@kyo-so/cli 0.7.1 → 0.9.0

package/dist/index.js

@@ -169498,7 +169498,7 @@ function defineConfig(config) {
   return config;
 }
 // src/core/runReview.ts
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 
 // node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -184076,6 +184076,28 @@ import { createInterface } from "node:readline/promises";
 
 // src/config/projectScope.ts
 var PROJECT_GLOBAL_ONLY_MESSAGE = "Move global-only settings to the user global config:";
+var kyosoConfigOverridePaths = [
+  "agents.codex.enabled",
+  "agents.codex.model",
+  "agents.codex.effort",
+  "agents.codex.role",
+  "agents.codex.timeoutMs",
+  "agents.claude.enabled",
+  "agents.claude.model",
+  "agents.claude.effort",
+  "agents.claude.role",
+  "agents.claude.timeoutMs",
+  "verification.enabled",
+  "verification.maxFindings",
+  "verification.timeoutMs",
+  "judge.mode",
+  "judge.provider",
+  "judge.timeoutMs"
+];
+var CONFIG_OVERRIDE_PATHS = new Set(kyosoConfigOverridePaths);
+function isAllowedConfigOverridePath(path) {
+  return CONFIG_OVERRIDE_PATHS.has(path.join("."));
+}
 function mergeProjectTomlConfig(baseConfig, projectConfig, options) {
   const violations = collectProjectScopeViolations(projectConfig);
   if (violations.length > 0) {
@@ -184108,13 +184130,9 @@ function collectProjectScopeViolations(config2) {
 }
 function isAllowedProjectPath(path) {
   const [top, second, third, fourth] = path;
-  if (top === "tools" && path.length === 2 && ["planReview", "securityReview", "diffReview"].includes(second ?? "")) {
+  if (isAllowedConfigOverridePath(path))
     return true;
-  }
-  if (top === "agents" && path.length === 3 && ["codex", "claude"].includes(second ?? "") && ["enabled", "model", "effort", "role", "timeoutMs"].includes(third ?? "")) {
-    return true;
-  }
-  if (top === "verification" && path.length === 2 && ["enabled", "maxFindings", "timeoutMs"].includes(second ?? "")) {
+  if (top === "tools" && path.length === 2 && ["planReview", "securityReview", "diffReview"].includes(second ?? "")) {
     return true;
   }
   if (top === "workspace" && path.length === 2 && ["maxContextBytes", "maxDiffBytes", "deny"].includes(second ?? "")) {
@@ -184126,9 +184144,6 @@ function isAllowedProjectPath(path) {
   if (top === "secrets" && path.length === 2 && ["blockOnDetectedSecret", "allowOverride"].includes(second ?? "")) {
     return true;
   }
-  if (top === "judge" && path.length === 2 && ["mode", "provider", "timeoutMs"].includes(second ?? "")) {
-    return true;
-  }
   if (top === "securityReview" && second === "cisaSecureByDesign" && path.length >= 3) {
     if (third === "dimensions") {
       return path.length === 4 && [
@@ -184246,6 +184261,7 @@ var REDACTION = "[KYOSO_REDACTED]";
 // src/core/constants.ts
 var DEFAULT_AGENT_TIMEOUT_MS = 120000;
 var RAW_OUTPUT_MAX_CHARS = 16384;
+var TRACE_DIR = ".kyoso/traces";
 var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
 
 // src/security/sanitizeText.ts
@@ -185548,6 +185564,90 @@ async function exists(path) {
   }
 }
 
+// src/config/configOverrides.ts
+var NUMBER_VALUE = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i;
+function applyConfigOverrides(config2, assignments) {
+  if (assignments.length === 0)
+    return config2;
+  const overrides = assignments.map(parseConfigOverride);
+  const baseConfig = config2;
+  const overridden = structuredClone(config2);
+  for (const override of overrides) {
+    writePath2(overridden, override.path, parseConfigOverrideValue(override.value, readPath2(baseConfig, override.path)));
+  }
+  const parsed = kyosoConfigSchema.safeParse(overridden);
+  if (parsed.success)
+    return parsed.data;
+  const issue2 = parsed.error.issues[0];
+  const issuePath = issue2?.path.map(String).join(".") ?? "config";
+  const assignment = findAssignmentForPath(overrides, issuePath) ?? assignments.at(-1) ?? "";
+  throw new Error(`Invalid --set value ${JSON.stringify(assignment)}: ${issuePath}: ${issue2?.message ?? "config validation failed"}.`);
+}
+function findAssignmentForPath(overrides, path) {
+  for (let index = overrides.length - 1;index >= 0; index -= 1) {
+    const override = overrides[index];
+    if (override?.path.join(".") === path)
+      return override.assignment;
+  }
+  return;
+}
+function parseConfigOverride(assignment) {
+  const separator = assignment.indexOf("=");
+  if (separator <= 0) {
+    throw new Error(`Invalid --set value ${JSON.stringify(assignment)}. Expected key=value.`);
+  }
+  const key = assignment.slice(0, separator);
+  const path = key.split(".");
+  if (!isAllowedConfigOverridePath(path)) {
+    throw new Error(`Unknown --set key ${JSON.stringify(key)}.`);
+  }
+  return {
+    assignment,
+    path,
+    value: assignment.slice(separator + 1)
+  };
+}
+function parseConfigOverrideValue(value, currentValue) {
+  if (typeof currentValue === "boolean") {
+    if (value === "true")
+      return true;
+    if (value === "false")
+      return false;
+    return value;
+  }
+  if (typeof currentValue === "number" && NUMBER_VALUE.test(value)) {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed))
+      return parsed;
+  }
+  return value;
+}
+function readPath2(target, path) {
+  let current = target;
+  for (const key of path) {
+    if (!isRecord4(current))
+      return;
+    current = current[key];
+  }
+  return current;
+}
+function writePath2(target, path, value) {
+  let current = target;
+  for (const key of path.slice(0, -1)) {
+    const child = current[key];
+    if (!isRecord4(child)) {
+      throw new Error(`Cannot apply --set key ${JSON.stringify(path.join("."))}.`);
+    }
+    current = child;
+  }
+  const leaf = path.at(-1);
+  if (leaf)
+    current[leaf] = value;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/acp/AcpAgentProcess.ts
 import { spawn } from "node:child_process";
 import { readFile as readFile4, realpath } from "node:fs/promises";
@@ -185622,6 +185722,48 @@ function requiredDefaultOnError(schema, fallback) {
     return exports_external.NEVER;
   });
 }
+function stringTag(value, key) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return;
+  }
+  const tag = value[key];
+  return typeof tag === "string" ? tag : undefined;
+}
+function excludeKnownTags(schema, key, knownTags) {
+  return schema.superRefine((value, context) => {
+    const tag = stringTag(value, key);
+    if (tag !== undefined && knownTags.includes(tag)) {
+      context.addIssue({
+        code: "custom",
+        path: [key],
+        message: `${key} ${JSON.stringify(tag)} is reserved by a known variant, ` + `but the value does not match that variant's schema`
+      });
+    }
+  });
+}
+function preserveCustomPayload(schema, key, knownTags) {
+  return exports_external.unknown().transform((value, context) => {
+    const result = schema.safeParse(value);
+    if (!result.success) {
+      for (const issue2 of result.error.issues) {
+        context.addIssue({ ...issue2, input: value });
+      }
+      return exports_external.NEVER;
+    }
+    const output = result.data;
+    const tag = stringTag(value, key);
+    if (tag !== undefined && !knownTags.includes(tag)) {
+      const raw = value;
+      for (const [property, rawValue] of Object.entries(raw)) {
+        if (property === "__proto__")
+          continue;
+        if (!Object.hasOwn(output, property))
+          output[property] = rawValue;
+      }
+    }
+    return output;
+  });
+}
 function vecSkipError(itemSchema) {
   return exports_external.array(itemSchema.catch(skippedItem)).transform((items) => items.filter((item) => item !== skippedItem));
 }
@@ -186045,15 +186187,15 @@ var zTitledMultiSelectItems = object({
     return;
   })
 });
-var zMultiSelectItems = union([
+var zMultiSelectItems = preserveCustomPayload(union([
   zStringMultiSelectItems.and(object({
     type: literal("string")
   })),
-  object({
+  excludeKnownTags(object({
     type: string2()
-  }),
+  }), "type", ["string"]),
   zTitledMultiSelectItems
-]);
+]), "type", ["string"]);
 var zMultiSelectPropertySchema = object({
   title: defaultOnError(string2().nullish(), () => {
     return;
@@ -186071,7 +186213,7 @@ var zMultiSelectPropertySchema = object({
     return;
   })
 });
-var zElicitationPropertySchema = union([
+var zElicitationPropertySchema = preserveCustomPayload(union([
   zStringPropertySchema.and(object({
     type: literal("string")
   })),
@@ -186087,10 +186229,10 @@ var zElicitationPropertySchema = union([
   zMultiSelectPropertySchema.and(object({
     type: literal("array")
   })),
-  object({
+  excludeKnownTags(object({
     type: string2()
-  })
-]);
+  }), "type", ["array", "boolean", "integer", "number", "string"])
+]), "type", ["array", "boolean", "integer", "number", "string"]);
 var zElicitationSchema = object({
   type: defaultOnError(zElicitationSchemaType.optional().default("object"), () => "object"),
   title: defaultOnError(string2().nullish(), () => {
@@ -186113,22 +186255,22 @@ var zElicitationUrlMode = intersection(union([zElicitationSessionScope, zElicita
   elicitationId: zElicitationId,
   url: url()
 }));
-var zCreateElicitationRequest = intersection(union([
+var zCreateElicitationRequest = preserveCustomPayload(intersection(union([
   zElicitationFormMode.and(object({
     mode: literal("form")
   })),
   zElicitationUrlMode.and(object({
     mode: literal("url")
   })),
-  intersection(union([zElicitationSessionScope, zElicitationRequestScope]), object({
+  excludeKnownTags(intersection(union([zElicitationSessionScope, zElicitationRequestScope]), object({
     mode: string2()
-  }))
+  })), "mode", ["form", "url"])
 ]), object({
   message: string2(),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
-}));
+})), "mode", ["form", "url"]);
 var zMcpServerAcpId = string2();
 var zConnectMcpRequest = object({
   serverId: zMcpServerAcpId,
@@ -187728,7 +187870,7 @@ var zElicitationContentValue = union([
 var zElicitationAcceptAction = object({
   content: record(string2(), zElicitationContentValue).nullish()
 });
-var zCreateElicitationResponse = intersection(union([
+var zCreateElicitationResponse = preserveCustomPayload(intersection(union([
   zElicitationAcceptAction.and(object({
     action: literal("accept")
   })),
@@ -187738,14 +187880,14 @@ var zCreateElicitationResponse = intersection(union([
   object({
     action: literal("cancel")
   }),
-  object({
+  excludeKnownTags(object({
     action: string2()
-  })
+  }), "action", ["accept", "cancel", "decline"])
 ]), object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
-}));
+})), "action", ["accept", "cancel", "decline"]);
 var zConnectMcpResponse = object({
   connectionId: zMcpConnectionId,
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
@@ -187881,16 +188023,34 @@ var zCancelRequestNotification = object({
     return;
   })
 });
+
+// node_modules/@agentclientprotocol/sdk/dist/schema/guards.gen.js
+var zGuardCreateElicitationRequestForm = zElicitationFormMode.and(object({ mode: literal("form") })).and(object({ message: string2() }));
+var zGuardCreateElicitationRequestUrl = zElicitationUrlMode.and(object({ mode: literal("url") })).and(object({ message: string2() }));
+var zGuardCreateElicitationRequestCustom = union([zElicitationSessionScope, zElicitationRequestScope]).and(object({ message: string2() }));
+var zGuardElicitationPropertySchemaString = zStringPropertySchema.and(object({ type: literal("string") }));
+var zGuardElicitationPropertySchemaNumber = zNumberPropertySchema.and(object({ type: literal("number") }));
+var zGuardElicitationPropertySchemaInteger = zIntegerPropertySchema.and(object({ type: literal("integer") }));
+var zGuardElicitationPropertySchemaBoolean = zBooleanPropertySchema.and(object({ type: literal("boolean") }));
+var zGuardElicitationPropertySchemaArray = zMultiSelectPropertySchema.and(object({ type: literal("array") }));
+var zGuardMultiSelectItemsString = zStringMultiSelectItems.and(object({ type: literal("string") }));
+var zGuardCreateElicitationResponseAccept = zElicitationAcceptAction.and(object({ action: literal("accept") }));
+var zGuardCreateElicitationResponseDecline = object({
+  action: literal("decline")
+});
+var zGuardCreateElicitationResponseCancel = object({
+  action: literal("cancel")
+});
 // node_modules/@agentclientprotocol/sdk/dist/jsonrpc.js
 var CANCEL_REQUEST_METHOD = "$/cancel_request";
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null;
 }
 function isJsonRpcId(value) {
   return value === null || typeof value === "string" || typeof value === "number" && Number.isFinite(value);
 }
 function cancelRequestId(params) {
-  if (!isRecord4(params) || !isJsonRpcId(params["requestId"])) {
+  if (!isRecord5(params) || !isJsonRpcId(params["requestId"])) {
     return;
   }
