diff --git a/.changeset/web-session-export.md b/.changeset/web-session-export.md
new file mode 100644
index 0000000000..b704c67166
--- /dev/null
+++ b/.changeset/web-session-export.md
@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+web: Add session diagnostic export to download a session and bounded metadata-only troubleshooting logs as a ZIP. Run `/export` or pick Export session from a session's more menu. Web downloads are limited to 64 MiB.
diff --git a/apps/kimi-web/src/App.vue b/apps/kimi-web/src/App.vue
index b5167633fe..8e2e336348 100644
--- a/apps/kimi-web/src/App.vue
+++ b/apps/kimi-web/src/App.vue
@@ -470,6 +470,9 @@ function handleCommand(cmd: string): void {
     case '/fork':
       void client.forkSession();
       break;
+    case '/export':
+      void client.exportSession();
+      break;
     case '/undo':
       void client.undo();
       break;
@@ -663,6 +666,7 @@ function openPr(url: string): void {
         @rename="(id, title) => client.renameSession(id, title)"
         @archive="(id) => client.archiveSession(id)"
         @fork="(id) => client.forkSession(id)"
+        @export="(id) => client.exportSession(id)"
         @rename-workspace="(id, name) => client.renameWorkspace(id, name)"
         @delete-workspace="(id) => client.deleteWorkspace(id)"
         @reorder-workspaces="client.reorderWorkspaces($event)"
@@ -767,6 +771,7 @@ function openPr(url: string): void {
       @rename-session="(id, title) => client.renameSession(id, title)"
       @fork-session="(id) => client.forkSession(id)"
       @archive-session="(id) => client.archiveSession(id)"
+      @export-session="(id) => client.exportSession(id)"
       @compact="client.compact()"
       @pick-model="openModelPicker()"
       @select-model="handleComposerSelectModel($event)"
diff --git a/apps/kimi-web/src/api/daemon/client.ts b/apps/kimi-web/src/api/daemon/client.ts
index 4a9e5e10e0..5ff57e741a 100644
--- a/apps/kimi-web/src/api/daemon/client.ts
+++ b/apps/kimi-web/src/api/daemon/client.ts
@@ -3,6 +3,7 @@
 
 import type { KimiApiConfig } from '../config';
 import { buildRestUrl, buildWsUrl } from '../config';
+import { traceKeyEvent } from '../../debug/trace';
 import type {
   AppConfig,
   AppGoal,
@@ -87,6 +88,53 @@ import type {
 } from './wire';
 import { DaemonEventSocket } from './ws';
 
+function safeExportFileName(contentDisposition: string | undefined, fallback: string): string {
+  if (contentDisposition === undefined) return fallback;
+  let candidate: string | undefined;
+  const encoded = /filename\*\s*=\s*UTF-8''([^;]+)/i.exec(contentDisposition)?.[1]?.trim();
+  if (encoded !== undefined) {
+    try {
+      candidate = decodeURIComponent(encoded.replaceAll(/^"|"$/g, ''));
+    } catch {
+      return fallback;
+    }
+  } else {
+    candidate =
+      /filename\s*=\s*"([^"]*)"/i.exec(contentDisposition)?.[1] ??
+      /filename\s*=\s*([^;]+)/i.exec(contentDisposition)?.[1]?.trim();
+  }
+  if (
+    candidate === undefined ||
+    candidate.length === 0 ||
+    candidate.length > 200 ||
+    candidate === '.' ||
+    candidate === '..' ||
+    /[\u0000-\u001F\u007F/\\]/.test(candidate) ||
+    !candidate.toLowerCase().endsWith('.zip')
+  ) {
+    return fallback;
+  }
+  return candidate;
+}
+
+function errorTraceMetadata(err: unknown): Record<string, string | number | undefined> {
+  if (typeof err !== 'object' || err === null) return { errorName: typeof err };
+  const value = err as {
+    name?: unknown;
+    code?: unknown;
+    requestId?: unknown;
+    phase?: unknown;
+    status?: unknown;
+  };
+  return {
+    errorName: typeof value.name === 'string' ? value.name : 'Error',
+    errorCode: typeof value.code === 'number' ? value.code : undefined,
+    requestId: typeof value.requestId === 'string' ? value.requestId : undefined,
+    phase: typeof value.phase === 'string' ? value.phase : undefined,
+    httpStatus: typeof value.status === 'number' ? value.status : undefined,
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Wire response shapes for endpoints not in shared wire.ts
 // ---------------------------------------------------------------------------
@@ -481,36 +529,74 @@ export class DaemonKimiWebApi implements KimiWebApi {
    * Rebuild flow: getSessionSnapshot() → seedSnapshot() → subscribe(cursor).
    */
   async getSessionSnapshot(sessionId: string): Promise<AppSessionSnapshot> {
-    const data = await this.http.get<WireSessionSnapshot>(
-      `/sessions/${encodeURIComponent(sessionId)}/snapshot`,
+    const startedAt = Date.now();
+    traceKeyEvent('session:snapshot:start', { sessionId });
+    try {
+      const data = await this.http.get<WireSessionSnapshot>(
+        `/sessions/${encodeURIComponent(sessionId)}/snapshot`,
+      );
+      const snapshot: AppSessionSnapshot = {
+        asOfSeq: data.as_of_seq,
+        epoch: data.epoch,
+        session: toAppSession(data.session),
+        // Snapshot messages are already chronological ascending.
+        messages: data.messages.items.map(toAppMessage),
+        hasMoreMessages: data.messages.has_more,
+        inFlightTurn:
+          data.in_flight_turn === null
+            ? null
+            : {
+                turnId: data.in_flight_turn.turn_id,
+                assistantText: data.in_flight_turn.assistant_text,
+                thinkingText: data.in_flight_turn.thinking_text,
+                runningTools: data.in_flight_turn.running_tools.map((t) => ({
+                  toolCallId: t.tool_call_id,
+                  name: t.name,
+                  args: t.args,
+                  description: t.description,
+                  lastProgress: t.last_progress,
+                })),
+                promptId: data.in_flight_turn.current_prompt_id,
+              },
+        pendingApprovals: data.pending_approvals.map(toAppApprovalRequest),
+        pendingQuestions: data.pending_questions.map(toAppQuestionRequest),
+        // Older servers omit the roster entirely; treat as an empty roster.
+        subagents: (data.subagents ?? []).map(toAppTask),
+      };
+      traceKeyEvent('session:snapshot:accepted', {
+        sessionId,
+        status: snapshot.session.status,
+        seq: snapshot.asOfSeq,
+        messageCount: snapshot.messages.length,
+        durationMs: Date.now() - startedAt,
+      });
+      return snapshot;
+    } catch (error) {
+      traceKeyEvent('session:snapshot:failed', {
+        sessionId,
+        status: 'failed',
+        durationMs: Date.now() - startedAt,
+        ...errorTraceMetadata(error),
+      });
+      throw error;
+    }
+  }
+
+  async exportSession(
+    sessionId: string,
+    webLog?: string,
+  ): Promise<{ blob: Blob; fileName: string }> {
+    const webLogBytes = webLog === undefined ? 0 : new TextEncoder().encode(webLog).byteLength;
+    const webLogEntries = webLog === undefined || webLog.length === 0 ? 0 : webLog.split('\n').length;
+    const result = await this.http.postZip(
+      `/sessions/${encodeURIComponent(sessionId)}/export`,
+      { web_log: webLog },
+      { web_log_bytes: webLogBytes, web_log_entries: webLogEntries },
     );
+    const fallback = `${sessionId}.zip`;
     return {
-      asOfSeq: data.as_of_seq,
-      epoch: data.epoch,
-      session: toAppSession(data.session),
-      // Snapshot messages are already chronological ascending.
-      messages: data.messages.items.map(toAppMessage),
-      hasMoreMessages: data.messages.has_more,
-      inFlightTurn:
-        data.in_flight_turn === null
-          ? null
-          : {
-              turnId: data.in_flight_turn.turn_id,
-              assistantText: data.in_flight_turn.assistant_text,
-              thinkingText: data.in_flight_turn.thinking_text,
-              runningTools: data.in_flight_turn.running_tools.map((t) => ({
-                toolCallId: t.tool_call_id,
-                name: t.name,
-                args: t.args,
-                description: t.description,
-                lastProgress: t.last_progress,
-              })),
-              promptId: data.in_flight_turn.current_prompt_id,
-            },
-      pendingApprovals: data.pending_approvals.map(toAppApprovalRequest),
-      pendingQuestions: data.pending_questions.map(toAppQuestionRequest),
-      // Older servers omit the roster entirely; treat as an empty roster.
-      subagents: (data.subagents ?? []).map(toAppTask),
+      blob: result.blob,
+      fileName: safeExportFileName(result.contentDisposition, fallback),
     };
   }
 
@@ -522,15 +608,39 @@ export class DaemonKimiWebApi implements KimiWebApi {
     sessionId: string,
     input: PromptSubmission,
   ): Promise<PromptSubmitResult> {
-    const data = await this.http.post<WirePromptSubmitResult>(
-      `/sessions/${encodeURIComponent(sessionId)}/prompts`,
-      toWirePromptSubmission(input),
-    );
-    return {
-      promptId: data.prompt_id,
-      userMessageId: data.user_message_id,
-      status: data.status,
-    };
+    const startedAt = Date.now();
+    traceKeyEvent('prompt:start', {
+      sessionId,
+      contentCount: input.content.length,
+      mediaCount: input.content.filter((part) =>
+        part.type === 'image' || part.type === 'video' || part.type === 'file'
+      ).length,
+    });
+    try {
+      const data = await this.http.post<WirePromptSubmitResult>(
+        `/sessions/${encodeURIComponent(sessionId)}/prompts`,
+        toWirePromptSubmission(input),
+      );
+      traceKeyEvent('prompt:accepted', {
+        sessionId,
+        promptId: data.prompt_id,
+        status: data.status,
+        durationMs: Date.now() - startedAt,
+      });
+      return {
+        promptId: data.prompt_id,
+        userMessageId: data.user_message_id,
+        status: data.status,
+      };
+    } catch (error) {
+      traceKeyEvent('prompt:failed', {
+        sessionId,
+        status: 'failed',
+        durationMs: Date.now() - startedAt,
+        ...errorTraceMetadata(error),
+      });
+      throw error;
+    }
   }
 
   // POST /sessions/{id}/prompts:steer — steer daemon-queued prompts into the
diff --git a/apps/kimi-web/src/api/daemon/http.ts b/apps/kimi-web/src/api/daemon/http.ts
index 495f8422b0..140ca1deb3 100644
--- a/apps/kimi-web/src/api/daemon/http.ts
+++ b/apps/kimi-web/src/api/daemon/http.ts
@@ -12,6 +12,7 @@ import type { WireEnvelope } from './wire';
     composer's in-flight flag with them. Generous enough for slow endpoints;
     streaming runs over the WS, not these REST calls. */
 const REQUEST_TIMEOUT_MS = 30_000;
+const EXPORT_TIMEOUT_MS = 5 * 60_000;
 const ULID_ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
 const BODY_PREVIEW_LIMIT = 500;
 
@@ -27,9 +28,9 @@ export interface DaemonHttpClientIdentity {
 }
 
 /** AbortSignal.timeout with a fallback for older environments (jsdom). */
-function timeoutSignal(): AbortSignal | undefined {
+function timeoutSignal(timeoutMs = REQUEST_TIMEOUT_MS): AbortSignal | undefined {
   try {
-    return AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    return AbortSignal.timeout(timeoutMs);
   } catch {
     return undefined;
   }
@@ -178,6 +179,161 @@ export class DaemonHttpClient {
     return this.request<T>('POST', path, body, undefined, opts?.allowCodes);
   }
 
+  /** POST JSON and receive a raw ZIP. The request trace accepts a separate
+   * metadata-only body so large/sensitive export logs never enter the trace. */
+  async postZip(
+    path: string,
+    body: unknown,
+    traceBody: Record<string, number>,
+  ): Promise<{ blob: Blob; contentDisposition?: string }> {
+    const method = 'POST';
+    const url = buildRestUrl(this.origin, path);
+    const requestId = createRequestId();
+    const headers: Record<string, string> = {
+      'X-Request-Id': requestId,
+      'Content-Type': 'application/json; charset=utf-8',
+    };
+    this.addClientHeaders(headers);
+    const startedAt = Date.now();
+    traceRestRequest({ method, path, url, requestId, body: traceBody });
+
+    let response: Response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers,
+        body: JSON.stringify(body),
+        signal: timeoutSignal(EXPORT_TIMEOUT_MS),
+      });
+    } catch (error) {
+      traceRestFailure({
+        method,
+        path,
+        requestId,
+        phase: 'fetch',
+        durationMs: Date.now() - startedAt,
+        error,
+      });
+      throw new DaemonNetworkError({
+        message: `Network error calling ${method} ${path}`,
+        cause: error,
+        method,
+        path,
+        url,
+        requestId,
+        phase: 'fetch',
+        timeoutMs: EXPORT_TIMEOUT_MS,
+        timestamp: Date.now(),
+        durationMs: Date.now() - startedAt,
+      });
+    }
+
+    const contentType = response.headers.get('content-type') ?? undefined;
+    const mediaType = contentType?.split(';', 1)[0]?.trim().toLowerCase();
+    if (!response.ok || mediaType !== 'application/zip') {
+      let envelope: WireEnvelope<unknown> | undefined;
+      try {
+        envelope = (await response.clone().json()) as WireEnvelope<unknown>;
+      } catch {
+        // A non-JSON response is diagnosed below without consuming the body.
+      }
+      this.checkAuthRequired(response, envelope?.code ?? 0);
+      if (!response.ok || (envelope !== undefined && envelope.code !== 0)) {
+        const code = envelope?.code ?? response.status;
+        const msg = envelope?.msg ?? response.statusText;
+        traceRestResponse({
+          method,
+          path,
+          requestId,
+          status: response.status,
+          durationMs: Date.now() - startedAt,
+          code,
+          msg,
+          envelopeRequestId: envelope?.request_id,
+        });
+        throw new DaemonApiError({
+          code,
+          msg,
+          requestId: envelope?.request_id ?? requestId,
+          details: envelope?.details,
+          timestamp: Date.now(),
+          durationMs: Date.now() - startedAt,
+        });
+      }
+
+      const diagnosticResponse = response.clone();
+      const error = new TypeError(`Expected application/zip, received ${contentType ?? 'no content type'}`);
+      traceRestFailure({
+        method,
+        path,
+        requestId,
+        phase: 'parse',
+        durationMs: Date.now() - startedAt,
+        status: response.status,
+        error,
+      });
+      throw new DaemonNetworkError({
+        message: `Invalid ZIP response from ${method} ${path}`,
+        cause: error,
+        method,
+        path,
+        url,
+        requestId,
+        phase: 'parse',
+        timeoutMs: EXPORT_TIMEOUT_MS,
+        status: response.status,
+        statusText: response.statusText,
+        contentType,
+        bodyPreview: await readResponsePreview(diagnosticResponse),
+        timestamp: Date.now(),
+        durationMs: Date.now() - startedAt,
+      });
+    }
+
+    let blob: Blob;
+    try {
+      blob = await response.blob();
+    } catch (error) {
+      traceRestFailure({
+        method,
+        path,
+        requestId,
+        phase: 'parse',
+        durationMs: Date.now() - startedAt,
+        status: response.status,
+        error,
+      });
+      throw new DaemonNetworkError({
+        message: `Failed to read ZIP response from ${method} ${path}`,
+        cause: error,
+        method,
+        path,
+        url,
+        requestId,
+        phase: 'parse',
+        timeoutMs: EXPORT_TIMEOUT_MS,
+        status: response.status,
+        statusText: response.statusText,
+        contentType,
+        timestamp: Date.now(),
+        durationMs: Date.now() - startedAt,
+      });
+    }
+    traceRestResponse({
+      method,
+      path,
+      requestId,
+      status: response.status,
+      durationMs: Date.now() - startedAt,
+      code: 0,
+      msg: '',
+    });
+    return {
+      blob,
+      contentDisposition: response.headers.get('content-disposition') ?? undefined,
+    };
+  }
+
   /** Send multipart/form-data (FormData). Does NOT set Content-Type — browser sets it with boundary. */
   async postForm<T>(path: string, formData: FormData): Promise<T> {
     const url = buildRestUrl(this.origin, path);
diff --git a/apps/kimi-web/src/api/types.ts b/apps/kimi-web/src/api/types.ts
index def845bca2..cbcde2d07b 100644
--- a/apps/kimi-web/src/api/types.ts
+++ b/apps/kimi-web/src/api/types.ts
@@ -674,6 +674,8 @@ export interface KimiWebApi {
   listMessages(sessionId: string, input?: PageRequest & { role?: AppMessageRole }): Promise<Page<AppMessage>>;
   /** v2 initial sync: atomic session state + `asOfSeq` watermark + epoch. */
   getSessionSnapshot(sessionId: string): Promise<AppSessionSnapshot>;
+  /** Export the session archive, optionally including the bounded Web JSONL log. */
+  exportSession(sessionId: string, webLog?: string): Promise<{ blob: Blob; fileName: string }>;
   submitPrompt(sessionId: string, input: PromptSubmission): Promise<PromptSubmitResult>;
   /** Steer daemon-queued prompts into the active turn (TUI ctrl+s). */
   steerPrompts(sessionId: string, promptIds: string[]): Promise<{ steered: boolean; promptIds: string[] }>;
diff --git a/apps/kimi-web/src/components/SessionRow.vue b/apps/kimi-web/src/components/SessionRow.vue
index 30158be01c..bc3b55cf3d 100644
--- a/apps/kimi-web/src/components/SessionRow.vue
+++ b/apps/kimi-web/src/components/SessionRow.vue
@@ -37,6 +37,7 @@ const emit = defineEmits<{
   rename: [id: string, title: string];
   archive: [id: string];
   fork: [id: string];
+  export: [id: string];
 }>();
 
 // Full, absolute timestamp shown on hover (the row's `time` is a short relative
@@ -161,6 +162,12 @@ function forkRow(): void {
   emit('fork', props.session.id);
 }
 
+// Export this session as a ZIP
+function exportRow(): void {
+  closeMenu();
+  emit('export', props.session.id);
+}
+
 // Archive confirm — modal, consistent with remove-workspace.
 async function startArchive(): Promise<void> {
   closeMenu();
@@ -264,6 +271,7 @@ defineExpose({ closeMenu });
     <Teleport to="body">
       <Menu ref="menuRef" v-if="menuOpen" class="menu" :style="menuStyle" @click.stop>
         <MenuItem :danger="copyFailed" @click="copySessionId">
+          <Icon :name="copiedId ? 'check' : 'copy'" size="sm" />
           {{
             copyFailed
               ? t('sidebar.copyFailed')
@@ -273,9 +281,22 @@ defineExpose({ closeMenu });
           }}
         </MenuItem>
         <MenuItem separator />
-        <MenuItem @click="startRename">{{ t('sidebar.rename') }}</MenuItem>
-        <MenuItem @click="forkRow">{{ t('sidebar.fork') }}</MenuItem>
-        <MenuItem danger @click="startArchive">{{ t('sidebar.archive') }}</MenuItem>
+        <MenuItem @click="startRename">
+          <Icon name="pencil" size="sm" />
+          {{ t('sidebar.rename') }}
+        </MenuItem>
+        <MenuItem @click="forkRow">
+          <Icon name="git-fork" size="sm" />
+          {{ t('sidebar.fork') }}
+        </MenuItem>
+        <MenuItem @click="exportRow">
+          <Icon name="download" size="sm" />
+          {{ t('sidebar.export') }}
+        </MenuItem>
+        <MenuItem danger @click="startArchive">
+          <Icon name="archive" size="sm" />
+          {{ t('sidebar.archive') }}
+        </MenuItem>
         <MenuItem separator />
         <div class="menu-time">{{ fullTime }}</div>
       </Menu>
diff --git a/apps/kimi-web/src/components/Sidebar.vue b/apps/kimi-web/src/components/Sidebar.vue
index ffd07ed102..b7e6089abf 100644
--- a/apps/kimi-web/src/components/Sidebar.vue
+++ b/apps/kimi-web/src/components/Sidebar.vue
@@ -111,6 +111,7 @@ const emit = defineEmits<{
   rename: [id: string, title: string];
   archive: [id: string];
   fork: [id: string];
+  export: [id: string];
   renameWorkspace: [id: string, name: string];
   deleteWorkspace: [id: string];
   reorderWorkspaces: [ids: string[]];
@@ -792,6 +793,7 @@ onBeforeUnmount(() => {
               @rename-session="(id, title) => emit('rename', id, title)"
               @archive-session="(id) => emit('archive', id)"
               @fork-session="(id) => emit('fork', id)"
+              @export-session="(id) => emit('export', id)"
               @load-more="onLoadMore"
               @toggle-expand="toggleExpand"
               @confirm-rename="confirmRenameWorkspace"
diff --git a/apps/kimi-web/src/components/WorkspaceGroup.vue b/apps/kimi-web/src/components/WorkspaceGroup.vue
index 4fd870a791..7692fa4c41 100644
--- a/apps/kimi-web/src/components/WorkspaceGroup.vue
+++ b/apps/kimi-web/src/components/WorkspaceGroup.vue
@@ -42,6 +42,7 @@ const emit = defineEmits<{
   renameSession: [id: string, title: string];
   archiveSession: [id: string];
   forkSession: [id: string];
+  exportSession: [id: string];
   loadMore: [workspaceId: string];
   toggleExpand: [workspaceId: string];
   confirmRename: [];
@@ -183,6 +184,7 @@ function onHeaderDragStart(event: DragEvent): void {
         @rename="(id, title) => emit('renameSession', id, title)"
         @archive="emit('archiveSession', $event)"
         @fork="emit('forkSession', $event)"
+        @export="emit('exportSession', $event)"
       />
       <button
         v-if="group.hasMore || group.loadingMore"
diff --git a/apps/kimi-web/src/components/chat/ChatHeader.vue b/apps/kimi-web/src/components/chat/ChatHeader.vue
index 5de3154b9e..ef7e9f9e51 100644
--- a/apps/kimi-web/src/components/chat/ChatHeader.vue
+++ b/apps/kimi-web/src/components/chat/ChatHeader.vue
@@ -44,6 +44,7 @@ const emit = defineEmits<{
   renameSession: [id: string, title: string];
   forkSession: [id: string];
   archiveSession: [id: string];
+  exportSession: [id: string];
 }>();
 
 const ahead = computed(() => props.ahead ?? 0);
@@ -199,6 +200,15 @@ function forkSession(): void {
   emit('forkSession', props.sessionId);
 }
 
