@kyo-so/cli 0.8.0 → 0.9.0

package/dist/index.js

@@ -169498,7 +169498,7 @@ function defineConfig(config) {
   return config;
 }
 // src/core/runReview.ts
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 
 // node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -184261,6 +184261,7 @@ var REDACTION = "[KYOSO_REDACTED]";
 // src/core/constants.ts
 var DEFAULT_AGENT_TIMEOUT_MS = 120000;
 var RAW_OUTPUT_MAX_CHARS = 16384;
+var TRACE_DIR = ".kyoso/traces";
 var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
 
 // src/security/sanitizeText.ts
@@ -185721,6 +185722,48 @@ function requiredDefaultOnError(schema, fallback) {
     return exports_external.NEVER;
   });
 }
+function stringTag(value, key) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return;
+  }
+  const tag = value[key];
+  return typeof tag === "string" ? tag : undefined;
+}
+function excludeKnownTags(schema, key, knownTags) {
+  return schema.superRefine((value, context) => {
+    const tag = stringTag(value, key);
+    if (tag !== undefined && knownTags.includes(tag)) {
+      context.addIssue({
+        code: "custom",
+        path: [key],
+        message: `${key} ${JSON.stringify(tag)} is reserved by a known variant, ` + `but the value does not match that variant's schema`
+      });
+    }
+  });
+}
+function preserveCustomPayload(schema, key, knownTags) {
+  return exports_external.unknown().transform((value, context) => {
+    const result = schema.safeParse(value);
+    if (!result.success) {
+      for (const issue2 of result.error.issues) {
+        context.addIssue({ ...issue2, input: value });
+      }
+      return exports_external.NEVER;
+    }
+    const output = result.data;
+    const tag = stringTag(value, key);
+    if (tag !== undefined && !knownTags.includes(tag)) {
+      const raw = value;
+      for (const [property, rawValue] of Object.entries(raw)) {
+        if (property === "__proto__")
+          continue;
+        if (!Object.hasOwn(output, property))
+          output[property] = rawValue;
+      }
+    }
+    return output;
+  });
+}
 function vecSkipError(itemSchema) {
   return exports_external.array(itemSchema.catch(skippedItem)).transform((items) => items.filter((item) => item !== skippedItem));
 }
@@ -186144,15 +186187,15 @@ var zTitledMultiSelectItems = object({
     return;
   })
 });
-var zMultiSelectItems = union([
+var zMultiSelectItems = preserveCustomPayload(union([
   zStringMultiSelectItems.and(object({
     type: literal("string")
   })),
-  object({
+  excludeKnownTags(object({
     type: string2()
-  }),
+  }), "type", ["string"]),
   zTitledMultiSelectItems
-]);
+]), "type", ["string"]);
 var zMultiSelectPropertySchema = object({
   title: defaultOnError(string2().nullish(), () => {
     return;
@@ -186170,7 +186213,7 @@ var zMultiSelectPropertySchema = object({
     return;
   })
 });
-var zElicitationPropertySchema = union([
+var zElicitationPropertySchema = preserveCustomPayload(union([
   zStringPropertySchema.and(object({
     type: literal("string")
   })),
@@ -186186,10 +186229,10 @@ var zElicitationPropertySchema = union([
   zMultiSelectPropertySchema.and(object({
     type: literal("array")
   })),
-  object({
+  excludeKnownTags(object({
     type: string2()
-  })
-]);
+  }), "type", ["array", "boolean", "integer", "number", "string"])
+]), "type", ["array", "boolean", "integer", "number", "string"]);
 var zElicitationSchema = object({
   type: defaultOnError(zElicitationSchemaType.optional().default("object"), () => "object"),
   title: defaultOnError(string2().nullish(), () => {
@@ -186212,22 +186255,22 @@ var zElicitationUrlMode = intersection(union([zElicitationSessionScope, zElicita
   elicitationId: zElicitationId,
   url: url()
 }));
-var zCreateElicitationRequest = intersection(union([
+var zCreateElicitationRequest = preserveCustomPayload(intersection(union([
   zElicitationFormMode.and(object({
     mode: literal("form")
   })),
   zElicitationUrlMode.and(object({
     mode: literal("url")
   })),
-  intersection(union([zElicitationSessionScope, zElicitationRequestScope]), object({
+  excludeKnownTags(intersection(union([zElicitationSessionScope, zElicitationRequestScope]), object({
     mode: string2()
-  }))
+  })), "mode", ["form", "url"])
 ]), object({
   message: string2(),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
-}));
+})), "mode", ["form", "url"]);
 var zMcpServerAcpId = string2();
 var zConnectMcpRequest = object({
   serverId: zMcpServerAcpId,
@@ -187827,7 +187870,7 @@ var zElicitationContentValue = union([
 var zElicitationAcceptAction = object({
   content: record(string2(), zElicitationContentValue).nullish()
 });
-var zCreateElicitationResponse = intersection(union([
+var zCreateElicitationResponse = preserveCustomPayload(intersection(union([
   zElicitationAcceptAction.and(object({
