@open-agent-toolkit/cli 0.2.51 → 0.2.53

package/dist/providers/identity/absolute-paths.js

@@ -0,0 +1,144 @@
+/**
+ * Absolute-path detection for dispatch records and messages.
+ *
+ * Two patterns, deliberately different. `IDENTITY_PATH_PATTERN` is strict and
+ * used where a path is never a legitimate value, so ambiguity resolves to
+ * rejection. `PROSE_PATH_PATTERN` is conservative and used where a false
+ * positive would corrupt legitimate evidence, so it under-matches by design:
+ * colon-prefixed forms, path-shaped routes inside URLs, and trailing-slash
+ * candidates survive. Prose redaction is therefore best-effort, not a
+ * guarantee — see `spec.md` NFR1, amended 2026-09-03.
+ *
+ * Before this module there were two independent notions of
+ * "looks like a path": a regex inside `redactDispatchMessage`, which only
+ * scrubbed error text, and nothing at all on the persistence boundary. The
+ * durable journal is committed to a shared repository, so a username or local
+ * layout that reaches it is in git history permanently.
+ *
+ * Message redaction and record sanitization now share this detector, because
+ * the gap between them is precisely what allowed paths to be scrubbed from a
+ * message and written verbatim into the record in the same command.
+ */
+/**
+ * Two detectors, because one regex cannot serve both jobs.
+ *
+ * `/dashboard` is a URL route, `/foo/bar/` is a regex literal, and
+ * `path:/Users/alice` is a real disclosure. Three rounds of tuning a single
+ * delimiter-sensitive pattern traded a leak for a mangled value each time, so
+ * the detectors are now split by what the field can legitimately contain.
+ *
+ * IDENTITY fields (caller, scope, selectors, routes, guidance references,
+ * authority, catalog snapshot, candidates, fallback) admit no URL, no regex and
+ * no path, so ambiguity there is resolved by rejecting. Its lookbehind includes
+ * `:` so `cwd:/Users/alice` is caught.
+ *
+ * PROSE fields carry human text and quoted evidence, where a URL or a regex is
+ * legitimate content. Redaction there is deliberately conservative and
+ * best-effort — see {@link redactAbsolutePaths}.
+ */
+const IDENTITY_PATH_PATTERN = /(?<=^|[\s'"`([{<=,;|:])(?:file:\/\/[^\s'"`;,)\]}]*|\\\\[^\s'"`;,)\]}]+|[A-Za-z]:[\\/][^\s'"`;,)\]}]*|\/(?!\/)[^\s'"`;,)\]}]+)/g;
+/** As above, minus `:`, which is what makes URLs and regexes distinguishable. */
+const PROSE_PATH_PATTERN = /(?<=^|[\s'"`([{<=,;|])(?:file:\/\/[^\s'"`;,)\]}]*|\\\\[^\s'"`;,)\]}]+|[A-Za-z]:[\\/][^\s'"`;,)\]}]*|\/(?!\/)[^\s'"`;,)\]}]+)/g;
+/** Spans of an http(s) URL, whose internal slashes are routes, not paths. */
+const HTTP_URL_PATTERN = /https?:\/\/[^\s'"`)\]}]*/g;
+/** The stable stand-in, matching the `<tier>/agents/<role>.md` precedent. */
+export const REDACTED_PATH = '<redacted-path>';
+function fresh(pattern) {
+    return new RegExp(pattern.source, 'g');
+}
+/**
+ * Identity-field detector. Rejects on ambiguity by design.
+ */
+export function containsAbsolutePath(value) {
+    return fresh(IDENTITY_PATH_PATTERN).test(value);
+}
+function httpUrlSpans(value) {
+    const spans = [];
+    const pattern = fresh(HTTP_URL_PATTERN);
+    let match;
+    while ((match = pattern.exec(value)) !== null) {
+        spans.push([match.index, match.index + match[0].length]);
+    }
+    return spans;
+}
+/**
+ * Best-effort prose redaction. NOT a guarantee.
+ *
+ * Known limits, stated so they are visible rather than assumed away:
+ * - A colon-prefixed path (`cwd:/Users/alice`) survives, because `:` cannot be
+ *   treated as a path delimiter without mangling every URL.
+ * - A candidate inside an http(s) URL is left alone, so a path-shaped route
+ *   such as `?next=/dashboard` survives.
