sernixa-cli 0.4.0__tar.gz → 0.4.2__tar.gz

{sernixa_cli-0.4.0 → sernixa_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sernixa-cli
-Version: 0.4.0
+Version: 0.4.2
 Summary: Official Sernixa CLI for policy-governed local AI agent actions
 Author: Sernixa Team
 License-Expression: MIT
@@ -20,8 +20,9 @@ Classifier: Topic :: Security
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: platformdirs>=4.0.0
+Requires-Dist: prompt-toolkit>=3.0.48
 Requires-Dist: rich>=13.8.0
-Requires-Dist: sernixa>=0.4.0
+Requires-Dist: sernixa>=0.4.1
 Requires-Dist: sernixa-agent>=1.6.1
 Requires-Dist: typer>=0.12.0
 
@@ -31,14 +32,44 @@ The official terminal and local-agent integration for Sernixa governance. The CL
 
 ## Install and set up
 
+macOS and Linux:
+
 ```bash
-pip install --upgrade sernixa-cli
+python3 -m pip install --upgrade sernixa-cli
+sernixa auth login
+sernixa setup
+sernixa doctor --strict
+```
+
+Windows PowerShell:
+
+```powershell
+py -m pip install --upgrade sernixa-cli
 sernixa auth login
 sernixa setup
 sernixa doctor --strict
 ```
 
-Then run `sernixa` by itself to open the persistent governance console:
+`sernixa auth login` opens the Sernixa sign-in page, displays a short confirmation
+code, and stores a revocable CLI session after approval. The session inherits the
+signed-in user's organization, role, plan, and feature entitlements. Check the
+active identity without exposing its credential:
+
+```bash
+sernixa auth status
+```
+
+Organization API keys remain available for CI and other non-interactive
+automation. Send the key over stdin so it is not saved in command history:
+
+```powershell
+Get-Clipboard | sernixa auth login --api-key-stdin
+```
+
+The key is never passed as a command-line argument or printed.
+
+Then run `sernixa` by itself to open the persistent governance console. Type
+`@` to open the selectable command palette, use the arrow keys, and press Enter:
 
 ```text
 sernixa › @status
@@ -49,7 +80,7 @@ sernixa › @approvals
 sernixa › @exit
 ```
 
-The console is project-aware, remains open across commands, supports tab completion and private command history, and dispatches only Sernixa commands. `@` is the primary command-palette prefix; slash-prefixed forms remain compatible. Every normal command such as `validate request.json` also works inside it. Bare `sernixa` remains concise when stdout or stdin is not a terminal, so scripts and CI never hang; `sernixa shell` is the explicit interactive entry point.
+The console is project-aware, remains open across commands, supports tab completion and private local history, and dispatches only Sernixa commands. The palette shows only actions available on the authenticated plan; direct commands are still checked by the backend. `@` is the primary command-palette prefix and slash-prefixed forms remain compatible. Every normal command such as `validate request.json` also works inside it. Bare `sernixa` remains concise when stdout or stdin is not a terminal, so scripts and CI never hang; `sernixa shell` is the explicit interactive entry point.
 
 `sernixa setup` configures Claude Code, Claude Desktop, Codex, and Cursor, preserves unrelated entries, backs up changed files, registers the bounded `sernixa://` dashboard launcher, and reports host restart or hook-trust steps. Preview without changing files:
 
