@dev.fast/whiteboard 0.0.0-stage → 0.2.0

package/dist/review-agent-traces-DNJFYzc8.js

@@ -0,0 +1,3866 @@
+import { d as gitAt, u as git, v as resolveRepoContext } from "./src-CmdiBL20.js";
+import { a as jsonNumber, c as jsonString, i as jsonBoolean, m as isStringValue, n as isJsonObject, o as jsonObject, r as jsonArray, t as isJsonArray, u as parseJsonText } from "./src-X9phtB2j.js";
+import { a as TRACE_STORE_CLIENT_ID, b as commitShaSchema, c as deleteStoreResponseSchema, d as listUploadsResponseSchema, f as storeErrorCodeSchema, g as uploadManifestMismatch, h as traceObjectNameSchema, i as storeRoutes, l as listSessionsResponseSchema, m as storeResponseSchema, n as DEVICE_TOKEN_PATH, o as beginUploadResponseSchema, p as storeErrorEnvelopeSchema, r as SESSION_PATH, s as completeUploadResponseSchema, t as DEVICE_CODE_PATH, x as sessionIdSchema } from "./src-CGP5ytbV.js";
+import { A as devReviewHome, E as writeTraceConfigFile, M as writeFileAtomic, P as writePrivateJsonAtomic, S as readTraceConfigFile, _ as emptyTraceConfig, c as resolveS3Setup, f as traceEnvValue$1, g as currentStore, h as TraceConfigurationError, i as isS3MockMode, j as normalizeStoreOrigin, l as s3CacheIdentity, m as DEFAULT_HOSTED_ORIGIN, n as clearTraceEnvCache$1, u as s3MockRoot, v as enabledOriginsOf, w as s3Store, x as hostedOrigin, y as hasHostedStore } from "./s3-config-CAxhO9u_.js";
+import { t as errorMessage } from "./error-message-OtiDonty.js";
+import { createHash, randomBytes } from "node:crypto";
+import { z } from "zod";
+import { closeSync, createReadStream, createWriteStream, existsSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
+import { chmod, mkdir, mkdtemp, readFile, readdir, rename, rm, stat } from "node:fs/promises";
+import path from "node:path";
+import os, { homedir, tmpdir } from "node:os";
+import { spawn } from "node:child_process";
+import { Readable, Transform } from "node:stream";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { pipeline } from "node:stream/promises";
+import { createGunzip, createGzip } from "node:zlib";
+//#region ../trace-protocol/src/event-text.ts
+function extractTraceEventText$1(event) {
+	if (!event) return "";
+	if (event.kind === "user") return event.text;
+	if (event.kind === "assistant") return event.markdown;
+	if (event.kind === "tool") return [
+		event.title,
+		event.command,
+		event.input,
+		event.output
+	].filter(Boolean).join(" ");
+	if (event.kind === "separator") return event.label;
+	return "";
+}
+//#endregion
+//#region ../trace-core/src/cli-output.ts
+/** The stream a human report belongs on. */
+function humanStream(output) {
+	return output.json ? output.stderr : output.stdout;
+}
+/** Writes one event line, and only under --json. */
+function emitJsonEvent(output, event) {
+	if (output.json) output.stdout.write(`${JSON.stringify(event)}\n`);
+}
+/**
+* Reports a failure on both channels and returns the exit code.
+*
+* The human message always reaches stderr. Under --json the same message also
+* reaches stdout as a parseable error event, so an agent never has to read
+* prose to learn why a command failed.
+*/
+function failWithJsonError(output, stage, message) {
+	output.stderr.write(`${message}\n`);
+	emitJsonEvent(output, {
+		event: "error",
+		stage,
+		message
+	});
+	return 1;
+}
+const VALUE_FLAGS = /* @__PURE__ */ new Set([
+	"--review",
+	"--session",
+	"--agent-session"
+]);
+/**
+* Report whether the caller asked for JSON, by reading raw argv.
+*
+* A usage error happens during parsing, before commander resolves any option,
+* so the error path cannot read the parsed value. Actions read the parsed
+* option instead; this scan only has to answer for failures.
+*/
+function jsonRequestedInArgv(argv) {
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (token === "--") return false;
+		if (VALUE_FLAGS.has(token)) {
+			index += 1;
+			continue;
+		}
+		if (token === "--json" || token === "--json=true") return true;
+	}
+	return false;
+}
+//#endregion
+//#region ../trace-core/src/store-authorization.ts
+const context = new AsyncLocalStorage();
+/** Only a foreground CLI installs this callback; hooks never prompt. */
+function withStoreAuthorization(authorize, operation) {
+	return context.run({
+		authorize,
+		attempted: false
+	}, operation);
+}
+async function requestStoreAuthorization(origin) {
+	const scope = context.getStore();
+	if (!scope || scope.attempted) return void 0;
+	scope.attempted = true;
+	return scope.authorize(origin);
+}
+//#endregion
+//#region ../trace-core/src/store-client.ts
+const DEFAULT_TIMEOUT_MS = 3e4;
+/** Largest metadata answer the client reads; object bytes never come this way. */
+const MAX_STORE_RESPONSE_BYTES = 8388608;
+/**
+* The message for a store whose responses do not match this client's
+* contract. A 0.1 store, for example, answers a begin call without an
+* `uploadId`.
+*/
+const STORE_UPGRADE_REQUIRED_MESSAGE = "The trace store does not support this version of Review. Update Review or use a matching store.";
+/**
+* The OAuth device-flow error shape used by the Better Auth device
+* endpoints, e.g. `{"error":"invalid_grant","error_description":"..."}`.
+* This is distinct from the store's own `storeErrorEnvelopeSchema`.
+*/
+const oauthDeviceErrorSchema = z.object({
+	error: z.string(),
+	error_description: z.string().optional()
+});
+var StoreApiError = class extends Error {
+	code;
+	status;
+	constructor(code, status, message) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.name = "StoreApiError";
+	}
+};
+var StoreClient = class {
+	origin;
+	token;
+	fetchImpl;
+	timeoutMs;
+	constructor(options) {
+		this.origin = options.origin;
+		this.token = options.token;
+		this.fetchImpl = options.fetch ?? globalThis.fetch;
+		this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	}
+	async listOwnUploads(repositoryId, query = {}) {
+		const params = new URLSearchParams();
+		if (query.session !== void 0) params.set("session", query.session);
+		if (query.cursor !== void 0) params.set("cursor", query.cursor);
+		if (query.limit !== void 0) params.set("limit", String(query.limit));
+		return this.get(storeRoutes.ownUploads(repositoryId), listUploadsResponseSchema, params);
+	}
+	async deviceCode(traces = true) {
+		return this.requestJson(DEVICE_CODE_PATH, {
+			client_id: TRACE_STORE_CLIENT_ID,
+			scope: traces ? "repo" : "identity"
+		}, void 0);
+	}
+	async deviceToken(deviceCode) {
+		const url = new URL(DEVICE_TOKEN_PATH, this.origin);
+		const response = await this.fetchImpl(url.toString(), {
+			method: "POST",
+			headers: this.jsonHeaders(),
+			body: JSON.stringify({
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				device_code: deviceCode,
+				client_id: TRACE_STORE_CLIENT_ID
+			}),
+			signal: AbortSignal.timeout(this.timeoutMs)
+		});
+		if (response.status === 400) {
+			const raw = await this.readJsonBody(response);
+			const oauthError = oauthDeviceErrorSchema.safeParse(raw);
+			if (oauthError.success && (oauthError.data.error === "authorization_pending" || oauthError.data.error === "slow_down")) return { pending: oauthError.data.error };
+			throw this.oauthOrEnvelopeError(raw, response.status);
+		}
+		if (!response.ok) throw await this.toStoreApiError(response);
+		return await response.json();
+	}
+	async session() {
+		return this.get(SESSION_PATH, z.object({ user: z.object({
+			id: z.string().min(1),
+			name: z.string()
+		}) }));
+	}
+	async createStore(body) {
+		return this.requestJson(storeRoutes.stores(), body, storeResponseSchema);
+	}
+	async findStore(query) {
+		try {
+			return await this.get(storeRoutes.stores(), storeResponseSchema, new URLSearchParams({
+				owner: query.owner,
+				name: query.name
+			}));
+		} catch (error) {
+			if (error instanceof StoreApiError && error.code === "not_found") return null;
+			throw error;
+		}
+	}
+	async beginUpload(repositoryId, sessionId, body) {
+		return this.requestJson(storeRoutes.uploads(repositoryId, sessionId), body, beginUploadResponseSchema);
+	}
+	async completeUpload(repositoryId, sessionId, uploadId, body) {
+		return this.requestJson(storeRoutes.uploadComplete(repositoryId, sessionId, uploadId), body, completeUploadResponseSchema);
+	}
+	/** Deletion is logical; the store answers 202 while an operator removes the objects. */
+	async deleteStore(repositoryId) {
+		return this.send("DELETE", storeRoutes.store(repositoryId), void 0, deleteStoreResponseSchema);
+	}
+	async listSessions(repositoryId, query) {
+		const params = new URLSearchParams();
+		if (query.commit) params.set("commit", query.commit);
+		if (query.session) params.set("session", query.session);
+		if (query.limit !== void 0) params.set("limit", String(query.limit));
+		if (query.cursor) params.set("cursor", query.cursor);
+		return this.get(storeRoutes.sessions(repositoryId), listSessionsResponseSchema, params);
+	}
+	jsonHeaders() {
+		return this.token ? {
+			"content-type": "application/json",
+			authorization: `Bearer ${this.token}`
+		} : { "content-type": "application/json" };
+	}
+	async get(path, schema, query) {
+		return this.send("GET", path, void 0, schema, query);
+	}
+	async requestJson(path, body, schema) {
+		return this.send("POST", path, body, schema);
+	}
+	async send(method, path, body, schema, query) {
+		const url = new URL(path, this.origin);
+		if (query) for (const [key, value] of query) url.searchParams.set(key, value);
+		const headers = {};
+		if (this.token) headers.authorization = `Bearer ${this.token}`;
+		if (body !== void 0) headers["content-type"] = "application/json";
+		const response = await this.fetchImpl(url.toString(), {
+			method,
+			headers,
+			body: body === void 0 ? void 0 : JSON.stringify(body),
+			signal: AbortSignal.timeout(this.timeoutMs)
+		});
+		if (!response.ok) {
+			const error = await this.toStoreApiError(response);
+			if (error.code === "repository_authorization_required") {
+				const token = await requestStoreAuthorization(this.origin);
+				if (token) {
+					this.token = token;
+					return this.send(method, path, body, schema, query);
+				}
+			}
+			throw error;
+		}
+		const contentLength = Number(response.headers.get("content-length") ?? "0");
+		if (contentLength > MAX_STORE_RESPONSE_BYTES) throw new StoreApiError("internal", response.status, `The trace store answered ${contentLength} bytes; the client accepts at most ${MAX_STORE_RESPONSE_BYTES}.`);
+		return this.parseJson(response, schema);
+	}
+	async parseJson(response, schema) {
+		const raw = await response.json();
+		if (!schema) return raw;
+		const result = schema.safeParse(raw);
+		if (!result.success) throw new StoreApiError("upgrade_required", response.status, STORE_UPGRADE_REQUIRED_MESSAGE);
+		return result.data;
+	}
+	async toStoreApiError(response) {
+		const raw = await this.readJsonBody(response);
+		return this.oauthOrEnvelopeError(raw, response.status);
+	}
+	/**
+	* Reads a response body once, as text, and parses it as JSON. Returns
+	* `undefined` if the body cannot be read or is not valid JSON.
+	*/
+	async readJsonBody(response) {
+		let text;
+		try {
+			text = await response.text();
+		} catch {
+			return;
+		}
+		try {
+			return parseJsonText(text);
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Builds a StoreApiError from an already-parsed body, which is either the
+	* store's own `{ error: { code, message } }` envelope or the OAuth
+	* device-flow error shape `{ error, error_description }` used by the
+	* Better Auth device endpoints.
+	*/
+	oauthOrEnvelopeError(raw, status) {
+		if (raw === void 0) return new StoreApiError("internal", status, "The store returned an unreadable response.");
+		const oauthError = oauthDeviceErrorSchema.safeParse(raw);
+		if (oauthError.success) {
+			const knownCode = storeErrorCodeSchema.safeParse(oauthError.data.error);
+			return new StoreApiError(knownCode.success ? knownCode.data : "invalid_request", status, oauthError.data.error_description ?? oauthError.data.error);
+		}
+		const result = storeErrorEnvelopeSchema.safeParse(raw);
+		if (!result.success) return new StoreApiError("internal", status, "The store returned an error response that does not match the contract.");
+		return new StoreApiError(result.data.error.code, status, result.data.error.message);
+	}
+};
+//#endregion
+//#region ../trace-core/src/store-auth.ts
+const DEFAULT_STORE_ORIGIN = DEFAULT_HOSTED_ORIGIN;
+const storeAuthSchema = z.object({
+	origin: z.string().min(1),
+	token: z.string().min(1),
+	login: z.string(),
+	savedAt: z.string()
+});
+/** Slow-down backoff added to the poll interval, per the OAuth device spec. */
+const SLOW_DOWN_MS = 5e3;
+function storeAuthPath(env = process.env) {
+	return path.join(devReviewHome(env), "auth.json");
+}
+async function readStoreAuth(env = process.env) {
+	let raw;
+	try {
+		raw = await readFile(storeAuthPath(env), "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	const result = storeAuthSchema.safeParse(parsed);
+	if (!result.success) return null;
+	try {
+		return {
+			...result.data,
+			origin: normalizeStoreOrigin(result.data.origin)
+		};
+	} catch {
+		return null;
+	}
+}
+async function writeStoreAuth(auth, env = process.env) {
+	await writePrivateJsonAtomic(storeAuthPath(env), {
+		...auth,
+		origin: normalizeStoreOrigin(auth.origin)
+	});
+}
+async function clearStoreAuth(env = process.env) {
+	await rm(storeAuthPath(env), { force: true });
+}
+/** A client bound to the saved login. Throws when no login is saved. */
+async function requireStoreClient(env = process.env) {
+	const auth = await readStoreAuth(env);
+	if (!auth) throw new Error(`Run \`whiteboard login\` first.`);
+	return new StoreClient({
+		origin: auth.origin,
+		token: auth.token
+	});
+}
+async function defaultSleep(ms) {
+	await new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** The command that opens a URL in the user's browser on this platform. */
+function browserOpenCommand(platform = process.platform) {
+	return platform === "darwin" ? "open" : "xdg-open";
+}
+/** Opens a URL in the browser. Callers inject a stub in tests. */
+async function openUrlInBrowser(url) {
+	const { spawn } = await import("node:child_process");
+	const child = spawn(browserOpenCommand(), [url], {
+		stdio: "ignore",
+		detached: true
+	});
+	child.on("error", () => {});
+	child.unref();
+}
+async function runStoreLogin(input) {
+	const output = {
+		json: input.json,
+		stdout: input.stdout,
+		stderr: input.stderr
+	};
+	let origin;
+	try {
+		origin = normalizeStoreOrigin(input.origin ?? DEFAULT_STORE_ORIGIN);
+	} catch (error) {
+		return failWithJsonError(output, "login", errorMessage(error));
+	}
+	const openUrl = input.openUrl ?? openUrlInBrowser;
+	const sleep = input.sleep ?? defaultSleep;
+	const client = new StoreClient({
+		origin,
+		fetch: input.fetch
+	});
+	const existing = input.traces ? await readStoreAuth(input.env) : null;
+	let expectedUser;
+	if (existing?.origin === origin) try {
+		expectedUser = (await new StoreClient({
+			origin,
+			token: existing.token,
+			fetch: input.fetch
+		}).session()).user.id;
+	} catch {}
+	let device;
+	try {
+		device = await client.deviceCode(input.traces ?? true);
+	} catch (error) {
+		return failWithJsonError(output, "login", error instanceof StoreApiError ? error.message : "Could not start the login.");
+	}
+	humanStream(output).write(`Open ${device.verification_uri_complete}\n`);
+	humanStream(output).write(`Code: ${device.user_code}\n`);
+	emitJsonEvent(output, {
+		event: "login",
+		status: "pending",
+		url: device.verification_uri_complete,
+		userCode: device.user_code
+	});
+	if (!input.noBrowser) await openUrl(device.verification_uri_complete);
+	let intervalMs = Math.max(1, device.interval) * 1e3;
+	const expiresAt = Date.now() + device.expires_in * 1e3;
+	let token;
+	while (Date.now() < expiresAt) {
+		await sleep(intervalMs);
+		let result;
+		try {
+			result = await client.deviceToken(device.device_code);
+		} catch (error) {
+			return failWithJsonError(output, "login", error instanceof StoreApiError ? error.message : "The login failed.");
+		}
+		if ("pending" in result) {
+			if (result.pending === "slow_down") intervalMs += SLOW_DOWN_MS;
+			continue;
+		}
+		token = result.access_token;
+		break;
+	}
+	if (!token) return failWithJsonError(output, "login", `The login expired. Run \`whiteboard login\` again.`);
+	const authedClient = new StoreClient({
+		origin,
+		token,
+		fetch: input.fetch
+	});
+	let login;
+	try {
+		const session = await authedClient.session();
+		if (expectedUser && session.user.id !== expectedUser) throw new Error("Authorize traces with the same GitHub account.");
+		login = session.user.name;
+	} catch (error) {
+		return failWithJsonError(output, "login", error instanceof StoreApiError ? error.message : "Could not read the login.");
+	}
+	await writeStoreAuth({
+		origin,
+		token,
+		login,
+		savedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}, input.env);
+	emitJsonEvent(output, {
+		event: "login",
+		status: "ok",
+		login
+	});
+	humanStream(output).write(`You are logged in as ${login}.\n`);
+	return 0;
+}
+async function runStoreLogout(input) {
+	const existing = await readStoreAuth(input.env);
+	await clearStoreAuth(input.env);
+	input.stdout.write(existing ? "You are logged out.\n" : "You were not logged in.\n");
+	return 0;
+}
+async function runStoreWhoami(input) {
+	const output = {
+		json: input.json,
+		stdout: input.stdout,
+		stderr: input.stderr
+	};
+	const auth = await readStoreAuth(input.env);
+	if (!auth) return failWithJsonError(output, "whoami", `Run \`whiteboard login\` first.`);
+	const client = new StoreClient({
+		origin: auth.origin,
+		token: auth.token,
+		fetch: input.fetch
+	});
+	let login;
+	try {
+		login = (await client.session()).user.name;
+	} catch (error) {
+		return failWithJsonError(output, "whoami", error instanceof StoreApiError ? error.message : "Could not reach the hosted trace store.");
+	}
+	emitJsonEvent(output, {
+		event: "whoami",
+		login,
+		origin: auth.origin
+	});
+	humanStream(output).write(`Logged in to ${auth.origin} as ${login}.\n`);
+	return 0;
+}
+//#endregion
+//#region ../trace-core/src/trace-consent.ts
+async function readTraceUserConfig(devHome) {
+	return (await readTraceUserConfigFile(devHome)).consent;
+}
+/** The consent entries together with the file read they came from. */
+async function readTraceUserConfigFile(devHome) {
+	const file = readTraceConfigFile({ devHome: devHome ?? devReviewHome() });
+	if (file.error) throw new TraceConfigurationError(file.error);
+	return {
+		file,
+		consent: {
+			version: 2,
+			repositories: (file.config?.repositories ?? []).map((entry) => ({
+				repositoryId: entry.repositoryId,
+				name: entry.name,
+				enabledOrigins: enabledOriginsOf(entry).flatMap((origin) => {
+					try {
+						return [normalizeStoreOrigin(origin)];
+					} catch {
+						return [];
+					}
+				}),
+				allowedAt: entry.allowedAt ?? null
+			}))
+		}
+	};
+}
+async function writeRepositories(file, repositories) {
+	await writeTraceConfigFile(file, {
+		...file.config ?? emptyTraceConfig(),
+		repositories
+	});
+}
+function toConfigEntry(entry) {
+	const written = {
+		repositoryId: entry.repositoryId,
+		name: entry.name,
+		enabledOrigins: entry.enabledOrigins
+	};
+	if (entry.allowedAt) written.allowedAt = entry.allowedAt;
+	return written;
+}
+/**
+* Allows one repository at one origin. A repository has one entry, keyed by
+* its immutable id; allowing it at another origin appends to its list, and
+* a rename updates the display name.
