@cspeach/cli 1.0.0 → 1.1.1

package/dist/commands/config-set.js

@@ -7,12 +7,16 @@ import { loadConfig, saveConfig, isValidWriteMode } from '../config/loader.js';
 const MUTABLE_KEYS = new Set([
     'proxy_url',
     'default_model',
+    'audit_model',
+    'compact_model',
     'effort',
     'telemetry',
     'classifier.safe_mode',
     'local_build',
     'local_files', // deprecated alias for local_build (2026-06-13) — still accepted
     'write_mode',
+    'plan_mode',
+    'plan_audit',
     'llm.mode',
     'llm.ai_hub_base_url',
     'llm.ai_hub_model_alias',
@@ -24,6 +28,8 @@ const MUTABLE_KEYS = new Set([
 ]);
 // SAP-scoped key pattern: sap.<alias>.auto_approve
 const SAP_AUTO_APPROVE_RE = /^sap\.([A-Z0-9_-]{2,32})\.auto_approve$/;
+// SAP-scoped key pattern: sap.<alias>.role (system role → write-mode ceiling)
+const SAP_ROLE_RE = /^sap\.([A-Z0-9_-]{2,32})\.role$/;
 // SAP-scoped TLS keys: sap.<alias>.ca_cert_path | sap.<alias>.insecure_skip_tls_verify
 const SAP_CA_CERT_PATH_RE = /^sap\.([A-Z0-9_-]{2,32})\.ca_cert_path$/;
 const SAP_INSECURE_TLS_RE = /^sap\.([A-Z0-9_-]{2,32})\.insecure_skip_tls_verify$/;
@@ -46,7 +52,10 @@ function coerceBool(value) {
 const EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'max'];
 const TELEMETRY_VALUES = ['minimal', 'full'];
 const AUTO_APPROVE_VALUES = ['never', 'low', 'medium'];
+const SYSTEM_ROLE_VALUES = ['dev', 'qas', 'prd'];
 const LLM_MODE_VALUES = ['managed', 'byok', 'ai-hub', 'local'];
+const PLAN_MODE_VALUES = ['step', 'guarded'];
+const PLAN_AUDIT_VALUES = ['on', 'off'];
 /**
  * Thrown on validation failure. The outer CLI dispatcher converts to
  * `console.error` + `process.exit(exitCode)`. Throwing instead of calling
@@ -65,6 +74,119 @@ export class ConfigSetError extends Error {
 function err(msg) {
     throw new ConfigSetError(`[config set] ${msg}`);
 }
+function errUnset(msg) {
+    throw new ConfigSetError(`[config unset] ${msg}`);
+}
+/**
+ * Internal, loader-derived flags that are never serialised (stripped by
+ * saveConfig). They must never be targets of `config set`/`config unset`.
+ */
+const INTERNAL_KEYS = new Set(['default_model_set', 'file_keys']);
+/**
+ * Virtual keys whose values live in the OS keychain, not config.toml. `config
+ * unset` cannot remove them — that is a keychain operation — so they are
+ * rejected with a pointer rather than silently no-op'd.
+ */
+const VIRTUAL_KEYCHAIN_KEYS = new Set(['llm.byok_key', 'llm.ai_hub_token']);
+/**
+ * MUTABLE_KEYS that `config unset` can act on (excludes keychain virtuals and
+ * the deprecated `local_files` alias — the canonical name is `local_build`).
+ */
+function unsettableKeyList() {
+    return [...MUTABLE_KEYS]
+        .filter((k) => !VIRTUAL_KEYCHAIN_KEYS.has(k) && k !== 'local_files')
+        .join(', ');
+}
+/**
+ * Mark a top-level config key as explicitly user-set so sparse serialisation
+ * (saveConfig) preserves it even when its value equals the built-in default.
+ * `file_keys` tracks TOP-LEVEL keys, so we push the first dotted segment
+ * (`default_model` → `default_model`, `classifier.safe_mode` → `classifier`).