     action: literal("accept")
   })),
@@ -187837,14 +187880,14 @@ var zCreateElicitationResponse = intersection(union([
   object({
     action: literal("cancel")
   }),
-  object({
+  excludeKnownTags(object({
     action: string2()
-  })
+  }), "action", ["accept", "cancel", "decline"])
 ]), object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
-}));
+})), "action", ["accept", "cancel", "decline"]);
 var zConnectMcpResponse = object({
   connectionId: zMcpConnectionId,
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
@@ -187980,6 +188023,24 @@ var zCancelRequestNotification = object({
     return;
   })
 });
+
+// node_modules/@agentclientprotocol/sdk/dist/schema/guards.gen.js
+var zGuardCreateElicitationRequestForm = zElicitationFormMode.and(object({ mode: literal("form") })).and(object({ message: string2() }));
+var zGuardCreateElicitationRequestUrl = zElicitationUrlMode.and(object({ mode: literal("url") })).and(object({ message: string2() }));
+var zGuardCreateElicitationRequestCustom = union([zElicitationSessionScope, zElicitationRequestScope]).and(object({ message: string2() }));
+var zGuardElicitationPropertySchemaString = zStringPropertySchema.and(object({ type: literal("string") }));
+var zGuardElicitationPropertySchemaNumber = zNumberPropertySchema.and(object({ type: literal("number") }));
+var zGuardElicitationPropertySchemaInteger = zIntegerPropertySchema.and(object({ type: literal("integer") }));
+var zGuardElicitationPropertySchemaBoolean = zBooleanPropertySchema.and(object({ type: literal("boolean") }));
+var zGuardElicitationPropertySchemaArray = zMultiSelectPropertySchema.and(object({ type: literal("array") }));
+var zGuardMultiSelectItemsString = zStringMultiSelectItems.and(object({ type: literal("string") }));
+var zGuardCreateElicitationResponseAccept = zElicitationAcceptAction.and(object({ action: literal("accept") }));
+var zGuardCreateElicitationResponseDecline = object({
+  action: literal("decline")
+});
+var zGuardCreateElicitationResponseCancel = object({
+  action: literal("cancel")
+});
 // node_modules/@agentclientprotocol/sdk/dist/jsonrpc.js
 var CANCEL_REQUEST_METHOD = "$/cancel_request";
 function isRecord5(value) {
@@ -190721,9 +190782,10 @@ function normalizeTitle(value) {
   return value.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim();
 }
 
-// src/audit/trace.ts
-import { mkdir as mkdir2, appendFile } from "node:fs/promises";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3 } from "node:path";
+// src/audit/stateRoot.ts
+import { createHash as createHash2 } from "node:crypto";
+import { lstat, mkdir as mkdir2, realpath as realpath2 } from "node:fs/promises";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute2, join as join3, resolve as resolve5 } from "node:path";
 
 // src/context/pathPolicy.ts
 import { normalize, sep } from "node:path";
@@ -190785,6 +190847,325 @@ function matchesPathPattern(path, patterns, mode) {
   });
 }
 
+// src/utils/pathContainment.ts
+import { resolve as resolve4, sep as sep2 } from "node:path";
+function isPathWithin(candidate, root) {
+  const resolvedCandidate = resolve4(candidate);
+  const resolvedRoot = resolve4(root);
+  const boundary = resolvedRoot.endsWith(sep2) ? resolvedRoot : `${resolvedRoot}${sep2}`;
+  return resolvedCandidate === resolvedRoot || resolvedCandidate.startsWith(boundary);
+}
+
+// src/audit/stateRoot.ts
+var PRIVATE_DIRECTORY_MODE = 448;
+var UNSAFE_DIRECTORY_MODE = 18;
+var STICKY_DIRECTORY_MODE = 512;
+var AUDIT_WARNING_DIRECTORY_IGNORED = "AUDIT_DIRECTORY_IGNORED: Audit directory is invalid; using the default logical directory.";
+var AUDIT_WARNING_UNSUPPORTED_PLATFORM = "AUDIT_DISABLED_UNSUPPORTED_PLATFORM: Audit trace writing is unavailable on this platform.";
+var AUDIT_WARNING_UNSUPPORTED_CAPABILITY = "AUDIT_DISABLED_UNSUPPORTED_CAPABILITY: Audit trace writing requires unavailable filesystem capabilities.";
+var AUDIT_WARNING_UNSAFE_STATE_ROOT = "AUDIT_DISABLED_UNSAFE_STATE_ROOT: Audit state root could not be verified.";
+async function resolveAuditStateRoot(options) {
+  const warnings = [];
+  const logicalDirectory = validateAuditDirectory(options.directory, warnings);
+  const platform = options.platform ?? process.platform;
+  if (platform === "win32") {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSUPPORTED_PLATFORM] };
+  }
+  const uid = getCurrentUid(options.getuid);
+  if (uid === undefined) {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSUPPORTED_CAPABILITY] };
+  }
+  try {
+    const workspaceRoot = await realpath2(resolve5(options.cwd));
+    const candidate = resolveStateBaseCandidate(options.env ?? process.env);
+    if (!candidate)
+      throw new Error("missing trusted state base");
+    const stateBase = await ensureTrustedStateBase({
+      candidate,
+      workspaceRoot,
+      uid
+    });
