agentflow-dashboard 0.8.3 → 0.9.0

package/dist/{chunk-E5RJCBK2.js → chunk-NEERJBUV.js}

@@ -1,16 +1,28 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
+import {
+  __require
+} from "./chunk-3RG5ZIWI.js";
 
 // src/server.ts
-import { execSync } from "child_process";
-import * as fs3 from "fs";
+import { execFileSync, execSync } from "child_process";
+import * as fs4 from "fs";
 import { createServer } from "http";
-import * as path3 from "path";
+import * as path4 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
+import {
+  auditProcesses,
+  createExecutionEvent,
+  createKnowledgeStore,
+  discoverAllProcessConfigs,
+  discoverProcess,
+  findVariants,
+  getBottlenecks,
+  loadGraph as loadGraph2,
+  toReceipt
+} from "agentflow-core";
+import chokidar2 from "chokidar";
+import express from "express";
+import rateLimit from "express-rate-limit";
+import { WebSocketServer } from "ws";
 
 // src/config.ts
 import { existsSync, readFileSync } from "fs";
@@ -82,21 +94,70 @@ function getAgentDetection(config) {
 function getProcessPreference(config) {
   return config.processPreference ?? null;
 }
-
-// src/server.ts
-import {
-  auditProcesses,
-  createExecutionEvent,
-  createKnowledgeStore,
-  discoverAllProcessConfigs,
-  discoverProcess,
-  findVariants,
-  getBottlenecks,
-  loadGraph as loadGraph2
-} from "agentflow-core";
-import chokidar2 from "chokidar";
-import express from "express";
-import { WebSocketServer } from "ws";
+function getExternalCommands(config) {
+  return config.externalCommands ?? {};
+}
+function getValidatedExternalCommands(config) {
+  var _a, _b, _c, _d;
+  const externalCommands = getExternalCommands(config);
+  const errors = [];
+  const validatedCommands = {};
+  if (!externalCommands.commands) {
+    return { commands: {}, errors: [] };
+  }
+  for (const [commandId, command] of Object.entries(externalCommands.commands)) {
+    try {
+      if (!commandId.match(/^[a-z][a-z0-9-_]*$/i)) {
+        errors.push(`Invalid command ID "${commandId}": must start with letter and contain only letters, numbers, hyphens, and underscores`);
+        continue;
+      }
+      if (!((_a = command.name) == null ? void 0 : _a.trim())) {
+        errors.push(`Command "${commandId}": name is required`);
+        continue;
+      }
+      if (!((_b = command.command) == null ? void 0 : _b.trim())) {
+        errors.push(`Command "${commandId}": command is required`);
+        continue;
+      }
+      const validatedCommand = {
+        name: command.name.trim(),
+        command: command.command.trim(),
+        args: command.args ?? [],
+        cwd: expandTilde(command.cwd ?? externalCommands.globalCwd ?? process.cwd()),
+        env: { ...externalCommands.globalEnv, ...command.env },
+        timeout: command.timeout ?? externalCommands.globalTimeout ?? 6e4,
+        description: ((_c = command.description) == null ? void 0 : _c.trim()) ?? "",
+        category: ((_d = command.category) == null ? void 0 : _d.trim()) ?? "general",
+        allowConcurrent: command.allowConcurrent ?? false
+      };
+      if (validatedCommand.timeout <= 0 || validatedCommand.timeout > 6e5) {
+        errors.push(`Command "${commandId}": timeout must be between 1ms and 600000ms (10 minutes)`);
+        continue;
+      }
+      if (validatedCommand.cwd.startsWith("/")) {
+        try {
+          const fs5 = __require("fs");
+          const stats = fs5.statSync(validatedCommand.cwd);
+          if (!stats.isDirectory()) {
+            errors.push(`Command "${commandId}": cwd "${validatedCommand.cwd}" is not a directory`);
+            continue;
+          }
+        } catch (err) {
+          errors.push(`Command "${commandId}": cwd "${validatedCommand.cwd}" does not exist or is not accessible`);
+          continue;
+        }
+      }
+      validatedCommands[commandId] = validatedCommand;
+    } catch (error) {
+      errors.push(`Command "${commandId}": validation error - ${error.message}`);
+    }
+  }
+  return { commands: validatedCommands, errors };
+}
+function getExternalCommand(config, commandId) {
+  const { commands } = getValidatedExternalCommands(config);
+  return commands[commandId] ?? null;
+}
 
 // src/adapters/agentflow.ts
 var SKIP_FILES = /* @__PURE__ */ new Set([
@@ -109,7 +170,14 @@ var SKIP_FILES = /* @__PURE__ */ new Set([
   "models.json",
   "config.json"
 ]);
-var SKIP_SUFFIXES = ["-state.json", "-config.json", "-watch-state.json", ".tmp", ".bak", ".backup"];
+var SKIP_SUFFIXES = [
+  "-state.json",
+  "-config.json",
+  "-watch-state.json",
+  ".tmp",
+  ".bak",
+  ".backup"
+];
 var AgentFlowAdapter = class {
   name = "agentflow";
   detect(_dirPath) {
@@ -168,6 +236,7 @@ var OpenClawAdapter = class {
     return filePath.includes("/cron/runs/") || filePath.includes("\\cron\\runs\\");
   }
   parse(filePath) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     const traces = [];
     try {
       const content = readFileSync2(filePath, "utf-8");
@@ -187,34 +256,100 @@ var OpenClawAdapter = class {
         const jobName = (job == null ? void 0 : job.name) ?? jobId;
         const startTime = entry.runAtMs ?? entry.ts;
         const duration = entry.durationMs ?? 0;
+        const runStatus = entry.status === "ok" ? "completed" : entry.status === "error" ? "failed" : "unknown";
+        const summary = entry.summary ?? "";
+        const nodes = {};
+        const rootChildren = [];
+        let stepIdx = 0;
+        let m;
+        const tableRe = /\|\s*\*?\*?(\d+)\.\s*\*?\*?([^|]+)\*?\*?\s*\|\s*([^|]+)\s*\|\s*([^|]*)\|/g;
+        while ((m = tableRe.exec(summary)) !== null) {
+          stepIdx++;
+          const nodeId = `step-${stepIdx}`;
+          rootChildren.push(nodeId);
+          nodes[nodeId] = {
+            id: nodeId,
+            type: "tool",
+            name: ((_a = m[2]) == null ? void 0 : _a.trim().replace(/\*+/g, "")) || `Step ${stepIdx}`,
+            status: ((_b = m[3]) == null ? void 0 : _b.includes("\u274C")) || ((_c = m[3]) == null ? void 0 : _c.toLowerCase().includes("fail")) ? "failed" : "completed",
+            startTime: startTime + (stepIdx - 1) * Math.floor(duration / Math.max(1, stepIdx + 1)),
+            endTime: startTime + stepIdx * Math.floor(duration / Math.max(1, stepIdx + 1)),
+            parentId: "root",
+            children: [],
+            metadata: { detail: ((_d = m[4]) == null ? void 0 : _d.trim()) || "" }
+          };
+        }
+        if (stepIdx === 0) {
+          const listRe = /^\s*(\d+)\.\s*\*?\*?([^*\n]+)\*?\*?\s*(?:[-\u2014]\s*(.+))?$/gm;
+          while ((m = listRe.exec(summary)) !== null) {
+            if ((_e = m[2]) == null ? void 0 : _e.trim().startsWith("#")) continue;
+            stepIdx++;
+            const nodeId = `step-${stepIdx}`;
+            const detail = ((_f = m[3]) == null ? void 0 : _f.trim()) || "";
+            rootChildren.push(nodeId);
+            nodes[nodeId] = {
+              id: nodeId,
+              type: "tool",
+              name: ((_g = m[2]) == null ? void 0 : _g.trim().replace(/\*+/g, "")) || `Step ${stepIdx}`,
+              status: detail.toLowerCase().includes("fail") ? "failed" : "completed",
+              startTime: startTime + (stepIdx - 1) * Math.floor(duration / Math.max(1, stepIdx + 1)),
+              endTime: startTime + stepIdx * Math.floor(duration / Math.max(1, stepIdx + 1)),
+              parentId: "root",
+              children: [],
+              metadata: { detail }
+            };
+          }
+        }
+        if (stepIdx === 0 && summary.length > 50) {
+          const sectionRe = /(?:^|\n)\s*(?:#{1,3}|(?:\*\*[^*\n]{3,50}\*\*))\s*(.+)/g;
+          while ((m = sectionRe.exec(summary)) !== null) {
+            const heading = ((_h = m[1]) == null ? void 0 : _h.trim().replace(/\*+/g, "").replace(/^#+\s*/, "")) || "";
+            if (!heading || heading.length < 3 || heading.startsWith("|") || heading.startsWith("---"))
+              continue;
+            stepIdx++;
+            const nodeId = `section-${stepIdx}`;
+            rootChildren.push(nodeId);
+            nodes[nodeId] = {
+              id: nodeId,
+              type: "custom",
+              name: heading.slice(0, 60),
+              status: "completed",
+              startTime: startTime + (stepIdx - 1) * Math.floor(duration / Math.max(1, stepIdx + 1)),
+              endTime: startTime + stepIdx * Math.floor(duration / Math.max(1, stepIdx + 1)),
+              parentId: "root",
+              children: [],
+              metadata: {}
+            };
+            if (stepIdx >= 10) break;
+          }
+        }
+        nodes["root"] = {
+          id: "root",
+          type: "cron-job",
+          name: jobName,
+          status: runStatus,
+          startTime,
+          endTime: startTime + duration,
+          parentId: null,
+          children: rootChildren,
+          metadata: {
+            jobId,
+            summary: entry.summary,
+            error: entry.error,
+            delivered: entry.delivered,
+            deliveryStatus: entry.deliveryStatus
+          }
+        };
         const trace = {
           id: entry.sessionId ?? `${jobId}-${entry.ts}`,
           agentId: `openclaw:${jobId}`,
           name: jobName,
-          status: entry.status === "ok" ? "completed" : entry.status === "error" ? "failed" : "unknown",
+          status: runStatus,
           startTime,
           endTime: startTime + duration,
           trigger: "cron",
           source: "openclaw",
-          nodes: {
-            root: {
-              id: "root",
-              type: "cron-job",
-              name: jobName,
-              status: entry.status === "ok" ? "completed" : entry.status === "error" ? "failed" : "unknown",
-              startTime,
-              endTime: startTime + duration,
-              parentId: null,
-              children: [],
-              metadata: {
-                jobId,
-                summary: entry.summary,
-                error: entry.error,
-                delivered: entry.delivered,
-                deliveryStatus: entry.deliveryStatus
-              }
-            }
-          },
+          nodes,
           metadata: {
             model: entry.model,
             provider: entry.provider,
@@ -234,7 +369,7 @@ var OpenClawAdapter = class {
 };
 
 // src/adapters/otel.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync } from "fs";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "fs";
 import { join as join3 } from "path";
 var SPAN_TYPE_MAP = {
   "gen_ai.chat": "llm",
@@ -386,8 +521,14 @@ registerAdapter(new AgentFlowAdapter());
 var PURPOSE_KEYWORDS = [
   { keywords: ["email", "mail", "inbox", "smtp"], group: "Email Processors" },
   { keywords: ["monitor", "watch", "alert", "surveillance"], group: "Monitors" },
-  { keywords: ["digest", "newsletter", "summary", "report", "briefing"], group: "Digests & Reports" },
-  { keywords: ["curator", "janitor", "distiller", "surveyor", "worker", "indexer"], group: "Workers" },
+  {
+    keywords: ["digest", "newsletter", "summary", "report", "briefing"],
+    group: "Digests & Reports"
+  },
+  {
+    keywords: ["curator", "janitor", "distiller", "surveyor", "worker", "indexer"],
+    group: "Workers"
+  },
   { keywords: ["cron", "schedule", "timer", "periodic"], group: "Scheduled Jobs" },
   { keywords: ["search", "scrape", "crawl", "fetch"], group: "Data Collection" },
   { keywords: ["embed", "vector", "index"], group: "Embeddings" }
@@ -419,6 +560,7 @@ function capitalize(s) {
   return s.charAt(0).toUpperCase() + s.slice(1);
 }
 function deduplicateAgents(agents) {
+  var _a, _b, _c, _d;
   const tagged = agents.map((a) => ({
     ...a,
     ...extractSource(a.agentId)
@@ -435,14 +577,15 @@ function deduplicateAgents(agents) {
   const mergedIds = /* @__PURE__ */ new Set();
   const mergedAgents = [];
   for (const [_key, group] of suffixGroups) {
-    const suffix = extractSuffix(group[0].localId);
     if (group.length < 2) continue;
+    const suffix = extractSuffix(((_a = group[0]) == null ? void 0 : _a.localId) ?? "");
+    if (!suffix) continue;
     const prefixes = new Set(group.map((a) => a.localId.split("-")[0]));
     if (prefixes.size < 2) continue;
     const longPrefixes = [...prefixes].filter((p) => p !== suffix && p.length > 2);
     if (longPrefixes.length >= 2) continue;
     const merged = {
-      agentId: group[0].source === "agentflow" ? suffix : `${group[0].source}:${suffix}`,
+      agentId: ((_b = group[0]) == null ? void 0 : _b.source) === "agentflow" ? suffix : `${(_c = group[0]) == null ? void 0 : _c.source}:${suffix}`,
       displayName: suffix,
       totalExecutions: group.reduce((s, a) => s + a.totalExecutions, 0),
       successfulExecutions: group.reduce((s, a) => s + a.successfulExecutions, 0),
@@ -453,7 +596,7 @@ function deduplicateAgents(agents) {
       triggers: {},
       recentActivity: group.flatMap((a) => a.recentActivity).sort((a, b) => b.timestamp - a.timestamp).slice(0, 50),
       sources: group.map((a) => a.agentId),
-      adapterSource: group[0].source
+      adapterSource: (_d = group[0]) == null ? void 0 : _d.source
     };
     merged.successRate = merged.totalExecutions > 0 ? merged.successfulExecutions / merged.totalExecutions * 100 : 0;
     const totalExecTime = group.reduce((s, a) => s + a.avgExecutionTime * a.totalExecutions, 0);
@@ -513,13 +656,470 @@ function groupAgents(agents) {
   return { groups };
 }
 
+// src/command-executor.ts
+import * as fs from "fs";
+import * as path from "path";
+import { spawn } from "child_process";
+var CommandExecutor = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    var _a;
+    this.maxConcurrentExecutions = options.maxConcurrentExecutions ?? ((_a = config.externalCommands) == null ? void 0 : _a.maxConcurrentExecutions) ?? 5;
+  }
+  executions = /* @__PURE__ */ new Map();
+  runningProcesses = /* @__PURE__ */ new Map();
+  executionCounter = 0;
+  maxConcurrentExecutions;
+  /**
+   * Execute an external command with security validation
+   */
+  async executeCommand(request) {
+    var _a, _b;
+    const executionId = this.generateExecutionId();
+    try {
+      const validation = this.validateExecutionRequest(request);
+      if (validation.length > 0) {
+        return this.createFailedResult(executionId, request.commandId, validation[0].message);
+      }
+      const command = getExternalCommand(this.config, request.commandId);
+      if (!command) {
+        return this.createFailedResult(executionId, request.commandId, `Command "${request.commandId}" not found in configuration`);
+      }
+      if (!this.canStartExecution(command)) {
+        return this.createFailedResult(
+          executionId,
+          request.commandId,
+          `Cannot start command: ${command.allowConcurrent ? "concurrent execution limit reached" : "command already running"}`
+        );
+      }
+      const result = {
+        executionId,
+        started: false,
+        command,
+        startedAt: Date.now(),
+        stdout: "",
+        stderr: "",
+        status: "running"
+      };
+      this.executions.set(executionId, result);
+      const sanitizedArgs = this.sanitizeArguments([
+        ...command.args,
+        ...request.additionalArgs ?? []
+      ]);
+      const executionTimeout = request.timeout ?? command.timeout;
+      const sanitizedEnv = this.sanitizeEnvironment(command.env);
+      const childProcess = spawn(command.command, sanitizedArgs, {
+        cwd: command.cwd,
+        env: { ...process.env, ...sanitizedEnv },
+        stdio: ["ignore", "pipe", "pipe"],
+        // stdin ignored, capture stdout/stderr
+        detached: false
+        // Keep process attached for proper cleanup
+      });
+      result.started = true;
+      result.pid = childProcess.pid;
+      this.runningProcesses.set(executionId, childProcess);
+      const timeoutHandle = setTimeout(() => {
