failproofai 0.0.10 → 0.0.11-beta.2

package/lib/claude-sessions.ts

@@ -0,0 +1,181 @@
+/**
+ * Claude Code session transcript discovery helpers.
+ *
+ * Claude stores transcripts at:
+ *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>.jsonl
+ *
+ * Subagent transcripts (when a session spawned subagents) live alongside:
+ *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>/subagents/<agentId>.jsonl
+ *
+ * The parser for these files lives in `lib/log-entries.ts` (`parseLogContent`,
+ * `parseSessionLog`). This module exposes discovery only — the audit pipeline
+ * and any future Claude-specific tool walk the directory layout via these
+ * helpers instead of re-implementing the path conventions.
+ *
+ * Mirrors the shape of `lib/cursor-sessions.ts` for parity across CLIs.
+ */
+import { readdirSync, statSync, existsSync } from "node:fs";
+import { join, basename } from "node:path";
+import { getClaudeProjectsPath, decodeFolderName } from "./paths";
+
+const UUID_RE = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+
+export interface ClaudeProjectFolder {
+  /** Encoded folder name on disk (e.g. "-home-user-project"). */
+  name: string;
+  /** Decoded filesystem path (e.g. "/home/user/project"). */
+  cwd: string;
+  /** Absolute path of the encoded folder. */
+  path: string;
+}
+
+export interface ClaudeTranscriptFile {
+  projectName: string;
+  /** Decoded cwd of the project. */
+  cwd: string;
+  sessionId: string;
+  /** Absolute path of `<sessionId>.jsonl`. */
+  transcriptPath: string;
+  mtimeMs: number;
+  sizeBytes: number;
+  /** True when this is a subagent transcript spawned from a parent session. */
+  isSubagent: boolean;
+}
+
+/** Returns the Claude projects root, honoring the CLAUDE_PROJECTS_PATH env var. */
+export function getClaudeProjectsRoot(): string {
+  return getClaudeProjectsPath();
+}
+
+/** Lists all Claude project folders (one per encoded cwd). Returns [] if the
+ *  projects root doesn't exist. Filenames that don't look like Claude project
+ *  encodings are still included — encoding is permissive. */
+export function listClaudeProjects(): ClaudeProjectFolder[] {
+  const root = getClaudeProjectsRoot();
+  let entries: import("node:fs").Dirent[];
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((e) => e.isDirectory())
+    .map((e) => ({
+      name: e.name,
+      cwd: decodeFolderName(e.name),
+      path: join(root, e.name),
+    }));
+}
+
+/** Lists every JSONL transcript under one Claude project folder, including
+ *  subagent transcripts under `<sessionId>/subagents/`. Returns [] on missing
+ *  or unreadable paths. */
+export function listClaudeTranscripts(project: ClaudeProjectFolder): ClaudeTranscriptFile[] {
+  const out: ClaudeTranscriptFile[] = [];
+  let entries: import("node:fs").Dirent[];
+  try {
+    entries = readdirSync(project.path, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name.endsWith(".jsonl")) {
+      const sessionId = entry.name.slice(0, -".jsonl".length);
+      if (!UUID_RE.test(sessionId)) continue;
+      const transcriptPath = join(project.path, entry.name);
+      try {
+        const s = statSync(transcriptPath);
+        out.push({
+          projectName: project.name,
+          cwd: project.cwd,
+          sessionId,
+          transcriptPath,
+          mtimeMs: s.mtimeMs,
+          sizeBytes: s.size,
+          isSubagent: false,
+        });
+      } catch {
+        // unreadable — skip
+      }