+// ---------------------------------------------------------------------------
+// Export
+// ---------------------------------------------------------------------------
+function exportSession(): void {
+  if (!props.sessionId) return;
+  closeMenu();
+  emit('exportSession', props.sessionId);
+}
+
 // ---------------------------------------------------------------------------
 // Archive — modal confirm (the header has no session row to swap, so use the
 // shared ConfirmDialog instead of the inline strip used in SessionRow).
@@ -262,23 +272,35 @@ async function startArchive(): Promise<void> {
       @click.stop
     >
       <MenuItem @click="onCopyAll">
+        <Icon :name="copied ? 'check' : 'copy'" size="sm" />
         {{ copied ? t('header.copied') : t('header.copyAll') }}
       </MenuItem>
       <MenuItem @click="onCopyFinalSummary">
+        <Icon name="file-text" size="sm" />
         {{ t('header.copyFinalSummary') }}
       </MenuItem>
       <template v-if="sessionId">
         <MenuItem separator />
         <MenuItem @click="copySessionId">
+          <Icon :name="copiedId ? 'check' : 'copy'" size="sm" />
           {{ copiedId ? t('header.copied') : t('header.copySessionId') }}
         </MenuItem>
         <MenuItem @click="startRename">
+          <Icon name="pencil" size="sm" />
           {{ t('header.renameSession') }}
         </MenuItem>
         <MenuItem @click="forkSession">
+          <Icon name="git-fork" size="sm" />
           {{ t('header.forkSession') }}
         </MenuItem>
-        <MenuItem danger @click="startArchive">{{ t('header.archiveSession') }}</MenuItem>
+        <MenuItem @click="exportSession">
+          <Icon name="download" size="sm" />
+          {{ t('header.exportSession') }}
+        </MenuItem>
+        <MenuItem danger @click="startArchive">
+          <Icon name="archive" size="sm" />
+          {{ t('header.archiveSession') }}
+        </MenuItem>
       </template>
     </Menu>
 
diff --git a/apps/kimi-web/src/components/chat/ConversationPane.vue b/apps/kimi-web/src/components/chat/ConversationPane.vue
index eff40b458e..aae9ff5fd2 100644
--- a/apps/kimi-web/src/components/chat/ConversationPane.vue
+++ b/apps/kimi-web/src/components/chat/ConversationPane.vue
@@ -135,6 +135,8 @@ const emit = defineEmits<{
   forkSession: [id: string];
   /** Chat header / session row: archive current session. */
   archiveSession: [id: string];
+  /** Chat header: export current session. */
+  exportSession: [id: string];
 }>();
 
 // Empty-composer workspace picker.
@@ -1254,6 +1256,7 @@ defineExpose({ loadComposerForEdit, focusComposer });
       @rename-session="(id, title) => emit('renameSession', id, title)"
       @fork-session="(id) => emit('forkSession', id)"
       @archive-session="(id) => emit('archiveSession', id)"
+      @export-session="(id) => emit('exportSession', id)"
     />
 
     <!-- Conversation outline: right edge rail of vertical bars (one per user
diff --git a/apps/kimi-web/src/composables/client/useWorkspaceState.ts b/apps/kimi-web/src/composables/client/useWorkspaceState.ts
index 7b9e797f5f..d3fd9847ee 100644
--- a/apps/kimi-web/src/composables/client/useWorkspaceState.ts
+++ b/apps/kimi-web/src/composables/client/useWorkspaceState.ts
@@ -35,6 +35,7 @@ import {
 } from '../../lib/storage';
 import { parseDiff } from '../../lib/parseDiff';
 import { coerceThinkingForModel } from '../../lib/modelThinking';
+import { sessionExportTraceToJsonl, traceKeyEvent } from '../../debug/trace';
 import { readSessionIdFromLocation, sessionUrl } from '../../lib/sessionRoute';
 import type { SessionUrlMode } from '../../lib/sessionRoute';
 import type {
@@ -295,6 +296,7 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
     fileDiffLines,
     fileDiffLoading,
   } = deps;
+  let exportInFlight = false;
 
   async function loadOlderMessages(sessionId: string): Promise<void> {
     if (rawState.messagesLoadingMoreBySession[sessionId]) return;
@@ -719,6 +721,9 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
   }
 
   async function load(): Promise<void> {
+    const startedAt = Date.now();
+    let traceStatus = 'accepted';
+    traceKeyEvent('app:load:start');
     rawState.loading = true;
     // The very first load gates on /auth before anything else: a transient
     // failure there (daemon still booting, network blip, 5xx) must NOT be read
@@ -731,6 +736,7 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
     try {
       if (firstLoad && (await waitForFirstAuth()) === 'server-auth-required') {
         authResolved = false;
+        traceStatus = 'auth-required';
         return;
       }
       const api = getKimiWebApi();
@@ -784,6 +790,7 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
         await selectSession(sessions[0]!.id, { urlMode: 'replace' });
       }
     } catch (err) {
+      traceStatus = 'failed';
       pushOperationFailure('load', err);
       // Do not re-throw — app stays mounted with empty sessions
     } finally {
@@ -791,6 +798,13 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
       // Without a definitive /auth outcome the splash stays up (retry loop or
       // ServerAuthDialog is handling it) — never expose the half-loaded app.
       if (authResolved) initialized.value = true;
+      traceKeyEvent('app:load:complete', {
+        status: traceStatus,
+        sessionId: rawState.activeSessionId,
+        sessionCount: rawState.sessions.length,
+        workspaceCount: rawState.workspaces.length,
+        durationMs: Date.now() - startedAt,
+      });
     }
   }
 
@@ -2129,6 +2143,77 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
     }
   }
 
+  /** Export the given session (default: the active one). The id is captured
+   * synchronously so a later session switch cannot redirect the in-flight
+   * request, and a lock prevents duplicate ZIP generation. */
+  async function exportSession(targetSessionId?: string): Promise<void> {
+    if (exportInFlight) return;
+    const sessionId = targetSessionId ?? rawState.activeSessionId;
+    if (!sessionId) {
+      const message = t('commands.export.noSession');
+      traceKeyEvent('export:failed', { status: 'no-session' });
+      pushOperationFailure('exportSession', new Error(message), { message });
+      return;
+    }
+    exportInFlight = true;
+    const startedAt = Date.now();
+    traceKeyEvent('export:start', { sessionId });
+    try {
+      const webLog = sessionExportTraceToJsonl();
+      const { blob, fileName } = await getKimiWebApi().exportSession(sessionId, webLog);
+      if (typeof document === 'undefined') throw new Error('Document is unavailable');
+      const url = URL.createObjectURL(blob);
+      let anchor: HTMLAnchorElement | undefined;
+      try {
+        anchor = document.createElement('a');
+        anchor.href = url;
+        anchor.download = fileName;
+        document.body.append(anchor);
+        anchor.click();
+      } finally {
+        anchor?.remove();
+        setTimeout(() => {
+          try {
+            URL.revokeObjectURL(url);
+          } catch {
+            // Object URL cleanup is best-effort in restricted browser contexts.
+          }
+        }, 0);
+      }
+      traceKeyEvent('export:accepted', {
+        sessionId,
+        status: 'accepted',
+        zipBytes: blob.size,
+        durationMs: Date.now() - startedAt,
+      });
+    } catch (error) {
+      const failure =
+        typeof error === 'object' && error !== null
+          ? (error as {
+              name?: unknown;
+              code?: unknown;
+              requestId?: unknown;
+              phase?: unknown;
+              status?: unknown;
+            })
+          : undefined;
+      traceKeyEvent('export:failed', {
+        sessionId,
+        status: 'failed',
+        durationMs: Date.now() - startedAt,
+        errorName:
+          typeof failure?.name === 'string' ? failure.name : typeof error,
+        errorCode: typeof failure?.code === 'number' ? failure.code : undefined,
+        requestId: typeof failure?.requestId === 'string' ? failure.requestId : undefined,
+        phase: typeof failure?.phase === 'string' ? failure.phase : undefined,
+        httpStatus: typeof failure?.status === 'number' ? failure.status : undefined,
+      });
+      pushOperationFailure('exportSession', error, { sessionId });
+    } finally {
+      exportInFlight = false;
+    }
+  }
+
   /** Restore an archived session — calls API, then puts the returned session
    *  back at the front of the list so it reappears in the sidebar. */
   async function restoreSession(id: string): Promise<boolean> {
@@ -2474,6 +2559,7 @@ export function useWorkspaceState(rawState: ExtendedState, deps: UseWorkspaceSta
     renameWorkspace,
     deleteWorkspace,
     archiveSession,
+    exportSession,
     restoreSession,
     loadArchivedSessions,
     logout,
diff --git a/apps/kimi-web/src/composables/useKimiWebClient.ts b/apps/kimi-web/src/composables/useKimiWebClient.ts
index 5797d838ea..40f86c0502 100644
--- a/apps/kimi-web/src/composables/useKimiWebClient.ts
+++ b/apps/kimi-web/src/composables/useKimiWebClient.ts
@@ -4,7 +4,7 @@
 
 import { computed, reactive, ref, watch } from 'vue';
 import { i18n } from '../i18n';
-import { traceClientEvent } from '../debug/trace';
+import { traceClientEvent, traceKeyEvent } from '../debug/trace';
 import { getKimiWebApi } from '../api';
 import { isDaemonApiError, isDaemonNetworkError } from '../api/errors';
 import {
@@ -496,6 +496,10 @@ if (typeof window !== 'undefined') {
 function recoverStaleConnection(): void {
   if (eventConn === null) return;
   if (!eventConn.health().stale) return;
+  traceKeyEvent('ws:stale-reconnect', {
+    sessionId: rawState.activeSessionId,
+    status: 'stale',
+  });
   traceClientEvent('ws: stale socket on focus, reconnecting', {
     activeSessionId: rawState.activeSessionId,
   });
@@ -948,6 +952,7 @@ function connectEventsIfNeeded(): void {
   // Guard: jsdom and some environments have no WebSocket
   if (typeof WebSocket === 'undefined') return;
 
+  traceKeyEvent('ws:connection', { status: 'connecting' });
   rawState.connection = 'connecting';
 
   const api = getKimiWebApi();
@@ -973,6 +978,11 @@ function connectEventsIfNeeded(): void {
     },
 
     onResync(sessionId: string, currentSeq: number, epoch?: string) {
+      traceKeyEvent('ws:resync', {
+        sessionId,
+        status: 'required',
+        seq: currentSeq,
+      });
       // Flush streaming deltas already queued so they render on the
       // pre-snapshot state (the snapshot is authoritative and will overwrite
       // them). Stragglers that arrive during the snapshot fetch are drained
@@ -989,7 +999,12 @@ function connectEventsIfNeeded(): void {
       snapshotSyncRunner.request(sessionId);
     },
 
-    onError(_code: number, msg: string, _fatal: boolean) {
+    onError(code: number, msg: string, fatal: boolean) {
+      traceKeyEvent('ws:error', {
+        status: 'failed',
+        errorCode: code,
+        fatal,
+      });
       pushWarning({
         severity: 'error',
         title: i18n.global.t('warnings.wsTitle'),
@@ -1001,6 +1016,9 @@ function connectEventsIfNeeded(): void {
     },
 
     onConnectionChange(connected: boolean) {
+      traceKeyEvent('ws:connection', {
+        status: connected ? 'connected' : 'disconnected',
+      });
       rawState.connected = connected;
       rawState.connection = connected ? 'connected' : 'disconnected';
       // The data channel is healthy again (server_hello received). Clear any
@@ -2743,6 +2761,7 @@ export function useKimiWebClient() {
     reorderWorkspaces,
     setWorkspaceSortMode,
     archiveSession: workspaceState.archiveSession,
+    exportSession: workspaceState.exportSession,
     restoreSession: workspaceState.restoreSession,
     loadArchivedSessions: workspaceState.loadArchivedSessions,
     compact: workspaceState.compact,
diff --git a/apps/kimi-web/src/debug/trace.ts b/apps/kimi-web/src/debug/trace.ts
index faca04c5ce..7cb06c4f63 100644
--- a/apps/kimi-web/src/debug/trace.ts
+++ b/apps/kimi-web/src/debug/trace.ts
@@ -1,11 +1,12 @@
 // apps/kimi-web/src/debug/trace.ts
-// KAP/daemon debug trace — a side-channel recording of REST calls and WS
-// frames, kept in a bounded ring buffer for the opt-in debug panel.
+// KAP/daemon trace — a side-channel recording of low-frequency client
+// lifecycle events plus opt-in REST/WS/console diagnostics.
 //
-// Opt-in: `?debug=1` in the URL or `localStorage["kimi-web.debug"]="1"`.
-// When not enabled every record call is a single boolean check, and nothing
-// is stored — normal use pays (almost) nothing. Recording NEVER changes the
-// request/WS behavior: callers pass data in, errors here must not propagate.
+// Full diagnostics are opt-in via `?debug=1` or
+// `localStorage["kimi-web.debug"]="1"`; key lifecycle metadata is always on.
+// Recording NEVER changes request/WS behavior: callers pass data in, errors
+// here must not propagate. Session exports use a separate metadata-only ring;
+// full REST/WS/console diagnostics never enter the archive.
 
 import { ref, shallowRef } from 'vue';
 import { safeGetString, STORAGE_KEYS } from '../lib/storage';
@@ -42,12 +43,64 @@ export interface TraceEntry {
   detail?: unknown;
 }
 
-const MAX_ENTRIES = 1000;
+const EXPORT_TRACE_EVENTS = [
+  'app:load:start',
+  'app:load:complete',
+  'export:start',
+  'export:accepted',
+  'export:failed',
+  'prompt:start',
+  'prompt:accepted',
+  'prompt:failed',
+  'session:snapshot:start',
+  'session:snapshot:accepted',
+  'session:snapshot:failed',
+  'window:error',
+  'window:unhandled-rejection',
+  'ws:connection',
+  'ws:error',
+  'ws:resync',
+  'ws:stale-reconnect',
+] as const;
+
+type ExportTraceEvent = (typeof EXPORT_TRACE_EVENTS)[number];
+
+export interface ExportTraceMetadata {
+  sessionId?: string;
+  status?: string;
+  seq?: number;
+  durationMs?: number;
+  messageCount?: number;
+  contentCount?: number;
+  mediaCount?: number;
+  sessionCount?: number;
+  workspaceCount?: number;
+  promptId?: string;
+  zipBytes?: number;
+  errorName?: string;
+  errorCode?: number;
+  requestId?: string;
+  phase?: string;
+  httpStatus?: number;
+  fatal?: boolean;
+  line?: number;
+  col?: number;
+}
+
+interface ExportTraceEntry extends ExportTraceMetadata {
+  ts: number;
+  event: ExportTraceEvent;
+}
+
+const MAX_ENTRIES = 500;
+const MAX_TOTAL_UTF8_BYTES = 256 * 1024;
+const MAX_EXPORT_STRING = 200;
 /** A single entry's detail JSON is capped so one giant frame (e.g. a snapshot
     with full scrollback) can't dominate the buffer's memory. */
 const MAX_DETAIL_JSON_CHARS = 16_384;
 const MAX_STRING = 500;
 const MAX_ARRAY_ITEMS = 50;
+const MAX_OBJECT_KEYS = 50;
 const MAX_DEPTH = 6;
 
 const SENSITIVE_KEY_RE = /api[_-]?key|authorization|token|secret|password|cookie|credential/i;
@@ -84,7 +137,13 @@ export function isTraceEnabled(): boolean {
 // ---------------------------------------------------------------------------
 
 const entries: TraceEntry[] = [];
+const entryJson: string[] = [];
+let totalUtf8Bytes = 0;
+const exportEntryJson: string[] = [];
+let exportTotalUtf8Bytes = 0;
 let nextId = 1;
+const utf8 = new TextEncoder();
+const exportTraceEvents = new Set<string>(EXPORT_TRACE_EVENTS);
 
 /** Bumped on every push; the panel re-reads the buffer when it changes. */
 export const traceVersion = ref(0);
@@ -97,16 +156,114 @@ export function traceEntries(): readonly TraceEntry[] {
 
 export function clearTrace(): void {
   entries.length = 0;
+  entryJson.length = 0;
+  totalUtf8Bytes = 0;
+  exportEntryJson.length = 0;
+  exportTotalUtf8Bytes = 0;
   traceVersion.value++;
 }
 
 function push(entry: Omit<TraceEntry, 'id' | 'ts'>): void {
   if (tracePaused.value) return;
-  entries.push({ id: nextId++, ts: Date.now(), ...entry });
-  if (entries.length > MAX_ENTRIES) entries.splice(0, entries.length - MAX_ENTRIES);
+  try {
+    const safeEntry: TraceEntry = {
+      id: nextId++,
+      ts: Date.now(),
+      source: entry.source,
+      kind: String(sanitizeForTrace(entry.kind)),
+      label: String(sanitizeForTrace(entry.label)),
+      sessionId:
+        entry.sessionId === undefined ? undefined : String(sanitizeForTrace(entry.sessionId)),
+      method: entry.method,
+      path: entry.path,
+      eventType: entry.eventType,
+      seq: entry.seq,
+      offset: entry.offset,
+      status: entry.status,
+      code: entry.code,
+      requestId: entry.requestId,
+      durationMs: entry.durationMs,
+      detail: detailOf(entry.detail),
+    };
+    const json = JSON.stringify(safeEntry);
+    const bytes = utf8.encode(json).byteLength;
+    // A single impossible-to-fit entry carries no useful debug signal and
+    // must not crowd the bounded panel buffer.
+    if (bytes > MAX_TOTAL_UTF8_BYTES) return;
+    entries.push(safeEntry);
+    entryJson.push(json);
+    totalUtf8Bytes += bytes + (entryJson.length > 1 ? 1 : 0);
+    while (entries.length > MAX_ENTRIES || totalUtf8Bytes > MAX_TOTAL_UTF8_BYTES) {
+      const removedJson = entryJson.shift();
+      entries.shift();
+      if (removedJson !== undefined) {
+        totalUtf8Bytes -= utf8.encode(removedJson).byteLength;
+        // Removing a non-empty buffer's first line also removes the newline
+        // that used to precede the new first line.
+        if (entryJson.length > 0) totalUtf8Bytes -= 1;
+      }
+    }
+  } catch {
+    return;
+  }
   traceVersion.value++;
 }
 
