@playola-radio/slipstream 0.1.0 → 0.3.0

package/dist/attach-workflow.js

@@ -0,0 +1,557 @@
+/**
+ * `slipstream attach` with no identity flags: connect the agent chat this
+ * command runs inside. It finds the chat from the harness's own environment,
+ * starts the shared daemon if needed, installs the question hook and answer
+ * tool for that harness in this workspace, and attaches with the chat's root
+ * transcript. Success needs both recording and a connected chat; anything less
+ * is reported as pending or refused, never as attached.
+ */
+import { readdir, readFile, writeFile, rename, mkdir, lstat, realpath, unlink, chmod, stat } from 'node:fs/promises';
+import { dirname, extname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { verifyClaudeRootTranscript } from "./claude-root-transcript.js";
+import { verifyCodexRootTranscript } from "./codex-root-transcript.js";
+import { defaultDaemonStore } from "./daemon-location.js";
+import { DaemonUnavailableError, ensureDaemon as ensureStoreDaemon } from "./ensure-daemon.js";
+class Refusal extends Error {
+}
+const HOOK_TIMEOUT_S = 3;
+/** Stays under an agent's default two-minute command timeout. */
+const ATTACH_WAIT_MS = 90_000;
+const WAIT_POLL_MS = 250;
+/** Distinct from a refusal (1) and a usage error (2). */
+export const PENDING_EXIT = 3;
+export async function runAttachWorkflow(opts, deps) {
+    try {
+        return await attachThisChat(opts, deps);
+    }
+    catch (err) {
+        if (!(err instanceof Refusal))
+            throw err;
+        deps.err(`slipstream: ${err.message}`);
+        return 1;
+    }
+}
+async function attachThisChat(opts, deps) {
+    const chat = detectChat(deps.env);
+    let worktree;
+    try {
+        worktree = await realpath(opts.dir);
+    }
+    catch {
+        throw new Refusal(`${opts.dir} does not exist; nothing was recorded`);
+    }
+    const transcript = await findTranscript(chat, deps);
+    await verifyTranscript(chat, transcript, worktree);
+    const plan = await planAgentConfig(chat, worktree, opts.store, deps);
+    await ensureDaemon(opts.store, deps);
+    const status = await deps.control({ verb: 'status' });
+    if (!status.ok)
+        throw new Refusal(`${status.code}: ${status.message}`);
+    requireCaptureTable(status, opts.store);
+    // A status snapshot can predict a refusal, but slots may free before attach.
+    const deferredConfig = refusalExpected(status, chat, worktree);
+    let changed = deferredConfig ? false : await applyAgentConfig(plan, worktree, deps);
+    const linked = await linkWhenRecording({ verb: 'attach', worktree, harness: chat.harness, harness_session_id: chat.id,
+        root_transcript: transcript }, deps);
+    if (typeof linked === 'number')
+        return linked;
+    const res = linked;
+    const connection = String(res.agent_connection);
+    if (connection !== 'connected' && connection !== 'setup_pending') {
+        throw new Refusal(`the daemon reported this chat as ${connection}; it is not connected.`);
+    }
+    if (deferredConfig) {
+        try {
+            changed = await applyAgentConfig(plan, worktree, deps);
+        }
+        catch (err) {
+            deps.out(`session_id: ${String(res.session_id)}`);
+            deps.out(`agent_connection: ${connection}`);
+            // Setup's pre-attach refusals cannot describe a link already saved by the daemon.
