@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/agentpack/index.js

@@ -3,7 +3,7 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkGitHubUpdate = exports.installFromGitHub = exports.validateForPublish = exports.publishToGitHub = exports.getGitHubUser = exports.isGitHubAuthenticated = exports.getGitHubToken = exports.formatGitHubSource = exports.parseGitHubSource = exports.resetDefaultAgent = exports.duplicateAgent = exports.updateFromUserLibrary = exports.checkForUpdate = exports.readAgentSource = exports.promoteToUserLibrary = exports.hydrateFromUserLibrary = exports.isAgentInUserLibrary = exports.isWorkspaceAgentAvailable = exports.listUserLibraryAgents = exports.updateManifestName = exports.parseAgentManifest = exports.loadAgentManifest = exports.stringifyYaml = exports.parseYaml = exports.AgentPackManager = exports.getUserAgentCurrentPath = exports.getUserAgentVersionDir = exports.getUserAgentRoot = exports.getUserAgentsDir = exports.getAgentideHome = exports.parseAgentIdFromPath = exports.getSessionsDir = exports.getAgentMcpDir = exports.getAgentRulesDir = exports.getAgentSkillsDir = exports.getAgentContextPath = exports.getAgentAgentsMdPath = exports.getAgentManifestPath = exports.isDefaultAgent = exports.userScopedEngineHome = exports.resolveRuntimePaths = exports.resolveAgentRuntimePaths = exports.getAgentRoot = exports.getAgentsDir = exports.getAgentideDir = exports.AGENT_CONSTANTS = void 0;
+exports.checkGitHubUpdate = exports.installFromGitHub = exports.validateForPublish = exports.publishToGitHub = exports.getGitHubUser = exports.isGitHubAuthenticated = exports.getGitHubToken = exports.formatGitHubSource = exports.parseGitHubSource = exports.resetDefaultAgent = exports.duplicateAgent = exports.updateFromUserLibrary = exports.checkForUpdate = exports.readAgentSource = exports.promoteToUserLibrary = exports.hydrateFromUserLibrary = exports.isAgentInUserLibrary = exports.isWorkspaceAgentAvailable = exports.listUserLibraryAgents = exports.updateManifestName = exports.parseAgentManifest = exports.loadAgentManifest = exports.stringifyYaml = exports.parseYaml = exports.AgentPackManager = exports.getUserAgentCurrentPath = exports.getUserAgentVersionDir = exports.getUserAgentRoot = exports.getUserAgentsDir = exports.getAgentideHome = exports.parseAgentIdFromPath = exports.getSessionsDir = exports.getAgentMcpDir = exports.getAgentRulesDir = exports.getAgentSkillsDir = exports.getAgentContextPath = exports.getAgentAgentsMdPath = exports.getAgentManifestPath = exports.isDefaultAgent = exports.engineHomeUserKey = exports.userScopedEngineHomeFromKey = exports.userScopedEngineHome = exports.resolveRuntimePaths = exports.resolveAgentRuntimePaths = exports.getAgentRoot = exports.getAgentsDir = exports.getAgentideDir = exports.AGENT_CONSTANTS = void 0;
 // Path utilities
 var paths_1 = require("./paths");
 Object.defineProperty(exports, "AGENT_CONSTANTS", { enumerable: true, get: function () { return paths_1.AGENT_CONSTANTS; } });
@@ -13,6 +13,8 @@ Object.defineProperty(exports, "getAgentRoot", { enumerable: true, get: function
 Object.defineProperty(exports, "resolveAgentRuntimePaths", { enumerable: true, get: function () { return paths_1.resolveAgentRuntimePaths; } });
 Object.defineProperty(exports, "resolveRuntimePaths", { enumerable: true, get: function () { return paths_1.resolveRuntimePaths; } });
 Object.defineProperty(exports, "userScopedEngineHome", { enumerable: true, get: function () { return paths_1.userScopedEngineHome; } });
+Object.defineProperty(exports, "userScopedEngineHomeFromKey", { enumerable: true, get: function () { return paths_1.userScopedEngineHomeFromKey; } });
+Object.defineProperty(exports, "engineHomeUserKey", { enumerable: true, get: function () { return paths_1.engineHomeUserKey; } });
 Object.defineProperty(exports, "isDefaultAgent", { enumerable: true, get: function () { return paths_1.isDefaultAgent; } });
 Object.defineProperty(exports, "getAgentManifestPath", { enumerable: true, get: function () { return paths_1.getAgentManifestPath; } });
 Object.defineProperty(exports, "getAgentAgentsMdPath", { enumerable: true, get: function () { return paths_1.getAgentAgentsMdPath; } });

