autopilot-ai 1.19.2 → 1.20.0

package/dist/index.js

@@ -635,6 +635,15 @@ function readNumberEnv(name) {
   const parsed = parseInt(raw, 10);
   return Number.isNaN(parsed) ? void 0 : parsed;
 }
+function resolveTraceConfig(persisted) {
+  const envEnabled = readBooleanEnv("KIMIFLARE_TRACE");
+  const envRoot = process.env.KIMIFLARE_TRACE_DIR?.trim() || void 0;
+  if (envEnabled === void 0 && envRoot === void 0 && persisted === void 0) return void 0;
+  const trace = { enabled: envEnabled ?? persisted?.enabled ?? false };
+  const root = envRoot ?? persisted?.root;
+  if (root) trace.root = root;
+  return trace;
+}
 async function loadConfig() {
   let persisted = {};
   let hasFile = false;
@@ -726,7 +735,8 @@ async function loadConfig() {
     workerPreReadMaxChars: readNumberEnv("KIMIFLARE_WORKER_PRE_READ_MAX_CHARS") ?? persisted.workerPreReadMaxChars,
     permissions: persisted.permissions,
     preferPullRequests: readBooleanEnv("KIMIFLARE_PREFER_PULL_REQUESTS") ?? persisted.preferPullRequests ?? true,
-    allowDirectPush: readBooleanEnv("KIMIFLARE_ALLOW_DIRECT_PUSH") ?? persisted.allowDirectPush ?? false
+    allowDirectPush: readBooleanEnv("KIMIFLARE_ALLOW_DIRECT_PUSH") ?? persisted.allowDirectPush ?? false,
+    trace: resolveTraceConfig(persisted.trace)
   };
   if (hasFile && hasLegacyFields(persisted)) {
     await rewriteLegacyConfig(persisted, openrouterApiKey).catch(() => void 0);
@@ -1474,6 +1484,68 @@ var init_messages = __esm({
   }
 });
 
+// src/trace/blobs.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync } from "fs";
+import { join as join8 } from "path";
+function sha256Hex(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+function truncateUtf8(content, maxBytes) {
+  const buf = Buffer.from(content, "utf8");
+  if (buf.length <= maxBytes) return content;
+  let end = maxBytes;
+  while (end > 0 && (buf[end] & 192) === 128) end--;
+  return buf.subarray(0, end).toString("utf8");
+}
+var DEFAULT_MAX_BLOB_BYTES, BlobStore;
+var init_blobs = __esm({
+  "src/trace/blobs.ts"() {
+    "use strict";
+    DEFAULT_MAX_BLOB_BYTES = 2 * 1024 * 1024;
+    BlobStore = class {
+      constructor(dir, opts2 = {}) {
+        this.dir = dir;
+        this.maxBlobBytes = opts2.maxBlobBytes ?? DEFAULT_MAX_BLOB_BYTES;
+      }
+      dir;
+      seen = /* @__PURE__ */ new Set();
+      dirReady = false;
+      maxBlobBytes;
+      put(content) {
+        const bytes = Buffer.byteLength(content, "utf8");
+        let stored = content;
+        let truncated = false;
+        if (bytes > this.maxBlobBytes) {
+          stored = `${truncateUtf8(content, this.maxBlobBytes)}
+[truncated: ${bytes} bytes total]`;
+          truncated = true;
+        }
+        const sha2563 = sha256Hex(stored);
+        if (this.seen.has(sha2563)) return { sha256: sha2563, bytes, truncated, written: 0 };
+        if (!this.dirReady) {
+          mkdirSync2(this.dir, { recursive: true });
+          this.dirReady = true;
+        }
+        const path = join8(this.dir, sha2563);
+        let written = 0;
+        if (!existsSync2(path)) {
+          writeFileSync(path, stored, "utf8");
+          written = Buffer.byteLength(stored, "utf8");
+        }
+        this.seen.add(sha2563);
+        return { sha256: sha2563, bytes, truncated, written };
+      }
+      has(sha2563) {
+        return this.seen.has(sha2563) || existsSync2(join8(this.dir, sha2563));
+      }
+      pathFor(sha2563) {
+        return join8(this.dir, sha2563);
+      }
+    };
+  }
+});
+
 // src/agent/session-state.ts
 function emptySessionState(task = "") {
   return {
@@ -1927,8 +1999,8 @@ var init_artifact_compaction = __esm({
 
 // src/util/llm-dump.ts
 import { homedir as homedir5 } from "os";
-import { join as join8 } from "path";
-import { mkdirSync as mkdirSync2, appendFileSync, writeFileSync } from "fs";
+import { join as join9 } from "path";
+import { mkdirSync as mkdirSync3, appendFileSync, writeFileSync as writeFileSync2 } from "fs";
 function isLlmDumpEnabled() {
   const raw = process.env.KIMIFLARE_DUMP_LLM;
   if (raw === void 0) return false;
@@ -1938,11 +2010,11 @@ function isLlmDumpEnabled() {
 function defaultDumpRoot() {
   const override = process.env.KIMIFLARE_DUMP_LLM_DIR;
   if (override && override.trim()) return override;
-  const xdg = process.env.XDG_CONFIG_HOME || join8(homedir5(), ".config");
-  return join8(xdg, "kimiflare", "llm-dumps");
+  const xdg = process.env.XDG_CONFIG_HOME || join9(homedir5(), ".config");
+  return join9(xdg, "kimiflare", "llm-dumps");
 }
 function dumpDir(sessionId) {
-  return join8(defaultDumpRoot(), sessionId && sessionId.trim() ? sessionId : "nosession");
+  return join9(defaultDumpRoot(), sessionId && sessionId.trim() ? sessionId : "nosession");
 }
 function messageChars(m) {
   let chars = 0;
@@ -1999,12 +2071,12 @@ function writeLlmDump(record) {
   if (!isLlmDumpEnabled()) return;
   try {
     const dir = dumpDir(record.meta.sessionId);
-    mkdirSync2(dir, { recursive: true });
+    mkdirSync3(dir, { recursive: true });
     const tsPart = safeSegment(record.meta.ts);
     const turnPart = safeSegment(record.meta.turnId ?? "noturn");
     const reqPart = safeSegment(record.meta.requestId);
-    const file = join8(dir, `${tsPart}-${turnPart}-${reqPart}.json`);
-    writeFileSync(file, JSON.stringify(record, null, 2));
+    const file = join9(dir, `${tsPart}-${turnPart}-${reqPart}.json`);
+    writeFileSync2(file, JSON.stringify(record, null, 2));
     const summary = {
       ...record.meta,
       ...record.breakdown,
@@ -2014,7 +2086,7 @@ function writeLlmDump(record) {
       usage: record.response.usage,
       file
     };
-    appendFileSync(join8(dir, "index.jsonl"), JSON.stringify(summary) + "\n");
+    appendFileSync(join9(dir, "index.jsonl"), JSON.stringify(summary) + "\n");
   } catch {
   }
 }
@@ -2257,41 +2329,89 @@ async function* runKimi(opts2) {
     if (Object.keys(provider).length > 0) body.provider = provider;
     if (vendorOf(opts2.model) === "anthropic") body.cache_control = { type: "ephemeral" };
   }
+  const dumpEnabled = isLlmDumpEnabled();
+  const trace = opts2.trace?.enabled ? opts2.trace : null;
+  const captured = dumpEnabled || trace ? captureRequest(body) : null;
+  const response = {
+    text: "",
+    reasoning: "",
+    reasoningDetails: [],
+    toolCalls: [],
+    finishReason: null,
+    usage: null
+  };
   let dumpRecord = null;
-  if (isLlmDumpEnabled()) {
-    const dumpMessages = body.messages;
-    const dumpTools = body.tools ?? [];
-    const { messages: _m, tools: _t, ...params } = body;
-    const dumpResponse = {
-      text: "",
-      reasoning: "",
-      toolCalls: [],
-      finishReason: null,
-      usage: null
-    };
+  if (dumpEnabled && captured) {
     dumpRecord = {
       meta: {
         requestId,
         sessionId: opts2.sessionId ?? getLogSessionId(),
-        turnId: getLogTurnId(),
+        turnId: opts2.turnId ?? getLogTurnId(),
         model: opts2.model,
         url,
         ts: (/* @__PURE__ */ new Date()).toISOString()
       },
       request: {
-        system: dumpMessages.filter((m) => m.role === "system"),
-        messages: dumpMessages,
-        tools: dumpTools,
-        params,
-        rawSerialized: stableStringify(body, jsonReplacer)
+        system: captured.messages.filter((m) => m.role === "system"),
+        messages: captured.messages,
+        tools: captured.tools,
+        params: captured.params,
+        rawSerialized: captured.rawSerialized
       },
-      breakdown: computeBreakdown(dumpMessages, dumpTools),
-      response: dumpResponse
+      breakdown: captured.breakdown,
+      response
     };
   }
+  const traceRequest = (attempt) => {
+    if (!trace || !captured) return;
+    trace.emit(
+      "llm_request",
+      {
+        request_id: requestId,
+        attempt,
+        model: opts2.model,
+        params: captured.params,
+        request_blob: trace.blob(captured.rawSerialized) ?? "",
+        messages_sha: captured.messagesSha,
+        tools_sha: captured.toolsSha,
+        estimated_tokens: captured.breakdown.estTokens
+      },
+      opts2.turnId ?? null
+    );
+  };
+  const traceResponse = (startedAt2, error) => {
+    if (!trace) return;
+    const usage = response.usage;
+    trace.emit(
+      "llm_response",
+      {
+        request_id: requestId,
+        text_blob: trace.blob(response.text) ?? "",
+        ...response.reasoning ? { reasoning_blob: trace.blob(response.reasoning) ?? "" } : {},
+        ...response.reasoningDetails.length ? { reasoning_details: response.reasoningDetails } : {},
+        tool_calls: response.toolCalls.map((tc) => ({ id: tc.id, name: tc.name, arguments: tc.arguments })),
+        finish_reason: response.finishReason,
+        ...usage ? {
+          usage: {
+            prompt_tokens: usage.prompt_tokens,
+            completion_tokens: usage.completion_tokens,
+            ...usage.prompt_tokens_details?.cached_tokens !== void 0 ? { cached_tokens: usage.prompt_tokens_details.cached_tokens ?? void 0 } : {},
+            ...usage.cost !== void 0 ? { cost: usage.cost } : {}
+          }
+        } : {},
+        ...response.generationId ? { generation_id: response.generationId } : {},
+        latency_ms: Math.round(performance.now() - startedAt2),
+        aborted: opts2.signal?.aborted === true,
+        ...error !== void 0 ? { error } : {}
+      },
+      opts2.turnId ?? null
+    );
+  };
   logger.debug("runKimi:request", { requestId, attempt: 0, model: opts2.model });
   for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
     let res;
+    const attemptStartedAt = performance.now();
+    traceRequest(attempt);
     try {
       const headers = {
         "Content-Type": "application/json",
@@ -2307,8 +2427,9 @@ async function* runKimi(opts2) {
         signal: opts2.signal
       });
     } catch (fetchErr) {
-      if (isAbortError(fetchErr)) throw fetchErr;
       const msg = fetchErr instanceof Error ? fetchErr.message : String(fetchErr);
+      traceResponse(attemptStartedAt, msg);
+      if (isAbortError(fetchErr)) throw fetchErr;
       logger.warn("runKimi:fetch_error", { requestId, attempt, error: msg });
       if (attempt < MAX_ATTEMPTS - 1) {
         const delay = Math.random() * (500 * 2 ** attempt);
@@ -2340,6 +2461,7 @@ async function* runKimi(opts2) {
         err?.code,
         status
       );
+      traceResponse(attemptStartedAt, apiErr.message);
       if (isRetryable(apiErr, attempt)) {
         const isRateLimit = apiErr.httpStatus === 429;
         const baseDelay = isRateLimit ? 2e3 : 500;
@@ -2351,18 +2473,27 @@ async function* runKimi(opts2) {
       }
       throw apiErr;
     }
-    if (!res.body) throw new KimiApiError("kimiflare: empty response body", void 0, res.status);
+    if (!res.body) {
+      const emptyErr = new KimiApiError("kimiflare: empty response body", void 0, res.status);
+      traceResponse(attemptStartedAt, emptyErr.message);
+      throw emptyErr;
+    }
     logger.debug("runKimi:stream_start", { requestId });
+    let streamError;
     try {
       for await (const ev of parseStream(res.body, opts2.signal, opts2.idleTimeoutMs, opts2.postFirstByteIdleTimeoutMs)) {
-        if (dumpRecord) accumulateDumpResponse(dumpRecord.response, ev);
+        if (captured) accumulateDumpResponse(response, ev);
         yield ev;
       }
+    } catch (streamErr) {
+      streamError = streamErr instanceof Error ? streamErr.message : String(streamErr);
+      throw streamErr;
     } finally {
       if (dumpRecord) {
         dumpRecord.meta.attempt = attempt;
         writeLlmDump(dumpRecord);
       }
+      traceResponse(attemptStartedAt, streamError);
     }
     logger.debug("runKimi:stream_end", { requestId });
     return;
@@ -2439,16 +2570,36 @@ function describeRequestyHttpError(model, status, msg) {
   }
   return msg;
 }
+function captureRequest(body) {
+  const messages = body.messages;
+  const tools = body.tools ?? [];
+  const { messages: _m, tools: _t, ...params } = body;
+  return {
+    messages,
+    tools,
+    params,
+    rawSerialized: stableStringify(body, jsonReplacer),
+    messagesSha: sha256Hex(stableStringify(messages, jsonReplacer)),
+    toolsSha: sha256Hex(stableStringify(tools, jsonReplacer)),
+    breakdown: computeBreakdown(messages, tools)
+  };
+}
 function accumulateDumpResponse(resp, ev) {
   switch (ev.type) {
+    case "response_meta":
+      if (ev.meta.generationId) resp.generationId = ev.meta.generationId;
+      break;
     case "text":
       resp.text += ev.delta;
       break;
     case "reasoning":
       resp.reasoning += ev.delta;
       break;
+    case "reasoning_details":
+      resp.reasoningDetails = mergeReasoningDetails(resp.reasoningDetails, ev.details);
+      break;
     case "tool_call_complete":
-      resp.toolCalls.push({ name: ev.name, arguments: ev.arguments });
+      resp.toolCalls.push({ id: ev.id, name: ev.name, arguments: ev.arguments });
       break;
     case "usage":
       resp.usage = ev.usage;
@@ -2674,6 +2825,7 @@ var init_client = __esm({
     init_errors();
     init_version();
     init_messages();
+    init_blobs();
     init_logger();
     init_log_sink();
     init_llm_dump();
@@ -2746,7 +2898,7 @@ var init_recall_inject = __esm({
 
 // src/storage-limits.ts
 import { readdir as readdir2, stat as stat2, unlink } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 async function listFilesByMtime(dir, pattern = /.*/) {
   let entries;
   try {
@@ -2757,7 +2909,7 @@ async function listFilesByMtime(dir, pattern = /.*/) {
   const files = [];
   for (const name of entries) {
     if (!pattern.test(name)) continue;
-    const p = join9(dir, name);
+    const p = join10(dir, name);
     try {
       const s = await stat2(p);
       if (s.isFile()) files.push({ path: p, mtime: s.mtime });
@@ -2834,7 +2986,13 @@ var init_storage_limits = __esm({
       /** Memories older than this (days) are pruned. */
       memoryMaxAgeDays: 90,
       /** Max memories per repo. */
-      memoryMaxEntries: 1e3
+      memoryMaxEntries: 1e3,
+      /** Session trace directories older than this (days) are pruned. */
+      traceMaxAgeDays: 90,
+      /** Max total size of all session traces (bytes). Oldest sessions go first. */
+      traceMaxTotalBytes: 2 * 1024 * 1024 * 1024,
+      /** Max size of a single session trace (bytes); recording stops at the cap. */
+      traceMaxSessionBytes: 200 * 1024 * 1024
     };
   }
 });
@@ -2842,13 +3000,13 @@ var init_storage_limits = __esm({
 // src/cost-debug.ts
 import { appendFile, mkdir as mkdir5 } from "fs/promises";
 import { homedir as homedir6 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function debugDir() {
-  const xdg = process.env.XDG_DATA_HOME || join10(homedir6(), ".local", "share");
-  return join10(xdg, "kimiflare");
+  const xdg = process.env.XDG_DATA_HOME || join11(homedir6(), ".local", "share");
+  return join11(xdg, "kimiflare");
 }
 function debugPath() {
-  return join10(debugDir(), "cost-debug.jsonl");
+  return join11(debugDir(), "cost-debug.jsonl");
 }
 function now() {
   return (/* @__PURE__ */ new Date()).toISOString();
@@ -3562,7 +3720,7 @@ var require_isolated_vm = __commonJS({
 });
 
 // src/code-mode/sandbox.ts
-import { join as join11, dirname as dirname5 } from "path";
+import { join as join12, dirname as dirname5 } from "path";
 import { pathToFileURL } from "url";
 function stripTypescript(code) {
   let js = code;
@@ -3589,7 +3747,7 @@ async function loadTypescript(cwd) {
   let dir = cwd;
   while (dir !== dirname5(dir)) {
     try {
-      const tsPath = join11(dir, "node_modules", "typescript", "lib", "typescript.js");
+      const tsPath = join12(dir, "node_modules", "typescript", "lib", "typescript.js");
       return await import(pathToFileURL(tsPath).href);
     } catch {
     }
@@ -4433,11 +4591,11 @@ Prefer non-interactive flags when they exist (\`--yes\`, \`-m\`, \`--with-token\
 
 // src/agent/system-prompt.ts
 import { platform, release, homedir as homedir7 } from "os";
-import { basename, join as join12 } from "path";
+import { basename, join as join13 } from "path";
 import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
 function loadContextFile(cwd) {
   for (const name of CONTEXT_FILENAMES) {
-    const path = join12(cwd, name);
+    const path = join13(cwd, name);
     try {
       const s = statSync2(path);
       if (!s.isFile() || s.size > MAX_CONTEXT_BYTES) continue;
@@ -4964,6 +5122,403 @@ var init_completion_check = __esm({
   }
 });
 