   return params["requestId"];
@@ -188237,7 +188397,7 @@ class Connection {
     if (this.abortController.signal.aborted) {
       return;
     }
-    if (!isRecord4(message)) {
+    if (!isRecord5(message)) {
       console.error("Invalid message", { message });
       return;
     }
@@ -188330,7 +188490,7 @@ class Connection {
       pendingResponse.cleanup?.();
       if ("result" in response) {
         pendingResponse.resolve(response.result);
-      } else if ("error" in response && isRecord4(response.error)) {
+      } else if ("error" in response && isRecord5(response.error)) {
         const { code, message, data } = response.error;
         pendingResponse.reject(new RequestError(code, message, data));
       } else {
@@ -188540,7 +188700,7 @@ function ndJsonStream(output, input) {
         if (trimmedLine) {
           try {
             const message = JSON.parse(trimmedLine);
-            if (isRecord4(message)) {
+            if (isRecord5(message)) {
               controller.enqueue(message);
             } else {
               console.warn("Skipping JSON line that is not an object:", trimmedLine);
@@ -189601,7 +189761,7 @@ function isSeverity(value) {
   return typeof value === "string" && severities.includes(value);
 }
 function normalizeCisaSecureByDesign(value) {
-  if (!isRecord5(value))
+  if (!isRecord6(value))
     return;
   const normalized = {};
   const customerSecurityOutcomes = normalizeGateStatus(value.customerSecurityOutcomes);
@@ -189642,7 +189802,7 @@ function normalizeFindingFiles(value) {
   if (!Array.isArray(value))
     return;
   const files = value.flatMap((item) => {
-    if (!isRecord5(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
+    if (!isRecord6(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
       return [];
     }
     const file2 = {
@@ -189661,7 +189821,7 @@ function normalizeFindingFiles(value) {
 function normalizeLineNumber(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -190622,9 +190782,10 @@ function normalizeTitle(value) {
   return value.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim();
 }
 
-// src/audit/trace.ts
-import { mkdir as mkdir2, appendFile } from "node:fs/promises";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3 } from "node:path";
+// src/audit/stateRoot.ts
+import { createHash as createHash2 } from "node:crypto";
+import { lstat, mkdir as mkdir2, realpath as realpath2 } from "node:fs/promises";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute2, join as join3, resolve as resolve5 } from "node:path";
 
 // src/context/pathPolicy.ts
 import { normalize, sep } from "node:path";
@@ -190686,6 +190847,325 @@ function matchesPathPattern(path, patterns, mode) {
   });
 }
 
+// src/utils/pathContainment.ts
+import { resolve as resolve4, sep as sep2 } from "node:path";
+function isPathWithin(candidate, root) {
+  const resolvedCandidate = resolve4(candidate);
+  const resolvedRoot = resolve4(root);
+  const boundary = resolvedRoot.endsWith(sep2) ? resolvedRoot : `${resolvedRoot}${sep2}`;
+  return resolvedCandidate === resolvedRoot || resolvedCandidate.startsWith(boundary);
+}
+
+// src/audit/stateRoot.ts
+var PRIVATE_DIRECTORY_MODE = 448;
+var UNSAFE_DIRECTORY_MODE = 18;
+var STICKY_DIRECTORY_MODE = 512;
+var AUDIT_WARNING_DIRECTORY_IGNORED = "AUDIT_DIRECTORY_IGNORED: Audit directory is invalid; using the default logical directory.";
+var AUDIT_WARNING_UNSUPPORTED_PLATFORM = "AUDIT_DISABLED_UNSUPPORTED_PLATFORM: Audit trace writing is unavailable on this platform.";
+var AUDIT_WARNING_UNSUPPORTED_CAPABILITY = "AUDIT_DISABLED_UNSUPPORTED_CAPABILITY: Audit trace writing requires unavailable filesystem capabilities.";
+var AUDIT_WARNING_UNSAFE_STATE_ROOT = "AUDIT_DISABLED_UNSAFE_STATE_ROOT: Audit state root could not be verified.";
+async function resolveAuditStateRoot(options) {
+  const warnings = [];
+  const logicalDirectory = validateAuditDirectory(options.directory, warnings);
+  const platform = options.platform ?? process.platform;
+  if (platform === "win32") {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSUPPORTED_PLATFORM] };
+  }
+  const uid = getCurrentUid(options.getuid);
+  if (uid === undefined) {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSUPPORTED_CAPABILITY] };
+  }
+  try {
+    const workspaceRoot = await realpath2(resolve5(options.cwd));
+    const candidate = resolveStateBaseCandidate(options.env ?? process.env);
+    if (!candidate)
+      throw new Error("missing trusted state base");
+    const stateBase = await ensureTrustedStateBase({
+      candidate,
+      workspaceRoot,
+      uid
+    });
+    const kyosoRoot = await ensureTrustedDirectory({
+      root: stateBase,
+      segments: ["kyoso"],
+      uid,
+      workspaceRoot
+    });
+    return {
+      stateBase,
+      kyosoRoot,
+      workspaceRoot,
+      workspaceHash: createHash2("sha256").update(workspaceRoot).digest("hex"),
+      logicalDirectory,
+      uid,
+      warnings
+    };
+  } catch {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSAFE_STATE_ROOT] };
+  }
+}
+async function ensureTrustedDirectory(options) {
+  const realRoot = await realpath2(options.root);
+  assertSafeDirectory(realRoot, options.uid, await lstat(realRoot));
+  if (options.workspaceRoot && isPathWithin(realRoot, options.workspaceRoot)) {
+    throw new Error("trusted directory resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(realRoot, options.uid);
+  let current = realRoot;
+  for (const segment of options.segments) {
+    if (!isSafePathSegment(segment))
+      throw new Error("unsafe path segment");
+    const next = join3(current, segment);
+    let entry = await optionalLstat(next);
+    if (!entry) {
+      await createDirectory(next);
+      entry = await lstat(next);
+    }
+    assertSafeDirectory(next, options.uid, entry);
+    const realNext = await realpath2(next);
+    if (!isPathWithin(realNext, realRoot)) {
+      throw new Error("managed directory escaped trusted root");
+    }
+    if (options.workspaceRoot && isPathWithin(realNext, options.workspaceRoot)) {
+      throw new Error("managed directory resolves inside workspace");
+    }
+    current = realNext;
+  }
+  return current;
+}
+function isResolvedAuditStateRoot(resolution) {
+  return "kyosoRoot" in resolution;
+}
+function validateAuditDirectory(directory, warnings) {
+  try {