+    const kyosoRoot = await ensureTrustedDirectory({
+      root: stateBase,
+      segments: ["kyoso"],
+      uid,
+      workspaceRoot
+    });
+    return {
+      stateBase,
+      kyosoRoot,
+      workspaceRoot,
+      workspaceHash: createHash2("sha256").update(workspaceRoot).digest("hex"),
+      logicalDirectory,
+      uid,
+      warnings
+    };
+  } catch {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSAFE_STATE_ROOT] };
+  }
+}
+async function ensureTrustedDirectory(options) {
+  const realRoot = await realpath2(options.root);
+  assertSafeDirectory(realRoot, options.uid, await lstat(realRoot));
+  if (options.workspaceRoot && isPathWithin(realRoot, options.workspaceRoot)) {
+    throw new Error("trusted directory resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(realRoot, options.uid);
+  let current = realRoot;
+  for (const segment of options.segments) {
+    if (!isSafePathSegment(segment))
+      throw new Error("unsafe path segment");
+    const next = join3(current, segment);
+    let entry = await optionalLstat(next);
+    if (!entry) {
+      await createDirectory(next);
+      entry = await lstat(next);
+    }
+    assertSafeDirectory(next, options.uid, entry);
+    const realNext = await realpath2(next);
+    if (!isPathWithin(realNext, realRoot)) {
+      throw new Error("managed directory escaped trusted root");
+    }
+    if (options.workspaceRoot && isPathWithin(realNext, options.workspaceRoot)) {
+      throw new Error("managed directory resolves inside workspace");
+    }
+    current = realNext;
+  }
+  return current;
+}
+function isResolvedAuditStateRoot(resolution) {
+  return "kyosoRoot" in resolution;
+}
+function validateAuditDirectory(directory, warnings) {
+  try {
+    if (directory.trim().length === 0 || isAbsolute2(directory) || directory.split(/[\\/]+/).includes("..")) {
+      throw new Error("unsafe logical directory");
+    }
+    const normalized = normalizeRelativePath(directory);
+    if (normalized === "." || normalized.split("/").includes("..")) {
+      throw new Error("unsafe logical directory");
+    }
+    return normalized;
+  } catch {
+    warnings.push(AUDIT_WARNING_DIRECTORY_IGNORED);
+    return TRACE_DIR;
+  }
+}
+function resolveStateBaseCandidate(env) {
+  const xdgStateHome = env.XDG_STATE_HOME?.trim();
+  if (xdgStateHome && isAbsolute2(xdgStateHome)) {
+    return resolve5(xdgStateHome);
+  }
+  const home = env.HOME?.trim();
+  if (!home || !isAbsolute2(home))
+    return;
+  return join3(resolve5(home), ".local", "state");
+}
+async function ensureTrustedStateBase(options) {
+  if (isPathWithin(options.candidate, options.workspaceRoot)) {
+    throw new Error("state base is inside workspace");
+  }
+  const existing = await findExistingAncestor(options.candidate);
+  assertSafeDirectory(existing.path, options.uid, await lstat(existing.path), {
+    allowFilesystemRoot: true
+  });
+  const realExisting = await realpath2(existing.path);
+  if (isPathWithin(realExisting, options.workspaceRoot)) {
+    throw new Error("state base resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(realExisting, options.uid);
+  let current = realExisting;
+  for (const segment of existing.missingSegments) {
+    current = join3(current, segment);
+    await createDirectory(current);
+    const entry = await lstat(current);
+    assertSafeDirectory(current, options.uid, entry);
+    const realCurrent = await realpath2(current);
+    if (!isPathWithin(realCurrent, realExisting)) {
+      throw new Error("state base changed while being created");
+    }
+    if (isPathWithin(realCurrent, options.workspaceRoot)) {
+      throw new Error("state base resolves inside workspace");
+    }
+    current = realCurrent;
+  }
+  const stateBase = await realpath2(current);
+  assertSafeDirectory(stateBase, options.uid, await lstat(stateBase));
+  if (isPathWithin(stateBase, options.workspaceRoot)) {
+    throw new Error("state base resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(stateBase, options.uid);
+  return stateBase;
+}
+async function findExistingAncestor(candidate) {
+  let current = resolve5(candidate);
+  const missingSegments = [];
+  while (true) {
+    const entry = await optionalLstat(current);
+    if (entry) {
+      if (entry.isSymbolicLink() || !entry.isDirectory()) {
+        throw new Error("state base ancestor is unsafe");
+      }
+      return { path: current, missingSegments };
+    }
+    const parent = dirname3(current);
+    if (parent === current)
+      throw new Error("state base has no existing ancestor");
+    missingSegments.unshift(basename(current));
+    current = parent;
+  }
+}
+function assertSafeDirectory(path, uid, entry, options = {}) {
+  const stat = entry;
+  if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error("state directory is unsafe");