package/out/agentpack/paths.js

@@ -52,6 +52,8 @@ exports.getAgentRoot = getAgentRoot;
 exports.resolveAgentRuntimePaths = resolveAgentRuntimePaths;
 exports.resolveRuntimePaths = resolveRuntimePaths;
 exports.userScopedEngineHome = userScopedEngineHome;
+exports.engineHomeUserKey = engineHomeUserKey;
+exports.userScopedEngineHomeFromKey = userScopedEngineHomeFromKey;
 exports.isDefaultAgent = isDefaultAgent;
 exports.getAgentManifestPath = getAgentManifestPath;
 exports.getAgentAgentsMdPath = getAgentAgentsMdPath;
@@ -227,12 +229,33 @@ function resolveRuntimePaths(workspaceRoot, storageUri, agentId, agentVersion) {
  * The user id is hashed — it is an email/subject, never safe as a raw path segment.
  */
 function userScopedEngineHome(baseHome, verifiedUserId) {
+    return userScopedEngineHomeFromKey(baseHome, engineHomeUserKey(verifiedUserId));
+}
+/**
+ * The opaque per-user directory segment, derived from a verified identity.
+ *
+ * Split out from `userScopedEngineHome` so it can cross a process boundary. A sandbox child has
+ * no `runWithCredential` frame — the credential deliberately never leaves broker memory — so
+ * before this existed every engine inside a tier-0 sandbox resolved the UNSCOPED base dir and
+ * every user's transcripts landed in one directory. The key is safe to send where the identity is
+ * not: it is a one-way hash, it authorizes nothing, and the child only ever uses it as a path
+ * segment.
+ */
+function engineHomeUserKey(verifiedUserId) {
     const uid = verifiedUserId?.trim();
     if (!uid) {
+        return undefined;
+    }
+    return crypto.createHash('sha256').update(uid).digest('hex').slice(0, 16);
+}
+/** `userScopedEngineHome` for a caller that already holds the key (i.e. inside a sandbox). */
+function userScopedEngineHomeFromKey(baseHome, userKey) {
+    // A key from the wire is a path segment, so it is checked rather than trusted: anything but
+    // the hex this function produces would let a caller aim an engine home anywhere on disk.
+    if (!userKey || !/^[0-9a-f]{16}$/.test(userKey)) {
         return baseHome;
     }
-    const hash = crypto.createHash('sha256').update(uid).digest('hex').slice(0, 16);
-    return path.join(baseHome, 'users', hash);
+    return path.join(baseHome, 'users', userKey);
 }
 /**
  * Check if an agent is the default workspace agent.