+            const reason = (err instanceof Error ? err.message : String(err)).replace(/ Nothing was recorded\.$/, '');
+            throw new Refusal(`The workspace is recording and this chat is linked, but setup is incomplete. ${reason} `
+                + `Fix the setup error, then run \`slipstream attach${storeFlag(opts.store, deps.home)}\` again from this chat.`);
+        }
+    }
+    const again = res.already_active === true;
+    if (connection === 'connected') {
+        deps.out(again
+            ? `Attached successfully: already recording ${worktree} with this chat, agent connected; nothing changed.`
+            : `Attached successfully: recording ${worktree}, agent connected.`);
+    }
+    else {
+        deps.out(`${again ? 'Already recording' : 'Recording'} ${worktree}; agent setup pending.`);
+        deps.out(pendingStep(chat, worktree, changed, storeFlag(opts.store, deps.home)));
+    }
+    deps.out(`session_id: ${String(res.session_id)}`);
+    deps.out(`agent_connection: ${connection}`);
+    return 0;
+}
+/** `slipstream attach` with explicit identity flags: link that chat, waiting out a
+ * starting capture exactly as the chat-detecting form does. */
+export async function runIdentityAttach(request, deps) {
+    try {
+        const res = await linkWhenRecording(request, deps);
+        if (typeof res === 'number')
+            return res;
+        deps.report(res);
+        return 0;
+    }
+    catch (err) {
+        if (!(err instanceof Refusal))
+            throw err;
+        deps.err(`slipstream: ${err.message}`);
+        return 1;
+    }
+}
+/** Attach a chat. A capture that is still starting is polled until it records,
+ * then the same attach is resubmitted (it is idempotent). Returns the link reply,
+ * or the exit code after reporting that the capture is still pending. */
+async function linkWhenRecording(request, deps) {
+    const deadline = clock(deps) + ATTACH_WAIT_MS;
+    for (;;) {
+        const res = await deps.control(request);
+        if (!res.ok)
+            throw new Refusal(`${res.code}: ${res.message}`);
+        if (res.binding_generation !== undefined)
+            return res;
+        if (res.state === 'not_recording')
+            throw notRecording(request.worktree, res);
+        const row = await waitForCapture(String(res.session_id), deadline, deps);
+        if (row === null)
+            return stillPending(request.worktree, String(res.session_id), deps);
+        if (row.state !== 'recording')
+            throw notRecording(request.worktree, row);
+    }
+}
+/** `slipstream attach --watch-only`: record a workspace with no chat linked. */
+export async function runWatchOnlyAttach(opts, deps) {
+    try {
+        const res = await deps.control({ verb: 'attach', mode: 'watch-only', worktree: opts.dir });
+        if (!res.ok)
+            throw new Refusal(`${res.code}: ${res.message}`);
+        const id = String(res.session_id);
+        let state = String(res.state);
+        if (state === 'queued' || state === 'baselining') {
+            if (!opts.wait) {
+                deps.out(`Capture of ${opts.dir} is starting (${state}); it is not recording yet. `
+                    + `Check with \`slipstream status ${id}\`.`);
+                deps.out(`session_id: ${id}`);
+                deps.out(`state: ${state}`);
+                return 0;
+            }
+            const row = await waitForCapture(id, clock(deps) + ATTACH_WAIT_MS, deps);
+            if (row === null)
+                return stillPending(opts.dir, id, deps);
+            if (row.state !== 'recording')
+                throw notRecording(opts.dir, row);
+            state = 'recording';
+        }
+        if (state !== 'recording')
+            throw notRecording(opts.dir, res);
+        deps.out(`Recording ${opts.dir}; this command linked no chat.`);
+        deps.out(`session_id: ${id}`);
+        deps.out(`state: ${state}`);
+        return 0;
+    }
+    catch (err) {
+        if (!(err instanceof Refusal))
+            throw err;
+        deps.err(`slipstream: ${err.message}`);
+        return 1;
+    }
+}
+function clock(deps) {
+    return (deps.now ?? Date.now)();
+}
+/** Poll one capture with short status requests until it is no longer starting.