+    if (directory.trim().length === 0 || isAbsolute2(directory) || directory.split(/[\\/]+/).includes("..")) {
+      throw new Error("unsafe logical directory");
+    }
+    const normalized = normalizeRelativePath(directory);
+    if (normalized === "." || normalized.split("/").includes("..")) {
+      throw new Error("unsafe logical directory");
+    }
+    return normalized;
+  } catch {
+    warnings.push(AUDIT_WARNING_DIRECTORY_IGNORED);
+    return TRACE_DIR;
+  }
+}
+function resolveStateBaseCandidate(env) {
+  const xdgStateHome = env.XDG_STATE_HOME?.trim();
+  if (xdgStateHome && isAbsolute2(xdgStateHome)) {
+    return resolve5(xdgStateHome);
+  }
+  const home = env.HOME?.trim();
+  if (!home || !isAbsolute2(home))
+    return;
+  return join3(resolve5(home), ".local", "state");
+}
+async function ensureTrustedStateBase(options) {
+  if (isPathWithin(options.candidate, options.workspaceRoot)) {
+    throw new Error("state base is inside workspace");
+  }
+  const existing = await findExistingAncestor(options.candidate);
+  assertSafeDirectory(existing.path, options.uid, await lstat(existing.path), {
+    allowFilesystemRoot: true
+  });
+  const realExisting = await realpath2(existing.path);
+  if (isPathWithin(realExisting, options.workspaceRoot)) {
+    throw new Error("state base resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(realExisting, options.uid);
+  let current = realExisting;
+  for (const segment of existing.missingSegments) {
+    current = join3(current, segment);
+    await createDirectory(current);
+    const entry = await lstat(current);
+    assertSafeDirectory(current, options.uid, entry);
+    const realCurrent = await realpath2(current);
+    if (!isPathWithin(realCurrent, realExisting)) {
+      throw new Error("state base changed while being created");
+    }
+    if (isPathWithin(realCurrent, options.workspaceRoot)) {
+      throw new Error("state base resolves inside workspace");
+    }
+    current = realCurrent;
+  }
+  const stateBase = await realpath2(current);
+  assertSafeDirectory(stateBase, options.uid, await lstat(stateBase));
+  if (isPathWithin(stateBase, options.workspaceRoot)) {
+    throw new Error("state base resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(stateBase, options.uid);
+  return stateBase;
+}
+async function findExistingAncestor(candidate) {
+  let current = resolve5(candidate);
+  const missingSegments = [];
+  while (true) {
+    const entry = await optionalLstat(current);
+    if (entry) {
+      if (entry.isSymbolicLink() || !entry.isDirectory()) {
+        throw new Error("state base ancestor is unsafe");
+      }
+      return { path: current, missingSegments };
+    }
+    const parent = dirname3(current);
+    if (parent === current)
+      throw new Error("state base has no existing ancestor");
+    missingSegments.unshift(basename(current));
+    current = parent;
+  }
+}
+function assertSafeDirectory(path, uid, entry, options = {}) {
+  const stat = entry;
+  if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error("state directory is unsafe");
+  }
+  if (numericStatValue(stat.uid) !== uid && !(options.allowFilesystemRoot && isFilesystemRoot(path))) {
+    throw new Error("state directory owner is unsafe");
+  }
+  const mode = numericStatValue(stat.mode);
+  if ((mode & UNSAFE_DIRECTORY_MODE) !== 0) {
+    throw new Error("state directory mode is unsafe");
+  }
+}
+function numericStatValue(value) {
+  return typeof value === "number" ? value : Number(value);
+}
+function getCurrentUid(getuid) {
+  const resolveUid = getuid ?? (typeof process.getuid === "function" ? process.getuid.bind(process) : undefined);
+  try {
+    const uid = resolveUid?.();
+    return typeof uid === "number" && Number.isInteger(uid) && uid >= 0 ? uid : undefined;
+  } catch {
+    return;
+  }
+}
+function isFilesystemRoot(path) {
+  return dirname3(path) === path;
+}
+async function assertTrustedAncestorChain(path, uid) {
+  let child = path;
+  while (!isFilesystemRoot(child)) {
+    const parent = dirname3(child);
+    const [parentStat, childStat] = await Promise.all([
+      lstat(parent),
+      lstat(child)
+    ]);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
+      throw new Error("state directory ancestor is unsafe");
+    }
+    const parentMode = numericStatValue(parentStat.mode);
+    const parentUid = numericStatValue(parentStat.uid);
+    const childUid = numericStatValue(childStat.uid);
+    const parentWritableByOthers = (parentMode & UNSAFE_DIRECTORY_MODE) !== 0;
+    const stickyChildEntry = (parentMode & STICKY_DIRECTORY_MODE) !== 0 && childUid === uid;
+    if (parentUid !== uid && parentUid !== 0 || parentWritableByOthers && !stickyChildEntry) {
+      throw new Error("state directory ancestor permissions are unsafe");
+    }
+    child = parent;
+  }
+}
+function isSafePathSegment(segment) {
+  return segment.length > 0 && segment !== "." && segment !== ".." && !segment.includes("/") && !segment.includes("\\");
+}
+async function optionalLstat(path) {
+  try {
+    return await lstat(path);
+  } catch (error51) {
+    if (isMissingPathError3(error51))
+      return;
+    throw error51;
+  }
+}
+async function createDirectory(path) {
+  try {
+    await mkdir2(path, { mode: PRIVATE_DIRECTORY_MODE });
+  } catch (error51) {
+    if (!isAlreadyExistsError(error51))
+      throw error51;
+  }
+}
+function isMissingPathError3(error51) {
+  return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
+}
+function isAlreadyExistsError(error51) {
+  return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "EEXIST";
+}
+
+// src/audit/safeTraceFile.ts
+import { constants } from "node:fs";
+import { lstat as lstat2, open, realpath as realpath3, stat } from "node:fs/promises";
+import { join as join4 } from "node:path";
+var AUDIT_WARNING_UNSUPPORTED_OPEN_CAPABILITY = "AUDIT_DISABLED_UNSUPPORTED_CAPABILITY: Audit trace writing requires unavailable filesystem capabilities.";
+async function openVerifiedTraceFile(options) {
+  const flags = secureOpenFlags(options.openConstants);
+  if (flags === undefined)
+    throw new Error("secure open capability unavailable");
+  if (!isSafeTraceId(options.traceId))
+    throw new Error("unsafe trace id");
+  const traceDirectory = await ensureTrustedDirectory({
+    root: options.kyosoRoot,
+    segments: [
+      "workspaces",
+      options.workspaceHash,