package/out/analytics/dashboard/localFleetAdapter.js

@@ -36,12 +36,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeSessionJsonlIntoFleetRows = mergeSessionJsonlIntoFleetRows;
 exports.getScheduledFleetRequests = getScheduledFleetRequests;
 exports.createLocalFleetAdapter = createLocalFleetAdapter;
 const vscode = __importStar(require("vscode"));
 const fleetTypes_1 = require("./fleetTypes");
 const fleetDisplayUtils_1 = require("./fleetDisplayUtils");
 const fleetRowDefaults_1 = require("./fleetRowDefaults");
+const sessionJsonlFleet_1 = require("./sessionJsonlFleet");
 const scheduledFleetStorage_1 = require("./scheduledFleetStorage");
 const LOCAL_SOURCE_ID = 'local';
 const FUTURE_START_SCHEDULED_MS = 60_000;
@@ -101,12 +103,87 @@ function toRow(sessionId, agentId, startedAt, endedAt, status, taskTitle, model,
         disconnectCapable: false,
     });
 }
+function scheduleSnapshotByChatSessionId(scheduled) {
+    const map = new Map();
+    for (const item of scheduled) {
+        const sessionId = String(item.sessionId ?? '').trim();
+        if (!sessionId) {
+            continue;
+        }
+        const existing = map.get(sessionId);
+        if (!existing || item.runAt >= existing.runAt) {
+            map.set(sessionId, item);
+        }
+    }
+    return map;
+}
+function applyJsonlHintToRow(row, hint) {
+    row.turns = Math.max(row.turns, hint.turns);
+    if (hint.startedAt) {
+        row.startedAt = hint.startedAt;
+    }
+    if (hint.endedAt) {
+        row.endedAt = hint.endedAt;
+    }
+    // JSONL turn events are authoritative when traces are missing or still show in_progress.
+    if (hint.turns > 0 || hint.status === 'done') {
+        row.status = hint.status;
+    }
+    else if (row.status === 'in_progress' && hint.status !== 'in_progress') {
+        row.status = hint.status;
+    }
+}
+function jsonlHintToRow(hint, schedule) {
+    const messagePreview = schedule?.messageText
+        ? (schedule.messageText.length > 80
+            ? `${schedule.messageText.slice(0, 77)}...`
+            : schedule.messageText)
+        : hint.sessionId;
+    return toRow(hint.sessionId, schedule?.agentId, hint.startedAt, hint.endedAt, hint.status, messagePreview, schedule?.model ?? 'unknown', schedule?.engine ?? (0, fleetDisplayUtils_1.inferFleetEngineId)(schedule?.model), hint.turns, 0);
+}
+/** Drop schedule:* cards when the linked chat session is live or finished. */
+function dropScheduleRowsSupersededByChatSession(sessionsById) {
+    for (const key of [...sessionsById.keys()]) {
+        if (!key.startsWith('schedule:')) {
+            continue;
+        }
+        const scheduleRow = sessionsById.get(key);
+        if (!scheduleRow) {
+            continue;
+        }
+        const linked = String(scheduleRow.channelTarget ?? '').trim();
+        if (!linked) {
+            continue;
+        }
+        const chatRow = sessionsById.get(linked);
+        if (chatRow && chatRow.status !== 'scheduled') {
+            sessionsById.delete(key);
+        }
+    }
+}
+/** @internal Exported for unit tests. */
+function mergeSessionJsonlIntoFleetRows(sessionsById, scheduleByChatSessionId, filters, sessionsDir) {
+    for (const hint of (0, sessionJsonlFleet_1.scanSessionJsonlFleetHints)(sessionsDir)) {
+        const schedule = scheduleByChatSessionId.get(hint.sessionId);
+        if (filters.agentId && schedule?.agentId && schedule.agentId !== filters.agentId) {
+            continue;
+        }
+        const existing = sessionsById.get(hint.sessionId);
+        if (existing) {
+            applyJsonlHintToRow(existing, hint);
+            continue;
+        }
+        sessionsById.set(hint.sessionId, jsonlHintToRow(hint, schedule));
+    }
+    dropScheduleRowsSupersededByChatSession(sessionsById);
+}
 /** Returns scheduled chat requests for fleet merge (used by orchestrator for formal local script). */
 async function getScheduledFleetRequests() {
     return (0, scheduledFleetStorage_1.loadScheduledFleetRequests)();
 }
 /**
- * Local fleet source adapter: trace-derived sessions + scheduled chat requests, merged and status-normalized.
+ * Local fleet source adapter: trace-derived sessions, session JSONL hints, and scheduled chat
+ * requests, merged and status-normalized.
  */
 function createLocalFleetAdapter(queryRunner) {
     return {
@@ -120,7 +197,9 @@ function createLocalFleetAdapter(queryRunner) {
                 // Trace DB may be missing; continue with scheduled only.
             }
             const scheduledRequests = await getScheduledFleetRequests();
-            const scheduleHintsByChatSessionId = (0, fleetDisplayUtils_1.buildScheduleHintsByChatSessionId)(await (0, scheduledFleetStorage_1.loadScheduledFleetEnrichmentHints)());
+            const scheduleEnrichment = await (0, scheduledFleetStorage_1.loadScheduledFleetEnrichmentHints)();
+            const scheduleByChatSessionId = scheduleSnapshotByChatSessionId(scheduleEnrichment);
+            const scheduleHintsByChatSessionId = (0, fleetDisplayUtils_1.buildScheduleHintsByChatSessionId)(scheduleEnrichment);
             const sessionsById = new Map();
             for (const session of sessions) {
                 const status = normalizeStatus(session);
@@ -153,6 +232,7 @@ function createLocalFleetAdapter(queryRunner) {
                 });
                 sessionsById.set(scheduleRowKey, scheduleRow);
             }
+            mergeSessionJsonlIntoFleetRows(sessionsById, scheduleByChatSessionId, filters);
             const sessionIdsForTitles = [...new Set(Array.from(sessionsById.values()).flatMap(row => {
                     const ids = [];
                     if (row.sessionId && !row.sessionId.startsWith('schedule:')) {

