entry types and nothing else: the other eight types of C-3 are eight more
+ * ways to corrupt an internal application database.
+ *
+ * Nothing here touches the filesystem except to read. `serialize` returns bytes;
+ * `src/import/landing/` creates the files (FR-49, FR-53).
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { asObject, asString, ENTRY_TYPE_ASSISTANT, ENTRY_TYPE_USER, parseJsonl, toIsoUtc, WRITTEN_ENTRY_TYPES, } from "./entries.js";
+import { projectDir, SESSION_FILE_SUFFIX, sessionFilePath } from "./layout.js";
+/** The version C-9 was measured against. Written so the target reads a version it knows. */
+export const CLAUDE_CODE_FORMAT_VERSION = "2.1.220";
+/** The model field of an imported turn. No model produced it, and none is claimed. */
+export const IMPORTED_MODEL = "imported";
+export const USER_TYPE = "external";
+const EMPTY_TURN_TEXT = "(empty message)";
+const TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
+/** A per-session sidecar directory is named after its session. */
+const SIDECAR_DIR_PATTERN = /^[0-9a-fA-F-]{8,}$/;
+const INERT_PROJECT_FILES = new Set(["sessions-index.json", ".session-aliases"]);
+const INERT_PROJECT_DIRS = new Set(["memory"]);
+const MAX_MINT_ATTEMPTS = 8;
+/** sha256-derived uuid, so one minted session id fixes every entry of the file. */
+function deterministicUuid(seed, index) {
+    const digest = createHash("sha256").update(`${seed}:${index}`).digest();
+    const bytes = Buffer.from(digest.subarray(0, 16));
+    bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x40;
+    bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80;
+    const hex = bytes.toString("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/**
+ * Refuse when the repository's record holds anything this adapter does not recognise.
+ *
+ * A stranger in that directory may be a registration index the new session would have to be
+ * added to, and adding it would mean opening an existing file for writing. FR-49 outranks
+ * convenience, so the adapter declares the limitation instead of guessing (C-3).
+ */
+function refuseUnrecognisedProjectRecord(home, repoPath) {
+    const dir = projectDir(home, repoPath);
+    let items;
+    try {
+        items = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return; // a record that does not exist yet is a new path, which is exactly what is allowed
+    }
+    for (const item of items) {
+        if (item.isFile() && item.name.endsWith(SESSION_FILE_SUFFIX))
+            continue;
+        if (item.isFile() && INERT_PROJECT_FILES.has(item.name))
+            continue;
+        if (item.isDirectory() && SIDECAR_DIR_PATTERN.test(item.name))
+            continue;
+        if (item.isDirectory() && INERT_PROJECT_DIRS.has(item.name))
+            continue;
+        throw new Error(`Claude Code adapter: ${path.join(dir, item.name)} is not a session file this adapter ` +
+            "recognises. Registering the imported session may require editing it, and this adapter " +
+            "only ever creates new paths (FR-49). Import refused.");
+    }
+}
+/** A session id whose file does not exist in the target home. A collision is never overwritten. */
+function mintSessionId(home, repoPath) {
+    for (let attempt = 0; attempt < MAX_MINT_ATTEMPTS; attempt++) {
+        const id = randomUUID();
+        if (!existsSync(sessionFilePath(home, repoPath, id)))
+            return id;
+    }
+    throw new Error(`Claude Code adapter: could not mint an unused session id in ${home}`);
+}
+function envelope(ctx, index, parentUuid, timestamp) {
+    return {
+        parentUuid,
+        isSidechain: false,
+        userType: USER_TYPE,
+        cwd: ctx.repoPath,
+        sessionId: ctx.sessionId,
+        version: CLAUDE_CODE_FORMAT_VERSION,
+        gitBranch: ctx.branch,
+        uuid: deterministicUuid(ctx.sessionId, index),
+        timestamp,
+    };
+}
+/**
+ * The provenance marker (FR-47, FR-48).
+ *
+ * It rides in a `user` entry flagged `isMeta`, the flag Claude Code puts on entries it shows in
+ * the transcript but does not send as a turn. C-9 proved the entry type; it did not prove the
+ * flag. T-CC-17 is what can falsify it — if the marker ever reaches the model, this module
+ * declares `provenance: "host-output-only"` instead and the marker moves to host output.
