@indigoai-us/hq-cloud 6.15.31 → 6.15.32

package/dist/telemetry.js

@@ -7,10 +7,12 @@
  * (`hq-sync-runner`, `hq-cli`, mobile wrappers) emits telemetry uniformly.
  *
  * What it does: after each successful sync (`all-complete` arm of
- * `bin/sync-runner.ts`), walks Claude session logs plus live and archived Codex
- * rollouts, then diffs each file against the persisted byte-offset cursor at `~/.hq/telemetry-cursor.json`, sanitizes new rows through a tight allowlist that matches the server's
- * KEEP_FIELDS set in `apps/hq-pro/src/vault-service/handlers/usage.ts`,
- * batches into server-sized POST bodies, and ships them to `/v1/usage`.
+ * `bin/sync-runner.ts`), walks Grok `updates.jsonl` sessions, live and archived
+ * Codex rollouts, and Claude session logs, then diffs each file against the
+ * persisted byte-offset cursor at `~/.hq/telemetry-cursor.json`, sanitizes new
+ * rows through a tight allowlist that matches the server's KEEP_FIELDS set in
+ * `apps/hq-pro/src/vault-service/handlers/usage.ts`, batches into server-sized
+ * POST bodies, and ships them to `/v1/usage`.
  *
  * Trust model: the caller's `personUid` is resolved on the server from the
  * Cognito JWT — never from the body. `sanitizeRow` strips prompt bodies,
@@ -430,6 +432,167 @@ async function listCodexRolloutFiles(codexRoot) {
     ]);
     return sortFilesFreshestFirst([...live, ...archived].filter((file) => path.basename(file).startsWith("rollout-")));
 }
+// ── Grok session adapter ─────────────────────────────────────────────────────
+function grokTimestamp(value) {
+    if (typeof value === "string") {
+        return boundedString(value, MAX_TIMESTAMP_BYTES);
+    }
+    if (typeof value === "number" && Number.isFinite(value)) {
+        const ms = value > 1e12 ? value : value * 1000;
+        try {
+            return new Date(ms).toISOString();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+function stableGrokEventId(sessionId, promptId, model) {
+    return ("grok-" +
+        createHash("sha256")
+            .update(sessionId)
+            .update(Buffer.from([0]))
+            .update(promptId)
+            .update(Buffer.from([0]))
+            .update(model)
+            .digest("hex"));
+}
+function grokUsageMessage(usage, model) {
+    const message = {
+        usage: {
+            input_tokens: tokenCount(usage.inputTokens),
+            output_tokens: tokenCount(usage.outputTokens) + tokenCount(usage.reasoningTokens),
+            cache_read_input_tokens: tokenCount(usage.cachedReadTokens),
+            cache_creation_input_tokens: tokenCount(usage.cacheCreationTokens),
+        },
+    };
+    if (model)
+        message.model = model;
+    return message;
+}
+/**
+ * Adapt a Grok `updates.jsonl` record to Claude-shaped sanitizer input(s).
+ * Emits only on `turn_completed` with `usage`. When `usage.modelUsage` is
+ * present, one row per model key (chart stacks by model id).
+ */
+export function grokUsageRows(row, sessionMeta) {
+    if (!row || typeof row !== "object" || Array.isArray(row))
+        return [];
+    const obj = row;
+    const method = obj.method;
+    if (method !== "session/update" && method !== "_x.ai/session/update") {
+        return [];
+    }
+    const rawParams = obj.params;
+    if (!rawParams || typeof rawParams !== "object" || Array.isArray(rawParams)) {
+        return [];
+    }
+    const params = rawParams;
+    const rawUpdate = params.update;
+    if (!rawUpdate || typeof rawUpdate !== "object" || Array.isArray(rawUpdate)) {
+        return [];
+    }
+    const update = rawUpdate;
+    if (update.sessionUpdate !== "turn_completed")
+        return [];
+    const rawUsage = update.usage;
+    if (!rawUsage || typeof rawUsage !== "object" || Array.isArray(rawUsage)) {
+        return [];
+    }
+    const usage = rawUsage;
+    const sessionId = boundedString(params.sessionId, MAX_ID_BYTES);
+    const promptId = typeof update.prompt_id === "string" ? update.prompt_id : "";
+    const timestamp = grokTimestamp(obj.timestamp);
+    const updateMeta = update._meta;
+    const paramsMeta = params._meta;
+    const eventId = (updateMeta &&
+        typeof updateMeta === "object" &&
+        !Array.isArray(updateMeta)
+        ? boundedString(updateMeta.eventId, MAX_ID_BYTES)
+        : undefined) ??
