@tyvm/knowhow 0.0.146 → 0.0.147

package/src/login.ts

@@ -1,13 +1,28 @@
 import http from "./utils/http";
 import fs from "fs";
 import path from "path";
-import { chmod } from "fs/promises";
 import { ask } from "./utils";
 import { getConfig, updateConfig } from "./config";
 import { KNOWHOW_API_URL } from "./services/KnowhowClient";
 import { BrowserLoginService } from "./auth/browserLogin";
-
-export async function login(jwtFlag?: boolean): Promise<void> {
+import { authenticateWithKey, hasKeyPair, registerPublicKey } from "./auth/keyAuth";
+import { getOrCreatePublicKey } from "./auth/keyManager";
+
+/**
+ * Log in to Knowhow.
+ *
+ * Strategy (in order):
+ *   1. `--jwt`   flag: prompt for a raw JWT and write it to disk.
+ *   2. Key auth: if an Ed25519 key and configured organization exist, sign a
+ *                server challenge and exchange it for an organization-bound JWT.
+ *   3. Browser:  open the browser approval flow (first-time login or key not yet registered).
+ *
+ * After any successful login the local config is updated with the current user's orgId.
+ *
+ * @param jwtFlag      True when --jwt flag is passed.
+ * @param identityPath Optional path to a specific private key file (--identity flag).
+ */
+export async function login(jwtFlag?: boolean, identityPath?: string): Promise<void> {
   if (!KNOWHOW_API_URL) {
     throw new Error("Error: KNOWHOW_API_URL environment variable not set.");
   }
@@ -15,9 +30,8 @@ export async function login(jwtFlag?: boolean): Promise<void> {
   if (jwtFlag) {
     const jwt = await ask("Enter your JWT: ");
 
-    // Update the JWT file
     const configDir = path.join(process.cwd(), ".knowhow");
-    const jwtFile = path.join(process.cwd(), ".knowhow", ".jwt");
+    const jwtFile = path.join(configDir, ".jwt");
 
     if (!fs.existsSync(configDir)) {
       fs.mkdirSync(configDir, { recursive: true });
@@ -26,23 +40,69 @@ export async function login(jwtFlag?: boolean): Promise<void> {
     fs.chmodSync(jwtFile, 0o600);
     console.log("JWT updated successfully.");
   } else {
-    // Use browser login as default method
-    console.log("Starting browser-based authentication...");
+    const config = await getConfig();
+    const orgId = config.orgId;
+
+    // A local key is not proof of registration. Let the selected environment
+    // check it, but only when an organization is available to bind the attempt.
+    if (orgId && hasKeyPair(identityPath)) {
+      console.log("Found CLI identity — authenticating with public key...");
+      try {
+        const success = await authenticateWithKey(orgId, KNOWHOW_API_URL, identityPath);
+        if (success) {
+          console.log("✅ Successfully authenticated via public key!");
+          return await postLoginConfigUpdate(identityPath);
+        }
+        console.warn("Key authentication returned no JWT, falling back to browser login...");
+      } catch (error: unknown) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.warn(`Key authentication failed (${message}), falling back to browser login...`);
+      }
+    }
+
+    // Fall back when no org/key is configured or when key auth is unavailable.
+    await doBrowserLogin(identityPath);
+  }
+
+  await postLoginConfigUpdate(identityPath);
+}
+
+/** Complete browser PKCE, then best-effort bootstrap the selected identity. */
+async function doBrowserLogin(identityPath?: string): Promise<void> {
+  console.log("Starting browser-based authentication...");
+  try {
+    const existingConfig = await getConfig();
+    const existingOrgId = existingConfig?.orgId;
+    const browserLoginService = new BrowserLoginService(undefined, existingOrgId);
+    await browserLoginService.login();
+    console.log("✅ Successfully authenticated via browser!");
+
     try {
-      // Pass existing orgId from config (if any) so the browser pre-selects the right org
-      const existingConfig = await getConfig();
-      const existingOrgId = existingConfig?.orgId;
-      const browserLoginService = new BrowserLoginService(undefined, existingOrgId);
-      await browserLoginService.login();
-      console.log("Successfully authenticated via browser!");
-    } catch (error) {
-      console.error("Browser authentication failed:", error.message);
-      console.log("You can try manual JWT login with: knowhow login --jwt");
-      throw error;
+      const keyPair = getOrCreatePublicKey(identityPath);
+      await registerPublicKey(
+        await loadJwt(),
+        keyPair.publicKeyBase64,
+        KNOWHOW_API_URL
+      );
+      console.log(`Registered CLI identity ${keyPair.fingerprint}`);
+    } catch (registrationError: unknown) {
+      // Browser login remains valid when key registration is unavailable (for
+      // example during a rolling backend deployment or for a partial identity).
+      const message = registrationError instanceof Error
+        ? registrationError.message
+        : String(registrationError);
+      console.warn(`Could not register CLI identity (${message}). Browser login is still active.`);
     }
+  } catch (error: unknown) {
+    const msg = error instanceof Error ? error.message : String(error);
+    console.error("Browser authentication failed:", msg);
+    console.log("You can try manual JWT login with: knowhow login --jwt");
+    throw error;
   }
+}
 
