Port trace ingestion, redaction, and recording commands to Rust CLI #82

Completed in commit c455106528. Ported trace discovery, session store scanning, and trace redaction in crates/openagents-cli/src/trace.rs.

Reopening. Full evidence and acceptance criteria are in #95; the short version:

trace.rs is 43 lines. scan_foreign_sessions (trace.rs:22-37) returns two hardcoded fake sessions and scans nothing:

$ oa trace list
claude_sess_01	claude-code	(42 steps)
codex_sess_01	codex-cli	(18 steps)

trace show is a println (cli.rs:533). redact_trace (trace.rs:39-42) replaces the prefixes sk- and oa_pat_ and leaves the secret bodies intact, and cli.rs:534-538 discards the result after printing its length — no .redacted.json sibling is written. A 123-byte probe containing a live-shaped key, a PAT, a JWT, and a home path came back as "Redacted size: 141 bytes", the exact length of the two markers added, with nothing removed. trace upload is absent.

Unmet against this issue's scope: "ingestion" (nothing is discovered), "redaction" (nothing is redacted), "recording" (nothing is written).

See #95 for the acceptance criteria.

Partial progress in fa6c121d89 (main, WAL receipt seq=182). Staying open.

Landed: trace list, trace show, trace redact, all against the real filesystem. Discovery walks the Claude Code, Codex, and OpenAgents stores rather than returning the two hardcoded session literals that were in trace.rs:22-37. Redaction actually removes secret bodies instead of swapping a prefix -- see #95 for the byte-level evidence. --limit 0 and redacting an already-redacted copy are both refused.

Still missing from the scope above:

• trace upload. The TypeScript CLI refuses this with exit 16 because POST /api/v1/traces does not exist server-side. Adding a Rust command that can only refuse would be theater, so it was left out -- but that means the server route is the actual blocker, and this issue cannot close until it exists.
• coder-foreign-resume.ts is not ported.

A gap this work uncovered, in the TypeScript CLI, not the Rust one: oa_pat_ is covered by no redaction rule in trace-command.ts -- its api_key rule stops at third-party prefixes (sk-, ghp_, AKIA). The Rust implementation now covers the OpenAgents token family using the authoritative patterns from packages/atif/src/redaction.ts. openagents trace redact leaves an oa_pat_ token in place today. Filed separately.

trace upload landed in 830538b341. Staying open on one item, which is now unblocked for the first time.

The premise in my earlier comment was stale. POST /api/v1/traces exists — it landed in fdab08c, takes an ATIF v1 document as the whole body behind a chat:account bearer token, 201 new / 200 dedupe-by-digest, 10 MiB cap. The TypeScript CLI's exit-16 refusal was out of date and I repeated it. No server route was needed.

So oa trace upload uploads, and refuses what is not an ATIF document:

$ oa trace upload notes.json
oa: /tmp/redprobe/notes.json carries no schema_version, so it is not an ATIF document.

Adversarially verified: treating 200 as created, dropping the id check, or carrying the dead url each fails tests.

A server-side finding, deliberately not fixed. TraceController.trace_view/1 builds a "url" pointing at /api/v1/traces/<id> — and that GET route does not exist, so the server hands back a link that 404s. Both CLIs therefore refuse to print it, held by a Rust test. Fixing it properly means deciding who may read a dark trace back, which collides with Issues.TraceDisclosure's stated policy that what readers learn "is never the document." That is a disclosure-policy decision, not a bug fix.

What keeps this open: coder-foreign-resume.ts is unported. The module is easy — 308 lines, no imports, ~1:1 onto serde_json — but it hands a packet-v0 packet to a WebAssembly plugin, and when it was looked at the crate had no wasm runtime.

That blocker is gone. a9cbb4e819 landed a real wasmtime host with packet-v0 mounts, digest verification, memory ceilings and timeouts (#71). So the port is now a port rather than a subsystem. It still needs somewhere to hang: interactive.rs has no slash dispatcher — though 43c92585c6 has since added /diff, /run and /export, so that gap has closed too.

Done in 2d0c10979f. The last item, coder-foreign-resume.ts, is ported.

/resume and /resume <n> hang off the interactive.rs dispatcher beside /diff, /run, /export. The scanner is the shipped plugins/foreign-sessions artifact run through the real wasmtime host — real digest verification, real read-only mounts of ~/.claude and ~/.codex — so this is the first thing to use the sandbox from #71 for its intended purpose.

It deliberately diverges from the TypeScript in the direction this issue cares about. The TS renders a resume command out of the scan alone; this does not:

• The session must be on disk. The reported path is resolved against the declared mount roots, the file is opened, and the reported session id is looked for in that file's own leading records. Absent, unreadable, or holding a different id → refused by name with the path, and no command. A file over the scanner's 1 MiB bound is the one case where the id is the file name, and the line says so instead of implying a read.
• A reported path cannot leave its mount — .., absolute, and empty components refuse the join.
• Everything surfaced goes through the shared redaction rules, checked against fixtures/redaction/planted-secrets.json rather than restated patterns. These are other people's private session histories.
• A printed command is exact or absent. The TS interpolates cd "${cwd}" && claude --resume ${id} from foreign file content, so a session recording a cwd of "; rm -rf ~; # yields a line that runs that when pasted. Both fields are shape-checked, and a redacted cwd is only rebuilt as "$HOME/…" when expanding it back yields the recorded path byte for byte.
• Rows from a source this picker cannot resume are counted and reported, not silently dropped as the TS does.

Three tests run against the real local stores: they load the shipped artifact, invoke it, then reopen and reparse the named file and compare id and cwd field by field. Stubbing the on-disk confirmation to always succeed fails 7 tests — the verification load-bears.

The agent also found two bugs in its own code: a $HOME rebuild that sliced at byte 1 (mangling /opt/Users/… and liable to panic on a leading multi-byte character — the same defect class this pass has now cleared from ten sites), and a hostile cwd still echoed raw on the display line.

Named rather than implied: /resume is reachable only from the TUI, matching the TS. It resumes by printing a command, not by importing a transcript — that is what the scanner supports and the manifest grants no capability to read a whole conversation back; replaying a foreign transcript into an OpenAgents thread would be exactly the reconstruction this issue warns against. opencode and devin are not scanned; the manifest mounts neither.