+        (paramsMeta &&
+            typeof paramsMeta === "object" &&
+            !Array.isArray(paramsMeta)
+            ? boundedString(paramsMeta.eventId, MAX_ID_BYTES)
+            : undefined);
+    const buildRow = (model, modelUsage, preferEventId) => {
+        const normalized = {
+            uuid: preferEventId && eventId
+                ? eventId
+                : stableGrokEventId(sessionId ?? "", promptId, model ?? ""),
+            message: grokUsageMessage(modelUsage, model),
+        };
+        if (sessionId)
+            normalized.sessionId = sessionId;
+        if (timestamp)
+            normalized.timestamp = timestamp;
+        if (sessionMeta.cwd)
+            normalized.cwd = sessionMeta.cwd;
+        if (sessionMeta.gitBranch)
+            normalized.gitBranch = sessionMeta.gitBranch;
+        return normalized;
+    };
+    const modelUsage = usage.modelUsage;
+    if (modelUsage &&
+        typeof modelUsage === "object" &&
+        !Array.isArray(modelUsage)) {
+        const entries = Object.entries(modelUsage).filter(([, entry]) => !!entry && typeof entry === "object" && !Array.isArray(entry));
+        const single = entries.length === 1;
+        const rows = [];
+        for (const [modelKey, entry] of entries) {
+            const model = boundedString(modelKey, MAX_MODEL_BYTES);
+            if (!model)
+                continue;
+            rows.push(buildRow(model, entry, single));
+        }
+        return rows;
+    }
+    return [
+        buildRow(sessionMeta.fallback_model, usage, true),
+    ];
+}
+function decodeGrokCwdFolder(encoded) {
+    try {
+        return boundedString(decodeURIComponent(encoded), MAX_PATH_BYTES);
+    }
+    catch {
+        return boundedString(encoded, MAX_PATH_BYTES);
+    }
+}
+/** Load cwd / branch / fallback model from sibling `summary.json` once per file. */
+export async function loadGrokSessionMeta(updatesPath) {
+    const sessionDir = path.dirname(updatesPath);
+    const encodedCwdDir = path.basename(path.dirname(sessionDir));
+    const meta = {};
+    try {
+        const raw = await fs.readFile(path.join(sessionDir, "summary.json"), "utf-8");
+        const parsed = JSON.parse(raw);
+        const info = parsed.info && typeof parsed.info === "object" && !Array.isArray(parsed.info)
+            ? parsed.info
+            : undefined;
+        meta.cwd =
+            boundedString(info?.cwd, MAX_PATH_BYTES) ??
+                boundedString(parsed.cwd, MAX_PATH_BYTES);
+        meta.gitBranch =
+            boundedString(parsed.head_branch, MAX_PATH_BYTES) ??
+                boundedString(info?.head_branch, MAX_PATH_BYTES);
+        meta.fallback_model =
+            boundedString(parsed.current_model_id, MAX_MODEL_BYTES) ??
+                boundedString(info?.current_model_id, MAX_MODEL_BYTES);
+    }
+    catch {
+        // Missing / unreadable summary — fall through to folder-name decode.
