@quantiya/codevibe-codex-plugin 2.0.27 → 2.0.29

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.js

@@ -7703,7 +7703,7 @@ CodeVibe \u2014 choose mode (${tier} tier):
 }
 
 // src/orchestration-shell/index.ts
-var React20 = __toESM(require("react")), path64 = __toESM(require("path")), os35 = __toESM(require("os")), import_promises2 = require("node:fs/promises"), import_node_async_hooks = require("node:async_hooks"), import_uuid11 = require("uuid");
+var React20 = __toESM(require("react")), path64 = __toESM(require("path")), os35 = __toESM(require("os")), import_promises2 = require("node:fs/promises"), import_node_fs26 = require("node:fs"), import_node_async_hooks = require("node:async_hooks"), import_uuid11 = require("uuid");
 init_logger2();
 
 // src/track-presentation.ts
@@ -24763,43 +24763,312 @@ function buildReviewerVerdictModel(payload) {
   let provenance = parts.length > 0 ? parts.join(" \xB7 ") : null, reasoning = asString(verdict.reasoning), sugRaw = verdict.suggested_changes ?? verdict.suggestedChanges, suggestedChanges = Array.isArray(sugRaw) ? sugRaw.filter((s) => typeof s == "string") : [];
   return { decisionLabel, provenance, reasoning, suggestedChanges };
 }
+function extractEffectivePayload(payload) {
+  let rec = asRecord2(payload);
+  if (!rec) return { dict: {}, hasSpec: !1 };
+  let spec = asRecord2(rec.spec);
+  if (spec && typeof rec.kind == "string") {
+    let extra = {};
+    for (let [k, v] of Object.entries(rec))
+      k !== "kind" && k !== "spec" && (extra[k] = v);
+    return { dict: { ...extra, ...spec }, hasSpec: !0 };
+  }
+  return { dict: rec, hasSpec: !1 };
+}
 function buildTaskAuthorizedModel(payload) {
-  let spec = asRecord2(payload.spec);
-  return spec ? {
-    authorizedAction: asString(spec.authorized_action),
+  let spec = asRecord2(payload.spec) ?? payload, authorizedAction = asString(spec.authorized_action);
+  return authorizedAction ? {
+    authorizedAction,
     authorityScope: asString(spec.authority_scope),
     authorityExpiresAt: asString(spec.authority_expires_at),
     approvalEventId: asString(spec.approval_event_id)
   } : null;
 }
+var decisionLabelMap = {
+  ...decisionCopy,
+  APPROVE: "Approved",
+  REJECT: "Rejected",
+  REVISE: "Requested changes",
+  ESCALATE: "Escalated",
+  approve: "Approved",
+  proceed: "Approved",
+  consensus_approve: "Consensus approve",
+  reject: "Rejected",
+  revise: "Requested changes",
+  auto_revise: "Auto-revise",
+  escalate: "Escalated",
+  pass: "Pass",
+  fail: "Fail",
+  accept: "Accept",
+  accept_with_notes: "Accept with notes",
+  reject_with_notes: "Reject with notes",
+  reject_restart: "Reject and restart",
+  abort_task: "Abort task"
+};
+function formatDecisionValue(raw) {
+  if (typeof raw == "string")
+    return decisionLabelMap[raw] ?? decisionCopy[raw] ?? raw;
+  if (typeof raw == "number" || typeof raw == "boolean")
+    return String(raw);
+  if (asRecord2(raw)) {
+    let rawKind = asRecord2(raw).kind;
+    if (typeof rawKind == "string")
+      return decisionLabelMap[rawKind] ?? decisionCopy[rawKind] ?? rawKind;
+    if (typeof rawKind == "number" || typeof rawKind == "boolean")
+      return String(rawKind);
+  }
+  return null;
+}
+function appendString(rows, dict, keys, label, consumed) {
+  for (let k of keys) {
+    let v = dict[k];
+    if (typeof v == "string" && v.trim().length > 0) {
+      rows.push({ label, value: v.trim() }), consumed && consumed.add(k);
+      return;
+    }
+  }
+}
+function appendScalar(rows, dict, keys, label, consumed) {
+  for (let k of keys) {
+    let v = dict[k];
+    if (typeof v == "string" && v.trim().length > 0) {
+      rows.push({ label, value: v.trim() }), consumed && consumed.add(k);
+      return;
+    }
+    if (typeof v == "number" && Number.isFinite(v)) {
+      rows.push({ label, value: String(v) }), consumed && consumed.add(k);
+      return;
+    }
+  }
+}
+function appendInt(rows, dict, keys, label, consumed) {
+  for (let k of keys) {
+    let v = dict[k];
+    if (typeof v == "number" && Number.isFinite(v)) {
+      rows.push({ label, value: String(v) }), consumed && consumed.add(k);
+      return;
+    }
+  }
+}
+function appendStringList(rows, dict, keys, label, consumed) {
+  for (let k of keys) {
+    let v = dict[k];
+    if (Array.isArray(v)) {
+      if (v.length === 0) {
+        rows.push({ label, value: "(none)" }), consumed && consumed.add(k);
+        return;
+      }
+      if (v.every((item) => typeof item == "string")) {
+        let items = v.map((item) => item.trim()).filter((s) => s.length > 0);
+        rows.push({ label, value: items.length > 0 ? items.join(", ") : "(none)" }), consumed && consumed.add(k);
+        return;
+      }
+      return;
+    }
+  }
+}
+function humanize(key) {
+  let spaced = key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
+  return spaced.length === 0 ? key : spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+function buildCompactVerdictRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  appendScalar(rows, payload, ["seat_id", "seatId", "exhausted_seat_id"], "Seat", consumed), appendString(rows, payload, ["new_seat_id", "newSeatId"], "New seat", consumed), appendString(rows, payload, ["role"], "Role", consumed), appendString(rows, payload, ["agent_kind", "reviewer_agent", "reviewerAgent"], "Reviewer", consumed);
+  let decisionKey = ["decision", "verdict", "seat_state"].find(
+    (k) => payload[k] !== void 0
+  );
+  if (decisionKey) {
+    let decisionRaw = payload[decisionKey], label = formatDecisionValue(decisionRaw), decisionRendered = !1;
+    if (label && (rows.push({ label: "Decision", value: label }), decisionRendered = !0), asRecord2(decisionRaw)) {
+      let decObj = asRecord2(decisionRaw), decConsumed = /* @__PURE__ */ new Set();
+      decisionRendered && decObj.kind !== void 0 && decConsumed.add("kind"), typeof decObj.reason == "string" && decObj.reason.trim().length > 0 && (rows.push({ label: "Reason", value: decObj.reason.trim() }), decConsumed.add("reason")), appendRemainingScalarRows(rows, decObj, decConsumed) && (ctx.hasUnrenderedComplex = !0), consumed.add(decisionKey);
+    } else typeof decisionRaw == "string" || typeof decisionRaw == "number" || typeof decisionRaw == "boolean" ? (decisionRendered || rows.push({ label: "Decision", value: String(decisionRaw) }), consumed.add(decisionKey)) : ctx.hasUnrenderedComplex = !0;
+  } else
+    appendString(rows, payload, ["state"], "State", consumed);
+  return appendString(rows, payload, ["exhaust_reason", "exhaustReason"], "Exhaust reason", consumed), appendString(rows, payload, ["dispatch_ulid", "dispatchUlid"], "Dispatch ULID", consumed), appendString(rows, payload, ["evidence_artifact_id", "evidenceArtifactId"], "Evidence artifact", consumed), appendString(rows, payload, ["provenance"], "Provenance", consumed), rows;
+}
+function buildGateLifecycleRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  appendString(
+    rows,
+    payload,
+    ["gate_type", "gateType", "gate_kind", "gateKind", "gate_id", "gateId"],
+    "Gate",
+    consumed
+  ), appendString(rows, payload, ["from", "from_status", "from_state"], "From", consumed), appendString(rows, payload, ["to", "to_status", "to_state"], "To", consumed);
