@iowarp/clio-coder 0.3.0

package/dist/chunk-E3NYWENM.js

@@ -0,0 +1,1004 @@
+// src/domains/observability/trace-store.ts
+import { createHash } from "node:crypto";
+import { mkdirSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+
+// src/domains/evidence/redact.ts
+function createRedactionTally() {
+  return { count: 0 };
+}
+var SECRET_PATTERNS = [
+  {
+    kind: "pem",
+    re: /-----BEGIN [A-Z0-9 ]*(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----[\s\S]*?(?:-----END [A-Z0-9 ]*(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----|$)/g
+  },
+  { kind: "aws-access-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { kind: "github-token", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g },
+  { kind: "github-token", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
+  { kind: "sk-key", re: /\bsk-(?:[A-Za-z0-9_-]{2,20}-)?[A-Za-z0-9_-]{16,}\b/g },
+  { kind: "slack-token", re: /\bxox[bpars]-[A-Za-z0-9-]{8,}\b/g },
+  { kind: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{30,}\b/g },
+  { kind: "jwt", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}\b/g },
+  {
+    kind: "assignment",
+    // KEY=value / key: value / "api_key": "value" shapes where the key name
+    // is secret-flavored and the value is long enough to be a credential.
+    re: /\b((?:[A-Za-z0-9_-]*(?:api[_-]?key|apikey|secret|token|passwd|password|credential)[A-Za-z0-9_-]*)\s*["']?\s*[:=]\s*["']?)([^\s"'`;,&|<>]{8,})/gi
+  }
+];
+function redactSecretsText(text, tally) {
+  let out = text;
+  for (const pattern of SECRET_PATTERNS) {
+    out = out.replace(pattern.re, (...match) => {
+      tally.count += 1;
+      if (pattern.kind === "assignment") {
+        return `${String(match[1])}[redacted:${pattern.kind}]`;
+      }
+      return `[redacted:${pattern.kind}]`;
+    });
+  }
+  return out;
+}
+function redactSecretsDeep(value, tally) {
+  if (typeof value === "string") return redactSecretsText(value, tally);
+  if (Array.isArray(value)) return value.map((item) => redactSecretsDeep(item, tally));
+  if (value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = redactSecretsDeep(item, tally);
+    }
+    return out;
+  }
+  return value;
+}
+
+// src/domains/observability/trace-store.ts
+var TRACE_SCHEMA_VERSION = 1;
+var TRACE_DATABASE_FILE = "trace.sqlite";
+var TRACE_EVENT_POLL_LIMIT = 500;
+var TRACE_PAYLOAD_LIMIT_BYTES = 16 * 1024;
+var TRACE_WRITE_QUEUE_LIMIT = 2048;
+var sqliteConstructor = null;
+function warningTracingRequested() {
+  const flagged = (argument) => argument === "--trace-warnings" || argument.startsWith("--trace-warnings=");
+  if (process.execArgv.some(flagged)) return true;
+  const nodeOptions = process.env.NODE_OPTIONS;
+  if (nodeOptions === void 0) return false;
+  return nodeOptions.split(/\s+/).some(flagged);
+}
+function isSqliteExperimentalWarning(args) {
+  const [warning, second] = args;
+  const type = typeof second === "string" ? second : typeof second === "object" && second !== null && "type" in second ? second.type : void 0;
+  if (type !== "ExperimentalWarning") return false;
+  const text = typeof warning === "string" ? warning : warning instanceof Error ? warning.message : "";
+  return text.includes("SQLite is an experimental feature");
+}
+function requireSqlite() {
+  return createRequire(import.meta.url)("node:sqlite").DatabaseSync;
+}
+function loadWithSqliteWarningSuppressed(load) {
+  if (warningTracingRequested()) return load();
+  const emitWarning = process.emitWarning;
+  const forward = emitWarning.bind(process);
+  process.emitWarning = ((...args) => {
+    if (isSqliteExperimentalWarning(args)) return;
+    forward(...args);
+  });
+  try {
+    return load();
+  } finally {
+    process.emitWarning = emitWarning;
+  }
+}
+function databaseSyncConstructor() {
+  sqliteConstructor ??= loadWithSqliteWarningSuppressed(requireSqlite);
+  return sqliteConstructor;
+}
+function traceDatabasePath(stateDir) {
+  return join(stateDir, TRACE_DATABASE_FILE);
+}
+var TraceSchemaVersionError = class extends Error {
+  constructor(found) {
+    super(
+      found === null ? "trace database has no schema version" : `unsupported trace schema version ${found}; this Clio supports ${TRACE_SCHEMA_VERSION}`
+    );
+    this.found = found;
+    this.name = "TraceSchemaVersionError";
+  }
+  found;
+};
+var SESSION_TRACE_ASSIGNMENT_ID = "session";
+function applyConnectionPragmas(db) {
+  db.exec("PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA busy_timeout=5000; PRAGMA foreign_keys=ON;");
+}
+function readVersion(db) {
+  const hasMeta = db.prepare("SELECT 1 AS found FROM sqlite_master WHERE type='table' AND name='meta'").get();
+  if (!hasMeta) return null;
+  const row = db.prepare("SELECT value FROM meta WHERE key='schema_version'").get();
+  if (!row) return null;
+  const parsed = Number.parseInt(row.value, 10);
+  return Number.isSafeInteger(parsed) ? parsed : null;
+}
+function assertSupportedVersion(db) {
+  const version = readVersion(db);
+  if (version !== TRACE_SCHEMA_VERSION) throw new TraceSchemaVersionError(version);
+}
+var SCHEMA_SQL = `
+CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+INSERT INTO meta(key, value) VALUES ('schema_version', '${TRACE_SCHEMA_VERSION}');
+
+CREATE TABLE runs (
+  run_id TEXT PRIMARY KEY,
+  assignment_id TEXT NOT NULL,
+  request TEXT,
+  status TEXT NOT NULL CHECK(status IN ('queued','running','success','fail')),
+  agent TEXT NOT NULL,
+  target TEXT NOT NULL,
+  model TEXT NOT NULL,
+  runtime TEXT NOT NULL,
+  node TEXT,
+  started_at TEXT NOT NULL,
+  ended_at TEXT,
+  total_tokens INTEGER,
+  total_cost_usd REAL
+);
+
+CREATE TABLE phases (
+  phase_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  seq INTEGER NOT NULL,
+  name TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  description TEXT,
+  status TEXT NOT NULL DEFAULT 'queued' CHECK(status IN ('queued','running','success','fail')),
+  attempt INTEGER NOT NULL DEFAULT 0,
+  retries INTEGER NOT NULL DEFAULT 0,
+  error TEXT,
+  started_at TEXT,
+  ended_at TEXT,
+  input_tokens INTEGER, output_tokens INTEGER, cache_read_tokens INTEGER, cache_write_tokens INTEGER,
+  reasoning_tokens INTEGER, total_tokens INTEGER,
+  input_cost_usd REAL, output_cost_usd REAL, cache_read_cost_usd REAL, cache_write_cost_usd REAL,
+  total_cost_usd REAL,
+  context_tokens INTEGER, context_window INTEGER
+);
+CREATE INDEX phases_run_seq ON phases(run_id, seq);
+
+CREATE TABLE events (
+  event_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  phase_id TEXT NOT NULL REFERENCES phases(phase_id),
+  parent_id TEXT,
+  type TEXT NOT NULL,
+  name TEXT NOT NULL,
+  payload_json TEXT,
+  tokens INTEGER,
+  started_at TEXT NOT NULL,
+  ended_at TEXT
+);
+CREATE INDEX events_run_rowid ON events(run_id);
+CREATE INDEX events_phase_rowid ON events(phase_id);
+
+CREATE TABLE envelopes (
+  envelope_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  phase_id TEXT NOT NULL REFERENCES phases(phase_id),
+  agent TEXT NOT NULL,
+  output_type TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  valid INTEGER NOT NULL CHECK(valid IN (0,1)),
+  attempt INTEGER NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE gate_results (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  phase_id TEXT NOT NULL REFERENCES phases(phase_id),
+  attempt INTEGER NOT NULL,
+  gate TEXT NOT NULL,
+  passed INTEGER NOT NULL CHECK(passed IN (0,1)),
+  violations_json TEXT NOT NULL,
+  checks_json TEXT,
+  created_at TEXT NOT NULL
+);
+CREATE INDEX gate_results_phase_attempt ON gate_results(phase_id, attempt);
+
+CREATE TABLE agent_sessions (
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  agent TEXT NOT NULL,
+  runtime TEXT NOT NULL,
+  model TEXT NOT NULL,
+  session_id TEXT,
+  context_tokens INTEGER,
+  context_window INTEGER,
+  created_at TEXT NOT NULL,
+  last_used_at TEXT NOT NULL,
+  PRIMARY KEY (run_id, agent)
+);
+
+CREATE TABLE processes (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  kind TEXT NOT NULL,
+  name TEXT NOT NULL,
+  pid INTEGER NOT NULL,
+  command TEXT NOT NULL,
+  command_digest TEXT NOT NULL,
+  started_at TEXT NOT NULL,
+  ended_at TEXT
+);
+CREATE INDEX processes_run_live ON processes(run_id, ended_at);
+`;
+var TraceStore = class {
+  constructor(path) {
+    this.path = path;
+    mkdirSync(dirname(path), { recursive: true });
+    this.db = new (databaseSyncConstructor())(path);
+    applyConnectionPragmas(this.db);
+    const version = readVersion(this.db);
+    if (version === null) this.db.exec(`BEGIN IMMEDIATE; ${SCHEMA_SQL} COMMIT;`);
+    else if (version !== TRACE_SCHEMA_VERSION) throw new TraceSchemaVersionError(version);
+  }
+  path;
+  db;
+  close() {
+    this.db.close();
+  }
+  transaction(action) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      action();
+      this.db.exec("COMMIT");
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  upsertRun(input, at = (/* @__PURE__ */ new Date()).toISOString()) {
+    this.transaction(() => {
+      this.db.prepare(`INSERT INTO runs
+          (run_id, assignment_id, request, status, agent, target, model, runtime, node, started_at)
+          VALUES (?, ?, ?, 'queued', ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(run_id) DO UPDATE SET request=excluded.request, agent=excluded.agent,
+            target=excluded.target, model=excluded.model, runtime=excluded.runtime, node=excluded.node`).run(
+        input.runId,
+        input.runId,
+        input.task === void 0 ? null : traceText(input.task, 2e3),
+        input.agentId,
+        input.targetId,
+        input.wireModelId,
+        input.runtimeId,
+        input.node ?? null,
+        at
+      );
+      this.db.prepare(`INSERT INTO phases
+          (phase_id, run_id, seq, name, kind, owner, description, status, started_at)
+          VALUES (?, ?, 0, ?, 'agent', ?, ?, 'queued', NULL)
+          ON CONFLICT(phase_id) DO NOTHING`).run(
+        input.runId,
+        input.runId,
+        traceText(input.agentId, 256),
+        traceText(input.agentId, 256),
+        input.task === void 0 ? null : traceText(input.task, 2e3)
+      );
+    });
+  }
+  startRun(input, at = (/* @__PURE__ */ new Date()).toISOString()) {
+    this.upsertRun(input, at);
+    this.transaction(() => {
+      this.db.prepare("UPDATE runs SET status='running', started_at=? WHERE run_id=?").run(at, input.runId);
+      this.db.prepare("UPDATE phases SET status='running', started_at=? WHERE phase_id=?").run(at, input.runId);
+      this.insertEventRaw({
+        eventId: `${input.runId}:agent_start`,
+        runId: input.runId,
+        phaseId: input.runId,
+        type: "agent_start",
+        name: input.agentId,
+        payload: { target: input.targetId, model: input.wireModelId, runtime: input.runtimeId },
+        startedAt: at
+      });
+      if (input.pid !== null) {
+        this.db.prepare(`INSERT INTO processes(run_id, kind, name, pid, command, command_digest, started_at)
+            VALUES (?, 'worker', ?, ?, ?, ?, ?)`).run(
+          input.runId,
+          input.agentId,
+          input.pid,
+          traceText(input.processCommand ?? "[]", 2e3),
+          sha256(input.processCommand ?? "[]"),
+          at
+        );
+      }
+      this.db.prepare(`INSERT INTO agent_sessions
+          (run_id, agent, runtime, model, session_id, context_tokens, context_window, created_at, last_used_at)
+          VALUES (?, ?, ?, ?, NULL, NULL, ?, ?, ?)
+          ON CONFLICT(run_id, agent) DO UPDATE SET runtime=excluded.runtime, model=excluded.model,
+            context_window=excluded.context_window, last_used_at=excluded.last_used_at`).run(
+        input.runId,
+        traceText(input.agentId, 256),
+        traceText(input.runtimeId, 256),
+        traceText(input.wireModelId, 256),
+        input.contextWindow ?? null,
+        at,
+        at
+      );
+    });
+  }
+  insertEvent(input) {
+    this.transaction(() => this.insertEventRaw(input));
+  }
+  insertEventRaw(input) {
+    this.db.prepare(`INSERT INTO events
+        (event_id, run_id, phase_id, parent_id, type, name, payload_json, tokens, started_at, ended_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(event_id) DO UPDATE SET name=excluded.name, payload_json=excluded.payload_json,
+          tokens=excluded.tokens, started_at=excluded.started_at, ended_at=excluded.ended_at`).run(
+      input.eventId,
+      input.runId,
+      input.phaseId,
+      input.parentId ?? null,
+      input.type,
+      traceText(input.name, 512),
+      input.payload === void 0 ? null : boundedJson(input.payload),
+      input.tokens ?? null,
+      input.startedAt,
+      input.endedAt ?? null
+    );
+  }
+  recordSpend(input) {
+    this.transaction(() => {
+      this.db.prepare(`UPDATE phases SET input_tokens=?, output_tokens=?, cache_read_tokens=?, cache_write_tokens=?,
+          reasoning_tokens=?, total_tokens=?, input_cost_usd=?, output_cost_usd=?, cache_read_cost_usd=?,
+          cache_write_cost_usd=?, total_cost_usd=?, context_tokens=?, context_window=? WHERE phase_id=? AND run_id=?`).run(
+        input.inputTokens,
+        input.outputTokens,
+        input.cacheReadTokens,
+        input.cacheWriteTokens,
+        input.reasoningTokens,
+        input.totalTokens,
+        input.inputCostUsd ?? null,
+        input.outputCostUsd ?? null,
+        input.cacheReadCostUsd ?? null,
+        input.cacheWriteCostUsd ?? null,
+        input.totalCostUsd,
+        input.contextTokens ?? null,
+        input.contextWindow ?? null,
+        input.phaseId,
+        input.runId
+      );
+      this.db.prepare("UPDATE runs SET total_tokens=?, total_cost_usd=? WHERE run_id=?").run(input.totalTokens, input.totalCostUsd, input.runId);
+    });
+  }
+  recordContext(runId, contextTokens, contextWindow, at) {
+    this.transaction(() => {
+      this.db.prepare("UPDATE phases SET context_tokens=?, context_window=COALESCE(?, context_window) WHERE run_id=?").run(contextTokens, contextWindow, runId);
+      this.db.prepare(`UPDATE agent_sessions SET context_tokens=?, context_window=COALESCE(?, context_window),
+          last_used_at=? WHERE run_id=?`).run(contextTokens, contextWindow, at, runId);
+    });
+  }
+  recordGate(input) {
