@warlock.js/ai-panoptic 4.8.1 → 4.9.0

package/cjs/index.cjs

@@ -3,8 +3,9 @@ let _warlock_js_ai = require("@warlock.js/ai");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_http = require("node:http");
+let _warlock_js_logger = require("@warlock.js/logger");
 
-//#region ../@warlock.js/ai-panoptic/src/exporters/utils/walk-spans.ts
+//#region ../ai-panoptic/src/exporters/utils/walk-spans.ts
 /**
 * Depth-first pre-order traversal of a {@link TraceSpan} tree, yielding
 * the root first and then each descendant in `children` (invocation)
@@ -23,7 +24,7 @@ function* walkSpans(root) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/collector/normalize-error.ts
+//#region ../ai-panoptic/src/collector/normalize-error.ts
 /**
 * Project a captured execution error onto the structural
 * {@link TraceSpanError} shape used on a failed / cancelled span.
@@ -71,7 +72,7 @@ function pickString(value) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/collector/extract-span-attributes.ts
+//#region ../ai-panoptic/src/collector/extract-span-attributes.ts
 /**
 * Build the free-form `TraceSpan.attributes` bag for one report node.
 *
@@ -148,7 +149,7 @@ function addToolAttributes(attributes, extensions) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/collector/report-to-span.ts
+//#region ../ai-panoptic/src/collector/report-to-span.ts
 /**
 * Project one {@link BaseReport} node — and its entire subtree — into a
 * {@link TraceSpan}. Pure and recursive: identity, timing, status, and
@@ -281,7 +282,7 @@ function lastNonEmptyOutput(trips) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/collector/report-to-trace.ts
+//#region ../ai-panoptic/src/collector/report-to-trace.ts
 /**
 * Project an outermost {@link BaseReport} (one whole `.execute()` /
 * `.invoke()` run) into a {@link Trace} — the root {@link
@@ -332,7 +333,7 @@ function reportToTrace(report, rootError, options) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/collector/collector.ts
+//#region ../ai-panoptic/src/collector/collector.ts
 /**
 * Drive the source end of the Panoptic pipeline: ingest core
 * `@warlock.js/ai` {@link BaseReport} trees, project them into {@link
@@ -456,7 +457,7 @@ function createCollector(options = {}) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/store/match-trace.ts
+//#region ../ai-panoptic/src/store/match-trace.ts
 /**
 * Test whether one trace satisfies a {@link TraceQuery}. Every declared
 * filter field must match (logical AND); absent fields are ignored, so
@@ -498,7 +499,7 @@ function toEpoch(bound) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/store/sum-usage.ts
+//#region ../ai-panoptic/src/store/sum-usage.ts
 /**
 * Fold a child {@link Usage} into a running accumulator. Token channels
 * (`input` / `output` / `total`) always sum; the optional cache /
@@ -559,7 +560,7 @@ function sumOptional(accumulator, next) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/store/cache-trace-store.ts
+//#region ../ai-panoptic/src/store/cache-trace-store.ts
 const DEFAULT_PREFIX = "panoptic";
 /**
 * Cache-backed {@link TraceStoreContract} with a **write-through** design
@@ -844,7 +845,7 @@ function createCacheTraceStore(cache, options = {}) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/store/in-memory-trace-store.ts
+//#region ../ai-panoptic/src/store/in-memory-trace-store.ts
 /**
 * In-memory {@link TraceStoreContract} that doubles as an
 * {@link ExporterContract} — register it on a collector
@@ -980,7 +981,7 @@ function createInMemoryTraceStore(options) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/exporters/utils/total-cost.ts
+//#region ../ai-panoptic/src/exporters/utils/total-cost.ts
 /**
 * Collapse a {@link Usage.cost} breakdown into a single USD scalar by
 * summing every populated field. Mirrors the formula documented on
@@ -1001,7 +1002,7 @@ function totalCostUsd(usage) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/exporters/utils/gen-ai-attributes.ts
+//#region ../ai-panoptic/src/exporters/utils/gen-ai-attributes.ts
 /**
 * Subset of the OpenTelemetry GenAI semantic-convention attribute keys
 * Panoptic emits. Kept as a named constant map (not inline string
@@ -1089,7 +1090,7 @@ function mergeScalarAttributes(target, source) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/exporters/console/format-span-io.ts
+//#region ../ai-panoptic/src/exporters/console/format-span-io.ts
 /** Default cap on how many characters of captured content a console line shows. */
 const DEFAULT_IO_MAX_CHARS = 500;
 /**
@@ -1139,7 +1140,7 @@ function stringify(value) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/exporters/console/format-span-line.ts
+//#region ../ai-panoptic/src/exporters/console/format-span-line.ts
 /**
 * Render a single {@link TraceSpan} as one scannable console line:
 * `<status> <type> "<name>" — <duration>ms, <tokens> tok[, $<cost>]`.
@@ -1176,7 +1177,7 @@ function statusMarker(status) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/exporters/console/console-exporter.ts
+//#region ../ai-panoptic/src/exporters/console/console-exporter.ts
 const EXPORTER_NAME$3 = "console";
 /**
 * Zero-dependency {@link ExporterContract} that prints traces to a
@@ -1267,7 +1268,7 @@ function spanDepth(root, targetSpanId, depth = 0) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/exporters/file/file-exporter.ts
+//#region ../ai-panoptic/src/exporters/file/file-exporter.ts
 const EXPORTER_NAME$2 = "file";
 /**
 * Zero-dependency {@link ExporterContract} that appends completed traces
@@ -1358,7 +1359,7 @@ var FileTraceWriter = class {
 };
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/exporters/langfuse/langfuse-exporter.ts
+//#region ../ai-panoptic/src/exporters/langfuse/langfuse-exporter.ts
 const EXPORTER_NAME$1 = "langfuse";
 let LangfuseSdk;
 let isModuleExists$1 = null;
@@ -1562,7 +1563,7 @@ function toLevel(span) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/exporters/otel/otel-exporter.ts
+//#region ../ai-panoptic/src/exporters/otel/otel-exporter.ts
 const EXPORTER_NAME = "otel";
 const DEFAULT_TRACER_NAME = "@warlock.js/ai-panoptic";
 let OtelApi;
@@ -1715,7 +1716,7 @@ function toEpochMillis(isoTimestamp) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/panoptic/panoptic-middleware.ts
+//#region ../ai-panoptic/src/panoptic/panoptic-middleware.ts
 /**
 * Build an {@link AgentMiddleware} that feeds a collector from the
 * `execute`- and `supervisor`-level hooks. An alternative wiring to event
@@ -1781,7 +1782,7 @@ function isReport(value) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/panoptic/panoptic.ts
+//#region ../ai-panoptic/src/panoptic/panoptic.ts
 /**
 * Terminal `*.completed` events of every core primitive that carries the
 * finalized `result` (and therefore the `report` tree). These fire once
@@ -1918,7 +1919,58 @@ function panoptic(options = {}) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/dashboard/parse-query.ts
+//#region ../ai-panoptic/src/evaluate/evaluate-system-prompt.ts
+/**
+* Grade `systemPrompt` with the configured judge model, reusing
+* `ai.prompts().validate()`'s own `judgePromptBody` — never a second
+* judging implementation. `instructionsOverride` (the dashboard's
+* per-run textarea) wins over `config.instructions`; with neither, the
+* judge falls back to `judgePromptBody`'s built-in prompt-quality rubric.
+*
+* The judge itself never throws (`judgePromptBody` degrades to an
+* issues-only outcome on failure) — the only thing that CAN throw here is
+* resolving `config.model` (a factory constructing an SDK client), which
+* the caller (the dashboard route) is expected to catch.