+*/
+async function allowTraceRepository(entry, devHome = devReviewHome()) {
+	const origin = normalizeStoreOrigin(entry.origin);
+	if (!Number.isSafeInteger(entry.repositoryId) || entry.repositoryId < 1) throw new Error("The trace repository id must be a positive integer.");
+	const { file, consent: config } = await readTraceUserConfigFile(devHome);
+	const existing = config.repositories.find((candidate) => candidate.repositoryId === entry.repositoryId);
+	const merged = {
+		repositoryId: entry.repositoryId,
+		name: entry.name,
+		enabledOrigins: [.../* @__PURE__ */ new Set([...existing?.enabledOrigins ?? [], origin])],
+		allowedAt: existing?.allowedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const repositories = [...config.repositories.filter((candidate) => candidate.repositoryId !== entry.repositoryId && candidate.name.toLowerCase() !== entry.name.toLowerCase()), merged];
+	await writeRepositories(file, repositories.map(toConfigEntry));
+	return {
+		version: 2,
+		repositories
+	};
+}
+/**
+* Withdraws consent for a repository at every origin. The immutable id
+* catches an entry whose display name moved; the name catches one whose id
+* this machine never learned.
+*/
+async function denyTraceRepository(repository, devHome = devReviewHome()) {
+	const { file, consent: config } = await readTraceUserConfigFile(devHome);
+	const repositories = config.repositories.filter((existing) => existing.name.toLowerCase() !== repository.name.toLowerCase() && (repository.repositoryId == null || existing.repositoryId !== repository.repositoryId));
+	const removed = repositories.length !== config.repositories.length;
+	if (removed) await writeRepositories(file, repositories.map(toConfigEntry));
+	return removed;
+}
+function findTraceRepository(config, name) {
+	return config.repositories.find((entry) => entry.name.toLowerCase() === name.toLowerCase()) ?? null;
+}
+//#endregion
+//#region ../trace-core/src/trace-repo.ts
+function parseRepo(value) {
+	const parts = value.split("/");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) throw new Error("Repository must be OWNER/REPO.");
+	return {
+		owner: parts[0],
+		repo: parts[1]
+	};
+}
+function traceRepoName(repo) {
+	return `${repo.owner}/${repo.repo}`;
+}
+async function inferRepoFromGit(cwd) {
+	if (process.env.GITHUB_REPOSITORY) return parseRepo(process.env.GITHUB_REPOSITORY);
+	const slug = (await resolveRepoContext(cwd))?.githubSlug;
+	if (slug) return parseRepo(slug);
+	const result = await git(cwd, [
+		"remote",
+		"get-url",
+		"origin"
+	], { allowFailure: true });
+	if (result.ok && result.stdout.trim()) {
+		const raw = result.stdout.trim();
+		const match = /[:/]([^/]+)\/([^/]+?)(?:\.git)?$/.exec(raw);
+		if (match && match[1] && match[2]) return parseRepo(`${match[1]}/${match[2]}`);
+	}
+	throw new Error("Could not infer GitHub repository from origin remote.");
+}
+//#endregion
+//#region ../trace-core/src/trace-repository-target.ts
+/**
+* The identity of one target on this machine: a short digest of the origin
+* and the repository id. Cache directories and provenance records use it,
+* so a rename keeps its cache and a second origin never shares one.
+*/
+function traceTargetKey(target) {
+	if (!Number.isSafeInteger(target.repositoryId) || target.repositoryId < 1) throw new Error("The trace repository id must be a positive integer.");
+	const origin = normalizeStoreOrigin(target.origin);
+	return `${createHash("sha256").update(origin).digest("hex").slice(0, 16)}/r${target.repositoryId}`;
+}
+const cachedTargetSchema = z.object({
+	origin: z.string(),
+	repositoryId: z.number().int().positive(),
+	storeId: z.string().regex(/^[0-9a-f]{32}$/),
+	name: z.string().min(1),
+	/** The checkout's own `owner/repo` at the time of the lookup. */
+	checkout: z.string().min(1),
+	savedAt: z.string()
+});
+/** The shared Git directory of a checkout. Sibling worktrees share it. */
+async function gitCommonDirectory(cwd) {
+	return (await resolveRepoContext(cwd).catch(() => null))?.commonDir ?? null;
+}
+async function cachedTargetPath(cwd, origin, devHome) {
+	const commonDir = await gitCommonDirectory(cwd);
+	if (!commonDir) return null;
+	const key = createHash("sha256").update(`${origin}\n${commonDir}`).digest("hex");
+	return path.join(devHome, "trace", "targets", `${key}.json`);
+}
+/**
+* Saves the target this checkout resolved to, so an offline read can reuse
+* the identity the store confirmed. Tests call it to stand in for a lookup.
+*/
+async function rememberTraceRepositoryTarget(input) {
+	const devHome = input.devHome ?? devReviewHome();
+	const origin = normalizeStoreOrigin(input.target.origin);
+	const filePath = await cachedTargetPath(input.cwd, origin, devHome);
+	if (!filePath) return;
+	await writePrivateJsonAtomic(filePath, {
+		...input.target,
+		origin,
+		checkout: input.checkout ?? input.target.name,
+		savedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+/**
+* The target this checkout resolved to on an earlier online lookup, or null
+* when none was saved or the saved one names another origin or repository.
+*/
+async function readCachedTraceRepositoryTarget(input) {
+	const devHome = input.devHome ?? devReviewHome();
+	const origin = normalizeStoreOrigin(input.origin);
+	const filePath = await cachedTargetPath(input.cwd, origin, devHome);
+	if (!filePath) return null;
+	let raw;
+	try {
+		raw = await readFile(filePath, "utf8");
+	} catch {
+		return null;
+	}
+	let parsed;
+	try {
+		const result = cachedTargetSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return null;
+		parsed = result.data;
+	} catch {
+		return null;
+	}
+	if (parsed.origin !== origin) return null;
+	const checkout = await inferRepoFromGit(input.cwd).catch(() => null);
+	if (!checkout || traceRepoName(checkout).toLowerCase() !== parsed.checkout.toLowerCase()) return null;
+	return {
+		origin: parsed.origin,
+		repositoryId: parsed.repositoryId,
+		storeId: parsed.storeId,
+		name: parsed.name
+	};
+}
+/** Whether a store failure means the store could not answer at all. */
+function isStoreUnreachable(error) {
+	return !(error instanceof StoreApiError) || error.status >= 500;
+}
+/**
+* Resolves the checkout to its trace target through the store. A network
+* failure on a read (`write === false`) falls back to the saved target of
+* this checkout and reports `offline: true`. A write never falls back.
+*/
+async function resolveTraceRepositoryTarget(input) {
+	const origin = normalizeStoreOrigin(input.origin);
+	const repo = await inferRepoFromGit(input.cwd);
+	const checkout = traceRepoName(repo);
+	let store;
+	try {
+		store = await input.client.findStore({
+			owner: repo.owner,
+			name: repo.repo
+		});
+	} catch (error) {
+		const cause = error instanceof Error ? error : new Error(String(error));
+		if (input.write || !isStoreUnreachable(cause) || cause instanceof StoreApiError && cause.code === "store_deleted") throw cause;
+		const cached = await readCachedTraceRepositoryTarget({
+			cwd: input.cwd,
+			origin,
+			devHome: input.devHome
+		});
+		if (!cached) throw cause;
+		return {
+			target: cached,
+			offline: true
+		};
+	}
+	if (!store) throw new StoreApiError("not_found", 404, `This repository has no active hosted trace store. Run \`whiteboard trace store create\`.`);
+	if (store.status !== "active") throw new StoreApiError("store_deleted", 410, "This repository's trace store was deleted.");
+	const target = {
+		origin,
+		repositoryId: store.repositoryId,
+		storeId: store.storeId,
+		name: store.displayName
+	};
+	await rememberTraceRepositoryTarget({
+		cwd: input.cwd,
+		target,
+		checkout,
+		devHome: input.devHome
+	}).catch(() => void 0);
+	return {
+		target,
+		offline: false
+	};
+}
+/**
+* The consent entry that covers this target: the repository, allowed at the
+* target's origin. An entry allowed only elsewhere names where.
+*/
+async function requireTraceConsent(target, devHome) {
+	const entry = (await readTraceUserConfig(devHome)).repositories.find((candidate) => candidate.repositoryId === target.repositoryId);
+	if (entry?.enabledOrigins.includes(target.origin)) return entry;
+	if (entry) throw new Error(`${entry.name} is allowed to publish traces to ${entry.enabledOrigins.join(", ")}, not ${target.origin}. Run \`whiteboard trace allow .\` while logged in there.`);
+	throw new Error(`This repository is not allowed for trace publication. Run \`whiteboard trace allow .\`.`);
+}
+//#endregion
+//#region ../trace-core/src/trace-session-provenance.ts
+/** Records older than this are pruned when a new record is written. */
+const PROVENANCE_RETENTION_MS = 7776e6;
+const provenanceRecordSchema = z.object({
+	identity: z.string().min(1),
+	allowed: z.boolean(),
+	recordedAt: z.string()
+});
+function capturedSessionsDir(devHome = devReviewHome()) {
+	return path.join(devHome, "trace", "captured-sessions");
+}
+function sessionDir(sessionId, devHome) {
+	return path.join(capturedSessionsDir(devHome), sessionIdSchema.parse(sessionId));
+}
+/**
+* The identity of one checkout for provenance. An allowed checkout is its
+* target key, so sibling worktrees of one repository count as one place. An
+* unallowed checkout is named by its repository, or by its Git directory
+* when it has no GitHub remote.
+*/
+function traceCaptureIdentity(input) {
+	if ("target" in input) return {
+		identity: traceTargetKey(input.target),
+		allowed: true
+	};
+	if ("repositoryName" in input) return {
+		identity: `unallowed:${input.repositoryName.toLowerCase()}`,
+		allowed: false
+	};
+	return {
+		identity: `unallowed:${input.gitDir}`,
+		allowed: false
+	};
+}
+/**
+* Writes the record for one session and identity when it does not exist
+* yet. Heartbeats call this often, so an existing record costs one stat.
+*/
+async function recordTraceSessionProvenance(input) {
+	const devHome = input.devHome ?? devReviewHome();
+	const fileName = `${createHash("sha256").update(input.identity).digest("hex")}.json`;
+	const filePath = path.join(sessionDir(input.sessionId, devHome), fileName);
+	if (await stat(filePath).then(() => true, () => false)) return;
+	const record = {
+		identity: input.identity,
+		allowed: input.allowed,
+		recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	await writePrivateJsonAtomic(filePath, record);
+	await pruneStaleProvenance(devHome).catch(() => void 0);
+}
+async function pruneStaleProvenance(devHome) {
+	const root = capturedSessionsDir(devHome);
+	const cutoff = Date.now() - PROVENANCE_RETENTION_MS;
+	for (const entry of await readdir(root, { withFileTypes: true })) {
+		if (!entry.isDirectory()) continue;
+		const dir = path.join(root, entry.name);
+		const info = await stat(dir).catch(() => null);
+		if (info && info.mtimeMs < cutoff) await rm(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Every record the hooks wrote for one session. */
+async function readTraceSessionProvenance(sessionId, devHome) {
+	const dir = sessionDir(sessionId, devHome ?? devReviewHome());
+	const files = await readdir(dir).catch(() => []);
+	const records = [];
+	for (const file of files.sort()) {
+		if (!file.endsWith(".json")) continue;
+		try {
+			const parsed = provenanceRecordSchema.safeParse(JSON.parse(await readFile(path.join(dir, file), "utf8")));
+			if (parsed.success) records.push(parsed.data);
+		} catch {}
+	}
+	return records;
+}
+var TraceProvenanceError = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+		this.name = "TraceProvenanceError";
+	}
+};
+/** Require an allowed record and no records from another repository or origin. */
+async function requireTraceSessionProvenance(sessionId, target, devHome) {
+	const records = await readTraceSessionProvenance(sessionId, devHome);
+	if (records.length === 0) throw new TraceProvenanceError("provenance_missing", `This session was not captured in ${target.name}. Start a new agent session there after \`whiteboard trace allow .\`; a commit trailer does not authorize publication.`);
+	const expected = traceTargetKey(target);
+	const samePlace = `unallowed:${target.name.toLowerCase()}`;
+	if (!(records.some((record) => record.allowed && record.identity === expected) && records.every((record) => record.identity === expected || record.identity === samePlace))) {
+		const mixed = records.some((record) => record.identity !== expected && record.identity !== samePlace);
+		throw new TraceProvenanceError(mixed ? "provenance_mixed" : "provenance_unapproved", mixed ? `This session also ran in a repository or destination outside ${target.name}. Start a new session in the allowed repository.` : `No hook recorded allowed capture for this session in ${target.name}. If publication is authorized, allow the repository and wait for the next hook before syncing, or start a new session.`);
+	}
+}
+//#endregion
+//#region ../trace-core/src/trace-store-transport.ts
+/** An object response failed. Its URL is deliberately not retained. */
+var TraceObjectHttpError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+const DEFAULT_LIMITS = {
+	timeoutMs: 3e5,
+	maxExpandedBytes: 1073741824
+};
+/**
+* One private directory per process holds every staged upload. Its mode is
+* 0700, so other local accounts cannot list or read staged transcripts. The
+* process removes it on exit; a crash leaves it to the OS temp cleaner.
+*/
+let stagingDirectory = null;
+function stagingDir() {
+	stagingDirectory ??= (async () => {
+		const dir = await mkdtemp(path.join(os.tmpdir(), "review-trace-"));
+		await chmod(dir, 448);
+		process.once("exit", () => {
+			try {
+				rmSync(dir, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+		});
+		return dir;
+	})();
+	stagingDirectory.catch(() => {
+		stagingDirectory = null;
+	});
+	return stagingDirectory;
+}
+/**
+* Compresses one file into the private staging directory. The size and the
+* digest describe the gzipped bytes, which is what the store signs and checks.
+*/
+async function gzipToTemp(sourcePath) {
+	const targetPath = path.join(await stagingDir(), `${randomBytes(8).toString("hex")}.jsonl.gz`);
+	const hash = createHash("sha256");
+	const digestTap = new Transform({ transform(chunk, _encoding, callback) {
+		hash.update(chunk);
+		callback(null, chunk);
+	} });
+	try {
+		await pipeline(createReadStream(sourcePath), createGzip(), digestTap, createWriteStream(targetPath, {
+			flags: "wx",
+			mode: 384
+		}));
+	} catch (cause) {
+		await rm(targetPath, { force: true });
+		throw cause;
+	}
+	return {
+		path: targetPath,
+		size: (await stat(targetPath)).size,
+		sha256: hash.digest("hex"),
+		cleanup: async () => {
+			await rm(targetPath, { force: true });
+		}
+	};
+}
+/** The transport used at run time. */
+function createHttpTraceStoreTransport(client, fetchImpl = globalThis.fetch, options = {}) {
+	const limits = {
+		...DEFAULT_LIMITS,
+		...options.limits
+	};
+	return {
+		beginUpload: (repositoryId, sessionId, body) => client.beginUpload(repositoryId, sessionId, body),
+		completeUpload: (repositoryId, sessionId, uploadId, body) => client.completeUpload(repositoryId, sessionId, uploadId, body),
+		listSessions: (repositoryId, query) => client.listSessions(repositoryId, query),
+		async putObject(upload, filePath) {
+			const init = {
+				method: "PUT",
+				headers: upload.headers,
+				body: Readable.toWeb(createReadStream(filePath)),
+				duplex: "half",
+				signal: AbortSignal.timeout(limits.timeoutMs)
+			};
+			const response = await fetchImpl(upload.url, init);
+			if (response.status === 412) return;
+			if (!response.ok) throw new Error(await storageErrorMessage(response, `store ${upload.name}`));
+		},
+		async getObject(object, destinationPath) {
+			const signal = AbortSignal.timeout(limits.timeoutMs);
+			const response = await fetchImpl(object.url, {
+				method: "GET",
+				signal
+			});
+			if (!response.ok) throw new TraceObjectHttpError(response.status, await storageErrorMessage(response, "read the object"));
+			const contentLength = response.headers.get("content-length");
+			if (contentLength !== null && Number(contentLength) !== object.size) throw new Error(`The trace store announced ${contentLength} bytes for ${object.name}; the session declared ${object.size}.`);
+			if (!response.body) throw new Error(`The trace store sent no body for ${object.name} (HTTP ${response.status}).`);
+			await writeVerifiedObject(Readable.fromWeb(response.body, { signal }), object, destinationPath, limits);
+		}
+	};
+}
+/**
+* Gunzips a compressed stream into `destinationPath` and only keeps the
+* result when the compressed bytes match the declared size and digest. The
+* output lands in a private temp file next to the destination first, so a
+* failed or corrupt transfer never touches an existing file.