+ */
+function outOfContextMarkerEntry(ctx, marker) {
+    return {
+        ...envelope(ctx, 0, null, toIsoUtc(marker.importedAt) ?? new Date(0).toISOString()),
+        type: ENTRY_TYPE_USER,
+        isMeta: true,
+        message: { role: "user", content: marker.lines.join("\n") },
+    };
+}
+/** What one canonical turn says, as text. A tool call crosses as its one outcome line (FR-23). */
+function turnText(turn) {
+    const call = turn.toolCall;
+    if (turn.kind === "tool-call" && call !== null) {
+        // FR-27: the tool name crosses unchanged, whatever adapter recorded the call.
+        return call.outcomeLine.includes(call.toolName)
+            ? call.outcomeLine
+            : `${call.toolName}(${call.argumentsText}) → ${call.outcomeLine}`;
+    }
+    return turn.text.trim() === "" ? EMPTY_TURN_TEXT : turn.text;
+}
+function buildEntries(session, marker, ctx) {
+    const fallbackTimestamp = toIsoUtc(marker.importedAt) ??
+        toIsoUtc(session.provenance.updatedAt) ??
+        new Date(0).toISOString();
+    const entries = [outOfContextMarkerEntry(ctx, marker)];
+    for (const turn of session.turns) {
+        const index = entries.length;
+        const previous = entries[index - 1];
+        const parentUuid = asString(previous?.uuid);
+        const timestamp = toIsoUtc(turn.timestamp) ?? fallbackTimestamp;
+        const base = envelope(ctx, index, parentUuid, timestamp);
+        const text = turnText(turn);
+        if (turn.role === "user") {
+            entries.push({
+                ...base,
+                type: ENTRY_TYPE_USER,
+                message: { role: "user", content: text },
+            });
+            continue;
+        }
+        entries.push({
+            ...base,
+            type: ENTRY_TYPE_ASSISTANT,
+            message: {
+                id: `msg_${base.uuid.replace(/-/g, "").slice(0, 24)}`,
+                type: "message",
+                role: "assistant",
+                model: IMPORTED_MODEL,
+                content: [{ type: "text", text }],
+                stop_reason: "end_turn",
+                stop_sequence: null,
+                usage: {
+                    input_tokens: 0,
+                    output_tokens: 0,
+                    cache_creation_input_tokens: 0,
+                    cache_read_input_tokens: 0,
+                    service_tier: "standard",
+                },
+            },
+        });
+    }
+    return entries;
+}
+/** Bytes only: the file is created by `src/import/landing/`, never here (FR-49, FR-53). */
+export function serialize(session, target, marker, context) {
+    const repoPath = path.resolve(context.cwd);
+    refuseUnrecognisedProjectRecord(target.home, repoPath);
+    const sessionId = mintSessionId(target.home, repoPath);
+    const entries = buildEntries(session, marker, {
+        sessionId,
+        repoPath,
+        branch: session.provenance.repo.branch ?? "",
+    });
+    const text = `${entries.map((entry) => JSON.stringify(entry)).join("\n")}\n`;
+    return {
+        sessionId,
+        files: [
+            {
+                absolutePath: sessionFilePath(target.home, repoPath, sessionId),
+                bytes: Buffer.from(text, "utf8"),
+            },
+        ],
+        itemCount: entries.length,
+    };
+}
+function checkEntry(entry, index, previousUuid, sessionId, defects) {
+    const at = `items/${index}`;
+    const type = entry.type;
+    if (typeof type !== "string" || !WRITTEN_ENTRY_TYPES.includes(type)) {
+        defects.push({
+            path: `${at}/type`,
+            message: `entry type ${JSON.stringify(type)} is not one of ${WRITTEN_ENTRY_TYPES.join(", ")}; Claude Code would not show it as a turn`,
+        });
+    }
+    if (asString(entry.uuid) === null) {
+        defects.push({
+            path: `${at}/uuid`,
+            message: "missing uuid; the transcript chain cannot be built",
+        });
+    }
+    const timestamp = asString(entry.timestamp);
+    if (timestamp === null || !TIMESTAMP_PATTERN.test(timestamp)) {
+        defects.push({
+            path: `${at}/timestamp`,
+            message: `malformed timestamp ${JSON.stringify(entry.timestamp)}; the resume list sorts on it`,
+        });
+    }