+*/
+async function evaluateSystemPrompt(systemPrompt, config, instructionsOverride) {
+	return (0, _warlock_js_ai.judgePromptBody)(systemPrompt, typeof config.model === "function" ? await config.model() : config.model, instructionsOverride?.trim() || config.instructions);
+}
+
+//#endregion
+//#region ../ai-panoptic/src/evaluate/extract-last-system-prompt.ts
+/**
+* Pull the LAST `{role: "system"}` message off a span's captured `input`.
+*
+* Only present under `captureContent` (off by default), and only shaped
+* this way for non-tool spans — either the `[system, user]` first-trip pair
+* or, under `fullHistory`, the full `CapturedMessage[]` conversation (see
+* `collector/report-to-span.ts`). "Last" (not "only") matters for
+* `fullHistory`: a long-running agent can carry more than one system-role
+* turn, and the most recent one is the one actually in effect. Returns
+* `undefined` for a tool span, an agent with no system prompt, or when
+* content capture is off — the caller treats that as "nothing to evaluate."
+*/
+function extractLastSystemPrompt(span) {
+	if (!Array.isArray(span.input)) return;
+	for (let index = span.input.length - 1; index >= 0; index -= 1) {
+		const entry = span.input[index];
+		if (entry && typeof entry === "object" && entry.role === "system") return typeof entry.content === "string" ? entry.content : void 0;
+	}
+}
+
+//#endregion
+//#region ../ai-panoptic/src/evaluate/find-span-by-id.ts
+/** Depth-first search for the span with `spanId` inside a trace's span tree. */
+function findSpanById(root, spanId) {
+	if (root.spanId === spanId) return root;
+	for (const child of root.children) {
+		const found = findSpanById(child, spanId);
+		if (found !== void 0) return found;
+	}
+}
+
+//#endregion
+//#region ../ai-panoptic/src/dashboard/parse-query.ts
 /**
 * The set of terminal statuses a stored trace can carry. Used to keep
 * `parseQuery` from forwarding arbitrary `?status=` junk into the store.
@@ -1970,7 +2022,7 @@ function parseQuery(params) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/dashboard/warlock-logo.ts
+//#region ../ai-panoptic/src/dashboard/warlock-logo.ts
 /**
 * The Warlock logo as an inlined base64 PNG data URI (64x64, ~9KB).
 * Inlined so the dashboard stays a single self-contained, offline-capable
@@ -1981,7 +2033,7 @@ function parseQuery(params) {
 const WARLOCK_LOGO_DATA_URI = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAkvklEQVR42nV7Z5hb1bX2u9Y+RRpNn7E9425s02wMxgZMNc1AqIkJLTcxgQChpBEC94bwpVwSCCQBEkghECD0DiZwIRBaAhhiMGCDccEejz3F0zQzGrVT9l7fj6MjaQzR8+iRdHTO3nutvcq7yiYikAgAAESASPQJRN8BgLnyO/6fCDCmfC+JoHQ3QEQQkfg+MqbqPwDE0f3xfACiGySayxiMe1XPt+ureoz4d7zW6DvFo4OZSAQipQdEAFW6o/xgPBlz5drnvZiJiBC/owkZYKKqiSMGACDmykKVGj+ySOlGqsy/K5HVa6v+nyNmUnnC0pd4/fG7mkkxc5hLDIh27PNviHe9tLFlYkq7DiKCEZLKRESAxJPSODoIUIpJpLwJ5XuoakwRUPyKmUiVbaLKWNF/1RJcuoMqdBGqSPsMU8dJQCzqpe9kTGXw6oeqGC3VkwMAKy7vSCwJVEVBdD99ZjyOLxHATON2Lh4nVquYuOjaeKkoTSVVdFH8VB2A2397sNO1Y8T09PsVEaVoYi49zK5LzDyO20wEVqpyPf6tFDGVOR7xrrR3pBSYuTxu6U2sFLPtEFeNTzGfEGsRR3NwNAcxl2WCiOLfFamsfts2sWWBmUEAURNAN14M1btl2aK+jmXznJKWlHYHpFRpsmjS8mRlokrEKBU/VFYFtm1iZiozT6mYARQTXx43XjzAlAB44QyXDpphUx0zlxbEllXZiOhZoojJEdHjbE+JwJjwte+c0vCHG/e3AZBlgwgWAaBVz852R3oPPcfrm39d0NfWXM0sK9bx2IpH4lsR/CpdjSQwFtvSp9YCkYhXIoLIugtVPSuxpBkDOCBceLKNr3/ZozUfS61SZI4/1Co89JiSm54MsDMbxvdLrN8VDyOxmJExgGvZKPqB/N+T89QRRzQu1UF/clMy/QIA1FsuTQ88eeajRQ3NU2ouTuT7zlLFnstpVjZd8jVlZSxb8SpdL1+LJ491D4AwExmBiKnoZLUbjI3keLdFOGl+Da69OsRgGk7L7NS+U3c3K0KvmO/aJPfZnto4sdGEN97Ecs9rATJeUG0jJOK8QASwLFAQMHa3DF7ffnBDU83I+chlDyzmM1c1zh3dngTTMTByz/bDpte24Gon038W+nb8eVgVrtl7QW3YJ9nyxpSte6xLSoFiMYzEOdY5lHXWsojG6X2VHsbiXq0qE5IO3/fjGt76d1ivP9Q8tfODxssL/amPZCgRmJ2On+tOvLvt/eRFqx5LtuU3pKxVdzSqRTOSHCEGVNudcbreuemoWr9vz2vDTc3bRlc7XxQRzEmAH/4+eLTv8EV+cfHzZmjPorxb84H5kOYCU6hkP7lqnIrLYQbZ9jijxdUTV2xEdJ0V8a5MYAYxVwzcisPqeOuz4H/8tb7249dbjx/ZVr9SD7g52WmFst3NyGY7LzssEw64meHO1COb36o9et3zdm3uE0vd/I0ktyYVgyIbsKuxW//OPMdsbjiosMo6e83DXDMZoE9fnefkRg47OfTnfyBjc3xZXZuVVfzNv2+fzRMTarzhjQ3I57m3issqIbaS0FSrQnwPc9l+gBnQmrD/5ATdcI2gpb2oPG6bOWOOWdHSnDvXYX8qDIoY5YLZKJY2AmsuhBoliQTZAdmdmRH33nQX399cm+7s/DihL7vGyNvbA4BMWXCZSWCEDGBEgLMaQH9au7Q21ZpdYbtD/0NB2IYNo0Am/6Jus1dM2LMuPYyB6rWDqAyExtsAZpBSJFVQt4QqPosFSj63gvKEaMWRLt19S5EGgoaGCdOaTp69R/Ha5sbc2RaFtfB5DNthsMXUSF7yYVrAQ0gwyEOKAuWa5mQ9Dk212IvyXkPOD6X7kq/mvAk6iQ82CXKBKc8nAPZpc3nweU03/OuY9lT9zqstp/cHZPxGbMkbDORHUcNXqf2++JFgDWtUQEgZY0R6TzCmgo9jMFEBLZX/qiFtlckUMQYL2m265X8EOdu22mc1zp8xy7+osaH4ZcsOGiGcxyA0usMECiZAgv8pTep2PaDrVEYupBCL0UCE3awA7WQhQQltEqP5TO1TQ13qdn9nx0db3qNgxa+UDOZCARin7Sv08/8VmnPYEXvZqvunSg2cAiXADoTYlnfB9Pvs9ORVe+zpB70coERkvKUQif3XLmIdu72SqJUJJwJpHcHYqkAHdcrGlWdbOOVkUBo1rbvNMadPmhhenEz6e4Pho6A89IY2MqEFizaiju6UKdZjD743s19Py+Jr3D+V+sxXkDPnAjQTrVaAGZZBi+2Ak64ftG4aHUjd2rN+x71fPqU7t1UzXXOmwXdu2Muqq69daqH7WqbhA6CgMaBCfFq0JZRNpoFPtw5ftAF4h5WK3bggDs5EAKsqepIq0SgDXGOkhPdFFFM5ghOAxDCO3NPFr3+g0OuTqybwkoXT/Mvq64MTlGUcaM5hQIC0l4RgGI38BCbwHcPJ2vVnTfbDd+lTygSMczF3x/begd9MGxj+B4bNRcgGp2KzbsQoeZhiBY7lTW+pLy6WGfa9tlZ08/kaF/xm36Rj/LOV2XoNSXYGLAoxZIX41FMoSmAS9MfvZ2ZsJLzHpCKLbcKwHNdU6KXyjpf1YtnBbVZ73US598W1emKNRf15DVAkLhUswPTdoxtxwpEhuXP19Nm704rWlvB81zFTweShQAHSoY2CaDh4E/XWH/Qk65WrDpyYe2eoj94dDeD5gQCAk3BIihYCHGeK21+qdYf9Y1EwlwFyMFK2hSR1wvW/RtNmrX7kwi102g3zWi0z+h02I5eR9hqgWKNghbLeB8a0bRx6OddgfbXhqNQgMFwd3BNzGU9IJQolqvaxePDWae1dmw64dKj7gL0fugzquCZwq21VwWCiFBL02O9qaz9+I/Gl0W3uK7rf9WTADWQgkZftTkE+UUVZzx/LFvsKM5CY8vQD+/AX2uu40XG4FPvRqpeXtL389JwImhIxQzFQT8AyCjvdybLR+oFsUh+ZbdYV993WyGdOZvZGF87VI+0PymDSl52Olp1OIDtqPP2CW9APsRc+wgP5Z60To50uuz3c+OP9nTOPb1IAyHHiOKGMAyLQExHn0BO/oaaRja3Phrnpa7Pp2Rf3bprTehVAJ80mpkqmgD5e3dpeHKr5q6SdggwnPcmmCpJ2Atlp9UuvfbsMOfv3ddfYNaihSTVOGdgAoFcePMTODi362UBHy3nRQohjXGHDZmASffivZivsc3fPdCQbAdBvLl+qwvy8oyXf+FcZrlkrA4m86U4U/JfcTPE+zngP8nDxSXXTmqecBJAgAHjx7mlWNr38iO51Sy+48yd2ElBlgFZmQJkJFhOg6MrzUvbgW/bvpK/ON8XmrJ+d/HR2aNbRPWtmJH64F/iomRbXOA6/+Ps2JSM1bdJvXyEDqU0STCiI3/Sa5FOn+2OpOkI7tUIxQEwcRYZx5D8ycNReOr/bhsLO5EufvGW3lhYcryO6GzZHO2mTssB7z0rxrZeCg8KsWsm23Wh6a4qZx52xnp9Stvvn/NHO29S3e5+xG2P/lBk8ZZrnHfuzcGhJ58Crk65bfhiUgr0roKpCReUQWND1mrpEr3fykq4pSCZldLap289Mu36sb/6cjieU+u054MPn1DLQTuv/3myZ0frFEu5zkQ4Xzrr2+HZuhE0cRQVEBLZtMCswwPzIz2aqYnbR1ZJvLep+dzTd6SwHWgEQx1Fg1S5xKe6jOGtg9N5Hm8yE7blnagqD1/JA/y/47p23qP2W/FeKRP6Fvm3LU35h2XIdLH5Dgn28cPWk0c576WypRDWVdwnaVuJjMIkAG/9hHxWsUWnZmhiToURB0q6W0VSgRyf+u5iec26md0HTS1eAv36gyxPRwMBMAppK8JIZ4FjUSnEFcSlMopG+L8wK8zPfk+FaX3a4pthjP77xLafehR2pAo/PFTBVntXmwKlmbNarhRcaiulfqbfTv+Wv7HzMSYkcibtuOZr97HELdGGf2403bVCCtlC2TMwVH7G3rbuDF8YMoP+kAkRxfD2NVj9t71b4UH3kv2pliq8m0mZHIiODri8DrjGDdWPB4OSHcjvnHdy3aU/33gvAh85wS+JN5Ti+ksSIRq+Fw3dfDi4OL77MDNcXpSfpyQY71NutgaGtzjHAVACqKr8QhSglpEIj+XkJPTz3V4VXm3syv7duGLlLzZIsQeQqeJlTJpjM/t81I5M/keHaUEZrfNNfnw2edLOZv/C/Xr5JTQBSpXiFmMr52fGYDoCg3RpFZ5/qL4xhjfQYx2wKXO8tY3Q3ZxFSkfxi0vIGz06Yroca6wv//aVfLJz2wP2GbvumYPcJdtnFiEjECQJBiDR8+eJVy9osM3gWFQouPAEK0JyX5qSSMz9+YyQ5vcaBkSp0FiXe6Pyvguqz5oRwc2ZWuCNz3uZUeE3Decd29I2c6prMS8ts74O/Un7TL8kb2B1hqKWPPHnTC2k0UEXBJ09/QCOAF5NazlaWc4JlJjAoZ0IaGEsGp+0RrK9huErRbCpKnenTJAX2KMUhKcOkvSYlhcMUewelJrZn9z1qUtcxs3f6g90K67uFojR0hDgSsHHjuZqWfKHpi1bQfQH5vhKfhHJRFoVtnmCl+PUf3eT2AIaITJkHIpBX/29BvZsrTg460/ekvnzEB7f9dZYcdURu9zra8t9U7PoJ+cMLgJAQWAE2kIc1PtOYTiBJ2wpJ+t0Z/2/yBmCESmn3cRlkqgL+MS6ABcA3vul4qjExhYrHKl8uR4AlosFIqoCnKUNtYsMyDpiUWO6oUfUrfWm8LbNt54dnnp7R/+wMwEwwhjATRj7sO6olRR33qkL3CTASep1KW6RF1RmFJCGfSNy0tcv9yX+dUQjX7ixEWSEmMlpwz02z2M31ydnXvKz9/I8aHd19OrzBb8PPzoPRBLDGoAqxwRgMhY44yKMOT5lG+u2b6eRHp5xflIwXiFIRQ8vR7S7REVWiP0DAEFMrIhnxX7LbbF+fSz4uFB/ToSlEs+XTLMVoMg5YFJQyIo1rkJi64sJp//70L2kiIkHKSeBrS4py85MHnOr4m/5KXrZWAksX3hVx641RU4RhgcOaxKZRU3/muQf0fvLcMBOzABAotlAfhvLxp4dZkyYXD4TX+z34I1+A9pMAaRSUxmYJsDUgiFhSS2tNA91UmGQ9W3fw8lwCj7LHIShKkQsglUJMRferiEfkGhybAYwRkcXucVP7VqVafi1N6hyqo0cpKR6NBglZ67PZTJ4EVhGeMVQYXUimuOx/HgPvPyUJEcLiCUX88vFldRZGzyZTqIdikRESCoymUARCAgWjJJydtHHS9Y+1qIXtKRgjMAZIhaH0ZJbXTWrPfB/5LQ+hOHA6JHBBKkS35eMN4+HTgMTBsG7hm712dZa17phH6w7mvMuPsK8MmEqUoxIGo+T6dglvSzZMBJ4nImIMEIpCNx1/dE74qCdWe5PsS00jf0dqsRZGW8Emzy2uFQMtDA4cyNjJsw8/prGlkAegsHAqJOkWD2CkjwaJASmDtFE6IS9KCmvhkYJFRBJaDrzTJ89umXrgtDEACgQHEwA47vCRCHquhMlPBFMgGSuUt6mIt/xQsoEJ6/G6N4HP75mb/GnyuImdjde+TECefGhIOTkplUJGNQPGJx8BpUBGi9xydcru23bAPjp/SH07fJnS4sGhMzmx2B374Y4F94f16pzA5j/4AQq6L2QJLR8WDCR7AJHefyANOXpiiP/927Kk4tEzCflWWGyQZ0FosmED3YUmegLGGAgJBKJMcX7SCo776lWgGjDq4ePjwopa6P6zEGabwIxgh53PPxt4er1HhqTHb+DrMm3qG8nTzv7H4kUSAl0y4oeSTKgSEKn29uNLZWXAUZ3VjeJlhZZGz07ItitYd9y2I7/7wtdens4Hu0W4NEZ3XbSOnCMu3/JKr/Vjz8aLNowjIxxAKQ0pNsFkTv336FL3xlOBRMqeT5I+HqIFpAyGNGtb3g3brFW6Xv1dHHTBA4NIKPQTjuTP2PPA+S2L7QBNgNj20P4wQ0eCxUCrwFsb+v6oNjmi5zMpnLd+buKWluMa+oH7qB+HyejOpTNfe2pOe6Goy5bdmGj3JVaBCKeAgfL1smeIJMZCMdAGuYyLfOYryO98uG1meOkr6QUt1x5psNc0AXATn3CZl/Xr+DFVIwUa1ASyfEAL9PCxdm3tbvN/Nc1i6V9OenQKCAY5EhkLA+PSU86s9uGgLrlZXHoJvlAkBWJUkD0gSbnDb7gGsjl7VgKm7wyY7EQoZfSQKnAmTAR1tHa1T1c0nR++c+bSnAEGJD9yYp14XSuc7JZ7Ev09i0UmiTEEAQkRhJlQglUkRsQYQRkIVZXAS8zQGCuwJoiPotbQ3iyY4euZ0ndd+dJ+h95xazNPawCIEjSg1BthDdZRPnCRVT4IBnpkJsK+ZZzYaw8yA6dCBwQog34DAT419fyPpy81Utt2hmcS/KRARuBFwkihV+vozFlzLmitt2pyeyPsOwFGA7ADs9UYZQnlXXpq2ZpZ3SCiJ19dqkxu8UFJ88HtyOy42Vs/OF/SBRvoi/a3ZAPiyk51LXGcDShfLDFj53bHiIOijBoyW5TGKNkIzYkoZH6xxwGYsk8+FEDoghfn9BdsekZIA/2hwJBB4Nnw06epcORc8tOzYcQgyxrDoRGLnvdnJjpf+GgIu+FxClPWu6LwNvKGATIQMUrnliZhHYpw52kIRqaByMiIKnCflwhd6ugjeh7PzBWRT2X+3qPzKNN5B4ojX/I7ffa7AttKfqa2H+FcU8ltjmMAK4qDl1LRSOijLleCHH2od+jXpav4ZrixsEa2ZjIYGliAwJzwy3cW8OQk4d0/HWXGiJ8PHXRhyLdRYB+hMfCGF3Fx+wp4HsOwQZ8IQtOHenrmiUcnByvXFdHPOdzw4N4j4vJTMMaDTwImwzpochF+B/ne5Qh8hnBoOsIQWts5S557ssfaCvyDgPNA4XATRkenYCikcLsGCyzLquzx+PL/uORvxQ3qUMREeWMigEAGg92ebHuf7xrWvHxkmru8MKv5QaSKtvhFV7Le6fPnBhN6CkUB7qIOP7XZZ3oFhdDGgNEwIvDzSRTSTdAiyLNGv09i4Q1p53X/+mMn8jpE1oT40w/6YWr4ZWHagKwwmASAWF52KfJDc6BFJKc82eE5oYO+IaGnb7wuHwIGQBtALBAIjGaCkKUAy6rUE3cVhBjwSAyESj/K2WAiQLHIvzfmcMA32Jt4apCxpy+eVlNvLiBLWbIeoXzgTUNnemI0Q0BLTxz2cgZPa5Gs6Q0ZIWuYEuhiNugTg4LJUZKe/mfv1Nwz6zxEMZkBuf30qWruFpueQ1EDHhkwCXTICDUDbGSHCbgYukVFr28I7I8spChiwDTAUoBNAotE2STKgihVFfdQdbxT8gaxG4ybIXbhUpl7C1N5Gtp+QkNNTd8Vigu7Y5PyeMCkKTQ/37F1dIOiJAOBEDXQANv/DpjWmNHQkTEKoUqlF18Z9IQKitaizXrrvWtHkNZGCBDFhF7Px95T27VJ8t+E0IuMMJgj+MYEBMo3nYEyhPwY6IkvXVTIhyiUYPwhkUJbJLAAUiBWANtU5dZFSjYwrjqXbQLHafAYADFHm6Y1MNmxcc/9u3FtY/9Zyhr8IrZKgB5/SBrpB6vm1j0841Qr0FIAALJUnuYvO2fYc/kZsBhJm2jnHRbpF2OyWiOFlUNzmwb/b20h5jLpUo5+utNBucbEJ+Lwq8gbRhARBJvEDLKHkTDhWXivD1hF1EZsESLujlUsOJOAIOX0ScW0UxznxLWMct1DpNJ9Vc6ZG5CCoj39QHY/as5+tjP8XeoOXHQF/dKEKx6a1fzEoYuLBsgCgFkwyUWoDYBtUkjxPySF7ZzTNgxrGKVNl2YodKCV//7QpY55rcMHYCFhCEoiU7Tdz6Ox7VsFU8NPCjCGjCFYLFC2r7dpETG6YNMTi9+ZkQb6icvFsV6UkT1VuqUiyGuV0W21plMpZ1VmQJQrj5MYkeWcCi1P9x7bbCd7fkCDmTnY5ndJvXzv8elTVv7X4jG0oICdm45L5vuPX7Dq3w2J5QsdAG/SelPTEdbSi2CtUBQjg6SR0UQpPOfNt7e982YaRzSEeOO+kHp2Hm337TzQuub0UA5q8DABdyJsdt+WGryHglEAG5NRvun1E6GijcMKL+G2IgAjUTOWRvSu1vCIhGgvw/hbWQXEVLV9xW5QjFQNQJhoGTy3cj+VbMqew5mhE9GR2yKJ8Nt3TZ723CX7D4JRkM7+ZfUts7zvuWHnHTXByKLzr6hDk0V0zNLhwEuplSaJEWRClu0BkYUBauaVqx+aFF507hi9lj6j7dCvHPv1xsbRX7fUFq+79v4DT3ujf1btN48Zote7905LHT0FSwLkRPSnoRHfcNHC31bWNXQl0EcAyERiK8DMij9jgjBFDqGaKabcUVbCORWRsKrEg0QgNlnUHwYy97jm/VWh81vUOdopHH73xuxer/7poG00JDnxcidMtNyhH9Lo6Plmc59rkvory04tvKdDLgINNAxrTU1Sv+NoOY7yIqil1zDbWbdw01ZKffekqdCdv4TuPAVeNom8BgLrG5Yjf/7xg8mfXz8pnT16m/USh8EWZMxc6dGuONSTU7TyypO+rYGfRlAWAKAICEuNdYjeJcWoJPsIIPlMQTdu1KsOhyUCQYFkR45psbzeq6hnoCChd+mX35r36h+Xb6FtuawYOXGmzf03c0f3N/F695jZkF0ZduL5bIfoDEIBxmi3RdeM+g4/KRY8sjFGdXjs6gf2ysvhU1kKO76G7MblKGZceFrDDw2yhTrZ5l0sn3rH/ASnSb/fuF1q+DkoQClRQQIvrrVSG1L4OYGIRAhJuABC6RrYZIHqpwCkSmGfAATiz8Q35fY9U9W7U0aCIkATQOtWL1EJGlmBgYF2PZa7pPGSfd54/cqNdNRRBTHFw/ZDf8etsqlzn3DjwK1+UDijOFed555xwjMLlhQDICi1UtxKY4Zf0YStSMqasI7fvP6qdyETd0tJNr0UmZyNsVCQ14APkSGE6JJaGZMjfvTY/Tx19y8FJsEr4WAANTRScPDYieeM+jlogjB2g+AXF3rQ4VlTplrPX4GhT3+CIEiJ4TAowAgDrCoSEON/lHuNSGLcY5U9iDg0DN/MmRMeIiMDS8LRzPcSS1pWJ7Gep0+38Ie7jp+nB7tON4M9fwvTmZc2tdH2/RaZcIKdIOAF7i5EoacFohBpuu1hu/uHZ/hP1tRTl32QlwaIfD+vagqei5wRCAEM0Wlo0ylsERntiFtTCAh4hHJir6u3/Df9Gjjb0vxeG9lkwcdcaHm/+OUaV/cvRf9blyHffxgQOMEIF0beC/1CjySsVimMJamAimCX+x6qmi2ljASNiVLWuYFDJprC6BH+2PANicX+6kZ7mAvw5bxL9uXhwVx2uKfvJne/0dtTR7d3HLYYhojZ03kCtLz9/nLO579e89wfE1gyycN119WbnVm6sxd4GmggwMLOvrGxMPDWIU/AmJigS8LiZoEuQjTBy4Pe/9GKQQ1kqXHG5flA8b3ZGrrroAuCbAuK9NyjbbQ+PHKOW/zoxxh8/08Y6z5WiiHnPubM0AvGz3cYJ+djy8atuGbVarxNVK4Dll1htduP0RABwBP3LVDHLWtcIrmuofrZWz+psWzOh0HcD0CIcCdFhkcLEVObZdCbhOjOo1p5rPsrSOj9UTPp4SA54Z9fn7Qy/+AgALhw3IB8jwG0yOCHmf3rC8FfKG329noEpAlWElKo5ec6hS/d9/RkH5AhwMXrjyvbLoZ49kee/9ONS+ps3X88csPfRjG3GIHmsJ/zubWm6PWKHQC5AQ8rNw7Tn8/+c/MnMCNCFFAs9kRCWsdqUGFGmQErHz/EnTtLavZetGoYsAkIhBkUAdYqJ0mVICLfdajjjg0fgvzA9+GMLYUVuuBkHxomPYqmGXd3bS9suHD+W+ZN7WAsDDCzycGV59bhlFMyi5JpfbGrZV8w/IKF13s0//mcFVO2bQ97KB+ESNkuJgRFeXvdIWrSHrk9Uei9CIXMmQjCFimy52+SvLfRiPGEsoL3O7P4w3Od9ovXP1AspGyHc0GIqHWbiJiEYKiqB6KMeeLeQOgynmBiNhCBWJaiIIh022UiT6KKu9YR3lj/wOTDJ9HIrQ6Kc7iGPXeSOCopLizWqG34GI1T7pTatid/u/zFwaf+Dazqs9BSb2Hn6AK5/cYP3X1mmAbPh3lunTXy6xvrwrrkEI0VgHnNGhedBHzrroMa2e87Ffn0pQgKCwAi0085/0Md6EFja4WBfp/uXzdIdy+/MdcF1BHgE4hEscTnFKhK56m8k3HzddUNVZ3XBDFES8jg7+ljptbWOnj+7vU9J13UqZkJRoD2iU24+guZuj3q9fHT63BpvUv7uQ1kUnMZTrtJkC02XCeP+saXUd/6x4Ca37p8338Wn+8hbB1TiPy3FYM0AKCkbWNf4+H5bYdbjW35fZDtvATFsS9CTAMCLpotUjCbtdKBIEv0r+0F3PLARvfN39wxM3CtjeyFulrEaVx5DeWgqBoXjz9oEKMkYyKVH+he0Fqns7dILtyWtVqvnzB3TY4YpZMdRFpbIhLIAxeqafu0yXmtSXwt6dIEZxKFidmwVJMkYIGRTPQiVf8w6qbcvf0T69PzDn7brA0sDHq6RDxjXovB984Dzr/xhBbOb1mOfN/FCPJ7gwgYtsbk41BL2iQ8JT0Dmu5cl1H3nXzVO/0tiQNoqKgRpf0qZr9S6IqCo/G7X73hUUX4M/nyx++ZrY45NHm26u/bZ2zbwB3Pb0h0XHBtYJhL+TUjpcoSCXCoHHHAe9bPjvQPntUs36536WjbheXMJG3vRg4lxQWRRqLmQ9RO+LMk259ZefW/0jf9FegYs7FkUoB7PjzeTjm5RRjruASFwRMBUw/NRXRIHlu1rQ0kw/RyZwE337mpdvXvf1urge5yC2dVpCelUyTlKDc+bxA1fI1r8owMpMTNcVU8uO9P+yX3n1uchf7NHfPOcQstiSIN+1EEZkzlUEJVWCEiRu79ltW0eLKcMbFGLk7amGs1cWDvzuAJSALGhlIZpBqeR23Lnzy/ZvXAprXBlIUntVF28xkY2/EN+LndwUqQUTls0hrDOlFg7OjX+OOHw/TQaVeeMTTReYL7/aC84Gq/Xo3+Sv+VVcKYCkNiV0jV2ZLy6Q8GkQFM2fVFL6WiQUriVOZ65B5AEMCYegGS9Mo1g3vObcUlzUk5w3WoltqVxzNgIykuGIyEsw3J+nthT1+HTM9Xke8/FghrYawCOpHH9tDRAj1K9EJHHrf8+g3n/YcfMIZQpDhvV93qVsWMqlMpMv5g1i6nW8bZgLhqGrfHVneJxoTKLpUlVqWCm0h8eCk6ScYKRmvzq4uSNSfP84+bUofvpBgHcJIMzVQak8mFbRxY7MO3xlAsNIPZIKvy2Kw1RoxbsLCt39Bt76fp0S99f8HIjPq13JkJdmndL6tu2QAQEZWMXXxQq0rcq4VDKgyI+/sBCJXUejwjPiNa5W5RywKF4fjMY2lJAJIAXpO/X3vI1HmT5PzWpHzdVdSGCcrDHMVoJAcFw8ibAN1cwPbQ0kbCUcJznUW65fq36tY9do82QJYAMw7AMJfSH5UjcGVRrz5HVKoClfIAlZR4rAJqvB5HJaNdRaZsTqtFqHJggEQozjdVjtAREAVHf6H7Xz1kNOsOvbVbe/ium0CrHZrZnBELtiqKp4r4ONTYqRNFRkef0HXvjlg3HXnZiZ19n6yngi5QHMft0qhd9nOxKigFAtGuW0ZM4+gZ5/nKOICo0jBdSpLGBZWyMfkcPaKqxUj8rDbxwCjV5AAFR0LxZeX1TsvCGfrsCQ3yrWQSu+lhCs0oimM2nukK+ea71zV99M7DRVnVW9712JlLHNCVelZLprtCr2UBYVg5kLnLcbqyERxHR8yA6hOj0a6WU0njpKD0MFUWMB5qlTrPQBSdJYrHicwRAZgqc9qz9Mh1o/vOmCLfs7OYN9hPf17nq0e++J19R3dvXsub0l611MVwFmJM7NJKhjjqfiYm0mGURI4XyRwldqOaYDkRGtMpsSf4XAb8J7Ev655AmIEwLCPH8oEpVLQDRDwuBUdMJESosy3JFHy5/+dOfVOdbrrrDbfrpceVyVOOdJyfo7LoSilvSRULHOcwY4ZL2chFAE2qD3jt8tDnBEOlBuJokMi4ltUhFuvYA1TXEavwAKotrAhIRKTUJgeRam8qYKVgDGA0CdAqQH+pyFEeu+zXxjX4YxxBZWmMpSLuAYlPocZt8buqa3lsqe4Si7MmVDkUvau+RMygXfSrrAUUtdBHx2NLalB1GiXagKg0DRAZiYjOEpXPdpYZHtshqtrJcUdkq84My7jCTqk/8/MkurTOcQxUFRqq3AZVFxYq/33OgKg2OJXui5igMvwc99o1KVEenysnmaJSbUQz7zJ3PHbMrCrdHpfzr143VSVGqpkzrk9w1wPUu4r8f8AFn8uQ6vHGZ+L/8xjxzsVCGif4d13L5611PHM+O+fnrRMA/j9u09405ZezXQAAAABJRU5ErkJggg==";
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/dashboard/ui.html.ts
+//#region ../ai-panoptic/src/dashboard/ui.html.ts
 /**
 * Build the single self-contained dashboard HTML page. No external
 * assets, no bundler, no framework — one inlined string that polls the
@@ -2021,7 +2073,7 @@ const WARLOCK_LOGO_DATA_URI = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEA
 * @param basePath Normalized mount path ending in `/` (e.g. `"/"`).