+function exportString(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  return value.length <= MAX_EXPORT_STRING ? value : value.slice(0, MAX_EXPORT_STRING);
+}
+
+function exportNumber(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+
+function pushExportTrace(event: string, info?: ExportTraceMetadata): void {
+  if (!exportTraceEvents.has(event)) return;
+  try {
+    const entry: ExportTraceEntry = {
+      ts: Date.now(),
+      event: event as ExportTraceEvent,
+      sessionId: exportString(info?.sessionId),
+      status: exportString(info?.status),
+      seq: exportNumber(info?.seq),
+      durationMs: exportNumber(info?.durationMs),
+      messageCount: exportNumber(info?.messageCount),
+      contentCount: exportNumber(info?.contentCount),
+      mediaCount: exportNumber(info?.mediaCount),
+      sessionCount: exportNumber(info?.sessionCount),
+      workspaceCount: exportNumber(info?.workspaceCount),
+      promptId: exportString(info?.promptId),
+      zipBytes: exportNumber(info?.zipBytes),
+      errorName: exportString(info?.errorName),
+      errorCode: exportNumber(info?.errorCode),
+      requestId: exportString(info?.requestId),
+      phase: exportString(info?.phase),
+      httpStatus: exportNumber(info?.httpStatus),
+      fatal: typeof info?.fatal === 'boolean' ? info.fatal : undefined,
+      line: exportNumber(info?.line),
+      col: exportNumber(info?.col),
+    };
+    const json = JSON.stringify(entry);
+    const bytes = utf8.encode(json).byteLength;
+    if (bytes > MAX_TOTAL_UTF8_BYTES) return;
+    exportEntryJson.push(json);
+    exportTotalUtf8Bytes += bytes + (exportEntryJson.length > 1 ? 1 : 0);
+    while (
+      exportEntryJson.length > MAX_ENTRIES ||
+      exportTotalUtf8Bytes > MAX_TOTAL_UTF8_BYTES
+    ) {
+      const removed = exportEntryJson.shift();
+      if (removed !== undefined) {
+        exportTotalUtf8Bytes -= utf8.encode(removed).byteLength;
+        if (exportEntryJson.length > 0) exportTotalUtf8Bytes -= 1;
+      }
+    }
+  } catch {
+    return;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Sanitization — redact sensitive keys, truncate long strings/arrays/depth.
 // ---------------------------------------------------------------------------
@@ -131,9 +288,13 @@ export function sanitizeForTrace(value: unknown, depth = 0): unknown {
     return out;
   }
   const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+  const objectEntries = Object.entries(value as Record<string, unknown>);
+  for (const [k, v] of objectEntries.slice(0, MAX_OBJECT_KEYS)) {
     out[k] = SENSITIVE_KEY_RE.test(k) ? '[redacted]' : sanitizeForTrace(v, depth + 1);
   }
+  if (objectEntries.length > MAX_OBJECT_KEYS) {
+    out['_truncatedKeys'] = objectEntries.length - MAX_OBJECT_KEYS;
+  }
   return out;
 }
 
@@ -296,12 +457,10 @@ export function traceWsIn(frame: unknown): void {
 }
 
 // ---------------------------------------------------------------------------
-// Client-side log capture — so the exported troubleshooting log includes the
-// front-end console (uncaught exceptions, rejected promises, and every console
-// level: error/warn/log/info/debug) that explains a broken page, not just
-// network traffic. Install-once, opt-in (only when tracing is enabled), and
-// never alters runtime behavior: the original console methods and default error
-// handling still run.
+// Client-side log capture for the opt-in debug panel. Console arguments may
+// contain user content, so these entries intentionally stay out of session
+// exports. Install-once and never alter runtime behavior: original console
+// methods and default error handling still run.
 // ---------------------------------------------------------------------------
 
 type ClientLogLevel = 'error' | 'warn' | 'log' | 'info' | 'debug';
@@ -328,7 +487,7 @@ function traceClientLog(level: ClientLogLevel, label: string, detail?: unknown):
     as audio playback) into the troubleshooting log. No-op unless tracing is
     enabled (?debug=1 or the debug localStorage flag), so production use pays
     only a boolean check. Prefer this over raw console.* for diagnostics that
-    should surface in the exported log. */
+    should surface in the debug panel. */
 export function traceClientEvent(label: string, detail?: unknown): void {
   if (!isTraceEnabled()) return;
   push({
@@ -339,47 +498,92 @@ export function traceClientEvent(label: string, detail?: unknown): void {
   });
 }
 
+/** Always-on, low-frequency product-path event. Only the explicitly selected
+ * fields are copied into the independent session-export ring. */
+export function traceKeyEvent(event: ExportTraceEvent, info?: ExportTraceMetadata): void {
+  pushExportTrace(event, info);
+  push({
+    source: 'client',
+    kind: 'client:key',
+    label: event,
+    sessionId: typeof info?.['sessionId'] === 'string' ? info['sessionId'] : undefined,
+    seq: typeof info?.['seq'] === 'number' ? info['seq'] : undefined,
+    durationMs: typeof info?.['durationMs'] === 'number' ? info['durationMs'] : undefined,
+    detail: info,
+  });
+}
+
 let clientCaptureInstalled = false;
+let uninstallClientCapture: (() => void) | null = null;
 
-/** Wire up window error + console.error/warn capture into the trace buffer. */
-export function installClientErrorCapture(): void {
-  if (clientCaptureInstalled || !isTraceEnabled()) return;
+/** Wire up always-on window failures and debug-only console capture. */
+export function installClientErrorCapture(): () => void {
+  if (clientCaptureInstalled) return () => uninstallClientCapture?.();
   clientCaptureInstalled = true;
 
+  const cleanup: Array<() => void> = [];
+
   try {
     if (typeof window !== 'undefined') {
-      window.addEventListener('error', (e: ErrorEvent) => {
-        traceClientLog('error', e.message || 'window error', {
-          source: e.filename,
+      const onError = (e: ErrorEvent): void => {
+        traceKeyEvent('window:error', {
+          status: 'failed',
+          errorName: e.error instanceof Error ? e.error.name : 'Error',
           line: e.lineno,
           col: e.colno,
-          stack: e.error instanceof Error ? e.error.stack : undefined,
         });
-      });
-      window.addEventListener('unhandledrejection', (e: PromiseRejectionEvent) => {
+      };
+      const onUnhandledRejection = (e: PromiseRejectionEvent): void => {
         const reason = e.reason;
-        traceClientLog('error', 'unhandled promise rejection', {
-          reason: reason instanceof Error ? `${reason.name}: ${reason.message}` : reason,
-          stack: reason instanceof Error ? reason.stack : undefined,
+        traceKeyEvent('window:unhandled-rejection', {
+          status: 'failed',
+          errorName: reason instanceof Error ? reason.name : typeof reason,
         });
+      };
+      window.addEventListener('error', onError);
+      window.addEventListener('unhandledrejection', onUnhandledRejection);
+      cleanup.push(() => {
+        window.removeEventListener('error', onError);
+      });
+      cleanup.push(() => {
+        window.removeEventListener('unhandledrejection', onUnhandledRejection);
       });
     }
   } catch {
     // window unavailable
   }
 
-  for (const level of ['error', 'warn', 'log', 'info', 'debug'] as const) {
-    const original = console[level];
-    if (typeof original !== 'function') continue;
-    console[level] = (...args: unknown[]): void => {
-      try {
-        traceClientLog(level, args.map(stringifyArg).join(' '), args.length > 1 ? args : args[0]);
-      } catch {
-        // never let tracing break logging
-      }
-      original.apply(console, args);
-    };
+  if (isTraceEnabled()) {
+    for (const level of ['error', 'warn', 'log', 'info', 'debug'] as const) {
+      const original = console[level];
+      if (typeof original !== 'function') continue;
+      const wrapped = (...args: unknown[]): void => {
+        try {
+          traceClientLog(level, args.map(stringifyArg).join(' '), args.length > 1 ? args : args[0]);
+        } catch {
+          // never let tracing break logging
+        }
+        original.apply(console, args);
+      };
+      console[level] = wrapped;
+      cleanup.push(() => {
+        if (console[level] === wrapped) console[level] = original;
+      });
+    }
   }
+
+  const dispose = (): void => {
+    if (uninstallClientCapture !== dispose) return;
+    for (const cleanupFunction of cleanup.toReversed()) cleanupFunction();
+    uninstallClientCapture = null;
+    clientCaptureInstalled = false;
+  };
+  uninstallClientCapture = dispose;
+  return dispose;
+}
+
+if (import.meta.hot) {
+  import.meta.hot.dispose(() => uninstallClientCapture?.());
 }
 
 function stringifyArg(a: unknown): string {
@@ -396,22 +600,37 @@ function stringifyArg(a: unknown): string {
 // Export
 // ---------------------------------------------------------------------------
 
-/** Download the captured trace as a JSONL file. Reusable so the debug panel and
-    any "Export log" UI action share one implementation. */
+/** Download the opt-in debug-panel trace as a JSONL file. */
 export function downloadTraceLog(list: readonly TraceEntry[] = entries): void {
   if (typeof document === 'undefined') return;
   const blob = new Blob([traceToJsonl(list)], { type: 'application/x-ndjson' });
   const url = URL.createObjectURL(blob);
-  const a = document.createElement('a');
-  a.href = url;
-  a.download = `kimi-web-log-${new Date().toISOString().replace(/[:.]/g, '-')}.jsonl`;
-  document.body.appendChild(a);
-  a.click();
-  a.remove();
-  URL.revokeObjectURL(url);
+  let anchor: HTMLAnchorElement | undefined;
+  try {
+    anchor = document.createElement('a');
+    anchor.href = url;
+    anchor.download = `kimi-web-log-${new Date().toISOString().replaceAll(/[:.]/g, '-')}.jsonl`;
+    document.body.append(anchor);
+    anchor.click();
+  } finally {
+    anchor?.remove();
+    setTimeout(() => {
+      try {
+        URL.revokeObjectURL(url);
+      } catch {
+        // Object URL cleanup is best-effort in restricted browser contexts.
+      }
+    }, 0);
+  }
 }
 
 /** Serialize the given entries (default: all) as JSONL for download. */
 export function traceToJsonl(list: readonly TraceEntry[] = entries): string {
+  if (list === entries) return entryJson.join('\n');
   return list.map((e) => JSON.stringify(e)).join('\n');
 }
+
+/** Serialize only the metadata-only ring accepted by session exports. */
+export function sessionExportTraceToJsonl(): string {
+  return exportEntryJson.join('\n');
+}
diff --git a/apps/kimi-web/src/i18n/locales/en/commands.ts b/apps/kimi-web/src/i18n/locales/en/commands.ts
index b1bdedcdf1..1b76d0c8a9 100644
--- a/apps/kimi-web/src/i18n/locales/en/commands.ts
+++ b/apps/kimi-web/src/i18n/locales/en/commands.ts
@@ -11,6 +11,10 @@ export default {
   thinking: { desc: 'Set the thinking level' },
   compact: { desc: 'Compact the conversation history' },
   fork: { desc: 'Fork this session into a new one' },
+  export: {
+    desc: 'Download this session and troubleshooting logs as a ZIP',
+    noSession: 'Open a session before exporting it.',
+  },
   status: { desc: 'View session status' },
   undo: { desc: 'Undo the last message' },
 } as const;
diff --git a/apps/kimi-web/src/i18n/locales/en/header.ts b/apps/kimi-web/src/i18n/locales/en/header.ts
index 4273de01de..cacbedb7c4 100644
--- a/apps/kimi-web/src/i18n/locales/en/header.ts
+++ b/apps/kimi-web/src/i18n/locales/en/header.ts
@@ -20,4 +20,5 @@ export default {
   renameSession: 'Rename',
   forkSession: 'Fork session',
   archiveSession: 'Archive',
+  exportSession: 'Export session',
 };
diff --git a/apps/kimi-web/src/i18n/locales/en/sidebar.ts b/apps/kimi-web/src/i18n/locales/en/sidebar.ts
index e87c42cd5d..70a3f932ac 100644
--- a/apps/kimi-web/src/i18n/locales/en/sidebar.ts
+++ b/apps/kimi-web/src/i18n/locales/en/sidebar.ts
@@ -20,6 +20,7 @@ export default {
   copyFailed: 'Copy failed',
   archive: 'Archive',
   fork: 'Fork session',
+  export: 'Export session',
   delete: 'Delete',
   removeWorkspace: 'Remove workspace',
   brand: 'Kimi Code',
diff --git a/apps/kimi-web/src/i18n/locales/zh/commands.ts b/apps/kimi-web/src/i18n/locales/zh/commands.ts
index 189d2d94eb..ebb8b2d9ad 100644
--- a/apps/kimi-web/src/i18n/locales/zh/commands.ts
+++ b/apps/kimi-web/src/i18n/locales/zh/commands.ts
@@ -11,6 +11,10 @@ export default {
   thinking: { desc: '设置思考强度' },
   compact: { desc: '压缩会话历史' },
   fork: { desc: '把当前会话 fork 出一个新会话' },
+  export: {
+    desc: '将当前会话和排障日志下载为 ZIP 压缩包',
+    noSession: '请先打开一个会话再导出。',
+  },
   status: { desc: '查看会话状态' },
   undo: { desc: '撤销上一条消息' },
 };
diff --git a/apps/kimi-web/src/i18n/locales/zh/header.ts b/apps/kimi-web/src/i18n/locales/zh/header.ts
index 687845609e..e94a960275 100644
--- a/apps/kimi-web/src/i18n/locales/zh/header.ts
+++ b/apps/kimi-web/src/i18n/locales/zh/header.ts
@@ -20,4 +20,5 @@ export default {
   renameSession: '重命名',
   forkSession: '分叉会话',
   archiveSession: '归档',
+  exportSession: '导出会话',
 };
diff --git a/apps/kimi-web/src/i18n/locales/zh/sidebar.ts b/apps/kimi-web/src/i18n/locales/zh/sidebar.ts
index dd07bc763f..66006924bc 100644
--- a/apps/kimi-web/src/i18n/locales/zh/sidebar.ts
+++ b/apps/kimi-web/src/i18n/locales/zh/sidebar.ts
@@ -20,6 +20,7 @@ export default {
   copyFailed: '复制失败',
   archive: '归档',
   fork: '分叉会话',
+  export: '导出会话',
   delete: '删除',
   removeWorkspace: '移除工作区',
   brand: 'Kimi Code',
diff --git a/apps/kimi-web/src/lib/icons.ts b/apps/kimi-web/src/lib/icons.ts
index 6e2b43d08b..fcd6025e0f 100644
--- a/apps/kimi-web/src/lib/icons.ts
+++ b/apps/kimi-web/src/lib/icons.ts
@@ -40,6 +40,7 @@ import TablerSidebarLeftExpand from '~icons/tabler/layout-sidebar-left-expand';
 // Components (Remix) ---------------------------------------------------------
 import RiAddLine from '~icons/ri/add-line';
 import RiAlertLine from '~icons/ri/alert-line';
+import RiArchiveLine from '~icons/ri/archive-line';
 import RiArrowDownLine from '~icons/ri/arrow-down-line';
 import RiArrowDownSLine from '~icons/ri/arrow-down-s-line';
 import RiArrowGoBackLine from '~icons/ri/arrow-go-back-line';
@@ -67,6 +68,7 @@ import RiFileTextLine from '~icons/ri/file-text-line';
 import RiFlashlightLine from '~icons/ri/flashlight-line';
 import RiFolderAddLine from '~icons/ri/folder-add-line';
 import RiFolderFill from '~icons/ri/folder-fill';
+import RiGitForkLine from '~icons/ri/git-fork-line';
 import RiGitPullRequestLine from '~icons/ri/git-pull-request-line';
 import RiGlobalLine from '~icons/ri/global-line';
 import RiImageLine from '~icons/ri/image-line';
@@ -108,6 +110,7 @@ import RawTablerSidebarLeftExpand from '~icons/tabler/layout-sidebar-left-expand
 // Raw SVG strings (Remix) ----------------------------------------------------
 import RawAddLine from '~icons/ri/add-line?raw';
 import RawAlertLine from '~icons/ri/alert-line?raw';
+import RawArchiveLine from '~icons/ri/archive-line?raw';
 import RawArrowDownLine from '~icons/ri/arrow-down-line?raw';
 import RawArrowDownSLine from '~icons/ri/arrow-down-s-line?raw';
 import RawArrowGoBackLine from '~icons/ri/arrow-go-back-line?raw';
@@ -135,6 +138,7 @@ import RawFileTextLine from '~icons/ri/file-text-line?raw';
 import RawFlashlightLine from '~icons/ri/flashlight-line?raw';
 import RawFolderAddLine from '~icons/ri/folder-add-line?raw';
 import RawFolderFill from '~icons/ri/folder-fill?raw';
+import RawGitForkLine from '~icons/ri/git-fork-line?raw';
 import RawGitPullRequestLine from '~icons/ri/git-pull-request-line?raw';
 import RawGlobalLine from '~icons/ri/global-line?raw';
 import RawImageLine from '~icons/ri/image-line?raw';
@@ -170,6 +174,7 @@ export type IconName =
   | 'calendar-todo'
   | 'close'
   | 'check'
+  | 'archive'
   | 'search'
   | 'copy'
   | 'link'
@@ -212,6 +217,7 @@ export type IconName =
   | 'globe'
   | 'check-list'
   | 'bolt'
+  | 'git-fork'
   | 'git-pull-request'
   | 'message'
   | 'mail'
@@ -252,6 +258,7 @@ export const ICONS: Record<IconName, IconEntry> = {
   'calendar-todo': entry(RiCalendarTodoLine, RawCalendarTodoLine),
   close: entry(RiCloseLine, RawCloseLine),
   check: entry(RiCheckLine, RawCheckLine),
+  archive: entry(RiArchiveLine, RawArchiveLine),
   search: entry(KimiSearch, RawKimiSearch),
   copy: entry(RiFileCopyLine, RawFileCopyLine),
   link: entry(RiLinksLine, RawLinksLine),
@@ -294,6 +301,7 @@ export const ICONS: Record<IconName, IconEntry> = {
   globe: entry(RiGlobalLine, RawGlobalLine),
   'check-list': entry(RiListCheck, RawListCheck),
   bolt: entry(RiFlashlightLine, RawFlashlightLine),
+  'git-fork': entry(RiGitForkLine, RawGitForkLine),
   'git-pull-request': entry(RiGitPullRequestLine, RawGitPullRequestLine),
   message: entry(RiMessageLine, RawMessageLine),
   mail: entry(RiMailLine, RawMailLine),
@@ -394,7 +402,9 @@ export const ICON_GROUPS: ReadonlyArray<readonly [string, readonly IconName[]]>
       'globe',
       'check-list',
       'bolt',
+      'git-fork',
       'git-pull-request',
+      'archive',
       'target',
       'calendar-schedule',
       'calendar-todo',
diff --git a/apps/kimi-web/src/lib/slashCommands.ts b/apps/kimi-web/src/lib/slashCommands.ts
index 7b6199e8cb..cbc080efd0 100644
--- a/apps/kimi-web/src/lib/slashCommands.ts
+++ b/apps/kimi-web/src/lib/slashCommands.ts
@@ -35,6 +35,7 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: '/compact',    desc: 'commands.compact.desc', acceptsInput: true },
   { name: '/undo',       desc: 'commands.undo.desc' },
   { name: '/fork',       desc: 'commands.fork.desc' },
+  { name: '/export',     desc: 'commands.export.desc' },
   { name: '/status',     desc: 'commands.status.desc' },
 ];
 
diff --git a/apps/kimi-web/src/main.ts b/apps/kimi-web/src/main.ts
index 55475a2348..8a1b5280f9 100644
--- a/apps/kimi-web/src/main.ts
+++ b/apps/kimi-web/src/main.ts
@@ -7,9 +7,8 @@ import '@fontsource-variable/inter/opsz-italic.css';
 import '@fontsource-variable/jetbrains-mono/wght.css';
 import './style.css';
 
-// Opt-in (only with ?debug=1 / the debug flag): fold front-end errors and
-// console.error/warn into the trace buffer so the panel's "export jsonl" gives
-// a complete troubleshooting log, not just network traffic.
+// Always retain bounded metadata for uncaught failures. With ?debug=1 / the
+// debug flag, console output is included too; HMR restores listeners/wrappers.
 installClientErrorCapture();
 
 createApp(App).use(i18n).mount('#app');
diff --git a/apps/kimi-web/test/daemon-client.test.ts b/apps/kimi-web/test/daemon-client.test.ts
index d24461289d..1d452ff54b 100644
--- a/apps/kimi-web/test/daemon-client.test.ts
+++ b/apps/kimi-web/test/daemon-client.test.ts
@@ -1,10 +1,12 @@
 // apps/kimi-web/test/daemon-client.test.ts
-// DaemonKimiWebApi.getSessionGoal — wire → app mapping of GET /sessions/{id}/goal:
-// a present snapshot, explicit null (no active goal), and the request URL.
+// DaemonKimiWebApi public REST adapter: session export binary/error contracts
+// and getSessionGoal wire → app mapping.
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { DaemonKimiWebApi } from '../src/api/daemon/client';
+import { DaemonApiError, DaemonNetworkError } from '../src/api/errors';
+import { clearTrace, traceToJsonl } from '../src/debug/trace';
 
 function envelope(data: unknown): Response {
   return new Response(JSON.stringify({ code: 0, msg: '', data }), {
@@ -44,6 +46,106 @@ function createApi(): DaemonKimiWebApi {
   });
 }
 
+describe('DaemonKimiWebApi.exportSession', () => {
+  beforeEach(() => {
+    vi.stubGlobal('location', { search: '?debug=1' });
+    vi.stubGlobal('fetch', vi.fn());
+    clearTrace();
+  });
+
+  afterEach(() => {
+    clearTrace();
+    vi.unstubAllGlobals();
+  });
+
+  it('posts the Web log to the encoded session export endpoint and returns the ZIP', async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(new Uint8Array([80, 75, 3, 4]), {
+        status: 200,
+        headers: {
+          'content-type': 'application/zip',
+          'content-disposition': 'attachment; filename="session-export.zip"',
+        },
+      }),
+    );
+
+    const result = await createApi().exportSession('sess/1', '{"event":"safe"}');
+
+    expect(vi.mocked(fetch).mock.calls[0]?.[0]).toBe(
+      'http://daemon.test/api/v1/sessions/sess%2F1/export',
+    );
+    expect(vi.mocked(fetch).mock.calls[0]?.[1]).toMatchObject({
+      method: 'POST',
+      body: JSON.stringify({ web_log: '{"event":"safe"}' }),
+    });
+    expect(result.fileName).toBe('session-export.zip');
+    expect(result.blob.size).toBe(4);
+  });
+
+  it('falls back to a session-id ZIP name for an unsafe response filename', async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(new Uint8Array([80, 75]), {
+        status: 200,
+        headers: {
+          'content-type': 'application/zip',
+          'content-disposition': 'attachment; filename="../credentials.zip"',
+        },
+      }),
+    );
+
+    const result = await createApi().exportSession('sess_1');
+
+    expect(result.fileName).toBe('sess_1.zip');
+  });
+
+  it('parses a JSON error envelope returned by the export endpoint', async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({ code: 41301, msg: 'export too large', request_id: 'req_server' }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      ),
+    );
+
+    const caught = await createApi()
+      .exportSession('sess_1', 'log')
+      .catch((error: unknown) => error);
+
+    expect(caught).toBeInstanceOf(DaemonApiError);
+    expect(caught).toMatchObject({ code: 41301, requestId: 'req_server' });
+  });
+
+  it('rejects a successful response whose media type is not a ZIP', async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      new Response('not a zip', {
+        status: 200,
+        headers: { 'content-type': 'text/plain' },
+      }),
+    );
+
+    const caught = await createApi().exportSession('sess_1').catch((error: unknown) => error);
+
+    expect(caught).toBeInstanceOf(DaemonNetworkError);
+    expect(caught).toMatchObject({ phase: 'parse', contentType: 'text/plain' });
+  });
+
+  it('records only Web-log counts in the request trace', async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(new Uint8Array([80, 75]), {
+        status: 200,
+        headers: { 'content-type': 'application/zip' },
+      }),
+    );
+    const secret = 'PROMPT_CONTENT_MUST_NOT_ENTER_TRACE';
+
+    await createApi().exportSession('sess_1', `${secret}\nsecond line`);
+
+    const trace = traceToJsonl();
+    expect(trace).not.toContain(secret);
+    expect(trace).toContain('web_log_bytes');
+    expect(trace).toContain('web_log_entries');
+  });
+});
+
 describe('DaemonKimiWebApi.getSessionGoal', () => {
   beforeEach(() => {
     vi.stubGlobal('fetch', vi.fn());
diff --git a/apps/kimi-web/test/lib-logic.test.ts b/apps/kimi-web/test/lib-logic.test.ts
index 7562f6cc0c..e79bd2cd1a 100644
--- a/apps/kimi-web/test/lib-logic.test.ts
+++ b/apps/kimi-web/test/lib-logic.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   collectFilePathAliases,
   findFilePathLinks,
@@ -32,6 +32,163 @@ import AgentTool from '../src/components/chat/tool-calls/AgentTool.vue';
 import EditTool from '../src/components/chat/tool-calls/EditTool.vue';
 import GenericTool from '../src/components/chat/tool-calls/GenericTool.vue';
 import type { ToolCall } from '../src/types';
+import {
+  clearTrace,
+  installClientErrorCapture,
+  sanitizeForTrace,
+  sessionExportTraceToJsonl,
+  traceEntries,
+  traceKeyEvent,
+  tracePaused,
+  traceRestRequest,
+  traceToJsonl,
+  traceWsIn,
+} from '../src/debug/trace';
+
+// The trace tests exercise its exported recording/serialization contract:
+// session exports receive only bounded, explicitly selected metadata.
+
+describe('bounded Web trace', () => {
+  beforeEach(() => {
+    tracePaused.value = false;
+    clearTrace();
+  });
+
+  afterEach(() => {
+    clearTrace();
+    vi.unstubAllGlobals();
+  });
+
+  it('copies only allowlisted key-path metadata into the independent export ring', () => {
+    const secret = 'PROMPT_TEXT_MUST_NOT_BE_EXPORTED';
+    const metadata = {
+      sessionId: 'sess_1',
+      contentCount: 2,
+      mediaCount: 1,
+      text: secret,
+      apiKey: secret,
+    };
+    traceKeyEvent('prompt:start', metadata);
+
+    metadata.sessionId = 'changed_after_recording';
+
+    expect(traceEntries()).toHaveLength(1);
+    expect(JSON.parse(sessionExportTraceToJsonl())).toEqual({
+      ts: expect.any(Number),
+      event: 'prompt:start',
+      sessionId: 'sess_1',
+      contentCount: 2,
+      mediaCount: 1,
+    });
+    expect(sessionExportTraceToJsonl()).not.toContain(secret);
+  });
+
+  it('records export metadata even while the full debug panel is paused', () => {
+    tracePaused.value = true;
+
+    traceKeyEvent('ws:connection', { status: 'connected' });
+
+    expect(traceEntries()).toHaveLength(0);
+    expect(JSON.parse(sessionExportTraceToJsonl())).toMatchObject({
+      event: 'ws:connection',
+      status: 'connected',
+    });
+  });
+
+  it('caps object keys and reports how many were omitted', () => {
+    const input = Object.fromEntries(Array.from({ length: 60 }, (_, index) => [`key${index}`, index]));
+
+    const result = sanitizeForTrace(input) as Record<string, unknown>;
+
+    expect(result['_truncatedKeys']).toBe(10);
+    expect(Object.keys(result)).toHaveLength(51);
+  });
+
+  it('keeps at most 500 of the newest export entries', () => {
+    for (let index = 0; index < 501; index++) {
+      traceKeyEvent('ws:connection', { status: String(index) });
+    }
+
+    const exported = sessionExportTraceToJsonl().split('\n').map((line) => JSON.parse(line));
+    expect(exported).toHaveLength(500);
+    expect(exported[0]).toMatchObject({ status: '1' });
+    expect(exported.at(-1)).toMatchObject({ status: '500' });
+  });
+
+  it('keeps export JSONL within the 256 KiB UTF-8 budget including newlines', () => {
+    for (let index = 0; index < 500; index++) {
+      traceKeyEvent('export:failed', {
+        sessionId: `sess-${index}-${'😀'.repeat(200)}`,
+        status: '😀'.repeat(200),
+        promptId: '😀'.repeat(200),
+        errorName: '😀'.repeat(200),
+        requestId: '😀'.repeat(200),
+        phase: '😀'.repeat(200),
+      });
+    }
+
+    const jsonl = sessionExportTraceToJsonl();
+    expect(new TextEncoder().encode(jsonl).byteLength).toBeLessThanOrEqual(256 * 1024);
+    expect(JSON.parse(jsonl.split('\n').at(-1)!)).toMatchObject({
+      sessionId: expect.stringMatching(/^sess-499-/),
+    });
+  });
+
+  it('never copies prompt, WebSocket, or console content from the full debug trace', () => {
+    vi.stubGlobal('location', { search: '?debug=1' });
+    const promptSecret = 'PROMPT_SECRET_9fdb1a';
+    const wsSecret = 'WS_PAYLOAD_SECRET_b84c7e';
+    const consoleSecret = 'CONSOLE_SECRET_a2d693';
+
+    traceRestRequest({
+      method: 'POST',
+      path: '/sessions/sess_1/prompts',
+      url: 'http://daemon.test/api/v1/sessions/sess_1/prompts',
+      requestId: 'req_1',
+      body: { prompt: promptSecret },
+    });
+    traceWsIn({
+      type: 'event',
+      session_id: 'sess_1',
+      seq: 4,
+      payload: { text: wsSecret },
+    });
+
+    const originalLog = console.log;
+    console.log = vi.fn();
+    const dispose = installClientErrorCapture();
+    try {
+      console.log(consoleSecret, { value: consoleSecret });
+    } finally {
+      dispose();
+      console.log = originalLog;
+    }
+
+    traceKeyEvent('prompt:start', {
+      sessionId: 'sess_1',
+      contentCount: 1,
+      mediaCount: 0,
+      text: promptSecret,
+    });
+
+    const fullDebugTrace = traceToJsonl();
+    expect(fullDebugTrace).toContain(promptSecret);
+    expect(fullDebugTrace).toContain(wsSecret);
+    expect(fullDebugTrace).toContain(consoleSecret);
+
+    const sessionExportTrace = sessionExportTraceToJsonl();
+    expect(sessionExportTrace).not.toContain(promptSecret);
+    expect(sessionExportTrace).not.toContain(wsSecret);
+    expect(sessionExportTrace).not.toContain(consoleSecret);
+    expect(JSON.parse(sessionExportTrace)).toEqual({
+      ts: expect.any(Number),
+      event: 'prompt:start',
+      sessionId: 'sess_1',
+      contentCount: 1,
+      mediaCount: 0,
+    });
+  });
+});
 
 describe('workspace path input', () => {
   it('recognizes the supported absolute path forms', () => {
diff --git a/apps/kimi-web/test/slash-menu.test.ts b/apps/kimi-web/test/slash-menu.test.ts
index 1f24c23bb7..35694194a6 100644
--- a/apps/kimi-web/test/slash-menu.test.ts
+++ b/apps/kimi-web/test/slash-menu.test.ts
@@ -3,6 +3,9 @@ import { nextTick, ref, type Ref } from 'vue';
 import type { AppSkill } from '../src/api/types';
 import { useSlashMenu } from '../src/composables/useSlashMenu';
 
+// Public slash-menu contract: matching built-ins and dispatching selected
+// commands without coupling tests to component internals.
+
 interface MockTextarea {
   value: string;
   selectionStart: number;
@@ -56,6 +59,12 @@ describe('useSlashMenu — update', () => {
     expect(slash.items.value.map((i) => i.name)).toContain('/compact');
   });
 
+  it('offers the session export command for an export prefix', () => {
+    const { slash } = setup('/exp');
+    slash.update();
+    expect(slash.items.value.map((item) => item.name)).toContain('/export');
+  });
+
   it('closes when nothing matches', () => {
     const { slash } = setup('/zzzznotacommand');
     slash.update();
diff --git a/apps/kimi-web/test/workspace-state.test.ts b/apps/kimi-web/test/workspace-state.test.ts
index 6e5c4c6821..9502a94c97 100644
--- a/apps/kimi-web/test/workspace-state.test.ts
+++ b/apps/kimi-web/test/workspace-state.test.ts
@@ -7,6 +7,7 @@ import { mergeWorkspaces } from '../src/lib/mergeWorkspaces';
 import { loadWorkspaceNameOverrides, saveWorkspaceNameOverrides } from '../src/lib/storage';
 import { useWorkspaceState, type UseWorkspaceStateDeps } from '../src/composables/client/useWorkspaceState';
 import type { ExtendedState } from '../src/composables/useKimiWebClient';
+import { clearTrace, traceKeyEvent } from '../src/debug/trace';
 
 const apiMock = vi.hoisted(() => ({
   abortPrompt: vi.fn(),
@@ -14,6 +15,7 @@ const apiMock = vi.hoisted(() => ({
   addWorkspace: vi.fn(),
   updateWorkspace: vi.fn(),
   createSession: vi.fn(),
+  exportSession: vi.fn(),
   updateSession: vi.fn(),
   submitPrompt: vi.fn(),
   respondQuestion: vi.fn(),
@@ -277,6 +279,128 @@ describe('useWorkspaceState — abortCurrentPrompt', () => {
   });
 });
 
+describe('useWorkspaceState — exportSession', () => {
+  let anchor: {
+    href: string;
+    download: string;
+    click: ReturnType<typeof vi.fn>;
+    remove: ReturnType<typeof vi.fn>;
+  };
+  let append: ReturnType<typeof vi.fn>;
+  let createObjectURL: ReturnType<typeof vi.fn>;
+  let revokeObjectURL: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    apiMock.exportSession.mockReset();
+    clearTrace();
+    anchor = { href: '', download: '', click: vi.fn(), remove: vi.fn() };
+    append = vi.fn();
+    createObjectURL = vi.fn(() => 'blob:session-export');
+    revokeObjectURL = vi.fn();
+    vi.stubGlobal('document', {
+      createElement: vi.fn(() => anchor),
+      body: { append },
+    });
+    vi.stubGlobal('URL', { createObjectURL, revokeObjectURL });
+  });
+
+  afterEach(() => {
+    clearTrace();
+    vi.unstubAllGlobals();
+  });
+
+  it('downloads the returned ZIP and reclaims its temporary browser resources', async () => {
+    const secret = 'PROMPT_TEXT_MUST_NOT_ENTER_EXPORT_REQUEST';
+    const metadata = {
+      sessionId: 'sess_1',
+      contentCount: 1,
+      mediaCount: 0,
+      text: secret,
+    };
+    traceKeyEvent('prompt:start', metadata);
+    const blob = new Blob(['zip']);
+    apiMock.exportSession.mockResolvedValue({ blob, fileName: 'sess_1.zip' });
+    const workspace = useWorkspaceState(createState(), createDeps());
+
+    await workspace.exportSession();
+
+    const webLog = apiMock.exportSession.mock.calls[0]?.[1] as string;
+    expect(webLog).toContain('prompt:start');
+    expect(webLog).toContain('contentCount');
+    expect(webLog).not.toContain(secret);
+    expect(createObjectURL).toHaveBeenCalledWith(blob);
+    expect(anchor).toMatchObject({ href: 'blob:session-export', download: 'sess_1.zip' });
+    expect(append).toHaveBeenCalledWith(anchor);
+    expect(anchor.click).toHaveBeenCalledOnce();
+    expect(anchor.remove).toHaveBeenCalledOnce();
+    await vi.waitFor(() => {
+      expect(revokeObjectURL).toHaveBeenCalledOnce();
+      expect(revokeObjectURL).toHaveBeenCalledWith('blob:session-export');
+    });
+  });
+
+  it('keeps one request targeted at the session selected when export started', async () => {
+    let resolveExport!: (value: { blob: Blob; fileName: string }) => void;
+    apiMock.exportSession.mockReturnValue(
+      new Promise((resolve) => {
+        resolveExport = resolve;
+      }),
+    );
+    const state = createState();
+    const workspace = useWorkspaceState(state, createDeps());
+
+    const first = workspace.exportSession();
+    state.activeSessionId = 'sess_2';
+    const second = workspace.exportSession();
+    resolveExport({ blob: new Blob(['zip']), fileName: 'sess_1.zip' });
+    await Promise.all([first, second]);
+    await vi.waitFor(() => {
+      expect(revokeObjectURL).toHaveBeenCalledWith('blob:session-export');
+    });
+
+    expect(apiMock.exportSession).toHaveBeenCalledTimes(1);
+    expect(apiMock.exportSession).toHaveBeenCalledWith('sess_1', expect.any(String));
+  });
+
+  it('reclaims the object URL when the browser rejects the download click', async () => {
+    apiMock.exportSession.mockResolvedValue({ blob: new Blob(['zip']), fileName: 'sess_1.zip' });
+    anchor.click.mockImplementation(() => {
+      throw new Error('download blocked');
+    });
+    const deps = createDeps();
+    const workspace = useWorkspaceState(createState(), deps);
+
+    await workspace.exportSession();
+
+    expect(anchor.remove).toHaveBeenCalledOnce();
+    await vi.waitFor(() => {
+      expect(revokeObjectURL).toHaveBeenCalledOnce();
+      expect(revokeObjectURL).toHaveBeenCalledWith('blob:session-export');
+    });
+    expect(deps.pushOperationFailure).toHaveBeenCalledWith(
+      'exportSession',
+      expect.any(Error),
+      { sessionId: 'sess_1' },
+    );
+  });
+
+  it('surfaces an error instead of silently exporting without an active session', async () => {
+    const state = createState();
+    state.activeSessionId = undefined;
+    const deps = createDeps();
+    const workspace = useWorkspaceState(state, deps);
+
+    await workspace.exportSession();
+
+    expect(apiMock.exportSession).not.toHaveBeenCalled();
+    expect(deps.pushOperationFailure).toHaveBeenCalledWith(
+      'exportSession',
+      expect.any(Error),
+      expect.objectContaining({ message: expect.any(String) }),
+    );
+  });
+});
+
 describe('mergeWorkspaces', () => {
   it('collapses registered workspaces that share a root, keeping the first entry and its sessions', () => {
     const result = mergeWorkspaces({
diff --git a/docs/en/guides/sessions.md b/docs/en/guides/sessions.md
index 2d605b1533..4c243d3220 100644
--- a/docs/en/guides/sessions.md
+++ b/docs/en/guides/sessions.md
@@ -108,6 +108,10 @@ You can also export from inside the TUI without leaving the interactive session:
 - **`/export-debug-zip`**: produces the same debug ZIP as `kimi export`.
 - **`/export-md`** (alias `/export`): exports the conversation as a human-readable Markdown file, suitable for sharing or archiving. Accepts an optional path argument; without one, it writes to `kimi-export-<short-id>-<timestamp>.md` in the current working directory.
 