+        this.killExecution(executionId, "timeout");
+      }, executionTimeout);
+      (_a = childProcess.stdout) == null ? void 0 : _a.on("data", (data) => {
+        result.stdout += data.toString();
+      });
+      (_b = childProcess.stderr) == null ? void 0 : _b.on("data", (data) => {
+        result.stderr += data.toString();
+      });
+      childProcess.on("close", (code, signal) => {
+        clearTimeout(timeoutHandle);
+        this.runningProcesses.delete(executionId);
+        result.completedAt = Date.now();
+        result.duration = result.completedAt - result.startedAt;
+        result.exitCode = code ?? void 0;
+        if (signal) {
+          result.status = result.status === "running" ? "killed" : result.status;
+          result.error = `Process killed by signal: ${signal}`;
+        } else if (code === 0) {
+          result.status = "completed";
+        } else {
+          result.status = "failed";
+          result.error = `Process exited with code: ${code}`;
+        }
+        this.logExecution(result, request.context);
+      });
+      childProcess.on("error", (error) => {
+        clearTimeout(timeoutHandle);
+        this.runningProcesses.delete(executionId);
+        result.completedAt = Date.now();
+        result.duration = result.completedAt - result.startedAt;
+        result.status = "failed";
+        result.error = `Process error: ${error.message}`;
+        this.logExecution(result, request.context);
+      });
+      return result;
+    } catch (error) {
+      return this.createFailedResult(
+        executionId,
+        request.commandId,
+        `Execution setup failed: ${error.message}`
+      );
+    }
+  }
+  /**
+   * Get execution status by ID
+   */
+  getExecution(executionId) {
+    return this.executions.get(executionId) ?? null;
+  }
+  /**
+   * Get all executions (recent first)
+   */
+  getAllExecutions(limit = 100) {
+    return Array.from(this.executions.values()).sort((a, b) => b.startedAt - a.startedAt).slice(0, limit);
+  }
+  /**
+   * Kill a running execution
+   */
+  killExecution(executionId, reason = "manual") {
+    const execution = this.executions.get(executionId);
+    const process2 = this.runningProcesses.get(executionId);
+    if (!execution || !process2) {
+      return false;
+    }
+    try {
+      process2.kill("SIGTERM");
+      setTimeout(() => {
+        if (this.runningProcesses.has(executionId)) {
+          process2.kill("SIGKILL");
+        }
+      }, 5e3);
+      if (reason === "timeout") {
+        execution.status = "timeout";
+        execution.error = "Command execution timed out";
+      } else {
+        execution.status = "killed";
+        execution.error = `Command killed: ${reason}`;
+      }
+      return true;
+    } catch (error) {
+      execution.error = `Failed to kill process: ${error.message}`;
+      return false;
+    }
+  }
+  /**
+   * Get currently running executions
+   */
+  getRunningExecutions() {
+    return Array.from(this.executions.values()).filter((exec) => exec.status === "running");
+  }
+  /**
+   * Clean up old execution records
+   */
+  cleanupExecutions(maxAge = 24 * 60 * 60 * 1e3) {
+    const cutoff = Date.now() - maxAge;
+    let cleaned = 0;
+    for (const [id, execution] of this.executions.entries()) {
+      if (execution.status !== "running" && execution.startedAt < cutoff) {
+        this.executions.delete(id);
+        cleaned++;
+      }
+    }
+    return cleaned;
+  }
+  validateExecutionRequest(request) {
+    var _a;
+    const errors = [];
+    if (!((_a = request.commandId) == null ? void 0 : _a.trim())) {
+      errors.push({
+        type: "validation_error",
+        message: "Command ID is required"
+      });
+      return errors;
+    }
+    const { commands, errors: configErrors } = getValidatedExternalCommands(this.config);
+    if (configErrors.length > 0) {
+      errors.push({
+        type: "config_error",
+        message: `Configuration errors: ${configErrors.join(", ")}`
+      });
+    }
+    if (!commands[request.commandId]) {
+      errors.push({
+        type: "validation_error",
+        message: `Command "${request.commandId}" not found in configuration`,
+        commandId: request.commandId
+      });
+    }
+    if (request.additionalArgs) {
+      for (const arg of request.additionalArgs) {
+        if (this.containsUnsafeContent(arg)) {
+          errors.push({
+            type: "security_violation",
+            message: `Unsafe content detected in additional arguments`,
+            commandId: request.commandId
+          });
+          break;
+        }
+      }
+    }
+    if (request.timeout !== void 0 && (request.timeout <= 0 || request.timeout > 6e5)) {
+      errors.push({
+        type: "validation_error",
+        message: "Timeout must be between 1ms and 600000ms (10 minutes)",
+        commandId: request.commandId
+      });
+    }
+    return errors;
+  }
+  containsUnsafeContent(content) {
+    const dangerousPatterns = [
+      /[;&|`$(){}[\]]/,
+      // Shell metacharacters
+      /\.\./,
+      // Directory traversal
+      /\/dev\/|\/proc\/|\/sys\//,
+      // System paths
+      /rm\s+-rf|rm\s+-f/i,
+      // Dangerous rm commands
+      /chmod|chown|sudo/i,
+      // Privilege escalation
+      /curl|wget|nc|telnet/i
+      // Network commands
+    ];
+    return dangerousPatterns.some((pattern) => pattern.test(content));
+  }
+  sanitizeArguments(args) {
+    return args.map((arg) => {
+      let sanitized = arg.replace(/[\x00-\x1f\x7f]/g, "");
+      sanitized = sanitized.trim();
+      if (sanitized.length > 1e3) {
+        sanitized = sanitized.substring(0, 1e3);
+      }
+      return sanitized;
+    }).filter((arg) => arg.length > 0);
+  }
+  sanitizeEnvironment(env) {
+    const sanitized = {};
+    if (!env) return sanitized;
+    for (const [key, value] of Object.entries(env)) {
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+        continue;
+      }
+      const sanitizedValue = value.replace(/[\x00-\x1f\x7f]/g, "").trim();
+      if (sanitizedValue.length > 0 && sanitizedValue.length <= 4096) {
+        sanitized[key] = sanitizedValue;
+      }
+    }
+    return sanitized;
+  }
+  canStartExecution(command) {
+    const running = this.getRunningExecutions();
+    if (running.length >= this.maxConcurrentExecutions) {
+      return false;
+    }
+    if (!command.allowConcurrent) {
+      const commandRunning = running.some(
+        (exec) => exec.command.name === command.name
+      );
+      if (commandRunning) {
+        return false;
+      }
+    }
+    return true;
+  }
+  generateExecutionId() {
+    return `exec_${Date.now()}_${++this.executionCounter}`;
+  }
+  createFailedResult(executionId, commandId, error) {
+    const result = {
+      executionId,
+      started: false,
+      command: {
+        name: commandId,
+        command: "unknown",
+        timeout: 0
+      },
+      startedAt: Date.now(),
+      completedAt: Date.now(),
+      duration: 0,
+      stdout: "",
+      stderr: "",
+      status: "failed",
+      error
+    };
+    this.executions.set(executionId, result);
+    return result;
+  }
+  logExecution(result, context) {
+    var _a;
+    const logEntry = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId: result.executionId,
+      commandId: result.command.name,
+      commandLine: `${result.command.command} ${((_a = result.command.args) == null ? void 0 : _a.join(" ")) ?? ""}`.trim(),
+      status: result.status,
+      duration: result.duration,
+      exitCode: result.exitCode,
+      pid: result.pid,
+      cwd: result.command.cwd,
+      timeout: result.command.timeout,
+      context,
+      hasOutput: result.stdout.length > 0,
+      hasError: result.stderr.length > 0,
+      outputSize: result.stdout.length,
+      errorSize: result.stderr.length,
+      error: result.error,
+      userAgent: (context == null ? void 0 : context.userId) ? `user:${context.userId}` : "system",
+      sessionId: context == null ? void 0 : context.sessionId,
+      requestId: context == null ? void 0 : context.requestId
+    };
+    console.log(`[CommandExecution] ${JSON.stringify(logEntry)}`);
+    this.writeAuditLog(logEntry, result);
+  }
+  /**
+   * Write detailed audit log to file for compliance and debugging
+   */
+  writeAuditLog(logEntry, result) {
+    var _a, _b, _c, _d;
+    try {
+      const auditDir = path.join(process.cwd(), ".agentflow", "audit");
+      const auditFile = path.join(auditDir, `command-executions-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
+      if (!fs.existsSync(auditDir)) {
+        fs.mkdirSync(auditDir, { recursive: true });
+      }
+      const auditEntry = {
+        ...logEntry,
+        // Additional audit fields
+        startedAt: new Date(result.startedAt).toISOString(),
+        completedAt: result.completedAt ? new Date(result.completedAt).toISOString() : null,
+        commandArgs: result.command.args,
+        allowConcurrent: result.command.allowConcurrent,
+        category: result.command.category,
+        description: result.command.description,
+        // Include first/last lines of output for audit trail
+        outputPreview: result.stdout ? {
+          firstLine: ((_a = result.stdout.split("\n")[0]) == null ? void 0 : _a.slice(0, 200)) || "",
+          lastLine: ((_b = result.stdout.split("\n").slice(-1)[0]) == null ? void 0 : _b.slice(0, 200)) || "",
+          totalLines: result.stdout.split("\n").length
+        } : null,
+        errorPreview: result.stderr ? {
+          firstLine: ((_c = result.stderr.split("\n")[0]) == null ? void 0 : _c.slice(0, 200)) || "",
+          lastLine: ((_d = result.stderr.split("\n").slice(-1)[0]) == null ? void 0 : _d.slice(0, 200)) || "",
+          totalLines: result.stderr.split("\n").length
+        } : null
+      };
+      fs.appendFileSync(auditFile, JSON.stringify(auditEntry) + "\n", "utf-8");
+    } catch (error) {
+      console.warn(`[CommandExecutor] Failed to write audit log: ${error.message}`);
+    }
+  }
+  /**
+   * Get audit trail for a specific execution
+   */
+  getAuditTrail(executionId) {
+    try {
+      const auditDir = path.join(process.cwd(), ".agentflow", "audit");
+      const auditEntries = [];
+      if (!fs.existsSync(auditDir)) {
+        return auditEntries;
+      }
+      const files = fs.readdirSync(auditDir).filter((f) => f.startsWith("command-executions-") && f.endsWith(".jsonl")).sort().slice(-7);
+      for (const file of files) {
+        const filePath = path.join(auditDir, file);
+        try {
+          const content = fs.readFileSync(filePath, "utf-8");
+          const lines = content.trim().split("\n").filter((line) => line.trim());
+          for (const line of lines) {
+            try {
+              const entry = JSON.parse(line);
+              if (entry.executionId === executionId) {
+                auditEntries.push(entry);
+              }
+            } catch {
+            }
+          }
+        } catch {
+        }
+      }
+      return auditEntries.sort((a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime());
+    } catch (error) {
+      console.warn(`[CommandExecutor] Failed to get audit trail: ${error.message}`);
+      return [];
+    }
+  }
+  /**
+   * Get audit statistics
+   */
+  getAuditStats(days = 7) {
+    try {
+      const auditDir = path.join(process.cwd(), ".agentflow", "audit");
+      const stats = {
+        totalExecutions: 0,
+        successfulExecutions: 0,
+        failedExecutions: 0,
+        averageDuration: 0,
+        commandFrequency: {},
+        userActivity: {}
+      };
+      if (!fs.existsSync(auditDir)) {
+        return stats;
+      }
+      const cutoff = Date.now() - days * 24 * 60 * 60 * 1e3;
+      let totalDuration = 0;
+      const files = fs.readdirSync(auditDir).filter((f) => f.startsWith("command-executions-") && f.endsWith(".jsonl")).sort().slice(-days);
+      for (const file of files) {
+        const filePath = path.join(auditDir, file);
+        try {
+          const content = fs.readFileSync(filePath, "utf-8");
+          const lines = content.trim().split("\n").filter((line) => line.trim());
+          for (const line of lines) {
+            try {
+              const entry = JSON.parse(line);
+              const entryTime = new Date(entry.timestamp).getTime();
+              if (entryTime < cutoff) continue;
+              stats.totalExecutions++;
+              if (entry.status === "completed") {
+                stats.successfulExecutions++;
+              } else if (["failed", "timeout", "killed"].includes(entry.status)) {
+                stats.failedExecutions++;
+              }
+              if (entry.duration) {
+                totalDuration += entry.duration;
+              }
+              const cmd = entry.commandId || "unknown";
+              stats.commandFrequency[cmd] = (stats.commandFrequency[cmd] || 0) + 1;
+              const user = entry.userAgent || "unknown";
+              stats.userActivity[user] = (stats.userActivity[user] || 0) + 1;
+            } catch {
+            }
+          }
+        } catch {
+        }
+      }
+      stats.averageDuration = stats.totalExecutions > 0 ? totalDuration / stats.totalExecutions : 0;
+      return stats;
+    } catch (error) {
+      console.warn(`[CommandExecutor] Failed to get audit stats: ${error.message}`);
+      return {
+        totalExecutions: 0,
+        successfulExecutions: 0,
+        failedExecutions: 0,
+        averageDuration: 0,
+        commandFrequency: {},
+        userActivity: {}
+      };
+    }
+  }
+};
+function createCommandExecutor(config, options) {
+  return new CommandExecutor(config, options);
+}
+
 // src/stats.ts
 import { getFailures, getHungNodes, getStats } from "agentflow-core";
 var AgentStats = class {
   agentMetrics = /* @__PURE__ */ new Map();
   processedTraces = /* @__PURE__ */ new Set();
   processTrace(trace) {
-    const traceKey = `${trace.filename || trace.agentId}-${trace.startTime}`;
+    const traceKey = `${trace.agentId}#${trace.filename || trace.id}-${trace.startTime}`;
     if (this.processedTraces.has(traceKey)) {
       return;
     }
@@ -690,8 +1290,8 @@ var AgentStats = class {
 
 // src/watcher.ts
 import { EventEmitter } from "events";
-import * as fs from "fs";
-import * as path from "path";
+import * as fs2 from "fs";
+import * as path2 from "path";
 import { loadGraph } from "agentflow-core";
 import chokidar from "chokidar";
 
@@ -739,13 +1339,19 @@ function extractKeyValuePairs(line) {
   const kvRegex = /(\w+)=('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|\S+)/g;
   let match;
   while ((match = kvRegex.exec(clean)) !== null) {
-    if (match[1] === "Z" || match[1] === "m") continue;
-    pairs[match[1]] = parseValue(match[2]);
+    const key = match[1];
+    const value = match[2];
+    if (!key || !value) continue;
+    if (key === "Z" || key === "m") continue;
+    pairs[key] = parseValue(value);
   }
   return pairs;
 }
 function detectComponent(action, kvPairs) {
-  if (action.includes(".")) return action.split(".")[0];
+  if (action.includes(".")) {
+    const parts = action.split(".");
+    return parts[0] || action;
+  }
   if (kvPairs.component) return String(kvPairs.component);
   if (kvPairs.service) return String(kvPairs.service);
   if (kvPairs.module) return String(kvPairs.module);
@@ -783,7 +1389,9 @@ function detectActivityPattern(line) {
       const pairs = {};
       for (const m of kvMatches) {
         const [key, value] = m.split("=", 2);
-        pairs[key] = parseValue(value);
+        if (key && value !== void 0) {
+          pairs[key] = parseValue(value);
+        }
       }
       timestamp = parseTimestamp(pairs.timestamp || pairs.time) || Date.now();
       level = String(pairs.level || "info");
@@ -795,7 +1403,7 @@ function detectActivityPattern(line) {
     const logMatch = line.match(