+  let decisionKey = ["decision", "verdict"].find((k) => payload[k] !== void 0);
+  if (decisionKey) {
+    let decisionRaw = payload[decisionKey], formatted = formatDecisionValue(decisionRaw), decisionRendered = !1;
+    if (formatted && (rows.push({ label: "Decision", value: formatted }), decisionRendered = !0), asRecord2(decisionRaw)) {
+      let decObj = asRecord2(decisionRaw), decConsumed = /* @__PURE__ */ new Set();
+      if (decisionRendered && decObj.kind !== void 0 && decConsumed.add("kind"), decObj.next_round !== void 0 && Number.isFinite(decObj.next_round) && (rows.push({ label: "Next round", value: String(decObj.next_round) }), decConsumed.add("next_round")), typeof decObj.reason == "string" && decObj.reason.trim().length > 0)
+        rows.push({ label: "Reason", value: decObj.reason.trim() }), decConsumed.add("reason");
+      else if (asRecord2(decObj.reason)) {
+        let reasonObj = asRecord2(decObj.reason), reasonConsumed = /* @__PURE__ */ new Set(), rawReasonKind = reasonObj.kind;
+        typeof rawReasonKind == "string" && rawReasonKind.trim().length > 0 ? (rows.push({ label: "Escalation reason", value: humanize(rawReasonKind.trim()) }), reasonConsumed.add("kind")) : (typeof rawReasonKind == "number" || typeof rawReasonKind == "boolean") && (rows.push({ label: "Escalation reason", value: String(rawReasonKind) }), reasonConsumed.add("kind")), typeof reasonObj.message == "string" && reasonObj.message.trim().length > 0 && (rows.push({ label: "Escalation message", value: reasonObj.message.trim() }), reasonConsumed.add("message")), appendRemainingScalarRows(rows, reasonObj, reasonConsumed) && (ctx.hasUnrenderedComplex = !0), decConsumed.add("reason");
+      } else decObj.reason !== void 0 && (ctx.hasUnrenderedComplex = !0);
+      appendRemainingScalarRows(rows, decObj, decConsumed) && (ctx.hasUnrenderedComplex = !0), consumed.add(decisionKey);
+    } else typeof decisionRaw == "string" || typeof decisionRaw == "number" || typeof decisionRaw == "boolean" ? (decisionRendered || rows.push({ label: "Decision", value: String(decisionRaw) }), consumed.add(decisionKey)) : ctx.hasUnrenderedComplex = !0;
+  }
+  return appendString(rows, payload, ["outcome", "merge_outcome", "mergeOutcome"], "Outcome", consumed), appendString(rows, payload, ["reason"], "Reason", consumed), appendInt(rows, payload, ["round_number", "round", "roundNumber", "current_round"], "Round", consumed), appendInt(rows, payload, ["next_round", "nextRound"], "Next round", consumed), appendInt(rows, payload, ["verdict_count", "verdictCount"], "Verdicts", consumed), appendStringList(rows, payload, ["blocking_seat_ids", "blockingSeatIds"], "Blocking seats", consumed), appendInt(rows, payload, ["cap"], "Cap", consumed), rows;
+}
+function buildToolUseRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  return appendString(rows, payload, ["tool_name", "toolName", "tool"], "Tool", consumed), appendString(rows, payload, ["file_path", "target", "filePath", "path"], "Target", consumed), appendString(rows, payload, ["command", "action", "input"], "Action", consumed), appendString(rows, payload, ["status"], "Status", consumed), appendInt(rows, payload, ["duration_ms", "durationMs"], "Duration (ms)", consumed), rows;
+}
+function buildEscalationRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  return appendString(rows, payload, ["action", "tool_name", "toolName"], "Action", consumed), appendString(rows, payload, ["refusal_category", "refusalCategory"], "Refusal category", consumed), appendString(rows, payload, ["risk_level", "riskLevel", "risk"], "Risk level", consumed), appendString(rows, payload, ["justification", "rationale", "reason"], "Justification", consumed), appendString(rows, payload, ["policy_rule", "rule"], "Policy rule", consumed), appendString(rows, payload, ["gate_id", "gateId"], "Gate", consumed), rows;
+}
+function buildUserDecisionRows(payload, ctx) {
+  let rows = [], { consumed } = ctx, decisionRaw = payload.decision;
+  if (decisionRaw !== void 0) {
+    let formatted = formatDecisionValue(decisionRaw), decisionRendered = !1;
+    if (formatted && (rows.push({ label: "Decision", value: formatted }), decisionRendered = !0), asRecord2(decisionRaw)) {
+      let decObj = asRecord2(decisionRaw), decConsumed = /* @__PURE__ */ new Set();
+      decisionRendered && decObj.kind !== void 0 && decConsumed.add("kind"), typeof decObj.reason == "string" && decObj.reason.trim().length > 0 && (rows.push({ label: "Reason", value: decObj.reason.trim() }), decConsumed.add("reason")), appendRemainingScalarRows(rows, decObj, decConsumed) && (ctx.hasUnrenderedComplex = !0), consumed.add("decision");
+    } else typeof decisionRaw == "string" || typeof decisionRaw == "number" || typeof decisionRaw == "boolean" ? (decisionRendered || rows.push({ label: "Decision", value: String(decisionRaw) }), consumed.add("decision")) : ctx.hasUnrenderedComplex = !0;
+  }
+  appendString(rows, payload, ["choice", "selected_option", "selectedOption"], "Selected option", consumed), appendString(rows, payload, ["notes", "note", "reason"], "Note", consumed);
+  let resActionKey = ["resulting_action", "resultingAction", "action"].find(
+    (k) => payload[k] !== void 0
+  );
+  if (resActionKey) {
+    let resAction = payload[resActionKey];
+    if (typeof resAction == "string")
+      consumed.add(resActionKey), rows.push({ label: "Resulting action", value: humanize(resAction) });
+    else if (asRecord2(resAction)) {
+      let actObj = asRecord2(resAction), actConsumed = /* @__PURE__ */ new Set(), actKind = null;
+      typeof actObj.kind == "string" ? (actKind = actObj.kind, actConsumed.add("kind")) : typeof actObj.action == "string" && (actKind = actObj.action, actConsumed.add("action")), actKind && rows.push({ label: "Resulting action", value: humanize(actKind) }), actObj.next_round !== void 0 && Number.isFinite(actObj.next_round) && (rows.push({ label: "Next round", value: String(actObj.next_round) }), actConsumed.add("next_round")), typeof actObj.user_notes == "string" && actObj.user_notes.trim().length > 0 && (rows.push({ label: "User notes", value: actObj.user_notes.trim() }), actConsumed.add("user_notes")), typeof actObj.notes == "string" && actObj.notes.trim().length > 0 && (rows.push({ label: "Notes", value: actObj.notes.trim() }), actConsumed.add("notes")), appendRemainingScalarRows(rows, actObj, actConsumed) && (ctx.hasUnrenderedComplex = !0), !actKind && Object.keys(actObj).length > 0 && rows.every((r) => r.label !== "Resulting action") && (ctx.hasUnrenderedComplex = !0), consumed.add(resActionKey);
+    } else
+      ctx.hasUnrenderedComplex = !0;
+  }
+  return appendInt(rows, payload, ["current_round", "round_number", "round"], "Round", consumed), appendString(rows, payload, ["provenance", "source"], "Provenance", consumed), appendString(rows, payload, ["offer_id", "offerId"], "Offer ID", consumed), appendString(rows, payload, ["source_agent", "sourceAgent"], "Source agent", consumed), appendString(rows, payload, ["target_agent", "targetAgent"], "Target agent", consumed), appendString(rows, payload, ["approver_user_id", "approverUserId"], "Approver", consumed), appendString(rows, payload, ["flagged_entry_id", "flaggedEntryId"], "Flagged entry", consumed), appendString(rows, payload, ["flagged_kind", "flaggedKind"], "Flagged kind", consumed), rows;
