@indigoai-us/hq-cloud 6.15.29 → 6.15.31

package/dist/telemetry.js

@@ -7,12 +7,10 @@
  * (`hq-sync-runner`, `hq-cli`, mobile wrappers) emits telemetry uniformly.
  *
  * What it does: after each successful sync (`all-complete` arm of
- * `bin/sync-runner.ts`), walks Grok `updates.jsonl` sessions, live and archived
- * Codex rollouts, and Claude session logs, then diffs each file against the
- * persisted byte-offset cursor at `~/.hq/telemetry-cursor.json`, sanitizes new
- * rows through a tight allowlist that matches the server's KEEP_FIELDS set in
- * `apps/hq-pro/src/vault-service/handlers/usage.ts`, batches into server-sized
- * POST bodies, and ships them to `/v1/usage`.
+ * `bin/sync-runner.ts`), walks Claude session logs plus live and archived Codex
+ * rollouts, then diffs each file against the persisted byte-offset cursor at `~/.hq/telemetry-cursor.json`, sanitizes new rows through a tight allowlist that matches the server's
+ * KEEP_FIELDS set in `apps/hq-pro/src/vault-service/handlers/usage.ts`,
+ * batches into server-sized POST bodies, and ships them to `/v1/usage`.
  *
  * Trust model: the caller's `personUid` is resolved on the server from the
  * Cognito JWT — never from the body. `sanitizeRow` strips prompt bodies,
@@ -432,167 +430,6 @@ async function listCodexRolloutFiles(codexRoot) {
     ]);
     return sortFilesFreshestFirst([...live, ...archived].filter((file) => path.basename(file).startsWith("rollout-")));
 }
-// ── Grok session adapter ─────────────────────────────────────────────────────
-function grokTimestamp(value) {
-    if (typeof value === "string") {
-        return boundedString(value, MAX_TIMESTAMP_BYTES);
-    }
-    if (typeof value === "number" && Number.isFinite(value)) {
-        const ms = value > 1e12 ? value : value * 1000;
-        try {
-            return new Date(ms).toISOString();
-        }
-        catch {
-            return undefined;
-        }
-    }
-    return undefined;
-}
-function stableGrokEventId(sessionId, promptId, model) {
-    return ("grok-" +
-        createHash("sha256")
-            .update(sessionId)
-            .update(Buffer.from([0]))
-            .update(promptId)
-            .update(Buffer.from([0]))
-            .update(model)
-            .digest("hex"));
-}
-function grokUsageMessage(usage, model) {
-    const message = {
-        usage: {
-            input_tokens: tokenCount(usage.inputTokens),
-            output_tokens: tokenCount(usage.outputTokens) + tokenCount(usage.reasoningTokens),
-            cache_read_input_tokens: tokenCount(usage.cachedReadTokens),
-            cache_creation_input_tokens: tokenCount(usage.cacheCreationTokens),
-        },
-    };
-    if (model)
-        message.model = model;
-    return message;
-}
-/**
- * Adapt a Grok `updates.jsonl` record to Claude-shaped sanitizer input(s).
- * Emits only on `turn_completed` with `usage`. When `usage.modelUsage` is
- * present, one row per model key (chart stacks by model id).
- */
-export function grokUsageRows(row, sessionMeta) {
-    if (!row || typeof row !== "object" || Array.isArray(row))
-        return [];
-    const obj = row;
-    const method = obj.method;
-    if (method !== "session/update" && method !== "_x.ai/session/update") {
-        return [];
-    }
-    const rawParams = obj.params;
-    if (!rawParams || typeof rawParams !== "object" || Array.isArray(rawParams)) {
-        return [];
-    }
-    const params = rawParams;
-    const rawUpdate = params.update;
-    if (!rawUpdate || typeof rawUpdate !== "object" || Array.isArray(rawUpdate)) {
-        return [];
-    }
-    const update = rawUpdate;
-    if (update.sessionUpdate !== "turn_completed")
-        return [];
-    const rawUsage = update.usage;
-    if (!rawUsage || typeof rawUsage !== "object" || Array.isArray(rawUsage)) {
-        return [];
-    }
-    const usage = rawUsage;
-    const sessionId = boundedString(params.sessionId, MAX_ID_BYTES);
-    const promptId = typeof update.prompt_id === "string" ? update.prompt_id : "";
-    const timestamp = grokTimestamp(obj.timestamp);
-    const updateMeta = update._meta;
-    const paramsMeta = params._meta;
-    const eventId = (updateMeta &&
-        typeof updateMeta === "object" &&
-        !Array.isArray(updateMeta)
-        ? boundedString(updateMeta.eventId, MAX_ID_BYTES)
-        : undefined) ??