+ * Null means the deadline passed first. */
+async function waitForCapture(id, deadline, deps) {
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    for (;;) {
+        const res = await deps.control({ verb: 'status', target: id });
+        if (!res.ok)
+            throw new Refusal(`${res.code}: ${res.message}`);
+        const row = res.capture;
+        if (row.state !== 'queued' && row.state !== 'baselining')
+            return row;
+        if (clock(deps) >= deadline)
+            return null;
+        await sleep(deps.pollIntervalMs ?? WAIT_POLL_MS);
+    }
+}
+function notRecording(worktree, row) {
+    const why = row.message ?? row.reason ?? row.state;
+    return new Refusal(`${worktree} is not recording (${String(row.state)}): ${String(why)}`);
+}
+function stillPending(worktree, id, deps) {
+    deps.err(`slipstream: the capture of ${worktree} is still pending, outcome unknown (session ${id}). `
+        + `Check with \`slipstream status ${id}\`; running this command again does not start a second capture.`);
+    return PENDING_EXIT;
+}
+function requireCaptureTable(status, store) {
+    const features = status.attach_features;
+    if (Array.isArray(features) && features.includes('agent-connection-v1') && features.includes('capture-table-v1'))
+        return;
+    throw new Refusal('the running daemon does not support multi-workspace capture and chat setup checks. Stop it '
+        + `(end the \`slipstream start --store ${shellWord(store)}\` process, or run \`slipstream conductor install\` to restart `
+        + `a managed daemon on this version), then run \`slipstream attach --store ${shellWord(store)}\` again. `
+        + 'Nothing was installed or recorded.');
+}
+/** Whether the daemon will refuse to link this chat: it is linked elsewhere, this
+ * workspace has another chat, or every chat slot is used. */
+function refusalExpected(status, chat, worktree) {
+    const rows = (Array.isArray(status.captures) ? status.captures : []);
+    const linked = (r) => r.binding != null && r.binding.state !== 'unlinked';
+    const mine = rows.find((r) => linked(r) && r.binding.harness === chat.harness
+        && r.binding.harness_session_id === chat.id);
+    if (mine)
+        return mine.root !== worktree;
+    const here = rows.find((r) => r.root === worktree && r.state !== 'stopped');
+    if (here && linked(here))
+        return true;
+    const slots = status.binding_slots;
+    return typeof slots?.used === 'number' && typeof slots.limit === 'number' && slots.used >= slots.limit;
+}
+function detectChat(env) {
+    const claude = env.CLAUDE_CODE_SESSION_ID;
+    const codex = env.CODEX_THREAD_ID;
+    if (claude && codex) {
+        throw new Refusal('this environment has both a Claude Code and a Codex chat; cannot tell which one to connect. '
+            + 'Nothing was recorded.');
+    }
+    if (!claude && !codex) {
+        throw new Refusal('no Claude Code or Codex chat detected. Run `slipstream attach` from inside the agent chat '
+            + 'you want to connect (for example, ask the agent to run it). Nothing was recorded.');
+    }
+    return { harness: claude ? 'claude-code' : 'codex', id: (claude ?? codex), conductor: !!env.CONDUCTOR_SESSION_ID };
+}
+async function findTranscript(chat, deps) {
+    const found = chat.harness === 'claude-code'
+        ? await claudeTranscripts(join(deps.env.CLAUDE_CONFIG_DIR ?? join(deps.home, '.claude'), 'projects'), `${chat.id}.jsonl`)
+        : await codexTranscripts(join(deps.env.CODEX_HOME ?? join(deps.home, '.codex'), 'sessions'), `-${chat.id}.jsonl`);
+    if (found.length === 1)
+        return found[0];
+    throw new Refusal(found.length === 0
+        ? `could not find this chat's transcript (${chat.harness} ${chat.id}); Slipstream needs it to confirm the chat. `
+            + 'Nothing was recorded.'