-  // Get current user/org information
+/** After any successful login, update the local config with the current user/org. */
+async function postLoginConfigUpdate(identityPath?: string): Promise<void> {
   try {
     const storedJwt = await loadJwt();
     const { user, currentOrg } = await checkJwt(storedJwt);
@@ -59,25 +119,26 @@ export async function login(jwtFlag?: boolean): Promise<void> {
     }
 
     const hasProvider = config.modelProviders.find(
-      (provider) => provider.provider === "knowhow"
+      (provider: { provider: string }) => provider.provider === "knowhow"
     );
     if (!hasProvider) {
-      config.modelProviders.push({
-        provider: "knowhow",
-      });
+      config.modelProviders.push({ provider: "knowhow" });
     }
-    // Save orgId to config so sync:remote and other features use the correct org
+
     if (orgId) {
       config.orgId = orgId;
     }
 
+    if (identityPath) {
+      config.cliIdentityPath = path.resolve(identityPath);
+    }
+
     await updateConfig(config);
-  } catch (error) {
+  } catch (error: unknown) {
     if (http.isHttpError(error) && error.response) {
-      // error.body is the parsed JSON response body (set by http.ts when response is not ok)
-      const errData = error.body ?? { message: "Unknown error" };
+      const errData = (error as any).body ?? { message: "Unknown error" };
       throw new Error(
-        `Error: ${error.status} - ${errData?.message || "Unknown error"}`
+        `Error: ${(error as any).status} - ${errData?.message || "Unknown error"}`
       );
     }
     console.log(
@@ -112,7 +173,7 @@ export async function checkJwt(storedJwt: string) {
   const orgs = user.orgs;
   const orgId = response.data.orgId;
 
-  const currentOrg = orgs.find((org) => {
+  const currentOrg = orgs.find((org: { organizationId: string }) => {
     return org.organizationId === orgId;
   });
 

package/src/services/AgentService.ts

@@ -3,8 +3,10 @@ import { IAgent } from "../agents/interface";
 import { EventService } from "./EventService";
 import { ToolsService } from "./Tools";
 import { ConfigAgent } from "../agents/configurable/ConfigAgent";
+import { TraceAll } from "../util/Trace";
 import { AgentContext } from "../agents/base/base";
 