+    if (asString(entry.sessionId) !== sessionId) {
+        defects.push({
+            path: `${at}/sessionId`,
+            message: `entry sessionId ${JSON.stringify(entry.sessionId)} does not match the session being written`,
+        });
+    }
+    if (index === 0) {
+        if (entry.parentUuid !== null) {
+            defects.push({
+                path: `${at}/parentUuid`,
+                message: "the first entry must have a null parentUuid",
+            });
+        }
+    }
+    else if (asString(entry.parentUuid) !== previousUuid) {
+        defects.push({
+            path: `${at}/parentUuid`,
+            message: "parentUuid does not point at the entry before it; the transcript would break",
+        });
+    }
+    const message = asObject(entry.message);
+    if (message === null) {
+        defects.push({
+            path: `${at}/message`,
+            message: "null or missing message body; Claude Code would fail on it",
+        });
+        return;
+    }
+    const expectedRole = type === ENTRY_TYPE_ASSISTANT ? "assistant" : "user";
+    if (message.role !== expectedRole) {
+        defects.push({
+            path: `${at}/message/role`,
+            message: `message role ${JSON.stringify(message.role)} does not match entry type ${JSON.stringify(type)}`,
+        });
+    }
+    const content = message.content;
+    const emptyContent = content === null ||
+        content === undefined ||
+        (typeof content === "string" && content === "") ||
+        (Array.isArray(content) && content.length === 0);
+    if (emptyContent) {
+        defects.push({
+            path: `${at}/message/content`,
+            message: "empty message content; the turn would be invisible",
+        });
+    }
+    if (type === ENTRY_TYPE_ASSISTANT) {
+        if (asObject(message.usage) === null) {
+            defects.push({
+                path: `${at}/message/usage`,
+                message: "assistant message has no usage object",
+            });
+        }
+        if (asString(message.model) === null) {
+            defects.push({
+                path: `${at}/message/model`,
+                message: "assistant message has no model",
+            });
+        }
+    }
+}
+/** Every structural defect, not the first (FR-50). Empty means the bytes may be placed. */
+export function validate(serialized) {
+    const defects = [];
+    if (serialized.files.length === 0) {
+        defects.push({ path: "files", message: "no file to place" });
+    }
+    let index = 0;
+    serialized.files.forEach((file, fileIndex) => {
+        if (!path.isAbsolute(file.absolutePath)) {
+            defects.push({
+                path: `files/${fileIndex}/absolutePath`,
+                message: "path is not absolute",
+            });
+        }
+        if (!file.absolutePath.endsWith(`${serialized.sessionId}${SESSION_FILE_SUFFIX}`)) {
+            defects.push({
+                path: `files/${fileIndex}/absolutePath`,
+                message: `file name does not match the session id ${serialized.sessionId}; Claude Code keys a session by its file name`,
+            });
+        }
+        const { entries, unreadable } = parseJsonl(file.bytes.toString("utf8"));
+        if (unreadable !== null) {
+            defects.push({
+                path: `files/${fileIndex}`,
+                message: `not a readable session file: ${unreadable}`,
+            });
+        }
+        let previousUuid = null;
+        for (const entry of entries) {
+            checkEntry(entry, index, previousUuid, serialized.sessionId, defects);
+            previousUuid = asString(entry.uuid);
+            index++;
+        }
+    });
+    if (index !== serialized.itemCount) {
+        defects.push({
+            path: "itemCount",
+            message: `itemCount is ${serialized.itemCount} but the files hold ${index} items; FR-52 compares the two`,
+        });
+    }
+    return defects;
+}

package/node_modules/@herbertgao/resume-from/dist/adapters/codex/contract.d.ts

@@ -0,0 +1,15 @@
+import type { AdapterRole, AgentAdapter, AgentCapabilities, AgentRuntime, Bytes, LandingLevel, PendingFile, ProvenanceSupport, SelectionLevel, SerializedSession, StoredSessionFacts, SwitchOutcome, ValidationDefect } from "../contract.js";
