@thehammer/danx-session-telemetry 0.1.1

package/dist/session-log-watcher.js

@@ -0,0 +1,846 @@
+/**
+ * SessionLogWatcher — Polls Claude Code JSONL session files for new entries.
+ *
+ * DX-2962: moved unchanged from danxbot root `src/agent/session-log-watcher.ts`
+ * into this shared published package, so the danxbot worker and the
+ * `danx-dashboard-mcp` desktop bridge (DX-2954) run identical collector
+ * code. Only the imports changed — `../logger.js` -> `./internal-logger.js`
+ * (this package's own tiny logging shim, since root's `logger.ts` has ~300
+ * unrelated consumers and does not move), `../types.js` -> `./types.js`
+ * (moved — see that file's own header).
+ *
+ * Claude Code writes:
+ *   - Parent session:   ~/.claude/projects/<cwd-path>/<session-uuid>.jsonl
+ *   - Sub-agent sessions: ~/.claude/projects/<cwd-path>/<session-uuid>/subagents/agent-<hash>.jsonl
+ *                        + agent-<hash>.meta.json sidecar with {agentType, description}
+ *
+ * The watcher tails the parent file and all sub-agent files in parallel, parses
+ * new lines, converts them to AgentLogEntry, and emits to registered consumers.
+ * Sub-agent entries are decorated with lineage metadata (subagent_id,
+ * parent_session_id, agent_type) inside `data` so downstream consumers can
+ * attribute usage correctly — they flow under the SAME dispatch, not a separate session.
+ */
+import { existsSync, realpathSync } from "node:fs";
+import { open, readFile, readdir, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { createLogger } from "./internal-logger.js";
+import { buildAssistantSummary, buildToolResultSummary, } from "./tool-summary.js";
+const log = createLogger("session-log-watcher");
+const DEFAULT_POLL_INTERVAL_MS = 5_000;
+const FILE_DISCOVERY_POLL_MS = 1_000;
+// 180s max wait for JSONL to appear. claude --resume on a clean-room with
+// slow pre-turn setup (SFC-deps provision, vitest cold start, mcp probe)
+// can take 60-90s before the first assistant turn writes to the JSONL.
+// 60s was too tight — matches DX-825 stall-threshold raise (5s→120s).
+const MAX_FILE_DISCOVERY_ATTEMPTS = 180;
+/**
+ * Tag prefix injected into the piped prompt by the launcher. The watcher scans
+ * JSONL files for this tag to deterministically find the correct session file
+ * for a given dispatch, avoiding mtime-based heuristics that can pick up the
+ * wrong file (e.g., an active human session).
+ */
+export const DISPATCH_TAG_PREFIX = "<!-- danxbot-dispatch:";
+/**
+ * Encode a working directory to the subdir name Claude Code writes JSONL
+ * under. Replaces `/`, `.`, AND `_` with `-`. Verified empirically against
+ * on-disk entries: a dispatched-agent cwd like
+ * `/var/tmp/danxbot-clean-room/<hash>/repo__board__work__dani__DX-1` encodes to
+ * `-var-tmp-danxbot-clean-room-<hash>-repo--board--work--dani--DX-1` — each
+ * `__` key delimiter collapses to `--`.
+ *
+ * `realpathSync` runs first so the encoding matches what claude's own
+ * resolver produces — the agent's cwd is realpath'd by the kernel before
+ * claude reads `process.cwd()`. ENOENT falls back to the normalized path
+ * so callers can pre-compute encodings before the dir exists (e.g. unit
+ * tests that exercise the pure encoding contract).
+ *
+ * The `.`/`_` encoding matters: a hidden-dir segment (leading `.`) or a
+ * clean-room key's `__` delimiter that the encoder does NOT collapse produces
+ * a directory Claude Code never writes to — silently breaking
+ * SessionLogWatcher attachment for every host-mode dispatch. The
+ * separator-encoding regression tests below pin this.
+ *
+ * Host mode (claude 2.1.104+, GitHub #51488 — symlinks under
+ * `~/.claude/projects/` are no longer followed) lets claude write its
+ * transcript to this exact realpath-encoded dir as a REAL directory; the
+ * watcher reads the same path, so they converge with no symlink. Docker
+ * binds `<repo>/claude-projects/` at `/home/danxbot/.claude/projects/` and
+ * relies on the same encoding for the bound subdir name. Keep the encoding
+ * logic centralized here so both runtimes stay in lockstep.
