fix(cli): the codex harvest reads the checkout, so a session reports the branch it is on (langwatch#7415)

* fix(cli): the codex harvest reads the checkout, so a session reports the branch it is on

A codex session could not attribute to a pull request. The harvest built its
session-context record from the rollout's session_meta alone, and codex writes
git identity there only when the session STARTED inside a repository, then never
revises it.

Both halves of that hurt. Every agent on our box starts codex a directory above
its checkouts, so session_meta carries `git: null` and the session reported no
repository for its whole life, however many pull requests it reviewed. A session
that does start inside a checkout is no better off over time: it reports the
branch it opened with, so a reviewer moving from one pull request to the next
keeps naming the first.

The harvest runs on the machine that ran the turn, moments after it, so it now
reads the working directory itself through the same helper the claude hook uses,
and keeps the transcript's values as the fallback for a rollout harvested away
from its checkout.

Verified on the agents box: a codex turn in a checkout on a pull request's branch
reported github.com/langwatch/langwatch@feat/home-pill-setup-menu, and the
pull-request usage API attributed 38,473 tokens to that pull request. Before this
the same session reported nothing at all.

Claude-Session: https://claude.ai/code/session_01BUKKUiZbSBHmrLK9JJj4Ba

* test(cli): one contextAttr helper, taking named parameters

The new module-scope helper took positional parameters, against the repo
convention for functions with several arguments, and it collided with a
describe-scoped helper of the same name that already took named ones. The
inner one shadowed it, so the file carried two helpers with one name and
two different signatures.

There is now one helper, at module scope, taking named parameters. It keeps
the inner one's guard on the logs POST being present, which reports a
missing session-context record instead of throwing a TypeError that hides
which expectation failed.

Claude-Session: https://claude.ai/code/session_01BUKKUiZbSBHmrLK9JJj4Ba

Author: rogeriochaves

sdks/typescript/src/cli/utils/governance/__tests__/codex-turn-harvest.unit.test.ts

@@ -110,6 +110,37 @@ const spansOf = (bodies: any[]) =>
 const attrOf = (span: any, key: string) =>
 	span.attributes.find((a: any) => a.key === key)?.value?.stringValue;
 
+/** One attribute of the session-context record, from the logs POST. */
+const contextAttr = ({
+	bodies,
+	urls,
+	key,
+}: {
+	bodies: any[];
+	urls: string[];
+	key: string;
+}) => {
+	const at = urls.indexOf("https://e/v1/logs");
+	// Without this the missing POST reads as `bodies[-1]` and the chain
+	// throws a TypeError, which hides which expectation actually failed.
+	expect(at, "no session-context record was posted").toBeGreaterThan(-1);
+	return attrOf(bodies[at].resourceLogs[0].scopeLogs[0].logRecords[0], key);
+};
+
+/**
+ * A working directory git answers for: the checkout the session is sitting in,
+ * on the branch it is on right now, which is what the harvest reads instead of
+ * trusting the transcript's record of the session's first minute.
+ */
+const checkoutOn =
+	(branch: string) =>
+	({ args }: { args: string[]; cwd: string }): string | null => {
+		if (args[0] === "remote") return "https://github.com/acme/acme-app.git";
+		if (args[0] === "branch") return branch;
+		// Not a linked worktree, so readWorktreeName finds nothing to name.
+		return null;
+	};
+
 describe("harvestCodexThread", () => {
 	describe("given a session that ran without the langwatch wrapper", () => {
 		describe("when its completed turn is harvested", () => {
@@ -353,6 +384,94 @@ describe("harvestCodexThread", () => {
 				expect(urls).toContain("https://e/v1/traces");
 			});
 