+    } else if (entry.isDirectory() && UUID_RE.test(entry.name)) {
+      // Subagent transcripts at <sessionId>/subagents/<agentId>.jsonl
+      const subDir = join(project.path, entry.name, "subagents");
+      if (!existsSync(subDir)) continue;
+      let subEntries: import("node:fs").Dirent[];
+      try {
+        subEntries = readdirSync(subDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const sub of subEntries) {
+        if (!sub.isFile() || !sub.name.endsWith(".jsonl")) continue;
+        const agentId = sub.name.slice(0, -".jsonl".length);
+        const transcriptPath = join(subDir, sub.name);
+        try {
+          const s = statSync(transcriptPath);
+          out.push({
+            projectName: project.name,
+            cwd: project.cwd,
+            sessionId: agentId,
+            transcriptPath,
+            mtimeMs: s.mtimeMs,
+            sizeBytes: s.size,
+            isSubagent: true,
+          });
+        } catch {
+          // unreadable — skip
+        }
+      }
+    }
+  }
+
+  return out;
+}
+
+/** Convenience: locate one Claude transcript file by session ID across all
+ *  project folders. Returns null if not found. */
+export function findClaudeTranscript(sessionId: string): string | null {
+  if (!UUID_RE.test(sessionId)) return null;
+  for (const project of listClaudeProjects()) {
+    const candidate = join(project.path, `${sessionId}.jsonl`);
+    if (existsSync(candidate)) return candidate;
+    // Subagent fallback
+    let entries: import("node:fs").Dirent[];
+    try {
+      entries = readdirSync(project.path, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || !UUID_RE.test(entry.name)) continue;
+      const subCandidate = join(project.path, entry.name, "subagents", `${sessionId}.jsonl`);
+      if (existsSync(subCandidate)) return subCandidate;
+    }
+  }
+  return null;
+}
+
+/** For tests: list all session IDs across all projects. */
+export function _listAllSessionIds(): string[] {
+  const ids: string[] = [];
+  for (const project of listClaudeProjects()) {
+    for (const t of listClaudeTranscripts(project)) {
+      ids.push(t.sessionId);
+    }
+  }
+  return ids;
+}
+
+/** For tests: stat one transcript file. */
+export function _statTranscript(path: string): { mtimeMs: number; sizeBytes: number } | null {
+  try {
+    const s = statSync(path);
+    return { mtimeMs: s.mtimeMs, sizeBytes: s.size };
+  } catch {
+    return null;
+  }
+}
+
+/** Re-export for callers that want to construct paths from a basename. */
+export { basename };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "0.0.10",
+  "version": "0.0.11-beta.2",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs"
@@ -59,19 +59,19 @@
   ],
   "author": "ExosphereHost Inc. <failproofai@exosphere.host>",
   "license": "SEE LICENSE IN LICENSE",
-  "homepage": "https://github.com/exospherehost/failproofai",
+  "homepage": "https://github.com/FailproofAI/failproofai",
   "repository": {
     "type": "git",
-    "url": "https://github.com/exospherehost/failproofai.git"
+    "url": "https://github.com/FailproofAI/failproofai.git"
   },
   "bugs": {
-    "url": "https://github.com/exospherehost/failproofai/issues"
+    "url": "https://github.com/FailproofAI/failproofai/issues"
   },
   "publishConfig": {
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.93.0",
+    "@anthropic-ai/sdk": "^0.96.0",
     "@tailwindcss/postcss": "^4.1.18",
     "@tanstack/react-virtual": "^3.13.18",
     "@testing-library/jest-dom": "^6.9.1",