+ */
+export function encodeClaudeProjectsCwd(cwd) {
+    const normalized = cwd.startsWith("/") ? cwd : `/${cwd}`;
+    let resolved;
+    try {
+        resolved = realpathSync(normalized);
+    }
+    catch {
+        // Path doesn't exist yet — use as-is (agent may not have started)
+        resolved = normalized;
+    }
+    // Claude Code encodes its cwd into ~/.claude/projects/<dir> by replacing
+    // EVERY non-alphanumeric separator — `/`, `.`, AND `_` — with `-`. The `_`
+    // matters: the clean-room key (`cleanRoomKey`, DX-1511)
+    // joins its components with `__`, so Claude writes the dir as `--` on disk.
+    // Omitting `_` here made the watcher wait on a `__` path Claude never
+    // creates → "session file not found after 180s" on every clean-room dispatch.
+    return resolved.replace(/[/._]/g, "-");
+}
+/**
+ * Derives the Claude Code session directory from a working directory path.
+ * Claude Code stores sessions at ~/.claude/projects/<encoded-cwd>/. See
+ * `encodeClaudeProjectsCwd` for the encoding contract.
+ */
+export function deriveSessionDir(cwd) {
+    return join(homedir(), ".claude", "projects", encodeClaudeProjectsCwd(cwd));
+}
+/**
+ * On-disk existence gate for a stored, resumable Claude session UUID
+ * (migration 061). Given the clean-room `cwd` a dispatch ran in and a
+ * session `uuid`, returns `true` iff `<uuid>.jsonl` lives under that cwd's
+ * encoded `~/.claude/projects/<encoded>/` dir.
+ *
+ * This is the deterministic precondition the issue-bound resume gates check
+ * BEFORE passing `--resume <uuid>`: a session pinned in cwd A is only
+ * resumable from cwd A (Claude Code keys JSONLs by encoded-cwd), so a uuid
+ * stored on a card but orphaned by a cwd / agent move resolves here to a
+ * different encoded dir, is not found, and the caller fails SOFT to a fresh
+ * launch. This is NOT a swallowed error (which fail-loud forbids) — it is a
+ * checked precondition: a genuinely-absent session legitimately means
+ * "start fresh", and the per-agent isolation DX-1071 enforced falls out for
+ * free (agent B's cwd never contains agent A's session file).
+ */
+export function sessionUuidExistsInCleanRoom(cwd, uuid) {
+    return existsSync(join(deriveSessionDir(cwd), `${uuid}.jsonl`));
+}
+/**
+ * Finds the newest .jsonl file in a directory.
+ * Returns the full path, or null if no .jsonl files exist.
+ */
+export async function findNewestJsonlFile(dir, sessionId) {
+    try {
+        const files = await readdir(dir);
+        const jsonlFiles = files.filter((f) => f.endsWith(".jsonl"));
+        if (jsonlFiles.length === 0)
+            return null;
+        // If a specific session ID is requested, look for that exact file
+        if (sessionId) {
+            const target = `${sessionId}.jsonl`;
+            if (jsonlFiles.includes(target)) {
+                return join(dir, target);
+            }
+            return null;
+        }
+        // Find the newest by mtime
+        let newest = null;
+        for (const file of jsonlFiles) {
+            const filePath = join(dir, file);
+            try {
+                const stats = await stat(filePath);
+                const mtime = stats.mtimeMs;
+                if (!newest || mtime > newest.mtime) {
+                    newest = { path: filePath, mtime };
+                }
+            }
+            catch (err) {
+                // DX-1201 — one unreadable/rotated sibling must NOT abort the whole
+                // mtime scan (see the matching guard in
+                // `findSessionFileByDispatchId`). A sibling deleted mid-scan
+                // (ENOENT) or otherwise unstattable just gets skipped.
+                const code = err.code;
+                if (code !== "ENOENT") {
+                    log.warn(`Skipping unstattable session file during newest-file scan: ${filePath} (${code ?? String(err)})`);
+                }
+                continue;
+            }
+        }
+        return newest?.path ?? null;
+    }
+    catch (err) {
+        // Directory doesn't exist yet — expected during agent startup
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+/**
+ * Finds a JSONL session file that contains the dispatch tag for a specific job ID.
+ *
+ * Scans each `.jsonl` file for the dispatch tag
+ * `<!-- danxbot-dispatch:<dispatchId> -->`, injected into the piped prompt
+ * by the launcher.
+ *
+ * The tag's position depends on whether this is a fresh spawn or a
+ * `claude --resume`:
+ *   - **Fresh** — the tag is in the FIRST `user` entry, near the head of a
+ *     brand-new file.
+ *   - **Resume (DX-1106)** — claude appends the new dispatch's tagged
+ *     prompt to the END of the prior session's already-multi-MB JSONL, so
+ *     the tag sits in the TAIL, far past any fixed head window. A
+ *     head-only scan never matches a resumed session → the watcher gives
+ *     up after 180s → no session_uuid stamp, no heartbeat, no stall
+ *     detection for that dispatch.
+ *
+ * So we scan BOTH a head window and a tail window (they overlap, covering
+ * the whole file, for any file ≤ 2×`SCAN_BYTES`). A resumed tag always
+ * lands in the freshly-appended tail; a fresh tag always lands in the head.
+ *
+ * Returns the full path to the matching file, or null if no file matches.
+ */
+export async function findSessionFileByDispatchId(dir, dispatchId) {
+    const tag = `${DISPATCH_TAG_PREFIX}${dispatchId} -->`;
+    const SCAN_BYTES = 65_536; // 64KB — enough to cover a fresh prompt entry
+    // (head) or the appended resume prompt (tail).
+    try {
+        const files = await readdir(dir);
+        const jsonlFiles = files.filter((f) => f.endsWith(".jsonl"));
+        for (const file of jsonlFiles) {
+            const filePath = join(dir, file);
+            let fd;
+            try {
+                fd = await open(filePath, "r");
+                const fileStats = await stat(filePath);
+                if (await windowIncludesTag(fd, 0, fileStats.size, SCAN_BYTES, tag)) {
+                    return filePath;
+                }
+                // Resume: the new tag is at the tail of a large prior-session file.
+                // Skip when the file fits in one head window (already fully read).
+                if (fileStats.size > SCAN_BYTES) {
+                    const tailStart = fileStats.size - SCAN_BYTES;
+                    if (await windowIncludesTag(fd, tailStart, fileStats.size, SCAN_BYTES, tag)) {
+                        return filePath;
+                    }
+                }
+            }
+            catch (err) {
+                // DX-1201 — a single unreadable SIBLING file must NOT abort the
+                // whole scan. Dispatched agents share a busy session dir (e.g.
+                // host-mode issue-worker dispatches all writing under
+                // `~/.claude/projects/-home-newms-web-danxbot/`), so any one of the
+                // co-located multi-MB files can momentarily fail an `open`/`stat`/
+                // `read`: ENOENT (sibling rotated/deleted mid-scan), ESTALE (a
+                // worktree torn down under the agent), EACCES (perms race), EMFILE
+                // (fd pressure across N concurrent watchers). Before this guard the
+                // throw propagated out of the per-file body and rejected the entire
+                // `findSessionFileByDispatchId` call → `discoverSessionFile` →
+                // `start()` (fire-and-forget, no `.catch`) → the watcher silently
+                // never attached → null `session_uuid` + zero usage/tool-call
+                // counters on ~20% of host dispatches (intermittent because the
+                // outcome hinged on `readdir` ordering vs the failing sibling).
+                // Skip this file and keep scanning the rest — the tagged file the
+                // caller actually wants may be later in the directory.
+                const code = err.code;
+                if (code !== "ENOENT") {
+                    log.warn(`Skipping unreadable session file during dispatch-tag scan: ${filePath} (${code ?? String(err)})`);
+                }
+                continue;
+            }
+            finally {
+                await fd?.close();
+            }
+        }
+        return null;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+/**
+ * Read a `<= maxBytes` window starting at `from` (clamped to the file) and
+ * report whether `tag` appears in it. Factored out so the head + tail scans
+ * in `findSessionFileByDispatchId` share one read path.
+ */
+async function windowIncludesTag(fd, from, fileSize, maxBytes, tag) {
+    const len = Math.min(maxBytes, fileSize - from);
+    if (len <= 0)
+        return false;
+    const buffer = Buffer.alloc(len);
+    await fd.read(buffer, 0, len, from);
+    return buffer.toString("utf-8", 0, len).includes(tag);
+}
+/**
+ * Converts a raw JSONL entry from Claude Code's session log into an AgentLogEntry
+ * used by downstream consumers (stall detection, event forwarding).