+In the web UI, `/export` downloads the current session as a diagnostic ZIP. It includes the persisted session data, diagnostic logs, and a bounded metadata-only `logs/kimi-web.jsonl` record of key browser events. Prompt text, WebSocket payloads, and console arguments are not copied into this browser log. This web command differs from the TUI `/export` alias above.
+
+The browser buffers the ZIP before saving it, so web exports are limited to 64 MiB. For a larger session, use `kimi export <sessionId>` or the TUI `/export-debug-zip` command.
+
 ::: tip
 Exported files may contain code, command output, and file paths that are sensitive. Review the content before sharing.
 :::
diff --git a/docs/zh/guides/sessions.md b/docs/zh/guides/sessions.md
index a9c7819812..2ca06a6d59 100644
--- a/docs/zh/guides/sessions.md
+++ b/docs/zh/guides/sessions.md
@@ -108,6 +108,10 @@ kimi export <sessionId> -o ~/Desktop/my-session.zip
 - **`/export-debug-zip`**：产生与 `kimi export` 相同的调试 ZIP。
 - **`/export-md`**（别名 `/export`）：导出为人类可读的 Markdown 对话记录，适合分享或存档。可选接收路径参数；不带参数时写入工作目录下的 `kimi-export-<short-id>-<timestamp>.md`。
 
+在 web UI 中，`/export` 会把当前会话下载为诊断 ZIP。压缩包包含持久化的会话数据、诊断日志，以及记录浏览器关键事件且大小有上限、只含元数据的 `logs/kimi-web.jsonl`；提示词正文、WebSocket 内容和 console 参数不会写入这份浏览器日志。这里的 web 命令与上面的 TUI `/export` 别名行为不同。
+
+浏览器需要先把 ZIP 缓存在内存中再保存，因此 web 导出上限为 64 MiB。更大的会话请使用 `kimi export <sessionId>` 或 TUI 的 `/export-debug-zip`。
+
 ::: tip 提示
 导出文件可能包含代码、命令输出和路径等敏感信息，分享前请先确认内容。
 :::
diff --git a/packages/agent-core-v2/src/app/sessionExport/errors.ts b/packages/agent-core-v2/src/app/sessionExport/errors.ts
index c6b83004bf..43d3a9ed8d 100644
--- a/packages/agent-core-v2/src/app/sessionExport/errors.ts
+++ b/packages/agent-core-v2/src/app/sessionExport/errors.ts
@@ -8,6 +8,8 @@ export const SessionExportErrors = {
   codes: {
     SESSION_EXPORT_NOT_FOUND: 'session.export_not_found',
     SESSION_EXPORT_MISSING_VERSION: 'session.export_missing_version',
+    SESSION_EXPORT_OUTPUT_CONFLICT: 'session.export_output_conflict',
+    SESSION_EXPORT_TOO_LARGE: 'session.export_too_large',
   },
 } as const satisfies ErrorDomain;
 
diff --git a/packages/agent-core-v2/src/app/sessionExport/file-source.ts b/packages/agent-core-v2/src/app/sessionExport/file-source.ts
new file mode 100644
index 0000000000..0d68d95d2a
--- /dev/null
+++ b/packages/agent-core-v2/src/app/sessionExport/file-source.ts
@@ -0,0 +1,71 @@
+/**
+ * `sessionExport` domain (L6) — bounded file source ownership.
+ *
+ * Opens one stable file handle, snapshots its current size, and exposes an
+ * idempotent close operation shared by normal completion and failure cleanup.
+ */
+
+import { open, type FileHandle } from 'node:fs/promises';
+import { Readable } from 'node:stream';
+import { finished } from 'node:stream/promises';
+import { resolve } from 'pathe';
+
+export interface ZipSource {
+  readonly stream: Readable;
+  readonly size: number;
+  readonly mtime: Date;
+  readonly mode: number;
+  readonly identity: ZipSourceIdentity;
+  readonly sourcePath?: string;
+  close(): Promise<void>;
+}
+
+export interface ZipSourceIdentity {
+  readonly device: bigint;
+  readonly inode: bigint;
+}
+
+export async function openZipSource(source: string, signal?: AbortSignal): Promise<ZipSource> {
+  const handle = await open(source, 'r');
+  let stream: Readable | undefined;
+  try {
+    signal?.throwIfAborted();
+    const file = await handle.stat({ bigint: true });
+    if (!file.isFile()) throw new Error(`not a file: ${source}`);
+    const size = Number(file.size);
+    if (!Number.isSafeInteger(size)) throw new Error(`file is too large to export: ${source}`);
+    signal?.throwIfAborted();
+    stream =
+      size === 0
+        ? Readable.from([])
+        : handle.createReadStream({
+            autoClose: false,
+            start: 0,
+            end: size - 1,
+            signal,
+          });
+    let closing: Promise<void> | undefined;
+    return {
+      stream,
+      size,
+      mtime: file.mtime,
+      mode: Number(file.mode),
+      identity: { device: file.dev, inode: file.ino },
+      sourcePath: resolve(source),
+      close: () => {
+        closing ??= closeZipSource(stream!, handle);
+        return closing;
+      },
+    };
+  } catch (error) {
+    stream?.destroy();
+    await handle.close().catch(() => {});
+    throw error;
+  }
+}
+
+async function closeZipSource(stream: Readable, handle: FileHandle): Promise<void> {
+  stream.destroy();
+  await finished(stream, { cleanup: true }).catch(() => {});
+  await handle.close();
+}
diff --git a/packages/agent-core-v2/src/app/sessionExport/manifest.ts b/packages/agent-core-v2/src/app/sessionExport/manifest.ts
index 213b77dca2..3a27dd4077 100644
--- a/packages/agent-core-v2/src/app/sessionExport/manifest.ts
+++ b/packages/agent-core-v2/src/app/sessionExport/manifest.ts
@@ -30,6 +30,7 @@ export function buildExportManifest(args: {
   readonly sessionScan: SessionWireScan;
   readonly sessionLogPath?: string | undefined;
   readonly globalLogPath?: string | undefined;
+  readonly webLogPath?: string;
   readonly installSource?: string | undefined;
   readonly shellEnv?: ShellEnvironment | undefined;
 }): ExportSessionManifest {
@@ -52,6 +53,7 @@ export function buildExportManifest(args: {
     workspaceDir: args.summary.workspaceDir,
     sessionLogPath: args.sessionLogPath,
     globalLogPath: args.globalLogPath,
+    webLogPath: args.webLogPath,
     installSource: args.installSource,
     shellEnv: args.shellEnv,
   };
diff --git a/packages/agent-core-v2/src/app/sessionExport/sessionExport.ts b/packages/agent-core-v2/src/app/sessionExport/sessionExport.ts
index 7caef435e8..108c5c44a9 100644
--- a/packages/agent-core-v2/src/app/sessionExport/sessionExport.ts
+++ b/packages/agent-core-v2/src/app/sessionExport/sessionExport.ts
@@ -39,6 +39,7 @@ export interface ExportSessionManifest {
   readonly workspaceDir?: string | undefined;
   readonly sessionLogPath?: string | undefined;
   readonly globalLogPath?: string | undefined;
+  readonly webLogPath?: string;
   readonly installSource?: string | undefined;
   readonly shellEnv?: ShellEnvironment | undefined;
 }
@@ -50,10 +51,19 @@ export interface ExportSessionResult {
   readonly manifest: ExportSessionManifest;
 }
 
+export interface ExportSessionOptions {
+  readonly webLog?: string;
+  readonly signal?: AbortSignal;
+  readonly maxArchiveBytes?: number;
+}
+
 export interface ISessionExportService {
   readonly _serviceBrand: undefined;
 
-  export(input: ExportSessionPayload): Promise<ExportSessionResult>;
+  export(
+    input: ExportSessionPayload,
+    options?: ExportSessionOptions,
+  ): Promise<ExportSessionResult>;
 }
 
 export const ISessionExportService: ServiceIdentifier<ISessionExportService> =
diff --git a/packages/agent-core-v2/src/app/sessionExport/sessionExportService.ts b/packages/agent-core-v2/src/app/sessionExport/sessionExportService.ts
index e274471971..95c85f7989 100644
--- a/packages/agent-core-v2/src/app/sessionExport/sessionExportService.ts
+++ b/packages/agent-core-v2/src/app/sessionExport/sessionExportService.ts
@@ -6,9 +6,7 @@
  * packages diagnostic files through the local zip writer. Bound at App scope.
  */
 
-import { readFile } from 'node:fs/promises';
-
-import { resolve } from 'pathe';
+import { join, resolve } from 'pathe';
 
 import { InstantiationType } from '#/_base/di/extensions';
 import { LifecycleScope, registerScopedService } from '#/_base/di/scope';
@@ -27,17 +25,21 @@ import { buildExportManifest, type ExportSessionManifestSummary } from './manife
 import {
   type ExportSessionPayload,
   type ExportSessionResult,
+  type ExportSessionOptions,
   ISessionExportService,
 } from './sessionExport';
 import { scanSessionWire } from './wire-scan';
 import {
   type ExtraZipEntry,
+  type SessionZipEntry,
   collectFilesRecursive,
   writeExportZip,
 } from './zip';
+import { openZipSource, type ZipSource } from './file-source';
 
 const SESSION_LOG_REL = 'logs/kimi-code.log';
 const GLOBAL_LOG_REL = 'logs/global/kimi-code.log';
+const WEB_LOG_REL = 'logs/kimi-web.jsonl';
 
 export class SessionExportService implements ISessionExportService {
   declare readonly _serviceBrand: undefined;
@@ -50,7 +52,11 @@ export class SessionExportService implements ISessionExportService {
     @ILogService private readonly log: ILogService,
   ) {}
 
-  async export(input: ExportSessionPayload): Promise<ExportSessionResult> {
+  async export(
+    input: ExportSessionPayload,
+    options: ExportSessionOptions = {},
+  ): Promise<ExportSessionResult> {
+    options.signal?.throwIfAborted();
     if (input.version.trim().length === 0) {
       throw new Error2(
         ErrorCodes.SESSION_EXPORT_MISSING_VERSION,
@@ -69,6 +75,7 @@ export class SessionExportService implements ISessionExportService {
     }
 
     const liveSummary = await this.flushLiveSession(summary);
+    options.signal?.throwIfAborted();
     if (input.includeGlobalLog === true) {
       await this.warnIfFails('export global log flush failed', () => this.log.flush(), {
         retry: true,
@@ -79,6 +86,9 @@ export class SessionExportService implements ISessionExportService {
       request: input,
       summary: liveSummary,
       globalLogPath: resolveGlobalLogPath(this.bootstrap.homeDir),
+      webLog: options.webLog,
+      signal: options.signal,
+      maxArchiveBytes: options.maxArchiveBytes,
     });
   }
 
@@ -149,72 +159,125 @@ export async function exportSessionDirectory(input: {
   readonly request: ExportSessionPayload;
   readonly summary: ExportSessionDirectorySummary;
   readonly globalLogPath?: string | undefined;
+  readonly webLog?: string;
+  readonly signal?: AbortSignal;
+  readonly maxArchiveBytes?: number;
 }): Promise<ExportSessionResult> {
+  input.signal?.throwIfAborted();
   const sessionDir = input.summary.sessionDir;
-  const sessionFiles = await collectFilesRecursive(sessionDir);
-  if (sessionFiles.length === 0) {
-    throw new Error2(
-      ErrorCodes.SESSION_EXPORT_NOT_FOUND,
-      `Session "${input.summary.id}" has no exportable directory at "${sessionDir}"`,
-      { details: { sessionId: input.summary.id, sessionDir } },
+  const sessionLogPath = join(sessionDir, SESSION_LOG_REL);
+  let sessionLogSource: ZipSource | undefined;
+  let sessionLogSourceTransferred = false;
+  let globalSource: ZipSource | undefined;
+  let globalSourceTransferred = false;
+
+  try {
+    sessionLogSource = await openOptionalZipSource(sessionLogPath, input.signal);
+    if (input.request.includeGlobalLog === true && input.globalLogPath !== undefined) {
+      globalSource = await openOptionalZipSource(input.globalLogPath, input.signal);
+    }
+    const sessionFiles = await collectFilesRecursive(sessionDir);
+    if (sessionFiles.length === 0 && sessionLogSource === undefined) {
+      throw new Error2(
+        ErrorCodes.SESSION_EXPORT_NOT_FOUND,
+        `Session "${input.summary.id}" has no exportable directory at "${sessionDir}"`,
+        { details: { sessionId: input.summary.id, sessionDir } },
+      );
+    }
+
+    const sessionScan = await scanSessionWire(sessionDir, input.signal);
+    const stableSessionLog = sessionLogSource;
+    const selectedSessionFiles: SessionZipEntry[] = sessionFiles.filter(
+      (file) => file !== sessionLogPath,
     );
-  }
+    if (stableSessionLog !== undefined) {
+      selectedSessionFiles.push({ path: sessionLogPath, source: stableSessionLog });
+      selectedSessionFiles.sort((left, right) =>
+        sessionZipEntryPath(left).localeCompare(sessionZipEntryPath(right)),
+      );
+    }
+    const bundledWebLog = input.webLog !== undefined;
+    const baseManifest = buildExportManifest({
+      summary: input.summary,
+      now: new Date(),
+      version: input.request.version,
+      sessionScan,
+      sessionLogPath: stableSessionLog === undefined ? undefined : SESSION_LOG_REL,
+      webLogPath: bundledWebLog ? WEB_LOG_REL : undefined,
+      installSource: input.request.installSource,
+      shellEnv: input.request.shellEnv,
+    });
+    const outputPath =
+      input.request.outputPath !== undefined
+        ? resolve(input.request.outputPath)
+        : resolve(`${input.summary.id}.zip`);
+    const extras: ExtraZipEntry[] = [];
+    if (input.webLog !== undefined) {
+      extras.push({ data: Buffer.from(input.webLog, 'utf8'), target: WEB_LOG_REL });
+    }
+    if (globalSource !== undefined) {
+      extras.push({ source: globalSource, target: GLOBAL_LOG_REL });
+    }
+    const manifest =
+      globalSource === undefined
+        ? baseManifest
+        : { ...baseManifest, globalLogPath: GLOBAL_LOG_REL };
 
-  const sessionScan = await scanSessionWire(sessionDir);
-  const hasSessionLog = sessionFiles.some((f) =>
-    f.endsWith(`/${SESSION_LOG_REL}`) || f.endsWith(`\\${SESSION_LOG_REL.replaceAll('/', '\\')}`),
-  );
+    const writing = writeExportZip({
+      outputPath,
+      manifest,
+      sessionDir,
+      sessionFiles: selectedSessionFiles,
+      extraEntries: extras,
+      signal: input.signal,
+      maxArchiveBytes: input.maxArchiveBytes,
+    });
+    sessionLogSourceTransferred = sessionLogSource !== undefined;
+    globalSourceTransferred = globalSource !== undefined;
+    const entries = await writing;
 
-  const extras: ExtraZipEntry[] = [];
-  let bundledGlobal = false;
-  if (input.request.includeGlobalLog === true && input.globalLogPath !== undefined) {
-    const data = await readOptionalFile(input.globalLogPath);
-    if (data !== undefined) {
-      extras.push({ data, target: GLOBAL_LOG_REL });
-      bundledGlobal = true;
+    return {
+      zipPath: outputPath,
+      entries,
+      sessionDir,
+      manifest,
+    };
+  } finally {
+    if (sessionLogSource !== undefined && !sessionLogSourceTransferred) {
+      await sessionLogSource.close().catch(() => {});
+    }
+    if (globalSource !== undefined && !globalSourceTransferred) {
+      await globalSource.close().catch(() => {});
     }
   }
+}
 
-  const manifest = buildExportManifest({
-    summary: input.summary,
-    now: new Date(),
-    version: input.request.version,
-    sessionScan,
-    sessionLogPath: hasSessionLog ? SESSION_LOG_REL : undefined,
-    globalLogPath: bundledGlobal ? GLOBAL_LOG_REL : undefined,
-    installSource: input.request.installSource,
-    shellEnv: input.request.shellEnv,
-  });
-
-  const outputPath =
-    input.request.outputPath !== undefined
-      ? resolve(input.request.outputPath)
-      : resolve(`${input.summary.id}.zip`);
-
-  const entries = await writeExportZip({
-    outputPath,
-    manifest,
-    sessionDir,
-    sessionFiles,
-    extraEntries: extras,
-  });
-
-  return {
-    zipPath: outputPath,
-    entries,
-    sessionDir,
-    manifest,
-  };
+function sessionZipEntryPath(entry: SessionZipEntry): string {
+  return typeof entry === 'string' ? entry : entry.path;
 }
 
-async function readOptionalFile(path: string): Promise<Buffer | undefined> {
+async function openOptionalZipSource(
+  path: string,
+  signal: AbortSignal | undefined,
+): Promise<ZipSource | undefined> {
   try {
-    return await readFile(path);
-  } catch {
-    return undefined;
+    return await openZipSource(path, signal);
+  } catch (error) {
+    signal?.throwIfAborted();
+    if (isMissingPath(error)) return undefined;
+    throw error;
   }
 }
 
+function isMissingPath(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    (error as NodeJS.ErrnoException).code === 'ENOENT'
+  );
+}
+
 registerScopedService(
   LifecycleScope.App,
   ISessionExportService,
diff --git a/packages/agent-core-v2/src/app/sessionExport/wire-scan.ts b/packages/agent-core-v2/src/app/sessionExport/wire-scan.ts
index 81b89b1bae..d9aa4e6955 100644
--- a/packages/agent-core-v2/src/app/sessionExport/wire-scan.ts
+++ b/packages/agent-core-v2/src/app/sessionExport/wire-scan.ts
@@ -6,7 +6,10 @@
  * export manifest without depending on live Agent services.
  */
 
-import { readdir, readFile } from 'node:fs/promises';
+import { open, readdir, type FileHandle } from 'node:fs/promises';
+import { createInterface } from 'node:readline';
+import { Readable } from 'node:stream';
+import { finished } from 'node:stream/promises';
 
 import { join } from 'pathe';
 
@@ -19,15 +22,20 @@ export interface SessionWireScan {
   readonly firstUserInput?: string | undefined;
 }
 
-export async function scanSessionWire(sessionDir: string): Promise<SessionWireScan> {
-  const wireFiles = await collectWireFiles(sessionDir);
+export async function scanSessionWire(
+  sessionDir: string,
+  signal?: AbortSignal,
+): Promise<SessionWireScan> {
+  signal?.throwIfAborted();
+  const wireFiles = await collectWireFiles(sessionDir, signal);
   let firstActivityMs: number | undefined;
   let lastActivityMs: number | undefined;
   let lastUserMessageMs: number | undefined;
   let firstUserInput: string | undefined;
 
   for (const file of wireFiles) {
-    const scan = await scanWireFile(file);
+    signal?.throwIfAborted();
+    const scan = await scanWireFile(file, signal);
     firstActivityMs = minDefined(firstActivityMs, scan.firstActivityMs);
     lastActivityMs = maxDefined(lastActivityMs, scan.lastActivityMs);
     lastUserMessageMs = maxDefined(lastUserMessageMs, scan.lastUserMessageMs);
@@ -42,12 +50,16 @@ export async function scanSessionWire(sessionDir: string): Promise<SessionWireSc
   };
 }
 
-async function collectWireFiles(sessionDir: string): Promise<readonly string[]> {
+async function collectWireFiles(
+  sessionDir: string,
+  signal?: AbortSignal,
+): Promise<readonly string[]> {
   const files = [join(sessionDir, WIRE_FILENAME)];
   const agentsDir = join(sessionDir, 'agents');
   try {
     const entries = await readdir(agentsDir, { recursive: true, withFileTypes: true });
     for (const entry of entries) {
+      signal?.throwIfAborted();
       if (!entry.isFile() || entry.name !== WIRE_FILENAME) continue;
       files.push(join(entry.parentPath, entry.name));
     }
@@ -57,52 +69,74 @@ async function collectWireFiles(sessionDir: string): Promise<readonly string[]>
   return files;
 }
 
-async function scanWireFile(path: string): Promise<SessionWireScan> {
-  let raw: string;
+async function scanWireFile(path: string, signal?: AbortSignal): Promise<SessionWireScan> {
+  let file: FileHandle;
   try {
-    raw = await readFile(path, 'utf-8');
+    file = await open(path, 'r');
   } catch (error) {
     if (!isMissingPath(error)) throw error;
     return {};
   }
 
+  let input: Readable | undefined;
+
   let firstActivityMs: number | undefined;
   let lastActivityMs: number | undefined;
   let lastUserMessageMs: number | undefined;
   let firstUserInput: string | undefined;
 