+*/
+async function writeVerifiedObject(compressed, object, destinationPath, limits) {
+	await mkdir(path.dirname(destinationPath), { recursive: true });
+	const tempPath = `${destinationPath}.${randomBytes(6).toString("hex")}.tmp`;
+	const hash = createHash("sha256");
+	let compressedBytes = 0;
+	let expandedBytes = 0;
+	const compressedTap = new Transform({ transform(chunk, _encoding, callback) {
+		compressedBytes += chunk.byteLength;
+		if (compressedBytes > object.size) {
+			callback(/* @__PURE__ */ new Error(`The trace store sent more than the declared ${object.size} bytes for ${object.name}.`));
+			return;
+		}
+		hash.update(chunk);
+		callback(null, chunk);
+	} });
+	const expansionTap = new Transform({ transform(chunk, _encoding, callback) {
+		expandedBytes += chunk.byteLength;
+		if (expandedBytes > limits.maxExpandedBytes) {
+			callback(/* @__PURE__ */ new Error(`${object.name} expands past the ${limits.maxExpandedBytes} byte limit.`));
+			return;
+		}
+		callback(null, chunk);
+	} });
+	try {
+		await pipeline(compressed, compressedTap, createGunzip(), expansionTap, createWriteStream(tempPath, {
+			flags: "wx",
+			mode: 384
+		}));
+		if (compressedBytes !== object.size) throw new Error(`The trace store sent ${compressedBytes} bytes for ${object.name}; the session declared ${object.size}.`);
+		if (hash.digest("hex") !== object.sha256) throw new Error(`The bytes of ${object.name} do not match the declared checksum.`);
+		await rename(tempPath, destinationPath);
+	} catch (cause) {
+		await rm(tempPath, { force: true });
+		throw cause;
+	}
+}
+/**
+* A presigned URL carries credentials, so no message shows it. S3 answers with
+* an XML body whose `Code` names the fault.
+*/
+async function storageErrorMessage(response, action) {
+	let code = null;
+	try {
+		code = /<Code>([^<]+)<\/Code>/.exec(await response.text())?.[1] ?? null;
+	} catch {
+		code = null;
+	}
+	return code ? `The trace store did not ${action} (HTTP ${response.status}: ${code}).` : `The trace store did not ${action} (HTTP ${response.status}).`;
+}
+//#endregion
+//#region ../trace-core/src/trace-sync-status.ts
+const MAX_ERROR_LENGTH = 300;
+const syncFailureSchema = z.object({
+	session: z.string(),
+	repository: z.string().nullable(),
+	status: z.literal("failed"),
+	error: z.string(),
+	at: z.string(),
+	retry: z.string().optional(),
+	reason: z.enum([
+		"provenance_missing",
+		"provenance_unapproved",
+		"provenance_mixed",
+		"sync_failed"
+	]).optional()
+});
+function traceSyncStatusDir(devHome = devReviewHome()) {
+	return path.join(devHome, "trace", "sync-status");
+}
+function statusPath(sessionId, devHome) {
+	return path.join(traceSyncStatusDir(devHome), `${sessionIdSchema.parse(sessionId)}.json`);
+}
+/** Strips URLs and credentials from a message and caps its length. */
+function sanitizeTraceSyncError(message) {
+	const cleaned = message.replace(/https?:\/\/\S+/g, "<url>").replace(/Bearer \S+/g, "Bearer <token>").replace(/X-Amz-\S+/g, "<signature>").replace(/\s+/g, " ").trim();
+	return cleaned.length > MAX_ERROR_LENGTH ? `${cleaned.slice(0, 299)}…` : cleaned;
+}
+async function recordTraceSyncFailure(input) {
+	if (!sessionIdSchema.safeParse(input.sessionId).success) return;
+	const record = {
+		session: input.sessionId,
+		repository: input.repository,
+		status: "failed",
+		error: sanitizeTraceSyncError(input.error),
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		reason: input.reason ?? "sync_failed",
+		retry: input.reason ? void 0 : `whiteboard trace sync ${input.sessionId}`
+	};
+	await writePrivateJsonAtomic(statusPath(input.sessionId, input.devHome ?? devReviewHome()), record);
+}
+async function clearTraceSyncFailure(sessionId, devHome) {
+	if (!sessionIdSchema.safeParse(sessionId).success) return;
+	await rm(statusPath(sessionId, devHome ?? devReviewHome()), { force: true });
+}
+function describeTraceSyncFailure(failure) {
+	const retry = failure.reason === "sync_failed" && failure.retry ? ` Retry with \`${failure.retry}\`.` : "";
+	return `Failed background sync: session ${failure.session}${failure.repository ? ` of ${failure.repository}` : ""} at ${failure.at}: ${failure.error}${retry}\n`;
+}
+async function listTraceSyncFailures(devHome) {
+	const dir = traceSyncStatusDir(devHome ?? devReviewHome());
+	const files = await readdir(dir).catch(() => []);
+	const failures = [];
+	for (const file of files.sort()) {
+		if (!file.endsWith(".json")) continue;
+		try {
+			const parsed = syncFailureSchema.safeParse(JSON.parse(await readFile(path.join(dir, file), "utf8")));
+			if (parsed.success) failures.push(parsed.data);
+		} catch {}
+	}
+	return failures;
+}
+//#endregion
+//#region ../trace-core/src/trace-storage/types.ts
+/** The store answered with a refusal (forbidden, deleted, bad login). Nothing is served. */
+var TraceStorageDeniedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TraceStorageDeniedError";
+	}
+};
+/** The store did not answer; a saved copy may be served, labeled offline. */
+var TraceStorageUnavailableError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TraceStorageUnavailableError";
+	}
+};
+//#endregion
+//#region ../trace-core/src/trace-storage/hosted.ts
+function defaultWarning(message) {
+	process.stderr.write(`${message}\n`);
+}
+/**
+* One line that names why a store read failed, or null when the answer
+* means the store simply holds nothing for this repository or session.
+*/
+function storeReadWarning(error) {
+	if (error instanceof StoreApiError) {
+		if (error.code === "not_found") return null;
+		if (error.code === "unauthorized") return `Trace store request failed: unauthorized. Run \`whiteboard login\`.`;
+		if (error.code === "forbidden") return `Trace store request failed: forbidden. ${error.message}`;
+		return `Trace store request failed: ${error.message}`;
+	}
+	return `Trace store request failed: ${error.message}`;
+}
+/** The object name the store uses for one trace of a session. */
+function traceObjectName(traceName) {
+	if (traceName === "main") return "main.jsonl.gz";
+	const base = path.basename(traceName);
+	return `subagents/${base.endsWith(".jsonl") ? base : `${base}.jsonl`}.gz`;
+}
+/** The trace name behind one store object name. */
+function traceNameFromObject(name) {
+	if (name === "main.jsonl.gz") return "main";
+	return name.slice(10, -9);
+}
+function contentId(session, sha256) {
+	return `sha256:${sha256}@${session.generation}`;
+}
+var HostedTraceStorage = class HostedTraceStorage {
+	kind = "hosted";
+	target;
+	repositoryTarget;
+	offline;
+	transport;
+	devHome;
+	warn;
+	/** One listing per session per instance; an instance lives one operation. */
+	lookups = /* @__PURE__ */ new Map();
+	constructor(parts) {
+		this.repositoryTarget = parts.target;
+		this.target = {
+			kind: "hosted",
+			...parts.target
+		};
+		this.transport = parts.transport;
+		this.offline = parts.offline ?? false;
+		this.devHome = parts.devHome ?? devReviewHome();
+		this.warn = parts.onWarning ?? defaultWarning;
+	}
+	/** A storage over an already resolved target; tests use a memory transport. */
+	static fromParts(parts) {
+		return new HostedTraceStorage(parts);
+	}
+	/**
+	* The store for this checkout, or null when no store answers for it. A
+	* reader needs no consent entry: a login plus GitHub admin access is enough
+	* and the store enforces that. Without a login, or when the store does
+	* not answer, the target this checkout resolved to earlier serves the
+	* saved copies with `offline: true`. A write never falls back.
+	*/
+	static async resolve(input) {
+		const env = input.env ?? process.env;
+		const devHome = devReviewHome(env, input.homeDir);
+		const report = input.onWarning ?? defaultWarning;
+		const origin = input.origin;
+		if (input.write) {
+			let client = input.client;
+			if (!client) {
+				const auth = await readStoreAuth(env);
+				if (!auth || auth.origin !== origin) throw new Error(auth ? `You are logged in to ${auth.origin}, not the selected store ${origin}. Run \`whiteboard login --origin ${origin}\`.` : `The trace store login is missing. Run \`whiteboard login --origin ${origin}\`.`);
+				client = new StoreClient({
+					origin,
+					token: auth.token
+				});
+			}
+			const { target } = await resolveTraceRepositoryTarget({
+				cwd: input.cwd,
+				origin,
+				client,
+				write: true,
+				devHome
+			});
+			return new HostedTraceStorage({
+				target,
+				transport: input.transport ?? createHttpTraceStoreTransport(client),
+				devHome,
+				onWarning: input.onWarning
+			});
+		}
+		const auth = await readStoreAuth(env);
+		const client = input.client ?? (auth && auth.origin === origin ? new StoreClient({
+			origin,
+			token: auth.token
+		}) : void 0);
+		if (!client) {
+			if (auth && auth.origin !== origin) report(`You are logged in to ${auth.origin}, not the selected store ${origin}. Run \`whiteboard login --origin ${origin}\`; using saved copies until then.`);
+			const cached = await readCachedTraceRepositoryTarget({
+				cwd: input.cwd,
+				origin,
+				devHome
+			}).catch(() => null);
+			if (!cached) return null;
+			return new HostedTraceStorage({
+				target: cached,
+				transport: input.transport ?? createHttpTraceStoreTransport(new StoreClient({ origin })),
+				devHome,
+				offline: true,
+				onWarning: input.onWarning
+			});
+		}
+		try {
+			const { target, offline } = await resolveTraceRepositoryTarget({
+				cwd: input.cwd,
+				origin,
+				client,
+				write: false,
+				devHome
+			});
+			if (offline) report("The trace store did not answer. Using the saved copies of this repository.");
+			return new HostedTraceStorage({
+				target,
+				transport: input.transport ?? createHttpTraceStoreTransport(client),
+				devHome,
+				offline,
+				onWarning: input.onWarning
+			});
+		} catch (error) {
+			const cause = error instanceof Error ? error : new Error(String(error));
+			if (cause instanceof StoreApiError && (cause.code === "unauthorized" || cause.code === "forbidden" || cause.code === "store_deleted")) throw new TraceStorageDeniedError(cause.message);
+			const message = cause instanceof StoreApiError && cause.code === "not_found" ? cause.message : storeReadWarning(cause);
+			if (message) report(message);
+			return null;
+		}
+	}
+	cacheIdentity() {
+		return `hosted:${traceTargetKey(this.repositoryTarget)}:${this.repositoryTarget.storeId}`;
+	}
+	cacheScope() {
+		const [originKey, repositoryKey] = traceTargetKey(this.repositoryTarget).split("/");
+		return {
+			owner: originKey,
+			repo: repositoryKey
+		};
+	}
+	async readiness() {
+		if (this.offline) return {
+			ready: false,
+			reason: "The trace store did not answer. Saved copies are served offline."
+		};
+		return { ready: true };
+	}
+	async describeObject(sessionId, traceName) {
+		const stored = await this.requireSession(sessionId);
+		if (!stored) return null;
+		const object = stored.objects.find((entry) => entry.name === traceObjectName(traceName));
+		if (!object) return null;
+		return {
+			size: object.size,
+			contentId: contentId(stored, object.sha256)
+		};
+	}
+	async downloadObject(sessionId, traceName, destinationPath) {
+		const stored = await this.requireSession(sessionId);
+		if (!stored) return null;
+		const object = stored.objects.find((entry) => entry.name === traceObjectName(traceName));
+		if (!object) return null;
+		let selected = object;
+		let refreshed = false;
+		const refresh = async () => {
+			refreshed = true;
+			this.lookups.delete(sessionId);
+			const fresh = await this.requireSession(sessionId);
+			const replacement = fresh?.objects.find((entry) => entry.name === object.name);
+			if (!fresh || fresh.uploadId !== stored.uploadId || !replacement || replacement.sha256 !== object.sha256 || replacement.size !== object.size) throw new TraceStorageDeniedError("The trace changed while downloading. Run the read command again.");
+			return replacement;
+		};
+		if (Date.parse(selected.expiresAt) <= Date.now() + 3e4) selected = await refresh();
+		try {
+			await this.transport.getObject(selected, destinationPath);
+		} catch (error) {
+			if (!(error instanceof TraceObjectHttpError) || error.status !== 403) throw error;
+			if (refreshed) throw new TraceStorageDeniedError(error.message);
+			selected = await refresh();
+			try {
+				await this.transport.getObject(selected, destinationPath);
+			} catch (retryError) {
+				if (retryError instanceof TraceObjectHttpError && retryError.status === 403) throw new TraceStorageDeniedError(retryError.message);
+				throw retryError;
+			}
+		}
+		return {
+			size: object.size,
+			contentId: contentId(stored, object.sha256)
+		};
+	}
+	async listSubagents(sessionId) {
+		const lookup = await this.lookupSession(sessionId);
+		if (lookup.status !== "found") return [];
+		return lookup.session.objects.filter((object) => object.name !== "main.jsonl.gz").map((object) => traceNameFromObject(object.name)).sort();
+	}
+	/**
+	* The store's record of one session, in the shape the bucket's meta.json
+	* has: repository, commits, branch, author, and last update. The store
+	* keeps no pull request number, so that stays null.
+	*/
+	async sessionMeta(sessionId) {
+		const stored = await reachableSession(() => this.requireSession(sessionId));
+		if (!stored) return null;
+		return {
+			session: stored.sessionId,
+			repo: this.repositoryTarget.name,
+			branch: stored.branch ?? null,
+			pr: null,
+			commits: [...stored.commits],
+			author: stored.author ?? null,
+			ts: stored.updatedAt
+		};
+	}
+	async sessionsForCommit(commit) {
+		if (this.offline) return null;
+		if (!commitShaSchema.safeParse(commit).success) return null;
+		try {
+			const sessions = [];
+			let cursor;
+			for (let page = 0; page < MAX_COMMIT_LISTING_PAGES; page += 1) {
+				const response = await this.transport.listSessions(this.repositoryTarget.repositoryId, cursor === void 0 ? { commit } : {
+					commit,
+					cursor
+				});
+				sessions.push(...response.sessions.map((session) => session.sessionId));
+				if (!response.nextCursor) break;
+				cursor = response.nextCursor;
+			}
+			return sessions.length > 0 ? {
+				sessions,
+				pr: null,
+				branch: null
+			} : null;
+		} catch (error) {
+			this.reportFailure(error instanceof Error ? error : new Error(String(error)));
+			return null;
+		}
+	}
+	/**
+	* Publishes one stable session snapshot. Consent and provenance are
+	* settled before any transcript is compressed, so nothing is sent for a
+	* session that may not leave the machine.
+	*/
+	async publish(input) {
+		const target = this.repositoryTarget;
+		const expected = traceRepoName(input.repo);
+		if (expected.toLowerCase() !== target.name.toLowerCase()) throw new Error(`This checkout is ${target.name}, not ${expected}. A session is published only to its own repository's store.`);
+		await requireTraceConsent(target, this.devHome);
+		await requireTraceSessionProvenance(input.sessionId, target, this.devHome);
+		const files = [];
+		const omittedSubagents = [];
+		for (const file of input.files) {
+			const name = traceObjectName(file.name);
+			if (file.name !== "main" && (files.length >= 64 || !traceObjectNameSchema.safeParse(name).success)) {
+				omittedSubagents.push(file.name.replace(/\.jsonl$/, ""));
+				continue;
+			}
+			files.push({
+				name,
+				path: file.path
+			});
+		}
+		const compressed = [];
+		try {
+			for (const file of files) {
+				const gzipped = await gzipToTemp(file.path);
+				compressed.push({
+					name: file.name,
+					...gzipped
+				});
+			}
+			const manifest = compressed.map((object) => ({
+				name: object.name,
+				size: object.size,
+				sha256: object.sha256
+			}));
+			const allCommits = [...new Set(input.commits?.filter((commit) => commitShaSchema.safeParse(commit).success) ?? await commitsForTraceSession(input.cwd, input.sessionId))];
+			const commits = allCommits.slice(0, 200);
+			const omitted = {
+				subagents: omittedSubagents,
+				commits: allCommits.length - commits.length
+			};
+			const labels = {
+				branch: input.branch,
+				author: input.author
+			};
+			this.lookups.delete(input.sessionId);
+			const current = await this.lookupSessionLive(input.sessionId, true);
+			if (current.status === "found" && sameObjects(manifest, current.session.objects)) {
+				const completed = await this.completeUploadOnce(input.sessionId, current.session.uploadId, commits, labels);
+				this.lookups.delete(input.sessionId);
+				await clearTraceSyncFailure(input.sessionId, this.devHome).catch(() => void 0);
+				return publishResult(compressed, "unchanged", target, completed, omitted);
+			}
+			const begun = await this.transport.beginUpload(target.repositoryId, input.sessionId, {
+				harness: input.harness,
+				objects: manifest
+			});
+			if (begun.storeId !== target.storeId) throw new Error(`The trace store changed while this session was being resolved. Run \`whiteboard trace allow .\` again.`);
+			const mismatch = uploadManifestMismatch(manifest, begun.uploads);
+			if (mismatch) throw new Error(mismatch);
+			for (const upload of begun.uploads) {
+				const object = compressed.find((entry) => entry.name === upload.name);
+				if (!object) throw new Error(`The store offered ${upload.name} twice.`);
+				await this.transport.putObject(upload, object.path);
+			}
+			const completed = await this.completeUploadOnce(input.sessionId, begun.uploadId, commits, labels);
+			this.lookups.delete(input.sessionId);
+			await clearTraceSyncFailure(input.sessionId, this.devHome).catch(() => void 0);
+			return publishResult(compressed, "uploaded", target, completed, omitted);
+		} finally {
+			for (const object of compressed) await object.cleanup();
+		}
+	}
+	/** Commits travel with the published snapshot; there is no separate index. */
+	async associateCommits(_input) {
+		return false;
+	}
+	async requireSession(sessionId) {
+		const lookup = await this.lookupSession(sessionId);
+		if (lookup.status === "unreachable") throw new TraceStorageUnavailableError(lookup.error?.message ?? "The trace store did not answer.");
+		if (lookup.status === "denied") throw new TraceStorageDeniedError(lookup.error.message);
+		return lookup.status === "found" ? lookup.session : null;
+	}
+	lookupSession(sessionId) {
+		const pending = this.lookups.get(sessionId);
+		if (pending) return pending;
+		const lookup = this.lookupSessionLive(sessionId);
+		this.lookups.set(sessionId, lookup);
+		return lookup;
+	}
+	async lookupSessionLive(sessionId, publishing = false) {
+		if (this.offline) return {
+			status: "unreachable",
+			error: null
+		};
+		try {
+			const session = (await this.transport.listSessions(this.repositoryTarget.repositoryId, { session: sessionId })).sessions.find((candidate) => candidate.sessionId === sessionId);
+			return session ? {
+				status: "found",
+				session
+			} : { status: "absent" };
+		} catch (error) {
+			const cause = error instanceof Error ? error : new Error(String(error));
+			if (!(publishing && cause instanceof StoreApiError && cause.code === "forbidden")) this.reportFailure(cause);
+			if (isStoreUnreachable(cause)) return {
+				status: "unreachable",
+				error: cause
+			};
+			if (cause instanceof StoreApiError && cause.code === "not_found") return { status: "absent" };
+			return {
+				status: "denied",
+				error: cause
+			};
+		}
+	}
+	/**
+	* Completes the upload, and once more when the first answer was lost on
+	* the network: completion is idempotent, so a repeat returns the same
+	* receipt. A store answer is never retried; `stale_upload` means another
+	* upload of this session published first.
