tokenoscopy 0.0.0-stage → 0.3.0

package/dist/chunk-L62TVAWB.js

@@ -0,0 +1,752 @@
+// src/auth-mode.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function keyWasRejected(key, cfg) {
+  const rejected = cfg?.customApiKeyResponses?.rejected ?? [];
+  return rejected.includes(key.slice(-20));
+}
+var SEAT_ORG = /^claude_(pro|max|team|enterprise)/i;
+var SEAT_TIER = /claude_(pro|max|team|enterprise)/i;
+function classifyAuth(env, cfg) {
+  if (env.CLAUDE_CODE_USE_BEDROCK === "1") {
+    return { mode: "api_key", evidence: "CLAUDE_CODE_USE_BEDROCK=1" };
+  }
+  if (env.CLAUDE_CODE_USE_VERTEX === "1") {
+    return { mode: "api_key", evidence: "CLAUDE_CODE_USE_VERTEX=1" };
+  }
+  if (env.ANTHROPIC_AUTH_TOKEN?.trim()) {
+    return { mode: "api_key", evidence: "ANTHROPIC_AUTH_TOKEN set" };
+  }
+  const key = env.ANTHROPIC_API_KEY?.trim();
+  if (key && !keyWasRejected(key, cfg)) {
+    return { mode: "api_key", evidence: "ANTHROPIC_API_KEY set" };
+  }
+  if (env.CLAUDE_CODE_OAUTH_TOKEN?.trim()) {
+    return { mode: "subscription", evidence: "CLAUDE_CODE_OAUTH_TOKEN set" };
+  }
+  const acct = cfg?.oauthAccount;
+  if (acct?.organizationType && SEAT_ORG.test(acct.organizationType)) {
+    return {
+      mode: "subscription",
+      evidence: `oauthAccount.organizationType=${acct.organizationType}`
+    };
+  }
+  if (acct?.billingType && /subscription/i.test(acct.billingType)) {
+    return {
+      mode: "subscription",
+      evidence: `oauthAccount.billingType=${acct.billingType}`
+    };
+  }
+  const tier = acct?.organizationRateLimitTier ?? acct?.userRateLimitTier;
+  if (tier && SEAT_TIER.test(tier)) {
+    return { mode: "subscription", evidence: `rate limit tier ${tier}` };
+  }
+  if (cfg?.hasAvailableSubscription === true) {
+    return { mode: "subscription", evidence: "hasAvailableSubscription=true" };
+  }
+  if (acct?.billingType) {
+    return {
+      mode: "api_key",
+      evidence: `oauthAccount.billingType=${acct.billingType}`
+    };
+  }
+  if (acct?.accountUuid) {
+    return {
+      mode: "unknown",
+      evidence: "signed in, but the account doesn't say how it bills"
+    };
+  }
+  return { mode: "unknown", evidence: "no API key and no Claude login found" };
+}
+function readClaudeJson() {
+  try {
+    return JSON.parse(
+      readFileSync(join(homedir(), ".claude.json"), "utf8")
+    );
+  } catch {
+    return null;
+  }
+}
+function detectAuth() {
+  return classifyAuth(process.env, readClaudeJson());
+}
+function detectAuthMode() {
+  return detectAuth().mode;
+}
+function costIsRealMoney(mode) {
+  return mode === "api_key";
+}
+
+// ../shared/src/redact.ts
+var REDACTED = "[REDACTED]";
+var REDACTED_EMAIL = "[EMAIL]";
+var PATTERNS = [
+  // Anthropic
+  { name: "anthropic_key", re: /\bsk-ant-[A-Za-z0-9_-]{10,}/g },
+  // OpenAI & friends (sk-..., sk-proj-...)