+ * - A candidate ending in `/` is left alone, because `/foo/bar/` is far more
+ *   often a regex literal than a directory in prose.
+ * - Any path shape the pattern does not match survives.
+ *
+ * The bias is deliberate. A path leaked into prose is a disclosure; a mangled
+ * URL or regex is corrupted evidence, and corrupted evidence is worse in a
+ * provenance record. Identity and control fields carry the enforceable half of
+ * the guarantee via {@link containsAbsolutePath}.
+ */
+export function redactAbsolutePaths(value) {
+    const spans = httpUrlSpans(value);
+    return value.replace(fresh(PROSE_PATH_PATTERN), (match, offset) => {
+        if (match.endsWith('/'))
+            return match;
+        const inUrl = spans.some(([from, to]) => offset >= from && offset < to);
+        return inUrl ? match : REDACTED_PATH;
+    });
+}
+/**
+ * Recursively redact every string in a JSON value. Used for prose and nested
+ * evidence containers, where a path is plausible incidental content rather than
+ * a malformed identifier.
+ */
+export function redactAbsolutePathsDeep(value) {
+    if (typeof value === 'string')
+        return redactAbsolutePaths(value);
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactAbsolutePathsDeep(entry));
+    }
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            key,
+            redactAbsolutePathsDeep(entry),
+        ]));
+    }
+    return value;
+}
+/**
+ * Recursively reject any absolute path. Used for identity and control fields,
+ * where a path is never a legitimate value and silently rewriting one would
+ * corrupt the identifier it claims to be.
+ */
+export function assertNoAbsolutePath(value, path) {
+    if (typeof value === 'string') {
+        if (containsAbsolutePath(value)) {
+            throw new Error(`A dispatch record must not carry an absolute filesystem path at ${path}.`);
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => assertNoAbsolutePath(entry, `${path}[${index}]`));
+        return;
+    }
+    if (value === null || typeof value !== 'object')
+        return;
+    for (const [key, entry] of Object.entries(value)) {
+        assertNoAbsolutePath(entry, `${path}.${key}`);
+    }
+}
+/**
+ * The publication postcondition, scoped to what is actually guaranteed.
+ *
+ * It hard-fails on a path in an identity or control field, which is the half of
+ * NFR1 that is enforceable. It deliberately does **not** claim that no absolute
+ * path remains anywhere in the revision: prose redaction is best-effort, and a
+ * postcondition that asserted more than the sanitizer can deliver would be a
+ * false guarantee rather than a check.
+ */
+export function assertJournalIdentityHasNoAbsolutePath(identityFields) {
+    for (const [field, value] of Object.entries(identityFields)) {
+        assertNoAbsolutePath(value, `<journal>.${field}`);
+    }
+}

package/dist/providers/identity/claude-runtime-observation.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Claude runtime metadata parsing.
+ *
+ * Field paths here are taken from real on-disk transcripts under
+ * `~/.claude/projects/`, not from assumption. Every corpus figure in this file
+ * is an operator-environment observation as of 2026-09-02 on the capturing
+ * operator's machine, not a provider guarantee: a later mismatch means the
+ * corpus moved, not that the claim was wrong.
+ *
+ * An earlier revision read only `system`/`init` and `result` records; a scan of
+ * all 2,725 local transcripts found `"subtype":"init"` in zero of them, so that parser returned
+ * `not-reported` against every real transcript while its hand-written fixtures
+ * agreed with it. The on-disk `assistant` entry is now the primary shape.
+ *
+ * Reading an `assistant` entry does not mean reading a conversation. The parser
+ * takes allowlisted entry-level metadata plus exactly two explicit key paths
+ * inside `message` — `message.model` and `message.usage.service_tier`.
+ * `message` is never spread, enumerated, or filtered after the fact, so
+ * `message.content` is not merely dropped later; it is never reached. The
+ * content-trap test pins this: a `message` whose `content` throws on access
+ * still parses cleanly.
+ *
+ * Everything this module produces is per-run, non-authoritative corroboration.
+ * A failed or partial parse yields `not-reported` and never falls back to the
+ * configured invocation.
+ */
+/**
+ * The complete entry-level read surface for an `assistant` entry. `message` is
+ * handled separately by explicit path and is deliberately absent from this
+ * list, so this plus `message.model` and `message.usage.service_tier` is
+ * everything the parser touches. Exported so a test can pin it: a future widening
+ * has to change this list, in view, rather than slip in at a call site.