+			/** @scenario "The reported branch follows the checkout, not the session's first minute" */
+			it("reports the branch the checkout is on now", async () => {
+				writeRollout(THREAD, [
+					sessionMeta(GIT),
+					taskStarted(TRACE),
+					userMessage("hi"),
+					agentFinal("hello"),
+				]);
+				const { bodies, urls, impl } = recordingFetch();
+
+				await harvestCodexThread({
+					threadId: THREAD,
+					nowMs: 1785654950000,
+					endpoint: "https://e/v1/traces",
+					logsEndpoint: "https://e/v1/logs",
+					token: "sk-lw-test",
+					sessionsRoot: root,
+					stateDir,
+					fetchImpl: impl,
+					runGit: checkoutOn("review/pr-7412"),
+				});
+
+				expect(contextAttr({ bodies, urls, key: "vcs.ref.head.name" })).toBe(
+					"review/pr-7412",
+				);
+				expect(contextAttr({ bodies, urls, key: "vcs.repository.name" })).toBe(
+					"acme-app",
+				);
+			});
+
+			/** @scenario "A session whose transcript records no repository still reports one" */
+			it("reports the working directory's repository when the transcript has none", async () => {
+				writeRollout(THREAD, [
+					sessionMeta(),
+					taskStarted(TRACE),
+					userMessage("hi"),
+					agentFinal("hello"),
+				]);
+				const { bodies, urls, impl } = recordingFetch();
+
+				await harvestCodexThread({
+					threadId: THREAD,
+					nowMs: 1785654950000,
+					endpoint: "https://e/v1/traces",
+					logsEndpoint: "https://e/v1/logs",
+					token: "sk-lw-test",
+					sessionsRoot: root,
+					stateDir,
+					fetchImpl: impl,
+					runGit: checkoutOn("review/pr-7412"),
+				});
+
+				expect(contextAttr({ bodies, urls, key: "vcs.repository.owner" })).toBe("acme");
+				expect(contextAttr({ bodies, urls, key: "vcs.ref.head.name" })).toBe(
+					"review/pr-7412",
+				);
+			});
+
+			/** @scenario "A transcript harvested away from its checkout keeps what codex recorded" */
+			it("falls back to the transcript when git cannot read the directory", async () => {
+				writeRollout(THREAD, [
+					sessionMeta(GIT),
+					taskStarted(TRACE),
+					userMessage("hi"),
+					agentFinal("hello"),
+				]);
+				const { bodies, urls, impl } = recordingFetch();
+
+				await harvestCodexThread({
+					threadId: THREAD,
+					nowMs: 1785654950000,
+					endpoint: "https://e/v1/traces",
+					logsEndpoint: "https://e/v1/logs",
+					token: "sk-lw-test",
+					sessionsRoot: root,
+					stateDir,
+					fetchImpl: impl,
+					runGit: () => null,
+				});
+
+				expect(contextAttr({ bodies, urls, key: "vcs.ref.head.name" })).toBe(
+					"feat/pricing",
+				);
+				expect(contextAttr({ bodies, urls, key: "vcs.repository.name" })).toBe(
+					"acme-app",
+				);
+			});
+
 			/** @scenario "A notify that fires after every turn posts the repository once" */
 			it("does not re-post an unchanged context on the next turn", async () => {
 				writeRollout(THREAD, [
@@ -444,24 +563,6 @@ describe("harvestCodexThread", () => {
 				fetchImpl: impl,
 			});
 
-		const contextAttr = ({
-			bodies,
-			urls,
-			key,
-		}: {
-			bodies: any[];
-			urls: string[];
-			key: string;
-		}) => {
-			const at = urls.indexOf("https://e/v1/logs");
-			// Without this the missing POST reads as `bodies[-1]` and the chain
-			// throws a TypeError, which hides which expectation actually failed.
-			expect(at, "no session-context record was posted").toBeGreaterThan(-1);
-			return bodies[at].resourceLogs[0].scopeLogs[0].logRecords[0].attributes.find(
-				(a: any) => a.key === key,
-			)?.value?.stringValue;
-		};
-
 		describe("when the session is harvested", () => {
 			/** @scenario "The harvest names the session by the first thing the user asked" */
 			it("posts the prompt's first line as the session title", async () => {