+  { name: "openai_key", re: /\bsk-[A-Za-z0-9_-]{20,}/g },
+  // GitHub tokens
+  { name: "github_token", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g },
+  { name: "github_pat", re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
+  // Slack
+  { name: "slack_token", re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
+  {
+    name: "slack_webhook",
+    re: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g
+  },
+  // AWS
+  { name: "aws_access_key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+  // Google API keys
+  { name: "google_api_key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  // Stripe
+  { name: "stripe_key", re: /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{10,}/g },
+  // Supabase/JWTs (three base64url segments starting with eyJ)
+  {
+    name: "jwt",
+    re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\b/g
+  },
+  // Private key blocks
+  {
+    name: "private_key_block",
+    re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g
+  },
+  // Authorization headers
+  {
+    name: "authorization_header",
+    re: /\b(Authorization\s*:\s*(?:Bearer|Basic|token)\s+)[^\s"'`,;]+/gi,
+    replacement: `$1${REDACTED}`
+  },
+  // Connection strings with credentials: scheme://user:pass@host
+  {
+    name: "connection_string_password",
+    re: /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@"']+:)[^\s@"']+(@)/gi,
+    replacement: `$1${REDACTED}$2`
+  },
+  // key=value / key: value assignments for sensitive names
+  {
+    name: "sensitive_assignment",
+    re: /\b((?:api[_-]?key|apikey|secret|token|passwd|password|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token)\s*[=:]\s*["']?)[^\s"',;&]{6,}/gi,
+    replacement: `$1${REDACTED}`
+  },
+  // Emails (PII) — applied last so credential shapes win first
+  {
+    name: "email",
+    re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+    replacement: REDACTED_EMAIL
+  }
+];
+function redactText(text) {
+  let out = text;
+  for (const p of PATTERNS) {
+    out = out.replace(p.re, p.replacement ?? REDACTED);
+  }
+  return out;
+}
+function redactValue(value) {
+  if (typeof value === "string") return redactText(value);
+  if (Array.isArray(value)) {
+    return value.map((v) => redactValue(v));
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactValue(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+// ../shared/src/events.ts
+import { z } from "zod";
+var agentProductSchema = z.enum([
+  "claude_code",
+  "codex",
+  "cursor",
+  "gemini_cli",
+  "ai_sdk",
+  "other"
+]);
+var eventSourceSchema = z.enum([
+  "cc_hook",
+  // Claude Code http hook POST
+  "cc_jsonl",
+  // parsed local transcript (flush/tail upload)
+  "cc_otel",
+  // OTLP logs intake (claude_code.api_request etc.)
+  "api"
+  // created by our own backend (guard decisions, system notes)
+]);
+var usageSchema = z.object({
+  input: z.number().int().nonnegative(),
+  output: z.number().int().nonnegative(),
+  cache_read: z.number().int().nonnegative().default(0),
+  cache_write_5m: z.number().int().nonnegative().default(0),
+  cache_write_1h: z.number().int().nonnegative().default(0)
+});
+var eventKindSchema = z.enum([
+  "session_start",
+  "prompt",
+  // user prompt submitted
+  "assistant",
+  // assistant text/thinking turn
+  "api_request",
+  // one billed LLM request (spend atom; unique per request_id)
+  "tool_call",