+    const violations = input.checks?.filter((check) => !check.ok).map((check) => `${check.item}: ${check.note}`) ?? [];
+    this.transaction(() => {
+      this.db.prepare("DELETE FROM gate_results WHERE run_id=? AND phase_id=? AND attempt=? AND gate=?").run(input.runId, input.phaseId, input.attempt, input.gate);
+      this.db.prepare(`INSERT INTO gate_results
+          (run_id, phase_id, attempt, gate, passed, violations_json, checks_json, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(
+        input.runId,
+        input.phaseId,
+        input.attempt,
+        input.gate,
+        input.passed ? 1 : 0,
+        JSON.stringify(violations),
+        input.checks === null ? null : JSON.stringify(input.checks),
+        input.createdAt
+      );
+      this.insertEventRaw({
+        eventId: `${input.runId}:gate:${input.gate}:${input.attempt}`,
+        runId: input.runId,
+        phaseId: input.phaseId,
+        type: input.passed ? "gate_pass" : "gate_fail",
+        name: input.gate,
+        payload: { attempt: input.attempt, checks: input.checks, violations },
+        startedAt: input.createdAt
+      });
+    });
+  }
+  recordEnvelope(input) {
+    this.transaction(() => {
+      this.db.prepare(`INSERT OR REPLACE INTO envelopes
+          (envelope_id, run_id, phase_id, agent, output_type, payload_json, valid, attempt, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
+        input.envelopeId,
+        input.runId,
+        input.phaseId,
+        input.agent,
+        input.outputType,
+        boundedJson(input.payload),
+        input.valid ? 1 : 0,
+        input.attempt,
+        input.createdAt
+      );
+    });
+  }
+  startProcess(input) {
+    let id = 0;
+    this.transaction(() => {
+      const result = this.db.prepare(`INSERT INTO processes(run_id, kind, name, pid, command, command_digest, started_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?)`).run(
+        input.runId,
+        input.kind,
+        traceText(input.name, 256),
+        input.pid,
+        traceText(input.command, 2e3),
+        sha256(input.command),
+        input.startedAt
+      );
+      id = Number(result.lastInsertRowid);
+    });
+    return id;
+  }
+  endProcesses(runId, endedAt) {
+    this.transaction(() => {
+      this.db.prepare("UPDATE processes SET ended_at=? WHERE run_id=? AND ended_at IS NULL").run(endedAt, runId);
+    });
+  }
+  recordRetryDenied(runId, agentId, detail, at) {
+    this.transaction(() => {
+      const phase = this.db.prepare("SELECT phase_id FROM phases WHERE run_id=? ORDER BY seq LIMIT 1").get(runId);
+      if (!phase) return;
+      this.insertEventRaw({
+        eventId: `${runId}:retry_denied:${at}`,
+        runId,
+        phaseId: phase.phase_id,
+        type: "error",
+        name: "retry denied",
+        payload: { agent: agentId, detail, reason: "retry_denied" },
+        startedAt: at
+      });
+    });
+  }
+  finishRun(input, success, at = (/* @__PURE__ */ new Date()).toISOString()) {
+    this.transaction(() => {
+      const fallbackStartedAt = typeof input.durationMs === "number" ? new Date(Math.max(0, Date.parse(at) - input.durationMs)).toISOString() : at;
+      this.db.prepare(`INSERT INTO runs
+          (run_id, assignment_id, request, status, agent, target, model, runtime, node, started_at)
+          VALUES (?, ?, ?, 'running', ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(run_id) DO NOTHING`).run(
+        input.runId,
+        input.lineage?.rootRunId ?? input.runId,
+        input.task === void 0 ? null : traceText(input.task, 2e3),
+        input.agentId,
+        input.targetId,
+        input.wireModelId,
+        input.runtimeId,
+        input.node ?? null,
+        fallbackStartedAt
+      );
+      this.db.prepare(`INSERT INTO phases
+          (phase_id, run_id, seq, name, kind, owner, description, status, started_at)
+          VALUES (?, ?, 0, ?, 'agent', ?, ?, 'running', ?)
+          ON CONFLICT(phase_id) DO NOTHING`).run(
+        input.runId,
+        input.runId,
+        traceText(input.agentId, 256),
+        traceText(input.agentId, 256),
+        input.task === void 0 ? null : traceText(input.task, 2e3),
+        fallbackStartedAt
+      );
+      this.db.prepare("UPDATE runs SET assignment_id=?, status=?, ended_at=?, total_tokens=?, total_cost_usd=? WHERE run_id=?").run(
+        input.lineage?.rootRunId ?? input.runId,
+        success ? "success" : "fail",
+        at,
+        input.tokenCount ?? null,
+        input.costUsd ?? null,
+        input.runId
+      );
+      this.db.prepare(`UPDATE phases SET status=?, attempt=?, retries=?, ended_at=?, error=?, input_tokens=?, output_tokens=?,
+          cache_read_tokens=?, cache_write_tokens=?, reasoning_tokens=?, total_tokens=?, total_cost_usd=?