+ * Dedup-safe. Closes the one edge the value-diff can't see: `config set
+ * default_model claude-opus-4-8` (equal to the built-in default) on a file that
+ * lacked the key would otherwise be dropped on save, permanently opting the
+ * user out of the model-governance server steering (default_model_set semantics).
+ */
+export function markExplicit(cfg, key) {
+    const top = key.split('.')[0];
+    if (!Array.isArray(cfg.file_keys))
+        cfg.file_keys = [];
+    if (!cfg.file_keys.includes(top))
+        cfg.file_keys.push(top);
+}
+/**
+ * Delete a (possibly dotted, max 2-level) key from a loaded config in place.
+ * Returns true if the key was present and removed, false if it was already
+ * absent (the caller renders a friendly no-op). Also drops the top-level key
+ * from `file_keys` — but ONLY when the whole top-level key was removed. If a
+ * nested sibling survives (e.g. unsetting `llm.local_model` while `llm.mode`
+ * remains), keeping the top-level entry in `file_keys` is what stops sparse
+ * save from dropping the now-default-equal parent table.
+ */
+function unsetConfigKey(cfg, key) {
+    const parts = key.split('.');
+    const top = parts[0];
+    const obj = cfg;
+    let removedTop = false;
+    if (parts.length === 1) {
+        if (!Object.prototype.hasOwnProperty.call(obj, top))
+            return false;
+        delete obj[top];
+        removedTop = true;
+    }
+    else {
+        const parent = obj[top];
+        if (!parent || typeof parent !== 'object')
+            return false;
+        const p = parent;
+        const leaf = parts.slice(1).join('.');
+        if (!Object.prototype.hasOwnProperty.call(p, leaf))
+            return false;
+        delete p[leaf];
+        if (Object.keys(p).length === 0) {
+            delete obj[top];
+            removedTop = true;
+        }
+    }
+    if (removedTop && Array.isArray(cfg.file_keys)) {
+        cfg.file_keys = cfg.file_keys.filter((k) => k !== top);
+    }
+    return true;
+}
+/**
+ * Executes `cspeach config unset <key>`.
+ * Removes a MUTABLE top-level key so it reverts to the built-in default (and,
+ * for the model keys, re-enables server model-steering). Rejects internal keys,
+ * keychain virtuals, and non-MUTABLE keys. Unsetting an absent key is a friendly
+ * no-op. Throws ConfigSetError on validation failure (the CLI dispatcher in
+ * cli.ts converts it to console.error + exit).
+ */
+export async function runConfigUnset(args) {
+    const key = args[0];
+    if (!key) {
+        errUnset('Usage: cspeach config unset <key>\n  Valid keys: ' + unsettableKeyList());
+    }
+    if (INTERNAL_KEYS.has(key)) {
+        errUnset(`"${key}" is an internal key (derived on load, never stored) and cannot be unset.`);
+    }
+    if (VIRTUAL_KEYCHAIN_KEYS.has(key)) {
+        errUnset(`"${key}" is stored in the OS keychain, not config.toml — it cannot be removed with config unset.`);
+    }
+    if (key.startsWith('sap.')) {
+        errUnset(`"${key}" is a SAP-scoped key — those are managed per system via \`cspeach config set ${key} <value>\`, not config unset.`);
+    }
+    if (!MUTABLE_KEYS.has(key)) {
+        errUnset(`Unknown key "${key}". Valid keys: ${unsettableKeyList()}`);
+    }
+    const cfg = await loadConfig();
+    const removed = unsetConfigKey(cfg, key);
+    if (!removed) {
+        console.log(chalk.dim(`${key} was not set — nothing to unset.`));
+        return;
+    }
+    await saveConfig(cfg);
+    console.log(chalk.green(`Unset ${key} — it now falls back to the built-in default (and any server steering).`));
+}
 /**
  * Executes `cspeach config set <key> <value>`.
  * Exits process with code 1 on validation error.
@@ -94,6 +216,23 @@ export async function runConfigSet(args) {
         console.log(chalk.green(`Set ${key} = ${value}`));
         return;
     }
+    // SAP-scoped key: sap.<alias>.role — system role, feeds the write-mode ceiling
+    // (prd → advisory-only, qas → approval-gated, dev → no ceiling).