-  for (const line of raw.split('\n')) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0) continue;
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(trimmed) as unknown;
-    } catch {
-      continue;
-    }
-    if (typeof parsed !== 'object' || parsed === null) continue;
-    const record = parsed as {
-      type?: unknown;
-      time?: unknown;
-      userInput?: unknown;
-    };
-    const timeMs = typeof record.time === 'number' ? normalizeTimestampMs(record.time) : undefined;
-    if (timeMs !== undefined) {
-      firstActivityMs = minDefined(firstActivityMs, timeMs);
-      lastActivityMs = maxDefined(lastActivityMs, timeMs);
-    }
-    if (record.type === 'turn_begin') {
+  try {
+    signal?.throwIfAborted();
+    const size = (await file.stat()).size;
+    signal?.throwIfAborted();
+    input =
+      size === 0
+        ? Readable.from([])
+        : file.createReadStream({
+            encoding: 'utf8',
+            autoClose: false,
+            end: size - 1,
+            signal,
+          });
+    const lines = createInterface({ input, crlfDelay: Infinity });
+    for await (const line of lines) {
+      const trimmed = line.trim();
+      if (trimmed.length === 0) continue;
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(trimmed) as unknown;
+      } catch {
+        continue;
+      }
+      if (typeof parsed !== 'object' || parsed === null) continue;
+      const record = parsed as {
+        type?: unknown;
+        time?: unknown;
+        userInput?: unknown;
+      };
+      const timeMs =
+        typeof record.time === 'number' ? normalizeTimestampMs(record.time) : undefined;
       if (timeMs !== undefined) {
-        lastUserMessageMs = maxDefined(lastUserMessageMs, timeMs);
+        firstActivityMs = minDefined(firstActivityMs, timeMs);
+        lastActivityMs = maxDefined(lastActivityMs, timeMs);
       }
-      if (
-        firstUserInput === undefined &&
-        typeof record.userInput === 'string' &&
-        record.userInput.trim().length > 0
-      ) {
-        firstUserInput = record.userInput;
+      if (record.type === 'turn_begin') {
+        if (timeMs !== undefined) {
+          lastUserMessageMs = maxDefined(lastUserMessageMs, timeMs);
+        }
+        if (
+          firstUserInput === undefined &&
+          typeof record.userInput === 'string' &&
+          record.userInput.trim().length > 0
+        ) {
+          firstUserInput = record.userInput;
+        }
       }
     }
+  } finally {
+    input?.destroy();
+    if (input !== undefined) await finished(input, { cleanup: true }).catch(() => {});
+    await file.close();
   }
 
   return {
diff --git a/packages/agent-core-v2/src/app/sessionExport/zip.ts b/packages/agent-core-v2/src/app/sessionExport/zip.ts
index a2c891e3de..0a1168ccdf 100644
--- a/packages/agent-core-v2/src/app/sessionExport/zip.ts
+++ b/packages/agent-core-v2/src/app/sessionExport/zip.ts
@@ -7,13 +7,20 @@
  */
 
 import { createWriteStream } from 'node:fs';
-import { mkdir, readdir, readFile } from 'node:fs/promises';
-import type { Readable } from 'node:stream';
+import { mkdir, mkdtemp, readdir, rename, rm, stat } from 'node:fs/promises';
+import { Readable, Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 
-import { dirname, join, relative } from 'pathe';
-import { ZipFile } from 'yazl';
+import { dirname, join, relative, resolve } from 'pathe';
+import { ZipFile, type ReadStreamOptions } from 'yazl';
 
+import { ErrorCodes, Error2 } from '#/errors';
+
+import {
+  openZipSource,
+  type ZipSource,
+  type ZipSourceIdentity,
+} from './file-source';
 import type { ExportSessionManifest } from './sessionExport';
 
 export async function collectFilesRecursive(root: string): Promise<string[]> {
@@ -30,48 +37,316 @@ export async function collectFilesRecursive(root: string): Promise<string[]> {
 }
 
 export type ExtraZipEntry =
-  | {
-      readonly source: string;
-      readonly target: string;
-    }
-  | {
-      readonly data: Buffer;
-      readonly target: string;
-    };
+  | { readonly source: ZipSource; readonly target: string }
+  | { readonly data: Buffer; readonly target: string };
+
+export type SessionZipEntry = string | { readonly path: string; readonly source: ZipSource };
 
 export async function writeExportZip(args: {
   readonly outputPath: string;
   readonly manifest: ExportSessionManifest;
   readonly sessionDir: string;
-  readonly sessionFiles: readonly string[];
+  readonly sessionFiles: readonly SessionZipEntry[];
   readonly extraEntries?: readonly ExtraZipEntry[];
+  readonly signal?: AbortSignal;
+  readonly maxArchiveBytes?: number;
 }): Promise<readonly string[]> {
-  await mkdir(dirname(args.outputPath), { recursive: true });
+  const unusedSources = new Set<ZipSource>([
+    ...args.sessionFiles.flatMap((entry) => (typeof entry === 'string' ? [] : [entry.source])),
+    ...(args.extraEntries ?? []).flatMap((entry) =>
+      'source' in entry ? [entry.source] : [],
+    ),
+  ]);
+  const pendingOpens = new Set<Promise<void>>();
+  let activeSource: ZipSource | undefined;
+  let releaseActive: (() => void) | undefined;
+  let closing = Promise.resolve();
+  let output: Readable | undefined;
+  let writing: Promise<void> | undefined;
+  let stopped: Error | undefined;
+  let failure: { readonly error: unknown } | undefined;
+  let onAbort: (() => void) | undefined;
+  let tempDir: string | undefined;
 
-  const entries: string[] = ['manifest.json'];
-  const zip = new ZipFile();
-  zip.addBuffer(Buffer.from(JSON.stringify(args.manifest, null, 2), 'utf-8'), 'manifest.json');
+  const getStopError = (): Error | undefined => stopped;
+  const stop = (error: Error): void => {
+    stopped ??= error;
+    releaseActive?.();
+    if (output !== undefined && !output.destroyed) output.destroy(stopped);
+  };
+  const queueClose = (source: ZipSource): void => {
+    const next = closing.catch(() => {}).then(() => source.close());
+    closing = next;
+    void next.catch((error: unknown) => {
+      stop(asError(error));
+    });
+  };
 
-  for (const abs of args.sessionFiles) {
-    const rel = relative(args.sessionDir, abs).split(/[\\/]/).join('/');
-    const data = await readFile(abs);
-    zip.addBuffer(data, rel);
-    entries.push(rel);
-  }
+  try {
+    const conflictingSource = await findConflictingSource(args);
+    if (conflictingSource !== undefined) {
+      throw new Error2(
+        ErrorCodes.SESSION_EXPORT_OUTPUT_CONFLICT,
+        `Session export output conflicts with selected source "${conflictingSource}".`,
+        { details: { outputPath: args.outputPath, source: conflictingSource } },
+      );
+    }
+    await mkdir(dirname(args.outputPath), { recursive: true });
+    args.signal?.throwIfAborted();
+    tempDir = await mkdtemp(join(dirname(args.outputPath), '.kimi-session-export-'));
+    const tempOutputPath = join(tempDir, 'archive.zip');
+
+    const zip = new ZipFile() as LazyZipFile;
+    output = zip.outputStream as unknown as Readable;
+    zip.on('error', (error: Error) => {
+      stop(error);
+    });
+    output.on('error', (error: Error) => {
+      stop(error);
+    });
+    onAbort = (): void => {
+      stop(abortReason(args.signal!));
+    };
+    args.signal?.addEventListener('abort', onAbort, { once: true });
+
+    const destination = createWriteStream(tempOutputPath, { flags: 'wx' });
+    writing =
+      args.maxArchiveBytes === undefined
+        ? pipeline(output, destination, { signal: args.signal })
+        : pipeline(output, createArchiveLimit(args.maxArchiveBytes), destination, {
+            signal: args.signal,
+          });
+
+    const activate = (source: ZipSource): Readable => {
+      unusedSources.delete(source);
+      activeSource = source;
+      let released = false;
+      const release = (): void => {
+        if (released) return;
+        released = true;
+        if (activeSource === source) activeSource = undefined;
+        if (releaseActive === release) releaseActive = undefined;
+        queueClose(source);
+      };
+      releaseActive = release;
+      source.stream.once('end', release);
+      source.stream.once('close', release);
+      source.stream.once('error', (error: Error) => {
+        release();
+        zip.emit('error', error);
+      });
+      return source.stream;
+    };
+
+    const addLazySource = (
+      target: string,
+      options: Partial<ReadStreamOptions>,
+      getSource: () => Promise<ZipSource>,
+    ): void => {
+      zip.addReadStreamLazy(target, options, (callback) => {
+        const pending = (async (): Promise<void> => {
+          try {
+            await closing;
+            if (stopped !== undefined) throw stopped;
+            const source = await getSource();
+            const stopError = getStopError();
+            if (stopError !== undefined) {
+              await source.close().catch(() => {});
+              throw stopError;
+            }
+            callback(null, activate(source));
+          } catch (error) {
+            callback(asError(error));
+          }
+        })();
+        pendingOpens.add(pending);
+        void pending.then(
+          () => pendingOpens.delete(pending),
+          (error: unknown) => {
+            pendingOpens.delete(pending);
+            zip.emit('error', asError(error));
+          },
+        );
+      });
+    };
 
-  for (const extra of args.extraEntries ?? []) {
+    zip.addBuffer(Buffer.from(JSON.stringify(args.manifest, null, 2), 'utf8'), 'manifest.json');
+
+    for (const entry of args.sessionFiles) {
+      const sourcePath = sessionEntryPath(entry);
+      const target = relative(args.sessionDir, sourcePath).split(/[\\/]/).join('/');
+      if (typeof entry === 'string') {
+        addLazySource(target, {}, () => openZipSource(entry, args.signal));
+      } else {
+        addLazySource(
+          target,
+          { size: entry.source.size, mtime: entry.source.mtime, mode: entry.source.mode },
+          async () => entry.source,
+        );
+      }
+    }
+
+    for (const extra of args.extraEntries ?? []) {
+      if ('data' in extra) {
+        zip.addBuffer(extra.data, extra.target);
+      } else {
+        addLazySource(
+          extra.target,
+          { size: extra.source.size, mtime: extra.source.mtime, mode: extra.source.mode },
+          async () => extra.source,
+        );
+      }
+    }
+
+    zip.end();
+    await writing;
+    await Promise.allSettled(pendingOpens);
+    await closing;
+    if (onAbort !== undefined) {
+      args.signal?.removeEventListener('abort', onAbort);
+      onAbort = undefined;
+    }
+    args.signal?.throwIfAborted();
+    await rename(tempOutputPath, args.outputPath);
+  } catch (error) {
+    failure = { error };
+    stop(asError(error));
+    await writing?.catch(() => {});
+  } finally {
+    if (onAbort !== undefined) args.signal?.removeEventListener('abort', onAbort);
+    await Promise.allSettled(pendingOpens);
+    releaseActive?.();
+    for (const source of unusedSources) queueClose(source);
+    unusedSources.clear();
     try {
-      const data = 'data' in extra ? extra.data : await readFile(extra.source);
-      zip.addBuffer(data, extra.target);
-      entries.push(extra.target);
+      await closing;
     } catch (error) {
-      if (!isMissingPath(error)) throw error;
+      failure ??= { error };
+    }
+    if (tempDir !== undefined) {
+      try {
+        await rm(tempDir, { recursive: true, force: true });
+      } catch (error) {
+        failure ??= { error };
+      }
     }
   }
 
-  zip.end();
-  await pipeline(zip.outputStream as unknown as Readable, createWriteStream(args.outputPath));
-  return entries;
+  if (failure !== undefined) throw failure.error;
+  if (stopped !== undefined) throw stopped;
+  return [
+    'manifest.json',
+    ...args.sessionFiles.map((entry) =>
+      relative(args.sessionDir, sessionEntryPath(entry)).split(/[\\/]/).join('/'),
+    ),
+    ...(args.extraEntries ?? []).map((entry) => entry.target),
+  ];
+}
+
+interface LazyZipFile extends ZipFile {
+  addReadStreamLazy(
+    target: string,
+    options: Partial<ReadStreamOptions>,
+    getReadStream: (
+      callback: (error: Error | null, stream?: NodeJS.ReadableStream) => void,
+    ) => void,
+  ): void;
+}
+
+function asError(error: unknown): Error {
+  return error instanceof Error ? error : new Error(String(error));
+}
+
+function abortReason(signal: AbortSignal): Error {
+  return signal.reason instanceof Error
+    ? signal.reason
+    : new DOMException('The operation was aborted.', 'AbortError');
+}
+
+function createArchiveLimit(maxArchiveBytes: number): Transform {
+  let archiveBytes = 0;
+  return new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      archiveBytes += chunk.length;
+      if (archiveBytes > maxArchiveBytes) {
+        callback(
+          new Error2(
+            ErrorCodes.SESSION_EXPORT_TOO_LARGE,
+            `Session export exceeds the ${maxArchiveBytes} byte archive limit.`,
+            { details: { archiveBytes, maxArchiveBytes } },
+          ),
+        );
+        return;
+      }
+      callback(null, chunk);
+    },
+  });
+}
+
+async function findConflictingSource(args: {
+  readonly outputPath: string;
+  readonly sessionFiles: readonly SessionZipEntry[];
+  readonly extraEntries?: readonly ExtraZipEntry[];
+  readonly signal?: AbortSignal;
+}): Promise<string | undefined> {
+  args.signal?.throwIfAborted();
+  const outputPath = resolve(args.outputPath);
+  for (const entry of args.sessionFiles) {
+    const sourcePath = sessionEntryPath(entry);
+    if (resolve(sourcePath) === outputPath) return sourcePath;
+  }
+  for (const entry of args.extraEntries ?? []) {
+    if (
+      'source' in entry &&
+      entry.source.sourcePath !== undefined &&
+      resolve(entry.source.sourcePath) === outputPath
+    ) {
+      return entry.target;
+    }
+  }
+
+  const output = await statExisting(outputPath);
+  if (output === undefined) return undefined;
+
+  for (const entry of args.sessionFiles) {
+    args.signal?.throwIfAborted();
+    const input =
+      typeof entry === 'string' ? await statExisting(entry) : entry.source.identity;
+    if (input !== undefined && sameFile(output, input)) return sessionEntryPath(entry);
+  }
+  for (const entry of args.extraEntries ?? []) {
+    args.signal?.throwIfAborted();
+    if ('source' in entry && sameFile(output, entry.source.identity)) return entry.target;
+  }
+  return undefined;
+}
+
+async function statExisting(
+  path: string,
+): Promise<ZipSourceIdentity | undefined> {
+  try {
+    const file = await stat(path, { bigint: true });
+    return { device: file.dev, inode: file.ino };
+  } catch (error) {
+    if (!isMissingPath(error)) throw error;
+    return undefined;
+  }
+}
+
+function sameFile(
+  left: ZipSourceIdentity,
+  right: ZipSourceIdentity,
+): boolean {
+  return (
+    left.inode !== 0n &&
+    right.inode !== 0n &&
+    left.device === right.device &&
+    left.inode === right.inode
+  );
+}
+
+function sessionEntryPath(entry: SessionZipEntry): string {
+  return typeof entry === 'string' ? entry : entry.path;
 }
 
 function isMissingPath(error: unknown): boolean {
diff --git a/packages/agent-core-v2/test/app/sessionExport/sessionExport.test.ts b/packages/agent-core-v2/test/app/sessionExport/sessionExport.test.ts
index c55a773e63..ec78f6111c 100644
--- a/packages/agent-core-v2/test/app/sessionExport/sessionExport.test.ts
+++ b/packages/agent-core-v2/test/app/sessionExport/sessionExport.test.ts
@@ -1,8 +1,24 @@
-import { mkdir, mkdtemp, stat, writeFile } from 'node:fs/promises';
+import {
+  appendFile,
+  type FileHandle,
+  link,
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rename,
+  stat,
+  symlink,
+  unlink,
+  writeFile,
+} from 'node:fs/promises';
 import { tmpdir } from 'node:os';
+import { Readable } from 'node:stream';
 
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { join } from 'pathe';
+import { open as openZip } from 'yauzl';
 
 import { DisposableStore, type IDisposable } from '#/_base/di/lifecycle';
 import {
@@ -15,11 +31,16 @@ import type { ServiceIdentifier, ServicesAccessor } from '#/_base/di/instantiati
 import { ILogService, type ILogService as LogService } from '#/_base/log/log';
 import { IAgentWireRecordService } from '#/agent/wireRecord/wireRecord';
 import { IBootstrapService } from '#/app/bootstrap/bootstrap';
-import { ISessionExportService } from '#/app/sessionExport/sessionExport';
+import { openZipSource, type ZipSource } from '#/app/sessionExport/file-source';
+import {
+  type ExportSessionManifest,
+  ISessionExportService,
+} from '#/app/sessionExport/sessionExport';
 import {
   exportSessionDirectory,
   SessionExportService,
 } from '#/app/sessionExport/sessionExportService';
+import { writeExportZip } from '#/app/sessionExport/zip';
 import { ISessionIndex, type SessionSummary } from '#/app/sessionIndex/sessionIndex';
 import {
   ISessionLifecycleService,
@@ -37,6 +58,22 @@ import { ISessionMetadata, type SessionMeta } from '#/session/sessionMetadata/se
 import { stubBootstrap } from '../bootstrap/stubs';
 import { stubLog } from '../../_base/log/stubs';
 
+const fsOpenHook = vi.hoisted(() => ({
+  afterOpen: undefined as ((path: string, handle: FileHandle) => Promise<void>) | undefined,
+}));
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:fs/promises')>();
+  return {
+    ...actual,
+    open: async (...args: Parameters<typeof actual.open>) => {
+      const handle = await actual.open(...args);
+      await fsOpenHook.afterOpen?.(String(args[0]), handle);
+      return handle;
+    },
+  };
+});
+
 const noopDisposable: IDisposable = { dispose: () => {} };
 const noopEvent = () => noopDisposable;
 
@@ -108,13 +145,152 @@ describe('sessionExport', () => {
     });
   });
 
-  it('omits the optional global log when the configured path cannot be read', async () => {
+  it('keeps the session log bound when it rotates as wire scanning starts', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const sessionDir = join(tmp, 'sessions', 'ws_demo', 'ses_rotating_log');
+    const logPath = join(sessionDir, 'logs', 'kimi-code.log');
+    const rotatedPath = `${logPath}.1`;
+    const wirePath = join(sessionDir, 'agents', 'main', 'wire.jsonl');
+    const outputPath = join(tmp, 'rotating-log.zip');
+    const log = Buffer.from('session log before rotation\n', 'utf8');
+    await mkdir(join(sessionDir, 'logs'), { recursive: true });
+    await mkdir(join(sessionDir, 'agents', 'main'), { recursive: true });
+    await writeFile(join(sessionDir, 'state.json'), '{}\n', 'utf8');
+    await writeFile(logPath, log);
+    await writeFile(wirePath, `${JSON.stringify({ type: 'metadata', time: 1_700_000_000 })}\n`);
+    let rotated = false;
+    fsOpenHook.afterOpen = async (path) => {
+      if (!rotated && path === wirePath) {
+        await rename(logPath, rotatedPath);
+        rotated = true;
+      }
+    };
+
+    try {
+      const result = await exportSessionDirectory({
+        request: {
+          sessionId: 'ses_rotating_log',
+          outputPath,
+          version: '1.0.0-test',
+        },
+        summary: {
+          id: 'ses_rotating_log',
+          sessionDir,
+        },
+      });
+
+      expect(rotated).toBe(true);
+      expect(result.manifest.sessionLogPath).toBe('logs/kimi-code.log');
+      expect(result.entries).toContain('logs/kimi-code.log');
+      await expect(readZipEntry(outputPath, 'logs/kimi-code.log')).resolves.toEqual(log);
+    } finally {
+      fsOpenHook.afterOpen = undefined;
+    }
+  });
+
+  it('keeps the global log bound when it rotates as wire scanning starts', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const sessionDir = join(tmp, 'sessions', 'ws_demo', 'ses_rotating_global');
+    const wirePath = join(sessionDir, 'agents', 'main', 'wire.jsonl');
+    const globalLogPath = join(tmp, 'logs', 'kimi-code.log');
+    const rotatedPath = `${globalLogPath}.1`;
+    const outputPath = join(tmp, 'rotating-global.zip');
+    const log = Buffer.from('global log before rotation\n', 'utf8');
+    await mkdir(join(sessionDir, 'agents', 'main'), { recursive: true });
+    await mkdir(join(tmp, 'logs'), { recursive: true });
+    await writeFile(join(sessionDir, 'state.json'), '{}\n', 'utf8');
+    await writeFile(wirePath, `${JSON.stringify({ type: 'metadata', time: 1_700_000_000 })}\n`);
+    await writeFile(globalLogPath, log);
+    let rotated = false;
+    fsOpenHook.afterOpen = async (path) => {
+      if (!rotated && path === wirePath) {
+        await rename(globalLogPath, rotatedPath);
+        rotated = true;
+      }
+    };
+
+    try {
+      const result = await exportSessionDirectory({
+        request: {
+          sessionId: 'ses_rotating_global',
+          outputPath,
+          includeGlobalLog: true,
+          version: '1.0.0-test',
+        },
+        summary: {
+          id: 'ses_rotating_global',
+          sessionDir,
+        },
+        globalLogPath,
+      });
+
+      expect(rotated).toBe(true);
+      expect(result.manifest.globalLogPath).toBe('logs/global/kimi-code.log');
+      expect(result.entries).toContain('logs/global/kimi-code.log');
+      await expect(readZipEntry(outputPath, 'logs/global/kimi-code.log')).resolves.toEqual(log);
+    } finally {
+      fsOpenHook.afterOpen = undefined;
+    }
+  });
+
+  it('closes pre-opened logs when manifest creation fails before writer ownership', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const sessionDir = join(tmp, 'sessions', 'ws_demo', 'ses_invalid_manifest');
+    const sessionLogPath = join(sessionDir, 'logs', 'kimi-code.log');
+    const globalLogPath = join(tmp, 'logs', 'kimi-code.log');
+    const wirePath = join(sessionDir, 'agents', 'main', 'wire.jsonl');
+    const outputPath = join(tmp, 'invalid-manifest.zip');
+    await mkdir(join(sessionDir, 'logs'), { recursive: true });
+    await mkdir(join(sessionDir, 'agents', 'main'), { recursive: true });
+    await mkdir(join(tmp, 'logs'), { recursive: true });
+    await writeFile(join(sessionDir, 'state.json'), '{}\n', 'utf8');
+    await writeFile(sessionLogPath, 'session log\n', 'utf8');
+    await writeFile(globalLogPath, 'global log\n', 'utf8');
+    await writeFile(
+      wirePath,
+      `${JSON.stringify({ type: 'metadata', time: 9_000_000_000_000_001 })}\n`,
+    );
+    const logHandles: FileHandle[] = [];
+    fsOpenHook.afterOpen = async (path, handle) => {
+      if (path === sessionLogPath || path === globalLogPath) logHandles.push(handle);
+    };
+
+    try {
+      await expect(
+        exportSessionDirectory({
+          request: {
+            sessionId: 'ses_invalid_manifest',
+            outputPath,
+            includeGlobalLog: true,
+            version: '1.0.0-test',
+          },
+          summary: {
+            id: 'ses_invalid_manifest',
+            sessionDir,
+          },
+          globalLogPath,
+        }),
+      ).rejects.toBeInstanceOf(RangeError);
+    } finally {
+      fsOpenHook.afterOpen = undefined;
+    }
+
+    expect(logHandles).toHaveLength(2);
+    for (const handle of logHandles) {
+      await expect(handle.stat()).rejects.toMatchObject({ code: 'EBADF' });
+    }
+    await expect(stat(outputPath)).rejects.toMatchObject({ code: 'ENOENT' });
+    expect((await readdir(tmp)).filter((entry) => entry.startsWith('.kimi-session-export-'))).toEqual(
+      [],
+    );
+  });
+
+  it('omits the optional global log when the configured file is missing', async () => {
     const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
     const sessionDir = join(tmp, 'sessions', 'ws_demo', 'ses_unreadable_global');
     await mkdir(sessionDir, { recursive: true });
     await writeFile(join(sessionDir, 'state.json'), '{}\n', 'utf-8');
     const globalLogPath = join(tmp, 'logs', 'kimi-code.log');
-    await mkdir(globalLogPath, { recursive: true });
 
