grix-connector 3.33.2 → 3.34.0

package/openclaw-plugin/audit-recorder-worker.js

@@ -1291,7 +1291,7 @@ function groupMessages(job, evidence, anomalies) {
       });
       continue;
     }
-    const timestamp4 = asTimestamp(line.record.timestamp, job.startedAt);
+    const timestamp5 = asTimestamp(line.record.timestamp, job.startedAt);
     let group = groups.get(messageId);
     if (!group) {
       group = {
@@ -1301,14 +1301,14 @@ function groupMessages(job, evidence, anomalies) {
         sourcePath: line.sourcePath,
         isSubagent: line.isSubagent,
         promptId: targetPromptId,
-        startedAt: timestamp4,
-        endedAt: timestamp4,
+        startedAt: timestamp5,
+        endedAt: timestamp5,
         samples: [],
         blocks: []
       };
       groups.set(messageId, group);
     } else {
-      group.endedAt = timestamp4;
+      group.endedAt = timestamp5;
       if (typeof line.record.requestId === "string") {
         group.requestId = line.record.requestId;
       }
@@ -2299,9 +2299,9 @@ function stableHash(value) {
   return (hash >>> 0).toString(16).padStart(8, "0");
 }
 function observedAt(value) {
-  const timestamp4 = stringValue2(value);
-  if (!timestamp4 || Number.isNaN(Date.parse(timestamp4))) return void 0;
-  return timestamp4;
+  const timestamp5 = stringValue2(value);
+  if (!timestamp5 || Number.isNaN(Date.parse(timestamp5))) return void 0;
+  return timestamp5;
 }
 function captureOptions2(job) {
   return job.options?.enabled === true ? job.options.capture : DEFAULT_CAPTURE2;
@@ -2816,7 +2816,7 @@ function toSpan(job, candidate, modelId) {
   if (candidate.snapshotKey) {
     nativeIds2.usageSnapshotId = stableHash(candidate.snapshotKey);
   }
-  const timestamp4 = candidate.observedAt ?? job.startedAt;
+  const timestamp5 = candidate.observedAt ?? job.startedAt;
   return {
     spanId: `codex-llm-${stableHash(`${job.traceId}|${nativeRequestId}`)}`,
     traceId: job.traceId,
@@ -2827,8 +2827,8 @@ function toSpan(job, candidate, modelId) {
     name: "codex response",
     sequence: candidate.sequence,
     status: "completed",
-    startedAt: timestamp4,
-    endedAt: timestamp4,
+    startedAt: timestamp5,
+    endedAt: timestamp5,
     ...modelId ? { modelId } : {},
     inputRefs: [],
     outputRefs: [],
@@ -3560,13 +3560,60 @@ var CodexAuditAdapter = class {
 };
 
 // src/audit/adapters/pi/pi-transcript-source.ts
-import { open as open3, stat as stat4 } from "node:fs/promises";
+import { open as open3 } from "node:fs/promises";
+
+// src/audit/core/transcript-fingerprint.ts
+import { createHash as createHash3 } from "node:crypto";
+var READ_CHUNK_BYTES = 64 * 1024;
+async function readAndHashFilePrefixRange(handle, start, end) {
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start) {
+    throw new Error("Transcript range must contain safe non-negative offsets");
+  }
+  const digest = createHash3("sha256").update(String(end)).update("\0");
+  const output = Buffer.allocUnsafe(end - start);
+  const chunk = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, Math.max(1, end)));
+  let position = 0;
+  while (position < end) {
+    const requested = Math.min(chunk.length, end - position);
+    const { bytesRead } = await handle.read(chunk, 0, requested, position);
+    if (bytesRead === 0) {
+      throw new Error(`Transcript ended before prefix offset ${end}`);
+    }
+    const value = chunk.subarray(0, bytesRead);
+    digest.update(value);
+    const overlapStart = Math.max(position, start);
+    const overlapEnd = Math.min(position + bytesRead, end);
+    if (overlapStart < overlapEnd) {
+      value.copy(
+        output,
+        overlapStart - start,
+        overlapStart - position,
+        overlapEnd - position
+      );
+    }
+    position += bytesRead;
+  }
+  return { buffer: output, fingerprint: digest.digest("hex") };
+}
+
+// src/audit/adapters/pi/pi-transcript-source.ts
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function finiteOffset3(value, fallback) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : fallback;
 }
+function recordIntegrityFailure(evidence, transcriptPath, detail) {
+  evidence.anomalies.push({
+    code: "pi_transcript_source_changed",
+    message: `${transcriptPath}: ${detail}`
+  });
+  evidence.gaps.push({
+    category: "main_transcript",
+    reason: "correlation_failed",
+    detail: `${transcriptPath}: ${detail}`
+  });
+}
 async function collectPiTranscript(boundary) {