-        (paramsMeta &&
-            typeof paramsMeta === "object" &&
-            !Array.isArray(paramsMeta)
-            ? boundedString(paramsMeta.eventId, MAX_ID_BYTES)
-            : undefined);
-    const buildRow = (model, modelUsage, preferEventId) => {
-        const normalized = {
-            uuid: preferEventId && eventId
-                ? eventId
-                : stableGrokEventId(sessionId ?? "", promptId, model ?? ""),
-            message: grokUsageMessage(modelUsage, model),
-        };
-        if (sessionId)
-            normalized.sessionId = sessionId;
-        if (timestamp)
-            normalized.timestamp = timestamp;
-        if (sessionMeta.cwd)
-            normalized.cwd = sessionMeta.cwd;
-        if (sessionMeta.gitBranch)
-            normalized.gitBranch = sessionMeta.gitBranch;
-        return normalized;
-    };
-    const modelUsage = usage.modelUsage;
-    if (modelUsage &&
-        typeof modelUsage === "object" &&
-        !Array.isArray(modelUsage)) {
-        const entries = Object.entries(modelUsage).filter(([, entry]) => !!entry && typeof entry === "object" && !Array.isArray(entry));
-        const single = entries.length === 1;
-        const rows = [];
-        for (const [modelKey, entry] of entries) {
-            const model = boundedString(modelKey, MAX_MODEL_BYTES);
-            if (!model)
-                continue;
-            rows.push(buildRow(model, entry, single));
-        }
-        return rows;
-    }
-    return [
-        buildRow(sessionMeta.fallback_model, usage, true),
-    ];
-}
-function decodeGrokCwdFolder(encoded) {
-    try {
-        return boundedString(decodeURIComponent(encoded), MAX_PATH_BYTES);
-    }
-    catch {
-        return boundedString(encoded, MAX_PATH_BYTES);
-    }
-}
-/** Load cwd / branch / fallback model from sibling `summary.json` once per file. */
-export async function loadGrokSessionMeta(updatesPath) {
-    const sessionDir = path.dirname(updatesPath);
-    const encodedCwdDir = path.basename(path.dirname(sessionDir));
-    const meta = {};
-    try {
-        const raw = await fs.readFile(path.join(sessionDir, "summary.json"), "utf-8");
-        const parsed = JSON.parse(raw);
-        const info = parsed.info && typeof parsed.info === "object" && !Array.isArray(parsed.info)
-            ? parsed.info
-            : undefined;
-        meta.cwd =
-            boundedString(info?.cwd, MAX_PATH_BYTES) ??
-                boundedString(parsed.cwd, MAX_PATH_BYTES);
-        meta.gitBranch =
-            boundedString(parsed.head_branch, MAX_PATH_BYTES) ??
-                boundedString(info?.head_branch, MAX_PATH_BYTES);
-        meta.fallback_model =
-            boundedString(parsed.current_model_id, MAX_MODEL_BYTES) ??
-                boundedString(info?.current_model_id, MAX_MODEL_BYTES);
-    }
-    catch {
-        // Missing / unreadable summary — fall through to folder-name decode.