sdks/typescript/src/cli/utils/governance/codex-rollout-otlp.ts

@@ -9,6 +9,11 @@ import { createHash } from "node:crypto";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import {
+  type GitRunner,
+  readSessionContext,
+  runGitCommand,
+} from "@/cli/commands/ingestion/git-context";
 import { LANGWATCH_SDK_VERSION } from "@/internal/constants";
 import { GovernanceCliError } from "./cli-api";
 import {
@@ -216,6 +221,7 @@ export async function harvestCodexThread(args: {
   sessionsRoot?: string;
   stateDir?: string;
   fetchImpl?: typeof fetch;
+  runGit?: GitRunner;
 }): Promise<number> {
   const root = args.sessionsRoot ?? defaultCodexSessionsRoot();
   const file = await findRolloutForThread(args.threadId, root);
@@ -236,6 +242,7 @@ export async function harvestCodexThread(args: {
     threadName: meta?.sessionId ? threadNames.get(meta.sessionId) : null,
     stateDir: args.stateDir,
     fetchImpl: args.fetchImpl,
+    runGit: args.runGit,
   });
   const recent = turns.slice(-RECENT_TURN_WINDOW);
   if (recent.length === 0) return 0;
@@ -371,6 +378,44 @@ async function postCodexTurns(args: {
  * the grammar cannot read, or a refused POST emits nothing and reports false,
  * because the content spans riding beside this are worth posting either way.
  */
+/**
+ * Which repository and branch a codex session is working in.
+ *
+ * The rollout's own `session_meta` is the weaker of the two sources and is
+ * consulted second. Codex fills it only when the session STARTED inside a
+ * repository, and never revises it: a reviewer that checks out one pull
+ * request's branch after another still reports the branch it opened with, and a
+ * session started a directory above the checkout reports nothing for its whole
+ * life, however much repository work it does. Codex has no equivalent of a
+ * native worktree switch, so that first directory is the session for good.
+ *
+ * The harvest runs on the machine that ran the turn, moments after it, so the
+ * working directory can be read directly and answers for the turn being
+ * harvested rather than for the session's first minute. The rollout's values
+ * stay as the fallback, which is what a transcript harvested on another machine
+ * (or after the checkout is gone) still has.
+ */
+function codexSessionContext({
+  meta,
+  runGit,
+}: {
+  meta: CodexRolloutMeta;
+  runGit: GitRunner;
+}): SessionContext | null {
+  const live = meta.cwd
+    ? readSessionContext({ directory: meta.cwd, runGit })
+    : null;
+  if (live) return live;
+  const repository = meta.gitRepositoryUrl
+    ? parseGitRemoteUrl(meta.gitRepositoryUrl)
+    : null;
+  if (!repository) return null;
+  return {
+    repository,
+    ...(meta.gitBranch ? { branch: meta.gitBranch } : {}),
+  };
+}
+
 export async function postCodexSessionContext(args: {
   meta: CodexRolloutMeta | null;
   nowMs: number;
@@ -380,28 +425,34 @@ export async function postCodexSessionContext(args: {
   threadName?: string | null;
   stateDir?: string;
   fetchImpl?: typeof fetch;
+  runGit?: GitRunner;
 }): Promise<boolean> {
-  const { meta, nowMs, logsEndpoint, token, threadName, stateDir, fetchImpl } =
-    args;
+  const {
+    meta,
+    nowMs,
+    logsEndpoint,
+    token,
+    threadName,
+    stateDir,
+    fetchImpl,
+    runGit,
+  } = args;
   if (!logsEndpoint) return false;
   if (!meta?.sessionId) return false;
-  const repository = meta.gitRepositoryUrl
-    ? parseGitRemoteUrl(meta.gitRepositoryUrl)
-    : null;
   const title = meta.firstUserMessage
     ? sessionTitleFromPrompt(meta.firstUserMessage)
     : null;
   const name = normalizeSessionName(threadName);
+  const context = codexSessionContext({
+    meta,
+    runGit: runGit ?? runGitCommand,
+  });
   // A codex session appears in the sessions screen only through this
   // record, so a session outside any repository still posts one as long
   // as there is a name to carry. With no identity and no name there is
   // nothing to say.
-  if (!repository && !title && !name) return false;
-  const context: SessionContext = {
-    ...(repository ? { repository } : {}),
-    ...(meta.gitBranch ? { branch: meta.gitBranch } : {}),
-  };
-  const fingerprint = sessionContextFingerprint(context, { title, name });
+  if (!context && !title && !name) return false;
+  const fingerprint = sessionContextFingerprint(context ?? {}, { title, name });
   const stateFile = stateFilePath({
     stateDir: stateDir ?? defaultStateDir(),
     agent: "codex",
@@ -411,7 +462,7 @@ export async function postCodexSessionContext(args: {
   const payload = buildSessionContextLogPayload({
     sessionId: meta.sessionId,
     agent: "codex",
-    context,
+    context: context ?? {},
     timeUnixNano: `${nowMs}000000`,
     scopeVersion: LANGWATCH_SDK_VERSION,
     // Codex withholds prompt text from its own events, so the transcript's
@@ -484,6 +535,7 @@ async function postCodexSessionContexts(args: {
   threadNames?: Map<string, string>;
   stateDir?: string;
   fetchImpl?: typeof fetch;
+  runGit?: GitRunner;
 }): Promise<void> {
   const { metas, threadNames, ...post } = args;
   if (metas.length === 0) return;
@@ -537,6 +589,7 @@ export async function harvestAndEmitCodexIO(args: {
   sessionsRoot?: string;
   stateDir?: string;
   fetchImpl?: typeof fetch;
+  runGit?: GitRunner;
 }): Promise<number> {
   const {
     sinceMs,
@@ -547,6 +600,7 @@ export async function harvestAndEmitCodexIO(args: {
     sessionsRoot,
     stateDir,
     fetchImpl,
+    runGit,
   } = args;
   const root = sessionsRoot ?? defaultCodexSessionsRoot();
   const { turns, metas } = await readRollouts({
@@ -561,6 +615,7 @@ export async function harvestAndEmitCodexIO(args: {
     threadNames: await readCodexThreadNames(codexSessionIndexPath(root)),
     stateDir,
     fetchImpl,
+    runGit,
   });
   if (turns.length === 0) return 0;
   await postCodexTurns({ turns, nowMs, endpoint, token, fetchImpl });
@@ -585,6 +640,7 @@ export function createCodexIOStreamer(args: {
   sessionsRoot?: string;
   stateDir?: string;
   fetchImpl?: typeof fetch;
+  runGit?: GitRunner;
 }): { harvest: (nowMs: number) => Promise<number> } {
   const root = args.sessionsRoot ?? defaultCodexSessionsRoot();
   const emitted = new Set<string>();
@@ -606,6 +662,7 @@ export function createCodexIOStreamer(args: {
         threadNames: await readCodexThreadNames(codexSessionIndexPath(root)),
         stateDir: args.stateDir,
         fetchImpl: args.fetchImpl,
+        runGit: args.runGit,
       });
       const fresh = turns.filter((t) => t.traceId && !emitted.has(t.traceId));
       if (fresh.length === 0) return 0;