+ */
+export function convertJsonlEntry(raw, lastTimestamp) {
+    const type = raw.type;
+    const timestamp = raw.timestamp
+        ? new Date(raw.timestamp).getTime()
+        : Date.now();
+    const deltaMs = lastTimestamp > 0 ? timestamp - lastTimestamp : 0;
+    const message = raw.message;
+    switch (type) {
+        case "assistant": {
+            if (!message)
+                return null;
+            const content = (message.content ?? []);
+            const usage = message.usage;
+            // Claude Code splits multi-block assistant turns (text + tool_use,
+            // thinking + text + tool_use, etc.) into one JSONL line per content
+            // block, but stamps the SAME response-level `message.usage` on every
+            // line. Surface `messageId` so downstream usage accumulators can dedupe
+            // — without it, every multi-block turn over-counts tokens 2-5×. See
+            // `.claude/rules/agent-dispatch.md`.
+            const messageId = typeof message.id === "string" && message.id.length > 0
+                ? message.id
+                : undefined;
+            // DX-1720 — surface the turn's model EXPLICITLY on `entry.data` so the
+            // usage accumulator buckets per-model usage without reaching into
+            // `raw`. `message.model` is the JSONL assistant turn's resolved model
+            // id (e.g. `claude-opus-4-8`); undefined on the rare malformed turn.
+            const model = typeof message.model === "string" && message.model.length > 0
+                ? message.model
+                : undefined;
+            return {
+                entry: {
+                    timestamp,
+                    type: "assistant",
+                    summary: buildAssistantSummary(content),
+                    data: {
+                        messageId,
+                        model,
+                        content,
+                        usage,
+                        delta_ms: deltaMs,
+                        raw,
+                    },
+                },
+                timestamp,
+            };
+        }
+        case "user": {
+            if (!message)
+                return null;
+            const content = message.content;
+            if (typeof content === "string")
+                return null;
+            const contentArr = (content ?? []);
+            if (contentArr.length === 0)
+                return null;
+            const hasToolResults = contentArr.some((b) => b.type === "tool_result");
+            if (!hasToolResults)
+                return null;
+            return {
+                entry: {
+                    timestamp,
+                    type: "user",
+                    summary: buildToolResultSummary(contentArr),
+                    data: {
+                        content: contentArr,
+                        delta_ms: deltaMs,
+                        raw: raw,
+                    },
+                },
+                timestamp,
+            };
+        }
+        case "system": {
+            const subtype = raw.subtype;
+            if (subtype === "init") {
+                return {
+                    entry: {
+                        timestamp,
+                        type: "system",
+                        subtype: "init",
+                        summary: `Session initialized: ${raw.model || "unknown"}`,
+                        data: {
+                            session_id: raw.session_id,
+                            model: raw.model,
+                            tools: raw.tools,
+                            delta_ms: deltaMs,
+                            raw,
+                        },
+                    },
+                    timestamp,
+                };
+            }
+            return null;
+        }
+        case "result": {
+            const subtype = raw.subtype || "success";
+            const costUsd = raw.cost_usd || 0;
+            const numTurns = raw.num_turns || 0;
+            return {
+                entry: {
+                    timestamp,
+                    type: "result",
+                    subtype,
+                    summary: `${subtype}: ${numTurns} turns, $${costUsd.toFixed(4)}`,
+                    data: {
+                        subtype,
+                        result_text: raw.result || "",
+                        total_cost_usd: costUsd,
+                        num_turns: numTurns,
+                        duration_ms: raw.duration_ms || 0,
+                        duration_api_ms: raw.duration_api_ms || 0,
+                        is_error: Boolean(raw.is_error),
+                        delta_ms: deltaMs,
+                        raw,
+                    },
+                },
+                timestamp,
+            };
+        }
+        default:
+            // Skip metadata types: permission-mode, attachment, file-history-snapshot, queue-operation, last-prompt
+            return null;
+    }
+}
+export class SessionLogWatcher {
+    consumers = [];
+    pollTimer;
+    parentTail = null;
+    subagentsDir = null;
+    subagentTails = new Map();
+    parentSessionId = null;
+    sessionDir;
+    sessionId;
+    dispatchId;
+    pollIntervalMs;
+    fromEof;
+    running = false;
+    polling = false;
+    // DX-2962: entries are NOT accumulated here — see `emitEntry`. Only
+    // consumers registered via `onEntry` observe entries; the watcher itself
+    // never holds a whole-process-lifetime list (that was the old
+    // `getEntries()` surface, deleted along with its accumulator — the
+    // pre-extraction contract kept an unbounded `AgentLogEntry[]` alive for
+    // the life of every dispatch, purely so three tests could read it back).
+    initSynthesized = false;
+    constructor(options) {
+        this.sessionDir = options.sessionDir ?? deriveSessionDir(options.cwd);
+        this.sessionId = options.sessionId;
+        this.dispatchId = options.dispatchId;
+        this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+        this.fromEof = options.fromEof ?? false;
+    }
+    /** Register a consumer callback that receives each new AgentLogEntry. */
+    onEntry(consumer) {
+        this.consumers.push(consumer);
+    }
+    /** Returns the discovered parent session file path, or null if not yet found. */
+    getSessionFilePath() {
+        return this.parentTail?.filePath ?? null;
+    }
+    /**
+     * Resolve this dispatch's JSONL session file by a one-shot disk scan,
+     * independent of the live tail loop (DX-1201).
+     *
+     * The live watcher records `session_uuid` lazily from the FIRST emitted
+     * entry. If discovery ever fails to attach within the dispatch's lifetime —
+     * a transient `open`/`stat`/`read` error on a busy shared session dir, or a
+     * timing window where the spawn finalizes before the first poll observed an
+     * entry — that lazy path never fires and the row's `session_uuid` stays
+     * NULL, breaking same-thread Slack resume (the dispatch is not resumable).
+     *
+     * This method gives the finalize backstop a deterministic, cause-agnostic
+     * way to resolve the file: by the time a dispatch finalizes, the agent's
+     * `danxbot_complete` tool_use is already written to the JSONL, so the file
+     * is guaranteed present on disk. It scans the watcher's OWN `sessionDir`
+     * (the dir derived from `agentCwd` at construction — the same dir claude
+     * wrote to) for the dispatch tag. Returns the file path, or null when no
+     * dispatchId is set or no file carries the tag.
+     *
+     * Prefers the already-discovered `parentTail.filePath` when the live loop
+     * did attach — no redundant scan on the happy path.
+     */
+    async resolveSessionFileNow() {
+        if (this.parentTail?.filePath)
+            return this.parentTail.filePath;
+        if (!this.dispatchId)
+            return null;
+        return findSessionFileByDispatchId(this.sessionDir, this.dispatchId);
+    }
+    /** Start polling for session log entries. */
+    async start() {
+        if (this.running)
+            return;
+        this.running = true;
+        await this.discoverSessionFile();
+        if (this.running && this.parentTail) {
+            this.pollTimer = setInterval(() => this.poll(), this.pollIntervalMs);
+            await this.poll();
+        }
+    }
+    /** Stop polling and clean up. */
+    stop() {
+        this.running = false;
+        if (this.pollTimer) {
+            clearInterval(this.pollTimer);
+            this.pollTimer = undefined;
+        }
+    }
+    /**
+     * Read any JSONL bytes appended since the last scheduled poll tick. Used by
+     * the launcher's cleanup path to capture the agent's final assistant entry
+     * (the one carrying the closing `usage` block + the `tool_use` for
+     * `danxbot_complete`) before stop() halts polling. Without this, the row
+     * finalized by `DispatchTracker.finalize` snapshots stale `job.usage` and
+     * the dispatches table undercounts every token + counter field by exactly
+     * what the JSONL grew between ticks.
+     *
+     * Race contract: if a scheduled `poll()` is already in flight when drain
+     * is called, the first poll() invoked here would early-return at the
+     * `this.polling` guard and silently miss the tail. To avoid that silent
+     * skip we yield until the in-flight poll completes, then run our own
+     * poll. The combined effect is "every byte written before drain returns
+     * has been observed" — exactly the guarantee finalize depends on.
+     *
+     * No-op when the parent file has not been discovered (drain before
+     * start, or start aborted) — there is nothing to read. Safe to call
+     * after `stop()`; returns immediately.
+     */
+    async drain() {
+        if (!this.running || !this.parentTail)
+            return;
+        // Wait for any in-flight scheduled poll to finish so our subsequent
+        // poll() doesn't hit the `this.polling` guard. The await yields so
+        // setInterval-driven polls can complete; we only loop a few microtasks
+        // in the worst case (one scheduled poll cycle).