+}
+function buildPlannerDecisionRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  appendString(rows, payload, ["action"], "Action", consumed);
+  let resultKey = ["result", "result_discriminant", "discriminant"].find(
+    (k) => payload[k] !== void 0
+  );
+  if (resultKey) {
+    let resultRaw = payload[resultKey];
+    if (typeof resultRaw == "string")
+      consumed.add(resultKey), rows.push({ label: "Result", value: resultRaw });
+    else if (asRecord2(resultRaw)) {
+      let resObj = asRecord2(resultRaw), resConsumed = /* @__PURE__ */ new Set(), outcome = asString(resObj.outcome);
+      outcome && (rows.push({ label: "Result", value: humanize(outcome) }), resConsumed.add("outcome"));
+      let reason = asString(resObj.reason);
+      reason && (rows.push({ label: "Reason", value: reason }), resConsumed.add("reason")), appendRemainingScalarRows(rows, resObj, resConsumed) && (ctx.hasUnrenderedComplex = !0), consumed.add(resultKey);
+    } else
+      ctx.hasUnrenderedComplex = !0;
+  }
+  let decisionRaw = payload.decision;
+  if (decisionRaw !== void 0) {
+    let formatted = formatDecisionValue(decisionRaw), decisionRendered = !1;
+    if (formatted && (rows.push({ label: "Decision", value: formatted }), decisionRendered = !0), asRecord2(decisionRaw)) {
+      let decObj = asRecord2(decisionRaw), decConsumed = /* @__PURE__ */ new Set();
+      decisionRendered && decObj.kind !== void 0 && decConsumed.add("kind"), typeof decObj.reason == "string" && decObj.reason.trim().length > 0 && (rows.push({ label: "Reason", value: decObj.reason.trim() }), decConsumed.add("reason")), appendRemainingScalarRows(rows, decObj, decConsumed) && (ctx.hasUnrenderedComplex = !0), consumed.add("decision");
+    } else typeof decisionRaw == "string" || typeof decisionRaw == "number" || typeof decisionRaw == "boolean" ? (decisionRendered || rows.push({ label: "Decision", value: String(decisionRaw) }), consumed.add("decision")) : ctx.hasUnrenderedComplex = !0;
+  }
+  return appendString(
+    rows,
+    payload,
+    ["validated_by", "validatedBy", "validator_id", "validatorId"],
+    "Validated by",
+    consumed
+  ), appendString(rows, payload, ["rationale", "reason"], "Rationale", consumed), appendString(rows, payload, ["step", "planned_action"], "Step", consumed), rows;
+}
+function buildPolicyRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  return appendInt(rows, payload, ["current_round", "round_number", "round", "roundNumber"], "Round", consumed), appendInt(rows, payload, ["consecutive_rounds", "consecutiveRounds"], "Consecutive rounds", consumed), appendInt(rows, payload, ["finding_count", "findingCount", "count"], "Finding count", consumed), appendInt(rows, payload, ["repeat_count", "repeatCount", "repeated_count"], "Repeat count", consumed), appendString(
+    rows,
+    payload,
+    ["finding_signature_hex", "finding_signature", "signature"],
+    "Signature",
+    consumed
+  ), appendString(rows, payload, ["matched_pattern", "matchedPattern"], "Matched pattern", consumed), appendString(
+    rows,
+    payload,
+    ["aggregate_status_label", "aggregateStatusLabel"],
+    "Aggregate status",
+    consumed
+  ), appendString(rows, payload, ["resolve_error_kind", "resolveErrorKind"], "Resolve error", consumed), appendString(rows, payload, ["gate_id", "gateId"], "Gate", consumed), appendString(rows, payload, ["task_id", "taskId"], "Task ID", consumed), appendString(rows, payload, ["risk_level", "riskLevel"], "Risk level", consumed), appendString(rows, payload, ["risk_category", "category"], "Risk category", consumed), appendString(rows, payload, ["reason", "message", "explanation"], "Reason", consumed), rows;
+}
+function buildTaskLifecycleRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  return appendString(rows, payload, ["task_id", "taskId"], "Task ID", consumed), appendString(rows, payload, ["task_group_id", "taskGroupId"], "Task group", consumed), appendStringList(rows, payload, ["member_task_ids", "memberTaskIds"], "Member tasks", consumed), appendString(rows, payload, ["track_id", "trackId"], "Track", consumed), appendString(rows, payload, ["from_state", "from"], "From", consumed), appendString(rows, payload, ["to_state", "to"], "To", consumed), appendString(rows, payload, ["status"], "Status", consumed), appendString(rows, payload, ["reason", "terminal_reason"], "Reason", consumed), rows;
+}
+function buildVerificationRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  return appendString(rows, payload, ["check_name", "check_id", "name", "check"], "Check", consumed), appendString(rows, payload, ["gate_id", "gateId"], "Gate", consumed), appendString(rows, payload, ["gate_kind", "gateKind"], "Gate kind", consumed), appendString(rows, payload, ["status", "result"], "Status", consumed), appendInt(rows, payload, ["exit_code", "exitCode"], "Exit code", consumed), appendString(rows, payload, ["details", "reason"], "Details", consumed), rows;
+}
+function buildContinuationRows(payload, ctx) {
+  let rows = [], { consumed } = ctx;
+  return appendString(rows, payload, ["offer_id", "offerId"], "Offer ID", consumed), appendString(rows, payload, ["handoff_kind", "handoffKind"], "Handoff kind", consumed), appendString(rows, payload, ["source_agent", "sourceAgent"], "Source agent", consumed), appendString(rows, payload, ["target_agent", "targetAgent"], "Target agent", consumed), appendString(rows, payload, ["blocked_reason", "blockedReason"], "Blocked reason", consumed), appendString(rows, payload, ["packet_relative_path", "packetRelativePath"], "Packet path", consumed), appendString(rows, payload, ["packet_hash", "packetHash"], "Packet hash", consumed), rows;
+}
+function appendRemainingScalarRows(rows, dict, consumed, options) {
+  let hasUnrenderedComplex = !1, isTopLevel = options?.isTopLevel ?? !1, sortedKeys = Object.keys(dict).sort();
+  for (let key of sortedKeys) {
+    if (consumed.has(key) || isTopLevel && (key === "kind" || key === "spec")) continue;
+    let val = dict[key];
+    typeof val == "string" ? (val.trim().length > 0 && rows.push({ label: humanize(key), value: val.trim() }), consumed.add(key)) : typeof val == "number" && Number.isFinite(val) ? (rows.push({ label: humanize(key), value: String(val) }), consumed.add(key)) : typeof val == "boolean" ? (rows.push({ label: humanize(key), value: val ? "true" : "false" }), consumed.add(key)) : Array.isArray(val) ? val.every(
+      (x) => typeof x == "string" || typeof x == "number" || typeof x == "boolean"
+    ) ? (rows.push({
+      label: humanize(key),
+      value: val.length > 0 ? val.join(", ") : "(none)"
+    }), consumed.add(key)) : hasUnrenderedComplex = !0 : val == null ? consumed.add(key) : hasUnrenderedComplex = !0;
+  }
+  return hasUnrenderedComplex;
+}
 function buildSafePayloadModel(kind, payload, status) {
-  let rec = asRecord2(payload);
-  if (kind === "reviewer_verdict_recorded" && rec) {
-    let model = buildReviewerVerdictModel(rec);
+  let { dict } = extractEffectivePayload(payload), rec = asRecord2(payload);
+  if (kind === "reviewer_verdict_recorded" && (rec || Object.keys(dict).length > 0)) {
+    let model = buildReviewerVerdictModel(dict);
     if (model)
       return {
         status,
         reviewerVerdict: model,