+    }
+    if (!meta.cwd) {
+        meta.cwd = decodeGrokCwdFolder(encodedCwdDir);
+    }
+    return meta;
+}
+async function listGrokUpdateFiles(grokRoot) {
+    const all = await listJsonlFiles(path.join(grokRoot, "sessions"));
+    return sortFilesFreshestFirst(all.filter((file) => path.basename(file) === "updates.jsonl"));
+}
 // ── Batching primitives ───────────────────────────────────────────────────────
 const MAX_BATCH_EVENTS = 100;
 const MAX_BATCH_BYTES = 240 * 1024;
@@ -494,7 +657,7 @@ function boundRowForPost(row, maxRowBytes) {
 }
 // ── Main entry point ──────────────────────────────────────────────────────────
 /**
- * Scan, sanitize, and POST new Claude Code and Codex usage rows.
+ * Scan, sanitize, and POST new Grok, Codex, and Claude Code usage rows.
  *
  * Fire-and-forget from the caller's perspective: errors are caught internally
  * and surfaced only via `log`. The returned summary lets observers (e.g.
@@ -505,6 +668,7 @@ export async function collectAndSendTelemetry(opts) {
     const home = os.homedir();
     const claudeProjectsRoot = opts.claudeProjectsRoot ?? path.join(home, ".claude", "projects");
     const codexRoot = opts.codexRoot ?? path.join(home, ".codex");
+    const grokRoot = opts.grokRoot ?? path.join(home, ".grok");
     const cursorPath = opts.cursorPath ?? path.join(home, ".hq", "telemetry-cursor.json");
     const menubarPath = opts.menubarPath ?? path.join(home, ".hq", "menubar.json");
     const log = opts.log ?? (() => { });
@@ -522,73 +686,80 @@ export async function collectAndSendTelemetry(opts) {
             ? repoCompanyMap.bySlug.get(opts.fallbackCompany)
             : undefined;
     // 1. Opt-in check (server-authoritative, with local fallback + self-heal).
+    // Fleet agents skip this: collection is always on (company + unattributed).
     let enabled;
     let optInSource;
-    try {
-        const resp = await opts.client.getTelemetryOptIn();
-        enabled = resp.enabled === true;
-        optInSource = "server";
-        // Self-heal a consent the user gave but that never reached the server.
-        //
-        // The installer writes the answer to `~/.hq/menubar.json` (always succeeds)
-        // AND posts it to `/v1/usage/opt-in` — but that post fires before the
-        // person entity exists, so it 404s and the attribute is never written.
-        // Absence then reads as `false`, the emitter goes silent, and the person
-        // shows as "not opted in" forever. Measured: 22 of 33 active Indigo members
-        // had no attribute at all, against only 2 genuine opt-outs.
-        //
-        // `unset` (never answered) is the ONLY state we heal. An explicit server
-        // `false` is a real opt-out and is left strictly alone. We also require a
-        // local answer to actually exist — we never invent consent, we only replay
-        // the answer the user already gave.
-        //
-        // And it must be THIS account's answer. `menubar.json` is per-MACHINE, so
-        // when two people sign in under the same OS user it holds whoever answered
-        // last; replaying that for the second account would opt in someone who
-        // never consented. The replay therefore requires the cached record to name
-        // the same `prs_*` the server says we are. A legacy record with no binding
-        // cannot be proven to belong to this caller and is skipped — for those
-        // machines the installer's own post-sign-in upload is the recovery path,
-        // and it is correctly account-scoped because it runs right after that
-        // person authenticates.
-        if (resp.unset === true && opts.client.setTelemetryOptIn) {
-            const record = await readLocalConsentRecord(menubarPath);
-            const local = record.enabled;
-            const boundToCaller = record.personUid !== undefined &&
-                resp.personUid !== undefined &&
-                record.personUid === resp.personUid;
-            if (local !== undefined && !boundToCaller) {
-                log("[telemetry] skipping consent re-assert: the locally cached answer is not bound to the signed-in account");
-            }
-            if (local !== undefined && boundToCaller) {
-                try {
-                    // `onlyIfUnset` keeps the replay atomic. Reading `unset` and writing
-                    // are two requests, so without it another device could record a real
-                    // opt-out in between and this stale local answer would overwrite it.