@@ -66,7 +97,7 @@ source .venv-cli/bin/activate
 pip install -e packages/sernixa -e packages/sernixa-agent -e apps/cli
 ```
 
-The CLI defaults to `https://api.sernixa.com`. Stored credentials use the platform user-config directory and mode `0600` on Unix. `SERNIXA_API_KEY` and `SERNIXA_BASE_URL` override the stored configuration for non-interactive use.
+The CLI defaults to `https://api.sernixa.com`. Stored credentials use the platform user-config directory and mode `0600` on Unix. `SERNIXA_ACCESS_TOKEN`, `SERNIXA_API_KEY`, and `SERNIXA_BASE_URL` override the stored configuration for non-interactive use.
 
 ## One-command Auto Discover
 
@@ -86,9 +117,9 @@ Discovery candidates are observations for review. Enrollment is inventory. An ac
 
 Supported global targets:
 
-- `claude`: Claude Code `PreToolUse` exec-form hook in `~/.claude/settings.json`.
+- `claude`: Claude Code enforcement and lifecycle hooks in `~/.claude/settings.json`, plus the Sernixa MCP server in `~/.claude.json`.
 - `claude-desktop`: real stdio MCP server in the OS-specific Claude Desktop configuration.
-- `codex`: current `PreToolUse` JSON or array-of-tables TOML hook in `~/.codex`. Hooks are effective by default unless `[features].hooks = false`; users still review/trust new non-managed hooks in Codex.
+- `codex`: enforcement and lifecycle hooks plus the Sernixa MCP server in `~/.codex`. Hooks are effective by default unless `[features].hooks = false`; users still review/trust new non-managed hooks in Codex.
 - `cursor`: global MCP entry in `~/.cursor/mcp.json`, shared by Cursor IDE and CLI.
 
 Install or repair an individual integration:
@@ -103,11 +134,11 @@ sernixa hook repair codex
 sernixa hook status
 ```
 
-Claude Code and Codex hooks call `sernixa hook run <provider>` before tool execution. `allow` continues through normal host permissions and `deny` blocks. Claude Code maps `review` to its supported human prompt. Current Codex `PreToolUse` does not support an `ask` result, so Sernixa maps `review` to a fail-closed deny with an explicit human-review reason instead of returning a hook shape that Codex would ignore. An API/configuration failure exits with code `2`, which both hosts treat as blocking; there is no local allow fallback.
+Claude Code and Codex hooks call `sernixa hook run <provider>` before tool execution and record privacy-bounded session, tool, subagent, and compaction lifecycle evidence. `allow` continues through normal host permissions and `deny` blocks. Claude Code maps `review` to its supported human prompt. Current Codex `PreToolUse` does not support an `ask` result, so Sernixa maps `review` to a fail-closed deny with an explicit human-review reason instead of returning a hook shape that Codex would ignore. A policy-evaluation API or configuration failure exits with code `2`, which both hosts treat as blocking; there is no local allow fallback. Observational lifecycle delivery is silent and non-blocking because a telemetry outage after an action cannot safely reverse that action.
 
 Hook handlers allow 35 seconds for the live policy request; the CLI request budget is 30 seconds. This prevents slow semantic evaluations from being killed by a shorter host-hook timeout.
 
-Claude Desktop and Cursor run `sernixa mcp serve`. The stdio MCP server exposes three non-mutating tools:
+Claude Code, Claude Desktop, Codex, and Cursor run `sernixa mcp serve`. The stdio MCP server exposes three non-mutating tools:
 
 - `sernixa_policy_check`: evaluate one proposed action.
 - `sernixa_plan_check`: evaluate a declared multi-step plan.
@@ -158,6 +189,7 @@ These commands call the authenticated organization endpoints and inherit backend
 ## Stable configuration overrides
 
 - `SERNIXA_CONFIG_FILE`
+- `SERNIXA_ACCESS_TOKEN`
 - `SERNIXA_CLI_TIMEOUT_SECONDS`
 - `SERNIXA_PLAN_SESSION_FILE`
 - `SERNIXA_HISTORY_FILE`

{sernixa_cli-0.4.0 → sernixa_cli-0.4.2}/README.md

@@ -4,14 +4,44 @@ The official terminal and local-agent integration for Sernixa governance. The CL
 
 ## Install and set up
 
+macOS and Linux:
+
 ```bash
-pip install --upgrade sernixa-cli
+python3 -m pip install --upgrade sernixa-cli
+sernixa auth login
+sernixa setup
+sernixa doctor --strict
+```
+
+Windows PowerShell:
+
+```powershell
+py -m pip install --upgrade sernixa-cli
 sernixa auth login
 sernixa setup
 sernixa doctor --strict
 ```
 