   const transcriptPath = typeof boundary.transcriptPath === "string" ? boundary.transcriptPath : void 0;
   if (!transcriptPath) {
@@ -3591,31 +3638,57 @@ async function collectPiTranscript(boundary) {
     sourcePaths: [transcriptPath]
   };
   try {
-    const sourceStat = await stat4(transcriptPath);
-    const requestedStart = finiteOffset3(boundary.transcriptStartOffset, 0);
-    const requestedEnd = typeof boundary.transcriptEndOffset === "number" ? finiteOffset3(boundary.transcriptEndOffset, sourceStat.size) : sourceStat.size;
-    if (requestedStart > sourceStat.size) {
-      evidence.anomalies.push({
-        code: "pi_transcript_boundary_out_of_range",
-        message: `${transcriptPath}: start ${requestedStart} exceeds size ${sourceStat.size}`
-      });
-      evidence.gaps.push({
-        category: "main_transcript",
-        reason: "correlation_failed",
-        detail: `${transcriptPath}:${requestedStart}-${requestedEnd}`
-      });
-      return evidence;
-    }
-    const start = requestedStart;
-    const end = Math.min(Math.max(requestedEnd, start), sourceStat.size);
-    const length = end - start;
-    if (length === 0) return evidence;
     const handle = await open3(transcriptPath, "r");
     let buffer;
+    let start;
     try {
-      buffer = Buffer.allocUnsafe(length);
-      const { bytesRead } = await handle.read(buffer, 0, length, start);
-      buffer = buffer.subarray(0, bytesRead);
+      const sourceStat = await handle.stat();
+      const requestedStart = finiteOffset3(boundary.transcriptStartOffset, 0);
+      const requestedEnd = typeof boundary.transcriptEndOffset === "number" ? finiteOffset3(boundary.transcriptEndOffset, sourceStat.size) : sourceStat.size;
+      if (requestedStart > sourceStat.size || requestedEnd > sourceStat.size) {
+        evidence.anomalies.push({
+          code: "pi_transcript_boundary_out_of_range",
+          message: `${transcriptPath}: boundary ${requestedStart}-${requestedEnd} exceeds size ${sourceStat.size}`
+        });
+        evidence.gaps.push({
+          category: "main_transcript",
+          reason: "correlation_failed",
+          detail: `${transcriptPath}:${requestedStart}-${requestedEnd}`
+        });
+        return evidence;
+      }
+      const expectedIdentity = typeof boundary.transcriptFileIdentity === "string" ? boundary.transcriptFileIdentity : void 0;
+      const actualIdentity = `${sourceStat.dev}:${sourceStat.ino}`;
+      if (expectedIdentity && actualIdentity !== expectedIdentity) {
+        recordIntegrityFailure(
+          evidence,
+          transcriptPath,
+          `identity ${actualIdentity} does not match ${expectedIdentity}`
+        );
+        return evidence;
+      }
+      const expectedFingerprint = typeof boundary.transcriptPrefixFingerprint === "string" ? boundary.transcriptPrefixFingerprint : void 0;
+      start = requestedStart;
+      const end = Math.max(requestedEnd, start);
+      const length = end - start;
+      if (expectedFingerprint) {
+        const verified = await readAndHashFilePrefixRange(handle, start, end);
+        if (verified.fingerprint !== expectedFingerprint) {
+          recordIntegrityFailure(
+            evidence,
+            transcriptPath,
+            "closed transcript prefix fingerprint changed"
+          );
+          return evidence;
+        }
+        buffer = verified.buffer;
+      } else {
+        if (length === 0) return evidence;
+        buffer = Buffer.allocUnsafe(length);
+        const { bytesRead } = await handle.read(buffer, 0, length, start);
+        buffer = buffer.subarray(0, bytesRead);
+      }
+      if (length === 0) return evidence;
     } finally {
       await handle.close();
     }
@@ -4273,7 +4346,7 @@ var PiAuditAdapter = class {
 };
 
 // src/audit/adapters/acp/generic-acp-audit-adapter.ts
-import { readFile as readFile3, readdir as readdir2, stat as stat5 } from "node:fs/promises";
+import { readFile as readFile3, readdir as readdir2, stat as stat4 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename as basename4, join as join2 } from "node:path";
 var DEFAULT_CAPTURE4 = Object.freeze({
@@ -4305,9 +4378,9 @@ function eventTime(value) {
   }
   return void 0;
 }
-function withinTurn(timestamp4, job) {
-  if (!timestamp4) return false;
-  const at = Date.parse(timestamp4);
+function withinTurn(timestamp5, job) {
+  if (!timestamp5) return false;
+  const at = Date.parse(timestamp5);