+        while (this.polling) {
+            await new Promise((resolve) => setImmediate(resolve));
+        }
+        await this.poll();
+    }
+    /**
+     * Discover the JSONL session file. Polls until found or max attempts reached.
+     * For dispatched agents, the file appears shortly after the process starts.
+     */
+    async discoverSessionFile() {
+        for (let attempt = 0; attempt < MAX_FILE_DISCOVERY_ATTEMPTS; attempt++) {
+            if (!this.running)
+                return;
+            const filePath = this.dispatchId
+                ? await findSessionFileByDispatchId(this.sessionDir, this.dispatchId)
+                : await findNewestJsonlFile(this.sessionDir, this.sessionId);
+            if (filePath) {
+                await this.setParentFile(filePath);
+                const tag = this.dispatchId ? `[Dispatch ${this.dispatchId}] ` : "";
+                log.info(`${tag}Watching session file: ${filePath}`);
+                return;
+            }
+            await new Promise((resolve) => setTimeout(resolve, FILE_DISCOVERY_POLL_MS));
+        }
+        log.error(`Session file not found after ${MAX_FILE_DISCOVERY_ATTEMPTS}s in ${this.sessionDir}`);
+    }
+    /**
+     * Adopt a parent session file and derive the sub-agent directory.
+     *
+     * When `this.fromEof` is set (Phase 2c reattach OR a DX-2583 resume — see
+     * the option's doc), seed `byteOffset` to the file's current size so the
+     * next poll reads strictly forward — historical entries are NOT re-emitted.
+     * A fresh `stat` failure (race
+     * with a delete that happens between discover and adopt) falls back to
+     * 0 so the watcher tails from the start; that is preferable to throwing
+     * during boot. `fromEof` does NOT skip sub-agent files: any sub-agent
+     * file claude writes AFTER reattach is genuinely new and should be
+     * tailed normally.
+     */
+    async setParentFile(filePath) {
+        let byteOffset = 0;
+        if (this.fromEof) {
+            try {
+                const fileStats = await stat(filePath);
+                byteOffset = fileStats.size;
+            }
+            catch (err) {
+                log.warn(`fromEof: stat failed for ${filePath}; tailing from 0: ${String(err)}`);
+            }
+        }
+        this.parentTail = {
+            filePath,
+            byteOffset,
+            lineBuffer: "",
+            lastTimestamp: 0,
+        };
+        this.subagentsDir = join(dirname(filePath), basename(filePath, ".jsonl"), "subagents");
+    }
+    /**
+     * Poll all known files: the parent session, then re-enumerate + tail sub-agent files.
+     * Guarded against concurrent polls and against stop() racing an in-flight poll.
+     */
+    async poll() {
+        if (this.polling || !this.parentTail || !this.running)
+            return;
+        this.polling = true;
+        try {
+            await this.pollFile(this.parentTail);
+            if (!this.running)
+                return;
+            await this.discoverNewSubagentFiles();
+            await this.refreshPendingAgentTypes();
+            for (const state of this.subagentTails.values()) {
+                if (!this.running)
+                    return;
+                await this.pollFile(state);
+            }
+        }
+        finally {
+            this.polling = false;
+        }
+    }
+    /** Read any new bytes from `state.filePath` and emit resulting entries. */
+    async pollFile(state) {
+        const isSubagent = state.lineage !== undefined;
+        // Refresh lineage inline before reading new bytes so emissions reflect
+        // the latest meta.json + parent session id even if the central refresh
+        // missed this cycle. Closes the race in production where claude writes
+        // `.jsonl` then `.meta.json` and a poll catches the new bytes between
+        // those writes — without this, the entry would emit permanently stamped
+        // with agent_type=undefined. archived investigation.
