@manyoars/oars 0.2.0 → 0.4.0

package/dist/sessions/codex.js

@@ -0,0 +1,745 @@
+// The OpenAI Codex CLI source: a Codex session log becomes the same capture records a Claude Code transcript does.
+//
+// FIXTURE-DERIVED: written from the open-source Codex CLI (github.com/openai/codex, Apache-2.0, commit ac558e2a, 2026-11-03), not from a live
+// store. Each field read below cites the file it comes from; `docs/sessions-store.md` says what a live run would still have to prove.
+//
+// Where it reads from (`codexRoot`): `$CODEX_HOME`, else `~/.codex` (`%USERPROFILE%\.codex` on Windows); the same on every OS
+// (codex-rs/utils/home-dir/src/lib.rs:5-18). Inside it, `sessions/YYYY/MM/DD/rollout-YYYY-MM-DDThh-mm-ss-<uuid>.jsonl` and `archived_sessions/` hold one
+// file per session (a reverted thread's session spans several); Codex compresses an old one to `.jsonl.zst` and reads either (rollout/src/compression.rs), so this reader does too.
+// A line is `{timestamp, type, payload}` (history/src/lib.rs `RolloutLine`, rollout_payload.rs). Like cursor.ts, the reader writes each session
+// out as the transcript lines `captureSession` already reads, so redaction, the 1,000-character line cap, the salted file hashes, and the
+// skeleton are the Claude Code path's own code:
+//   session_meta        {id, cwd, cli_version, timestamp, history_mode, parent_thread_id, forked_from_id, subagent_history_start_ordinal}: the
+//                       working directory and the harness version; only the first one in the file (recorder.rs:1157-1158). A spawned agent has `parent_thread_id` (protocol.rs:3464); records whose
+//                       `ordinal` is below its `subagent_history_start_ordinal` (:3511-3516) are the parent's prefix (ordinal.rs:86-89), and are dropped. A Referenced fork copies none: its `history_base` points at the parent (:3508-3510; core/src/session/session.rs:1139-1140). A Copied fork, in either mode, does copy the parent's history and writes no `history_base`
+//                       (`fork_thread_from_history` is `ForkPersistence::Copied`, core/src/thread_manager.rs:1680; session.rs:1139; app-server takes it when no prepared fork exists, app-server/src/request_processors/thread_processor.rs:5724-5728). Ordinals exist
+//                       only in a Paginated rollout (ordinal.rs:37), the CLI's default (thread-store/src/local/mod.rs:512-515), which holds item_completed TurnItems
+//                       (UserMessage, AgentMessage, FileChange, McpToolCall) in place of the legacy events below (rollout/src/policy.rs:142-156, `persisted_item_completed_event` :232, its Paginated arm :253); both are read.
+//                       A Copied fork's history, in either mode, is dropped by matching the parent's lineage as of the fork's start, record for record
+//   turn_context        {model, cwd, approval_policy}: the model, the directory when it changes, and the approval policy, which rides later lines as `permissionMode`
+//   session_meta also holds `dynamic_tools`, the tools the session declared (a `DynamicToolSpec`, dynamic_tools.rs), read as the offered list
+//   event_msg turn_aborted {reason}             `interrupted` is the operator cutting a turn short (TurnAbortReason, protocol.rs:4580-4585); the others are the harness's own
+//   response_item additional_tools {tools} / tool_search_output {tools}   tools offered later, and tools a search loaded (models.rs:1076, :1257)
+//                       That these records are persisted into the rollout is rollout/src/policy.rs:83, :91, and :137 at ac558e2.
+//   event_msg user_message {message}            a prompt (the `response_item` user messages also hold injected context, so they are not read)
+//   event_msg agent_message {message}           the assistant's text
+//   event_msg token_count {info.last_token_usage}  one model response's usage, closing the lines since the last one
+//   response_item function_call / local_shell_call / custom_tool_call   a tool call
+//   response_item function_call_output {call_id, output}   a shell call's outcome: the text `Exit code: N` / `Process exited with code N` then `Output:`
+//                       (the unified-exec emitter's own text, core/src/tools/events.rs:400, :416, :423; context.rs:556), the real exit code; `execution error: ...` (core/src/tools/events.rs:438) is a
+//                       call that failed to spawn. `write_stdin` (handlers/shell_spec.rs:113) is a shell call too: the process it polls ends only where the
+//                       poll reports its exit code; a poll that failed (`write_stdin failed: ...`, write_stdin.rs:123) is its own error and settles nothing else
+//   event_msg item_completed CommandExecution {id, exit_code, status, aggregated_output}   Paginated mode only (policy.rs:253 arm, kept by `_ =>` :284; Legacy
+//                       keeps none, :238-251). `id` is the exec_command's call id (events.rs:571), written when the process exits (events.rs:561-590):
+//                       by the exit watcher for a process the model never polled (unified_exec/async_watcher.rs:158, :224), or by the call itself when it exits in
+//                       its first yield (process_manager.rs:827). It settles a known unresolved shell call from the real `exit_code` and the output; a
+//                       `declined` one (exit code -1, events.rs:552-554) settles as a refusal only where its output is the user's refusal text (`exec command rejected by user`), and nothing otherwise. A `failed` one with exit code -1 is a failure with no exit status (a tool
+//                       failure message, events.rs:538-542; a process with none, async_watcher.rs:213, :409), so its text is the error line. So a backgrounded process keeps its failure and its commit sha
+//                       even with no `write_stdin` poll; only a Legacy rollout leaves it unsettled until a poll, and there the poll settles it
+//   response_item custom_tool_call `exec` / function_call `wait`   Codex 0.166+ code mode (the live 0.166/0.167 store, 2026-11-06; upstream rust-v0.167.0 not yet read): `exec`'s input is a JavaScript cell, not a command; its
+//                       output opens `Script completed`, `Script failed` (+ a `Script error:` part), or `Script running with cell ID <id>`, which is the cell's outcome and never its
+//                       commands'. `wait {cell_id}` polls a cell with the same three headers and settles it, in Paginated mode too
+//   event_msg item_completed CommandExecution, id `exec-<uuid>` (no call owns it, 0.166+)   the command a cell ran, as its own Bash call: exit_code, aggregated_output, duration
+//   event_msg mcp_tool_call_end {call_id, result}   an MCP call's outcome: `result.Err`, or `result.Ok.isError` (protocol.rs:3047, :3076); Legacy mode only
+//   event_msg patch_apply_end {call_id, success, stderr, status}   an apply_patch call's outcome (Legacy mode only); a declined one settles as a refusal only where its stderr is the user's refusal text (`patch rejected by user`), and nothing otherwise, and a
+//                       patch with no end event stays unsettled (a rejected patch is only a `RespondToModel` output, tools/handlers/apply_patch.rs)
+//   event_msg exec_command_end                  never persisted at ac558e2 (policy.rs:165) nor at rust-v0.46.0, so it is not read: the CommandExecution item and the call's output are the two sources
+// Older shapes: the JSON `{output, metadata.exit_code}` wrapper of a shell output (rust-v0.46.0 core/src/tools/mod.rs:186-210).