-    }
-    if (!meta.cwd) {
-        meta.cwd = decodeGrokCwdFolder(encodedCwdDir);
-    }
-    return meta;
-}
-async function listGrokUpdateFiles(grokRoot) {
-    const all = await listJsonlFiles(path.join(grokRoot, "sessions"));
-    return sortFilesFreshestFirst(all.filter((file) => path.basename(file) === "updates.jsonl"));
-}
 // ── Batching primitives ───────────────────────────────────────────────────────
 const MAX_BATCH_EVENTS = 100;
 const MAX_BATCH_BYTES = 240 * 1024;
@@ -657,7 +494,7 @@ function boundRowForPost(row, maxRowBytes) {
 }
 // ── Main entry point ──────────────────────────────────────────────────────────
 /**
- * Scan, sanitize, and POST new Grok, Codex, and Claude Code usage rows.
+ * Scan, sanitize, and POST new Claude Code and Codex usage rows.
  *
  * Fire-and-forget from the caller's perspective: errors are caught internally
  * and surfaced only via `log`. The returned summary lets observers (e.g.
@@ -668,7 +505,6 @@ export async function collectAndSendTelemetry(opts) {
     const home = os.homedir();
     const claudeProjectsRoot = opts.claudeProjectsRoot ?? path.join(home, ".claude", "projects");
     const codexRoot = opts.codexRoot ?? path.join(home, ".codex");
-    const grokRoot = opts.grokRoot ?? path.join(home, ".grok");
     const cursorPath = opts.cursorPath ?? path.join(home, ".hq", "telemetry-cursor.json");
     const menubarPath = opts.menubarPath ?? path.join(home, ".hq", "menubar.json");
     const log = opts.log ?? (() => { });
@@ -686,80 +522,73 @@ export async function collectAndSendTelemetry(opts) {
             ? repoCompanyMap.bySlug.get(opts.fallbackCompany)
             : undefined;
     // 1. Opt-in check (server-authoritative, with local fallback + self-heal).
-    // Fleet agents skip this: collection is always on (company + unattributed).
     let enabled;
     let optInSource;
-    if (opts.forceCollect) {
-        enabled = true;
-        optInSource = "agent-required";
-    }
-    else {
-        try {
-            const resp = await opts.client.getTelemetryOptIn();
-            enabled = resp.enabled === true;
-            optInSource = "server";
-            // Self-heal a consent the user gave but that never reached the server.
-            //
-            // The installer writes the answer to `~/.hq/menubar.json` (always succeeds)
-            // AND posts it to `/v1/usage/opt-in` — but that post fires before the
-            // person entity exists, so it 404s and the attribute is never written.
-            // Absence then reads as `false`, the emitter goes silent, and the person
-            // shows as "not opted in" forever. Measured: 22 of 33 active Indigo members
-            // had no attribute at all, against only 2 genuine opt-outs.
-            //
-            // `unset` (never answered) is the ONLY state we heal. An explicit server
-            // `false` is a real opt-out and is left strictly alone. We also require a
-            // local answer to actually exist — we never invent consent, we only replay
-            // the answer the user already gave.
-            //
-            // And it must be THIS account's answer. `menubar.json` is per-MACHINE, so
-            // when two people sign in under the same OS user it holds whoever answered
-            // last; replaying that for the second account would opt in someone who
-            // never consented. The replay therefore requires the cached record to name
-            // the same `prs_*` the server says we are. A legacy record with no binding
-            // cannot be proven to belong to this caller and is skipped — for those
-            // machines the installer's own post-sign-in upload is the recovery path,
-            // and it is correctly account-scoped because it runs right after that
-            // person authenticates.
-            if (resp.unset === true && opts.client.setTelemetryOptIn) {
-                const record = await readLocalConsentRecord(menubarPath);
-                const local = record.enabled;
-                const boundToCaller = record.personUid !== undefined &&
-                    resp.personUid !== undefined &&
-                    record.personUid === resp.personUid;
-                if (local !== undefined && !boundToCaller) {
-                    log("[telemetry] skipping consent re-assert: the locally cached answer is not bound to the signed-in account");
-                }
-                if (local !== undefined && boundToCaller) {
-                    try {
-                        // `onlyIfUnset` keeps the replay atomic. Reading `unset` and writing
-                        // are two requests, so without it another device could record a real
-                        // opt-out in between and this stale local answer would overwrite it.