         taskAuthorized: null,
+        detailRows: [],
         rawJson: null,
         unavailableLine: null
       };
   }
-  if (kind === "task_authorized" && rec) {
-    let model = buildTaskAuthorizedModel(rec);
+  if (kind === "task_authorized" && (rec || Object.keys(dict).length > 0)) {
+    let model = buildTaskAuthorizedModel(rec ?? dict);
     if (model)
       return {
         status,
         reviewerVerdict: null,
         taskAuthorized: model,
+        detailRows: [],
         rawJson: null,
         unavailableLine: null
       };
   }
+  if (kind in auditKindCopy && Object.keys(dict).length > 0) {
+    let ctx = {
+      consumed: /* @__PURE__ */ new Set(),
+      hasUnrenderedComplex: !1
+    }, rows = [];
+    kind === "reviewer_verdict" || kind === "reviewer_verdict_received" ? rows = buildCompactVerdictRows(dict, ctx) : kind === "gate_transition" || kind === "gate_resolved" || kind === "auto_revise_triggered" || kind === "gateplan_transition" || kind === "merge_gate_result" || kind === "gate_blocked_by_review" || kind === "auto_revise_cap_exhausted" ? rows = buildGateLifecycleRows(dict, ctx) : kind === "tool_use" ? rows = buildToolUseRows(dict, ctx) : kind === "destructive_action_escalated" || kind === "unsafe_action_escalated" || kind === "insufficient_quorum_escalated" ? rows = buildEscalationRows(dict, ctx) : kind === "user_decision_recorded" || kind === "flag_bad_approval" || kind === "final_approval" ? rows = buildUserDecisionRows(dict, ctx) : kind === "planner_decision" ? rows = buildPlannerDecisionRows(dict, ctx) : kind.startsWith("policy_") || kind === "custom_panel_rejected" ? rows = buildPolicyRows(dict, ctx) : kind === "task_created" || kind === "task_terminated" || kind === "task_group_scheduled" || kind === "track_transition" ? rows = buildTaskLifecycleRows(dict, ctx) : kind === "verification_result" || kind === "verification_result_recorded" ? rows = buildVerificationRows(dict, ctx) : (kind === "continuation" || kind === "continuation_packet_written" || kind === "continuation_switch_accepted" || kind === "continuation_switch_declined") && (rows = buildContinuationRows(dict, ctx));
+    let topLevelUnrendered = appendRemainingScalarRows(rows, dict, ctx.consumed, { isTopLevel: !0 }), hasUnrenderedComplex = ctx.hasUnrenderedComplex || topLevelUnrendered;
+    if (rows.length > 0)
+      return {
+        status,
+        reviewerVerdict: null,
+        taskAuthorized: null,
+        detailRows: rows,
+        rawJson: hasUnrenderedComplex ? prettyJson(payload) : null,
+        unavailableLine: null
+      };
+  }
   return {
     status,
     reviewerVerdict: null,
     taskAuthorized: null,
+    detailRows: [],
     rawJson: prettyJson(payload),
     unavailableLine: null
   };
@@ -24809,6 +25078,7 @@ function failClosedModel() {
     status: "unavailable",
     reviewerVerdict: null,
     taskAuthorized: null,
+    detailRows: [],
     rawJson: null,
     unavailableLine: ENTRY_DETAILS_UNAVAILABLE
   };
@@ -24831,10 +25101,10 @@ function routeAuditEntry(row, sessionKey, decrypt) {
     }
     let gateResolved = null;
     if (kind === "gate_resolved") {
-      let rec = asRecord2(plaintextObj);
-      gateResolved = {
-        outcome: rec ? asString(rec.outcome) : null,
-        decisionKind: rec ? asString(asRecord2(rec.decision)?.kind ?? null) : null
+      let { dict } = extractEffectivePayload(plaintextObj), decRaw = dict.decision, decisionKind = null;
+      typeof decRaw == "string" ? decisionKind = decRaw : asRecord2(decRaw) && (decisionKind = asString(asRecord2(decRaw).kind)), gateResolved = {
+        outcome: asString(dict.outcome),
+        decisionKind
       };
     }
     return {
@@ -24845,13 +25115,73 @@ function routeAuditEntry(row, sessionKey, decrypt) {
   }
   return WIRE_PUBLIC_PLAINTEXT_KINDS.has(kind) ? { ...base, ...buildSafePayloadModel(kind, payload, "plaintext") } : { ...base, ...failClosedModel() };
 }
-function buildAuditBrowserModel(rows, sessionKey, decrypt) {
-  if (rows.length === 0)
-    return { title: AUDIT_LOG_TITLE, entries: [], emptyLine: NO_AUDIT_ENTRIES };
-  let entries = rows.slice().reverse().map(
+function buildAuditBrowserModel(rows, sessionKey, decrypt, options) {
+  let totalCount = rows.length;
+  if (totalCount === 0)
+    return {
+      title: AUDIT_LOG_TITLE,
+      entries: [],
+      emptyLine: NO_AUDIT_ENTRIES,
+      totalCount: 0,
+      filteredCount: 0,
+      limit: options?.limit,
+      offset: options?.offset
+    };
+  let orderedRows = rows.slice().reverse();
+  if (options?.verdictsOnly) {
+    let verdictKinds = /* @__PURE__ */ new Set([
+      "reviewer_verdict_recorded",
+      "reviewer_verdict",
+      "reviewer_verdict_received"
+    ]);
+    orderedRows = orderedRows.filter((r) => {
+      let k = asString(r.kind) ?? asString(r.kindWire);
+      return k !== null && verdictKinds.has(k);
+    });
+  }
+  if (options?.kind && options.kind.trim().length > 0) {
+    let targetKind = options.kind.trim();
+    orderedRows = orderedRows.filter((r) => (asString(r.kind) ?? asString(r.kindWire)) === targetKind);
+  }
+  let filteredCount = orderedRows.length;
+  if (filteredCount === 0)
+    return {
+      title: AUDIT_LOG_TITLE,
+      entries: [],
+      emptyLine: "No audit entries match the specified filter.",
+      totalCount,
+      filteredCount: 0,
+      limit: options?.limit,
+      offset: options?.offset
+    };
+  let offset = options?.offset !== void 0 && options.offset > 0 ? options.offset : 0, windowedRows = orderedRows.slice(offset);
+  options?.limit !== void 0 && options.limit > 0 && (windowedRows = windowedRows.slice(0, options.limit));
+  let entries = windowedRows.map(
     (row) => routeAuditEntry(row, sessionKey, decrypt)
-  );
-  return { title: AUDIT_LOG_TITLE, entries, emptyLine: null };
+  ), emptyLine = entries.length === 0 && filteredCount > 0 ? "No audit entries in this window." : null;
+  return {
+    title: AUDIT_LOG_TITLE,
+    entries,
+    emptyLine,
+    totalCount,
+    filteredCount,
+    limit: options?.limit,
+    offset: options?.offset
+  };
+}
+function formatAuditExport(model, format = "text", meta) {
+  if (format === "json") {
+    let payload = {
+      taskId: meta?.taskId,
+      sessionId: meta?.sessionId,
+      exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      totalCount: model.totalCount,
+      filteredCount: model.filteredCount,
+      entries: model.entries
+    };
+    return JSON.stringify(payload, null, 2);
+  }
+  return renderAuditBrowserText(model);
 }
 function renderAuditEntryText(entry) {
   let lines = [entry.timestamp !== null ? `${entry.kindLabel}  \xB7  ${entry.timestamp}` : entry.kindLabel];
@@ -24865,12 +25195,15 @@ function renderAuditEntryText(entry) {
     let ta = entry.taskAuthorized;
     return ta.authorizedAction && lines.push(`  Action: ${ta.authorizedAction}`), ta.authorityScope && lines.push(`  Scope: ${ta.authorityScope}`), ta.authorityExpiresAt && lines.push(`  Expires: ${ta.authorityExpiresAt}`), ta.approvalEventId && lines.push(`  Approval: ${ta.approvalEventId}`), lines;
   }
-  return entry.rawJson && entry.rawJson.split(`
-`).forEach((l) => lines.push(`  ${l}`)), lines;
+  return entry.detailRows && entry.detailRows.length > 0 ? (entry.detailRows.forEach((r) => lines.push(`  ${r.label}: ${r.value}`)), entry.rawJson && (lines.push("  Payload:"), entry.rawJson.split(`
+`).forEach((l) => lines.push(`    ${l}`))), lines) : (entry.rawJson && entry.rawJson.split(`
+`).forEach((l) => lines.push(`  ${l}`)), lines);
 }
 function renderAuditBrowserText(model) {
   let lines = [model.title];
-  return model.emptyLine ? (lines.push(model.emptyLine), lines.join(`
+  return model.totalCount > 0 && (model.limit !== void 0 || model.offset !== void 0 || model.filteredCount !== model.totalCount) && lines.push(
+    `Showing ${model.entries.length} of ${model.filteredCount} entries (total: ${model.totalCount})`
+  ), model.emptyLine ? (lines.push(model.emptyLine), lines.join(`
 `)) : (model.entries.forEach((entry) => {
     lines.push(""), lines.push(...renderAuditEntryText(entry));
   }), lines.join(`
@@ -24908,7 +25241,19 @@ async function runAuditBrowser(deps) {
     let reason = err?.message ?? String(err);
     return logger.warn("[audit-browser] queryAudit failed", { reason }), { kind: "error", line: AUDIT_LOG_TOO_LARGE, reason };
   }
-  let getSessionKey = deps.getSessionKeyFn ?? ((sid) => keychainManager.getSessionKey(sid)), sessionKey = null;
+  let getSessionKey = deps.getSessionKeyFn ?? (async (sid) => {
+    let key = await keychainManager.getSessionKey(sid);
+    if (!key && deps.appsyncClient.getSession)
+      try {
+        let session = await deps.appsyncClient.getSession(sid);
+        if (session?.encryptedKeys && session.encryptedKeys.length > 0) {
+          let gen = session.sessionKeyGen != null ? String(session.sessionKeyGen) : null;
+          key = await keychainManager.getSessionKey(sid, session.encryptedKeys, gen);
+        }
+      } catch {
+      }
+    return key;
+  }), sessionKey = null;
   try {
     sessionKey = await getSessionKey(deps.sessionId);
   } catch (err) {
@@ -24918,7 +25263,12 @@ async function runAuditBrowser(deps) {
     });
   }
   let decryptFn = deps.decryptFn ?? ((ct, key) => cryptoService.decryptContent(ct, key));
-  return { kind: "ok", model: buildAuditBrowserModel(rows, sessionKey, decryptFn) };
+  return { kind: "ok", model: buildAuditBrowserModel(rows, sessionKey, decryptFn, {
+    kind: deps.kind,
+    verdictsOnly: deps.verdictsOnly,
+    limit: deps.limit,
+    offset: deps.offset
+  }) };
 }
 function renderAuditResultText(result) {
   switch (result.kind) {
@@ -24998,7 +25348,7 @@ function dedupKeyForBrokerCredentialLoaded(taskId, credentialIssuanceId) {
 
 // src/orchestration-shell/flag-command.ts
 init_logger2();
-function buildAuditFlagIndex(taskId, model) {
+function buildAuditFlagIndex(taskId, model, sessionId) {
   let entries = /* @__PURE__ */ new Map();
   for (let entry of model.entries)
     entries.set(entry.entryId, {
@@ -25006,7 +25356,12 @@ function buildAuditFlagIndex(taskId, model) {
       kind: entry.kind,
       flaggable: isFlaggableAuditEntry(entry)
     });
-  return { taskId, entries, flagged: /* @__PURE__ */ new Set() };
+  return {
+    taskId,
+    entries,
+    flagged: /* @__PURE__ */ new Set(),
+    ...sessionId !== void 0 ? { sessionId } : {}
+  };
 }
 var FLAG_NO_INDEX_LINE = "No /audit listing to flag from yet. Run /audit <task-id> first, then /flag <entry-id> using an id it shows.", SEQ_NUM_SHAPE = /^\d{16}$/, UUID_SHAPE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function mapServerRejection(reason) {
@@ -25016,6 +25371,11 @@ async function runFlagCommand(deps) {
   let { index, entryId } = deps;
   if (!index)
     return { kind: "no_index", line: FLAG_NO_INDEX_LINE };
+  if (index.sessionId && deps.sessionId && index.sessionId.trim().length > 0 && deps.sessionId.trim().length > 0 && index.sessionId.trim() !== deps.sessionId.trim())
+    return {
+      kind: "cross_session_unsupported",
+      line: `Cannot flag audit entries from another session (${index.sessionId}). /flag only supports entries from the current orchestration session.`
+    };
   let entry = index.entries.get(entryId);
   if (!entry)
     return {
@@ -25040,12 +25400,12 @@ async function runFlagCommand(deps) {
       line: `Entry id ${entryId} is not a valid audit entry id.`,
       reason: "entry id is not a canonical UUID"
     };
-  let dedupKeyHex = dedupKeyForFlagBadApproval(entryId), getSessionKey = deps.getSessionKeyFn ?? ((sid) => keychainManager.getSessionKey(sid)), sessionKey = null;
+  let dedupKeyHex = dedupKeyForFlagBadApproval(entryId), targetSessionId = deps.sessionId, getSessionKey = deps.getSessionKeyFn ?? ((sid) => keychainManager.getSessionKey(sid)), sessionKey = null;
   try {
-    sessionKey = await getSessionKey(deps.sessionId);
+    sessionKey = await getSessionKey(targetSessionId);
   } catch (err) {
     sessionKey = null, logger.warn("[flag-command] session-key resolve threw", {
-      sessionId: deps.sessionId,
+      sessionId: targetSessionId,
       errorName: err?.name ?? "Error"
     });
   }
@@ -25058,7 +25418,7 @@ async function runFlagCommand(deps) {
     await deps.appsyncClient.recordExecutionEvent(
       {
         taskId: index.taskId,
-        sessionId: deps.sessionId,
+        sessionId: targetSessionId,
         kind: "FLAG_BAD_APPROVAL",
         payload: {
           note: deps.note ?? null,
@@ -61782,6 +62142,37 @@ async function resolvePlannerOffer(deps) {
 `)
   );
 }
+function tokenizeCommandLine(input) {
+  let tokens = [], current = "", inDouble = !1, inSingle = !1, escaping = !1, hasToken = !1;
+  for (let i = 0; i < input.length; i++) {
+    let ch = input[i];
+    if (escaping) {
+      current += ch, hasToken = !0, escaping = !1;
+      continue;
+    }
+    if (ch === "\\" && !inSingle) {
+      escaping = !0;
+      continue;
+    }
+    if (ch === '"' && !inSingle) {
+      inDouble = !inDouble, hasToken = !0;
+      continue;
+    }
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle, hasToken = !0;
+      continue;
+    }
+    if (/\s/.test(ch) && !inDouble && !inSingle) {
+      hasToken && (tokens.push(current), current = "", hasToken = !1);
+      continue;
+    }
+    current += ch, hasToken = !0;
+  }
+  return escaping ? { tokens: [], error: "Trailing escape character in command input" } : inDouble || inSingle ? { tokens: [], error: "Unmatched quote in command input" } : (hasToken && tokens.push(current), { tokens });
+}
+function isFlagToken(tok) {
+  return tok.startsWith("-") && !/^-\d+$/.test(tok);
+}
 async function handleShellUserInput(deps) {
   let {
     text: text2,
@@ -61974,36 +62365,126 @@ async function handleShellUserInput(deps) {
         }
       }
     else if (output.command === "/audit" && !output.sideEffect && output.output === "PENDING \u2014 entrypoint runs audit browser") {
-      let taskId = text2.trim().split(/\s+/)[1];
-      if (!taskId)
-        output.output = args.tier !== "MAX" ? renderAuditResultText({
-          kind: "gated",
-          headline: AUDIT_BROWSER_MAX_HEADLINE,
-          upgradeHint: AUDIT_BROWSER_UPGRADE_HINT
-        }) : renderSessionTaskList(store.getState(), args.quorumLoop?.activeTask ?? null);
-      else
-        try {
-          let result = runAuditBrowserFn ? await runAuditBrowserFn(taskId) : await runAuditBrowser({
-            appsyncClient: args.appsyncClient,
-            taskId,
-            sessionId: args.session.sessionId,
-            tier: args.tier
-          });
-          output.output = renderAuditResultText(result), result.kind === "ok" && store.dispatch({
-            type: "AUDIT_FLAG_INDEX_RETAINED",
-            index: buildAuditFlagIndex(taskId, result.model)
-          });
-        } catch (err) {
-          output.output = `Audit browser error: ${err.message ?? String(err)}`, logger.warn("[orchestration-shell] /audit dispatch failed", {
-            error: err.message
-          });
+      let { tokens: cmdTokens, error: tokenizeErr } = tokenizeCommandLine(text2.trim());
+      if (tokenizeErr)
+        output.output = tokenizeErr;
+      else {
+        let rawTokens = cmdTokens.slice(1), taskId, explicitSessionId, kind, verdictsOnly = !1, limit, offset, exportPath, json = !1, parseError;
+        for (let i = 0; i < rawTokens.length; i++) {
+          let tok = rawTokens[i];
+          if (tok === "--kind") {
+            let val = rawTokens[++i];
+            if (!val || val.length === 0 || isFlagToken(val)) {
+              parseError = "Missing value for --kind";
+              break;
+            }
+            kind = val;
+          } else if (tok === "--session") {
+            let val = rawTokens[++i];
+            if (!val || val.length === 0 || isFlagToken(val)) {
+              parseError = "Missing value for --session";
+              break;
+            }
+            explicitSessionId = val;
+          } else if (tok === "--verdicts-only")
+            verdictsOnly = !0;
+          else if (tok === "--limit") {
+            let raw = rawTokens[++i];
+            if (!raw || raw.length === 0 || isFlagToken(raw)) {
+              parseError = "Missing value for --limit";
+              break;
+            }
+            let parsed = parseInt(raw, 10);
+            if (Number.isNaN(parsed) || parsed <= 0 || String(parsed) !== raw) {
+              parseError = `Invalid value for --limit: expected a positive integer, got "${raw}"`;
+              break;
+            }
+            limit = parsed;
+          } else if (tok === "--offset") {
+            let raw = rawTokens[++i];
+            if (!raw || raw.length === 0 || isFlagToken(raw)) {
+              parseError = "Missing value for --offset";
+              break;
+            }
+            let parsed = parseInt(raw, 10);
+            if (Number.isNaN(parsed) || parsed < 0 || String(parsed) !== raw) {
+              parseError = `Invalid value for --offset: expected a non-negative integer, got "${raw}"`;
+              break;
+            }
+            offset = parsed;
+          } else if (tok === "--export") {
+            let val = rawTokens[++i];
+            if (!val || val.length === 0 || isFlagToken(val)) {
+              parseError = "Missing value for --export";
+              break;
+            }
+            exportPath = val;
+          } else if (tok === "--json")
+            json = !0;
+          else if (tok.startsWith("-")) {
+            parseError = `Unrecognized option: "${tok}"`;
+            break;
+          } else if (!taskId)
+            taskId = tok;
+          else {
+            parseError = `Unexpected argument: "${tok}"`;
+            break;
+          }
         }
+        if (parseError)
+          output.output = parseError;
+        else if (!taskId)
+          output.output = args.tier !== "MAX" ? renderAuditResultText({
+            kind: "gated",
+            headline: AUDIT_BROWSER_MAX_HEADLINE,
+            upgradeHint: AUDIT_BROWSER_UPGRADE_HINT
+          }) : renderSessionTaskList(store.getState(), args.quorumLoop?.activeTask ?? null);
+        else
+          try {
+            let effectiveSessionId = explicitSessionId || args.session.sessionId, result = runAuditBrowserFn ? await runAuditBrowserFn(taskId, {
+              kind,
+              verdictsOnly,
+              limit,
+              offset,
+              sessionId: effectiveSessionId
+            }) : await runAuditBrowser({
+              appsyncClient: args.appsyncClient,
+              taskId,
+              sessionId: effectiveSessionId,
+              tier: args.tier,
+              kind,
+              verdictsOnly,
+              limit,
+              offset
+            });
+            if (result.kind === "ok" && exportPath)
+              try {
+                let formatted = formatAuditExport(
+                  result.model,
+                  json ? "json" : "text",
+                  { taskId, sessionId: effectiveSessionId }
+                );
+                (0, import_node_fs26.writeFileSync)(exportPath, formatted, "utf8"), output.output = `Audit log exported to ${exportPath} (${result.model.entries.length} entries)`;
+              } catch (err) {
+                output.output = `Failed to export audit log to ${exportPath}: ${err.message ?? String(err)}`;
+              }
+            else exportPath && result.kind !== "ok" ? result.kind === "gated" ? output.output = `Cannot export audit log: ${result.headline} \u2014 ${result.upgradeHint}` : output.output = `Cannot export audit log: ${result.line} (${result.reason})` : json ? output.output = JSON.stringify(result, null, 2) : output.output = renderAuditResultText(result);
+            result.kind === "ok" && store.dispatch({
+              type: "AUDIT_FLAG_INDEX_RETAINED",
+              index: buildAuditFlagIndex(taskId, result.model, effectiveSessionId)
+            });
+          } catch (err) {
+            output.output = `Audit browser error: ${err.message ?? String(err)}`, logger.warn("[orchestration-shell] /audit dispatch failed", {
+              error: err.message
+            });
+          }
+      }
     } else if (output.command === "/flag" && !output.sideEffect && output.output === "PENDING \u2014 entrypoint records bad-approval flag") {
       let flagParts = slashCommandText.trim().split(/\s+/), flagEntryId = flagParts[1] ?? "", flagNote = flagParts.length > 2 ? flagParts.slice(2).join(" ") : void 0;
       try {
-        let result = runFlagCommandFn ? await runFlagCommandFn(flagEntryId, flagNote) : await runFlagCommand({
+        let retainedIndex = store.getState().auditFlagIndex, result = runFlagCommandFn ? await runFlagCommandFn(flagEntryId, flagNote) : await runFlagCommand({
           appsyncClient: args.appsyncClient,
-          index: store.getState().auditFlagIndex,
+          index: retainedIndex,
           entryId: flagEntryId,
           ...flagNote !== void 0 ? { note: flagNote } : {},
           sessionId: args.session.sessionId
@@ -63280,7 +63761,7 @@ function renderStructuralSummaryPreview(summary, error, tier) {
 }
 
 // src/planner/cache.ts
-var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")), os36 = __toESM(require("node:os")), crypto26 = __toESM(require("node:crypto")), TAXONOMY_VERSION = 2, CACHE_SCHEMA_VERSION = 2, WORKFLOW_CACHE_TTL_MS = 1440 * 60 * 1e3, SIGNATURE_CACHE_TTL_MS = 300 * 1e3, WORKFLOW_CACHE_MAX_ENTRIES = 1e3, CACHE_FILE_PERMS = 384, CACHE_ROOT_PERMS = 448, VALID_KINDS = /* @__PURE__ */ new Set([
+var import_node_fs27 = require("node:fs"), path65 = __toESM(require("node:path")), os36 = __toESM(require("node:os")), crypto26 = __toESM(require("node:crypto")), TAXONOMY_VERSION = 2, CACHE_SCHEMA_VERSION = 2, WORKFLOW_CACHE_TTL_MS = 1440 * 60 * 1e3, SIGNATURE_CACHE_TTL_MS = 300 * 1e3, WORKFLOW_CACHE_MAX_ENTRIES = 1e3, CACHE_FILE_PERMS = 384, CACHE_ROOT_PERMS = 448, VALID_KINDS = /* @__PURE__ */ new Set([