-Then run `sernixa` by itself to open the persistent governance console:
+`sernixa auth login` opens the Sernixa sign-in page, displays a short confirmation
+code, and stores a revocable CLI session after approval. The session inherits the
+signed-in user's organization, role, plan, and feature entitlements. Check the
+active identity without exposing its credential:
+
+```bash
+sernixa auth status
+```
+
+Organization API keys remain available for CI and other non-interactive
+automation. Send the key over stdin so it is not saved in command history:
+
+```powershell
+Get-Clipboard | sernixa auth login --api-key-stdin
+```
+
+The key is never passed as a command-line argument or printed.
+
+Then run `sernixa` by itself to open the persistent governance console. Type
+`@` to open the selectable command palette, use the arrow keys, and press Enter:
 
 ```text
 sernixa › @status
@@ -22,7 +52,7 @@ sernixa › @approvals
 sernixa › @exit
 ```
 
-The console is project-aware, remains open across commands, supports tab completion and private command history, and dispatches only Sernixa commands. `@` is the primary command-palette prefix; slash-prefixed forms remain compatible. Every normal command such as `validate request.json` also works inside it. Bare `sernixa` remains concise when stdout or stdin is not a terminal, so scripts and CI never hang; `sernixa shell` is the explicit interactive entry point.
+The console is project-aware, remains open across commands, supports tab completion and private local history, and dispatches only Sernixa commands. The palette shows only actions available on the authenticated plan; direct commands are still checked by the backend. `@` is the primary command-palette prefix and slash-prefixed forms remain compatible. Every normal command such as `validate request.json` also works inside it. Bare `sernixa` remains concise when stdout or stdin is not a terminal, so scripts and CI never hang; `sernixa shell` is the explicit interactive entry point.
 
 `sernixa setup` configures Claude Code, Claude Desktop, Codex, and Cursor, preserves unrelated entries, backs up changed files, registers the bounded `sernixa://` dashboard launcher, and reports host restart or hook-trust steps. Preview without changing files:
 
@@ -39,7 +69,7 @@ source .venv-cli/bin/activate
 pip install -e packages/sernixa -e packages/sernixa-agent -e apps/cli
 ```
 
-The CLI defaults to `https://api.sernixa.com`. Stored credentials use the platform user-config directory and mode `0600` on Unix. `SERNIXA_API_KEY` and `SERNIXA_BASE_URL` override the stored configuration for non-interactive use.
+The CLI defaults to `https://api.sernixa.com`. Stored credentials use the platform user-config directory and mode `0600` on Unix. `SERNIXA_ACCESS_TOKEN`, `SERNIXA_API_KEY`, and `SERNIXA_BASE_URL` override the stored configuration for non-interactive use.
 
 ## One-command Auto Discover
 
@@ -59,9 +89,9 @@ Discovery candidates are observations for review. Enrollment is inventory. An ac
 
 Supported global targets:
 
-- `claude`: Claude Code `PreToolUse` exec-form hook in `~/.claude/settings.json`.
+- `claude`: Claude Code enforcement and lifecycle hooks in `~/.claude/settings.json`, plus the Sernixa MCP server in `~/.claude.json`.
 - `claude-desktop`: real stdio MCP server in the OS-specific Claude Desktop configuration.
-- `codex`: current `PreToolUse` JSON or array-of-tables TOML hook in `~/.codex`. Hooks are effective by default unless `[features].hooks = false`; users still review/trust new non-managed hooks in Codex.
+- `codex`: enforcement and lifecycle hooks plus the Sernixa MCP server in `~/.codex`. Hooks are effective by default unless `[features].hooks = false`; users still review/trust new non-managed hooks in Codex.
 - `cursor`: global MCP entry in `~/.cursor/mcp.json`, shared by Cursor IDE and CLI.
 
 Install or repair an individual integration:
@@ -76,11 +106,11 @@ sernixa hook repair codex
 sernixa hook status
 ```
 