+ *
+ * `attributionAgent` is the role identifier and is the same class of signal
+ * Codex carries as `agent_role`: a bounded enum-like name, not conversation
+ * content. Across 2,725 captured transcripts it took 8 distinct values, all
+ * of which pass the shared identifier validator, with a longest value of 21
+ * characters against the 256 bound. It appears on subagent turns only, so a
+ * main session reports no role rather than a synthesized one.
+ */
+export declare const CLAUDE_ASSISTANT_KEYS: readonly ['type', 'isSidechain', 'effort', 'attributionAgent', 'sessionId', 'session_id', 'requestId'];
+/**
+ * Stream-json entry keys, for `claude -p --output-format stream-json`.
+ *
+ * UNVERIFIED: no captured artifact of that format was available, and zero of
+ * the 2,725 observed local transcripts contained a `system`/`init` record. This path is
+ * retained as a secondary shape and must not be presented as equally grounded
+ * with the on-disk shape above.
+ */
+export declare const CLAUDE_INIT_KEYS: readonly ['type', 'subtype', 'model', 'service_tier', 'serviceTier', 'agent', 'subagent_type', 'reasoning_effort', 'effort', 'request_id'];
+export declare const CLAUDE_OBSERVATION_SOURCE = "claude-session-metadata";
+export interface ClaudeRuntimeMetadata {
+    /**
+     * `root` for a main session, `depth-unknown` for a subagent turn.
+     *
+     * `isSidechain` is the only lineage signal Claude emits and it is binary. No
+     * depth, nesting, level, or ancestry key appeared on any of the 141,078
+     * observed assistant entries, and `parentUuid` never crosses an `agentId`
+     * boundary, so it chains messages within one agent rather than agents to
+     * each other. A depth number is therefore not derivable and is not invented.
+     */
+    childLineage: string | null;
+    /** Observed role, from `attributionAgent`; `null` when the run reports none. */
+    role: string | null;
+    model: string | null;
+    effort: string | null;
+    serviceTier: string | null;
+    /**
+     * OAT request correlation declared by the provider, for parity with the Codex
+     * parser. Claude declares none, so this is `null` on a real transcript.
+     * Claude's own `requestId` is a per-turn API identifier and its `sessionId` a
+     * transcript identifier; neither is an OAT dispatch request id, so neither is
+     * equality-checked against one.
+     */
+    requestId: string | null;
+    /** Provider session identifier, used to prove the envelope is one session. */
+    sessionId: string | null;
+}
+/**
+ * Extract the child's metadata from Claude transcript entries.
+ *
+ * The applicable turn is the last one: it is the most recent state the session
+ * reported. Earlier turns fill only the fields the last one left unreported.
+ * Returns `null` when no Claude metadata is present, or when the entries mix
+ * sessions — every captured transcript carries exactly one `sessionId`, so more
+ * than one means no single applicable child exists.
+ */
+export declare function extractClaudeRuntimeMetadata(entries: readonly unknown[]): ClaudeRuntimeMetadata | null;
+/**
+ * Neutral observation facts for the cross-provider projection.
+ *
+ * The single-session guarantee runs in-process inside
+ * {@link extractClaudeRuntimeMetadata}, so `sessionId` never needs to survive
+ * into the projected output — which matters, because `sessionId` classifies
+ * sensitive and previously made every real transcript unrecordable.
+ */
+export declare function observeClaudeRuntimeFacts(entries: readonly unknown[]): {
+    lineage: string | null;
+    role: string | null;
+    model: string | null;
+    effort: string | null;
+    serviceTier: string | null;
+    correlation: string | null;
+} | null;
+//# sourceMappingURL=claude-runtime-observation.d.ts.map

package/dist/providers/identity/claude-runtime-observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-runtime-observation.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/claude-runtime-observation.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,YAChC,MAAM,EACN,aAAa,EACb,QAAQ,EACR,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,WAAW,CACH,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,YAC3B,MAAM,EACN,SAAS,EACT,OAAO,EACP,cAAc,EACd,aAAa,EACb,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,YAAY,CACJ,CAAC;AAEX,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AA+FD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,OAAO,EAAE,GAC1B,qBAAqB,GAAG,IAAI,CAmD9B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG;IACtE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,IAAI,CAWP"}

package/dist/providers/identity/claude-runtime-observation.fixtures.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Captured Claude transcript metadata, sanitized.