+  }
+  if (numericStatValue(stat.uid) !== uid && !(options.allowFilesystemRoot && isFilesystemRoot(path))) {
+    throw new Error("state directory owner is unsafe");
+  }
+  const mode = numericStatValue(stat.mode);
+  if ((mode & UNSAFE_DIRECTORY_MODE) !== 0) {
+    throw new Error("state directory mode is unsafe");
+  }
+}
+function numericStatValue(value) {
+  return typeof value === "number" ? value : Number(value);
+}
+function getCurrentUid(getuid) {
+  const resolveUid = getuid ?? (typeof process.getuid === "function" ? process.getuid.bind(process) : undefined);
+  try {
+    const uid = resolveUid?.();
+    return typeof uid === "number" && Number.isInteger(uid) && uid >= 0 ? uid : undefined;
+  } catch {
+    return;
+  }
+}
+function isFilesystemRoot(path) {
+  return dirname3(path) === path;
+}
+async function assertTrustedAncestorChain(path, uid) {
+  let child = path;
+  while (!isFilesystemRoot(child)) {
+    const parent = dirname3(child);
+    const [parentStat, childStat] = await Promise.all([
+      lstat(parent),
+      lstat(child)
+    ]);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
+      throw new Error("state directory ancestor is unsafe");
+    }
+    const parentMode = numericStatValue(parentStat.mode);
+    const parentUid = numericStatValue(parentStat.uid);
+    const childUid = numericStatValue(childStat.uid);
+    const parentWritableByOthers = (parentMode & UNSAFE_DIRECTORY_MODE) !== 0;
+    const stickyChildEntry = (parentMode & STICKY_DIRECTORY_MODE) !== 0 && childUid === uid;
+    if (parentUid !== uid && parentUid !== 0 || parentWritableByOthers && !stickyChildEntry) {
+      throw new Error("state directory ancestor permissions are unsafe");
+    }
+    child = parent;
+  }
+}
+function isSafePathSegment(segment) {
+  return segment.length > 0 && segment !== "." && segment !== ".." && !segment.includes("/") && !segment.includes("\\");
+}
+async function optionalLstat(path) {
+  try {
+    return await lstat(path);
+  } catch (error51) {
+    if (isMissingPathError3(error51))
+      return;
+    throw error51;
+  }
+}
+async function createDirectory(path) {
+  try {
+    await mkdir2(path, { mode: PRIVATE_DIRECTORY_MODE });
+  } catch (error51) {
+    if (!isAlreadyExistsError(error51))
+      throw error51;
+  }
+}
+function isMissingPathError3(error51) {
+  return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
+}
+function isAlreadyExistsError(error51) {
+  return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "EEXIST";
+}
+
+// src/audit/safeTraceFile.ts
+import { constants } from "node:fs";
+import { lstat as lstat2, open, realpath as realpath3, stat } from "node:fs/promises";
+import { join as join4 } from "node:path";
+var AUDIT_WARNING_UNSUPPORTED_OPEN_CAPABILITY = "AUDIT_DISABLED_UNSUPPORTED_CAPABILITY: Audit trace writing requires unavailable filesystem capabilities.";
+async function openVerifiedTraceFile(options) {
+  const flags = secureOpenFlags(options.openConstants);
+  if (flags === undefined)
+    throw new Error("secure open capability unavailable");
+  if (!isSafeTraceId(options.traceId))
+    throw new Error("unsafe trace id");
+  const traceDirectory = await ensureTrustedDirectory({
+    root: options.kyosoRoot,
+    segments: [
+      "workspaces",
+      options.workspaceHash,
+      ...options.logicalDirectory.split("/"),
+      options.date
+    ],
+    uid: options.uid,
+    workspaceRoot: options.workspaceRoot
+  });
+  const tracePath = join4(traceDirectory, `${options.traceId}.jsonl`);
+  if (await optionalLstat2(tracePath)) {
+    throw new Error("trace path already exists");
+  }
+  await options.beforeOpen?.(tracePath);
+  const handle = await open(tracePath, flags, 384);
+  try {
+    const [handleStat, pathStat, realTracePath] = await Promise.all([
+      handle.stat({ bigint: true }),
+      stat(tracePath, { bigint: true }),
+      realpath3(tracePath)
+    ]);
+    if (!handleStat.isFile() || !pathStat.isFile() || handleStat.dev !== pathStat.dev || handleStat.ino !== pathStat.ino || !isPathWithin(realTracePath, options.kyosoRoot)) {
+      throw new Error("trace file identity could not be verified");
+    }
+    return { handle, tracePath };
+  } catch (error51) {
+    try {
+      await handle.close();
+    } catch {}
+    throw error51;
+  }
+}
+function secureOpenFlags(provided) {
+  const openConstants = provided ?? constants;
+  const required2 = [
+    openConstants.O_CREAT,
+    openConstants.O_EXCL,
+    openConstants.O_APPEND,
+    openConstants.O_WRONLY,
+    openConstants.O_NOFOLLOW,
+    openConstants.O_NONBLOCK
+  ];
+  if (required2.some((flag) => typeof flag !== "number" || flag <= 0)) {
+    return;
+  }
+  return required2.reduce((combined, flag) => combined | flag, 0);
+}
+function isSafeTraceId(traceId) {