+    const roleMatch = SAP_ROLE_RE.exec(key);
+    if (roleMatch) {
+        const alias = roleMatch[1];
+        if (!SYSTEM_ROLE_VALUES.includes(value)) {
+            err(`Invalid value for ${key}. Allowed: ${SYSTEM_ROLE_VALUES.join(', ')}`);
+        }
+        const cfg = await loadConfig();
+        if (!cfg.sap[alias]) {
+            err(`SAP system "${alias}" not found in config. Add it first with: cspeach config add-sap`);
+        }
+        cfg.sap[alias].role = value;
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${value}`));
+        return;
+    }
     // SAP-scoped TLS: sap.<alias>.ca_cert_path — trust a CA, verification STAYS ON.
     const caMatch = SAP_CA_CERT_PATH_RE.exec(key);
     if (caMatch) {
@@ -184,6 +323,24 @@ export async function runConfigSet(args) {
             }
             cfg.default_model = value;
             break;
+        case 'audit_model':
+            // model-governance Step 1 — the per-phase auditor's model. Same claude-
+            // prefix guard as default_model; env CSPEACH_AUDIT_MODEL still overrides
+            // this at runtime (see resolveAuditModel).
+            if (!value.startsWith('claude-')) {
+                err(`model must start with "claude-", got "${value}".`);
+            }
+            cfg.audit_model = value;
+            break;
+        case 'compact_model':
+            // model-governance step 2d — the model `/compact` summarisation runs on.
+            // Same claude- prefix guard as default_model/audit_model; env
+            // CSPEACH_COMPACT_MODEL still overrides this at runtime (resolveModelRole).
+            if (!value.startsWith('claude-')) {
+                err(`model must start with "claude-", got "${value}".`);
+            }
+            cfg.compact_model = value;
+            break;
         case 'effort':
             if (!EFFORT_VALUES.includes(value)) {
                 err(`Invalid effort value "${value}". Allowed: ${EFFORT_VALUES.join(', ')}`);
@@ -233,6 +390,24 @@ export async function runConfigSet(args) {
             }
             cfg.write_mode = value;
             break;
+        case 'plan_mode':
+            // 'step' = prompt before every phase (default when unset);
+            // 'guarded' = auto-chain non-write phases, stop on write phases /
+            // unresolved audits. Per-run --guarded/--step flags override this.
+            if (!PLAN_MODE_VALUES.includes(value)) {
+                err(`Invalid plan_mode "${value}". Allowed: ${PLAN_MODE_VALUES.join(', ')}`);
+            }
+            cfg.plan_mode = value;
+            break;
+        case 'plan_audit':
+            // 'on' = audit every phase (default when unset); 'off' = skip the
+            // independent auditor entirely (owner off-switch, 2026-07-06). Per-run
+            // --audit/--no-audit flags override this default.
+            if (!PLAN_AUDIT_VALUES.includes(value)) {
+                err(`Invalid plan_audit "${value}". Allowed: ${PLAN_AUDIT_VALUES.join(', ')}`);
+            }
+            cfg.plan_audit = value;
+            break;
         case 'llm.mode':
             if (!LLM_MODE_VALUES.includes(value)) {
                 err(`Invalid llm.mode "${value}". Allowed: ${LLM_MODE_VALUES.join(', ')}`);
@@ -270,6 +445,10 @@ export async function runConfigSet(args) {
         default:
             err(`Unhandled key "${key}".`);
     }
+    // Mark this top-level key as explicitly user-set so sparse serialisation
+    // keeps it even when the value equals the built-in default (the edge the
+    // value-diff can't see — e.g. `config set default_model claude-opus-4-8`).