+        : `found ${found.length} transcripts for this chat (${chat.harness} ${chat.id}); cannot tell which is the root. `
+            + 'Nothing was recorded.');
+}
+async function claudeTranscripts(projects, name) {
+    const found = [];
+    for (const dir of await listDir(projects)) {
+        const path = join(projects, dir, name);
+        if (await isFile(path))
+            found.push(path);
+    }
+    return found;
+}
+/** Codex keeps rollouts under sessions/YYYY/MM/DD/rollout-<time>-<thread id>.jsonl. */
+async function codexTranscripts(sessions, suffix) {
+    const found = [];
+    for (const year of await listDir(sessions)) {
+        for (const month of await listDir(join(sessions, year))) {
+            for (const day of await listDir(join(sessions, year, month))) {
+                for (const file of await listDir(join(sessions, year, month, day))) {
+                    const path = join(sessions, year, month, day, file);
+                    if (file.startsWith('rollout-') && file.endsWith(suffix) && await isFile(path))
+                        found.push(path);
+                }
+            }
+        }
+    }
+    return found;
+}
+async function listDir(path) {
+    try {
+        return await readdir(path);
+    }
+    catch {
+        return [];
+    }
+}
+async function isFile(path) {
+    try {
+        return (await lstat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function verifyTranscript(chat, transcript, worktree) {
+    if (chat.harness === 'codex') {
+        if (!await verifyCodexRootTranscript(transcript, chat.id, worktree)) {
+            throw new Refusal('this Codex chat\'s version or launch mode (such as `codex exec`) is not a runtime Slipstream has '
+                + `verified, or its transcript does not match ${worktree}. Questions could not be delivered reliably, so nothing `
+                + 'was installed or recorded.');
+        }
+        return;
+    }
+    const result = await verifyClaudeRootTranscript(transcript, chat.id, worktree);
+    if (result.ok)
+        return;
+    if (result.reason === 'not-yet') {
+        throw new Refusal('this chat\'s transcript is still being written; run `slipstream attach` again after the next '
+            + 'tool call. Nothing was recorded.');
+    }
+    if (result.reason === 'gap') {
+        throw new Refusal('this chat\'s opening transcript is too large to verify; attach early in a new chat. '
+            + 'Nothing was recorded.');
+    }
+    throw new Refusal(`this chat's transcript does not match ${worktree}: the chat may have been started in another `
+        + 'directory, or its transcript is missing or contradicts the session, folder or launch details Slipstream checks. '
+        + 'Questions could not be delivered reliably, so nothing was installed or recorded.');
+}
+async function ensureDaemon(store, deps) {
+    try {
+        await ensureStoreDaemon(store, deps);
+    }
+    catch (err) {
+        if (err instanceof DaemonUnavailableError)
+            throw new Refusal(err.message);
+        throw err;
+    }
+}
+export function shellWord(value) {
+    return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
+}
+/** Plan only the selected harness's hook and answer tool. Unrelated entries
+ * are kept, an identical entry is left alone, and a different Slipstream entry
+ * is refused rather than replaced. Nothing is written yet. */
+async function planAgentConfig(chat, worktree, store, deps) {
+    const forwarder = join(dirname(deps.cliPath), `mcp-forwarder${extname(deps.cliPath)}`);
+    if (!await isFile(forwarder)) {
+        throw new Refusal(`the Slipstream answer tool is missing next to ${deps.cliPath}; reinstall Slipstream. `
+            + 'Nothing was recorded.');
+    }
+    const hook = [deps.nodePath, deps.cliPath, 'hook', chat.harness, 'post-tool-use', '--store', store]
+        .map(shellWord).join(' ');
+    const hookFile = chat.harness === 'claude-code' ? '.claude/settings.local.json' : '.codex/hooks.json';
+    const hookEdit = await planHook(join(worktree, hookFile), hook);
+    const toolArgs = [forwarder, '--store', store];
+    if (chat.harness === 'codex') {
+        const userConfig = join(deps.env.CODEX_HOME ?? join(deps.home, '.codex'), 'config.toml');
+        const userTool = await readCodexTool(userConfig, deps.nodePath, toolArgs, 'user-wide');
+        // A project server takes precedence over the user-wide server. Plan it even
+        // when the user entry matches so a conflicting project entry is refused.