       /^(\d{4}-\d{2}-\d{2}[T\s]\d{2}:\d{2}:\d{2}[.\d]*Z?)\s+(\w+)?\s*:?\s*(.+)/
     );
-    if (logMatch) {
+    if (logMatch && logMatch[1]) {
       timestamp = new Date(logMatch[1]).getTime();
       level = logMatch[2] || "info";
       action = logMatch[3] || "";
@@ -833,11 +1441,38 @@ function getUniversalNodeStatus(activity) {
   if (op.match(/complete|finish|end|done/i)) return "completed";
   return "completed";
 }
-function openClawSessionIdToAgent(sessionId) {
+function openClawSessionIdToAgent(sessionId, lookupMap) {
+  if (lookupMap == null ? void 0 : lookupMap.has(sessionId)) {
+    return lookupMap.get(sessionId);
+  }
   const firstSegment = sessionId.split("-")[0];
   if (firstSegment) return firstSegment;
   return "openclaw";
 }
+function parseOpenClawSessionKey(key) {
+  const parts = key.split(":");
+  if (parts.length < 3 || parts[0] !== "agent") return null;
+  const agentName = parts[1];
+  const kind = parts[2];
+  if (parts.length === 3 && kind === agentName) {
+    return `openclaw:${agentName}`;
+  }
+  if (kind === "cron" && parts.length >= 4) {
+    const runIdx = parts.indexOf("run", 4);
+    const jobParts = runIdx > 0 ? parts.slice(3, runIdx) : parts.slice(3);
+    const jobId = jobParts.join("-");
+    return jobId ? `openclaw:${jobId}` : null;
+  }
+  if (parts.length >= 5) {
+    const target = parts[4];
+    return `openclaw:${kind}:${target}`;
+  }
+  if (parts.length >= 4) {
+    const target = parts[3];
+    return `openclaw:${kind}:${target}`;
+  }
+  return null;
+}
 
 // src/watcher.ts
 var TraceWatcher = class _TraceWatcher extends EventEmitter {
@@ -848,19 +1483,21 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   allWatchDirs;
   maxAgeMs;
   userConfig;
+  /** Maps OpenClaw session UUIDs to resolved agentIds (populated from sessions.json) */
+  sessionAgentMap = /* @__PURE__ */ new Map();
   constructor(tracesDirOrOptions) {
     super();
     const defaultMaxAgeMs = 48 * 60 * 60 * 1e3;
     const envHours = process.env.AGENTFLOW_TRACE_WINDOW_HOURS;
     const envMaxAgeMs = envHours ? parseFloat(envHours) * 60 * 60 * 1e3 : void 0;
     if (typeof tracesDirOrOptions === "string") {
-      this.tracesDir = path.resolve(tracesDirOrOptions);
+      this.tracesDir = path2.resolve(tracesDirOrOptions);
       this.dataDirs = [];
       this.maxAgeMs = envMaxAgeMs ?? defaultMaxAgeMs;
       this.userConfig = {};
     } else {
-      this.tracesDir = path.resolve(tracesDirOrOptions.tracesDir);
-      this.dataDirs = (tracesDirOrOptions.dataDirs || []).map((d) => path.resolve(d));
+      this.tracesDir = path2.resolve(tracesDirOrOptions.tracesDir);
+      this.dataDirs = (tracesDirOrOptions.dataDirs || []).map((d) => path2.resolve(d));
       this.maxAgeMs = envMaxAgeMs ?? tracesDirOrOptions.maxAgeMs ?? defaultMaxAgeMs;
       this.userConfig = tracesDirOrOptions.userConfig ?? {};
     }
@@ -869,7 +1506,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
       ...getSkipFiles(this.userConfig)
     ]);
     this.userSkipDirs = new Set(getSkipDirectories(this.userConfig));
-    this.allWatchDirs = [...new Set([this.tracesDir, ...this.dataDirs].map((d) => path.resolve(d)))];
+    this.allWatchDirs = [
+      ...new Set([this.tracesDir, ...this.dataDirs].map((d) => path2.resolve(d)))
+    ];
     this.ensureTracesDir();
     this.loadExistingFiles();
     this.archiveOldTraces();
@@ -879,9 +1518,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   /** Move trace files older than maxAgeMs into archive/YYYY-MM/ subdirectories. */
   archiveOldTraces() {
     const cutoff = Date.now() - this.maxAgeMs;
-    let archived = 0;
+    const _archived = 0;
     for (const dir of this.allWatchDirs) {
-      if (!fs.existsSync(dir)) continue;
+      if (!fs2.existsSync(dir)) continue;
       try {
         this.archiveDirectory(dir, cutoff, 0);
       } catch (error) {
@@ -891,27 +1530,28 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   }
   archiveDirectory(dir, cutoff, depth) {
     if (depth > 10) return 0;
-    if (path.basename(dir) === "archive") return 0;
+    if (path2.basename(dir) === "archive") return 0;
     let archived = 0;
     try {
-      const entries = fs.readdirSync(dir, { withFileTypes: true });
+      const entries = fs2.readdirSync(dir, { withFileTypes: true });
       for (const entry of entries) {
-        if (entry.name.startsWith(".") || entry.name === "archive" || this.userSkipDirs.has(entry.name)) continue;
-        const fullPath = path.join(dir, entry.name);
+        if (entry.name.startsWith(".") || entry.name === "archive" || this.userSkipDirs.has(entry.name))
+          continue;
+        const fullPath = path2.join(dir, entry.name);
         if (entry.isDirectory()) {
           archived += this.archiveDirectory(fullPath, cutoff, depth + 1);
           continue;
         }
         if (!entry.isFile() || !this.isSupportedFile(entry.name)) continue;
         try {
-          const stats = fs.statSync(fullPath);
+          const stats = fs2.statSync(fullPath);
           if (stats.mtimeMs >= cutoff) continue;
           const mtime = new Date(stats.mtimeMs);
           const yearMonth = `${mtime.getFullYear()}-${String(mtime.getMonth() + 1).padStart(2, "0")}`;
-          const archiveDir = path.join(this.tracesDir, "archive", yearMonth);
-          fs.mkdirSync(archiveDir, { recursive: true });
-          const dest = path.join(archiveDir, entry.name);
-          fs.renameSync(fullPath, dest);
+          const archiveDir = path2.join(this.tracesDir, "archive", yearMonth);
+          fs2.mkdirSync(archiveDir, { recursive: true });
+          const dest = path2.join(archiveDir, entry.name);
+          fs2.renameSync(fullPath, dest);
           const key = this.traceKey(fullPath);
           this.traces.delete(key);
           archived++;
@@ -923,16 +1563,19 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
     return archived;
   }
   ensureTracesDir() {
-    if (!fs.existsSync(this.tracesDir)) {
-      fs.mkdirSync(this.tracesDir, { recursive: true });
-      console.log(`Created traces directory: ${this.tracesDir}`);
+    try {
+      if (!fs2.existsSync(this.tracesDir)) {
+        fs2.mkdirSync(this.tracesDir, { recursive: true });
+        console.log(`Created traces directory: ${this.tracesDir}`);
+      }
+    } catch {
     }
   }
   loadExistingFiles() {
     let totalFiles = 0;
     let totalDirectories = 0;
     for (const dir of this.allWatchDirs) {
-      if (!fs.existsSync(dir)) continue;
+      if (!fs2.existsSync(dir)) continue;
       try {
         totalDirectories++;
         const loadedFiles = this.scanDirectoryRecursive(dir);
@@ -950,16 +1593,16 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
     if (depth > 10) return 0;
     let fileCount = 0;
     try {
-      const entries = fs.readdirSync(dir, { withFileTypes: true });
+      const entries = fs2.readdirSync(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.name.startsWith(".")) continue;
         if (entry.name === "archive") continue;
         if (this.userSkipDirs.has(entry.name)) continue;
-        const fullPath = path.join(dir, entry.name);
+        const fullPath = path2.join(dir, entry.name);
         if (entry.isFile()) {
           if (this.isSupportedFile(entry.name)) {
             try {
-              const mtime = fs.statSync(fullPath).mtimeMs;
+              const mtime = fs2.statSync(fullPath).mtimeMs;
               if (Date.now() - mtime > this.maxAgeMs) continue;
             } catch {
               continue;
@@ -1011,7 +1654,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   ];
   /** Load a file using the adapter registry, falling back to built-in parsing. */
   loadFile(filePath) {
-    const filename = path.basename(filePath);
+    const filename = path2.basename(filePath);
     if (this.skipFiles.has(filename)) return false;
     if (_TraceWatcher.SKIP_SUFFIXES.some((s) => filename.endsWith(s))) return false;
     const adapter = findAdapter(filePath);
@@ -1064,9 +1707,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           metadata: { ...trace.metadata, adapterSource: adapterName },
           sessionEvents: trace.sessionEvents ?? [],
           sourceType: "session",
-          filename: path.basename(filePath),
+          filename: path2.basename(filePath),
           lastModified: Date.now(),
-          sourceDir: path.dirname(filePath)
+          sourceDir: path2.dirname(filePath)
         };
         const key = `${adapterName}:${trace.id}`;
         this.traces.set(key, watched);
@@ -1079,9 +1722,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   }
   loadLogFile(filePath) {
     try {
-      const content = fs.readFileSync(filePath, "utf8");
-      const filename = path.basename(filePath);
-      const stats = fs.statSync(filePath);
+      const content = fs2.readFileSync(filePath, "utf8");
+      const filename = path2.basename(filePath);
+      const stats = fs2.statSync(filePath);
       if (filename.startsWith("openclaw-") || filePath.includes("openclaw")) {
         const result = this.loadOpenClawLogFile(content, filename, filePath, stats);
         if (result) return true;
@@ -1099,8 +1742,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         trace.filename = filename;
         trace.lastModified = stats.mtime.getTime();
         trace.sourceType = trace.sourceType || "trace";
-        trace.sourceDir = path.dirname(filePath);
-        const key = traces.length === 1 ? this.traceKey(filePath) : `${this.traceKey(filePath)}-${i}`;
+        trace.sourceDir = path2.dirname(filePath);
+        const traceAgentId = trace.agentId;
+        const key = traces.length === 1 ? this.traceKey(filePath, traceAgentId) : `${this.traceKey(filePath, traceAgentId)}-${i}`;
         this.traces.set(key, trace);
       }
       return traces.length > 0;
@@ -1161,7 +1805,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
       trace.sourceType = "session";
     }
     if (traces.length === 0) {
-      const stats = fs.statSync(filePath);
+      const stats = fs2.statSync(filePath);
       traces.push({
         id: "",
         rootNodeId: "root",
@@ -1201,10 +1845,10 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
     const pathAgent = this.extractAgentFromPath(filePath);
     const detection = getAgentDetection(this.userConfig);
     if (detection.filePatterns) {
-      const basename3 = path.basename(filePath, path.extname(filePath));
+      const basename4 = path2.basename(filePath, path2.extname(filePath));
       for (const [pattern, template] of Object.entries(detection.filePatterns)) {
         const re = new RegExp(`^(${pattern})$`);
-        const match = basename3.match(re);
+        const match = basename4.match(re);
         if (match) {
           const resolved = template.replace("${match}", match[1]);
           return this.normaliseAgentId(resolved);
@@ -1214,8 +1858,8 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
     return this.normaliseAgentId(pathAgent);
   }
   extractAgentFromPath(filePath) {
-    const filename = path.basename(filePath, path.extname(filePath));
-    const pathParts = filePath.split(path.sep);
+    const filename = path2.basename(filePath, path2.extname(filePath));
+    const pathParts = filePath.split(path2.sep);
     const detection = getAgentDetection(this.userConfig);
     let pathPrefix = "";
     if (detection.pathPatterns) {
@@ -1286,7 +1930,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
             if ((inner == null ? void 0 : inner.payloads) && ((_a = inner == null ? void 0 : inner.meta) == null ? void 0 : _a.agentMeta)) {
               const agentMeta = inner.meta.agentMeta;
               const sessionId = agentMeta.sessionId || "unknown";
-              const agentName = openClawSessionIdToAgent(sessionId);
+              const agentName = openClawSessionIdToAgent(sessionId, this.sessionAgentMap);
               const timestamp = parsed.time ? new Date(parsed.time).getTime() : ((_b = parsed._meta) == null ? void 0 : _b.date) ? new Date(parsed._meta.date).getTime() : stats.mtime.getTime();
               const texts = (inner.payloads || []).map((p) => p.text || "").filter(Boolean);
               if (!sessions.has(sessionId)) {
@@ -1310,7 +1954,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         if (parsed.payloads && ((_d = parsed.meta) == null ? void 0 : _d.agentMeta)) {
           const agentMeta = parsed.meta.agentMeta;
           const sessionId = agentMeta.sessionId || "unknown";
-          const agentName = openClawSessionIdToAgent(sessionId);
+          const agentName = openClawSessionIdToAgent(sessionId, this.sessionAgentMap);
           const timestamp = parsed.time ? new Date(parsed.time).getTime() : ((_e = parsed._meta) == null ? void 0 : _e.date) ? new Date(parsed._meta.date).getTime() : stats.mtime.getTime();
           const texts = (parsed.payloads || []).map((p) => p.text || "").filter(Boolean);
           if (!sessions.has(sessionId)) {
@@ -1418,7 +2062,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         filename,
         lastModified: stats.mtime.getTime(),
         sourceType: "session",
-        sourceDir: path.dirname(filePath),
+        sourceDir: path2.dirname(filePath),
         sessionEvents,
         tokenUsage: {
           input: totalInput,
@@ -1433,7 +2077,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           source: "openclaw-log"
         }
       };
-      const key = sessions.size === 1 ? this.traceKey(filePath) : `${this.traceKey(filePath)}-${traceIndex}`;
+      const key = sessions.size === 1 ? this.traceKey(filePath, agentId) : `${this.traceKey(filePath, agentId)}-${traceIndex}`;
       this.traces.set(key, trace);
       traceIndex++;
     }
@@ -1441,23 +2085,26 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   }
   loadTraceFile(filePath) {
     try {
-      const content = fs.readFileSync(filePath, "utf8");
-      const filename = path.basename(filePath);
+      const content = fs2.readFileSync(filePath, "utf8");
+      const filename = path2.basename(filePath);
       if (filename === "sessions.json") {
         return this.loadSessionsIndex(filePath, content);
       }
       const graph = loadGraph(content);
-      const stats = fs.statSync(filePath);
+      const stats = fs2.statSync(filePath);
       graph.filename = filename;
       graph.lastModified = stats.mtime.getTime();
       graph.sourceType = "trace";
-      graph.sourceDir = path.dirname(filePath);
+      graph.sourceDir = path2.dirname(filePath);
+      if (!graph.agentId || graph.agentId === "unknown") {
+        graph.agentId = this.extractAgentFromPath(filePath);
+      }
       if (graph.nodes instanceof Map) {
         for (const node of graph.nodes.values()) {
           if (!node.children) node.children = [];
         }
       }
-      this.traces.set(this.traceKey(filePath), graph);
+      this.traces.set(this.traceKey(filePath, graph.agentId), graph);
       return true;
     } catch {
       return false;
@@ -1465,11 +2112,12 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   }
   /** Parse sessions.json index to discover agents and their sessions. */
   loadSessionsIndex(filePath, content) {
+    var _a;
     try {
       const data = JSON.parse(content);
       if (typeof data !== "object" || data === null) return false;
-      const stats = fs.statSync(filePath);
-      const pathParts = filePath.split(path.sep);
+      const stats = fs2.statSync(filePath);
+      const pathParts = filePath.split(path2.sep);
       const agentsIndex = pathParts.lastIndexOf("agents");
       if (agentsIndex === -1 || agentsIndex + 1 >= pathParts.length) return false;
       const agentName = pathParts[agentsIndex + 1];
@@ -1480,11 +2128,19 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         const session = sessionData;
         const sessionId = session.sessionId;
         if (!sessionId) continue;
