/export and /report naming conflict — alias overlap causes confusion

[badchars]

Summary

/export and /report have overlapping naming that causes user confusion. /report declares aliases: ["export"] (session/index.tsx line 580), so typing /export can trigger either the transcript exporter or the report generator depending on autocomplete selection.

Current behavior

/export (session.export)

• Described as: "Export session transcript"
• Actually does: Formats session messages as Markdown conversation log
• Missing content: Does NOT include subagent conversations, full tool/MCP call details, thinking blocks are opt-in
• Output: <cwd>/session-<id>.md

/report (session.report)

• Described as: "Generate report"
• Actually does: Two-phase — TUI preview dialog then LLM agent generates security assessment report
• Output: .cyberstrike/reports/report-<timestamp>.md
• Data: Compiled from Vulnerability store, Intel coverage, Methodology state, Chains, Validation gates

The conflict

/report has aliases: ["export"] at line 580 of packages/cyberstrike/src/cli/cmd/tui/routes/session/index.tsx. This means /export appears twice in autocomplete — once as transcript export, once as report alias.

Expected behavior

Clear separation:

/export should be a complete session transcript

• All user prompts (verbatim)
• All assistant responses (full text)
• All subagent/orchestrator conversations (proxy-agent, testers, analyzer — currently missing)
• All tool calls with inputs and outputs (function calls, MCP calls)
• Thinking/reasoning blocks (included by default or clearly opt-in)
• Timestamps per message
• Token usage per step
• Session metadata (model, provider, agent, duration)
• Format: Markdown, structured for forensic review of what happened

/report should be a security assessment report

• Executive summary (LLM-generated)
• Vulnerability findings table (severity, status, evidence)
• Coverage metrics (methodology %, per-asset coverage)
• Attack chains
• Risk assessment and remediation priorities (LLM-generated)
• No raw conversation data — this is a deliverable, not a log
• Format: Markdown, structured for client/stakeholder delivery

Required changes

1. Remove aliases: ["export"] from /report — eliminate the naming conflict
2. Enhance /export transcript content:
   • Include subagent conversations (orchestrator dispatches proxy testers as subagents — their full conversations should appear in the export)
   • Include all tool/function/MCP call details by default
   • Include thinking/reasoning blocks
   • Add timestamps and token usage per step
3. Verify /report is clearly labeled — "Generate security report" not just "Generate report"

Affected files

• packages/cyberstrike/src/cli/cmd/tui/routes/session/index.tsx — Both slash command registrations (lines 575-596 for /report, lines 970-1029 for /export)
• packages/cyberstrike/src/cli/cmd/tui/util/transcript.ts — formatTranscript() function (needs subagent + tool detail enhancements)
• packages/cyberstrike/src/cli/cmd/tui/component/dialog-report.tsx — Report dialog (label clarity)
• packages/cyberstrike/src/cli/cmd/tui/ui/dialog-export-options.tsx — Export options dialog (default toggles)
• packages/cyberstrike/src/tool/generate-report.ts — Report generation tool (no changes needed, read-only confirmed)

Data safety note

Both /export and /report are confirmed read-only — neither modifies vulnerability records. Vulnerability mutations only happen via report_vulnerability and triage_vulnerability tools.

[badchars]

Fixed in two commits:

• 3d9276b — Remove export alias from /report, rename to 'Generate security report'
• 90eaf16 — Enhance /export with subagent sessions, step metrics, collapsible details