+// What Codex has no equivalent of (cost) stays at the value capture gives an absent field; message ids and a call reply's wall time are persisted and not read (a code-mode command item's `duration` is).
+import { createReadStream } from 'node:fs';
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { PassThrough, pipeline } from 'node:stream';
+import { createZstdDecompress, zstdDecompressSync } from 'node:zlib';
+import { INTERRUPT_MARKER, SHAPE_TOOLS_LINE } from './session-shape.js';
+/** The Codex home for an environment; a test passes its own so it never reads the real one. */
+export const codexRoot = (env, home = homedir()) => {
+    const set = env.CODEX_HOME;
+    return set === undefined || set === '' ? join(home, '.codex') : set;
+};
+const isObj = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const str = (value) => (typeof value === 'string' && value !== '' ? value : undefined);
+const num = (value) => (typeof value === 'number' && Number.isFinite(value) ? value : undefined);
+const parse = (text) => {
+    if (typeof text !== 'string')
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * A rollout file name is `rollout-<timestamp>-<thread>.jsonl`, optionally `.zst`; a reverted thread's is `rollout-<timestamp>-<thread>_<rollout>.jsonl`
+ * (rollout/src/rollout_file_name.rs:12-14, parsed at :41-47, rendered at :66-73).
+ */
+const ROLLOUT = /^rollout-.+\.jsonl(\.zst)?$/;
+const UUID = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}';
+const ROLLOUT_NAME = new RegExp(String.raw `^rollout-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-(${UUID})(?:_(${UUID}))?\.jsonl(?:\.zst)?$`, 'i');
+const SAFE_ID = /^(?!\.+$)[A-Za-z0-9._-]+$/;
+/** The key a rollout is deposited under, and the thread it belongs to when it is a reverted copy of one (folded into that thread's lineage when the thread is in the store). */
+const idOf = (name) => {
+    const match = ROLLOUT_NAME.exec(name);
+    const thread = match?.[1]?.toLowerCase();
+    const reverted = match?.[2]?.toLowerCase();
+    if (thread === undefined)
+        return { id: name.replace(/^rollout-/, '').replace(/\.jsonl(\.zst)?$/, ''), thread: null };
+    return reverted === undefined || reverted === thread ? { id: thread, thread: null } : { id: `${thread}_${reverted}`, thread };
+};
+const textOf = async (file) => {
+    const bytes = await readFile(file);
+    return (file.endsWith('.zst') ? zstdDecompressSync(bytes) : bytes).toString('utf8');
+};
+/** The first line of a rollout, read without loading the rest: a compressed file is decompressed as a stream and the read stops at the line, so the cost does not grow with the file. */
+const firstLine = async (file) => {
+    const source = createReadStream(file);
+    const stream = new PassThrough({ encoding: 'utf8' });
+    // pipeline hands a failure in either stage (a missing file, a corrupt frame) to `stream`, and the early destroy below ends it with a premature close nobody awaits.
+    if (file.endsWith('.zst'))
+        pipeline(source, createZstdDecompress(), stream, () => undefined);
+    else
+        pipeline(source, stream, () => undefined);
+    const failed = new Promise((_, reject) => stream.once('error', reject));
+    failed.catch(() => undefined);
+    const lines = createInterface({ input: stream, crlfDelay: Infinity });
+    const first = async () => {
+        for await (const line of lines)
+            return line;
+        return '';
+    };
+    try {
+        return await Promise.race([first(), failed]);
+    }
+    finally {
+        lines.close();
+        stream.destroy();
+    }
+};
+/** An error's message with `file` cut to its base name, so a reason that is logged names no folder. */
+const reasonOf = (error, file) => (error instanceof Error ? error.message : String(error)).split(file).join(basename(file));
+/** Lists rollout files under `dir`; only a missing folder is silent, any other failure (EACCES, ENOTDIR) is reported against `dir`. */
+const walk = async (dir, found, unreadable) => {
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT'))
+            unreadable.push({ file: dir, reason: reasonOf(error, dir) });
+        return;
+    }
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        if (entry.isDirectory())
+            await walk(join(dir, entry.name), found, unreadable);
+        else if (entry.isFile() && ROLLOUT.test(entry.name))
+            found.push(join(dir, entry.name));
+    }
+};
+const iso = (value) => {
+    const text = str(value);
+    // An absolute time only: a missing or relative one (not a date after 2000) says nothing about when.
+    return text !== undefined && Date.parse(text) >= Date.parse('2000-01-01T00:00:00Z') ? text : undefined;
+};
+/** The tool vocabulary prompt classes and `files` are computed in; a Codex name with no counterpart keeps its own. */
+const SHELL_CALLS = new Set(['shell', 'shell_command', 'exec_command', 'local_shell', 'container.exec', 'write_stdin', 'exec', 'wait']);
+const PATCH_CALLS = new Set(['apply_patch']);
+/** The namespace upstream fills in for a top-level function (codex-rs/protocol/src/tool_name.rs:6-7); with none and an empty one, it is the plain tool (:46-50). */
+const DEFAULT_FUNCTION_NAMESPACE = 'functions';
+/** One word of an argv as a POSIX shell reads it back: left alone when it holds only safe characters, else in single quotes, so `bash -lc 'git revert HEAD'` keeps its script as one word. */
+const quotedWord = (word) => (/^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`);
+const commandOf = (args) => {
+    const command = args.command ?? args.cmd;
+    if (Array.isArray(command))
+        return command.filter((part) => typeof part === 'string').map(quotedWord).join(' ');
+    return str(command);
+};
+/** The paths an `apply_patch` input touches (`*** Add|Update|Delete File: <path>`, the grammar of codex-rs/apply-patch). */
+const patchFiles = (input) => [...input.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm)].map((match) => (match[1] ?? '').trim());
+const EXIT_LINE = /^(?:Exit code: |Process exited with code )(-?\d+)\s*$/m;
+const OUTPUT_MARK = /(?:^|\n)Output:\n?/;
+const RUNNING_LINE = /^Process running with session ID (\S+)\s*$/m;
+/**
+ * A code-mode cell's outcome is its output's first line (the live 0.166/0.167 store, 2026-11-06; upstream rust-v0.167.0 not yet read): `Script completed`, `Script failed` (a second part
+ * `Script error:\n<message>` follows), or `Script running with cell ID <id>`. It is the cell's outcome, never its commands': a completed cell can hold
+ * commands that exited nonzero, and those are CommandExecution items of their own.