+        const resolvedAgentId = parseOpenClawSessionKey(sessionKey) ?? agentId;
+        this.sessionAgentMap.set(String(sessionId), resolvedAgentId);
         const existingKey = Array.from(this.traces.keys()).find((k) => {
           const t = this.traces.get(k);
           return (t == null ? void 0 : t.id) === sessionId || (t == null ? void 0 : t.traceId) === sessionId;
         });
-        if (existingKey) continue;
+        if (existingKey) {
+          const existing = this.traces.get(existingKey);
+          if (existing && (existing.agentId === agentId || ((_a = existing.agentId) == null ? void 0 : _a.startsWith("openclaw-main")))) {
+            existing.agentId = resolvedAgentId;
+          }
+          continue;
+        }
         const updatedAt = session.updatedAt || stats.mtime.getTime();
         const label = session.label || sessionKey.split(":").pop() || sessionId;
         const chatType = session.chatType || (sessionKey.includes("cron") ? "cron" : "direct");
@@ -1513,7 +2169,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           edges: [],
           events: [],
           startTime: updatedAt,
-          agentId,
+          agentId: resolvedAgentId,
           trigger,
           name: label,
           traceId: sessionId,
@@ -1521,7 +2177,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           filename: `${agentName}-${sessionId.slice(0, 8)}.index`,
           lastModified: updatedAt,
           sourceType: "session",
-          sourceDir: path.dirname(filePath),
+          sourceDir: path2.dirname(filePath),
           sessionEvents: [],
           tokenUsage: { input: 0, output: 0, total: 0, cost: 0 },
           metadata: {
@@ -1531,7 +2187,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
             agentName
           }
         };
-        const key = `${this.traceKey(filePath)}-${sessionId.slice(0, 12)}`;
+        const key = `${this.traceKey(filePath, agentId)}-${sessionId.slice(0, 12)}`;
         this.traces.set(key, trace);
         loaded++;
       }
@@ -1544,7 +2200,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   loadSessionFile(filePath) {
     var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l;
     try {
-      const content = fs.readFileSync(filePath, "utf8");
+      const content = fs2.readFileSync(filePath, "utf8");
       const lines = content.split("\n").filter((l) => l.trim());
       if (lines.length === 0) return false;
       const rawEvents = [];
@@ -1560,13 +2216,13 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         return this.loadCronRunFile(rawEvents, filePath);
       }
       const sessionEvent = rawEvents.find((e) => e.type === "session");
-      const sessionId = (sessionEvent == null ? void 0 : sessionEvent.id) || path.basename(filePath, ".jsonl");
+      const sessionId = (sessionEvent == null ? void 0 : sessionEvent.id) || path2.basename(filePath, ".jsonl");
       const sessionTimestamp = (sessionEvent == null ? void 0 : sessionEvent.timestamp) || ((_a = rawEvents[0]) == null ? void 0 : _a.timestamp);
       const startTime = sessionTimestamp ? new Date(sessionTimestamp).getTime() : 0;
       if (!startTime) return false;
-      const parentDir = path.basename(path.dirname(filePath));
-      const grandParentDir = path.basename(path.dirname(path.dirname(filePath)));
-      const greatGrandParentDir = path.basename(path.dirname(path.dirname(path.dirname(filePath))));
+      const parentDir = path2.basename(path2.dirname(filePath));
+      const grandParentDir = path2.basename(path2.dirname(path2.dirname(filePath)));
+      const greatGrandParentDir = path2.basename(path2.dirname(path2.dirname(path2.dirname(filePath))));
       let agentName;
       if (parentDir === "sessions" && greatGrandParentDir === "agents") {
         agentName = grandParentDir;
@@ -1585,6 +2241,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           }
         }
       }
+      if (this.sessionAgentMap.has(sessionId)) {
+        agentId = this.sessionAgentMap.get(sessionId);
+      }
       const modelEvent = rawEvents.find((e) => e.type === "model_change");
       const provider = (modelEvent == null ? void 0 : modelEvent.provider) || "";
       const modelId = (modelEvent == null ? void 0 : modelEvent.modelId) || "";
@@ -1788,7 +2447,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           if (role === "toolResult") {
             const toolCallId = ((_j = contentBlocks[0]) == null ? void 0 : _j.toolCallId) || evt.parentId;
             const resultContent = contentBlocks.map((b) => b.text || b.content || "").join("\n");
-            const hasError = contentBlocks.some((b) => b.isError || b.error);
+            const hasError = contentBlocks.some(
+              (b) => b.isError || b.error
+            );
             const errorText = hasError ? resultContent : void 0;
             sessionEvents.push({
               type: "tool_result",
@@ -1816,7 +2477,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           }
         }
       }
-      const fileStat = fs.statSync(filePath);
+      const fileStat = fs2.statSync(filePath);
       const fileAge = Date.now() - fileStat.mtime.getTime();
       const lastEvt = rawEvents[rawEvents.length - 1];
       const hasToolError = sessionEvents.some((e) => e.type === "tool_result" && e.toolError);
@@ -1864,7 +2525,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           "gen_ai.request.model": modelId
         }
       });
-      const filename = path.basename(filePath);
+      const filename = path2.basename(filePath);
       const trace = {
         id: sessionId,
         nodes,
@@ -1880,7 +2541,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         filename,
         lastModified: fileStat.mtime.getTime(),
         sourceType: "session",
-        sourceDir: path.dirname(filePath),
+        sourceDir: path2.dirname(filePath),
         sessionEvents,
         tokenUsage,
         metadata: {
@@ -1894,93 +2555,180 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
           sessionVersion: sessionEvent == null ? void 0 : sessionEvent.version
         }
       };
-      this.traces.set(this.traceKey(filePath), trace);
+      this.traces.set(this.traceKey(filePath, agentId), trace);
       return true;
     } catch {
       return false;
     }
   }
-  /** Parse cron run JSONL files (ts, jobId, action, status format). */
+  /** Parse cron run JSONL files — creates one trace per execution run. */
   loadCronRunFile(rawEvents, filePath) {
-    var _a, _b, _c;
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     try {
-      const filename = path.basename(filePath);
-      const jobId = ((_a = rawEvents[0]) == null ? void 0 : _a.jobId) || path.basename(filePath, ".jsonl");
-      const fileStat = fs.statSync(filePath);
-      const sessionEvents = [];
-      let lastStatus = "completed";
+      const filename = path2.basename(filePath);
+      const fileJobId = String(((_a = rawEvents[0]) == null ? void 0 : _a.jobId) || path2.basename(filePath, ".jsonl"));
+      const fileStat = fs2.statSync(filePath);
+      const agentId = `openclaw:${fileJobId}`;
+      let loaded = 0;
       for (const evt of rawEvents) {
         const ts = evt.ts || Date.now();
-        const action = evt.action || "unknown";
-        const status = evt.status || "ok";
-        if (status !== "ok") lastStatus = "failed";
-        sessionEvents.push({
-          type: action === "finished" ? "assistant" : "system",
-          timestamp: ts,
-          name: `${jobId}: ${action}`,
-          content: evt.summary || evt.error || `${action} (${status})`,
-          id: `cron-${ts}`
+        const runAtMs = evt.runAtMs || ts;
+        const durationMs = evt.durationMs || 0;
+        const status = evt.status === "ok" ? "completed" : "failed";
+        const sessionId = String(evt.sessionId || `${fileJobId}-${ts}`);
+        const summary = String(evt.summary || evt.error || "");
+        const model = String(evt.model || "");
+        const usage = evt.usage || {};
+        const rootId = `cron-${sessionId.slice(0, 12)}`;
+        const nodes = /* @__PURE__ */ new Map();
+        const children = [];
+        nodes.set(rootId, {
+          id: rootId,
+          type: "agent",
+          name: `${fileJobId} run`,
+          startTime: runAtMs,
+          endTime: runAtMs + durationMs,
+          status,
+          parentId: void 0,
+          children,
+          metadata: {
+            jobId: fileJobId,
+            model,
+            sessionId,
+            durationMs
+          }
         });
-      }
-      const firstTs = ((_b = rawEvents[0]) == null ? void 0 : _b.ts) || fileStat.mtime.getTime();
-      const lastTs = ((_c = rawEvents[rawEvents.length - 1]) == null ? void 0 : _c.ts) || fileStat.mtime.getTime();
-      const rootId = `cron-${jobId.slice(0, 12)}`;
-      const nodes = /* @__PURE__ */ new Map();
-      nodes.set(rootId, {
-        id: rootId,
-        type: "agent",
-        name: jobId,
-        startTime: firstTs,
-        endTime: lastTs,
-        status: lastStatus,
-        parentId: void 0,
-        children: [],
-        metadata: { jobId, runs: rawEvents.length }
-      });
-      const trace = {
-        id: jobId,
-        nodes,
-        edges: [],
-        events: [],
-        startTime: firstTs,
-        agentId: "openclaw-cron",
-        trigger: "cron",
-        name: jobId,
-        traceId: jobId,
-        spanId: jobId,
-        filename,
-        lastModified: fileStat.mtime.getTime(),
-        sourceType: "session",
-        sourceDir: path.dirname(filePath),
-        sessionEvents,
-        tokenUsage: { input: 0, output: 0, total: 0, cost: 0 },
-        metadata: { jobId, source: "cron-run" }
-      };
-      this.traces.set(this.traceKey(filePath), trace);
-      return true;
+        let stepIdx = 0;
+        const tablePattern = /\|\s*\*?\*?(\d+)\.\s*\*?\*?([^|]+)\*?\*?\s*\|\s*([^|]+)\s*\|\s*([^|]*)\|/g;
+        let m;
+        while ((m = tablePattern.exec(summary)) !== null) {
+          stepIdx++;
+          const stepName = ((_b = m[2]) == null ? void 0 : _b.trim().replace(/\*+/g, "")) || `Step ${stepIdx}`;
+          const stepDetail = ((_c = m[4]) == null ? void 0 : _c.trim()) || "";
+          const nodeId = `step-${stepIdx}`;
+          children.push(nodeId);
+          nodes.set(nodeId, {
+            id: nodeId,
+            type: "tool",
+            name: stepName,
+            startTime: runAtMs + (stepIdx - 1) * Math.floor(durationMs / Math.max(1, stepIdx + 1)),
+            endTime: runAtMs + stepIdx * Math.floor(durationMs / Math.max(1, stepIdx + 1)),
+            status: ((_d = m[3]) == null ? void 0 : _d.includes("\u274C")) || ((_e = m[3]) == null ? void 0 : _e.includes("Fail")) ? "failed" : "completed",
+            parentId: rootId,
+            children: [],
+            metadata: { detail: stepDetail }
+          });
+        }
+        if (stepIdx === 0) {
+          const listPattern = /^\s*(\d+)\.\s*\*?\*?([^*\n]+)\*?\*?\s*(?:[-—]\s*(.+))?$/gm;
+          while ((m = listPattern.exec(summary)) !== null) {
+            if ((_f = m[2]) == null ? void 0 : _f.trim().startsWith("#")) continue;
+            stepIdx++;
+            const stepName = ((_g = m[2]) == null ? void 0 : _g.trim().replace(/\*+/g, "")) || `Step ${stepIdx}`;
+            const stepDetail = ((_h = m[3]) == null ? void 0 : _h.trim()) || "";
+            const nodeId = `step-${stepIdx}`;
+            children.push(nodeId);
+            nodes.set(nodeId, {
+              id: nodeId,
+              type: "tool",
+              name: stepName,
+              startTime: runAtMs + (stepIdx - 1) * Math.floor(durationMs / Math.max(1, stepIdx + 1)),
+              endTime: runAtMs + stepIdx * Math.floor(durationMs / Math.max(1, stepIdx + 1)),
+              status: stepDetail.toLowerCase().includes("fail") ? "failed" : "completed",
+              parentId: rootId,
+              children: [],
+              metadata: { detail: stepDetail }
+            });
+          }
+        }
+        if (stepIdx === 0 && summary) {
+          const sumId = "summary-0";
+          children.push(sumId);
+          nodes.set(sumId, {
+            id: sumId,
+            type: "tool",
+            name: status === "completed" ? "Execution" : evt.error ? String(evt.error) : "Execution",
+            startTime: runAtMs,
+            endTime: runAtMs + durationMs,
+            status,
+            parentId: rootId,
+            children: [],
+            metadata: { summary: summary.slice(0, 500) }
+          });
+        }
+        const sessionEvents = [
+          {
+            type: "system",
+            timestamp: runAtMs,
+            name: `${fileJobId} started`,
+            content: `Model: ${model}`,
+            id: `start-${ts}`
+          }
+        ];
+        if (summary) {
+          sessionEvents.push({
+            type: "assistant",
+            timestamp: runAtMs + durationMs,
+            name: status === "completed" ? "Completed" : "Failed",
+            content: summary,
+            id: `result-${ts}`
+          });
+        }
+        const trace = {
+          id: sessionId,
+          nodes,
+          edges: [],
+          events: [],
+          startTime: runAtMs,
+          agentId,
+          trigger: "cron",
+          name: `${fileJobId} ${new Date(runAtMs).toISOString().slice(0, 16)}`,
+          traceId: sessionId,
+          spanId: sessionId,
+          filename,
+          lastModified: fileStat.mtime.getTime(),
+          sourceType: "session",
+          sourceDir: path2.dirname(filePath),
+          sessionEvents,
+          tokenUsage: {
+            input: usage.promptTokens || usage.input || 0,
+            output: usage.completionTokens || usage.output || 0,
+            total: usage.totalTokens || usage.total || 0,
+            cost: 0
+          },
+          metadata: { jobId: fileJobId, model, source: "cron-run", sessionId }
+        };
+        const key = `${this.traceKey(filePath, agentId)}-${sessionId.slice(0, 12)}`;
+        this.traces.set(key, trace);
+        loaded++;
+      }
+      return loaded > 0;
     } catch {
       return false;
     }
   }
-  /** Unique key for a file across directories. */
-  traceKey(filePath) {
+  /** Unique key for a file across directories. Includes agentId to prevent collisions between agents. */
+  traceKey(filePath, agentId) {
+    let fileKey;
     for (const dir of this.allWatchDirs) {
       if (filePath.startsWith(dir)) {
-        const dirParts = dir.split(path.sep).filter(Boolean);
+        const dirParts = dir.split(path2.sep).filter(Boolean);
         const dirSuffix = dirParts.slice(-2).join("/");
-        return `${path.relative(dir, filePath).replace(/\\/g, "/")}@${dirSuffix}`;
+        fileKey = `${path2.relative(dir, filePath).replace(/\\/g, "/")}@${dirSuffix}`;
+        return agentId ? `${fileKey}#${agentId}` : fileKey;
       }
     }
-    return filePath;
+    fileKey = filePath;
+    return agentId ? `${fileKey}#${agentId}` : fileKey;
   }
   startWatching() {
     for (const dir of this.allWatchDirs) {
-      if (!fs.existsSync(dir)) continue;
+      if (!fs2.existsSync(dir)) continue;
       const patterns = [
-        path.join(dir, "**/*.json"),
-        path.join(dir, "**/*.jsonl"),
-        path.join(dir, "**/*.log"),
-        path.join(dir, "**/*.trace")
+        path2.join(dir, "**/*.json"),
+        path2.join(dir, "**/*.jsonl"),
+        path2.join(dir, "**/*.log"),
+        path2.join(dir, "**/*.trace")
       ];
       const watcher = chokidar.watch(patterns, {
         ignored: [
@@ -2006,9 +2754,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         // Allow deep nesting for OpenClaw agents/*/sessions/
       });
       watcher.on("add", (filePath) => {
-        if (this.isSupportedFile(path.basename(filePath))) {
-          const relativePath = path.relative(dir, filePath);