+    markExplicit(cfg, key);
     await saveConfig(cfg);
     console.log(chalk.green(`Set ${key} = ${value}`));
 }
@@ -286,6 +465,10 @@ export function validateValue(key, value) {
     if (SAP_AUTO_APPROVE_RE.test(key)) {
         return AUTO_APPROVE_VALUES.includes(value);
     }
+    // SAP-scoped key: sap.<alias>.role
+    if (SAP_ROLE_RE.test(key)) {
+        return SYSTEM_ROLE_VALUES.includes(value);
+    }
     // SAP-scoped TLS keys.
     if (SAP_CA_CERT_PATH_RE.test(key)) {
         return value.length > 0; // any non-empty path; existence checked at connect
@@ -305,6 +488,8 @@ export function validateValue(key, value) {
                 return false;
             }
         case 'default_model':
+        case 'audit_model':
+        case 'compact_model':
             return value.startsWith('claude-');
         case 'effort':
             return EFFORT_VALUES.includes(value);
@@ -317,6 +502,10 @@ export function validateValue(key, value) {
             return coerceBool(value) !== null;
         case 'write_mode':
             return isValidWriteMode(value);
+        case 'plan_mode':
+            return PLAN_MODE_VALUES.includes(value);
+        case 'plan_audit':
+            return PLAN_AUDIT_VALUES.includes(value);
         case 'llm.mode':
             return LLM_MODE_VALUES.includes(value);
         case 'llm.ai_hub_base_url':

package/dist/commands/config-show.js

@@ -14,6 +14,16 @@ const REDACTED_KEYS = new Set([
     'llm.byok_key', // Anthropic API key — keychain "cspeach.anthropic"
     'llm.ai_hub_token', // SAP AI Hub bearer — keychain "cspeach.ai-hub"
 ]);
+/**
+ * INTERNAL, loader-derived flags that are attached to the config object at load
+ * time but never serialised (stripped by saveConfig). They must not render in
+ * `config show` — `default_model_set` was a pre-existing leak, `file_keys` was
+ * added by sparse-config task 1. Both are top-level only.
+ */
+const INTERNAL_KEYS = new Set([
+    'default_model_set',
+    'file_keys',
+]);
 function formatTomlValue(value) {
     if (typeof value === 'string')
         return `"${value}"`;
@@ -61,6 +71,9 @@ function printConfigAsToml(cfg, prefix = '') {
     const tables = entries.filter(([, v]) => typeof v === 'object' && v !== null && !Array.isArray(v));
     for (const [k, v] of scalars) {
         const fullKey = prefix ? `${prefix}.${k}` : k;
+        // Skip internal, never-serialised keys so they never leak into output.
+        if (INTERNAL_KEYS.has(fullKey))
+            continue;
         if (REDACTED_KEYS.has(fullKey)) {
             console.log(`${k} = [REDACTED]`);
         }
@@ -126,6 +139,13 @@ export async function runConfigShow(args) {
         return;
     }
     const keyPath = args[0];
+    // Reject internal, loader-derived keys in the single-key path too — the full
+    // dump already filters INTERNAL_KEYS, but resolveDottedKey would happily
+    // print e.g. the raw `file_keys` array. Mirror `config unset`'s wording.
+    if (INTERNAL_KEYS.has(keyPath)) {
+        console.error(chalk.red(`[config show] "${keyPath}" is an internal key (derived on load, never stored) and cannot be shown.`));
+        process.exit(1);
+    }
     const resolved = resolveDottedKey(cfg, keyPath);
     if (resolved === undefined) {
         console.error(chalk.red(`[config show] Key "${keyPath}" not found.`));

package/dist/commands/export-audit.js

@@ -0,0 +1,43 @@
+// cspeach-cli/src/commands/export-audit.ts
+//
+// `/export audit [filename]` — write the signable session audit record to a
+// markdown file in the cwd and print the path.
+//
+// Thin I/O wrapper over the pure buildAuditReport builder (session/audit-export
+// .ts): reads the session's cost JSONL, resolves the target filename (explicit
+// arg or a deterministic default), writes the file, and emits a confirmation
+// line through the caller-supplied `emit` (chunkEmitter in Ink mode, console
+// .log in classic mode — same seam as printHelp / runCostCommand).