   "workflow_status_query",
   "workflow_audit_query",
   "workflow_review_query",
@@ -63370,7 +63851,7 @@ var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")
     await this.mutex.run(async () => {
       this.workflowCache.clear(), this.signatureCache.clear(), this.hydrated.clear();
       try {
-        let entries = await import_node_fs26.promises.readdir(this.cacheRoot, { withFileTypes: !0 });
+        let entries = await import_node_fs27.promises.readdir(this.cacheRoot, { withFileTypes: !0 });
         for (let ent of entries)
           ent.isDirectory() && await this.rmRecursiveSafe(path65.join(this.cacheRoot, ent.name));
       } catch {
@@ -63381,7 +63862,7 @@ var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")
     await this.mutex.run(async () => {
       let newPrefix = this.userIdPrefix(newUserId), markerPath = path65.join(this.cacheRoot, ".last-user"), lastUserPrefix = null;
       try {
-        let raw = (await import_node_fs26.promises.readFile(markerPath, "utf-8")).trim();
+        let raw = (await import_node_fs27.promises.readFile(markerPath, "utf-8")).trim();
         /^[0-9a-f]{16}$/.test(raw) ? lastUserPrefix = raw : lastUserPrefix = "__corrupt__";
       } catch (err) {
         err?.code !== "ENOENT" && (lastUserPrefix = "__error__");
@@ -63389,7 +63870,7 @@ var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")
       if (lastUserPrefix && lastUserPrefix !== newPrefix) {
         this.workflowCache.clear(), this.signatureCache.clear(), this.hydrated.clear();
         try {
-          let entries = await import_node_fs26.promises.readdir(this.cacheRoot, { withFileTypes: !0 });
+          let entries = await import_node_fs27.promises.readdir(this.cacheRoot, { withFileTypes: !0 });
           for (let ent of entries)
             ent.isDirectory() && await this.rmRecursiveSafe(path65.join(this.cacheRoot, ent.name));
         } catch {
@@ -63398,8 +63879,8 @@ var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")
       await this.ensureCacheRoot();
       let tmp = markerPath + ".tmp";
       try {
-        await import_node_fs26.promises.writeFile(tmp, newPrefix + `
-`, { mode: CACHE_FILE_PERMS }), await import_node_fs26.promises.rename(tmp, markerPath);
+        await import_node_fs27.promises.writeFile(tmp, newPrefix + `
+`, { mode: CACHE_FILE_PERMS }), await import_node_fs27.promises.rename(tmp, markerPath);
       } catch {
       }
     });
@@ -63409,11 +63890,11 @@ var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")
     this.hydrated.add(userId);
     let filePath = this.workflowFilePath(userId);
     try {
-      if (((await import_node_fs26.promises.stat(filePath)).mode & 63) !== 0) {
+      if (((await import_node_fs27.promises.stat(filePath)).mode & 63) !== 0) {
         await this.rotateCorrupt(filePath);
         return;
       }
-      let raw = await import_node_fs26.promises.readFile(filePath, "utf-8"), parsed = JSON.parse(raw);
+      let raw = await import_node_fs27.promises.readFile(filePath, "utf-8"), parsed = JSON.parse(raw);
       if (parsed.schemaVersion !== CACHE_SCHEMA_VERSION) {
         await this.rotateCorrupt(filePath);
         return;
@@ -63426,7 +63907,7 @@ var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")
   }
   async rotateCorrupt(filePath) {
     try {
-      await import_node_fs26.promises.rename(filePath, filePath + ".bak");
+      await import_node_fs27.promises.rename(filePath, filePath + ".bak");
     } catch {
     }
   }
@@ -63437,7 +63918,7 @@ var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")
       schemaVersion: CACHE_SCHEMA_VERSION,
       entries: Array.from(userMap.entries())
     };
-    await import_node_fs26.promises.writeFile(tmp, JSON.stringify(data), { mode: CACHE_FILE_PERMS }), await import_node_fs26.promises.rename(tmp, filePath);
+    await import_node_fs27.promises.writeFile(tmp, JSON.stringify(data), { mode: CACHE_FILE_PERMS }), await import_node_fs27.promises.rename(tmp, filePath);
   }
   cacheDir(userId) {
     return path65.join(this.cacheRoot, this.userIdPrefix(userId));
@@ -63467,14 +63948,14 @@ var import_node_fs26 = require("node:fs"), path65 = __toESM(require("node:path")
     oldestKey !== null && userMap.delete(oldestKey);
   }
   async ensureCacheRoot() {
-    await import_node_fs26.promises.mkdir(this.cacheRoot, { recursive: !0, mode: CACHE_ROOT_PERMS });
+    await import_node_fs27.promises.mkdir(this.cacheRoot, { recursive: !0, mode: CACHE_ROOT_PERMS });
   }
   async ensureDir(dir) {
-    await import_node_fs26.promises.mkdir(dir, { recursive: !0, mode: CACHE_ROOT_PERMS });
+    await import_node_fs27.promises.mkdir(dir, { recursive: !0, mode: CACHE_ROOT_PERMS });
   }
   async rmRecursiveSafe(dir) {
     try {
-      await import_node_fs26.promises.rm(dir, { recursive: !0, force: !0 });
+      await import_node_fs27.promises.rm(dir, { recursive: !0, force: !0 });
     } catch {
     }
   }
@@ -63769,7 +64250,7 @@ async function registerDeviceEncryptionKey(appSyncClient, logger2, options = {})
 }
 
 // src/session/pending-session-create.ts
-var crypto27 = __toESM(require("node:crypto")), import_node_fs27 = require("node:fs"), fs45 = __toESM(require("node:fs/promises")), os37 = __toESM(require("node:os")), path66 = __toESM(require("node:path"));
+var crypto27 = __toESM(require("node:crypto")), import_node_fs28 = require("node:fs"), fs45 = __toESM(require("node:fs/promises")), os37 = __toESM(require("node:os")), path66 = __toESM(require("node:path"));
 var pendingRemovalFaultForTests = null, PermanentlyUnreadablePendingLedgerError = class extends Error {
   constructor(sessionId, message) {
     super(message);
@@ -63802,7 +64283,7 @@ function isTombstone(value) {
 }
 async function syncPendingDirectory() {
   if (process.platform === "win32") return;
-  let handle = await fs45.open(pendingDirectory(), import_node_fs27.constants.O_RDONLY);
+  let handle = await fs45.open(pendingDirectory(), import_node_fs28.constants.O_RDONLY);
   try {
     await handle.sync();
   } finally {
@@ -64210,10 +64691,10 @@ async function prepareSessionEncryption(sessionId, appSyncClient, logger2) {
 }
 
 // src/orchestration-shell/cli.ts
-var import_uuid14 = require("uuid");
+var import_uuid14 = require("uuid"), fs51 = __toESM(require("fs"));
 
 // src/substrate-launch/engage-substrate.ts
-var import_node_fs28 = require("node:fs"), os38 = __toESM(require("node:os")), path67 = __toESM(require("node:path"));
+var import_node_fs29 = require("node:fs"), os38 = __toESM(require("node:os")), path67 = __toESM(require("node:path"));
 
 // src/credential-broker/types.ts
 var BROKER_ROUTES = [
@@ -65805,17 +66286,17 @@ function deriveAuditPath(workdir) {
 async function assertAuditOutsideWorkdir(auditPath, workdir) {
   let realWorkdir;
   try {
-    realWorkdir = await import_node_fs28.promises.realpath(workdir);
+    realWorkdir = await import_node_fs29.promises.realpath(workdir);
   } catch {
     throw new Error(
       `CP-7 W3: cannot realpath workdir "${workdir}" \u2014 refusing to launch (audit containment fail-closed)`
     );
   }
   let auditDir = path67.dirname(auditPath);