+ *
+ * Derived from real on-disk transcripts under `~/.claude/projects/`, which is
+ * the format Claude actually writes. Corpus counts below are
+ * operator-environment observations (as of 2026-09-02, on the capturing operator's machine). They replaced hand-written fixtures built
+ * around `system`/`init` and `result` records: a scan of all 2,725 local
+ * transcripts found `"subtype":"init"` in zero of them, so the previous parser
+ * returned `not-reported` against every real transcript while its own fixtures
+ * agreed with it.
+ *
+ * Sanitization is allowlist-based. Retained: the entry-level metadata keys the
+ * parser reads plus a few it does not (`version`, `userType`, `uuid`), so the
+ * fixtures still demonstrate that unread keys are dropped. `message` is reduced
+ * to the two explicit key paths the parser reaches — `message.model` and
+ * `message.usage.service_tier`. Dropped outright: `message.content` (the
+ * conversation), `cwd`, `gitBranch`, `slug`, `agentId`, and the remaining
+ * `attribution*` fields.
+ *
+ * Structural facts these fixtures preserve, each load-bearing:
+ * - `effort` is a real top-level field on an assistant entry. Claude does
+ *   expose a selectable effort axis, so reporting `not-exposed` for it was
+ *   wrong; observed values across 124,804 entries are `high`, `xhigh`,
+ *   `medium`, and `max`.
+ * - `attributionAgent` is the role identifier, and it is exactly the signal
+ *   Codex carries as `agent_role`. It appears on subagent turns only: present
+ *   on 114,600 of 114,657 sidechain entries and on none of the 26,497
+ *   main-session entries. `SIDECHAIN_TRANSCRIPT` therefore carries it and
+ *   `MAIN_SESSION_TRANSCRIPT` does not, which is the real distinction rather
+ *   than a constructed one.
+ * - `isSidechain` distinguishes a main session from a subagent turn. It is the
+ *   only lineage signal present, and it is binary. Role names are not a depth
+ *   signal and are never read as one.
+ * - `sessionId` is constant within a transcript; every one of the 2,655 local
+ *   transcripts that carries one carries exactly one.
+ * - Model and service tier live only under `message`, never at the top level.
+ */
+export declare const MAIN_SESSION_TRANSCRIPT: readonly unknown[];
+export declare const SIDECHAIN_TRANSCRIPT: readonly unknown[];
+//# sourceMappingURL=claude-runtime-observation.fixtures.d.ts.map

package/dist/providers/identity/claude-runtime-observation.fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-runtime-observation.fixtures.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/claude-runtime-observation.fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,eAAO,MAAM,uBAAuB,EAAE,SAAS,OAAO,EAoDrD,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,SAAS,OAAO,EAuDlD,CAAC"}

package/dist/providers/identity/claude-runtime-observation.fixtures.js

@@ -0,0 +1,146 @@
+/**
+ * Captured Claude transcript metadata, sanitized.
+ *
+ * Derived from real on-disk transcripts under `~/.claude/projects/`, which is
+ * the format Claude actually writes. Corpus counts below are
+ * operator-environment observations (as of 2026-09-02, on the capturing operator's machine). They replaced hand-written fixtures built
+ * around `system`/`init` and `result` records: a scan of all 2,725 local
+ * transcripts found `"subtype":"init"` in zero of them, so the previous parser
+ * returned `not-reported` against every real transcript while its own fixtures
+ * agreed with it.
+ *
+ * Sanitization is allowlist-based. Retained: the entry-level metadata keys the
+ * parser reads plus a few it does not (`version`, `userType`, `uuid`), so the
+ * fixtures still demonstrate that unread keys are dropped. `message` is reduced
+ * to the two explicit key paths the parser reaches — `message.model` and
+ * `message.usage.service_tier`. Dropped outright: `message.content` (the
+ * conversation), `cwd`, `gitBranch`, `slug`, `agentId`, and the remaining
+ * `attribution*` fields.
+ *
+ * Structural facts these fixtures preserve, each load-bearing:
+ * - `effort` is a real top-level field on an assistant entry. Claude does
+ *   expose a selectable effort axis, so reporting `not-exposed` for it was
+ *   wrong; observed values across 124,804 entries are `high`, `xhigh`,
+ *   `medium`, and `max`.