+      ...options.logicalDirectory.split("/"),
+      options.date
+    ],
+    uid: options.uid,
+    workspaceRoot: options.workspaceRoot
+  });
+  const tracePath = join4(traceDirectory, `${options.traceId}.jsonl`);
+  if (await optionalLstat2(tracePath)) {
+    throw new Error("trace path already exists");
+  }
+  await options.beforeOpen?.(tracePath);
+  const handle = await open(tracePath, flags, 384);
+  try {
+    const [handleStat, pathStat, realTracePath] = await Promise.all([
+      handle.stat({ bigint: true }),
+      stat(tracePath, { bigint: true }),
+      realpath3(tracePath)
+    ]);
+    if (!handleStat.isFile() || !pathStat.isFile() || handleStat.dev !== pathStat.dev || handleStat.ino !== pathStat.ino || !isPathWithin(realTracePath, options.kyosoRoot)) {
+      throw new Error("trace file identity could not be verified");
+    }
+    return { handle, tracePath };
+  } catch (error51) {
+    try {
+      await handle.close();
+    } catch {}
+    throw error51;
+  }
+}
+function secureOpenFlags(provided) {
+  const openConstants = provided ?? constants;
+  const required2 = [
+    openConstants.O_CREAT,
+    openConstants.O_EXCL,
+    openConstants.O_APPEND,
+    openConstants.O_WRONLY,
+    openConstants.O_NOFOLLOW,
+    openConstants.O_NONBLOCK
+  ];
+  if (required2.some((flag) => typeof flag !== "number" || flag <= 0)) {
+    return;
+  }
+  return required2.reduce((combined, flag) => combined | flag, 0);
+}
+function isSafeTraceId(traceId) {
+  return traceId.length > 0 && traceId !== "." && traceId !== ".." && !traceId.includes("/") && !traceId.includes("\\");
+}
+async function optionalLstat2(path) {
+  try {
+    return await lstat2(path);
+  } catch (error51) {
+    if (typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT") {
+      return;
+    }
+    throw error51;
+  }
+}
+
 // src/audit/sanitize.ts
 function sanitizeForAudit(value, options = {}) {
   if (typeof value === "string")
@@ -190706,46 +191186,149 @@ function sanitizeForAudit(value, options = {}) {
 }
 
 // src/audit/trace.ts
+var AUDIT_WARNING_WRITE_FAILED = "AUDIT_WRITE_FAILED: Audit trace writing failed; no further audit events will be written.";
+var AUDIT_WARNING_FINALIZE_FAILED = "AUDIT_FINALIZE_FAILED: Audit trace close failed.";
+var AUDIT_WARNING_WRITE_AFTER_FINALIZE = "AUDIT_WRITE_AFTER_FINALIZE: Audit trace is already finalized.";
 function createTraceWriter(options) {
   const warnings = [];
-  if (!options.enabled) {
-    return {
-      warnings,
-      async write() {
-        return;
-      }
-    };
-  }
+  const warningSet = new Set;
   const date5 = new Date().toISOString().slice(0, 10);
-  const directory = validateAuditDirectory(options.directory, warnings);
-  const tracePath = join3(options.cwd, directory, date5, `${options.traceId}.jsonl`);
+  let tracePath;
+  let handle;
+  let disabled = !options.enabled;
+  let finalizing = false;
+  let finalized = false;
+  let queue = Promise.resolve();
+  let finalizePromise;
+  const addWarning = (warning) => {
+    if (warningSet.has(warning))
+      return;
+    warningSet.add(warning);
+    warnings.push(warning);
+  };
+  const closeHandle = async () => {
+    const current = handle;
+    handle = undefined;
+    if (!current)
+      return;
+    try {
+      await (options.closeHandle ?? defaultCloseHandle)(current);
+    } catch {
+      addWarning(AUDIT_WARNING_FINALIZE_FAILED);
+    }
+  };
+  const disableAfterWriteFailure = async () => {
+    disabled = true;
+    addWarning(AUDIT_WARNING_WRITE_FAILED);
+    await closeHandle();
+  };
+  const openIfNeeded = async () => {
+    if (handle || disabled)
+      return;
+    if (secureOpenFlags(options.openConstants) === undefined) {
+      disabled = true;
+      addWarning(AUDIT_WARNING_UNSUPPORTED_OPEN_CAPABILITY);
+      return;
+    }
+    const stateRoot = await resolveAuditStateRoot({
+      cwd: options.cwd,
+      directory: options.directory,
+      env: options.env,
+      platform: options.platform,
+      getuid: options.getuid
+    });
+    for (const warning of stateRoot.warnings)
+      addWarning(warning);
+    if (!isResolvedAuditStateRoot(stateRoot)) {
+      disabled = true;
+      return;
+    }
+    try {
+      const opened = await openVerifiedTraceFile({
+        kyosoRoot: stateRoot.kyosoRoot,
+        workspaceHash: stateRoot.workspaceHash,
+        logicalDirectory: stateRoot.logicalDirectory,
+        date: date5,
+        traceId: options.traceId,
+        uid: stateRoot.uid,
+        workspaceRoot: stateRoot.workspaceRoot,
+        openConstants: options.openConstants,
+        beforeOpen: options.beforeOpen
+      });
+      handle = opened.handle;
+      tracePath = opened.tracePath;
+    } catch {
+      disabled = true;
+      addWarning(AUDIT_WARNING_WRITE_FAILED);
+    }
+  };
+  const writeOne = async (event) => {
+    if (disabled)
+      return;
+    try {
+      await openIfNeeded();
+      if (disabled || !handle)
+        return;
+      const line = Buffer.from(`${JSON.stringify(sanitizeForAudit(event, {
+        includeRawAgentOutput: options.includeRawAgentOutput
+      }))}
+`, "utf8");
+      await writeFully(handle, line, options.writeChunk);
+    } catch {
+      await disableAfterWriteFailure();
+    }
+  };
   return {
-    tracePath,
+    get tracePath() {
+      return tracePath;
+    },
     warnings,
-    async write(event) {
-      try {
-        await mkdir2(dirname3(tracePath), { recursive: true });
-        await appendFile(tracePath, `${JSON.stringify(sanitizeForAudit(event, {
-          includeRawAgentOutput: options.includeRawAgentOutput
-        }))}
-`, "utf8");
-      } catch (error51) {
-        warnings.push(`Audit write failed: ${error51 instanceof Error ? error51.message : String(error51)}`);
-      }
+    write(event) {
+      if (finalizing || finalized) {
+        addWarning(AUDIT_WARNING_WRITE_AFTER_FINALIZE);
+        return Promise.resolve();
+      }
+      const task = queue.then(() => writeOne(event));
+      queue = task.catch(async () => {
+        await disableAfterWriteFailure();
+      });
+      return task.catch(() => {
+        return;
+      });
+    },
+    finalize() {
+      if (finalizePromise)
+        return finalizePromise;
+      finalizing = true;
+      finalizePromise = queue.then(async () => {
+        await closeHandle();
+        finalized = true;