+  // tool invocation with input
+  "tool_result",
+  // tool outcome (stdout/stderr/result payload)
+  "file_diff",
+  // Edit/Write derived diff
+  "subagent",
+  // subagent lifecycle
+  "guard_decision",
+  // tokenoscopy guard allow/ask/deny
+  "session_end",
+  "system"
+  // parser drift notes, api errors, misc
+]);
+var sessionEventSchema = z.object({
+  /** Claude Code session UUID (or equivalent per product). */
+  session_id: z.string().min(8),
+  ts: z.string().datetime({ offset: true }),
+  kind: eventKindSchema,
+  source: eventSourceSchema,
+  agent_product: agentProductSchema.default("claude_code"),
+  // Join / dedup keys
+  uuid: z.string().optional(),
+  // upstream record uuid (JSONL `uuid`)
+  parent_uuid: z.string().nullish(),
+  prompt_id: z.string().optional(),
+  tool_use_id: z.string().optional(),
+  request_id: z.string().optional(),
+  // spend dedup key
+  // Normalized core
+  model: z.string().optional(),
+  usage: usageSchema.optional(),
+  /** List-price estimate in USD for this event (api_request events only). */
+  cost_usd: z.number().nonnegative().optional(),
+  tool_name: z.string().optional(),
+  is_sidechain: z.boolean().optional(),
+  /** Kind-specific display payload (REDACTED before upload). */
+  payload: z.record(z.string(), z.unknown()).default({})
+});
+var authModeSchema = z.enum(["subscription", "api_key", "unknown"]);
+var costBasisSchema = z.enum(["estimated", "billed"]);
+var sessionSummarySchema = z.object({
+  session_id: z.string().min(8),
+  agent_product: agentProductSchema.default("claude_code"),
+  agent_version: z.string().optional(),
+  actor: z.object({
+    email: z.string().optional(),
+    /** Display name — git user.name, else OS user. */
+    name: z.string().optional(),
+    machine_id: z.string().optional()
+  }).default({}),
+  cwd: z.string().optional(),
+  git_repo: z.string().optional(),
+  // basename or remote-derived slug, never a full local path
+  git_branch: z.string().optional(),
+  /** Branch drift from local refs at flush time (as of the last fetch). */
+  git_base: z.string().optional(),
+  git_behind: z.number().int().nonnegative().optional(),
+  git_ahead: z.number().int().nonnegative().optional(),
+  started_at: z.string().datetime({ offset: true }).optional(),
+  ended_at: z.string().datetime({ offset: true }).optional(),
+  auth_mode: authModeSchema.default("unknown"),
+  cost_basis: costBasisSchema.default("estimated"),
+  models: z.array(z.string()).default([]),
+  usage_totals: usageSchema,
+  estimated_cost_usd: z.number().nonnegative(),
+  api_request_count: z.number().int().nonnegative().default(0),
+  tool_call_count: z.number().int().nonnegative().default(0),
+  lines_added: z.number().int().nonnegative().default(0),
+  lines_removed: z.number().int().nonnegative().default(0),
+  /** Count of transcript records the parser did not recognize (drift signal). */
+  unknown_record_count: z.number().int().nonnegative().default(0)
+});
+var flushUploadSchema = z.object({
+  schema_version: z.literal(1),
+  summary: sessionSummarySchema,
+  events: z.array(sessionEventSchema)
+});
+var hookEventSchema = z.object({
+  hook_event_name: z.string(),
+  session_id: z.string().min(8),
+  transcript_path: z.string().optional(),
+  cwd: z.string().optional(),
+  permission_mode: z.string().optional(),
+  prompt_id: z.string().optional(),