+ */
+const SCRIPT_HEAD = /^Script (completed|failed|running with cell ID (\S+))[ \t]*(?:\n|$)/;
+const SCRIPT_ERROR = /(?:^|\n)Script error:\n?/;
+/**
+ * The message of a call that failed before it produced an exit code, written as the whole output (no `Output:` header): `execution error: ` for a
+ * shell call (core/src/tools/events.rs:438), and for the default unified-exec tool (ConfigShellToolType is only `UnifiedExec | Disabled`,
+ * protocol/src/openai_models.rs:330-333) `exec_command failed: ` (core/src/tools/handlers/unified_exec/exec_command.rs:270), `write_stdin failed: `
+ * (write_stdin.rs:123), and `write_stdin approval failed: ` (:121). `wait failed: ` is assumed by analogy with `write_stdin failed: ` (write_stdin.rs:123) and has not
+ * been seen in the live store. `write_stdin rejected: ` (:118) stays unsettled: its reason is the approval policy's.
+ */
+const SPAWN_ERROR = /^(?:execution error|exec_command failed|wait failed|write_stdin(?: approval)? failed): /;
+/**
+ * A declined call is the user's refusal only where its message says so. Codex reports `ToolError::Rejected` as `declined` for a user's refusal and for some
+ * runtime rejections, and normalizes only the literal text `rejected by user` (events.rs:448-458): `exec command rejected by user` for a shell call (:456) and
+ * `patch rejected by user` for a patch (:457). So a `declined` item settles as the user's refusal when the message it carries is that text (`aggregated_output`
+ * for a CommandExecution item, events.rs:549-551; `stderr` for a FileChange item and `patch_apply_end`, events.rs:341, :616), and any other `declined` message
+ * stays unsettled. A settled one is these two sentences, which `errorCodeOf` classes `user-rejected`. `write_stdin rejected: <reason>` (:118) is not read this
+ * way either: its reason is the approval policy's, which the user may not have given.
+ */
+const DECLINED_SHELL = 'exec command rejected by user';
+const DECLINED_OUTPUT = /^exec command rejected by user\s*$/;
+const DECLINED_PATCH = 'patch rejected by user';
+const DECLINED_PATCH_TEXT = /^(?:patch )?rejected by user\s*$/;
+/** The text of a `function_call_output` body: a bare string, or an array of `{type: input_text, text}` items (protocol/src/models.rs:2376). */
+const bodyText = (raw) => {
+    if (!Array.isArray(raw))
+        return str(raw) ?? '';
+    return raw.map((item) => (isObj(item) ? (str(item.text) ?? '') : '')).filter((text) => text !== '').join('\n');
+};
+/**
+ * What a shell output says: the real exit code and the text after the `Output:` line, which is what an error line is cut from. The two header
+ * forms are the unified-exec emitter's own `Exit code: N` (core/src/tools/events.rs:400, :416, :423; `shell` and `shell_command` are older names for it) and
+ * core/src/tools/context.rs:556 (`Process exited with code N`); no code and no `Process running with session ID N` line means the call failed before it
+ * ran (`SPAWN_ERROR` above), was declined (`... rejected by user`, events.rs:456), or is a process with no exit status, whose reply header gets neither line
+ * (`None` writes none, context.rs:555-557; its -1 goes to the item only, process_manager.rs:823, :839). An older Codex wrote JSON `{output, metadata.exit_code}` (rust-v0.46.0 core/src/tools/mod.rs:186-210).
+ */
+const outcomeOf = (raw) => {
+    const body = bodyText(raw);
+    const printed = OUTPUT_MARK.exec(body);
+    const script = SCRIPT_HEAD.exec(printed === null ? body : body.slice(0, printed.index));
+    if (script !== null) {
+        const error = SCRIPT_ERROR.exec(body);
+        const output = printed === null ? '' : body.slice(printed.index + printed[0].length, error === null || error.index < printed.index ? undefined : error.index);
+        if (script[1] === 'failed') {
+            const message = error === null ? output : body.slice(error.index + error[0].length);
+            return { text: message.trim() === '' ? 'Script failed' : message, exit: undefined, spawnError: true, running: undefined, script: true };
+        }
+        return { text: output, exit: script[2] === undefined ? 0 : undefined, spawnError: false, running: script[2], script: true };
+    }
+    const wrapped = parse(body);
+    if (isObj(wrapped) && typeof wrapped.output === 'string')
+        return { text: wrapped.output, exit: isObj(wrapped.metadata) ? num(wrapped.metadata.exit_code) : undefined, spawnError: false, running: undefined, script: false };
+    const mark = OUTPUT_MARK.exec(body);
+    if (mark === null)
+        return { text: body, exit: undefined, spawnError: SPAWN_ERROR.test(body), running: undefined, script: false };
+    const head = body.slice(0, mark.index);
+    const code = EXIT_LINE.exec(head)?.[1];
+    return { text: body.slice(mark.index + mark[0].length), exit: code === undefined ? undefined : Number(code), spawnError: false, running: RUNNING_LINE.exec(head)?.[1], script: false };
+};
+/**
+ * A failed call's error text. A negative code is no exit status: upstream writes -1 for a tool failure message (core/src/tools/events.rs:538-542) and for a
+ * process with none (unified_exec/async_watcher.rs:213, :409; process_manager.rs:823), and capture's `Exit code (\d+)` (extract.ts, `EXIT_RE`) cannot read it, so
+ * an `Exit code -1` line would be the error line and the message lost. The message stands alone then, and a code is the line capture skips.
