@dev.fast/whiteboard 0.0.0-stage → 0.2.0

package/dist/review-home-paths-6zZH-1c9.js

@@ -0,0 +1,2560 @@
+import { d as gitAt, u as git } from "./src-CmdiBL20.js";
+import { c as jsonString, m as isStringValue, n as isJsonObject, o as jsonObject, r as jsonArray, t as isJsonArray, u as parseJsonText } from "./src-X9phtB2j.js";
+import { u as listUploadsQuerySchema, x as sessionIdSchema } from "./src-CGP5ytbV.js";
+import { $ as emitJsonEvent, A as traceCaptureIdentity, B as findTraceRepository, D as recordTraceSyncFailure, E as listTraceSyncFailures, F as inferRepoFromGit, G as readStoreAuth, I as parseRepo, K as requireStoreClient, L as traceRepoName, M as readCachedTraceRepositoryTarget, O as TraceProvenanceError, R as allowTraceRepository, S as traceNameFromObject, T as describeTraceSyncFailure, V as readTraceUserConfig, X as StoreApiError, Z as StoreClient, a as describeTraceSession, b as selectTraceStorage, c as lookupReviewTraceBlame, d as findLocalTrace, et as failWithJsonError, f as isOpenCodeSessionId, g as describeSelection, h as extractTraceEventText, i as clearTraceEnvCache, j as gitCommonDirectory, k as recordTraceSessionProvenance, l as lookupReviewTraceCommit, m as readTrailerSessions, n as writeReviewTraceCommitMapping, o as listReviewTraceSessions, p as listRepositoryTraceSessionIds, s as loadReviewAgentTrace, t as syncReviewTrace, tt as humanStream, u as pullReviewTraceCorpus, w as clearTraceSyncFailure, x as traceStorageExpectation, y as resolveTraceStorage, z as denyTraceRepository } from "./review-agent-traces-DNJFYzc8.js";
+import { A as devReviewHome, E as writeTraceConfigFile, N as writeFileAtomicAsync, S as readTraceConfigFile, _ as emptyTraceConfig, b as hostedCaptureEnabled, c as resolveS3Setup, d as traceEnvPath, h as TraceConfigurationError, p as traceSettingsPath, x as hostedOrigin } from "./s3-config-CAxhO9u_.js";
+import { t as errorMessage } from "./error-message-OtiDonty.js";
+import crypto from "node:crypto";
+import { z } from "zod";
+import { accessSync, constants, existsSync } from "node:fs";
+import { chmod, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { InvalidArgumentError, Option } from "commander";
+//#region ../trace-core/src/trace-command.ts
+/** Resolves the machine paths and environment shared by one CLI run. */
+function traceScope(input = {}) {
+	const env = input.env ?? process.env;
+	const homeDir = input.homeDir ?? os.homedir();
+	return {
+		homeDir,
+		env,
+		devHome: devReviewHome(env, homeDir)
+	};
+}
+/** The executable name used in trace hooks. */
+function traceCliName() {
+	return "whiteboard";
+}
+/** Returns the configured trace home, then the operating-system home. */
+function traceHomeDir(env = process.env) {
+	return env.TRACE_HOME_DIR ?? os.homedir();
+}
+/**
+* Resolves an explicit command, the environment, an installed command, or
+* the configured CLI name on PATH, in that order.
+*/
+function resolveTraceCommand(input = {}) {
+	if (isStringValue(input.explicit)) return { file: input.explicit };
+	if (input.explicit) return input.explicit;
+	const env = input.env ?? process.env;
+	if (env.REVIEW_TRACE_COMMAND) return { file: env.REVIEW_TRACE_COMMAND };
+	const installed = path.join(input.homeDir ?? traceHomeDir(env), ".local", "bin", "whiteboard");
+	if (existsSync(installed)) return { file: installed };
+	return { file: (env.PATH ?? "").split(path.delimiter).filter((directory) => path.isAbsolute(directory)).map((directory) => path.join(directory, "whiteboard")).find(isLiveTraceExecutable) ?? "whiteboard" };
+}
+/** Quotes one value for a POSIX shell command. */
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+/** Renders the executable and each leading argument as quoted shell words. */
+function renderTraceCommand(command) {
+	return [command.file, ...command.args ?? []].map(shellQuote).join(" ");
+}
+/** Only stable absolute commands can retain ownership across installations. */
+function isLiveTraceExecutable(file) {
+	if (!file || !path.isAbsolute(file)) return false;
+	try {
+		accessSync(file, constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Keep an existing working installation; a missing executable can be repaired. */
+function keepTraceExecutable(existing, wanted) {
+	return existing !== wanted && isLiveTraceExecutable(existing);
+}
+/** The first shell word from our rendered Git hook command. */
+function traceCommandExecutable(command) {
+	if (!command) return void 0;
+	const quoted = /^'((?:[^']|'"'"')*)'(?:\s|$)/.exec(command);
+	const bare = /^([^\s']+)(?:\s|$)/.exec(command);
+	return quoted ? quoted[1].replaceAll(`'"'"'`, "'") : bare?.[1];
+}
+//#endregion
+//#region ../trace-core/src/agent-trace-hooks.ts
+/** Every harness whose trace hook this package writes, in report order. */
+const AGENT_TRACE_HOOK_AGENTS = [
+	"claude",
+	"codex",
+	"opencode",
+	"pi"
+];
+const PI_EXTENSION_MARKER = "Managed by Review Desktop trace setup";
+const OPENCODE_TRACE_PLUGIN_MARKER = PI_EXTENSION_MARKER;
+function claudeSettingsPath(homeDir) {
+	return path.join(homeDir, ".claude", "settings.json");
+}
+function codexConfigPath(homeDir) {
+	return path.join(homeDir, ".codex", "config.toml");
+}
+function piExtensionPath(homeDir) {
+	return path.join(homeDir, ".pi", "agent", "extensions", "review-trace.ts");
+}
+/** The configuration base OpenCode reads: `$XDG_CONFIG_HOME`, else `~/.config`. */
+function configHome(homeDir, env = process.env) {
+	return env.XDG_CONFIG_HOME?.trim() || path.join(homeDir, ".config");
+}
+function openCodeDirectory(homeDir, env = process.env) {
+	return path.join(configHome(homeDir, env), "opencode");
+}
+function openCodePluginPath(homeDir, env = process.env) {
+	return path.join(openCodeDirectory(homeDir, env), "plugins", "review-trace.ts");
+}
+function executableOwner(file) {
+	const base = path.basename(file);
+	return base === "review" || base === "whiteboard" ? "review" : null;
+}
+/** The executable of a single lifecycle command, or undefined for a shell compound. */
+function traceHookCommandFile(command) {
+	const text = jsonString(command);
+	if (text === void 0) return void 0;
+	const match = /^(.*) trace hook (SessionStart|UserPromptSubmit|SessionEnd)$/.exec(text);
+	if (!match) return void 0;
+	const prefix = match[1];
+	if (/^[a-zA-Z0-9_./-]+$/.test(prefix)) return prefix;
+	const decoded = prefix.slice(1, -1).replaceAll(`'"'"'`, "'");
+	return shellQuote(decoded) === prefix ? decoded : void 0;
+}
+/** Identifies a single executable lifecycle command; never accepts shell compounds. */
+function traceHookCommandOwner(command) {
+	const file = traceHookCommandFile(command);
+	return file === void 0 ? null : executableOwner(file);
+}
+function extensionCommandFile(source) {
+	if (!source.trimStart().startsWith(`// ${PI_EXTENSION_MARKER}`)) return void 0;
+	const match = /spawn\(("(?:[^"\\]|\\.)*"), \["trace", "hook"/.exec(source);
+	if (!match) return void 0;
+	return jsonString(parseJsonText(match[1]));
+}
+function extensionOwner(source) {
+	const file = extensionCommandFile(source);
+	return file === void 0 ? null : executableOwner(file);
+}
+function piExtensionSource(reviewCommand) {
+	return `// ${PI_EXTENSION_MARKER}
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { spawn } from "node:child_process";
+
+export default function (pi: ExtensionAPI) {
+  pi.on("session_start", async (_event, ctx) => {
+    const sessionId = ctx.sessionManager.getSessionId();
+    if (!sessionId) return;
+    runTraceHook("SessionStart", sessionId, ctx.cwd);
+  });
+
+  pi.on("turn_start", async (_event, ctx) => {
+    const sessionId = ctx.sessionManager.getSessionId();
+    if (!sessionId) return;
+    runTraceHook("TurnStart", sessionId, ctx.cwd);
+  });
+
+  pi.on("session_shutdown", async (_event, ctx) => {
+    const sessionId = ctx.sessionManager.getSessionId();
+    if (!sessionId) return;
+    runTraceHook("SessionEnd", sessionId, ctx.cwd);
+  });
+}
+
+function runTraceHook(eventName: string, sessionId: string, cwd: string) {
+  const payload = JSON.stringify({
+    hook_event_name: eventName,
+    session_id: sessionId,
+  });
+
+  const proc = spawn(${JSON.stringify(reviewCommand)}, ["trace", "hook", eventName], {
+    cwd,
+    stdio: ["pipe", "ignore", "ignore"],
+  });
+
+  // Missing binaries and closed pipes must never crash the harness.
+  proc.on("error", () => {});
+  proc.stdin.on("error", () => {});
+  proc.stdin.end(payload);
+}
+`;
+}
+function openCodeTracePluginSource(reviewCommand) {
+	return `// ${OPENCODE_TRACE_PLUGIN_MARKER}
+import { spawn } from "node:child_process";
+
+interface OpenCodeEvent {
+  type: string;
+  properties: Record<string, unknown>;
+}
+
+// OpenCode has no session-end event. A session goes idle after each turn,
+// so every turn is one SessionStart/UserPromptSubmit .. SessionEnd cycle:
+// the prompt registers the session for commit stamping and idle syncs the
+// trace. Child sessions spawned by the task tool stay attached to their
+// parent's turn and are never registered on their own.
+export default async function reviewTracePlugin(input: { directory: string }) {
+  const directories = new Map<string, string>();
+  const childSessions = new Set<string>();
+
+  return {
+    event: async ({ event }: { event: OpenCodeEvent }) => {
+      const properties = event.properties;
+      if (event.type === "session.created") {
+        const info = record(properties.info);
+        const sessionId = text(info.id);
+        if (!sessionId) return;
+        if (typeof info.parentID === "string") {
+          childSessions.add(sessionId);
+          return;
+        }
+        const directory = text(info.directory) ?? input.directory;
+        directories.set(sessionId, directory);
+        runTraceHook("SessionStart", sessionId, directory);
+        return;
+      }
+      if (event.type === "message.updated") {
+        const info = record(properties.info);
+        if (info.role !== "user") return;
+        const sessionId = text(info.sessionID);
+        if (!sessionId || childSessions.has(sessionId)) return;
+        runTraceHook(
+          "UserPromptSubmit",
+          sessionId,
+          directories.get(sessionId) ?? input.directory,
+        );
+        return;
+      }
+      if (event.type === "session.idle") {
+        const sessionId = text(properties.sessionID);
+        if (!sessionId || childSessions.has(sessionId)) return;
+        runTraceHook(
+          "SessionEnd",
+          sessionId,
+          directories.get(sessionId) ?? input.directory,
+        );
+      }
+    },
+  };
+}
+
+function record(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object"
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function text(value: unknown): string | undefined {
+  return typeof value === "string" && value ? value : undefined;
+}
+
+function runTraceHook(eventName: string, sessionId: string, cwd: string) {
+  const payload = JSON.stringify({
+    hook_event_name: eventName,
+    session_id: sessionId,
+  });
+
+  const proc = spawn(${JSON.stringify(reviewCommand)}, ["trace", "hook", eventName], {
+    cwd,
+    stdio: ["pipe", "ignore", "ignore"],
+  });
+
+  // Missing binaries and closed pipes must never crash the harness.
+  proc.on("error", () => {});
+  proc.stdin.on("error", () => {});
+  proc.stdin.end(payload);
+}
+`;
+}
+/**
+* Installs the session lifecycle hook of every harness this package owns.
+*
+* `harnessHooks: false` installs none, so one caller can keep the option its
+* command registers. The result names each file that was written, in the
+* order the installers ran.
+*/
+async function installHarnessHooks(input) {
+	const installed = [];
+	const skipped = [];
+	if (input.harnessHooks === false) return {
+		installed,
+		skipped
+	};
+	const env = input.env ?? process.env;
+	for (const agent of AGENT_TRACE_HOOK_AGENTS) {
+		const present = existsSync(agentTraceHomeDirectory(agent, input.homeDir, env));
+		if (input.allHarnesses !== true && !present) {
+			skipped.push(agent);
+			continue;
+		}
+		const result = await HARNESS_HOOK_INSTALLERS[agent](input.homeDir, input.executable, env);
+		installed.push(result);
+	}
+	return {
+		installed,
+		skipped
+	};
+}
+/** The installer of one harness hook, keyed by the harness. */
+const HARNESS_HOOK_INSTALLERS = {
+	claude: installClaudeTraceHook,
+	codex: installCodexTraceHook,
+	opencode: installOpenCodeTraceExtension,
+	pi: installPiTraceExtension
+};
+/** One line that names the harnesses an install left alone. */
+function skippedHarnessesLine(skipped) {
+	return `Skipped the ${skipped.join(", ")} hook${skipped.length === 1 ? "" : "s"}: this machine has no such harness. Use --all-harnesses to write them anyway.\n`;
+}
+/**
+* Idempotently configures Claude Code session lifecycle hooks in ~/.claude/settings.json.