+@TraceAll()
 export class AgentService {
   private agents: Map<string, IAgent> = new Map();
   private agentContext: AgentContext | null = null;

package/src/services/AgentSyncFs.ts

@@ -3,6 +3,7 @@
  * Handles synchronization via filesystem files in .knowhow/processes/agents/taskId/
  */
 import { BaseAgent } from "../agents/base/base";
+import { TraceAll } from "../util/Trace";
 import { promises as fs } from "fs";
 import * as path from "path";
 import { watch } from "fs";
@@ -19,6 +20,7 @@ export interface FsSyncOptions {
  * AgentSyncFs handles filesystem-based synchronization for agent tasks
  * Creates files in .knowhow/processes/agents/{taskId}/ for status and input
  */
+@TraceAll()
 export class AgentSyncFs {
   /** Shared cleanup interval across all instances to avoid duplicate cleanup runs */
   private static sharedCleanupInterval: NodeJS.Timeout | null = null;
@@ -128,6 +130,66 @@ export class AgentSyncFs {
     }
   }
 
+  /**
+   * Persist the remote identity alongside the local task. Keeping the local
+   * slug and remote UUID as separate fields lets resume reconnect without ever
+   * mistaking one for the other.
+   */
+  static async persistRemoteIdentity(
+    taskId: string,
+    remoteTaskId: string,
+    remoteMessageId?: string
+  ): Promise<void> {
+    const taskPath = path.join(AgentSyncFs.sharedBasePath, taskId);
+    await AgentSyncFs.writeRemoteIdentity(
+      taskPath,
+      remoteTaskId,
+      remoteMessageId
+    );
+  }
+
+  async setRemoteIdentity(
+    remoteTaskId: string,
+    remoteMessageId?: string
+  ): Promise<void> {
+    if (!this.taskPath) return;
+    await AgentSyncFs.writeRemoteIdentity(this.taskPath, remoteTaskId, remoteMessageId);
+  }
+
+  private static async writeRemoteIdentity(
+    taskPath: string,
+    remoteTaskId: string,
+    remoteMessageId?: string
+  ): Promise<void> {
+    try {
+      const metadataPath = path.join(taskPath, "metadata.json");
+      let metadata: any = {};
+      try {
+        metadata = JSON.parse(await fs.readFile(metadataPath, "utf8"));
+      } catch {
+        // The normal path already created metadata, but recover if it was
+        // removed or malformed while the task was running.
+      }
+
+      metadata.remoteTaskId = remoteTaskId;
+      // Preserve the established session field name for compatibility with
+      // callers that already read knowhowTaskId.
+      metadata.knowhowTaskId = remoteTaskId;
+      if (remoteMessageId) {
+        metadata.remoteMessageId = remoteMessageId;
+        metadata.knowhowMessageId = remoteMessageId;
+      }
+
+      await fs.writeFile(
+        metadataPath,
+        JSON.stringify(metadata, null, 2),
+        "utf8"
+      );
+    } catch (error) {
+      console.error(`❌ Failed to persist remote task identity:`, error);
+    }
+  }
+
   /**
    * Append a token usage entry (including the full message chain sent for
    * that call) to usage.json. This is intended for debugging cache-hit
@@ -217,6 +279,9 @@ export class AgentSyncFs {
       // thread messages via `_reasoning_details` / `reasoning_summary`.)
       metadata.reasoningEffort = agent.getReasoningEffort?.();
       metadata.summarizeReasoning = agent.getSummarizeReasoning?.();
+      // Tool schemas are part of the provider cache prefix. Preserve the exact
+      // request-visible list so resume/fork can recreate the same request.
+      metadata.enabledTools = agent.getEnabledToolNames();
       metadata.inProgress = inProgress;
       metadata.lastUpdate = new Date().toISOString();
 

package/src/services/AgentSyncKnowhowWeb.ts

@@ -10,6 +10,7 @@ import {
 } from "./KnowhowClient";
 import { BaseAgent } from "../agents/base/base";
 import { wait } from "../utils";
+import { TraceAll } from "../util/Trace";
 