+          WHERE phase_id=?`).run(
+        success ? "success" : "fail",
+        input.lineage?.attempt ?? 0,
+        input.lineage?.attempt ?? 0,
+        at,
+        success ? null : input.outcomeDetail,
+        input.inputTokenCount ?? null,
+        input.outputTokenCount ?? null,
+        input.cacheReadTokenCount ?? null,
+        input.cacheWriteTokenCount ?? null,
+        input.reasoningTokenCount ?? null,
+        input.tokenCount ?? null,
+        input.costUsd ?? null,
+        input.runId
+      );
+      this.db.prepare("UPDATE processes SET ended_at=? WHERE run_id=? AND ended_at IS NULL").run(at, input.runId);
+      this.insertEventRaw({
+        eventId: `${input.runId}:agent_end`,
+        runId: input.runId,
+        phaseId: input.runId,
+        type: "agent_end",
+        name: input.agentId,
+        payload: {
+          outcome: input.outcome,
+          outcomeDetail: input.outcomeDetail,
+          usage: terminalUsage(input),
+          cost: input.costUsd ?? null,
+          contextWindow: input.contextWindow ?? null
+        },
+        tokens: input.tokenCount ?? null,
+        startedAt: at
+      });
+      this.insertEventRaw({
+        eventId: `${input.runId}:phase_end`,
+        runId: input.runId,
+        phaseId: input.runId,
+        type: "phase_end",
+        name: input.agentId,
+        payload: { status: success ? "success" : "fail" },
+        startedAt: at
+      });
+    });
+  }
+  /**
+   * Record one fact about a turn the operator ran in the chat loop.
+   *
+   * The three shapes reuse the dispatch tables exactly: `start` opens the
+   * runs/phases pair, `event` appends to the same `events` table a worker's
+   * tool calls land in, and `finish` closes both with the turn's usage. The
+   * phase id is the run id, as it is for a dispatched run's single phase, so
+   * `clio-coder trace phases` and `clio-coder trace tail` need no session-specific path.
+   */
+  recordSessionTurn(input) {
+    if (input.kind === "start") {
+      this.startSessionTurn(input);
+      return;
+    }
+    if (input.kind === "event") {
+      this.transaction(() => {
+        this.insertEventRaw({
+          eventId: `${input.runId}:${input.eventId}`,
+          runId: input.runId,
+          phaseId: input.runId,
+          parentId: `${input.runId}:turn_start`,
+          type: input.type,
+          name: input.name,
+          ...input.payload === void 0 ? {} : { payload: input.payload },
+          tokens: input.tokens ?? null,
+          startedAt: input.startedAt,
+          endedAt: input.endedAt ?? null
+        });
+      });
+      return;
+    }
+    this.finishSessionTurn(input);
+  }
+  startSessionTurn(input) {
+    this.transaction(() => {
+      this.db.prepare(`INSERT INTO runs
+          (run_id, assignment_id, request, status, agent, target, model, runtime, node, started_at)
+          VALUES (?, ?, ?, 'running', ?, ?, ?, ?, NULL, ?)
+          ON CONFLICT(run_id) DO NOTHING`).run(
+        input.runId,
+        SESSION_TRACE_ASSIGNMENT_ID,
+        input.prompt === null ? null : traceText(input.prompt, 2e3),
+        traceText(input.agent, 256),
+        traceText(input.target, 256),
+        traceText(input.model, 256),
+        traceText(input.runtime, 256),
+        input.at
+      );
+      this.db.prepare(`INSERT INTO phases
+          (phase_id, run_id, seq, name, kind, owner, description, status, started_at)
+          VALUES (?, ?, 0, ?, 'session', ?, ?, 'running', ?)
+          ON CONFLICT(phase_id) DO NOTHING`).run(
+        input.runId,
+        input.runId,
+        traceText(input.agent, 256),
+        traceText(input.agent, 256),
+        input.prompt === null ? null : traceText(input.prompt, 2e3),
+        input.at
+      );
+      this.insertEventRaw({
+        eventId: `${input.runId}:turn_start`,
+        runId: input.runId,
+        phaseId: input.runId,
+        type: "agent_start",
+        name: input.agent,
+        payload: { target: input.target, model: input.model, runtime: input.runtime, session: true },
+        startedAt: input.at
+      });
+    });
+  }
+  finishSessionTurn(input) {
+    const usage = input.usage;
+    this.transaction(() => {
+      this.db.prepare("UPDATE runs SET status=?, ended_at=?, total_tokens=?, total_cost_usd=? WHERE run_id=?").run(input.status, input.at, usage?.totalTokens ?? null, usage?.costUsd ?? null, input.runId);
+      this.db.prepare(`UPDATE phases SET status=?, ended_at=?, error=?, input_tokens=?, output_tokens=?,
+          cache_read_tokens=?, cache_write_tokens=?, reasoning_tokens=?, total_tokens=?, total_cost_usd=?