package/scripts/launch.ts

@@ -17,7 +17,7 @@ export function launch(mode: "dev" | "start"): void {
   // same column so the values form a clean right-hand column).
   console.log(`\n  failproof ai\n`);
   console.log(`  📦 Version:      ${version}`);
-  console.log(`  ⭐ Star us:      https://github.com/exospherehost/failproofai`);
+  console.log(`  ⭐ Star us:      https://github.com/failproofai/failproofai`);
   console.log(`  📖 Docs:         https://befailproof.ai`);
   console.log(`  💬 Slack:        https://join.slack.com/t/failproofai/shared_invite/zt-3v63b7k5e-O3NBHmj8X6n9gZSGDx6ggQ\n`);
 

package/scripts/postinstall.mjs

@@ -7,7 +7,7 @@
  *
  * No external dependencies — Node.js built-ins only.
  */
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { resolve } from "node:path";
 import { platform, arch, release, homedir, hostname } from "node:os";
 import { createHmac } from "node:crypto";
@@ -134,6 +134,94 @@ try {
   // Non-critical — don't fail the install
 }
 
+if (!hooksResult.configured && !hooksResult.registered) {
+  console.log(
+    `\n[failproofai] Installed. Next steps:\n` +
+    `  1. Run \`failproofai policies --install\` to enable safety policies.\n` +
+    `  2. Run \`failproofai\` to open the dashboard (or just \`failproofai\` to start now — it'll offer to set up policies for you).\n` +
+    `  Disable first-run prompt: FAILPROOFAI_NO_FIRST_RUN=1\n`
+  );
+}
+
+// First-run + version_changed detection. The presence of ~/.failproofai/last-version
+// is a stable signal: written on every postinstall, absent before the first one.
+// Cannot piggy-back on instance-id because most users hit Tier 2 (OS machine ID)
+// and never create that file.
+//
+// Semver comparison: a release (no prerelease tag) is greater than the same
+// version with a prerelease tag (semver §11). Inside the prerelease, numeric
+// identifiers are lower than non-numeric ones of the same length.
+function compareSemver(a, b) {
+  const parse = (v) => {
+    const m = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(v);
+    if (!m) return null;
+    return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null };
+  };
+  const pa = parse(a);
+  const pb = parse(b);
+  if (!pa || !pb) return a < b ? -1 : a > b ? 1 : 0;
+  for (let i = 0; i < 3; i++) {
+    if (pa.nums[i] !== pb.nums[i]) return pa.nums[i] < pb.nums[i] ? -1 : 1;
+  }
+  if (pa.pre === null && pb.pre === null) return 0;
+  if (pa.pre === null) return 1;
+  if (pb.pre === null) return -1;
+  const ax = pa.pre.split(/[.-]/);
+  const bx = pb.pre.split(/[.-]/);
+  for (let i = 0; i < Math.max(ax.length, bx.length); i++) {
+    const ai = ax[i], bi = bx[i];
+    if (ai === undefined) return -1;
+    if (bi === undefined) return 1;
+    const aNum = /^\d+$/.test(ai), bNum = /^\d+$/.test(bi);
+    if (aNum && bNum) {
+      const d = Number(ai) - Number(bi);
+      if (d !== 0) return d < 0 ? -1 : 1;
+    } else if (aNum) {
+      return -1;
+    } else if (bNum) {
+      return 1;
+    } else if (ai !== bi) {
+      return ai < bi ? -1 : 1;
+    }
+  }
+  return 0;
+}
+
+const currentVersion = process.env.npm_package_version ?? "unknown";
+const lastVersionFile = resolve(homedir(), ".failproofai", "last-version");
+let previousVersion = null;
+try {
+  if (existsSync(lastVersionFile)) {
+    previousVersion = readFileSync(lastVersionFile, "utf8").trim() || null;
+  }
+} catch {}
+
+if (previousVersion === null) {
+  trackInstallEvent("first_install", {
+    platform: platform(),
+    arch: arch(),
+    os_release: release(),
+    node_version: process.versions.node,
+    version: currentVersion,
+  }).catch(() => {});
+} else {
+  // Same version is a reinstall — still worth tracking; users hitting `npm install -g`
+  // repeatedly is itself signal. Drop the `!==` guard so cmp===0 reaches the event.
+  const cmp = compareSemver(previousVersion, currentVersion);
+  trackInstallEvent("version_changed", {
+    from_version: previousVersion,
+    to_version: currentVersion,
+    direction: cmp < 0 ? "upgrade" : cmp > 0 ? "downgrade" : "reinstall",
+    platform: platform(),
+    arch: arch(),
+  }).catch(() => {});
+}
+
+try {
+  mkdirSync(resolve(homedir(), ".failproofai"), { recursive: true });
+  writeFileSync(lastVersionFile, currentVersion, "utf8");
+} catch {}
+
 // Telemetry (best-effort, fire-and-forget)
 trackInstallEvent("package_installed", {
   platform: platform(),