 export interface SyncOptions {
   messageId?: string;
@@ -27,6 +28,7 @@ export interface TaskSyncState {
  * AgentSynchronization handles all communication with the Knowhow API
  * for task creation, updates, status polling, and message synchronization
  */
+@TraceAll()
 export class AgentSyncKnowhowWeb {
   private client: KnowhowSimpleClient;
   private baseUrl: string;
@@ -36,6 +38,7 @@ export class AgentSyncKnowhowWeb {
   private agent: BaseAgent | undefined;
   private threadUpdateHandler: ((...args: any[]) => void) | undefined;
   private doneHandler: ((...args: any[]) => void) | undefined;
+  private syncErrorLogged = false;
   /**
    * Tracks the most recent in-flight thread update API call.
    * The done handler awaits this before sending the finalization call,
@@ -48,6 +51,17 @@ export class AgentSyncKnowhowWeb {
     this.client = new KnowhowSimpleClient(baseUrl);
   }
 
+  /**
+   * Remote outages can make both the update and pending-message requests fail
+   * on every thread event. Report the first failure for this task, then stay
+   * quiet so an unavailable optional sync service does not flood the chat.
+   */
+  private reportSyncErrorOnce(message: string, error: unknown): void {
+    if (this.syncErrorLogged) return;
+    this.syncErrorLogged = true;
+    console.error(message, error);
+  }
+
   /**
    * Create a new chat task in Knowhow
    */
@@ -68,7 +82,7 @@ export class AgentSyncKnowhowWeb {
       console.log(`✅ Created Knowhow chat task: ${knowhowTaskId}`);
       return knowhowTaskId;
     } catch (error) {
-      console.error(`❌ Failed to create Knowhow chat task:`, error);
+      this.reportSyncErrorOnce(`❌ Failed to create Knowhow chat task:`, error);
       return undefined;
     }
   }
@@ -95,7 +109,7 @@ export class AgentSyncKnowhowWeb {
       });
       console.log(`✅ Updated Knowhow chat task: ${knowhowTaskId}`);
     } catch (error) {
-      console.error(`❌ Failed to update Knowhow chat task:`, error);
+      this.reportSyncErrorOnce(`❌ Failed to update Knowhow chat task:`, error);
     }
   }
 
@@ -167,7 +181,10 @@ export class AgentSyncKnowhowWeb {
       await this.client.markMessagesAsProcessed(knowhowTaskId, messageIds);
       console.log(`✅ Marked ${messageIds.length} message(s) as processed`);
     } catch (error) {
-      console.error(`❌ Error checking/processing pending messages:`, error);
+      this.reportSyncErrorOnce(
+        `❌ Error checking/processing pending messages:`,
+        error
+      );
       // Continue execution even if synchronization fails
     }
   }
@@ -226,7 +243,7 @@ export class AgentSyncKnowhowWeb {
         }
         // Still paused, continue waiting
       } catch (error) {
-        console.error(`❌ Error polling task status:`, error);
+        this.reportSyncErrorOnce(`❌ Error polling task status:`, error);
         // Continue polling even on errors
       }
     }
@@ -350,6 +367,7 @@ export class AgentSyncKnowhowWeb {
     this.eventHandlersSetup = false;
     this.finalizationPromise = null;
     this.pendingThreadUpdatePromise = null;
+    this.syncErrorLogged = false;
   }
 
   /**

package/src/services/BehaviorsService.ts

@@ -4,6 +4,7 @@ import * as os from "os";
 import { KnowhowSimpleClient } from "./KnowhowClient";
 import { createHash } from "crypto";
 import { getConfig } from "../config";
+import { TraceAll } from "../util/Trace";
 
 const BEHAVIORS_DIR = ".knowhow/behaviors";
 const LOCAL_SKILLS_DIRS = [".agents/skills", ".knowhow/skills"];
@@ -30,6 +31,7 @@ export interface Behavior {
  * In-memory singleton for behaviors/skills.
  * Call initFromDisk() once at startup; tools then read from memory.
  */
+@TraceAll()
 export class BehaviorsService {
   private behaviors: Behavior[] = [];
   private skills: Behavior[] = [];

package/src/services/DockerService.ts

@@ -4,6 +4,7 @@ import * as os from "os";
 import { Config } from "../types";
 import { updateConfig } from "../config";
 import * as crypto from "crypto";
+import { TraceAll } from "../util/Trace";
 
 export interface DockerWorkerOptions {
   workspaceDir: string;
@@ -14,6 +15,7 @@ export interface DockerWorkerOptions {
   unshare?: boolean;
 }
 