+        const projectTool = await planCodexTool(join(worktree, '.codex', 'config.toml'), deps.nodePath, toolArgs);
+        return { hookEdit, toolEdit: userTool ? null : projectTool,
+            claudeTool: null };
+    }
+    const missing = await claudeToolMissing(chat, worktree, deps, toolArgs);
+    return { hookEdit, toolEdit: null, claudeTool: missing ? [deps.nodePath, ...toolArgs] : null };
+}
+/** Write the plan, refusing if a file changed since it was planned. Returns
+ * whether anything was written. */
+async function applyAgentConfig(plan, worktree, deps) {
+    const { hookEdit, toolEdit, claudeTool } = plan;
+    for (const edit of [hookEdit, toolEdit]) {
+        if (!edit)
+            continue;
+        await writeAtomic(edit);
+        deps.out(`Installed the Slipstream ${edit === hookEdit ? 'question hook' : 'answer tool'} in ${edit.path}`);
+    }
+    if (claudeTool) {
+        const claude = deps.env.CLAUDE_CODE_EXECPATH ?? 'claude';
+        const { code, output } = await deps.run(claude, ['mcp', 'add', '--scope', 'local', 'slipstream', '--', ...claudeTool], worktree);
+        if (code !== 0) {
+            throw new Refusal(`could not add the Slipstream answer tool with \`claude mcp add\` (exit ${String(code)}): `
+                + `${output.trim()}. Nothing was recorded.`);
+        }
+        deps.out('Installed the Slipstream answer tool for this workspace (claude mcp add --scope local).');
+    }
+    return hookEdit !== null || toolEdit !== null || claudeTool !== null;
+}
+async function readConfig(path) {
+    try {
+        return await readFile(path, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw new Refusal(`cannot read ${path}: ${err.message}. Nothing was recorded.`);
+    }
+}
+const SLIPSTREAM_HOOK = /\bhook (?:claude-code|codex) post-tool-use\b/;
+/** Workspace config is edited in place only; a symlinked file or directory may
+ * be shared with other workspaces, so it is refused rather than followed. */
+async function readWorkspaceConfig(path) {
+    for (const p of [dirname(path), path]) {
+        let link = false;
+        try {
+            link = (await lstat(p)).isSymbolicLink();
+        }
+        catch { /* missing: created later */ }
+        if (link) {
+            throw new Refusal(`${p} is a symbolic link; attach only edits this workspace's own config. Nothing was recorded.`);
+        }
+    }
+    return readConfig(path);
+}
+async function planHook(path, command) {
+    const text = await readWorkspaceConfig(path);
+    let config = {};
+    if (text !== null) {
+        try {
+            config = JSON.parse(text);
+        }
+        catch {
+            throw new Refusal(`${path} is not valid JSON; fix it and run attach again. Nothing was changed.`);
+        }
+        if (typeof config !== 'object' || config === null || Array.isArray(config)) {
+            throw new Refusal(`${path} is not a JSON object; fix it and run attach again. Nothing was changed.`);
+        }
+    }
+    const hooks = (config.hooks ?? {});
+    const post = (hooks.PostToolUse ?? []);
+    if (typeof hooks !== 'object' || Array.isArray(hooks) || !Array.isArray(post)) {
+        throw new Refusal(`${path} has an unexpected hooks layout; add the Slipstream hook by hand: ${command}`);
+    }
+    const existing = post.flatMap((group) => {
+        const { matcher, hooks: entries } = (group ?? {});
+        return Array.isArray(entries) ? entries.map((h) => ({ matcher, ...(h ?? {}) })) : [];
+    }).filter((h) => typeof h.command === 'string' && SLIPSTREAM_HOOK.test(h.command));
+    const different = existing.find((h) => h.matcher !== '*' || h.type !== 'command' || h.command !== command);
+    if (different) {
+        throw new Refusal(`${path} already has a different Slipstream hook (${String(different.command)}, matcher `
+            + `${JSON.stringify(different.matcher)}). It was kept; remove it or make it match. Nothing was recorded.`);
+    }
+    if (existing.length > 0)
+        return null;
+    const next = { ...config, hooks: { ...hooks, PostToolUse: [...post,
+                { matcher: '*', hooks: [{ type: 'command', command, timeout: HOOK_TIMEOUT_S }] }] } };
+    return { path, text: `${JSON.stringify(next, null, 2)}\n`, original: text };