   return at >= Date.parse(job.startedAt) - 5e3 && at <= Date.parse(job.endedAt) + 3e4;
 }
 function contentText2(value) {
@@ -4364,7 +4437,7 @@ async function collectQwenUsage(job, providerSessionId, cwd) {
     `${providerSessionId}.jsonl`
   );
   try {
-    await stat5(sourcePath);
+    await stat4(sourcePath);
   } catch {
     return { records: [] };
   }
@@ -4413,7 +4486,7 @@ async function locateGeminiSession(providerSessionId, cwd) {
     const candidates = names.filter((name) => name.startsWith("session-") && name.includes(shortId) && (name.endsWith(".json") || name.endsWith(".jsonl")));
     const ranked = await Promise.all(candidates.map(async (name) => {
       const sourcePath = join2(chats, name);
-      return { sourcePath, modifiedAt: (await stat5(sourcePath)).mtimeMs };
+      return { sourcePath, modifiedAt: (await stat4(sourcePath)).mtimeMs };
     }));
     return ranked.sort((left, right) => right.modifiedAt - left.modifiedAt)[0]?.sourcePath;
   } catch {
@@ -4895,7 +4968,7 @@ var GenericAcpAuditAdapter = class {
 };
 
 // src/audit/adapters/acp/kimi-audit-adapter.ts
-import { readFile as readFile4, readdir as readdir3, stat as stat6 } from "node:fs/promises";
+import { readFile as readFile4, readdir as readdir3, stat as stat5 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { basename as basename5, dirname, join as join3 } from "node:path";
 var DEFAULT_CAPTURE5 = Object.freeze({
@@ -4950,8 +5023,8 @@ function lineEvent(line) {
   return line.record.type === "context.append_loop_event" && isRecord7(line.record.event) ? line.record.event : void 0;
 }
 function withinTurn2(value, job) {
-  const timestamp4 = Date.parse(isoTime(value, ""));
-  return Number.isFinite(timestamp4) && timestamp4 >= Date.parse(job.startedAt) - 5e3 && timestamp4 <= Date.parse(job.endedAt) + 3e4;
+  const timestamp5 = Date.parse(isoTime(value, ""));
+  return Number.isFinite(timestamp5) && timestamp5 >= Date.parse(job.startedAt) - 5e3 && timestamp5 <= Date.parse(job.endedAt) + 3e4;
 }
 async function readJsonl2(sourcePath) {
   const raw = await readFile4(sourcePath, "utf8");
@@ -5027,7 +5100,7 @@ async function locateSessionDirectory(job) {
     const path = join3(root, workspace.name, providerSessionId);
     const wirePath = join3(path, "agents", "main", "wire.jsonl");
     try {
-      const wireStat = await stat6(wirePath);
+      const wireStat = await stat5(wirePath);
       let cwdMatches = false;
       const cwd = stringValue5(job.boundary.cwd);
       if (cwd) {
@@ -5868,7 +5941,7 @@ var KimiAuditAdapter = class {
 };
 
 // src/audit/adapters/acp/reasonix-transcript-source.ts
-import { open as open4, stat as stat7 } from "node:fs/promises";
+import { open as open4, stat as stat6 } from "node:fs/promises";
 function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -5921,7 +5994,7 @@ async function collectReasonixTranscript(boundary) {
     return evidence;
   }
   try {
-    const sourceStat = await stat7(transcriptPath);
+    const sourceStat = await stat6(transcriptPath);
     const requestedStart = finiteOffset4(boundary.transcriptStartOffset, 0);
     const requestedEnd = typeof boundary.transcriptEndOffset === "number" ? finiteOffset4(boundary.transcriptEndOffset, sourceStat.size) : sourceStat.size;
     if (requestedStart > sourceStat.size) {
@@ -7986,7 +8059,7 @@ var DeepSeekHarnessAuditAdapter = class {
       const mapped = mapDshSessionEvent(event);
       const eventSessionId = String(event.sessionId ?? "");
       const isChild = !!eventSessionId && !!rootSessionId && eventSessionId !== rootSessionId;
-      const timestamp4 = iso(record4.at, job.startedAt);
+      const timestamp5 = iso(record4.at, job.startedAt);
       if (mapped.kind === "thinking") {
         if (capture.thinking && mapped.text) {
           addContent10(contents, { role: "thinking", format: "text", value: mapped.text, captureLevel: "runtime_exact" });
@@ -8061,9 +8134,9 @@ var DeepSeekHarnessAuditAdapter = class {
           continue;
         }
         tool.span.status = mapped.isError ? "failed" : "completed";
-        tool.span.endedAt = timestamp4;
+        tool.span.endedAt = timestamp5;
         const startMs = Date.parse(tool.span.startedAt);
-        const endMs = Date.parse(timestamp4);
+        const endMs = Date.parse(timestamp5);
         if (Number.isFinite(startMs) && Number.isFinite(endMs)) {
           tool.span.durationMs = Math.max(0, endMs - startMs);
         }
@@ -8161,7 +8234,7 @@ function turnSpan(job, spanId) {
   };
 }