package/out/analytics/dashboard/provider.js

@@ -2058,12 +2058,23 @@ class AnalyticsDashboardProvider {
         await fs_1.promises.mkdir(panelDir, { recursive: true });
         const webviewBasePath = this.getWebviewPath();
         const bundledDir = path.join(this.extensionContext.extensionPath, webviewBasePath);
-        // Bundled source → user destination filename
+        // Bundled source → user destination filename.
+        // panel.js is deliberately NOT seeded: getHtmlContent always loads the bundled panel.js,
+        // so a seeded copy is never executed. Writing one only created a file that looks editable,
+        // silently diverges from the bundle, and makes "my dashboard edit did nothing" reports.
         const seedMap = [
-            { bundled: 'panel.js', userFile: 'panel.js' },
             { bundled: 'styles.css', userFile: 'panel.css' },
             { bundled: 'analytics-panel.html', userFile: 'panel.html' },
         ];
+        // Explain a pre-existing seeded copy rather than deleting the user's file.
+        try {
+            await fs_1.promises.access(path.join(panelDir, 'panel.js'));
+            this.outputChannel.appendLine(`[Dashboard] Note: ${path.join(panelDir, 'panel.js')} is not used — the bundled panel.js always loads. ` +
+                `Edit panel.html / panel.css to customize the dashboard.`);
+        }
+        catch {
+            // No stale copy — nothing to explain.
+        }
         for (const { bundled, userFile } of seedMap) {
             const dest = path.join(panelDir, userFile);
             try {

package/out/analytics/dashboard/webview/panel.js

@@ -5,8 +5,9 @@
  * Handles artifact display, rendering, and interactions.
  * Uses panelApi (provided by runtime-bridge.js) instead of raw VS Code API.
  *
- * This file is seeded to .agent-hippo/analytics/panel/panel.js on first use.
- * Users can edit the seeded copy to customize the dashboard UI.
+ * This bundled file is the ONLY panel.js ever executed (see provider.getHtmlContent).
+ * It is not seeded to .agent-hippo/analytics/panel/ — a copy there would never run.
+ * Dashboard UI is customized via panel.html / panel.css, which ARE read from that directory.
  * ----------------------------------------------------------------------------- */
 