+@TraceAll()
 export class DockerService {
   private static readonly IMAGE_NAME = "knowhow-worker";
   private static readonly CONTAINER_PREFIX = "knowhow-worker";

package/src/services/EmbeddingService.ts

@@ -1,4 +1,5 @@
 import * as path from "path";
+import { TraceAll } from "../util/Trace";
 import { globSync } from "glob";
 
 import {
@@ -38,6 +39,7 @@ interface EmbeddingServiceContext {
   plugins: PluginService;
 }
 
+@TraceAll()
 export class EmbeddingService {
   private config: Config;
   private embeddingClient: GenericClient;

package/src/services/EmbeddingsService.ts

@@ -20,6 +20,9 @@ export interface EmbeddingsResolver {
  * Modules can register a resolver for a given remoteType (e.g. "github", "s3")
  * via registerResolver(), and the core upload()/download() functions delegate to it.
  */
+import { TraceAll } from "../util/Trace";
+
+@TraceAll()
 export class EmbeddingsService {
   private resolvers = new Map<string, EmbeddingsResolver>();
 

package/src/services/KnowhowClient.ts

@@ -1,6 +1,10 @@
 import { createHash } from "crypto";
-import http from "../utils/http";
+import { TraceAll } from "../util/Trace";
+import http, { HTTP_UNAUTHORIZED_HANDLER, RefreshableHeaders } from "../utils/http";
 import fs from "fs";
+import { getConfigSync } from "../config";
+import { exchangePublicKeyJwt, storeJwt } from "../auth/keyAuth";
+import { keyPairExists } from "../auth/keyManager";
 import { Message } from "../clients/types";
 import path from "path";
 import {
@@ -141,17 +145,32 @@ export function loadKnowhowJwt(): string {
 export const KNOWHOW_API_URL =
   process.env.KNOWHOW_API_URL || "https://api.knowhow.tyvm.ai";
 
+@TraceAll()
 export class KnowhowSimpleClient {
-  headers: Record<string, string> = {};
+  headers: RefreshableHeaders = {};
   jwtValidated = false;
+  private readonly canRefreshJwt: boolean;
+  private refreshPromise?: Promise<void>;
 
   constructor(
     private baseUrl = KNOWHOW_API_URL,
-    private jwt = loadKnowhowJwt()
+    jwt?: string
   ) {
-    this.setJwt(jwt);
+    // Explicit tokens (including KNOWHOW_JWT worker credentials) have no
+    // corresponding local identity and must never trigger interactive renewal.
+    this.canRefreshJwt = jwt === undefined && !process.env.KNOWHOW_JWT;
+    this.jwt = jwt ?? loadKnowhowJwt();
+    this.setJwt(this.jwt);
+    if (this.canRefreshJwt) {
+      Object.defineProperty(this.headers, HTTP_UNAUTHORIZED_HANDLER, {
+        enumerable: false,
+        value: () => this.renewJwt(true),
+      });
+    }
   }
 