+ */
+const failureOf = (exit, text) => exit === undefined || exit === 0 ? undefined : exit < 0 && text.trim() !== '' ? text : `Exit code ${String(exit)}\n${text}`;
+const usageOf = (info) => {
+    const last = isObj(info) && isObj(info.last_token_usage) ? info.last_token_usage : undefined;
+    if (last === undefined)
+        return undefined;
+    const input = num(last.input_tokens) ?? 0;
+    const cached = Math.min(num(last.cached_input_tokens) ?? 0, input);
+    const output = num(last.output_tokens) ?? 0;
+    // A zero total means Codex recorded none, so no usage is written rather than a measured zero.
+    if (input === 0 && output === 0)
+        return undefined;
+    const reasoning = num(last.reasoning_output_tokens);
+    const written = num(last.cache_write_input_tokens) ?? 0;
+    // Codex counts cached and written tokens both inside `input_tokens` (input 100 = cached 40 + write 60, codex-api/src/sse/responses.rs:889-911); capture's
+    // `input` excludes cache reads and creation, as the Claude Code path's does, so each token is counted once.
+    return {
+        input_tokens: Math.max(input - cached - written, 0),
+        cache_read_input_tokens: cached,
+        cache_creation_input_tokens: written,
+        output_tokens: output,
+        ...(reasoning === undefined ? {} : { output_tokens_details: { thinking_tokens: reasoning } }),
+    };
+};
+/** The non-blank lines of a rollout that are not JSON (a torn write), kept so `captureSession` counts them and the deposit line reports them. */
+export const rolloutBadLines = (text) => text.split('\n').filter((raw) => raw.trim() !== '' && parse(raw) === undefined);
+/**
+ * The names in a list of tool declarations: each entry's `name` (a `DynamicToolSpec` function, dynamic_tools.rs; an `additional_tools` or
+ * `tool_search_output` entry is an untyped value, models.rs:1076, :1257), and the names of a namespace's own `tools`; a namespace's own name is a grouping, not a tool. Nothing else is read: a
+ * declaration's description and schema stay where they are.
+ */
+const toolNames = (list) => (Array.isArray(list) ? list : [])
+    .flatMap((entry) => (isObj(entry) ? [Array.isArray(entry.tools) ? undefined : str(entry.name), ...toolNames(entry.tools)] : []))
+    .filter((name) => name !== undefined && name !== '');
+/** The approval policy as the permission mode: a string, or the tag of an externally tagged object (`{granular: {...}}`, protocol.rs:1181), which `mode()` keeps if documented and stores as `other` if not. */
+const approvalMode = (policy) => (isObj(policy) ? Object.keys(policy)[0] : str(policy));
+/** One rollout as the lines `captureSession` reads. */
+export const rolloutLines = (text, fallbackId, parentText) => {
+    const nonblank = text.split('\n').filter((raw) => raw.trim() !== '');
+    if (nonblank.length > 0 && !nonblank.some((raw) => isObj(parse(raw))))
+        throw new Error('no parseable line');
+    const lines = [];
+    const base = { sessionId: fallbackId };
+    let at;
+    let model;
+    let sequence = 0;
+    let response = 0;
+    // The assistant lines since the last counted token_count share one response id; the first of them carries its usage.
+    let open;
+    let lastTotal;
+    const calls = new Map();
+    // The tools the session declared as dynamic (`dynamic_tools`): their output carries no failure signal, only their DynamicToolCall item does.
+    const dynamicNames = new Set();
+    // A unified-exec process still running, by its session id, to the exec_command that started it: in a Legacy rollout the `write_stdin` that sees it exit settles both.
+    const running = new Map();
+    // Records below this ordinal are the parent prefix a subagent's rollout copied (ordinal.rs:86-89), not the session's own. Only a Paginated rollout
+    // holds ordinals (rollout/src/ordinal.rs:29-30, :37).
+    let inherited;
+    // Only the first session_meta is the rollout's own; later ones are copied from fork history (rollout/src/recorder.rs:1157-1158, :1173).
+    let seenMeta = false;
+    // A Paginated rollout holds the exit watcher's item, which carries the whole output, so there a poll that sees the exit settles only itself.
+    let paginated = false;
+    // A Copied fork's file holds the parent's records first (no ordinal marks them: a Paginated one numbers them afresh from 0, ordinal.rs:28-33, and a Legacy
+    // one has none), so the leading records equal to the parent's, in order, are its copied history, in either mode. Null once it stops matching.
+    let copied = null;
+    const resolved = new Set();
+    // The stamp before the record being read, so an item's start (its stamp less its duration) is never earlier than the line before it.
+    let before;
+    const stamp = (value) => {
+        before = at;
+        const candidate = iso(value);
+        if (candidate !== undefined && (at === undefined || Date.parse(candidate) >= Date.parse(at)))
+            at = candidate;
+        return at ?? new Date(0).toISOString();
+    };
+    const assistant = (content, when) => {
+        sequence += 1;
+        const message = { role: 'assistant', content };
+        // The id is set here, not when a token_count closes the response: a line no token_count follows (an aborted turn, a local model) still has one.
+        const requestId = `${String(base.sessionId)}-resp${String(response + 1)}`;
+        const line = { ...base, type: 'assistant', uuid: `${fallbackId}-a${String(sequence)}`, requestId, timestamp: when, ...(model === undefined ? {} : { requestedModel: model }), message };
+        lines.push(line);
+        open ??= line;
+    };
+    // A failure is the error text; a success carries the call's own output when it has one, which capture reads transiently, as on the Claude Code
+    // path: a shell call's `[branch sha]` line is how a commit's sha is found. The output follows an `Exit code 0` line, the shape a Claude Code Bash
+    // result has (fixtures/proj/errors-a.jsonl:15): capture marks a result whose text starts `Exit code <nonzero>` as failed (`isErrorResult` in extract.ts), and a
+    // call that exited 0 may print such a line (`cat ci.log`). The commit patterns read every line (`COMMIT_LINE` and `HASH_LINE` in extract.ts, both `gm`), so the sha is still found.
+    const result = (id, failure, when, output = '', timed = false) => {
+        sequence += 1;
+        lines.push({
+            ...base,
+            type: 'user',
+            uuid: `${fallbackId}-r${String(sequence)}`,
+            timestamp: when,
+            // Codex stamps a result with its own time, but the call's start is not paired to it, so no duration is claimed; a CommandExecution item's own `duration` is the exception.
+            ...(timed ? {} : { noDuration: true }),
+            message: { role: 'user', content: [{ type: 'tool_result', tool_use_id: id, is_error: failure !== undefined, content: failure ?? (output === '' ? '' : `Exit code 0\n${output}`) }] },
+        });
+    };
+    // A neutral line for the setup, funnel, and trust shape (session-shape.ts): none of it is a Claude-shaped line, and none carries a message.