+ * - `attributionAgent` is the role identifier, and it is exactly the signal
+ *   Codex carries as `agent_role`. It appears on subagent turns only: present
+ *   on 114,600 of 114,657 sidechain entries and on none of the 26,497
+ *   main-session entries. `SIDECHAIN_TRANSCRIPT` therefore carries it and
+ *   `MAIN_SESSION_TRANSCRIPT` does not, which is the real distinction rather
+ *   than a constructed one.
+ * - `isSidechain` distinguishes a main session from a subagent turn. It is the
+ *   only lineage signal present, and it is binary. Role names are not a depth
+ *   signal and are never read as one.
+ * - `sessionId` is constant within a transcript; every one of the 2,655 local
+ *   transcripts that carries one carries exactly one.
+ * - Model and service tier live only under `message`, never at the top level.
+ */
+export const MAIN_SESSION_TRANSCRIPT = [
+    {
+        type: 'assistant',
+        isSidechain: false,
+        effort: 'high',
+        sessionId: '7f9d5ab4-3b08-4a21-adb5-405c04af2d89',
+        requestId: 'req_011Ce9GB4DvzreK2hzChvmgy',
+        uuid: '14c99a81-02ff-4153-8104-3e4d238451f9',
+        parentUuid: '66d090ee-2e16-4b8d-bc67-bcb1027220cb',
+        version: '2.1.234',
+        userType: 'external',
+        message: {
+            model: 'claude-fable-5',
+            usage: {
+                service_tier: 'standard',
+            },
+        },
+    },
+    {
+        type: 'assistant',
+        isSidechain: false,
+        effort: 'high',
+        sessionId: '7f9d5ab4-3b08-4a21-adb5-405c04af2d89',
+        requestId: 'req_011Ce9GB4DvzreK2hzChvmgy',
+        uuid: '50ef9865-24e6-4a77-9831-a01258db757f',
+        parentUuid: '14c99a81-02ff-4153-8104-3e4d238451f9',
+        version: '2.1.234',
+        userType: 'external',
+        message: {
+            model: 'claude-fable-5',
+            usage: {
+                service_tier: 'standard',
+            },
+        },
+    },
+    {
+        type: 'assistant',
+        isSidechain: false,
+        effort: 'high',
+        sessionId: '7f9d5ab4-3b08-4a21-adb5-405c04af2d89',
+        requestId: 'req_011Ce9GB4DvzreK2hzChvmgy',
+        uuid: '15864101-70c5-48fb-939f-679a458ba679',
+        parentUuid: '50ef9865-24e6-4a77-9831-a01258db757f',
+        version: '2.1.234',
+        userType: 'external',
+        message: {
+            model: 'claude-fable-5',
+            usage: {
+                service_tier: 'standard',
+            },
+        },
+    },
+];
+export const SIDECHAIN_TRANSCRIPT = [
+    {
+        type: 'assistant',
+        isSidechain: true,
+        effort: 'high',
+        attributionAgent: 'general-purpose',
+        sessionId: '19c78382-cceb-45ab-bf24-bb8aa284d96b',
+        requestId: 'req_011CdSgeEdPwRsUpVTCihKmV',
+        uuid: '0f106449-eeb9-475c-8186-d70b9d14a82c',
+        parentUuid: '95017f46-0284-49e3-9a7c-597ad4364042',
+        version: '2.1.220',
+        userType: 'external',
+        message: {
+            model: 'claude-opus-5',
+            usage: {
+                service_tier: 'standard',
+            },
+        },
+    },
+    {
+        type: 'assistant',
+        isSidechain: true,
+        effort: 'high',
+        attributionAgent: 'general-purpose',
+        sessionId: '19c78382-cceb-45ab-bf24-bb8aa284d96b',
+        requestId: 'req_011CdSgeEdPwRsUpVTCihKmV',
+        uuid: '24c36d1b-c532-447f-9981-8f2b0d0988f8',
+        parentUuid: '0f106449-eeb9-475c-8186-d70b9d14a82c',
+        version: '2.1.220',
+        userType: 'external',
+        message: {
+            model: 'claude-opus-5',
+            usage: {
+                service_tier: 'standard',
+            },
+        },
+    },
+    {
+        type: 'assistant',
+        isSidechain: true,
+        effort: 'high',
+        attributionAgent: 'general-purpose',
+        sessionId: '19c78382-cceb-45ab-bf24-bb8aa284d96b',
+        requestId: 'req_011CdSgeEdPwRsUpVTCihKmV',
+        uuid: 'd3453335-a00b-4716-95bf-6a7574903336',
+        parentUuid: 'c0d14665-a467-46e5-abcd-85c3e15ba30e',
+        version: '2.1.220',
+        userType: 'external',
+        message: {
+            model: 'claude-opus-5',
+            usage: {
+                service_tier: 'standard',
+            },
+        },
+    },
+];

package/dist/providers/identity/claude-runtime-observation.js

@@ -0,0 +1,229 @@
+import { observationIdentifier as observedValue } from './oat-dispatch-record.js';
+/**
+ * Claude runtime metadata parsing.