 * @param title Header title shown in the page.
 */
-function dashboardHtml(basePath, title) {
+function dashboardHtml(basePath, title, evaluateEnabled = false, evaluateDefaultInstructions = "") {
 	const apiBase = `${basePath}api`;
 	const safeTitle = escapeHtml(title);
 	return `<!doctype html>
@@ -2202,6 +2254,18 @@ function dashboardHtml(basePath, title) {
   .legend { margin-left: auto; display: flex; align-items: center; gap: 6px; font-size: 11px; color: var(--dim); }
   .legend .grad { width: 64px; height: 8px; border-radius: 4px; background: linear-gradient(90deg, var(--surface2), var(--cost)); border: 1px solid var(--border); }
   .gantt { padding: 8px 10px; }
+
+  /* Evaluate — the drawer's one write action (config-gated). */
+  .eval-btn { background: transparent; border: 1px solid var(--border); color: var(--text2); cursor: pointer; font-size: 12px; padding: 4px 10px; border-radius: 6px; margin: 10px 0 0; }
+  .eval-btn:hover:not(:disabled) { color: var(--text); border-color: var(--border2); }
+  .eval-btn:disabled { opacity: .6; cursor: default; }
+  .eval-panel { margin-top: 8px; padding: 10px; border: 1px solid var(--border); border-radius: 8px; background: var(--surface2); }
+  .eval-panel textarea { width: 100%; min-height: 64px; background: var(--panel); color: var(--text); border: 1px solid var(--border); border-radius: 6px; padding: 8px; font: 12px/1.5 ui-sans-serif, system-ui, sans-serif; resize: vertical; }
+  .eval-actions { display: flex; align-items: center; gap: 8px; margin-top: 8px; }
+  .eval-error { color: var(--fail); font-size: 12px; }
+  .eval-result { margin-top: 10px; padding-top: 10px; border-top: 1px solid var(--border); font-size: 12px; }
+  .eval-score { font-weight: 600; }
+  .eval-issues { margin: 6px 0 0; padding-left: 18px; }
   .grow { display: flex; align-items: center; gap: 8px; padding: 2px 0; font-size: 12px; cursor: pointer; border-radius: 4px; }
   .grow:hover { background: var(--surface); }
   .grow.selected { background: var(--sel-bg); }
@@ -2266,7 +2330,21 @@ function dashboardHtml(basePath, title) {
 <script>
 (function () {
   var API = ${JSON.stringify(apiBase)};
+  var EVALUATE_ENABLED = ${JSON.stringify(evaluateEnabled)};
   var BT = String.fromCharCode(96);
+  var EVALUATE_DEFAULT_INSTRUCTIONS = ${encodeForInlineScript(evaluateDefaultInstructions)};
+
+  // Carry the ?token= the page itself was loaded with onto every
+  // subsequent poll — otherwise the API calls below inherit no auth and
+  // 401 forever once authToken is configured (the initial page load is
+  // the only request the URL's query string naturally reaches).
+  var TOKEN = new URLSearchParams(window.location.search).get("token");
+  function fetchAuthed(url, options) {
+    var opts = options || {};
+    var headers = opts.headers || {};
+    if (TOKEN) headers = Object.assign({}, headers, { Authorization: "Bearer " + TOKEN });
+    return fetch(url, Object.assign({}, opts, { headers: headers }));
+  }
 
   var state = {
     traces: [], selectedId: null, selectedSpanId: null, collapsed: {}, sig: null,
@@ -2278,7 +2356,8 @@ function dashboardHtml(basePath, title) {
     showStats: false,             // per-type aggregate-stats panel toggle (independent of grouping)
     collapsedGroups: {},          // collapsed group headers (session, prompt, or type)
     view: "tree",                 // drawer left pane: "tree" | "timeline"
-    hashApplied: false            // guards one-time deep-link open on load
+    hashApplied: false,           // guards one-time deep-link open on load
+    evaluate: {}                  // per-span evaluate UI state, keyed by spanId
   };
 
   var STATUS_FILTERS = ["completed", "failed", "cancelled"];
@@ -2987,6 +3066,80 @@ function dashboardHtml(basePath, title) {
     return '<div class="meta-sec"><div class="meta-title">metadata</div><div class="kv">' + kv + "</div></div>";
   }
 
+  // --- Evaluate: grade a span's last captured system prompt -------------
+  // Config-gated (EVALUATE_ENABLED) — the drawer's only write action, POSTing
+  // to a route that itself only exists when the server was configured with
+  // evaluate. UI state lives in state.evaluate, keyed by spanId, so it
+  // survives a re-render (e.g. switching to a sibling span and back).