-Claude Code and Codex hooks call `sernixa hook run <provider>` before tool execution. `allow` continues through normal host permissions and `deny` blocks. Claude Code maps `review` to its supported human prompt. Current Codex `PreToolUse` does not support an `ask` result, so Sernixa maps `review` to a fail-closed deny with an explicit human-review reason instead of returning a hook shape that Codex would ignore. An API/configuration failure exits with code `2`, which both hosts treat as blocking; there is no local allow fallback.
+Claude Code and Codex hooks call `sernixa hook run <provider>` before tool execution and record privacy-bounded session, tool, subagent, and compaction lifecycle evidence. `allow` continues through normal host permissions and `deny` blocks. Claude Code maps `review` to its supported human prompt. Current Codex `PreToolUse` does not support an `ask` result, so Sernixa maps `review` to a fail-closed deny with an explicit human-review reason instead of returning a hook shape that Codex would ignore. A policy-evaluation API or configuration failure exits with code `2`, which both hosts treat as blocking; there is no local allow fallback. Observational lifecycle delivery is silent and non-blocking because a telemetry outage after an action cannot safely reverse that action.
 
 Hook handlers allow 35 seconds for the live policy request; the CLI request budget is 30 seconds. This prevents slow semantic evaluations from being killed by a shorter host-hook timeout.
 
-Claude Desktop and Cursor run `sernixa mcp serve`. The stdio MCP server exposes three non-mutating tools:
+Claude Code, Claude Desktop, Codex, and Cursor run `sernixa mcp serve`. The stdio MCP server exposes three non-mutating tools:
 
 - `sernixa_policy_check`: evaluate one proposed action.
 - `sernixa_plan_check`: evaluate a declared multi-step plan.
@@ -131,6 +161,7 @@ These commands call the authenticated organization endpoints and inherit backend
 ## Stable configuration overrides
 
 - `SERNIXA_CONFIG_FILE`
+- `SERNIXA_ACCESS_TOKEN`
 - `SERNIXA_CLI_TIMEOUT_SECONDS`
 - `SERNIXA_PLAN_SESSION_FILE`
 - `SERNIXA_HISTORY_FILE`

{sernixa_cli-0.4.0 → sernixa_cli-0.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sernixa-cli"
-version = "0.4.0"
+version = "0.4.2"
 description = "Official Sernixa CLI for policy-governed local AI agent actions"
 readme = "README.md"
 license = "MIT"
@@ -19,8 +19,9 @@ classifiers = [
 ]
 dependencies = [
     "platformdirs>=4.0.0",
+    "prompt-toolkit>=3.0.48",
     "rich>=13.8.0",
-    "sernixa>=0.4.0",
+    "sernixa>=0.4.1",
     "sernixa-agent>=1.6.1",
     "typer>=0.12.0",
 ]

{sernixa_cli-0.4.0 → sernixa_cli-0.4.2}/sernixa_cli/__init__.py

@@ -1,3 +1,3 @@
 """Official Sernixa command-line client."""
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"

{sernixa_cli-0.4.0 → sernixa_cli-0.4.2}/sernixa_cli/config.py

@@ -2,12 +2,22 @@ from __future__ import annotations
 
 import json
 import os
+import unicodedata
 from dataclasses import asdict, dataclass
 from pathlib import Path
+from typing import Literal
 
 from platformdirs import user_config_path
 
 DEFAULT_BASE_URL = "https://api.sernixa.com"
+API_KEY_PREFIX = "srnx_live_"
+
+_PASTE_QUOTE_PAIRS = {
+    '"': '"',
+    "'": "'",
+    "“": "”",
+    "‘": "’",
+}
 
 
 class ConfigError(RuntimeError):
@@ -16,8 +26,15 @@ class ConfigError(RuntimeError):
 