+export type { AdapterRole, AgentAdapter, AgentCapabilities, AgentRuntime, Bytes, LandingLevel, PendingFile, ProvenanceSupport, SelectionLevel, SerializedSession, StoredSessionFacts, SwitchOutcome, ValidationDefect, };
+import type { AgentId, CanonicalSession, CanonicalTurn, HomePath, ProvenanceMarker, RepoSnapshot, SessionDescriptor, SessionId, SessionRef, SourceProvenance, TargetProfile, ToolCallRecord, ToolEffect, TurnKind, TurnRole } from "../../session/contract.js";
+export type { AgentId, CanonicalSession, CanonicalTurn, HomePath, ProvenanceMarker, RepoSnapshot, SessionDescriptor, SessionId, SessionRef, SourceProvenance, TargetProfile, ToolCallRecord, ToolEffect, TurnKind, TurnRole, };
+/** The injectable seam that keeps serialize pure (no ambient process state). */
+export interface CodexSerializeDeps {
+    /** Where the user is when the import runs. `codex resume` filters the picker by cwd. */
+    cwd(): string;
+    /** Produces the new thread's UUID. Injected so two calls with the same deps are byte-equal. */
+    newSessionId(): string;
+}
+/** Builds the Codex adapter. The only export of this module (FR-57). */
+export interface CodexAdapterFactory {
+    create(overrides?: Partial<CodexSerializeDeps>): AgentAdapter;
+}

package/node_modules/@herbertgao/resume-from/dist/adapters/codex/contract.js

@@ -0,0 +1,4 @@
+// GENERATED from src/adapters/codex/module.md — the Public Contract section is the normative home.
+// Declarations only: no behaviour, no defaults. If this file and module.md disagree,
+// the document wins and this file is corrected.
+export {};

package/node_modules/@herbertgao/resume-from/dist/adapters/codex/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The Codex adapter: everything the tool knows about Codex, behind the one contract every
+ * adapter implements (FR-57).
+ */
+import type { CodexAdapterFactory } from "./contract.js";
+export declare const codexAdapterFactory: CodexAdapterFactory;

package/node_modules/@herbertgao/resume-from/dist/adapters/codex/index.js

@@ -0,0 +1,44 @@
+/**
+ * The Codex adapter: everything the tool knows about Codex, behind the one contract every
+ * adapter implements (FR-57).
+ */
+import { randomUUID } from "node:crypto";
+import { listCodexSessions, loadCodexSession } from "./read.js";
+import { readBackCodex, switchToCodex } from "./readback.js";
+import { defaultCodexHome } from "./rollout.js";
+import { serializeCodex, validateCodex } from "./write.js";
+/** Codex's own default for the models it ships with. Configuration overrides it (FR-18). */
+const CODEX_WINDOW_TOKENS = 258_400;
+const DEFAULT_DEPS = {
+    cwd: () => process.cwd(),
+    newSessionId: () => randomUUID(),
+};
+function codexCapabilities() {
+    return {
+        agent: "codex",
+        roles: ["source", "target"],
+        // C-1: Codex cannot host our picker, so the user picks from a numbered list we print.
+        selection: "numbered-list",
+        // C-2: Codex cannot move the user, so the landing hands back the command (FR-45).
+        landing: "create-only",
+        // Codex has no verified durable, out-of-context entry shape. The CLI prints
+        // provenance after landing instead of writing it as a conversation turn.
+        provenance: "host-output-only",
+        defaultHome: defaultCodexHome(),
+        defaultWindowTokens: CODEX_WINDOW_TOKENS,
+    };
+}
+export const codexAdapterFactory = {
+    create(overrides = {}) {
+        const deps = { ...DEFAULT_DEPS, ...overrides };
+        return {
+            capabilities: codexCapabilities,
+            listSessions: listCodexSessions,
+            loadSession: loadCodexSession,
+            serialize: (session, target, marker) => serializeCodex(session, target, marker, deps),
+            validate: validateCodex,
+            readBack: readBackCodex,
+            switchTo: switchToCodex,
+        };
+    },
+};

package/node_modules/@herbertgao/resume-from/dist/adapters/codex/read.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The source role: a Codex home becomes a list of sessions, and one session becomes the
+ * canonical vocabulary. Every result body is dropped (FR-24) and every reasoning trace is
+ * ignored (FR-28, C-4).