     const outputPath = join(tmp, 'unreadable-global.zip');
     const result = await exportSessionDirectory({
@@ -137,6 +313,322 @@ describe('sessionExport', () => {
     expect(result.entries).not.toContain('logs/global/kimi-code.log');
   });
 
+  it('archives more than 300 session files without exhausting file handles', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const sessionFiles: string[] = [];
+    for (let index = 0; index < 320; index += 1) {
+      const path = join(tmp, `entry-${index.toString().padStart(3, '0')}.txt`);
+      await writeFile(path, `${index}\n`, 'utf8');
+      sessionFiles.push(path);
+    }
+
+    const entries = await writeExportZip({
+      outputPath: join(tmp, 'many-files.zip'),
+      manifest: testManifest('ses_many_files'),
+      sessionDir: tmp,
+      sessionFiles,
+    });
+
+    expect(entries).toHaveLength(321);
+    await expect(readZipEntry(join(tmp, 'many-files.zip'), 'entry-319.txt')).resolves.toEqual(
+      Buffer.from('319\n', 'utf8'),
+    );
+  });
+
+  it('rejects an output path that is also a selected session file without modifying it', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const outputPath = join(tmp, 'state.json');
+    const original = Buffer.from('{"state":"preserved"}\n', 'utf8');
+    await writeFile(outputPath, original);
+
+    await expect(
+      exportSessionDirectory({
+        request: {
+          sessionId: 'ses_output_conflict',
+          outputPath,
+          version: '1.0.0-test',
+        },
+        summary: {
+          id: 'ses_output_conflict',
+          sessionDir: tmp,
+        },
+      }),
+    ).rejects.toMatchObject({
+      name: 'Error2',
+      code: 'session.export_output_conflict',
+      details: { outputPath, source: outputPath },
+    });
+    await expect(readFile(outputPath)).resolves.toEqual(original);
+  });
+
+  it('rejects a hard-linked output path without modifying the selected session file', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const sourcePath = join(tmp, 'state.json');
+    const outputPath = join(tmp, 'export.zip');
+    const original = Buffer.from('{"state":"preserved"}\n', 'utf8');
+    await writeFile(sourcePath, original);
+    await link(sourcePath, outputPath);
+
+    await expect(
+      writeExportZip({
+        outputPath,
+        manifest: testManifest('ses_hard_link_conflict'),
+        sessionDir: tmp,
+        sessionFiles: [sourcePath],
+      }),
+    ).rejects.toMatchObject({ code: 'session.export_output_conflict' });
+    await expect(readFile(sourcePath)).resolves.toEqual(original);
+  });
+
+  it('closes a pre-opened source when it conflicts with the output path', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const outputPath = join(tmp, 'global.log');
+    const original = Buffer.from('global log\n', 'utf8');
+    await writeFile(outputPath, original);
+    const opened = await openZipSource(outputPath);
+    let closeCalls = 0;
+    const source: ZipSource = {
+      ...opened,
+      close: async () => {
+        closeCalls += 1;
+        await opened.close();
+      },
+    };
+
+    await expect(
+      writeExportZip({
+        outputPath,
+        manifest: testManifest('ses_extra_conflict'),
+        sessionDir: tmp,
+        sessionFiles: [],
+        extraEntries: [{ source, target: 'logs/global/kimi-code.log' }],
+      }),
+    ).rejects.toMatchObject({ code: 'session.export_output_conflict' });
+    expect(closeCalls).toBe(1);
+    await expect(readFile(outputPath)).resolves.toEqual(original);
+  });
+
+  it('archives a bound session log after its path is rotated', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const logPath = join(tmp, 'logs', 'kimi-code.log');
+    const rotatedPath = `${logPath}.1`;
+    const outputPath = join(tmp, 'rotated-log.zip');
+    const original = Buffer.from('before rotation\n', 'utf8');
+    await mkdir(join(tmp, 'logs'), { recursive: true });
+    await writeFile(logPath, original);
+    const opened = await openZipSource(logPath);
+    let closeCalls = 0;
+    const source: ZipSource = {
+      ...opened,
+      close: async () => {
+        closeCalls += 1;
+        await opened.close();
+      },
+    };
+    await rename(logPath, rotatedPath);
+
+    await expect(
+      writeExportZip({
+        outputPath,
+        manifest: testManifest('ses_rotated_log'),
+        sessionDir: tmp,
+        sessionFiles: [{ path: logPath, source }],
+      }),
+    ).resolves.toContain('logs/kimi-code.log');
+    await expect(readZipEntry(outputPath, 'logs/kimi-code.log')).resolves.toEqual(original);
+    expect(closeCalls).toBe(1);
+  });
+
+  it('includes a bounded Web log in the exported archive', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const sessionDir = join(tmp, 'sessions', 'ws_demo', 'ses_web_log');
+    await mkdir(sessionDir, { recursive: true });
+    await writeFile(join(sessionDir, 'state.json'), '{}\n', 'utf-8');
+    const webLog = [
+      JSON.stringify({ event: 'websocket.connected', time: 1 }),
+      JSON.stringify({ event: 'prompt.submitted', time: 2 }),
+    ].join('\n');
+    const outputPath = join(tmp, 'web-log.zip');
+
+    const result = await exportSessionDirectory({
+      request: {
+        sessionId: 'ses_web_log',
+        outputPath,
+        version: '1.0.0-test',
+      },
+      summary: {
+        id: 'ses_web_log',
+        sessionDir,
+      },
+      webLog,
+    });
+
+    expect(result.entries).toContain('logs/kimi-web.jsonl');
+    expect(result.manifest.webLogPath).toBe('logs/kimi-web.jsonl');
+    await expect(readZipEntry(outputPath, 'logs/kimi-web.jsonl')).resolves.toEqual(
+      Buffer.from(webLog, 'utf8'),
+    );
+  });
+
+  it('rejects when a collected file disappears before it can be archived', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const removedPath = join(tmp, 'removed-state.json');
+    await writeFile(removedPath, 'remove me\n', 'utf8');
+    await unlink(removedPath);
+
+    await expect(
+      writeExportZip({
+        outputPath: join(tmp, 'missing-file.zip'),
+        manifest: testManifest('ses_missing_file'),
+        sessionDir: tmp,
+        sessionFiles: [removedPath],
+      }),
+    ).rejects.toMatchObject({ code: 'ENOENT' });
+    await expect(readdir(tmp)).resolves.toEqual([]);
+  });
+
+  it('archives the opened file size when the source is appended during compression', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const livePath = join(tmp, 'live.log');
+    const outputPath = join(tmp, 'append.zip');
+    const initialContent = Buffer.from('before\n', 'utf8');
+    await writeFile(livePath, initialContent);
+    const source = await openZipSource(livePath);
+    await appendFile(livePath, 'after\n', 'utf8');
+
+    await expect(
+      writeExportZip({
+        outputPath,
+        manifest: testManifest('ses_append'),
+        sessionDir: tmp,
+        sessionFiles: [],
+        extraEntries: [{ source, target: 'live.log' }],
+      }),
+    ).resolves.toContain('live.log');
+
+    await expect(readZipEntry(outputPath, 'live.log')).resolves.toEqual(initialContent);
+  });
+
+  it('destroys and closes the active source when compression is aborted', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const outputPath = join(tmp, 'aborted.zip');
+    const abort = new AbortController();
+    const readStarted = deferred();
+    const allowRead = deferred();
+    let reading = false;
+    const stream = new Readable({
+      read() {
+        if (reading) return;
+        reading = true;
+        readStarted.resolve();
+        void allowRead.promise.then(() => {
+          if (this.destroyed) return;
+          this.push(Buffer.from('payload', 'utf8'));
+          this.push(null);
+        });
+      },
+    });
+    let closeCalls = 0;
+    let closed = false;
+    const source: ZipSource = {
+      stream,
+      size: 7,
+      mtime: new Date(0),
+      mode: 0o600,
+      identity: { device: -1n, inode: -1n },
+      close: async () => {
+        if (closed) return;
+        closed = true;
+        closeCalls += 1;
+        stream.destroy();
+      },
+    };
+
+    const writing = writeExportZip({
+      outputPath,
+      manifest: testManifest('ses_abort'),
+      sessionDir: tmp,
+      sessionFiles: [],
+      extraEntries: [{ source, target: 'controlled.bin' }],
+      signal: abort.signal,
+    });
+    await readStarted.promise;
+    abort.abort(new DOMException('test abort', 'AbortError'));
+
+    await expect(writing).rejects.toMatchObject({ name: 'AbortError' });
+    expect(stream.destroyed).toBe(true);
+    expect(closeCalls).toBe(1);
+    allowRead.resolve();
+    await expect(readdir(tmp)).resolves.toEqual([]);
+  });
+
+  it('does not follow an output symlink swapped during compression', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+    const statePath = join(tmp, 'state.json');
+    const safeTarget = join(tmp, 'safe-output');
+    const outputPath = join(tmp, 'export.zip');
+    const state = Buffer.from('{"state":"preserved"}\n', 'utf8');
+    await writeFile(statePath, state);
+    await writeFile(safeTarget, 'safe\n', 'utf8');
+    await symlink(safeTarget, outputPath);
+    const readStarted = deferred();
+    const allowRead = deferred();
+    const payload = Buffer.from('payload', 'utf8');
+    const stream = Readable.from(
+      (async function* (): AsyncGenerator<Buffer> {
+        readStarted.resolve();
+        await allowRead.promise;
+        yield payload;
+      })(),
+    );
+    const source: ZipSource = {
+      stream,
+      size: payload.length,
+      mtime: new Date(0),
+      mode: 0o600,
+      identity: { device: -1n, inode: -1n },
+      close: async () => {
+        stream.destroy();
+      },
+    };
+
+    const writing = writeExportZip({
+      outputPath,
+      manifest: testManifest('ses_symlink_swap'),
+      sessionDir: tmp,
+      sessionFiles: [],
+      extraEntries: [{ source, target: 'controlled.bin' }],
+    });
+    await readStarted.promise;
+    await unlink(outputPath);
+    await symlink(statePath, outputPath);
+    allowRead.resolve();
+    await writing;
+
+    await expect(readFile(statePath)).resolves.toEqual(state);
+    await expect(readFile(safeTarget, 'utf8')).resolves.toBe('safe\n');
+    expect((await lstat(outputPath)).isSymbolicLink()).toBe(false);
+    await expect(readZipEntry(outputPath, 'controlled.bin')).resolves.toEqual(payload);
+    expect((await readdir(tmp)).toSorted()).toEqual(['export.zip', 'safe-output', 'state.json']);
+  });
+
+  it('rejects with a coded error when compressed output exceeds the configured limit', async () => {
+    const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
+
+    await expect(
+      writeExportZip({
+        outputPath: join(tmp, 'too-large.zip'),
+        manifest: testManifest('ses_too_large'),
+        sessionDir: tmp,
+        sessionFiles: [],
+        maxArchiveBytes: 1,
+      }),
+    ).rejects.toMatchObject({
+      code: 'session.export_too_large',
+      details: { maxArchiveBytes: 1 },
+    });
+  });
+
   it('throws a coded error when the session is unknown', async () => {
     const tmp = await mkdtemp(join(tmpdir(), 'session-export-test-'));
     ix = createTestServices(tmp, {
@@ -443,3 +935,71 @@ function stubAgentWire(flush: () => Promise<void> = async () => {}): IAgentWireR
     close: async () => {},
   };
 }
+
+function testManifest(sessionId: string): ExportSessionManifest {
+  return {
+    sessionId,
+    exportedAt: '2026-01-01T00:00:00.000Z',
+    kimiCodeVersion: '1.0.0-test',
+    wireProtocolVersion: '1',
+    os: 'test',
+    nodejsVersion: 'test',
+  };
+}
+
+function deferred(): {
+  readonly promise: Promise<void>;
+  readonly resolve: () => void;
+} {
+  let resolve!: () => void;
+  const promise = new Promise<void>((resolvePromise) => {
+    resolve = resolvePromise;
+  });
+  return { promise, resolve };
+}
+
+function readZipEntry(path: string, target: string): Promise<Buffer> {
+  return new Promise<Buffer>((resolve, reject) => {
+    openZip(path, { lazyEntries: true }, (openError, zip) => {
+      if (openError !== null) {
+        reject(openError);
+        return;
+      }
+
+      let settled = false;
+      const fail = (error: Error): void => {
+        if (settled) return;
+        settled = true;
+        zip.close();
+        reject(error);
+      };
+
+      zip.once('error', fail);
+      zip.on('entry', (entry) => {
+        if (entry.fileName !== target) {
+          zip.readEntry();
+          return;
+        }
+        zip.openReadStream(entry, (streamError, stream) => {
+          if (streamError !== null) {
+            fail(streamError);
+            return;
+          }
+          const chunks: Buffer[] = [];
+          stream.on('data', (chunk: Buffer) => chunks.push(chunk));
+          stream.once('error', fail);
+          stream.once('end', () => {
+            if (settled) return;
+            settled = true;
+            zip.close();
+            resolve(Buffer.concat(chunks));
+          });
+        });
+      });
+      zip.once('end', () => {
+        fail(new Error(`zip entry not found: ${target}`));
+      });
+      zip.readEntry();
+    });
+  });
+}
diff --git a/packages/kap-server/src/openapi/transforms.ts b/packages/kap-server/src/openapi/transforms.ts
index 63264042e2..316d10dcdd 100644
--- a/packages/kap-server/src/openapi/transforms.ts
+++ b/packages/kap-server/src/openapi/transforms.ts
@@ -117,6 +117,7 @@ export function transformOpenApiDocument(
 
   patchFileUpload(paths);
   patchFileDownload(paths);
+  patchSessionExport(paths);
   patchSessionAction(paths);
   patchFsAction(paths);
   patchFsDownload(paths);
@@ -125,6 +126,26 @@ export function transformOpenApiDocument(
   return document;
 }
 