+ *
+ * Field paths here are taken from real on-disk transcripts under
+ * `~/.claude/projects/`, not from assumption. Every corpus figure in this file
+ * is an operator-environment observation as of 2026-09-02 on the capturing
+ * operator's machine, not a provider guarantee: a later mismatch means the
+ * corpus moved, not that the claim was wrong.
+ *
+ * An earlier revision read only `system`/`init` and `result` records; a scan of
+ * all 2,725 local transcripts found `"subtype":"init"` in zero of them, so that parser returned
+ * `not-reported` against every real transcript while its hand-written fixtures
+ * agreed with it. The on-disk `assistant` entry is now the primary shape.
+ *
+ * Reading an `assistant` entry does not mean reading a conversation. The parser
+ * takes allowlisted entry-level metadata plus exactly two explicit key paths
+ * inside `message` — `message.model` and `message.usage.service_tier`.
+ * `message` is never spread, enumerated, or filtered after the fact, so
+ * `message.content` is not merely dropped later; it is never reached. The
+ * content-trap test pins this: a `message` whose `content` throws on access
+ * still parses cleanly.
+ *
+ * Everything this module produces is per-run, non-authoritative corroboration.
+ * A failed or partial parse yields `not-reported` and never falls back to the
+ * configured invocation.
+ */
+/**
+ * The complete entry-level read surface for an `assistant` entry. `message` is
+ * handled separately by explicit path and is deliberately absent from this
+ * list, so this plus `message.model` and `message.usage.service_tier` is
+ * everything the parser touches. Exported so a test can pin it: a future widening
+ * has to change this list, in view, rather than slip in at a call site.
+ *
+ * `attributionAgent` is the role identifier and is the same class of signal
+ * Codex carries as `agent_role`: a bounded enum-like name, not conversation
+ * content. Across 2,725 captured transcripts it took 8 distinct values, all
+ * of which pass the shared identifier validator, with a longest value of 21
+ * characters against the 256 bound. It appears on subagent turns only, so a
+ * main session reports no role rather than a synthesized one.
+ */
+export const CLAUDE_ASSISTANT_KEYS = [
+    'type',
+    'isSidechain',
+    'effort',
+    'attributionAgent',
+    'sessionId',
+    'session_id',
+    'requestId',
+];
+/**
+ * Stream-json entry keys, for `claude -p --output-format stream-json`.
+ *
+ * UNVERIFIED: no captured artifact of that format was available, and zero of
+ * the 2,725 observed local transcripts contained a `system`/`init` record. This path is
+ * retained as a secondary shape and must not be presented as equally grounded
+ * with the on-disk shape above.
+ */
+export const CLAUDE_INIT_KEYS = [
+    'type',
+    'subtype',
+    'model',
+    'service_tier',
+    'serviceTier',
+    'agent',
+    'subagent_type',
+    'reasoning_effort',
+    'effort',
+    'request_id',
+];
+export const CLAUDE_OBSERVATION_SOURCE = 'claude-session-metadata';
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * The two explicit key paths inside `message`. Reaching them by path is what
+ * makes the projection narrow; a spread or key-filter would touch
+ * `message.content` on the way.