-                    // The server tests "still unset?" as part of the write instead.
-                    const ack = await opts.client.setTelemetryOptIn(local, { onlyIfUnset: true });
-                    if (ack && ack.applied === false) {
-                        // Lost the race — a real answer was recorded first and it stands.
-                        // Keep the server's answer for this run rather than the local one.
-                        log("[telemetry] consent was recorded elsewhere before the re-assert landed; deferring to the server");
+    if (opts.forceCollect) {
+        enabled = true;
+        optInSource = "agent-required";
+    }
+    else {
+        try {
+            const resp = await opts.client.getTelemetryOptIn();
+            enabled = resp.enabled === true;
+            optInSource = "server";
+            // Self-heal a consent the user gave but that never reached the server.
+            //
+            // The installer writes the answer to `~/.hq/menubar.json` (always succeeds)
+            // AND posts it to `/v1/usage/opt-in` — but that post fires before the
+            // person entity exists, so it 404s and the attribute is never written.
+            // Absence then reads as `false`, the emitter goes silent, and the person
+            // shows as "not opted in" forever. Measured: 22 of 33 active Indigo members
+            // had no attribute at all, against only 2 genuine opt-outs.
+            //
+            // `unset` (never answered) is the ONLY state we heal. An explicit server
+            // `false` is a real opt-out and is left strictly alone. We also require a
+            // local answer to actually exist — we never invent consent, we only replay
+            // the answer the user already gave.
+            //
+            // And it must be THIS account's answer. `menubar.json` is per-MACHINE, so
+            // when two people sign in under the same OS user it holds whoever answered
+            // last; replaying that for the second account would opt in someone who
+            // never consented. The replay therefore requires the cached record to name
+            // the same `prs_*` the server says we are. A legacy record with no binding
+            // cannot be proven to belong to this caller and is skipped — for those
+            // machines the installer's own post-sign-in upload is the recovery path,
+            // and it is correctly account-scoped because it runs right after that
+            // person authenticates.
+            if (resp.unset === true && opts.client.setTelemetryOptIn) {
+                const record = await readLocalConsentRecord(menubarPath);
+                const local = record.enabled;
+                const boundToCaller = record.personUid !== undefined &&
+                    resp.personUid !== undefined &&
+                    record.personUid === resp.personUid;
+                if (local !== undefined && !boundToCaller) {
+                    log("[telemetry] skipping consent re-assert: the locally cached answer is not bound to the signed-in account");
+                }
+                if (local !== undefined && boundToCaller) {
+                    try {
+                        // `onlyIfUnset` keeps the replay atomic. Reading `unset` and writing
+                        // are two requests, so without it another device could record a real
+                        // opt-out in between and this stale local answer would overwrite it.
+                        // The server tests "still unset?" as part of the write instead.
+                        const ack = await opts.client.setTelemetryOptIn(local, { onlyIfUnset: true });
+                        if (ack && ack.applied === false) {
+                            // Lost the race — a real answer was recorded first and it stands.
+                            // Keep the server's answer for this run rather than the local one.
+                            log("[telemetry] consent was recorded elsewhere before the re-assert landed; deferring to the server");
+                        }
+                        else {
+                            enabled = local;
+                            optInSource = "menubar-reasserted";
+                            log(`[telemetry] server had no recorded consent; re-asserted the local install-time answer (enabled=${local})`);
+                        }
                     }
-                    else {
-                        enabled = local;
-                        optInSource = "menubar-reasserted";
-                        log(`[telemetry] server had no recorded consent; re-asserted the local install-time answer (enabled=${local})`);
+                    catch (err) {
+                        // Non-fatal: fall through on the server's answer. Next run retries.
+                        log(`[telemetry] failed to re-assert local opt-in (${err.message ?? err})`);
                     }
                 }
-                catch (err) {
-                    // Non-fatal: fall through on the server's answer. Next run retries.