 // @ts-check

package/out/analytics/service.js

@@ -800,21 +800,22 @@ class AnalyticsService {
             '-ConfigPath',
             options.configPath,
         ]);
+        // A missing config is not fatal: the launcher re-seeds the managed default
+        // (~/.agent-hippo/litellm-otel.yaml) from its bundled template before starting.
         return [
             'Write-Host "Starting LiteLLM proxy..."',
             `if (-not (Test-Path ${q(options.configPath)})) {`,
-            `  Write-Host ${q(`[WARN] LiteLLM config not found: ${options.configPath}`)} -ForegroundColor Yellow`,
-            '} else {',
-            `  $env:LITELLM_CONFIG_PATH = ${q(options.configPath)}`,
-            '  try {',
-            `    $proc = Start-Process -FilePath ${q(getWindowsPwshOrPowerShell())} -WindowStyle Hidden -WorkingDirectory ${q(path.dirname(options.litellmScript))} -ArgumentList ${q(launcherArgumentLine)} -RedirectStandardOutput ${q(options.stdoutPath)} -RedirectStandardError ${q(options.stderrPath)} -PassThru -ErrorAction Stop`,
-            '    Write-Host "[OK]   LiteLLM launcher started (PID: $($proc.Id))"',
-            `    Write-Host ${q(`       Logs: ${options.stdoutPath}`)}`,
-            `    Write-Host ${q(`       Errors: ${options.stderrPath}`)}`,
-            '  } catch {',
-            '    Write-Host "[ERROR] Failed to start LiteLLM launcher." -ForegroundColor Red',
-            '    Write-Host $_.Exception.Message -ForegroundColor Red',
-            '  }',
+            `  Write-Host ${q(`[INFO] LiteLLM config missing: ${options.configPath} — launcher will re-create it from the bundled template.`)}`,
+            '}',
+            `$env:LITELLM_CONFIG_PATH = ${q(options.configPath)}`,
+            'try {',
+            `  $proc = Start-Process -FilePath ${q(getWindowsPwshOrPowerShell())} -WindowStyle Hidden -WorkingDirectory ${q(path.dirname(options.litellmScript))} -ArgumentList ${q(launcherArgumentLine)} -RedirectStandardOutput ${q(options.stdoutPath)} -RedirectStandardError ${q(options.stderrPath)} -PassThru -ErrorAction Stop`,
+            '  Write-Host "[OK]   LiteLLM launcher started (PID: $($proc.Id))"',
+            `  Write-Host ${q(`       Logs: ${options.stdoutPath}`)}`,
+            `  Write-Host ${q(`       Errors: ${options.stderrPath}`)}`,
+            '} catch {',
+            '  Write-Host "[ERROR] Failed to start LiteLLM launcher." -ForegroundColor Red',
+            '  Write-Host $_.Exception.Message -ForegroundColor Red',
             '}',
         ];
     }
@@ -854,17 +855,18 @@ class AnalyticsService {
         if (!options.litellmScript) {
             return ['echo "[WARN] LiteLLM launcher script not found. Skipping LiteLLM start." >&2'];
         }
+        // A missing config is not fatal: the launcher re-seeds the managed default
+        // (~/.agent-hippo/litellm-otel.yaml) from its bundled template before starting.
         return [
             'echo "Starting LiteLLM proxy..."',
             `if [ ! -f ${q(options.configPath)} ]; then`,
-            `  echo ${q(`[WARN] LiteLLM config not found: ${options.configPath}`)} >&2`,
-            'else',
-            `  export LITELLM_CONFIG_PATH=${q(options.configPath)}`,
-            `  nohup ${q(options.litellmScript)} --config ${q(options.configPath)} >> ${q(options.stdoutPath)} 2>> ${q(options.stderrPath)} &`,
-            '  echo "[OK]   LiteLLM launcher started (PID: $!)"',
-            `  echo ${q(`       Logs: ${options.stdoutPath}`)}`,
-            `  echo ${q(`       Errors: ${options.stderrPath}`)}`,
+            `  echo ${q(`[INFO] LiteLLM config missing: ${options.configPath} — launcher will re-create it from the bundled template.`)}`,
             'fi',
+            `export LITELLM_CONFIG_PATH=${q(options.configPath)}`,
+            `nohup ${q(options.litellmScript)} --config ${q(options.configPath)} >> ${q(options.stdoutPath)} 2>> ${q(options.stderrPath)} &`,
+            'echo "[OK]   LiteLLM launcher started (PID: $!)"',
+            `echo ${q(`       Logs: ${options.stdoutPath}`)}`,
+            `echo ${q(`       Errors: ${options.stderrPath}`)}`,
         ];
     }
     getLifecycleTerminalIntro(action) {
@@ -893,13 +895,9 @@ class AnalyticsService {
      * Start LiteLLM in a detached background process. Logs go to .agent-hippo/analytics/litellm.{log,error.log}.
      */
     async startLiteLLMDirectly() {
+        // No existence check: a missing managed config is re-seeded from the bundled
+        // template by the launcher itself (deleting it is a "reset to defaults" gesture).
         const configPath = path.join((0, index_1.getAgentideHome)(), 'litellm-otel.yaml');
-        try {
-            await fs_1.promises.access(configPath);
-        }
-        catch {
-            return false;
-        }
         const isWindows = process.platform === 'win32';
         const args = isWindows
             ? ['-ConfigPath', configPath]
@@ -922,6 +920,12 @@ class AnalyticsService {
             ? ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', scriptPath, ...args]
             : [scriptPath, ...args];
         const env = { ...process.env, AGENT_HOME_DIR: (0, index_1.getAgentideHome)() };
+        // IDE-launched proxies default to content capture ON so Spotlight can show prompts and
+        // correlate sessions; serve/gateway deployments launch LiteLLM elsewhere and keep the
+        // metadata-only default. An explicit AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=0 still wins.
+        if (!env.AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE) {
+            env.AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE = '1';
+        }
         if (opts.configPath) {
             env.LITELLM_CONFIG_PATH = opts.configPath;
         }