+  return traceId.length > 0 && traceId !== "." && traceId !== ".." && !traceId.includes("/") && !traceId.includes("\\");
+}
+async function optionalLstat2(path) {
+  try {
+    return await lstat2(path);
+  } catch (error51) {
+    if (typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT") {
+      return;
+    }
+    throw error51;
+  }
+}
+
 // src/audit/sanitize.ts
 function sanitizeForAudit(value, options = {}) {
   if (typeof value === "string")
@@ -190805,46 +191186,149 @@ function sanitizeForAudit(value, options = {}) {
 }
 
 // src/audit/trace.ts
+var AUDIT_WARNING_WRITE_FAILED = "AUDIT_WRITE_FAILED: Audit trace writing failed; no further audit events will be written.";
+var AUDIT_WARNING_FINALIZE_FAILED = "AUDIT_FINALIZE_FAILED: Audit trace close failed.";
+var AUDIT_WARNING_WRITE_AFTER_FINALIZE = "AUDIT_WRITE_AFTER_FINALIZE: Audit trace is already finalized.";
 function createTraceWriter(options) {
   const warnings = [];
-  if (!options.enabled) {
-    return {
-      warnings,
-      async write() {
-        return;
-      }
-    };
-  }
+  const warningSet = new Set;
   const date5 = new Date().toISOString().slice(0, 10);
-  const directory = validateAuditDirectory(options.directory, warnings);
-  const tracePath = join3(options.cwd, directory, date5, `${options.traceId}.jsonl`);
+  let tracePath;
+  let handle;
+  let disabled = !options.enabled;
+  let finalizing = false;
+  let finalized = false;
+  let queue = Promise.resolve();
+  let finalizePromise;
+  const addWarning = (warning) => {
+    if (warningSet.has(warning))
+      return;
+    warningSet.add(warning);
+    warnings.push(warning);
+  };
+  const closeHandle = async () => {
+    const current = handle;
+    handle = undefined;
+    if (!current)
+      return;
+    try {
+      await (options.closeHandle ?? defaultCloseHandle)(current);
+    } catch {
+      addWarning(AUDIT_WARNING_FINALIZE_FAILED);
+    }
+  };
+  const disableAfterWriteFailure = async () => {
+    disabled = true;
+    addWarning(AUDIT_WARNING_WRITE_FAILED);
+    await closeHandle();
+  };
+  const openIfNeeded = async () => {
+    if (handle || disabled)
+      return;
+    if (secureOpenFlags(options.openConstants) === undefined) {
+      disabled = true;
+      addWarning(AUDIT_WARNING_UNSUPPORTED_OPEN_CAPABILITY);
+      return;
+    }
+    const stateRoot = await resolveAuditStateRoot({
+      cwd: options.cwd,
+      directory: options.directory,
+      env: options.env,
+      platform: options.platform,
+      getuid: options.getuid
+    });
+    for (const warning of stateRoot.warnings)
+      addWarning(warning);
+    if (!isResolvedAuditStateRoot(stateRoot)) {
+      disabled = true;
+      return;
+    }
+    try {
+      const opened = await openVerifiedTraceFile({
+        kyosoRoot: stateRoot.kyosoRoot,
+        workspaceHash: stateRoot.workspaceHash,
+        logicalDirectory: stateRoot.logicalDirectory,
+        date: date5,
+        traceId: options.traceId,
+        uid: stateRoot.uid,
+        workspaceRoot: stateRoot.workspaceRoot,
+        openConstants: options.openConstants,
+        beforeOpen: options.beforeOpen
+      });
+      handle = opened.handle;
+      tracePath = opened.tracePath;
+    } catch {
+      disabled = true;
+      addWarning(AUDIT_WARNING_WRITE_FAILED);
+    }
+  };
+  const writeOne = async (event) => {
+    if (disabled)
+      return;
+    try {
+      await openIfNeeded();
+      if (disabled || !handle)
+        return;
+      const line = Buffer.from(`${JSON.stringify(sanitizeForAudit(event, {
+        includeRawAgentOutput: options.includeRawAgentOutput
+      }))}
+`, "utf8");
+      await writeFully(handle, line, options.writeChunk);
+    } catch {
+      await disableAfterWriteFailure();
+    }
+  };
   return {
-    tracePath,
+    get tracePath() {
+      return tracePath;
+    },
     warnings,
-    async write(event) {
-      try {
-        await mkdir2(dirname3(tracePath), { recursive: true });
-        await appendFile(tracePath, `${JSON.stringify(sanitizeForAudit(event, {
-          includeRawAgentOutput: options.includeRawAgentOutput
-        }))}
-`, "utf8");
-      } catch (error51) {
-        warnings.push(`Audit write failed: ${error51 instanceof Error ? error51.message : String(error51)}`);
-      }
+    write(event) {
+      if (finalizing || finalized) {
+        addWarning(AUDIT_WARNING_WRITE_AFTER_FINALIZE);
+        return Promise.resolve();
+      }
+      const task = queue.then(() => writeOne(event));
+      queue = task.catch(async () => {
+        await disableAfterWriteFailure();
+      });
+      return task.catch(() => {
+        return;
+      });
+    },
+    finalize() {
+      if (finalizePromise)
+        return finalizePromise;
+      finalizing = true;
+      finalizePromise = queue.then(async () => {
+        await closeHandle();
+        finalized = true;
