failproofai 1.0.4-beta.7 → 1.0.4

package/dist/worker.mjs

@@ -2805,39 +2805,15 @@ var init_builtin_policies = __esm(() => {
   SHELL_METACHAR_RE = /[;&<>`$()\\]/;
   JWT_RE = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/;
   API_KEY_PATTERNS = [
-    [/sk-ant-api03-[A-Za-z0-9\-_]{20,}/, "Anthropic API key"],
-    [/sk-ant-oat01-[A-Za-z0-9\-_]{20,}/, "Anthropic OAuth token"],
     [/sk-ant-[A-Za-z0-9\-_]{20,}/, "Anthropic API key"],
     [/sk-proj-[A-Za-z0-9\-_]{20,}/, "OpenAI project API key"],
-    [/(?<!\w)sk-svcacct-[A-Za-z0-9\-_]{20,}/, "OpenAI service-account key"],
-    [/(?<!\w)sk-admin-[A-Za-z0-9\-_]{20,}/, "OpenAI admin key"],
-    [/sk-or-v1-[A-Za-z0-9\-_]{20,}/, "OpenRouter API key"],
-    [/sk-[A-Za-z0-9]{20,}/, "OpenAI-compatible key (issuer unknown)"],
-    [/github_pat_[A-Za-z0-9_]{82}/, "GitHub fine-grained token"],
+    [/sk-[A-Za-z0-9]{20,}/, "OpenAI API key"],
     [/ghp_[A-Za-z0-9]{36}/, "GitHub personal access token"],
-    [/gho_[A-Za-z0-9]{36}/, "GitHub OAuth token"],
-    [/ghu_[A-Za-z0-9]{36}/, "GitHub user-to-server token"],
-    [/ghs_[A-Za-z0-9]{36}/, "GitHub server-to-server token"],
-    [/ghr_[A-Za-z0-9]{36}/, "GitHub refresh token"],
-    [/glpat-[A-Za-z0-9\-_]{20,}/, "GitLab personal access token"],
+    [/github_pat_[A-Za-z0-9_]{82}/, "GitHub fine-grained token"],
     [/AKIA[A-Z0-9]{16}/, "AWS access key ID"],
-    [/ASIA[A-Z0-9]{16}/, "AWS temporary access key ID"],
     [/sk_live_[A-Za-z0-9]{24,}/, "Stripe live secret key"],
     [/sk_test_[A-Za-z0-9]{24,}/, "Stripe test secret key"],
-    [/rk_live_[A-Za-z0-9]{24,}/, "Stripe restricted key"],
-    [/AIza[0-9A-Za-z\-_]{35}/, "Google API key"],
-    [/\d{8,10}:[A-Za-z0-9_-]{35}/, "Telegram bot token"],
-    [/xox[baprs]-[A-Za-z0-9-]{10,}/, "Slack token"],
-    [/xapp-[0-9]-[A-Za-z0-9-]{10,}/, "Slack app-level token"],
-    [/hf_[A-Za-z0-9]{30,}/, "Hugging Face token"],
-    [/gsk_[A-Za-z0-9]{40,}/, "Groq API key"],
-    [/r8_[A-Za-z0-9]{30,}/, "Replicate token"],
-    [/xai-[A-Za-z0-9]{40,}/, "xAI API key"],
-    [/npm_[A-Za-z0-9]{36}/, "npm access token"],
-    [/dop_v1_[a-f0-9]{64}/, "DigitalOcean token"],
-    [/shpat_[a-fA-F0-9]{32}/, "Shopify access token"],
-    [/sb_secret_[A-Za-z0-9\-_]{20,}/, "Supabase secret key"],
-    [/sbp_[a-f0-9]{40}/, "Supabase personal token"]
+    [/AIza[0-9A-Za-z\-_]{35}/, "Google API key"]
   ];
   CONNECTION_STRING_RE = /(?:postgresql|postgres|mysql|mongodb(?:\+srv)?|redis|amqps?|smtps?):\/\/[^@\s]+@/;
   PRIVATE_KEY_RE = /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/;
@@ -3507,7 +3483,7 @@ function parsePackPolicyName(canonicalName) {
 }
 