 function simpleSpan(job, parentSpanId, sequence, kind, name, at, nativeIds2) {
-  const timestamp4 = iso(at, job.startedAt);
+  const timestamp5 = iso(at, job.startedAt);
   return {
     spanId: `deepseek-harness:${job.turnId}:${sequence}`,
     traceId: job.traceId,
@@ -8172,8 +8245,8 @@ function simpleSpan(job, parentSpanId, sequence, kind, name, at, nativeIds2) {
     name,
     sequence,
     status: "completed",
-    startedAt: timestamp4,
-    endedAt: timestamp4,
+    startedAt: timestamp5,
+    endedAt: timestamp5,
     inputRefs: [],
     outputRefs: [],
     provider: { provider: "deepseek-harness", nativeEventType: name, nativeIds: nativeIds2 },
@@ -8231,31 +8304,412 @@ function usageSpan(job, parentSpanId, sequence, at, raw, requestId2, modelId, pr
   return span2;
 }
 
-// src/audit/adapters/openclaw/openclaw-audit-adapter.ts
+// src/audit/adapters/agy/agy-audit-adapter.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import { dirname as dirname2, join as join4 } from "node:path";
+var DEFAULT_CAPTURE11 = Object.freeze({
+  inputOutput: true,
+  tools: true,
+  subagents: false,
+  thinking: true,
+  rawProviderBody: false
+});
+var AGY_LOG_EXCERPT_MAX_CHARS = 256e3;
 function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function resolveTranscriptBoundary(boundary) {
-  if (typeof boundary.transcriptPath === "string") return boundary;
+function stringValue10(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function offsetValue(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+function captureOptions11(job) {
+  return job.options?.enabled === true ? job.options.capture : DEFAULT_CAPTURE11;
+}
+function addContent11(contents, seen, content) {
+  const key = [content.role, content.value ?? ""].join("\0");
+  if (seen.has(key)) return seen.get(key);
+  const reference = referenceCaptureContent(content);
+  seen.set(key, reference);
+  contents.push(content);
+  return reference;
+}
+function append5(target, reference) {
+  if (reference && !target.some((item) => item.contentId === reference.contentId)) {
+    target.push(reference);
+  }
+}
+function timestamp4(value, fallback) {
+  return typeof value === "string" && Number.isFinite(Date.parse(value)) ? value : fallback;
+}
+function makeSpan8(input) {
+  const startedAt = input.startedAt ?? input.job.startedAt;
+  const endedAt = input.endedAt ?? input.job.endedAt;
+  const startMs = Date.parse(startedAt);
+  const endMs = Date.parse(endedAt);
+  return {
+    spanId: input.spanId,
+    traceId: input.job.traceId,
+    turnId: input.job.turnId,
+    sessionId: input.job.sessionId,
+    ...input.parentSpanId ? { parentSpanId: input.parentSpanId } : {},
+    kind: input.kind,
+    name: input.name,
+    sequence: input.sequence,
+    status: input.status ?? "completed",
+    startedAt,
+    endedAt,
+    ...Number.isFinite(startMs) && Number.isFinite(endMs) ? { durationMs: Math.max(0, endMs - startMs) } : {},
+    inputRefs: [],
+    outputRefs: [],
+    provider: {
+      provider: "agy",
+      nativeEventType: input.nativeEventType,
+      nativeIds: Object.fromEntries(
+        Object.entries(input.nativeIds ?? {}).filter(
+          (entry) => typeof entry[1] === "string"
+        )
+      ),
+      ...input.rawAttributes ? { rawAttributes: input.rawAttributes } : {}
+    },
+    provenance: {
+      source: "connector",
+      accuracy: "runtime_exact"
+    }
+  };
+}
+function parseToolInvocation(value) {
+  if (!isRecord14(value) || typeof value.sequence !== "number" || typeof value.observedAt !== "string" || typeof value.action !== "string") {
+    return void 0;
+  }
+  return {
+    sequence: value.sequence,
+    observedAt: value.observedAt,
+    action: value.action,
+    ...value.params === void 0 ? {} : { params: value.params },
+    ...value.result === void 0 ? {} : { result: value.result },
+    ...typeof value.error === "string" ? { error: value.error } : {},
+    ...typeof value.completedAt === "string" ? { completedAt: value.completedAt } : {}
+  };
+}
+var AgyAuditAdapter = class {
+  provider = "agy";
+  async collect(job) {
+    const evidence = {
+      toolInvocations: [],
+      anomalies: [],
+      gaps: []
+    };
+    const bundle = isRecord14(job.boundary.agyEvidence) ? job.boundary.agyEvidence : void 0;
+    if (!bundle) {
+      evidence.gaps.push({
+        category: "agy_evidence",
+        reason: "source_log_missing",
+        detail: "boundary.agyEvidence is missing"
+      });
+    } else {
+      const prompt = stringValue10(bundle.prompt);
+      if (prompt !== void 0) evidence.prompt = prompt;
+      const stdout = stringValue10(bundle.stdout);
+      if (stdout !== void 0) evidence.stdout = stdout;
+      const stderr = stringValue10(bundle.stderr);
+      if (stderr !== void 0) evidence.stderr = stderr;
+      if (typeof bundle.exitCode === "number" || bundle.exitCode === null) {
+        evidence.exitCode = bundle.exitCode;
+      }
+      const response = stringValue10(bundle.response);
+      if (response !== void 0) evidence.response = response;
+      if (Array.isArray(bundle.toolInvocations)) {
+        for (const value of bundle.toolInvocations) {
+          const invocation = parseToolInvocation(value);
+          if (!invocation) {
+            evidence.anomalies.push({
+              code: "agy_tool_invocation_malformed",
+              message: "agy tool invocation row is malformed"
+            });
+            evidence.gaps.push({
+              category: "agy_tool_invocation",
+              reason: "correlation_failed"
+            });
+            continue;
+          }
+          evidence.toolInvocations.push(invocation);
+        }
+        evidence.toolInvocations.sort(
+          (left, right) => left.sequence - right.sequence
+        );
+      }
+    }
+    const logPath = stringValue10(job.boundary.transcriptPath);
+    const logStart = offsetValue(job.boundary.transcriptStartOffset);
+    const logEnd = offsetValue(job.boundary.transcriptEndOffset);
+    if (logPath) {
+      evidence.logPath = logPath;
+      try {
+        const raw = await readFile5(logPath);
+        const start = logStart !== void 0 && logStart <= raw.length ? logStart : 0;
+        const end = logEnd !== void 0 && logEnd >= start && logEnd <= raw.length ? logEnd : raw.length;
+        evidence.logStartOffset = start;
+        evidence.logEndOffset = end;
+        const excerpt = raw.subarray(start, end).toString("utf-8");
+        evidence.logExcerpt = excerpt.length > AGY_LOG_EXCERPT_MAX_CHARS ? excerpt.slice(0, AGY_LOG_EXCERPT_MAX_CHARS) : excerpt;
+      } catch (error) {
+        evidence.anomalies.push({
+          code: "agy_log_unreadable",
+          message: error instanceof Error ? error.message : String(error)
+        });
+        evidence.gaps.push({
+          category: "agy_log",
+          reason: "source_log_missing",
+          detail: logPath
+        });
+      }
+    }
+    return evidence;
+  }
+  async normalize(job, rawEvidence) {
+    const collection = rawEvidence;
+    const capture = captureOptions11(job);
+    const spans = [];
+    const contents = [];
+    const seen = /* @__PURE__ */ new Map();
+    let sequence = 0;
+    const turnSpanId = `agy:${job.turnId}:turn`;
+    const turn = makeSpan8({
+      job,
+      spanId: turnSpanId,
+      kind: "turn",
+      name: "agy audited turn",
+      sequence: sequence++,
+      status: job.outcome === "completed" ? "completed" : job.outcome === "cancelled" ? "cancelled" : "failed",
+      nativeEventType: "print_turn",
+      nativeIds: {
+        providerSessionId: stringValue10(job.boundary.providerSessionId)
+      }
+    });
+    spans.push(turn);
+    const runtimeInput = capture.inputOutput && job.input ? addContent11(contents, seen, {
+      ...job.input,
+      captureLevel: job.input.captureLevel ?? "runtime_exact"
+    }) : void 0;
+    append5(turn.inputRefs, runtimeInput);
+    if (capture.inputOutput && job.finalOutput) {
+      append5(turn.outputRefs, addContent11(contents, seen, {
+        ...job.finalOutput,
+        captureLevel: job.finalOutput.captureLevel ?? "runtime_exact"
+      }));
+    }
+    const request = makeSpan8({
+      job,
+      spanId: `agy:${job.sessionId}:request:${job.turnId}`,
+      parentSpanId: turnSpanId,
+      kind: "llm_request",
+      name: "agy print request",
+      sequence: sequence++,
+      status: job.outcome === "completed" ? "completed" : "failed",
+      nativeEventType: "print_process",
+      nativeIds: {
+        providerSessionId: stringValue10(job.boundary.providerSessionId)
+      },
+      rawAttributes: {
+        ...collection.exitCode === void 0 ? {} : { exitCode: collection.exitCode },
+        ...collection.logPath ? { logPath: collection.logPath } : {},
+        ...collection.logStartOffset === void 0 ? {} : { logStartOffset: collection.logStartOffset },
+        ...collection.logEndOffset === void 0 ? {} : { logEndOffset: collection.logEndOffset },