+  function extractLastSystemPrompt(span) {
+    if (!Array.isArray(span.input)) return null;
+    for (var i = span.input.length - 1; i >= 0; i--) {
+      var m = span.input[i];
+      if (m && typeof m === "object" && m.role === "system" && typeof m.content === "string") return m.content;
+    }
+    return null;
+  }
+  function evalState(spanId) {
+    return state.evaluate[spanId] || (state.evaluate[spanId] = {
+      open: false, instructions: EVALUATE_DEFAULT_INSTRUCTIONS, status: "idle", result: null, error: null
+    });
+  }
+  function evalResultHtml(result) {
+    var score = typeof result.score === "number" ? Math.round(result.score * 100) + "%" : "n/a";
+    var issues = (result.issues || []).map(function (i) { return "<li>" + esc(i) + "</li>"; }).join("");
+    return '<div class="eval-result"><span class="eval-score">Score: ' + score + "</span>"
+      + (issues ? '<ul class="eval-issues">' + issues + "</ul>" : "") + "</div>";
+  }
+  function evalSectionHtml(span) {
+    if (!EVALUATE_ENABLED) return "";
+    var sysPrompt = extractLastSystemPrompt(span);
+    if (!sysPrompt) return "";
+    var st = evalState(span.spanId);
+    var btn = '<button type="button" class="eval-btn" data-evaluate-toggle="' + esc(span.spanId) + '">'
+      + (st.open ? "Hide evaluate" : "Evaluate system prompt") + "</button>";
+    if (!st.open) return btn;
+    var running = st.status === "running";
+    return btn + '<div class="eval-panel">'
+      + '<textarea id="eval-instructions" placeholder="Grading instructions (optional — falls back to the configured default)"' + (running ? " disabled" : "") + ">" + esc(st.instructions || "") + "</textarea>"
+      + '<div class="eval-actions">'
+      + '<button type="button" class="eval-btn" data-evaluate-run="' + esc(span.spanId) + '"' + (running ? " disabled" : "") + ">" + (running ? "Evaluating…" : "Run") + "</button>"
+      + (st.error ? '<span class="eval-error">' + esc(st.error) + "</span>" : "")
+      + "</div>"
+      + (st.result ? evalResultHtml(st.result) : "")
+      + "</div>";
+  }
+  function rerenderDetail() {
+    var t = findTrace(state.selectedId);
+    if (!t) return;
+    var sel = findSpan(t.root, state.selectedSpanId) || t.root;
+    document.getElementById("drawer-detail").innerHTML = renderDetail(sel, t);
+  }
+  function toggleEvalPanel(spanId) {
+    evalState(spanId).open = !evalState(spanId).open;
+    rerenderDetail();
+  }
+  function runEvaluate(traceId, spanId) {
+    var st = evalState(spanId);
+    var textarea = document.getElementById("eval-instructions");
+    if (textarea) st.instructions = textarea.value;
+    st.status = "running"; st.error = null;
+    rerenderDetail();
+    fetchAuthed(API + "/traces/" + encodeURIComponent(traceId) + "/spans/" + encodeURIComponent(spanId) + "/evaluate", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ instructions: st.instructions })
+    }).then(function (r) {
+      return r.json().then(function (data) { return { ok: r.ok, data: data }; });
+    }).then(function (res) {
+      if (res.ok) { st.status = "done"; st.result = res.data; st.error = null; }
+      else { st.status = "error"; st.error = (res.data && (res.data.message || res.data.error)) || "evaluate failed"; st.result = null; }
+      rerenderDetail();
+    }).catch(function () {
+      st.status = "error"; st.error = "network error"; st.result = null;
+      rerenderDetail();
+    });
+  }
+
   function renderDetail(span, trace) {
     var path = findPath(trace.root, span.spanId) || [span];
     var crumb = path.map(function (p, i) { return (i ? '<span class="sep"> › </span>' : "") + "<span>" + esc(p.name) + "</span>"; }).join("");
@@ -3009,6 +3162,7 @@ function dashboardHtml(basePath, title) {
       + '<span class="dim">· ' + dur(span.duration) + "</span></div>"
       + metaLine
       + io
+      + evalSectionHtml(span, trace)
       + renderMeta(span, trace);
   }
 
@@ -3171,9 +3325,20 @@ function dashboardHtml(basePath, title) {
     if (vb) { setView(vb.getAttribute("data-view")); return; }
     var tog = e.target.closest ? e.target.closest("[data-toggle]") : null;
     if (tog) { toggleSpan(tog.getAttribute("data-toggle")); return; }
+    var evalToggle = e.target.closest ? e.target.closest("[data-evaluate-toggle]") : null;
+    if (evalToggle) { toggleEvalPanel(evalToggle.getAttribute("data-evaluate-toggle")); return; }
+    var evalRun = e.target.closest ? e.target.closest("[data-evaluate-run]") : null;
+    if (evalRun && state.selectedId) { runEvaluate(state.selectedId, evalRun.getAttribute("data-evaluate-run")); return; }
     var node = e.target.closest ? e.target.closest(".tnode[data-span], .grow[data-span]") : null;
     if (node) selectSpan(node.getAttribute("data-span"));
   });
+  // Track the instructions textarea live (no re-render on keystroke, so
+  // typing never loses focus/cursor position).
+  document.getElementById("drawer-body").addEventListener("input", function (e) {
+    if (e.target && e.target.id === "eval-instructions" && state.selectedSpanId) {
+      evalState(state.selectedSpanId).instructions = e.target.value;
+    }
+  });
   document.getElementById("backdrop").addEventListener("click", closeDrawer);
   document.addEventListener("keydown", function (e) { if (e.key === "Escape" || e.keyCode === 27) closeDrawer(); });
 
@@ -3269,8 +3434,8 @@ function dashboardHtml(basePath, title) {
 
   function poll() {
     Promise.all([
-      fetch(API + "/aggregate").then(function (r) { return r.json(); }),
-      fetch(API + "/traces").then(function (r) { return r.json(); })
+      fetchAuthed(API + "/aggregate").then(function (r) { return r.json(); }),
+      fetchAuthed(API + "/traces").then(function (r) { return r.json(); })
     ]).then(function (res) {
       renderStats(res[0]);
       state.traces = res[1] || [];
@@ -3305,9 +3470,27 @@ function dashboardHtml(basePath, title) {
 function escapeHtml(value) {
 	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+/**
+* Encode free-form text (e.g. `evaluate.instructions`, which an operator
+* could type anything into) as a JS EXPRESSION that reconstructs it at
+* runtime, WITHOUT ever emitting a literal backtick into the served page —
+* the client script is itself built from a TS template literal, so a raw
+* backtick in the output would be a real syntax hazard (see the `BT =
+* String.fromCharCode(96)` construction already in the client script for
+* the same reason). `JSON.stringify` alone doesn't escape backticks (they
+* aren't JSON-significant), so a value containing one is split around it
+* and rejoined with the client's own `BT` constant. No backticks in the
+* input ⇒ a single plain `JSON.stringify(value)` — no unnecessary
+* concatenation in the common case.
+*/
+function encodeForInlineScript(value) {
+	return value.split("`").map((part) => JSON.stringify(part)).join(" + BT + ");
+}
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/dashboard/serve.ts
+//#region ../ai-panoptic/src/dashboard/serve.ts
+/** Hard cap on the evaluate route's request body — well beyond a real instructions string. */
+const MAX_EVALUATE_BODY_BYTES = 64 * 1024;
 /**
 * Security response headers added to every dashboard response (S4):
 * block MIME-sniffing, framing, referrer leakage, and lock the page's
@@ -3337,15 +3520,22 @@ function isAuthorized(req, url, token) {
 * trace store. Kept separate from the server lifecycle so it can be unit
 * tested by feeding it a fake `req`/`res` without binding a port.
 *
-* Routes (all under `config.basePath`, all read-only):
+* Routes (all under `config.basePath`):
 *
 * - `GET api/traces`        → `store.query(parseQuery(searchParams))`
 * - `GET api/traces/:id`    → `store.get(id)` or `404`
 * - `GET api/aggregate`     → `store.aggregate(parseQuery(searchParams))`
 * - `GET {basePath}`        → the self-contained HTML page
+* - `POST api/traces/:traceId/spans/:spanId/evaluate` → ONLY when
+*   `config.evaluate` is set; grades the span's last captured system
+*   prompt and returns a {@link EvaluateVerdict}. The dashboard's one
+*   write route — absent config, POST 405s like it would against any
+*   other route (the path is never even pattern-matched).
 *
-* Anything else → `404`. Non-`GET` methods → `405`. The store shapes
-* ({@link Trace}/{@link TraceSpan}) are already JSON-safe, so responses
+* Anything else → `404`. A method the matched route doesn't accept → `405`.
+* Host allowlist + bearer-token auth (S4) are checked for EVERY request,
+* regardless of method, before any routing. The store shapes
+* ({@link Trace}/{@link TraceSpan}) are already JSON-safe, so GET responses
 * are a plain `JSON.stringify` with no serializer.
