Skip to content

Add GitHub Copilot parser and fix incremental timestamps for resumed sessions #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
barisozbas merged 5 commits into from
Sep 12, 2026
Merged

Add GitHub Copilot parser and fix incremental timestamps for resumed sessions #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
bdcf83a
Add GitHub Copilot parser and fix incremental timestamps for resumed …
zzzLi-56 Aug 12, 2026
5fd4758
Add GitHub Copilot parser and fix incremental timestamps for resumed …
zzzLi-56 Aug 12, 2026
30d2982
Fix incremental exports for Codex and Copilot
zzzLi-56 Sep 1, 2026
0b6dee1
Merge main and add Copilot history filtering
barisozbas Sep 12, 2026
7ad6978
Document cross-platform Copilot CLI support
barisozbas Sep 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

[![uber/ADR | Trendshift](https://trendshift.io/api/badge/repositories/100696)](https://trendshift.io/repositories/100696?utm_source=repository-badge&utm_medium=badge&utm_campaign=badge-repository-100696)

ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It helps organizations secure employee-facing agents such as Cursor, Claude Code, and Codex, as well as customer-facing agents such as AI support agents.
ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It helps organizations secure employee-facing agents such as Cursor, Claude Code, Codex, and GitHub Copilot CLI, as well as customer-facing agents such as AI support agents.

ADR is **deployed in production at Uber**, and the accompanying paper was accepted to **MLSys 2026**: [Paper PDF](docs/adr-paper.pdf) · [Slides PDF](docs/adr-mlsys-2026-slides.pdf)

Expand All @@ -23,7 +23,7 @@ This repository contains the open-source **ADR Discovery**, **ADR Sensor**, **AD
| Path | ADR component | Description |
| -------------------------------------------------- | -------------------------- | ------------------------------------------------------------------------------------ |
| [Discovery/](Discovery/) | ADR Discovery | Inventory the AI apps, CLI agents, IDE extensions, model runtimes, and MCP servers on an endpoint, and flag unknown surfaces for review |
| [Sensor/](Sensor/) | ADR Observability | Collect and normalize agent telemetry from Claude Code, Cursor, Codex, opencode, Claude Desktop, and others |
| [Sensor/](Sensor/) | ADR Observability | Collect and normalize agent telemetry from Claude Code, Cursor, Codex, GitHub Copilot CLI, opencode, Claude Desktop, and others |
| [Detection/](Detection/) | ADR Benchmark + Detection | Dual-agent detector, 134 MCP servers, 304 benchmark tasks, baselines, figure scripts |
| [docs/REPRODUCIBILITY.md](docs/REPRODUCIBILITY.md) | Evaluation | Step-by-step workflow to reproduce benchmark detection and paper figures |

Expand Down
36 changes: 32 additions & 4 deletions Sensor/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ ADR Sensor is a Python library that collects telemetry from AI coding agents to
| **Cline (Claude Dev)** | `cline` | JSON task files | macOS, Linux, Windows |
| **Claude Desktop** | `claude_desktop` | JSONL audit logs | macOS, Windows |
| **OpenAI Codex CLI** | `codex` | JSONL + SQLite path catalogs | macOS, Linux, Windows |
| **GitHub Copilot CLI** | `copilot` | JSONL (`~/.copilot/session-state/`) | macOS, Linux, Windows |
| **Warp Terminal** | `warp` | SQLite (`warp.sqlite`) | macOS, Windows |
| **opencode** | `opencode` | SQLite (`opencode.db`) or JSON tree | macOS, Linux |

Expand Down Expand Up @@ -50,6 +51,30 @@ files found under `sessions/`; malformed timestamps fall back to file modificati
time. Pass `max_age_days` to `CodexParser` or `AgentObserver` to customize the
lookback; values less than or equal to zero disable age filtering for `CodexParser`.

### GitHub Copilot CLI

The `copilot` source reads each GitHub Copilot CLI session's `events.jsonl` and
optional `workspace.yaml` and `vscode.metadata.json` files. Copilot CLI uses the
same home-relative configuration directory on every supported operating system;
it does not use `Library/Application Support` or `AppData` for session history:

| Operating system | Default session directory |
| ---------------- | ------------------------- |
| macOS | `/Users/<user>/.copilot/session-state/` |
| Linux | `/home/<user>/.copilot/session-state/` |
| Windows | `%USERPROFILE%\.copilot\session-state\` (typically `C:\Users\<user>\.copilot\session-state\`) |

Set `COPILOT_HOME` for both Copilot CLI and ADR Sensor when the CLI configuration
directory has been moved; the Sensor then reads `$COPILOT_HOME/session-state/`.
Copilot CLI's legacy `--config-dir` option is deprecated in favor of this
environment variable. These locations and the override are defined by the
[Copilot CLI configuration directory reference](https://docs.github.com/copilot/reference/copilot-cli-reference/cli-config-dir-reference).