 // package.json
-var version = "1.0.4-beta.7";
+var version = "1.0.4";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -3611,8 +3587,7 @@ function projectConfig(parsed) {
     const daemon = parsed.daemon ?? {};
     const collector = parsed.collector ?? {};
     const telemetry = parsed.telemetry ?? {};
-    const auditPresent = !!parsed.audit && typeof parsed.audit === "object" && !Array.isArray(parsed.audit);
-    const audit = auditPresent ? parsed.audit : {};
+    const audit = parsed.audit ?? {};
     return {
       mode: mode === "cloud" ? "cloud" : "oss",
       daemon: { configured: daemon.configured === true },
@@ -3627,8 +3602,7 @@ function projectConfig(parsed) {
       },
       telemetry: { enabled: telemetry.enabled !== false },
       audit: {
-        auto: auditPresent && audit.auto !== false,
-        notify: audit.notify !== false,
+        auto: audit.auto === true,
         intervalDays: readIntervalDays(audit.interval_days),
         reportsConsentedAt: typeof audit.reports_consented_at === "number" && Number.isFinite(audit.reports_consented_at) ? audit.reports_consented_at : undefined
       }
@@ -3650,7 +3624,7 @@ var init_fp_config = __esm(() => {
       environment: "local"
     },
     telemetry: { enabled: true },
-    audit: { auto: false, notify: true, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS }
+    audit: { auto: false, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS }
   };
 });
 
@@ -5902,21 +5876,8 @@ var init_cursor_projects = __esm(() => {
 // lib/sqlite-reader.ts
 import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
 import initSqlJs from "sql.js/dist/sql-asm.js";
-function silenceSqliteExperimentalWarning() {
-  if (warningPatched)
-    return;
-  warningPatched = true;
-  const original = process.emitWarning.bind(process);
-  process.emitWarning = (warning, ...rest) => {
-    const text = typeof warning === "string" ? warning : String(warning?.message ?? "");
-    if (text.includes("SQLite is an experimental feature"))
-      return;
-    return original(warning, ...rest);
-  };
-}
 async function tryNodeSqlite(dbPath) {
   try {
-    silenceSqliteExperimentalWarning();
     const mod = await import("node:sqlite");
     const db = new mod.DatabaseSync(dbPath, { readOnly: true });
     return {
@@ -5937,21 +5898,10 @@ function loadSqlJs() {
     sqlPromise = initSqlJs();
   return sqlPromise;
 }
-function clearWalFlag(bytes) {
-  if (bytes.length < 20)
-    return bytes;
-  if (bytes.toString("latin1", 0, 16) !== SQLITE_MAGIC)
-    return bytes;
-  if (bytes[18] === 1 && bytes[19] === 1)
-    return bytes;
-  bytes[18] = 1;
-  bytes[19] = 1;
-  return bytes;
-}
 async function trySqlJs(dbPath) {
   try {
     const SQL = await loadSqlJs();
-    const db = new SQL.Database(clearWalFlag(readFileSync6(dbPath)));
+    const db = new SQL.Database(readFileSync6(dbPath));
     return {
       query(sql, params) {
         const stmt = db.prepare(sql);
@@ -5979,7 +5929,7 @@ async function openSqliteReadonly(dbPath) {
     return null;
   return await tryNodeSqlite(dbPath) ?? await trySqlJs(dbPath);
 }
-var warningPatched = false, sqlPromise = null, SQLITE_MAGIC = "SQLite format 3\x00";
+var sqlPromise = null;
 var init_sqlite_reader = () => {};
 