 @dataclass(frozen=True)
 class CliConfig:
-    api_key: str
+    api_key: str = ""
     base_url: str = DEFAULT_BASE_URL
+    access_token: str = ""
+    auth_type: Literal["none", "api_key", "user_session"] = "none"
+    expires_at: str | None = None
+
+    @property
+    def credential(self) -> str:
+        return self.access_token or self.api_key
 
 
 def config_path() -> Path:
@@ -81,11 +98,60 @@ def normalize_base_url(value: str) -> str:
     return normalized
 
 
+def _strip_paste_boundaries(value: str) -> str:
+    """Remove only whitespace and invisible/control characters at paste edges."""
+    start = 0
+    end = len(value)
+    while start < end:
+        character = value[start]
+        if not character.isspace() and unicodedata.category(character) not in {
+            "Cc",
+            "Cf",
+        }:
+            break
+        start += 1
+    while end > start:
+        character = value[end - 1]
+        if not character.isspace() and unicodedata.category(character) not in {
+            "Cc",
+            "Cf",
+        }:
+            break
+        end -= 1
+    return value[start:end]
+
+
+def normalize_api_key(value: str) -> str:
+    """Normalize harmless clipboard wrappers without changing the secret itself."""
+    normalized = _strip_paste_boundaries(value)
+    closing_quote = _PASTE_QUOTE_PAIRS.get(normalized[:1])
+    if closing_quote and normalized.endswith(closing_quote) and len(normalized) >= 2:
+        normalized = _strip_paste_boundaries(normalized[1:-1])
+    if not normalized:
+        raise ConfigError(
+            "No API key text was received. In Windows Terminal, paste with right-click "
+            "or Ctrl+Shift+V, or run `Get-Clipboard | sernixa auth login --api-key-stdin`."
+        )
+    if not normalized.startswith(API_KEY_PREFIX):
+        raise ConfigError(
+            "Invalid Sernixa API key. Copy the complete one-time key from Team Settings; "
+            f"it must start with {API_KEY_PREFIX}."
+        )
+    return normalized
+
+
 def save_config(config: CliConfig) -> Path:
     path = config_path()
     path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
     temporary = path.with_suffix(".tmp")
-    temporary.write_text(json.dumps(asdict(config), indent=2) + "\n", encoding="utf-8")
+    payload = asdict(config)
+    if not payload["access_token"]:
+        payload.pop("access_token")
+    if payload["expires_at"] is None:
+        payload.pop("expires_at")
+    if payload["auth_type"] == "none":
+        payload.pop("auth_type")
+    temporary.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
     if os.name == "posix":
         temporary.chmod(0o600)
     temporary.replace(path)
@@ -98,6 +164,7 @@ def load_config(
     *, require_key: bool = True, base_url_override: str | None = None
 ) -> CliConfig:
     env_key = os.getenv("SERNIXA_API_KEY", "").strip()
+    env_access_token = os.getenv("SERNIXA_ACCESS_TOKEN", "").strip()
     env_base_url = os.getenv("SERNIXA_BASE_URL", "").strip()
     stored: dict[str, object] = {}
     path = config_path()
@@ -110,15 +177,28 @@ def load_config(
             raise ConfigError(f"Configuration file must contain a JSON object: {path}")
         stored = parsed
 
-    api_key = env_key or str(stored.get("api_key") or "").strip()
+    raw_api_key = env_key or str(stored.get("api_key") or "")
+    api_key = normalize_api_key(raw_api_key) if raw_api_key else ""
+    access_token = env_access_token or str(stored.get("access_token") or "").strip()
     base_url = normalize_base_url(
         base_url_override
         or env_base_url
         or str(stored.get("base_url") or DEFAULT_BASE_URL)
     )
-    if require_key and not api_key:
-        raise ConfigError("No API key configured. Run `sernixa auth login` first.")
-    return CliConfig(api_key=api_key, base_url=base_url)
+    if require_key and not (access_token or api_key):
+        raise ConfigError(
+            "No Sernixa credential configured. Run `sernixa auth login` first."
+        )
+    auth_type: Literal["none", "api_key", "user_session"] = (
+        "user_session" if access_token else "api_key" if api_key else "none"
+    )
+    return CliConfig(
+        api_key=api_key,
+        access_token=access_token,
+        base_url=base_url,
+        auth_type=auth_type,
+        expires_at=str(stored.get("expires_at")) if stored.get("expires_at") else None,
+    )
 
 
 def remove_config() -> bool:

{sernixa_cli-0.4.0 → sernixa_cli-0.4.2}/sernixa_cli/discovery.py

@@ -55,7 +55,7 @@ def _ensure_agent_ready(
     agent_config_path: Path,
 ) -> tuple[str, dict[str, Any], bool, dict[str, str]]:
     executable = _agent_executable()
-    agent_env = {"SERNIXA_DISCOVERY_TOKEN": config.api_key}
+    agent_env = {"SERNIXA_DISCOVERY_TOKEN": config.credential}
     initialized = False
     if not agent_config_path.exists():
         _run_agent(

{sernixa_cli-0.4.0 → sernixa_cli-0.4.2}/sernixa_cli/hooks.py

@@ -28,10 +28,15 @@ class HookInstallResult:
     status: str
     path: Path
     created: bool
-    backup_path: Path | None = None
+    backup_paths: tuple[Path, ...] = ()
     error: str | None = None
     manual_steps: list[str] | None = None
 
+    @property
+    def backup_path(self) -> Path | None:
+        """Return the first backup for compatibility with older callers."""
+        return self.backup_paths[0] if self.backup_paths else None
+
 
 @dataclass(frozen=True)
 class HookRepairResult:
@@ -61,7 +66,7 @@ def install_hook(target: str) -> HookInstallResult:
     try:
         resolution = resolve_local_agent_target(target)
         existed_before = resolution.selected_path.exists()
-        resolution, status, backup_path = install_target(target)
+        resolution, status, backup_paths = install_target(target)
     except HookInstallError as exc:
         resolution = resolve_local_agent_target(target)
         return HookInstallResult(
@@ -79,7 +84,7 @@ def install_hook(target: str) -> HookInstallResult:
         status=status,
         path=resolution.selected_path,
         created=not existed_before,
-        backup_path=backup_path,
+        backup_paths=backup_paths,
     )
 
 