-                        // The server tests "still unset?" as part of the write instead.
-                        const ack = await opts.client.setTelemetryOptIn(local, { onlyIfUnset: true });
-                        if (ack && ack.applied === false) {
-                            // Lost the race — a real answer was recorded first and it stands.
-                            // Keep the server's answer for this run rather than the local one.
-                            log("[telemetry] consent was recorded elsewhere before the re-assert landed; deferring to the server");
-                        }
-                        else {
-                            enabled = local;
-                            optInSource = "menubar-reasserted";
-                            log(`[telemetry] server had no recorded consent; re-asserted the local install-time answer (enabled=${local})`);
-                        }
+    try {
+        const resp = await opts.client.getTelemetryOptIn();
+        enabled = resp.enabled === true;
+        optInSource = "server";
+        // Self-heal a consent the user gave but that never reached the server.
+        //
+        // The installer writes the answer to `~/.hq/menubar.json` (always succeeds)
+        // AND posts it to `/v1/usage/opt-in` — but that post fires before the
+        // person entity exists, so it 404s and the attribute is never written.
+        // Absence then reads as `false`, the emitter goes silent, and the person
+        // shows as "not opted in" forever. Measured: 22 of 33 active Indigo members
+        // had no attribute at all, against only 2 genuine opt-outs.
+        //
+        // `unset` (never answered) is the ONLY state we heal. An explicit server
+        // `false` is a real opt-out and is left strictly alone. We also require a
+        // local answer to actually exist — we never invent consent, we only replay
+        // the answer the user already gave.
+        //
+        // And it must be THIS account's answer. `menubar.json` is per-MACHINE, so
+        // when two people sign in under the same OS user it holds whoever answered
+        // last; replaying that for the second account would opt in someone who
+        // never consented. The replay therefore requires the cached record to name
+        // the same `prs_*` the server says we are. A legacy record with no binding
+        // cannot be proven to belong to this caller and is skipped — for those
+        // machines the installer's own post-sign-in upload is the recovery path,
+        // and it is correctly account-scoped because it runs right after that
+        // person authenticates.
+        if (resp.unset === true && opts.client.setTelemetryOptIn) {
+            const record = await readLocalConsentRecord(menubarPath);
+            const local = record.enabled;
+            const boundToCaller = record.personUid !== undefined &&
+                resp.personUid !== undefined &&
+                record.personUid === resp.personUid;
+            if (local !== undefined && !boundToCaller) {
+                log("[telemetry] skipping consent re-assert: the locally cached answer is not bound to the signed-in account");
+            }
+            if (local !== undefined && boundToCaller) {
+                try {
+                    // `onlyIfUnset` keeps the replay atomic. Reading `unset` and writing
+                    // are two requests, so without it another device could record a real
+                    // opt-out in between and this stale local answer would overwrite it.
+                    // The server tests "still unset?" as part of the write instead.
+                    const ack = await opts.client.setTelemetryOptIn(local, { onlyIfUnset: true });
+                    if (ack && ack.applied === false) {
+                        // Lost the race — a real answer was recorded first and it stands.
+                        // Keep the server's answer for this run rather than the local one.
+                        log("[telemetry] consent was recorded elsewhere before the re-assert landed; deferring to the server");
                     }
-                    catch (err) {
-                        // Non-fatal: fall through on the server's answer. Next run retries.
-                        log(`[telemetry] failed to re-assert local opt-in (${err.message ?? err})`);
+                    else {
+                        enabled = local;
+                        optInSource = "menubar-reasserted";
+                        log(`[telemetry] server had no recorded consent; re-asserted the local install-time answer (enabled=${local})`);
                     }
                 }
+                catch (err) {
+                    // Non-fatal: fall through on the server's answer. Next run retries.