+//
+// The default filename's date comes from SESSION DATA (last_turn_at), never
+// now() — a re-export of an old session names the file for when the work
+// happened, matching the deterministic report body.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildAuditReport } from '../session/audit-export.js';
+import { readCostLog } from '../cost/cost-log.js';
+/** Parse the text after `/export` into a subcommand + optional filename. */
+export function parseExportArgs(rest) {
+    const parts = rest.trim().split(/\s+/).filter(Boolean);
+    return { sub: (parts[0] ?? '').toLowerCase(), filename: parts[1] };
+}
+/** Deterministic default filename: date from session data, not now(). */
+export function defaultAuditFilename(session) {
+    const date = (session.last_turn_at || session.started_at || '').slice(0, 10) || 'undated';
+    return `cspeach-audit-${session.id}-${date}.md`;
+}
+export async function runExportAuditCommand(opts) {
+    const { session, transport, emit } = opts;
+    const cwd = opts.cwd ?? process.cwd();
+    const costEntries = opts.costEntries ?? (await readCostLog(session.id));
+    const report = buildAuditReport({ session, costEntries, transport });
+    const name = opts.filename && opts.filename.trim().length > 0
+        ? opts.filename.trim()
+        : defaultAuditFilename(session);
+    const outPath = path.resolve(cwd, name);
+    await fs.writeFile(outPath, report, 'utf-8');
+    emit('');
+    emit(`Audit written to ${outPath}`);
+    emit('');
+    return { path: outPath };
+}

package/dist/commands/help.js

@@ -93,7 +93,12 @@ export function printHelp(emit = (s) => console.log(s)) {
     emit(`  ${chalk.bold('/ui [auto|ink|classic]'.padEnd(NAME_COL_PAD))} View or change UI rendering mode`);
     emit(`  ${chalk.bold('/reroute <skill>'.padEnd(NAME_COL_PAD))} Re-run your last prompt with a different skill`);
     emit(`  ${chalk.bold('/new'.padEnd(NAME_COL_PAD))} End the current Q&A chain — next prompt is classified fresh`);
+    emit(`  ${chalk.bold('/mode [advisory|gated|auto]'.padEnd(NAME_COL_PAD))} Cycle or set the session write mode (Shift+Tab / Alt+M also cycle)`);
+    emit(`  ${chalk.bold('/recap'.padEnd(NAME_COL_PAD))} Show the session recap (last session · open tasks · plan progress)`);
+    emit(`  ${chalk.bold('/rewind'.padEnd(NAME_COL_PAD))} Undo a write from this session — restore an object to a pre-write snapshot (Esc Esc)`);
     emit(`  ${chalk.bold('/cost'.padEnd(NAME_COL_PAD))} Show this session's API spend so far ($ + token breakdown)`);
+    emit(`  ${chalk.bold('/context'.padEnd(NAME_COL_PAD))} Show what fills the model context window — a composition grid of bars`);
+    emit(`  ${chalk.bold('/export audit [file]'.padEnd(NAME_COL_PAD))} Write the signable session audit record to a markdown file`);
     emit(`  ${chalk.bold('/compact'.padEnd(NAME_COL_PAD))} Summarise older turns into a compact context block — cuts subsequent turn cost by 80-90%`);
     emit(`  ${chalk.bold('/exit'.padEnd(NAME_COL_PAD))} Quit CSPeach`);
     emit('');

package/dist/commands/plan-audit-evidence.js

@@ -0,0 +1,266 @@
+/**
+ * Ground-truth extractor for the phase auditor.
+ *
+ * The agent loop writes a JSONL audit log of every tool call to
+ * `~/.cspeach/checkpoints/<sessionId>/tool-calls.jsonl` (Layer 2 default
+ * handler in `agent/skill-checkpoint.ts`). The phase auditor must judge a
+ * phase's self-report against evidence the audited model did NOT author —
+ * this module produces that evidence: a bounded, compact excerpt of the
+ * write + verification tool calls (set_source, activate, syntax_check,
+ * transport, snapshot, ...), newest-last.
+ *
+ * Pure read module — no writes, no new dependencies.