sernixa_cli-0.4.2/sernixa_cli/lifecycle.py

@@ -0,0 +1,167 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from datetime import UTC, datetime
+from typing import Any, Literal
+
+
+LifecycleProvider = Literal["claude", "codex"]
+LIFECYCLE_EVENTS = {
+    "SessionStart",
+    "UserPromptSubmit",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "SubagentStart",
+    "SubagentStop",
+    "PreCompact",
+    "PostCompact",
+    "Stop",
+    "SessionEnd",
+}
+
+
+class LifecycleEventError(ValueError):
+    pass
+
+
+def parse_hook_event(content: str) -> dict[str, Any]:
+    stripped = content.strip()
+    if not stripped:
+        raise LifecycleEventError("Hook payload is empty.")
+    try:
+        parsed = json.loads(stripped)
+    except json.JSONDecodeError:
+        objects: list[dict[str, Any]] = []
+        for line_number, line in enumerate(content.splitlines(), start=1):
+            if not line.strip():
+                continue
+            try:
+                item = json.loads(line)
+            except json.JSONDecodeError as exc:
+                raise LifecycleEventError(
+                    f"Invalid hook JSON on line {line_number}."
+                ) from exc
+            if isinstance(item, dict):
+                objects.append(item)
+        if not objects:
+            raise LifecycleEventError("Hook payload must contain a JSON object.")
+        return objects[-1]
+    if not isinstance(parsed, dict):
+        raise LifecycleEventError("Hook payload must be a JSON object.")
+    return parsed
+
+
+def lifecycle_payload(
+    provider: LifecycleProvider,
+    event: dict[str, Any],
+    *,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    event_name = str(event.get("hook_event_name") or "")
+    if event_name not in LIFECYCLE_EVENTS:
+        raise LifecycleEventError(
+            f"Unsupported lifecycle event: {event_name or 'missing'}."
+        )
+    session_id = str(event.get("session_id") or "").strip()
+    if not session_id:
+        raise LifecycleEventError("Lifecycle hook payload is missing session_id.")
+
+    occurred_at = (now or datetime.now(UTC)).isoformat().replace("+00:00", "Z")
+    prompt_digest, prompt_bytes = _digest(event.get("prompt"))
+    input_digest, input_bytes = _digest(event.get("tool_input"))
+    output_digest, output_bytes = _digest(
+        _first_present(event, "tool_response", "tool_output", "output")
+    )
+    error_digest, error_bytes = _digest(
+        _first_present(event, "error", "error_message", "stderr")
+    )
+    status = _status(event_name)
+    payload: dict[str, Any] = {
+        "provider": provider,
+        "event_name": event_name,
+        "occurred_at": occurred_at,
+        "session_id": session_id,
+        "turn_id": _bounded_string(event.get("turn_id"), 256),
+        "tool_use_id": _bounded_string(event.get("tool_use_id"), 256),
+        "model": _bounded_string(event.get("model"), 256),
+        "tool_name": _bounded_string(event.get("tool_name"), 256),
+        "status": status,
+        "cwd_digest": _digest(event.get("cwd"))[0],
+        "prompt_digest": prompt_digest,
+        "prompt_bytes": prompt_bytes,
+        "input_digest": input_digest,
+        "input_bytes": input_bytes,
+        "output_digest": output_digest,
+        "output_bytes": output_bytes,
+        "error_digest": error_digest,
+        "error_bytes": error_bytes,
+        "start_source": _allowlisted(
+            event.get("source"), {"startup", "resume", "clear", "compact", "fork"}
+        ),
+        "stop_reason": _allowlisted(
+            event.get("reason"),
+            {
+                "completed",
+                "error",
+                "cancelled",
+                "clear",
+                "resume",
+                "logout",
+                "prompt_input_exit",
+                "bypass_permissions_disabled",
+                "other",
+            },
+        ),
+        "subagent_id": _bounded_string(
+            _first_present(event, "agent_id", "subagent_id"), 256
+        ),
+        "subagent_type": _bounded_string(
+            _first_present(event, "agent_type", "subagent_type"), 256
+        ),
+        "compact_trigger": _allowlisted(
+            _first_present(event, "trigger", "compact_trigger"), {"manual", "auto"}
+        ),
+    }
+    payload = {key: value for key, value in payload.items() if value is not None}
+    source = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+    payload["source_event_id"] = hashlib.sha256(source.encode("utf-8")).hexdigest()
+    return payload
+
+
+def _status(event_name: str) -> str:
+    if event_name in {"SessionStart", "SubagentStart"}:
+        return "started"
+    if event_name == "PostToolUse":
+        return "succeeded"
+    if event_name == "PostToolUseFailure":
+        return "failed"
+    if event_name in {"Stop", "SessionEnd", "SubagentStop"}:
+        return "stopped"
+    return "observed"
+
+
+def _digest(value: Any) -> tuple[str | None, int | None]:
+    if value is None:
+        return None, None
+    serialized = json.dumps(value, sort_keys=True, separators=(",", ":"), default=str)
+    encoded = serialized.encode("utf-8")
+    return f"sha256:{hashlib.sha256(encoded).hexdigest()}", len(encoded)
+
+
+def _first_present(event: dict[str, Any], *keys: str) -> Any:
+    for key in keys:
+        if event.get(key) is not None:
+            return event[key]
+    return None
+
+
+def _bounded_string(value: Any, limit: int) -> str | None:
+    if value in (None, ""):
+        return None
+    return str(value)[:limit]
+
+
+def _allowlisted(value: Any, allowed: set[str]) -> str | None:
+    normalized = str(value or "").strip().casefold()
+    return normalized if normalized in allowed else None