+    const tools = (fields) => {
+        sequence += 1;
+        lines.push({ ...base, type: SHAPE_TOOLS_LINE, uuid: `${fallbackId}-t${String(sequence)}`, ...fields });
+    };
+    const prompted = (message, when) => {
+        sequence += 1;
+        lines.push({ ...base, type: 'user', uuid: `${fallbackId}-u${String(sequence)}`, timestamp: when, message: { role: 'user', content: [{ type: 'text', text: message }] } });
+    };
+    const settlePatch = (id, failure, when) => {
+        const known = calls.get(id);
+        if (known?.kind !== 'patch' || resolved.has(id))
+            return;
+        resolved.add(id);
+        for (const part of known.ids)
+            result(part, failure, when);
+    };
+    const settleMcp = (id, failure, when) => {
+        if (calls.get(id)?.kind !== 'other' || resolved.has(id))
+            return;
+        resolved.add(id);
+        result(id, failure, when);
+    };
+    // A shell call settles on its exit code, or on a failure to spawn, whether that comes from its own output or from a CommandExecution item. A
+    // process still running was remembered by its session id, so in a Legacy rollout the `write_stdin` that polled it and read its exit
+    // code settles both calls (in a Paginated one an item settles only its own exec_command; a `wait` on a code-mode cell settles the cell in either mode, because
+    // the cell's outcome is its own header and no item carries it). A poll that failed instead (`write_stdin failed: ...`, `exited` false) says nothing about the process: a
+    // non-empty write to one with no tty is `StdinClosed` (unified_exec/process_manager.rs:1021-1026) and it runs on, so only the poll is the error.
+    const settleShell = (id, failure, output, when, exited = true) => {
+        const known = calls.get(id);
+        if (known?.kind !== 'shell' || resolved.has(id))
+            return;
+        resolved.add(id);
+        result(id, failure, when, output);
+        const pending = known.session === undefined ? undefined : running.get(known.session);
+        if (exited && (!paginated || known.cell === true) && pending !== undefined && !resolved.has(pending)) {
+            resolved.add(pending);
+            result(pending, failure, when, output);
+        }
+    };
+    // The text of a TurnItem's content array. Each variant tags its own parts: a UserMessage's `UserInput` is snake_case, `text` (user_input.rs:16), but an
+    // AgentMessage's `AgentMessageContent` has no rename_all, so it is `Text` (items.rs:131-135).
+    const contentText = (content, tag) => (Array.isArray(content) ? content.map((part) => (isObj(part) && part.type === tag ? (str(part.text) ?? '') : '')).filter((part) => part !== '').join('\n') : '');
+    // A completed TurnItem, the Paginated mode's replacement for the legacy events (policy.rs:142-156).
+    const completed = (item, when) => {
+        const kind = str(item.type);
+        const id = str(item.id);
+        if (kind === 'UserMessage') {
+            const message = contentText(item.content, 'text');
+            if (message !== '')
+                prompted(message, when);
+        }
+        else if (kind === 'AgentMessage') {
+            const message = contentText(item.content, 'Text');
+            if (message !== '')
+                assistant([{ type: 'text', text: message }], when);
+        }
+        else if (kind === 'FileChange' && id !== undefined && (item.status === 'completed' || item.status === 'failed' || (item.status === 'declined' && DECLINED_PATCH_TEXT.test(str(item.stderr) ?? '')))) {
+            settlePatch(id, item.status === 'declined' ? DECLINED_PATCH : item.status === 'failed' ? (str(item.stderr) ?? 'patch failed') : undefined, when);
+        }
+        else if (kind === 'CommandExecution' && id !== undefined && item.status === 'declined' && calls.has(id)) {
+            // A `declined` one has exit code -1 (events.rs:552-554); only the user's refusal text settles it, as a refusal.
+            if (DECLINED_OUTPUT.test(str(item.aggregated_output) ?? ''))
+                settleShell(id, DECLINED_SHELL, '', when);
+        }
+        else if (kind === 'CommandExecution' && id !== undefined && (item.status === 'completed' || item.status === 'failed' || item.status === 'declined') && !calls.has(id)) {
+            // A code-mode cell's `exec_command` (Codex 0.166+) is run by the cell's JavaScript, so no call carries the item's `exec-<uuid>` id: the item is the
+            // command's only record, and it is its own Bash call. Binding it to its cell by position would hold for 191 of 193 items in a live 0.167.0 store and fail
+            // for 2, so it is not attempted.
+            const exit = num(item.exit_code);
+            if (resolved.has(id))
+                return;
+            resolved.add(id);
+            const output = str(item.aggregated_output) ?? '';
+            const spent = isObj(item.duration) ? Math.round((num(item.duration.secs) ?? 0) * 1000 + (num(item.duration.nanos) ?? 0) / 1e6) : undefined;
+            const parsed = Array.isArray(item.parsed_cmd) && item.parsed_cmd.length === 1 && isObj(item.parsed_cmd[0]) ? str(item.parsed_cmd[0].cmd) : undefined;
+            const joined = commandOf(item);
+            // The command array is the launcher then its flags then the text (`pwsh.exe -Command <text>`); a single parsed command is that text alone.
+            const command = parsed !== undefined && (joined === undefined || parsed.length < joined.length) ? parsed : joined;
+            const began = spent === undefined ? when : new Date(Math.max(Date.parse(when) - spent, Date.parse(before ?? when))).toISOString();
+            assistant([{ type: 'tool_use', id, name: 'Bash', native: 'exec_command', input: command === undefined ? {} : { command } }], began);
+            // An item with no exit_code (an Option, skipped when None, items.rs:284-286) keeps its command and has no outcome, as an owned one does.
+            // A refused one (exit code -1) is the user's refusal only where its output says so; any other declined text leaves no outcome.
+            if (item.status === 'declined') {
+                if (DECLINED_OUTPUT.test(output))
+                    result(id, DECLINED_SHELL, when, '');
+            }
+            else if (exit !== undefined)
+                result(id, failureOf(exit, output), when, output, spent !== undefined);
+        }
+        else if (kind === 'CommandExecution' && id !== undefined && (item.status === 'completed' || item.status === 'failed')) {
+            // The exec_command's own item: `id` is its call id, written when the process exits, even one the model never polled (header). It carries the
+            // real exit code and the output.