+      }).catch(() => {
+        disabled = true;
+        addWarning(AUDIT_WARNING_FINALIZE_FAILED);
+        finalized = true;
+      });
+      return finalizePromise;
     }
   };
 }
-function validateAuditDirectory(directory, warnings) {
-  try {
-    if (isAbsolute2(directory) || directory.split(/[\\/]+/).includes("..")) {
-      throw new Error("unsafe path");
+async function writeFully(handle, buffer, writeChunk) {
+  let offset = 0;
+  while (offset < buffer.byteLength) {
+    const bytesWritten = await (writeChunk ?? defaultWriteChunk)(handle, buffer, offset);
+    if (!Number.isInteger(bytesWritten) || bytesWritten <= 0) {
+      throw new Error("partial audit write could not advance");
     }
-    return normalizeRelativePath(directory);
-  } catch {
-    warnings.push(`Unsafe audit directory ignored: ${directory}`);
-    return ".kyoso/traces";
+    offset += bytesWritten;
   }
 }
+async function defaultWriteChunk(handle, buffer, offset) {
+  const { bytesWritten } = await handle.write(buffer, offset, buffer.byteLength - offset, null);
+  return bytesWritten;
+}
+async function defaultCloseHandle(handle) {
+  await handle.close();
+}
 
 // src/context/truncate.ts
 function truncateUtf8(input, maxBytes) {
@@ -191019,7 +191602,7 @@ function parseJudgeOutput(text, fallbackSummaryText) {
   const parsed = JSON.parse(json2);
   const summaryText = typeof parsed.summaryText === "string" && parsed.summaryText.trim().length > 0 ? sanitizeText(parsed.summaryText) : fallbackSummaryText;
   const disagreementComments = Array.isArray(parsed.disagreementComments) ? parsed.disagreementComments.flatMap((item) => {
-    if (!isRecord6(item) || typeof item.topic !== "string" || typeof item.judgeComment !== "string") {
+    if (!isRecord7(item) || typeof item.topic !== "string" || typeof item.judgeComment !== "string") {
       return [];
     }
     return [
@@ -191035,7 +191618,7 @@ function parseJudgeOutput(text, fallbackSummaryText) {
   return { summaryText, disagreementComments, analysis };
 }
 function parseAnalysis(value) {
-  if (!isRecord6(value))
+  if (!isRecord7(value))
     return;
   if (!Array.isArray(value.blindSpots) || !Array.isArray(value.contradictions) || !Array.isArray(value.partialCoverage)) {
     return;
@@ -191043,7 +191626,7 @@ function parseAnalysis(value) {
   return {
     blindSpots: value.blindSpots.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => typeof item === "string" ? [sanitizeAnalysisText(item)] : []),
     contradictions: value.contradictions.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => {
-      if (!isRecord6(item) || typeof item.topic !== "string" || typeof item.detail !== "string") {
+      if (!isRecord7(item) || typeof item.topic !== "string" || typeof item.detail !== "string") {
         return [];
       }
       return [
@@ -191054,7 +191637,7 @@ function parseAnalysis(value) {
       ];
     }),
     partialCoverage: value.partialCoverage.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => {
-      if (!isRecord6(item) || typeof item.note !== "string")
+      if (!isRecord7(item) || typeof item.note !== "string")
         return [];
       const findingId = typeof item.findingId === "string" ? sanitizeAnalysisText(item.findingId) : undefined;
       return [
@@ -191101,7 +191684,7 @@ function extractFirstJsonObject2(text) {
   }
   return;
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -191437,12 +192020,12 @@ function decide(input) {
 
 // src/workspace/createSnapshot.ts
 import { chmod, mkdir as mkdir3, mkdtemp, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4, join as join4 } from "node:path";
+import { dirname as dirname4, join as join5 } from "node:path";
 import { tmpdir } from "node:os";
 async function createSnapshot(traceId, tool, request, options = {}) {
-  const root = await mkdtemp(join4(tmpdir(), `kyoso-${traceId}-`));
-  const repoDir = join4(root, "repo");
-  const contextDir = join4(root, "context");
+  const root = await mkdtemp(join5(tmpdir(), `kyoso-${traceId}-`));
+  const repoDir = join5(root, "repo");
+  const contextDir = join5(root, "context");
   await mkdir3(repoDir, { recursive: true });
   await mkdir3(contextDir, { recursive: true });
   let fileCount = 0;
@@ -191452,7 +192035,7 @@ async function createSnapshot(traceId, tool, request, options = {}) {
       continue;
     if (!isAllowedPath(relative2, options.allowPatterns ?? []))
       continue;
-    const dest = join4(repoDir, relative2);
+    const dest = join5(repoDir, relative2);
     await mkdir3(dirname4(dest), { recursive: true });
     await writeFile2(dest, file2.content, "utf8");
     await chmod(dest, 292).catch(() => {
@@ -191460,16 +192043,16 @@ async function createSnapshot(traceId, tool, request, options = {}) {
     });
     fileCount += 1;
   }
-  await writeFile2(join4(contextDir, "request.json"), JSON.stringify(stripContents(request), null, 2), "utf8");
-  await writeFile2(join4(contextDir, "selected_files_manifest.json"), JSON.stringify(buildSelectedFilesManifest(request), null, 2), "utf8");
-  await writeFile2(join4(contextDir, "instructions.codex.md"), buildAgentPrompt(tool, request, "codex", options.agentRoles?.codex ?? "implementation_reviewer"), "utf8");
-  await writeFile2(join4(contextDir, "instructions.claude.md"), buildAgentPrompt(tool, request, "claude", options.agentRoles?.claude ?? "architecture_security_reviewer"), "utf8");
+  await writeFile2(join5(contextDir, "request.json"), JSON.stringify(stripContents(request), null, 2), "utf8");
+  await writeFile2(join5(contextDir, "selected_files_manifest.json"), JSON.stringify(buildSelectedFilesManifest(request), null, 2), "utf8");
+  await writeFile2(join5(contextDir, "instructions.codex.md"), buildAgentPrompt(tool, request, "codex", options.agentRoles?.codex ?? "implementation_reviewer"), "utf8");
+  await writeFile2(join5(contextDir, "instructions.claude.md"), buildAgentPrompt(tool, request, "claude", options.agentRoles?.claude ?? "architecture_security_reviewer"), "utf8");
   if (request.repoSummary)
-    await writeFile2(join4(contextDir, "repo_summary.md"), request.repoSummary, "utf8");
+    await writeFile2(join5(contextDir, "repo_summary.md"), request.repoSummary, "utf8");
   if (request.currentPlan)
-    await writeFile2(join4(contextDir, "current_plan.md"), request.currentPlan, "utf8");
+    await writeFile2(join5(contextDir, "current_plan.md"), request.currentPlan, "utf8");