-                    log(`[telemetry] failed to re-assert local opt-in (${err.message ?? err})`);
-                }
             }
         }
-    }
-    catch (err) {
-        log(`[telemetry] opt-in check failed (${err.message ?? err}) — falling back to local menubar.json`);
-        enabled = await readLocalTelemetryEnabled(menubarPath);
-        optInSource = "menubar-fallback";
+        catch (err) {
+            log(`[telemetry] opt-in check failed (${err.message ?? err}) — falling back to local menubar.json`);
+            enabled = await readLocalTelemetryEnabled(menubarPath);
+            optInSource = "menubar-fallback";
+        }
     }
     // Consent split (company-scope mandatory capture): a FALSE/unset personal
     // opt-in silences PERSONAL/unattributed rows only. Rows produced inside a
@@ -608,14 +779,16 @@ export async function collectAndSendTelemetry(opts) {
     const loadedFiles = { ...cursor.files };
     const rotationResets = {};
     const newlyCommitted = {};
-    const [claudeFilesUnsorted, codexFiles] = await Promise.all([
+    const [claudeFilesUnsorted, codexFiles, grokFiles] = await Promise.all([
         listJsonlFiles(claudeProjectsRoot),
         listCodexRolloutFiles(codexRoot),
+        listGrokUpdateFiles(grokRoot),
     ]);
     const claudeFiles = await sortFilesFreshestFirst(claudeFilesUnsorted);
-    // Codex goes first so a fresh Linux install cannot spend its entire bounded
-    // pass replaying an older Claude backlog before reporting current Codex use.
+    // Newest runtimes first so a bounded first pass reports current Grok/Codex
+    // use before replaying an older Claude backlog.
     const files = [
+        ...grokFiles.map((filePath) => ({ filePath, kind: "grok" })),
         ...codexFiles.map((filePath) => ({ filePath, kind: "codex" })),
         ...claudeFiles.map((filePath) => ({ filePath, kind: "claude" })),
     ];
@@ -635,7 +808,7 @@ export async function collectAndSendTelemetry(opts) {
     let batchesSent = 0;
     let uploadFailed = false;
     let batchLimitReached = false;
-    const scannedBytes = { claude: 0, codex: 0 };
+    const scannedBytes = { claude: 0, codex: 0, grok: 0 };
     const commitSources = (sources) => {
         const maxPerFile = new Map();
         for (const source of sources) {
@@ -704,16 +877,21 @@ export async function collectAndSendTelemetry(opts) {
         const currentMtime = Math.floor(stat.mtimeMs / 1000);
         const stored = cursor.files[filePath] ?? { offset: 0, mtime: 0 };
         let offset = stored.offset;
-        let codexContext = kind === "codex" ? cloneCodexContext(stored.context ?? {}) : undefined;
+        const needsScanContext = kind === "codex" || kind === "grok";
+        let scanContext = needsScanContext
+            ? cloneCodexContext(stored.context ?? {})
+            : undefined;
         const rotated = currentSize < offset || (stored.mtime > 0 && currentMtime < stored.mtime);
         if (rotated) {
             offset = 0;
-            if (kind === "codex")
-                codexContext = {};
+            if (needsScanContext)
+                scanContext = {};
             rotationResets[filePath] = { offset: 0, mtime: currentMtime };
         }
         if (offset >= currentSize && !rotated)
             continue;
+        // Grok session meta is loaded once per updates.jsonl (not persisted in cursor).
+        const grokSessionMeta = kind === "grok" ? await loadGrokSessionMeta(filePath) : undefined;
         let content;
         let bytesRead = 0;
         let readBuffer = Buffer.alloc(0);
@@ -734,19 +912,19 @@ export async function collectAndSendTelemetry(opts) {
         }
         if (bytesRead === 0)
             continue;
-        // Resume a previously discarded oversized Codex row using raw byte
+        // Resume a previously discarded oversized Codex/Grok row using raw byte
         // positions. Decoding from the middle of a multibyte UTF-8 codepoint would
         // otherwise skew byte offsets and could skip or replay later rows.