-          console.log(`New file: ${relativePath} (in ${path.basename(dir)})`);
+        if (this.isSupportedFile(path2.basename(filePath))) {
+          const relativePath = path2.relative(dir, filePath);
+          console.log(`New file: ${relativePath} (in ${path2.basename(dir)})`);
           if (this.loadFile(filePath)) {
             const key = this.traceKey(filePath);
             const trace = this.traces.get(key);
@@ -2019,7 +2767,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         }
       });
       watcher.on("change", (filePath) => {
-        if (this.isSupportedFile(path.basename(filePath))) {
+        if (this.isSupportedFile(path2.basename(filePath))) {
           if (this.loadFile(filePath)) {
             const key = this.traceKey(filePath);
             const trace = this.traces.get(key);
@@ -2030,7 +2778,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         }
       });
       watcher.on("unlink", (filePath) => {
-        if (this.isSupportedFile(path.basename(filePath))) {
+        if (this.isSupportedFile(path2.basename(filePath))) {
           const key = this.traceKey(filePath);
           this.traces.delete(key);
           this.emit("trace-removed", key);
@@ -2054,6 +2802,10 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
     let candidates = [];
     const exact = this.traces.get(filename);
     if (exact) candidates.push(exact);
+    if (agentId && !filename.includes("#")) {
+      const agentKeyed = this.traces.get(`${filename}#${agentId}`);
+      if (agentKeyed) candidates.push(agentKeyed);
+    }
     if (filename.includes("::")) {
       const [fname, startTimeStr] = filename.split("::");
       const startTime = Number(startTimeStr);
@@ -2074,19 +2826,21 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
         candidates.push(trace);
       }
     }
+    candidates = [...new Set(candidates)];
     if (candidates.length === 0) return void 0;
     if (candidates.length === 1) return candidates[0];
     if (agentId) {
       const agentMatches = candidates.filter((c) => c.agentId === agentId);
-      if (agentMatches.length > 0) {
-        candidates = agentMatches;
-      }
+      if (agentMatches.length === 1) return agentMatches[0];
+      if (agentMatches.length > 1) candidates = agentMatches;
+      if (agentMatches.length === 0) return void 0;
     }
-    if (candidates.length === 1) return candidates[0];
     let best = candidates[0];
+    if (!best) return void 0;
     let bestNodeCount = best.nodes instanceof Map ? best.nodes.size : Object.keys(best.nodes ?? {}).length;
     for (let i = 1; i < candidates.length; i++) {
       const c = candidates[i];
+      if (!c) continue;
       const nc = c.nodes instanceof Map ? c.nodes.size : Object.keys(c.nodes ?? {}).length;
       if (nc > bestNodeCount) {
         best = c;
@@ -2137,12 +2891,14 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
 };
 
 // src/cli.ts
-import * as fs2 from "fs";
+import * as fs3 from "fs";
 import * as os from "os";
-import * as path2 from "path";
+import * as path3 from "path";
 import { fileURLToPath } from "url";
-var __cliDirname = path2.dirname(fileURLToPath(import.meta.url));
-var VERSION = JSON.parse(fs2.readFileSync(path2.resolve(__cliDirname, "../package.json"), "utf-8")).version;
+var __cliDirname = path3.dirname(fileURLToPath(import.meta.url));
+var VERSION = JSON.parse(
+  fs3.readFileSync(path3.resolve(__cliDirname, "../package.json"), "utf-8")
+).version;
 function getLanAddress() {
   const interfaces = os.networkInterfaces();
   for (const name of Object.keys(interfaces)) {
@@ -2246,9 +3002,9 @@ async function startDashboard() {
   if (!config.somaVault && process.env.SOMA_VAULT) {
     config.somaVault = process.env.SOMA_VAULT;
   }
-  const tracesPath = path2.resolve(config.tracesDir);
-  if (!fs2.existsSync(tracesPath)) {
-    fs2.mkdirSync(tracesPath, { recursive: true });
+  const tracesPath = path3.resolve(config.tracesDir);
+  if (!fs3.existsSync(tracesPath)) {
+    fs3.mkdirSync(tracesPath, { recursive: true });
   }
   config.tracesDir = tracesPath;
   console.log("\nStarting AgentFlow Dashboard...\n");
@@ -2320,13 +3076,77 @@ Examples:
 
 // src/server.ts
 var __filename = fileURLToPath2(import.meta.url);
-var __dirname = path3.dirname(__filename);
+var __dirname = path4.dirname(__filename);
+function safePath(segment) {
+  return path4.basename(segment.replace(/\.\./g, ""));
+}
+function parseVaultFrontmatter(content) {
+  const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!fmMatch) return null;
+  const fm = {};
+  const lines = fmMatch[1].split("\n");
+  let currentKey = "";
+  let collectingList = null;
+  for (const line of lines) {
+    if (line.match(/^\s*-\s/) && currentKey) {
+      if (!collectingList) collectingList = [];
+      const val2 = line.replace(/^\s*-\s*/, "").trim().replace(/^["']|["']$/g, "");
+      collectingList.push(val2);
+      continue;
+    }
+    if (collectingList && currentKey) {
+      fm[currentKey] = collectingList;
+      collectingList = null;
+    }
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1 || line.startsWith(" ")) continue;
+    currentKey = line.slice(0, colonIdx).trim();
+    let val = line.slice(colonIdx + 1).trim();
+    if (val === "") continue;
+    if (val.startsWith("[") && val.endsWith("]")) {
+      try {
+        fm[currentKey] = JSON.parse(val);
+      } catch {
+        fm[currentKey] = val;
+      }
+      currentKey = "";
+      continue;
+    }
+    if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    }
+    if (val === "true") fm[currentKey] = true;
+    else if (val === "false") fm[currentKey] = false;
+    else if (/^\d+(\.\d+)?$/.test(val)) fm[currentKey] = Number(val);
+    else fm[currentKey] = val;
+    currentKey = "";
+  }
+  if (collectingList && currentKey) {
+    fm[currentKey] = collectingList;
+  }
+  for (const key of ["tags", "related", "evidence", "evidence_links", "sourceIds"]) {
+    if (fm[key] && !Array.isArray(fm[key])) {
+      const str = String(fm[key]);
+      if (str.startsWith("[")) {
+        try {
+          fm[key] = JSON.parse(str);
+        } catch {
+          fm[key] = [str];
+        }
+      } else {
+        fm[key] = [str];
+      }
+    }
+    if (!fm[key]) fm[key] = [];
+  }
+  return fm;
+}
 function serializeTrace(trace) {
   if (!trace) return trace;
   const obj = { ...trace };
-  if (obj.nodes instanceof Map) {
+  if (trace.nodes instanceof Map) {
     const nodesObj = {};
-    for (const [key, value] of obj.nodes) {
+    for (const [key, value] of trace.nodes) {
       nodesObj[key] = value;
     }
     obj.nodes = nodesObj;
@@ -2340,11 +3160,11 @@ var DashboardServer = class {
     this.userConfig = userCfg;
     this.configPath = cfgPath;
     const home = process.env.HOME ?? process.env.USERPROFILE ?? "/tmp";
-    const dashConfigPath = path3.join(home, ".agentflow/dashboard-config.json");
+    const dashConfigPath = path4.join(home, ".agentflow/dashboard-config.json");
     if (!config.dataDirs) config.dataDirs = [];
     try {
-      if (fs3.existsSync(dashConfigPath)) {
-        const saved = JSON.parse(fs3.readFileSync(dashConfigPath, "utf-8"));
+      if (fs4.existsSync(dashConfigPath)) {
+        const saved = JSON.parse(fs4.readFileSync(dashConfigPath, "utf-8"));
         const extraDirs = saved.extraDirs ?? [];
         for (const d of extraDirs) {
           if (!config.dataDirs.includes(d)) config.dataDirs.push(d);
@@ -2353,7 +3173,7 @@ var DashboardServer = class {
     } catch {
     }
     for (const p of getDiscoveryPaths(this.userConfig)) {
-      if (fs3.existsSync(p) && !config.dataDirs.includes(p)) {
+      if (fs4.existsSync(p) && !config.dataDirs.includes(p)) {
         config.dataDirs.push(p);
       }
     }
@@ -2364,8 +3184,9 @@ var DashboardServer = class {
     });
     this.stats = new AgentStats();
     this.knowledgeStore = createKnowledgeStore({
-      baseDir: path3.join(config.tracesDir, "..", ".agentflow", "knowledge")
+      baseDir: path4.join(config.tracesDir, "..", ".agentflow", "knowledge")
     });
+    this.commandExecutor = createCommandExecutor(this.userConfig);
     this.setupExpress();
     this.setupWebSocket();
     this.setupTraceWatcher();
@@ -2396,9 +3217,21 @@ var DashboardServer = class {
     ts: 0
   };
   knowledgeStore;
+  commandExecutor;
   userConfig;
   configPath;
   setupExpress() {
+    this.app.use(
+      "/api/",
+      rateLimit({
+        windowMs: 60 * 1e3,
+        // 1 minute
+        max: 300,
+        // 300 requests per minute per IP
+        standardHeaders: true,
+        legacyHeaders: false
+      })
+    );
     if (this.config.enableCors) {
       this.app.use((_req, res, next) => {
         res.header("Access-Control-Allow-Origin", "*");
@@ -2409,11 +3242,11 @@ var DashboardServer = class {
         next();
       });
     }
-    const pkgDir = path3.join(__dirname, "..");
-    const clientDir = path3.join(pkgDir, "dist/client");
-    const clientIndex = path3.join(clientDir, "index.html");
-    const srcDir = path3.join(pkgDir, "src/client");
-    const needsBuild = !fs3.existsSync(clientIndex) || fs3.existsSync(srcDir) && this.isClientStale(srcDir, clientDir);
+    const pkgDir = path4.join(__dirname, "..");
+    const clientDir = path4.join(pkgDir, "dist/client");
+    const clientIndex = path4.join(clientDir, "index.html");
+    const srcDir = path4.join(pkgDir, "src/client");
+    const needsBuild = !fs4.existsSync(clientIndex) || fs4.existsSync(srcDir) && this.isClientStale(srcDir, clientDir);
     if (needsBuild) {
       try {
         console.log("Building dashboard client...");
@@ -2422,7 +3255,7 @@ var DashboardServer = class {
         console.warn("Client build failed \u2014 dashboard UI may be stale:", err.message);
       }
     }
-    if (fs3.existsSync(clientDir)) {
+    if (fs4.existsSync(clientDir)) {
       this.app.use(express.static(clientDir));
     }
     this.app.get("/api/traces", (req, res) => {
@@ -2469,6 +3302,20 @@ var DashboardServer = class {
         res.status(500).json({ error: "Failed to load trace events" });
       }
     });
+    this.app.get("/api/traces/:filename/receipt", (req, res) => {
+      try {
+        const trace = this.watcher.getTrace(req.params.filename);
+        if (!trace) {
+          return res.status(404).json({ error: "Trace not found" });
+        }
+        const serialized = serializeTrace(trace);
+        const graph = loadGraph2(serialized);
+        const receipt = toReceipt(graph);
+        res.json(receipt);
+      } catch (_error) {
+        res.status(500).json({ error: "Failed to generate receipt" });
+      }
+    });
     this.app.get("/api/agents", (req, res) => {
       try {
         const raw = this.stats.getAgentsList();
@@ -2591,19 +3438,37 @@ var DashboardServer = class {
         res.status(500).json({ error: "Failed to build process graph" });
       }
     });
-    this.app.get("/api/agents/:agentId/variants", (req, res) => {
+    this.app.get("/api/agents/:agentId/variants", async (req, res) => {
       try {
         const agentId = req.params.agentId;
+        const byModel = req.query.by === "model";
         const graphs = this.getGraphTraces(agentId);
         if (graphs.length === 0) {
-          return res.json({ agentId, totalTraces: 0, variants: [] });
+          return res.json({ agentId, totalTraces: 0, variants: [], modelVariants: [] });
         }
         const variants = findVariants(graphs).map((v) => ({
           pathSignature: v.pathSignature,
           count: v.count,
           percentage: v.percentage
         }));
-        res.json({ agentId, totalTraces: graphs.length, variants });
+        let modelVariants = [];
+        if (byModel) {
+          try {
+            const { findVariantsWithModel } = await import(
+              /* webpackIgnore: true */
+              "./ops-intel-PL6GGIKL.js"
+            );
+            modelVariants = findVariantsWithModel(graphs, { includeModel: true }).map(
+              (v) => ({
+                pathSignature: v.pathSignature,
+                count: v.count,
+                percentage: v.percentage
+              })
+            );
+          } catch {
+          }
+        }
+        res.json({ agentId, totalTraces: graphs.length, variants, modelVariants });
       } catch (error) {
         console.error("Variants error:", error);
         res.status(500).json({ error: "Failed to compute variants" });
@@ -2628,6 +3493,147 @@ var DashboardServer = class {
         res.status(500).json({ error: "Failed to compute bottlenecks" });
       }
     });
+    this.app.get("/api/agents/:agentId/health-briefing", async (req, res) => {
+      const somaVault = this.config.somaVault;
+      if (!somaVault) return res.status(404).json({ error: "Soma vault not configured" });
+      try {
+        const agentId = req.params.agentId;
+        const agentFile = path4.join(
+          somaVault,
+          "agent",
+          `${safePath(agentId.replace(/:/g, "-"))}.md`
+        );
+        let agentData = {};
+        if (fs4.existsSync(agentFile)) {
+          agentData = parseVaultFrontmatter(fs4.readFileSync(agentFile, "utf-8")) ?? {};
+        }
+        const totalExecutions = Number(agentData.totalExecutions ?? 0);
+        const failureRate = Number(agentData.failureRate ?? 0);
+        const failureCount = Number(agentData.failureCount ?? 0);
+        const status = failureRate > 0.5 ? "critical" : failureRate > 0.1 ? "degraded" : "healthy";
+        const knowledgeTypes = ["decision", "insight", "constraint", "contradiction", "policy"];
+        const intelligence = [];
+        for (const kt of knowledgeTypes) {
+          const dir = path4.join(somaVault, kt);
+          if (!fs4.existsSync(dir)) continue;
+          for (const f of fs4.readdirSync(dir)) {
+            if (!f.endsWith(".md")) continue;
+            try {
+              const content = fs4.readFileSync(path4.join(dir, f), "utf-8");
+              if (!content.includes(agentId) && !content.includes(agentId.replace(/:/g, "-")))
+                continue;
+              const parsed = parseVaultFrontmatter(content);
+              if (!parsed) continue;
+              intelligence.push({
+                type: String(parsed.type ?? kt),
+                name: String(parsed.name ?? f.replace(".md", "")),
+                claim: String(parsed.claim ?? "").slice(0, 150),
+                confidence: parsed.confidence
+              });
+            } catch {
+            }
+          }
+        }
+        const agentDir = path4.join(somaVault, "agent");
+        const peers = [];
+        if (fs4.existsSync(agentDir)) {
+          for (const f of fs4.readdirSync(agentDir)) {
+            if (!f.endsWith(".md")) continue;
+            const p = parseVaultFrontmatter(fs4.readFileSync(path4.join(agentDir, f), "utf-8"));
+            if (!p) continue;
+            const runs = Number(p.totalExecutions ?? 0);
+            if (runs > 0) {
+              peers.push({
+                name: String(p.name ?? p.agentId ?? f.replace(".md", "")),
+                successRate: 1 - Number(p.failureRate ?? 0),
+                runs
+              });
+            }
+          }
+        }
+        peers.sort((a, b) => b.successRate - a.successRate);
+        let drift = null;
+        try {
+          const historyPath = path4.join(somaVault, "..", "conformance-history.json");
+          if (fs4.existsSync(historyPath)) {
+            const history = JSON.parse(fs4.readFileSync(historyPath, "utf-8"));
+            const agentHistory = history.filter((e) => e.agentId === agentId);
+            if (agentHistory.length >= 10) {
+              try {
+                const { detectDrift: dd } = await import(
+                  /* webpackIgnore: true */
+                  "./ops-intel-PL6GGIKL.js"
+                );
+                drift = dd(agentHistory);
+              } catch {