+            const exit = num(item.exit_code);
+            const output = str(item.aggregated_output) ?? '';
+            if (exit !== undefined)
+                settleShell(id, failureOf(exit, output), output, when);
+        }
+        else if (kind === 'McpToolCall' && id !== undefined && (item.status === 'completed' || item.status === 'failed')) {
+            const refused = isObj(item.result) && item.result.isError === true;
+            const failed = item.status === 'failed' || refused;
+            const text = isObj(item.error) ? (str(item.error.message) ?? '') : isObj(item.result) ? bodyText(item.result.content) : '';
+            settleMcp(id, failed ? (text === '' ? 'mcp tool call failed' : text) : undefined, when);
+        }
+        else if (kind === 'DynamicToolCall' && id !== undefined && (item.status === 'completed' || item.status === 'failed')) {
+            // The item's `success` and `error` (items.rs:301-322; dynamic.rs:246-262): a call with no item stays unsettled, since its output text says nothing of failure.
+            const failed = item.status === 'failed' || item.success === false;
+            const text = isObj(item.error) ? (str(item.error.message) ?? '') : '';
+            settleMcp(id, failed ? (text === '' ? 'dynamic tool call failed' : text) : undefined, when);
+        }
+    };
+    const parentKeys = (parent) => parent
+        .split('\n')
+        .map((raw) => parse(raw))
+        .filter((parsed) => isObj(parsed) && isObj(parsed.payload) && parsed.type !== 'session_meta')
+        .map((parsed) => JSON.stringify([parsed.type, parsed.payload]));
+    for (const raw of text.split('\n')) {
+        const entry = parse(raw);
+        if (!isObj(entry) || !isObj(entry.payload))
+            continue;
+        const payload = entry.payload;
+        const ordinal = num(entry.ordinal);
+        if (inherited !== undefined && ordinal !== undefined && ordinal < inherited)
+            continue;
+        const type = str(entry.type);
+        if (type !== 'session_meta' && copied !== null) {
+            if (copied.keys[copied.at] === JSON.stringify([entry.type, payload])) {
+                copied.at += 1;
+                continue;
+            }
+            copied = null;
+        }
+        if (type === 'session_meta' && seenMeta)
+            continue;
+        const when = stamp(entry.timestamp);
+        if (type === 'session_meta') {
+            seenMeta = true;
+            const id = str(payload.id);
+            if (id !== undefined)
+                base.sessionId = id;
+            const cwd = str(payload.cwd);
+            if (cwd !== undefined)
+                base.cwd = cwd;
+            const version = str(payload.cli_version);
+            if (version !== undefined)
+                base.version = version;
+            stamp(payload.timestamp);
+            const declared = toolNames(payload.dynamic_tools);
+            if (declared.length > 0)
+                tools({ offered: declared });
+            for (const name of declared)
+                dynamicNames.add(name);
+            inherited = num(payload.subagent_history_start_ordinal);
+            paginated = payload.history_mode === 'paginated';
+            if (inherited === undefined && parentText !== undefined && str(payload.forked_from_id) !== undefined && !isObj(payload.history_base))
+                copied = { keys: parentKeys(parentText), at: 0 };
+        }
+        else if (type === 'turn_context') {
+            model = str(payload.model) ?? model;
+            // The policy rides every later line as `permissionMode`, the key a Claude Code user line carries.
+            const mode = approvalMode(payload.approval_policy);
+            if (mode !== undefined)
+                base.permissionMode = mode;
+            const cwd = str(payload.cwd);
+            if (cwd !== undefined)
+                base.cwd = cwd;
+        }
+        else if (type === 'event_msg') {
+            const kind = str(payload.type);
+            if (kind === 'user_message') {
+                const message = str(payload.message);
+                if (message !== undefined)
+                    prompted(message, when);
+            }
+            else if (kind === 'item_completed') {
+                if (isObj(payload.item))
+                    completed(payload.item, when);
+            }
+            else if (kind === 'turn_aborted') {
+                // Only `interrupted` is the operator cutting a turn short: `replaced`, `review_ended`, and `budget_limited` are the harness's own (protocol.rs:4580-4585).
+                // It is written as the marker line Claude Code writes, so capture keeps it as a prompt record and the shape counts one interrupt (CAPTURE 23).
+                if (payload.reason === 'interrupted')
+                    prompted(`${INTERRUPT_MARKER}]`, when);
+            }
+            else if (kind === 'agent_message') {
+                const message = str(payload.message);
+                if (message !== undefined)
+                    assistant([{ type: 'text', text: message }], when);
+            }
+            else if (kind === 'token_count') {
+                const info = isObj(payload.info) ? payload.info : undefined;
+                const total = info !== undefined && isObj(info.total_token_usage) ? num(info.total_token_usage.total_tokens) : undefined;
+                const usage = usageOf(info);
+                // Codex repeats a token_count whose totals did not move; counting it twice would double the response.
+                // A token_count with no assistant line before it (a reasoning-only response) has nothing to attach to, so its usage is not counted.
+                if (usage !== undefined && (total === undefined || total !== lastTotal) && open !== undefined) {
+                    const first = open.message;
+                    if (isObj(first))
+                        first.usage = usage;
+                    lastTotal = total;
+                    response += 1;
+                    open = undefined;
+                }
+            }
+            else if (kind === 'mcp_tool_call_end') {
+                const id = str(payload.call_id);
+                const outcome = isObj(payload.result) ? payload.result : {};
+                const refused = isObj(outcome.Ok) && outcome.Ok.isError === true;
+                const text = typeof outcome.Err === 'string' ? outcome.Err : isObj(outcome.Ok) ? bodyText(outcome.Ok.content) : '';
+                if (id !== undefined)
+                    settleMcp(id, typeof outcome.Err === 'string' || refused ? (text === '' ? 'mcp tool call failed' : text) : undefined, when);
+            }
+            else if (kind === 'patch_apply_end') {
+                const id = str(payload.call_id);
+                const declined = payload.status === 'declined';
+                // A declined patch settles only where its stderr is the user's refusal text (`DECLINED_PATCH_TEXT`); any other declined one stays unsettled.