+          WHERE phase_id=?`).run(
+        input.status,
+        input.at,
+        input.error,
+        usage?.inputTokens ?? null,
+        usage?.outputTokens ?? null,
+        usage?.cacheReadTokens ?? null,
+        usage?.cacheWriteTokens ?? null,
+        usage?.reasoningTokens ?? null,
+        usage?.totalTokens ?? null,
+        usage?.costUsd ?? null,
+        input.runId
+      );
+      this.insertEventRaw({
+        eventId: `${input.runId}:turn_end`,
+        runId: input.runId,
+        phaseId: input.runId,
+        type: "agent_end",
+        name: input.status,
+        payload: { status: input.status, error: input.error, usage },
+        tokens: usage?.totalTokens ?? null,
+        startedAt: input.at
+      });
+    });
+  }
+};
+var TraceReader = class {
+  constructor(path) {
+    this.path = path;
+    this.db = new (databaseSyncConstructor())(path, { readOnly: true });
+    this.db.exec("PRAGMA busy_timeout=5000;");
+    assertSupportedVersion(this.db);
+    const mode = this.db.prepare("PRAGMA journal_mode").get();
+    if (mode.journal_mode.toLowerCase() !== "wal")
+      throw new Error(`trace database journal mode is ${mode.journal_mode}, expected WAL`);
+  }
+  path;
+  db;
+  close() {
+    this.db.close();
+  }
+  runs(limit = 50) {
+    return this.db.prepare("SELECT * FROM runs ORDER BY started_at DESC LIMIT ?").all(clampInt(limit, 1, 500));
+  }
+  run(runId) {
+    return this.db.prepare("SELECT * FROM runs WHERE run_id=?").get(runId) ?? null;
+  }
+  phases(runId) {
+    return this.db.prepare("SELECT * FROM phases WHERE run_id=? ORDER BY seq, phase_id").all(runId);
+  }
+  events(runId, afterRowid = 0, limit = TRACE_EVENT_POLL_LIMIT) {
+    return this.db.prepare(`SELECT rowid, event_id, run_id, phase_id, parent_id, type, name, payload_json,
+        tokens, started_at, ended_at FROM events
+        WHERE run_id = ? AND rowid > ? ORDER BY rowid LIMIT ?`).all(
+      runId,
+      Math.max(0, Math.trunc(afterRowid)),
+      clampInt(limit, 1, TRACE_EVENT_POLL_LIMIT)
+    );
+  }
+  processes(runId) {
+    return this.db.prepare("SELECT * FROM processes WHERE run_id=? ORDER BY ended_at IS NOT NULL, id").all(runId);
+  }
+  gateResults(runId) {
+    return this.db.prepare("SELECT * FROM gate_results WHERE run_id=? ORDER BY phase_id, attempt, id").all(runId);
+  }
+  envelopes(runId) {
+    return this.db.prepare("SELECT * FROM envelopes WHERE run_id=? ORDER BY created_at, envelope_id").all(runId);
+  }
+  select(sql) {
+    assertSelectOnly(sql);
+    return this.db.prepare(sql).all();
+  }
+};
+function createDispatchTraceMirror(path, options = {}) {
+  const warn = options.warn ?? ((message) => process.stderr.write(`[clio:trace] ${message}
+`));
+  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  let store = null;
+  let chain = Promise.resolve();
+  let closed = false;
+  let degraded = false;
+  let pendingWrites = 0;
+  let droppedProgress = 0;
+  const starts = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Map();
+  const contextWindows = /* @__PURE__ */ new Map();
+  const gateRuns = /* @__PURE__ */ new Map();
+  const getStore = () => {
+    store ??= new TraceStore(path);
+    return store;
+  };
+  const schedule = (work) => {
+    if (closed || degraded) return;
+    pendingWrites += 1;
+    chain = chain.then(
+      () => new Promise((resolve) => {
+        setImmediate(() => {
+          try {
+            if (degraded) {
+              pendingWrites -= 1;
+              return resolve();
+            }
+            work();
+          } catch (error) {
+            if (!degraded) warn(error instanceof Error ? error.message : String(error));
+            degraded = true;
+          }
+          pendingWrites -= 1;
+          resolve();
+        });
+      })
+    );
+  };
+  return {
+    enqueue(channel, raw) {
+      const observedAt = now();
+      if (pendingWrites >= TRACE_WRITE_QUEUE_LIMIT && !isCriticalTraceEvent(channel, raw)) {
+        droppedProgress += 1;
+        return;
+      }
+      schedule(() => {
+        if (!isRecord(raw)) return;
+        if (channel === "dispatch.enqueued") {
+          const payload = raw;
+          getStore().upsertRun(payload, observedAt);
+          if (payload.contextWindow !== void 0) contextWindows.set(payload.runId, payload.contextWindow);
+          if (payload.gate !== void 0) gateRuns.set(payload.runId, payload.gate);
+        } else if (channel === "dispatch.started")
+          getStore().startRun(raw, observedAt);
+        else if (channel === "dispatch.progress")
+          recordProgress(
+            getStore(),
+            raw,
+            starts,
+            seen,
+            contextWindows,
+            gateRuns,
+            observedAt
+          );
+        else if (channel === "dispatch.completed")
+          getStore().finishRun(raw, true, observedAt);
+        else if (channel === "dispatch.failed")