+*/
+async function installClaudeTraceHook(homeDir = os.homedir(), reviewCommand = traceCliName()) {
+	const settingsDir = path.join(homeDir, ".claude");
+	const settingsPath = claudeSettingsPath(homeDir);
+	let parsed = {};
+	if (existsSync(settingsPath)) try {
+		const content = parseJsonText(await readFile(settingsPath, "utf8"));
+		if (isJsonObject(content)) parsed = content;
+	} catch {
+		parsed = {};
+	}
+	const hooks = isJsonObject(parsed.hooks) ? parsed.hooks : {};
+	let modified = false;
+	let keptCommand;
+	const hookCommand = (eventName) => ({
+		type: "command",
+		command: `${shellCommand(reviewCommand)} trace hook ${eventName}`
+	});
+	for (const eventName of [
+		"SessionStart",
+		"UserPromptSubmit",
+		"SessionEnd"
+	]) {
+		const existing = hooks[eventName];
+		const group = isJsonArray(existing) ? existing : [];
+		const wanted = hookCommand(eventName);
+		let found = false;
+		for (const entry of group) {
+			if (!isJsonObject(entry) || !isJsonArray(entry.hooks)) continue;
+			for (const hook of entry.hooks) {
+				if (!isJsonObject(hook)) continue;
+				const file = traceHookCommandFile(hook.command);
+				if (file === void 0 || executableOwner(file) === null) continue;
+				found = true;
+				if (keepTraceExecutable(file, reviewCommand)) {
+					keptCommand = file;
+					continue;
+				}
+				if (hook.command !== wanted.command) {
+					hook.command = wanted.command;
+					modified = true;
+				}
+			}
+		}
+		if (!found) {
+			group.push({ hooks: [wanted] });
+			modified = true;
+		}
+		hooks[eventName] = group;
+	}
+	if (modified || !existsSync(settingsPath)) {
+		parsed.hooks = hooks;
+		await mkdir(settingsDir, { recursive: true });
+		await writeFile(settingsPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
+	}
+	const result = {
+		agent: "claude",
+		path: settingsPath,
+		modified
+	};
+	if (keptCommand) result.keptCommand = keptCommand;
+	return result;
+}
+/**
+* Idempotently configures Codex session lifecycle hooks in ~/.codex/config.toml.
+*/
+async function installCodexTraceHook(homeDir = os.homedir(), reviewCommand = traceCliName()) {
+	const codexDir = path.join(homeDir, ".codex");
+	const configPath = codexConfigPath(homeDir);
+	let existing = "";
+	if (existsSync(configPath)) existing = await readFile(configPath, "utf8");
+	const hookEvents = [
+		"SessionStart",
+		"UserPromptSubmit",
+		"SessionEnd"
+	];
+	const found = /* @__PURE__ */ new Set();
+	let keptCommand;
+	let next = transformCodexHooks(existing, (block, command, event) => {
+		const file = traceHookCommandFile(command);
+		if (file === void 0 || executableOwner(file) === null) return block;
+		found.add(event);
+		if (keepTraceExecutable(file, reviewCommand)) {
+			keptCommand = file;
+			return block;
+		}
+		return block.replace(/^command = .*$/m, () => `command = ${JSON.stringify(`${shellCommand(reviewCommand)} trace hook ${event}`)}`);
+	});
+	const missing = hookEvents.filter((event) => !found.has(event));
+	if (missing.length > 0) next = existing ? `${next.trimEnd()}\n\n${missing.map((event) => codexTraceHookToml(event, reviewCommand)).join("\n\n")}\n` : codexHookBlock(reviewCommand).trimStart();
+	const result = {
+		agent: "codex",
+		path: configPath,
+		modified: next !== existing
+	};
+	if (keptCommand) result.keptCommand = keptCommand;
+	if (!result.modified) return result;
+	await mkdir(codexDir, { recursive: true });
+	await writeFile(configPath, next, "utf8");
+	return result;
+}
+/**
+* Idempotently writes the Pi session lifecycle extension into ~/.pi/agent/extensions/review-trace.ts.
+*/
+async function installPiTraceExtension(homeDir = os.homedir(), reviewCommand = traceCliName()) {
+	const extensionsDir = path.join(homeDir, ".pi", "agent", "extensions");
+	const extensionPath = piExtensionPath(homeDir);
+	let existing = "";
+	if (existsSync(extensionPath)) existing = await readFile(extensionPath, "utf8");
+	const existingCommand = extensionCommandFile(existing);
+	if (keepTraceExecutable(existingCommand, reviewCommand)) return {
+		agent: "pi",
+		path: extensionPath,
+		modified: false,
+		keptCommand: existingCommand
+	};
+	const source = piExtensionSource(reviewCommand);
+	if (existing.trim() === source.trim()) return {
+		agent: "pi",
+		path: extensionPath,
+		modified: false
+	};
+	await mkdir(extensionsDir, { recursive: true });
+	await writeFile(extensionPath, source, "utf8");
+	return {
+		agent: "pi",
+		path: extensionPath,
+		modified: true
+	};
+}
+/**
+* Idempotently writes the OpenCode trace plugin into ~/.config/opencode/plugins/review-trace.ts.
+*/
+async function installOpenCodeTraceExtension(homeDir = os.homedir(), reviewCommand = traceCliName(), env = process.env) {
+	const pluginPath = openCodePluginPath(homeDir, env);
+	const pluginsDir = path.dirname(pluginPath);
+	let existing = "";
+	if (existsSync(pluginPath)) existing = await readFile(pluginPath, "utf8");
+	const existingCommand = extensionCommandFile(existing);
+	if (keepTraceExecutable(existingCommand, reviewCommand)) return {
+		agent: "opencode",
+		path: pluginPath,
+		modified: false,
+		keptCommand: existingCommand
+	};
+	const source = openCodeTracePluginSource(reviewCommand);
+	if (existing.trim() === source.trim()) return {
+		agent: "opencode",
+		path: pluginPath,
+		modified: false
+	};
+	await mkdir(pluginsDir, { recursive: true });
+	await writeFile(pluginPath, source, "utf8");
+	return {
+		agent: "opencode",
+		path: pluginPath,
+		modified: true
+	};
+}
+/** Removes Review hooks; a scoped removal preserves another live executable. */
+async function removeAgentTraceHook(agent, homeDir = os.homedir(), env = process.env, expectedCommand) {
+	const removable = (file) => expectedCommand === void 0 || !keepTraceExecutable(file, expectedCommand);
+	if (agent === "claude") {
+		const settingsPath = claudeSettingsPath(homeDir);
+		if (!existsSync(settingsPath)) return false;
+		let parsed;
+		try {
+			parsed = parseJsonText(await readFile(settingsPath, "utf8"));
+		} catch {
+			return false;
+		}
+		if (!isJsonObject(parsed)) return false;
+		const hooks = parsed.hooks;
+		if (!isJsonObject(hooks)) return false;
+		let changed = false;
+		for (const eventName of [
+			"SessionStart",
+			"UserPromptSubmit",
+			"SessionEnd"
+		]) {
+			const existing = hooks[eventName];
+			const keptGroups = (isJsonArray(existing) ? existing : []).flatMap((group) => {
+				if (!isJsonObject(group)) return [group];
+				if (!isJsonArray(group.hooks)) return [group];
+				const keptHooks = group.hooks.filter((hook) => {
+					const command = isJsonObject(hook) ? hook.command : void 0;
+					const owned = traceHookCommandOwner(command) === "review" && removable(traceHookCommandFile(command));
+					if (owned) changed = true;
+					return !owned;
+				});
+				return keptHooks.length > 0 ? [{
+					...group,
+					hooks: keptHooks
+				}] : [];
+			});
+			if (keptGroups.length > 0) hooks[eventName] = keptGroups;
+			else delete hooks[eventName];
+		}
+		if (!changed) return false;
+		parsed.hooks = hooks;
+		await writeFile(settingsPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
+		return true;
+	}
+	if (agent === "codex") {
+		const configPath = codexConfigPath(homeDir);
+		if (!existsSync(configPath)) return false;
+		const existing = await readFile(configPath, "utf8");
+		const removed = transformCodexHooks(existing, (block, command) => traceHookCommandOwner(command) === "review" && removable(traceHookCommandFile(command)) ? "" : block).replace(/# review-trace-hooks:start\n\s*# review-trace-hooks:end\n?/, "");
+		if (removed === existing) return false;
+		const next = removed.replace(/\n{3,}/g, "\n\n");
+		await writeFile(configPath, next.trim() ? `${next.trimEnd()}\n` : "", "utf8");
+		return true;
+	}
+	const extensionPath = agent === "pi" ? piExtensionPath(homeDir) : openCodePluginPath(homeDir, env);
+	if (!existsSync(extensionPath)) return false;
+	const existing = await readFile(extensionPath, "utf8");
+	if (extensionOwner(existing) !== "review" || !removable(extensionCommandFile(existing))) return false;
+	await rm(extensionPath, { force: true });
+	return true;
+}
+function shellCommand(command) {
+	return command === traceCliName() ? command : shellQuote(command);
+}
+function codexTraceHookToml(eventName, reviewCommand) {
+	const status = eventName === "SessionStart" ? "\nstatusMessage = \"Recording agent session id for trace stamping\"" : "";
+	return `[[hooks.${eventName}]]
+[[hooks.${eventName}.hooks]]
+type = "command"
+command = ${JSON.stringify(`${shellCommand(reviewCommand)} trace hook ${eventName}`)}${status}`;
+}
+/** The whole marked block, written when the Codex config is empty. */
+function codexHookBlock(reviewCommand) {
+	return `\n# review-trace-hooks:start\n${[
+		"SessionStart",
+		"UserPromptSubmit",
+		"SessionEnd"
+	].map((eventName) => codexTraceHookToml(eventName, reviewCommand)).join("\n\n")}\n# review-trace-hooks:end\n`;
+}
+function transformCodexHooks(content, transform) {
+	return content.replace(/^\[\[hooks\.(SessionStart|UserPromptSubmit|SessionEnd)\]\]\n\[\[hooks\.\1\.hooks\]\]\ntype = "command"\ncommand = ("(?:[^"\\\n]|\\.)*")(?:\n|$)(?:statusMessage = "[^"\n]*"(?:\n|$))?/gm, (block, event, encoded, offset) => {
+		let reachedOtherTable = false;
+		for (const line of content.slice(offset + block.length).split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed || trimmed.startsWith("#")) continue;
+			if (!trimmed.startsWith("[")) {
+				if (!reachedOtherTable) return block;
+				continue;
+			}
+			const header = /^\[{1,2}([A-Za-z0-9_.-]+)\]{1,2}(?:\s*#.*)?$/.exec(trimmed);
+			if (!header) return block;
+			if (trimmed === `[[hooks.${event}]]`) break;
+			if (header[1] === `hooks.${event}` || header[1].startsWith(`hooks.${event}.`)) return block;
+			reachedOtherTable = true;
+		}
+		try {
+			const command = jsonString(parseJsonText(encoded));
+			if (!command?.endsWith(` trace hook ${event}`)) return block;
+			return transform(block, command, event);
+		} catch {
+			return block;
+		}
+	});
+}
+async function readTextOrEmpty(filePath) {
+	return existsSync(filePath) ? readFile(filePath, "utf8") : "";
+}
+/**
+* The directory one harness keeps its own configuration in. A machine without
+* that directory does not run the harness, so an install writes it no hook.
+*/
+function agentTraceHomeDirectory(agent, homeDir = os.homedir(), env = process.env) {
+	if (agent === "claude") return path.join(homeDir, ".claude");
+	if (agent === "codex") return path.join(homeDir, ".codex");
+	if (agent === "opencode") return openCodeDirectory(homeDir, env);
+	if (agent === "pi") return path.join(homeDir, ".pi");
+	throw new Error(`Unknown trace hook agent: ${String(agent)}`);
+}
+/** Reports recognized SessionStart owners and extension owners without changing files. */
+async function describeTraceHookOwners(homeDir = os.homedir(), env = process.env) {
+	let claude = null;
+	try {
+		const parsed = parseJsonText(await readTextOrEmpty(claudeSettingsPath(homeDir)));
+		const hooks = isJsonObject(parsed) ? parsed.hooks : void 0;
+		const groups = isJsonObject(hooks) ? hooks.SessionStart : void 0;
+		for (const group of isJsonArray(groups) ? groups : []) {
+			if (!isJsonObject(group) || !isJsonArray(group.hooks)) continue;
+			for (const hook of group.hooks) {
+				const owner = isJsonObject(hook) ? traceHookCommandOwner(hook.command) : null;
+				if (owner) claude = owner;
+			}
+		}
+	} catch {
+		claude = null;
+	}
+	let codex = null;
+	transformCodexHooks(await readTextOrEmpty(codexConfigPath(homeDir)), (block, command, event) => {
+		if (event === "SessionStart") codex = traceHookCommandOwner(command) ?? codex;
+		return block;
+	});
+	return {
+		claude,
+		codex,
+		opencode: extensionOwner(await readTextOrEmpty(openCodePluginPath(homeDir, env))),
+		pi: extensionOwner(await readTextOrEmpty(piExtensionPath(homeDir)))
+	};
+}
+async function readActiveTraceSessions(filePath, now = Date.now()) {
+	const [content, fileStat] = await Promise.all([readFile(filePath, "utf8").catch(() => ""), stat(filePath).catch(() => null)]);
+	const legacyTimestamp = Math.floor(fileStat?.mtimeMs ?? now);
+	const sessions = /* @__PURE__ */ new Map();
+	for (const rawLine of content.split("\n")) {
+		const line = rawLine.trim();
+		if (!line) continue;
+		const fields = line.split("	");
+		const parsedSessionId = sessionIdSchema.safeParse(fields[0]);
+		if (!parsedSessionId.success) continue;
+		const sessionId = parsedSessionId.data;
+		let lastActiveAt = legacyTimestamp;
+		if (fields.length > 1) {
+			if (fields.length !== 2 || !/^\d+$/.test(fields[1] ?? "")) continue;
+			lastActiveAt = Number(fields[1]);
+			if (!Number.isSafeInteger(lastActiveAt) || lastActiveAt <= 0) continue;
+		}
+		if (now - lastActiveAt <= 72e5) sessions.set(sessionId, lastActiveAt);
+	}
+	return sessions;
+}
+async function writeTraceSessions(filePath, sessions) {
+	if (sessions.size === 0) {
+		await rm(filePath, { force: true });
+		return;
+	}
+	const content = [...sessions].map(([sessionId, lastActiveAt]) => `${sessionId}\t${lastActiveAt}`).join("\n");
+	await writeFile(filePath, `${content}\n`, "utf8");
+}
+//#endregion
+//#region ../trace-core/src/trace-capture-scope.ts
+const HOSTED_CAPTURE_SCOPE_DESCRIPTION = "Hosted capture is limited to repositories allowed at this origin. Enable another repository only when the user explicitly requests publication.\n";
+//#endregion
+//#region ../trace-core/src/trace-repository-hooks.ts
+const repositoryHookStateSchema = z.object({
+	version: z.literal(1),
+	root: z.string(),
+	managedHooksPath: z.string(),
+	previousHooksPath: z.string(),
+	previousHookDirectory: z.string(),
+	previousWasConfigured: z.boolean(),
+	command: z.string().optional()
+});
+async function enableTraceRepository(input) {
+	const resolved = await resolveRepository(input.cwd);
+	if (!resolved) return {
+		repository: false,
+		enabled: false,
+		message: "Not inside a Git repository."
+	};
+	const statePath = path.join(resolved.commonDir, "dev-fast", "trace-hooks", "state.json");
+	const hooksPath = path.join(resolved.commonDir, "dev-fast", "trace-hooks", "hooks");
+	const current = await configuredHooksPath(resolved.root);
+	const oldState = await readState(statePath);
+	const alreadyManaged = path.resolve(resolved.root, current.value || ".") === path.resolve(hooksPath);
+	const previousWasConfigured = alreadyManaged ? oldState?.previousWasConfigured ?? false : current.configured;
+	const previousHooksPath = alreadyManaged ? oldState?.previousHooksPath ?? path.join(resolved.commonDir, "hooks") : current.configured ? current.value : path.join(resolved.commonDir, "hooks");
+	const previousHookDirectory = alreadyManaged ? oldState?.previousHookDirectory ?? resolveHooksPath(resolved.root, previousHooksPath) : previousHooksPath;
+	const homeDir = input.scope.homeDir;
+	let reviewCommand = renderTraceCommand(resolveTraceCommand({
+		explicit: input.reviewCommand,
+		env: input.scope.env,
+		homeDir
+	}));
+	if (alreadyManaged && !input.replaceCommand && oldState?.command && keepTraceExecutable(traceCommandExecutable(oldState.command), traceCommandExecutable(reviewCommand) ?? "")) reviewCommand = oldState.command;
+	const state = {
+		version: 1,
+		root: resolved.root,
+		managedHooksPath: hooksPath,
+		previousHooksPath,
+		previousHookDirectory,
+		previousWasConfigured,
+		command: reviewCommand
+	};
+	await mkdir(hooksPath, { recursive: true });
+	await writeHook(path.join(hooksPath, "prepare-commit-msg"), prepareCommitMessageHook(previousHookDirectory, reviewCommand));
+	await writeHook(path.join(hooksPath, "pre-push"), prePushHook(previousHookDirectory, reviewCommand));
+	await writePrivateJson(statePath, state);
+	await gitAt(resolved.root, [
+		"config",
+		"--local",
+		"core.hooksPath",
+		hooksPath
+	]);
+	await registerRepository(homeDir, resolved.root);
+	return {
+		repository: true,
+		enabled: true,
+		root: resolved.root,
+		managedHooksPath: hooksPath,
+		previousHooksPath,
+		command: reviewCommand,
+		message: "Review trace hooks are enabled for this repository."
+	};
+}
+async function repairTraceRepository(input) {
+	return enableTraceRepository(input);
+}
+async function disableTraceRepository(input) {
+	const resolved = await resolveRepository(input.cwd);
+	if (!resolved) return {
+		repository: false,
+		enabled: false,
+		message: "Not inside a Git repository."
+	};
+	const stateDir = path.join(resolved.commonDir, "dev-fast", "trace-hooks");
+	const state = await readState(path.join(stateDir, "state.json"));
+	if (!state) return {
+		repository: true,
+		enabled: false,
+		root: resolved.root,
+		message: "Review trace hooks are not enabled for this repository."
+	};
+	const current = await configuredHooksPath(resolved.root);
+	if (path.resolve(resolved.root, current.value || ".") === path.resolve(state.managedHooksPath)) {
+		if (state.previousWasConfigured) await gitAt(resolved.root, [
+			"config",
+			"--local",
+			"core.hooksPath",
+			state.previousHooksPath
+		]);
+		else await gitAt(resolved.root, [
+			"config",
+			"--local",
+			"--unset",
+			"core.hooksPath"
+		], { allowFailure: true });
+	}
+	await rm(stateDir, {
+		recursive: true,
+		force: true
+	});
+	await unregisterRepository(input.scope.homeDir, resolved.root);
+	return {
+		repository: true,
+		enabled: false,
+		root: resolved.root,
+		message: "Review trace hooks are disabled for this repository."
+	};
+}
+async function traceRepositoryStatus(cwd) {
+	const resolved = await resolveRepository(cwd);
+	if (!resolved) return {
+		repository: false,
+		enabled: false,
+		message: "Not inside a Git repository."
+	};
+	const state = await readState(path.join(resolved.commonDir, "dev-fast", "trace-hooks", "state.json"));
+	const current = await configuredHooksPath(resolved.root);
+	const enabled = Boolean(state && path.resolve(resolved.root, current.value || ".") === path.resolve(state.managedHooksPath));
+	const status = {
+		repository: true,
+		enabled,
+		root: resolved.root,
+		message: enabled ? "Review trace hooks are enabled for this repository." : "Review trace hooks are not enabled for this repository."
+	};
+	if (state) {
+		status.managedHooksPath = state.managedHooksPath;
+		status.previousHooksPath = state.previousHooksPath;
+		if (state.command !== void 0) status.command = state.command;
+	}
+	return status;
+}
+/** Disables registered hooks, preserving other live executables when scoped. */
+async function disableAllTraceRepositories(scope, expectedCommand) {
+	const registry = await readRegistry(scope.homeDir);
+	const disabled = [];
+	const kept = [];
+	for (const root of registry) {
+		if (expectedCommand !== void 0) {
+			if (keepTraceExecutable(traceCommandExecutable((await traceRepositoryStatus(root).catch(() => null))?.command), expectedCommand)) {
+				kept.push(root);
+				continue;
+			}
+		}
+		if ((await disableTraceRepository({
+			cwd: root,
+			scope
+		}).catch(() => null))?.repository) disabled.push(root);
+	}
+	return {
+		disabled,
+		kept
+	};
+}
+async function resolveRepository(cwd) {
+	const rootResult = await gitAt(cwd, ["rev-parse", "--show-toplevel"], { allowFailure: true });
+	const commonResult = await gitAt(cwd, [
+		"rev-parse",
+		"--path-format=absolute",
+		"--git-common-dir"
+	], { allowFailure: true });
+	if (!rootResult.ok || !commonResult.ok) return null;
+	return {
+		root: rootResult.stdout.trim(),
+		commonDir: commonResult.stdout.trim()
+	};
+}
+async function configuredHooksPath(root) {
+	const result = await gitAt(root, [
+		"config",
+		"--local",
+		"--get",
+		"core.hooksPath"
+	], { allowFailure: true });
+	return {
+		configured: result.ok && Boolean(result.stdout.trim()),
+		value: result.stdout.trim()
+	};
+}
+function resolveHooksPath(root, hooksPath) {
+	return path.isAbsolute(hooksPath) ? hooksPath : path.resolve(root, hooksPath);
+}
+function previousHookSetup(pathValue, name) {
+	if (path.isAbsolute(pathValue)) return `previous=${shellQuote(path.join(pathValue, name))}`;
+	return ["root=\"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\"", `previous="$root"/${shellQuote(path.join(pathValue, name))}`].join("\n");
+}
+function prepareCommitMessageHook(previousPath, reviewCommand) {
+	return `#!/bin/sh\n${previousHookSetup(previousPath, "prepare-commit-msg")}\nif [ -x "$previous" ]; then\n  "$previous" "$@" || exit $?\nfi\n${reviewCommand} trace git-hook prepare-commit-msg "$@" || true\nexit 0\n`;
+}
+function prePushHook(previousPath, reviewCommand) {
+	return `#!/bin/sh\n${previousHookSetup(previousPath, "pre-push")}\ntmp="$(mktemp "\${TMPDIR:-/tmp}/review-pre-push.XXXXXX")" || exit 0\ntrap 'rm -f "$tmp"' EXIT HUP INT TERM\ncat > "$tmp"\nif [ -x "$previous" ]; then\n  "$previous" "$@" < "$tmp" || exit $?\nfi\n${reviewCommand} trace git-hook pre-push "$@" < "$tmp" || true\nexit 0\n`;
+}
+async function writeHook(filePath, contents) {
+	await writeFile(filePath, contents, { mode: 493 });
+	await chmod(filePath, 493);
+}
+async function readState(filePath) {
+	try {
+		const parsed = repositoryHookStateSchema.safeParse(parseJsonText(await readFile(filePath, "utf8")));
+		return parsed.success ? parsed.data : null;
+	} catch {
+		return null;
+	}
+}
+async function writePrivateJson(filePath, value) {
+	await writeFileAtomicAsync(filePath, `${JSON.stringify(value, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+}
+function registryPath(homeDir) {
+	return path.join(homeDir, ".config", "dev-trace", "repositories.json");
+}
+/** Returns the registered repository roots; never scans repositories or changes hooks. */
+function listTraceRepositoryRoots(homeDir) {
+	return readRegistry(homeDir ?? traceHomeDir());
+}
+async function readRegistry(homeDir) {
+	try {
+		const value = parseJsonText(await readFile(registryPath(homeDir), "utf8"));
+		return (jsonArray(value) ?? []).map(jsonString).filter((item) => item !== void 0);
+	} catch {
+		return [];
+	}
+}
+async function registerRepository(homeDir, root) {
+	const current = await readRegistry(homeDir);
+	await writePrivateJson(registryPath(homeDir), [.../* @__PURE__ */ new Set([...current, root])]);
+}
+async function unregisterRepository(homeDir, root) {
+	await writePrivateJson(registryPath(homeDir), (await readRegistry(homeDir)).filter((entry) => entry !== root));
+}
+//#endregion
+//#region ../trace-core/src/trace-upload-status.ts
+/** A live, writer-authorized check of recorded uploads. */
+async function writeOwnUploadStatus(input) {
+	const query = listUploadsQuerySchema.safeParse({
+		session: input.session,
+		cursor: input.cursor,
+		limit: input.limit ?? 10
+	});
+	if (!query.success) {
+		input.stdout.write("Upload status: invalid session, cursor, or limit.\n");
+		return 1;
+	}
+	if (!input.client) {
+		input.stdout.write("Upload status: not checked. Log in to the selected store.\n");
+		return 1;
+	}
+	const client = input.client;
+	try {
+		const store = await client.findStore({
+			owner: input.repo.owner,
+			name: input.repo.repo
+		});
+		if (!store) throw new StoreApiError("not_found", 404, "This repository has no hosted trace store.");
+		if (store.status !== "active") throw new StoreApiError("store_deleted", 410, "This trace store was deleted.");
+		if (store.bytesStored !== void 0) input.stdout.write(`Stored bytes: ${store.bytesStored}\n`);
+		const page = await client.listOwnUploads(store.repositoryId, query.data);
+		if (page.storeId !== store.storeId) throw new StoreApiError("store_deleted", 410, "The trace store changed. Check status again.");
+		input.stdout.write("Your uploads (checked with the store):\n");
+		if (page.uploads.length === 0) input.stdout.write("No upload found for this account.\n");
+		for (const upload of page.uploads) {
+			const label = upload.status === "pending" ? "Not completed" : upload.current ? "Uploaded" : "Uploaded, later replaced";
+			input.stdout.write(`${upload.sessionId}: ${label} at ${upload.completedAt ?? upload.createdAt} (upload ${upload.uploadId}).\n`);
+		}
+		if (page.nextCursor) input.stdout.write(`More uploads: run \`whiteboard trace status${input.session ? ` --agent-session ${input.session}` : ""} --limit ${query.data.limit} --cursor ${page.nextCursor}\`.\n`);
+		return 0;
+	} catch (error) {
+		const cause = error instanceof Error ? error : new Error(String(error));
+		input.stdout.write(`Upload status: not checked. ${cause.message}\n`);
+		return 1;
+	}
+}
+//#endregion
+//#region ../trace-core/src/trace-hosted-cli.ts
+/** A store failure as one sentence the user can act on. */
+function describeStoreFailure(error, origin, repository) {
+	if (!(error instanceof StoreApiError)) return `Could not reach the trace store at ${origin}: ${error.message}`;
+	switch (error.code) {
+		case "unauthorized": return `The trace store at ${origin} rejected the login. Run \`whiteboard login --origin ${origin}\`.`;
+		case "forbidden": return `You cannot read the traces of ${repository}: ${error.message}`;
+		case "store_deleted": return `The trace store of ${repository} was deleted. Run \`whiteboard trace store create\` to create a new one.`;
+		case "not_found": return `${repository} has no trace store. Run \`whiteboard trace store create\` first.`;
+		default: return `The trace store at ${origin} answered ${error.code}: ${error.message}`;
+	}
+}
+/** A failure a hosted command reports on both channels, then exits 1. */
+var HostedCommandFailure = class extends Error {};
+/** Shares repository inference without changing each command's login policy. */
+async function withHostedRepository(input, stage, fn) {
+	const fail = (message) => failWithJsonError(input, stage, message);
+	let name;
+	try {
+		name = await inferRepoFromGit(input.cwd);
+	} catch (error) {
+		return fail(errorMessage(error));
+	}
+	let origin = input.origin ?? "https://app.dev.fast";
+	let client = input.client;
+	if (stage === "store.create") try {
+		client ??= await requireStoreClient(input.scope.env);
+	} catch (error) {
+		return fail(errorMessage(error));
+	}
+	else if (stage === "allow" || !client) {
+		const auth = await readStoreAuth(input.scope.env);
+		if (!auth) return fail(stage === "allow" ? `Run \`whiteboard login\` first.` : `The trace store login is missing. Run \`whiteboard login --origin ${origin}\`.`);
+		origin = input.origin ?? auth.origin;
+		if (auth.origin !== origin) return fail(`You are logged in to ${auth.origin}, not the selected store ${origin}. Run \`whiteboard login --origin ${origin}\`.`);
+		client ??= new StoreClient({
+			origin,
+			token: auth.token
+		});
+	}
+	try {
+		return await fn({
+			name,
+			repository: traceRepoName(name),
+			origin,
+			client,
+			stage
+		});
+	} catch (error) {
+		if (error instanceof HostedCommandFailure) return fail(error.message);
+		throw error;
+	}
+}
+/** Requires an active store, preserving the command's store-error wording. */
+async function requireActiveStore(ctx) {
+	let store;
+	try {
+		store = await ctx.client.findStore({
+			owner: ctx.name.owner,
+			name: ctx.name.repo
+		});
+	} catch (error) {
+		const failure = error instanceof Error ? error : new Error(String(error));
+		throw new HostedCommandFailure(ctx.stage === "sessions" ? describeStoreFailure(failure, ctx.origin, ctx.repository) : failure.message);
+	}
+	if (!store) throw new HostedCommandFailure(`${ctx.repository} has no trace store. Run \`whiteboard trace store create\` first.`);
+	if (store.status !== "active") throw new HostedCommandFailure(`The trace store of ${store.displayName} was deleted. Run \`whiteboard trace store create\` to create a new one.`);
+	return store;
+}
+/**
+* Hosted consent commands: onboarding creates a repository store, allow
+* records publication consent bound to the login's origin, deny withdraws
+* it. None of them selects hosted storage; the trace storage use
+* hosted` does that explicitly.
+*/
+async function runTraceOnboard(input) {
+	return withHostedRepository(input, "store.create", async (ctx) => {
+		let store;
+		try {
+			store = await ctx.client.createStore({
+				owner: ctx.name.owner,
+				name: ctx.name.repo
+			});
+		} catch (error) {
+			if (error instanceof StoreApiError && error.code === "forbidden") throw new HostedCommandFailure(`You need push access to ${ctx.repository} to create its trace store.`);
+			throw new HostedCommandFailure(errorMessage(error));
+		}
+		emitJsonEvent(input, {
+			event: "trace.store.create",
+			repositoryId: store.repositoryId,
+			displayName: store.displayName,
+			created: store.created === true
+		});
+		const stream = humanStream(input);
+		stream.write(`Created the trace store of ${store.displayName} (id ${store.repositoryId}).\n`);
+		stream.write(`Run \`whiteboard trace allow .\` to send traces from this repository.\n`);
+		return 0;
+	});
+}
+/** Reports the hosted store of one repository, or exits 1 without one. */
+async function runTraceStoreInfo(input) {
+	return withHostedRepository(input, "store.info", async (ctx) => {
+		let store;
+		try {
+			store = await ctx.client.findStore({
+				owner: ctx.name.owner,
+				name: ctx.name.repo
+			});
+		} catch (error) {
+			throw new HostedCommandFailure(describeStoreFailure(error instanceof Error ? error : new Error(String(error)), ctx.origin, ctx.repository));
+		}
+		if (!store) throw new HostedCommandFailure(`${ctx.repository} has no trace store. Run \`whiteboard trace store create\` first.`);
+		emitJsonEvent(input, {
+			event: "trace.store",
+			repository: store.displayName,
+			repositoryId: store.repositoryId,
+			storeId: store.storeId,
+			status: store.status,
+			bytesStored: store.bytesStored ?? null
+		});
+		const stream = humanStream(input);
+		stream.write(`Repository: ${store.displayName} (id ${store.repositoryId})\n`);
+		stream.write(`Store: ${store.storeId} (${store.status})\n`);
+		if (store.bytesStored !== void 0) stream.write(`Stored bytes: ${store.bytesStored}\n`);
+		return 0;
+	});
+}
+/**
+* Deletes the hosted store of one repository. The deletion is logical: the
+* store stops every read and write at once, and an operator removes the
+* objects later. The consent of this machine stays; `deny` removes that.
+*/
+async function runTraceStoreDelete(input) {
+	return withHostedRepository(input, "store.delete", async (ctx) => {
+		const store = await requireActiveStore(ctx);
+		let deletion;
+		try {
+			deletion = await ctx.client.deleteStore(store.repositoryId);
+		} catch (error) {
+			if (error instanceof StoreApiError && error.code === "forbidden") throw new HostedCommandFailure(`Deleting the store of ${ctx.repository} needs admin access to the repository.`);
+			throw new HostedCommandFailure(errorMessage(error));
+		}
+		emitJsonEvent(input, {
+			event: "trace.store.delete",
+			repository: store.displayName,
+			repositoryId: deletion.repositoryId,
+			storeId: deletion.storeId,
+			status: deletion.status
+		});
+		humanStream(input).write(`Store deletion requested for ${store.displayName} (store ${deletion.storeId}). Uploaded objects are removed by a later operator cleanup.\n`);
+		return 0;
+	});
+}
+async function runTraceAllow(input) {
+	return withHostedRepository(input, "allow", async (ctx) => {
+		const selection = selectTraceStorage(input.scope);
+		if (selection.error) return failWithJsonError(input, "allow", selection.error);
+		if (selection.mode === "s3") return failWithJsonError(input, "allow", `This machine sends traces to a bucket. Run \`whiteboard trace storage use hosted\` first.`);
+		const storeOrigin = ctx.origin;
+		const store = await requireActiveStore(ctx);
+		const { skipped } = await installHarnessHooks({
+			homeDir: input.scope.homeDir,
+			env: input.scope.env,
+			executable: input.traceCommand?.file,
+			harnessHooks: input.harnessHooks,
+			allHarnesses: input.allHarnesses
+		});
+		if (skipped.length > 0) humanStream(input).write(skippedHarnessesLine(skipped));
+		await enableTraceRepository({
+			cwd: input.cwd,
+			scope: input.scope,
+			reviewCommand: input.traceCommand
+		});
+		await enableHostedCapture(input.scope.devHome, storeOrigin);
+		await allowTraceRepository({
+			repositoryId: store.repositoryId,
+			name: store.displayName,
+			origin: storeOrigin
+		}, input.scope.devHome);
+		emitJsonEvent(input, {
+			event: "trace.allow",
+			repositoryId: store.repositoryId,
+			name: store.displayName,
+			store: storeOrigin
+		});
+		const verifyCommand = input.verifyCommand ?? `whiteboard trace status`;
+		humanStream(input).write(`Traces from ${store.displayName} may be published to ${storeOrigin}. Run \`${verifyCommand}\` to verify.\n`);
+		return 0;
+	});
+}
+/**
+* Switches hosted capture on. An uninstall leaves `capture.enabled: false`
+* behind; a later allow means the user wants capture back. A file with no
+* hosted entry gets one that names the login's origin.
+*/
+async function enableHostedCapture(devHome, origin) {
+	const file = readTraceConfigFile({ devHome });
+	const current = file.config ?? emptyTraceConfig();
+	const hosted = current.stores?.hosted;
+	if (hosted?.capture?.enabled === true) return;
+	await writeTraceConfigFile(file, {
+		...current,
+		stores: {
+			...current.stores,
+			hosted: hosted ? {
+				...hosted,
+				capture: { enabled: true }
+			} : {
+				origin,
+				capture: { enabled: true }
+			}
+		}
+	});
+}
+async function runTraceDeny(input) {
+	let name;
+	try {
+		name = traceRepoName(await inferRepoFromGit(input.cwd));
+	} catch (error) {
+		return failWithJsonError(input, "deny", errorMessage(error));
+	}
+	const devHome = input.scope.devHome;
+	const cached = await readCachedTraceRepositoryTarget({
+		cwd: input.cwd,
+		origin: hostedOrigin(readTraceConfigFile({ devHome }).config),
+		devHome
+	}).catch(() => null);
+	const removed = await denyTraceRepository({
+		name,
+		repositoryId: cached?.repositoryId ?? null
+	}, devHome);
+	emitJsonEvent(input, {
+		event: "trace.deny",
+		name,
+		removed
+	});
+	humanStream(input).write(removed ? `${name} will no longer publish traces.\n` : `${name} was not allowed to publish traces.\n`);
+	return 0;
+}
+function listedSession(session) {
+	let bytes = 0;
+	for (const object of session.objects) bytes += object.size;
+	return {
+		id: session.sessionId,
+		harness: session.harness,
+		updatedAt: session.updatedAt,
+		branch: session.branch ?? null,
+		author: session.author ?? null,
+		generation: session.generation,
+		commits: session.commits,
+		traces: session.objects.map((object) => traceNameFromObject(object.name)),
+		bytes
+	};
+}
+/**
+* Lists every published session of this checkout's hosted store, one page
+* at a time. The command reads the store live: a missing login, a store
+* that does not answer, or a refusal is a failure, never a saved copy.
+* Reading needs no local publication consent; the store checks GitHub
+* access itself.
+*/
+async function runTraceSessions(input) {
+	const fail = (message) => failWithJsonError(input, "sessions", message);
+	if (input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 200)) return fail(`--limit must be a whole number from 1 to 200.`);
+	if (input.cursor !== void 0 && !sessionIdSchema.safeParse(input.cursor).success) return fail("--cursor must be a session id from a previous page.");
+	const selection = selectTraceStorage(input.scope);
+	const mode = input.storage ?? selection.mode;
+	if (mode === "s3") return fail(`\`whiteboard trace sessions\` lists the hosted store only. Run \`whiteboard trace storage use hosted\`, or pass \`--storage hosted\`.`);
+	if (selection.error && (mode !== "hosted" || !selection.hosted)) return fail(selection.error);
+	if (!selection.hosted) return fail(`Hosted trace storage is not configured. Run \`whiteboard trace allow .\` or \`whiteboard trace storage use hosted\`.`);
+	return withHostedRepository({
+		...input,
+		origin: selection.hosted.origin
+	}, "sessions", async (ctx) => {
+		const store = await requireActiveStore(ctx);
+		const origin = ctx.origin;
+		const query = input.cursor === void 0 ? { limit: input.limit ?? 50 } : {
+			limit: input.limit ?? 50,
+			cursor: input.cursor
+		};
+		let page;
+		try {
+			page = await ctx.client.listSessions(store.repositoryId, query);
+		} catch (error) {
+			if (error instanceof StoreApiError && error.code === "invalid_request") throw new HostedCommandFailure(`The trace store at ${origin} does not support listing every session yet. Update the store, or use \`whiteboard trace list --commit <sha>\`.`);
+			throw new HostedCommandFailure(describeStoreFailure(error instanceof Error ? error : new Error(String(error)), origin, store.displayName));
+		}
+		const sessions = page.sessions.map(listedSession);
+		emitJsonEvent(input, {
+			event: "trace.sessions",
+			repository: store.displayName,
+			repositoryId: store.repositoryId,
+			store: origin,
+			sessions,
+			nextCursor: page.nextCursor ?? null
+		});
+		const stream = humanStream(input);
+		if (sessions.length === 0) {
+			stream.write(`No published sessions in the trace store of ${store.displayName} at ${origin}.\n`);
+			return 0;
+		}
+		for (const session of sessions) stream.write(`${session.id}  ${session.harness}  ${session.updatedAt}  ${session.branch ?? "-"}  ${session.bytes} bytes\n`);
+		const nextPageFlags = (input.limit === void 0 ? "" : ` --limit ${input.limit}`) + (input.storage === void 0 ? "" : ` --storage ${input.storage}`);
+		stream.write(page.nextCursor ? `Sessions are ordered by id. More follow: run \`whiteboard trace sessions${nextPageFlags} --cursor ${page.nextCursor}\`.\n` : "Sessions are ordered by id. This is the last page.\n");
+		return 0;
+	});
+}
+/** The hosted trace status lines: login, consent, and pending work. */
+async function writeHostedTraceStatus(input) {
+	const stream = input.stdout;
+	stream.write(HOSTED_CAPTURE_SCOPE_DESCRIPTION);
+	const devHome = input.scope.devHome;
+	const auth = await readStoreAuth(input.scope.env);
+	const config = await readTraceUserConfig(devHome);
+	stream.write(auth ? `Login: ${auth.login} at ${auth.origin}${auth.origin === input.origin ? "" : ` (selected store is ${input.origin}; run \`whiteboard login --origin ${input.origin}\`)`}\n` : `Login: none. Run \`whiteboard login --origin ${input.origin}\`.\n`);
+	stream.write(`Capture switch: ${hostedCaptureEnabled(readTraceConfigFile({ devHome }).config) ? "on" : "off"}\n`);
+	const owners = await describeTraceHookOwners(input.scope.homeDir, input.scope.env);
+	stream.write(`Harness hooks: claude -> ${owners.claude ?? "none"}, codex -> ${owners.codex ?? "none"}, opencode -> ${owners.opencode ?? "none"}, pi -> ${owners.pi ?? "none"}\n`);
+	const repositoryHooks = await traceRepositoryStatus(input.cwd);
+	stream.write(`Git hooks: ${repositoryHooks.enabled ? repositoryHooks.command ?? "enabled" : "not enabled"}\n`);
+	if (config.repositories.length === 0) stream.write(`Allowed repositories: none. Run \`whiteboard trace allow .\`.\n`);
+	else for (const repository of config.repositories) stream.write(`Allowed repository: ${repository.name} (id ${repository.repositoryId}) -> ${repository.enabledOrigins.join(", ")}\n`);
+	let repo = null;
+	try {
+		repo = await inferRepoFromGit(input.cwd);
+	} catch {
+		repo = null;
+	}
+	if (repo === null) stream.write("This directory has no GitHub remote to check.\n");
+	else {
+		const name = traceRepoName(repo);
+		const entry = findTraceRepository(config, name);
+		if (!entry) stream.write(`This repository (${name}) is not allowed. Run \`whiteboard trace allow .\`.\n`);
+		else if (!entry.enabledOrigins.includes(input.origin)) stream.write(`This repository (${name}) is allowed at ${entry.enabledOrigins.join(", ")}, not the selected ${input.origin}. Run \`whiteboard trace allow .\` while logged in there.\n`);
+		else stream.write(`This repository (${name}) is allowed to publish traces to ${input.origin}.\n`);
+	}
+	for (const sessionId of await pendingTraceSessions(input.cwd)) {
+		if (input.session !== void 0 && input.session !== sessionId) continue;
+		stream.write(`Pending agent session: ${sessionId}\n`);
+	}
+	for (const failure of await listTraceSyncFailures(devHome)) if (input.session === void 0 || input.session === failure.session) stream.write(describeTraceSyncFailure(failure));
+	if (repo === null) return 1;
+	return writeOwnUploadStatus({
+		...input,
+		repo,
+		client: input.client ?? (auth && auth.origin === input.origin ? new StoreClient({
+			origin: auth.origin,
+			token: auth.token
+		}) : null)
+	});
+}
+/** The agent sessions still marked active in this checkout. */
+async function pendingTraceSessions(cwd) {
+	const gitPathResult = await git(cwd, [
+		"rev-parse",
+		"--git-path",
+		"agent-session"
+	], { allowFailure: true });
+	const sessionFilePath = gitPathResult.ok ? gitPathResult.stdout.trim() : "";
+	if (!sessionFilePath) return [];
+	return [...(await readActiveTraceSessions(sessionFilePath)).keys()];
+}
+//#endregion
+//#region ../trace-core/src/trace-machine-setup.ts
+const traceMachineSettingsSchema = z.object({
+	version: z.literal(1),
+	enabled: z.boolean(),
+	autoActivateRepositories: z.literal(true),
+	verifiedAt: z.string().optional(),
+	error: z.string().optional()
+});
+/** The bucket credentials in the setup flow's field names. */
+async function readTraceCredentials(homeDir = os.homedir(), env = process.env) {
+	const credentials = resolveS3Setup({
+		homeDir,
+		env
+	}).credentials;
+	if (!credentials) return null;
+	return {
+		endpoint: credentials.endpoint,
+		bucket: credentials.bucket,
+		key: credentials.accessKeyId,
+		secret: credentials.secretAccessKey,
+		region: credentials.region
+	};
+}
+/**
+* The capture settings in effect: the profile's when the version-2 profile
+* carries them, otherwise the legacy settings file.
+*/
+async function readCaptureSettings(setup, settingsPath) {
+	if (setup.profile?.capture) return {
+		settings: setup.profile.capture,
+		source: "profile"
+	};
+	const legacy = await readSettings(settingsPath);
+	return {
+		settings: legacy ? {
+			enabled: legacy.enabled,
+			autoActivateRepositories: legacy.autoActivateRepositories,
+			verifiedAt: legacy.verifiedAt,
+			error: legacy.error
+		} : null,
+		source: "settings"
+	};
+}
+async function traceMachineStatus(input = {}) {
+	const homeDir = input.homeDir ?? os.homedir();
+	const env = input.env ?? process.env;
+	const envPath = traceEnvPath(homeDir, env);
+	const settingsPath = traceSettingsPath(homeDir, env);
+	const selection = selectTraceStorage({
+		homeDir,
+		env
+	});
+	if (!selection.s3) return {
+		enabled: false,
+		configured: false,
+		autoActivateRepositories: false,
+		envPath,
+		settingsPath,
+		configPath: selection.config.path,
+		storageMode: selection.mode,
+		error: selection.error
+	};
+	const setup = selection.s3;
+	const credentials = setup.credentials;
+	const { settings, source } = await readCaptureSettings(setup, settingsPath);
+	const hostedSelected = selection.mode === "hosted";
+	const hosted = hostedSelected && hostedCaptureEnabled(selection.config.config);
+	const s3Enabled = !hostedSelected && settings?.enabled === true;
+	const status = {
+		enabled: hosted || s3Enabled,
+		configured: hostedSelected || credentials !== null,
+		autoActivateRepositories: hosted || s3Enabled && settings?.autoActivateRepositories === true,
+		envPath,
+		settingsPath,
+		configPath: setup.configPath,
+		storageMode: selection.mode,
+		credentialsSource: setup.source,
+		captureSource: source
+	};
+	if (credentials) {
+		status.endpoint = credentials.endpoint;
+		status.bucket = credentials.bucket;
+		status.region = credentials.region;
+		status.accessKeyIdPrefix = credentials.accessKeyId.slice(0, 6);
+	}
+	if (settings?.verifiedAt) status.verifiedAt = settings.verifiedAt;
+	if (settings?.error) status.error = settings.error;
+	if (selection.error) status.error = selection.error;
+	return status;
+}
+/**
+* Whether this machine captures agent sessions at all. Every gate (session
+* hook, scaffold discovery, hook installation, repository enable/repair)
+* asks this instead of reading the settings file itself.
+*/
+async function traceMachineEnabled(input = {}) {
+	return (await traceMachineStatus(input)).enabled;
+}
+async function configureTraceMachine(input) {
+	const homeDir = input.homeDir ?? os.homedir();
+	const env = input.env ?? process.env;
+	const existing = await readTraceCredentials(homeDir, env);
+	const credentials = {
+		endpoint: input.credentials?.endpoint ?? existing?.endpoint ?? "",
+		bucket: input.credentials?.bucket ?? existing?.bucket ?? "",
+		key: input.credentials?.key ?? existing?.key ?? "",
+		secret: input.credentials?.secret ?? existing?.secret ?? ""
+	};
+	if (!Object.values(credentials).every(Boolean)) throw new Error("Trace setup needs an S3/R2 endpoint, bucket, access key ID, and secret access key.");
+	const region = input.credentials?.region?.trim() || existing?.region || "auto";
+	const configFile = readTraceConfigFile({
+		homeDir,
+		env
+	});
+	if (configFile.error) throw new TraceConfigurationError(configFile.error);
+	const envPath = traceEnvPath(homeDir, env);
+	const legacyPathsRequested = env.TRACE_ENV_FILE !== void 0 || env.TRACE_SETTINGS_FILE !== void 0;
+	const target = configFile.config?.stores?.s3 || !existsSync(envPath) && !legacyPathsRequested ? "profile" : "legacy";
+	if (target === "legacy") {
+		await mkdir(path.dirname(envPath), { recursive: true });
+		await writeFile(envPath, [
+			`export TRACE_R2_ENDPOINT=${JSON.stringify(credentials.endpoint)}`,
+			`export TRACE_R2_BUCKET=${JSON.stringify(credentials.bucket)}`,
+			`export TRACE_R2_ACCESS_KEY_ID=${JSON.stringify(credentials.key)}`,
+			`export TRACE_R2_SECRET_ACCESS_KEY=${JSON.stringify(credentials.secret)}`,
+			`export TRACE_R2_REGION=${JSON.stringify(region)}`,
+			""
+		].join("\n"), { mode: 384 });
+		await chmod(envPath, 384);
+		clearTraceEnvCache();
+	}
+	let error;
+	let verifiedAt;
+	if (input.verify !== false) {
+		if (env.TRACE_R2_MODE === "mock") verifiedAt = (/* @__PURE__ */ new Date()).toISOString();
+		else {
+			const { S3TraceStorage } = await import("./s3-SzLpeCG6.js");
+			const readiness = await S3TraceStorage.fromCredentials({
+				endpoint: credentials.endpoint,
+				bucket: credentials.bucket,
+				accessKeyId: credentials.key,
+				secretAccessKey: credentials.secret,
+				region
+			}, env).readiness();
+			if (readiness.ready) verifiedAt = (/* @__PURE__ */ new Date()).toISOString();
+			else error = readiness.reason;
+		}
+	}
+	if (target === "legacy") {
+		const settings = {
+			version: 1,
+			enabled: true,
+			autoActivateRepositories: true
+		};
+		if (verifiedAt) settings.verifiedAt = verifiedAt;
+		if (error) settings.error = error;
+		await writeSettings(traceSettingsPath(homeDir, env), settings);
+	} else {
+		const capture = {
+			enabled: true,
+			autoActivateRepositories: true
+		};
+		if (verifiedAt) capture.verifiedAt = verifiedAt;
+		if (error) capture.error = error;
+		await writeS3Profile(configFile, {
+			endpoint: credentials.endpoint,
+			bucket: credentials.bucket,
+			accessKeyId: credentials.key,
+			secretAccessKey: credentials.secret,
+			region,
+			capture
+		});
+		clearTraceEnvCache();
+	}
+	return traceMachineStatus({
+		homeDir,
+		env
+	});
+}
+/**
+* Stores the profile and, when nothing is selected yet, selects direct
+* storage explicitly. An explicit hosted selection is left alone: setup
+* never silently redirects uploads.
+*/
+async function writeS3Profile(configFile, profile) {
+	const current = configFile.config ?? emptyTraceConfig();
+	await writeTraceConfigFile(configFile, {
+		...current,
+		"current-store": current["current-store"] ?? "s3",
+		stores: {
+			...current.stores,
+			s3: profile
+		}
+	});
+}
+async function disableTraceMachine(input = {}) {
+	const homeDir = input.homeDir ?? os.homedir();
+	const env = input.env ?? process.env;
+	const configFile = readTraceConfigFile({
+		homeDir,
+		env
+	});
+	if (configFile.error) throw new TraceConfigurationError(configFile.error);
+	if (selectTraceStorage({
+		homeDir,
+		env
+	}).mode === "hosted") {
+		const current = configFile.config ?? emptyTraceConfig();
+		await writeTraceConfigFile(configFile, {
+			...current,
+			stores: {
+				...current.stores,
+				hosted: {
+					...current.stores?.hosted,
+					capture: { enabled: false }
+				}
+			}
+		});
+		return;
+	}
+	const profile = configFile.config?.stores?.s3;
+	if (profile?.capture) {
+		await writeS3Profile(configFile, {
+			...profile,
+			capture: {
+				...profile.capture,
+				enabled: false
+			}
+		});
+		return;
+	}
+	const settingsPath = traceSettingsPath(homeDir, env);
+	if (input.removeSettings) {
+		await rm(settingsPath, { force: true });
+		return;
+	}
+	await writeSettings(settingsPath, {
+		version: 1,
+		enabled: false,
+		autoActivateRepositories: true
+	});
+}
+/** The legacy settings file alone, as `config migrate` reports it. */
+async function readLegacyCaptureSettings(filePath) {
+	const legacy = await readSettings(filePath);
+	if (!legacy) return null;
+	const capture = {
+		enabled: legacy.enabled,
+		autoActivateRepositories: legacy.autoActivateRepositories
+	};
+	if (legacy.verifiedAt) capture.verifiedAt = legacy.verifiedAt;
+	if (legacy.error) capture.error = legacy.error;
+	return capture;
+}
+async function readSettings(filePath) {
+	try {
+		const parsed = traceMachineSettingsSchema.safeParse(parseJsonText(await readFile(filePath, "utf8")));
+		return parsed.success ? parsed.data : null;
+	} catch {
+		return null;
+	}
+}
+async function writeSettings(filePath, settings) {
+	await writeFileAtomicAsync(filePath, `${JSON.stringify(settings, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+}
+//#endregion
+//#region ../trace-core/src/trace-hook-runner.ts
+const execFileAsync = promisify(execFile);
+const SESSION_ID_REGEX = /^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/;
+/**
+* Starts `whiteboard trace sync` detached for one session. The attempt names
+* the destination it was started for; the sync rechecks the selection and
+* consent before any transfer. A missing CLI reports asynchronously and
+* never fails the caller.
+*/
+function spawnDetachedTraceSync(input) {
+	try {
+		const command = resolveTraceCommand({
+			explicit: input.command,
+			env: input.scope.env,
+			homeDir: input.scope.homeDir
+		});
+		const expectation = traceStorageExpectation(input.scope);
+		const child = spawn(command.file, [
+			...command.args ?? [],
+			"trace",
+			"sync",
+			input.sessionId,
+			"--expect-storage",
+			expectation
+		], {
+			cwd: input.cwd,
+			detached: true,
+			stdio: "ignore"
+		});
+		child.on("error", () => {});
+		child.unref();
+	} catch {}
+}
+async function runTraceHook(input) {
+	if (input.scope.env.TRACE_DISABLE === "1") return 0;
+	const selection = selectTraceStorage(input.scope);
+	if (selection.error || selection.mode === "none") return 0;
+	if (!await traceMachineEnabled(input.scope)) return 0;
+	let event = input.event;
+	let sessionId = input.sessionId;
+	if (input.stdin && !input.stdin.isTTY) try {
+		const chunks = [];
+		for await (const chunk of input.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+		const raw = Buffer.concat(chunks).toString("utf8").trim();
+		if (raw) {
+			const parsed = jsonObject(parseJsonText(raw));
+			const hookEventName = jsonString(parsed?.hook_event_name);
+			const parsedSessionId = jsonString(parsed?.session_id);
+			if (hookEventName) event = hookEventName;
+			if (parsedSessionId) sessionId = parsedSessionId;
+		}
+	} catch {}
+	sessionId = (sessionId || input.scope.env.AGENT_SESSION_ID || "").trim();
+	if (!sessionId || !SESSION_ID_REGEX.test(sessionId)) return 0;
+	const normalizedEvent = event.toLowerCase().replaceAll(/[_-]/g, "");
+	const isStart = normalizedEvent === "sessionstart";
+	const isEnd = normalizedEvent === "sessionend";
+	const isHeartbeat = normalizedEvent === "userpromptsubmit" || normalizedEvent === "turnstart";
+	if (!isStart && !isEnd && !isHeartbeat) return 0;
+	if (selection.mode === "hosted") {
+		const origin = selection.hosted?.origin ?? "";
+		const entry = await resolveAllowedTraceRepository(input.cwd, input.scope);
+		await recordCaptureProvenance({
+			cwd: input.cwd,
+			sessionId,
+			entry,
+			origin,
+			scope: input.scope
+		}).catch(() => void 0);
+		if (!entry || !entry.enabledOrigins.includes(origin)) return 0;
+	}
+	if (isStart) await enableTraceRepository({
+		cwd: input.cwd,
+		scope: input.scope,
+		reviewCommand: input.traceCommand
+	}).catch(() => void 0);
+	const gitPathResult = await git(input.cwd, [
+		"rev-parse",
+		"--git-path",
+		"agent-session"
+	], { allowFailure: true });
+	let sessionFilePath = null;
+	if (gitPathResult.ok && gitPathResult.stdout.trim()) sessionFilePath = gitPathResult.stdout.trim();
+	const jjRootResult = await execFileAsync("jj", ["root"], { cwd: input.cwd }).catch(() => null);
+	if (!sessionFilePath && jjRootResult?.stdout.trim()) sessionFilePath = path.join(jjRootResult.stdout.trim(), ".jj", "agent-session");
+	let remainingSessions = [];
+	if (sessionFilePath) {
+		const now = Date.now();
+		const currentSessions = await readActiveTraceSessions(sessionFilePath, now);
+		if (isStart || isHeartbeat) {
+			currentSessions.set(sessionId, now);
+			remainingSessions = [...currentSessions.keys()];
+			await writeTraceSessions(sessionFilePath, currentSessions).catch(() => void 0);
+		} else if (isEnd) {
+			currentSessions.delete(sessionId);
+			remainingSessions = [...currentSessions.keys()];
+			await writeTraceSessions(sessionFilePath, currentSessions).catch(() => void 0);
+		}
+	}
+	if (jjRootResult?.stdout.trim()) {
+		if ((isStart || isHeartbeat) && remainingSessions.length > 0) {
+			const templateVal = jjCommitTrailersConfigValue(remainingSessions);
+			await execFileAsync("jj", [
+				"config",
+				"set",
+				"--repo",
+				"templates.commit_trailers",
+				templateVal
+			], { cwd: input.cwd }).catch(() => void 0);
+		} else if (isEnd) {
+			if (remainingSessions.length > 0) {
+				const templateVal = jjCommitTrailersConfigValue(remainingSessions);
+				await execFileAsync("jj", [
+					"config",
+					"set",
+					"--repo",
+					"templates.commit_trailers",
+					templateVal
+				], { cwd: input.cwd }).catch(() => void 0);
+			} else await execFileAsync("jj", [
+				"config",
+				"unset",
+				"--repo",
+				"templates.commit_trailers"
+			], { cwd: input.cwd }).catch(() => void 0);
+		}
+	}
+	if (isEnd) spawnDetachedTraceSync({
+		sessionId,
+		cwd: input.cwd,
+		scope: input.scope,
+		command: input.traceCommand
+	});
+	return 0;
+}
+/**
+* The consent entry for this checkout's repository, or null when the
+* directory is not a GitHub repository or has no entry.
+*/
+async function resolveAllowedTraceRepository(cwd, scope) {
+	let name;
+	try {
+		name = traceRepoName(await inferRepoFromGit(cwd));
+	} catch {
+		return null;
+	}
+	const config = await readTraceUserConfig(scope.devHome);
+	return findTraceRepository(config, name);
+}
+/**
+* Records where this session ran. The identity is the allowed target when
+* the entry names the selected store and the login matches it; otherwise
+* the repository, or the Git directory of a checkout without a remote.
+*/
+async function recordCaptureProvenance(input) {
+	const auth = await readStoreAuth(input.scope.env);
+	let identity;
+	if (input.entry && input.entry.enabledOrigins.includes(input.origin) && auth && auth.origin === input.origin) identity = traceCaptureIdentity({ target: {
+		origin: input.origin,
+		repositoryId: input.entry.repositoryId
+	} });
+	else {
+		const repo = await inferRepoFromGit(input.cwd).catch(() => null);
+		if (repo) identity = traceCaptureIdentity({ repositoryName: traceRepoName(repo) });
+		else {
+			const gitDir = await gitCommonDirectory(input.cwd);
+			if (!gitDir) return;
+			identity = traceCaptureIdentity({ gitDir });
+		}
+	}
+	await recordTraceSessionProvenance({
+		sessionId: input.sessionId,
+		...identity,
+		devHome: input.scope.devHome
+	});
+}
+function jjCommitTrailersConfigValue(sessionIds) {
+	const trailers = `${sessionIds.map((id) => `Agent-Session: ${id}`).join("\n")}\n`;
+	const templateExpression = JSON.stringify(trailers);
+	return JSON.stringify(templateExpression);
+}
+//#endregion
+//#region ../trace-core/src/trace-git-hook-runner.ts
+const ZERO_OID = /^0+$/;
+async function runTraceGitHook(input) {
+	if (input.scope.env.TRACE_DISABLE === "1") return 0;
+	if (!await traceMachineEnabled(input.scope)) return 0;
+	try {
+		if (input.hook === "prepare-commit-msg") return runPrepareCommitMessage(input.cwd, input.args[0]);
+		if (input.hook === "pre-push") {
+			await runPrePush(input);
+			return 0;
+		}
+	} catch (cause) {
+		input.stderr.write(`trace-sync: warning: ${errorMessage(cause)}\n`);
+	}
+	return 0;
+}
+async function runPrepareCommitMessage(cwd, messagePath) {
+	if (!messagePath) return 0;
+	const sessions = await activeSessions(cwd);
+	for (const session of sessions) await git(cwd, [
+		"interpret-trailers",
+		"--in-place",
+		"--if-exists",
+		"addIfDifferent",
+		"--trailer",
+		`Agent-Session: ${session}`,
+		messagePath
+	], { allowFailure: true });
+	return 0;
+}
+async function activeSessions(cwd) {
+	const fromEnv = (process.env.AGENT_SESSION_ID ?? "").trim();
+	if (sessionIdSchema.safeParse(fromEnv).success) return [fromEnv];
+	const fileResult = await git(cwd, [
+		"rev-parse",
+		"--git-path",
+		"agent-session"
+	], { allowFailure: true });
+	if (!fileResult.ok) return [];
+	const filePath = fileResult.stdout.trim();
+	if (!filePath) return [];
+	const sessions = await readActiveTraceSessions(filePath);
+	await writeTraceSessions(filePath, sessions).catch(() => void 0);
+	return [...sessions.keys()];
+}
+async function runPrePush(input) {
+	const raw = await readStdin(input.stdin);
+	const commits = /* @__PURE__ */ new Map();
+	for (const line of raw.split("\n")) {
+		const [localRef, localSha, remoteRef, remoteSha] = line.trim().split(/\s+/);
+		if (!localRef || !localSha || !remoteRef || !remoteSha || ZERO_OID.test(localSha)) continue;
+		const branch = remoteRef.startsWith("refs/heads/") ? remoteRef.slice(11) : null;
+		const revisionArgs = await revisionRange(input.cwd, localSha, remoteSha);
+		const listed = await git(input.cwd, [
+			"rev-list",
+			"--max-count=500",
+			...revisionArgs
+		], { allowFailure: true });
+		if (!listed.ok) continue;
+		for (const commit of listed.stdout.split("\n").map((value) => value.trim()).filter(Boolean)) {
+			const sessions = await readTrailerSessions(input.cwd, commit);
+			if (sessions.length > 0) commits.set(commit, {
+				branch,
+				sessions
+			});
+		}
+	}
+	if (commits.size === 0) return;
+	const sessionCommits = /* @__PURE__ */ new Map();
+	for (const [commit, value] of commits) {
+		await writeReviewTraceCommitMapping({
+			cwd: input.cwd,
+			commit,
+			sessions: value.sessions,
+			branch: value.branch
+		}).catch((cause) => warn(input.stderr, cause));
+		for (const session of value.sessions) sessionCommits.set(session, [...sessionCommits.get(session) ?? [], commit]);
+	}
+	const selection = selectTraceStorage(input.scope);
+	for (const [sessionId, values] of sessionCommits) {
+		if (!isOpenCodeSessionId(sessionId)) try {
+			if (!await findLocalTrace(sessionId)) {
+				input.stderr.write(`trace-sync: skipping ${sessionId}: no local transcript.\n`);
+				continue;
+			}
+		} catch (cause) {
+			warn(input.stderr, cause);
+			continue;
+		}
+		if (selection.mode === "hosted") {
+			spawnDetachedTraceSync({
+				sessionId,
+				cwd: input.cwd,
+				scope: input.scope,
+				command: input.traceCommand
+			});
+			continue;
+		}
+		await syncReviewTrace({
+			sessionId,
+			cwd: input.cwd,
+			commits: values
+		}).catch((cause) => warn(input.stderr, cause));
+	}
+}
+async function revisionRange(cwd, localSha, remoteSha) {
+	if (ZERO_OID.test(remoteSha)) return [
+		localSha,
+		"--not",
+		"--remotes"
+	];
+	return (await git(cwd, [
+		"cat-file",
+		"-e",
+		remoteSha
+	], { allowFailure: true })).ok ? [`${remoteSha}..${localSha}`] : [
+		localSha,
+		"--not",
+		"--remotes"
+	];
+}
+async function readStdin(stdin) {
+	if (!stdin) return "";
+	const chunks = [];
+	for await (const chunk of stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+	return Buffer.concat(chunks).toString("utf8");
+}
+function warn(stderr, cause) {
+	stderr.write(`trace-sync: warning: ${errorMessage(cause)}\n`);
+}
+//#endregion
+//#region ../trace-core/src/trace-capture-cli.ts
+async function runTraceStatus(input) {
+	const machine = await traceMachineStatus(input.scope);
+	const repository = await traceRepositoryStatus(input.cwd);
+	const selection = selectTraceStorage(input.scope);
+	input.stdout.write(`Trace capture: ${machine.enabled ? "enabled" : "disabled"}\n`);
+	input.stdout.write(`Repository: ${repository.message}\n`);
+	input.stdout.write(`Storage: ${describeSelection(selection)}\n`);
+	input.stdout.write(`Config: ${selection.config.path} (${selection.config.source === "absent" ? "not present" : `version ${selection.config.source === "v1" ? "1, consent only" : "2"}`})\n`);
+	if (selection.error) {
+		input.stderr.write(`trace status: ${selection.error}\n`);
+		return 1;
+	}
+	if (selection.mode === "hosted") return writeHostedTraceStatus({
+		scope: input.scope,
+		cwd: input.cwd,
+		origin: selection.hosted?.origin ?? "",
+		stdout: input.stdout,
+		session: input.session,
+		cursor: input.cursor,
+		limit: input.limit
+	});
+	if (input.session !== void 0 || input.cursor !== void 0 || input.limit !== void 0) {
+		input.stderr.write("Upload status filters require hosted storage.\n");
+		return 1;
+	}
+	const [{ S3TraceStorage }, { describeS3Setup, noTraceConfigurationMessage }] = await Promise.all([import("./s3-SzLpeCG6.js"), import("./s3-config-BgxkSoOy.js")]);
+	const setup = describeS3Setup(input.scope.env);
+	input.stdout.write(`Checking trace configuration (${setup.envPath})…\n`);
+	for (const failure of await listTraceSyncFailures(input.scope.devHome)) input.stdout.write(describeTraceSyncFailure(failure));
+	if (!setup.config) {
+		input.stderr.write(`trace status: ${setup.error ?? noTraceConfigurationMessage()}\n`);
+		return 1;
+	}
+	input.stdout.write(`  Endpoint: ${setup.config.endpoint}\n`);
+	input.stdout.write(`  Bucket:   ${setup.config.bucket}\n`);
+	input.stdout.write(`  Key:      ${setup.config.accessKeyId.slice(0, 6)}…\n`);
+	const readiness = await S3TraceStorage.fromEnvironment(input.scope)?.readiness() ?? {
+		ready: false,
+		reason: "unknown error"
+	};
+	if (readiness.ready) {
+		input.stdout.write(`✓ S3/R2 bucket "${setup.config.bucket}" is reachable.\n`);
+		return 0;
+	}
+	input.stderr.write(`✗ Cannot reach S3/R2 bucket "${setup.config.bucket}": ${readiness.reason ?? "unknown error"}\n`);
+	return 1;
+}
+async function runTraceEnable(input) {
+	if (!(await traceMachineStatus(input.scope)).enabled) {
+		input.stderr.write(`trace enable: Trace capture is not enabled. Run \`whiteboard trace allow .\`\n`);
+		return 1;
+	}
+	const result = await enableTraceRepository({
+		cwd: input.cwd,
+		scope: input.scope,
+		reviewCommand: input.traceCommand
+	});
+	(result.enabled ? input.stdout : input.stderr).write(`${result.message}\n`);
+	return result.enabled ? 0 : 1;
+}
+/**
+* Installs the machine parts of trace capture: the harness hooks of every
+* agent, and the CLI itself when the CLI passes an installer. The command
+* touches no repository; `allow` keeps the consent and the Git hooks.
+*
+* The CLI install runs first, because it reports the command file the
+* harness hooks must call.