+function patchSessionExport(paths: Record<string, unknown>): void {
+  const operation = getOperation(paths, '/api/v1/sessions/{session_id}/export', 'post');
+  if (operation === undefined) return;
+
+  setResponse(operation, '200', {
+    description: 'Session export archive or JSON error envelope',
+    headers: {
+      'content-disposition': headerString(),
+      'content-length': headerInteger(),
+      'cache-control': headerString(),
+    },
+    content: {
+      'application/zip': {
+        schema: binarySchema,
+      },
+      ...jsonContent(errorEnvelopeSchema),
+    },
+  });
+}
+
 function patchFileUpload(paths: Record<string, unknown>): void {
   const operation = getOperation(paths, '/api/v1/files', 'post');
   if (operation === undefined) return;
diff --git a/packages/kap-server/src/routes/registerApiV1Routes.ts b/packages/kap-server/src/routes/registerApiV1Routes.ts
index 4320cb4c64..092463c24d 100644
--- a/packages/kap-server/src/routes/registerApiV1Routes.ts
+++ b/packages/kap-server/src/routes/registerApiV1Routes.ts
@@ -30,6 +30,7 @@ import { registerModelCatalogRoutes } from './modelCatalog';
 import { registerOAuthRoutes } from './oauth';
 import { registerPromptsRoutes } from './prompts';
 import { registerQuestionsRoutes } from './questions';
+import { registerSessionExportRoute } from './sessionExport';
 import { registerSessionsRoutes } from './sessions';
 import { registerShutdownRoutes } from './shutdown';
 import { registerSnapshotRoutes } from './snapshot';
@@ -100,6 +101,11 @@ export async function registerApiV1Routes(
         apiV1 as unknown as Parameters<typeof registerSessionsRoutes>[0],
         core,
       );
+      registerSessionExportRoute(
+        apiV1 as unknown as Parameters<typeof registerSessionExportRoute>[0],
+        core,
+        { serverVersion: opts.serverVersion },
+      );
       registerSkillsRoutes(apiV1 as unknown as Parameters<typeof registerSkillsRoutes>[0], core);
       registerMessagesRoutes(
         apiV1 as unknown as Parameters<typeof registerMessagesRoutes>[0],
diff --git a/packages/kap-server/src/routes/sessionExport.ts b/packages/kap-server/src/routes/sessionExport.ts
new file mode 100644
index 0000000000..ea10a28329
--- /dev/null
+++ b/packages/kap-server/src/routes/sessionExport.ts
@@ -0,0 +1,211 @@
+/**
+ * `POST /sessions/{session_id}/export` — stream a session diagnostic archive.
+ *
+ * The server owns archive options and temporary paths. A bounded Web JSONL log
+ * may be supplied by the client and is added to the archive by sessionExport.
+ */
+
+import { createReadStream, type ReadStream } from 'node:fs';
+import { mkdtemp, rm, stat } from 'node:fs/promises';
+import type { ServerResponse } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  ErrorCodes,
+  ILogService,
+  ISessionExportService,
+  isError2,
+  type Scope,
+} from '@moonshot-ai/agent-core-v2';
+import {
+  ErrorCode,
+  errEnvelope,
+  exportSessionParamsSchema,
+  exportSessionRequestSchema,
+} from '@moonshot-ai/protocol';
+
+import { defineRoute } from '../middleware/defineRoute';
+
+const MAX_WEB_SESSION_EXPORT_BYTES = 64 * 1024 * 1024;
+
+interface SessionExportRouteHost {
+  post(
+    path: string,
+    options: { preHandler: unknown[]; schema?: Record<string, unknown> },
+    handler: (req: unknown, reply: SessionExportReply) => unknown,
+  ): unknown;
+}
+
+interface SessionExportReply {
+  readonly raw: ServerResponse;
+  type(mime: string): SessionExportReply;
+  header(name: string, value: string | number): SessionExportReply;
+  send(payload: unknown): unknown;
+}
+
+export function registerSessionExportRoute(
+  app: SessionExportRouteHost,
+  core: Scope,
+  options: { readonly serverVersion: string },
+): void {
+  const log = core.accessor.get(ILogService);
+  const route = defineRoute(
+    {
+      method: 'POST',
+      path: '/sessions/{session_id}/export',
+      params: exportSessionParamsSchema,
+      body: exportSessionRequestSchema,
+      rawResponse: {
+        200: { type: 'string', format: 'binary' },
+      },
+      errors: {
+        [ErrorCode.VALIDATION_FAILED]: {},
+        [ErrorCode.SESSION_NOT_FOUND]: {},
+        [ErrorCode.FILE_TOO_LARGE]: {},
+        [ErrorCode.INTERNAL_ERROR]: {},
+      },
+      description: 'Export a session and diagnostic logs as a zip archive',
+      tags: ['sessions'],
+    },
+    async (req, reply) => {
+      const response = reply as unknown as SessionExportReply;
+      let aborted = false;
+      let responseStream: ReadStream | undefined;
+      let streaming = false;
+      let tempDir: string | undefined;
+      let cleanupPromise: Promise<void> | undefined;
+      const exportAbort = new AbortController();
+
+      const onResponseClose = (): void => {
+        if (response.raw.writableFinished) return;
+        aborted = true;
+        exportAbort.abort();
+        responseStream?.destroy();
+      };
+      response.raw.once('close', onResponseClose);
+
+      const cleanup = async (): Promise<void> => {
+        if (tempDir === undefined) return;
+        cleanupPromise ??= rm(tempDir, {
+          recursive: true,
+          force: true,
+          maxRetries: 3,
+          retryDelay: 50,
+        }).catch((error: unknown) => {
+          log.warn('session export temporary directory cleanup failed', {
+            error,
+            requestId: req.id,
+            tempDir,
+          });
+        });
+        await cleanupPromise;
+      };
+
+      try {
+        if (aborted) return;
+
+        const safeSessionId = sanitizeSessionId(req.params.session_id);
+        tempDir = await mkdtemp(join(tmpdir(), `kimi-session-export-${safeSessionId}-`));
+        if (aborted) {
+          await cleanup();
+          return;
+        }
+
+        const outputPath = join(tempDir, 'session.zip');
+        await core.accessor.get(ISessionExportService).export(
+          {
+            sessionId: req.params.session_id,
+            outputPath,
+            includeGlobalLog: true,
+            version: options.serverVersion,
+          },
+          {
+            webLog: req.body.web_log,
+            signal: exportAbort.signal,
+            maxArchiveBytes: MAX_WEB_SESSION_EXPORT_BYTES,
+          },
+        );
+        if (aborted) {
+          await cleanup();
+          return;
+        }
+
+        const archive = await stat(outputPath);
+        if (aborted) {
+          await cleanup();
+          return;
+        }
+
+        responseStream = createReadStream(outputPath);
+        responseStream.once('close', () => {
+          response.raw.off('close', onResponseClose);
+          void cleanup();
+        });
+
+        const sent = response
+          .type('application/zip')
+          .header(
+            'content-disposition',
+            `attachment; filename="kimi-session-${safeSessionId}.zip"`,
+          )
+          .header('content-length', archive.size)
+          .header('cache-control', 'no-store')
+          .send(responseStream);
+        streaming = true;
+        return sent as void;
+      } catch (error) {
+        const stream = responseStream;
+        if (stream !== undefined && !stream.closed) {
+          const closed = new Promise<void>((resolve) => {
+            stream.once('close', resolve);
+          });
+          stream.destroy();
+          await closed;
+        } else {
+          stream?.destroy();
+        }
+        await cleanup();
+        if (!aborted) sendMappedError(response, req.id, error);
+      } finally {
+        if (!streaming) response.raw.off('close', onResponseClose);
+      }
+    },
+  );
+
+  app.post(
+    route.path,
+    route.options,
+    route.handler as unknown as Parameters<SessionExportRouteHost['post']>[2],
+  );
+}
+
+function sanitizeSessionId(sessionId: string): string {
+  return sessionId.replaceAll(/[^A-Za-z0-9_-]/g, '_').slice(0, 48) || 'session';
+}
+
+function sendMappedError(reply: SessionExportReply, requestId: string, error: unknown): void {
+  if (isError2(error)) {
+    if (error.code === ErrorCodes.SESSION_NOT_FOUND) {
+      reply.send(errEnvelope(ErrorCode.SESSION_NOT_FOUND, error.message, requestId));
+      return;
+    }
+    if (error.code === ErrorCodes.SESSION_EXPORT_TOO_LARGE) {
+      reply.send(
+        errEnvelope(
+          ErrorCode.FILE_TOO_LARGE,
+          'session export exceeds the 64 MiB web limit',
+          requestId,
+        ),
+      );
+      return;
+    }
+  }
+  reply.send(
+    errEnvelope(
+      ErrorCode.INTERNAL_ERROR,
+      error instanceof Error ? error.message : 'internal error',
+      requestId,
+    ),
+  );
+}
diff --git a/packages/kap-server/test/__snapshots__/apiSurface.snapshot.test.ts.snap b/packages/kap-server/test/__snapshots__/apiSurface.snapshot.test.ts.snap
index d5952aaa63..b9bb042f93 100644
--- a/packages/kap-server/test/__snapshots__/apiSurface.snapshot.test.ts.snap
+++ b/packages/kap-server/test/__snapshots__/apiSurface.snapshot.test.ts.snap
@@ -272,6 +272,10 @@ exports[`API surface snapshot > matches the documented v2 route table and meta e
       "POST",
       "/api/v1/sessions/{session_id}/children",
     ],
+    [
+      "POST",
+      "/api/v1/sessions/{session_id}/export",
+    ],
     [
       "POST",
       "/api/v1/sessions/{session_id}/profile",
diff --git a/packages/kap-server/test/openapi.test.ts b/packages/kap-server/test/openapi.test.ts
index aa4358e4ee..19bb2827a2 100644
--- a/packages/kap-server/test/openapi.test.ts
+++ b/packages/kap-server/test/openapi.test.ts
@@ -93,6 +93,29 @@ describe('server-v2 OpenAPI', () => {
     expect(content['multipart/form-data']).toBeDefined();
   });
 
+  it('describes session export as a ZIP or JSON error envelope', async () => {
+    const doc = await fetchOpenApi();
+    const exportOp = operation(doc, '/api/v1/sessions/{session_id}/export', 'post');
+    const responses = asRecord(exportOp['responses']);
+    const response = asRecord(responses['200']);
+    const content = asRecord(response['content']);
+    const headers = asRecord(response['headers']);
+    const zipSchema = asRecord(asRecord(content['application/zip'])['schema']);
+    const errorSchema = asRecord(asRecord(content['application/json'])['schema']);
+    const errorProperties = asRecord(errorSchema['properties']);
+
+    expect(zipSchema).toMatchObject({ type: 'string', format: 'binary' });
+    expect(errorProperties).toMatchObject({
+      code: expect.any(Object),
+      msg: expect.any(Object),
+      data: expect.any(Object),
+      request_id: expect.any(Object),
+    });
+    expect(headers['content-disposition']).toBeDefined();
+    expect(headers['content-length']).toBeDefined();
+    expect(headers['cache-control']).toBeDefined();
+  });
+
   it('represents the fs-action dispatcher as a oneOf union', async () => {
     const doc = await fetchOpenApi();
     const fsActionOp = operation(doc, '/api/v1/sessions/{session_id}/{tail}', 'post');
diff --git a/packages/kap-server/test/sessions.test.ts b/packages/kap-server/test/sessions.test.ts
index 4b5d704cb7..3b08e5704c 100644
--- a/packages/kap-server/test/sessions.test.ts
+++ b/packages/kap-server/test/sessions.test.ts
@@ -1,10 +1,16 @@
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import { mkdtemp, readdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { inflateRawSync } from 'node:zlib';
 
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 
-import { IEventService, ISessionLifecycleService } from '@moonshot-ai/agent-core-v2';
+import {
+  IBootstrapService,
+  IEventService,
+  ISessionLifecycleService,
+} from '@moonshot-ai/agent-core-v2';
 import { sessionWarningsResponseSchema } from '@moonshot-ai/protocol';
 
 import { type RunningServer, startServer } from '../src/start';
@@ -99,6 +105,91 @@ describe('server-v2 /api/v1/sessions', () => {
     return { status: res.status, body: (await res.json()) as Envelope<T> };
   }
 
+  it('downloads a ZIP with the supplied Web log and cleans up its temporary directory', async () => {
+    const created = await postJson<SessionWire>('/api/v1/sessions', {
+      metadata: { cwd: home as string },
+    });
+    const id = created.body.data.id;
+    const webLog = [
+      JSON.stringify({ event: 'websocket.connected', time: 1 }),
+      JSON.stringify({ event: 'prompt.submitted', time: 2 }),
+    ].join('\n');
+
+    const res = await fetch(`${base}/api/v1/sessions/${id}/export`, {
+      method: 'POST',
+      headers: authHeaders(server as RunningServer, { 'content-type': 'application/json' }),
+      body: JSON.stringify({ web_log: webLog }),
+    } as never);
+    const archive = Buffer.from(await res.arrayBuffer());
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toBe('application/zip');
+    expect(res.headers.get('content-disposition')).toBe(
+      `attachment; filename="kimi-session-${id}.zip"`,
+    );
+    expect(res.headers.get('content-length')).toBe(String(archive.length));
+    expect(res.headers.get('cache-control')).toBe('no-store');
+
+    const entries = readZipEntries(archive);
+    const manifest = JSON.parse(entries.get('manifest.json')?.toString('utf8') ?? 'null') as {
+      sessionId: string;
+      webLogPath?: string;
+    };
+    expect(entries.get('logs/kimi-web.jsonl')?.toString('utf8')).toBe(webLog);
+    expect(manifest).toMatchObject({
+      sessionId: id,
+      webLogPath: 'logs/kimi-web.jsonl',
+    });
+    await expect.poll(() => listExportTempDirs(id)).toEqual([]);
+  });
+
+  it('returns the JSON session-not-found envelope instead of a ZIP', async () => {
+    const id = 'sess_missing_export';
+    const { status, body } = await postJson<null>(`/api/v1/sessions/${id}/export`, {});
+
+    expect(status).toBe(200);
+    expect(body.code).toBe(40401);
+    await expect.poll(() => listExportTempDirs(id)).toEqual([]);
+  });
+
+  it('cleans up the temporary archive when the client cancels the download', async () => {
+    const created = await postJson<SessionWire>('/api/v1/sessions', {
+      metadata: { cwd: home as string },
+    });
+    const id = created.body.data.id;
+    const sessionDir = (server as RunningServer).core.accessor
+      .get(IBootstrapService)
+      .sessionDir(created.body.data.workspace_id, id);
+    await writeFile(join(sessionDir, 'cancel-test.bin'), randomBytes(8 * 1024 * 1024));
+
+    const res = await fetch(`${base}/api/v1/sessions/${id}/export`, {
+      method: 'POST',
+      headers: authHeaders(server as RunningServer, { 'content-type': 'application/json' }),
+      body: '{}',
+    } as never);
+    const reader = res.body?.getReader();
+    expect(reader).toBeDefined();
+    const first = await reader?.read();
+    expect(first?.done).toBe(false);
+    await reader?.cancel();
+
+    await expect.poll(() => listExportTempDirs(id)).toEqual([]);
+  });
+
+  it('rejects a Web log larger than 256 KiB in UTF-8', async () => {
+    const created = await postJson<SessionWire>('/api/v1/sessions', {
+      metadata: { cwd: home as string },
+    });
+    const { status, body } = await postJson<null>(
+      `/api/v1/sessions/${created.body.data.id}/export`,
+      { web_log: '你'.repeat(87_382) },
+    );
+
+    expect(status).toBe(200);
+    expect(body.code).toBe(40001);
+    expect(body.details?.[0]?.path).toBe('web_log');
+  });
+
   it('creates a session from metadata.cwd', async () => {
     const cwd = home as string;
     const { status, body } = await postJson<SessionWire>('/api/v1/sessions', {
@@ -822,6 +913,49 @@ describe('server-v2 /api/v1/sessions', () => {
   });
 });
 
+async function listExportTempDirs(sessionId: string): Promise<string[]> {
+  const prefix = `kimi-session-export-${sessionId}-`;
+  return (await readdir(tmpdir())).filter((entry) => entry.startsWith(prefix)).toSorted();
+}
+
+function readZipEntries(archive: Buffer): Map<string, Buffer> {
+  const endSignature = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
+  const endOffset = archive.lastIndexOf(endSignature);
+  if (endOffset < 0) throw new Error('ZIP end record not found');
+
+  const entryCount = archive.readUInt16LE(endOffset + 10);
+  let centralOffset = archive.readUInt32LE(endOffset + 16);
+  const entries = new Map<string, Buffer>();
+
+  for (let index = 0; index < entryCount; index += 1) {
+    if (archive.readUInt32LE(centralOffset) !== 0x02014b50) {
+      throw new Error('Invalid ZIP central directory entry');
+    }
+    const method = archive.readUInt16LE(centralOffset + 10);
+    const compressedSize = archive.readUInt32LE(centralOffset + 20);
+    const nameLength = archive.readUInt16LE(centralOffset + 28);
+    const extraLength = archive.readUInt16LE(centralOffset + 30);
+    const commentLength = archive.readUInt16LE(centralOffset + 32);
+    const localOffset = archive.readUInt32LE(centralOffset + 42);
+    const name = archive.subarray(centralOffset + 46, centralOffset + 46 + nameLength).toString('utf8');
+
+    if (archive.readUInt32LE(localOffset) !== 0x04034b50) {
+      throw new Error('Invalid ZIP local entry');
+    }
+    const localNameLength = archive.readUInt16LE(localOffset + 26);
+    const localExtraLength = archive.readUInt16LE(localOffset + 28);
+    const dataOffset = localOffset + 30 + localNameLength + localExtraLength;
+    const compressed = archive.subarray(dataOffset, dataOffset + compressedSize);
+    if (method === 0) entries.set(name, Buffer.from(compressed));
+    else if (method === 8) entries.set(name, inflateRawSync(compressed));
+    else throw new Error(`Unsupported ZIP compression method: ${method}`);
+
+    centralOffset += 46 + nameLength + extraLength + commentLength;
+  }
+
+  return entries;
+}
+
 describe('server-v2 /api/v1/sessions status context window', () => {
   let server: RunningServer | undefined;
   let home: string | undefined;
diff --git a/packages/protocol/src/__tests__/rest-session.test.ts b/packages/protocol/src/__tests__/rest-session.test.ts
index 88cfbd083a..6e5f9612d0 100644
--- a/packages/protocol/src/__tests__/rest-session.test.ts
+++ b/packages/protocol/src/__tests__/rest-session.test.ts
@@ -8,6 +8,8 @@ import {
   createSessionRequestSchema,
   archiveSessionResponseSchema,
   deleteSessionResponseSchema,
+  exportSessionParamsSchema,
+  exportSessionRequestSchema,
   forkSessionRequestSchema,
   forkSessionResponseSchema,
   getSessionProfileResponseSchema,
@@ -22,6 +24,48 @@ import {
   undoSessionResponseSchema,
 } from '../rest/session';
 
+describe('exportSessionRequestSchema', () => {
+  it('accepts an empty body and an optional Web log', () => {
+    expect(exportSessionRequestSchema.parse({})).toEqual({});
+    expect(exportSessionRequestSchema.parse({ web_log: '{"event":"connected"}\n' })).toEqual({
+      web_log: '{"event":"connected"}\n',
+    });
+  });
+
+  it('accepts a Web log at the 256 KiB UTF-8 boundary', () => {
+    expect(exportSessionRequestSchema.safeParse({ web_log: 'a'.repeat(256 * 1024) }).success).toBe(
+      true,
+    );
+  });
+
+  it('rejects a Web log over the 256 KiB UTF-8 boundary', () => {
+    expect(
+      exportSessionRequestSchema.safeParse({ web_log: `${'a'.repeat(256 * 1024)}b` }).success,
+    ).toBe(false);
+  });
+
+  it('measures the Web log limit in UTF-8 bytes instead of JavaScript characters', () => {
+    expect(exportSessionRequestSchema.safeParse({ web_log: '你'.repeat(87_382) }).success).toBe(
+      false,
+    );
+  });
+
+  it('rejects fields that the server owns', () => {
+    expect(
+      exportSessionRequestSchema.safeParse({ outputPath: '/tmp/export.zip' }).success,
+    ).toBe(false);
+  });
+});
+
+describe('exportSessionParamsSchema', () => {
+  it('requires a non-empty session_id', () => {
+    expect(exportSessionParamsSchema.parse({ session_id: 'sess_abc' })).toEqual({
+      session_id: 'sess_abc',
+    });
+    expect(exportSessionParamsSchema.safeParse({ session_id: '' }).success).toBe(false);
+  });
+});
+
 describe('createSessionRequestSchema', () => {
   it('accepts a minimal POST body with metadata.cwd', () => {
     const parsed = createSessionRequestSchema.parse({ metadata: { cwd: '/tmp/foo' } });
diff --git a/packages/protocol/src/events.ts b/packages/protocol/src/events.ts
index de09c1e65b..b729a370a9 100644
--- a/packages/protocol/src/events.ts
+++ b/packages/protocol/src/events.ts
@@ -220,6 +220,8 @@ export type KimiErrorCode =
   | 'session.undo_unavailable'
   | 'session.export_not_found'
   | 'session.export_missing_version'
+  | 'session.export_output_conflict'
+  | 'session.export_too_large'
   | 'session.closed'
   | 'session.permission_mode_invalid'
   | 'session.thinking_empty'
@@ -1120,6 +1122,8 @@ export const kimiErrorCodeSchema = z.enum([
   'session.undo_unavailable',
   'session.export_not_found',
   'session.export_missing_version',
+  'session.export_output_conflict',
+  'session.export_too_large',
   'session.closed',
   'session.permission_mode_invalid',
   'session.thinking_empty',
diff --git a/packages/protocol/src/rest/session.ts b/packages/protocol/src/rest/session.ts
index 2b4dec6760..22413fd6f2 100644
--- a/packages/protocol/src/rest/session.ts
+++ b/packages/protocol/src/rest/session.ts
@@ -60,6 +60,25 @@ export type GetSessionResponse = z.infer<typeof getSessionResponseSchema>;
 export const getSessionProfileResponseSchema = sessionSchema;
 export type GetSessionProfileResponse = z.infer<typeof getSessionProfileResponseSchema>;
 
+export const MAX_SESSION_EXPORT_WEB_LOG_BYTES = 256 * 1024;
+
+export const exportSessionParamsSchema = z.object({
+  session_id: z.string().min(1),
+});
+export type ExportSessionParams = z.infer<typeof exportSessionParamsSchema>;
+
+export const exportSessionRequestSchema = z
+  .object({
+    web_log: z
+      .string()
+      .refine((value) => fitsUtf8ByteLimit(value, MAX_SESSION_EXPORT_WEB_LOG_BYTES), {
+        message: `web_log must not exceed ${MAX_SESSION_EXPORT_WEB_LOG_BYTES} UTF-8 bytes`,
+      })
+      .optional(),
+  })
+  .strict();
+export type ExportSessionRequest = z.infer<typeof exportSessionRequestSchema>;
+
 export const updateSessionProfileRequestSchema = sessionUpdateSchema;
 export type UpdateSessionProfileRequest = z.infer<typeof updateSessionProfileRequestSchema>;
 
@@ -182,3 +201,22 @@ export const sessionAbortResponseSchema = z.object({
   aborted: z.boolean(),
 });
 export type SessionAbortResponse = z.infer<typeof sessionAbortResponseSchema>;
+
+function fitsUtf8ByteLimit(value: string, limit: number): boolean {
+  let bytes = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const codePoint = value.codePointAt(index)!;
+    if (codePoint < 0x80) {
+      bytes += 1;
+    } else if (codePoint < 0x800) {
+      bytes += 2;
+    } else if (codePoint > 0xffff) {
+      bytes += 4;
+      index += 1;
+    } else {
+      bytes += 3;
+    }
+    if (bytes > limit) return false;
+  }
+  return true;
+}