+ */
+function messageMetadata(entry) {
+    const message = entry.message;
+    if (!isRecord(message))
+        return { model: undefined, serviceTier: undefined };
+    const usage = message.usage;
+    return {
+        model: message.model,
+        serviceTier: isRecord(usage) ? usage.service_tier : undefined,
+    };
+}
+function firstModelUsage(entry) {
+    const usage = entry.modelUsage;
+    if (!isRecord(usage))
+        return null;
+    const [name, detail] = Object.entries(usage)[0] ?? [];
+    if (name === undefined)
+        return null;
+    return {
+        model: observedValue(name),
+        serviceTier: isRecord(detail)
+            ? observedValue(detail.serviceTier ?? detail.service_tier)
+            : null,
+    };
+}
+function assistantTurn(entry) {
+    const { model, serviceTier } = messageMetadata(entry);
+    return {
+        isSidechain: typeof entry.isSidechain === 'boolean' ? entry.isSidechain : null,
+        effort: observedValue(entry.effort),
+        sessionId: observedValue(entry.sessionId ?? entry.session_id),
+        model: observedValue(model),
+        serviceTier: observedValue(serviceTier),
+        requestId: null,
+        // Role only. It never contributes to lineage: `isSidechain` is the sole
+        // lineage signal, and inferring depth from a role name would be exactly
+        // the invention this parser was rewritten to remove.
+        role: observedValue(entry.attributionAgent),
+    };
+}
+/** Secondary, unverified stream-json shape; see CLAUDE_INIT_KEYS. */
+function streamJsonTurn(entry) {
+    if (entry.type === 'system' && entry.subtype === 'init') {
+        return {
+            isSidechain: null,
+            effort: observedValue(entry.reasoning_effort ?? entry.effort),
+            sessionId: null,
+            model: observedValue(entry.model),
+            serviceTier: observedValue(entry.service_tier ?? entry.serviceTier),
+            requestId: observedValue(entry.request_id),
+            role: observedValue(entry.agent ?? entry.subagent_type),
+        };
+    }
+    if (entry.type === 'result') {
+        const usage = firstModelUsage(entry);
+        if (usage === null)
+            return null;
+        return {
+            isSidechain: null,
+            effort: null,
+            sessionId: null,
+            model: usage.model,
+            serviceTier: usage.serviceTier,
+            requestId: null,
+            role: null,
+        };
+    }
+    return null;
+}
+/**
+ * Extract the child's metadata from Claude transcript entries.
+ *
+ * The applicable turn is the last one: it is the most recent state the session
+ * reported. Earlier turns fill only the fields the last one left unreported.
+ * Returns `null` when no Claude metadata is present, or when the entries mix
+ * sessions — every captured transcript carries exactly one `sessionId`, so more
+ * than one means no single applicable child exists.
+ */
+export function extractClaudeRuntimeMetadata(entries) {
+    if (!Array.isArray(entries))
+        return null;
+    const turns = [];
+    for (const entry of entries) {
+        if (!isRecord(entry))
+            continue;
+        // Classification is by discriminator alone.
+        if (entry.type === 'assistant') {
+            turns.push(assistantTurn(entry));
+            continue;
+        }
+        const fallback = streamJsonTurn(entry);
+        if (fallback !== null)
+            turns.push(fallback);
+    }
+    if (turns.length === 0)
+        return null;
+    const sessions = new Set(turns
+        .map((turn) => turn.sessionId)
+        .filter((value) => value !== null));
+    if (sessions.size > 1)
+        return null;
+    const applicable = turns.at(-1);
+    if (!applicable)
+        return null;
+    let model = null;
+    let effort = null;
+    let serviceTier = null;
+    let requestId = null;
+    let role = null;
+    for (const turn of turns) {
+        model = turn.model ?? model;
+        effort = turn.effort ?? effort;
+        serviceTier = turn.serviceTier ?? serviceTier;
+        requestId = turn.requestId ?? requestId;
+        role = turn.role ?? role;
+    }
+    return {
+        childLineage: applicable.isSidechain === null
+            ? null
+            : applicable.isSidechain
+                ? 'depth-unknown'
+                : 'root',
+        role,
+        model,
+        effort,
+        serviceTier,
+        requestId,
+        sessionId: [...sessions][0] ?? null,
+    };
+}
+/**
+ * Neutral observation facts for the cross-provider projection.
+ *
+ * The single-session guarantee runs in-process inside
+ * {@link extractClaudeRuntimeMetadata}, so `sessionId` never needs to survive
+ * into the projected output — which matters, because `sessionId` classifies
+ * sensitive and previously made every real transcript unrecordable.
+ */
+export function observeClaudeRuntimeFacts(entries) {
+    const metadata = extractClaudeRuntimeMetadata(entries);
+    if (metadata === null)
+        return null;
+    return {
+        lineage: metadata.childLineage,
+        role: metadata.role,
+        model: metadata.model,
+        effort: metadata.effort,
+        serviceTier: metadata.serviceTier,
+        correlation: metadata.requestId,
+    };
+}