 // lib/opencode-db.ts
@@ -8777,15 +8727,6 @@ function joinTexts(blocks, wantedType) {
   return blocks.filter((b) => b?.type === wantedType && typeof b.text === "string").map((b) => b.text).join(`
 `);
 }
-function toolOutputText(output) {
-  if (typeof output === "string")
-    return output;
-  if (Array.isArray(output)) {
-    return output.filter((block) => !!block && typeof block === "object").map((block) => typeof block.text === "string" ? block.text : "").filter(Boolean).join(`
-`);
-  }
-  return output === undefined ? "" : JSON.stringify(output);
-}
 async function parseCodexLog(fileContent, source = "session") {
   const lines = fileContent.split(`
 `).filter((line) => line.trim() !== "");
@@ -8862,11 +8803,10 @@ async function parseCodexLog(fileContent, source = "session") {
         });
         continue;
       }
-      if (subType === "function_call" || subType === "custom_tool_call") {
+      if (subType === "function_call") {
         const callId = payload.call_id;
         const name = payload.name ?? "function_call";
-        const encodedInput = payload.arguments ?? payload.input;
-        const input = safeJsonParse4(encodedInput);
+        const input = safeJsonParse4(payload.arguments);
         const toolUse = {
           type: "tool_use",
           id: callId ?? `${timestamp}-${name}`,
@@ -8885,7 +8825,7 @@ async function parseCodexLog(fileContent, source = "session") {
         }
         continue;
       }
-      if (subType === "function_call_output" || subType === "custom_tool_call_output") {
+      if (subType === "function_call_output") {
         const callId = payload.call_id;
         const block = callId ? toolUseById.get(callId) : undefined;
         if (block) {
@@ -8894,7 +8834,7 @@ async function parseCodexLog(fileContent, source = "session") {
           block.result = {
             timestamp,
             timestampFormatted: formatTimestamp(date),
-            content: toolOutputText(payload.output),
+            content: typeof payload.output === "string" ? payload.output : JSON.stringify(payload.output),
             durationMs: duration,
             durationFormatted: formatDuration(duration)
           };
@@ -9089,8 +9029,6 @@ async function parseCopilotLog(fileContent, source = "session") {
   const rawLines = [];
   const toolUseById = new Map;
   const toolUseStartMs = new Map;
-  let mostRecentToolUse;
-  let mostRecentToolUseStartMs = 0;
   let cwd;
   let seenSessionStart = false;
   for (let i = 0;i < lines.length; i++) {
@@ -9186,24 +9124,8 @@ async function parseCopilotLog(fileContent, source = "session") {
         toolUseById.set(callId, toolUse);
         toolUseStartMs.set(callId, date.getTime());
       }
-      mostRecentToolUse = toolUse;
-      mostRecentToolUseStartMs = date.getTime();
       continue;
     }
-    if (recType === "hook.start" && data.hookType === "postToolUse" && mostRecentToolUse) {
-      const input = data.input ?? {};
-      const hookResult = input.toolResult ?? {};
-      const hookContent = hookResult.textResultForLlm ?? hookResult.sessionLog;
-      if (typeof hookContent === "string" && hookContent.length > 0) {
-        mostRecentToolUse.result = {
-          timestamp,
-          timestampFormatted: formatTimestamp(date),
-          content: hookContent,
-          durationMs: Math.max(0, date.getTime() - mostRecentToolUseStartMs),
-          durationFormatted: formatDuration(Math.max(0, date.getTime() - mostRecentToolUseStartMs))
-        };
-      }
-    }
     if (recType === "tool.execution_complete") {
       const callId = data.toolCallId;
       const block = callId ? toolUseById.get(callId) : undefined;
@@ -9213,8 +9135,7 @@ async function parseCopilotLog(fileContent, source = "session") {
         const telemetry = data.toolTelemetry ?? {};