+// src/trace/paths.ts
+import { homedir as homedir8 } from "os";
+import { join as join14 } from "path";
+function defaultTraceRoot() {
+  const xdg = process.env.XDG_DATA_HOME || join14(homedir8(), ".local", "share");
+  return join14(xdg, "kimiflare", "traces");
+}
+function traceRoot(configRoot) {
+  const env2 = process.env.KIMIFLARE_TRACE_DIR;
+  if (env2 && env2.trim()) return env2.trim();
+  if (configRoot && configRoot.trim()) return configRoot.trim();
+  return defaultTraceRoot();
+}
+function safeSessionSegment(sessionId) {
+  const cleaned = sessionId.replace(/[\\/\0]/g, "_").replace(/^\.+$/, "_");
+  return cleaned || "session";
+}
+function sessionTraceDir(sessionId, root) {
+  return join14(traceRoot(root), safeSessionSegment(sessionId));
+}
+function traceFilePath(sessionDir) {
+  return join14(sessionDir, TRACE_FILE_NAME);
+}
+function blobsDir(sessionDir) {
+  return join14(sessionDir, BLOBS_DIR_NAME);
+}
+var TRACE_FILE_NAME, BLOBS_DIR_NAME;
+var init_paths = __esm({
+  "src/trace/paths.ts"() {
+    "use strict";
+    TRACE_FILE_NAME = "trace.jsonl";
+    BLOBS_DIR_NAME = "blobs";
+  }
+});
+
+// src/trace/redact.ts
+function redactLight(text) {
+  if (!text) return text;
+  let out = text.replace(PEM_BLOCK, "<redacted-key>");
+  for (const re of TOKEN_SHAPES) out = out.replace(re, "<redacted>");
+  out = out.replace(KEY_VALUE, "$1$2<redacted>");
+  return out;
+}
+function isSecretConfigKey(key) {
+  const lower = key.toLowerCase();
+  return SECRET_KEY_SUFFIXES.some((suffix) => lower.endsWith(suffix));
+}
+function redactConfig(value) {
+  return redactValue(value, true);
+}
+function redactDeep(value) {
+  return redactValue(value, false);
+}
+function redactValue(value, redactSecretKeys) {
+  if (typeof value === "string") return redactLight(value);
+  if (Array.isArray(value)) return value.map((v) => redactValue(v, redactSecretKeys));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v === void 0) continue;
+      if (redactSecretKeys && isSecretConfigKey(k) && v !== null && v !== "") {
+        out[k] = "<redacted>";
+      } else {
+        out[k] = redactValue(v, redactSecretKeys);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+var PEM_BLOCK, TOKEN_SHAPES, KEY_VALUE, SECRET_KEY_SUFFIXES;
+var init_redact = __esm({
+  "src/trace/redact.ts"() {
+    "use strict";
+    PEM_BLOCK = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+    TOKEN_SHAPES = [
+      /sk-or-v1-[A-Za-z0-9]+/g,
+      /ghp_[A-Za-z0-9]+/g,
+      /github_pat_[A-Za-z0-9_]+/g,
+      /Bearer [A-Za-z0-9._-]+/g,
+      /Basic [A-Za-z0-9+/=]+/g
+    ];
+    KEY_VALUE = /(api[_-]?key|secret|token|password|authorization)(["']?\s*[:=]\s*["']?)[^\s"']+/gi;
+    SECRET_KEY_SUFFIXES = ["apikey", "token", "secret", "password"];
+  }
+});
+
+// src/trace/types.ts
+var TRACE_SCHEMA_VERSION;
+var init_types = __esm({
+  "src/trace/types.ts"() {
+    "use strict";
+    TRACE_SCHEMA_VERSION = 1;
+  }
+});
+
+// src/trace/recorder.ts
+import { randomUUID } from "crypto";
+import { appendFileSync as appendFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync3 } from "fs";
+function createNoopRecorder(sessionId = "") {
+  return new NoopRecorder(sessionId);
+}
+function makeTurnId() {
+  return randomUUID();
+}
+function createRecorder(opts2) {
+  if (!opts2.enabled) return new NoopRecorder(opts2.sessionId);
+  const dir = sessionTraceDir(opts2.sessionId, opts2.root);
+  return new FileTraceRecorder(opts2.sessionId, dir, {
+    maxBlobBytes: opts2.maxBlobBytes,
+    maxSessionBytes: opts2.maxSessionBytes
+  });
+}
+var NoopRecorder, FileTraceRecorder;
+var init_recorder = __esm({
+  "src/trace/recorder.ts"() {
+    "use strict";
+    init_logger();
+    init_log_sink();
+    init_storage_limits();
+    init_blobs();
+    init_paths();
+    init_redact();
+    init_types();
+    NoopRecorder = class {
+      constructor(sessionId) {
+        this.sessionId = sessionId;
+      }
+      sessionId;
+      enabled = false;
+      dir = null;
+      emit() {
+      }
+      blob() {
+        return null;
+      }
+      flush() {
+        return Promise.resolve();
+      }
+    };
+    FileTraceRecorder = class {
+      constructor(sessionId, dir, opts2) {
+        this.sessionId = sessionId;
+        this.dir = dir;
+        this.file = traceFilePath(dir);
+        this.blobs = new BlobStore(blobsDir(dir), { maxBlobBytes: opts2.maxBlobBytes });
+        this.maxSessionBytes = opts2.maxSessionBytes ?? RETENTION.traceMaxSessionBytes;
+      }
+      sessionId;
+      enabled = true;
+      dir;
+      file;
+      blobs;
+      maxSessionBytes;
+      seq = 0;
+      bytesWritten = 0;
+      dirReady = false;
+      emit(type, payload, turnId) {
+        if (!this.enabled) return;
+        try {
+          const event = {
+            v: TRACE_SCHEMA_VERSION,
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            seq: this.seq,
+            session_id: this.sessionId,
+            turn_id: turnId === void 0 ? getLogTurnId() : turnId,
+            type,
+            payload: redactDeep(payload)
+          };
+          if (!this.dirReady) {
+            mkdirSync4(this.dir, { recursive: true });
+            this.dirReady = true;
+            this.resumeSeq();
+            event.seq = this.seq;
+          }
+          const line = JSON.stringify(event) + "\n";
+          if (!this.ensureBudget(Buffer.byteLength(line, "utf8"))) return;
+          appendFileSync2(this.file, line, "utf8");
+          this.seq++;
+        } catch (err) {
+          this.fail(err);
+        }
+      }
+      blob(content) {
+        if (!this.enabled) return null;
+        try {
+          const result2 = this.blobs.put(redactLight(content));
+          if (result2.written > 0) this.ensureBudget(result2.written);
+          return result2.sha256;
+        } catch (err) {
+          this.fail(err);
+          return null;
+        }
+      }
+      flush() {
+        return Promise.resolve();
+      }
+      /** Continue `seq` after the lines already in an existing trace file. */
+      resumeSeq() {
+        if (!existsSync3(this.file)) return;
+        const existing = readFileSync3(this.file, "utf8");
+        let lines = 0;
+        for (let i = 0; i < existing.length; i++) if (existing.charCodeAt(i) === 10) lines++;
+        this.seq = lines;
+        this.bytesWritten += Buffer.byteLength(existing, "utf8");
+      }
+      /** Account for `bytes`; returns false (and disables) once the session cap is exceeded. */
+      ensureBudget(bytes) {
+        this.bytesWritten += bytes;
+        if (this.bytesWritten > this.maxSessionBytes) {
+          this.enabled = false;
+          logger.warn("trace:session_cap", {
+            session_id: this.sessionId,
+            dir: this.dir,
+            max_bytes: this.maxSessionBytes
+          });
+          return false;
+        }
+        return true;
+      }
+      fail(err) {
+        this.enabled = false;
+        logger.warn("trace:write_failed", {
+          session_id: this.sessionId,
+          dir: this.dir,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    };
+  }
+});
+
+// src/cost-attribution/git-diff.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+function parseNumstat(raw) {
+  const entries = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    const parts = line.split("	");
+    if (parts.length < 3) continue;
+    const ins = parseInt(parts[0], 10);
+    const del = parseInt(parts[1], 10);
+    entries.push({
+      file: parts.slice(2).join("	"),
+      insertions: Number.isNaN(ins) ? 0 : ins,
+      deletions: Number.isNaN(del) ? 0 : del
+    });
+  }
+  return entries;
+}
+async function gitNumstat(cwd, opts2 = {}) {
+  let raw;
+  try {
+    const args = ["diff", "--numstat"];
+    if (opts2.againstHead) args.push("HEAD");
+    args.push("--", ".");
+    try {
+      raw = (await execFileAsync("git", args, { cwd, timeout: 5e3 })).stdout;
+    } catch (err) {
+      if (!opts2.againstHead) throw err;
+      raw = (await execFileAsync("git", ["diff", "--numstat", "--", "."], { cwd, timeout: 5e3 })).stdout;
+    }
+  } catch {
+    return null;
+  }
+  const entries = parseNumstat(raw);
+  if (opts2.includeUntracked) {
+    try {
+      const { stdout } = await execFileAsync("git", ["ls-files", "--others", "--exclude-standard"], { cwd, timeout: 5e3 });
+      const { readFile: readFile32, stat: stat11 } = await import("fs/promises");
+      const { join: join54 } = await import("path");
+      for (const file of stdout.split("\n").filter(Boolean)) {
+        let lines = 0;
+        try {
+          const path = join54(cwd, file);
+          const size = (await stat11(path)).size;
+          if (size > 0 && size <= 1024 * 1024) {
+            const text = await readFile32(path, "utf8");
+            lines = text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
+          }
+        } catch {
+        }
+        entries.push({ file, insertions: lines, deletions: 0 });
+        raw += `${lines}	0	${file}
+`;
+      }
+    } catch {
+    }
+  }
+  return { raw, entries };
+}
+async function gitPatch(cwd, maxBytes) {
+  try {
+    let stdout;
+    try {
+      stdout = (await execFileAsync("git", ["diff", "HEAD", "--", "."], { cwd, timeout: 1e4, maxBuffer: maxBytes * 4 })).stdout;
+    } catch {
+      stdout = (await execFileAsync("git", ["diff", "--", "."], { cwd, timeout: 1e4, maxBuffer: maxBytes * 4 })).stdout;
+    }
+    return Buffer.byteLength(stdout, "utf8") <= maxBytes ? stdout : null;
+  } catch {
+    return null;
+  }
+}
+var execFileAsync;
+var init_git_diff = __esm({
+  "src/cost-attribution/git-diff.ts"() {
+    "use strict";
+    execFileAsync = promisify(execFile);
+  }
+});
+
+// src/trace/git-delta.ts
+function toMap(entries) {
+  return new Map(entries.map((e) => [e.file, e]));
+}
+function diffNumstat(before, after) {
+  const b = toMap(before);
+  const a = toMap(after);
+  const files = /* @__PURE__ */ new Set([...b.keys(), ...a.keys()]);
+  let insertions = 0;
+  let deletions = 0;
+  const changed = [];
+  for (const file of files) {
+    const x = b.get(file) ?? { file, insertions: 0, deletions: 0 };
+    const y = a.get(file) ?? { file, insertions: 0, deletions: 0 };
+    const di = y.insertions - x.insertions;
+    const dd = y.deletions - x.deletions;
+    if (di === 0 && dd === 0) continue;
+    changed.push(file);
+    insertions += Math.max(0, di);
+    deletions += Math.max(0, dd);
+  }
+  changed.sort();
+  return { files_changed: changed.length, insertions, deletions, files: changed };
+}
+function rememberGitDelta(sessionId, turnId, files) {
+  if (files.length === 0) return;
+  lastDeltaBySession.set(sessionId, { turnId, files });
+}
+function detectGitRevert(sessionId, command) {
+  const last = lastDeltaBySession.get(sessionId);
+  if (!last) return null;
+  if (!REVERT_COMMAND.test(command)) return null;
+  const isStash = /git\s+stash\b/.test(command) && !/git\s+stash\s+(pop|apply|list|show|drop)\b/.test(command);
+  if (isStash) return { turnId: last.turnId };
+  if (/git\s+(checkout\s+--|restore)\s*$/.test(command.trim())) return null;
+  const hit = last.files.some((file) => {
+    const base = file.slice(file.lastIndexOf("/") + 1);
+    return command.includes(file) || base && new RegExp(`(^|[\\s/'"])${base.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(['"\\s]|$)`).test(command);
+  });
+  if (hit) return { turnId: last.turnId };
+  if (/git\s+restore\s+(\.|--staged\s+\.)(\s|$)/.test(command) || /git\s+checkout\s+--\s+\.(\s|$)/.test(command)) return { turnId: last.turnId };
+  return null;
+}
+async function beginGitDelta(opts2) {
+  if (!opts2.trace.enabled) return null;
+  const before = await gitNumstat(opts2.cwd, { againstHead: true, includeUntracked: true });
+  if (!before) return null;
+  let done = false;
+  return {
+    async finish() {
+      if (done) return;
+      done = true;
+      const after = await gitNumstat(opts2.cwd, { againstHead: true, includeUntracked: true });
+      if (!after || !opts2.trace.enabled) return;
+      const delta = diffNumstat(before.entries, after.entries);
+      const patch = delta.files_changed > 0 ? await gitPatch(opts2.cwd, MAX_PATCH_BYTES) : null;
+      opts2.trace.emit(
+        "outcome",
+        {
+          kind: "git_delta",
+          turn_id: opts2.turnId,
+          files_changed: delta.files_changed,
+          insertions: delta.insertions,
+          deletions: delta.deletions,
+          numstat_blob: opts2.trace.blob(after.raw) ?? "",
+          ...patch ? { patch_blob: opts2.trace.blob(patch) ?? "" } : {}
+        },
+        opts2.turnId
+      );
+      if (opts2.sessionId) rememberGitDelta(opts2.sessionId, opts2.turnId, delta.files);
+    }
+  };
+}
+var MAX_PATCH_BYTES, lastDeltaBySession, REVERT_COMMAND;
+var init_git_delta = __esm({
+  "src/trace/git-delta.ts"() {
+    "use strict";
+    init_git_diff();
+    MAX_PATCH_BYTES = 512 * 1024;
+    lastDeltaBySession = /* @__PURE__ */ new Map();
+    REVERT_COMMAND = /(^|[\s;&|(])git\s+(checkout\s+--|restore\b|stash\b)/;
+  }
+});
+
 // src/agent/loop.ts
 function getSessionWebFetchHistory(sessionId) {
   const key = sessionId ?? "default";
@@ -5002,7 +5557,90 @@ function raceWithSignal(promise, signal) {
   ]);
 }
 async function runAgentTurn(opts2) {
-  const turnStart = performance.now();
+  const tr = {
+    trace: opts2.trace ?? createNoopRecorder(opts2.sessionId ?? ""),
+    turnId: opts2.turnId ?? makeTurnId(),
+    startedAt: performance.now(),
+    toolsUsed: [],
+    partialText: "",
+    finalText: null,
+    costUsd: 0,
+    endReason: null
+  };
+  const endTurn = (reason, finalText) => {
+    if (!tr.trace.enabled) return;
+    const finalBlob = finalText ? tr.trace.blob(finalText) : null;
+    tr.trace.emit(
+      "turn_end",
+      {
+        reason,
+        tools_used: tr.toolsUsed,
+        ...tr.costUsd > 0 ? { cost_usd: tr.costUsd } : {},
+        duration_ms: Math.round(performance.now() - tr.startedAt),
+        ...finalBlob ? { final_text_blob: finalBlob } : {}
+      },
+      tr.turnId
+    );
+  };
+  const gitDelta = await beginGitDelta({ trace: tr.trace, turnId: tr.turnId, sessionId: opts2.sessionId, cwd: opts2.cwd }).catch(
+    () => null
+  );
+  try {
+    await runAgentTurnInner(opts2, tr);
+    endTurn(tr.endReason ?? "complete", tr.finalText);
+  } catch (err) {
+    if (err instanceof DOMException && err.name === "AbortError") {
+      endTurn("aborted", tr.partialText || tr.finalText);
+    } else if (err instanceof AgentLoopError || err instanceof BudgetExhaustedError) {
+      endTurn("guardrail", tr.finalText);
+    } else {
+      endTurn("error", tr.partialText || tr.finalText);
+    }
+    throw err;
+  } finally {
+    await gitDelta?.finish().catch(() => void 0);
+  }
+}
+async function runAgentTurnInner(opts2, tr) {
+  const turnStart = tr.startedAt;
+  const { trace, turnId } = tr;
+  const notifyGuardrail = (ev) => {
+    if (ev.kind !== "completion_nudge") trace.emit("guardrail", { kind: ev.kind, message: ev.message }, turnId);
+    opts2.callbacks.onGuardrail?.(ev);
+  };
+  const traceBlocked = (tc, result2, errorCode, redirected = false) => {
+    if (!trace.enabled) return;
+    const argsBlob = trace.blob(tc.function.arguments) ?? "";
+    trace.emit(
+      "tool_call",
+      {
+        tool_call_id: tc.id,
+        name: tc.function.name,
+        args_blob: argsBlob,
+        ...tc.function.arguments.length <= 2048 ? { args_inline: parseArgsObject(tc.function.arguments) } : {},
+        needs_permission: false,
+        code_mode_redirected: redirected
+      },
+      turnId
+    );
+    const blob = trace.blob(result2.content) ?? "";
+    const bytes = Buffer.byteLength(result2.content, "utf8");
+    trace.emit(
+      "tool_result",
+      {
+        tool_call_id: tc.id,
+        name: tc.function.name,
+        ok: false,
+        error_code: errorCode,
+        raw_blob: blob,
+        raw_bytes: bytes,
+        reduced_blob: blob,
+        reduced_bytes: bytes,
+        duration_ms: 0
+      },
+      turnId
+    );
+  };
   logger.info("turn:start", { sessionId: opts2.sessionId, codeMode: opts2.codeMode ?? false });
   const max = opts2.maxToolIterations ?? 200;
   const limitBehavior = opts2.toolLimitBehavior ?? (opts2.continueOnLimit ? "continue" : "throw");
@@ -5164,6 +5802,18 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
   const webFetchHistory = getSessionWebFetchHistory(opts2.sessionId);
   let webFetchesThisTurn = 0;
   let codeModeRedirects = 0;
+  const noteCodeModeRedirect = () => {
+    if (codeModeRedirects === MAX_CODE_MODE_REDIRECTS) {
+      trace.emit(
+        "guardrail",
+        {
+          kind: "code_mode_redirect_cap",
+          message: `Code Mode redirect cap (${MAX_CODE_MODE_REDIRECTS}) reached \u2014 direct tool calls now execute normally.`
+        },
+        turnId
+      );
+    }
+  };
   const MAX_WEB_FETCH_PER_TURN = 5;
   let cumulativePromptTokens = 0;
   let iter = 0;
@@ -5201,7 +5851,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
         role: "system",
         content: `You have reached the hard safety ceiling of ${hardCeiling} tool iterations for this turn. Do not call any more tools. Summarize what you accomplished, what remains unfinished, and the concrete next steps needed to complete the task.`
       });
-      opts2.callbacks.onGuardrail?.({
+      notifyGuardrail({
         kind: "limit_ceiling",
         message: `Tool-iteration ceiling (${hardCeiling}) reached \u2014 wrapping up the turn with a summary.`,
         totalIterations: totalIter
@@ -5213,17 +5863,18 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
           content: "You have reached the tool-call limit for this session. The counter has been reset so you can continue working. Please proceed with your task."
         });
         iter = 0;
-        opts2.callbacks.onGuardrail?.({
+        notifyGuardrail({
           kind: "limit_reset",
           message: `Tool-call limit (${max}) reached \u2014 counter reset automatically (${totalIter}/${hardCeiling} total).`,
           totalIterations: totalIter
         });
       } else if (limitBehavior === "stop") {
-        opts2.callbacks.onGuardrail?.({
+        notifyGuardrail({
           kind: "limit_stopped",
           message: `Tool-call limit (${max}) reached \u2014 turn stopped.`,
           totalIterations: totalIter
         });
+        tr.endReason = "guardrail";
         await fireStopHook();
         return;
       } else {
@@ -5240,6 +5891,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
     let reasoning = "";
     let responseMeta;
     let reasoningDetails = [];
+    tr.partialText = "";
     opts2.callbacks.onAssistantStart?.();
     const stripReasoning = process.env.KIMIFLARE_STRIP_REASONING === "1";
     const shadowStrip = process.env.KIMIFLARE_SHADOW_STRIP === "1";
@@ -5286,6 +5938,17 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
           budgetTokens: maxPromptTokens
         };
         logger.info("context:compacted", { sessionId: opts2.sessionId, ...info });
+        trace.emit(
+          "compaction",
+          {
+            method: "preflight",
+            tokens_before: info.tokensBefore,
+            tokens_after: info.tokensAfter,
+            turns_removed: info.turnsRemoved,
+            artifacts_archived: info.artifactsArchived
+          },
+          turnId
+        );
         opts2.callbacks.onCompacted?.(info);
       }
     }
@@ -5305,7 +5968,9 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
       reasoningEffort: opts2.reasoningEffort,
       sessionId: opts2.sessionId,
       idleTimeoutMs: opts2.idleTimeoutMs ?? 6e4,
-      postFirstByteIdleTimeoutMs: opts2.postFirstByteIdleTimeoutMs
+      postFirstByteIdleTimeoutMs: opts2.postFirstByteIdleTimeoutMs,
+      trace,
+      turnId
     });
     let gotFirstChunk = false;
     for await (const ev of events) {
@@ -5327,6 +5992,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
           break;
         case "text":
           content += ev.delta;
+          tr.partialText = content;
           opts2.callbacks.onTextDelta?.(ev.delta);
           break;
         case "tool_call_start":
@@ -5343,6 +6009,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
             function: { name: normalizeToolName(ev.name, opts2.tools), arguments: safeArgs }
           };
           toolCalls.push(call);
+          tr.toolsUsed.push(call.function.name);
           opts2.callbacks.onToolCallFinalized?.(call);
           break;
         }
@@ -5356,6 +6023,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
     }
     if (opts2.signal.aborted) throw new DOMException("aborted", "AbortError");
     if (lastUsage) {
+      if (typeof lastUsage.cost === "number") tr.costUsd += lastUsage.cost;
       opts2.callbacks.onUsageFinal?.(lastUsage, responseMeta);
       cumulativePromptTokens += lastUsage.prompt_tokens;
       if (!budgetExhausted && opts2.maxInputTokens !== void 0 && opts2.maxInputTokens > 0 && cumulativePromptTokens >= opts2.maxInputTokens) {
@@ -5384,8 +6052,10 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
       }
     }
     opts2.messages.push(assistantMsg);
+    tr.finalText = typeof assistantMsg.content === "string" ? assistantMsg.content : null;
     opts2.callbacks.onAssistantFinal?.(assistantMsg);
     if (finalizeReason !== null) {
+      tr.endReason = "guardrail";
       logger.info("turn:finalized", { sessionId: opts2.sessionId, reason: finalizeReason, totalIter });
       if (budgetExhausted) throw new BudgetExhaustedError();
       await fireStopHook();
@@ -5424,11 +6094,12 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
         if (shouldCheckCompletion(input, opts2.intentClassification?.tier)) {
           const p = await opts2.completionCheck(input, opts2.signal).catch(() => null);
           if (opts2.signal.aborted) throw new DOMException("aborted", "AbortError");
+          if (p !== null) trace.emit("completion_check", { probability: p, nudged: p < INCOMPLETE_THRESHOLD }, turnId);
           if (p !== null && p < INCOMPLETE_THRESHOLD) {
             completionNudges++;
             logger.info("turn:completion_nudge", { sessionId: opts2.sessionId, probability: p });
             opts2.messages.push({ role: "system", content: CONTINUE_NUDGE });
-            opts2.callbacks.onGuardrail?.({
+            notifyGuardrail({
               kind: "completion_nudge",
               message: "The agent stopped before finishing \u2014 asked it to continue.",
               probability: p
@@ -5468,6 +6139,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
             kind: "blocked",
             tc,
             loopSignature,
+            errorCode: "loop_guardrail",
             result: {
               tool_call_id: tc.id,
               name: tc.function.name,
@@ -5480,10 +6152,13 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
         }
         if (codeMode && CODE_MODE_REDIRECT_TOOLS.has(tc.function.name) && codeModeRedirects < MAX_CODE_MODE_REDIRECTS) {
           codeModeRedirects++;
+          noteCodeModeRedirect();
           items.push({
             kind: "blocked",
             tc,
             loopSignature,
+            errorCode: "code_mode_redirect",
+            redirected: true,
             result: { tool_call_id: tc.id, name: tc.function.name, content: codeModeRedirectMessage(tc.function.name), ok: false }
           });
           continue;
@@ -5500,6 +6175,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
                 kind: "blocked",
                 tc,
                 loopSignature,
+                errorCode: "web_fetch_budget",
                 result: { tool_call_id: tc.id, name: "web_fetch", content: warning, ok: false, guardrail: true }
               });
               continue;
@@ -5520,6 +6196,8 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
             { id: it.tc.id, name: it.tc.function.name, arguments: it.tc.function.arguments },
             batchAskPermission,
             {
+              trace,
+              turnId,
               cwd: opts2.cwd,
               signal: opts2.signal,
               onTasks: wrappedOnTasks,
@@ -5562,6 +6240,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
       }
       for (const it of items) {
         if (it.kind === "blocked") {
+          traceBlocked(it.tc, it.result, it.errorCode, it.redirected === true);
           toolResults.push(it.result);
           opts2.messages.push({
             role: "tool",
@@ -5697,6 +6376,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
             content: `Tool ${tc.function.name} is not available under this turn's policy. Continue without it or ask the user to enable it.`,
             ok: false
           };
+          traceBlocked(tc, unavailableResult, "unavailable");
           toolResults.push(unavailableResult);
           opts2.messages.push({
             role: "tool",
@@ -5720,6 +6400,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
             ok: false,
             guardrail: true
           };
+          traceBlocked(tc, loopResult, "loop_guardrail");
           toolResults.push(loopResult);
           opts2.messages.push({
             role: "tool",
@@ -5748,6 +6429,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
                 ok: false,
                 guardrail: true
               };
+              traceBlocked(tc, budgetResult, "web_fetch_budget");
               toolResults.push(budgetResult);
               opts2.messages.push({
                 role: "tool",
@@ -5770,6 +6452,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
                 ok: false,
                 guardrail: true
               };
+              traceBlocked(tc, sessionCapResult, "web_fetch_budget");
               toolResults.push(sessionCapResult);
               opts2.messages.push({
                 role: "tool",
@@ -5791,12 +6474,39 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
         if (codeMode && tc.function.name === "execute_code") {
           const args = JSON.parse(tc.function.arguments || "{}");
           const code = args.code || "";
+          const sandboxStartedAt = performance.now();
+          if (trace.enabled) {
+            trace.emit(
+              "tool_call",
+              {
+                tool_call_id: tc.id,
+                name: "execute_code",
+                args_blob: trace.blob(tc.function.arguments) ?? "",
+                ...tc.function.arguments.length <= 2048 ? { args_inline: parseArgsObject(tc.function.arguments) } : {},
+                needs_permission: false,
+                code_mode_redirected: false
+              },
+              turnId
+            );
+          }
           const sandboxResult = await runInSandbox({
             code,
             tools: sandboxTools,
             executor: opts2.executor,
             askPermission: opts2.callbacks.askPermission,
-            ctx: { cwd: opts2.cwd, signal: opts2.signal, onTasks: wrappedOnTasks, onPlanOptions: opts2.callbacks.onPlanOptions, coauthor: opts2.coauthor, memoryManager: opts2.memoryManager, sessionId: opts2.sessionId, githubToken: opts2.githubToken },
+            ctx: {
+              cwd: opts2.cwd,
+              signal: opts2.signal,
+              onTasks: wrappedOnTasks,
+              onPlanOptions: opts2.callbacks.onPlanOptions,
+              coauthor: opts2.coauthor,
+              memoryManager: opts2.memoryManager,
+              sessionId: opts2.sessionId,
+              githubToken: opts2.githubToken,
+              trace,
+              turnId,
+              codeModeParentToolCallId: tc.id
+            },
             timeoutMs: 3e4,
             memoryLimitMB: 128
           });
@@ -5819,6 +6529,7 @@ Not in this API \u2014 call these as separate tools instead: ${directTools.map((
 
 Output:
 ${sandboxResult.output}` : sandboxResult.output;
+          const sandboxRawContent = resultContent;
           if (resultContent.length > MAX_TOOL_CONTENT_CHARS) {
             const rawBytes = resultContent.length;
             resultContent = resultContent.slice(0, MAX_TOOL_CONTENT_CHARS) + `
@@ -5837,6 +6548,24 @@ ${sandboxResult.output}` : sandboxResult.output;
             content: resultContent,
             ok: !sandboxResult.error
           };
+          if (trace.enabled) {
+            const rawBlob = trace.blob(sandboxRawContent) ?? "";
+            trace.emit(
+              "tool_result",
+              {
+                tool_call_id: tc.id,
+                name: "execute_code",
+                ok: result2.ok,
+                ...sandboxResult.error ? { error_code: "sandbox_error" } : {},
+                raw_blob: rawBlob,
+                raw_bytes: Buffer.byteLength(sandboxRawContent, "utf8"),
+                reduced_blob: sandboxRawContent === resultContent ? rawBlob : trace.blob(resultContent) ?? "",
+                reduced_bytes: Buffer.byteLength(resultContent, "utf8"),
+                duration_ms: Math.round(performance.now() - sandboxStartedAt)
+              },
+              turnId
+            );
+          }
           toolResults.push(result2);
           opts2.messages.push({
             role: "tool",
@@ -5849,8 +6578,10 @@ ${sandboxResult.output}` : sandboxResult.output;
           if (recentToolCalls.length > LOOP_WINDOW) recentToolCalls.shift();
         } else if (codeMode && CODE_MODE_REDIRECT_TOOLS.has(tc.function.name) && codeModeRedirects < MAX_CODE_MODE_REDIRECTS) {
           codeModeRedirects++;
+          noteCodeModeRedirect();
           const msg = codeModeRedirectMessage(tc.function.name);
           const redirectResult = { tool_call_id: tc.id, name: tc.function.name, content: msg, ok: false };
+          traceBlocked(tc, redirectResult, "code_mode_redirect", true);
           toolResults.push(redirectResult);
           opts2.messages.push({ role: "tool", tool_call_id: tc.id, content: msg, name: tc.function.name });
           opts2.callbacks.onToolResult?.(redirectResult);
@@ -5861,6 +6592,8 @@ ${sandboxResult.output}` : sandboxResult.output;
             { id: tc.id, name: tc.function.name, arguments: tc.function.arguments },
             opts2.callbacks.askPermission,
             {
+              trace,
+              turnId,
               cwd: opts2.cwd,
               signal: opts2.signal,
               onTasks: wrappedOnTasks,
@@ -5929,6 +6662,7 @@ ${sandboxResult.output}` : sandboxResult.output;
               condition: result2.waitRequest.condition,
               wakeAt: result2.waitRequest.wakeAt
             });
+            tr.endReason = "needs_input";
             try {
               opts2.callbacks.onRunYield?.(result2.waitRequest);
             } catch (error) {
@@ -6087,7 +6821,7 @@ ${sandboxResult.output}` : sandboxResult.output;
           role: "system",
           content: "Every tool call in your last step was blocked because you kept repeating the same calls with identical arguments. Do not repeat them. Either take a genuinely different approach (different tools, arguments, or files), or, if you already have enough information, stop calling tools and give your final answer."
         });
-        opts2.callbacks.onGuardrail?.({
+        notifyGuardrail({
           kind: "loop_recovery",
           message: "Loop guardrail: repeated tool calls were blocked \u2014 asked the agent to change approach."
         });
@@ -6098,7 +6832,7 @@ ${sandboxResult.output}` : sandboxResult.output;
         role: "system",
         content: "You are still repeating blocked tool calls after being asked to change approach, so this turn is ending. Do not call any more tools. Summarize what you accomplished, what is blocking you, and what the user could do next."
       });
-      opts2.callbacks.onGuardrail?.({
+      notifyGuardrail({
         kind: "loop_stopped",
         message: "Loop guardrail: the agent kept repeating blocked tool calls \u2014 ending the turn with a summary."
       });
@@ -6159,6 +6893,8 @@ var init_loop = __esm({
     init_context_budget();
     init_turn_directive();
     init_completion_check();
+    init_recorder();
+    init_git_delta();
     MAX_LOOP_RECOVERIES = 1;
     BudgetExhaustedError = class extends Error {
       constructor(message2 = "Cumulative input token budget exhausted") {
@@ -6214,10 +6950,10 @@ var init_pricing = __esm({
 // src/util/atomic-file.ts
 import { mkdir as mkdir6, rename, rm, stat as stat3, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname6 } from "path";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 async function writeFileAtomic(path, data) {
   await mkdir6(dirname6(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
+  const tmp = `${path}.${process.pid}.${randomUUID2().slice(0, 8)}.tmp`;
   try {
     await writeFile5(tmp, data, "utf8");
     await rename(tmp, path);
@@ -6272,19 +7008,19 @@ var init_atomic_file = __esm({
 
 // src/usage-tracker.ts
 import { readFile as readFile5, rename as rename2 } from "fs/promises";
-import { homedir as homedir8 } from "os";
-import { join as join13 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join15 } from "path";
 import { EventEmitter } from "events";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 function usageDir() {
-  const xdg = process.env.XDG_DATA_HOME || join13(homedir8(), ".local", "share");
-  return join13(xdg, "kimiflare");
+  const xdg = process.env.XDG_DATA_HOME || join15(homedir9(), ".local", "share");
+  return join15(xdg, "kimiflare");
 }
 function usagePath() {
-  return join13(usageDir(), "usage.json");
+  return join15(usageDir(), "usage.json");
 }
 function historyPath() {
-  return join13(usageDir(), "history.jsonl");
+  return join15(usageDir(), "history.jsonl");
 }
 function today() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -6404,7 +7140,7 @@ async function recordUsage(sessionId, usage, lookup, model) {
   );
   const estimatedCost = cost.total;
   const cachedTokens = usage.prompt_tokens_details?.cached_tokens ?? 0;
-  const turnId = randomUUID2();
+  const turnId = randomUUID3();
   const generationId = lookup?.meta.generationId;
   const inlineCost = typeof usage.cost === "number" && Number.isFinite(usage.cost) ? usage.cost : void 0;
   await withLock(async () => {
@@ -6705,12 +7441,41 @@ var init_tool_error = __esm({
   }
 });
 