package/src/audit/cache.ts

@@ -0,0 +1,113 @@
+/**
+ * Per-transcript audit-result cache.
+ *
+ * Stored at `~/.failproofai/cache/audit/<sha1(transcriptPath)>.json` with
+ * mode 0600. Keyed by (mtime, size, engineVersion, detectorVersion) so the
+ * cache invalidates automatically when either the transcript or the policy /
+ * detector code changes.
+ *
+ * Skipped for transcripts whose `sizeBytes === 0` (currently: OpenCode, whose
+ * sessions live in a SQLite DB rather than a file with a stable mtime).
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { BUILTIN_POLICIES } from "../hooks/builtin-policies";
+import { AUDIT_DETECTORS } from "./detectors";
+import type { TranscriptAuditResult } from "./types";
+
+let cachedEngineVersion: string | null = null;
+let cachedDetectorVersion: string | null = null;
+
+/** Hash of every builtin policy's name + function body. Changes when policy
+ *  code changes, invalidating downstream caches. */
+function getEngineVersion(): string {
+  if (cachedEngineVersion) return cachedEngineVersion;
+  const blob = BUILTIN_POLICIES
+    .map((p) => `${p.name}|${p.fn.toString()}`)
+    .sort()
+    .join("\n");
+  cachedEngineVersion = createHash("sha1").update(blob).digest("hex").slice(0, 16);
+  return cachedEngineVersion;
+}
+
+/** Same for audit detectors. */
+function getDetectorVersion(): string {
+  if (cachedDetectorVersion) return cachedDetectorVersion;
+  const blob = AUDIT_DETECTORS
+    .map((d) => `${d.name}|${d.detect.toString()}`)
+    .sort()
+    .join("\n");
+  cachedDetectorVersion = createHash("sha1").update(blob).digest("hex").slice(0, 16);
+  return cachedDetectorVersion;
+}
+
+function getCachePathFor(transcriptPath: string): string {
+  const root = join(homedir(), ".failproofai", "cache", "audit");
+  const key = createHash("sha1").update(transcriptPath).digest("hex");
+  return join(root, `${key}.json`);
+}
+
+interface CacheEntry {
+  mtimeMs: number;
+  sizeBytes: number;
+  engineVersion: string;
+  detectorVersion: string;
+  result: TranscriptAuditResult;
+}
+
+export function readCachedTranscriptResult(
+  transcriptPath: string,
+  mtimeMs: number,
+  sizeBytes: number,
+): TranscriptAuditResult | null {
+  if (sizeBytes === 0) return null; // OpenCode and other DB-backed sources
+  const cachePath = getCachePathFor(transcriptPath);
+  if (!existsSync(cachePath)) return null;
+  try {
+    const raw = readFileSync(cachePath, "utf-8");
+    const entry = JSON.parse(raw) as CacheEntry;
+    if (entry.mtimeMs !== mtimeMs) return null;
+    if (entry.sizeBytes !== sizeBytes) return null;
+    if (entry.engineVersion !== getEngineVersion()) return null;
+    if (entry.detectorVersion !== getDetectorVersion()) return null;
+    return entry.result;
+  } catch {
+    return null;
+  }
+}
+
+export function writeCachedTranscriptResult(
+  transcriptPath: string,
+  mtimeMs: number,
+  sizeBytes: number,
+  result: TranscriptAuditResult,
+): void {
+  if (sizeBytes === 0) return;
+  const cachePath = getCachePathFor(transcriptPath);
+  try {
+    mkdirSync(join(homedir(), ".failproofai", "cache", "audit"), { recursive: true });
+    const entry: CacheEntry = {
+      mtimeMs,
+      sizeBytes,
+      engineVersion: getEngineVersion(),
+      detectorVersion: getDetectorVersion(),
+      result,
+    };
+    // Set 0o600 at file-creation time so there's no window where the file
+    // exists with the umask default (typically 0o644). The chmodSync below is
+    // a belt-and-suspenders pass for the case where the file already existed.
+    writeFileSync(cachePath, JSON.stringify(entry), { encoding: "utf-8", mode: 0o600 });
+    try { chmodSync(cachePath, 0o600); } catch { /* best-effort on POSIX */ }
+  } catch {
+    // Cache writes are best-effort — never let a cache error kill the audit.
+  }
+}
+
+/** Test helper: reset memoized version hashes (so they recompute after a
+ *  detector or policy is monkey-patched in a test). */
+export function _resetVersionCache(): void {
+  cachedEngineVersion = null;
+  cachedDetectorVersion = null;
+}