+        ...collection.stderr ? { stderr: collection.stderr.slice(0, 2e3) } : {}
+      }
+    });
+    append5(request.inputRefs, runtimeInput);
+    if (capture.inputOutput && collection.prompt) {
+      append5(request.inputRefs, addContent11(contents, seen, {
+        role: "model_request",
+        format: "text",
+        value: collection.prompt,
+        captureLevel: "provider_exact"
+      }));
+    }
+    const outputText2 = collection.response ?? collection.stdout;
+    if (capture.inputOutput && outputText2) {
+      append5(request.outputRefs, addContent11(contents, seen, {
+        role: "assistant_text",
+        format: "text",
+        value: outputText2,
+        captureLevel: "provider_exact"
+      }));
+    }
+    if (capture.rawProviderBody && collection.logExcerpt) {
+      append5(request.outputRefs, addContent11(contents, seen, {
+        role: "model_response",
+        format: "text",
+        value: collection.logExcerpt,
+        sourcePath: collection.logPath,
+        sourceOffset: collection.logStartOffset,
+        captureLevel: "provider_exact"
+      }));
+    }
+    spans.push(request);
+    if (capture.tools) {
+      for (const invocation of collection.toolInvocations) {
+        const tool = makeSpan8({
+          job,
+          spanId: `agy:${job.sessionId}:tool:${invocation.sequence}`,
+          parentSpanId: request.spanId,
+          kind: "tool_call",
+          name: invocation.action,
+          sequence: sequence++,
+          status: invocation.error ? "failed" : invocation.completedAt ? "completed" : "running",
+          startedAt: timestamp4(invocation.observedAt, job.startedAt),
+          endedAt: timestamp4(invocation.completedAt, job.endedAt),
+          nativeEventType: "grix_tool_invoke",
+          nativeIds: { toolSequence: String(invocation.sequence) },
+          rawAttributes: { toolInvocation: invocation }
+        });
+        if (invocation.params !== void 0) {
+          append5(tool.inputRefs, addContent11(contents, seen, {
+            role: "tool_arguments",
+            format: "json",
+            value: typeof invocation.params === "string" ? invocation.params : JSON.stringify(invocation.params),
+            captureLevel: "runtime_exact"
+          }));
+        }
+        const result = invocation.result ?? invocation.error;
+        if (result !== void 0) {
+          append5(tool.outputRefs, addContent11(contents, seen, {
+            role: "tool_result",
+            format: typeof result === "string" ? "text" : "json",
+            value: typeof result === "string" ? result : JSON.stringify(result),
+            captureLevel: "runtime_exact"
+          }));
+        }
+        spans.push(tool);
+      }
+    }
+    collection.gaps.push({
+      category: "provider_usage",
+      reason: "provider_usage_missing",
+      detail: "agy print mode does not report token usage"
+    });
+    return {
+      spans,
+      contents,
+      anomalies: collection.anomalies,
+      collection,
+      capture
+    };
+  }
+  async correlate(_job, evidence) {
+    return evidence;
+  }
+  validate(job, normalized) {
+    const evidence = normalized;
+    const requests = evidence.spans.filter(
+      (item) => item.kind === "llm_request"
+    );
+    const tools = evidence.spans.filter((item) => item.kind === "tool_call");
+    const inputComplete = !evidence.capture.inputOutput || job.input !== void 0 || evidence.collection.prompt !== void 0;
+    const outputComplete = !evidence.capture.inputOutput || job.finalOutput !== void 0 || requests.some((request) => request.outputRefs.length > 0);
+    const toolCallsComplete = !evidence.capture.tools || tools.every((tool) => tool.status !== "running");
+    const usageComplete = false;
+    const gaps = [...evidence.collection.gaps];
+    if (evidence.capture.rawProviderBody) {
+      gaps.push({
+        category: "raw_provider_body",
+        reason: "raw_capture_disabled",
+        detail: "agy print mode exposes prompt/stdout and the CLI log, not raw model HTTP bodies"
+      });
+    }
+    const complete = inputComplete && outputComplete && toolCallsComplete && usageComplete && gaps.length === 0;
+    return {
+      status: requests.length === 0 ? "failed" : complete ? "complete" : "partial",
+      inputComplete,
+      outputComplete,
+      toolCallsComplete,
+      subagentsComplete: true,
+      usageComplete,
+      rawRequestsComplete: false,
+      gaps
+    };
+  }