   if (request.diff?.unifiedDiff)
-    await writeFile2(join4(contextDir, "diff.patch"), request.diff.unifiedDiff, "utf8");
+    await writeFile2(join5(contextDir, "diff.patch"), request.diff.unifiedDiff, "utf8");
   return { root, repoDir, contextDir, fileCount };
 }
 function stripContents(request) {
@@ -191559,7 +192142,7 @@ function parseVerificationVerdicts(rawText) {
     if (!Array.isArray(parsed.verdicts))
       return;
     return parsed.verdicts.flatMap((item) => {
-      if (!isRecord7(item))
+      if (!isRecord8(item))
         return [];
       if (typeof item.findingId !== "string")
         return [];
@@ -191637,7 +192220,7 @@ function verificationNote(reasoning) {
 function isVerdict(value) {
   return value === "confirmed" || value === "refuted" || value === "uncertain";
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -191646,47 +192229,54 @@ async function runReview(tool, request, options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const traceId = newTraceId();
   const startedAt = new Date().toISOString();
+  const auditEnv = { ...process.env, ...options.env };
+  const traceWriterFactory = options.traceWriterFactory ?? createTraceWriter;
   let snapshot;
   try {
     assertNotChildAgent(options.env ?? process.env);
   } catch (error51) {
     if (error51 instanceof KyosoRequestError) {
       const config2 = kyosoConfigSchema.parse(defaultConfig);
-      const trace2 = createTraceWriter({
+      const trace2 = traceWriterFactory({
         enabled: config2.audit.enabled,
         directory: config2.audit.directory,
         traceId,
-        cwd
-      });
-      await trace2.write({
-        type: "request_received",
-        traceId,
-        tool,
-        timestamp: new Date().toISOString()
-      });
-      return await buildPolicyBlockResult({
-        tool,
-        trace: trace2,
-        traceId,
-        startedAt,
-        networkMode: config2.network.defaultMode,
-        warning: error51.message,
-        finding: {
-          id: "KYOSO-1",
-          severity: "critical",
-          category: "other",
-          title: "Recursive Kyoso invocation blocked",
-          evidence: error51.message,
-          recommendation: "Do not expose Kyoso MCP tools to Kyoso child agents.",
-          sourceAgents: ["kyoso_policy"],
-          confidence: "high"
-        },
-        redactionsApplied: 0
+        cwd,
+        env: auditEnv
       });
+      try {
+        await trace2.write({
+          type: "request_received",
+          traceId,
+          tool,
+          timestamp: new Date().toISOString()
+        });
+        return await buildPolicyBlockResult({
+          tool,
+          trace: trace2,
+          traceId,
+          startedAt,
+          networkMode: config2.network.defaultMode,
+          warning: error51.message,
+          finding: {
+            id: "KYOSO-1",
+            severity: "critical",
+            category: "other",
+            title: "Recursive Kyoso invocation blocked",
+            evidence: error51.message,
+            recommendation: "Do not expose Kyoso MCP tools to Kyoso child agents.",
+            sourceAgents: ["kyoso_policy"],
+            confidence: "high"
+          },
+          redactionsApplied: 0
+        });
+      } finally {
+        await trace2.finalize();
+      }
     }
     throw error51;
   }
-  const loaded = options.config !== undefined ? {
+  const baseLoaded = options.config !== undefined ? {
     config: options.config,
     configHash: options.configHash,
     configTrustStatus: "trusted",
@@ -191703,12 +192293,17 @@ async function runReview(tool, request, options = {}) {
     env: options.env,
     trustPrompt: options.trustPrompt
   });
-  const trace = createTraceWriter({
+  const loaded = options.configOverrides && options.configOverrides.length > 0 ? {
+    ...baseLoaded,
+    config: applyConfigOverrides(baseLoaded.config, options.configOverrides)
+  } : baseLoaded;
+  const trace = traceWriterFactory({
     enabled: loaded.config.audit.enabled,
     directory: loaded.config.audit.directory,
     traceId,
     cwd,
-    includeRawAgentOutput: loaded.config.audit.includeRawAgentOutput
+    includeRawAgentOutput: loaded.config.audit.includeRawAgentOutput,
+    env: auditEnv
   });
   const warnings = [...loaded.warnings, ...trace.warnings];
   try {
@@ -191790,11 +192385,11 @@ async function runReview(tool, request, options = {}) {
       manager,
       trace
     });
-    warnings.push(...agentResults.flatMap((result2) => (result2.warnings ?? []).map((warning) => `Agent ${result2.agent} ${warning}`)));
+    warnings.push(...agentResults.flatMap((result) => (result.warnings ?? []).map((warning) => `Agent ${result.agent} ${warning}`)));
     const normalizedAgentResults = agentResults.map(normalizeAgentRunResult);
-    const agentsUsed = normalizedAgentResults.map((result2) => result2.agent);
+    const agentsUsed = normalizedAgentResults.map((result) => result.agent);
     const reviewMode = agentsUsed.length === 1 ? "single_agent" : "multi_agent";
-    const completed = normalizedAgentResults.filter((result2) => result2.status === "completed");
+    const completed = normalizedAgentResults.filter((result) => result.status === "completed");
     const degraded = completed.length !== agentResults.length;
     let aggregate = aggregateAgentResults(normalizedAgentResults, {
       reviewMode
@@ -191821,7 +192416,7 @@ async function runReview(tool, request, options = {}) {
             severity: "critical",
             category: "other",
             title: "All backend agents failed",
-            evidence: normalizedAgentResults.map((result2) => `${result2.agent}: ${result2.error?.code ?? result2.status}`).join("; "),
+            evidence: normalizedAgentResults.map((result) => `${result.agent}: ${result.error?.code ?? result.status}`).join("; "),
             recommendation: "Run kyoso doctor and retry after agent authentication or adapter issues are fixed.",
             sourceAgents: ["kyoso_policy"],
             confidence: "high"
@@ -191871,7 +192466,7 @@ async function runReview(tool, request, options = {}) {
       residualRisks: tool === "security_review" && aggregate.residualRisks.length === 0 ? [
         "No residual risks were reported by completed agents; verify security assumptions before release."