package/out/analytics/sessionEvents.js

@@ -1,6 +1,7 @@
 "use strict";
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *  Licensed under the MIT License. See LICENSE.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -36,7 +37,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ObservableStreamEmitter = exports.SessionEventWriter = void 0;
+exports.ObservableStreamEmitter = exports.SessionEventWriter = exports.EVIDENCE_REQUIRED_ENV = void 0;
+exports.getSessionEventWriterStats = getSessionEventWriterStats;
+exports.resetSessionEventWriterStatsForTest = resetSessionEventWriterStatsForTest;
+exports.evidenceRequired = evidenceRequired;
 exports.wrapEmitterWithObservability = wrapEmitterWithObservability;
 /**
  * Session Event Writer & Observable Stream Emitter
@@ -47,24 +51,51 @@ exports.wrapEmitterWithObservability = wrapEmitterWithObservability;
  *
  * Events are written to ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
  * and queryable by DuckDB alongside OTEL traces.
+ *
+ * PRIVACY: user identifiers are salted hashes and tool I/O is a sha256 + length, unless an
+ * operator opts in — see ./identity.ts. These records are shipped wholesale to the evidence
+ * server, so whatever lands in this file leaves the machine.
  */
 const path = __importStar(require("path"));
 const fs_1 = require("fs");
 const branding_1 = require("../branding");
 const os = __importStar(require("os"));
-// -----------------------------------------------------------------------------
-// Session Event Writer
-// -----------------------------------------------------------------------------
+const identity_1 = require("./identity");
+/** Process-wide counters, aggregated across every writer instance. */
+const globalStats = {
+    written: 0,
+    failed: 0,
+};
 /**
- * Append-only JSONL writer for session events.
- * One file per session: ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
+ * Process-wide evidence-write health, for /health-style output.
  *
- * Design: write-through (no buffering). Each event appends immediately.
- * JSONL is safe for concurrent writes and crash-safe.
+ * `failed > 0` means at least one consequential act produced no record (R-1 completeness).
+ */
+function getSessionEventWriterStats() {
+    return { written: globalStats.written, failed: globalStats.failed, lastError: globalStats.lastError };
+}
+/** Reset the process-wide counters. Tests only. */
+function resetSessionEventWriterStatsForTest() {
+    globalStats.written = 0;
+    globalStats.failed = 0;
+    globalStats.lastError = undefined;
+}
+/**
+ * Set when evidence is REQUIRED: a failed write then rejects rather than returning, so the turn
+ * fails instead of proceeding unrecorded. Off by default — an IDE user should not lose a turn
+ * because a disk was full — but a regulated deployment wants the opposite trade.
  */
+exports.EVIDENCE_REQUIRED_ENV = 'AGENTHIPPO_EVIDENCE_REQUIRED';
+function evidenceRequired(env = process.env) {
+    const v = (env[exports.EVIDENCE_REQUIRED_ENV] ?? '').trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
 class SessionEventWriter {
     baseDir;
     ensuredDirs = new Set();
+    written = 0;
+    failed = 0;
+    lastError;
     sanitizeSessionId(sessionId) {
         const trimmed = sessionId.trim();
         if (!trimmed) {
@@ -78,6 +109,14 @@ class SessionEventWriter {
     }
     /**
      * Append a session event to the session's JSONL file.
+     *
+     * A failed write is a HOLE IN THE RECORD, not a nuisance: the act still happened, and nothing
+     * downstream can tell the difference between "no tool ran" and "the tool event never landed".
+     * So every failure is logged at error level and counted into /health-visible state. With
+     * AGENTHIPPO_EVIDENCE_REQUIRED set it also rejects, so the caller fails the turn rather than
+     * completing it unrecorded.
+     *
+     * This used to swallow every error in an empty catch block — silence on every failure.
      */
     async append(sessionId, requestId, eventType, payload) {
         try {
@@ -97,11 +136,27 @@ class SessionEventWriter {
             const filePath = path.join(this.baseDir, `${safeSessionId}.jsonl`);
             const line = JSON.stringify(event) + '\n';
             await fs_1.promises.appendFile(filePath, line);
+            this.written++;
+            globalStats.written++;
         }
-        catch {
-            // Best-effort: don't crash the agent if event writing fails
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            this.failed++;
+            globalStats.failed++;
+            const record = { at: Date.now(), message, eventType };
+            this.lastError = record;
+            globalStats.lastError = record;
+            console.error(`[evidence] LOST session event ${eventType} (session=${sessionId} request=${requestId}): ` +
+                `${message} — ${globalStats.failed} evidence write(s) lost since start`);
+            if (evidenceRequired()) {
+                throw new Error(`evidence write failed for ${eventType}: ${message}`);
+            }
         }
     }
+    /** Per-writer evidence-write health. See {@link getSessionEventWriterStats} for the process view. */
+    getStats() {
+        return { written: this.written, failed: this.failed, lastError: this.lastError };