+}
+/** Codex project config is TOML; Slipstream owns only its own server table and
+ * appends it as text so the rest of the file stays byte-for-byte unchanged. */
+async function planCodexTool(path, node, args) {
+    const text = await readWorkspaceConfig(path);
+    const existing = codexToolMatches(path, text, node, args, 'workspace');
+    if (existing)
+        return null;
+    const block = `[mcp_servers.slipstream]\ncommand = ${JSON.stringify(node)}\n`
+        + `args = [${args.map((a) => JSON.stringify(a)).join(', ')}]\n`;
+    if (text === null)
+        return { path, text: block, original: null };
+    const lines = text.split('\n');
+    const sep = text === '' ? '' : text.endsWith('\n\n') ? '' : text.endsWith('\n') ? '\n' : '\n\n';
+    return { path, text: `${text}${sep}${block}`, original: text };
+}
+async function readCodexTool(path, node, args, scope) {
+    return codexToolMatches(path, await readConfig(path), node, args, scope);
+}
+function codexToolMatches(path, text, node, args, scope) {
+    if (text === null)
+        return false;
+    const block = `[mcp_servers.slipstream]\ncommand = ${JSON.stringify(node)}\n`
+        + `args = [${args.map((a) => JSON.stringify(a)).join(', ')}]\n`;
+    const lines = text.split('\n');
+    const header = lines.findIndex((l) => l.trim() === '[mcp_servers.slipstream]');
+    if (header >= 0) {
+        let end = lines.findIndex((l, i) => i > header && l.trim().startsWith('['));
+        if (end < 0)
+            end = lines.length;
+        const current = lines.slice(header, end).filter((l) => l.trim() !== '').join('\n');
+        if (current === block.trimEnd())
+            return true;
+        throw new Refusal(`${path} already has a different Slipstream server entry (${scope} \`slipstream\` MCP server). It was kept; remove it or make it `
+            + `match:\n${block}Nothing was recorded.`);
+    }
+    if (lines.some(unsafeServerLine)) {
+        throw new Refusal(`${path} declares MCP servers in a form attach cannot safely edit or inspect. Add this entry by hand:\n`
+            + `${block}Nothing was recorded.`);
+    }
+    return false;
+}
+/** Only plain `[mcp_servers.<other name>]` tables are understood; any other
+ * header or key that mentions mcp_servers (quoted, spaced, dotted, arrays) could
+ * already declare Slipstream, so appending a table might break the file. */
+function unsafeServerLine(line) {
+    const t = line.trim();
+    const keyOrHeader = (t.startsWith('[') ? t : t.split('=')[0])
+        .replace(/\\u([\da-fA-F]{4})|\\U([\da-fA-F]{8})/g, (_, u, U) => {
+        const code = parseInt(u ?? U, 16);
+        return code <= 0x10ffff ? String.fromCodePoint(code) : '\ufffd';
+    });
+    if (t.startsWith('#') || !keyOrHeader.includes('mcp_servers'))
+        return false;
+    return !/^\[mcp_servers\.(?!slipstream[.\]])[\w-]+(?:\.[\w-]+)*\]$/.test(t);
+}
+/** Claude keeps local-scope servers per project in its own global config; read
+ * it to stay idempotent, but leave writing to `claude mcp add`. */
+async function claudeToolMissing(chat, worktree, deps, args) {
+    const configDir = deps.env.CLAUDE_CONFIG_DIR;
+    const path = configDir ? join(configDir, '.claude.json') : join(deps.home, '.claude.json');
+    const text = await readConfig(path);
+    if (text === null)
+        return true;
+    let local;
+    let user;
+    try {
+        const config = JSON.parse(text);
+        local = config.projects?.[worktree]?.mcpServers?.slipstream;
+        user = config.mcpServers?.slipstream;
+    }
+    catch {
+        throw new Refusal(`${path} is not valid JSON; cannot check for an existing Slipstream answer tool.`);
+    }
+    for (const [scope, server] of [['workspace', local], ['user-wide', user]]) {
+        if (server === undefined)
+            continue;
+        if (server !== null && typeof server === 'object' && server.command === deps.nodePath
+            && JSON.stringify(server.args) === JSON.stringify(args))
+            return false;
+        throw new Refusal(`this ${scope} has a different \`slipstream\` MCP server for ${chat.harness} `
+            + '(see `claude mcp get slipstream`). It was kept; remove it or make it use this store. Nothing was recorded.');