+	*/
+	async completeUploadOnce(sessionId, uploadId, commits, labels) {
+		const complete = () => this.transport.completeUpload(this.repositoryTarget.repositoryId, sessionId, uploadId, {
+			commits,
+			branch: labels.branch,
+			author: labels.author
+		});
+		try {
+			return await complete();
+		} catch (error) {
+			if (error instanceof StoreApiError) throw syncStoreError(error, sessionId);
+			try {
+				return await complete();
+			} catch (retryError) {
+				throw retryError instanceof StoreApiError ? syncStoreError(retryError, sessionId) : retryError;
+			}
+		}
+	}
+	reportFailure(cause) {
+		const message = storeReadWarning(cause);
+		if (message) this.warn(message);
+	}
+};
+/** A session lookup, or null when the store could not be reached or refused. */
+async function reachableSession(lookup) {
+	try {
+		return await lookup();
+	} catch (error) {
+		if (error instanceof TraceStorageUnavailableError || error instanceof TraceStorageDeniedError) return null;
+		throw error;
+	}
+}
+/** Most listing pages one commit lookup walks. */
+const MAX_COMMIT_LISTING_PAGES = 10;
+/** Whether the manifest names exactly the stored objects, byte for byte. */
+function sameObjects(manifest, stored) {
+	if (manifest.length !== stored.length) return false;
+	return manifest.every((object) => stored.some((candidate) => candidate.name === object.name && candidate.size === object.size && candidate.sha256 === object.sha256));
+}
+function publishResult(compressed, status, target, completed, omitted) {
+	return {
+		uploads: compressed.map((object) => ({
+			blob: object.name === "main.jsonl.gz" ? "trace.jsonl" : `subagents/${traceNameFromObject(object.name)}.jsonl`,
+			bytes_stored: object.size,
+			status
+		})),
+		hosted: {
+			repositoryId: target.repositoryId,
+			storeId: target.storeId,
+			uploadId: completed.uploadId,
+			generation: completed.generation,
+			complete: omitted.subagents.length === 0 && omitted.commits === 0,
+			objects: completed.objects.map((object) => object.name),
+			commits: completed.commits,
+			omitted
+		}
+	};
+}
+function syncStoreError(error, sessionId) {
+	if (error.code === "stale_upload") return /* @__PURE__ */ new Error(`Another upload of this session finished first. Run \`whiteboard trace sync ${sessionId}\` again to publish the newer transcript.`);
+	return error;
+}
+const FIELD_SEPARATOR$1 = "";
+/** The commits whose Agent-Session trailers name this session. */
+async function commitsForTraceSession(cwd, sessionId) {
+	const result = await git(cwd, [
+		"log",
+		"--all",
+		"--no-show-signature",
+		`--format=%H${FIELD_SEPARATOR$1}%(trailers:key=Agent-Session,valueonly,separator=${FIELD_SEPARATOR$1})`
+	], { allowFailure: true });
+	if (!result.ok) return [];
+	const commits = [];
+	for (const line of result.stdout.split("\n")) {
+		const [sha, ...trailers] = line.trim().split(FIELD_SEPARATOR$1);
+		if (!commitShaSchema.safeParse(sha).success) continue;
+		if (trailers.flatMap((value) => value.split("\n")).some((value) => value.trim() === sessionId) && !commits.includes(sha)) commits.push(sha);
+	}
+	return commits;
+}
+//#endregion
+//#region ../trace-core/src/trace-storage/resolve.ts
+function selectTraceStorage(scope = {}) {
+	const env = scope.env ?? process.env;
+	const config = readTraceConfigFile(scope);
+	if (config.error) return {
+		mode: "none",
+		explicit: false,
+		config,
+		s3: null,
+		hosted: null,
+		error: config.error
+	};
+	let s3;
+	try {
+		s3 = resolveS3Setup(scope);
+	} catch (error) {
+		return {
+			mode: "none",
+			explicit: false,
+			config,
+			s3: null,
+			hosted: null,
+			error: errorMessage(error)
+		};
+	}
+	const mock = isS3MockMode(env);
+	const file = config.config;
+	const pointer = currentStore(file);
+	const hosted = hasHostedStore(file) ? { origin: hostedOrigin(file) } : null;
+	const hasS3 = s3Store(file) !== null || s3.credentials !== null || mock;
+	if (pointer === "hosted") return {
+		mode: "hosted",
+		explicit: true,
+		config,
+		s3,
+		hosted: hosted ?? { origin: hostedOrigin(file) }
+	};
+	if (pointer === "s3") {
+		if (!hasS3) return {
+			mode: "s3",
+			explicit: true,
+			config,
+			s3,
+			hosted,
+			error: `S3 trace storage is selected but no bucket credentials are configured. Run \`whiteboard trace storage use s3 --endpoint <url> --bucket <name> --key <id> --secret <secret>\`.`
+		};
+		return {
+			mode: "s3",
+			explicit: true,
+			config,
+			s3,
+			hosted
+		};
+	}
+	if (hasS3) return {
+		mode: "s3",
+		explicit: false,
+		config,
+		s3,
+		hosted
+	};
+	if (hosted) return {
+		mode: "hosted",
+		explicit: false,
+		config,
+		s3,
+		hosted
+	};
+	return {
+		mode: "none",
+		explicit: false,
+		config,
+		s3,
+		hosted
+	};
+}
+/**
+* The store to use, or null when no remote storage is configured. Throws a
+* TraceConfigurationError instead of silently selecting another destination
+* when the configuration is malformed or incomplete.
+*/
+async function resolveTraceStorage(input = {}) {
+	const selection = selectTraceStorage(input);
+	if (selection.error) throw new TraceConfigurationError(selection.error);
+	const mode = input.override ?? selection.mode;
+	if (mode === "none") return null;
+	if (mode === "s3") return s3Storage(selection, input);
+	return hostedStorage(selection, input);
+}
+/**
+* Names the destination a capture attempt was started for, so a detached
+* trace sync can refuse to run once the selection changed.
+*/
+function traceStorageExpectation(scope = {}) {
+	const selection = selectTraceStorage(scope);
+	if (selection.error || selection.mode === "none") return "none";
+	if (selection.mode === "hosted") return `hosted:${selection.hosted?.origin ?? ""}`;
+	const env = scope.env ?? process.env;
+	if (isS3MockMode(env)) return `s3:${s3CacheIdentity(null, s3MockRoot(env))}`;
+	return `s3:${s3CacheIdentity(requireS3Credentials(selection), null)}`;
+}
+function requireS3Credentials(selection) {
+	const credentials = selection.s3?.credentials;
+	if (!credentials) throw new TraceConfigurationError("S3 trace storage was requested but no bucket credentials are configured.");
+	return credentials;
+}
+/** One human line for `trace status` and `trace storage use`. */
+function describeSelection(selection) {
+	if (selection.error) return `error (${selection.error})`;
+	if (selection.mode === "hosted") return `hosted (${selection.hosted?.origin ?? "unknown origin"})`;
+	if (selection.mode === "none") return "none configured";
+	const setup = selection.s3;
+	const credentials = setup?.credentials;
+	const where = credentials ? `bucket "${credentials.bucket}" at ${credentials.endpoint}` : "mock bucket";
+	const source = setup?.source === "profile" ? "config.json profile" : setup?.source === "legacy-file" ? `legacy env file ${setup.envPath}` : setup?.source === "process-env" ? "process environment" : "test mode";
+	const overrides = setup && setup.overrides.length > 0 && setup.source !== "process-env" ? `; environment overrides: ${setup.overrides.join(", ")}` : "";
+	return `S3/R2 ${where} (${selection.explicit ? "selected" : "legacy configuration"}; credentials from ${source}${overrides})`;
+}
+/** The bucket store; its module loads only when a bucket is selected. */
+async function s3Storage(selection, scope) {
+	const env = scope.env ?? process.env;
+	const S3TraceStorage = await loadS3TraceStorage();
+	if (isS3MockMode(env)) return S3TraceStorage.fromEnvironment(scope);
+	return S3TraceStorage.fromCredentials(requireS3Credentials(selection), env);
+}
+async function hostedStorage(selection, input) {
+	const origin = selection.hosted?.origin;
+	if (!origin) throw new TraceConfigurationError(`Hosted trace storage is not configured. Run \`whiteboard trace allow .\` or \`whiteboard trace storage use hosted\`.`);
+	const write = input.purpose === "write";
+	const storage = await HostedTraceStorage.resolve({
+		cwd: input.cwd ?? process.cwd(),
+		origin,
+		write,
+		env: input.env,
+		homeDir: input.homeDir,
+		onWarning: input.onWarning
+	});
+	if (!storage) throw new TraceConfigurationError(`Hosted trace storage needs a login and a GitHub checkout with a trace store. Run \`whiteboard login\`, \`whiteboard trace store create\`, and \`whiteboard trace allow .\`.`);
+	return storage;
+}
+/** Whether the selected store can be used; a configuration error counts as no. */
+function isTraceStorageConfigured(scope = {}) {
+	const selection = selectTraceStorage(scope);
+	return !selection.error && selection.mode !== "none";
+}
+/** Loads the direct-store implementation on demand, without opening a store. */
+async function loadS3TraceStorage() {
+	return (await import("./s3-SzLpeCG6.js")).S3TraceStorage;
+}
+//#endregion
+//#region ../trace-core/src/agent-trace-parser.ts
+function extractTraceEventText(event) {
+	return extractTraceEventText$1(event);
+}
+const ACTIVE_GAP_LIMIT_MS = 6e5;
+function computeActiveMs(events) {
+	let total = 0;
+	let previous = null;
+	let sawTimestamp = false;
+	for (const event of events) {
+		const at = timestampOf(event);
+		if (at === null) continue;
+		sawTimestamp = true;
+		if (previous !== null && at > previous) total += Math.min(at - previous, ACTIVE_GAP_LIMIT_MS);
+		previous = at;
+	}
+	return sawTimestamp ? total : null;
+}
+const OUTPUT_LIMIT = 2e4;
+const INPUT_LIMIT = 4e3;
+const TITLE_LIMIT = 160;
+function parseAgentTraceJsonl(jsonl, options) {
+	const records = [];
+	for (const line of jsonl.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		try {
+			records.push(parseJsonText(trimmed));
+		} catch {}
+	}
+	const firstType = jsonObject(records[0])?.type;
+	const parsed = firstType === "session_meta" ? parseCodexRecords(records) : firstType === "session" ? parsePiRecords(records) : firstType === "opencode_session" ? parseOpenCodeRecords(records) : parseClaudeRecords(records, options);
+	parsed.activeMs = computeActiveMs(parsed.events);
+	return parsed;
+}
+function truncate(text, limit) {
+	if (text.length <= limit) return text;
+	const half = Math.floor(limit / 2);
+	return `${text.slice(0, half)}\n… (+${text.length - limit} characters omitted) …\n${text.slice(-half)}`;
+}
+function compactLine(text, limit = TITLE_LIMIT) {
+	const collapsed = text.replace(/\s+/g, " ").trim();
+	if (collapsed.length <= limit) return collapsed;
+	return `${collapsed.slice(0, limit - 1)}…`;
+}
+/** File titles keep their tail: the filename matters more than the prefix. */
+function compactFileLine(text, limit = TITLE_LIMIT) {
+	const collapsed = text.replace(/\s+/g, " ").trim();
+	if (collapsed.length <= limit) return collapsed;
+	return `…${collapsed.slice(-(limit - 1))}`;
+}
+function relativizePath(filePath, cwd) {
+	if (!cwd) return filePath;
+	const relative = path.relative(cwd, filePath);
+	if (!relative || relative.startsWith("..")) return filePath;
+	return relative;
+}
+function timestampOf(event) {
+	if (!event || event.kind === "separator" || !event.at) return null;
+	const value = Date.parse(event.at);
+	return Number.isFinite(value) ? value : null;
+}
+function claudeRecord(value) {
+	const message = jsonObject(value.message);
+	const toolUseResult = jsonObject(value.toolUseResult);
+	return {
+		type: jsonString(value.type),
+		isSidechain: jsonBoolean(value.isSidechain),
+		isMeta: jsonBoolean(value.isMeta),
+		timestamp: jsonString(value.timestamp),
+		cwd: jsonString(value.cwd),
+		aiTitle: jsonString(value.aiTitle),
+		customTitle: jsonString(value.customTitle),
+		message: message && {
+			role: jsonString(message.role),
+			content: message.content
+		},
+		toolUseResult: toolUseResult && {
+			filePath: jsonString(toolUseResult.filePath),
+			structuredPatch: toolUseResult.structuredPatch
+		}
+	};
+}
+function claudeContentBlock(value) {
+	if (!isJsonObject(value)) return void 0;
+	return {
+		type: jsonString(value.type),
+		text: jsonString(value.text),
+		thinking: jsonString(value.thinking),
+		id: jsonString(value.id),
+		name: jsonString(value.name),
+		input: value.input,
+		tool_use_id: jsonString(value.tool_use_id),
+		content: value.content,
+		is_error: jsonBoolean(value.is_error)
+	};
+}
+function claudeContentBlocks(content) {
+	const text = jsonString(content);
+	if (text !== void 0) return [{
+		type: "text",
+		text
+	}];
+	return jsonArray(content)?.flatMap((block) => claudeContentBlock(block) ?? []) ?? [];
+}
+const CLAUDE_NOISE_PATTERNS = [
+	/^\[SYSTEM NOTIFICATION/,
+	/^\[Request interrupted/,
+	/^This session is being continued/,
+	/^<task-notification>/,
+	/^<local-command-stdout>/
+];
+function cleanClaudeUserText(text) {
+	let cleaned = text;
+	cleaned = cleaned.replace(/<system-reminder>[\s\S]*?<\/system-reminder>/g, "");
+	cleaned = cleaned.replace(/<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, "");
+	const commandName = /<command-name>([\s\S]*?)<\/command-name>/.exec(cleaned)?.[1];
+	if (commandName) {
+		const args = /<command-args>([\s\S]*?)<\/command-args>/.exec(cleaned)?.[1] ?? "";
+		return `${commandName.trim().startsWith("/") ? "" : "/"}${commandName.trim()} ${args.trim()}`.trim();
+	}
+	cleaned = cleaned.trim();
+	if (!cleaned) return null;
+	for (const pattern of CLAUDE_NOISE_PATTERNS) if (pattern.test(cleaned)) return null;
+	return cleaned;
+}
+function claudeResultText(content) {
+	const text = jsonString(content);
+	if (text !== void 0) return text;
+	const parts = [];
+	for (const block of claudeContentBlocks(content)) if (block.type === "text" && block.text !== void 0) parts.push(block.text);
+	else if (block.type === "image") parts.push("[image]");
+	return parts.join("\n");
+}
+function patchCounts(patch) {
+	const hunks = jsonArray(patch);
+	if (!hunks) return null;
+	let additions = 0;
+	let deletions = 0;
+	for (const hunk of hunks) for (const line of jsonArray(jsonObject(hunk)?.lines) ?? []) {
+		const text = jsonString(line);
+		if (text === void 0) continue;
+		if (text.startsWith("+")) additions += 1;
+		else if (text.startsWith("-")) deletions += 1;
+	}
+	return {
+		additions,
+		deletions
+	};
+}
+function claudeToolEvent(block, at, cwd) {
+	const name = block.name ?? "tool";
+	const input = isJsonObject(block.input) ? block.input : {};
+	const event = {
+		kind: "tool",
+		tool: name,
+		verb: "Called",
+		title: name,
+		at
+	};
+	const inputText = (key) => jsonString(input[key]) ?? null;
+	const filePath = inputText("file_path") ?? inputText("path") ?? inputText("notebook_path");
+	switch (name) {
+		case "Bash": {
+			const command = inputText("command") ?? "";
+			event.verb = "Ran";
+			event.title = compactLine(command);
+			event.command = truncate(command, INPUT_LIMIT);
+			break;
+		}
+		case "Edit":
+		case "MultiEdit":
+		case "NotebookEdit":
+			event.verb = "Edited";
+			event.title = filePath ? relativizePath(filePath, cwd) : name;
+			if (filePath) event.filePath = relativizePath(filePath, cwd);
+			break;
+		case "Write":
+			event.verb = "Wrote";
+			event.title = filePath ? relativizePath(filePath, cwd) : name;
+			if (filePath) event.filePath = relativizePath(filePath, cwd);
+			break;
+		case "Read":
+			event.verb = "Read";
+			event.title = filePath ? relativizePath(filePath, cwd) : name;
+			if (filePath) event.filePath = relativizePath(filePath, cwd);
+			break;
+		case "Grep":
+		case "Glob": {
+			const pattern = inputText("pattern") ?? "";
+			event.verb = "Searched";
+			event.title = compactLine(inputText("path") ? `${pattern} in ${relativizePath(inputText("path") ?? "", cwd)}` : pattern);
+			break;
+		}
+		case "Task":
+		case "Agent":
+			event.verb = "Ran agent";
+			event.title = compactLine(inputText("description") ?? inputText("prompt") ?? "subagent");
+			break;
+		case "WebFetch":
+			event.verb = "Fetched";
+			event.title = compactLine(inputText("url") ?? "");
+			break;
+		case "WebSearch":
+			event.verb = "Searched web";
+			event.title = compactLine(inputText("query") ?? "");
+			break;
+		case "TodoWrite":
+			event.verb = "Updated";
+			event.title = "task list";
+			break;
+		case "Skill":
+			event.verb = "Loaded skill";
+			event.title = compactLine(inputText("skill") ?? "");
+			break;
+		default: if (name.startsWith("mcp__")) {
+			event.verb = "Called";
+			event.title = name.replace(/^mcp__/, "").replace(/__/g, " · ");
+		}
+	}
+	if (!event.command) {
+		const pretty = JSON.stringify(input, null, 2);
+		if (pretty && pretty !== "{}") event.input = truncate(pretty, INPUT_LIMIT);
+	}
+	return event;
+}
+function parseClaudeRecords(records, options) {
+	const events = [];
+	const pendingTools = /* @__PURE__ */ new Map();
+	let title = null;
+	let startedAt = null;
+	let endedAt = null;
+	let cwd = null;
+	let userTurns = 0;
+	let toolCalls = 0;
+	for (const raw of records) {
+		if (!isJsonObject(raw)) continue;
+		const record = claudeRecord(raw);
+		if (record.type === "ai-title" && record.aiTitle !== void 0) {
+			title ??= record.aiTitle;
+			continue;
+		}
+		if (record.type === "custom-title" && record.customTitle !== void 0) {
+			title = record.customTitle;
+			continue;
+		}
+		if (record.type !== "user" && record.type !== "assistant") continue;
+		if (!options?.isSubagent && record.isSidechain) continue;
+		cwd ??= record.cwd ?? null;
+		const at = record.timestamp;
+		if (at) {
+			startedAt ??= at;
+			endedAt = at;
+		}
+		const blocks = claudeContentBlocks(record.message?.content);
+		if (record.type === "user") {
+			let sawToolResult = false;
+			for (const block of blocks) {
+				if (block.type !== "tool_result") continue;
+				sawToolResult = true;
+				const pending = block.tool_use_id ? pendingTools.get(block.tool_use_id) : void 0;
+				if (!pending) continue;
+				const resultText = claudeResultText(block.content).trim();
+				if (resultText) pending.output = truncate(resultText, OUTPUT_LIMIT);
+				if (block.is_error) pending.error = true;
+				const counts = patchCounts(record.toolUseResult?.structuredPatch);
+				if (counts) {
+					pending.additions = counts.additions;
+					pending.deletions = counts.deletions;
+				}
+				if (record.toolUseResult?.filePath && !pending.filePath) pending.filePath = relativizePath(record.toolUseResult.filePath, cwd);
+				if (block.tool_use_id) pendingTools.delete(block.tool_use_id);
+			}
+			if (sawToolResult || record.isMeta) continue;
+			const cleaned = cleanClaudeUserText(blocks.flatMap((block) => block.type === "text" && block.text !== void 0 ? [block.text] : []).join("\n"));
+			if (!cleaned) continue;
+			userTurns += 1;
+			events.push({
+				kind: "user",
+				text: cleaned,
+				at
+			});
+			continue;
+		}
+		for (const block of blocks) if (block.type === "thinking" && block.thinking !== void 0) {