+  tool_name: z.string().optional(),
+  tool_use_id: z.string().optional(),
+  tool_input: z.unknown().optional(),
+  tool_response: z.unknown().optional(),
+  prompt: z.string().optional(),
+  stop_reason: z.string().optional(),
+  reason: z.string().optional(),
+  agent_id: z.string().optional(),
+  agent_type: z.string().optional()
+}).passthrough();
+var guardCheckRequestSchema = z.object({
+  session_id: z.string().min(8),
+  tool_name: z.string(),
+  cwd: z.string().optional(),
+  git_repo: z.string().optional()
+});
+var guardDecisionSchema = z.enum(["allow", "ask", "deny"]);
+var guardCheckResponseSchema = z.object({
+  decision: guardDecisionSchema,
+  reason: z.string().optional(),
+  budget: z.object({
+    scope: z.string(),
+    cap_usd: z.number(),
+    spent_usd: z.number()
+  }).optional()
+});
+
+// ../shared/src/pricing.ts
+var CACHE_READ_MULT = 0.1;
+var CACHE_WRITE_5M_MULT = 1.25;
+var CACHE_WRITE_1H_MULT = 2;
+var MODEL_PRICES = [
+  // Claude 5 family
+  { prefix: "claude-fable-5", input: 10, output: 50 },
+  { prefix: "claude-mythos-5", input: 10, output: 50 },
+  { prefix: "claude-opus-5", input: 5, output: 25 },
+  { prefix: "claude-sonnet-5", input: 3, output: 15 },
+  // Claude 4.x
+  { prefix: "claude-opus-4-8", input: 5, output: 25 },
+  { prefix: "claude-opus-4-7", input: 5, output: 25 },
+  { prefix: "claude-opus-4-6", input: 5, output: 25 },
+  { prefix: "claude-opus-4-5", input: 5, output: 25 },
+  { prefix: "claude-opus-4-1", input: 15, output: 75 },
+  { prefix: "claude-opus-4-2", input: 15, output: 75 },
+  // dated opus-4-0 ids: claude-opus-4-20250514
+  { prefix: "claude-opus-4-0", input: 15, output: 75 },
+  { prefix: "claude-sonnet-4", input: 3, output: 15 },
+  // covers 4-6, 4-5, 4-0, dated ids
+  { prefix: "claude-haiku-4-5", input: 1, output: 5 },
+  // Claude 3.x stragglers
+  { prefix: "claude-3-5-haiku", input: 0.8, output: 4 },
+  { prefix: "claude-3-7-sonnet", input: 3, output: 15 },
+  { prefix: "claude-3-haiku", input: 0.25, output: 1.25 }
+];
+function normalizeModelId(model) {
+  let m = model.trim().toLowerCase();
+  const anthropicIdx = m.indexOf("anthropic.");
+  if (anthropicIdx >= 0) m = m.slice(anthropicIdx + "anthropic.".length);
+  m = m.replace(/-v\d+:\d+$/, "");
+  return m;
+}
+function findModelPrice(model) {
+  const normalized = normalizeModelId(model);
+  let best = null;
+  for (const row of MODEL_PRICES) {
+    if (normalized.startsWith(row.prefix)) {
+      if (!best || row.prefix.length > best.prefix.length) best = row;
+    }
+  }
+  return best;
+}
+function estimateCostUsd(model, usage) {
+  const price = findModelPrice(model);
+  if (!price) return null;
+  const perTok = 1 / 1e6;
+  const cost = usage.input * price.input * perTok + usage.output * price.output * perTok + usage.cache_read * price.input * CACHE_READ_MULT * perTok + usage.cache_write_5m * price.input * CACHE_WRITE_5M_MULT * perTok + usage.cache_write_1h * price.input * CACHE_WRITE_1H_MULT * perTok;
+  return Math.round(cost * 1e6) / 1e6;
+}
+
+// ../shared/src/diagnose.ts
+var DIAG = {
+  /** A session counts as live if it produced an event this recently. */
+  LIVE_WINDOW_MS: 15 * 6e4,
+  RUNAWAY_MIN_COST: 10,
+  RUNAWAY_CTX_TOKENS: 4e5,
+  RUNAWAY_CYCLE: 40,
+  RUNAWAY_REPEAT: 10,
+  BLOAT_CTX_TOKENS: 2e5,
+  BLOAT_MIN_COST: 5,
+  CYCLE_MIN: 25,
+  REPEAT_MIN: 5
+};
+
+// ../shared/src/guard-contract.ts