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { checkpointsRoot } from '../agent/skill-checkpoint.js';
+/**
+ * PROTECTED evidence — write + verification calls that PROVE a phase's core
+ * claims and must NEVER be evicted by read rows (see the two-tier cap in
+ * extractAuditEvidence). Transport tools are matched by their EXACT
+ * write-relevant names (fix-wave): the registered family is
+ * sap_transport_create / _for_object / _list / _release (tools/transport.ts),
+ * and a bare `sap_transport` prefix let list-shaped read polling
+ * (sap_transport_list, sap_transport_for_object) evict real write rows from
+ * the 60-row cap.
+ *
+ * D-A (2026-07-05): sap_atc_run and sap_inactive_objects are VERIFICATION
+ * tools the audit contract + phase exit gates explicitly demand (ATC clean /
+ * no inactive versions remain), yet they were missing from this filter — so
+ * a phase that legitimately ran ATC or checked for inactive objects had that
+ * evidence stripped, and the auditor false-failed it with "no ATC call
+ * appears anywhere in the evidence". They are reads in the sense of not
+ * mutating source, but they ARE the proof of the verify steps, so they
+ * belong in the evidence excerpt. (Unlike the transport LIST polling, these
+ * fire once per verify, not in a loop, so they do not threaten the row cap.)
+ *
+ * Task 2 (audit-confidence-tiered-redesign, §6): request_approval is admitted
+ * here too. It is the PROOF-of-consent the §6 escalation exception keys on — a
+ * write to an infra base-object (DEVC / transport / number-range) under a
+ * writes:false phase is a sanctioned escalation ONLY IF the evidence carries an
+ * OK request_approval row for it. With the old sap_*-only filter that row was
+ * dropped, so the exception could never be satisfied. Like the existence-read
+ * proofs it is ground truth (the user's recorded consent), and the whole
+ * contract branch depends on it — so it must NEVER be evicted by the row cap:
+ * PROTECTED, not the fillable existence tier. Matched EXACTLY (^…$ anchored) so
+ * a near-miss tool name can never masquerade as consent.
+ */
+const PROTECTED_TOOL_RE = /^sap_(set_source|update_method|create_object|delete_object|activate|syntax_check|atc_run|inactive_objects|transport_create|transport_release|service_binding_publish|snapshot)|^request_approval$/;
+/**
+ * D-F (2026-07-05): EXISTENCE / VERIFY-READ evidence. A verify-only phase
+ * re-run (object already built in a prior attempt; this attempt proves it
+ * exists / is active / is clean and writes NOTHING) records only reads:
+ * sap_object_structure (version=active), sap_get_source (fields match), and
+ * sap_transport_for_object (object locked in a transport). With the old
+ * write-only filter those rows were stripped, the evidence went empty, and
+ * the auditor false-FAILED the re-run ("no write call in evidence"). These
+ * reads are legitimate ground truth: a read against the live harness log
+ * cannot be fabricated — a read of a nonexistent object ERRORS, so an `ok`
+ * existence read IS the system agreeing the object is there. They are
+ * admitted here so the auditor can satisfy a pre-existence claim on
+ * verification evidence alone (contract Rule 1, D-F branch).
+ *
+ * Cap safety (two-tier, see extractAuditEvidence): these reads are also used
+ * heavily in analysis phases and could, in a single-bucket cap, evict real
+ * write rows. They are therefore the FILLABLE tier — the newest of them fill
+ * whatever budget remains after every PROTECTED row is kept; a write row is
+ * never dropped to make room for one of these.
+ */
+const EXISTENCE_READ_RE = /^sap_(object_structure|get_source|transport_for_object)/;
+/** Any row the auditor may see is the union of the two tiers. */
+const EVIDENCE_TOOL_RE = new RegExp(`${PROTECTED_TOOL_RE.source}|${EXISTENCE_READ_RE.source}`);
+const NO_LOG_SENTINEL = '(no tool-call log found for this session)';
+const NO_EVIDENCE_ROWS = '(tool-call log present, but no write/verify calls recorded for this session)';
+const DEFAULT_MAX_ROWS = 60;
+const RESULT_EXCERPT_CHARS = 200;
+const ARGS_COMPACT_CHARS = 80;
+/**
+ * audit-timeout (2026-07-06) — per-tool result caps.