+      }).catch(() => {
+        disabled = true;
+        addWarning(AUDIT_WARNING_FINALIZE_FAILED);
+        finalized = true;
+      });
+      return finalizePromise;
     }
   };
 }
-function validateAuditDirectory(directory, warnings) {
-  try {
-    if (isAbsolute2(directory) || directory.split(/[\\/]+/).includes("..")) {
-      throw new Error("unsafe path");
+async function writeFully(handle, buffer, writeChunk) {
+  let offset = 0;
+  while (offset < buffer.byteLength) {
+    const bytesWritten = await (writeChunk ?? defaultWriteChunk)(handle, buffer, offset);
+    if (!Number.isInteger(bytesWritten) || bytesWritten <= 0) {
+      throw new Error("partial audit write could not advance");
     }
-    return normalizeRelativePath(directory);
-  } catch {
-    warnings.push(`Unsafe audit directory ignored: ${directory}`);
-    return ".kyoso/traces";
+    offset += bytesWritten;
   }
 }
+async function defaultWriteChunk(handle, buffer, offset) {
+  const { bytesWritten } = await handle.write(buffer, offset, buffer.byteLength - offset, null);
+  return bytesWritten;
+}
+async function defaultCloseHandle(handle) {
+  await handle.close();
+}
 
 // src/context/truncate.ts
 function truncateUtf8(input, maxBytes) {
@@ -191536,12 +192020,12 @@ function decide(input) {
 
 // src/workspace/createSnapshot.ts
 import { chmod, mkdir as mkdir3, mkdtemp, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4, join as join4 } from "node:path";
+import { dirname as dirname4, join as join5 } from "node:path";
 import { tmpdir } from "node:os";
 async function createSnapshot(traceId, tool, request, options = {}) {
-  const root = await mkdtemp(join4(tmpdir(), `kyoso-${traceId}-`));
-  const repoDir = join4(root, "repo");
-  const contextDir = join4(root, "context");
+  const root = await mkdtemp(join5(tmpdir(), `kyoso-${traceId}-`));
+  const repoDir = join5(root, "repo");
+  const contextDir = join5(root, "context");
   await mkdir3(repoDir, { recursive: true });
   await mkdir3(contextDir, { recursive: true });
   let fileCount = 0;
@@ -191551,7 +192035,7 @@ async function createSnapshot(traceId, tool, request, options = {}) {
       continue;
     if (!isAllowedPath(relative2, options.allowPatterns ?? []))
       continue;
-    const dest = join4(repoDir, relative2);
+    const dest = join5(repoDir, relative2);
     await mkdir3(dirname4(dest), { recursive: true });
     await writeFile2(dest, file2.content, "utf8");
     await chmod(dest, 292).catch(() => {
@@ -191559,16 +192043,16 @@ async function createSnapshot(traceId, tool, request, options = {}) {
     });
     fileCount += 1;
   }
-  await writeFile2(join4(contextDir, "request.json"), JSON.stringify(stripContents(request), null, 2), "utf8");
-  await writeFile2(join4(contextDir, "selected_files_manifest.json"), JSON.stringify(buildSelectedFilesManifest(request), null, 2), "utf8");
-  await writeFile2(join4(contextDir, "instructions.codex.md"), buildAgentPrompt(tool, request, "codex", options.agentRoles?.codex ?? "implementation_reviewer"), "utf8");
-  await writeFile2(join4(contextDir, "instructions.claude.md"), buildAgentPrompt(tool, request, "claude", options.agentRoles?.claude ?? "architecture_security_reviewer"), "utf8");
+  await writeFile2(join5(contextDir, "request.json"), JSON.stringify(stripContents(request), null, 2), "utf8");
+  await writeFile2(join5(contextDir, "selected_files_manifest.json"), JSON.stringify(buildSelectedFilesManifest(request), null, 2), "utf8");
+  await writeFile2(join5(contextDir, "instructions.codex.md"), buildAgentPrompt(tool, request, "codex", options.agentRoles?.codex ?? "implementation_reviewer"), "utf8");
+  await writeFile2(join5(contextDir, "instructions.claude.md"), buildAgentPrompt(tool, request, "claude", options.agentRoles?.claude ?? "architecture_security_reviewer"), "utf8");
   if (request.repoSummary)
-    await writeFile2(join4(contextDir, "repo_summary.md"), request.repoSummary, "utf8");
+    await writeFile2(join5(contextDir, "repo_summary.md"), request.repoSummary, "utf8");
   if (request.currentPlan)
-    await writeFile2(join4(contextDir, "current_plan.md"), request.currentPlan, "utf8");
+    await writeFile2(join5(contextDir, "current_plan.md"), request.currentPlan, "utf8");
   if (request.diff?.unifiedDiff)
-    await writeFile2(join4(contextDir, "diff.patch"), request.diff.unifiedDiff, "utf8");
+    await writeFile2(join5(contextDir, "diff.patch"), request.diff.unifiedDiff, "utf8");
   return { root, repoDir, contextDir, fileCount };
 }
 function stripContents(request) {
@@ -191745,43 +192229,50 @@ async function runReview(tool, request, options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const traceId = newTraceId();
   const startedAt = new Date().toISOString();
+  const auditEnv = { ...process.env, ...options.env };