+    }
     /**
      * Get the sessions directory path (for DuckDB queries).
      */
@@ -126,9 +181,15 @@ class ObservableStreamEmitter {
     writer;
     sessionId;
     requestId;
-    userId;
+    stamp;
     missingCallIdCounter = 0;
     pendingSyntheticCallIds = new Map();
+    /**
+     * Salted pseudonym of the acting user — the warrant, in the form the evidence index wants
+     * (PLAN/compliance.md §2 "salted identity hashes"). Raw only under
+     * AGENTHIPPO_EVIDENCE_RAW_IDS=1. Derived in the constructor; the raw id is never a field.
+     */
+    actorId;
     constructor(inner, writer, sessionId, requestId, 
     /**
      * Acting user for the warrant audit trail on tool events. Captured once at
@@ -138,13 +199,25 @@ class ObservableStreamEmitter {
      * parent IPC callback whose ALS can stick to the spawn request; constructor
      * capture keeps attribution correct for every engine. Undefined outside a
      * serve credential scope (IDE-local / CLI without runWithCredential).
+     *
+     * NOT a field: it is hashed into `actorId` in the constructor and the raw value is then
+     * unreachable from any emit path.
+     */
+    userId, 
+    /**
+     * Provenance stamp merged into turn_start (policy_version, pack_digest, engine_version,
+     * tier) — which rules and which artifacts governed this turn, recorded at the moment of
+     * the act rather than reconstructed later (PLAN/compliance.md §3.1).
      */
-    userId) {
+    stamp) {
         this.inner = inner;
         this.writer = writer;
         this.sessionId = sessionId;
         this.requestId = requestId;
-        this.userId = userId;
+        this.stamp = stamp;
+        // Hash once at construction: the raw id is never stored on this object, so no later edit
+        // to an emit path can leak it by reaching for `this.userId`.
+        this.actorId = (0, identity_1.hashIdentity)(userId);
     }
     makeCallIdKey(toolName) {
         return `${this.sessionId}:${this.requestId}:${toolName}`;
@@ -185,10 +258,12 @@ class ObservableStreamEmitter {
         await this.writer.append(this.sessionId, this.requestId, 'tool_start', {
             toolName,
             callId: loggedCallId,
-            // Truncate input to avoid huge JSONL files
-            inputPreview: input?.slice(0, 500),
+            // Tool arguments are content — paths, queries, credentials people paste into prompts.
+            // Digest by default (input_sha256 + input_length); `inputPreview` returns only under
+            // AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1.
+            ...(0, identity_1.describeContent)('input', input),
             // The warrant: who this tool call ran as (captured at wrap; see constructor).
-            userId: this.userId,
+            userId: this.actorId,
         });
         return this.inner.toolStart(toolName, input, toolCallId, metadata);
     }
@@ -200,9 +275,10 @@ class ObservableStreamEmitter {
             toolName,
             callId: loggedCallId,
             isError: isError ?? false,
-            // Truncate result to avoid huge JSONL files
-            resultPreview: result?.slice(0, 500),
-            userId: this.userId,
+            // Tool output is content — file contents, command output, customer data. Digest by
+            // default; `resultPreview` returns only under AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1.
+            ...(0, identity_1.describeContent)('result', result),
+            userId: this.actorId,
         });
         return this.inner.toolEnd(toolName, toolCallId, result, isError, metadata);
     }
@@ -215,7 +291,7 @@ class ObservableStreamEmitter {
     async error(message) {
         await this.writer.append(this.sessionId, this.requestId, 'error', {
             message,
-            userId: this.userId,
+            userId: this.actorId,
         });
         return this.inner.error(message);
     }
@@ -226,7 +302,7 @@ class ObservableStreamEmitter {
      * Emit a turn_start event. Call at the beginning of stream().
      */
     async emitTurnStart() {
-        await this.writer.append(this.sessionId, this.requestId, 'turn_start', { userId: this.userId });
+        await this.writer.append(this.sessionId, this.requestId, 'turn_start', { userId: this.actorId, ...this.stamp });
     }
     /**
      * Emit a turn_end event. Call at the end of stream().
@@ -234,7 +310,7 @@ class ObservableStreamEmitter {
     async emitTurnEnd(success) {
         await this.writer.append(this.sessionId, this.requestId, 'turn_end', {
             success,
-            userId: this.userId,
+            userId: this.actorId,
         });
     }
 }
@@ -243,6 +319,6 @@ exports.ObservableStreamEmitter = ObservableStreamEmitter;
  * Create an ObservableStreamEmitter that wraps the given emitter.
  * Returns both the wrapped emitter and emit helpers for turn boundaries.
  */
-function wrapEmitterWithObservability(inner, writer, sessionId, requestId, userId) {
-    return new ObservableStreamEmitter(inner, writer, sessionId, requestId, userId);
+function wrapEmitterWithObservability(inner, writer, sessionId, requestId, userId, stamp) {
+    return new ObservableStreamEmitter(inner, writer, sessionId, requestId, userId, stamp);
 }