+ *
+ * Live false-FAIL #4: a c1.behavior audit failed with "both sap_inactive_objects
+ * results are truncated (only ZI_FRG3_DC and ZI_FRG_V2DC visible, followed by
+ * ellipsis)". The default 200-char cap beheaded the inactive-objects LIST,
+ * destroying the absence-from-inactive-list proof the D-F activeness arm depends
+ * on — and the auditor was CORRECTLY refusing to certify activeness from clipped
+ * evidence. The fix: render the inactive-objects list generously (it is names
+ * only, bounded in practice) so absence stays judgeable; only if it is
+ * pathologically huge do we clip it AND mark the clip HONESTLY, so the contract
+ * can fall back to the object_structure "version": "active" proof rather than
+ * inferring absence from a beheaded list. ATC results get a modest bump because
+ * the auditor reads finding priorities/counts from them. Everything else keeps
+ * the 200-char cap (object_structure surfaces "version" early, so 200 is fine).
+ */
+const INACTIVE_LIST_CAP = 4000;
+const ATC_RESULT_CAP = 500;
+/** Appended when the inactive-objects list itself is clipped — see the contract. */
+const INACTIVE_CLIP_MARKER = ' … (list clipped — absence not verifiable from this row; use object_structure version)';
+function resultCapFor(toolName) {
+    if (/^sap_inactive_objects/.test(toolName))
+        return INACTIVE_LIST_CAP;
+    if (/^sap_atc_run/.test(toolName))
+        return ATC_RESULT_CAP;
+    return RESULT_EXCERPT_CHARS;
+}
+function normalizeRow(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return null;
+    const r = raw;
+    const toolName = typeof r.toolName === 'string' ? r.toolName
+        : typeof r.tool === 'string' ? r.tool
+            : null;
+    if (!toolName)
+        return null;
+    const isError = typeof r.isError === 'boolean' ? r.isError
+        : typeof r.ok === 'boolean' ? !r.ok
+            : false;
+    const at = typeof r.completedAt === 'string' ? r.completedAt
+        : typeof r.at === 'string' ? r.at
+            : null;
+    // PROTECTED is checked first: it is a strict-enough family that no
+    // existence-read name can collide with it, but ordering makes the tiering
+    // explicit for the reader.
+    const kind = PROTECTED_TOOL_RE.test(toolName) ? 'protected' : 'existence';
+    return { toolName, args: r.args, result: r.result, isError, at, kind };
+}
+/** Render the args as `name/type` when available, else a compact fallback. */
+function renderArgs(args) {
+    if (args === null || args === undefined || typeof args !== 'object')
+        return '';
+    const a = args;
+    const name = a.name ?? a.object_name;
+    const type = a.type ?? a.object_type;
+    if (typeof name === 'string' && name.length > 0) {
+        return typeof type === 'string' && type.length > 0 ? `${name}/${type}` : name;
+    }
+    // No name/type — render what's available, compactly.
+    try {
+        const json = JSON.stringify(a);
+        if (!json || json === '{}')
+            return '';
+        return json.length <= ARGS_COMPACT_CHARS ? json : json.slice(0, ARGS_COMPACT_CHARS) + '…';
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Result excerpt, flattened to a single line, capped per-tool (see
+ * resultCapFor). For sap_inactive_objects, a clip is marked honestly so a
+ * beheaded list can never masquerade as a complete absence proof.
+ */
+function renderResult(result, toolName) {
+    let text;
+    if (typeof result === 'string') {
+        text = result;
+    }
+    else if (result === null || result === undefined) {
+        text = '';
+    }
+    else {
+        try {
+            text = JSON.stringify(result) ?? '';
+        }
+        catch {
+            text = String(result);
+        }
+    }
+    const flat = text.replace(/\s+/g, ' ').trim();
+    const cap = resultCapFor(toolName);
+    if (flat.length <= cap)
+        return flat;
+    if (/^sap_inactive_objects/.test(toolName)) {
+        // Absence-from-inactive-list is an activeness PROOF; a bare ellipsis would
+        // silently behead the list and make absence unverifiable. Mark it honestly.