+*/
+async function runTraceInstallMachine(input) {
+	const output = {
+		json: input.json,
+		stdout: input.stdout,
+		stderr: input.stderr
+	};
+	const traceCommand = input.traceCommand;
+	const { installed, skipped } = await installHarnessHooks({
+		homeDir: input.scope.homeDir,
+		env: input.scope.env,
+		executable: traceCommand?.file,
+		harnessHooks: input.harnessHooks,
+		allHarnesses: input.allHarnesses
+	});
+	emitJsonEvent(output, {
+		event: "trace.install",
+		hooks: installed,
+		skipped
+	});
+	const stream = humanStream(output);
+	if (input.harnessHooks === false) {
+		stream.write("Harness hooks: skipped.\n");
+		return 0;
+	}
+	for (const hook of installed) stream.write(`Harness hook: ${hook.agent} -> ${hook.path}\n`);
+	if (skipped.length > 0) stream.write(skippedHarnessesLine(skipped));
+	return 0;
+}
+async function runTraceDisable(input) {
+	const result = await disableTraceRepository({
+		cwd: input.cwd,
+		scope: input.scope
+	});
+	input.stdout.write(`${result.message}\n`);
+	return result.repository ? 0 : 1;
+}
+async function runTraceRepair(input) {
+	if (!(await traceMachineStatus(input.scope)).enabled) {
+		input.stderr.write(`trace repair: Trace capture is not enabled. Run \`whiteboard trace allow .\`\n`);
+		return 1;
+	}
+	const result = await repairTraceRepository({
+		cwd: input.cwd,
+		scope: input.scope,
+		reviewCommand: input.traceCommand
+	});
+	(result.enabled ? input.stdout : input.stderr).write(`${result.message}\n`);
+	return result.enabled ? 0 : 1;
+}
+async function runTraceSync(input) {
+	let result;
+	try {
+		if (input.expectStorage !== void 0) {
+			const current = traceStorageExpectation(input.scope);
+			if (current !== input.expectStorage) throw new Error(`The trace storage selection changed since this capture started (expected ${input.expectStorage}, now ${current}). Run \`whiteboard trace sync ${input.sessionId}\` to publish to the current selection.`);
+		}
+		result = await syncReviewTrace({
+			sessionId: input.sessionId,
+			cwd: input.cwd,
+			repo: input.repo
+		});
+	} catch (error) {
+		const message = errorMessage(error);
+		await recordTraceSyncFailure({
+			sessionId: input.sessionId.trim(),
+			repository: await inferRepoFromGit(input.cwd).then((repo) => `${repo.owner}/${repo.repo}`).catch(() => null),
+			error: message,
+			reason: error instanceof TraceProvenanceError ? error.reason : void 0,
+			devHome: input.scope.devHome
+		}).catch(() => void 0);
+		throw error;
+	}
+	await clearTraceSyncFailure(input.sessionId.trim(), input.scope.devHome).catch(() => void 0);
+	if (input.json) {
+		input.stdout.write(`${JSON.stringify(result)}\n`);
+		return 0;
+	}
+	for (const upload of result.uploads) input.stdout.write(`${upload.blob}  ${upload.bytes_stored} bytes  ${upload.status}\n`);
+	if (result.hosted) {
+		for (const name of result.hosted.omitted.subagents) input.stdout.write(`${name}  omitted (over the object limit or not a store name)\n`);
+		if (result.hosted.omitted.commits > 0) input.stdout.write(`${result.hosted.omitted.commits} commit link(s) omitted (over the commit limit).\n`);
+		input.stdout.write(result.hosted.complete ? `Published session ${result.session} of ${result.repo} to the trace store (generation ${result.hosted.generation}).\n` : `Published part of session ${result.session} of ${result.repo} to the trace store (generation ${result.hosted.generation}).\n`);
+		return 0;
+	}
+	input.stdout.write(`Updated meta for session ${result.session} in ${result.repo}.\n`);
+	return 0;
+}
+//#endregion
+//#region ../trace-core/src/trace-read-cli.ts
+/**
+* The store a read command uses: the explicit `--storage` override for this
+* one operation, or the machine's selection when none is given. An override
+* never changes the selection, capture settings, or consent.
+*/
+async function resolveTraceReadStorage(override, cwd) {
+	if (!override) return void 0;
+	return resolveTraceStorage({
+		cwd,
+		override
+	});
+}
+async function listSessionsForReviewScope(review, storage) {
+	return listReviewTraceSessions({
+		rootPath: review.repoRoot,
+		baseCommit: review.baseCommit,
+		headCommit: review.headCommit,
+		storage
+	});
+}
+async function runTraceList(input) {
+	const storage = "resolvedStorage" in input ? input.resolvedStorage : await resolveTraceReadStorage(input.storage, input.cwd);
+	let scope;
+	let sessions;
+	if ("commit" in input.scope) {
+		const resolution = await lookupReviewTraceCommit({
+			cwd: input.cwd,
+			sha: input.scope.commit,
+			storage
+		});
+		scope = { commit: resolution.commit };
+		sessions = await Promise.all(resolution.sessions.map((sessionId) => describeTraceSession({
+			sessionId,
+			commits: [{
+				sha: resolution.commit,
+				subject: ""
+			}]
+		}, storage)));
+	} else {
+		scope = { review: input.scope.review.uuid };
+		sessions = await listSessionsForReviewScope(input.scope.review, storage);
+	}
+	const publicSessions = sessions.map((session) => ({
+		id: session.sessionId,
+		harness: session.harness,
+		available: session.available,
+		traces: ["main", ...session.subagents ?? []],
+		commits: session.commits
+	}));
+	if (input.json) {
+		input.stdout.write(`${JSON.stringify({
+			...scope,
+			sessions: publicSessions
+		})}\n`);
+		return 0;
+	}
+	if (sessions.length === 0) {
+		const label = "review" in scope ? `review ${scope.review}` : `commit ${scope.commit}`;
+		input.stdout.write(`No agent sessions recorded for ${label}.\n`);
+		return 0;
+	}
+	for (const session of publicSessions) {
+		input.stdout.write(`${session.id}  (${session.harness}, ${session.available ? "S3/R2 synced" : "not synced"})\n`);
+		for (const commit of session.commits) input.stdout.write(`  commit ${commit.sha.slice(0, 9)}  ${commit.subject}\n`);
+		for (const name of session.traces.slice(1)) input.stdout.write(`  trace ${name}\n`);
+	}
+	return 0;
+}
+async function runTraceShow(input) {
+	const traceName = input.trace === "main" ? void 0 : input.trace;
+	const loaded = await loadReviewAgentTrace({
+		sessionId: input.sessionId,
+		trace: traceName,
+		cwd: input.cwd,
+		storage: await resolveTraceReadStorage(input.storage, input.cwd)
+	});
+	if (!loaded) throw new Error(`No transcript is available for session ${input.sessionId}${traceName ? ` (trace ${traceName})` : ""}.`);
+	const { trace } = loaded;
+	if (input.eventIndex !== void 0) {
+		const event = trace.events[input.eventIndex];
+		if (!event) throw new Error(`Event ${input.eventIndex} is out of range. Session ${input.sessionId} has ${trace.events.length} events.`);
+		const text = extractTraceEventText(event);
+		if (input.json) {
+			const traceQuoteProps = {
+				sessionId: input.sessionId,
+				event: input.eventIndex,
+				trace: traceName || void 0
+			};
+			input.stdout.write(`${JSON.stringify({
+				session: input.sessionId,
+				trace: traceName ?? "main",
+				event: input.eventIndex,
+				kind: event.kind,
+				text,
+				trace_quote_props: traceQuoteProps
+			})}\n`);
+			return 0;
+		}
+		input.stdout.write(`${text}\n`);
+		return 0;
+	}
+	const rows = trace.events.map((event, index) => ({
+		event,
+		index
+	})).filter((row) => !input.kind || row.event.kind === input.kind);
+	if (input.json) {
+		input.stdout.write(`${JSON.stringify({
+			session: input.sessionId,
+			trace: traceName ?? "main",
+			harness: trace.harness,
+			title: trace.title,
+			cache: loaded.cacheStatus,
+			events: rows.map(({ event, index }) => ({
+				event: index,
+				kind: event.kind,
+				summary: compactEventLine(event)
+			}))
+		})}\n`);
+		return 0;
+	}
+	input.stdout.write(`# session ${input.sessionId}${traceName ? ` (trace ${traceName})` : ""} (${trace.harness}) — ${trace.title ?? "untitled"}\n# ${trace.events.length} events${input.kind ? ` (${rows.length} shown, kind=${input.kind})` : ""}${loaded.cacheStatus === "current" ? "" : ` (${loaded.cacheStatus} copy)`}\n`);
+	for (const { event, index } of rows) input.stdout.write(`${String(index).padStart(4, " ")}  ${compactEventLine(event)}\n`);
+	return 0;
+}
+async function runTracePull(input) {
+	try {
+		const storage = "resolvedStorage" in input ? input.resolvedStorage : await resolveTraceReadStorage(input.storage, input.cwd);
+		let scope;
+		let sessions;
+		let repoRoot = input.cwd;
+		if ("review" in input.scope) {
+			const review = input.scope.review;
+			repoRoot = review.repoRoot;
+			const refs = await listSessionsForReviewScope(review, storage);
+			scope = { review: review.uuid };
+			sessions = refs.map((ref) => ({
+				id: ref.sessionId,
+				traces: ref.subagents
+			}));
+		} else if ("commit" in input.scope) {
+			const resolution = await lookupReviewTraceCommit({
+				cwd: input.cwd,
+				sha: input.scope.commit,
+				storage
+			});
+			scope = { commit: resolution.commit };
+			sessions = resolution.sessions.map((id) => ({ id }));
+		} else if ("session" in input.scope) {
+			scope = { session: input.scope.session };
+			sessions = [{ id: input.scope.session }];
+		} else {
+			sessions = (await listRepositoryTraceSessionIds(input.cwd)).map((id) => ({ id }));
+			scope = { repository: input.repo ?? "current" };
+		}
+		const repo = input.repo ? parseRepo(input.repo) : await inferRepoFromGit(repoRoot);
+		const result = await pullReviewTraceCorpus({
+			repo,
+			sessions,
+			mainOnly: input.mainOnly,
+			cwd: repoRoot,
+			storage
+		});
+		const output = {
+			scope,
+			corpus_root: result.corpusRoot,
+			repository: result.repository,
+			sessions: result.sessions,
+			unavailable_sessions: result.unavailableSessions,
+			events: result.events,
+			files: result.files,
+			paths: result.paths
+		};
+		if (input.json) input.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+		else {
+			input.stdout.write(`Pulled ${result.sessions.length} session(s) into ${result.corpusRoot}.\n`);
+			input.stdout.write(`Materialized ${result.files} normalized trace file(s) with ${result.events} event(s) for ${result.repository}.\n`);
+			for (const filePath of result.paths) input.stdout.write(`  ${filePath}\n`);
+			if (result.unavailableSessions.length > 0) input.stderr.write(`Unavailable sessions: ${result.unavailableSessions.join(", ")}\n`);
+		}
+		return sessions.length > 0 && result.sessions.length === 0 ? 1 : 0;
+	} catch (error) {
+		input.stderr.write(`trace pull error: ${errorMessage(error)}\n`);
+		return 1;
+	}
+}
+async function runTraceBlame(input) {
+	let result;
+	try {
+		result = await lookupReviewTraceBlame({
+			cwd: input.cwd,
+			file: input.file,
+			lines: input.lines,
+			history: input.history,
+			storage: await resolveTraceReadStorage(input.storage, input.cwd)
+		});
+	} catch (err) {
+		input.stderr.write(`trace blame error: ${errorMessage(err)}\n`);
+		return 1;
+	}
+	if (input.json) {
+		input.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+		return result.resolutions.some((r) => r.sessions.length > 0) ? 0 : 1;
+	}
+	if (result.resolutions.length === 0) {
+		input.stderr.write(`no commits found for ${input.file}\n`);
+		return 1;
+	}
+	for (const resolution of result.resolutions) printCommitResolution(resolution, input.stdout);
+	return result.resolutions.some((r) => r.sessions.length > 0) ? 0 : 1;
+}
+function printCommitResolution(resolution, stdout) {
+	const shortCommit = resolution.commit.slice(0, 12);
+	if (resolution.sessions.length === 0) {
+		stdout.write(`${shortCommit}  no agent sessions found (source checked: trailer, index, pr-scan)\n`);
+		return;
+	}
+	const prSuffix = resolution.pr !== null ? ` PR #${resolution.pr}` : "";
+	stdout.write(`${shortCommit}  → ${resolution.sessions.length} session(s) via ${resolution.source}${prSuffix}\n`);
+	for (const session of resolution.sessions) {
+		const meta = resolution.session_meta?.[session];
+		const metaSuffix = meta ? `  (${meta.branch || "?"}, ${meta.author || "?"})` : "";
+		stdout.write(`    ${session}${metaSuffix}\n`);
+		stdout.write(`      trace: by-session/${session}/trace.jsonl\n`);
+		stdout.write(`      pull for FFF: whiteboard trace pull --agent-session ${session}\n`);
+	}
+}
+function compactEventLine(event) {
+	const oneLine = (text, limit) => {
+		const collapsed = text.replace(/\s+/g, " ").trim();
+		return collapsed.length > limit ? `${collapsed.slice(0, limit - 1)}…` : collapsed;
+	};
+	if (event.kind === "user") return `user       ${oneLine(event.text, 160)}`;
+	if (event.kind === "assistant") return `${event.thinking ? "thinking  " : "assistant "} ${oneLine(event.markdown, 160)}`;
+	if (event.kind === "separator") return `separator  ${event.label}`;
+	const counts = [event.additions ? `+${event.additions}` : null, event.deletions ? `−${event.deletions}` : null].filter(Boolean).join(" ");
+	return `tool       ${event.verb} ${oneLine(event.title, 120)}${counts ? ` ${counts}` : ""}${event.filePath ? ` [${event.filePath}]` : ""}`;
+}
+//#endregion
+//#region ../trace-core/src/trace-command-storage-option.ts
+/** Adds a read-only store override ; never changes persisted selection. */
+function addTraceStorageOption(command) {
+	return command.addOption(new Option("--storage <mode>", "read from the s3 or hosted store instead of the selected one").choices(["s3", "hosted"]));
+}
+//#endregion
+//#region ../trace-core/src/trace-uninstall-hooks.ts
+/** Release Review hooks; keep its install, login, consent and data. */
+async function runTraceUninstallHooks(input) {
+	const removed = [];
+	for (const agent of AGENT_TRACE_HOOK_AGENTS) if (await removeAgentTraceHook(agent, input.scope.homeDir, input.scope.env)) removed.push(agent);
+	const { disabled } = await disableAllTraceRepositories(input.scope);