+			const trimmed = block.thinking.trim();
+			if (trimmed) events.push({
+				kind: "assistant",
+				markdown: trimmed,
+				thinking: true,
+				at
+			});
+		} else if (block.type === "text" && block.text !== void 0) {
+			const trimmed = block.text.trim();
+			if (trimmed) events.push({
+				kind: "assistant",
+				markdown: trimmed,
+				at
+			});
+		} else if (block.type === "tool_use") {
+			const event = claudeToolEvent(block, at, cwd);
+			toolCalls += 1;
+			events.push(event);
+			if (block.id) pendingTools.set(block.id, event);
+		}
+	}
+	return {
+		harness: "claude-code",
+		title,
+		events,
+		startedAt,
+		endedAt,
+		activeMs: null,
+		userTurns,
+		toolCalls
+	};
+}
+function codexTextBlocks(value) {
+	return jsonArray(value)?.flatMap((block) => {
+		const record = jsonObject(block);
+		return record ? [{
+			type: jsonString(record.type),
+			text: jsonString(record.text)
+		}] : [];
+	}) ?? [];
+}
+function codexPayload(value) {
+	return {
+		type: jsonString(value.type),
+		role: jsonString(value.role),
+		content: codexTextBlocks(value.content),
+		name: jsonString(value.name),
+		arguments: value.arguments,
+		input: value.input,
+		call_id: jsonString(value.call_id),
+		output: value.output,
+		cwd: jsonString(value.cwd),
+		timestamp: jsonString(value.timestamp),
+		message: jsonString(value.message),
+		query: jsonString(value.query),
+		stdout: jsonString(value.stdout),
+		success: jsonBoolean(value.success),
+		changes: jsonObject(value.changes),
+		invocation: jsonObject(value.invocation),
+		result: value.result,
+		command: value.command,
+		aggregated_output: jsonString(value.aggregated_output),
+		exit_code: jsonNumber(value.exit_code)
+	};
+}
+function codexRecord(value) {
+	const payload = jsonObject(value.payload);
+	return {
+		type: jsonString(value.type),
+		timestamp: jsonString(value.timestamp),
+		payload: payload && codexPayload(payload)
+	};
+}
+const CODEX_USER_NOISE_PREFIXES = [
+	"<recommended_plugins",
+	"<permissions",
+	"<environment_context",
+	"<environments_instructions",
+	"<user_instructions",
+	"<user_shell_command",
+	"<turn_aborted",
+	"<subagent_notification",
+	"<codex_internal_context",
+	"<goal_context",
+	"<codex_delegation",
+	"<external_",
+	"<skills_instructions",
+	"<skill>",
+	"<apps_instructions",
+	"<plugins_instructions",
+	"<tools>",
+	"<collaboration_mode",
+	"<multi_agent_mode",
+	"<multi_agent_role",
+	"<realtime_conversation",
+	"<context_window",
+	"<turn_context",
+	"<model_switch",
+	"<personality_spec",
+	"<token_budget",
+	"<rollout_budget",
+	"<git_attribution",
+	"<ENVIRONMENT",
+	"# AGENTS"
+];
+function codexText(payload) {
+	return (payload.content ?? []).flatMap((block) => (block.type === "input_text" || block.type === "output_text") && block.text !== void 0 ? [block.text] : []).join("\n").trim();
+}
+function codexPatchSummary(patch, cwd) {
+	const files = [];
+	let additions = 0;
+	let deletions = 0;
+	for (const line of patch.split("\n")) {
+		const header = /^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(line);
+		if (header) {
+			files.push(relativizePath(header[1].trim(), cwd));
+			continue;
+		}
+		if (line.startsWith("***")) continue;
+		if (line.startsWith("+")) additions += 1;
+		else if (line.startsWith("-")) deletions += 1;
+	}
+	return {
+		filePath: files[0],
+		additions,
+		deletions,
+		files
+	};
+}
+const CODE_MODE_FILE_PATTERN = /\*\*\* (?:Add|Update|Delete) File: ([^\n\\"`]+)/g;
+function unifiedDiffCounts(diff) {
+	let additions = 0;
+	let deletions = 0;
+	for (const line of diff.split("\n")) if (line.startsWith("+") && !line.startsWith("+++")) additions += 1;
+	else if (line.startsWith("-") && !line.startsWith("---")) deletions += 1;
+	return {
+		additions,
+		deletions
+	};
+}
+function codexValueText(value) {
+	const text = jsonString(value);
+	if (text !== void 0) return text;
+	if (value === null || value === void 0) return "";
+	return JSON.stringify(value);
+}
+function codexPatchEvent(payload, at, cwd) {
+	const changes = payload.changes ?? {};
+	const paths = Object.keys(changes);
+	if (paths.length === 0) return null;
+	let additions = 0;
+	let deletions = 0;
+	const relativePaths = paths.map((filePath) => relativizePath(filePath, cwd));
+	for (const filePath of paths) {
+		const change = jsonObject(changes[filePath]) ?? {};
+		const content = jsonString(change.content);
+		const unifiedDiff = jsonString(change.unified_diff);
+		if (change.type === "add" && content !== void 0) additions += content.split("\n").length;
+		else if (change.type === "delete" && content !== void 0) deletions += content.split("\n").length;
+		else if (unifiedDiff !== void 0) {
+			const counts = unifiedDiffCounts(unifiedDiff);
+			additions += counts.additions;
+			deletions += counts.deletions;
+		}
+	}
+	const single = paths.length === 1 ? jsonObject(changes[paths[0]]) : null;
+	const event = {
+		kind: "tool",
+		tool: "apply_patch",
+		verb: single?.type === "add" ? "Added" : single?.type === "delete" ? "Deleted" : "Edited",
+		title: compactFileLine(relativePaths.join(", ")),
+		filePath: relativePaths[0],
+		additions,
+		deletions,
+		at
+	};
+	const diffs = paths.flatMap((filePath) => jsonString(jsonObject(changes[filePath])?.unified_diff) ?? []);
+	if (diffs.length > 0) event.input = truncate(diffs.join("\n"), INPUT_LIMIT);
+	if (payload.stdout) event.output = truncate(payload.stdout, OUTPUT_LIMIT);
+	if (payload.success === false) event.error = true;
+	return event;
+}
+function codexMcpEvent(payload, at) {
+	const invocation = payload.invocation ?? {};
+	const server = jsonString(invocation.server) ?? "mcp";
+	const tool = jsonString(invocation.tool) ?? "tool";
+	const argumentsTitle = jsonString(jsonObject(invocation.arguments)?.title);
+	const title = argumentsTitle === void 0 ? `${server} · ${tool}` : `${server} · ${tool} — ${argumentsTitle}`;
+	const event = {
+		kind: "tool",
+		tool: `${server}.${tool}`,
+		verb: "Called",
+		title: compactLine(title),
+		at
+	};
+	const input = codexValueText(invocation.arguments);
+	if (input && input !== "{}") event.input = truncate(input, INPUT_LIMIT);
+	const result = jsonObject(payload.result);
+	const ok = jsonObject(result?.Ok);
+	if (ok?.content) {
+		const text = codexTextBlocks(ok.content).flatMap((block) => block.type === "text" && block.text !== void 0 ? [block.text] : []).join("\n").trim();
+		if (text) event.output = truncate(text, OUTPUT_LIMIT);
+		if (ok.isError) event.error = true;
+	} else if (result && "Err" in result) {
+		event.error = true;
+		event.output = truncate(codexValueText(result.Err), OUTPUT_LIMIT);
+	}
+	return event;
+}
+function codexCodeModeEvent(event, source, cwd, skipPatches) {
+	const cmdMatch = /"cmd"\s*:\s*"((?:[^"\\]|\\.)*)"/.exec(source);
+	if (cmdMatch) {
+		let command = cmdMatch[1];
+		try {
+			command = jsonString(parseJsonText(`"${cmdMatch[1]}"`)) ?? command;
+		} catch {}
+		event.verb = "Ran";
+		event.title = compactLine(command);
+		event.command = truncate(command, INPUT_LIMIT);
+		return event;
+	}
+	const files = [];
+	for (const match of source.matchAll(CODE_MODE_FILE_PATTERN)) {
+		const file = relativizePath(match[1].trim(), cwd);
+		if (!files.includes(file)) files.push(file);
+	}
+	if (files.length > 0) {
+		if (skipPatches) return null;
+		event.verb = "Edited";
+		event.title = compactFileLine(files.join(", "));
+		event.filePath = files[0];
+		event.input = truncate(source, INPUT_LIMIT);
+		return event;
+	}
+	const inner = /tools\.(\w+)\(/.exec(source);
+	if (inner) {
+		if (inner[1] === "wait") return null;
+		if (inner[1].startsWith("mcp__")) return null;
+		event.verb = "Called";
+		event.title = inner[1].replace(/^mcp__/, "").replace(/__/g, " · ");
+		event.input = truncate(source, INPUT_LIMIT);
+		return event;
+	}
+	return null;
+}
+function codexToolEvent(payload, at, cwd, flags) {
+	const name = payload.name ?? "tool";
+	if (name === "wait") return null;
+	const event = {
+		kind: "tool",
+		tool: name,
+		verb: "Called",
+		title: name,
+		at
+	};
+	if (name === "exec" || name === "exec_command" || name === "shell" || name === "local_shell") {
+		const source = codexValueText(payload.arguments ?? payload.input);
+		if (source.includes("tools.")) return codexCodeModeEvent(event, source, cwd, flags.hasPatchEvents);
+		let command = source;
+		try {
+			const parsed = jsonObject(parseJsonText(source || "{}"));
+			command = jsonString(parsed?.cmd) ?? jsonArray(parsed?.command)?.join(" ") ?? jsonString(parsed?.command) ?? command;
+		} catch {}
+		event.verb = "Ran";
+		event.title = compactLine(command);
+		event.command = truncate(command, INPUT_LIMIT);
+		return event;
+	}
+	if (name === "apply_patch") {
+		if (flags.hasPatchEvents) return null;
+		const patchInput = codexValueText(payload.input);
+		const summary = codexPatchSummary(patchInput, cwd);
+		event.verb = "Edited";
+		event.title = compactFileLine(summary.files.join(", ") || "files");
+		event.filePath = summary.filePath;
+		event.additions = summary.additions;
+		event.deletions = summary.deletions;
+		event.input = truncate(patchInput, INPUT_LIMIT);
+		return event;
+	}
+	const inputSource = codexValueText(payload.arguments ?? payload.input);
+	if (inputSource) event.input = truncate(inputSource, INPUT_LIMIT);
+	return event;
+}
+function codexOutputText(output) {
+	const text = jsonString(output);
+	if (text !== void 0) {
+		try {
+			const inner = jsonString(jsonObject(parseJsonText(text))?.output);
+			if (inner !== void 0) return inner;
+		} catch {}
+		return text;
+	}
+	const inner = jsonString(jsonObject(output)?.output);
+	if (inner !== void 0) return inner;
+	return isJsonObject(output) || isJsonArray(output) ? codexValueText(output) : "";
+}
+function parseCodexRecords(records) {
+	const events = [];
+	const pendingTools = /* @__PURE__ */ new Map();
+	let startedAt = null;
+	let endedAt = null;
+	let cwd = null;
+	let userTurns = 0;
+	let toolCalls = 0;
+	let firstUserText = null;
+	let hasUserMessageEvent = false;
+	let hasAgentMessageEvent = false;
+	let hasPatchEvents = false;
+	let hasMcpEvents = false;
+	const codexRecords = records.flatMap((raw) => isJsonObject(raw) ? [codexRecord(raw)] : []);
+	for (const record of codexRecords) {
+		if (record.type !== "event_msg") continue;
+		const eventType = record.payload?.type;
+		if (eventType === "user_message") hasUserMessageEvent = true;
+		else if (eventType === "agent_message") hasAgentMessageEvent = true;
+		else if (eventType === "patch_apply_end") hasPatchEvents = true;
+		else if (eventType === "mcp_tool_call_end") hasMcpEvents = true;
+	}
+	const flags = {
+		hasPatchEvents,
+		hasMcpEvents
+	};
+	for (const record of codexRecords) {
+		const payload = record.payload;
+		if (record.type === "session_meta") {
+			cwd = payload?.cwd ?? null;
+			startedAt ??= payload?.timestamp ?? record.timestamp ?? null;
+			continue;
+		}
+		const at = record.timestamp;
+		if (record.type === "event_msg" && payload) {
+			if (at) {
+				startedAt ??= at;
+				endedAt = at;
+			}
+			switch (payload.type) {
+				case "user_message": {
+					const text = (payload.message ?? "").trim();
+					if (!text) break;
+					const lowered = text.trimStart().toLowerCase();
+					if (CODEX_USER_NOISE_PREFIXES.some((prefix) => lowered.startsWith(prefix.toLowerCase()))) break;
+					userTurns += 1;
+					firstUserText ??= text;
+					events.push({
+						kind: "user",
+						text,
+						at
+					});
+					break;
+				}
+				case "agent_message": {
+					const text = (payload.message ?? "").trim();
+					if (text) events.push({
+						kind: "assistant",
+						markdown: text,
+						at
+					});
+					break;
+				}
+				case "patch_apply_end": {
+					const event = codexPatchEvent(payload, at, cwd);
+					if (event) {
+						toolCalls += 1;
+						events.push(event);
+					}
+					break;
+				}
+				case "mcp_tool_call_end":
+					toolCalls += 1;
+					events.push(codexMcpEvent(payload, at));
+					break;
+				case "web_search_end":
+					toolCalls += 1;
+					events.push({
+						kind: "tool",
+						tool: "web_search",
+						verb: "Searched web",
+						title: compactLine(payload.query ?? ""),
+						at
+					});
+					break;
+				case "exec_command_end": {
+					const command = jsonArray(payload.command)?.join(" ") ?? codexValueText(payload.command);
+					if (!command) break;
+					toolCalls += 1;
+					const event = {
+						kind: "tool",
+						tool: "exec",
+						verb: "Ran",
+						title: compactLine(command),
+						command: truncate(command, INPUT_LIMIT),
+						at
+					};
+					if (payload.aggregated_output) event.output = truncate(payload.aggregated_output, OUTPUT_LIMIT);
+					if (payload.exit_code !== void 0 && payload.exit_code !== 0) event.error = true;
+					events.push(event);
+					break;
+				}
+			}
+			continue;
+		}
+		if (record.type !== "response_item" || !payload) continue;
+		if (at) {
+			startedAt ??= at;
+			endedAt = at;
+		}
+		switch (payload.type) {
+			case "message": {
+				const text = codexText(payload);
+				if (!text) break;
+				if (payload.role === "user") {
+					if (hasUserMessageEvent) break;
+					const lowered = text.trimStart().toLowerCase();
+					if (CODEX_USER_NOISE_PREFIXES.some((prefix) => lowered.startsWith(prefix.toLowerCase()))) break;
+					userTurns += 1;
+					firstUserText ??= text;
+					events.push({
+						kind: "user",
+						text,
+						at
+					});
+				} else if (payload.role === "assistant") {
+					if (hasAgentMessageEvent) break;
+					events.push({
+						kind: "assistant",
+						markdown: text,
+						at
+					});
+				}
+				break;
+			}
+			case "function_call":
+			case "custom_tool_call": {
+				const event = codexToolEvent(payload, at, cwd, flags);
+				if (!event) break;
+				toolCalls += 1;
+				events.push(event);
+				if (payload.call_id) pendingTools.set(payload.call_id, event);
+				break;
+			}
+			case "function_call_output":
+			case "custom_tool_call_output": {
+				const pending = payload.call_id ? pendingTools.get(payload.call_id) : void 0;
+				if (!pending) break;
+				const text = codexOutputText(payload.output).trim();
+				if (text && !pending.output) pending.output = truncate(text, OUTPUT_LIMIT);
+				if (payload.call_id) pendingTools.delete(payload.call_id);
+				break;
+			}
+		}
+	}
+	return {
+		harness: "codex",
+		title: firstUserText ? compactLine(firstUserText) : null,
+		events,
+		startedAt,
+		endedAt,
+		activeMs: null,
+		userTurns,
+		toolCalls
+	};
+}
+function piRecord(value) {
+	const message = jsonObject(value.message);
+	return {
+		type: jsonString(value.type),
+		timestamp: jsonString(value.timestamp),
+		cwd: jsonString(value.cwd),
+		message: message && {
+			role: jsonString(message.role),
+			toolCallId: jsonString(message.toolCallId),
+			content: message.content
+		}
+	};
+}
+function piContentBlocks(content) {
+	return jsonArray(content)?.flatMap((block) => {
+		const record = jsonObject(block);
+		return record ? [{
+			type: jsonString(record.type),
+			text: jsonString(record.text),
+			thinking: jsonString(record.thinking),
+			id: jsonString(record.id),
+			name: jsonString(record.name),
+			arguments: jsonObject(record.arguments)
+		}] : [];
+	}) ?? [];
+}
+function piText(content) {
+	const text = jsonString(content);
+	if (text !== void 0) return text;
+	return piContentBlocks(content).flatMap((block) => block.type === "text" && block.text !== void 0 ? [block.text] : []).join("\n").trim();
+}
+function piToolEvent(block, at, cwd) {
+	const name = block.name ?? "tool";
+	const args = block.arguments ?? {};
+	const argText = (key) => jsonString(args[key]) ?? null;
+	const event = {
+		kind: "tool",
+		tool: name,
+		verb: "Called",
+		title: name,
+		at
+	};
+	const pathValue = argText("path");
+	switch (name) {
+		case "bash": {
+			const command = argText("command") ?? "";
+			event.verb = "Ran";
+			event.title = compactLine(command);
+			event.command = truncate(command, INPUT_LIMIT);
+			break;
+		}
+		case "read":
+			event.verb = "Read";
+			event.title = pathValue ? compactFileLine(relativizePath(pathValue, cwd)) : name;
+			if (pathValue) event.filePath = relativizePath(pathValue, cwd);
+			break;
+		case "edit":
+			event.verb = "Edited";
+			event.title = pathValue ? compactFileLine(relativizePath(pathValue, cwd)) : name;
+			if (pathValue) event.filePath = relativizePath(pathValue, cwd);
+			break;
+		case "write":
+			event.verb = "Wrote";
+			event.title = pathValue ? compactFileLine(relativizePath(pathValue, cwd)) : name;
+			if (pathValue) event.filePath = relativizePath(pathValue, cwd);
+			const content = argText("content");
+			if (content !== null) event.additions = content.split("\n").length;
+			break;
+		case "subagent":
+			event.verb = "Ran agent";
+			event.title = compactLine(codexValueText(args.action));
+			break;
+		case "web_search":
+			event.verb = "Searched web";
+			event.title = compactLine(argText("query") ?? "");
+	}
+	if (!event.command) {
+		const pretty = codexValueText(args);
+		if (pretty && pretty !== "{}") event.input = truncate(pretty, INPUT_LIMIT);
+	}
+	return event;
+}
+function parsePiRecords(records) {
+	const events = [];
+	const pendingTools = /* @__PURE__ */ new Map();
+	let startedAt = null;
+	let endedAt = null;
+	let cwd = null;
+	let userTurns = 0;
+	let toolCalls = 0;
+	let firstUserText = null;
+	for (const raw of records) {
+		if (!isJsonObject(raw)) continue;
+		const record = piRecord(raw);
+		if (record.type === "session") {
+			cwd = record.cwd ?? null;
+			startedAt ??= record.timestamp ?? null;
+			continue;
+		}
+		if (record.type !== "message" || !record.message) continue;
+		const at = record.timestamp;
+		if (at) {
+			startedAt ??= at;
+			endedAt = at;
+		}
+		const message = record.message;
+		if (message.role === "user") {
+			const text = piText(message.content);
+			if (!text) continue;
+			const lowered = text.trimStart().toLowerCase();
+			if (CODEX_USER_NOISE_PREFIXES.some((prefix) => lowered.startsWith(prefix.toLowerCase()))) continue;
+			userTurns += 1;
+			firstUserText ??= text;
+			events.push({
+				kind: "user",
+				text,
+				at
+			});
+			continue;
+		}
+		if (message.role === "assistant") {
+			const contentText = jsonString(message.content);
+			if (contentText !== void 0) {
+				const trimmed = contentText.trim();
+				if (trimmed) events.push({
+					kind: "assistant",
+					markdown: trimmed,
+					at
+				});
+				continue;
+			}
+			for (const block of piContentBlocks(message.content)) if (block.type === "thinking" && block.thinking !== void 0) {