+// src/trace/verification.ts
+function segment(alternatives) {
+  return new RegExp(`${SEG}(?:${alternatives})(?:\\s|$)`);
+}
+function classifyVerification(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return null;
+  for (const [category, re] of TABLE) {
+    if (re.test(trimmed)) return category;
+  }
+  return null;
+}
+var SEG, TABLE;
+var init_verification = __esm({
+  "src/trace/verification.ts"() {
+    "use strict";
+    SEG = String.raw`(?:^|[;|(]\s*|&&\s*|\|\|\s*)(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:npx\s+|pnpm\s+exec\s+|pnpm\s+dlx\s+|yarn\s+|bunx\s+|bun\s+run\s+|(?:\.\/)?node_modules\/\.bin\/)?`;
+    TABLE = [
+      [
+        "test",
+        segment(String.raw`npm\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|yarn\s+(?:run\s+)?test|tsx\s+--test|node\s+--test|vitest|jest|pytest|go\s+test|cargo\s+test`)
+      ],
+      ["lint", segment(String.raw`eslint|ruff|golangci-lint|npm\s+run\s+lint|pnpm\s+(?:run\s+)?lint|yarn\s+(?:run\s+)?lint`)],
+      ["typecheck", segment(String.raw`tsc|mypy|pyright|npm\s+run\s+typecheck|pnpm\s+(?:run\s+)?typecheck|yarn\s+(?:run\s+)?typecheck`)],
+      ["build", segment(String.raw`npm\s+run\s+build|tsup|cargo\s+build|go\s+build|pnpm\s+(?:run\s+)?build|yarn\s+(?:run\s+)?build`)]
+    ];
+  }
+});
+
 // src/util/paths.ts
 import { resolve, isAbsolute, relative, sep } from "path";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 function resolvePath(cwd, input) {
   if (input.startsWith("~/") || input === "~") {
-    return resolve(homedir9(), input === "~" ? "." : input.slice(2));
+    return resolve(homedir10(), input === "~" ? "." : input.slice(2));
   }
   return isAbsolute(input) ? input : resolve(cwd, input);
 }
@@ -6737,7 +7502,7 @@ function collapsePath(input, cwd, maxLen = 40) {
 function collapsePathsInText(s, cwd, maxLen = 40) {
   return s.replace(/([~/][^\s"',)}\]]+)/g, (match) => collapsePath(match, cwd, maxLen));
 }
-var init_paths = __esm({
+var init_paths2 = __esm({
   "src/util/paths.ts"() {
     "use strict";
   }
@@ -6794,7 +7559,7 @@ var MAX_BYTES, MAX_STREAM_BYTES, readTool;
 var init_read = __esm({
   "src/tools/read.ts"() {
     "use strict";
-    init_paths();
+    init_paths2();
     MAX_BYTES = 2 * 1024 * 1024;
     MAX_STREAM_BYTES = 50 * 1024 * 1024;
     readTool = {
@@ -6845,7 +7610,7 @@ var writeTool;
 var init_write = __esm({
   "src/tools/write.ts"() {
     "use strict";
-    init_paths();
+    init_paths2();
     writeTool = {
       name: "write",
       description: "Create a file or overwrite an existing one with the given contents. Prompts the user for permission first and shows a diff preview.",
@@ -6896,7 +7661,7 @@ var editTool;
 var init_edit = __esm({
   "src/tools/edit.ts"() {
     "use strict";
-    init_paths();
+    init_paths2();
     editTool = {
       name: "edit",
       description: "Replace an exact string in a file. If replace_all is false (default), the old_string must appear exactly once or the call fails. Prompts the user for permission first and shows a diff preview.",
@@ -6937,7 +7702,7 @@ var init_edit = __esm({
 // src/tools/bash.ts
 import { spawn } from "child_process";
 import { tmpdir, platform as platform2 } from "os";
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 function getShellCommand(override) {
   const raw = override?.trim();
   if (raw && raw !== "auto") {
@@ -7139,7 +7904,7 @@ function injectCoauthor(command, coauthor) {
   if (movesHeadOnly) return unchanged;
   const env2 = {
     [COAUTHOR_TRAILER_ENV]: trailer,
-    [COAUTHOR_MSG_ENV]: join14(tmpdir(), `kf-coauthor-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`)
+    [COAUTHOR_MSG_ENV]: join16(tmpdir(), `kf-coauthor-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`)
   };
   if (createsCommit || isRebaseContinue) {
     return { command: `(${command}) && { ${AMEND_BLOCK}
@@ -7232,7 +7997,8 @@ ${stderr}`
       resolve15({
         content: raw,
         rawBytes: Buffer.byteLength(raw, "utf8"),
-        reducedBytes: Buffer.byteLength(raw, "utf8")
+        reducedBytes: Buffer.byteLength(raw, "utf8"),
+        meta: { exitCode: code, timedOut: killedByTimeout }
       });
     });
   });
@@ -7280,7 +8046,7 @@ var init_bash = __esm({
 
 // src/util/glob.ts
 import { readdir as readdir3, lstat, realpath } from "fs/promises";
-import { join as join15, relative as relative2, resolve as resolve2 } from "path";
+import { join as join17, relative as relative2, resolve as resolve2 } from "path";
 function parsePattern(pattern) {
   const parts = pattern.split(/\//g);
   return parts.map((p) => {
@@ -7321,8 +8087,8 @@ function globToRegex(glob2) {
   re += "$";
   return new RegExp(re);
 }
-function matchSegment(segment, pattern) {
-  return globToRegex(pattern).test(segment);
+function matchSegment(segment2, pattern) {
+  return globToRegex(pattern).test(segment2);
 }
 function shouldIgnore(relativePath, ignorePatterns) {
   for (const pat of ignorePatterns) {
@@ -7389,7 +8155,7 @@ async function* walk(root, pattern, options) {
         if (!dot && name.startsWith(".")) continue;
         const matched = seg.type === "literal" ? seg.value === name : matchSegment(name, seg.value);
         if (!matched) continue;
-        const childPath = join15(dirPath, name);
+        const childPath = join17(dirPath, name);
         const childRel = [...relativeParts, name];
         const childRelStr = childRel.join("/");
         if (shouldIgnore(childRelStr, ignorePatterns)) continue;
@@ -7414,7 +8180,7 @@ async function* walk(root, pattern, options) {
       if (!dot && name.startsWith(".")) continue;
       const matched = seg.type === "literal" ? seg.value === name : matchSegment(name, seg.value);
       if (!matched) continue;
-      const childPath = join15(dirPath, name);
+      const childPath = join17(dirPath, name);
       const childRel = [...relativeParts, name];
       const childRelStr = childRel.join("/");
       if (shouldIgnore(childRelStr, ignorePatterns)) continue;
@@ -7456,7 +8222,7 @@ async function* walk(root, pattern, options) {
         const name = String(ent.name);
         if (name === "." || name === "..") continue;
         if (!dot && name.startsWith(".")) continue;
-        const childPath = join15(dirPath, name);
+        const childPath = join17(dirPath, name);
         const childRel = [...relativeParts, name];
         const childRelStr = childRel.join("/");
         if (shouldIgnore(childRelStr, ignorePatterns)) continue;
@@ -7550,7 +8316,7 @@ var globTool;
 var init_glob2 = __esm({
   "src/tools/glob.ts"() {
     "use strict";
-    init_paths();
+    init_paths2();
     init_glob();
     globTool = {
       name: "glob",
@@ -7601,8 +8367,8 @@ var init_glob2 = __esm({
 });
 
 // src/tools/grep.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
 import { readFile as readFile9 } from "fs/promises";
 async function hasRipgrep() {
   if (cachedHasRg !== null) return cachedHasRg;
@@ -7678,9 +8444,9 @@ var pExecFile, cachedHasRg, grepTool;
 var init_grep = __esm({
   "src/tools/grep.ts"() {
     "use strict";
-    init_paths();
+    init_paths2();
     init_glob();
-    pExecFile = promisify(execFile);
+    pExecFile = promisify2(execFile2);
     cachedHasRg = null;
     grepTool = {
       name: "grep",
@@ -8224,7 +8990,7 @@ __export(changelog_image_exports, {
 });
 import { readFile as readFile10 } from "fs/promises";
 import { writeFile as writeFile8 } from "fs/promises";
-import { join as join16 } from "path";
+import { join as join18 } from "path";
 async function githubFetch2(path, token) {
   const controller = new AbortController();
   const timer3 = setTimeout(() => controller.abort(), TIMEOUT_MS4);
@@ -8255,7 +9021,7 @@ function escapeXml(str) {
 }
 async function loadLogoBase64() {
   try {
-    const buf = await readFile10(join16(process.cwd(), "docs", "logo.png"));
+    const buf = await readFile10(join18(process.cwd(), "docs", "logo.png"));
     return `data:image/png;base64,${buf.toString("base64")}`;
   } catch {
     return null;
@@ -8563,7 +9329,7 @@ Format your response as plain text bullet points, one per line, starting with "\
 // src/tools/browser.ts
 import { mkdir as mkdir8 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join17, dirname as dirname8 } from "path";
+import { join as join19, dirname as dirname8 } from "path";
 async function autoScroll(page) {
   await page.evaluate(async () => {
     await new Promise((resolve15) => {
@@ -8639,7 +9405,7 @@ var init_browser = __esm({
           }
           let screenshotPath;
           if (args.screenshot) {
-            screenshotPath = join17(tmpdir2(), `kimiflare-browser-${Date.now()}.png`);
+            screenshotPath = join19(tmpdir2(), `kimiflare-browser-${Date.now()}.png`);
             await mkdir8(dirname8(screenshotPath), { recursive: true });
             await page.screenshot({ path: screenshotPath, fullPage: true });
           }
@@ -8893,13 +9659,13 @@ var init_memory = __esm({
 });
 
 // src/tools/hotcell-snapshot.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile as execFile3 } from "child_process";
 import { mkdtemp, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join18 } from "path";
-import { promisify as promisify2 } from "util";
+import { join as join20 } from "path";
+import { promisify as promisify3 } from "util";
 async function git(args, cwd, env2) {
-  const { stdout } = await execFileAsync("git", args, {
+  const { stdout } = await execFileAsync2("git", args, {
     cwd,
     env: env2 ? { ...process.env, ...env2 } : process.env,
     maxBuffer: 64 * 1024 * 1024,
@@ -8908,7 +9674,7 @@ async function git(args, cwd, env2) {
   return stdout.toString("utf8");
 }
 async function gitBuffer(args, cwd) {
-  const { stdout } = await execFileAsync("git", args, { cwd, maxBuffer: 64 * 1024 * 1024, encoding: "buffer" });
+  const { stdout } = await execFileAsync2("git", args, { cwd, maxBuffer: 64 * 1024 * 1024, encoding: "buffer" });
   return stdout;
 }
 async function originBranchesContaining(commit, cwd) {
@@ -8944,9 +9710,9 @@ async function getRepositorySnapshot(cwd) {
   if (!ref) {
     throw new Error("Could not find an origin branch containing the base commit. Run git fetch, then retry.");
   }
-  const scratch = await mkdtemp(join18(tmpdir3(), "autopilot-snapshot-"));
+  const scratch = await mkdtemp(join20(tmpdir3(), "autopilot-snapshot-"));
   try {
-    const env2 = { GIT_INDEX_FILE: join18(scratch, "index") };
+    const env2 = { GIT_INDEX_FILE: join20(scratch, "index") };
     await git(["read-tree", "HEAD"], root, env2);
     await git(["add", "-A", "--", ".", ...SECRET_EXCLUDES], root, env2);
     const tree = (await git(["write-tree"], root, env2)).trim();
@@ -8971,9 +9737,9 @@ async function getRepositorySnapshot(cwd) {
 async function getWorkingTreeArchive(cwd, limitBytes = MAX_ARCHIVE_BYTES) {
   const root = (await git(["rev-parse", "--show-toplevel"], cwd).catch(() => "")).trim();
   if (!root) throw new Error("Subagents need to run inside a Git repository.");
-  const scratch = await mkdtemp(join18(tmpdir3(), "autopilot-archive-"));
+  const scratch = await mkdtemp(join20(tmpdir3(), "autopilot-archive-"));
   try {
-    const env2 = { GIT_INDEX_FILE: join18(scratch, "index") };
+    const env2 = { GIT_INDEX_FILE: join20(scratch, "index") };
     const hasHead = await git(["rev-parse", "--verify", "-q", "HEAD"], root).then(() => true, () => false);
     await git(hasHead ? ["read-tree", "HEAD"] : ["read-tree", "--empty"], root, env2);
     await git(["add", "-A", "--", ".", ...SECRET_EXCLUDES], root, env2);
@@ -8995,11 +9761,11 @@ function chunkPayload(base64, chunkSize = PAYLOAD_CHUNK_CHARS) {
   for (let i = 0; i < base64.length; i += chunkSize) chunks.push(base64.slice(i, i + chunkSize));
   return chunks;
 }
-var execFileAsync, MAX_SNAPSHOT_PATCH_BYTES, MAX_ARCHIVE_BYTES, SECRET_EXCLUDES, PAYLOAD_CHUNK_CHARS;
+var execFileAsync2, MAX_SNAPSHOT_PATCH_BYTES, MAX_ARCHIVE_BYTES, SECRET_EXCLUDES, PAYLOAD_CHUNK_CHARS;
 var init_hotcell_snapshot = __esm({
   "src/tools/hotcell-snapshot.ts"() {
     "use strict";
-    execFileAsync = promisify2(execFile2);
+    execFileAsync2 = promisify3(execFile3);
     MAX_SNAPSHOT_PATCH_BYTES = 4 * 1024 * 1024;
     MAX_ARCHIVE_BYTES = 24 * 1024 * 1024;
     SECRET_EXCLUDES = [
@@ -9022,11 +9788,11 @@ var init_hotcell_snapshot = __esm({
 
 // src/tools/hotcell-worker-cache.ts
 import { mkdir as mkdir9, readFile as readFile11, writeFile as writeFile10 } from "fs/promises";
-import { homedir as homedir10 } from "os";
-import { dirname as dirname9, join as join19 } from "path";
+import { homedir as homedir11 } from "os";
+import { dirname as dirname9, join as join21 } from "path";
 function workerCachePath() {
-  const xdg = process.env.XDG_CONFIG_HOME || join19(homedir10(), ".config");
-  return join19(xdg, "kimiflare", "hotcell-worker-cache.json");
+  const xdg = process.env.XDG_CONFIG_HOME || join21(homedir11(), ".config");
+  return join21(xdg, "kimiflare", "hotcell-worker-cache.json");
 }
 async function readCache2() {
   try {
@@ -9098,8 +9864,8 @@ var init_hotcell_worker_cache = __esm({
 
 // src/tools/hotcell-worker.ts
 import { spawn as spawn2 } from "child_process";
-import { promisify as promisify3 } from "util";
-import { execFile as execFile3 } from "child_process";
+import { promisify as promisify4 } from "util";
+import { execFile as execFile4 } from "child_process";
 import { resolve as resolve3 } from "path";
 async function runHotcellWorker(options) {
   const workerId = `hotcell-${crypto.randomUUID().slice(0, 8)}`;
@@ -9505,7 +10271,7 @@ function releaseSlot() {
   runningWorkers = Math.max(0, runningWorkers - 1);
   for (const wake of workerQueue.slice()) wake();
 }
-var execFileAsync2, MAX_OUTPUT_BYTES, MAX_PROMPT_CHARS, DEFAULT_CELL_TIMEOUT_MS, DEFAULT_SETUP_TIMEOUT_MS, WORKER_BIN, PACKAGE_SPEC, LOCATE_REPO_ROOT, READ_REPO_ROOT, REPO_ASIDE, SNAPSHOT_PREFIX, ARCHIVE_ROOT, MAX_PARALLEL_WORKERS, MIN_WORKER_INPUT_TOKENS, MAX_WORKER_INPUT_TOKENS, DEFAULT_WORKER_INPUT_TOKENS, INPUT_SHARE_OF_BUDGET, MAX_REPORT_FINDINGS, MAX_REPORT_SUMMARY_CHARS, MAX_REPORT_LIST_ITEMS, runningWorkers, workerQueue, WORKER_REPORT_INSTRUCTIONS;
+var execFileAsync3, MAX_OUTPUT_BYTES, MAX_PROMPT_CHARS, DEFAULT_CELL_TIMEOUT_MS, DEFAULT_SETUP_TIMEOUT_MS, WORKER_BIN, PACKAGE_SPEC, LOCATE_REPO_ROOT, READ_REPO_ROOT, REPO_ASIDE, SNAPSHOT_PREFIX, ARCHIVE_ROOT, MAX_PARALLEL_WORKERS, MIN_WORKER_INPUT_TOKENS, MAX_WORKER_INPUT_TOKENS, DEFAULT_WORKER_INPUT_TOKENS, INPUT_SHARE_OF_BUDGET, MAX_REPORT_FINDINGS, MAX_REPORT_SUMMARY_CHARS, MAX_REPORT_LIST_ITEMS, runningWorkers, workerQueue, WORKER_REPORT_INSTRUCTIONS;
 var init_hotcell_worker = __esm({
   "src/tools/hotcell-worker.ts"() {
     "use strict";
@@ -9514,7 +10280,7 @@ var init_hotcell_worker = __esm({
     init_registry();
     init_hotcell_snapshot();
     init_hotcell_worker_cache();
-    execFileAsync2 = promisify3(execFile3);
+    execFileAsync3 = promisify4(execFile4);
     MAX_OUTPUT_BYTES = 1e6;
     MAX_PROMPT_CHARS = 4e4;
     DEFAULT_CELL_TIMEOUT_MS = 3e5;
@@ -9636,11 +10402,11 @@ var init_worker_registry = __esm({
 
 // src/tools/subagent-stats.ts
 import { appendFile as appendFile2, mkdir as mkdir10, readFile as readFile12 } from "fs/promises";
-import { homedir as homedir11 } from "os";
-import { dirname as dirname10, join as join20 } from "path";
+import { homedir as homedir12 } from "os";
+import { dirname as dirname10, join as join22 } from "path";
 function subagentStatsPath() {
-  const xdg = process.env.XDG_DATA_HOME || join20(homedir11(), ".local", "share");
-  return join20(xdg, "kimiflare", "subagents.jsonl");
+  const xdg = process.env.XDG_DATA_HOME || join22(homedir12(), ".local", "share");
+  return join22(xdg, "kimiflare", "subagents.jsonl");
 }
 async function recordSubagentEvent(event) {
   const path = subagentStatsPath();
@@ -9866,16 +10632,29 @@ var init_subagent = __esm({
         }
         const handle = workerRegistry.start(args.mission, model, ctx.signal);
         const startedAt2 = Date.now();
-        const record = (status, extra = {}) => void recordSubagentEvent({
-          kind: "subagent",
-          ts: Date.now(),
-          sessionId: ctx.sessionId ?? "unknown",
-          status,
-          durationMs: Date.now() - startedAt2,
-          costUsd: extra.costUsd ?? 0,
-          ...failureReason(extra.error) ? { reason: failureReason(extra.error) } : {},
-          ...extra.localChanges ? { localChanges: extra.localChanges } : {}
-        });
+        const record = (status, extra = {}) => {
+          void recordSubagentEvent({
+            kind: "subagent",
+            ts: Date.now(),
+            sessionId: ctx.sessionId ?? "unknown",
+            status,
+            durationMs: Date.now() - startedAt2,
+            costUsd: extra.costUsd ?? 0,
+            ...failureReason(extra.error) ? { reason: failureReason(extra.error) } : {},
+            ...extra.localChanges ? { localChanges: extra.localChanges } : {}
+          });
+          ctx.trace?.emit(
+            "subagent",
+            {
+              worker_id: handle.id,
+              mode: "hotcell",
+              status,
+              ...extra.costUsd !== void 0 ? { cost_usd: extra.costUsd } : {},
+              duration_ms: Date.now() - startedAt2
+            },
+            ctx.turnId ?? null
+          );
+        };
         let result2;
         try {
           result2 = await runHotcellWorker({
@@ -10547,13 +11326,13 @@ var init_expand_artifact = __esm({
 // src/jobs/manager.ts
 import Database from "better-sqlite3";
 import { spawn as spawn3, execFileSync } from "child_process";
-import { mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync3, readSync, existsSync as existsSync2, statSync as statSync3, closeSync, rmSync } from "fs";
-import { homedir as homedir12 } from "os";
-import { dirname as dirname11, join as join21 } from "path";
-import { randomUUID as randomUUID3 } from "crypto";
+import { mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync4, readSync, existsSync as existsSync4, statSync as statSync3, closeSync, rmSync } from "fs";
+import { homedir as homedir13 } from "os";
+import { dirname as dirname11, join as join23 } from "path";
+import { randomUUID as randomUUID4 } from "crypto";
 function defaultJobDbPath() {
-  const root = process.env.XDG_STATE_HOME || join21(homedir12(), ".local", "state");
-  return process.env.AUTOPILOT_JOBS_DB || join21(root, "autopilot", "jobs.db");
+  const root = process.env.XDG_STATE_HOME || join23(homedir13(), ".local", "state");
+  return process.env.AUTOPILOT_JOBS_DB || join23(root, "autopilot", "jobs.db");
 }
 function isProcessGroupAlive(pgid) {
   try {
@@ -10571,7 +11350,7 @@ function waitForProcessStartTime(pid, jobId, exitPath) {
   let previous = null;
   const title = `autopilot-job-${jobId}`;
   while (Date.now() < deadline) {
-    if (existsSync2(exitPath)) break;
+    if (existsSync4(exitPath)) break;
     const current = readProcessStartTime(pid);
     const hasUniqueTitle = process.platform !== "darwin" || current?.includes(title) === true;
     if (current && current === previous && hasUniqueTitle && !isZombie(pid)) return current;
@@ -10583,8 +11362,8 @@ function waitForProcessStartTime(pid, jobId, exitPath) {
 function readProcessStartTime(pid) {
   if (process.platform === "linux") {
     try {
-      const stat10 = readFileSync3(`/proc/${pid}/stat`, "utf8");
-      const fieldsAfterCommand = stat10.slice(stat10.lastIndexOf(")") + 1).trim().split(/\s+/);
+      const stat11 = readFileSync4(`/proc/${pid}/stat`, "utf8");
+      const fieldsAfterCommand = stat11.slice(stat11.lastIndexOf(")") + 1).trim().split(/\s+/);
       return fieldsAfterCommand[19] ? `linux:${fieldsAfterCommand[19]}` : null;
     } catch {
       return null;
@@ -10696,9 +11475,9 @@ child.on('close', (code, signal) => {
       db;
       jobsDir;
       constructor(dbPath = defaultJobDbPath()) {
-        mkdirSync3(dirname11(dbPath), { recursive: true, mode: 448 });
-        this.jobsDir = join21(dirname11(dbPath), "jobs");
-        mkdirSync3(this.jobsDir, { recursive: true, mode: 448 });
+        mkdirSync5(dirname11(dbPath), { recursive: true, mode: 448 });
+        this.jobsDir = join23(dirname11(dbPath), "jobs");
+        mkdirSync5(this.jobsDir, { recursive: true, mode: 448 });
         this.db = new Database(dbPath);
         this.db.pragma("journal_mode = WAL");
         this.db.pragma("busy_timeout = 5000");
@@ -10747,14 +11526,14 @@ child.on('close', (code, signal) => {
           const existing = this.db.prepare("SELECT * FROM jobs WHERE cwd = ? AND idempotency_key = ?").get(options.cwd, options.idempotencyKey);
           if (existing) return toJobRecord(existing);
         }
-        const id = randomUUID3();
-        const jobDir = join21(this.jobsDir, id);
-        mkdirSync3(jobDir, { recursive: true, mode: 448 });
+        const id = randomUUID4();
+        const jobDir = join23(this.jobsDir, id);
+        mkdirSync5(jobDir, { recursive: true, mode: 448 });
         const paths = {
-          stdoutPath: join21(jobDir, "stdout.log"),
-          stderrPath: join21(jobDir, "stderr.log"),
-          exitPath: join21(jobDir, "exit.json"),
-          pidPath: join21(jobDir, "pid")
+          stdoutPath: join23(jobDir, "stdout.log"),
+          stderrPath: join23(jobDir, "stderr.log"),
+          exitPath: join23(jobDir, "exit.json"),
+          pidPath: join23(jobDir, "pid")
         };
         const now2 = Date.now();
         try {
@@ -10807,7 +11586,7 @@ child.on('close', (code, signal) => {
         const row = this.getRow(id);
         if (!row) throw new Error(`Job not found: ${id}`);
         const path = stream === "stdout" ? row.stdout_path : row.stderr_path;
-        if (!existsSync2(path)) return { content: "", offset: 0, size: 0, truncated: false };
+        if (!existsSync4(path)) return { content: "", offset: 0, size: 0, truncated: false };
         const size = statSync3(path).size;
         if (options.offset !== void 0) {
           const offset = Math.max(0, Math.min(size, Math.trunc(options.offset)));
@@ -10875,9 +11654,9 @@ child.on('close', (code, signal) => {
       reconcile() {
         const rows = this.db.prepare("SELECT * FROM jobs WHERE status IN ('starting', 'running', 'cancelling', 'unknown')").all();
         for (const row of rows) {
-          if (existsSync2(row.exit_path)) {
+          if (existsSync4(row.exit_path)) {
             try {
-              const result2 = JSON.parse(readFileSync3(row.exit_path, "utf8"));
+              const result2 = JSON.parse(readFileSync4(row.exit_path, "utf8"));
               const status = result2.timedOut ? "timed_out" : row.status === "cancelling" ? "cancelled" : result2.code === 0 ? "completed" : "failed";
               this.db.prepare("UPDATE jobs SET status = ?, exit_code = ?, finished_at = COALESCE(finished_at, ?) WHERE id = ?").run(status, result2.code, Date.now(), row.id);
               continue;
@@ -10885,8 +11664,8 @@ child.on('close', (code, signal) => {
             }
           }
           let pid = row.pid;
-          if (!pid && existsSync2(row.pid_path)) {
-            const parsed = Number(readFileSync3(row.pid_path, "utf8").trim());
+          if (!pid && existsSync4(row.pid_path)) {
+            const parsed = Number(readFileSync4(row.pid_path, "utf8").trim());
             if (Number.isInteger(parsed) && parsed > 0) pid = parsed;
           }
           if (pid && row.process_start_time) {
@@ -11032,13 +11811,13 @@ ${result2.content}`;
 