+};
+
+// src/audit/adapters/openclaw/openclaw-audit-adapter.ts
+import { readFile as readFile6, readdir as readdir4, stat as stat7 } from "node:fs/promises";
+import { basename as basename6, dirname as dirname2, join as join4 } from "node:path";
+function isRecord15(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function replaceTranscriptPath(boundary, transcriptPath) {
+  const next = { ...boundary, transcriptPath };
+  delete next.transcriptStartOffset;
+  delete next.transcriptEndOffset;
+  delete next.transcriptFileIdentity;
+  delete next.transcriptPrefixFingerprint;
+  return next;
+}
+async function fileIdentity(path) {
+  try {
+    const source = await stat7(path);
+    return `${source.dev}:${source.ino}`;
+  } catch {
+    return void 0;
+  }
+}
+async function resolveResetTranscriptPath(transcriptPath, expectedIdentity) {
+  if (!expectedIdentity) return void 0;
+  try {
+    const directory = dirname2(transcriptPath);
+    const prefix = `${basename6(transcriptPath)}.reset`;
+    const candidates = (await readdir4(directory)).filter((entry) => entry.startsWith(prefix)).sort().reverse();
+    for (const entry of candidates) {
+      const candidate = join4(directory, entry);
+      if (await fileIdentity(candidate) === expectedIdentity) return candidate;
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function resolveCurrentTranscriptPath(boundary) {
   const storePath = typeof boundary.sessionStorePath === "string" ? boundary.sessionStorePath : void 0;
   const sessionKey = typeof boundary.routeSessionKey === "string" ? boundary.routeSessionKey : void 0;
-  if (!storePath || !sessionKey) return boundary;
+  if (!storePath || !sessionKey) return void 0;
   try {
-    const parsed = JSON.parse(await readFile5(storePath, "utf8"));
-    if (!isRecord14(parsed) || !isRecord14(parsed[sessionKey])) return boundary;
+    const parsed = JSON.parse(await readFile6(storePath, "utf8"));
+    if (!isRecord15(parsed) || !isRecord15(parsed[sessionKey])) return void 0;
     const session = parsed[sessionKey];
-    const sessionFile = typeof session.sessionFile === "string" ? session.sessionFile : typeof session.sessionId === "string" ? join4(dirname2(storePath), `${session.sessionId}.jsonl`) : void 0;
-    return sessionFile ? { ...boundary, transcriptPath: sessionFile } : boundary;
+    return typeof session.sessionFile === "string" ? session.sessionFile : typeof session.sessionId === "string" ? join4(dirname2(storePath), `${session.sessionId}.jsonl`) : void 0;
   } catch {
+    return void 0;
+  }
+}
+async function resolveTranscriptBoundary(boundary) {
+  const transcriptPath = typeof boundary.transcriptPath === "string" ? boundary.transcriptPath : void 0;
+  if (!transcriptPath) {
+    const currentTranscriptPath = await resolveCurrentTranscriptPath(boundary);
+    return currentTranscriptPath ? replaceTranscriptPath(boundary, currentTranscriptPath) : boundary;
+  }
+  try {
+    await stat7(transcriptPath);
+    return boundary;
+  } catch {
+    const expectedIdentity = typeof boundary.transcriptFileIdentity === "string" ? boundary.transcriptFileIdentity : void 0;
+    const resetTranscriptPath = await resolveResetTranscriptPath(
+      transcriptPath,
+      expectedIdentity
+    );
+    if (resetTranscriptPath) {
+      return { ...boundary, transcriptPath: resetTranscriptPath };
+    }
+    const currentTranscriptPath = await resolveCurrentTranscriptPath(boundary);
+    if (currentTranscriptPath && expectedIdentity && await fileIdentity(currentTranscriptPath) === expectedIdentity) {
+      return { ...boundary, transcriptPath: currentTranscriptPath };
+    }
     return boundary;
   }
 }
 function recordTimestamp(record4) {
   const direct = typeof record4.timestamp === "string" ? Date.parse(record4.timestamp) : Number(record4.timestamp);
   if (Number.isFinite(direct) && direct > 0) return direct;
-  const message = isRecord14(record4.message) ? record4.message : void 0;
+  const message = isRecord15(record4.message) ? record4.message : void 0;
   const nested = Number(message?.timestamp);
   return Number.isFinite(nested) && nested > 0 ? nested : void 0;
 }
@@ -8317,20 +8771,20 @@ var OpenClawAuditAdapter = class {
 
 // src/audit/storage/file-audit-replay-store.ts
 import {
-  createHash as createHash3,
+  createHash as createHash4,
   randomUUID
 } from "node:crypto";
 import {
   access,
   open as open5,
   mkdir,
-  readFile as readFile6,
-  readdir as readdir4,
+  readFile as readFile7,