+    }
+    return true;
+}
+/** Replace a planned file atomically, refusing if it changed since planning. A
+ * sandboxed chat may not be allowed to write workspace config (Codex keeps
+ * `.codex/` read-only in workspace-write mode); that is explained, not crashed on. */
+async function writeAtomic(edit) {
+    const tmp = `${edit.path}.${randomUUID()}.tmp`;
+    try {
+        await mkdir(dirname(edit.path), { recursive: true });
+        await writeFile(tmp, edit.text, { flag: 'wx' });
+        if (edit.original !== null)
+            await chmod(tmp, (await stat(edit.path)).mode & 0o777);
+        if (await readConfig(edit.path) !== edit.original) {
+            throw new Refusal(`${edit.path} changed while attach was running; it was kept. Run attach again. `
+                + 'Nothing was recorded.');
+        }
+        await rename(tmp, edit.path);
+    }
+    catch (err) {
+        await unlink(tmp).catch(() => { });
+        if (err instanceof Refusal)
+            throw err;
+        const code = err.code ?? err.message;
+        throw new Refusal(`could not write ${edit.path} (${code}). This chat's sandbox may block writing there; allow the `
+            + 'command to run with write access to the workspace, or start the chat with full access, then run attach '
+            + 'again. Nothing was recorded.');
+    }
+}
+function storeFlag(store, home) {
+    return store === defaultDaemonStore(home) ? '' : ` --store ${shellWord(store)}`;
+}
+function pendingStep(chat, worktree, installed, store) {
+    const status = `\`slipstream status${store}\``;
+    const conductorReload = 'Conductor has no verified way to reload a running chat\'s hooks and tools, so this stays '
+        + `pending until the chat confirms. Send this chat another message; if it is still pending, run ${status} to check.`;
+    const reload = chat.harness === 'claude-code'
+        ? chat.conductor ? conductorReload
+            : `Exit this chat, run \`claude --resume ${chat.id}\` in ${worktree}, then run \`slipstream attach${store}\` `
+                + 'again there.'
+        : chat.conductor
+            ? 'Codex runs a project hook only after you trust it, and Conductor does not show that review: in a terminal, '
+                + `run \`codex\` in ${worktree}, trust the Slipstream hook in its hook review, and quit. ${conductorReload}`
+            : `Exit this chat, run \`codex resume ${chat.id}\` in ${worktree}, trust the Slipstream hook when Codex shows `
+                + `its hook review, then run \`slipstream attach${store}\` again there.`;
+    return installed
+        ? `Next step: the chat must reload to load the new hook and tool. ${reload}`
+        : 'Next step: this chat confirms after its next tool call (usually right after this command); check with '
+            + `${status}. If it stays setup_pending: ${reload}`;
+}

package/dist/attribution-engine.js

@@ -21,8 +21,7 @@
  * Clock and timers are injected so tests drive them deterministically. A single
  * timer is armed for the nearest pending deadline.
  */
-import { foldEvidence } from "./attribution.js";
-import { evaluateChange, attributionResultsEqual } from "./attribution-scoring.js";
+import { evaluateChange, attributionResultsEqual, foldScoredEvidence } from "./attribution-scoring.js";
 export function createAttributionEngine(opts) {
     const { now, setTimer, clearTimer, readEvents, appendAttribution } = opts;
     const changes = new Map();
@@ -64,7 +63,7 @@ export function createAttributionEngine(opts) {
         const c = changes.get(changeSeq);
         if (!c)
             return;
-        const invocations = foldEvidence(readEvents()).values();
+        const invocations = foldScoredEvidence(readEvents());
         const result = evaluateChange({
             path: c.path,
             interval: c.interval,

package/dist/attribution-scoring.js

@@ -1,4 +1,20 @@
-import { evidenceKeyString } from "./attribution.js";
+import { evidenceKeyString, foldEvidence, variantSignature } from "./attribution.js";
+/** {@link foldEvidence} plus each invocation's sorted, distinct variant signatures. */
+export function foldScoredEvidence(events) {
+    const signatures = new Map();