+ */
+import type { CanonicalSession, CanonicalTurn, SessionDescriptor } from "./contract.js";
+import type { CodexSessionMeta } from "./rollout.js";
+export interface CodexRollout {
+    filePath: string;
+    meta: CodexSessionMeta | null;
+    turns: CanonicalTurn[];
+    /** Entries of a type this module does not understand. Codex drops them in silence (C-6). */
+    skippedEntries: number;
+    startedAt: string | null;
+    updatedAt: string | null;
+    title: string;
+    changedPaths: string[];
+    truncated: boolean;
+}
+export declare class CodexRolloutUnreadableError extends Error {
+    constructor(filePath: string);
+}
+/** Lenient: a file cut mid-entry still yields whatever parsed, with `truncated` set. */
+export declare function scanRollout(filePath: string): Promise<CodexRollout>;
+/** Strict: FR-51's "unreadable" answer. */
+export declare function readRollout(filePath: string): Promise<CodexRollout>;
+export declare function listCodexSessions(home: string): Promise<SessionDescriptor[]>;
+export declare function loadCodexSession(descriptor: SessionDescriptor): Promise<CanonicalSession>;

package/node_modules/@herbertgao/resume-from/dist/adapters/codex/read.js

@@ -0,0 +1,270 @@
+/**
+ * The source role: a Codex home becomes a list of sessions, and one session becomes the
+ * canonical vocabulary. Every result body is dropped (FR-24) and every reasoning trace is
+ * ignored (FR-28, C-4).
+ */
+import { readFile } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { redactSensitiveArgumentsText, redactSensitiveText } from "./redaction.js";
+import { CODEX_ENTRY_COMPACTED, CODEX_ENTRY_EVENT_MSG, CODEX_ENTRY_RESPONSE_ITEM, CODEX_EVENT_AGENT_MESSAGE, CODEX_EVENT_USER_MESSAGE, CODEX_ITEM_CUSTOM_TOOL_CALL, CODEX_ITEM_CUSTOM_TOOL_CALL_OUTPUT, CODEX_ITEM_FUNCTION_CALL, CODEX_ITEM_FUNCTION_CALL_OUTPUT, isNotFoundError, KNOWN_ENTRY_TYPES, listRolloutFiles, parseRolloutText, payloadType, readSessionMeta, sessionsRoot, toIsoUtc, } from "./rollout.js";
+const TITLE_LIMIT = 80;
+const ARGUMENTS_PREVIEW_LIMIT = 60;
+/** Tools whose name alone settles the question (FR-26). Everything else stays "unknown". */
+const READ_ONLY_TOOLS = new Set([
+    "read_file",
+    "read",
+    "view_image",
+    "list_dir",
+    "grep",
+    "find",
+    "web_search",
+]);
+const MUTATING_TOOLS = new Set([
+    "apply_patch",
+    "write_file",
+    "edit_file",
+    "create_file",
+    "delete_file",
+]);
+export class CodexRolloutUnreadableError extends Error {
+    constructor(filePath) {
+        super(`Codex thread is unreadable: ${filePath} was cut mid-entry`);
+        this.name = "CodexRolloutUnreadableError";
+    }
+}
+/** Lenient: a file cut mid-entry still yields whatever parsed, with `truncated` set. */
+export async function scanRollout(filePath) {
+    // Whole-file read: listing a home reads every rollout, and C-5 measured those files
+    // in megabytes. Ceiling accepted because title and turn count both need the whole file;
+    // revisit if a home with thousands of threads makes the listing feel slow.
+    const text = await readFile(filePath, "utf8");
+    const { entries, truncated } = parseRolloutText(text);
+    let meta = null;
+    for (const entry of entries) {
+        meta = readSessionMeta(entry);
+        if (meta !== null)
+            break;
+    }
+    const { turns, skippedEntries, changedPaths } = toCanonicalTurns(entries);
+    const firstUserTurn = turns.find((turn) => turn.role === "user" && turn.kind === "message");
+    const lastStamp = [...entries].reverse().find((entry) => toIsoUtc(entry.timestamp) !== null);
+    return {
+        filePath,
+        meta,
+        turns,
+        skippedEntries,
+        startedAt: toIsoUtc(meta?.timestamp ?? entries[0]?.timestamp ?? null),
+        updatedAt: toIsoUtc(lastStamp?.timestamp ?? meta?.timestamp ?? null),
+        title: titleOf(firstUserTurn?.text ?? ""),
+        changedPaths,
+        truncated,
+    };
+}
+/** Strict: FR-51's "unreadable" answer. */
+export async function readRollout(filePath) {
+    const rollout = await scanRollout(filePath);
+    if (rollout.truncated)
+        throw new CodexRolloutUnreadableError(filePath);
+    return rollout;
+}
+export async function listCodexSessions(home) {
+    const descriptors = [];
+    for (const filePath of await listRolloutFiles(sessionsRoot(home))) {
+        let rollout;
+        try {
+            rollout = await scanRollout(filePath);
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                continue; // A rollout may disappear during a concurrent cleanup.