+                    log(`[telemetry] failed to re-assert local opt-in (${err.message ?? err})`);
+                }
             }
         }
-        catch (err) {
-            log(`[telemetry] opt-in check failed (${err.message ?? err}) — falling back to local menubar.json`);
-            enabled = await readLocalTelemetryEnabled(menubarPath);
-            optInSource = "menubar-fallback";
-        }
+    }
+    catch (err) {
+        log(`[telemetry] opt-in check failed (${err.message ?? err}) — falling back to local menubar.json`);
+        enabled = await readLocalTelemetryEnabled(menubarPath);
+        optInSource = "menubar-fallback";
     }
     // Consent split (company-scope mandatory capture): a FALSE/unset personal
     // opt-in silences PERSONAL/unattributed rows only. Rows produced inside a
@@ -779,16 +608,14 @@ export async function collectAndSendTelemetry(opts) {
     const loadedFiles = { ...cursor.files };
     const rotationResets = {};
     const newlyCommitted = {};
-    const [claudeFilesUnsorted, codexFiles, grokFiles] = await Promise.all([
+    const [claudeFilesUnsorted, codexFiles] = await Promise.all([
         listJsonlFiles(claudeProjectsRoot),
         listCodexRolloutFiles(codexRoot),
-        listGrokUpdateFiles(grokRoot),
     ]);
     const claudeFiles = await sortFilesFreshestFirst(claudeFilesUnsorted);
-    // Newest runtimes first so a bounded first pass reports current Grok/Codex
-    // use before replaying an older Claude backlog.
+    // Codex goes first so a fresh Linux install cannot spend its entire bounded
+    // pass replaying an older Claude backlog before reporting current Codex use.
     const files = [
-        ...grokFiles.map((filePath) => ({ filePath, kind: "grok" })),
         ...codexFiles.map((filePath) => ({ filePath, kind: "codex" })),
         ...claudeFiles.map((filePath) => ({ filePath, kind: "claude" })),
     ];
@@ -808,7 +635,7 @@ export async function collectAndSendTelemetry(opts) {
     let batchesSent = 0;
     let uploadFailed = false;
     let batchLimitReached = false;
-    const scannedBytes = { claude: 0, codex: 0, grok: 0 };
+    const scannedBytes = { claude: 0, codex: 0 };
     const commitSources = (sources) => {
         const maxPerFile = new Map();
         for (const source of sources) {
@@ -877,21 +704,16 @@ export async function collectAndSendTelemetry(opts) {
         const currentMtime = Math.floor(stat.mtimeMs / 1000);
         const stored = cursor.files[filePath] ?? { offset: 0, mtime: 0 };
         let offset = stored.offset;
-        const needsScanContext = kind === "codex" || kind === "grok";
-        let scanContext = needsScanContext
-            ? cloneCodexContext(stored.context ?? {})
-            : undefined;
+        let codexContext = kind === "codex" ? cloneCodexContext(stored.context ?? {}) : undefined;
         const rotated = currentSize < offset || (stored.mtime > 0 && currentMtime < stored.mtime);
         if (rotated) {
             offset = 0;
-            if (needsScanContext)
-                scanContext = {};
+            if (kind === "codex")
+                codexContext = {};
             rotationResets[filePath] = { offset: 0, mtime: currentMtime };
         }
         if (offset >= currentSize && !rotated)
             continue;
-        // Grok session meta is loaded once per updates.jsonl (not persisted in cursor).
-        const grokSessionMeta = kind === "grok" ? await loadGrokSessionMeta(filePath) : undefined;
         let content;
         let bytesRead = 0;
         let readBuffer = Buffer.alloc(0);
@@ -912,19 +734,19 @@ export async function collectAndSendTelemetry(opts) {
         }
         if (bytesRead === 0)
             continue;
-        // Resume a previously discarded oversized Codex/Grok row using raw byte
+        // Resume a previously discarded oversized Codex row using raw byte
         // positions. Decoding from the middle of a multibyte UTF-8 codepoint would
         // otherwise skew byte offsets and could skip or replay later rows.