+                if (id !== undefined && (!declined || DECLINED_PATCH_TEXT.test(str(payload.stderr) ?? ''))) {
+                    settlePatch(id, declined ? DECLINED_PATCH : payload.success === false ? (str(payload.stderr) ?? 'patch failed') : undefined, when);
+                }
+            }
+        }
+        else if (type === 'response_item') {
+            const kind = str(payload.type);
+            if (kind === 'additional_tools') {
+                const declared = toolNames(payload.tools);
+                if (declared.length > 0)
+                    tools({ offered: declared });
+            }
+            else if (kind === 'tool_search_output') {
+                const found = toolNames(payload.tools);
+                if (found.length > 0)
+                    tools({ loaded: found });
+            }
+            else if (kind === 'web_search_call') {
+                // A search is its own response item (protocol/src/models.rs:1270; persisted, rollout/src/policy.rs:94), with no call_id and no output item: the item
+                // is the finished call (`response.output_item.done`, models.rs:1262-1269), so it carries no failure signal and is recorded ok, as another non-shell call is.
+                // Only a `search` action has a query (`query`, else the first of `queries`; models.rs:2125-2132); `open_page` and `find_in_page` carry a url (:2134-2145).
+                const action = isObj(payload.action) ? payload.action : {};
+                const first = Array.isArray(action.queries) ? str(action.queries[0]) : undefined;
+                const query = action.type === 'search' ? (str(action.query) ?? first) : undefined;
+                const id = str(payload.id) ?? `${fallbackId}-ws${String(sequence + 1)}`;
+                assistant([{ type: 'tool_use', id, name: 'WebSearch', native: 'web_search', input: query === undefined ? {} : { query } }], when);
+                result(id, undefined, when);
+            }
+            else if (kind === 'function_call' || kind === 'local_shell_call' || kind === 'custom_tool_call') {
+                const id = str(payload.call_id) ?? str(payload.id);
+                const bare = str(payload.name) ?? 'shell';
+                // A namespaced function (models.rs:1154) is not its bare name: only a plain one is Codex's own shell or patch tool. The router makes every
+                // function_call's ToolName with the default namespace filled in (core/src/tools/router.rs:285), and none, an empty string, and `functions`
+                // all flatten to the bare name (protocol/src/tool_name.rs:46-50; core/src/tools/mod.rs:51-53), so `functions` is no namespace here.
+                const declared = str(payload.namespace);
+                const namespace = declared === DEFAULT_FUNCTION_NAMESPACE ? undefined : declared;
+                // Upstream flattens any other namespace to namespace + name with no delimiter (core/src/tools/mod.rs:55-60; codex-mcp/src/tools.rs:296), and
+                // an MCP namespace carries its own trailing `__` (tools.rs:253), so that form joins a Claude Code MCP name as written. The `__` added to a
+                // namespace without one is this reader's own choice (models.rs:3485-3486: `collaboration` + `spawn_agent`), not upstream's flat name.
+                const joiner = namespace?.endsWith('__') === true ? '' : '__';
+                const name = namespace === undefined || bare.startsWith(namespace) ? bare : `${namespace}${joiner}${bare}`;
+                const args = kind === 'custom_tool_call' ? { input: str(payload.input) } : parse(payload.arguments);
+                const input = isObj(args) ? args : {};
+                const action = isObj(payload.action) ? payload.action : {};
+                if (id === undefined)
+                    continue;
+                if (kind === 'local_shell_call' || (namespace === undefined && SHELL_CALLS.has(name))) {
+                    // A code-mode `exec` call's input is a JavaScript cell, not a command, so it has none.
+                    const command = name === 'exec' ? undefined : commandOf(kind === 'local_shell_call' ? action : input);
+                    const poll = name === 'wait' ? input.cell_id : input.session_id;
+                    const polled = name === 'write_stdin' || name === 'wait' ? (str(poll) ?? (num(poll) === undefined ? undefined : String(num(poll)))) : undefined;
+                    calls.set(id, { kind: 'shell', ids: [id], ...(polled === undefined ? {} : { session: name === 'wait' ? `cell:${polled}` : polled }), ...(name === 'exec' || name === 'wait' ? { cell: true } : {}) });
+                    // `native` keeps Codex's own name for the action table (the contract at extract.ts, as cursor.ts does); a `local_shell_call` has no name field.
+                    assistant([{ type: 'tool_use', id, name: 'Bash', native: kind === 'local_shell_call' ? 'local_shell' : name, input: command === undefined ? {} : { command } }], when);
+                }
+                else if (namespace === undefined && PATCH_CALLS.has(name)) {
+                    const files = patchFiles(str(input.input) ?? str(input.patch) ?? '');
+                    const ids = (files.length === 0 ? [''] : files).map((_, index) => `${id}#${String(index)}`);
+                    calls.set(id, { kind: 'patch', ids });
+                    assistant(ids.map((part, index) => ({ type: 'tool_use', id: part, name: 'Edit', native: name, input: files[index] === undefined ? {} : { file_path: files[index] } })), when);
+                }
+                else {
+                    calls.set(id, { kind: 'other', ids: [id], ...(dynamicNames.has(name) ? { dynamic: true } : {}) });
+                    const file = str(input.path) ?? str(input.file_path);
+                    const query = str(input.query);
+                    assistant([{ type: 'tool_use', id, name, input: { ...(file === undefined ? {} : { file_path: file }), ...(query === undefined ? {} : { query }) } }], when);
+                }
+            }
+            else if (kind === 'function_call_output' || kind === 'custom_tool_call_output') {
+                const id = str(payload.call_id);
+                const known = id === undefined ? undefined : calls.get(id);
+                if (id !== undefined && known !== undefined && !resolved.has(id)) {
+                    const out = outcomeOf(payload.output);
+                    if (known.kind === 'shell') {
+                        // A shell call settles on its exit code, or on a failure to spawn. A process still running stays unsettled and is remembered by its
+                        // session id, so in a Legacy rollout the `write_stdin` that sees it exit settles it too. A call declined with the user's refusal text has neither and settles as that refusal; any other declined text stays unsettled.
+                        if (out.exit === undefined && DECLINED_OUTPUT.test(out.text))
+                            settleShell(id, DECLINED_SHELL, '', when, false);
+                        else if (out.exit !== undefined || out.spawnError)
+                            settleShell(id, out.spawnError ? out.text : failureOf(out.exit, out.text), out.text, when, out.exit !== undefined || out.script);
+                        else if (out.running !== undefined && known.session === undefined)
+                            running.set(known.cell === true ? `cell:${out.running}` : out.running, id);
+                    }
+                    else if (known.kind === 'other' && known.dynamic !== true) {
+                        // Another call's output carries no failure signal (an MCP call's comes from its mcp_tool_call_end), and a patch settles only from its
+                        // patch_apply_end, because a rejected patch comes back as plain output text (tools/handlers/apply_patch.rs).