+            throw error;
+        }
+        if (rollout.meta === null)
+            continue;
+        descriptors.push({
+            ref: { agent: "codex", home, id: rollout.meta.id },
+            title: rollout.title,
+            startedAt: rollout.startedAt ?? "",
+            updatedAt: rollout.updatedAt ?? rollout.startedAt ?? "",
+            turnCount: rollout.turns.length,
+            repoPath: rollout.meta.cwd !== null && isAbsolute(rollout.meta.cwd) ? rollout.meta.cwd : null,
+            filePath,
+        });
+    }
+    descriptors.sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+    return descriptors;
+}
+export async function loadCodexSession(descriptor) {
+    const rollout = await readRollout(descriptor.filePath);
+    return {
+        provenance: {
+            ref: descriptor.ref,
+            title: descriptor.title,
+            startedAt: descriptor.startedAt,
+            updatedAt: descriptor.updatedAt,
+            repo: {
+                commit: rollout.meta?.commit ?? null,
+                branch: rollout.meta?.branch ?? null,
+                changedPaths: rollout.changedPaths,
+            },
+        },
+        turns: rollout.turns,
+    };
+}
+function titleOf(text) {
+    const line = text
+        .split("\n")
+        .find((candidate) => candidate.trim() !== "")
+        ?.trim() ?? "";
+    return line.length > TITLE_LIMIT ? `${line.slice(0, TITLE_LIMIT - 1)}…` : line;
+}
+/**
+ * Messages come from `event_msg` and tool calls from `response_item`: the same text appears in
+ * both shapes, and taking each from one place is what keeps every turn out of the session twice.
+ * Reasoning, in either shape, produces nothing at all (C-4, FR-28, NG-8).
+ */
+function toCanonicalTurns(entries) {
+    const outputs = new Map();
+    for (const entry of entries) {
+        if (entry.type !== CODEX_ENTRY_RESPONSE_ITEM)
+            continue;
+        const type = payloadType(entry);
+        if (type !== CODEX_ITEM_FUNCTION_CALL_OUTPUT && type !== CODEX_ITEM_CUSTOM_TOOL_CALL_OUTPUT)
+            continue;
+        const callId = entry.payload.call_id;
+        if (typeof callId !== "string")
+            continue;
+        outputs.set(callId, outputTextOf(entry.payload.output));
+    }
+    const turns = [];
+    const changed = new Set();
+    let skippedEntries = 0;
+    for (const entry of entries) {
+        if (!KNOWN_ENTRY_TYPES.has(entry.type)) {
+            skippedEntries += 1;
+            continue;
+        }
+        const type = payloadType(entry);
+        if (entry.type === CODEX_ENTRY_COMPACTED) {
+            const message = entry.payload.message;
+            if (typeof message !== "string" || message.trim() === "")
+                continue;
+            turns.push({
+                index: turns.length,
+                role: "agent",
+                kind: "summary",
+                // FR-28, security: credentials in message text must not cross to a different vendor.
+                text: redactSensitiveText(message),
+                toolCall: null,
+                timestamp: toIsoUtc(entry.timestamp),
+            });
+            continue;
+        }
+        if (entry.type === CODEX_ENTRY_EVENT_MSG) {
+            if (type !== CODEX_EVENT_USER_MESSAGE && type !== CODEX_EVENT_AGENT_MESSAGE)
+                continue;
+            const message = entry.payload.message;
+            if (typeof message !== "string" || message.trim() === "")
+                continue;
+            turns.push({
+                index: turns.length,
+                role: type === CODEX_EVENT_USER_MESSAGE ? "user" : "agent",
+                kind: "message",
+                // FR-28, security: credentials in message text must not cross to a different vendor.