-  await import_node_fs28.promises.mkdir(auditDir, { recursive: !0 });
+  await import_node_fs29.promises.mkdir(auditDir, { recursive: !0 });
   let realAuditDir;
   try {
-    realAuditDir = await import_node_fs28.promises.realpath(auditDir);
+    realAuditDir = await import_node_fs29.promises.realpath(auditDir);
   } catch {
     throw new Error(
       `CP-7 W3: cannot realpath audit dir "${auditDir}" \u2014 refusing to launch (fail-closed)`
@@ -65823,14 +66304,14 @@ async function assertAuditOutsideWorkdir(auditPath, workdir) {
   }
   let resolvedAuditPath = path67.join(realAuditDir, path67.basename(auditPath)), leafStat;
   try {
-    leafStat = await import_node_fs28.promises.lstat(resolvedAuditPath);
+    leafStat = await import_node_fs29.promises.lstat(resolvedAuditPath);
   } catch {
     leafStat = void 0;
   }
   let resolvedLeafTarget = resolvedAuditPath;
   if (leafStat?.isSymbolicLink())
     try {
-      resolvedLeafTarget = await import_node_fs28.promises.realpath(resolvedAuditPath);
+      resolvedLeafTarget = await import_node_fs29.promises.realpath(resolvedAuditPath);
     } catch {
       throw new Error(
         `CP-7 W3: audit leaf "${resolvedAuditPath}" is a symlink that does not resolve (dangling) \u2014 refusing to launch (fail-closed). The audit file must be a regular file in the sibling .codevibe/audit/ tree.`
@@ -66116,7 +66597,7 @@ async function engageWriteConfinedResolverSandbox(input) {
     homedir29,
     ...RESOLVER_AGENT_STATE_DIR_SEGMENTS[agentKind]
   );
-  await import_node_fs28.promises.mkdir(stateDir, { recursive: !0 }).catch(() => {
+  await import_node_fs29.promises.mkdir(stateDir, { recursive: !0 }).catch(() => {
   });
   let env = {}, nodeDir = process.execPath.slice(0, process.execPath.lastIndexOf("/"));
   env.PATH = `${SANDBOX_DEFAULT_PATH}:${nodeDir}`, env.HOME = homedir29;
@@ -67935,25 +68416,76 @@ async function runCompanion(args) {
     passthrough: args.passthrough
   });
 }
+function isFlagToken2(tok) {
+  return tok ? tok.startsWith("--") ? !0 : tok.startsWith("-") && !/^-\d+$/.test(tok) : !1;
+}
 function parseAuditArgs(argv) {
-  if (argv[0] !== "audit" || argv[1] !== "show") return null;
-  let rest = argv.slice(2), taskId, json = !1, sessionId;
+  let args = argv[0] === "node" || argv[0]?.endsWith("/node") || argv[0]?.endsWith("node.exe") ? argv.slice(2) : argv;
+  if (args[0] !== "audit" || args[1] !== "show")
+    return null;
+  let taskId, json = !1, sessionId, kind, verdictsOnly = !1, limit, offset, exportPath, rest = args.slice(2);
   for (let i = 0; i < rest.length; i++) {
     let a = rest[i];
     if (a === "--json") {
       json = !0;
       continue;
     }
+    if (a === "--verdicts-only") {
+      verdictsOnly = !0;
+      continue;
+    }
     if (a === "--session") {
-      sessionId = rest[++i];
+      let val = rest[++i];
+      if (!val || isFlagToken2(val))
+        return { taskId: taskId ?? "", json: !1, error: "Missing value for --session" };
+      sessionId = val;
+      continue;
+    }
+    if (a === "--kind") {
+      let val = rest[++i];
+      if (!val || isFlagToken2(val))
+        return { taskId: taskId ?? "", json: !1, error: "Missing value for --kind" };
+      kind = val;
       continue;
     }
-    if (!taskId && !a.startsWith("-")) {
-      taskId = a;
+    if (a === "--export") {
+      let val = rest[++i];
+      if (!val || isFlagToken2(val))
+        return { taskId: taskId ?? "", json: !1, error: "Missing value for --export" };
+      exportPath = val;
       continue;
     }
+    if (a === "--limit") {
+      let raw = rest[++i];
+      if (!raw || isFlagToken2(raw))
+        return { taskId: taskId ?? "", json: !1, error: "Missing value for --limit" };
+      let parsed = parseInt(raw, 10);
+      if (Number.isNaN(parsed) || parsed <= 0 || String(parsed) !== raw)
+        return { taskId: taskId ?? "", json: !1, error: `Invalid value for --limit: expected a positive integer, got "${raw}"` };
+      limit = parsed;
+      continue;
+    }
+    if (a === "--offset") {
+      let raw = rest[++i];
+      if (!raw || isFlagToken2(raw))
+        return { taskId: taskId ?? "", json: !1, error: "Missing value for --offset" };
+      let parsed = parseInt(raw, 10);
+      if (Number.isNaN(parsed) || parsed < 0 || String(parsed) !== raw)
+        return { taskId: taskId ?? "", json: !1, error: `Invalid value for --offset: expected a non-negative integer, got "${raw}"` };
+      offset = parsed;
+      continue;
+    }
+    if (!a.startsWith("-")) {
+      if (!taskId)
+        taskId = a;
+      else
+        return { taskId, json: !1, error: `Unexpected argument: "${a}"` };
+      continue;
+    }
+    return { taskId: taskId ?? "", json: !1, error: `Unrecognized option: "${a}"` };
   }
-  return taskId ? { taskId, json, sessionId } : { taskId: "", json, sessionId };
+  let result = { taskId: taskId ?? "", json, sessionId };
+  return kind !== void 0 && (result.kind = kind), verdictsOnly && (result.verdictsOnly = !0), limit !== void 0 && (result.limit = limit), offset !== void 0 && (result.offset = offset), exportPath !== void 0 && (result.exportPath = exportPath), result;
 }
 var MODEL_COMMANDS = /* @__PURE__ */ new Set([
   "install",
@@ -68095,9 +68627,14 @@ async function buildLocalGemmaPlannerAdapter(args) {
 }
 async function runAuditCli(parsed, deps) {
   let out = deps?.stdout ?? ((s) => process.stdout.write(s)), err = deps?.stderr ?? ((s) => process.stderr.write(s));
+  if (parsed.error)
+    return err(`${parsed.error}
+`), 2;
   if (!parsed.taskId)
     return err(
-      `Usage: codevibe audit show <task-id> [--json] [--session <session-id>]
+      `Usage: codevibe audit show <task-id> [--json] [--session <session-id>] [--kind <kind>] [--verdicts-only] [--limit <n>] [--offset <n>] [--export <path>]
+
+Note: --export will overwrite any existing file at <path>.
 `
     ), 2;
   let appsyncClient = deps?.appsyncClient ?? new AppSyncClient(), authenticated;
@@ -68130,9 +68667,34 @@ async function runAuditCli(parsed, deps) {
   let result = await runAuditBrowser({
     appsyncClient,
     taskId: parsed.taskId,
-    sessionId
+    sessionId,
+    kind: parsed.kind,
+    verdictsOnly: parsed.verdictsOnly,
+    limit: parsed.limit,
+    offset: parsed.offset
   });
-  return parsed.json ? (out(`${JSON.stringify(result, null, 2)}
+  if (result.kind === "ok" && parsed.exportPath) {
+    let writeFile4 = deps?.writeFileFn ?? ((p, c) => fs51.writeFileSync(p, c, "utf8"));
+    try {
+      let formatted = formatAuditExport(
+        result.model,
+        parsed.json ? "json" : "text",
+        { taskId: parsed.taskId, sessionId }
+      );
+      return writeFile4(parsed.exportPath, formatted), out(
+        `Audit log exported to ${parsed.exportPath} (${result.model.entries.length} entries)
+`
+      ), 0;
+    } catch (e) {
+      return err(
+        `Failed to export audit log to ${parsed.exportPath}: ${e?.message}
+`
+      ), 2;
+    }
+  }
+  return parsed.exportPath && result.kind !== "ok" ? (result.kind === "gated" ? err(`Cannot export audit log: ${result.headline} \u2014 ${result.upgradeHint}
+`) : err(`Cannot export audit log: ${result.line} (${result.reason})
+`), 1) : parsed.json ? (out(`${JSON.stringify(result, null, 2)}
 `), 0) : (out(`${renderAuditResultText(result)}
 `), 0);
 }