From e50b44e1016d5a3f771431d174d750d63e6357f3 Mon Sep 17 00:00:00 2001
From: "Ioannis L." <44038245+blitzcrieg1@users.noreply.github.com>
Date: Sat, 7 Nov 2026 21:19:40 +0200
Subject: [PATCH] fix(account): find Codex's session file when the hook's path
 does not match

The first real Codex session after #395 recorded no account, although its session
file existed and held both IDs. The read only accepted a plain path under Codex's
home, so a Windows extended path was rejected, and a missing path gave up.

It now accepts the extended form, and when the path is missing or unusable it finds
the file by the session ID in its name. The ID is checked first, so a crafted value
cannot widen the search, and the search stays inside Codex's sessions folder.

What Codex actually sent is not known, so which of the two was the cause is not
proven. A real session after merge decides whether this fixed it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                                     |  2 +-
 apps/orchestrator/agentmetry/core/account.py  | 34 +++++++++++++++----
 apps/orchestrator/tests/test_codex_account.py | 32 +++++++++++++++++
 docs/agentmetry-event-schema.md               |  3 +-
 4 files changed, 63 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 2b7f409..830bdc1 100644
--- a/README.md
+++ b/README.md
@@ -155,7 +155,7 @@ These are the numbers from commands, not from a slide.
 
 That block is what `agentmetry benchmark` printed from the PyPI 0.9.4 package and from this tree. "Rules covered 13" counts rule ids named in corpus expectations. Twelve of those are published rules. The thirteenth is the experimental rule. Two published rules have no corpus case: `host-subagent-swarm-burst` and `off-hours-activity`. They are named in `apps/orchestrator/tools/generate_sigma_pack.py` so the Sigma pack still has them.
 
-2258 tests collected (`pytest --collect-only -q` from `apps/orchestrator`). The
+2269 tests collected (`pytest --collect-only -q` from `apps/orchestrator`). The
 [0.10.6 release PR's CI run](https://github.com/blitzcrieg1/agentmetry/actions/runs/42082231888)
 on Python 3.12 reported 2089 passed and 19 skipped on Linux and macOS,
 2102 passed and 6 skipped on Windows, and 82.13% line coverage on Linux
diff --git a/apps/orchestrator/agentmetry/core/account.py b/apps/orchestrator/agentmetry/core/account.py
index acb7448..6eb56a1 100644
--- a/apps/orchestrator/agentmetry/core/account.py
+++ b/apps/orchestrator/agentmetry/core/account.py
@@ -26,6 +26,7 @@
 )
 #: The first line of a Codex session file also holds its base instructions.
 _SESSION_META_MAX_BYTES = 1024 * 1024
+_WINDOWS_EXTENDED_PREFIX = chr(92) * 2 + "?" + chr(92)
 _CLAUDE_AUTH_OVERRIDE_VARS = (
     "ANTHROPIC_API_KEY",
     "ANTHROPIC_AUTH_TOKEN",
@@ -244,7 +245,30 @@ def _local_antigravity_account() -> dict[str, str]:
         return {}
 
 
-def _codex_session_account(transcript_path: Any) -> dict[str, str]:
+def _codex_session_file(home: Path, transcript_path: Any, session_id: Any) -> Path | None:
+    """Find the session file, from the path the hook named or else from its ID.
+
+    Windows tools can hand over the extended form of a path, which would not
+    match Codex's home. A session with no usable path is found by its ID, which
+    Codex puts in the file name.
+    """
+    if isinstance(transcript_path, str) and transcript_path.endswith(".jsonl"):
+        text = transcript_path
+        if text.startswith(_WINDOWS_EXTENDED_PREFIX):
+            text = text[len(_WINDOWS_EXTENDED_PREFIX) :]
+        path = Path(text).resolve()
+        if path.is_relative_to(home) and path.is_file():
+            return path
+    session = _clean_id(session_id)
+    if not session or not session.replace("-", "").isalnum():
+        return None
+    # sessions/YYYY/MM/DD/rollout-<time>-<session id>.jsonl
+    for path in (home / "sessions").glob(f"*/*/*/rollout-*-{session}.jsonl"):
+        return path.resolve()
+    return None
+
+
+def _codex_session_account(transcript_path: Any, session_id: Any = "") -> dict[str, str]:
     """Read Codex's account IDs from the first line of its session file.
 