+                text: redactSensitiveText(message),
+                toolCall: null,
+                timestamp: toIsoUtc(entry.timestamp),
+            });
+            continue;
+        }
+        if (entry.type !== CODEX_ENTRY_RESPONSE_ITEM)
+            continue;
+        if (type !== CODEX_ITEM_FUNCTION_CALL && type !== CODEX_ITEM_CUSTOM_TOOL_CALL)
+            continue;
+        const toolName = typeof entry.payload.name === "string" ? entry.payload.name : "";
+        if (toolName === "")
+            continue;
+        const rawArguments = type === CODEX_ITEM_FUNCTION_CALL ? entry.payload.arguments : entry.payload.input;
+        const argumentsText = typeof rawArguments === "string" ? rawArguments : "";
+        const callId = entry.payload.call_id;
+        // FR-54: use has() not get() — outputs.get() can return "" for an empty result.
+        const resultRecorded = typeof callId === "string" && outputs.has(callId);
+        const output = typeof callId === "string" ? (outputs.get(callId) ?? null) : null;
+        const toolCall = toolCallRecord(toolName, argumentsText, output, resultRecorded);
+        if (toolCall.effect === "mutating")
+            for (const path of pathsOf(argumentsText))
+                changed.add(path);
+        turns.push({
+            index: turns.length,
+            role: "agent",
+            kind: "tool-call",
+            text: "",
+            toolCall,
+            timestamp: toIsoUtc(entry.timestamp),
+        });
+    }
+    return { turns, skippedEntries, changedPaths: [...changed] };
+}
+/** Only the shape of the output is measured. Not one fragment of it is carried (FR-24, FR-25). */
+function toolCallRecord(toolName, argumentsText, output, resultRecorded) {
+    const safeArguments = redactSensitiveArgumentsText(argumentsText);
+    const head = `${toolName}(${singleLine(safeArguments, ARGUMENTS_PREVIEW_LIMIT)})`;
+    const outcomeLine = output === null
+        ? `${head} → no output recorded`
+        : `${head} → ${output.split("\n").length} lines, body dropped`;
+    return {
+        toolName,
+        argumentsText: safeArguments,
+        outcomeLine: redactSensitiveText(outcomeLine),
+        effect: effectOf(toolName),
+        bodyDropped: output !== null,
+        // FR-54: false when no *_call_output entry existed for this call_id (broken tail signal).
+        resultRecorded,
+    };
+}
+function effectOf(toolName) {
+    if (MUTATING_TOOLS.has(toolName))
+        return "mutating";
+    if (READ_ONLY_TOOLS.has(toolName))
+        return "read-only";
+    return "unknown";
+}
+function outputTextOf(output) {
+    if (typeof output === "string")
+        return output;
+    if (Array.isArray(output)) {
+        return output
+            .map((part) => typeof part === "object" && part !== null
+            ? String(part.text ?? "")
+            : "")
+            .join("\n");
+    }
+    return output === undefined || output === null ? "" : JSON.stringify(output);
+}
+function singleLine(text, limit) {
+    const flat = text.replaceAll(/\s+/g, " ").trim();
+    return flat.length > limit ? `${flat.slice(0, limit - 1)}…` : flat;
+}
+/** Files a mutating call touched, for RepoSnapshot.changedPaths (FR-36). */
+function pathsOf(argumentsText) {
+    let text = argumentsText;
+    const direct = [];
+    try {
+        const parsed = JSON.parse(argumentsText);
+        if (typeof parsed === "object" && parsed !== null) {
+            const record = parsed;
+            const strings = Object.values(record).filter((value) => typeof value === "string");
+            text = strings.join("\n");
+            for (const key of ["path", "file_path", "filename"]) {
+                const value = record[key];
+                if (typeof value === "string" && value !== "")
+                    direct.push(value);
+            }
+        }
+    }
+    catch {
+        // Arguments that are not JSON are searched as they were recorded.
+    }
+    const patched = [...text.matchAll(/\*\*\* (?:Add|Update|Delete) File: (.+)/g)].map((match) => (match[1] ?? "").trim());
+    return [...direct, ...patched].filter((path) => path !== "");
+}