package/src/audit/cli-adapters/claude.ts

@@ -0,0 +1,97 @@
+/**
+ * Claude Code transcript adapter.
+ *
+ * Discovers ~/.claude/projects/<encoded>/<sessionId>.jsonl (and any subagent
+ * transcripts under <sessionId>/subagents/) via lib/claude-sessions.ts, then
+ * parses each via lib/log-entries.ts.
+ */
+import { readFile } from "node:fs/promises";
+import {
+  listClaudeProjects,
+  listClaudeTranscripts,
+  type ClaudeTranscriptFile,
+} from "../../../lib/claude-sessions";
+import { parseLogContent, type LogSource } from "../../../lib/log-entries";
+import type { NormalizedToolEvent, TranscriptMetadata } from "../types";
+import { logEntriesToEvents } from "./shared";
+
+export interface ListOpts {
+  /** Restrict to sessions whose decoded cwd matches one of these paths. */
+  projects?: string[];
+  /** Filter on transcript mtime — only return if mtimeMs >= sinceMs. */
+  sinceMs?: number;
+}
+
+export async function listClaudeTranscriptMetadata(
+  opts: ListOpts = {},
+): Promise<TranscriptMetadata[]> {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out: TranscriptMetadata[] = [];
+
+  for (const project of listClaudeProjects()) {
+    if (projectFilter && !projectFilter.has(project.cwd)) continue;
+    let transcripts: ClaudeTranscriptFile[];
+    try {
+      transcripts = listClaudeTranscripts(project);
+    } catch {
+      continue;
+    }
+    for (const t of transcripts) {
+      if (t.mtimeMs < sinceMs) continue;
+      out.push({
+        cli: "claude",
+        projectName: project.name,
+        sessionId: t.sessionId,
+        transcriptPath: t.transcriptPath,
+        mtimeMs: t.mtimeMs,
+        sizeBytes: t.sizeBytes,
+      });
+    }
+  }
+
+  return out;
+}
+
+export async function streamClaudeEvents(
+  meta: TranscriptMetadata,
+): Promise<NormalizedToolEvent[]> {
+  let content: string;
+  try {
+    content = await readFile(meta.transcriptPath, "utf-8");
+  } catch {
+    return [];
+  }
+
+  const source: LogSource = "session";
+  let entries;
+  try {
+    entries = await parseLogContent(content, source);
+  } catch {
+    return [];
+  }
+
+  // Best-effort cwd resolution: the JSONL lines carry `cwd` directly on each
+  // record (verified live — see plan exploration notes). Pull the first one
+  // we find rather than re-decoding the folder name (which is lossy on POSIX).
+  let cwd = "";
+  for (const line of content.split("\n", 50)) {
+    if (!line.trim()) continue;
+    try {
+      const parsed = JSON.parse(line) as { cwd?: unknown };
+      if (typeof parsed.cwd === "string" && parsed.cwd.length > 0) {
+        cwd = parsed.cwd;
+        break;
+      }
+    } catch {
+      // skip malformed lines
+    }
+  }
+
+  return logEntriesToEvents(entries, {
+    cli: "claude",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd,
+  });
+}