package/out/auth/authBaseUrl.js

@@ -0,0 +1,59 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertSafeAuthBaseUrl = void 0;
+exports.pickTrustedAuthBaseUrl = pickTrustedAuthBaseUrl;
+exports.resolveAuthBrokerBaseUrl = resolveAuthBrokerBaseUrl;
+/**
+ * Where `agentide.auth.baseUrl` is allowed to come from.
+ *
+ * The setting is declared `"scope": "application"` in package.json, which is what actually stops a
+ * repo's `.vscode/settings.json` from setting it. This module is the defence in depth behind that
+ * declaration: it re-derives the value from `inspect()` and takes ONLY the user/application/default
+ * layers, so even if the contribution scope is ever loosened by accident (or the value arrives
+ * through a remote/folder layer this extension does not expect), a workspace-supplied endpoint is
+ * dropped rather than trusted.
+ *
+ * Why this matters concretely: the resolved URL receives the PKCE authorization code, then
+ * `Authorization: Bearer <AgentHippo access token>` on `/api/ide/bootstrap`, and the response
+ * configures team store settings plus `agentide.AgentHippoModelGateway.url` (application-scoped).
+ * The access token is also synced to the `agenthippo` model provider. A workspace that could
+ * steer the auth endpoint would capture the token AND every subsequent prompt.
+ */
+const brokerClient_js_1 = require("./brokerClient.js");
+Object.defineProperty(exports, "assertSafeAuthBaseUrl", { enumerable: true, get: function () { return brokerClient_js_1.assertSafeAuthBaseUrl; } });
+/**
+ * Pick the auth base URL from the trusted layers only.
+ *
+ * Precedence matches VS Code's own (most specific trusted layer wins): remote user → local user →
+ * user → default. `workspaceValue` / `workspaceFolderValue` are never consulted for the result;
+ * they are only reported so the caller can warn.
+ */
+function pickTrustedAuthBaseUrl(inspect) {
+    if (!inspect) {
+        return {};
+    }
+    const ignored = inspect.workspaceFolderValue?.trim() || inspect.workspaceValue?.trim() || undefined;
+    const trusted = inspect.globalRemoteValue?.trim() ||
+        inspect.globalLocalValue?.trim() ||
+        inspect.globalValue?.trim() ||
+        inspect.defaultValue?.trim() ||
+        undefined;
+    // A workspace value that merely repeats the trusted value is not an override worth warning about.
+    const ignoredWorkspaceValue = ignored && ignored !== trusted ? ignored : undefined;
+    return { value: trusted, ...(ignoredWorkspaceValue ? { ignoredWorkspaceValue } : {}) };
+}
+/**
+ * Resolve the auth broker base URL from configuration, dropping workspace-scoped values and
+ * enforcing the https/loopback requirement. Throws (with an actionable message) on a bad URL.
+ */
+function resolveAuthBrokerBaseUrl(config, warn) {
+    const picked = pickTrustedAuthBaseUrl(config?.inspect('auth.baseUrl'));
+    if (picked.ignoredWorkspaceValue) {
+        warn?.(`[AgentIDE] Ignoring workspace-provided "agentide.auth.baseUrl" (${picked.ignoredWorkspaceValue}). ` +
+            `This endpoint receives your AgentHippo access token, so it is only honoured from user/application settings.`);
+    }
+    return (0, brokerClient_js_1.getAuthBrokerBaseUrl)(picked.value);
+}