+  const traceWriterFactory = options.traceWriterFactory ?? createTraceWriter;
   let snapshot;
   try {
     assertNotChildAgent(options.env ?? process.env);
   } catch (error51) {
     if (error51 instanceof KyosoRequestError) {
       const config2 = kyosoConfigSchema.parse(defaultConfig);
-      const trace2 = createTraceWriter({
+      const trace2 = traceWriterFactory({
         enabled: config2.audit.enabled,
         directory: config2.audit.directory,
         traceId,
-        cwd
-      });
-      await trace2.write({
-        type: "request_received",
-        traceId,
-        tool,
-        timestamp: new Date().toISOString()
-      });
-      return await buildPolicyBlockResult({
-        tool,
-        trace: trace2,
-        traceId,
-        startedAt,
-        networkMode: config2.network.defaultMode,
-        warning: error51.message,
-        finding: {
-          id: "KYOSO-1",
-          severity: "critical",
-          category: "other",
-          title: "Recursive Kyoso invocation blocked",
-          evidence: error51.message,
-          recommendation: "Do not expose Kyoso MCP tools to Kyoso child agents.",
-          sourceAgents: ["kyoso_policy"],
-          confidence: "high"
-        },
-        redactionsApplied: 0
+        cwd,
+        env: auditEnv
       });
+      try {
+        await trace2.write({
+          type: "request_received",
+          traceId,
+          tool,
+          timestamp: new Date().toISOString()
+        });
+        return await buildPolicyBlockResult({
+          tool,
+          trace: trace2,
+          traceId,
+          startedAt,
+          networkMode: config2.network.defaultMode,
+          warning: error51.message,
+          finding: {
+            id: "KYOSO-1",
+            severity: "critical",
+            category: "other",
+            title: "Recursive Kyoso invocation blocked",
+            evidence: error51.message,
+            recommendation: "Do not expose Kyoso MCP tools to Kyoso child agents.",
+            sourceAgents: ["kyoso_policy"],
+            confidence: "high"
+          },
+          redactionsApplied: 0
+        });
+      } finally {
+        await trace2.finalize();
+      }
     }
     throw error51;
   }
@@ -191806,12 +192297,13 @@ async function runReview(tool, request, options = {}) {
     ...baseLoaded,
     config: applyConfigOverrides(baseLoaded.config, options.configOverrides)
   } : baseLoaded;
-  const trace = createTraceWriter({
+  const trace = traceWriterFactory({
     enabled: loaded.config.audit.enabled,
     directory: loaded.config.audit.directory,
     traceId,
     cwd,
-    includeRawAgentOutput: loaded.config.audit.includeRawAgentOutput
+    includeRawAgentOutput: loaded.config.audit.includeRawAgentOutput,
+    env: auditEnv
   });
   const warnings = [...loaded.warnings, ...trace.warnings];
   try {
@@ -191893,11 +192385,11 @@ async function runReview(tool, request, options = {}) {
       manager,
       trace
     });
-    warnings.push(...agentResults.flatMap((result2) => (result2.warnings ?? []).map((warning) => `Agent ${result2.agent} ${warning}`)));
+    warnings.push(...agentResults.flatMap((result) => (result.warnings ?? []).map((warning) => `Agent ${result.agent} ${warning}`)));
     const normalizedAgentResults = agentResults.map(normalizeAgentRunResult);
-    const agentsUsed = normalizedAgentResults.map((result2) => result2.agent);
+    const agentsUsed = normalizedAgentResults.map((result) => result.agent);
     const reviewMode = agentsUsed.length === 1 ? "single_agent" : "multi_agent";
-    const completed = normalizedAgentResults.filter((result2) => result2.status === "completed");
+    const completed = normalizedAgentResults.filter((result) => result.status === "completed");
     const degraded = completed.length !== agentResults.length;
     let aggregate = aggregateAgentResults(normalizedAgentResults, {
       reviewMode
@@ -191924,7 +192416,7 @@ async function runReview(tool, request, options = {}) {
             severity: "critical",
             category: "other",
             title: "All backend agents failed",
-            evidence: normalizedAgentResults.map((result2) => `${result2.agent}: ${result2.error?.code ?? result2.status}`).join("; "),
+            evidence: normalizedAgentResults.map((result) => `${result.agent}: ${result.error?.code ?? result.status}`).join("; "),
             recommendation: "Run kyoso doctor and retry after agent authentication or adapter issues are fixed.",
             sourceAgents: ["kyoso_policy"],
             confidence: "high"
@@ -191974,7 +192466,7 @@ async function runReview(tool, request, options = {}) {
       residualRisks: tool === "security_review" && aggregate.residualRisks.length === 0 ? [
         "No residual risks were reported by completed agents; verify security assumptions before release."