+                drift = { status: "stable", dataPoints: agentHistory.length };
+              }
+            } else {
+              drift = { status: "insufficient_data", dataPoints: agentHistory.length };
+            }
+          }
+        } catch {
+        }
+        res.json({
+          agentId,
+          status,
+          totalExecutions,
+          failureRate,
+          failureCount,
+          intelligence: {
+            total: intelligence.length,
+            byType: Object.fromEntries(
+              knowledgeTypes.map((t) => [t, intelligence.filter((i) => i.type === t)])
+            )
+          },
+          peers,
+          drift
+        });
+      } catch (error) {
+        console.error("Health briefing error:", error);
+        res.status(500).json({ error: "Failed to generate briefing" });
+      }
+    });
+    this.app.get("/api/traces/:filename/decisions", (req, res) => {
+      try {
+        const trace = this.watcher.getTrace(req.params.filename);
+        if (!trace) return res.status(404).json({ error: "Trace not found" });
+        const serialized = serializeTrace(trace);
+        const sessionEvents = trace.sessionEvents;
+        let decisions = [];
+        if (sessionEvents && sessionEvents.length > 0) {
+          try {
+            import("./ops-intel-PL6GGIKL.js").then(({ extractDecisionsFromSession, computePatternSignature }) => {
+              decisions = extractDecisionsFromSession(sessionEvents);
+              res.json({
+                decisions,
+                pattern: computePatternSignature(
+                  decisions
+                )
+              });
+            }).catch(() => {
+              res.json({ decisions: [], pattern: "" });
+            });
+            return;
+          } catch {
+          }
+        }
+        const graph = loadGraph2(serialized);
+        const nodes = [...graph.nodes.values()];
+        const toolNodes = nodes.filter((n) => n.type === "tool" || n.type === "action").sort((a, b) => (a.startTime ?? 0) - (b.startTime ?? 0));
+        decisions = toolNodes.map((n, i) => ({
+          action: n.name,
+          tool: n.name,
+          outcome: n.status === "failed" ? "failed" : "ok",
+          durationMs: n.endTime != null ? n.endTime - n.startTime : void 0,
+          index: i
+        }));
+        const pattern = decisions.map((d) => d.action).join("\u2192");
+        res.json({ decisions, pattern });
+      } catch {
+        res.status(500).json({ error: "Failed to extract decisions" });
+      }
+    });
     this.app.get("/api/agents/:agentId/profile", (req, res) => {
       try {
         const profile = this.knowledgeStore.getAgentProfile(req.params.agentId);
@@ -2641,6 +3647,7 @@ var DashboardServer = class {
       }
     });
     this.app.get("/api/process-model/:agentId", (req, res) => {
+      var _a, _b;
       try {
         const agentId = req.params.agentId;
         const allTraces = this.watcher.getTracesByAgent(agentId);
@@ -2658,8 +3665,8 @@ var DashboardServer = class {
           const nodeArr = Object.values(nodes);
           const sorted = nodeArr.filter((n) => n.name && typeof n.startTime === "number" && n.startTime > 0).sort((a, b) => (a.startTime ?? 0) - (b.startTime ?? 0));
           for (let i = 0; i < sorted.length - 1; i++) {
-            const from = sorted[i].name;
-            const to = sorted[i + 1].name;
+            const from = ((_a = sorted[i]) == null ? void 0 : _a.name) ?? "";
+            const to = ((_b = sorted[i + 1]) == null ? void 0 : _b.name) ?? "";
             const key = `${from}|||${to}`;
             transMap.set(key, (transMap.get(key) ?? 0) + 1);
           }
@@ -2682,7 +3689,7 @@ var DashboardServer = class {
         const model = {
           transitions: [...transMap.entries()].map(([key, count]) => {
             const [from, to] = key.split("|||");
-            return { from, to, count };
+            return { from: from ?? "", to: to ?? "", count };
           }),
           nodeTypes: Object.fromEntries(nodeTypeMap)
         };
@@ -2735,11 +3742,11 @@ var DashboardServer = class {
         return res.json({ tier: "teaser", somaVault: false, governanceAvailable: false });
       }
       try {
-        const reportPath = path3.join(somaVault, "..", "soma-report.json");
-        if (!fs3.existsSync(reportPath)) {
+        const reportPath = path4.join(somaVault, "..", "soma-report.json");
+        if (!fs4.existsSync(reportPath)) {
           return res.json({ tier: "free", somaVault: true, governanceAvailable: false });
         }
-        const report = JSON.parse(fs3.readFileSync(reportPath, "utf-8"));
+        const report = JSON.parse(fs4.readFileSync(reportPath, "utf-8"));
         const hasGovernance = report.governance && typeof report.governance.pending === "number";
         return res.json({
           tier: hasGovernance ? "pro" : "free",
@@ -2756,11 +3763,15 @@ var DashboardServer = class {
         return res.json({ available: false, teaser: true });
       }
       try {
-        const reportPath = path3.join(somaVault, "..", "soma-report.json");
-        if (!fs3.existsSync(reportPath)) {
-          return res.json({ available: false, teaser: false, message: "No report file yet. Run soma watch." });
+        const reportPath = path4.join(somaVault, "..", "soma-report.json");
+        if (!fs4.existsSync(reportPath)) {
+          return res.json({
+            available: false,
+            teaser: false,
+            message: "No report file yet. Run soma watch."
+          });
         }
-        const report = JSON.parse(fs3.readFileSync(reportPath, "utf-8"));
+        const report = JSON.parse(fs4.readFileSync(reportPath, "utf-8"));
         res.json(report);
       } catch (error) {
         console.error("Soma report error:", error);
@@ -2773,17 +3784,21 @@ var DashboardServer = class {
         return res.json({ available: false });
       }
       try {
-        const reportPath = path3.join(somaVault, "..", "soma-report.json");
-        if (!fs3.existsSync(reportPath)) {
+        const reportPath = path4.join(somaVault, "..", "soma-report.json");
+        if (!fs4.existsSync(reportPath)) {
           return res.json({ available: false, message: "No report file. Run soma report." });
         }
-        const report = JSON.parse(fs3.readFileSync(reportPath, "utf-8"));
+        const report = JSON.parse(fs4.readFileSync(reportPath, "utf-8"));
         res.json({
           available: true,
           layers: report.layers ?? { archive: 0, working: 0, emerging: 0, canon: 0 },
           governance: report.governance ?? { pending: 0, promoted: 0, rejected: 0 },
-          insights: (report.insights ?? []).filter((i) => i.layer === "emerging" && i.proposal_status === "pending"),
-          canon: (report.insights ?? []).filter((i) => i.layer === "canon"),
+          insights: (report.insights ?? []).filter(
+            (i) => i.layer === "emerging" && i.proposal_status === "pending"
+          ),
+          canon: (report.insights ?? []).filter(
+            (i) => i.layer === "canon"
+          ),
           generatedAt: report.generatedAt
         });
       } catch (error) {
@@ -2791,24 +3806,28 @@ var DashboardServer = class {
         res.status(500).json({ available: false, message: "Failed to read governance data" });
       }
     });
-    const sanitizeArg = (s) => s.replace(/[^a-zA-Z0-9_\-.:]/g, "");
-    const sanitizeReason = (s) => s.replace(/["`$\\]/g, "").slice(0, 500);
+    const isValidId = (s) => /^[a-zA-Z0-9_\-.:]+$/.test(s);
     this.app.post("/api/soma/governance/promote", (req, res) => {
       var _a;
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
       const { entryId } = req.body ?? {};
-      if (!entryId) return res.status(400).json({ error: "entryId required" });
+      if (!entryId || !isValidId(String(entryId)))
+        return res.status(400).json({ error: "Invalid entryId" });
       try {
-        const { execSync: execSync2 } = __require("child_process");
-        const safeId = sanitizeArg(String(entryId));
-        const result = execSync2(`npx soma governance promote ${safeId} --vault "${somaVault}"`, {
-          encoding: "utf-8",
-          timeout: 1e4
-        });
+        const result = execFileSync(
+          "npx",
+          ["soma", "governance", "promote", String(entryId), "--vault", somaVault],
+          {
+            encoding: "utf-8",
+            timeout: 1e4
+          }
+        );
         res.json({ success: true, message: result.trim() });
       } catch (error) {
-        res.status(400).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
+        res.status(400).json({
+          error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message
+        });
       }
     });
     this.app.post("/api/soma/governance/reject", (req, res) => {
@@ -2816,43 +3835,62 @@ var DashboardServer = class {
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
       const { entryId, reason } = req.body ?? {};
-      if (!entryId || !reason) return res.status(400).json({ error: "entryId and reason required" });
+      if (!entryId || !isValidId(String(entryId)))
+        return res.status(400).json({ error: "Invalid entryId" });
+      if (!reason || typeof reason !== "string")
+        return res.status(400).json({ error: "reason required" });
       try {
-        const { execSync: execSync2 } = __require("child_process");
-        const safeId = sanitizeArg(String(entryId));
-        const safeReason = sanitizeReason(String(reason));
-        const result = execSync2(`npx soma governance reject ${safeId} "${safeReason}" --vault "${somaVault}"`, {
-          encoding: "utf-8",
-          timeout: 1e4
-        });
+        const result = execFileSync(
+          "npx",
+          [
+            "soma",
+            "governance",
+            "reject",
+            String(entryId),
+            String(reason).slice(0, 500),
+            "--vault",
+            somaVault
+          ],
+          {
+            encoding: "utf-8",
+            timeout: 1e4
+          }
+        );
         res.json({ success: true, message: result.trim() });
       } catch (error) {
-        res.status(400).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
+        res.status(400).json({
+          error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message
+        });
       }
     });
     this.app.get("/api/soma/governance/evidence/:id", (req, res) => {
       var _a;
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
+      if (!isValidId(String(req.params.id))) return res.status(400).json({ error: "Invalid id" });
       try {
-        const { execSync: execSync2 } = __require("child_process");
-        const safeId = sanitizeArg(String(req.params.id));
-        const result = execSync2(`npx soma governance show ${safeId} --vault "${somaVault}"`, {
-          encoding: "utf-8",
-          timeout: 1e4
-        });
+        const result = execFileSync(
+          "npx",
+          ["soma", "governance", "show", String(req.params.id), "--vault", somaVault],
+          {
+            encoding: "utf-8",
+            timeout: 1e4
+          }
+        );
         res.json({ available: true, output: result.trim() });
       } catch (error) {
-        res.status(404).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
+        res.status(404).json({
+          error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message
+        });
       }
     });
     this.app.get("/api/soma/policies", (_req, res) => {
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.json({ policies: [] });
       try {
-        const reportPath = path3.join(somaVault, "..", "soma-report.json");
-        if (!fs3.existsSync(reportPath)) return res.json({ policies: [] });
-        const report = JSON.parse(fs3.readFileSync(reportPath, "utf-8"));
+        const reportPath = path4.join(somaVault, "..", "soma-report.json");
+        if (!fs4.existsSync(reportPath)) return res.json({ policies: [] });
+        const report = JSON.parse(fs4.readFileSync(reportPath, "utf-8"));
         res.json({ policies: report.policies ?? [] });
       } catch {
         res.json({ policies: [] });
@@ -2863,57 +3901,102 @@ var DashboardServer = class {
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
       const { name, enforcement, scope, conditions } = req.body ?? {};
-      if (!name) return res.status(400).json({ error: "name required" });
+      if (!name || !isValidId(String(name)))
+        return res.status(400).json({ error: "Invalid policy name" });
+      const enf = String(enforcement || "warn");
+      if (!isValidId(enf)) return res.status(400).json({ error: "Invalid enforcement value" });
       try {
-        const safeName = sanitizeArg(String(name));
-        const safeEnf = sanitizeArg(String(enforcement || "warn"));
-        const safeScope = sanitizeReason(String(scope || "all"));
-        const safeCond = sanitizeReason(String(conditions || ""));
-        const result = execSync(
-          `npx soma policy create "${safeName}" --enforcement ${safeEnf} --scope "${safeScope}" --conditions "${safeCond}" --vault "${somaVault}"`,
-          { encoding: "utf-8", timeout: 1e4 }
-        );
+        const args = [
+          "soma",
+          "policy",
+          "create",
+          String(name),
+          "--enforcement",
+          enf,
+          "--vault",
+          somaVault
+        ];
+        if (scope) args.push("--scope", String(scope).slice(0, 500));
+        if (conditions) args.push("--conditions", String(conditions).slice(0, 500));
+        const result = execFileSync("npx", args, { encoding: "utf-8", timeout: 1e4 });
         res.json({ success: true, message: result.trim() });
       } catch (error) {
-        res.status(400).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
+        res.status(400).json({
+          error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message
+        });
       }
     });
     this.app.delete("/api/soma/policies/:name", (req, res) => {
       var _a;
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
+      if (!isValidId(String(req.params.name)))
+        return res.status(400).json({ error: "Invalid policy name" });
       try {
-        const safeName = sanitizeArg(String(req.params.name));
-        const result = execSync(
-          `npx soma policy delete "${safeName}" --vault "${somaVault}"`,
-          { encoding: "utf-8", timeout: 1e4 }
+        const result = execFileSync(
+          "npx",
+          ["soma", "policy", "delete", String(req.params.name), "--vault", somaVault],
+          {
+            encoding: "utf-8",
+            timeout: 1e4
+          }
         );
         res.json({ success: true, message: result.trim() });
       } catch (error) {
-        res.status(400).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
+        res.status(400).json({
+          error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message
+        });
       }
     });
     this.app.get("/api/soma/vault/entities", (req, res) => {
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.json({ entities: [], total: 0 });
       try {
-        const reportPath = path3.join(somaVault, "..", "soma-report.json");
-        if (!fs3.existsSync(reportPath)) return res.json({ entities: [], total: 0 });
-        const report = JSON.parse(fs3.readFileSync(reportPath, "utf-8"));
-        let entities = [
-          ...(report.agents ?? []).map((a) => ({ ...a, type: "agent", id: a.name })),
-          ...(report.insights ?? []).map((i, idx) => {
-            var _a;
-            return { ...i, type: i.type || "insight", id: ((_a = i.title) == null ? void 0 : _a.replace(/\s+/g, "-").toLowerCase()) || `insight-${idx}` };
-          }),
-          ...(report.policies ?? []).map((p) => ({ ...p, type: "policy", id: p.name }))
+        const entityTypes = [
+          "agent",