+				const trimmed = block.thinking.trim();
+				if (trimmed) events.push({
+					kind: "assistant",
+					markdown: trimmed,
+					thinking: true,
+					at
+				});
+			} else if (block.type === "text" && block.text !== void 0) {
+				const trimmed = block.text.trim();
+				if (trimmed) events.push({
+					kind: "assistant",
+					markdown: trimmed,
+					at
+				});
+			} else if (block.type === "toolCall") {
+				if (block.name === "subagent_wait") continue;
+				const event = piToolEvent(block, at, cwd);
+				toolCalls += 1;
+				events.push(event);
+				if (block.id) pendingTools.set(block.id, event);
+			}
+			continue;
+		}
+		if (message.role === "toolResult") {
+			const pending = message.toolCallId ? pendingTools.get(message.toolCallId) : void 0;
+			if (!pending) continue;
+			const text = piText(message.content);
+			if (text && !pending.output) pending.output = truncate(text, OUTPUT_LIMIT);
+			if (message.toolCallId) pendingTools.delete(message.toolCallId);
+		}
+	}
+	return {
+		harness: "pi",
+		title: firstUserText ? compactLine(firstUserText) : null,
+		events,
+		startedAt,
+		endedAt,
+		activeMs: null,
+		userTurns,
+		toolCalls
+	};
+}
+function openCodeIso(value) {
+	const millis = jsonNumber(value);
+	return millis === void 0 ? void 0 : new Date(millis).toISOString();
+}
+function openCodeRecord(value) {
+	const info = jsonObject(value.info);
+	const infoTime = jsonObject(info?.time);
+	const time = jsonObject(value.time);
+	return {
+		type: jsonString(value.type),
+		directory: jsonString(value.directory),
+		title: jsonString(value.title),
+		createdAt: openCodeIso(time?.created),
+		role: jsonString(info?.role),
+		messageCreatedAt: openCodeIso(infoTime?.created),
+		completedAt: openCodeIso(infoTime?.completed),
+		parts: (jsonArray(value.parts) ?? []).flatMap((part) => isJsonObject(part) ? [openCodePart(part)] : [])
+	};
+}
+function openCodePart(value) {
+	const state = jsonObject(value.state);
+	return {
+		type: jsonString(value.type),
+		text: jsonString(value.text),
+		ignored: jsonBoolean(value.ignored) === true,
+		synthetic: jsonBoolean(value.synthetic) === true,
+		startedAt: openCodeIso(jsonObject(value.time)?.start),
+		tool: jsonString(value.tool),
+		state: {
+			status: jsonString(state?.status),
+			input: jsonObject(state?.input) ?? {},
+			output: jsonString(state?.output),
+			error: jsonString(state?.error),
+			title: jsonString(state?.title),
+			startedAt: openCodeIso(jsonObject(state?.time)?.start)
+		}
+	};
+}
+function openCodeText(parts) {
+	return parts.flatMap((part) => part.type === "text" && part.text !== void 0 && !part.ignored && !part.synthetic ? [part.text] : []).join("\n").trim();
+}
+function openCodeToolEvent(part, at, cwd) {
+	const name = part.tool ?? "tool";
+	const state = part.state;
+	const args = state.input;
+	const argText = (key) => jsonString(args[key]) ?? null;
+	const lineCount = (key) => jsonString(args[key])?.split("\n").length;
+	const event = {
+		kind: "tool",
+		tool: name,
+		verb: "Called",
+		title: state.title || name,
+		at
+	};
+	const filePath = argText("filePath");
+	const fileTitle = () => {
+		if (!filePath) return;
+		event.filePath = relativizePath(filePath, cwd);
+		event.title = compactFileLine(event.filePath);
+	};
+	switch (name) {
+		case "bash": {
+			const command = argText("command") ?? "";
+			event.verb = "Ran";
+			event.title = compactLine(command);
+			event.command = truncate(command, INPUT_LIMIT);
+			break;
+		}
+		case "read":
+			event.verb = "Read";
+			fileTitle();
+			break;
+		case "edit": {
+			event.verb = "Edited";
+			fileTitle();
+			const additions = lineCount("newString");
+			const deletions = lineCount("oldString");
+			if (additions !== void 0) event.additions = additions;
+			if (deletions !== void 0) event.deletions = deletions;
+			break;
+		}
+		case "write": {
+			event.verb = "Wrote";
+			fileTitle();
+			const additions = lineCount("content");
+			if (additions !== void 0) event.additions = additions;
+			break;
+		}
+		case "apply_patch": {
+			const summary = codexPatchSummary(argText("patchText") ?? "", cwd);
+			event.verb = "Edited";
+			event.title = compactFileLine(summary.files.join(", ") || name);
+			if (summary.filePath) event.filePath = summary.filePath;
+			event.additions = summary.additions;
+			event.deletions = summary.deletions;
+			break;
+		}
+		case "glob":
+		case "grep":
+			event.verb = "Searched";
+			event.title = compactLine(argText("pattern") ?? name);
+			break;
+		case "list": {
+			const listPath = argText("path");
+			event.verb = "Listed";
+			event.title = compactFileLine(listPath ? relativizePath(listPath, cwd) : name);
+			break;
+		}
+		case "task":
+			event.verb = "Ran agent";
+			event.title = compactLine(argText("description") ?? name);
+			break;
+		case "webfetch":
+			event.verb = "Fetched";
+			event.title = compactLine(argText("url") ?? name);
+			break;
+		case "websearch":
+			event.verb = "Searched web";
+			event.title = compactLine(argText("query") ?? name);
+			break;
+		case "skill":
+			event.verb = "Loaded skill";
+			event.title = compactLine(argText("name") ?? name);
+	}
+	if (!event.command) {
+		const pretty = codexValueText(args);
+		if (pretty && pretty !== "{}") event.input = truncate(pretty, INPUT_LIMIT);
+	}
+	const output = state.status === "error" && state.error !== void 0 ? state.error : state.output ?? "";
+	if (output.trim()) event.output = truncate(output, OUTPUT_LIMIT);
+	return event;
+}
+function parseOpenCodeRecords(records) {
+	const events = [];
+	let title = null;
+	let startedAt = null;
+	let endedAt = null;
+	let cwd = null;
+	let userTurns = 0;
+	let toolCalls = 0;
+	let firstUserText = null;
+	for (const raw of records) {
+		if (!isJsonObject(raw)) continue;
+		const record = openCodeRecord(raw);
+		if (record.type === "opencode_session") {
+			cwd = record.directory ?? null;
+			title = record.title?.trim() || null;
+			startedAt ??= record.createdAt ?? null;
+			continue;
+		}
+		if (record.type !== "opencode_message") continue;
+		const createdAt = record.messageCreatedAt;
+		if (createdAt) {
+			startedAt ??= createdAt;
+			endedAt = record.completedAt ?? createdAt;
+		}
+		if (record.role === "user") {
+			const text = openCodeText(record.parts);
+			if (!text) continue;
+			userTurns += 1;
+			firstUserText ??= text;
+			events.push({
+				kind: "user",
+				text,
+				at: createdAt
+			});
+			continue;
+		}
+		if (record.role !== "assistant") continue;
+		for (const part of record.parts) if (part.type === "reasoning" && part.text !== void 0) {
+			const trimmed = part.text.trim();
+			if (trimmed) events.push({
+				kind: "assistant",
+				markdown: trimmed,
+				thinking: true,
+				at: part.startedAt ?? createdAt
+			});
+		} else if (part.type === "text" && part.text !== void 0) {
+			const trimmed = part.text.trim();
+			if (trimmed) events.push({
+				kind: "assistant",
+				markdown: trimmed,
+				at: createdAt
+			});
+		} else if (part.type === "tool") {
+			toolCalls += 1;
+			events.push(openCodeToolEvent(part, part.state.startedAt ?? createdAt, cwd));
+		} else if (part.type === "compaction") events.push({
+			kind: "separator",
+			label: "Context compacted"
+		});
+	}
+	return {
+		harness: "opencode",
+		title: title ?? (firstUserText ? compactLine(firstUserText) : null),
+		events,
+		startedAt,
+		endedAt,
+		activeMs: null,
+		userTurns,
+		toolCalls
+	};
+}
+//#endregion
+//#region ../trace-core/src/trace-corpus.ts
+const RECORD_SEPARATOR = "";
+const FIELD_SEPARATOR = "";
+/** Atomically replaces a normalized JSONL copy without changing its version-1 record format. */
+function writeNormalizedTraceAtomic(targetPath, trace) {
+	const content = [trace.metadata, ...trace.events].map((record) => JSON.stringify(record)).join("\n");
+	writeFileAtomic(targetPath, `${content}\n`, "utf8");
+}
+/**
+* A saved copy, or null when the file is absent, written by another parser
+* version, or made for another store. A copy that names its store is served
+* only to that store; a copy from before the field is trusted only by s3
+* storage, which wrote every such file.
+*/
+function readNormalizedTrace(filePath, storage) {
+	try {
+		const records = readFileSync(filePath, "utf8").split("\n").filter(Boolean).map((line) => parseJsonText(line));
+		const metadata = records[0];
+		if (!metadata || metadata.type !== "metadata" || metadata.version !== 1 || metadata.parserVersion !== "1" || !Number.isFinite(metadata.source?.bytes)) return null;
+		if (storage) {
+			const owner = metadata.source.storage;
+			if (owner !== void 0 && owner !== storage.cacheIdentity()) return null;
+			if (owner === void 0 && storage.kind !== "s3") return null;
+		}
+		const events = records.slice(1);
+		if (events.some((record, index) => record.type !== "event" || record.index !== index || record.kind !== record.event?.kind || record.text !== extractTraceEventText(record.event))) return null;
+		return {
+			metadata,
+			events
+		};
+	} catch {
+		return null;
+	}
+}
+/** Creates and returns the configured local search corpus directory; it performs no remote lookup. */
+function traceSearchCorpusDir() {
+	const dir = process.env.REVIEW_TEST_TRACE_SEARCH_DIR ?? path.join(devReviewHome(), "trace-search");
+	mkdirSync(dir, { recursive: true });
+	return dir;
+}
+/** Parses a repository slug or returns the supplied owner/repo pair without consulting Git. */
+function normalizeRepo(repo) {
+	return isRepoSlug(repo) ? parseRepo(repo) : repo;
+}
+/** Whether a repo input is the "owner/repo" slug form. */
+function isRepoSlug(repo) {
+	return isStringValue(repo);
+}
+/** Builds a validated corpus path and ensures the corpus root exists; it does not write a trace. */
+function normalizedTracePath(repo, sessionId, traceName) {
+	return path.join(traceSearchCorpusDir(), corpusPathSegment(repo.owner, "owner"), corpusPathSegment(repo.repo, "repository"), corpusPathSegment(sessionId, "session"), `${corpusPathSegment(traceName.replace(/\.jsonl$/, ""), "trace")}.jsonl`);
+}
+/** Finds a local copy compatible with the supplied store, restricting scoped stores to their own paths; it never downloads content. */
+function findNormalizedTraceFile(sessionId, traceName, storage) {
+	const fileName = `${corpusPathSegment(traceName.replace(/\.jsonl$/, ""), "trace")}.jsonl`;
+	const own = storage?.cacheScope(null);
+	if (own) {
+		const candidate = path.join(path.dirname(normalizedTracePath(own, sessionId, "main")), fileName);
+		return isFile(candidate) ? candidate : null;
+	}
+	for (const sessionDir of findNormalizedSessionDirs(sessionId)) {
+		const candidate = path.join(sessionDir, fileName);
+		if (!isFile(candidate)) continue;
+		if (!storage || readNormalizedTrace(candidate, storage) !== null) return candidate;
+	}
+	return null;
+}
+/** Returns sorted local corpus directories for a session, or an empty list on traversal failure. */
+function findNormalizedSessionDirs(sessionId) {
+	const root = traceSearchCorpusDir();
+	const session = corpusPathSegment(sessionId, "session");
+	const results = [];
+	try {
+		for (const owner of readdirSync(root, { withFileTypes: true })) {
+			if (!owner.isDirectory()) continue;
+			const ownerDir = path.join(root, owner.name);
+			for (const repo of readdirSync(ownerDir, { withFileTypes: true })) {
+				if (!repo.isDirectory()) continue;
+				const candidate = path.join(ownerDir, repo.name, session);
+				if (isDirectory(candidate)) results.push(candidate);
+			}
+		}
+	} catch {
+		return [];
+	}
+	return results.sort();
+}
+function corpusPathSegment(value, label) {
+	if (!/^[A-Za-z0-9._-]+$/.test(value)) throw new Error(`Invalid ${label} path segment: ${value}`);
+	return value;
+}
+/** Returns the version-1 bucket object label for cache metadata without accessing storage. */
+function legacyObjectKey(sessionId, traceName) {
+	if (traceName === "main") return `by-session/${sessionId}/trace.jsonl`;
+	const base = path.basename(traceName);
+	return `by-session/${sessionId}/subagents/${base.endsWith(".jsonl") ? base : `${base}.jsonl`}`;
+}
+/** Returns distinct strings in first-seen order without modifying the input. */
+function deduplicateStrings(items) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const item of items) if (!seen.has(item)) {
+		seen.add(item);
+		out.push(item);
+	}
+	return out;
+}
+/** Resolves a Git revision to its SHA, retaining the supplied revision when resolution fails. */
+async function resolveCommitSha(cwd, rev) {
+	const result = await git(cwd, [
+		"rev-parse",
+		"--verify",
+		"--end-of-options",
+		rev
+	], { allowFailure: true });
+	return result.ok && result.stdout.trim() ? result.stdout.trim() : rev;
+}
+/** Returns valid, unique Agent-Session trailers for a revision, or an empty list when Git fails. */
+async function readTrailerSessions(cwd, rev) {
+	const result = await git(cwd, [
+		"show",
+		"-s",
+		"--format=%(trailers:key=Agent-Session,valueonly)",
+		"--end-of-options",
+		rev
+	], { allowFailure: true });
+	if (!result.ok) return [];
+	const sessions = [];
+	for (const line of result.stdout.split("\n")) {
+		const value = line.trim();
+		if (value && sessionIdSchema.safeParse(value).success && !sessions.includes(value)) sessions.push(value);
+	}
+	return sessions;
+}
+/** Reads valid, unique session trailers from all repository refs without consulting trace storage. */
+async function listRepositoryTraceSessionIds(cwd) {
+	const result = await gitAt(cwd, [
+		"log",
+		"--all",
+		"--no-show-signature",
+		"--format=%(trailers:key=Agent-Session,valueonly,separator=%x1f)"
+	], { allowFailure: true });
+	if (!result.ok) return [];
+	return deduplicateStrings(result.stdout.split(/[\n\x1f]+/).map((value) => value.trim()).filter((value) => sessionIdSchema.safeParse(value).success));
+}
+/** Reads a revision subject and extracts its trailing pull request number, or returns null. */
+async function readSubjectPullNumber(cwd, rev) {
+	const result = await git(cwd, [
+		"show",
+		"-s",
+		"--format=%s",
+		"--end-of-options",
+		rev
+	], { allowFailure: true });
+	if (!result.ok) return null;
+	return subjectPullNumber(result.stdout.trim());
+}
+/** Extracts a trailing (#number) from a subject without consulting Git. */
+function subjectPullNumber(subject) {
+	const match = /\(#(\d+)\)$/.exec(subject);
+	return match ? Number(match[1]) : null;
+}
+/** Reads the repository author email and current branch, returning null fields outside a worktree. */
+async function readRepoMetaFields(cwd) {
+	const insideResult = await git(cwd, ["rev-parse", "--is-inside-work-tree"], { allowFailure: true });
+	if (!insideResult.ok || insideResult.stdout.trim() !== "true") return {
+		author: null,
+		branch: null
+	};
+	const branchResult = await git(cwd, ["branch", "--show-current"], { allowFailure: true });
+	const branch = branchResult.ok ? branchResult.stdout.trim() : null;
+	const authorResult = await git(cwd, ["config", "user.email"], { allowFailure: true });
+	return {
+		author: (authorResult.ok ? authorResult.stdout.trim() : null) || null,
+		branch: branch || null
+	};
+}
+/** Reads commit subjects and valid session trailers in the requested range without consulting trace storage. */
+async function commitsWithTrailers(input) {
+	if (input.baseCommit === input.headCommit) return [];
+	const format = [
+		"%H",
+		"%s",
+		"%(trailers:key=Agent-Session,valueonly,separator=%x1f)"
+	].join("%x1f");
+	const result = await git(input.rootPath, [
+		"log",
+		"--no-show-signature",
+		`--format=${format}${RECORD_SEPARATOR}`,
+		`${input.baseCommit}..${input.headCommit}`
+	], { allowFailure: true });
+	if (!result.ok) return [];
+	const commits = [];
+	for (const chunk of result.stdout.split(RECORD_SEPARATOR)) {
+		const record = chunk.replace(/^\s+/, "");
+		if (!record) continue;
+		const [sha, subject, ...trailerFields] = record.split(FIELD_SEPARATOR);
+		if (!sha || !/^[0-9a-f]{40,64}$/.test(sha)) continue;
+		const sessions = new Set(trailerFields.flatMap((field) => field.split("\n"))).values().map((value) => value.trim()).filter((value) => sessionIdSchema.safeParse(value).success).toArray();
+		commits.push({
+			sha,
+			subject: subject ?? "",
+			sessions
+		});
+	}
+	return commits;
+}
+/** Fetches a pull request head and collects its unique session trailers, returning an empty list if Git cannot resolve the branch. */
+async function prScanTrailerSessions(cwd, commit, pr) {
+	if (!(await gitAt(cwd, [
+		"fetch",
+		"--quiet",
+		"origin",
+		`refs/pull/${pr}/head`
+	], { allowFailure: true })).ok) return [];
+	let revListRes = await gitAt(cwd, [
+		"rev-list",
+		"FETCH_HEAD",
+		"--not",
+		`${commit}^`
+	], { allowFailure: true });
+	if (!revListRes.ok) revListRes = await gitAt(cwd, [
+		"rev-list",
+		"FETCH_HEAD",
+		"--not",
+		`${commit}~1`
+	], { allowFailure: true });
+	if (!revListRes.ok) revListRes = await gitAt(cwd, ["rev-list", "FETCH_HEAD"], { allowFailure: true });
+	if (!revListRes.ok) return [];
+	const branchShas = revListRes.stdout.trim().split(/\s+/).filter(Boolean);
+	const prSessions = [];
+	for (const branchSha of branchShas) {
+		const sessionsOnSha = await readTrailerSessions(cwd, branchSha);
+		for (const s of sessionsOnSha) if (!prSessions.includes(s)) prSessions.push(s);
+	}
+	return prSessions;
+}
+/** Reports whether a path resolves to a regular file, returning false for filesystem errors. */
+function isFile(targetPath) {
+	try {
+		return statSync(targetPath).isFile();
+	} catch {
+		return false;
+	}
+}
+function isDirectory(targetPath) {
+	try {
+		return statSync(targetPath).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/** Collects regular files recursively, retaining files found before a directory read fails. */
+function listFilesRecursive(dirPath) {
+	const files = [];
+	try {
+		const entries = readdirSync(dirPath, { withFileTypes: true });
+		for (const entry of entries) {
+			const full = path.join(dirPath, entry.name);
+			if (entry.isDirectory()) files.push(...listFilesRecursive(full));
+			else if (entry.isFile()) files.push(full);
+		}
+	} catch {}
+	return files;
+}
+//#endregion
+//#region ../trace-core/src/opencode-trace-export.ts
+const OPENCODE_SESSION_RECORD = "opencode_session";
+const OPENCODE_MESSAGE_RECORD = "opencode_message";
+/** OpenCode session ids are `ses_` followed by a sortable id. */
+function isOpenCodeSessionId(sessionId) {
+	return sessionId.startsWith("ses_");
+}
+/**
+* OpenCode keeps sessions in its own database rather than a transcript file.