-        if (codexContext?.discarding_partial_line) {
+        if (scanContext?.discarding_partial_line) {
             const newlineIndex = readBuffer.subarray(0, bytesRead).indexOf(0x0a);
             const discardedBytes = newlineIndex >= 0 ? newlineIndex + 1 : bytesRead;
-            codexContext.discarding_partial_line = newlineIndex < 0;
+            scanContext.discarding_partial_line = newlineIndex < 0;
             scannedBytes[kind] += discardedBytes;
             batchSources.push({
                 filePath,
                 endOffset: offset + discardedBytes,
                 mtime: currentMtime,
-                context: cloneCodexContext(codexContext),
+                context: cloneCodexContext(scanContext),
             });
             if (newlineIndex < 0)
                 continue;
@@ -775,17 +953,17 @@ export async function collectAndSendTelemetry(opts) {
                 : lineEndOffsets[i];
             const lineBytes = endOffset - startOffset;
             if (!hasNewline && !reachedPhysicalEof) {
-                const discarding = codexContext?.discarding_partial_line === true;
+                const discarding = scanContext?.discarding_partial_line === true;
                 if (discarding || lineBytes >= MAX_PARTIAL_LINE_BYTES) {
-                    if (codexContext)
-                        codexContext.discarding_partial_line = true;
+                    if (scanContext)
+                        scanContext.discarding_partial_line = true;
                     scannedBytes[kind] += lineBytes;
                     batchSources.push({
                         filePath,
                         endOffset,
                         mtime: currentMtime,
-                        ...(codexContext
-                            ? { context: cloneCodexContext(codexContext) }
+                        ...(scanContext
+                            ? { context: cloneCodexContext(scanContext) }
                             : {}),
                     });
                 }
@@ -796,12 +974,12 @@ export async function collectAndSendTelemetry(opts) {
                 filePath,
                 endOffset,
                 mtime: currentMtime,
-                ...(codexContext
-                    ? { context: cloneCodexContext(codexContext) }
+                ...(scanContext
+                    ? { context: cloneCodexContext(scanContext) }
                     : {}),
             });
-            if (codexContext?.discarding_partial_line) {
-                codexContext.discarding_partial_line = false;
+            if (scanContext?.discarding_partial_line) {
+                scanContext.discarding_partial_line = false;
                 batchSources.push(source());
                 continue;
             }
@@ -818,65 +996,83 @@ export async function collectAndSendTelemetry(opts) {
                 batchSources.push(source());
                 continue;
             }
-            const sourceRow = kind === "codex"
-                ? codexUsageRow(parsed, codexContext, filePath, startOffset, endOffset)
-                : parsed;
-            const rowCwd = sourceRow && typeof sourceRow === "object" && !Array.isArray(sourceRow)
-                ? sourceRow.cwd
-                : undefined;
-            const companyUid = resolveCompanyForCwd(typeof rowCwd === "string" ? rowCwd : undefined, repoCompanyMap) ?? fallbackCompanyUid;
-            // Company-scope-only mode: a row that resolves to NO company is personal
-            // work by an opted-out person — skipped, but still cursor-advanced (via
-            // batchSources) exactly like a sanitize-rejected row, so it is not
-            // re-read every run.