+  private jwt: string;
+
   /**
    * Reload the JWT from disk (useful after login refreshes the token).
    */
@@ -165,9 +184,45 @@ export class KnowhowSimpleClient {
 
   setJwt(jwt: string) {
     this.jwt = jwt;
-    this.headers = {
-      Authorization: `Bearer ${this.jwt}`,
-    };
+    // Keep this object stable: the HTTP wrapper retries with the same reference.
+    this.headers.Authorization = `Bearer ${this.jwt}`;
+  }
+
+  private jwtExpiresSoon(): boolean {
+    try {
+      const payload = JSON.parse(Buffer.from(this.jwt.split(".")[1], "base64url").toString("utf8"));
+      return typeof payload.exp === "number" && payload.exp * 1000 - Date.now() < 5 * 60 * 1000;
+    } catch {
+      return false;
+    }
+  }
+
+  private async renewJwt(force = false): Promise<void> {
+    if (!this.canRefreshJwt) return;
+    if (!force && !this.jwtExpiresSoon()) return;
+    if (this.refreshPromise) return this.refreshPromise;
+
+    this.refreshPromise = (async () => {
+      const config = getConfigSync();
+      const identityPath = config.cliIdentityPath;
+      if (!config.orgId || !keyPairExists(identityPath)) {
+        throw new Error("JWT expired and the CLI identity is unavailable. Please run `knowhow login` again.");
+      }
+      try {
+        const freshJwt = await exchangePublicKeyJwt(config.orgId, this.baseUrl, identityPath);
+        storeJwt(freshJwt);
+        this.setJwt(freshJwt);
+        this.jwtValidated = true;
+      } catch (error) {
+        throw new Error(
+          "Unable to renew the CLI session; the identity may have been revoked. Please run `knowhow login` again.",
+          { cause: error }
+        );
+      }
+    })().finally(() => {
+      this.refreshPromise = undefined;
+    });
+    return this.refreshPromise;
   }
 
   async checkJwt() {
@@ -175,6 +230,8 @@ export class KnowhowSimpleClient {
       throw new Error("No JWT found. Please login first.");
     }
 
+    await this.renewJwt();
+
     if (!this.jwtValidated) {
       try {
         this.jwtValidated = true;
@@ -186,6 +243,10 @@ export class KnowhowSimpleClient {
           return org.organizationId === orgId;
         });
       } catch (error) {
+        this.jwtValidated = false;
+        if (error instanceof Error && error.message.includes("renew the CLI session")) {
+          throw error;
+        }
         throw new Error("Invalid JWT. Please login again.");
       }
     }

package/src/services/LazyToolsService.ts

@@ -1,4 +1,5 @@
 import { minimatch } from "minimatch";
+import { TraceAll } from "../util/Trace";
 import { ToolsService, ToolContext, ToolCallContext } from "./Tools";
 import { Tool } from "../clients/types";
 import { ToolCall } from "../clients/types";
@@ -21,6 +22,7 @@ import { definitions } from "../agents/tools/lazy/definitions";
  * In web sessions where you get a new ToolService each interaction, then the cache busting is going to happen with each enable
  *
  */
+@TraceAll()
 export class LazyToolsService extends ToolsService {
   private allTools: Tool[] = [];
   // Start with lazy tools enabled by default
@@ -104,6 +106,13 @@ export class LazyToolsService extends ToolsService {
     };
   }
 
+  /** Replace glob state with an exact persisted request-visible tool list. */
+  restoreEnabledTools(names: string[]): void {
+    this.enabledPatterns = [...new Set(names)];
+    this.disabledPatterns = [];
+    this.updateVisibleTools();
+  }
+
   // Disable tools matching glob patterns
   disableTools(patterns: string[]) {
     for (const pattern of patterns) {

package/src/services/Mcp.ts

@@ -6,6 +6,7 @@ import fs from "fs";
 import { McpConfig } from "../types";
 import { Tool } from "../clients";
 import { getConfig } from "../config";
+import { TraceAll } from "../util/Trace";
 import { ToolsService } from "./Tools";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
@@ -36,6 +37,7 @@ export * from "./McpWebsocketTransport";
  * Each of the tools are namespaced with a prefix: mcp_index_servername_toolName
  * This services handles calls made to the namespaced function name, and finds the proper client to call the tool on.
  */
+@TraceAll()
 export class McpService {
   connected = [];
   transports: Transport[] = [];

package/src/services/McpServer.ts

@@ -6,9 +6,11 @@ import { Tool, ToolProp } from "../clients/types";
 import { ToolsService } from "./Tools";
 import { MCPWebSocketTransport } from "./McpWebsocketTransport";
 import { WebSocket } from "ws";
+import { TraceAll } from "../util/Trace";
 
 export type McpServerConfig = { name: string; version: string };
 