+          "decision",
+          "insight",
+          "constraint",
+          "contradiction",
+          "policy",
+          "archetype"
         ];
-        const { type, layer, q, limit: limitStr, offset: offsetStr } = req.query;
+        let entities = [];
+        for (const entityType of entityTypes) {
+          const dir = path4.join(somaVault, entityType);
+          if (!fs4.existsSync(dir)) continue;
+          for (const file of fs4.readdirSync(dir)) {
+            if (!file.endsWith(".md")) continue;
+            try {
+              const content = fs4.readFileSync(path4.join(dir, file), "utf-8");
+              const parsed = parseVaultFrontmatter(content);
+              if (!parsed) continue;
+              const body = content.slice(content.indexOf("---", 4) + 3).trim().slice(0, 500);
+              entities.push({
+                ...parsed,
+                type: parsed.type || entityType,
+                id: parsed.id || file.replace(".md", ""),
+                name: parsed.name || file.replace(".md", ""),
+                body
+              });
+            } catch {
+            }
+          }
+        }
+        const {
+          type,
+          layer,
+          q,
+          limit: limitStr,
+          offset: offsetStr
+        } = req.query;
         if (type) entities = entities.filter((e) => e.type === type);
         if (layer) entities = entities.filter((e) => e.layer === layer);
         if (q) {
           const lq = q.toLowerCase();
-          entities = entities.filter((e) => (e.name || e.title || "").toLowerCase().includes(lq) || (e.claim || e.body || "").toLowerCase().includes(lq));
+          entities = entities.filter(
+            (e) => (e.name || e.title || "").toLowerCase().includes(lq) || (e.claim || e.body || "").toLowerCase().includes(lq)
+          );
         }
         const total = entities.length;
         const offset = parseInt(offsetStr || "0", 10);
@@ -2929,35 +4012,414 @@ var DashboardServer = class {
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(404).json({ error: "Soma vault not configured" });
       try {
-        const reportPath = path3.join(somaVault, "..", "soma-report.json");
-        const report = JSON.parse(fs3.readFileSync(reportPath, "utf-8"));
-        const { type, id } = req.params;
-        let entity = null;
+        const type = safePath(req.params.type);
+        const id = safePath(req.params.id);
+        const filePath = path4.join(somaVault, type, `${id}.md`);
+        if (!path4.resolve(filePath).startsWith(path4.resolve(somaVault))) {
+          return res.status(400).json({ error: "Invalid path" });
+        }
+        if (!fs4.existsSync(filePath)) return res.status(404).json({ error: "Entity not found" });
+        const content = fs4.readFileSync(filePath, "utf-8");
+        const fm = parseVaultFrontmatter(content);
+        if (!fm) return res.status(404).json({ error: "Entity not found" });
+        const body = content.slice(content.indexOf("---", 4) + 3).trim();
+        const agentKnowledge = [];
         if (type === "agent") {
-          entity = (report.agents ?? []).find((a) => a.name === id);
-        } else if (type === "policy") {
-          entity = (report.policies ?? []).find((p) => p.name === id);
-        } else {
-          entity = (report.insights ?? []).find(
-            (i) => {
-              var _a;
-              return (((_a = i.title) == null ? void 0 : _a.replace(/\s+/g, "-").toLowerCase()) || "") === id || i.title === id;
+          const agentName = fm.name || fm.agentId || id;
+          const knowledgeTypes = ["decision", "insight", "constraint", "contradiction", "policy"];
+          for (const kt of knowledgeTypes) {
+            const ktDir = path4.join(somaVault, kt);
+            if (!fs4.existsSync(ktDir)) continue;
+            for (const f of fs4.readdirSync(ktDir)) {
+              if (!f.endsWith(".md")) continue;
+              try {
+                const c = fs4.readFileSync(path4.join(ktDir, f), "utf-8");
+                if (!c.includes(String(agentName))) continue;
+                const parsed = parseVaultFrontmatter(c);
+                if (!parsed) continue;
+                agentKnowledge.push({
+                  type: parsed.type || kt,
+                  id: parsed.id || f.replace(".md", ""),
+                  name: parsed.name || f.replace(".md", ""),
+                  claim: parsed.claim || "",
+                  confidence: parsed.confidence || "",
+                  layer: parsed.layer || ""
+                });
+              } catch {
+              }
             }
-          );
+          }
         }
-        if (!entity) return res.status(404).json({ error: "Entity not found" });
         res.json({
-          ...entity,
+          ...fm,
           type,
           id,
-          body: entity.claim || entity.conditions || "",
-          tags: entity.tags ?? [],
-          related: entity.related ?? []
+          name: fm.name || id,
+          body: type === "agent" && !body ? `Agent with ${fm.totalExecutions ?? 0} executions, ${((1 - Number(fm.failureRate || 0)) * 100).toFixed(1)}% success rate.` : body,
+          knowledge: agentKnowledge
         });
       } catch {
         res.status(404).json({ error: "Entity not found" });
       }
     });
+    this.app.get("/api/aicp/preflight", async (req, res) => {
+      const agentId = req.query.agentId;
+      if (!agentId) {
+        return res.status(400).json({ error: "agentId query parameter required" });
+      }
+      const somaVault = this.config.somaVault;
+      if (!somaVault) {
+        return res.json({
+          proceed: true,
+          warnings: [],
+          recommendations: [],
+          available: false,
+          _meta: { durationMs: 0 }
+        });
+      }
+      try {
+        const { evaluatePreflight } = await import(
+          /* webpackIgnore: true */
+          "./dist-H4QMTTY3.js"
+        );
+        const { createVault } = await import(
+          /* webpackIgnore: true */
+          "./dist-H4QMTTY3.js"
+        );
+        const vault = createVault({ baseDir: somaVault });
+        const result = evaluatePreflight(vault, safePath(agentId));
+        res.json(result);
+      } catch {
+        res.json({
+          proceed: true,
+          warnings: [],
+          recommendations: [],
+          available: false,
+          _meta: { durationMs: 0 }
+        });
+      }
+    });
+    this.app.get("/api/soma/efficiency", async (_req, res) => {
+      try {
+        const allTraces = this.watcher.getAllTraces().map(serializeTrace);
+        const graphs = [];
+        for (const t of allTraces) {
+          try {
+            if (t.sourceType === "session" || t.sourceType === "log") continue;
+            if (!t.rootNodeId && !t.rootId) continue;
+            const nodes = t.nodes;
+            if (!nodes || typeof nodes === "object" && Object.keys(nodes).length === 0) continue;
+            graphs.push(loadGraph2(t));
+          } catch {
+          }
+        }
+        try {
+          const { getEfficiency } = await import(
+            /* webpackIgnore: true */
+            "./ops-intel-PL6GGIKL.js"
+          );
+          const report2 = getEfficiency(graphs);
+          return res.json(report2);
+        } catch {
+        }
+        const somaVault = this.config.somaVault;
+        if (!somaVault) return res.status(404).json({ error: "Soma vault not configured" });
+        const reportPath = path4.join(somaVault, "..", "soma-report.json");
+        if (!fs4.existsSync(reportPath)) {
+          return res.status(404).json({ error: "No SOMA report found" });
+        }
+        const report = JSON.parse(fs4.readFileSync(reportPath, "utf-8"));
+        const agents = report.agents ?? [];
+        const runs = agents.map((a) => ({
+          graphId: a.name,
+          agentId: a.name,
+          totalTokenCost: a.totalTokenCost ?? 0,
+          completedNodes: a.totalRuns ?? 0,
+          costPerNode: (a.totalTokenCost ?? 0) / Math.max(1, a.totalRuns ?? 1)
+        }));
+        const costs = runs.map((r) => r.costPerNode).filter((c) => c > 0).sort((a, b) => a - b);
+        const mean = costs.length > 0 ? costs.reduce((a, b) => a + b, 0) / costs.length : 0;
+        const median = costs.length > 0 ? costs[Math.floor(costs.length / 2)] : 0;
+        const p95 = costs.length > 0 ? costs[Math.min(costs.length - 1, Math.ceil(costs.length * 0.95) - 1)] : 0;
+        res.json({
+          runs,
+          aggregate: { mean, median, p95 },
+          flags: [],
+          nodeCosts: [],
+          dataCoverage: agents.length > 0 ? 1 : 0
+        });
+      } catch {
+        res.status(500).json({ error: "Failed to compute efficiency" });
+      }
+    });
+    this.app.get("/api/soma/drift", async (req, res) => {
+      const agentId = req.query.agentId;
+      if (!agentId) return res.status(400).json({ error: "agentId query parameter required" });
+      try {
+        const somaVault = this.config.somaVault;
+        if (!somaVault) return res.status(404).json({ error: "Soma vault not configured" });
+        const historyPath = path4.join(somaVault, "..", "conformance-history.json");
+        let history = [];
+        if (fs4.existsSync(historyPath)) {
+          history = JSON.parse(fs4.readFileSync(historyPath, "utf-8"));
+        }
+        const agentHistory = history.filter((e) => e.agentId === agentId);
+        try {
+          const { detectDrift } = await import(
+            /* webpackIgnore: true */
+            "./ops-intel-PL6GGIKL.js"
+          );
+          const driftReport = detectDrift(agentHistory);
+          return res.json({ drift: driftReport, points: agentHistory });
+        } catch {
+        }
+        const n = agentHistory.length;
+        if (n < 10) {
+          return res.json({
+            drift: { status: "insufficient_data", slope: 0, r2: 0, windowSize: n, dataPoints: n },
+            points: agentHistory
+          });
+        }
+        let sumX = 0, sumY = 0, sumXY = 0, sumX2 = 0;
+        for (let i = 0; i < n; i++) {
+          const y = agentHistory[i].score;
+          sumX += i;
+          sumY += y;
+          sumXY += i * y;
+          sumX2 += i * i;
+        }
+        const denom = n * sumX2 - sumX * sumX;
+        const slope = denom !== 0 ? (n * sumXY - sumX * sumY) / denom : 0;
+        const intercept = (sumY - slope * sumX) / n;
+        const meanY = sumY / n;
+        let ssRes = 0, ssTot = 0;
+        for (let i = 0; i < n; i++) {
+          const y = agentHistory[i].score;
+          ssRes += (y - (intercept + slope * i)) ** 2;
+          ssTot += (y - meanY) ** 2;
+        }
+        const r2 = ssTot > 0 ? 1 - ssRes / ssTot : 0;
+        const status = r2 > 0.3 ? slope < 0 ? "degrading" : "improving" : "stable";
+        res.json({
+          drift: { status, slope, r2, windowSize: n, dataPoints: n },
+          points: agentHistory
+        });
+      } catch {
+        res.status(404).json({ error: "Drift detection not available" });
+      }
+    });
+    this.app.get("/api/soma/cross-agent", (_req, res) => {
+      const somaVault = this.config.somaVault;
+      if (!somaVault) return res.json({ insights: [], pairs: [] });
+      try {
+        const insightDir = path4.join(somaVault, "insight");
+        if (!fs4.existsSync(insightDir)) return res.json({ insights: [], pairs: [] });
+        const crossAgent = [];
+        for (const file of fs4.readdirSync(insightDir)) {
+          if (!file.endsWith(".md")) continue;
+          try {
+            const content = fs4.readFileSync(path4.join(insightDir, file), "utf-8");
+            const parsed = parseVaultFrontmatter(content);
+            if (!parsed) continue;
+            const sa = parsed.source_agents;
+            if (!sa || !Array.isArray(sa) || sa.length < 2) continue;
+            crossAgent.push({
+              name: String(parsed.name ?? file.replace(".md", "")),
+              claim: String(parsed.claim ?? "").slice(0, 200),
+              sourceAgents: sa,
+              tags: parsed.tags ?? []
+            });
+          } catch {
+          }
+        }
+        const pairMap = /* @__PURE__ */ new Map();
+        for (const insight of crossAgent) {
+          const key = [...insight.sourceAgents].sort().join(" \u2194 ");
+          if (!pairMap.has(key)) pairMap.set(key, []);
+          pairMap.get(key).push(insight);
+        }
+        const pairs = [...pairMap.entries()].map(([agents, insights]) => ({
+          agents,
+          count: insights.length,
+          insights: insights.slice(0, 5)
+        }));
+        res.json({ total: crossAgent.length, pairs });
+      } catch {
+        res.json({ insights: [], pairs: [] });
+      }
+    });
+    this.app.get("/api/external/commands", (_req, res) => {
+      try {
+        const { commands, errors } = getValidatedExternalCommands(this.userConfig);
+        const commandList = Object.entries(commands).map(([id, command]) => ({
+          id,
+          name: command.name,
+          description: command.description,
+          category: command.category,
+          allowConcurrent: command.allowConcurrent,
+          timeout: command.timeout
+        }));
+        res.json({
+          commands: commandList,
+          configErrors: errors,
+          total: commandList.length
+        });
+      } catch (error) {
+        res.status(500).json({
+          error: "Failed to load external commands",
+          message: error.message
+        });
+      }
+    });
+    this.app.post("/api/external/commands/:commandId/execute", express.json(), async (req, res) => {
+      try {
+        const { commandId } = req.params;
+        const { additionalArgs, timeout, context } = req.body;
+        if (!isValidId(commandId)) {
+          return res.status(400).json({ error: "Invalid command ID" });
+        }
+        const executionResult = await this.commandExecutor.executeCommand({
+          commandId,
+          additionalArgs: Array.isArray(additionalArgs) ? additionalArgs : void 0,
+          timeout: typeof timeout === "number" ? timeout : void 0,
+          context: context && typeof context === "object" ? context : void 0
+        });
+        res.json({
+          executionId: executionResult.executionId,
+          started: executionResult.started,
+          status: executionResult.status,
+          commandName: executionResult.command.name,
+          pid: executionResult.pid,
+          startedAt: executionResult.startedAt,
+          error: executionResult.error
+        });
+      } catch (error) {
+        res.status(500).json({
+          error: "Command execution failed",
+          message: error.message
+        });
+      }
+    });
+    this.app.get("/api/external/executions/:executionId", (req, res) => {
+      try {
+        const { executionId } = req.params;
+        if (!isValidId(executionId)) {
+          return res.status(400).json({ error: "Invalid execution ID" });
+        }
+        const execution = this.commandExecutor.getExecution(executionId);
+        if (!execution) {
+          return res.status(404).json({ error: "Execution not found" });
+        }
+        res.json({
+          executionId: execution.executionId,
+          started: execution.started,
+          status: execution.status,
+          commandName: execution.command.name,
+          pid: execution.pid,
+          startedAt: execution.startedAt,
+          completedAt: execution.completedAt,
+          duration: execution.duration,
+          exitCode: execution.exitCode,
+          hasOutput: execution.stdout.length > 0,
+          hasError: execution.stderr.length > 0,
+          // Limit output size for API response
+          stdout: execution.stdout.slice(-2e3),
+          // Last 2KB
+          stderr: execution.stderr.slice(-1e3),
+          // Last 1KB
+          error: execution.error