     Hook input names the file, but that format is not a stable interface and
@@ -253,13 +277,11 @@ def _codex_session_account(transcript_path: Any) -> dict[str, str]:
     read past the first line, and `auth.json` is never touched: it holds
     credentials, and a security sensor has no business opening it.
     """
-    if not isinstance(transcript_path, str) or not transcript_path.endswith(".jsonl"):
-        return {}
     try:
         configured = os.environ.get("CODEX_HOME", "").strip()
         home = (Path(configured) if configured else Path.home() / ".codex").resolve()
-        path = Path(transcript_path).resolve()
-        if not path.is_relative_to(home) or not path.is_file():
+        path = _codex_session_file(home, transcript_path, session_id)
+        if path is None:
             return {}
         with path.open("rb") as handle:
             line = handle.readline(_SESSION_META_MAX_BYTES + 1)
@@ -289,7 +311,7 @@ def account_for_hook(source_app: str, data: dict[str, Any]) -> dict[str, str]:
     if source == "claude":
         return _local_claude_account()
     if source == "codex":
-        return _codex_session_account(data.get("transcript_path"))
+        return _codex_session_account(data.get("transcript_path"), data.get("session_id"))
     if source == "antigravity":
         return _local_antigravity_account()
     return {}
diff --git a/apps/orchestrator/tests/test_codex_account.py b/apps/orchestrator/tests/test_codex_account.py
index 0d20871..63297cf 100644
--- a/apps/orchestrator/tests/test_codex_account.py
+++ b/apps/orchestrator/tests/test_codex_account.py
@@ -49,6 +49,38 @@ def test_the_ids_come_from_the_session_file(codex_home: Path):
     }
 
 
+def test_the_windows_extended_form_of_the_path_is_accepted(codex_home: Path):
+    path = _session(codex_home)
+    extended = chr(92) * 2 + "?" + chr(92) + str(path)
+    assert account_for_hook("codex", {"transcript_path": extended})["account_id"] == "workspace-1"
+
+
+def test_a_session_with_no_path_is_found_by_its_id(codex_home: Path):
+    session = "01a1a857-aaaa-bbbb-cccc-000000000000"
+    _session(codex_home, name=f"rollout-2026-11-07T10-00-00-{session}.jsonl")
+    assert account_for_hook("codex", {"session_id": session})["account_id"] == "workspace-1"
+    assert account_for_hook("codex", {"transcript_path": None, "session_id": session})["user_id"] == "user-1"
+
+
+def test_a_path_that_fails_falls_back_to_the_id(codex_home: Path, tmp_path: Path):
+    session = "01a1a857-aaaa-bbbb-cccc-000000000000"
+    _session(codex_home, name=f"rollout-2026-11-07T10-00-00-{session}.jsonl")
+    outside = _session(tmp_path / "elsewhere", {"creator_account_id": "not-this-one"})
+    block = account_for_hook("codex", {"transcript_path": str(outside), "session_id": session})
+    assert block["account_id"] == "workspace-1"
+
+
+def test_another_session_id_does_not_match(codex_home: Path):
+    _session(codex_home, name="rollout-2026-11-07T10-00-00-01a1a857-aaaa.jsonl")
+    assert account_for_hook("codex", {"session_id": "01a1a857-bbbb"}) == {}
+
+
+@pytest.mark.parametrize("session", ["*", "..", "a/b", "a*", "../../etc", "rollout", ""])
+def test_a_crafted_session_id_cannot_widen_the_search(codex_home: Path, session: str):
+    _session(codex_home, name="rollout-2026-11-07T10-00-00-01a1a857-aaaa.jsonl")
+    assert account_for_hook("codex", {"session_id": session}) == {}
+
+
 def test_a_file_outside_codex_home_is_not_opened(codex_home: Path, tmp_path: Path):
     outside = _session(tmp_path / "elsewhere")
     assert account_for_hook("codex", {"transcript_path": str(outside)}) == {}
diff --git a/docs/agentmetry-event-schema.md b/docs/agentmetry-event-schema.md
index 3189210..4c88965 100644
--- a/docs/agentmetry-event-schema.md
+++ b/docs/agentmetry-event-schema.md
@@ -158,7 +158,8 @@ federation, or routed-access environment state selects another credential.
 `ANTHROPIC_BASE_URL=https://api.anthropic.com` is the one exception: its
 official host keeps the fallback, while other, look-alike, or malformed URLs
 skip it. Codex's hook input has no account field, but it names the session file,
-whose first line carries `creator_account_id` and `creator_user_id`. Those arrive
+whose first line carries `creator_account_id` and `creator_user_id`. If the path
+is missing or unusable, the file is found by session ID in its name. Those arrive
 as `account_id` and `user_id` with source `session_meta`. That format is not a
 stable interface and can change between versions, and only a file under Codex's
 home (`CODEX_HOME`, else `~/.codex`) is opened. `auth.json` is never read, because