         const reportedMs = telemetry.metrics?.commandTimeMs ?? telemetry.metrics?.durationMs ?? null;
         const durationMs = typeof reportedMs === "number" && reportedMs >= 0 ? reportedMs : Math.max(0, date.getTime() - startMs);
-        const completionContent = result.detailedContent ?? result.content ?? "";
-        const content = block.result?.content || completionContent;
+        const content = result.detailedContent ?? result.content ?? "";
         block.result = {
           timestamp,
           timestampFormatted: formatTimestamp(date),
@@ -9338,27 +9259,8 @@ async function parseCursorLog(fileContent, source = "session") {
     if (!raw.type && raw.role && raw.message?.content) {
       const synthDate = new Date(SYNTH_T0 + i);
       const synthTs = synthDate.toISOString();
-      const messageContent = raw.message.content;
-      const textParts = messageContent.filter((c) => c?.type === "text" && typeof c.text === "string").map((c) => c.text).join("");
+      const textParts = raw.message.content.filter((c) => c?.type === "text" && typeof c.text === "string").map((c) => c.text).join("");
       if (raw.role === "user") {
-        let attachedResult = false;
-        for (const block of messageContent) {
-          if (block?.type !== "tool_result")
-            continue;
-          const callId = typeof block.tool_use_id === "string" ? block.tool_use_id : undefined;
-          const toolUse = callId ? toolUseById.get(callId) : undefined;
-          if (!toolUse)
-            continue;
-          const durationMs = Math.max(0, synthDate.getTime() - (toolUseStartMs.get(callId) ?? synthDate.getTime()));
-          toolUse.result = {
-            timestamp: synthTs,
-            timestampFormatted: formatTimestamp(synthDate),
-            content: typeof block.content === "string" ? block.content : block.content == null ? "" : JSON.stringify(block.content),
-            durationMs,
-            durationFormatted: formatDuration(durationMs)
-          };
-          attachedResult = true;
-        }
         const queryMatch = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/.exec(textParts);
         const text = queryMatch ? queryMatch[1] : textParts;
         if (text) {
@@ -9367,35 +9269,11 @@ async function parseCursorLog(fileContent, source = "session") {
             ...baseEntry(rawCopy, synthTs, synthDate, source),
             message: { role: "user", content: text }
           });
-        } else if (!attachedResult) {
-          entries.push({
-            type: "system",
-            ...baseEntry(rawCopy, synthTs, synthDate, source),
-            raw: rawCopy
-          });
         }
         continue;
       }
       if (raw.role === "assistant") {
-        const blocks = [];
-        if (textParts)
-          blocks.push({ type: "text", text: textParts });
-        for (let j = 0;j < messageContent.length; j++) {
-          const contentBlock = messageContent[j];
-          if (contentBlock?.type !== "tool_use")
-            continue;
-          const name = typeof contentBlock.name === "string" ? contentBlock.name : "tool";
-          const id = typeof contentBlock.id === "string" && contentBlock.id ? contentBlock.id : `cursor-${i}-${name}-${j}`;
-          const toolUse = {
-            type: "tool_use",
-            id,
-            name,
-            input: contentBlock.input && typeof contentBlock.input === "object" ? contentBlock.input : {}
-          };
-          blocks.push(toolUse);
-          toolUseById.set(id, toolUse);
-          toolUseStartMs.set(id, synthDate.getTime());
-        }
+        const blocks = textParts ? [{ type: "text", text: textParts }] : [];
         if (blocks.length === 0) {
           entries.push({
             type: "system",