       ] : aggregate.residualRisks,
-      agentOpinions: normalizedAgentResults.map((result2) => agentOpinionSummary(result2, request.options?.includeAgentRawOutputs === true)),
+      agentOpinions: normalizedAgentResults.map((result) => agentOpinionSummary(result, request.options?.includeAgentRawOutputs === true)),
       audit: {
         traceId,
         startedAt,
@@ -192006,15 +192498,10 @@ async function runReview(tool, request, options = {}) {
       judgeComment: judgeComments.get(disagreement.topic) ?? disagreement.judgeComment
     }));
     const crossModelAnalysis = buildCrossModelAnalysis(judge, reviewMode);
-    const result = {
+    const resultAfterJudge = {
       ...resultWithoutMarkdown,
       disagreements,
-      ...crossModelAnalysis ? { crossModelAnalysis } : {},
-      summaryMarkdown: renderMarkdownResult(tool, {
-        ...resultWithoutMarkdown,
-        disagreements,
-        ...crossModelAnalysis ? { crossModelAnalysis } : {}
-      }, { summaryText: judge.output.summaryText })
+      ...crossModelAnalysis ? { crossModelAnalysis } : {}
     };
     const judgeEvent = {
       type: "judge_completed",
@@ -192026,7 +192513,7 @@ async function runReview(tool, request, options = {}) {
     if (judge.error)
       judgeEvent.error = judge.error;
     await trace.write(judgeEvent);
-    result.audit.completedAt = new Date().toISOString();
+    resultAfterJudge.audit.completedAt = new Date().toISOString();
     await trace.write({
       type: "decision_completed",
       traceId,
@@ -192038,8 +192525,14 @@ async function runReview(tool, request, options = {}) {
       traceId,
       timestamp: new Date().toISOString()
     });
-    return result;
+    return await finalizeReviewResult({
+      tool,
+      trace,
+      result: resultAfterJudge,
+      summaryText: judge.output.summaryText
+    });
   } finally {
+    await trace.finalize();
     if (snapshot)
       await cleanupSnapshot(snapshot.root);
   }
@@ -192288,10 +192781,6 @@ async function buildSecretBlockResult(input) {
       warnings: input.warnings
     }
   };
-  const result = {
-    ...resultWithoutMarkdown,
-    summaryMarkdown: renderMarkdownResult(input.tool, resultWithoutMarkdown)
-  };
   await input.trace.write({
     type: "decision_completed",
     traceId: input.traceId,
@@ -192303,7 +192792,11 @@ async function buildSecretBlockResult(input) {
     traceId: input.traceId,
     timestamp: new Date().toISOString()
   });
-  return result;
+  return await finalizeReviewResult({
+    tool: input.tool,
+    trace: input.trace,
+    result: resultWithoutMarkdown
+  });
 }
 function buildSecretFinding(secretScan, options) {
   return {
@@ -192353,10 +192846,6 @@ async function buildPolicyBlockResult(input) {
       warnings: [input.warning]
     }
   };
-  const result = {
-    ...resultWithoutMarkdown,
-    summaryMarkdown: renderMarkdownResult(input.tool, resultWithoutMarkdown)
-  };
   await input.trace.write({
     type: "decision_completed",
     traceId: input.traceId,
@@ -192368,7 +192857,30 @@ async function buildPolicyBlockResult(input) {
     traceId: input.traceId,
     timestamp: new Date().toISOString()
   });
-  return result;
+  return await finalizeReviewResult({
+    tool: input.tool,
+    trace: input.trace,
+    result: resultWithoutMarkdown
+  });
+}
+async function finalizeReviewResult(input) {
+  await input.trace.finalize();
+  const result = {
+    ...input.result,
+    audit: {
+      ...input.result.audit,
+      warnings: Array.from(new Set([
+        ...input.result.audit.warnings ?? [],
+        ...input.trace.warnings
+      ]))
+    }
+  };
+  return {
+    ...result,
+    summaryMarkdown: renderMarkdownResult(input.tool, result, {
+      summaryText: input.summaryText
+    })
+  };
 }
 function mergeDenyPatterns(configDeny, requestDeny) {
   return Array.from(new Set([...configDeny, ...requestDeny ?? []]));
@@ -192376,7 +192888,7 @@ function mergeDenyPatterns(configDeny, requestDeny) {
 function assertTrustedWorkspaceRoot(requestRoot, configRoot, cwd) {
   if (!requestRoot)
     return;
-  if (resolve4(cwd, requestRoot) !== resolve4(cwd, configRoot)) {
+  if (resolve6(cwd, requestRoot) !== resolve6(cwd, configRoot)) {
     throw new KyosoRequestError("workspace.root is not trusted by config", "UNTRUSTED_WORKSPACE_ROOT");
   }
 }