       ] : aggregate.residualRisks,
-      agentOpinions: normalizedAgentResults.map((result2) => agentOpinionSummary(result2, request.options?.includeAgentRawOutputs === true)),
+      agentOpinions: normalizedAgentResults.map((result) => agentOpinionSummary(result, request.options?.includeAgentRawOutputs === true)),
       audit: {
         traceId,
         startedAt,
@@ -191903,15 +192498,10 @@ async function runReview(tool, request, options = {}) {
       judgeComment: judgeComments.get(disagreement.topic) ?? disagreement.judgeComment
     }));
     const crossModelAnalysis = buildCrossModelAnalysis(judge, reviewMode);
-    const result = {
+    const resultAfterJudge = {
       ...resultWithoutMarkdown,
       disagreements,
-      ...crossModelAnalysis ? { crossModelAnalysis } : {},
-      summaryMarkdown: renderMarkdownResult(tool, {
-        ...resultWithoutMarkdown,
-        disagreements,
-        ...crossModelAnalysis ? { crossModelAnalysis } : {}
-      }, { summaryText: judge.output.summaryText })
+      ...crossModelAnalysis ? { crossModelAnalysis } : {}
     };
     const judgeEvent = {
       type: "judge_completed",
@@ -191923,7 +192513,7 @@ async function runReview(tool, request, options = {}) {
     if (judge.error)
       judgeEvent.error = judge.error;
     await trace.write(judgeEvent);
-    result.audit.completedAt = new Date().toISOString();
+    resultAfterJudge.audit.completedAt = new Date().toISOString();
     await trace.write({
       type: "decision_completed",
       traceId,
@@ -191935,8 +192525,14 @@ async function runReview(tool, request, options = {}) {
       traceId,
       timestamp: new Date().toISOString()
     });
-    return result;
+    return await finalizeReviewResult({
+      tool,
+      trace,
+      result: resultAfterJudge,
+      summaryText: judge.output.summaryText
+    });
   } finally {
+    await trace.finalize();
     if (snapshot)
       await cleanupSnapshot(snapshot.root);
   }
@@ -192185,10 +192781,6 @@ async function buildSecretBlockResult(input) {
       warnings: input.warnings
     }
   };
-  const result = {
-    ...resultWithoutMarkdown,
-    summaryMarkdown: renderMarkdownResult(input.tool, resultWithoutMarkdown)
-  };
   await input.trace.write({
     type: "decision_completed",
     traceId: input.traceId,
@@ -192200,7 +192792,11 @@ async function buildSecretBlockResult(input) {
     traceId: input.traceId,
     timestamp: new Date().toISOString()
   });
-  return result;
+  return await finalizeReviewResult({
+    tool: input.tool,
+    trace: input.trace,
+    result: resultWithoutMarkdown
+  });
 }
 function buildSecretFinding(secretScan, options) {
   return {
@@ -192250,10 +192846,6 @@ async function buildPolicyBlockResult(input) {
       warnings: [input.warning]
     }
   };
-  const result = {
-    ...resultWithoutMarkdown,
-    summaryMarkdown: renderMarkdownResult(input.tool, resultWithoutMarkdown)
-  };
   await input.trace.write({
     type: "decision_completed",
     traceId: input.traceId,
@@ -192265,7 +192857,30 @@ async function buildPolicyBlockResult(input) {
     traceId: input.traceId,
     timestamp: new Date().toISOString()
   });
-  return result;
+  return await finalizeReviewResult({
+    tool: input.tool,
+    trace: input.trace,
+    result: resultWithoutMarkdown
+  });
+}
+async function finalizeReviewResult(input) {
+  await input.trace.finalize();
+  const result = {
+    ...input.result,
+    audit: {
+      ...input.result.audit,
+      warnings: Array.from(new Set([
+        ...input.result.audit.warnings ?? [],
+        ...input.trace.warnings
+      ]))
+    }
+  };
+  return {
+    ...result,
+    summaryMarkdown: renderMarkdownResult(input.tool, result, {
+      summaryText: input.summaryText
+    })
+  };
 }
 function mergeDenyPatterns(configDeny, requestDeny) {
   return Array.from(new Set([...configDeny, ...requestDeny ?? []]));
@@ -192273,7 +192888,7 @@ function mergeDenyPatterns(configDeny, requestDeny) {
 function assertTrustedWorkspaceRoot(requestRoot, configRoot, cwd) {
   if (!requestRoot)
     return;
-  if (resolve4(cwd, requestRoot) !== resolve4(cwd, configRoot)) {
+  if (resolve6(cwd, requestRoot) !== resolve6(cwd, configRoot)) {
     throw new KyosoRequestError("workspace.root is not trusted by config", "UNTRUSTED_WORKSPACE_ROOT");
   }
 }