+	emitJsonEvent(input, {
+		event: "trace.uninstall-hooks",
+		owner: "review",
+		removed,
+		repositories: disabled
+	});
+	const output = humanStream(input);
+	output.write(`Removed Whiteboard trace hooks. Kept the CLI, login, consent and captured traces.\n`);
+	output.write("Run `whiteboard trace install` to restore trace hooks.\n");
+	return 0;
+}
+//#endregion
+//#region ../trace-core/src/trace-capture-commands.ts
+/** Registers storage inspection and repository capture actions; never owns app commands. */
+function registerTraceCaptureCommands(trace, settings) {
+	const { runtime, cwd, scope, traceCommand, configureOutput, configureJsonOutput } = settings;
+	configureJsonOutput(trace.command("uninstall-hooks").description("Remove this CLI's agent and Git trace hooks; keep login, consent and traces")).action(async (options) => {
+		settings.setExitCode(await runTraceUninstallHooks({
+			scope,
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	const withStorage = (command) => addTraceStorageOption(command);
+	configureOutput(trace.command("status").description("Check trace storage and your hosted uploads").option("--agent-session <id>", "Check uploads of one session").option("--cursor <cursor>", "Continue an upload status page").option("--limit <count>", "Uploads per page", Number)).action(async (options) => {
+		settings.setExitCode(await runtime.runTraceStatus({
+			scope,
+			cwd,
+			session: options.agentSession,
+			cursor: options.cursor,
+			limit: options.limit,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureJsonOutput(withStorage(trace.command("sessions").description("List every published session of this repository's hosted trace store").option("--limit <n>", `sessions per page (1-200, default 50)`, (value) => {
+		if (!/^\d+$/.test(value)) throw new InvalidArgumentError(`--limit must be a whole number from 1 to 200.`);
+		return Number(value);
+	}).option("--cursor <session-id>", "continue after this session id"))).action(async (options) => {
+		settings.setExitCode(await runtime.runTraceSessions({
+			scope,
+			cwd,
+			limit: options.limit,
+			cursor: options.cursor,
+			storage: options.storage,
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	const repositoryCwd = (repoPath) => repoPath ? path.resolve(cwd, repoPath) : cwd;
+	const createStore = async (repoPath, options) => {
+		settings.setExitCode(await runtime.runTraceOnboard({
+			scope,
+			cwd: repositoryCwd(repoPath),
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	};
+	const store = configureOutput(trace.command("store").description("Manage this repository's hosted trace store"));
+	configureJsonOutput(store.command("create [path]").description("Create the hosted trace store for one repository (needs push access)")).action(createStore);
+	configureJsonOutput(store.command("delete [path]").description("Delete the hosted trace store of one repository (admins only)")).action(async (repoPath, options) => {
+		settings.setExitCode(await runtime.runTraceStoreDelete({
+			scope,
+			cwd: repositoryCwd(repoPath),
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureJsonOutput(store.command("info [path]").description("Show the hosted trace store of one repository")).action(async (repoPath, options) => {
+		settings.setExitCode(await runtime.runTraceStoreInfo({
+			scope,
+			cwd: repositoryCwd(repoPath),
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureJsonOutput(trace.command("install").description("Install the agent hooks on this machine").option("--no-harness-hooks", "skip the Claude, Codex, OpenCode, and pi hook installers").option("--all-harnesses", "write every harness hook, even for a harness this machine lacks")).action(async (options) => {
+		settings.setExitCode(await runtime.runTraceInstallMachine({
+			scope,
+			json: options.json,
+			harnessHooks: options.harnessHooks,
+			allHarnesses: options.allHarnesses,
+			traceCommand,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureJsonOutput(trace.command("allow [path]").description("Allow one repository to publish traces to the hosted store").option("--no-harness-hooks", "skip the Claude, Codex, OpenCode, and pi hook installers").option("--all-harnesses", "write every harness hook, even for a harness this machine lacks")).action(async (repoPath, options) => {
+		settings.setExitCode(await runtime.runTraceAllow({
+			scope,
+			cwd: repositoryCwd(repoPath),
+			json: options.json,
+			harnessHooks: options.harnessHooks,
+			allHarnesses: options.allHarnesses,
+			traceCommand,
+			verifyCommand: settings.verifyCommand,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureJsonOutput(trace.command("deny [path]").description("Stop publishing traces from one repository to the hosted store")).action(async (repoPath, options) => {
+		settings.setExitCode(await runtime.runTraceDeny({
+			scope,
+			cwd: repositoryCwd(repoPath),
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureOutput(trace.command("enable [path]").description("Enable trace hooks for one Git repository")).action(async (repoPath) => {
+		settings.setExitCode(await runtime.runTraceEnable({
+			scope,
+			cwd: repositoryCwd(repoPath),
+			stdout: settings.stdout,
+			stderr: settings.stderr,
+			traceCommand
+		}));
+	});
+	configureOutput(trace.command("disable [path]").description("Disable the trace hooks of one Git repository")).action(async (repoPath) => {
+		settings.setExitCode(await runtime.runTraceDisable({
+			scope,
+			cwd: repositoryCwd(repoPath),
+			stdout: settings.stdout
+		}));
+	});
+	configureOutput(trace.command("repair [path]").description("Repair the trace hooks of one Git repository")).action(async (repoPath) => {
+		settings.setExitCode(await runtime.runTraceRepair({
+			scope,
+			cwd: repositoryCwd(repoPath),
+			stdout: settings.stdout,
+			stderr: settings.stderr,
+			traceCommand
+		}));
+	});
+}
+//#endregion
+//#region ../trace-core/src/trace-hook-commands.ts
+/** Registers upload and hidden hook actions; never resolves the machine scope. */
+function registerTraceHookCommands(trace, settings) {
+	const { runtime, cwd, scope, traceCommand, configureOutput, configureJsonOutput } = settings;
+	configureJsonOutput(trace.command("sync <session-id>").description("Upload a local session trace and its metadata").option("--repo <repo>", "GitHub owner/repo").addOption(new Option("--expect-storage <selection>", "abort when the storage selection changed since capture").hideHelp())).action(async (sessionId, options) => {
+		settings.setExitCode(await runtime.runTraceSync({
+			scope,
+			cwd,
+			sessionId,
+			repo: options.repo,
+			json: options.json,
+			expectStorage: options.expectStorage,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureOutput(trace.command("hook <event>", { hidden: true }).description("Handle agent session lifecycle hooks").option("--session <id>", "Agent session ID")).action(async (event, options) => {
+		settings.setExitCode(await runtime.runTraceHook({
+			scope,
+			cwd,
+			event,
+			sessionId: options.session,
+			stdin: settings.stdin,
+			traceCommand
+		}));
+	});
+	configureOutput(trace.command("git-hook <hook> [args...]", { hidden: true }).description("Run a package-owned Git trace hook")).action(async (hook, args) => {
+		settings.setExitCode(await runtime.runTraceGitHook({
+			scope,
+			cwd,
+			hook,
+			args,
+			stdin: settings.stdin,
+			stderr: settings.stderr,
+			traceCommand
+		}));
+	});
+}
+//#endregion
+//#region ../trace-core/src/trace-read-commands.ts
+/** Registers Review trace reads; never resolves Review state. */
+function registerTraceReadCommands(trace, settings) {
+	const { runtime, cwd, configureJsonOutput } = settings;
+	const withStorage = (command) => addTraceStorageOption(command);
+	const listOptions = (command) => command.option("--session <uuid>", "Whiteboard session UUID").option("--commit <sha>", "commit or revision");
+	const pullOptions = (command) => command.option("--session <uuid>", "pull sessions for one Whiteboard");
+	configureJsonOutput(withStorage(listOptions(trace.command("list").description("List agent sessions for a Whiteboard or commit")))).action(async (options) => {
+		if (options.session && options.commit) throw new Error("Use either --session or --commit, not both.");
+		settings.setExitCode(await runtime.runTraceList({
+			cwd,
+			reviewUuid: options.session,
+			commitSha: options.commit,
+			storage: options.storage,
+			json: options.json,
+			stdout: settings.stdout
+		}));
+	});
+	configureJsonOutput(withStorage(trace.command("show <session-id>").description("Survey a trace or show an exact event").option("--trace <name>", "trace name; omit for the main trace").option("--event <index>", "print the complete text of one event", (value) => Number.parseInt(value, 10)).option("--kind <kind>", "only list user|assistant|tool|separator rows"))).action(async (sessionId, options) => {
+		settings.setExitCode(await runtime.runTraceShow({
+			cwd,
+			sessionId,
+			trace: options.trace,
+			eventIndex: options.event,
+			kind: options.kind,
+			storage: options.storage,
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureJsonOutput(withStorage(pullOptions(trace.command("pull").description("Pull traces into the local FFF search corpus").option("--repo <owner/repo>", "repository for the corpus path")).option("--commit <sha>", "pull sessions for one commit or revision").option("--agent-session <id>", "pull one session").option("--main-only", "exclude subagent traces"))).action(async (options) => {
+		if ([
+			options.session,
+			options.commit,
+			options.agentSession
+		].filter(Boolean).length > 1) throw new Error("Use only one of --session, --commit, or --agent-session.");
+		settings.setExitCode(await runtime.runTracePull({
+			cwd,
+			repo: options.repo,
+			reviewUuid: options.session,
+			commitSha: options.commit,
+			session: options.agentSession,
+			mainOnly: options.mainOnly,
+			storage: options.storage,
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+	configureJsonOutput(withStorage(trace.command("blame <file>").description("Blame lines in a file to agent sessions").option("-L, --lines <range>", "start,end line range").option("--history", "use git log -L to include every commit that shaped the lines"))).action(async (file, options) => {
+		settings.setExitCode(await runtime.runTraceBlame({
+			cwd,
+			file,
+			lines: options.lines,
+			history: options.history,
+			storage: options.storage,
+			json: options.json,
+			stdout: settings.stdout,
+			stderr: settings.stderr
+		}));
+	});
+}
+//#endregion
+//#region ../trace-core/src/trace-commands.ts
+/** Registers the shared trace surface with explicit runtime and scope; never imports Review app state. */
+function registerTraceCommands(parent, options) {
+	registerTraceCaptureCommands(parent, options);
+	registerTraceReadCommands(parent, options);
+	registerTraceHookCommands(parent, options);
+}
+//#endregion
+//#region src/review-home-paths.ts
+/** `<basename>-<12 hex>` of a resolved path, one safe storage segment. */
+function hashedSegment(target, fallback) {
+	const resolved = path.resolve(target);
+	return `${safeStorageSegment(path.basename(resolved) || fallback)}-${crypto.createHash("sha256").update(resolved).digest("hex").slice(0, 12)}`;
+}
+/** Encode a value as one filesystem-safe storage path segment. */
+function safeStorageSegment(value) {
+	return value.replace(/[^A-Za-z0-9_.-]+/g, "__");
+}
+function reviewDesktopRoot(env = process.env) {
+	return path.join(devReviewHome(env), "review-desktop");
+}
+/** Written by Desktops that predate instance selection. */
+function reviewLegacyDiscoveryPath(env = process.env) {
+	return path.join(reviewDesktopRoot(env), "server.json");
+}
+function reviewInstancesDir(env = process.env) {
+	return path.join(reviewDesktopRoot(env), "instances");
+}
+function reviewInstanceDiscoveryPath(key, env = process.env) {
+	return path.join(reviewInstancesDir(env), `${key}.json`);
+}
+function reviewDefaultInstancePath(env = process.env) {
+	return path.join(reviewDesktopRoot(env), "default-instance");
+}
+/** `dev-<name>-<hash>` for a source checkout, keyed like reviewRepoStorageRoot. */
+function reviewDevInstanceKey(checkout) {
+	return `dev-${hashedSegment(checkout, "checkout")}`;
+}
+function reviewDesktopStateDir(env = process.env) {
+	return path.join(reviewDesktopRoot(env), "state");
+}
+//#endregion
+export { runTraceSessions as A, installHarnessHooks as B, disableTraceMachine as C, runTraceAllow as D, traceMachineStatus as E, listTraceRepositoryRoots as F, traceScope as G, resolveTraceCommand as H, traceRepositoryStatus as I, HOSTED_CAPTURE_SCOPE_DESCRIPTION as L, runTraceStoreInfo as M, disableAllTraceRepositories as N, runTraceDeny as O, enableTraceRepository as P, AGENT_TRACE_HOOK_AGENTS as R, configureTraceMachine as S, traceMachineEnabled as T, shellQuote as U, removeAgentTraceHook as V, traceHomeDir as W, runTraceRepair as _, reviewInstancesDir as a, runTraceGitHook as b, registerTraceCommands as c, runTraceList as d, runTracePull as f, runTraceInstallMachine as g, runTraceEnable as h, reviewInstanceDiscoveryPath as i, runTraceStoreDelete as j, runTraceOnboard as k, resolveTraceReadStorage as l, runTraceDisable as m, reviewDesktopStateDir as n, reviewLegacyDiscoveryPath as o, runTraceShow as p, reviewDevInstanceKey as r, safeStorageSegment as s, reviewDefaultInstancePath as t, runTraceBlame as u, runTraceStatus as v, readLegacyCaptureSettings as w, runTraceHook as x, runTraceSync as y, describeTraceHookOwners as z };