+* `opencode export` renders one as JSON; this writes that as the JSONL trace
+* the rest of the pipeline expects: one session header record, then one
+* record per message with its parts stripped of provider metadata and inline
+* file data. Returns null when OpenCode has no such session.
+*/
+async function exportOpenCodeTrace(input) {
+	mkdirSync(input.root, { recursive: true });
+	const destination = path.join(input.root, `${input.sessionId}.jsonl`);
+	const staging = `${destination}.tmp-${process.pid}`;
+	const raw = await runOpenCodeExport(input.sessionId, `${staging}.json`);
+	if (raw === null) return null;
+	const exported = jsonObject(parseJsonText(raw));
+	const info = jsonObject(exported?.info);
+	if (!exported || !info) throw new Error(`opencode export ${input.sessionId} returned no session info.`);
+	const messages = jsonArray(exported.messages);
+	if (!messages) throw new Error(`opencode export ${input.sessionId} returned no message list.`);
+	const header = {
+		type: OPENCODE_SESSION_RECORD,
+		...pick(info, [
+			"id",
+			"parentID",
+			"directory",
+			"title",
+			"version",
+			"time"
+		])
+	};
+	const lines = [JSON.stringify(header), ...messages.map((message) => JSON.stringify(traceMessageRecord(message)))];
+	writeFileAtomic(destination, `${lines.join("\n")}\n`, "utf8");
+	return destination;
+}
+/**
+* Runs `opencode export` with stdout on a file. OpenCode exits before a pipe
+* drains, so a piped export is cut off at 128 KiB; a file descriptor is not.
+* Resolves to the exported JSON, or null when OpenCode has no such session.
+*/
+function runOpenCodeExport(sessionId, stdoutPath) {
+	const fd = openSync(stdoutPath, "w");
+	return new Promise((resolve, reject) => {
+		const child = spawn("opencode", [
+			"export",
+			sessionId,
+			"--pure"
+		], {
+			stdio: [
+				"ignore",
+				fd,
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let stderr = "";
+		const stderrStream = child.stderr;
+		if (!stderrStream) throw new Error("opencode export did not open a stderr pipe.");
+		stderrStream.setEncoding("utf8");
+		stderrStream.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		child.once("error", (error) => {
+			closeSync(fd);
+			rmSync(stdoutPath, { force: true });
+			reject(/* @__PURE__ */ new Error(`opencode export ${sessionId} failed: ${error.message}`));
+		});
+		child.once("exit", (code) => {
+			closeSync(fd);
+			try {
+				if (code === 0) resolve(readFileSync(stdoutPath, "utf8"));
+				else if (stderr.includes("Session not found")) resolve(null);
+				else reject(/* @__PURE__ */ new Error(`opencode export ${sessionId} exited with ${code}: ${stderr.trim()}`));
+			} finally {
+				rmSync(stdoutPath, { force: true });
+			}
+		});
+	});
+}
+function traceMessageRecord(message) {
+	const record = jsonObject(message);
+	const info = jsonObject(record?.info);
+	if (!record || !info) throw new Error("opencode export returned a message without info.");
+	const parts = jsonArray(record.parts) ?? [];
+	return {
+		type: OPENCODE_MESSAGE_RECORD,
+		info: pick(info, [
+			"id",
+			"sessionID",
+			"role",
+			"time",
+			"error",
+			"agent",
+			"modelID",
+			"providerID"
+		]),
+		parts: parts.flatMap((part) => {
+			const object = jsonObject(part);
+			return object ? [tracePart(object)] : [];
+		})
+	};
+}
+function tracePart(part) {
+	const common = pick(part, ["id", "type"]);
+	switch (part.type) {
+		case "text": return {
+			...common,
+			...pick(part, [
+				"text",
+				"ignored",
+				"synthetic"
+			])
+		};
+		case "reasoning": return {
+			...common,
+			...pick(part, ["text", "time"])
+		};
+		case "tool": {
+			const state = jsonObject(part.state);
+			return {
+				...common,
+				...pick(part, ["tool", "callID"]),
+				state: state ? pick(state, [
+					"status",
+					"input",
+					"output",
+					"error",
+					"title",
+					"time"
+				]) : {}
+			};
+		}
+		case "file": return {
+			...common,
+			...pick(part, ["mime", "filename"])
+		};
+		case "patch": return {
+			...common,
+			...pick(part, ["hash", "files"])
+		};
+		case "compaction": return {
+			...common,
+			...pick(part, ["auto"])
+		};
+		default: return common;
+	}
+}
+function pick(value, keys) {
+	const picked = {};
+	for (const key of keys) {
+		const entry = value[key];
+		if (entry !== void 0) picked[key] = entry;
+	}
+	return picked;
+}
+//#endregion
+//#region ../trace-core/src/trace-local-sessions.ts
+/** Finds a local harness transcript and subagents, exporting OpenCode data when needed; it never publishes traces. */
+async function findLocalTrace(sessionId) {
+	if (!sessionIdSchema.safeParse(sessionId).success) return null;
+	const claudeRoot = traceEnvValue("TRACE_LOCAL_TRACE_ROOT") || path.join(homedir(), ".claude", "projects");
+	const codexRoot = codexSessionsRoot();
+	const piRoot = traceEnvValue("TRACE_PI_SESSIONS_ROOT") || path.join(homedir(), ".pi", "agent", "sessions");
+	let harness = "claude";
+	let tracePath = findClaudeTrace(claudeRoot, sessionId);
+	if (!tracePath) {
+		tracePath = findCodexTrace(codexRoot, sessionId);
+		if (tracePath) harness = "codex";
+	}
+	if (!tracePath) {
+		tracePath = findPiTrace(piRoot, sessionId);
+		if (tracePath) harness = "pi";
+	}
+	if (!tracePath) {
+		if (existsSync(claudeRoot) && isFile(path.join(claudeRoot, `${sessionId}.jsonl`))) {
+			tracePath = path.join(claudeRoot, `${sessionId}.jsonl`);
+			harness = "claude";
+		}
+	}
+	if (!tracePath && isOpenCodeSessionId(sessionId)) {
+		tracePath = await exportOpenCodeTrace({
+			sessionId,
+			root: process.env.TRACE_OPENCODE_TRACES_ROOT || path.join(devReviewHome(), "opencode-traces")
+		});
+		if (tracePath) harness = "opencode";
+	}
+	if (!tracePath) return null;
+	const subagentPaths = findSubagentBlobs(tracePath);
+	return {
+		tracePath,
+		harness,
+		subagentPaths
+	};
+}
+function findClaudeTrace(root, sessionId) {
+	const fileName = `${sessionId}.jsonl`;
+	if (!existsSync(root)) return null;
+	const direct = path.join(root, fileName);
+	if (isFile(direct)) return direct;
+	try {
+		const entries = readdirSync(root, { withFileTypes: true });
+		for (const entry of entries) if (entry.isDirectory()) {
+			const candidate = path.join(root, entry.name, fileName);
+			if (isFile(candidate)) return candidate;
+		}
+	} catch {}
+	return null;
+}
+function findCodexTrace(root, sessionId) {
+	if (!existsSync(root)) return null;
+	const suffix = `-${sessionId}.jsonl`;
+	return listFilesRecursive(root).sort().find((entry) => {
+		const name = path.basename(entry);
+		return name.startsWith("rollout-") && name.endsWith(suffix);
+	}) ?? null;
+}
+function findPiTrace(root, sessionId) {
+	if (!existsSync(root)) return null;
+	try {
+		const entries = readdirSync(root, { withFileTypes: true });
+		for (const entry of entries) if (entry.isDirectory()) {
+			const subDir = path.join(root, entry.name);
+			for (const file of readdirSync(subDir)) if (file.endsWith(`_${sessionId}.jsonl`) || file === `${sessionId}.jsonl`) {
+				const candidate = path.join(subDir, file);
+				if (isFile(candidate)) return candidate;
+			}
+		} else if (entry.isFile()) {
+			if (entry.name.endsWith(`_${sessionId}.jsonl`) || entry.name === `${sessionId}.jsonl`) return path.join(root, entry.name);
+		}
+	} catch {}
+	return null;
+}
+function findSubagentBlobs(tracePath) {
+	const results = [];
+	const stem = tracePath.endsWith(".jsonl") ? tracePath.slice(0, -6) : tracePath;
+	const subagentsDir = path.join(stem, "subagents");
+	if (existsSync(subagentsDir)) try {
+		for (const name of readdirSync(subagentsDir)) if (name.endsWith(".jsonl")) results.push({
+			name,
+			path: path.join(subagentsDir, name)
+		});
+	} catch {}
+	if (existsSync(stem)) try {
+		for (const childEntry of readdirSync(stem, { withFileTypes: true })) if (childEntry.isDirectory() && childEntry.name !== "subagents") {
+			const childDir = path.join(stem, childEntry.name);
+			for (const runEntry of readdirSync(childDir, { withFileTypes: true })) if (runEntry.isDirectory() && runEntry.name.startsWith("run-")) {
+				const runFile = path.join(childDir, runEntry.name, "session.jsonl");
+				if (isFile(runFile)) {
+					const shortChild = childEntry.name.slice(0, 8);
+					results.push({
+						name: `pi-${runEntry.name}-${shortChild}.jsonl`,
+						path: runFile
+					});
+				}
+			}
+		}
+	} catch {}
+	return results.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Reads a trace setting through the existing environment and saved-file resolver without changing configuration. */
+function traceEnvValue(name) {
+	return traceEnvValue$1(name);
+}
+/** Resolves the Codex session directory using the trace override or process CODEX_HOME, without reading CODEX_HOME from the trace env file. */
+function codexSessionsRoot() {
+	const codexHome = process.env.CODEX_HOME;
+	return traceEnvValue("TRACE_CODEX_SESSIONS_ROOT") || path.join(codexHome ? path.resolve(codexHome) : path.join(homedir(), ".codex"), "sessions");
+}
+//#endregion
+//#region ../trace-core/src/trace-read.ts
+const STORE_COMMIT_LOOKUP_LIMIT = 30;
+const REMOTE_HEAD_TTL_MS = 15e3;
+const TUTORIAL_TRACE_SESSION_ID = "review-tutorial-checkout";
+const lastCheckedTimes = /* @__PURE__ */ new Map();
+/**
+* The store to read from or publish to: an explicit override, or the
+* machine's selected store. Null means no remote storage is configured.
+*/
+async function storageFor(storage, cwd) {
+	return storage === void 0 ? resolveTraceStorage({ cwd }) : storage;
+}
+/**
+* A remote lookup, or null when the store could not be reached. A refusal
+* propagates: the caller must show nothing, not "nothing here".