+var GUARD_TIMEOUT_MS = 1500;
+var ALLOW_CACHE_MS = 15e3;
+
+// ../shared/src/dedup.ts
+function dedupKeyPrefix(kind) {
+  switch (kind) {
+    case "api_request":
+      return "api";
+    case "tool_call":
+      return "tc";
+    case "tool_result":
+      return "tr";
+    case "file_diff":
+      return "fd";
+    case "prompt":
+      return "pr";
+    case "assistant":
+      return "as";
+    default:
+      return kind;
+  }
+}
+function naturalDedupKey(e) {
+  const id = (() => {
+    switch (e.kind) {
+      case "api_request":
+        return e.request_id ?? e.uuid;
+      case "tool_call":
+      case "tool_result":
+      case "file_diff":
+        return e.tool_use_id ?? e.uuid;
+      case "prompt":
+        return e.prompt_id ?? e.uuid;
+      default:
+        return e.uuid;
+    }
+  })();
+  return id ? `${dedupKeyPrefix(e.kind)}:${id}` : null;
+}
+var MAX_PAYLOAD_TEXT = 2e4;
+var MARKER = /^\n…\[truncated \d+ chars\]$/;
+function truncatePayload(value) {
+  if (typeof value === "string") {
+    if (value.length <= MAX_PAYLOAD_TEXT) return value;
+    if (MARKER.test(value.slice(MAX_PAYLOAD_TEXT))) return value;
+    return `${value.slice(0, MAX_PAYLOAD_TEXT)}
+\u2026[truncated ${value.length - MAX_PAYLOAD_TEXT} chars]`;
+  }
+  if (Array.isArray(value)) return value.map(truncatePayload);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = truncatePayload(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+// ../shared/src/work-map.ts
+function trimSlashes(p) {
+  return p.replace(/\/+$/, "");
+}
+function relativeToRoot(abs, root) {
+  if (!abs || !root) return void 0;
+  if (!abs.startsWith("/") || !root.startsWith("/")) return void 0;
+  const r = trimSlashes(root);
+  if (r.length === 0) return void 0;
+  if (!abs.startsWith(`${r}/`)) return void 0;
+  const rel = abs.slice(r.length + 1).replace(/\/{2,}/g, "/");
+  if (rel.length === 0 || rel.split("/").includes("..")) return void 0;
+  return rel;
+}
+function toolFilePath(input) {
+  if (!input || typeof input !== "object") return void 0;
+  const i = input;
+  const p = i.file_path ?? i.notebook_path;
+  return typeof p === "string" && p.length > 0 ? p : void 0;
+}
+function withRelPath(event, root) {
+  if (!root) return event;
+  let abs;
+  if (event.kind === "tool_call") abs = toolFilePath(event.payload.input);
+  else if (event.kind === "file_diff") {
+    const p = event.payload.file_path;
+    abs = typeof p === "string" ? p : void 0;
+  }
+  const rel = relativeToRoot(abs, root);
+  if (!rel) return event;
+  return { ...event, payload: { ...event.payload, rel_path: rel } };
+}
+
+// src/transcript.ts
+var SKIPPED_TYPES = /* @__PURE__ */ new Set([
+  "summary",
+  "attachment",
+  "file-history-snapshot",
+  "last-prompt",
+  "mode",
+  "permission-mode",
+  "queue-operation",
+  "progress"
+]);
+var EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "NotebookEdit", "MultiEdit"]);
+function normalizeUsage(raw) {
+  const split = raw.cache_creation;
+  const write5m = split?.ephemeral_5m_input_tokens;
+  const write1h = split?.ephemeral_1h_input_tokens;
+  return {
+    input: raw.input_tokens ?? 0,
+    output: raw.output_tokens ?? 0,
+    cache_read: raw.cache_read_input_tokens ?? 0,
+    // No TTL split reported → attribute the whole write to the cheaper 5m class
+    // (under-estimate beats over-estimate for a number we label "estimated").