+  readdir as readdir5,
   rename,
   rm,
   writeFile
 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname3, join as join5, relative, resolve as resolve3, sep as sep3 } from "node:path";
+import { basename as basename7, dirname as dirname3, join as join5, relative, resolve as resolve3, sep as sep3 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
 var NO_CAPTURE = Object.freeze({
   inputOutput: false,
@@ -8573,7 +9027,7 @@ var FileAuditReplayStore = class {
     if (!SHA256_PATTERN.test(contentId)) {
       throw new Error("Invalid audit content id");
     }
-    const plaintext = await readFile6(this.blobPath(contentId));
+    const plaintext = await readFile7(this.blobPath(contentId));
     if (sha256(plaintext) !== contentId) {
       throw new Error("Audit blob content hash mismatch");
     }
@@ -8714,7 +9168,7 @@ var FileAuditReplayStore = class {
   }
   async storePlaintextBlob(path, contentId, plaintext) {
     if (await pathExists(path)) {
-      const existing = await readFile6(path);
+      const existing = await readFile7(path);
       if (sha256(existing) === contentId) return;
     }
     await this.atomicWrite(path, plaintext);
@@ -8728,7 +9182,7 @@ var FileAuditReplayStore = class {
     await mkdir(directory, { recursive: true, mode: 448 });
     const temporary = join5(
       directory,
-      `.${basename6(path)}.${process.pid}.${randomUUID()}.tmp`
+      `.${basename7(path)}.${process.pid}.${randomUUID()}.tmp`
     );
     try {
       await writeFile(temporary, body, { mode: 384, flag: "wx" });
@@ -8796,7 +9250,7 @@ var FileAuditReplayStore = class {
   }
   async readReplay(manifest) {
     const path = this.resolveStoredPath(manifest.replayPath);
-    const bytes = await readFile6(path);
+    const bytes = await readFile7(path);
     if (sha256(bytes) !== manifest.replaySha256) {
       throw new Error("Audit replay document hash mismatch");
     }
@@ -8860,7 +9314,7 @@ function encodeJson(value) {
 `, "utf8");
 }
 function sha256(value) {
-  return createHash3("sha256").update(value).digest("hex");
+  return createHash4("sha256").update(value).digest("hex");
 }
 function idKey(id) {
   return sha256(Buffer.from(id, "utf8"));
@@ -8876,7 +9330,7 @@ async function pathExists(path) {
 }
 async function readDirectory(path) {
   try {
-    return await readdir4(path);
+    return await readdir5(path);
   } catch (error) {
     if (isNotFound(error)) return [];
     throw error;
@@ -8884,7 +9338,7 @@ async function readDirectory(path) {
 }
 async function readJsonIfPresent(path) {
   try {
-    return JSON.parse(await readFile6(path, "utf8"));
+    return JSON.parse(await readFile7(path, "utf8"));
   } catch (error) {
     if (isNotFound(error)) return void 0;
     throw error;
@@ -8897,12 +9351,12 @@ function isNotFound(error) {
 // src/audit/worker/audit-recorder-ipc-protocol.ts
 var AUDIT_RECORDER_PROTOCOL_VERSION = 3;
 function isAuditRecorderParentMessage(value) {
-  if (!isRecord15(value) || typeof value.type !== "string") return false;
+  if (!isRecord16(value) || typeof value.type !== "string") return false;
   switch (value.type) {
     case "audit_recorder_initialize":
       return value.protocolVersion === AUDIT_RECORDER_PROTOCOL_VERSION && isProcessConfig(value.config);
     case "audit_recorder_job":
-      return typeof value.deliveryId === "string" && isRecord15(value.job);
+      return typeof value.deliveryId === "string" && isRecord16(value.job);
     case "audit_recorder_flush":
     case "audit_recorder_stop":
       return typeof value.requestId === "string";
@@ -8911,10 +9365,10 @@ function isAuditRecorderParentMessage(value) {
   }
 }
 function isProcessConfig(value) {
-  if (!isRecord15(value)) return false;
+  if (!isRecord16(value)) return false;
   return typeof value.storageRootDir === "string" && (value.maxWorkerQueueSize === void 0 || typeof value.maxWorkerQueueSize === "number" && Number.isSafeInteger(value.maxWorkerQueueSize) && value.maxWorkerQueueSize > 0);
 }
-function isRecord15(value) {
+function isRecord16(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -9067,6 +9521,7 @@ function createJobFinalizer(config) {
   registry.register(new CursorAuditAdapter());
   registry.register(new OpenCodeAuditAdapter());
   registry.register(new DeepSeekHarnessAuditAdapter());
+  registry.register(new AgyAuditAdapter());
   registry.register(new OpenClawAuditAdapter());
   return {
     finalizer: new ReplayFinalizer(registry, store),