package/lib/auth/api-server-client.ts

@@ -253,49 +253,21 @@ export interface AuditReportBody {
     last_seen?: string;
     examples: string[];
   }[];
-  /**
-   * Credentials this machine found in its own transcripts.
-   *
-   * Optional on the wire, so a CLI newer than the api-server sends a field the
-   * server ignores rather than failing the whole report — the harmful counts
-   * are the older half of the contract and must keep arriving either way.
-   *
-   * Every field here is a mask, a label, a length or a location. There is no
-   * shape of this object that carries a secret, because the record it is built
-   * from never stores one: `recordLeaks` fingerprints at detection time and
-   * keeps only the masked rendering.
-   */
-  leaks?: {
-    id: string;
-    display: string;
-    label: string;
-    length: number;
-    attributed: boolean;
-    name: string | null;
-    confidence: string;
-    first_seen: string;
-    last_seen: string;
-    occurrences: number;
-    cli: string;
-    project: string;
-    mechanism: string;
-    direction: "input" | "result";
-  }[];
 }
 
 export interface AuditReportResult {
   report_id: string;
   /** Whether this report produced an email. */
   emailed: boolean;
-  /** `no_leak`, `cooldown`, `send_failed`, or null when mail went out. */
+  /** `below_threshold`, `cooldown`, `send_failed`, or null when mail went out. */
   reason: string | null;
   /**
    * Where the next window starts, per the SERVER.
    *
    * Persisted verbatim rather than computed locally. The server anchors it on
-   * the last DELIVERED alert, so a report held by the cooldown — or one whose
+   * the last DELIVERED digest, so a report held by the cooldown — or one whose
    * send failed — correctly leaves the watermark where it was, and its findings
-   * turn up in the next alert instead of falling into a gap. A machine that
+   * turn up in the next digest instead of falling into a gap. A machine that
    * lost `machine.json` also resyncs here rather than re-reporting from the
    * beginning of time.
    */
@@ -303,11 +275,11 @@ export interface AuditReportResult {
 }
 