 // src/runs/store.ts
 import Database2 from "better-sqlite3";
-import { createHash, randomUUID as randomUUID4 } from "crypto";
-import { chmodSync, mkdirSync as mkdirSync4 } from "fs";
-import { homedir as homedir13 } from "os";
-import { dirname as dirname12, join as join22 } from "path";
+import { createHash as createHash2, randomUUID as randomUUID5 } from "crypto";
+import { chmodSync, mkdirSync as mkdirSync6 } from "fs";
+import { homedir as homedir14 } from "os";
+import { dirname as dirname12, join as join24 } from "path";
 function defaultRunsDbPath() {
-  const root = process.env.XDG_STATE_HOME || join22(homedir13(), ".local", "state");
-  return process.env.AUTOPILOT_RUNS_DB || join22(root, "autopilot", "runs.db");
+  const root = process.env.XDG_STATE_HOME || join24(homedir14(), ".local", "state");
+  return process.env.AUTOPILOT_RUNS_DB || join24(root, "autopilot", "runs.db");
 }
 function validateOptionalPositiveInteger(name, value, minimum = 1) {
   if (value !== null && (!Number.isSafeInteger(value) || value < minimum)) {
@@ -11054,7 +11833,7 @@ function stableJson(value) {
   }
 }
 function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
+  return createHash2("sha256").update(value).digest("hex");
 }
 function rowToRun(row) {
   return {
@@ -11126,7 +11905,7 @@ var init_store = __esm({
     RunStore = class {
       db;
       constructor(dbPath = defaultRunsDbPath()) {
-        mkdirSync4(dirname12(dbPath), { recursive: true, mode: 448 });
+        mkdirSync6(dirname12(dbPath), { recursive: true, mode: 448 });
         this.db = new Database2(dbPath);
         this.db.pragma("journal_mode = WAL");
         this.db.pragma("foreign_keys = ON");
@@ -11231,7 +12010,7 @@ var init_store = __esm({
         if (maxCostUsd !== null && (!Number.isFinite(maxCostUsd) || maxCostUsd < 0.01)) {
           throw new Error("maxCostUsd must be null or a finite number greater than or equal to 0.01");
         }
-        const id = input.id ?? input.worktree?.runId ?? randomUUID4();
+        const id = input.id ?? input.worktree?.runId ?? randomUUID5();
         if (!id.trim()) throw new Error("id must not be empty");
         if (input.worktree && input.worktree.runId !== id) throw new Error("worktree runId must match run id");
         const now2 = Date.now();
@@ -11425,7 +12204,7 @@ var init_store = __esm({
           throw new Error("intervalMs must be an integer from 1000 through 604800000");
         }
         this.assertRunExists(input.runId);
-        const id = randomUUID4();
+        const id = randomUUID5();
         const now2 = Date.now();
         this.db.prepare(`INSERT INTO run_timers
       (id, run_id, condition_type, job_id, wake_at, interval_ms, status, max_attempts, created_at)
@@ -11721,6 +12500,12 @@ function capContentForHook(s) {
   return `${cut}
 [\u2026truncated for hook payload]`;
 }
+function tracePermissionDecision(result2) {
+  if (result2.decision === "deny") return "deny";
+  if (result2.scope === "session") return "allow_session";
+  if (result2.scope === "pattern") return "auto";
+  return "allow";
+}
 function isDiffCommand(cmd) {
   const trimmed = cmd.trim();
   if (/^git\s+show(?:\s|$)/.test(trimmed)) return true;
@@ -11741,11 +12526,13 @@ function normalizeToolOutput(result2) {
 function truncateForError(s) {
   return s.length <= 200 ? s : `${s.slice(0, 200)}... [${s.length - 200} more chars]`;
 }
-var ALL_TOOLS, RESEARCH_WORKER_TOOL_NAMES, SENSITIVE_RESEARCH_PATHS, HOOK_RESULT_CONTENT_CAP_BYTES, ToolExecutor;
+var ALL_TOOLS, RESEARCH_WORKER_TOOL_NAMES, SENSITIVE_RESEARCH_PATHS, HOOK_RESULT_CONTENT_CAP_BYTES, ToolExecutor, TRACE_ARGS_INLINE_MAX, ToolTrace;
 var init_executor = __esm({
   "src/tools/executor.ts"() {
     "use strict";
     init_tool_error();
+    init_verification();
+    init_git_delta();
     init_read();
     init_write();
     init_edit();
@@ -11825,17 +12612,25 @@ var init_executor = __esm({
        *  every `run` call regardless of caller (standard agent loop,
        *  code-mode sandbox, init turn, SDK, CLI print mode). */
       hooks;
+      /** Default session trace recorder; `ctx.trace` (set by the agent loop)
+       *  takes precedence per call. */
+      trace;
       constructor(tools = ALL_TOOLS, opts2) {
         this.tools = new Map(tools.map((t) => [t.name, t]));
         this.artifactStore = new ToolArtifactStore();
         this.tools.set("expand_artifact", makeExpandArtifactTool(this.artifactStore));
         this.hooks = opts2?.hooks ?? null;
+        this.trace = opts2?.trace ?? null;
       }
       /** Swap or detach the hooks manager. Used by app startup so the
        *  executor created before the manager exists can pick it up later. */
       setHooks(hooks) {
         this.hooks = hooks;
       }
+      /** Swap or detach the default trace recorder (e.g. when the TUI starts a new session). */
+      setTrace(trace) {
+        this.trace = trace;
+      }
       list() {
         return [...this.tools.values()];
       }
@@ -11852,8 +12647,17 @@ var init_executor = __esm({
         this.artifactStore.clear();
       }
       async run(call, askPermission, ctx, onFileChange) {
+        const trace = ctx.trace ?? this.trace;
+        if (!trace?.enabled) return this.runInner(call, askPermission, ctx, onFileChange, null);
+        const tr = new ToolTrace(trace, ctx, call);
+        const result2 = await this.runInner(call, askPermission, ctx, onFileChange, tr);
+        tr.finish(result2);
+        return result2;
+      }
+      async runInner(call, askPermission, ctx, onFileChange, tr) {
         const tool = this.tools.get(call.name) ?? (call.name === "spawn_worker" ? this.tools.get("subagent") : void 0);
         if (!tool) {
+          tr?.call(null, false);
           return {
             tool_call_id: call.id,
             name: call.name,
@@ -11867,6 +12671,7 @@ var init_executor = __esm({
         try {
           args = call.arguments.trim() ? JSON.parse(call.arguments) : {};
         } catch (e) {
+          tr?.call(null, tool.needsPermission);
           return {
             tool_call_id: call.id,
             name: call.name,
@@ -11877,6 +12682,7 @@ var init_executor = __esm({
             suggestion: "reformulate the tool call with valid JSON arguments"
           };
         }
+        tr?.call(args, tool.needsPermission);
         if (this.hooks?.hasEnabledHooks("PreToolUse")) {
           const preOutcome = await this.hooks.fire(
             "PreToolUse",
@@ -11908,8 +12714,10 @@ var init_executor = __esm({
         if (tool.needsPermission) {
           const sessionKey = this.permissionKey(tool, args);
           if (!this.sessionAllowed.has(sessionKey)) {
+            const askedAt = performance.now();
             const raw = await askPermission({ tool, args, sessionKey });
             const result2 = toPermissionResult(raw);
+            tr?.permission(tracePermissionDecision(result2), Math.round(performance.now() - askedAt), result2.feedback);
             if (result2.decision === "deny") {
               const denied = {
                 tool_call_id: call.id,
@@ -11924,7 +12732,11 @@ var init_executor = __esm({
               return denied;
             }
             if (result2.scope === "session") this.sessionAllowed.add(sessionKey);
+          } else {
+            tr?.permission("auto", 0);
           }
+        } else {
+          tr?.permission("auto", 0);
         }
         let runStore = null;
         let intentRecorded = false;
@@ -11938,6 +12750,7 @@ var init_executor = __esm({
           const result2 = await tool.run(args, ctx);
           toolCompleted = true;
           const normalized = normalizeToolOutput(result2);
+          tr?.raw(normalized);
           if (runStore && ctx.runId) {
             runStore.recordToolResult(ctx.runId, call.id, call.name, { ok: true, content: normalized.content });
           }
@@ -11991,6 +12804,7 @@ var init_executor = __esm({
           if (e instanceof RunToolBudgetExceededError) ctx.onRunBudgetExceeded?.(e.reason);
           const err = wrapAsToolError(e);
           const msg = `Error running ${call.name}: ${err.message}`;
+          tr?.raw({ content: msg, rawBytes: Buffer.byteLength(msg, "utf8"), reducedBytes: Buffer.byteLength(msg, "utf8") });
           const failure = {
             tool_call_id: call.id,
             name: call.name,
@@ -12051,6 +12865,121 @@ var init_executor = __esm({
         return tool.name;
       }
     };
+    TRACE_ARGS_INLINE_MAX = 2 * 1024;
+    ToolTrace = class {
+      constructor(trace, ctx, invocation) {
+        this.trace = trace;
+        this.invocation = invocation;
+        this.turnId = ctx.turnId ?? null;
+        this.parentId = ctx.codeModeParentToolCallId;
+        this.sessionId = ctx.sessionId;
+      }
+      trace;
+      invocation;
+      startedAt = performance.now();
+      turnId;
+      parentId;
+      sessionId;
+      rawOutput = null;
+      argsBlob = "";
+      args = null;
+      /** The call was parsed (args null when the arguments were not valid JSON). */
+      call(args, needsPermission) {
+        this.args = args;
+        this.argsBlob = this.trace.blob(this.invocation.arguments) ?? "";
+        if (this.parentId) return;
+        const payload = {
+          tool_call_id: this.invocation.id,
+          name: this.invocation.name,
+          args_blob: this.argsBlob,
+          ...args && this.invocation.arguments.length <= TRACE_ARGS_INLINE_MAX ? { args_inline: args } : {},
+          needs_permission: needsPermission,
+          code_mode_redirected: false
+        };
+        this.trace.emit("tool_call", payload, this.turnId);
+      }
+      permission(decision, latencyMs, feedback) {
+        this.trace.emit(
+          "permission_decision",
+          {
+            tool_call_id: this.invocation.id,
+            decision,
+            ...feedback ? { feedback_text: feedback } : {},
+            latency_ms: latencyMs
+          },
+          this.turnId
+        );
+      }
+      /** The tool's output before reduction. */
+      raw(output) {
+        this.rawOutput = output;
+      }
+      finish(result2) {
+        const durationMs = Math.round(performance.now() - this.startedAt);
+        const rawContent = this.rawOutput?.content ?? result2.content;
+        const rawBlob = this.trace.blob(rawContent) ?? "";
+        this.outcomes(result2);
+        if (this.parentId) {
+          this.trace.emit(
+            "code_mode_call",
+            {
+              parent_tool_call_id: this.parentId,
+              name: this.invocation.name,
+              args_blob: this.argsBlob,
+              raw_blob: rawBlob,
+              ok: result2.ok,
+              duration_ms: durationMs
+            },
+            this.turnId
+          );
+          return;
+        }
+        const meta = this.rawOutput?.meta;
+        const payload = {
+          tool_call_id: this.invocation.id,
+          name: this.invocation.name,
+          ok: result2.ok,
+          ...result2.errorCode ? { error_code: result2.errorCode } : {},
+          raw_blob: rawBlob,
+          raw_bytes: Buffer.byteLength(rawContent, "utf8"),
+          reduced_blob: rawContent === result2.content ? rawBlob : this.trace.blob(result2.content) ?? "",
+          reduced_bytes: Buffer.byteLength(result2.content, "utf8"),
+          ...result2.artifactId ? { artifact_id: result2.artifactId } : {},
+          ...meta && meta.exitCode !== void 0 && meta.exitCode !== null ? { exit_code: meta.exitCode } : {},
+          ...meta?.timedOut !== void 0 ? { timed_out: meta.timedOut } : {},
+          duration_ms: durationMs
+        };
+        this.trace.emit("tool_result", payload, this.turnId);
+      }
+      /** Outcome signals a bash call carries: a verification exit code, or a git revert of the last delta. */
+      outcomes(result2) {
+        if (this.invocation.name !== "bash") return;
+        const command = this.args?.command;
+        if (typeof command !== "string" || !command.trim()) return;
+        const exitCode = this.rawOutput?.meta?.exitCode;
+        const category = classifyVerification(command);
+        if (category && typeof exitCode === "number") {
+          this.trace.emit(
+            "outcome",
+            {
+              kind: "verification",
+              turn_id: this.turnId ?? "",
+              tool_call_id: this.invocation.id,
+              command,
+              category,
+              exit_code: exitCode
+            },
+            this.turnId
+          );
+        }
+        if (result2.ok && this.sessionId) {
+          const reverted = detectGitRevert(this.sessionId, command);
+          if (reverted) {
+            this.trace.emit("outcome", { kind: "reverted", turn_id: reverted.turnId, how: "git_checkout" }, this.turnId);
+          }
+        }
+      }
+    };
   }
 });
 
@@ -12068,11 +12997,11 @@ __export(sessions_exports, {
   sessionsDir: () => sessionsDir
 });
 import { readFile as readFile13, writeFile as writeFile11, mkdir as mkdir11, readdir as readdir4, stat as stat5 } from "fs/promises";
-import { homedir as homedir14 } from "os";
-import { join as join23 } from "path";
+import { homedir as homedir15 } from "os";
+import { join as join25 } from "path";
 function sessionsDir() {
-  const xdg = process.env.XDG_DATA_HOME || join23(homedir14(), ".local", "share");
-  return join23(xdg, "kimiflare", "sessions");
+  const xdg = process.env.XDG_DATA_HOME || join25(homedir15(), ".local", "share");
+  return join25(xdg, "kimiflare", "sessions");
 }
 function sanitize(text) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
@@ -12092,7 +13021,7 @@ function makeSessionId(firstPrompt) {
 async function saveSession(file) {
   const dir = sessionsDir();
   await mkdir11(dir, { recursive: true });
-  const path = join23(dir, `${file.id}.json`);
+  const path = join25(dir, `${file.id}.json`);
   await writeFile11(path, JSON.stringify(file, null, 2), "utf8");
   return path;
 }
@@ -12112,7 +13041,7 @@ async function listSessions(limit = 30, cwd) {
   const summaries = [];
   for (const name of entries) {
     if (!name.endsWith(".json")) continue;
-    const path = join23(dir, name);
+    const path = join25(dir, name);
     try {
       const [s, raw] = await Promise.all([stat5(path), readFile13(path, "utf8")]);
       const parsed = JSON.parse(raw);
@@ -12223,7 +13152,7 @@ var init_image = __esm({
 
 // src/permissions-evaluator.ts
 import { resolve as resolve5, relative as relative4 } from "path";
-import { homedir as homedir15 } from "os";
+import { homedir as homedir16 } from "os";
 function evaluatePermissionRules(req, rules) {
   const toolRules = rules[req.tool];
   if (!toolRules) return "ask";
@@ -12239,7 +13168,7 @@ function evaluatePermissionRules(req, rules) {
 }
 function expandHome(path) {
   if (path.startsWith("~/")) {
-    return resolve5(homedir15(), path.slice(2));
+    return resolve5(homedir16(), path.slice(2));
   }
   return path;
 }
@@ -12265,7 +13194,7 @@ function extractTarget(tool, args, cwd) {
 function matchPattern(target, pattern, cwd) {
   let expandedPattern = pattern;
   if (pattern.startsWith("~/")) {
-    expandedPattern = resolve5(homedir15(), pattern.slice(2));
+    expandedPattern = resolve5(homedir16(), pattern.slice(2));
   }
   if (target.startsWith(expandedPattern)) {
     return true;
@@ -12342,9 +13271,237 @@ var init_classify = __esm({
   }
 });
 
+// src/trace/retention.ts
+var retention_exports = {};
+__export(retention_exports, {
+  listTraceSessions: () => listTraceSessions,
+  pruneTraces: () => pruneTraces
+});
+import { readdir as readdir5, rm as rm3, stat as stat6 } from "fs/promises";
+import { join as join26 } from "path";
+async function dirSize(path) {
+  let total = 0;
+  const entries = await readdir5(path, { withFileTypes: true });
+  for (const entry of entries) {
+    const p = join26(path, entry.name);
+    if (entry.isDirectory()) total += await dirSize(p);
+    else if (entry.isFile()) {
+      try {
+        total += (await stat6(p)).size;
+      } catch {
+      }
+    }
+  }
+  return total;
+}
+async function listTraceSessions(root) {
+  const base = traceRoot(root);
+  let names;
+  try {
+    names = await readdir5(base);
+  } catch {
+    return [];
+  }
+  const sessions = [];
+  for (const name of names) {
+    const path = join26(base, name);
+    try {
+      const s = await stat6(path);
+      if (!s.isDirectory()) continue;
+      let mtime = s.mtime;
+      try {
+        mtime = (await stat6(join26(path, TRACE_FILE_NAME))).mtime;
+      } catch {
+      }
+      sessions.push({ sessionId: name, path, mtime, bytes: await dirSize(path) });
+    } catch {
+    }
+  }
+  sessions.sort((a, b) => b.mtime.getTime() - a.mtime.getTime());
+  return sessions;
+}
+async function pruneTraces(opts2 = {}) {
+  const maxAgeDays = opts2.maxAgeDays ?? RETENTION.traceMaxAgeDays;
+  const maxTotalBytes = opts2.maxTotalBytes ?? RETENTION.traceMaxTotalBytes;
+  const maxSessionBytes = opts2.maxSessionBytes ?? RETENTION.traceMaxSessionBytes;
+  const now2 = opts2.now ?? Date.now();
+  const cutoff = now2 - maxAgeDays * 24 * 60 * 60 * 1e3;
+  const removed = [];
+  let sessions;
+  try {
+    sessions = await listTraceSessions(opts2.root);
+  } catch {
+    return { removed, keptBytes: 0 };
+  }
+  const remove = async (s) => {
+    try {
+      await rm3(s.path, { recursive: true, force: true });
+      removed.push(s.sessionId);
+    } catch {
+    }
+  };
+  const kept = [];
+  for (const s of sessions) {
+    if (s.mtime.getTime() < cutoff || s.bytes > maxSessionBytes) await remove(s);
+    else kept.push(s);
+  }
+  let total = kept.reduce((sum, s) => sum + s.bytes, 0);
+  while (total > maxTotalBytes && kept.length > 0) {
+    const oldest = kept.pop();
+    await remove(oldest);
+    total -= oldest.bytes;
+  }
+  return { removed, keptBytes: total };
+}
+var init_retention = __esm({
+  "src/trace/retention.ts"() {
+    "use strict";
+    init_storage_limits();
+    init_paths();
+  }
+});
+
+// src/trace/session-start.ts
+import { execFile as execFile5 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { dirname as dirname13, join as join27 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+import { promisify as promisify5 } from "util";
+async function git2(args, cwd) {
+  try {
+    const { stdout } = await execFileAsync4("git", args, { cwd, timeout: 3e3, windowsHide: true });
+    const out = stdout.trim();
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+function harnessCheckoutDir() {
+  const here = dirname13(fileURLToPath4(import.meta.url));
+  for (const candidate of [join27(here, "..", ".."), join27(here, "..")]) {
+    if (existsSync5(join27(candidate, "package.json")) && existsSync5(join27(candidate, ".git"))) return candidate;
+  }
+  return null;
+}
+async function resolveHarnessCommit() {
+  const dir = harnessCheckoutDir();
+  if (!dir) return null;
+  return git2(["rev-parse", "HEAD"], dir);
+}
+async function collectSessionStart(opts2, blob) {
+  const toolsJson = JSON.stringify(opts2.tools);
+  const [harnessCommit, repoRemote, repoHead] = await Promise.all([
+    resolveHarnessCommit(),
+    git2(["remote", "get-url", "origin"], opts2.cwd),
+    git2(["rev-parse", "HEAD"], opts2.cwd)
+  ]);
+  return {
+    autopilot_version: getAppVersion(),
+    harness_commit: harnessCommit,
+    cwd: opts2.cwd,
+    repo_remote: repoRemote,
+    repo_head: repoHead,
+    model: opts2.model,
+    mode: opts2.mode,
+    config: redactConfig(opts2.config ?? {}),
+    tool_profile: opts2.toolProfile ?? "full",
+    tool_schemas_sha: sha256Hex(toolsJson),
+    tools_blob: blob(toolsJson) ?? "",
+    system_prompt_sha: sha256Hex(opts2.systemPrompt)
+  };
+}
+async function emitSessionStart(recorder, opts2) {
+  if (!recorder.enabled) return;
+  const payload = await collectSessionStart(opts2, (content) => recorder.blob(content));
+  recorder.emit("session_start", payload, null);
+}
+var execFileAsync4;
+var init_session_start = __esm({
+  "src/trace/session-start.ts"() {
+    "use strict";
+    init_version();
+    init_blobs();
+    init_redact();
+    execFileAsync4 = promisify5(execFile5);
+  }
+});
+
+// src/trace/compaction.ts
+function traceCompiledCompaction(trace, result2, turnId = null) {
+  if (!trace?.enabled || result2.metrics.rawTurnsRemoved === 0) return;
+  trace.emit(
+    "compaction",
+    {
+      method: "compiled",
+      tokens_before: result2.metrics.estimatedTokensBefore,
+      tokens_after: result2.metrics.estimatedTokensAfter,
+      turns_removed: result2.metrics.rawTurnsRemoved,
+      artifacts_archived: result2.metrics.archivedArtifacts
+    },
+    turnId
+  );
+}
+function traceLlmCompaction(trace, before, result2, turnId = null) {
+  if (!trace?.enabled || result2.replacedCount === 0) return;
+  trace.emit(
+    "compaction",
+    {
+      method: "llm",
+      tokens_before: estimatePromptTokens(before),
+      tokens_after: estimatePromptTokens(result2.newMessages),
+      turns_removed: result2.replacedCount,
+      ...result2.summary ? { summary_blob: trace.blob(result2.summary) ?? "" } : {}
+    },
+    turnId
+  );
+}
+var init_compaction = __esm({
+  "src/trace/compaction.ts"() {
+    "use strict";
+    init_artifact_compaction();
+  }
+});
+
+// src/trace/next-message.ts
+function classifyNextMessage(text) {
+  const trimmed = text.trim();
+  if (!trimmed) return "other";
+  if (trimmed.startsWith("/")) return "other";
+  if (CORRECTION.test(trimmed)) return "correction";
+  if (CONTINUE.test(trimmed)) return "continue";
+  if (trimmed.endsWith("?")) return "question";
+  return "new_task";
+}
+var CORRECTION, CONTINUE;
+var init_next_message = __esm({
+  "src/trace/next-message.ts"() {
+    "use strict";
+    CORRECTION = /^(no\b|nope\b|wrong\b|that's not\b|that is not\b|thats not\b|not what\b|undo\b|revert\b|stop\b|don't\b|dont\b)/i;
+    CONTINUE = /^(go on\b|continue\b|yes\b|yep\b|yeah\b|ok\b|okay\b|do it\b|proceed\b|sure\b|sounds good\b|lgtm\b|looks good\b|next\b)/i;
+  }
+});
+
+// src/trace/index.ts
+var init_trace = __esm({
+  "src/trace/index.ts"() {
+    "use strict";
+    init_types();
+    init_recorder();
+    init_blobs();
+    init_redact();
+    init_paths();
+    init_retention();
+    init_session_start();
+    init_compaction();
+    init_verification();
+    init_next_message();
+    init_git_delta();
+  }
+});
+
 // src/hooks/types.ts
 var HOOK_EVENTS;
-var init_types = __esm({
+var init_types2 = __esm({
   "src/hooks/types.ts"() {
     "use strict";
     HOOK_EVENTS = [
@@ -12358,21 +13515,21 @@ var init_types = __esm({
 });
 
 // src/hooks/settings.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, mkdirSync as mkdirSync5, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir16 } from "os";
-import { join as join24, dirname as dirname13 } from "path";
-import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync6, readFileSync as readFileSync5, mkdirSync as mkdirSync7, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir17 } from "os";
+import { join as join28, dirname as dirname14 } from "path";
+import { createHash as createHash3 } from "crypto";
 function globalSettingsPath() {
-  const xdg = process.env.XDG_CONFIG_HOME || join24(homedir16(), ".config");
-  return join24(xdg, "kimiflare", "settings.json");
+  const xdg = process.env.XDG_CONFIG_HOME || join28(homedir17(), ".config");
+  return join28(xdg, "kimiflare", "settings.json");
 }
 function projectSettingsPath(cwd) {
-  return join24(cwd, ".kimiflare", "settings.json");
+  return join28(cwd, ".kimiflare", "settings.json");
 }
 function readSettingsFile(path) {
-  if (!existsSync3(path)) return null;
+  if (!existsSync6(path)) return null;
   try {
-    const raw = readFileSync4(path, "utf8");
+    const raw = readFileSync5(path, "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
@@ -12380,7 +13537,7 @@ function readSettingsFile(path) {
   }
 }
 function deriveHookId(event, command) {
-  const h = createHash2("sha256").update(`${event}\0${command}`).digest("hex");
+  const h = createHash3("sha256").update(`${event}\0${command}`).digest("hex");
   return h.slice(0, 8);
 }
 function normalizeHook(event, raw, source) {
@@ -12443,8 +13600,8 @@ function appendHook(scope, cwd, event, hook) {
     return rest;
   });
   existing.hooks = hooks;
-  mkdirSync5(dirname13(path), { recursive: true });
-  writeFileSync3(path, JSON.stringify(existing, null, 2) + "\n", "utf8");
+  mkdirSync7(dirname14(path), { recursive: true });
+  writeFileSync4(path, JSON.stringify(existing, null, 2) + "\n", "utf8");
   return path;
 }
 function setHookEnabled(cwd, id, enabled2) {
@@ -12469,8 +13626,8 @@ function setHookEnabled(cwd, id, enabled2) {
       }
     }
     if (changed) {
-      mkdirSync5(dirname13(path), { recursive: true });
-      writeFileSync3(path, JSON.stringify(existing, null, 2) + "\n", "utf8");
+      mkdirSync7(dirname14(path), { recursive: true });
+      writeFileSync4(path, JSON.stringify(existing, null, 2) + "\n", "utf8");
       return path;
     }
     void scope;
@@ -12480,7 +13637,7 @@ function setHookEnabled(cwd, id, enabled2) {
 var init_settings = __esm({
   "src/hooks/settings.ts"() {
     "use strict";
-    init_types();
+    init_types2();
   }
 });
 
@@ -12698,11 +13855,11 @@ __export(cost_verify_exports, {
   verifyTurn: () => verifyTurn
 });
 import { readFile as readFile16 } from "fs/promises";
-import { homedir as homedir17 } from "os";
-import { join as join25 } from "path";
+import { homedir as homedir18 } from "os";
+import { join as join29 } from "path";
 function usagePath2() {
-  const xdg = process.env.XDG_DATA_HOME || join25(homedir17(), ".local", "share");
-  return join25(xdg, "kimiflare", "usage.json");
+  const xdg = process.env.XDG_DATA_HOME || join29(homedir18(), ".local", "share");
+  return join29(xdg, "kimiflare", "usage.json");
 }
 async function loadSessions() {
   try {
@@ -12795,7 +13952,7 @@ var init_cost_verify = __esm({
 