specs/ai-governance/cli-wrappers/codex-rollout-io.feature

@@ -138,13 +138,39 @@ Feature: Codex Path B recovers the full request body from the rollout transcript
     branch (which is what links it to its pull request) with no hooks.json
     entry and no per-hook trust grant.
 
+    What codex recorded is the weaker source and is read second. It is written
+    only when the session started inside a repository, and it is never revised,
+    so a reviewer that checks out one pull request's branch after another would
+    report the branch it opened with for the rest of its life. The harvest runs
+    on the machine that ran the turn, moments after it, so it reads the working
+    directory itself and answers for the turn it is harvesting.
+
     @unit
     Scenario: The harvest reports the repository the session worked on
       Given a rollout whose session_meta names a remote and a branch
       When the completed turn is harvested
       Then one session-context record posts beside the conversation
       And the codex session gains its repository and branch
 
+    @unit
+    Scenario: The reported branch follows the checkout, not the session's first minute
+      Given a session that has moved its checkout to another branch since it started
+      When the completed turn is harvested
+      Then the record names the branch the checkout is on now
+
+    @unit
+    Scenario: A session whose transcript records no repository still reports one
+      Given a rollout whose session_meta records no git identity
+      And a working directory that is a checkout
+      When the completed turn is harvested
+      Then the record names the repository of that working directory
+
+    @unit
+    Scenario: A transcript harvested away from its checkout keeps what codex recorded
+      Given a rollout whose working directory cannot be read as a repository
+      When the completed turn is harvested
+      Then the record falls back to the remote and branch in the session_meta
+
     @unit
     Scenario: A notify that fires after every turn posts the repository once
       Given a session whose context was already posted