The parser applies a 14-day lookback using each `events.jsonl` modification time.
Use `--all-history` to include older sessions. This source covers GitHub Copilot
CLI session state only; it does not read the separate storage used by the VS Code
Copilot Chat extension.

### opencode

[opencode](https://github.com/sst/opencode) uses the XDG layout on every platform,
Expand All @@ -72,10 +97,10 @@ its `server_name` populated.
```
┌─────────────────────────────────────────────────────────────────┐
│ AI Agent Logs │
│ Claude Code │ Cursor │ Cline │ Codex │ Warp │ Desktop │ opencode│
└──────┬──────┴───┬────┴───┬───┴───┬───┴──┬───┴───┬────┴─────┬────┘
│ │ │ │ │ │ │
▼ ▼ ▼ ▼ ▼ ▼ ▼
│ Claude, Cursor, Cline, Codex, Copilot CLI, Warp │
│ Claude Desktop, opencode │
└───────────────────────────────┬─────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────────┐
│ Source-Specific Parsers │
│ (Each implements BaseParser) │
Expand Down Expand Up @@ -127,6 +152,7 @@ adr-sensor
adr-sensor --source claude
adr-sensor --source cursor
adr-sensor --source codex
adr-sensor --source copilot
adr-sensor --source claude_desktop
adr-sensor --source opencode

Expand Down Expand Up @@ -348,6 +374,7 @@ cannot run on the current platform are skipped rather than failing.
| Variable | Read by | Effect |
| ----------------- | -------------------------- | ----------------------------------------------------------------- |
| `CODEX_HOME` | Codex parser | Codex data root containing `sessions/` and optional `state_*.sqlite` catalogs (default `~/.codex`) |
| `COPILOT_HOME` | Copilot parser | Copilot CLI data root containing `session-state/` (default `~/.copilot`) |
| `XDG_CACHE_HOME` | `AgentObserver` | Base for `--save-sessions` output (`$XDG_CACHE_HOME/adr_sensor`, default `~/.cache/adr_sensor`) |
| `XDG_DATA_HOME` | opencode parser | Overrides the opencode data directory (default `~/.local/share/opencode`) |
| `OPENCODE_DB` | opencode parser | Overrides the opencode SQLite filename or path (`:memory:` is ignored) |
Expand Down Expand Up @@ -399,6 +426,7 @@ adr-sensor/
│ │ ├── cline_parser.py
│ │ ├── claude_desktop_parser.py
│ │ ├── codex_parser.py
│ │ ├── copilot_parser.py
│ │ ├── opencode_parser.py
│ │ └── warp_parser.py
│ ├── schemas/
Expand Down
6 changes: 3 additions & 3 deletions Sensor/adr_sensor/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
ADR Sensor - Agentic Detection & Response

Security observability library for AI coding agents. Collects telemetry from
Claude Code, Cursor, Cline, OpenAI Codex CLI, Warp Terminal, opencode, and
Claude Desktop Agent Mode (including Dispatch sessions) to enable threat
detection and security monitoring.
Claude Code, Cursor, Cline, OpenAI Codex CLI, GitHub Copilot CLI, Warp
Terminal, opencode, and Claude Desktop Agent Mode (including Dispatch
sessions) to enable threat detection and security monitoring.

Usage:
from adr_sensor import AgentObserver
Expand Down
1 change: 1 addition & 0 deletions Sensor/adr_sensor/cli.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ def main():
adr-sensor --source claude Ingest Claude Code logs only
adr-sensor --source cursor Ingest Cursor IDE logs only
adr-sensor --source claude_desktop Ingest Claude Desktop agent-mode logs only (macOS/Windows)
adr-sensor --source copilot Ingest GitHub Copilot CLI logs only
adr-sensor --source opencode Ingest opencode logs only
adr-sensor --save-sessions Save individual session files
adr-sensor --output-format jsonl Export as JSONL
Expand Down
Loading