+        if (isSubagent) {
+            await this.refreshLineage(state);
+        }
+        try {
+            const fileStats = await stat(state.filePath);
+            if (!this.running)
+                return;
+            if (fileStats.size <= state.byteOffset)
+                return;
+            const fd = await open(state.filePath, "r");
+            try {
+                if (!this.running)
+                    return;
+                const bytesToRead = fileStats.size - state.byteOffset;
+                const buffer = Buffer.alloc(bytesToRead);
+                const { bytesRead } = await fd.read(buffer, 0, bytesToRead, state.byteOffset);
+                if (!this.running)
+                    return;
+                if (bytesRead === 0)
+                    return;
+                state.byteOffset += bytesRead;
+                const text = buffer.toString("utf-8", 0, bytesRead);
+                this.processText(text, state);
+            }
+            finally {
+                await fd.close();
+            }
+        }
+        catch (err) {
+            if (err.code === "ENOENT") {
+                if (isSubagent) {
+                    // Sub-agent file gone — drop it; next discoverNewSubagentFiles
+                    // will pick up any replacement.
+                    this.subagentTails.delete(state.filePath);
+                }
+                else {
+                    log.warn("Parent session file disappeared, attempting rediscovery");
+                    this.parentTail = null;
+                    this.subagentsDir = null;
+                    this.subagentTails.clear();
+                    this.parentSessionId = null;
+                    await this.discoverSessionFile();
+                }
+            }
+            else {
+                log.error("Poll error:", err);
+            }
+        }
+    }
+    /**
+     * Re-enumerate the sub-agent directory and add tail states for any
+     * `agent-<hash>.jsonl` files not already being tailed.
+     */
+    async discoverNewSubagentFiles() {
+        if (!this.subagentsDir)
+            return;
+        let files;
+        try {
+            files = await readdir(this.subagentsDir);
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return;
+            log.error("Failed to enumerate sub-agent directory:", err);
+            return;
+        }
+        for (const file of files) {
+            if (!file.endsWith(".jsonl"))
+                continue;
+            const fullPath = join(this.subagentsDir, file);
+            if (this.subagentTails.has(fullPath))
+                continue;
+            const subagentId = basename(file, ".jsonl");
+            const agentType = await this.readAgentType(subagentId);
+            this.subagentTails.set(fullPath, {
+                filePath: fullPath,
+                byteOffset: 0,
+                lineBuffer: "",
+                lastTimestamp: 0,
+                lineage: {
+                    subagent_id: subagentId,
+                    parent_session_id: this.parentSessionId,
+                    agent_type: agentType,
+                },
+            });
+        }
+    }
+    /** Centralized lineage refresh — see `refreshLineage` for the per-state body. */
+    async refreshPendingAgentTypes() {
+        for (const state of this.subagentTails.values()) {
+            await this.refreshLineage(state);
+        }
+    }
+    /**
+     * Refresh `state.lineage` by re-reading the meta sidecar and back-filling
+     * parent_session_id from the most recent parent observation. Idempotent:
+     * once `agent_type` is set it stays set (never read meta twice). Used by
+     * both the centralized `refreshPendingAgentTypes` and the inline call from
+     * `pollFile` — the inline call is the defense-in-depth that closes the race
+     * where bytes appear before `refreshPendingAgentTypes` has a chance to run.
+     */
+    async refreshLineage(state) {
+        if (!state.lineage)
+            return;
+        let { agent_type, parent_session_id } = state.lineage;
+        if (agent_type === undefined) {
+            agent_type = await this.readAgentType(state.lineage.subagent_id);
+        }
+        if (parent_session_id === null && this.parentSessionId !== null) {
+            parent_session_id = this.parentSessionId;
+        }
+        state.lineage = {
+            subagent_id: state.lineage.subagent_id,
+            parent_session_id,
+            agent_type,
+        };
+    }
+    /**
+     * Read agentType from the `<subagentId>.meta.json` sidecar. Returns
+     * undefined only for ENOENT (file not written yet). Malformed JSON or
+     * permission errors are logged at WARN and return undefined — the watcher
+     * must not crash on bad sidecar files, but the failure is visible in logs.
+     */
+    async readAgentType(subagentId) {
+        if (!this.subagentsDir)
+            return undefined;
+        const metaPath = join(this.subagentsDir, `${subagentId}.meta.json`);
+        try {
+            const text = await readFile(metaPath, "utf-8");
+            const meta = JSON.parse(text);
+            return typeof meta.agentType === "string" ? meta.agentType : undefined;
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT")
+                return undefined;
+            log.warn(`Failed to read sub-agent meta for ${subagentId}: ${String(err)}`);
+            return undefined;
+        }
+    }
+    /** Process raw text from a file tail, handling partial lines across poll ticks. */
+    processText(text, state) {
+        state.lineBuffer += text;
+        let newlineIdx;
+        while ((newlineIdx = state.lineBuffer.indexOf("\n")) !== -1) {
+            const line = state.lineBuffer.substring(0, newlineIdx).trim();
+            state.lineBuffer = state.lineBuffer.substring(newlineIdx + 1);
+            if (!line)
+                continue;
+            try {
+                const raw = JSON.parse(line);
+                this.handleRawEntry(raw, state);
+            }
+            catch {
+                log.warn(`Skipping malformed JSONL line: ${line.substring(0, 100)}`);
+            }
+        }
+    }
+    /**
+     * Convert a raw JSONL entry and emit to consumers.
