feat(proxy): emit session summary on persistent proxy shutdown (#352)

* feat(proxy): emit session summary on persistent proxy shutdown

The persistent proxy daemon never ran the per-invocation flow that calls
LogSessionComplete, so no session summary reached the cloud for server-mode
runs. Emit one from the daemon's aggregate stats collector on shutdown,
before the final cloud flush, so it is delivered with the run's events and
carries the CI/invocation context.

Extract the event emission into a shared LogSessionSummary(SessionData); both
the per-invocation flow and the daemon now use it. The daemon serves every
package manager, so the summary carries no single package manager.

* chore(action): shorten default cloud endpoint id prefix to gha/

internal/audit/audit.go

@@ -276,25 +276,37 @@ func LogSessionComplete(outcome Outcome, flowType FlowType) {
 
 	cfg := config.Get()
 
+	LogSessionSummary(SessionData{
+		PackageManager:       s.packageManager,
+		FlowType:             flowType,
+		Outcome:              outcome,
+		TotalAnalyzed:        s.totalAnalyzed,
+		AllowedCount:         s.allowedCount,
+		BlockedCount:         s.blockedCount,
+		ConfirmedCount:       s.confirmedCount,
+		TrustedSkipped:       s.trustedSkipped,
+		InsecureBypassed:     s.insecureBypassed,
+		CooldownBlockedCount: s.cooldownBlockedCount,
+		Duration:             time.Since(s.startTime),
+		SandboxEnabled:       cfg.Config.Sandbox.Enabled,
+		ParanoidMode:         cfg.Config.Paranoid,
+		TransitiveEnabled:    cfg.Config.Transitive,
+	})
+}
+
+// LogSessionSummary emits a session-complete audit event from explicit session
+// data. The persistent proxy daemon uses this because it aggregates run stats in
+// a stats collector rather than the per-invocation audit session that
+// LogSessionComplete reads from.
+func LogSessionSummary(data SessionData) {
+	if global == nil {
+		return
+	}
+
 	logEvent(AuditEvent{
-		Type:    EventTypeSessionComplete,
-		Message: fmt.Sprintf("Session complete: %s", outcome),
-		SessionData: &SessionData{
-			PackageManager:       s.packageManager,
-			FlowType:             flowType,
-			Outcome:              outcome,
-			TotalAnalyzed:        s.totalAnalyzed,
-			AllowedCount:         s.allowedCount,
-			BlockedCount:         s.blockedCount,
-			ConfirmedCount:       s.confirmedCount,
-			TrustedSkipped:       s.trustedSkipped,
-			InsecureBypassed:     s.insecureBypassed,
-			CooldownBlockedCount: s.cooldownBlockedCount,
-			Duration:             time.Since(s.startTime),
-			SandboxEnabled:       cfg.Config.Sandbox.Enabled,
-			ParanoidMode:         cfg.Config.Paranoid,
-			TransitiveEnabled:    cfg.Config.Transitive,
-		},
+		Type:        EventTypeSessionComplete,
+		Message:     fmt.Sprintf("Session complete: %s", data.Outcome),
+		SessionData: &data,
 	})
 }
 

internal/audit/audit_test.go

@@ -273,6 +273,37 @@ func TestLogSessionCompleteSilentWhenNotInitialized(t *testing.T) {
 	LogSessionComplete(OutcomeSuccess, FlowTypeGuard)
 }
 
+func TestLogSessionSummaryDispatchesEvent(t *testing.T) {
+	s := &mockSink{}
+	setGlobal(newAuditor(s))
+	defer resetGlobal()
+
+	// The persistent proxy daemon serves every package manager, so the summary
+	// carries no single one.
+	LogSessionSummary(SessionData{
+		FlowType:      FlowTypeProxy,
+		Outcome:       OutcomeBlocked,
+		TotalAnalyzed: 3,
+		BlockedCount:  1,
+		AllowedCount:  2,
+	})
+
+	events := s.getEvents()
+	require.Len(t, events, 1)
+	assert.Equal(t, EventTypeSessionComplete, events[0].Type)
+	require.NotNil(t, events[0].SessionData)
+	assert.Empty(t, events[0].SessionData.PackageManager)
+	assert.Equal(t, FlowTypeProxy, events[0].SessionData.FlowType)
+	assert.Equal(t, OutcomeBlocked, events[0].SessionData.Outcome)
+	assert.Equal(t, uint32(1), events[0].SessionData.BlockedCount)
+}
+
+func TestLogSessionSummarySilentWhenNotInitialized(t *testing.T) {
+	resetGlobal()
+	// Should not panic
+	LogSessionSummary(SessionData{Outcome: OutcomeSuccess})
+}
+
 // TestUIOutcomesMappToAuditOutcomes ensures every ui.ExecutionOutcome has a
 // corresponding audit.Outcome constant. If someone adds a new outcome to the
 // UI layer without updating the audit package, this test will fail.