+*/
+async function reachable(lookup) {
+	try {
+		return await lookup();
+	} catch (error) {
+		if (error instanceof TraceStorageUnavailableError) return null;
+		throw error;
+	}
+}
+function freshnessKey(storage, sessionId, traceName) {
+	return `${storage.cacheIdentity()}/${sessionId}/${traceName}`;
+}
+/** Describes sessions for a change range using trailers, then bounded store-index and pull-request fallbacks when none are found. */
+async function listReviewTraceSessions(input) {
+	const storage = await storageFor(input.storage, input.rootPath);
+	const sessions = /* @__PURE__ */ new Map();
+	const commits = await commitsWithTrailers(input);
+	for (const commit of commits) for (const sessionId of commit.sessions) {
+		const existing = sessions.get(sessionId);
+		if (existing) existing.commits.push({
+			sha: commit.sha,
+			subject: commit.subject
+		});
+		else sessions.set(sessionId, {
+			sessionId,
+			commits: [{
+				sha: commit.sha,
+				subject: commit.subject
+			}]
+		});
+	}
+	if (sessions.size === 0 && commits.length <= STORE_COMMIT_LOOKUP_LIMIT) await addSessionsFromStoreIndex(storage, commits, sessions);
+	if (sessions.size === 0 && commits.length <= STORE_COMMIT_LOOKUP_LIMIT) await addSessionsFromPrScan(input.rootPath, commits, sessions);
+	const descriptors = [];
+	for (const ref of sessions.values()) {
+		const desc = await describeTraceSession(ref, storage);
+		descriptors.push(desc);
+	}
+	return descriptors;
+}
+/** Describes availability from compatible local copies and the selected store; store refusals propagate. */
+async function describeTraceSession(ref, storage) {
+	const store = await storageFor(storage);
+	const local = findNormalizedTraceFile(ref.sessionId, "main", store);
+	const normalized = local ? readNormalizedTrace(local, store) : null;
+	const remote = store ? await reachable(() => store.describeObject(ref.sessionId, "main")) : null;
+	const available = normalized !== null || remote !== null && remote.size > 0;
+	const harness = normalized?.metadata.harness ?? "unknown";
+	const subagents = await listSessionSubagents(ref.sessionId, store);
+	return {
+		sessionId: ref.sessionId,
+		harness,
+		available,
+		source: available ? "r2" : null,
+		notSynced: !available,
+		subagents,
+		commits: ref.commits
+	};
+}
+/** Loads the offline tutorial or a store-compatible normalized trace, preserving freshness and offline fallback status; store refusals propagate. */
+async function loadReviewAgentTrace(input) {
+	const { sessionId, trace } = input;
+	if (sessionId === "review-tutorial-checkout") {
+		if (trace && trace !== "main") return null;
+		const { loadTutorialTrace } = await import("./tutorial-trace-DrBvkaeL.js");
+		return loadTutorialTrace();
+	}
+	if (!sessionIdSchema.safeParse(sessionId).success) return null;
+	const traceName = trace ?? "main";
+	const storage = await storageFor(input.storage, input.cwd);
+	const requestedRepo = input.repo ? normalizeRepo(input.repo) : null;
+	let scope = storage ? storage.cacheScope(requestedRepo) : requestedRepo;
+	let normalizedPath = scope ? normalizedTracePath(scope, sessionId, traceName) : findNormalizedTraceFile(sessionId, traceName, storage);
+	let normalized = normalizedPath ? readNormalizedTrace(normalizedPath, storage) : null;
+	const now = Date.now();
+	const checkKey = storage ? freshnessKey(storage, sessionId, traceName) : null;
+	const lastChecked = checkKey ? lastCheckedTimes.get(checkKey) ?? 0 : 0;
+	const canUseWithoutCheck = normalized && !input.refresh && now - lastChecked < REMOTE_HEAD_TTL_MS;
+	if (storage && checkKey && !canUseWithoutCheck) {
+		if (storage.kind === "hosted") lastCheckedTimes.delete(checkKey);
+		let remote;
+		try {
+			remote = await storage.describeObject(sessionId, traceName);
+		} catch (error) {
+			if (error instanceof TraceStorageDeniedError) return null;
+			if (!(error instanceof TraceStorageUnavailableError)) throw error;
+			return normalized ? loadedNormalizedTrace(normalized, input.commits, "offline") : null;
+		}
+		if (storage.kind === "hosted" && remote === null) {
+			if (normalized && normalizedPath) rmSync(normalizedPath, { force: true });
+			lastCheckedTimes.delete(checkKey);
+			return null;
+		}
+		if (storage.kind !== "hosted") lastCheckedTimes.set(checkKey, now);
+		if (remote !== null && (!normalized || !cacheIsCurrent(storage, normalized, remote))) {
+			if (!scope) {
+				let repo = requestedRepo;
+				if (!repo && input.cwd) repo = await inferRepoFromGit(input.cwd).catch(() => null);
+				if (!repo) {
+					const meta = await storage.sessionMeta(sessionId);
+					if (meta?.repo) try {
+						repo = parseRepo(meta.repo);
+					} catch {
+						repo = null;
+					}
+				}
+				scope = storage.cacheScope(repo);
+			}
+			if (!scope) return normalized ? loadedNormalizedTrace(normalized, input.commits, "stale") : null;
+			normalizedPath = normalizedTracePath(scope, sessionId, traceName);
+			const fresh = await materializeNormalizedTrace({
+				storage,
+				sessionId,
+				traceName,
+				normalizedPath,
+				repository: requestedRepo ? traceRepoName(requestedRepo) : normalized?.metadata.repository ?? traceRepoName(scope)
+			});
+			if (!fresh) return normalized ? loadedNormalizedTrace(normalized, input.commits, "stale") : null;
+			normalized = fresh;
+		}
+		if (storage.kind === "hosted") lastCheckedTimes.set(checkKey, now);
+	}
+	if (!normalized) return null;
+	return loadedNormalizedTrace(normalized, input.commits, storage?.kind === "hosted" && (await storage.readiness()).ready === false ? "offline" : "current");
+}
+/**
+* Whether a saved copy still matches the stored object. S3 storage can
+* only compare sizes and objects only grow; hosted storage names content
+* exactly, so an equal-size or smaller replacement is still seen.
+*/
+function cacheIsCurrent(storage, normalized, remote) {
+	if (storage.kind === "s3") return remote.size <= normalized.metadata.source.bytes;
+	return normalized.metadata.source.contentId === remote.contentId;
+}
+function loadedNormalizedTrace(normalized, commits, cacheStatus) {
+	const metadata = normalized.metadata;
+	const descriptor = {
+		sessionId: metadata.session,
+		harness: metadata.harness,
+		available: true,
+		source: "r2",
+		subagents: metadata.subagents,
+		commits: commits ?? []
+	};
+	return {
+		parserVersion: metadata.parserVersion,
+		descriptor,
+		trace: {
+			harness: metadata.harness,
+			title: metadata.title,
+			events: normalized.events.map((record) => record.event),
+			startedAt: metadata.startedAt,
+			endedAt: metadata.endedAt,
+			activeMs: metadata.activeMs,
+			userTurns: metadata.userTurns,
+			toolCalls: metadata.toolCalls
+		},
+		subagents: metadata.subagents,
+		traceName: metadata.trace === "main" ? null : metadata.trace,
+		cacheStatus
+	};
+}
+async function materializeNormalizedTrace(input) {
+	const rawTempPath = path.join(tmpdir(), `review-trace-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.jsonl`);
+	try {
+		let downloaded;
+		try {
+			downloaded = await input.storage.downloadObject(input.sessionId, input.traceName, rawTempPath);
+		} catch (error) {
+			if (error instanceof TraceStorageDeniedError) throw error;
+			if (error instanceof TraceStorageUnavailableError) return null;
+			process.stderr.write(`Trace store download failed for ${input.traceName}: ${errorMessage(error)}\n`);
+			return null;
+		}
+		if (!downloaded) return null;
+		const parsed = parseAgentTraceJsonl(readFileSync(rawTempPath, "utf8"), { isSubagent: input.traceName !== "main" });
+		const subagents = await listSessionSubagents(input.sessionId, input.storage);
+		const normalized = {
+			metadata: {
+				type: "metadata",
+				version: 1,
+				parserVersion: "1",
+				repository: input.repository,
+				session: input.sessionId,
+				trace: input.traceName,
+				harness: parsed.harness,
+				title: parsed.title,
+				startedAt: parsed.startedAt,
+				endedAt: parsed.endedAt,
+				activeMs: parsed.activeMs,
+				userTurns: parsed.userTurns,
+				toolCalls: parsed.toolCalls,
+				subagents,
+				source: {
+					r2Key: legacyObjectKey(input.sessionId, input.traceName),
+					bytes: downloaded.size,
+					checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					contentId: downloaded.contentId,
+					storage: input.storage.cacheIdentity()
+				}
+			},
+			events: parsed.events.map((event, index) => ({
+				type: "event",
+				index,
+				kind: event.kind,
+				text: extractTraceEventText(event),
+				event
+			}))
+		};
+		writeNormalizedTraceAtomic(input.normalizedPath, normalized);
+		return normalized;
+	} finally {
+		rmSync(rawTempPath, { force: true });
+	}
+}
+/** Refreshes requested sessions into the local corpus and reports available paths and unavailable sessions without publishing traces. */
+async function pullReviewTraceCorpus(input) {
+	const repository = `${input.repo.owner}/${input.repo.repo}`;
+	const corpusRoot = traceSearchCorpusDir();
+	const storage = await storageFor(input.storage, input.cwd);
+	const scope = (storage ? storage.cacheScope(input.repo) : null) ?? input.repo;
+	const sessions = [];
+	const unavailableSessions = [];
+	const paths = [];
+	for (const sessionRef of input.sessions) {
+		const main = await loadReviewAgentTrace({
+			sessionId: sessionRef.id,
+			repo: input.repo,
+			refresh: true,
+			storage
+		});
+		if (!main) {
+			unavailableSessions.push(sessionRef.id);
+			continue;
+		}
+		paths.push(normalizedTracePath(scope, sessionRef.id, "main"));
+		let traceCount = 1;
+		let eventCount = main.trace.events.length;
+		if (!input.mainOnly) for (const traceName of sessionRef.traces ?? main.subagents) {
+			const subagent = await loadReviewAgentTrace({
+				sessionId: sessionRef.id,
+				trace: traceName,
+				repo: input.repo,
+				refresh: true,
+				storage
+			});
+			if (subagent) {
+				paths.push(normalizedTracePath(scope, sessionRef.id, traceName));
+				traceCount += 1;
+				eventCount += subagent.trace.events.length;
+			}
+		}
+		sessions.push({
+			session: sessionRef.id,
+			traces: traceCount,
+			events: eventCount,
+			files: traceCount
+		});
+	}
+	return {
+		corpusRoot,
+		repository,
+		sessions,
+		unavailableSessions,
+		events: sessions.reduce((total, session) => total + session.events, 0),
+		files: sessions.reduce((total, session) => total + session.files, 0),
+		paths
+	};
+}
+/** Resolves sessions by commit trailers, then the store index, then a pull-request scan, retaining the lookup source. */
+async function lookupReviewTraceCommit(input) {
+	const storage = await storageFor(input.storage, input.cwd);
+	const commit = await resolveCommitSha(input.cwd, input.sha);
+	const trailerSessions = await readTrailerSessions(input.cwd, commit);
+	const pr = await readSubjectPullNumber(input.cwd, commit);
+	if (trailerSessions.length > 0) {
+		const sessionMeta = await enrichSessionMeta(trailerSessions, storage);
+		const result = {
+			commit,
+			sessions: trailerSessions,
+			pr,
+			branch: null,
+			source: "trailer"
+		};
+		if (sessionMeta) result.session_meta = sessionMeta;
+		return result;
+	}
+	const indexed = storage ? await storage.sessionsForCommit(commit) : null;
+	if (indexed && indexed.sessions.length > 0) {
+		const sessions = deduplicateStrings(indexed.sessions);
+		const sessionMeta = await enrichSessionMeta(sessions, storage);
+		const result = {
+			commit,
+			sessions,
+			pr: indexed.pr ?? pr,
+			branch: indexed.branch ?? null,
+			source: "index"
+		};
+		if (sessionMeta) result.session_meta = sessionMeta;
+		return result;
+	}
+	if (pr !== null) {
+		const prSessions = await prScanTrailerSessions(input.cwd, commit, pr);
+		if (prSessions.length > 0) {
+			const sessionMeta = await enrichSessionMeta(prSessions, storage);
+			const result = {
+				commit,
+				sessions: prSessions,
+				pr,
+				branch: null,
+				source: "pr-scan"
+			};
+			if (sessionMeta) result.session_meta = sessionMeta;
+			return result;
+		}
+	}
+	return {
+		commit,
+		sessions: [],
+		pr,
+		branch: null,
+		source: "none"
+	};
+}
+async function enrichSessionMeta(sessions, storage) {
+	if (!storage || sessions.length === 0) return void 0;
+	const detail = {};
+	for (const session of sessions) {
+		const meta = await storage.sessionMeta(session);
+		if (meta) detail[session] = {
+			repo: meta.repo,
+			branch: meta.branch,
+			pr: meta.pr,
+			author: meta.author
+		};
+	}
+	return Object.keys(detail).length > 0 ? detail : void 0;
+}
+/** Resolves sessions for file blame or history commits, preserving their resolution order and lookup sources. */
+async function lookupReviewTraceBlame(input) {
+	if (!input.file) throw new Error("File path is required.");
+	if (input.lines) {
+		const match = /^(\d+)(?:,(\d+))?$/.exec(input.lines.trim());
+		if (!match) throw new Error(`Invalid line range "${input.lines}". Expected start,end or single line number.`);
+		const start = parseInt(match[1], 10);
+		const end = match[2] ? parseInt(match[2], 10) : start;
+		if (start <= 0 || end < start) throw new Error(`Invalid line range "${input.lines}". Start must be >= 1 and end >= start.`);
+	}
+	let shas = [];
+	if (input.history) {
+		const spec = input.lines ? `${input.lines}:${input.file}` : `1,$:${input.file}`;
+		const res = await gitAt(input.cwd, [
+			"log",
+			"-L",
+			spec,
+			"--format=%H",
+			"-s"
+		], { allowFailure: true });
+		if (!res.ok) throw new Error(res.stderr.trim() || `git log -L failed for ${input.file}`);
+		shas = deduplicateStrings(res.stdout.trim().split(/\s+/).filter(Boolean));
+	} else {
+		const args = ["blame", "--line-porcelain"];
+		if (input.lines) args.push("-L", input.lines);
+		args.push("--", input.file);
+		const res = await gitAt(input.cwd, args, { allowFailure: true });
+		if (!res.ok) throw new Error(res.stderr.trim() || `git blame failed for ${input.file}`);
+		const collected = [];
+		for (const line of res.stdout.split("\n")) {
+			const parts = line.trim().split(/\s+/);
+			if (parts.length >= 3 && /^[0-9a-f]{40,64}$/i.test(parts[0])) {
+				if (!collected.includes(parts[0])) collected.push(parts[0]);
+			}
+		}
+		shas = collected;
+	}
+	const storage = await storageFor(input.storage, input.cwd);
+	const resolutions = [];
+	for (const sha of shas) resolutions.push(await lookupReviewTraceCommit({
+		cwd: input.cwd,
+		sha,
+		storage
+	}));
+	return {
+		file: input.file,
+		range: input.lines ?? null,
+		history: Boolean(input.history),
+		resolutions
+	};
+}
+/** Clears saved trace environment values and remote freshness timestamps without deleting normalized copies. */
+function clearTraceEnvCache() {
+	clearTraceEnvCache$1();
+	lastCheckedTimes.clear();
+}
+/** Subagent traces known locally or in the store, by name without ".jsonl". */
+async function listSessionSubagents(sessionId, storage) {
+	const subagents = /* @__PURE__ */ new Set();
+	for (const localSessionDir of findNormalizedSessionDirs(sessionId)) try {
+		for (const entry of readdirSync(localSessionDir)) if (entry.endsWith(".jsonl") && entry !== "main.jsonl") subagents.add(entry.slice(0, -6));
+	} catch {}
+	const store = await storageFor(storage);
+	if (store) {
+		const names = await reachable(() => store.listSubagents(sessionId));
+		for (const name of names ?? []) subagents.add(name);
+	}
+	return [...subagents].sort();
+}
+async function addSessionsFromPrScan(rootPath, commits, sessions) {
+	const scannedPrs = /* @__PURE__ */ new Set();
+	for (const commit of commits) {
+		const pr = subjectPullNumber(commit.subject);
+		if (pr === null || scannedPrs.has(pr)) continue;
+		scannedPrs.add(pr);
+		const prSessions = await prScanTrailerSessions(rootPath, commit.sha, pr);
+		for (const sessionId of prSessions) {
+			const existing = sessions.get(sessionId);
+			if (existing) existing.commits.push({
+				sha: commit.sha,
+				subject: commit.subject
+			});
+			else sessions.set(sessionId, {
+				sessionId,
+				commits: [{
+					sha: commit.sha,
+					subject: commit.subject
+				}]
+			});
+		}
+	}
+}
+async function addSessionsFromStoreIndex(storage, commits, sessions) {
+	if (!storage) return;
+	for (const commit of commits) {
+		const indexed = await storage.sessionsForCommit(commit.sha);
+		if (!indexed) continue;
+		for (const sessionId of indexed.sessions) {
+			const existing = sessions.get(sessionId);
+			if (existing) existing.commits.push({
+				sha: commit.sha,
+				subject: commit.subject
+			});
+			else sessions.set(sessionId, {
+				sessionId,
+				commits: [{
+					sha: commit.sha,
+					subject: commit.subject
+				}]
+			});
+		}
+	}
+}
+//#endregion
+//#region ../trace-core/src/trace-sync.ts
+/** Publishes the discovered local transcript and subagents through the selected store, preserving its consent and provenance checks. */
+async function syncReviewTrace(input) {
+	const sessionId = input.sessionId.trim();
+	if (!sessionIdSchema.safeParse(sessionId).success) throw new Error("Session id must be 8-128 characters of letters, digits, dots, dashes, or underscores.");
+	const workDir = input.cwd ?? process.cwd();
+	const storage = input.storage === void 0 ? await resolveTraceStorage({
+		cwd: workDir,
+		purpose: "write"
+	}) : input.storage;
+	if (!storage) throw new Error(`S3/R2 storage is not configured. Run \`whiteboard trace allow .\` to configure trace capture.`);
+	const repo = input.repo ? parseRepo(input.repo) : await inferRepoFromGit(workDir);
+	const local = await findLocalTrace(sessionId);
+	if (!local) throw new Error(`No local trace found for session ${sessionId}.`);
+	const { author, branch } = await readRepoMetaFields(workDir);
+	const published = await storage.publish({
+		sessionId,
+		cwd: workDir,
+		repo,
+		harness: local.harness,
+		files: [{
+			name: "main",
+			path: local.tracePath
+		}, ...local.subagentPaths.map((sub) => ({
+			name: sub.name,
+			path: sub.path
+		}))],
+		commits: input.commits,
+		branch,
+		author
+	});
+	const result = {
+		session: sessionId,
+		repo: `${repo.owner}/${repo.repo}`,
+		uploads: published.uploads
+	};
+	if (published.hosted) result.hosted = published.hosted;
+	return result;
+}
+/** Validates a commit and associates its sessions through the selected store, failing when storage is absent. */
+async function writeReviewTraceCommitMapping(input) {
+	const commit = commitShaSchema.parse(input.commit);
+	const storage = await storageFor(input.storage, input.cwd);
+	if (!storage) throw new Error(`Failed to write by-commit/${commit}.json.`);
+	return storage.associateCommits({
+		commit,
+		sessions: input.sessions,
+		branch: input.branch,
+		resolve: async () => ({
+			repo: await inferRepoFromGit(input.cwd),
+			pr: await readSubjectPullNumber(input.cwd, commit)
+		})
+	});
+}
+//#endregion
+export { emitJsonEvent as $, traceCaptureIdentity as A, findTraceRepository as B, TraceStorageDeniedError as C, recordTraceSyncFailure as D, listTraceSyncFailures as E, inferRepoFromGit as F, readStoreAuth as G, DEFAULT_STORE_ORIGIN as H, parseRepo as I, runStoreLogout as J, requireStoreClient as K, traceRepoName as L, readCachedTraceRepositoryTarget as M, requireTraceConsent as N, TraceProvenanceError as O, resolveTraceRepositoryTarget as P, withStoreAuthorization as Q, allowTraceRepository as R, traceNameFromObject as S, describeTraceSyncFailure as T, clearStoreAuth as U, readTraceUserConfig as V, openUrlInBrowser as W, StoreApiError as X, runStoreWhoami as Y, StoreClient as Z, isTraceStorageConfigured as _, describeTraceSession as a, selectTraceStorage as b, lookupReviewTraceBlame as c, findLocalTrace as d, failWithJsonError as et, isOpenCodeSessionId as f, describeSelection as g, extractTraceEventText as h, clearTraceEnvCache as i, gitCommonDirectory as j, recordTraceSessionProvenance as k, lookupReviewTraceCommit as l, readTrailerSessions as m, writeReviewTraceCommitMapping as n, jsonRequestedInArgv as nt, listReviewTraceSessions as o, listRepositoryTraceSessionIds as p, runStoreLogin as q, TUTORIAL_TRACE_SESSION_ID as r, loadReviewAgentTrace as s, syncReviewTrace as t, humanStream as tt, pullReviewTraceCorpus as u, loadS3TraceStorage as v, clearTraceSyncFailure as w, traceStorageExpectation as x, resolveTraceStorage as y, denyTraceRepository as z };