+     *
+     * Init synthesis (parent stream only): the persisted JSONL transcript never
+     * carries a `system/init` line in ANY runtime — Claude Code (2.1.201) only
+     * streams that event over stdout (`--output-format stream-json`), which the
+     * docker spawn path intentionally never reads (`spawn-docker-mode.ts`), and
+     * host's interactive JSONL never wrote one either. So we ALWAYS synthesize
+     * one from the first assistant message's sessionId and model, on host AND
+     * docker alike. Sub-agent streams never synthesize — their entries flow
+     * under the parent dispatch's existing session.
+     *
+     * IMPORTANT (DX-651): synthesized init events carry `tools: []` and
+     * `data.synthesized: true` — this watcher never observes the real
+     * MCP-registered tool / skill / agent list for EITHER runtime. Any consumer
+     * that wants to check what actually loaded (tools, skills, agents) MUST
+     * skip an entry carrying `data.synthesized === true` — treating it as a
+     * truthful docker `system/init` (as `declared-loaded-observer.ts` used to,
+     * gating on runtime alone) manufactures a guaranteed false
+     * declared-not-loaded drift for every dispatch with a non-empty declared
+     * skill/agent set. The pre-launch probe in `mcp-server-probe.ts` is the
+     * tool-registration check that works across both runtimes.
+     */
+    handleRawEntry(raw, state) {
+        const isSubagent = state.lineage !== undefined;
+        if (!isSubagent && !this.initSynthesized && raw.type === "assistant") {
+            const message = raw.message;
+            const model = message?.model;
+            const sessionId = raw.sessionId;
+            if (sessionId || model) {
+                this.parentSessionId = sessionId ?? this.parentSessionId;
+                const initEntry = {
+                    timestamp: raw.timestamp
+                        ? new Date(raw.timestamp).getTime()
+                        : Date.now(),
+                    type: "system",
+                    subtype: "init",
+                    summary: `Session initialized: ${model || "unknown"}`,
+                    data: {
+                        session_id: sessionId || "",
+                        model: model || "",
+                        tools: [],
+                        delta_ms: 0,
+                        raw: {},
+                        synthesized: true,
+                    },
+                };
+                this.emitEntry(initEntry, state);
+                this.initSynthesized = true;
+            }
+        }
+        const result = convertJsonlEntry(raw, state.lastTimestamp);
+        if (!result)
+            return;
+        if (!isSubagent &&
+            result.entry.type === "system" &&
+            result.entry.subtype === "init") {
+            this.initSynthesized = true;
+            const sid = result.entry.data.session_id;
+            if (sid)
+                this.parentSessionId = sid;
+        }
+        state.lastTimestamp = result.timestamp;
+        this.emitEntry(result.entry, state);
+    }
+    /**
+     * Emit an entry to registered consumers. For sub-agent streams,
+     * `state.lineage` decorates `entry.data` so the emitted EventPayload
+     * (via mapEntryToEvents) inherits subagent_id/parent_session_id/agent_type.
+     *
+     * DX-2962: no longer also pushes onto an internal `this.entries` array —
+     * the pre-extraction watcher kept every entry alive for the life of the
+     * process purely so `getEntries()` (deleted) could hand it back to three
+     * tests; nothing else read it. Every real consumer subscribes via
+     * `onEntry` instead.
+     */
+    emitEntry(entry, state) {
+        if (state.lineage) {
+            entry.data = {
+                ...entry.data,
+                subagent_id: state.lineage.subagent_id,
+                parent_session_id: state.lineage.parent_session_id,
+                agent_type: state.lineage.agent_type,
+            };
+        }
+        for (const consumer of this.consumers) {
+            try {
+                consumer(entry);
+            }
+            catch (err) {
+                log.error("Consumer error:", err);
+            }
+        }
+    }
+}