Skip to content

fix(sdk): align scan session attribution rules - #599

Merged
mldangelo-oai merged 3 commits into
mainfrom
mdangelo/codex/scan-session-attribution
Aug 21, 2026
Merged

fix(sdk): align scan session attribution rules#599
mldangelo-oai merged 3 commits into
mainfrom
mdangelo/codex/scan-session-attribution

Conversation

@mldangelo-oai

@mldangelo-oai mldangelo-oai commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

Summary

Follow-up to #589. Thanks to @Drewwb for the original directory-attribution fix and regression test.

Share the directory predicate between live cost tracking and saved logs, and fix the remaining timestamp and parentage cases that could include unrelated sessions in scan costs and trigger a budget limit early.

Changes

  • Share artifact-directory matching, timestamp parsing, and parent extraction in a small internal module. Keep the log reader's archived-path and completion-cutoff handling separate.
  • Preserve millisecond timestamps when deciding whether an independent session started during a scan. Treat invalid timestamps as unknown, and keep the second-based conversion at the forked-history replay boundary.
  • Only infer independent sessions from their working directory. Include child sessions through known parent links, including when a parent session arrives later.
  • Recognize nested source.subagent.thread_spawn.parent_thread_id, direct parent_thread_id, and forked_from_id, in that order, matching the bundled workbench. Ignore empty parent fields when considering a fallback.
  • Extend the original regression fixture to compare cost and saved-log membership, with Windows cross-drive, subsecond, invalid-timestamp, and unrelated-parent cases. Preserve coverage for legitimate workers, reducers, descendants, Windows casing, and trailing separators. Keep the metadata checks in the existing cost test file to preserve Windows CI shard assignments.
  • Make the saved-log directory tests run within the scan's time window so the directory checks are actually exercised. Add the shared module to the package allowlist.

Testing

Local macOS verification with Bun 1.3.14 and Node 24.15.0:

  • Confirmed five attribution regression failures before the initial implementation changes, then three fork-parent failures before addressing review feedback. The focused cost/log/metadata suite now passes all 64 tests, including legitimate descendants, unrelated forks, and inherited-history replay across all three parent formats.
  • Full SDK suite: 1,522 passed, 29 skipped, zero failures with seeds 12345 and 4081297345.
  • pnpm run types and pnpm run format: passed.
  • pnpm pack and pnpm run check:package: passed, including the installed public import, CLI, bundled plugin, and nested-worker smoke checks.
  • Additional compiled-Node QA: 52 POSIX/Windows/UNC path cases passed, along with tracker/log membership and budget-callback checks for directory bystanders and unrelated forks. Legitimate forked workers remain included.
  • git diff --check: passed.

The local Windows path checks use path.win32. The committed cross-drive and case-normalization fixtures are included in Windows CI. Those fixtures use synthetic session metadata and do not require a second physical drive or paid model calls.

Risk and rollout

No public CLI, API, schema, dependency, or output-format changes. Cost tracking rejects independently inferred sessions when a scan or session timestamp is unknown/invalid, the session predates the scan, or it declares an unrelated parent. Legitimate descendants still follow their parent association. Existing archived-scan handling and completed-scan time bounds remain unchanged in the log reader.

This aligns the shared directory and live-session metadata rules; it does not replace the historical log reader's additional selection rules.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

Share scan-directory matching and timestamp parsing between live cost tracking and saved logs. Preserve millisecond precision for ownership checks while keeping replay boundaries in seconds.

Require directory-associated sessions to be independent and follow known parent links for child sessions. Cover subsecond and invalid timestamps, unrelated and delayed parents, Windows drive and case handling, and packaged helper availability.
@github-actions github-actions Bot added the bug Something isn't working label Aug 21, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 21, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-08-21T14:48:34.721423Z 77d3b57 Manual request
🔒 Security Review Completed 2026-08-21T14:09:07.227191Z 7f4244c PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review commit 7f4244c, especially timestamp units, parent-session attribution, and preservation of forked-history replay.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7f4244cc8a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/src/cost.ts
Share parent extraction between live costs and saved logs, including
forked_from_id and the bundled workbench's parent-field precedence.
Cover legitimate descendants, unrelated forks, and inherited usage replay
for all three supported parent metadata formats.
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review commit 1cd043d, including shared parent-field precedence, fork attribution, and inherited-usage replay. The previous fork-parent finding is addressed in this commit.

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex security review

Please review commit 1cd043d. The session ownership rules now recognize forked_from_id as parentage in both readers.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 1cd043da8c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex security review

Please run the security review on current head 1cd043d. The code review has completed on this head, but the review summary still lists the security review for the previous commit.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 1cd043da8c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Keep all seven parent-format checks in the existing cost suite so this
follow-up does not reshuffle unrelated Windows CI shards. Production code
and assertions are unchanged.
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review current head 77d3b57, including timestamp units, parent-field precedence, and inherited-history replay. The final commit keeps the seven parent-metadata checks in the existing cost suite so Windows CI shard assignments stay unchanged; production code and assertions are unchanged from the previously reviewed runtime fix.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 77d3b57c1e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai
mldangelo-oai merged commit ab038a5 into main Aug 21, 2026
56 of 59 checks passed
@mldangelo-oai
mldangelo-oai deleted the mdangelo/codex/scan-session-attribution branch August 21, 2026 17:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants