Report why a Copilot turn never reaches the gateway

[anonpran]

Why

build_exchange_from_transcript has four exits that return None, and none of them logs anything (grep -c log_error over the function returns 0). A None exchange then fails the gate in the Stop handler:

if exchange and (forwarded_now or text_sig != last_text_sig or usage):

send_to_api is never called and the hook exits 0. The turn is never attempted live and never reported as missing — from our side it simply never existed.

Backfill later reads the same transcript files from disk and recovers it, which is why usage reappears days later tagged backfilled=true.

Evidence (Xome, org 3604)

38 applications have 574 backfilled rows dated after their live traffic had already started. If backfill only seeded history, that set would be empty.

Backfill genuinely carries historical conversations — for app 13559, live rows land 0.1 h after the conversation, backfilled rows land 212 h later (max 425 h).

Two distinct causes:

user	api_call errors (30d)	backfilled after live
Ameer.Khan	270	284
Ahsan.Amir	12	13
Ramya.Kumar	0	77
Veronika.S	0	33

The first two track send failures (the 413s). The last two have no hook errors at all — nothing failed because nothing was tried. That is the path this PR makes visible.

What

A distinct log_error(..., 'transcript') at each of the four exits:

line	condition
5167	transcript missing or not yet written
5182	transcript unreadable
5230	turn start anchor not found
5390	no messages assembled

The bare except Exception at 5182 is narrowed to (OSError, UnicodeDecodeError). Anything else now propagates to main's handler, which logs it and still prints {}, so Copilot is unaffected either way — the difference is that a real bug becomes visible instead of being silently swallowed.

What this does not do

Diagnosis only. No behaviour change to when a turn is sent. Once we know which of the four dominates, the actual fix follows — likely a retry when the transcript is not yet flushed, if that turns out to be the common case. Guessing before the data arrives is how we would pick the wrong one.

Reaches machines via SCRIPT_URL, which points at main, so this needs promoting past staging.

Testing

tests/copilot — 371 passed. The 2 failures are identical on clean staging (verified in a separate worktree, same counts), so they are pre-existing and unrelated.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge, although the non-blocking transcript error diagnostic still lacks enough context to debug unexpected exceptions.

Findings

1.  Unexpected Errors Lose Context ▶

Summary

• Reports missing transcript files using a basename-only identifier.
• Reports transcript read failures, missing turn anchors, and empty message assembly.
• Preserves the existing control flow and exception handling behavior.

_{Reviews (3) · Last reviewed commit: "Keep the broad except and log the basena..."}

[cursor]

Stale comment

Agentic security review of the Copilot transcript observability changes. One medium finding on the new transcript missing error path.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[vigneshsubbiah16]

🛡️ Automated Security Review (consensus)

1 finding: 0 high-confidence, 1 to triage. Reviewers: Claude (lead), Semgrep, Gitleaks.

• [LOW] Full transcript path sent to the remote error endpoint (copilot/hooks/unbound.py:5168)
  • What: The new message log_error(f"transcript missing: {transcript_path}", 'transcript') puts the full local file path from the hook payload into error.log and into the remote error report.
  • Why: The path usually has the user's OS username and the conversation or session ID in it, for example /Users/<name>/.copilot/session-state/<conversation_id>/events.jsonl. That is personal data leaving the machine only to explain why a turn failed. The other three new messages avoid this: they log only the exception type or a count.
  • Fix: Don't log the raw path. Log whether it was empty or just not on disk yet, for example "transcript missing: path_empty=%s exists=False", plus the fallback_session_id if you need to link it to a session. If you need the path, send only its base name or a hash of it.
  • Flagged by: Claude; also raised in the earlier Greptile review. No SAST scanner flagged it.

Pre-existing (not introduced by this PR)

• Semgrep insecure-file-permissions at copilot/hooks/unbound.py:5529 is on a line this diff does not touch. It is also a false positive: 0o700 gives access to the owner only, which is stricter than the 0o644 that Semgrep suggests. No action needed.

---

🤖 consensus review · reviewers: Claude, Semgrep, Gitleaks · head e61bdf85 · 2026-09-14T11:11Z

[greptile-apps]

Unexpected Errors Lose Context

This handler catches every exception, including unexpected programming failures, but logs only the exception class before returning an empty exchange. This makes new transcript-processing bugs look like expected read failures and violates the repository requirement that caught errors include diagnostic context and a stack trace. This requirement must be satisfied before merging by limiting the handler to expected read or parsing failures, or by preserving full exception details.

Context Used: P0 — Critical (must block merge) Django / Backend — Database N+1 queries. Flag any DB query inside a loop, list/dict comprehension, or per-row serializer method. Flag related-object access (obj.fk.field, obj.related_set.all()) inside loops or DRF Ser... (source)

[vigneshsubbiah16]

✅ Security consensus: no issues found. (reviewers: Claude, Semgrep, Gitleaks)

---

🤖 consensus review · reviewers: Claude, Semgrep, Gitleaks · head 364e763f · 2026-09-14T11:31Z