-            if (companyScopeOnly && !companyUid) {
-                batchSources.push(source());
-                continue;
+            let adaptedRows;
+            if (kind === "codex") {
+                const adapted = codexUsageRow(parsed, scanContext, filePath, startOffset, endOffset);
+                adaptedRows = adapted ? [adapted] : [];
             }
-            const sanitized = sanitizeRow(sourceRow, companyUid);
-            if (!sanitized) {
-                batchSources.push(source());
-                continue;
+            else if (kind === "grok") {
+                adaptedRows = grokUsageRows(parsed, grokSessionMeta ?? {});
             }
-            const maxRowBytes = MAX_BATCH_BYTES - ENVELOPE_BYTES;
-            const wasOversized = jsonBytes(sanitized) > maxRowBytes;
-            const bounded = boundRowForPost(sanitized, maxRowBytes);
-            if (!bounded) {
-                log("[telemetry] oversized row dropped before send (" +
-                    filePath +
-                    ":" +
-                    (i + 1) +
-                    ")");
+            else {
+                adaptedRows = [parsed];
+            }
+            if (adaptedRows.length === 0) {
                 batchSources.push(source());
                 continue;
             }
-            if (wasOversized) {
-                log("[telemetry] oversized row truncated before send (" +
-                    filePath +
-                    ":" +
-                    (i + 1) +
-                    ")");
-            }
-            const rowJsonBytes = jsonBytes(bounded);
-            const addCost = rowJsonBytes + (batchEvents.length > 0 ? 1 : 0);
-            if (batchEvents.length > 0 &&
-                (batchEvents.length >= MAX_BATCH_EVENTS ||
-                    batchBytes + addCost > MAX_BATCH_BYTES)) {
-                if (!(await flush())) {
-                    uploadFailed = true;
-                    break filesLoop;
+            let emittedFromLine = 0;
+            for (const sourceRow of adaptedRows) {
+                const rowCwd = sourceRow && typeof sourceRow === "object" && !Array.isArray(sourceRow)
+                    ? sourceRow.cwd
+                    : undefined;
+                const companyUid = resolveCompanyForCwd(typeof rowCwd === "string" ? rowCwd : undefined, repoCompanyMap) ?? fallbackCompanyUid;
+                // Company-scope-only mode: a row that resolves to NO company is personal
+                // work by an opted-out person — skipped, but still cursor-advanced (via
+                // batchSources) exactly like a sanitize-rejected row, so it is not
+                // re-read every run.
+                if (companyScopeOnly && !companyUid) {
+                    continue;
+                }
+                const sanitized = sanitizeRow(sourceRow, companyUid);
+                if (!sanitized) {
+                    continue;
                 }
-                if (batchesSent >= maxBatchesPerRun) {
-                    batchLimitReached = true;
-                    break filesLoop;
+                const maxRowBytes = MAX_BATCH_BYTES - ENVELOPE_BYTES;
+                const wasOversized = jsonBytes(sanitized) > maxRowBytes;
+                const bounded = boundRowForPost(sanitized, maxRowBytes);
+                if (!bounded) {
+                    log("[telemetry] oversized row dropped before send (" +
+                        filePath +
+                        ":" +
+                        (i + 1) +
+                        ")");
+                    continue;
                 }
-                batchBytes = ENVELOPE_BYTES + rowJsonBytes;
+                if (wasOversized) {
+                    log("[telemetry] oversized row truncated before send (" +
+                        filePath +
+                        ":" +
+                        (i + 1) +
+                        ")");
+                }
+                const rowJsonBytes = jsonBytes(bounded);
+                const addCost = rowJsonBytes + (batchEvents.length > 0 ? 1 : 0);
+                if (batchEvents.length > 0 &&
+                    (batchEvents.length >= MAX_BATCH_EVENTS ||
+                        batchBytes + addCost > MAX_BATCH_BYTES)) {
+                    if (!(await flush())) {
+                        uploadFailed = true;
+                        break filesLoop;
+                    }
+                    if (batchesSent >= maxBatchesPerRun) {
+                        batchLimitReached = true;
+                        break filesLoop;
+                    }
+                    batchBytes = ENVELOPE_BYTES + rowJsonBytes;
+                }
+                else {
+                    batchBytes += addCost;
+                }
+                batchEvents.push(bounded);
+                // Same endOffset for every model row from this JSONL line; commitSources
+                // keeps the max, so the cursor advances once per line.
+                batchSources.push(source());
+                emittedFromLine++;
             }
-            else {
-                batchBytes += addCost;
+            if (emittedFromLine === 0) {
+                batchSources.push(source());
             }
-            batchEvents.push(bounded);
-            batchSources.push(source());
         }
     }
     if (!uploadFailed && !batchLimitReached) {