+    cache_write_5m: write5m ?? raw.cache_creation_input_tokens ?? 0,
+    cache_write_1h: write1h ?? 0
+  };
+}
+function addUsage(a, b) {
+  return {
+    input: a.input + b.input,
+    output: a.output + b.output,
+    cache_read: a.cache_read + b.cache_read,
+    cache_write_5m: a.cache_write_5m + b.cache_write_5m,
+    cache_write_1h: a.cache_write_1h + b.cache_write_1h
+  };
+}
+function countLines(s) {
+  if (typeof s !== "string" || s.length === 0) return 0;
+  return s.split("\n").length;
+}
+function repoLabelFromCwd(cwd) {
+  if (!cwd) return void 0;
+  const parts = cwd.split("/").filter(Boolean);
+  return parts[parts.length - 1];
+}
+function parseTranscript(jsonl) {
+  const warnings = [];
+  const events = [];
+  const seenRequestIds = /* @__PURE__ */ new Set();
+  const models = /* @__PURE__ */ new Set();
+  let sessionId = "";
+  let agentVersion;
+  let cwd;
+  let gitBranch;
+  let firstTs;
+  let lastTs;
+  let unknownCount = 0;
+  let unknownModelFlagged = false;
+  let usageTotals = {
+    input: 0,
+    output: 0,
+    cache_read: 0,
+    cache_write_5m: 0,
+    cache_write_1h: 0
+  };
+  let totalCost = 0;
+  let apiRequestCount = 0;
+  let toolCallCount = 0;
+  let linesAdded = 0;
+  let linesRemoved = 0;
+  const lines = jsonl.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let record;
+    try {
+      record = JSON.parse(trimmed);
+    } catch {
+      unknownCount++;
+      warnings.push("unparseable_line");
+      continue;
+    }
+    sessionId ||= record.sessionId ?? "";
+    agentVersion ||= record.version;
+    cwd ||= record.cwd;
+    gitBranch ||= record.gitBranch;
+    if (record.timestamp) {
+      firstTs ??= record.timestamp;
+      lastTs = record.timestamp;
+    }
+    const type = record.type ?? "NO_TYPE";
+    if (SKIPPED_TYPES.has(type)) continue;
+    const base = {
+      session_id: record.sessionId ?? sessionId ?? "unknown-session",
+      ts: record.timestamp ?? lastTs ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+      source: "cc_jsonl",
+      agent_product: "claude_code",
+      uuid: record.uuid,
+      parent_uuid: record.parentUuid,
+      prompt_id: record.promptId,
+      is_sidechain: record.isSidechain
+    };
+    if (type === "assistant") {
+      const msg = record.message ?? {};
+      const model = msg.model;
+      if (model) models.add(model);
+      const requestId = record.requestId ?? msg.id;
+      if (requestId && !seenRequestIds.has(requestId) && msg.usage) {
+        seenRequestIds.add(requestId);
+        const usage = normalizeUsage(msg.usage);
+        usageTotals = addUsage(usageTotals, usage);
+        apiRequestCount++;
+        let cost;
+        if (model) {
+          const estimated = estimateCostUsd(model, usage);
+          if (estimated === null) {
+            if (!unknownModelFlagged) {
+              warnings.push(`unknown_model_price:${model}`);
+              unknownModelFlagged = true;
+            }
+          } else {
+            cost = estimated;
+            totalCost += estimated;
+          }
+        }
+        events.push({
+          ...base,
+          kind: "api_request",
+          request_id: requestId,
+          model,
+          usage,
+          cost_usd: cost,
+          payload: { stop_reason: msg.stop_reason ?? null }
+        });
+      }
+      const content = Array.isArray(msg.content) ? msg.content : [];
+      for (const block of content) {
+        if (typeof block !== "object" || block === null) continue;
+        const b = block;
+        if (b.type === "text" || b.type === "thinking") {
+          const text = b.type === "text" ? b.text : b.thinking;
+          if (!text) continue;
+          events.push({
+            ...base,
+            kind: "assistant",
+            request_id: requestId,
+            model,
+            payload: { block_type: b.type, text }
+          });
+        } else if (b.type === "tool_use") {
+          toolCallCount++;
+          const toolName = typeof b.name === "string" ? b.name : "unknown";
+          const input = b.input;
+          events.push({
+            ...base,
+            kind: "tool_call",
+            request_id: requestId,
+            tool_use_id: typeof b.id === "string" ? b.id : void 0,