package/src/audit/cli-adapters/codex.ts

@@ -0,0 +1,56 @@
+/**
+ * Codex (OpenAI) transcript adapter.
+ *
+ * Codex stores transcripts at ~/.codex/sessions/YYYY/MM/DD/<*sessionId*>.jsonl
+ * with a different layout per project. We enumerate via lib/codex-projects.ts
+ * and parse via lib/codex-sessions.ts which produces the same LogEntry[] shape
+ * the Claude parser uses, so the shared converter handles the rest.
+ */
+import { statSync } from "node:fs";
+import { getCodexProjects, getCodexSessionsByEncodedName } from "../../../lib/codex-projects";
+import { getCodexSessionLog } from "../../../lib/codex-sessions";
+import type { NormalizedToolEvent, TranscriptMetadata } from "../types";
+import type { ListOpts } from "./claude";
+import { logEntriesToEvents } from "./shared";
+
+export async function listCodexTranscriptMetadata(
+  opts: ListOpts = {},
+): Promise<TranscriptMetadata[]> {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out: TranscriptMetadata[] = [];
+
+  const projects = await getCodexProjects();
+  for (const project of projects) {
+    const { cwd, sessions } = await getCodexSessionsByEncodedName(project.name);
+    const effectiveCwd = cwd ?? "";
+    if (projectFilter && !projectFilter.has(effectiveCwd)) continue;
+    for (const s of sessions) {
+      const mtimeMs = s.lastModified.getTime();
+      if (mtimeMs < sinceMs) continue;
+      let sizeBytes = 0;
+      try { sizeBytes = statSync(s.path).size; } catch { /* unreadable */ }
+      if (!s.sessionId) continue;
+      out.push({
+        cli: "codex",
+        projectName: project.name,
+        sessionId: s.sessionId,
+        transcriptPath: s.path,
+        mtimeMs,
+        sizeBytes,
+      });
+    }
+  }
+  return out;
+}
+
+export async function streamCodexEvents(meta: TranscriptMetadata): Promise<NormalizedToolEvent[]> {
+  const log = await getCodexSessionLog(meta.sessionId);
+  if (!log) return [];
+  return logEntriesToEvents(log.entries, {
+    cli: "codex",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd: log.cwd ?? "",
+  });
+}

package/src/audit/cli-adapters/copilot.ts

@@ -0,0 +1,51 @@
+/**
+ * GitHub Copilot CLI transcript adapter.
+ */
+import { statSync } from "node:fs";
+import { getCopilotProjects, getCopilotSessionsByEncodedName } from "../../../lib/copilot-projects";
+import { getCopilotSessionLog } from "../../../lib/copilot-sessions";
+import type { NormalizedToolEvent, TranscriptMetadata } from "../types";
+import type { ListOpts } from "./claude";
+import { logEntriesToEvents } from "./shared";
+
+export async function listCopilotTranscriptMetadata(
+  opts: ListOpts = {},
+): Promise<TranscriptMetadata[]> {
+  const projectFilter = opts.projects ? new Set(opts.projects) : null;
+  const sinceMs = opts.sinceMs ?? 0;
+  const out: TranscriptMetadata[] = [];
+
+  const projects = await getCopilotProjects();
+  for (const project of projects) {
+    const { cwd, sessions } = await getCopilotSessionsByEncodedName(project.name);
+    const effectiveCwd = cwd ?? "";
+    if (projectFilter && !projectFilter.has(effectiveCwd)) continue;
+    for (const s of sessions) {
+      const mtimeMs = s.lastModified.getTime();
+      if (mtimeMs < sinceMs) continue;
+      let sizeBytes = 0;
+      try { sizeBytes = statSync(s.path).size; } catch { /* unreadable */ }
+      if (!s.sessionId) continue;
+      out.push({
+        cli: "copilot",
+        projectName: project.name,
+        sessionId: s.sessionId,
+        transcriptPath: s.path,
+        mtimeMs,
+        sizeBytes,
+      });
+    }
+  }
+  return out;
+}
+
+export async function streamCopilotEvents(meta: TranscriptMetadata): Promise<NormalizedToolEvent[]> {
+  const log = await getCopilotSessionLog(meta.sessionId);
+  if (!log) return [];
+  return logEntriesToEvents(log.entries, {
+    cli: "copilot",
+    sessionId: meta.sessionId,
+    transcriptPath: meta.transcriptPath,
+    cwd: log.cwd ?? "",
+  });
+}