 // src/cost-attribution/types.ts
 var ALL_CATEGORIES;
-var init_types2 = __esm({
+var init_types3 = __esm({
   "src/cost-attribution/types.ts"() {
     "use strict";
     ALL_CATEGORIES = [
@@ -12874,7 +14031,7 @@ function buildReport(opts2) {
 var init_report = __esm({
   "src/cost-attribution/report.ts"() {
     "use strict";
-    init_types2();
+    init_types3();
   }
 });
 
@@ -13238,11 +14395,11 @@ var init_heuristic = __esm({
 
 // src/cost-attribution/classify-from-session.ts
 import { readFile as readFile17 } from "fs/promises";
-import { join as join26 } from "path";
-import { homedir as homedir18 } from "os";
+import { join as join30 } from "path";
+import { homedir as homedir19 } from "os";
 function sessionsDir2() {
-  const xdg = process.env.XDG_DATA_HOME || join26(homedir18(), ".local", "share");
-  return join26(xdg, "kimiflare", "sessions");
+  const xdg = process.env.XDG_DATA_HOME || join30(homedir19(), ".local", "share");
+  return join30(xdg, "kimiflare", "sessions");
 }
 function parseToolCalls(calls) {
   return calls.map((c) => {
@@ -13256,7 +14413,7 @@ function parseToolCalls(calls) {
 }
 async function classifyFromSessionFile(sessionId) {
   try {
-    const raw = await readFile17(join26(sessionsDir2(), `${sessionId}.json`), "utf8");
+    const raw = await readFile17(join30(sessionsDir2(), `${sessionId}.json`), "utf8");
     const session = JSON.parse(raw);
     const messages = session.messages ?? [];
     const turns = [];
@@ -13290,14 +14447,14 @@ __export(cli_exports, {
   runCostCommand: () => runCostCommand
 });
 import { readFile as readFile18 } from "fs/promises";
-import { join as join27 } from "path";
-import { homedir as homedir19 } from "os";
+import { join as join31 } from "path";
+import { homedir as homedir20 } from "os";
 function usageDir2() {
-  const xdg = process.env.XDG_DATA_HOME || join27(homedir19(), ".local", "share");
-  return join27(xdg, "kimiflare");
+  const xdg = process.env.XDG_DATA_HOME || join31(homedir20(), ".local", "share");
+  return join31(xdg, "kimiflare");
 }
 function usagePath3() {
-  return join27(usageDir2(), "usage.json");
+  return join31(usageDir2(), "usage.json");
 }
 function today2() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -13399,7 +14556,7 @@ __export(aster_workspaces_exports, {
   findAsterWorkspace: () => findAsterWorkspace,
   loadAsterServerConfig: () => loadAsterServerConfig
 });
-import { readFile as readFile19, realpath as realpath3, stat as stat6 } from "fs/promises";
+import { readFile as readFile19, realpath as realpath3, stat as stat7 } from "fs/promises";
 import { isAbsolute as isAbsolute3, relative as relative5, sep as sep3 } from "path";
 async function loadAsterServerConfig(configPath3 = process.env.AUTOPILOT_ASTER_CONFIG || "/etc/autopilot/aster.json") {
   let raw;
@@ -13441,7 +14598,7 @@ async function loadAsterServerConfig(configPath3 = process.env.AUTOPILOT_ASTER_C
     let rootPath;
     try {
       rootPath = await realpath3(workspace.rootPath);
-      if (!(await stat6(rootPath)).isDirectory()) throw new Error("not a directory");
+      if (!(await stat7(rootPath)).isDirectory()) throw new Error("not a directory");
     } catch {
       throw new AsterConfigError();
     }
@@ -13481,16 +14638,16 @@ __export(aster_store_exports, {
   defaultAsterDbPath: () => defaultAsterDbPath
 });
 import Database3 from "better-sqlite3";
-import { createHash as createHash3, randomBytes as randomBytes2, randomUUID as randomUUID5 } from "crypto";
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync6 } from "fs";
-import { homedir as homedir20 } from "os";
-import { dirname as dirname14, join as join28 } from "path";
+import { createHash as createHash4, randomBytes as randomBytes2, randomUUID as randomUUID6 } from "crypto";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync8 } from "fs";
+import { homedir as homedir21 } from "os";
+import { dirname as dirname15, join as join32 } from "path";
 function defaultAsterDbPath() {
-  const root = process.env.XDG_STATE_HOME || join28(homedir20(), ".local", "state");
-  return process.env.AUTOPILOT_ASTER_DB || join28(root, "autopilot", "aster.db");
+  const root = process.env.XDG_STATE_HOME || join32(homedir21(), ".local", "state");
+  return process.env.AUTOPILOT_ASTER_DB || join32(root, "autopilot", "aster.db");
 }
 function hashToken(token) {
-  return createHash3("sha256").update(token).digest("hex");
+  return createHash4("sha256").update(token).digest("hex");
 }
 function cellMappingFromRow(row) {
   return {
@@ -13554,9 +14711,9 @@ var init_aster_store = __esm({
     AsterStore = class {
       db;
       constructor(dbPath = defaultAsterDbPath()) {
-        mkdirSync6(dirname14(dbPath), { recursive: true, mode: 448 });
+        mkdirSync8(dirname15(dbPath), { recursive: true, mode: 448 });
         try {
-          chmodSync2(dirname14(dbPath), 448);
+          chmodSync2(dirname15(dbPath), 448);
         } catch {
         }
         this.db = new Database3(dbPath);
@@ -13667,8 +14824,8 @@ var init_aster_store = __esm({
         this.db.close();
       }
       reserveCellConversation(input) {
-        const keyHash = createHash3("sha256").update(input.idempotencyKey).digest("hex");
-        const fingerprint = createHash3("sha256").update(JSON.stringify([input.workspaceId, input.model])).digest("hex");
+        const keyHash = createHash4("sha256").update(input.idempotencyKey).digest("hex");
+        const fingerprint = createHash4("sha256").update(JSON.stringify([input.workspaceId, input.model])).digest("hex");
         const reserve = this.db.transaction(() => {
           const existing = this.db.prepare("SELECT * FROM aster_cell_mappings WHERE credential_id = ? AND create_key_hash = ?").get(input.credentialId, keyHash);
           if (existing) {
@@ -13719,7 +14876,7 @@ var init_aster_store = __esm({
         const scopes = [...new Set(input.scopes)];
         if (scopes.length === 0 || scopes.some((scope) => !VALID_SCOPES.has(scope))) throw new Error("credential scopes are invalid");
         if (!Number.isSafeInteger(input.expiresAt) || input.expiresAt <= Date.now()) throw new Error("credential expiry must be in the future");
-        const id = randomUUID5();
+        const id = randomUUID6();
         const token = `aster_${randomBytes2(32).toString("base64url")}`;
         const now2 = Date.now();
         this.db.prepare(`INSERT INTO aster_credentials
@@ -13892,7 +15049,7 @@ var init_aster_store = __esm({
         }));
       }
       createApproval(input) {
-        const id = randomUUID5();
+        const id = randomUUID6();
         const now2 = Date.now();
         this.db.prepare(`INSERT INTO aster_approvals
       (id, conversation_id, run_id, tool_name, explanation, arguments_json, status, expires_at, created_at)
@@ -14553,13 +15710,13 @@ var init_openapi = __esm({
 });
 
 // src/runs/worktrees.ts
-import { execFile as execFile4 } from "child_process";
+import { execFile as execFile6 } from "child_process";
 import { access as access2, chmod as chmod2, mkdir as mkdir12, realpath as realpath4 } from "fs/promises";
-import { homedir as homedir21 } from "os";
-import { isAbsolute as isAbsolute4, join as join29, parse, relative as relative6, resolve as resolve7, sep as sep4 } from "path";
+import { homedir as homedir22 } from "os";
+import { isAbsolute as isAbsolute4, join as join33, parse, relative as relative6, resolve as resolve7, sep as sep4 } from "path";
 function defaultWorktreesDir() {
-  const dataHome = process.env.XDG_DATA_HOME || join29(homedir21(), ".local", "share");
-  return join29(dataHome, "autopilot", "worktrees");
+  const dataHome = process.env.XDG_DATA_HOME || join33(homedir22(), ".local", "share");
+  return join33(dataHome, "autopilot", "worktrees");
 }
 function isOutside(path) {
   return path === ".." || path.startsWith(`..${sep4}`) || isAbsolute4(path);
@@ -14570,7 +15727,7 @@ function isWithin2(parent, candidate) {
 }
 function runGit(args, cwd) {
   return new Promise((resolveOutput, reject) => {
-    execFile4("git", args, { cwd, encoding: "utf8", timeout: 3e4, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
+    execFile6("git", args, { cwd, encoding: "utf8", timeout: 3e4, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
       if (error) {
         const detail = stderr.trim();
         reject(new Error(`git ${args[0]} failed${detail ? `: ${detail}` : ""}`, { cause: error }));
@@ -14610,7 +15767,7 @@ var init_worktrees = __esm({
           throw new Error("worktree root must be outside the source repository");
         }
         await chmod2(worktreesRoot, 448);
-        const worktreePath = join29(worktreesRoot, runId);
+        const worktreePath = join33(worktreesRoot, runId);
         try {
           await access2(worktreePath);
           throw new Error(`worktree path already exists for run ${runId}`);
@@ -14787,11 +15944,11 @@ __export(openrouter_catalog_exports, {
   mapOpenRouterModel: () => mapOpenRouterModel
 });
 import { readFile as readFile20, writeFile as writeFile12, mkdir as mkdir13 } from "fs/promises";
-import { homedir as homedir22 } from "os";
-import { join as join30, dirname as dirname15 } from "path";
+import { homedir as homedir23 } from "os";
+import { join as join34, dirname as dirname16 } from "path";
 function catalogCachePath() {
-  const xdg = process.env.XDG_CONFIG_HOME || join30(homedir22(), ".config");
-  return join30(xdg, "kimiflare", "openrouter-models.json");
+  const xdg = process.env.XDG_CONFIG_HOME || join34(homedir23(), ".config");
+  return join34(xdg, "kimiflare", "openrouter-models.json");
 }
 function perMtok(perToken) {
   const n = Number(perToken);
@@ -14852,7 +16009,7 @@ async function readCache3() {
 async function writeCache3(models) {
   const path = catalogCachePath();
   try {
-    await mkdir13(dirname15(path), { recursive: true });
+    await mkdir13(dirname16(path), { recursive: true });
     const cache = { version: CACHE_VERSION, fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), models };
     await writeFile12(path, JSON.stringify(cache, null, 2), "utf8");
   } catch {
@@ -15083,7 +16240,7 @@ var init_aster_tools = __esm({
     init_edit();
     init_read();
     init_write();
-    init_paths();
+    init_paths2();
     ASTR_TOOLS = [readTool, writeTool, editTool];
     SENSITIVE_NAMES = /* @__PURE__ */ new Set([
       ".git",
@@ -15105,9 +16262,9 @@ var init_aster_tools = __esm({
 
 // src/server/aster-memory.ts
 import Database4 from "better-sqlite3";
-import { randomUUID as randomUUID6 } from "crypto";
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync7 } from "fs";
-import { dirname as dirname16 } from "path";
+import { randomUUID as randomUUID7 } from "crypto";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync9 } from "fs";
+import { dirname as dirname17 } from "path";
 function rowToItem(row) {
   return {
     id: row.id,
@@ -15160,7 +16317,7 @@ var init_aster_memory = __esm({
     AsterMemory = class {
       constructor(dbPath = defaultAsterDbPath(), options = {}) {
         this.options = options;
-        mkdirSync7(dirname16(dbPath), { recursive: true, mode: 448 });
+        mkdirSync9(dirname17(dbPath), { recursive: true, mode: 448 });
         this.db = new Database4(dbPath);
         this.db.pragma("journal_mode = WAL");
         this.db.pragma("busy_timeout = 5000");
@@ -15224,7 +16381,7 @@ var init_aster_memory = __esm({
           this.db.prepare("UPDATE aster_memories SET title = ?, content = ?, pinned = ?, updated_at = ? WHERE id = ?").run(title, content, existing.pinned || input.pinned ? 1 : 0, now2, existing.id);
           return { item: this.get(existing.id), change: "updated" };
         }
-        const id = randomUUID6();
+        const id = randomUUID7();
         this.db.prepare(`INSERT INTO aster_memories (id, kind, key, title, content, pinned, source_conversation_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, input.kind, input.key ?? null, title, content, input.pinned ? 1 : 0, input.sourceConversationId ?? null, now2, now2);
         return { item: this.get(id), change: "added" };
@@ -15436,9 +16593,9 @@ var init_aster_github_proxy = __esm({
       }
       handle(req, res) {
         const url = new URL(req.url ?? "/", "http://proxy.local");
-        const git2 = url.pathname.match(GIT_PATH_RE);
-        const api = git2 ? null : url.pathname.match(API_PATH_RE);
-        if (!git2 && !api) return deny(res, 404, "Only this conversation's repository is reachable");
+        const git3 = url.pathname.match(GIT_PATH_RE);
+        const api = git3 ? null : url.pathname.match(API_PATH_RE);
+        if (!git3 && !api) return deny(res, 404, "Only this conversation's repository is reachable");
         const grantToken = extractToken(req);
         if (!grantToken) {
           res.writeHead(401, { "www-authenticate": 'Basic realm="aster-github"', "content-type": "text/plain" });
@@ -15447,18 +16604,18 @@ var init_aster_github_proxy = __esm({
         }
         const grant = this.options.resolveGrant(grantToken);
         if (!grant) return deny(res, 403, "This repository grant is invalid or was revoked");
-        const [, owner, name] = git2 ?? api;
+        const [, owner, name] = git3 ?? api;
         if (`${owner}/${name}`.toLowerCase() !== grant.repository.toLowerCase()) {
           return deny(res, 403, `This conversation can only access ${grant.repository}`);
         }
-        const upstream = git2 ? new URL(`/${owner}/${name}.git/${git2[3]}${url.search}`, this.gitUpstream) : new URL(`/repos/${owner}/${name}${api[3] ?? ""}${url.search}`, this.apiUpstream);
+        const upstream = git3 ? new URL(`/${owner}/${name}.git/${git3[3]}${url.search}`, this.gitUpstream) : new URL(`/repos/${owner}/${name}${api[3] ?? ""}${url.search}`, this.apiUpstream);
         const headers = {};
         for (const name2 of FORWARDED_REQUEST_HEADERS) {
           const value = req.headers[name2];
           if (typeof value === "string") headers[name2] = value;
         }
         headers["user-agent"] ??= "autopilot-aster";
-        headers.authorization = git2 ? "Basic " + Buffer.from(`x-access-token:${this.options.token}`).toString("base64") : `Bearer ${this.options.token}`;
+        headers.authorization = git3 ? "Basic " + Buffer.from(`x-access-token:${this.options.token}`).toString("base64") : `Bearer ${this.options.token}`;
         const send = upstream.protocol === "https:" ? httpsRequest : httpRequest;
         const forward = send(upstream, { method: req.method, headers }, (upstreamRes) => {
           const responseHeaders = {};
@@ -15481,7 +16638,7 @@ var init_aster_github_proxy = __esm({
 // src/server/aster-push.ts
 import Database5 from "better-sqlite3";
 import { createSign } from "crypto";
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { connect } from "http2";
 function truncate2(value, limit) {
   const clean = value.replace(/\s+/g, " ").trim();
@@ -15599,7 +16756,7 @@ var init_aster_push = __esm({
       token() {
         const now2 = Math.floor(Date.now() / 1e3);
         if (this.jwt && now2 - this.jwt.issuedAt < 50 * 60) return this.jwt.value;
-        this.privateKey ??= readFileSync5(this.options.keyPath, "utf8");
+        this.privateKey ??= readFileSync6(this.options.keyPath, "utf8");
         const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
         const unsigned = `${encode({ alg: "ES256", kid: this.options.keyId })}.${encode({ iss: this.options.teamId, iat: now2 })}`;
         const signature = createSign("SHA256").update(unsigned).sign({ key: this.privateKey, dsaEncoding: "ieee-p1363" }).toString("base64url");
@@ -15611,7 +16768,7 @@ var init_aster_push = __esm({
 });
 
 // src/server/aster-api.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { unlink as unlink2 } from "fs/promises";
 import { resolve as resolve8 } from "path";
 function parseCursor(header, query) {
@@ -16168,8 +17325,8 @@ var init_aster_api = __esm({
         };
       }
       async createConversation(res, store, principal, workspace, model, idempotencyKey, kind, repository) {
-        const candidateId = randomUUID7();
-        const candidateSessionId = randomUUID7();
+        const candidateId = randomUUID8();
+        const candidateSessionId = randomUUID8();
         const reservation = store.reserveCellConversation({
           conversationId: candidateId,
           credentialId: principal.credentialId,
@@ -16299,7 +17456,7 @@ var init_aster_api = __esm({
           sendError(res, 409, "conversation_cell_unavailable", "Conversation cell is not available");
           return;
         }
-        const runId = randomUUID7();
+        const runId = randomUUID8();
         if (!idempotent && !store.beginTurn(conversation.id, runId)) {
           sendError(res, 409, "conversation_busy", "A turn is already active for this conversation");
           return;
@@ -16747,9 +17904,10 @@ data: ${JSON.stringify(event.data)}
 });
 
 // src/server/aster-cell-runtime.ts
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify4 } from "util";
-import { randomUUID as randomUUID8 } from "crypto";
+import { execFile as execFile7 } from "child_process";
+import { readFile as readFile21 } from "fs/promises";
+import { promisify as promisify6 } from "util";
+import { randomUUID as randomUUID9 } from "crypto";
 async function writeCellFileChunked(cell, path, content) {
   if (Buffer.byteLength(content, "utf8") <= CELL_FILE_WRITE_CHUNK_CHARS) {
     await cell.writeFile(path, content, { mode: "0600" });
@@ -16774,8 +17932,17 @@ async function writeCellFileChunked(cell, path, content) {
     });
   }
 }
+async function readBundledCellSdkBundle() {
+  for (const url of [new URL("./sdk/index.js", import.meta.url), new URL("../sdk/index.js", import.meta.url)]) {
+    try {
+      return await readFile21(url, "utf8");
+    } catch {
+    }
+  }
+  throw new Error("cell_runtime_bundle_unavailable");
+}
 async function defaultArchiveWorkspace(workspaceRoot) {
-  const { stdout } = await execFileAsync3("git", ["-C", workspaceRoot, "archive", "--format=tar", "HEAD"], {
+  const { stdout } = await execFileAsync5("git", ["-C", workspaceRoot, "archive", "--format=tar", "HEAD"], {
     encoding: "buffer",
     maxBuffer: 512 * 1024 * 1024
   });
@@ -16823,17 +17990,19 @@ ${redacted.slice(-half)}`;
 function sleep4(ms) {
   return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
-var execFileAsync3, CELL_WORKSPACE, CELL_STATE_DIR, CHECKPOINT_MESSAGE_FILE, INSTALLED_RUNTIME_PACKAGE, NOTES_FILE, MEMORY_FILE, MEMORY_EXTRACTION_TIMEOUT_MS, LIVENESS_CHECK_MS, ARTIFACTS_DIR, MAX_ARTIFACTS, MAX_ARTIFACT_BYTES, BRANCH_RE, REPOSITORY_RE, GIT, COMMIT_SHA_RE, MAX_TOOL_OUTPUT_CHARS, MAX_TOOL_INPUT_CHARS, MAX_CHECKPOINTS, CELL_CONTROL_DIR, BRIDGE_MARKER, CONTROL_RUNNER, BRIDGE_RUNNER, HEALTH_TIMEOUT_MS, EVENT_POLL_MS, AsterHotcellRuntime, CELL_FILE_WRITE_CHUNK_CHARS, ARTIFACT_MIME_TYPES;
+var execFileAsync5, CELL_WORKSPACE, CELL_STATE_DIR, CHECKPOINT_MESSAGE_FILE, CELL_RUNTIME_DIR, INSTALLED_RUNTIME_PACKAGE, CELL_RUNTIME_SDK_ENTRY, NOTES_FILE, MEMORY_FILE, MEMORY_EXTRACTION_TIMEOUT_MS, LIVENESS_CHECK_MS, ARTIFACTS_DIR, MAX_ARTIFACTS, MAX_ARTIFACT_BYTES, BRANCH_RE, REPOSITORY_RE, GIT, COMMIT_SHA_RE, MAX_TOOL_OUTPUT_CHARS, MAX_TOOL_INPUT_CHARS, MAX_CHECKPOINTS, CELL_CONTROL_DIR, BRIDGE_MARKER, CONTROL_RUNNER, BRIDGE_RUNNER, HEALTH_TIMEOUT_MS, EVENT_POLL_MS, AsterHotcellRuntime, CELL_FILE_WRITE_CHUNK_CHARS, ARTIFACT_MIME_TYPES;
 var init_aster_cell_runtime = __esm({
   "src/server/aster-cell-runtime.ts"() {
     "use strict";
     init_version();
     init_aster_tools();
-    execFileAsync3 = promisify4(execFile5);
+    execFileAsync5 = promisify6(execFile7);
     CELL_WORKSPACE = "/workspace";
     CELL_STATE_DIR = "/workspace/.aster";
     CHECKPOINT_MESSAGE_FILE = `${CELL_STATE_DIR}/checkpoint-message`;
-    INSTALLED_RUNTIME_PACKAGE = "/opt/autopilot/node_modules/autopilot-ai/package.json";
+    CELL_RUNTIME_DIR = "/opt/autopilot/node_modules/autopilot-ai";
+    INSTALLED_RUNTIME_PACKAGE = `${CELL_RUNTIME_DIR}/package.json`;
+    CELL_RUNTIME_SDK_ENTRY = `${CELL_RUNTIME_DIR}/dist/sdk/index.js`;
     NOTES_FILE = `${CELL_STATE_DIR}/pending-notes`;
     MEMORY_FILE = `${CELL_STATE_DIR}/memory.md`;
     MEMORY_EXTRACTION_TIMEOUT_MS = 15e3;
@@ -16858,6 +18027,7 @@ var init_aster_cell_runtime = __esm({
       constructor(provider, options = {}) {
         this.provider = provider;
         this.packageSpec = options.autopilotPackageSpec ?? `autopilot-ai@${getAppVersion()}`;
+        this.cellRuntimeSdkBundle = options.cellRuntimeSdkBundle;
         this.archiveWorkspace = options.archiveWorkspace ?? defaultArchiveWorkspace;
         this.pollIntervalMs = options.pollIntervalMs ?? EVENT_POLL_MS;
         this.healthTimeoutMs = options.healthTimeoutMs ?? HEALTH_TIMEOUT_MS;
@@ -16872,6 +18042,7 @@ var init_aster_cell_runtime = __esm({
       }
       provider;
       packageSpec;
+      cellRuntimeSdkBundle;
       archiveWorkspace;
       pollIntervalMs;
       healthTimeoutMs;
@@ -16932,7 +18103,7 @@ var init_aster_cell_runtime = __esm({
         await this.installRuntime(cell);
         await this.ensureBridge(cell);
         await this.control(cell, "POST", "/rpc", {
-          id: randomUUID8(),
+          id: randomUUID9(),
           type: "new_session",
           sessionId: input.sessionId,
           config: { model: input.model, cwd: CELL_WORKSPACE }
@@ -16951,7 +18122,7 @@ var init_aster_cell_runtime = __esm({
       /** Switch the cell session's model between turns. The bridge persists it for session restore. */
       async setModel(cellId, model) {
         await this.ensureReady(cellId);
-        await this.controlById(cellId, "POST", "/rpc", { id: randomUUID8(), type: "set_model", modelId: model });
+        await this.controlById(cellId, "POST", "/rpc", { id: randomUUID9(), type: "set_model", modelId: model });
       }
       /** Reinstall the runtime if the cell's image lost it and restart the bridge if it isn't running. */
       async ensureReady(cellId) {
@@ -17014,7 +18185,7 @@ var init_aster_cell_runtime = __esm({
         const active = this.activeRuns.get(runId);
         if (!active) return;
         active.stop();
-        void this.controlById(active.cellId, "POST", "/rpc", { id: randomUUID8(), type: "abort" }).catch(() => {
+        void this.controlById(active.cellId, "POST", "/rpc", { id: randomUUID9(), type: "abort" }).catch(() => {
         });
       }
       async runTurn(turn, options = {}) {
@@ -17113,7 +18284,7 @@ ${turn.userText}` : turn.userText;
                   args: event.args ?? {}
                 });
                 await this.controlById(cellId, "POST", "/rpc", {
-                  id: randomUUID8(),
+                  id: randomUUID9(),
                   type: "resolve_permission",
                   requestId: event.requestId,
                   decision
@@ -17241,9 +18412,9 @@ ${turn.userText}` : turn.userText;
         if (!isSafeArtifactPath(path)) throw new Error("invalid_artifact_path");
         const cell = await this.provider.getCell(cellId);
         const file = shellQuote2(`${ARTIFACTS_DIR}/${path}`);
-        const stat10 = await cell.exec(`[ -f ${file} ] && [ ! -L ${file} ] && stat -c %s -- ${file}`);
-        if (stat10.exitCode !== 0) throw new Error("artifact_not_found");
-        if (Number(stat10.stdout.trim()) > MAX_ARTIFACT_BYTES) throw new Error("artifact_too_large");
+        const stat11 = await cell.exec(`[ -f ${file} ] && [ ! -L ${file} ] && stat -c %s -- ${file}`);
+        if (stat11.exitCode !== 0) throw new Error("artifact_not_found");
+        if (Number(stat11.stdout.trim()) > MAX_ARTIFACT_BYTES) throw new Error("artifact_too_large");
         const encoded = await cell.exec(`base64 -w0 -- ${file}`);
         if (encoded.exitCode !== 0) throw new Error("artifact_not_found");
         return { data: Buffer.from(encoded.stdout.trim(), "base64"), mimeType: artifactMimeType(path), name: path.split("/").pop() ?? path };
@@ -17268,11 +18439,38 @@ ${text}` : text, { mode: "0600" });
       }
       async installRuntime(cell) {
         const expectedVersion = /@(\d[^@/]*)$/.exec(this.packageSpec)?.[1];
+        let installed;
         try {
-          const installed = JSON.parse(await cell.readFile(INSTALLED_RUNTIME_PACKAGE));
-          if (!expectedVersion || installed.version === expectedVersion) return;
+          installed = JSON.parse(await cell.readFile(INSTALLED_RUNTIME_PACKAGE));
+          if (!expectedVersion || installed?.version === expectedVersion) return;
         } catch {
         }
+        if (installed && expectedVersion) {
+          const sdkBundle = this.cellRuntimeSdkBundle ?? await readBundledCellSdkBundle();
+          await cell.mkdir(`${CELL_RUNTIME_DIR}/dist/sdk`, { parents: true });
+          await writeCellFileChunked(cell, CELL_RUNTIME_SDK_ENTRY, sdkBundle);
+          const bridge = (await cell.listProcesses()).find(
+            (process3) => process3.status === "running" && process3.command.includes(BRIDGE_MARKER)
+          );
+          if (bridge) {
+            await cell.killProcess(bridge.procId);
+            const deadline = Date.now() + 5e3;
+            for (; ; ) {
+              const stillRunning = (await cell.listProcesses()).some(
+                (process3) => process3.procId === bridge.procId && process3.status === "running"
+              );
+              if (!stillRunning) break;
+              if (Date.now() >= deadline) throw new Error("cell_runtime_restart_failed");
+              await sleep4(50);
+            }
+          }
+          await cell.writeFile(
+            INSTALLED_RUNTIME_PACKAGE,
+            JSON.stringify({ ...installed, version: expectedVersion }),
+            { mode: "0600" }
+          );
+          return;
+        }
         const install = await cell.exec(`mkdir -p /opt/autopilot && npm install --prefix /opt/autopilot --no-audit --no-fund ${this.packageSpec}`);
         if (install.exitCode !== 0) throw new Error("cell_runtime_install_failed");
       }
@@ -17295,7 +18493,7 @@ ${text}` : text, { mode: "0600" });
         }
       }
       async control(cell, method, path, body) {
-        const requestId = randomUUID8();
+        const requestId = randomUUID9();
         await cell.mkdir(CELL_CONTROL_DIR, { parents: true });
         await writeCellFileChunked(cell, `${CELL_CONTROL_DIR}/${requestId}.json`, JSON.stringify({ method, path, body }));
         const result2 = await cell.exec(`${CONTROL_RUNNER} ${requestId}`);
@@ -17511,9 +18709,9 @@ var init_hotcell_provider = __esm({
 });
 