+                        resolved.add(id);
+                        result(id, undefined, when);
+                    }
+                }
+            }
+        }
+    }
+    return lines;
+};
+/**
+ * The thread a rollout is deposited under, or null for a main session. A spawned agent's `session_meta` names `parent_thread_id` (protocol.rs:3463-3464); a
+ * delegate Codex starts for itself, such as a review, gets its parent's thread id there too (core/src/codex_delegate.rs:138, through core/src/session/session.rs:1126
+ * and thread-store/src/local/create_thread.rs:35 into rollout/src/recorder.rs:965). Yet `SubAgentSource::parent_thread_id` is Some for ThreadSpawn only
+ * (protocol.rs:3376-3386), so the rollout's `source` decides when it is absent: upstream's `is_non_root_agent` is `Internal(_) | SubAgent(_)` (:3280-3285), and
+ * `SessionMeta.source` (:3477) serializes lowercase and externally tagged (:3141-3144, :3223-3226), so `{subagent: ...}` or `{internal: ...}`. Such a rollout belongs
+ * to `session_id`, "equal to the root thread's ID" (:3451-3452), or else names itself. A reverted file's parent is its own thread.
+ */
+const parentOf = (head, id, thread) => {
+    const parent = str(head.parent_thread_id)?.toLowerCase() ?? thread;
+    if (parent !== null)
+        return parent;
+    const source = head.source;
+    const nonRoot = isObj(source) && (Object.hasOwn(source, 'subagent') || Object.hasOwn(source, 'internal'));
+    return nonRoot ? (str(head.session_id)?.toLowerCase() ?? id) : null;
+};
+/**
+ * A thread's records as one text: its own file, then each revert's file in the order they were written. A later file supersedes the records at or after
+ * its `from` ordinal in every earlier one (the prefix a revert retains is below it), so the turns a revert dropped are not read. A record with no
+ * ordinal (a line that is not a Paginated record) is kept, and so is a line that is not JSON, which `captureSession` counts. Only the reverts written at
+ * or before `before` count: a fork copied the lineage as it stood when it started, so a revert written later has not dropped anything from its copy.
+ */
+const lineageText = async (session, before = Infinity) => {
+    const read = (file) => textOf(file).catch((error) => {
+        throw new Error(reasonOf(error, file));
+    });
+    const revisions = session.revisions.filter((revision) => revision.at <= before).sort((a, b) => a.at - b.at);
+    if (revisions.length === 0)
+        return read(session.file);
+    const parts = [{ file: session.file, from: Infinity }, ...revisions];
+    const texts = [];
+    for (const [index, part] of parts.entries()) {
+        const cut = Math.min(...parts.slice(index + 1).map((later) => later.from), Infinity);
+        const kept = (await read(part.file)).split('\n').filter((raw) => {
+            const entry = parse(raw);
+            const ordinal = isObj(entry) ? num(entry.ordinal) : undefined;
+            return ordinal === undefined || ordinal < cut;
+        });
+        texts.push(kept.join('\n'));
+    }
+    return texts.join('\n');
+};
+/** Opens the Codex store under `root`; undefined when it holds no `sessions` folder, so a machine without Codex is skipped silently. */
+export const openCodexStore = async (root) => {
+    const files = [];
+    const unreadable = [];
+    await walk(join(root, 'sessions'), files, unreadable);
+    await walk(join(root, 'archived_sessions'), files, unreadable);
+    if (files.length === 0 && unreadable.length === 0)
+        return undefined;
+    const sessions = new Map();
+    const reverts = new Map();
+    let rejected = 0;
+    for (const file of files) {
+        const { id, thread } = idOf(basename(file));
+        if (!SAFE_ID.test(id)) {
+            rejected += 1;
+            continue;
+        }
+        // The active copy wins over an archived one of the same thread.
+        if (sessions.has(id))
+            continue;
+        try {
+            const info = await stat(file);
+            const meta = parse(await firstLine(file));
+            const head = isObj(meta) && isObj(meta.payload) ? meta.payload : {};
+            const base = isObj(head.history_base) ? head.history_base : {};
+            const started = Date.parse(str(head.timestamp) ?? '') || 0;
+            if (thread !== null && isObj(meta))
+                reverts.set(id, { thread, from: num(base.end_ordinal_exclusive) ?? 0, at: started });
+            sessions.set(id, { id, folder: str(head.cwd) ?? null, parent: parentOf(head, id, thread), agentRole: str(head.agent_role) ?? null, forkedFrom: str(head.forked_from_id)?.toLowerCase() ?? null, revisions: [], started, file, size: info.size, mtimeMs: Math.floor(info.mtimeMs) });
+        }
+        catch (error) {
+            unreadable.push({ file, reason: reasonOf(error, file) });
+        }
+    }
+    // A reverted thread is one lineage: the new file holds only the records written after the revert, so it is folded into the thread's own session, whose
+    // retained prefix and these records read as one. A reverted file whose thread is not in the store stays a session of its own, a subagent of that thread.
+    for (const [id, revert] of reverts) {
+        const origin = sessions.get(revert.thread);
+        const own = sessions.get(id);
+        if (origin === undefined || own === undefined)
+            continue;
+        origin.revisions.push({ file: own.file, from: revert.from, at: revert.at });
+        origin.size += own.size;
+        origin.mtimeMs = Math.max(origin.mtimeMs, own.mtimeMs);
+        sessions.delete(id);
+    }
+    const ordered = [...sessions.values()].sort((a, b) => a.mtimeMs - b.mtimeMs || a.id.localeCompare(b.id));
+    return {
+        sessions: ordered,
+        rejected,
+        unreadable,
+        transcript: async (session) => {
+            // A rollout that vanished after it was listed (Codex compresses an old one) fails with its reason, which names no path.
+            const text = await lineageText(session);
+            // A Copied fork's history is found by matching it against the parent's lineage as of the fork's start; a parent outside the store (or unreadable) leaves it whole.
+            const parent = session.forkedFrom === null ? undefined : sessions.get(session.forkedFrom);
+            const parentText = parent === undefined ? undefined : await lineageText(parent, session.started).catch(() => undefined);
+            const lines = [...rolloutLines(text, session.id, parentText).map((line) => JSON.stringify(line)), ...rolloutBadLines(text)];
+            return lines.join('\n') + (lines.length === 0 ? '' : '\n');
+        },
+    };
+};