 /**
- * Submit one scheduled scan's harmful findings and newest masked credential.
+ * Submit one scheduled scan's harmful findings.
  *
  * Called only by the audit child, and only on `--scheduled`. The destination
  * address is never sent: the api-server takes it from the access-token claims,
- * so a report cannot name where its email alert goes.
+ * so a report cannot name where its digest goes.
  */
 export async function submitAuditReport(
   accessToken: string,

package/lib/claude-sessions.ts

@@ -4,14 +4,8 @@
  * Claude stores transcripts at:
  *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>.jsonl
  *
- * Subagent transcripts (when a session spawned subagents) live alongside, in two
- * shapes — a direct child, and one nested per workflow run:
+ * Subagent transcripts (when a session spawned subagents) live alongside:
  *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>/subagents/<agentId>.jsonl
- *   <CLAUDE_PROJECTS_PATH>/<encoded-cwd>/<sessionId>/subagents/workflows/<runId>/<agentId>.jsonl
- *
- * Everything below `subagents/` is walked to a bounded depth rather than one
- * level, because the second shape arrived after this module was written and the
- * miss was most of the corpus. See `collectSubagentTranscripts`.
  *
  * The parser for these files lives in `lib/log-entries.ts` (`parseLogContent`,
  * `parseSessionLog`). This module exposes discovery only — the audit pipeline
@@ -76,99 +70,6 @@ export function listClaudeProjects(): ClaudeProjectFolder[] {
 /** Lists every JSONL transcript under one Claude project folder, including
  *  subagent transcripts under `<sessionId>/subagents/`. Returns [] on missing
  *  or unreadable paths. */
-/**
- * Depth of nesting allowed below `subagents/`.
- *
- * The two shapes that exist today need 0 and 2 (`<agent>.jsonl` and
- * `workflows/<runId>/<agent>.jsonl`). The cap is here so an unexpected layout —
- * or a symlink cycle a future Claude build introduces — costs a bounded walk
- * rather than an audit that never returns, and it is deliberately loose enough
- * that a third shape lands inside it without another release.
- */
-const MAX_SUBAGENT_DEPTH = 5;
-
-/**
- * Collect every `.jsonl` beneath a session's `subagents/` directory.
- *
- * This used to read only the DIRECT children of `subagents/`, which was correct
- * for the layout Claude shipped when it was written and silently wrong the day
- * workflow runs started nesting their agents one level further down. On a
- * machine that uses them the miss is most of the corpus: 1,839 transcripts on
- * disk, 1,741 under `subagents/`, and 1,679 of those inside
- * `subagents/workflows/<runId>/` — so the audit was walking 160 files, 8.7% of
- * the evidence, and reporting the result as though it had read everything.
- *
- * ## Session ids come from the relative path, not the basename
- *
- * Every workflow run writes a `journal.jsonl` beside its agents, so basenames
- * are NOT unique below this directory — 1,741 files share 1,613 distinct names
- * on the machine this was found on. A basename id would collide those 128 files
- * onto ~one row each, and `sessionId` is what the cache, the per-session
- * detector state and the example attribution are keyed by, so the collision
- * would silently merge unrelated sessions rather than fail.
- *
- * Nor is the path below `subagents/` unique on its own. A workflow run id is
- * reused when its session is resumed, so `wf_3d609e92-a38/journal.jsonl` exists
- * under two different parent sessions in the same project — found by asserting
- * uniqueness over the real corpus, not by reasoning about it.
- *
- * The id is therefore the PARENT SESSION id followed by the path relative to
- * `subagents/`, minus the extension, joined with `__`:
- * `<parentUuid>__workflows__wf_123__agent-abc`. That is a filesystem path
- * within the project, so it is unique by construction rather than by argument,
- * and it names the session the subagent belongs to. `__` is safe as the joiner
- * because no id Claude generates contains one — verified against 1,741 real
- * files, zero hits. Top-level session ids are untouched.
- *
- * Symlinks are not followed. Nothing in the layout uses them, and following one
- * is how a directory walk turns into an infinite loop.
- */
-function collectSubagentTranscripts(
-  dir: string,
-  relPrefix: string,
-  project: ClaudeProjectFolder,
-  out: ClaudeTranscriptFile[],
-  depth: number,
-): void {
-  if (depth > MAX_SUBAGENT_DEPTH) return;
-  let entries: import("node:fs").Dirent[];
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (entry.isSymbolicLink()) continue;
-    if (entry.isDirectory()) {
-      collectSubagentTranscripts(
-        join(dir, entry.name),
-        relPrefix ? `${relPrefix}__${entry.name}` : entry.name,
-        project,
-        out,
-        depth + 1,
-      );
-      continue;
-    }
-    if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
-    const stem = entry.name.slice(0, -".jsonl".length);
-    const transcriptPath = join(dir, entry.name);
-    try {
-      const s = statSync(transcriptPath);
-      out.push({
-        projectName: project.name,
-        cwd: project.cwd,
-        sessionId: relPrefix ? `${relPrefix}__${stem}` : stem,
-        transcriptPath,
-        mtimeMs: s.mtimeMs,
-        sizeBytes: s.size,
-        isSubagent: true,
-      });
-    } catch {
-      // unreadable — skip
-    }
-  }
-}
-
 export function listClaudeTranscripts(project: ClaudeProjectFolder): ClaudeTranscriptFile[] {
   const out: ClaudeTranscriptFile[] = [];
   let entries: import("node:fs").Dirent[];
@@ -198,9 +99,34 @@ export function listClaudeTranscripts(project: ClaudeProjectFolder): ClaudeTrans
         // unreadable — skip
       }
     } else if (entry.isDirectory() && UUID_RE.test(entry.name)) {
+      // Subagent transcripts at <sessionId>/subagents/<agentId>.jsonl
       const subDir = join(project.path, entry.name, "subagents");
       if (!existsSync(subDir)) continue;
-      collectSubagentTranscripts(subDir, entry.name, project, out, 0);
+      let subEntries: import("node:fs").Dirent[];
+      try {
+        subEntries = readdirSync(subDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const sub of subEntries) {
+        if (!sub.isFile() || !sub.name.endsWith(".jsonl")) continue;
+        const agentId = sub.name.slice(0, -".jsonl".length);
+        const transcriptPath = join(subDir, sub.name);
+        try {
+          const s = statSync(transcriptPath);
+          out.push({
+            projectName: project.name,
+            cwd: project.cwd,
+            sessionId: agentId,
+            transcriptPath,
+            mtimeMs: s.mtimeMs,
+            sizeBytes: s.size,
+            isSubagent: true,
+          });
+        } catch {
+          // unreadable — skip
+        }
+      }
     }
   }
 