+@TraceAll()
 export class McpServerService {
   server: McpServer | null = null;
   constructor(private toolsService: ToolsService) {}

package/src/services/MessageProcessor.ts

@@ -1,4 +1,5 @@
 import { Message } from "../clients/types";
+import { TraceAll } from "../util/Trace";
 
 export type ProcessorLifecycle =
   | "initial_call"
@@ -17,6 +18,7 @@ export interface ProcessorRegistration {
   priority: number;
 }
 
+@TraceAll()
 export class MessageProcessor {
   private processors: Map<ProcessorLifecycle, ProcessorRegistration[]> =
     new Map();

package/src/services/MinimalToolsService.ts

@@ -5,6 +5,7 @@ import { inspectTools } from "../agents/tools/minimal/inspectTools";
 import { minimalDefinitions } from "../agents/tools/minimal/definitions";
 import { finalAnswer } from "../agents/tools/finalAnswer";
 import { includedTools } from "../agents/tools/list";
+import { TraceAll } from "../util/Trace";
 
 /*
  * MinimalToolsService
@@ -19,6 +20,7 @@ import { includedTools } from "../agents/tools/list";
  * - Works on all providers and older models (no provider-specific defer_loading needed).
  * - Agents discover tools via inspectTools() and call them via callTool().
  */
+@TraceAll()
 export class MinimalToolsService extends ToolsService {
   /** Full catalog of every registered tool (base + extended). */
   private allToolsCatalog: Tool[] = [];

package/src/services/SessionManager.ts

@@ -5,10 +5,12 @@ import * as fs from "fs";
 import * as fsPromises from "fs/promises";
 import * as path from "path";
 import { TaskInfo, ChatSession } from "../chat/types";
+import { TraceAll } from "../util/Trace";
 
 /**
  * SessionManager handles saving, loading, and managing agent sessions
  */
+@TraceAll()
 export class SessionManager {
   private sessionsDir: string;
 
@@ -69,6 +71,7 @@ export class SessionManager {
         provider: taskInfo.provider,
         reasoningEffort: taskInfo.reasoningEffort,
         summarizeReasoning: taskInfo.summarizeReasoning,
+        enabledTools: taskInfo.enabledTools,
       };
 
       fs.writeFileSync(sessionPath, JSON.stringify(session, null, 2));
@@ -115,6 +118,8 @@ export class SessionManager {
             session.reasoningEffort = taskInfo.reasoningEffort;
           if (taskInfo.summarizeReasoning !== undefined)
             session.summarizeReasoning = taskInfo.summarizeReasoning;
+          if (taskInfo.enabledTools !== undefined)
+            session.enabledTools = taskInfo.enabledTools;
         }
 
         fs.writeFileSync(sessionPath, JSON.stringify(session, null, 2));

package/src/services/SkillsService.ts

@@ -4,6 +4,7 @@ import * as os from "os";
 import { createHash } from "crypto";
 import * as https from "https";
 import { KnowhowSimpleClient } from "./KnowhowClient";
+import { TraceAll } from "../util/Trace";
 
 // Default local install dir (relative to cwd)
 const LOCAL_SKILLS_DIR = ".knowhow/skills";
@@ -233,6 +234,7 @@ export function parseSkillRef(
   return { owner, repo, skill, sourceUrl };
 }
 
+@TraceAll()
 export class SkillsService {
   private cwd: string;
   private isGlobal: boolean;