+          recordFailure(getStore(), raw, observedAt);
+      });
+    },
+    enqueueSessionTurn(trace) {
+      schedule(() => getStore().recordSessionTurn(trace));
+    },
+    async flush() {
+      await chain;
+      if (droppedProgress > 0) {
+        warn(`dropped ${droppedProgress} display-only progress events because the trace queue was full`);
+        droppedProgress = 0;
+      }
+    },
+    async close() {
+      closed = true;
+      await chain;
+      if (droppedProgress > 0)
+        warn(`dropped ${droppedProgress} display-only progress events because the trace queue was full`);
+      store?.close();
+    }
+  };
+}
+function recordProgress(store, payload, starts, seen, contextWindows, gateRuns, at) {
+  if (!isRecord(payload.event)) return;
+  const event = payload.event;
+  const type = typeof event.type === "string" ? event.type : "progress";
+  const toolCallId = stringValue(event.toolCallId) ?? stringValue(event.tool_call_id);
+  if (type === "message_end" && isRecord(event.message) && event.message.role === "assistant" && event.message.stopReason !== "error" && event.message.stopReason !== "aborted" && isRecord(event.message.usage)) {
+    const usage = event.message.usage;
+    const contextTokens = finiteNonNegative(usage.totalTokens) ?? finiteNonNegative(usage.total_tokens) ?? [usage.input, usage.output, usage.cacheRead, usage.cacheWrite].map((value) => finiteNonNegative(value) ?? 0).reduce((sum, value) => sum + value, 0);
+    store.recordContext(payload.runId, contextTokens, contextWindows.get(payload.runId) ?? null, at);
+  }
+  const gate = gateRuns.get(payload.runId);
+  if (type === "message_end" && gate !== void 0 && isRecord(event.message) && event.message.role === "assistant") {
+    const result = structuredGateResult(messageText(event.message));
+    if (result !== null) {
+      store.recordGate({
+        runId: payload.runId,
+        phaseId: payload.runId,
+        attempt: gate.cycle,
+        gate: gate.role,
+        passed: result.passed,
+        checks: result.checks,
+        createdAt: at
+      });
+    }
+  }
+  if ((type === "tool_execution_start" || type === "clio_tool_start") && toolCallId !== null) {
+    starts.set(`${payload.runId}:${toolCallId}`, {
+      toolCallId,
+      tool: stringValue(event.toolName) ?? stringValue(event.tool) ?? "tool",
+      args: event.args ?? null,
+      startedAt: at
+    });
+    return;
+  }
+  if ((type === "tool_execution_end" || type === "clio_tool_finish") && toolCallId !== null) {
+    const key = `${payload.runId}:${toolCallId}`;
+    const start = starts.get(key);
+    const duration = finiteNonNegative(event.durationMs);
+    const startedAt = start?.startedAt ?? (duration === null ? at : new Date(Date.parse(at) - duration).toISOString());
+    const tool = start?.tool ?? stringValue(event.toolName) ?? stringValue(event.tool) ?? "tool";
+    const args = start?.args ?? event.args ?? null;
+    const result = event.result ?? event.resultSnippet ?? null;
+    const ok = event.isError !== true && event.outcome !== "error" && event.outcome !== "blocked";
+    store.insertEvent({
+      eventId: `${payload.runId}:tool:${toolCallId}`,
+      runId: payload.runId,
+      phaseId: payload.runId,
+      parentId: `${payload.runId}:agent_start`,
+      type: "tool_call",
+      name: readableToolName(tool, args),
+      payload: {
+        tool,
+        tool_call_id: toolCallId,
+        args,
+        result_snippet: boundedSnippet(result),
+        ok,
+        duration_ms: duration,
+        agent: payload.agentId
+      },
+      startedAt,
+      endedAt: at
+    });
+    starts.delete(key);
+    return;
+  }
+  const sequence = (seen.get(payload.runId) ?? 0) + 1;
+  seen.set(payload.runId, sequence);
+  store.insertEvent({
+    eventId: `${payload.runId}:event:${sequence}`,
+    runId: payload.runId,
+    phaseId: payload.runId,
+    parentId: `${payload.runId}:agent_start`,
+    type: normalizeEventType(type),
+    name: eventName(event, type),
+    payload: projectProgressPayload(type, event),
+    tokens: eventTokens(event),
+    startedAt: at
+  });
+}
+function terminalUsage(input) {
+  if (input.tokenCount === void 0) return null;
+  return {
+    input: input.inputTokenCount ?? 0,
+    output: input.outputTokenCount ?? 0,
+    cache_read: input.cacheReadTokenCount ?? 0,
+    cache_write: input.cacheWriteTokenCount ?? 0,
+    reasoning_tokens: input.reasoningTokenCount ?? 0,
+    total_tokens: input.tokenCount
+  };
+}
+function recordFailure(store, input, at) {
+  if (input.reason === "retry_denied") {
+    store.recordRetryDenied(input.runId, input.agentId, input.outcomeDetail, at);
+    return;
+  }
+  store.finishRun(input, false, at);
+}
+function isCriticalTraceEvent(channel, raw) {
+  if (channel !== "dispatch.progress") return true;
+  if (!isRecord(raw) || !isRecord(raw.event)) return false;
+  const type = raw.event.type;