package/lib/codex-sessions.ts

@@ -158,21 +158,6 @@ function joinTexts(blocks: CodexContentBlock[] | undefined, wantedType: "input_t
     .join("\n");
 }
 
-/** Text carried by tool outputs. Newer Codex chronicles use an array of
- * `input_text` blocks for `custom_tool_call_output`, while older releases use
- * one string for `function_call_output`. */
-function toolOutputText(output: unknown): string {
-  if (typeof output === "string") return output;
-  if (Array.isArray(output)) {
-    return output
-      .filter((block): block is CodexContentBlock => !!block && typeof block === "object")
-      .map((block) => typeof block.text === "string" ? block.text : "")
-      .filter(Boolean)
-      .join("\n");
-  }
-  return output === undefined ? "" : JSON.stringify(output);
-}
-
 /**
  * Parse a Codex JSONL transcript into `LogEntry[]` plus the raw lines.
  * Yields to the event loop every 200 lines so big transcripts don't block.
@@ -265,11 +250,10 @@ export async function parseCodexLog(
         continue;
       }
 
-      if (subType === "function_call" || subType === "custom_tool_call") {
+      if (subType === "function_call") {
         const callId = payload.call_id as string | undefined;
         const name = (payload.name as string | undefined) ?? "function_call";
-        const encodedInput = (payload.arguments ?? payload.input) as string | undefined;
-        const input = safeJsonParse(encodedInput);
+        const input = safeJsonParse(payload.arguments as string | undefined);
         const toolUse: ToolUseBlock = {
           type: "tool_use",
           id: callId ?? `${timestamp}-${name}`,
@@ -289,7 +273,7 @@ export async function parseCodexLog(
         continue;
       }
 
-      if (subType === "function_call_output" || subType === "custom_tool_call_output") {
+      if (subType === "function_call_output") {
         const callId = payload.call_id as string | undefined;
         const block = callId ? toolUseById.get(callId) : undefined;
         if (block) {
@@ -298,7 +282,7 @@ export async function parseCodexLog(
           block.result = {
             timestamp,
             timestampFormatted: formatTimestamp(date),
-            content: toolOutputText(payload.output),
+            content: typeof payload.output === "string" ? (payload.output as string) : JSON.stringify(payload.output),
             durationMs: duration,
             durationFormatted: formatDuration(duration),
           };

package/lib/copilot-sessions.ts

@@ -151,11 +151,6 @@ interface CopilotToolResult {
   detailedContent?: string;
 }
 
-interface CopilotHookToolResult {
-  textResultForLlm?: string;
-  sessionLog?: string;
-}
-
 interface CopilotToolTelemetry {
   metrics?: { commandTimeMs?: number; durationMs?: number };
   properties?: Record<string, unknown>;
@@ -176,8 +171,6 @@ export async function parseCopilotLog(
   // toolCallId → tool_use block, so we can attach tool.execution_complete back.
   const toolUseById = new Map<string, ToolUseBlock>();
   const toolUseStartMs = new Map<string, number>();
-  let mostRecentToolUse: ToolUseBlock | undefined;
-  let mostRecentToolUseStartMs = 0;
   let cwd: string | undefined;
   let seenSessionStart = false;
 
@@ -280,32 +273,9 @@ export async function parseCopilotLog(
         toolUseById.set(callId, toolUse);
         toolUseStartMs.set(callId, date.getTime());
       }
-      mostRecentToolUse = toolUse;
-      mostRecentToolUseStartMs = date.getTime();
       continue;
     }
 
-    // Copilot CLI 1.0.39 can omit the command's real stdout from
-    // `tool.execution_complete` and expose it only to the PostToolUse hook as
-    // `input.toolResult.textResultForLlm`. That is the value the model saw and
-    // the value failproofai must audit. Keep it on the active tool block; the
-    // later completion record may still contribute timing, but must not replace
-    // this output with its shorter status-only summary.
-    if (recType === "hook.start" && data.hookType === "postToolUse" && mostRecentToolUse) {
-      const input = (data.input as Record<string, unknown> | undefined) ?? {};
-      const hookResult = (input.toolResult as CopilotHookToolResult | undefined) ?? {};
-      const hookContent = hookResult.textResultForLlm ?? hookResult.sessionLog;
-      if (typeof hookContent === "string" && hookContent.length > 0) {
-        mostRecentToolUse.result = {
-          timestamp,
-          timestampFormatted: formatTimestamp(date),
-          content: hookContent,
-          durationMs: Math.max(0, date.getTime() - mostRecentToolUseStartMs),
-          durationFormatted: formatDuration(Math.max(0, date.getTime() - mostRecentToolUseStartMs)),
-        };
-      }
-    }
-
     if (recType === "tool.execution_complete") {
       const callId = data.toolCallId as string | undefined;
       const block = callId ? toolUseById.get(callId) : undefined;
@@ -319,8 +289,7 @@ export async function parseCopilotLog(
           typeof reportedMs === "number" && reportedMs >= 0
             ? reportedMs
             : Math.max(0, date.getTime() - startMs);
-        const completionContent = result.detailedContent ?? result.content ?? "";
-        const content = block.result?.content || completionContent;
+        const content = result.detailedContent ?? result.content ?? "";
         block.result = {
           timestamp,
           timestampFormatted: formatTimestamp(date),