 // src/server/routes.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { URL as URL2 } from "url";
-import { readFile as readFile21, unlink as unlink3 } from "fs/promises";
+import { readFile as readFile22, unlink as unlink3 } from "fs/promises";
 import { resolve as resolve9, basename as basename5 } from "path";
 function createHotcellAsterRuntime() {
   try {
@@ -17526,6 +18724,27 @@ function createHotcellAsterRuntime() {
     throw error;
   }
 }
+async function startSessionTrace(config2, sessionFile, tools, messages) {
+  const trace = createRecorder({
+    enabled: config2.trace?.enabled === true,
+    sessionId: sessionFile.id,
+    root: config2.trace?.root
+  });
+  const systemPrompt = messages.filter((m) => m.role === "system" && typeof m.content === "string").map((m) => m.content).join("\n\n");
+  await emitSessionStart(trace, {
+    cwd: sessionFile.cwd,
+    model: sessionFile.model,
+    mode: "server",
+    config: config2,
+    tools: toOpenAIToolDefs(tools),
+    systemPrompt
+  });
+  return trace;
+}
+function traceUserMessage(trace, text, attachments, turnId) {
+  if (!trace?.enabled) return;
+  trace.emit("user_message", { content_blob: trace.blob(text) ?? "", source: "server", attachments }, turnId);
+}
 function parseOptionalBudgetInteger(body, name, minimum = 1) {
   if (!Object.hasOwn(body, name)) return void 0;
   const value = body[name];
@@ -17576,8 +18795,8 @@ async function resolveFiles2(filePatterns, cwd) {
   const resolved = /* @__PURE__ */ new Set();
   for (const pattern of filePatterns) {
     try {
-      const stat10 = await import("fs/promises").then((m) => m.stat(resolve9(cwd, pattern)));
-      if (stat10.isFile()) {
+      const stat11 = await import("fs/promises").then((m) => m.stat(resolve9(cwd, pattern)));
+      if (stat11.isFile()) {
         resolved.add(resolve9(cwd, pattern));
         continue;
       }
@@ -17606,7 +18825,7 @@ async function buildUserMessage2(prompt, files, cwd) {
       }
     } else {
       try {
-        const content = await readFile21(filePath, "utf8");
+        const content = await readFile22(filePath, "utf8");
         const relPath = filePath.startsWith(cwd) ? filePath.slice(cwd.length + 1) : filePath;
         fileContents.push(`
 --- ${relPath} ---
@@ -17645,7 +18864,8 @@ function setupRoutes(config2, options = {}) {
       executor: new ToolExecutor(tools),
       sseClients: /* @__PURE__ */ new Set(),
       runId: run.id,
-      allowedTools
+      allowedTools,
+      trace: await startSessionTrace(config2, sessionFile, tools, sessionFile.messages)
     };
     activeSessions.set(run.sessionId, active);
     activeRuns.set(run.id, active);
@@ -17833,7 +19053,7 @@ function setupRoutes(config2, options = {}) {
         const executor = new ToolExecutor(tools);
         const { makeSessionId: makeSessionId2 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
         const sessionId = makeSessionId2(task);
-        const runId = randomUUID9();
+        const runId = randomUUID10();
         const worktreeManager = new RunWorktreeManager();
         let worktree;
         if (useWorktree) {
@@ -17891,7 +19111,10 @@ function setupRoutes(config2, options = {}) {
           }
           throw error;
         }
+        const runTrace = await startSessionTrace(config2, sessionFile, tools, messages);
+        traceUserMessage(runTrace, task, 0, makeTurnId());
         const active = {
+          trace: runTrace,
           sessionFile,
           messages,
           executor,
@@ -18073,11 +19296,16 @@ function setupRoutes(config2, options = {}) {
         const resolvedFiles = await resolveFiles2(files, cwd);
         const userContent = await buildUserMessage2(prompt, resolvedFiles, cwd);
         messages.push({ role: "user", content: userContent });
+        const trace = await startSessionTrace(config2, sessionFile, ALL_TOOLS, messages);
+        const firstTurnId = makeTurnId();
+        traceUserMessage(trace, prompt, resolvedFiles.length, firstTurnId);
         const active = {
           sessionFile,
           messages,
           executor,
-          sseClients: /* @__PURE__ */ new Set()
+          sseClients: /* @__PURE__ */ new Set(),
+          trace,
+          nextTurnId: firstTurnId
         };
         activeSessions.set(sessionId, active);
         launchAgentTurnForSession(active, config2, allowAll);
@@ -18105,6 +19333,15 @@ function setupRoutes(config2, options = {}) {
         const resolvedFiles = await resolveFiles2(files, active.sessionFile.cwd);
         const userContent = await buildUserMessage2(prompt, resolvedFiles, active.sessionFile.cwd);
         active.messages.push({ role: "user", content: userContent });
+        active.nextTurnId = makeTurnId();
+        if (active.trace?.enabled && active.lastTurnId) {
+          active.trace.emit(
+            "outcome",
+            { kind: "next_message", turn_id: active.lastTurnId, classification: classifyNextMessage(prompt), classifier: "regex" },
+            active.lastTurnId
+          );
+        }
+        traceUserMessage(active.trace, prompt, resolvedFiles.length, active.nextTurnId);
         launchAgentTurnForSession(active, config2, allowAll);
         json2(res, 202, { sessionId, status: "started" });
         return;
@@ -18119,6 +19356,7 @@ function setupRoutes(config2, options = {}) {
     wakeScheduler.dispose();
     for (const [, active] of activeSessions) {
       active.shuttingDown = true;
+      if (active.trace?.enabled) active.trace.emit("session_end", { reason: "exit" }, null);
       active.controller?.abort(new Error("server_shutdown"));
       for (const client of active.sseClients) {
         client.close();
@@ -18287,6 +19525,9 @@ async function runAgentTurnForSession(active, config2, allowAll) {
     }
   };
   const compaction = sessionFileCompactionTarget(sessionFile);
+  const turnId = active.nextTurnId ?? makeTurnId();
+  active.nextTurnId = void 0;
+  active.lastTurnId = turnId;
   try {
     if (run && runStore) {
       const tools = ALL_TOOLS.filter((tool) => active.allowedTools?.has(tool.name));
@@ -18308,6 +19549,8 @@ async function runAgentTurnForSession(active, config2, allowAll) {
         preferPullRequests: config2.preferPullRequests,
         compaction,
         callbacks,
+        trace: active.trace,
+        turnId,
         onIterationEnd: async (updatedMessages) => {
           sessionFile.messages = updatedMessages;
           sessionFile.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -18334,7 +19577,9 @@ async function runAgentTurnForSession(active, config2, allowAll) {
         allowDirectPush: config2.allowDirectPush,
         preferPullRequests: config2.preferPullRequests,
         compaction,
-        callbacks
+        callbacks,
+        trace: active.trace,
+        turnId
       });
     }
     sessionFile.messages = messages;
@@ -18386,6 +19631,8 @@ var init_routes = __esm({
     "use strict";
     init_config();
     init_llm_auth();
+    init_trace();
+    init_registry2();
     init_loop();
     init_system_prompt();
     init_executor();
@@ -18518,8 +19765,8 @@ __export(db_exports, {
   updateMemoryEmbedding: () => updateMemoryEmbedding
 });
 import Database6 from "better-sqlite3";
-import { dirname as dirname17 } from "path";
-import { mkdirSync as mkdirSync8, statSync as statSync4 } from "fs";
+import { dirname as dirname18 } from "path";
+import { mkdirSync as mkdirSync10, statSync as statSync4 } from "fs";
 function initSchema(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS memories (
@@ -18603,7 +19850,7 @@ function openMemoryDb(dbPath) {
   if (dbInstance) {
     dbInstance.close();
   }
-  mkdirSync8(dirname17(dbPath), { recursive: true });
+  mkdirSync10(dirname18(dbPath), { recursive: true });
   dbInstance = new Database6(dbPath);
   dbInstance.pragma("journal_mode = WAL");
   dbInstance.pragma("foreign_keys = ON");
@@ -19737,12 +20984,12 @@ var init_connection = __esm({
 });
 
 // src/lsp/protocol.ts
-import { pathToFileURL as pathToFileURL2, fileURLToPath as fileURLToPath4 } from "url";
+import { pathToFileURL as pathToFileURL2, fileURLToPath as fileURLToPath5 } from "url";
 function toUri(path) {
   return pathToFileURL2(path).href;
 }
 function fromUri(uri) {
-  return fileURLToPath4(uri);
+  return fileURLToPath5(uri);
 }
 function symbolKindName(kind) {
   const names = {
@@ -20553,7 +21800,7 @@ function makeLspTools(manager) {
 var init_lsp = __esm({
   "src/tools/lsp.ts"() {
     "use strict";
-    init_paths();
+    init_paths2();
     init_adapter();
   }
 });
@@ -20568,12 +21815,12 @@ __export(requesty_catalog_exports, {
   loadRequestyCatalog: () => loadRequestyCatalog,
   mapRequestyModel: () => mapRequestyModel
 });
-import { readFile as readFile22, writeFile as writeFile13, mkdir as mkdir14 } from "fs/promises";
-import { homedir as homedir23 } from "os";
-import { join as join32, dirname as dirname18 } from "path";
+import { readFile as readFile23, writeFile as writeFile13, mkdir as mkdir14 } from "fs/promises";
+import { homedir as homedir24 } from "os";
+import { join as join36, dirname as dirname19 } from "path";
 function catalogCachePath2() {
-  const xdg = process.env.XDG_CONFIG_HOME || join32(homedir23(), ".config");
-  return join32(xdg, "kimiflare", "requesty-models.json");
+  const xdg = process.env.XDG_CONFIG_HOME || join36(homedir24(), ".config");
+  return join36(xdg, "kimiflare", "requesty-models.json");
 }
 function isSafeModelId(id) {
   return typeof id === "string" && id.length > 0 && !CONTROL_CHARS.test(id);
@@ -20629,7 +21876,7 @@ async function fetchRequestyCatalog(fetchImpl2 = fetch) {
 }
 async function readCache4() {
   try {
-    const raw = await readFile22(catalogCachePath2(), "utf8");
+    const raw = await readFile23(catalogCachePath2(), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== CACHE_VERSION2) return null;
     return {
@@ -20644,7 +21891,7 @@ async function readCache4() {
 async function writeCache4(catalog) {
   const path = catalogCachePath2();
   try {
-    await mkdir14(dirname18(path), { recursive: true });
+    await mkdir14(dirname19(path), { recursive: true });
     const cache = { version: CACHE_VERSION2, fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), ...catalog };
     await writeFile13(path, JSON.stringify(cache, null, 2), "utf8");
   } catch {
@@ -20736,9 +21983,9 @@ var init_permissions = __esm({
 
 // src/sdk/session.ts
 import { resolve as resolve10 } from "path";
-import { homedir as homedir24 } from "os";
-import { join as join33 } from "path";
-import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir25 } from "os";
+import { join as join37 } from "path";
+import { existsSync as existsSync7 } from "fs";
 async function createAgentSession(opts2) {
   const config2 = await resolveSdkConfig(opts2);
   if (usesRequesty(llmAuthFromConfig(config2))) await ensureRequestyCatalog();
@@ -20754,7 +22001,7 @@ async function createAgentSession(opts2) {
   let memoryManager = null;
   const memoryEnabled = opts2.memoryEnabled ?? config2.memoryEnabled ?? false;
   if (memoryEnabled) {
-    const dbPath = config2.memoryDbPath ?? join33(homedir24(), ".local", "share", "kimiflare", "memory.db");
+    const dbPath = config2.memoryDbPath ?? join37(homedir25(), ".local", "share", "kimiflare", "memory.db");
     memoryManager = new MemoryManager({
       dbPath,
       ...llmAuthFromConfig(config2),
@@ -20784,7 +22031,7 @@ async function createAgentSession(opts2) {
   }
   let sessionFile;
   if (opts2.sessionId) {
-    const filePath = join33(sessionsDir(), `${opts2.sessionId}.json`);
+    const filePath = join37(sessionsDir(), `${opts2.sessionId}.json`);
     try {
       sessionFile = await loadSession(filePath);
     } catch {
@@ -20819,6 +22066,19 @@ async function createAgentSession(opts2) {
     ...sessionFile.messages.filter((m) => m.role !== "system")
   ];
   const isNewSession = sessionFile.messages.length === 0;
+  const trace = createRecorder({
+    enabled: config2.trace?.enabled === true,
+    sessionId: sessionFile.id,
+    root: config2.trace?.root
+  });
+  await emitSessionStart(trace, {
+    cwd,
+    model: config2.model,
+    mode: "sdk",
+    config: config2,
+    tools: toOpenAIToolDefs(allTools),
+    systemPrompt
+  });
   const session = new InternalSession({
     sessionFile,
     cwd,
@@ -20832,7 +22092,8 @@ async function createAgentSession(opts2) {
     permissionHandler: opts2.permissionHandler,
     onKimiMdStale: opts2.onKimiMdStale,
     hooks,
-    provider: opts2.provider
+    provider: opts2.provider,
+    trace
   });
   if (isNewSession) {
     await session.save().catch((err) => {
@@ -20865,6 +22126,8 @@ var init_session = __esm({
     init_context_budget();
     init_config2();
     init_permissions();
+    init_trace();
+    init_registry2();
     InternalSession = class {
       sessionId;
       cwd;
@@ -20880,6 +22143,10 @@ var init_session = __esm({
       onKimiMdStale;
       provider;
       hooks;
+      trace;
+      traceCostUsd = 0;
+      /** Turn id of the last turn that ran, for next-message outcome signals. */
+      lastTurnId = null;
       listeners = /* @__PURE__ */ new Set();
       steerQueue = [];
       followUpQueue = [];
@@ -20920,6 +22187,7 @@ var init_session = __esm({
         this.onKimiMdStale = opts2.onKimiMdStale;
         this.provider = opts2.provider;
         this.hooks = opts2.hooks;
+        this.trace = opts2.trace;
         this.permissionHandler = opts2.permissionHandler ?? createDefaultPermissionHandler({
           mode: this.currentMode,
           onRequest: (req) => {
@@ -20961,8 +22229,8 @@ var init_session = __esm({
           const parts = [{ type: "text", text }];
           for (const img of options.images) {
             if ("path" in img) {
-              const { readFile: readFile31 } = await import("fs/promises");
-              const data = await readFile31(img.path, "base64");
+              const { readFile: readFile32 } = await import("fs/promises");
+              const data = await readFile32(img.path, "base64");
               const mimeType = img.path.endsWith(".png") ? "image/png" : img.path.endsWith(".jpg") || img.path.endsWith(".jpeg") ? "image/jpeg" : "image/webp";
               parts.push({ type: "image_url", image_url: { url: `data:${mimeType};base64,${data}` } });
             } else {
@@ -20973,6 +22241,22 @@ var init_session = __esm({
         }
         const userMessage = { role: "user", content: userContent };
         this.messages.push(userMessage);
+        const turnId = makeTurnId();
+        if (this.trace.enabled) {
+          if (this.lastTurnId) {
+            this.trace.emit(
+              "outcome",
+              { kind: "next_message", turn_id: this.lastTurnId, classification: classifyNextMessage(text), classifier: "regex" },
+              this.lastTurnId
+            );
+          }
+          this.trace.emit(
+            "user_message",
+            { content_blob: this.trace.blob(text) ?? "", source: "sdk", attachments: options?.images?.length ?? 0 },
+            turnId
+          );
+        }
+        this.lastTurnId = turnId;
         this.emit({ type: "message.start", messageId, role: "user" });
         this.emit({ type: "message.end", messageId });
         this.isStreaming = true;
@@ -20980,7 +22264,7 @@ var init_session = __esm({
         this.abortController = new AbortController();
         let succeeded = false;
         try {
-          await this.runTurn(mode, options?.maxToolIterations);
+          await this.runTurn(mode, options?.maxToolIterations, turnId);
           succeeded = true;
           this.isStreaming = false;
           this.emit({ type: "status", status: "idle" });
@@ -21075,6 +22359,9 @@ var init_session = __esm({
       }
       dispose() {
         this.disposed = true;
+        if (this.trace.enabled) {
+          this.trace.emit("session_end", { reason: "exit", ...this.traceCostUsd > 0 ? { total_cost_usd: this.traceCostUsd } : {} }, null);
+        }
         this.denyPendingPermissions();
         this.abortController?.abort();
         this.lspManager?.stopAll().catch(() => {
@@ -21082,7 +22369,7 @@ var init_session = __esm({
         this.memoryManager?.close();
         this.listeners.clear();
       }
-      async runTurn(mode, maxToolIterations) {
+      async runTurn(mode, maxToolIterations, turnId = makeTurnId()) {
         const signal = this.abortController.signal;
         const coauthor = this.config.coauthor !== false ? {
           name: this.config.coauthorName || "autopilot",
@@ -21155,6 +22442,7 @@ var init_session = __esm({
             });
           },
           onUsageFinal: (usage, gatewayMeta) => {
+            if (typeof usage.cost === "number") this.traceCostUsd += usage.cost;
             this.usage.totalInputTokens += usage.prompt_tokens;
             this.usage.totalOutputTokens += usage.completion_tokens;
             this.usage.turnCount += 1;
@@ -21232,6 +22520,8 @@ var init_session = __esm({
           compaction: this.compaction,
           allowDirectPush: this.config.allowDirectPush,
           preferPullRequests: this.config.preferPullRequests,
+          trace: this.trace,
+          turnId,
           // Steering lands at the next tool boundary, or before the final answer
           // ends the turn (the loop continues so the model can respond to it).
           drainPendingInput: () => {
@@ -21240,6 +22530,9 @@ var init_session = __esm({
               const messageId = `msg_${this.nextMessageId++}`;
               this.emit({ type: "message.start", messageId, role: "user" });
               this.emit({ type: "message.end", messageId });
+              if (this.trace.enabled) {
+                this.trace.emit("user_message", { content_blob: this.trace.blob(text) ?? "", source: "continuation", attachments: 0 }, turnId);
+              }
               return { role: "user", content: text };
             });
           },
@@ -21248,14 +22541,14 @@ var init_session = __esm({
               this.lspManager?.notifyChange(path, content);
             } else {
               void import("fs/promises").then(
-                ({ readFile: readFile31 }) => readFile31(path, "utf8").then((c) => this.lspManager?.notifyChange(path, c)).catch(() => {
+                ({ readFile: readFile32 }) => readFile32(path, "utf8").then((c) => this.lspManager?.notifyChange(path, c)).catch(() => {
                 })
               ).catch(() => {
               });
             }
           }
         });
-        if (["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync4(join33(this.cwd, name)))) {
+        if (["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync7(join37(this.cwd, name)))) {
           this.messages[0] = {
             role: "system",
             content: buildSystemPrompt({
@@ -22067,6 +23360,8 @@ var init_builtins = __esm({
       { name: "checkpoint", argHint: "[label]", description: "Save current point in session", source: "builtin" },
       { name: "checkpoints", description: "List checkpoints in current session", source: "builtin" },
       { name: "compact", description: "Summarize old turns to free context", source: "builtin" },
+      { name: "good", description: "Rate the last turn as good (recorded in the local session trace)", source: "builtin" },
+      { name: "bad", argHint: "[reason]", description: "Rate the last turn as bad (recorded in the local session trace)", source: "builtin" },
       { name: "clear", description: "Clear current conversation", source: "builtin" },
       { name: "fresh", description: "Start a fresh session with a summarized plan or continuation context", source: "builtin" },
       { name: "init", description: "Scan repo and write AGENTS.md", source: "builtin" },
@@ -22533,7 +23828,9 @@ var init_help_menu = __esm({
           { command: "/resume", description: "pick a past conversation" },
           { command: "/compact", description: "summarize old turns to free context" },
           { command: "/clear", description: "clear current conversation" },
-          { command: "/fresh", description: "reset session and start fresh with the last plan" }
+          { command: "/fresh", description: "reset session and start fresh with the last plan" },
+          { command: "/good", description: "rate the last turn good (local session trace)" },
+          { command: "/bad [reason]", description: "rate the last turn bad (local session trace)", selectable: false }
         ]
       },
       {
@@ -22692,8 +23989,8 @@ __export(app_helpers_exports, {
   trackRecentFile: () => trackRecentFile
 });
 import { execSync as execSync3, spawn as spawn6 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync6, statSync as statSync5 } from "fs";
-import { join as join34 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync7, statSync as statSync5 } from "fs";
+import { join as join38 } from "path";
 import { platform as platform3 } from "os";
 function replaceQueuedPrompt(queue2, key, full, display) {
   const index = queue2.findIndex((item) => item.key === key);
@@ -22801,12 +24098,12 @@ function buildFilePickerIgnoreList(cwd) {
   ];
   const gitignorePatterns = [];
   try {
-    const gitignorePath = join34(cwd, ".gitignore");
+    const gitignorePath = join38(cwd, ".gitignore");
     const stats = statSync5(gitignorePath);
     if (stats.size > MAX_GITIGNORE_SIZE) {
       return hardcoded;
     }
-    const content = readFileSync6(gitignorePath, "utf-8");
+    const content = readFileSync7(gitignorePath, "utf-8");
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -22940,7 +24237,7 @@ function findImagePaths(text) {
   let match;
   while ((match = quotedRegex.exec(text)) !== null) {
     const path = match[1] ?? match[2];
-    if (path && isImagePath(path) && existsSync5(path)) {
+    if (path && isImagePath(path) && existsSync8(path)) {
       paths.push(path);
     }
   }
@@ -22949,7 +24246,7 @@ function findImagePaths(text) {
   const processed = remaining.replace(/\\ /g, ESCAPED_SPACE);
   for (const token of processed.split(/\s+/)) {
     const clean = token.replace(new RegExp(ESCAPED_SPACE, "g"), " ").replace(/^["']|["',;:!?]$/g, "").replace(/[.,;:!?]$/, "");
-    if (clean && isImagePath(clean) && existsSync5(clean) && !paths.includes(clean)) {
+    if (clean && isImagePath(clean) && existsSync8(clean) && !paths.includes(clean)) {
       paths.push(clean);
     }
   }
@@ -22979,9 +24276,9 @@ var init_app_helpers = __esm({
 
 // src/ui/bang-command.ts
 import { spawn as spawn7 } from "child_process";
-import { mkdtemp as mkdtemp2, readFile as readFile23, rm as rm3 } from "fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile24, rm as rm4 } from "fs/promises";
 import { tmpdir as tmpdir4, platform as platform4 } from "os";
-import { join as join35 } from "path";
+import { join as join39 } from "path";
 function registerInkInstance(instance) {
   inkInstance = instance;
 }
@@ -23084,8 +24381,8 @@ async function runBangCommand(command, cwd) {
   const origErr = stderr.write;
   const readable = stdin.listeners("readable");
   const wasRaw = stdin.isTTY ? stdin.isRaw : false;
-  const logDir2 = isWindows ? null : await mkdtemp2(join35(tmpdir4(), "autopilot-bang-"));
-  const logPath = logDir2 ? join35(logDir2, "out.log") : null;
+  const logDir2 = isWindows ? null : await mkdtemp2(join39(tmpdir4(), "autopilot-bang-"));
+  const logPath = logDir2 ? join39(logDir2, "out.log") : null;
   const viaScript = logPath ? scriptInvocation(command, shell, logPath) : null;
   inkInstance?.clear();
   origOut.call(stdout, `
@@ -23127,9 +24424,9 @@ $ ${command}
   }
   let output = spawnError ? `failed to start: ${spawnError}` : null;
   if (captured && logPath) {
-    output = cleanTerminalOutput(await readFile23(logPath, "utf8").catch(() => ""));
+    output = cleanTerminalOutput(await readFile24(logPath, "utf8").catch(() => ""));
   }
-  if (logDir2) await rm3(logDir2, { recursive: true, force: true }).catch(() => {
+  if (logDir2) await rm4(logDir2, { recursive: true, force: true }).catch(() => {
   });
   return { command, exitCode: result2.code, signal: result2.signal, output };
 }
@@ -25316,9 +26613,9 @@ __export(camouflage_view_exports, {
   validateCommandName: () => validateCommandName
 });
 import { execFileSync as execFileSync2, spawn as spawn9 } from "child_process";
-import { readdir as readdir5 } from "fs/promises";
-import { homedir as homedir25 } from "os";
-import { join as join36, resolve as resolve11 } from "path";
+import { readdir as readdir6 } from "fs/promises";
+import { homedir as homedir26 } from "os";
+import { join as join40, resolve as resolve11 } from "path";
 async function loadSdk() {
   const sdk = await import("camouflage-tui").catch((err) => {
     throw new CamouflageUnavailable(`camouflage-tui is not installed (${err.message})`);
@@ -25497,10 +26794,10 @@ function truncateText(s, max) {
 async function listMentionDir(cwd, query) {
   const exact = query === "~" || query === "." || query === ".." || query.endsWith("/..");
   const dir = exact ? `${query}/` : query.slice(0, query.lastIndexOf("/") + 1);
-  const expanded = dir.startsWith("~") ? join36(homedir25(), dir.slice(1)) : dir;
+  const expanded = dir.startsWith("~") ? join40(homedir26(), dir.slice(1)) : dir;
   const target = resolve11(cwd, expanded || ".");
   try {
-    const items = await readdir5(target, { withFileTypes: true });
+    const items = await readdir6(target, { withFileTypes: true });
     const entries = items.filter((d) => !d.name.startsWith(".")).map((d) => ({ name: d.name, isDir: d.isDirectory() })).sort((a, b) => a.isDir !== b.isDir ? a.isDir ? -1 : 1 : a.name.localeCompare(b.name)).slice(0, 300).map((d) => `${dir}${d.name}${d.isDir ? "/" : ""}`);
     return { dir, entries };
   } catch {
@@ -25578,7 +26875,7 @@ function shortModel(id) {
   return id.includes("/") ? id.slice(id.indexOf("/") + 1) : id;
 }
 function shortPath(p) {
-  const home = homedir25();
+  const home = homedir26();
   return p === home ? "~" : p.startsWith(home + "/") ? `~${p.slice(home.length)}` : p;
 }
 function gitBranch(cwd) {
@@ -27585,7 +28882,7 @@ var init_tool_view = __esm({
     "use strict";
     init_spinner();
     init_diff_view();
-    init_paths();
+    init_paths2();
     init_theme_context();
     init_narrator();
     ToolView = React7.memo(function ToolView2({ evt, verbose, isRepeated, intentTier }) {
@@ -28332,7 +29629,7 @@ function PermissionModal({ tool, args, onDecide, onFeedback }) {
   );
   const handleFeedbackSubmit = useCallback(
     (text) => {
-      onDecide(DENY);
+      onDecide(text.trim() ? { ...DENY, feedback: text.trim() } : DENY);
       if (text.trim()) {
         onFeedback?.(text);
       }
@@ -28847,8 +30144,8 @@ var init_queue_plan_picker = __esm({
 