+            tool_name: toolName,
+            payload: { input: input ?? {} }
+          });
+          if (EDIT_TOOLS.has(toolName) && input) {
+            const filePath = input.file_path;
+            const oldStr = input.old_string;
+            const newStr = input.new_string ?? input.content;
+            const added = toolName === "Write" ? countLines(newStr) : countLines(newStr);
+            const removed = toolName === "Write" ? 0 : countLines(oldStr);
+            linesAdded += added;
+            linesRemoved += removed;
+            events.push({
+              ...base,
+              kind: "file_diff",
+              request_id: requestId,
+              tool_use_id: typeof b.id === "string" ? b.id : void 0,
+              tool_name: toolName,
+              payload: {
+                file_path: filePath,
+                old_string: oldStr,
+                new_string: newStr,
+                lines_added: added,
+                lines_removed: removed
+              }
+            });
+          }
+        }
+      }
+      continue;
+    }
+    if (type === "user") {
+      const msg = record.message ?? {};
+      const content = msg.content;
+      if (typeof content === "string") {
+        events.push({ ...base, kind: "prompt", payload: { text: content } });
+        continue;
+      }
+      if (Array.isArray(content)) {
+        for (const block of content) {
+          if (typeof block !== "object" || block === null) continue;
+          const b = block;
+          if (b.type === "text" && typeof b.text === "string") {
+            events.push({ ...base, kind: "prompt", payload: { text: b.text } });
+          } else if (b.type === "tool_result") {
+            const tur = record.toolUseResult;
+            const isError = b.is_error === true;
+            const payload = { is_error: isError };
+            if (typeof tur === "object" && tur !== null) {
+              if (typeof tur.stdout === "string") payload.stdout = tur.stdout;
+              if (typeof tur.stderr === "string") payload.stderr = tur.stderr;
+              if (typeof tur.interrupted === "boolean")
+                payload.interrupted = tur.interrupted;
+              if (payload.stdout === void 0 && payload.stderr === void 0) {
+                payload.result = tur;
+              }
+            } else if (typeof tur === "string") {
+              payload.result = tur;
+            } else if (typeof b.content === "string") {
+              payload.result = b.content;
+            }
+            events.push({
+              ...base,
+              kind: "tool_result",
+              tool_use_id: typeof b.tool_use_id === "string" ? b.tool_use_id : void 0,
+              payload
+            });
+          }
+        }
+        continue;
+      }
+      continue;
+    }
+    if (type === "system") {
+      events.push({
+        ...base,
+        kind: "system",
+        payload: {
+          subtype: record.subtype ?? "unknown",
+          // api_error records carry retry metadata worth keeping raw
+          detail: record.content ?? record.error ?? null
+        }
+      });
+      continue;
+    }
+    unknownCount++;
+    if (!warnings.includes(`unknown_record_type:${type}`)) {
+      warnings.push(`unknown_record_type:${type}`);
+    }
+  }
+  const summary = sessionSummarySchema.parse({
+    session_id: sessionId || "unknown-session",
+    agent_product: "claude_code",
+    agent_version: agentVersion,
+    actor: {},
+    cwd,
+    git_repo: repoLabelFromCwd(cwd),
+    git_branch: gitBranch,
+    started_at: firstTs,
+    ended_at: lastTs,
+    auth_mode: "unknown",
+    cost_basis: "estimated",
+    models: [...models],
+    usage_totals: usageTotals,
+    estimated_cost_usd: Math.round(totalCost * 1e6) / 1e6,
+    api_request_count: apiRequestCount,
+    tool_call_count: toolCallCount,
+    lines_added: linesAdded,
+    lines_removed: linesRemoved,
+    unknown_record_count: unknownCount
+  });
+  return { summary, events, warnings };
+}
+
+export {
+  classifyAuth,
+  readClaudeJson,
+  detectAuth,
+  detectAuthMode,
+  costIsRealMoney,
+  redactText,
+  redactValue,
+  GUARD_TIMEOUT_MS,
+  ALLOW_CACHE_MS,
+  naturalDedupKey,
+  truncatePayload,
+  withRelPath,
+  repoLabelFromCwd,
+  parseTranscript
+};