+    for (const e of events) {
+        if (e.type !== 'slipstream.harness.evidence.v1')
+            continue;
+        const keyStr = evidenceKeyString(e.data.evidence_key);
+        const set = signatures.get(keyStr) ?? new Set();
+        set.add(variantSignature(e.data));
+        signatures.set(keyStr, set);
+    }
+    return [...foldEvidence(events).values()].map((inv) => ({
+        ...inv,
+        signatures: [...(signatures.get(inv.keyStr) ?? [])].sort(),
+    }));
+}
 /** Whether an invocation's ±window overlaps the observation interval, inclusive. */
 function windowOverlaps(inv, start, end, windowMs) {
     const winStart = inv.minAtMs - windowMs;
@@ -8,11 +24,62 @@ function windowOverlaps(inv, start, end, windowMs) {
 function touchesPath(inv, path) {
     return inv.knownPaths.includes(path);
 }
+function isExactCopy(a, b) {
+    if (!sameStringSet(a.signatures, b.signatures))
+        return false;
+    const pa = [...a.knownPaths].sort();
+    const pb = [...b.knownPaths].sort();
+    return (a.minAtMs === b.minAtMs &&
+        a.maxAtMs === b.maxAtMs &&
+        a.evidenceSeqs.length === b.evidenceSeqs.length &&
+        pa.length === pb.length &&
+        pa.every((p, i) => p === pb[i]));
+}
+/**
+ * Split invocations into eligible candidates and conflicts. Groups are formed
+ * over ALL invocations sharing `(harness, record_id)` before relevance, so a
+ * differing or conflicted copy that is irrelevant to this change still stops
+ * the rest collapsing. A group of 2+ non-conflicted exact copies becomes one
+ * candidate citing every copy's evidence (if relevant); any other group is
+ * handled member by member, relevant members only.
+ */
+function partitionInvocations(invocations, isRelevant) {
+    const groups = new Map();
+    for (const inv of invocations) {
+        const id = `${inv.key.harness}\u0000${inv.key.record_id}`;
+        const group = groups.get(id);
+        if (group === undefined)
+            groups.set(id, [inv]);
+        else
+            group.push(inv);
+    }
+    const eligible = [];
+    const conflicts = [];
+    for (const group of groups.values()) {
+        const [first] = group;
+        const collapsible = group.length >= 2 && group.every((inv) => !inv.conflicted && isExactCopy(first, inv));
+        if (collapsible) {
+            if (isRelevant(first)) {
+                eligible.push({ ...first, evidenceSeqs: group.flatMap((inv) => inv.evidenceSeqs) });
+            }
+            continue;
+        }
+        for (const inv of group) {
+            if (!isRelevant(inv))
+                continue;
+            (inv.conflicted ? conflicts : eligible).push(inv);
+        }
+    }
+    return { eligible, conflicts };
+}
 /**
  * Match one change against the known invocations under its bound policy. An
  * unavailable interval resolves to `unknown` with its own distinct reason — never
  * conflated with "we looked and found nothing". Each eligible invocation
  * contributes one candidate; conflicts are excluded and disclosed, never counted.
+ * Copies from forked transcripts repeat a tool call verbatim (same id, tool
+ * timestamps, paths), so identical copies count once; copies that differ or are
+ * conflicted are not collapsed, so a contradiction is never hidden.
  */
 export function evaluateChange(input) {
     const { interval } = input;
@@ -28,18 +95,8 @@ export function evaluateChange(input) {
             excludedConflicts: [],
         };
     }
-    const eligible = [];
-    const conflicts = [];
-    for (const inv of input.invocations) {
-        const relevant = touchesPath(inv, input.path) &&
-            windowOverlaps(inv, interval.start_ms, interval.end_ms, input.policy.window_ms);
-        if (!relevant)
-            continue;
-        if (inv.conflicted)
-            conflicts.push(inv);
-        else
-            eligible.push(inv);
-    }
+    const { eligible, conflicts } = partitionInvocations(input.invocations, (inv) => touchesPath(inv, input.path) &&
+        windowOverlaps(inv, interval.start_ms, interval.end_ms, input.policy.window_ms));
     const evidenceSeqs = eligible
         .flatMap((inv) => inv.evidenceSeqs)
         .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));