-        if (scanContext?.discarding_partial_line) {
+        if (codexContext?.discarding_partial_line) {
             const newlineIndex = readBuffer.subarray(0, bytesRead).indexOf(0x0a);
             const discardedBytes = newlineIndex >= 0 ? newlineIndex + 1 : bytesRead;
-            scanContext.discarding_partial_line = newlineIndex < 0;
+            codexContext.discarding_partial_line = newlineIndex < 0;
             scannedBytes[kind] += discardedBytes;
             batchSources.push({
                 filePath,
                 endOffset: offset + discardedBytes,
                 mtime: currentMtime,
-                context: cloneCodexContext(scanContext),
+                context: cloneCodexContext(codexContext),
             });
             if (newlineIndex < 0)
                 continue;
@@ -953,17 +775,17 @@ export async function collectAndSendTelemetry(opts) {
                 : lineEndOffsets[i];
             const lineBytes = endOffset - startOffset;
             if (!hasNewline && !reachedPhysicalEof) {
-                const discarding = scanContext?.discarding_partial_line === true;
+                const discarding = codexContext?.discarding_partial_line === true;
                 if (discarding || lineBytes >= MAX_PARTIAL_LINE_BYTES) {
-                    if (scanContext)
-                        scanContext.discarding_partial_line = true;
+                    if (codexContext)
+                        codexContext.discarding_partial_line = true;
                     scannedBytes[kind] += lineBytes;
                     batchSources.push({
                         filePath,
                         endOffset,
                         mtime: currentMtime,
-                        ...(scanContext
-                            ? { context: cloneCodexContext(scanContext) }
+                        ...(codexContext
+                            ? { context: cloneCodexContext(codexContext) }
                             : {}),
                     });
                 }
@@ -974,12 +796,12 @@ export async function collectAndSendTelemetry(opts) {
                 filePath,
                 endOffset,
                 mtime: currentMtime,
-                ...(scanContext
-                    ? { context: cloneCodexContext(scanContext) }
+                ...(codexContext
+                    ? { context: cloneCodexContext(codexContext) }
                     : {}),
             });
-            if (scanContext?.discarding_partial_line) {
-                scanContext.discarding_partial_line = false;
+            if (codexContext?.discarding_partial_line) {
+                codexContext.discarding_partial_line = false;
                 batchSources.push(source());
                 continue;
             }
@@ -996,83 +818,65 @@ export async function collectAndSendTelemetry(opts) {
                 batchSources.push(source());
                 continue;
             }
-            let adaptedRows;
-            if (kind === "codex") {
-                const adapted = codexUsageRow(parsed, scanContext, filePath, startOffset, endOffset);
-                adaptedRows = adapted ? [adapted] : [];
-            }
-            else if (kind === "grok") {
-                adaptedRows = grokUsageRows(parsed, grokSessionMeta ?? {});
+            const sourceRow = kind === "codex"
+                ? codexUsageRow(parsed, codexContext, filePath, startOffset, endOffset)
+                : parsed;
+            const rowCwd = sourceRow && typeof sourceRow === "object" && !Array.isArray(sourceRow)
+                ? sourceRow.cwd
+                : undefined;
+            const companyUid = resolveCompanyForCwd(typeof rowCwd === "string" ? rowCwd : undefined, repoCompanyMap) ?? fallbackCompanyUid;
+            // Company-scope-only mode: a row that resolves to NO company is personal
+            // work by an opted-out person — skipped, but still cursor-advanced (via
+            // batchSources) exactly like a sanitize-rejected row, so it is not
+            // re-read every run.