 // src/agent/jev-context.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { readFile as readFile24 } from "fs/promises";
-import { basename as basename6, join as join37, resolve as resolve12 } from "path";
+import { readFile as readFile25 } from "fs/promises";
+import { basename as basename6, join as join41, resolve as resolve12 } from "path";
 function messageText(message2) {
   if (typeof message2.content === "string") return message2.content.trim();
   if (!Array.isArray(message2.content)) return "";
@@ -28870,7 +30167,7 @@ function projectRoot(cwd) {
 }
 async function readPackageMetadata(root) {
   try {
-    const parsed = JSON.parse(await readFile24(join37(root, "package.json"), "utf8"));
+    const parsed = JSON.parse(await readFile25(join41(root, "package.json"), "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
     const pkg = parsed;
     const metadata = {};
@@ -28887,7 +30184,7 @@ async function readPackageMetadata(root) {
 async function readLicenseEvidence(root) {
   for (const name of ["LICENSE", "LICENSE.md", "LICENSE.txt", "LICENCE", "COPYING"]) {
     try {
-      const content = (await readFile24(join37(root, name), "utf8")).trim();
+      const content = (await readFile25(join41(root, name), "utf8")).trim();
       if (content) return { source: `project license (${name})`, content: content.slice(0, 700) };
     } catch {
     }
@@ -29969,8 +31266,8 @@ var init_frontmatter = __esm({
 });
 
 // src/skills/loader.ts
-import { readFile as readFile25, readdir as readdir6, stat as stat7 } from "fs/promises";
-import { join as join38, extname } from "path";
+import { readFile as readFile26, readdir as readdir7, stat as stat8 } from "fs/promises";
+import { join as join42, extname } from "path";
 function normalizeManifest(raw, filePath) {
   const name = typeof raw.name === "string" ? raw.name : "";
   const description = typeof raw.description === "string" ? raw.description : "";
@@ -29984,7 +31281,7 @@ function normalizeManifest(raw, filePath) {
   return { name, description, match, scope, priority, enabled: enabled2 };
 }
 async function loadSkillFile(filePath) {
-  const raw = await readFile25(filePath, "utf-8");
+  const raw = await readFile26(filePath, "utf-8");
   const parsed = parseFrontmatter(raw);
   const manifest = normalizeManifest(parsed.data, filePath);
   const body = parsed.content.trim();
@@ -30003,11 +31300,11 @@ async function loadSkillFile(filePath) {
 }
 async function loadSkillsFromDir(dirPath) {
   try {
-    const entries = await readdir6(dirPath);
+    const entries = await readdir7(dirPath);
     const files = [];
     for (const entry of entries) {
-      const full = join38(dirPath, entry);
-      const s = await stat7(full);
+      const full = join42(dirPath, entry);
+      const s = await stat8(full);
       if (s.isFile() && extname(entry) === ".md") {
         files.push(full);
       }
@@ -30034,12 +31331,12 @@ var init_loader = __esm({
 });
 
 // src/skills/manager.ts
-import { mkdir as mkdir15, writeFile as writeFile14, unlink as unlink4, readFile as readFile26 } from "fs/promises";
-import { join as join39 } from "path";
+import { mkdir as mkdir15, writeFile as writeFile14, unlink as unlink4, readFile as readFile27 } from "fs/promises";
+import { join as join43 } from "path";
 function getSkillDirs(cwd) {
   return {
-    projectDir: join39(cwd, ".kimiflare", "skills"),
-    globalDir: join39(process.env.HOME ?? "", ".config", "kimiflare", "skills")
+    projectDir: join43(cwd, ".kimiflare", "skills"),
+    globalDir: join43(process.env.HOME ?? "", ".config", "kimiflare", "skills")
   };
 }
 async function listAllSkills(cwd) {
@@ -30053,7 +31350,7 @@ async function listAllSkills(cwd) {
 async function createSkill(opts2) {
   const dirs = getSkillDirs(opts2.cwd);
   const dir = opts2.scope === "project" ? dirs.projectDir : dirs.globalDir;
-  const filepath = join39(dir, `${opts2.name}.md`);
+  const filepath = join43(dir, `${opts2.name}.md`);
   const frontmatter = {
     name: opts2.name,
     enabled: true,
@@ -30089,7 +31386,7 @@ async function setSkillEnabled(name, enabled2, cwd) {
   const all = await listAllSkills(cwd);
   const skill = all.project.find((s) => s.name === name) ?? all.global.find((s) => s.name === name);
   if (!skill) throw new Error(`skill "${name}" not found`);
-  const raw = await readFile26(skill.filePath, "utf-8");
+  const raw = await readFile27(skill.filePath, "utf-8");
   const parsed = parseFrontmatter(raw);
   parsed.data.enabled = enabled2;
   const yaml = Object.entries(parsed.data).map(([k, v]) => {
@@ -30361,15 +31658,15 @@ var tui_report_exports = {};
 __export(tui_report_exports, {
   getCategoryReportText: () => getCategoryReportText
 });
-import { readFile as readFile27 } from "fs/promises";
-import { join as join40 } from "path";
-import { homedir as homedir26 } from "os";
+import { readFile as readFile28 } from "fs/promises";
+import { join as join44 } from "path";
+import { homedir as homedir27 } from "os";
 function usageDir3() {
-  const xdg = process.env.XDG_DATA_HOME || join40(homedir26(), ".local", "share");
-  return join40(xdg, "kimiflare");
+  const xdg = process.env.XDG_DATA_HOME || join44(homedir27(), ".local", "share");
+  return join44(xdg, "kimiflare");
 }
 function usagePath4() {
-  return join40(usageDir3(), "usage.json");
+  return join44(usageDir3(), "usage.json");
 }
 function today3() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
@@ -30381,7 +31678,7 @@ function daysAgo2(n) {
 }
 async function loadLog3() {
   try {
-    const raw = await readFile27(usagePath4(), "utf8");
+    const raw = await readFile28(usagePath4(), "utf8");
     return JSON.parse(raw);
   } catch {
     return { version: 1, days: [], sessions: [] };
@@ -30438,7 +31735,7 @@ var init_tui_report = __esm({
 });
 
 // src/ui/slash-commands.ts
-import { join as join41 } from "path";
+import { join as join45 } from "path";
 import QRCode from "qrcode";
 function executeFreshStart(ctx, planText, overrideMode, opts2 = {}) {
   const oldSessionId = ctx.sessionIdRef.current;
@@ -30529,6 +31826,28 @@ function modesGate(ctx) {
   ]);
   return false;
 }
+function rateLastTurn(ctx, value, reason) {
+  const { mkKey: mkKey2, setEvents } = ctx;
+  const last = ctx.turnHistoryRef.current.at(-1);
+  if (!last) {
+    setEvents((e) => [...e, { kind: "info", key: mkKey2(), text: "nothing to rate yet \u2014 finish a turn first" }]);
+    return true;
+  }
+  const trace = ctx.traceRef.current;
+  if (!trace.enabled) {
+    setEvents((e) => [
+      ...e,
+      { kind: "info", key: mkKey2(), text: "session tracing is off, so the rating was not recorded (enable with KIMIFLARE_TRACE=1)" }
+    ]);
+    return true;
+  }
+  trace.emit("outcome", { kind: "rating", turn_id: last.turnId, value, ...reason ? { reason } : {} }, last.turnId);
+  setEvents((e) => [
+    ...e,
+    { kind: "info", key: mkKey2(), text: `recorded ${value === "good" ? "\u{1F44D} good" : "\u{1F44E} bad"} for the last turn${reason ? `: ${reason}` : ""}` }
+  ]);
+  return true;
+}
 function dispatchSlashCommand(ctx, cmd) {
   const raw = cmd.trim();
   const [head, ...rest] = raw.split(/\s+/);
@@ -30538,7 +31857,7 @@ function dispatchSlashCommand(ctx, cmd) {
   if (!handler) return false;
   return handler(ctx, rest, arg);
 }
-var handleExit, handleClear, handleFresh, handleReasoning, handleCost, handleShell, handleSubagents, handleJev, handleModel, SETTINGS, handleSettings, handleKey, handleMode, handleMultiAgent, handleTheme, handlePlan, handleAuto, handleEdit, handleSkills, handleMemory, handleResume, handleCheckpoint, handleCompact, handleInit, handleUpdate, handleMcp, handleLsp, handleHooks, handleHello, handleInbox, handleLogout, handleCommand, handleRemote, handleHelp, handleChangelogImage, handlers;
+var handleExit, handleClear, handleFresh, handleReasoning, handleCost, handleShell, handleSubagents, handleJev, handleModel, SETTINGS, handleSettings, handleKey, handleMode, handleMultiAgent, handleTheme, handlePlan, handleAuto, handleEdit, handleSkills, handleMemory, handleResume, handleCheckpoint, handleCompact, handleInit, handleUpdate, handleMcp, handleLsp, handleHooks, handleHello, handleInbox, handleLogout, handleCommand, handleRemote, handleHelp, handleChangelogImage, handleGood, handleBad, handlers;
 var init_slash_commands = __esm({
   "src/ui/slash-commands.ts"() {
     "use strict";
@@ -30561,7 +31880,7 @@ var init_slash_commands = __esm({
     init_executor();
     init_recommended();
     init_settings();
-    init_types();
+    init_types2();
     init_update_check();
     init_version();
     init_app_helpers();
@@ -31348,7 +32667,7 @@ ${lines.join("\n")}` }]);
         void (async () => {
           try {
             const { sessionsDir: sessionsDir3 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
-            const file = await loadSession(join41(sessionsDir3(), `${currentId}.json`));
+            const file = await loadSession(join45(sessionsDir3(), `${currentId}.json`));
             const cps = file.checkpoints ?? [];
             if (cps.length === 0) {
               setEvents((e) => [...e, { kind: "info", key: mkKey2(), text: "no checkpoints in this session" }]);
@@ -31393,7 +32712,7 @@ ${lines.join("\n")}` }]);
         try {
           ctx.ensureSessionId();
           const { sessionsDir: sessionsDir3 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
-          const filePath = join41(sessionsDir3(), `${ctx.sessionIdRef.current}.json`);
+          const filePath = join45(sessionsDir3(), `${ctx.sessionIdRef.current}.json`);
           await addCheckpoint(filePath, cp);
           setEvents((e) => [...e, { kind: "info", key: mkKey2(), text: `checkpoint saved: "${label}"` }]);
         } catch (e) {
@@ -31984,6 +33303,8 @@ project: ${projectSettingsPath(cwd)}`
       });
       return true;
     };
+    handleGood = (ctx, rest) => rateLastTurn(ctx, "good", rest.join(" ").trim());
+    handleBad = (ctx, rest) => rateLastTurn(ctx, "bad", rest.join(" ").trim());
     handlers = {
       "/exit": handleExit,
       "/clear": handleClear,
@@ -32007,6 +33328,8 @@ project: ${projectSettingsPath(cwd)}`
       "/resume": handleResume,
       "/checkpoint": handleCheckpoint,
       "/compact": handleCompact,
+      "/good": handleGood,
+      "/bad": handleBad,
       "/init": handleInit,
       "/update": handleUpdate,
       "/mcp": handleMcp,
@@ -32338,7 +33661,7 @@ __export(openrouter_oauth_exports, {
   pkceChallenge: () => pkceChallenge,
   startLoopbackListener: () => startLoopbackListener
 });
-import { createHash as createHash4, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash5, randomBytes as randomBytes3 } from "crypto";
 import { createServer as createServer3 } from "http";
 import { hostname } from "os";
 function createPkce() {
@@ -32346,7 +33669,7 @@ function createPkce() {
   return { verifier, challenge: pkceChallenge(verifier) };
 }
 function pkceChallenge(verifier) {
-  return createHash4("sha256").update(verifier).digest("base64url");
+  return createHash5("sha256").update(verifier).digest("base64url");
 }
 function openRouterAuthPageUrl() {
   return (process.env.OPENROUTER_AUTH_URL?.trim() || "https://openrouter.ai/auth").replace(/\/+$/, "");
@@ -32858,14 +34181,14 @@ var init_frontmatter2 = __esm({
 
 // src/commands/loader.ts
 import { open, realpath as realpath6 } from "fs/promises";
-import { homedir as homedir27 } from "os";
-import { join as join42, relative as relative10, sep as sep6 } from "path";
+import { homedir as homedir28 } from "os";
+import { join as join46, relative as relative10, sep as sep6 } from "path";
 function projectCommandsDir(cwd = process.cwd()) {
-  return join42(cwd, ".kimiflare", "commands");
+  return join46(cwd, ".kimiflare", "commands");
 }
 function globalCommandsDir() {
-  const xdg = process.env.XDG_CONFIG_HOME || join42(homedir27(), ".config");
-  return join42(xdg, "kimiflare", "commands");
+  const xdg = process.env.XDG_CONFIG_HOME || join46(homedir28(), ".config");
+  return join46(xdg, "kimiflare", "commands");
 }
 async function loadCustomCommands(cwd = process.cwd()) {
   const warnings = [];
@@ -33009,7 +34332,7 @@ var init_loader2 = __esm({
     init_mode();
     init_glob();
     init_config();
-    init_paths();
+    init_paths2();
     init_frontmatter2();
     MAX_COMMAND_FILE_BYTES = 256 * 1024;
   }
@@ -33019,7 +34342,7 @@ var init_loader2 = __esm({
 import { exec } from "child_process";
 import { open as open2, realpath as realpath7 } from "fs/promises";
 import { isAbsolute as isAbsolute6, relative as relative11, resolve as resolvePathJoin, basename as pathBasename } from "path";
-import { promisify as promisify5 } from "util";
+import { promisify as promisify7 } from "util";
 function tokenizeArgs(s) {
   return [...s.matchAll(ARG_TOKEN_RE)].map((match) => {
     const token = match[0];
@@ -33171,8 +34494,8 @@ var execAsync, ARG_TOKEN_RE, POSITIONAL_RE, HAS_POSITIONAL, SHELL_RE, FILE_RE, D
 var init_renderer2 = __esm({
   "src/commands/renderer.ts"() {
     "use strict";
-    init_paths();
-    execAsync = promisify5(exec);
+    init_paths2();
+    execAsync = promisify7(exec);
     ARG_TOKEN_RE = /(?:"[^"]*"|'[^']*'|[^\s"']+)/g;
     POSITIONAL_RE = /\$(\d+)/g;
     HAS_POSITIONAL = /\$\d+/;
@@ -33247,11 +34570,11 @@ var init_wcag = __esm({
 });
 
 // src/ui/theme-loader.ts
-import { readFile as readFile28, readdir as readdir7 } from "fs/promises";
-import { join as join43 } from "path";
-import { homedir as homedir28 } from "os";
+import { readFile as readFile29, readdir as readdir8 } from "fs/promises";
+import { join as join47 } from "path";
+import { homedir as homedir29 } from "os";
 function projectThemesDir(cwd = process.cwd()) {
-  return join43(cwd, ".kimiflare", "themes");
+  return join47(cwd, ".kimiflare", "themes");
 }
 function isHexColor(c) {
   return /^#[0-9a-fA-F]{6}$/.test(c);
@@ -33335,15 +34658,15 @@ async function loadThemesFromDir(dir, source) {
   const errors = [];
   let files;
   try {
-    files = await readdir7(dir);
+    files = await readdir8(dir);
   } catch {
     return { themes, errors };
   }
   for (const file of files.filter((f) => f.endsWith(".json"))) {
-    const path = join43(dir, file);
+    const path = join47(dir, file);
     let raw;
     try {
-      raw = await readFile28(path, "utf-8");
+      raw = await readFile29(path, "utf-8");
     } catch (e) {
       errors.push(`${path}: ${e instanceof Error ? e.message : String(e)}`);
       continue;
@@ -33489,8 +34812,8 @@ var init_theme_loader = __esm({
     "use strict";
     init_wcag();
     init_theme();
-    USER_THEMES_DIR = join43(
-      process.env.XDG_CONFIG_HOME || join43(homedir28(), ".config"),
+    USER_THEMES_DIR = join47(
+      process.env.XDG_CONFIG_HOME || join47(homedir29(), ".config"),
       "kimiflare",
       "themes"
     );
@@ -35648,6 +36971,61 @@ function useSessionManager(deps) {
     setLogSessionId(sessionIdRef.current);
     return sessionIdRef.current;
   }, []);
+  const traceRef = useRef7(createNoopRecorder());
+  const traceStartedRef = useRef7(false);
+  const turnHistoryRef = useRef7([]);
+  const noteTurnEnded = useCallback6((turnId) => {
+    turnHistoryRef.current.push({ turnId, endedAt: Date.now() });
+    if (turnHistoryRef.current.length > 100) turnHistoryRef.current.shift();
+  }, []);
+  const endTrace = useCallback6((reason) => {
+    const trace = traceRef.current;
+    if (trace.enabled && traceStartedRef.current) trace.emit("session_end", { reason }, null);
+    traceStartedRef.current = false;
+    traceRef.current = createNoopRecorder();
+  }, []);
+  const traceReverted = useCallback6((how, turns) => {
+    const trace = traceRef.current;
+    if (!trace.enabled) return;
+    for (const turn of turns) trace.emit("outcome", { kind: "reverted", turn_id: turn.turnId, how }, turn.turnId);
+  }, []);
+  const ensureTrace = useCallback6(() => {
+    const id = ensureSessionId();
+    const cfgTrace = depsRef.current.cfg?.trace;
+    const wantEnabled = cfgTrace?.enabled === true;
+    const current = traceRef.current;
+    if (current.sessionId === id && current.enabled === wantEnabled) return current;
+    if (current.enabled && traceStartedRef.current) current.emit("session_end", { reason: "exit" }, null);
+    traceStartedRef.current = false;
+    traceRef.current = createRecorder({ enabled: wantEnabled, sessionId: id, root: cfgTrace?.root });
+    return traceRef.current;
+  }, [ensureSessionId]);
+  const ensureTraceStarted = useCallback6(
+    async (info) => {
+      const trace = ensureTrace();
+      if (!trace.enabled || traceStartedRef.current) return trace;
+      traceStartedRef.current = true;
+      await emitSessionStart(trace, {
+        cwd: process.cwd(),
+        model: info.model,
+        mode: info.mode,
+        config: info.config,
+        tools: info.tools,
+        systemPrompt: info.systemPrompt,
+        toolProfile: info.toolProfile
+      });
+      return trace;
+    },
+    [ensureTrace]
+  );
+  React23.useEffect(() => {
+    const onExit = () => endTrace("exit");
+    process.on("exit", onExit);
+    return () => {
+      process.off("exit", onExit);
+      endTrace("exit");
+    };
+  }, [endTrace]);
   const saveSessionSafe = useCallback6(async () => {
     const d = depsRef.current;
     if (!d.cfg) return;
@@ -35686,11 +37064,18 @@ function useSessionManager(deps) {
         setResumeProgress(0);
         setResumeStage("Loading session file\u2026");
         startSmoothProgress(0, 10, 400);
-        const file = checkpointId ? (await loadSessionFromCheckpoint(filePath, checkpointId)).file : await loadSession(filePath);
+        const loaded = checkpointId ? await loadSessionFromCheckpoint(filePath, checkpointId) : null;
+        const file = loaded ? loaded.file : await loadSession(filePath);
         setResumeProgress(10);
         setResumeStage("Restoring artifact store\u2026");
         startSmoothProgress(10, 20, 400);
         d.messagesRef.current = file.messages;
+        if (loaded && file.id === sessionIdRef.current) {
+          const since = Date.parse(loaded.checkpoint.timestamp);
+          traceReverted("restore_checkpoint", turnHistoryRef.current.filter((t) => Number.isNaN(since) || t.endedAt > since));
+        }
+        endTrace(checkpointId ? "restore_checkpoint" : "exit");
+        turnHistoryRef.current = [];
         sessionIdRef.current = file.id;
         setLogSessionId(file.id);
         sessionCreatedAtRef.current = file.createdAt;
@@ -35866,6 +37251,9 @@ ${summary}`
     [checkpointSession, doResumeSession]
   );
   const resetSession = useCallback6(() => {
+    traceReverted("clear", turnHistoryRef.current.slice(-2));
+    turnHistoryRef.current = [];
+    endTrace("clear");
     sessionIdRef.current = null;
     setLogSessionId(null);
     sessionCreatedAtRef.current = null;
@@ -35873,7 +37261,7 @@ ${summary}`
     const d = depsRef.current;
     d.sessionStateRef.current = emptySessionState();
     d.artifactStoreRef.current = new ArtifactStore();
-  }, []);
+  }, [endTrace, traceReverted]);
   return {
     sessionIdRef,
     sessionCreatedAtRef,
@@ -35895,7 +37283,13 @@ ${summary}`
     doResumeSession,
     handleResumePick,
     handleCheckpointPick,
-    resetSession
+    resetSession,
+    traceRef,
+    ensureTrace,
+    ensureTraceStarted,
+    endTrace,
+    turnHistoryRef,
+    noteTurnEnded
   };
 }
 var init_use_session_manager = __esm({
@@ -35907,6 +37301,7 @@ var init_use_session_manager = __esm({
     init_recall_inject();
     init_usage_tracker();
     init_log_sink();
+    init_trace();
     init_app_helpers();
     init_continuation_summary();
     init_config();
@@ -35945,9 +37340,9 @@ var init_resume_progress = __esm({
 });
 
 // src/agent/supervisor.ts
-import { readdir as readdir8, readFile as readFile29, stat as stat8 } from "fs/promises";
-import { createHash as createHash5 } from "crypto";
-import { resolve as resolve13, join as join44 } from "path";
+import { readdir as readdir9, readFile as readFile30, stat as stat9 } from "fs/promises";
+import { createHash as createHash6 } from "crypto";
+import { resolve as resolve13, join as join48 } from "path";
 var TurnSupervisor;
 var init_supervisor = __esm({
   "src/agent/supervisor.ts"() {
@@ -36334,13 +37729,13 @@ var init_input_handlers = __esm({
 });
 
 // src/init/context-generator.ts
-import { existsSync as existsSync6, statSync as statSync6 } from "fs";
-import { join as join45 } from "path";
+import { existsSync as existsSync9, statSync as statSync6 } from "fs";
+import { join as join49 } from "path";
 function detectFlavor(cwd) {
   for (const [flavor, signatures] of Object.entries(FLAVOR_SIGNATURES)) {
     if (flavor === "generic") continue;
     for (const sig of signatures) {
-      const path = join45(cwd, sig);
+      const path = join49(cwd, sig);
       if (sig.includes("*")) {
         try {
           const parts = sig.split("*");
@@ -36352,7 +37747,7 @@ function detectFlavor(cwd) {
           }
         } catch {
         }
-      } else if (existsSync6(path)) {
+      } else if (existsSync9(path)) {
         return flavor;
       }
     }
@@ -36361,14 +37756,14 @@ function detectFlavor(cwd) {
 }
 function findFile(cwd, candidates) {
   for (const c of candidates) {
-    if (existsSync6(join45(cwd, c))) return c;
+    if (existsSync9(join49(cwd, c))) return c;
   }
   return null;
 }
 function findSourceRoots(cwd) {
   const roots = [];
   for (const r of SOURCE_ROOT_CANDIDATES) {
-    const p = join45(cwd, r);
+    const p = join49(cwd, r);
     try {
       const s = statSync6(p);
       if (s.isDirectory()) roots.push(r);
@@ -36379,9 +37774,9 @@ function findSourceRoots(cwd) {
 }
 function findCiConfig(cwd) {
   for (const c of CI_PATHS) {
-    if (existsSync6(join45(cwd, c))) {
+    if (existsSync9(join49(cwd, c))) {
       try {
-        const s = statSync6(join45(cwd, c));
+        const s = statSync6(join49(cwd, c));
         return s.isDirectory() ? c : c;
       } catch {
       }
@@ -36518,7 +37913,7 @@ function analyzeProject(cwd) {
     ciConfig: findCiConfig(cwd),
     readme: findFile(cwd, ["README.md", "README.rst", "README.txt", "Readme.md"]),
     sourceRoots: findSourceRoots(cwd),
-    hasGit: existsSync6(join45(cwd, ".git"))
+    hasGit: existsSync9(join49(cwd, ".git"))
   };
 }
 function bashDiscoveryCommands(profile) {
@@ -36683,7 +38078,7 @@ Aim for 100\u2013200 lines total. Use markdown tables where they save space.
 }
 function buildInitPrompt(cwd) {
   const existingName = ["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].find(
-    (n) => existsSync6(join45(cwd, n))
+    (n) => existsSync9(join49(cwd, n))
   );
   const isRefresh = existingName !== void 0;
   const targetFilename = existingName ?? "AGENTS.md";
@@ -36766,8 +38161,8 @@ var init_context_generator = __esm({
 });
 