+        });
+      } catch (error) {
+        res.status(500).json({
+          error: "Failed to get execution status",
+          message: error.message
+        });
+      }
+    });
+    this.app.post("/api/external/executions/:executionId/kill", (req, res) => {
+      try {
+        const { executionId } = req.params;
+        if (!isValidId(executionId)) {
+          return res.status(400).json({ error: "Invalid execution ID" });
+        }
+        const killed = this.commandExecutor.killExecution(executionId, "manual");
+        if (!killed) {
+          return res.status(404).json({ error: "Execution not found or not running" });
+        }
+        res.json({ success: true, message: "Execution killed" });
+      } catch (error) {
+        res.status(500).json({
+          error: "Failed to kill execution",
+          message: error.message
+        });
+      }
+    });
+    this.app.get("/api/external/executions", (req, res) => {
+      try {
+        const limit = Math.min(parseInt(String(req.query.limit)) || 50, 100);
+        const status = req.query.status;
+        let executions = this.commandExecutor.getAllExecutions(limit);
+        if (status && ["running", "completed", "failed", "timeout", "killed"].includes(status)) {
+          executions = executions.filter((exec) => exec.status === status);
+        }
+        const executionSummaries = executions.map((exec) => ({
+          executionId: exec.executionId,
+          commandName: exec.command.name,
+          status: exec.status,
+          startedAt: exec.startedAt,
+          completedAt: exec.completedAt,
+          duration: exec.duration,
+          exitCode: exec.exitCode,
+          hasOutput: exec.stdout.length > 0,
+          hasError: exec.stderr.length > 0,
+          error: exec.error
+        }));
+        res.json({
+          executions: executionSummaries,
+          total: executionSummaries.length,
+          running: this.commandExecutor.getRunningExecutions().length
+        });
+      } catch (error) {
+        res.status(500).json({
+          error: "Failed to get executions",
+          message: error.message
+        });
+      }
+    });
+    this.app.get("/api/external/executions/:executionId/audit", (req, res) => {
+      try {
+        const { executionId } = req.params;
+        if (!isValidId(executionId)) {
+          return res.status(400).json({ error: "Invalid execution ID" });
+        }
+        const auditTrail = this.commandExecutor.getAuditTrail(executionId);
+        res.json({
+          executionId,
+          auditEntries: auditTrail,
+          total: auditTrail.length
+        });
+      } catch (error) {
+        res.status(500).json({
+          error: "Failed to get audit trail",
+          message: error.message
+        });
+      }
+    });
+    this.app.get("/api/external/audit/stats", (req, res) => {
+      try {
+        const days = Math.min(parseInt(String(req.query.days)) || 7, 30);
+        const stats = this.commandExecutor.getAuditStats(days);
+        res.json({
+          period: `${days} days`,
+          ...stats
+        });
+      } catch (error) {
+        res.status(500).json({
+          error: "Failed to get audit statistics",
+          message: error.message
+        });
+      }
+    });
     this.app.get("/api/process-health", (_req, res) => {
       var _a, _b;
       try {
@@ -2967,7 +4429,7 @@ var DashboardServer = class {
         }
         const discoveryDirs = [
           this.config.tracesDir,
-          path3.dirname(this.config.tracesDir),
+          path4.dirname(this.config.tracesDir),
           ...this.config.dataDirs || []
         ];
         let configs = discoverAllProcessConfigs(discoveryDirs);
@@ -3004,9 +4466,7 @@ var DashboardServer = class {
         const orphans = uniqueProcesses.filter(
           (p) => !allKnownPids.has(p.pid) && p.pid !== process.pid && p.pid !== process.ppid
         );
-        const problems = services.flatMap(
-          (s) => s.audit.problems.map((p) => `[${s.name}] ${p}`)
-        );
+        const problems = services.flatMap((s) => s.audit.problems.map((p) => `[${s.name}] ${p}`));
         const result = {
           // Backward-compatible fields from primary service
           pidFile: (primary == null ? void 0 : primary.audit.pidFile) ?? null,
@@ -3032,7 +4492,7 @@ var DashboardServer = class {
           // Topology edges: parent-child relationships from process ppid
           topology: uniqueProcesses.map((p) => {
             try {
-              const statusContent = fs3.readFileSync(`/proc/${p.pid}/status`, "utf8");
+              const statusContent = fs4.readFileSync(`/proc/${p.pid}/status`, "utf8");
               const ppidMatch = statusContent.match(/^PPid:\s+(\d+)/m);
               const ppid = ppidMatch ? parseInt(ppidMatch[1] ?? "0", 10) : 0;
               if (ppid > 1 && allKnownPids.has(ppid)) {
@@ -3052,34 +4512,39 @@ var DashboardServer = class {
     this.app.get("/api/directories", (_req, res) => {
       try {
         const home = process.env.HOME ?? "/home/trader";
-        const configPath = path3.join(home, ".agentflow/dashboard-config.json");
+        const configPath = path4.join(home, ".agentflow/dashboard-config.json");
         let extraDirs = [];
         try {
-          if (fs3.existsSync(configPath)) {
-            const cfg = JSON.parse(fs3.readFileSync(configPath, "utf-8"));
+          if (fs4.existsSync(configPath)) {
+            const cfg = JSON.parse(fs4.readFileSync(configPath, "utf-8"));
             extraDirs = cfg.extraDirs ?? [];
           }
         } catch {
         }
-        const watched = [...new Set([
-          this.config.tracesDir,
-          ...this.config.dataDirs || [],
-          ...extraDirs
-        ].map((w) => path3.resolve(w)))];
+        const watched = [
+          ...new Set(
+            [this.config.tracesDir, ...this.config.dataDirs || [], ...extraDirs].map(
+              (w) => path4.resolve(w)
+            )
+          )
+        ];
         const discovered = [];
         const svcNames = getSystemdServices(this.userConfig);
         if (svcNames.length > 0) {
           try {
-            const { execSync: execSync2 } = __require("child_process");
-            const raw = execSync2(
-              `systemctl --user show --property=ExecStart --no-pager ${svcNames.join(" ")} 2>/dev/null`,
-              { encoding: "utf8", timeout: 5e3 }
+            const raw = execFileSync(
+              "systemctl",
+              ["--user", "show", "--property=ExecStart", "--no-pager", ...svcNames],
+              {
+                encoding: "utf8",
+                timeout: 5e3
+              }
             );
             for (const line of raw.split("\n")) {
               const match = line.match(/path=([^\s;]+)/);
               if (match == null ? void 0 : match[1]) {
-                const dir = path3.dirname(match[1]);
-                if (fs3.existsSync(dir)) discovered.push(dir);
+                const dir = path4.dirname(match[1]);
+                if (fs4.existsSync(dir)) discovered.push(dir);
               }
             }
           } catch {
@@ -3087,15 +4552,15 @@ var DashboardServer = class {
         }
         const commonPaths = [
           ...getDiscoveryPaths(this.userConfig),
-          path3.join(home, ".agentflow/traces")
+          path4.join(home, ".agentflow/traces")
         ];
         for (const p of commonPaths) {
-          if (fs3.existsSync(p) && !discovered.includes(p)) {
+          if (fs4.existsSync(p) && !discovered.includes(p)) {
             discovered.push(p);
           }
         }
-        const watchedSet = new Set(watched.map((w) => path3.resolve(w)));
-        const suggested = discovered.filter((d) => !watchedSet.has(path3.resolve(d)));
+        const watchedSet = new Set(watched.map((w) => path4.resolve(w)));
+        const suggested = discovered.filter((d) => !watchedSet.has(path4.resolve(d)));
         res.json({ watched, discovered, suggested });
       } catch (error) {
         console.error("Directory discovery error:", error);
@@ -3105,14 +4570,23 @@ var DashboardServer = class {
     this.app.post("/api/directories", express.json(), (req, res) => {
       try {
         const { add, remove } = req.body;
-        if (add && !fs3.existsSync(add)) {
-          return res.status(400).json({ error: `Directory does not exist: ${add}` });
+        if (add) {
+          const resolved = path4.resolve(add);
+          if (resolved !== add || add.includes("..")) {
+            return res.status(400).json({ error: "Invalid directory path" });
+          }
+          if (!fs4.existsSync(resolved)) {
+            return res.status(400).json({ error: `Directory does not exist: ${add}` });
+          }
         }
-        const configPath = path3.join(process.env.HOME ?? "/home/trader", ".agentflow/dashboard-config.json");
+        const configPath = path4.join(
+          process.env.HOME ?? "/home/trader",
+          ".agentflow/dashboard-config.json"
+        );
         let config = {};
         try {
-          if (fs3.existsSync(configPath)) {
-            config = JSON.parse(fs3.readFileSync(configPath, "utf-8"));
+          if (fs4.existsSync(configPath)) {
+            config = JSON.parse(fs4.readFileSync(configPath, "utf-8"));
           }
         } catch {
         }
@@ -3123,8 +4597,8 @@ var DashboardServer = class {
         if (remove) {
           config.extraDirs = config.extraDirs.filter((d) => d !== remove);
         }
-        fs3.mkdirSync(path3.dirname(configPath), { recursive: true });
-        fs3.writeFileSync(configPath, JSON.stringify(config, null, 2));
+        fs4.mkdirSync(path4.dirname(configPath), { recursive: true });
+        fs4.writeFileSync(configPath, JSON.stringify(config, null, 2));
         res.json({ ok: true, extraDirs: config.extraDirs });
       } catch (error) {
         console.error("Directory config error:", error);
@@ -3166,7 +4640,10 @@ var DashboardServer = class {
               lastModified: Date.now(),
               sourceDir: "http-collector"
             };
-            this.watcher.traces.set(`otel:${trace.id}`, watched);
+            this.watcher.traces.set(
+              `otel:${trace.id}`,
+              watched
+            );
             ingested++;
           }
           if (ingested > 0) {
@@ -3190,14 +4667,18 @@ var DashboardServer = class {
     this.app.get("/ready", (_req, res) => {
       res.json({ status: "ready" });
     });
-    this.app.get("*", (_req, res) => {
-      const clientIndex2 = path3.join(__dirname, "../dist/client/index.html");
-      if (fs3.existsSync(clientIndex2)) {
-        res.sendFile(clientIndex2);
-      } else {
-        res.status(404).send("Dashboard not found - public files may not be built");
+    this.app.get(
+      "*",
+      rateLimit({ windowMs: 60 * 1e3, max: 600, standardHeaders: true, legacyHeaders: false }),
+      (_req, res) => {
+        const clientIndex2 = path4.join(__dirname, "../dist/client/index.html");
+        if (fs4.existsSync(clientIndex2)) {
+          res.sendFile(clientIndex2);
+        } else {
+          res.status(404).send("Dashboard not found - public files may not be built");
+        }
       }
-    });
+    );
   }
   setupWebSocket() {
     this.wss.on("connection", (ws) => {
@@ -3223,9 +4704,9 @@ var DashboardServer = class {
   setupSomaReportWatcher() {
     const somaVault = this.config.somaVault;
     if (!somaVault) return;
-    const reportPath = path3.join(somaVault, "..", "soma-report.json");
-    const reportDir = path3.dirname(reportPath);
-    if (!fs3.existsSync(reportDir)) return;
+    const reportPath = path4.join(somaVault, "..", "soma-report.json");
+    const reportDir = path4.dirname(reportPath);
+    if (!fs4.existsSync(reportDir)) return;
     let debounceTimer = null;
     const watcher = chokidar2.watch(reportPath, {
       ignoreInitial: true,
@@ -3237,7 +4718,7 @@ var DashboardServer = class {
       debounceTimer = setTimeout(() => {
         var _a, _b;
         try {
-          const report = JSON.parse(fs3.readFileSync(reportPath, "utf-8"));
+          const report = JSON.parse(fs4.readFileSync(reportPath, "utf-8"));
           this.broadcast({ type: "soma-report-updated", data: report });
           if (report.generatedAt) {
             this.broadcast({
@@ -3268,7 +4749,10 @@ var DashboardServer = class {
         const nodes = trace.nodes;
         if (!nodes || typeof nodes === "object" && Object.keys(nodes).length === 0) continue;
         const nodeValues = Object.values(nodes);
-        if (nodeValues.some((n) => n.type === "log-file" || n.type === "log-entry")) continue;
+        if (nodeValues.some(
+          (n) => n.type === "log-file" || n.type === "log-entry"
+        ))
+          continue;
         graphs.push(loadGraph2(trace));
       } catch {
       }
@@ -3318,13 +4802,31 @@ var DashboardServer = class {
         isVirtual: false
       });
     }
-    const rootSteps = new Set(model.steps);
-    const childSteps = new Set(model.transitions.map((t) => t.to));
-    const leafSteps = new Set(model.steps);
-    for (const t of model.transitions) {
+    const _rootSteps = new Set(model.steps);
+    const _childSteps = new Set(model.transitions.map((t) => t.to));
+    const _leafSteps = new Set(model.steps);
+    for (const _t of model.transitions) {
     }
-    nodes.push({ id: "[START]", label: "[START]", count: model.totalGraphs, frequency: 1, avgDuration: 0, failRate: 0, p95Duration: 0, isVirtual: true });
-    nodes.push({ id: "[END]", label: "[END]", count: model.totalGraphs, frequency: 1, avgDuration: 0, failRate: 0, p95Duration: 0, isVirtual: true });
+    nodes.push({
+      id: "[START]",
+      label: "[START]",
+      count: model.totalGraphs,
+      frequency: 1,
+      avgDuration: 0,
+      failRate: 0,
+      p95Duration: 0,
+      isVirtual: true
+    });
+    nodes.push({
+      id: "[END]",
+      label: "[END]",
+      count: model.totalGraphs,
+      frequency: 1,
+      avgDuration: 0,
+      failRate: 0,
+      p95Duration: 0,
+      isVirtual: true
+    });
     const edges = model.transitions.map((t) => ({
       source: t.from,
       target: t.to,
@@ -3388,7 +4890,7 @@ var DashboardServer = class {
       }
       const seq = ["[START]", ...activities.map((a) => a.name), "[END]"];
       for (let i = 0; i < seq.length; i++) {
-        const act = seq[i];
+        const act = seq[i] ?? "";
         activityCounts.set(act, (activityCounts.get(act) || 0) + 1);
         if (i < seq.length - 1) {
           const key = `${act} \u2192 ${seq[i + 1]}`;
@@ -3487,15 +4989,15 @@ var DashboardServer = class {
   /** Check if any src/client file is newer than the built bundle. */
   isClientStale(srcDir, distDir) {
     try {
-      const distIndex = path3.join(distDir, "index.html");
-      if (!fs3.existsSync(distIndex)) return true;
-      const distMtime = fs3.statSync(distIndex).mtimeMs;
+      const distIndex = path4.join(distDir, "index.html");
+      if (!fs4.existsSync(distIndex)) return true;
+      const distMtime = fs4.statSync(distIndex).mtimeMs;
       const check = (dir) => {
-        for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
-          const full = path3.join(dir, entry.name);
+        for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
+          const full = path4.join(dir, entry.name);
           if (entry.isDirectory()) {
             if (check(full)) return true;
-          } else if (fs3.statSync(full).mtimeMs > distMtime) {
+          } else if (fs4.statSync(full).mtimeMs > distMtime) {
             return true;
           }
         }
@@ -3521,6 +5023,9 @@ var DashboardServer = class {
   getStats() {
     return this.stats.getGlobalStats();
   }
+  getTrace(filename) {
+    return this.watcher.getTrace(filename);
+  }
   getTraces() {
     return this.watcher.getAllTraces();
   }