+        return flat.slice(0, cap) + INACTIVE_CLIP_MARKER;
+    }
+    return flat.slice(0, cap);
+}
+function renderRow(row) {
+    const status = row.isError ? 'ERROR' : 'ok';
+    return `${row.toolName}(${renderArgs(row.args)}) → ${status} — ${renderResult(row.result, row.toolName)}`;
+}
+/**
+ * Extract a bounded, auditor-ready excerpt of the session's write +
+ * verification tool calls from the JSONL audit log.
+ *
+ * - Only rows whose toolName matches {@link EVIDENCE_TOOL_RE} are included.
+ * - D-B: when `sinceIso` is given, rows whose timestamp is strictly BEFORE it
+ *   are excluded — so an audit judging attempt N of a phase never sees the
+ *   rows of an earlier attempt that shares the same session JSONL (two
+ *   attempts in one CLI process). Untimestamped rows are kept (fail-open).
+ * - D-F two-tier cap: chronological order is preserved (newest-last). When
+ *   the evidence exceeds `maxRows` (default 60), the OLDEST existence-read
+ *   rows are dropped first; a PROTECTED (write / verify-proof) row is dropped
+ *   only if no existence-read rows remain to drop. So a write row is never
+ *   evicted to make room for a read — the exact regression a single bucket +
+ *   the new existence reads would have introduced. The 60 cap is kept (not
+ *   raised): the tiering, not a bigger budget, is what guarantees write
+ *   survival, and a fixed cap keeps the audit prompt's token cost bounded.
+ * - Missing file/dir returns the sentinel — never throws.
+ * - Malformed JSONL lines are skipped silently.
+ */
+export async function extractAuditEvidence(sessionId, opts) {
+    const maxRows = opts?.maxRows ?? DEFAULT_MAX_ROWS;
+    const sinceIso = opts?.sinceIso;
+    const filePath = path.join(checkpointsRoot(), sessionId, 'tool-calls.jsonl');
+    let content;
+    try {
+        content = await fs.readFile(filePath, 'utf-8');
+    }
+    catch {
+        return NO_LOG_SENTINEL;
+    }
+    const rows = [];
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            continue; // malformed line — skip silently
+        }
+        const row = normalizeRow(parsed);
+        if (!row || !EVIDENCE_TOOL_RE.test(row.toolName))
+            continue;
+        // D-B attempt-window: drop rows recorded before this attempt started.
+        // ISO-8601 UTC strings compare correctly lexicographically. A row with no
+        // timestamp is never excluded (fail-open).
+        if (sinceIso && row.at !== null && row.at < sinceIso)
+            continue;
+        rows.push(row);
+    }
+    if (rows.length === 0)
+        return NO_EVIDENCE_ROWS;
+    return capRows(rows, maxRows).map(renderRow).join('\n');
+}
+/**
+ * D-F two-tier cap. Returns at most `maxRows` rows in chronological order.
+ * Eviction order when over budget: oldest EXISTENCE reads first, then (only
+ * if still over and no reads remain) oldest PROTECTED rows. Writes are thus
+ * never evicted by reads.
+ */
+function capRows(rows, maxRows) {
+    if (rows.length <= maxRows)
+        return rows;
+    let over = rows.length - maxRows;
+    const dropped = new Set();
+    // Pass 1 — drop oldest existence reads.
+    for (let i = 0; i < rows.length && over > 0; i++) {
+        if (rows[i].kind === 'existence') {
+            dropped.add(i);
+            over--;
+        }
+    }
+    // Pass 2 — reads exhausted, still over: drop oldest protected rows (writes
+    // evicting older writes is the original 60-cap behavior, not a read winning).
+    for (let i = 0; i < rows.length && over > 0; i++) {
+        if (!dropped.has(i)) {
+            dropped.add(i);
+            over--;
+        }
+    }
+    return rows.filter((_, i) => !dropped.has(i));
+}