 // src/init/run-init.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join46 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { join as join50 } from "path";
 async function runInit(deps) {
   const {
     cfg,
@@ -36860,7 +38255,7 @@ async function runInit(deps) {
           lspManagerRef.current.notifyChange(path, content);
         } else {
           void import("fs/promises").then(
-            ({ readFile: readFile31 }) => readFile31(path, "utf8").then((c) => lspManagerRef.current.notifyChange(path, c)).catch(() => {
+            ({ readFile: readFile32 }) => readFile32(path, "utf8").then((c) => lspManagerRef.current.notifyChange(path, c)).catch(() => {
             })
           );
         }
@@ -36965,7 +38360,7 @@ async function runInit(deps) {
         }
       }
     });
-    if (existsSync7(join46(cwd, targetFilename))) {
+    if (existsSync10(join50(cwd, targetFilename))) {
       if (cacheStableRef.current) {
         messagesRef.current[1] = {
           role: "system",
@@ -37057,11 +38452,11 @@ var init_run_init = __esm({
 });
 
 // src/skills/discovery.ts
-import { readdir as readdir9, stat as stat9, readFile as readFile30 } from "fs/promises";
-import { join as join47, extname as extname2 } from "path";
+import { readdir as readdir10, stat as stat10, readFile as readFile31 } from "fs/promises";
+import { join as join51, extname as extname2 } from "path";
 async function dirExists(path) {
   try {
-    const s = await stat9(path);
+    const s = await stat10(path);
     return s.isDirectory();
   } catch {
     return false;
@@ -37069,7 +38464,7 @@ async function dirExists(path) {
 }
 async function fileExists(path) {
   try {
-    const s = await stat9(path);
+    const s = await stat10(path);
     return s.isFile();
   } catch {
     return false;
@@ -37077,25 +38472,25 @@ async function fileExists(path) {
 }
 async function scanSkillDir(dirPath, source) {
   if (!await dirExists(dirPath)) return [];
-  const entries = await readdir9(dirPath, { withFileTypes: true });
+  const entries = await readdir10(dirPath, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     if (!SKILL_EXTENSIONS.has(extname2(entry.name))) continue;
-    files.push({ filePath: join47(dirPath, entry.name), source });
+    files.push({ filePath: join51(dirPath, entry.name), source });
   }
   return files;
 }
 async function discoverSkills(cwd) {
-  const agentsSkills = await scanSkillDir(join47(cwd, ".agents", "skills"), "agents");
-  const agentsMd = await fileExists(join47(cwd, "AGENTS.md")) ? [{ filePath: join47(cwd, "AGENTS.md"), source: "agents-md" }] : [];
-  const githubSkills = await scanSkillDir(join47(cwd, ".github", "skills"), "github");
-  const kimiflareSkills = await scanSkillDir(join47(cwd, ".kimiflare", "skills"), "kimiflare");
+  const agentsSkills = await scanSkillDir(join51(cwd, ".agents", "skills"), "agents");
+  const agentsMd = await fileExists(join51(cwd, "AGENTS.md")) ? [{ filePath: join51(cwd, "AGENTS.md"), source: "agents-md" }] : [];
+  const githubSkills = await scanSkillDir(join51(cwd, ".github", "skills"), "github");
+  const kimiflareSkills = await scanSkillDir(join51(cwd, ".kimiflare", "skills"), "kimiflare");
   const ordered = [...agentsSkills, ...agentsMd, ...githubSkills, ...kimiflareSkills];
   return ordered;
 }
 async function readSkillFile(filePath) {
-  const bytes = await readFile30(filePath);
+  const bytes = await readFile31(filePath);
   return { bytes, text: bytes.toString("utf-8") };
 }
 var SKILL_EXTENSIONS;
@@ -37107,9 +38502,9 @@ var init_discovery = __esm({
 });
 
 // src/skills/parser.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function sha2562(input) {
-  return createHash6("sha256").update(input).digest("hex");
+  return createHash7("sha256").update(input).digest("hex");
 }
 function computeContentHash(rawText, parserVersion) {
   return sha2562(`${rawText}
@@ -37300,8 +38695,8 @@ var init_skills = __esm({
 });
 
 // src/ui/run-startup-tasks.ts
-import { existsSync as existsSync8 } from "fs";
-import { join as join48 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join52 } from "path";
 function runStartupTasks(deps) {
   const {
     cfg,
@@ -37315,6 +38710,7 @@ function runStartupTasks(deps) {
   } = deps;
   const auth = llmAuthFromConfig(cfg);
   void Promise.resolve().then(() => (init_sessions(), sessions_exports)).then(({ pruneSessions: pruneSessions2 }) => pruneSessions2());
+  void Promise.resolve().then(() => (init_retention(), retention_exports)).then(({ pruneTraces: pruneTraces2 }) => pruneTraces2({ root: cfg.trace?.root }));
   void Promise.resolve().then(() => (init_log_sink(), log_sink_exports)).then(({ pruneOldLogs: pruneOldLogs2, isLogSinkEnabled: isLogSinkEnabled2 }) => {
     if (!isLogSinkEnabled2()) return;
     try {
@@ -37323,7 +38719,7 @@ function runStartupTasks(deps) {
     }
   });
   if (cfg.memoryEnabled) {
-    const dbPath = cfg.memoryDbPath ?? join48(process.cwd(), ".kimiflare", "memory.db");
+    const dbPath = cfg.memoryDbPath ?? join52(process.cwd(), ".kimiflare", "memory.db");
     const manager = new MemoryManager({
       dbPath,
       ...auth,
@@ -37355,7 +38751,7 @@ function runStartupTasks(deps) {
     });
     const cwd = process.cwd();
     sessionStartRecallRef.current = manager.recall({ text: cwd, repoPath: cwd, limit: 5 });
-    if (["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync8(join48(cwd, name)))) {
+    if (["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync11(join52(cwd, name)))) {
       const lastRefresh = manager.getLastKimiMdRefreshTime(cwd);
       const driftCount = manager.countHighSignalMemoriesSince(cwd, lastRefresh);
       if (driftCount >= 5) {
@@ -37366,7 +38762,7 @@ function runStartupTasks(deps) {
     memoryManagerRef.current?.close();
     memoryManagerRef.current = null;
   }
-  const skillDbPath = cfg.memoryDbPath ?? join48(process.cwd(), ".kimiflare", "memory.db");
+  const skillDbPath = cfg.memoryDbPath ?? join52(process.cwd(), ".kimiflare", "memory.db");
   const skillDb = getMemoryDb() ?? openMemoryDb(skillDbPath);
   initSkillsSchema(skillDb);
   void indexSkills({
@@ -37611,7 +39007,8 @@ async function runCompact(deps) {
     pendingToolCallsRef,
     hooks,
     sessionId,
-    supervisorRef
+    supervisorRef,
+    trace
   } = deps;
   if (busy || supervisorRef.current.isRunning) {
     setEvents((e) => [
@@ -37647,6 +39044,7 @@ async function runCompact(deps) {
       if (result2.metrics.rawTurnsRemoved === 0) {
         setEvents((e) => [...e, { kind: "info", key: mkKey2(), text: "nothing to compact yet" }]);
       } else {
+        traceCompiledCompaction(trace, result2);
         messagesRef.current = result2.newMessages;
         sessionStateRef.current = result2.newState;
         setEvents(
@@ -37665,6 +39063,7 @@ async function runCompact(deps) {
         await saveSessionSafe();
       }
     } else {
+      const before = messagesRef.current;
       const result2 = await summarizeMessagesViaLlm({
         ...llmAuthFromConfig(cfg),
         model: cfg.model,
@@ -37674,6 +39073,7 @@ async function runCompact(deps) {
       if (result2.replacedCount === 0) {
         setEvents((e) => [...e, { kind: "info", key: mkKey2(), text: "nothing to compact yet" }]);
       } else {
+        traceLlmCompaction(trace, before, result2);
         messagesRef.current = result2.newMessages;
         setEvents(
           (e) => compactEventsVisual(
@@ -37714,12 +39114,13 @@ var init_run_compact = __esm({
     init_logger();
     init_app_helpers();
     init_llm_auth();
+    init_compaction();
   }
 });
 
 // src/commands/save.ts
 import { mkdir as mkdir16, writeFile as writeFile15, unlink as unlink5 } from "fs/promises";
-import { dirname as dirname20 } from "path";
+import { dirname as dirname21 } from "path";
 async function saveCustomCommand(opts2) {
   const dir = opts2.source === "project" ? projectCommandsDir(opts2.cwd) : globalCommandsDir();
   const filepath = `${dir}/${opts2.name}.md`;
@@ -37730,7 +39131,7 @@ async function saveCustomCommand(opts2) {
   if (opts2.effort) data.effort = opts2.effort;
   const frontmatter = serializeFrontmatter(data);
   const content = frontmatter + opts2.template;
-  await mkdir16(dirname20(filepath), { recursive: true });
+  await mkdir16(dirname21(filepath), { recursive: true });
   await writeFile15(filepath, content, "utf8");
   return { filepath };
 }
@@ -37853,9 +39254,9 @@ __export(app_exports, {
 });
 import React25, { useState as useState27, useRef as useRef9, useEffect as useEffect11, useCallback as useCallback8, useMemo as useMemo6 } from "react";
 import { Box as Box40, Text as Text41, useApp, useInput as useInput19, useWindowSize as useWindowSize2, render } from "ink";
-import { existsSync as existsSync9 } from "fs";
-import { join as join49, resolve as resolve14 } from "path";
-import { homedir as homedir29 } from "os";
+import { existsSync as existsSync12 } from "fs";
+import { join as join53, resolve as resolve14 } from "path";
+import { homedir as homedir30 } from "os";
 import { jsx as jsx42, jsxs as jsxs39 } from "react/jsx-runtime";
 function App({
   initialCfg,
@@ -38112,6 +39513,8 @@ ${wcagWarnings.join("\n")}` }
   }, []);
   const sessionStartRecallRef = useRef9(null);
   const kimiMdStaleNudgedRef = useRef9(false);
+  const currentTurnIdRef = useRef9(null);
+  const denyFeedbackRef = useRef9(false);
   const sessionPlanRef = useRef9(null);
   const planCompletePlanRef = useRef9(null);
   const sessionMgr = useSessionManager({
@@ -38149,7 +39552,11 @@ ${wcagWarnings.join("\n")}` }
     doResumeSession,
     handleResumePick,
     handleCheckpointPick,
-    resetSession
+    resetSession,
+    traceRef,
+    ensureTraceStarted,
+    turnHistoryRef,
+    noteTurnEnded
   } = sessionMgr;
   const pendingTextRef = useRef9(/* @__PURE__ */ new Map());
   const flushTimeoutRef = useRef9(null);
@@ -38175,7 +39582,7 @@ ${wcagWarnings.join("\n")}` }
       const exactDirectory = query === "~" || query === "." || query === ".." || query.endsWith("/..");
       const prefix = exactDirectory ? `${query.replace(/\/$/, "")}/` : slash >= 0 ? query.slice(0, slash + 1) : "";
       const directory = exactDirectory ? query : slash >= 0 ? query.slice(0, slash + 1) : query;
-      const expanded = directory.startsWith("~") ? join49(homedir29(), directory.slice(1)) : directory;
+      const expanded = directory.startsWith("~") ? join53(homedir30(), directory.slice(1)) : directory;
       const target = resolve14(cwd, expanded || ".");
       const entries2 = await glob("*", {
         cwd: target,
@@ -38436,6 +39843,7 @@ ${wcagWarnings.join("\n")}` }
           store
         });
         if (result2.metrics.rawTurnsRemoved > 0) {
+          traceCompiledCompaction(traceRef.current, result2, currentTurnIdRef.current);
           sessionStateRef.current = result2.newState;
           setEvents((e) => [
             ...e,
@@ -38481,6 +39889,7 @@ ${wcagWarnings.join("\n")}` }
             signal
           });
           if (result2.replacedCount > 0) {
+            traceLlmCompaction(traceRef.current, messages, result2, currentTurnIdRef.current);
             setEvents((e) => [
               ...e,
               {
@@ -38654,7 +40063,8 @@ ${wcagWarnings.join("\n")}` }
       pendingToolCallsRef,
       hooks: hooksManagerRef.current,
       sessionId: sessionIdRef.current,
-      supervisorRef
+      supervisorRef,
+      trace: traceRef.current
     });
   }, [cfg, busy, saveSessionSafe]);
   const runInit2 = useCallback8(async () => {
@@ -38834,7 +40244,9 @@ ${wcagWarnings.join("\n")}` }
     compiledContextRef,
     lastApiErrorRef,
     activeScopeRef,
-    sessionPlanRef
+    sessionPlanRef,
+    traceRef,
+    turnHistoryRef
   }), [
     exit,
     busy,
@@ -39137,6 +40549,8 @@ ${result2.output ?? "(output not captured)"}`,
         }
       }
       messagesRef.current.push({ role: "user", content });
+      const traceUserSource = denyFeedbackRef.current ? "deny_feedback" : "typed";
+      denyFeedbackRef.current = false;
       await saveSessionSafe();
       if (compiledContextRef.current) {
         const { ids, recalled } = recallArtifacts(messagesRef.current, artifactStoreRef.current, sessionStateRef.current);
@@ -39150,7 +40564,7 @@ ${result2.output ?? "(output not captured)"}`,
         }
       }
       turnCounterRef.current += 1;
-      if (turnCounterRef.current % 15 === 0 && ["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync9(join49(process.cwd(), name))) && !kimiMdStale) {
+      if (turnCounterRef.current % 15 === 0 && ["AGENTS.md", "KIMI.md", "KIMIFLARE.md", "AGENT.md"].some((name) => existsSync12(join53(process.cwd(), name))) && !kimiMdStale) {
         setEvents((e) => [
           ...e,
           { kind: "info", key: mkKey(), text: "Tip: Rerunning /init occasionally helps autopilot (formerly kimiflare) stay accurate as your project evolves." }
@@ -39174,7 +40588,7 @@ ${result2.output ?? "(output not captured)"}`,
                 };
                 ensureSessionId();
                 const { sessionsDir: sessionsDir3 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
-                const filePath = join49(sessionsDir3(), `${sessionIdRef.current}.json`);
+                const filePath = join53(sessionsDir3(), `${sessionIdRef.current}.json`);
                 await addCheckpoint(filePath, cp);
               }
               const summary = await generateContinuationSummary({
@@ -39423,6 +40837,34 @@ ${result2.output ?? "(output not captured)"}`,
         offered: turnTools.some((tool) => tool.name === "subagent"),
         guidance: delegationGuidance.kind
       });
+      const turnId = makeTurnId();
+      currentTurnIdRef.current = turnId;
+      const trace = await ensureTraceStarted({
+        tools: toOpenAIToolDefs(turnTools),
+        systemPrompt: messagesRef.current.filter((m) => m.role === "system" && typeof m.content === "string").map((m) => m.content).join("\n\n"),
+        model: overrideModel ?? cfg.model,
+        mode: "tui",
+        config: cfg
+      });
+      if (trace.enabled) {
+        const previousTurn = turnHistoryRef.current.at(-1);
+        if (previousTurn) {
+          trace.emit(
+            "outcome",
+            { kind: "next_message", turn_id: previousTurn.turnId, classification: classifyNextMessage(trimmed), classifier: "regex" },
+            previousTurn.turnId
+          );
+        }
+        trace.emit(
+          "user_message",
+          {
+            content_blob: trace.blob(typeof content === "string" ? content : trimmed) ?? "",
+            source: traceUserSource,
+            attachments: Array.isArray(content) ? content.filter((p) => p.type !== "text").length : 0
+          },
+          turnId
+        );
+      }
       supervisorRef.current.startTurn(
         {
           ...llmAuthFromConfig(cfg),
@@ -39468,12 +40910,14 @@ ${result2.output ?? "(output not captured)"}`,
           },
           mode: modeRef.current,
           cacheStable: cacheStableRef.current,
+          trace,
+          turnId,
           onFileChange: (path, content2) => {
             if (content2) {
               lspManagerRef.current.notifyChange(path, content2);
             } else {
               void import("fs/promises").then(
-                ({ readFile: readFile31 }) => readFile31(path, "utf8").then((c) => lspManagerRef.current.notifyChange(path, c)).catch(() => {
+                ({ readFile: readFile32 }) => readFile32(path, "utf8").then((c) => lspManagerRef.current.notifyChange(path, c)).catch(() => {
                 })
               );
             }
@@ -39482,6 +40926,7 @@ ${result2.output ?? "(output not captured)"}`,
         },
         {
           onDone: () => {
+            noteTurnEnded(turnId);
             void (async () => {
               await saveSessionSafe();
               if (turnScope.signal.aborted) {
@@ -39509,6 +40954,7 @@ ${result2.output ?? "(output not captured)"}`,
                     store
                   });
                   if (result2.metrics.rawTurnsRemoved > 0) {
+                    traceCompiledCompaction(traceRef.current, result2, turnId);
                     messagesRef.current = result2.newMessages;
                     sessionStateRef.current = result2.newState;
                     setEvents((e) => [
@@ -39524,6 +40970,7 @@ ${result2.output ?? "(output not captured)"}`,
                   }
                 } else {
                   try {
+                    const before = messagesRef.current;
                     const result2 = await summarizeMessagesViaLlm({
                       ...llmAuthFromConfig(cfg),
                       model: cfg.model,
@@ -39531,6 +40978,7 @@ ${result2.output ?? "(output not captured)"}`,
                       signal: turnScope.signal
                     });
                     if (result2.replacedCount > 0) {
+                      traceLlmCompaction(traceRef.current, before, result2, turnId);
                       messagesRef.current = result2.newMessages;
                       setEvents((e) => [
                         ...e,
@@ -39596,6 +41044,7 @@ ${result2.output ?? "(output not captured)"}`,
                     keepLastTurns: 1
                   });
                   if (result2.metrics.rawTurnsRemoved > 0) {
+                    traceCompiledCompaction(traceRef.current, result2, turnId);
                     messagesRef.current = result2.newMessages;
                     sessionStateRef.current = result2.newState;
                     setEvents((e) => [
@@ -39611,6 +41060,7 @@ ${result2.output ?? "(output not captured)"}`,
                   }
                 } else {
                   try {
+                    const before = messagesRef.current;
                     const result2 = await summarizeMessagesViaLlm({
                       ...llmAuthFromConfig(cfg),
                       model: cfg.model,
@@ -39619,6 +41069,7 @@ ${result2.output ?? "(output not captured)"}`,
                       signal: turnScope.signal
                     });
                     if (result2.replacedCount > 0) {
+                      traceLlmCompaction(traceRef.current, before, result2, turnId);
                       messagesRef.current = result2.newMessages;
                       setEvents((e) => [
                         ...e,
@@ -39659,7 +41110,7 @@ ${result2.output ?? "(output not captured)"}`,
                       };
                       ensureSessionId();
                       const { sessionsDir: sessionsDir3 } = await Promise.resolve().then(() => (init_sessions(), sessions_exports));
-                      const filePath = join49(sessionsDir3(), `${sessionIdRef.current}.json`);
+                      const filePath = join53(sessionsDir3(), `${sessionIdRef.current}.json`);
                       await addCheckpoint(filePath, cp);
                     }
                     const summary = await generateContinuationSummary({
@@ -39710,6 +41161,7 @@ ${result2.output ?? "(output not captured)"}`,
             }
           },
           onError: async (e) => {
+            noteTurnEnded(turnId);
             if (e.name === "AbortError") {
               for (const [tcId, tcName] of pendingToolCallsRef.current) {
                 messagesRef.current.push({
@@ -39741,7 +41193,7 @@ ${result2.output ?? "(output not captured)"}`,
         }
       );
     },
-    [cfg, handleSlash, updateAssistant, updateTool, saveSessionSafe, updateResponseMeta, setShowPlanCompletePicker, runUserShellCommand]
+    [cfg, handleSlash, updateAssistant, updateTool, saveSessionSafe, updateResponseMeta, setShowPlanCompletePicker, runUserShellCommand, ensureTraceStarted]
   );
   useEffect11(() => {
     if (!busy && queuePlanDraft === null && supervisorRef.current.phase === "idle") {
@@ -40242,7 +41694,7 @@ ${result2.output ?? "(output not captured)"}`,
       lsp: {
         servers: cfg?.lspServers ?? {},
         scope: lspScope,
-        hasProjectDir: existsSync9(join49(process.cwd(), ".kimiflare"))
+        hasProjectDir: existsSync12(join53(process.cwd(), ".kimiflare"))
       }
     });
   });
@@ -40299,7 +41751,7 @@ ${result2.output ?? "(output not captured)"}`,
         onCommandDelete: handleCommandDelete2,
         lspServers: cfg?.lspServers ?? {},
         lspScope,
-        hasProjectDir: existsSync9(join49(process.cwd(), ".kimiflare")),
+        hasProjectDir: existsSync12(join53(process.cwd(), ".kimiflare")),
         onLspSave: handleLspSave2,
         themes: themeList(),
         onPickTheme: handleThemePick,
@@ -40370,6 +41822,7 @@ ${result2.output ?? "(output not captured)"}`,
         args: perm.args,
         onDecide: decidePermission2,
         onFeedback: (text) => {
+          denyFeedbackRef.current = true;
           submitRef.current(text);
         }
       }
@@ -40635,6 +42088,8 @@ var init_app = __esm({
     init_run_startup_tasks();
     init_manager_init();
     init_run_compact();
+    init_trace();
+    init_registry2();
     init_distill();
     init_plan_resolver();
     init_user_shell();
@@ -40780,6 +42235,8 @@ init_glob();
 init_permissions_evaluator();
 init_classify();
 init_subagent_policy();
+init_trace();
+init_registry2();
 import { readFile as readFile15 } from "fs/promises";
 import { resolve as resolve6, basename as basename3 } from "path";
 async function resolveSession(opts2) {
@@ -40819,8 +42276,8 @@ async function resolveFiles(filePatterns, cwd) {
   const resolved = /* @__PURE__ */ new Set();
   for (const pattern of filePatterns) {
     try {
-      const stat10 = await import("fs/promises").then((m) => m.stat(resolve6(cwd, pattern)));
-      if (stat10.isFile()) {
+      const stat11 = await import("fs/promises").then((m) => m.stat(resolve6(cwd, pattern)));
+      if (stat11.isFile()) {
         resolved.add(resolve6(cwd, pattern));
         continue;
       }
@@ -40914,24 +42371,43 @@ async function runPrintMode(opts2) {
     });
   }
   const messages = [];
+  const systemPrompt = buildSystemPrompt({ cwd, tools: workerTools, model: opts2.model, preferPullRequests: opts2.preferPullRequests });
   if (isNew || sessionFile.messages.length === 0) {
-    messages.push({
-      role: "system",
-      content: buildSystemPrompt({ cwd, tools: workerTools, model: opts2.model, preferPullRequests: opts2.preferPullRequests })
-    });
+    messages.push({ role: "system", content: systemPrompt });
   } else {
     const nonSystem = sessionFile.messages.filter(
       (m) => m.role !== "system" || typeof m.content === "string" && m.content.startsWith("[compiled session state]")
     );
-    messages.push({
-      role: "system",
-      content: buildSystemPrompt({ cwd, tools: workerTools, model: opts2.model, preferPullRequests: opts2.preferPullRequests })
-    });
+    messages.push({ role: "system", content: systemPrompt });
     messages.push(...nonSystem);
   }
+  const trace = createRecorder({
+    enabled: opts2.trace?.enabled === true,
+    sessionId: sessionFile.id,
+    root: opts2.trace?.root
+  });
+  await emitSessionStart(trace, {
+    cwd,
+    model: opts2.model,
+    mode: "print",
+    config: opts2.traceConfigSnapshot,
+    tools: toOpenAIToolDefs(workerTools),
+    systemPrompt,
+    toolProfile: opts2.workerProfile ?? "full"
+  });
+  let traceCostUsd = 0;
+  let traceEndReason = "exit";
   const files = opts2.files ? await resolveFiles(opts2.files, cwd) : [];
   const { content: userContent } = await buildUserMessage(opts2.prompt, files, cwd);
   messages.push({ role: "user", content: userContent });
+  const turnId = makeTurnId();
+  if (trace.enabled) {
+    trace.emit(
+      "user_message",
+      { content_blob: trace.blob(opts2.prompt) ?? "", source: "print", attachments: files.length },
+      turnId
+    );
+  }
   const controller = new AbortController();
   process.on("SIGINT", () => controller.abort());
   const format = opts2.format ?? "text";
@@ -40955,6 +42431,7 @@ async function runPrintMode(opts2) {
     onUsageFinal: (u, meta) => {
       const lookup = opts2.openrouterApiKey && !auth.customEndpoint && meta?.generationId ? { apiKey: opts2.openrouterApiKey, meta } : void 0;
       usageWrites.push(recordUsage(sessionFile.id, u, lookup, opts2.model).catch(() => void 0));
+      if (typeof u.cost === "number") traceCostUsd += u.cost;
     },
     onReasoningDelta: opts2.showReasoning ? (delta) => {
       if (format === "text") {
@@ -41096,7 +42573,9 @@ async function runPrintMode(opts2) {
       // --continue sessions grow across runs; archive older turns onto the
       // session file (saved below) instead of failing on context size.
       compaction: sessionFileCompactionTarget(sessionFile),
-      callbacks
+      callbacks,
+      trace,
+      turnId
     });
   } catch (err) {
     if (err instanceof BudgetExhaustedError) {
@@ -41126,9 +42605,12 @@ async function runPrintMode(opts2) {
       process.exitCode = 1;
       return;
     }
+    traceEndReason = "crash";
     throw err;
   } finally {
     await Promise.all(usageWrites);
+    trace.emit("session_end", { reason: traceEndReason, total_cost_usd: traceCostUsd || void 0 }, null);
+    await trace.flush();
   }
   sessionFile.messages = messages;
   sessionFile.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -41442,7 +42924,9 @@ To use Requesty instead, set REQUESTY_API_KEY or run  autopilot auth requesty`
       dir: opts.dir,
       title: opts.title,
       permissions: cfg.permissions,
-      workerProfile: opts.workerProfile
+      workerProfile: opts.workerProfile,
+      trace: cfg.trace,
+      traceConfigSnapshot: cfg
     });
     return;
   }