+            if (companyScopeOnly && !companyUid) {
+                batchSources.push(source());
+                continue;
             }
-            else {
-                adaptedRows = [parsed];
+            const sanitized = sanitizeRow(sourceRow, companyUid);
+            if (!sanitized) {
+                batchSources.push(source());
+                continue;
             }
-            if (adaptedRows.length === 0) {
+            const maxRowBytes = MAX_BATCH_BYTES - ENVELOPE_BYTES;
+            const wasOversized = jsonBytes(sanitized) > maxRowBytes;
+            const bounded = boundRowForPost(sanitized, maxRowBytes);
+            if (!bounded) {
+                log("[telemetry] oversized row dropped before send (" +
+                    filePath +
+                    ":" +
+                    (i + 1) +
+                    ")");
                 batchSources.push(source());
                 continue;
             }
-            let emittedFromLine = 0;
-            for (const sourceRow of adaptedRows) {
-                const rowCwd = sourceRow && typeof sourceRow === "object" && !Array.isArray(sourceRow)
-                    ? sourceRow.cwd
-                    : undefined;
-                const companyUid = resolveCompanyForCwd(typeof rowCwd === "string" ? rowCwd : undefined, repoCompanyMap) ?? fallbackCompanyUid;
-                // Company-scope-only mode: a row that resolves to NO company is personal
-                // work by an opted-out person — skipped, but still cursor-advanced (via
-                // batchSources) exactly like a sanitize-rejected row, so it is not
-                // re-read every run.
-                if (companyScopeOnly && !companyUid) {
-                    continue;
-                }
-                const sanitized = sanitizeRow(sourceRow, companyUid);
-                if (!sanitized) {
-                    continue;
-                }
-                const maxRowBytes = MAX_BATCH_BYTES - ENVELOPE_BYTES;
-                const wasOversized = jsonBytes(sanitized) > maxRowBytes;
-                const bounded = boundRowForPost(sanitized, maxRowBytes);
-                if (!bounded) {
-                    log("[telemetry] oversized row dropped before send (" +
-                        filePath +
-                        ":" +
-                        (i + 1) +
-                        ")");
-                    continue;
-                }
-                if (wasOversized) {
-                    log("[telemetry] oversized row truncated before send (" +
-                        filePath +
-                        ":" +
-                        (i + 1) +
-                        ")");
-                }
-                const rowJsonBytes = jsonBytes(bounded);
-                const addCost = rowJsonBytes + (batchEvents.length > 0 ? 1 : 0);
-                if (batchEvents.length > 0 &&
-                    (batchEvents.length >= MAX_BATCH_EVENTS ||
-                        batchBytes + addCost > MAX_BATCH_BYTES)) {
-                    if (!(await flush())) {
-                        uploadFailed = true;
-                        break filesLoop;
-                    }
-                    if (batchesSent >= maxBatchesPerRun) {
-                        batchLimitReached = true;
-                        break filesLoop;
-                    }
-                    batchBytes = ENVELOPE_BYTES + rowJsonBytes;
+            if (wasOversized) {
+                log("[telemetry] oversized row truncated before send (" +
+                    filePath +
+                    ":" +
+                    (i + 1) +
+                    ")");
+            }
+            const rowJsonBytes = jsonBytes(bounded);
+            const addCost = rowJsonBytes + (batchEvents.length > 0 ? 1 : 0);
+            if (batchEvents.length > 0 &&
+                (batchEvents.length >= MAX_BATCH_EVENTS ||
+                    batchBytes + addCost > MAX_BATCH_BYTES)) {
+                if (!(await flush())) {
+                    uploadFailed = true;
+                    break filesLoop;
                 }
-                else {
-                    batchBytes += addCost;
+                if (batchesSent >= maxBatchesPerRun) {
+                    batchLimitReached = true;
+                    break filesLoop;
                 }
-                batchEvents.push(bounded);
-                // Same endOffset for every model row from this JSONL line; commitSources
-                // keeps the max, so the cursor advances once per line.
-                batchSources.push(source());
-                emittedFromLine++;
+                batchBytes = ENVELOPE_BYTES + rowJsonBytes;
             }
-            if (emittedFromLine === 0) {
-                batchSources.push(source());
+            else {
+                batchBytes += addCost;
             }
+            batchEvents.push(bounded);
+            batchSources.push(source());
         }
     }
     if (!uploadFailed && !batchLimitReached) {