 *
 * @example
@@ -3356,10 +3546,6 @@ function createRequestHandler(store, config) {
 	const base = config.basePath;
 	const apiPrefix = `${base}api`;
 	return function handle(req, res) {
-		if (req.method !== "GET") {
-			sendJson(res, 405, { error: "method_not_allowed" });
-			return;
-		}
 		const url = new URL(req.url ?? "/", "http://localhost");
 		const pathname = url.pathname;
 		const host = hostHeaderName(req.headers.host);
@@ -3371,6 +3557,17 @@ function createRequestHandler(store, config) {
 			sendJson(res, 401, { error: "unauthorized" });
 			return;
 		}
+		if (req.method === "POST" && config.evaluate) {
+			const match = matchEvaluatePath(pathname, apiPrefix);
+			if (match) {
+				handleEvaluate(store, config.evaluate, match.traceId, match.spanId, req, res);
+				return;
+			}
+		}
+		if (req.method !== "GET") {
+			sendJson(res, 405, { error: "method_not_allowed" });
+			return;
+		}
 		if (pathname === `${apiPrefix}/traces`) {
 			sendJson(res, 200, store.query(parseQuery(url.searchParams)));
 			return;
@@ -3397,7 +3594,7 @@ function createRequestHandler(store, config) {
 				"content-type": "text/html; charset=utf-8",
 				...SECURITY_HEADERS
 			});
-			res.end(dashboardHtml(base, config.title));
+			res.end(dashboardHtml(base, config.title, Boolean(config.evaluate), config.evaluate?.instructions ?? ""));
 			return;
 		}
 		sendJson(res, 404, { error: "not_found" });
@@ -3411,9 +3608,105 @@ function sendJson(res, status, body) {
 	});
 	res.end(JSON.stringify(body));
 }
+/**
+* Match `{apiPrefix}/traces/:traceId/spans/:spanId/evaluate` — the one
+* write route. Returns `undefined` for anything else, including the plain
+* `{apiPrefix}/traces/:id` read route (no `/spans/.../evaluate` suffix),
+* so the two never collide.
+*/
+function matchEvaluatePath(pathname, apiPrefix) {
+	const prefix = `${apiPrefix}/traces/`;
+	if (!pathname.startsWith(prefix)) return;
+	const match = /^([^/]+)\/spans\/([^/]+)\/evaluate$/.exec(pathname.slice(prefix.length));
+	if (!match) return;
+	return {
+		traceId: decodeURIComponent(match[1]),
+		spanId: decodeURIComponent(match[2])
+	};
+}
+/**
+* Collect and JSON-parse a request body, capped at
+* {@link MAX_EVALUATE_BODY_BYTES} so an oversized body can't hold the
+* connection open indefinitely. An empty body resolves to `undefined` —
+* the evaluate route treats that as "no per-run override".
+*/
+function readJsonBody(req) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let size = 0;
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > MAX_EVALUATE_BODY_BYTES) {
+				req.destroy();
+				reject(/* @__PURE__ */ new Error("payload_too_large"));
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => {
+			if (chunks.length === 0) {
+				resolve(void 0);
+				return;
+			}
+			try {
+				resolve(JSON.parse(Buffer.concat(chunks).toString("utf-8")));
+			} catch {
+				reject(/* @__PURE__ */ new Error("invalid_json"));
+			}
+		});
+		req.on("error", reject);
+	});
+}
+/**
+* Handle `POST {apiPrefix}/traces/:traceId/spans/:spanId/evaluate`. Looks
+* up the trace + span, extracts its last captured system prompt, and
+* grades it via {@link evaluateSystemPrompt}. `judgePromptBody` itself
+* never throws (a broken judge degrades to an issues-only outcome) — the
+* try/catch here only guards `config.evaluate.model` resolution, the one
+* step that CAN throw (e.g. a factory constructing an SDK client).
+*/
+async function handleEvaluate(store, evaluate, traceId, spanId, req, res) {
+	const trace = store.get(traceId);
+	if (trace === void 0) {
+		sendJson(res, 404, {
+			error: "trace_not_found",
+			traceId
+		});
+		return;
+	}
+	const span = findSpanById(trace.root, spanId);
+	if (span === void 0) {
+		sendJson(res, 404, {
+			error: "span_not_found",
+			spanId
+		});
+		return;
+	}
+	const systemPrompt = extractLastSystemPrompt(span);
+	if (systemPrompt === void 0) {
+		sendJson(res, 422, { error: "no_system_prompt" });
+		return;
+	}
+	let body;
+	try {
+		body = await readJsonBody(req);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "invalid_json";
+		sendJson(res, message === "payload_too_large" ? 413 : 400, { error: message });
+		return;
+	}
+	try {
+		sendJson(res, 200, await evaluateSystemPrompt(systemPrompt, evaluate, body?.instructions));
+	} catch (error) {
+		sendJson(res, 502, {
+			error: "evaluate_failed",
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+}
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/dashboard/dashboard.ts
+//#region ../ai-panoptic/src/dashboard/dashboard.ts
 const DEFAULT_PORT = 4319;
 const DEFAULT_HOST = "127.0.0.1";
 const DEFAULT_TITLE = "Panoptic";
@@ -3452,7 +3745,8 @@ function dashboard(store, options = {}) {
 		basePath,
 		title,
 		authToken: options.authToken,
-		allowedHosts
+		allowedHosts,
+		evaluate: options.evaluate
 	}));
 	return new Promise((resolve, reject) => {
 		const onError = (error) => {
@@ -3540,7 +3834,7 @@ function openBrowser(url) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/dashboard/trace-filter.ts
+//#region ../ai-panoptic/src/dashboard/trace-filter.ts
 /** Statuses the errors-only toggle keeps. */
 const ERROR_STATUSES = ["failed", "cancelled"];
 /**
@@ -3808,7 +4102,7 @@ function maxNodeCost(root) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/config/apply-panoptic-config.ts
+//#region ../ai-panoptic/src/config/apply-panoptic-config.ts
 let applied;
 /**
 * Read a {@link PanopticConfig} and wire panoptic onto the core observe
@@ -3839,7 +4133,8 @@ function applyPanopticConfig(config) {
 		let cacheStore;
 		if (store === void 0 && config.dashboard) {
 			if (config.cache !== void 0) {
-				cacheStore = createCacheTraceStore(config.cache);
+				const onError = config.onError ?? ((error) => _warlock_js_logger.log.error("ai-panoptic", "cacheStore", error));
+				cacheStore = createCacheTraceStore(config.cache, { onError });
 				store = cacheStore;
 			} else store = createInMemoryTraceStore();
 			exporters.push(store);
@@ -3889,7 +4184,7 @@ function startDashboard(store, dashboardConfig) {
 }
 
 //#endregion
-//#region ../@warlock.js/ai-panoptic/src/register.ts
+//#region ../ai-panoptic/src/register.ts
 (0, _warlock_js_ai.onConfigApplied)((config) => {
 	applyPanopticConfig(config.panoptic);
 });
@@ -3910,9 +4205,12 @@ exports.createInMemoryTraceStore = createInMemoryTraceStore;
 exports.createPanopticMiddleware = createPanopticMiddleware;
 exports.dashboard = dashboard;
 exports.emptyUsage = emptyUsage;
+exports.evaluateSystemPrompt = evaluateSystemPrompt;
+exports.extractLastSystemPrompt = extractLastSystemPrompt;
 exports.extractSpanAttributes = extractSpanAttributes;
 exports.fileExporter = fileExporter;
 exports.filterTraces = filterTraces;
+exports.findSpanById = findSpanById;
 exports.formatSpanIO = formatSpanIO;
 exports.formatSpanLine = formatSpanLine;
 exports.groupByPrompt = groupByPrompt;