+  return type === "tool_execution_start" || type === "tool_execution_end" || type === "clio_tool_start" || type === "clio_tool_finish" || type === "message_end" || type === "attempt_start";
+}
+function projectProgressPayload(type, event) {
+  if (type === "message_end") {
+    const message = isRecord(event.message) ? event.message : {};
+    return {
+      role: message.role ?? null,
+      stopReason: message.stopReason ?? null,
+      usage: isRecord(message.usage) ? message.usage : null,
+      model: message.model ?? null
+    };
+  }
+  const projected = { sourceType: type };
+  for (const key of ["level", "status", "attempt", "reason", "dueAt", "previousRunId", "runId"]) {
+    const value = event[key];
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") projected[key] = value;
+  }
+  return projected;
+}
+function messageText(message) {
+  if (typeof message.content === "string") return message.content;
+  if (!Array.isArray(message.content)) return "";
+  return message.content.map((part) => isRecord(part) && part.type === "text" && typeof part.text === "string" ? part.text : "").join("");
+}
+function structuredGateResult(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!isRecord(parsed) || !Array.isArray(parsed.checks) || parsed.checks.length === 0) return null;
+  const checks = [];
+  for (const raw of parsed.checks) {
+    if (!isRecord(raw) || typeof raw.name !== "string" || typeof raw.passed !== "boolean" || typeof raw.evidence !== "string") {
+      return null;
+    }
+    checks.push({ item: raw.name, ok: raw.passed, note: raw.evidence });
+  }
+  if (parsed.verdict !== void 0 && parsed.verdict !== "pass" && parsed.verdict !== "fail") return null;
+  if (parsed.winner !== void 0 && (!Number.isSafeInteger(parsed.winner) || parsed.winner < 1))
+    return null;
+  if (parsed.verdict === void 0 && parsed.winner === void 0) return null;
+  return { passed: parsed.verdict === "pass" || parsed.winner !== void 0, checks };
+}
+function normalizeEventType(type) {
+  if (type === "message_end") return "log";
+  if (type === "attempt_start") return "handoff";
+  return type.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64) || "progress";
+}
+function eventName(event, fallback) {
+  return stringValue(event.name) ?? stringValue(event.message) ?? fallback;
+}
+function eventTokens(event) {
+  if (!isRecord(event.message) || !isRecord(event.message.usage)) return null;
+  return finiteNonNegative(event.message.usage.totalTokens) ?? finiteNonNegative(event.message.usage.total_tokens);
+}
+function readableToolName(tool, args) {
+  if (isRecord(args)) {
+    const target = stringValue(args.command) ?? stringValue(args.path) ?? stringValue(args.file_path);
+    if (target !== null) return traceText(`${tool}: ${target.replace(/\s+/g, " ").trim()}`, 160);
+  }
+  return traceText(tool, 160);
+}
+function boundedSnippet(value) {
+  if (value === null || value === void 0) return null;
+  const encoded = typeof value === "string" ? value : JSON.stringify(value, (_key, current) => typeof current === "bigint" ? current.toString() : current);
+  const text = encoded ?? String(value);
+  return Buffer.byteLength(text) <= 4096 ? text : `${Buffer.from(text).subarray(0, 4093).toString("utf8")}\u2026`;
+}
+function boundedJson(value) {
+  const serialized = JSON.stringify(
+    value,
+    (_key, current) => typeof current === "bigint" ? current.toString() : current
+  );
+  const json = serialized === void 0 ? void 0 : redactSecretsText(serialized, createRedactionTally());
+  if (json === void 0) return "null";
+  if (Buffer.byteLength(json) <= TRACE_PAYLOAD_LIMIT_BYTES) return json;
+  return JSON.stringify({
+    truncated: true,
+    snippet: Buffer.from(json).subarray(0, TRACE_PAYLOAD_LIMIT_BYTES - 128).toString("utf8")
+  });
+}
+function traceText(value, maxChars) {
+  return redactSecretsText(value, createRedactionTally()).replace(/[\r\n\t]+/g, " ").slice(0, maxChars);
+}
+function sha256(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function assertSelectOnly(sql) {
+  const trimmed = sql.trim();
+  if (!/^(SELECT|WITH)\b/i.test(trimmed)) throw new Error("trace sql accepts SELECT or read-only WITH queries only");
+  if (trimmed.includes(";")) throw new Error("trace sql accepts exactly one statement");
+  if (/\b(INSERT|UPDATE|DELETE|REPLACE|CREATE|ALTER|DROP|ATTACH|DETACH|VACUUM|PRAGMA)\b/i.test(trimmed)) {
+    throw new Error("trace sql query is not read-only");
+  }
+}
+function clampInt(value, min, max) {
+  if (!Number.isFinite(value)) return min;
+  return Math.min(max, Math.max(min, Math.trunc(value)));
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function finiteNonNegative(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+
+export {
+  createRedactionTally,
+  redactSecretsText,
+  redactSecretsDeep,
+  TRACE_EVENT_POLL_LIMIT,
+  traceDatabasePath,
+  TraceReader,
+  createDispatchTraceMirror
+};
+//# sourceMappingURL=chunk-E3NYWENM.js.map