@akasecurity/ai-tc-claude-code 0.9.12 → 0.9.13

package/scripts/pre-tool-use.js

@@ -20482,7 +20482,17 @@ var UNPRICEABLE_PROVIDERS = Object.freeze([
   "gateway",
   "unknown",
   "cli",
-  "api"
+  "api",
+  // The browser extension's native host records these as `llm_call.provider`
+  // for a web-chat turn — the web tool id, deliberately never the vendor id
+  // (`openai`/`anthropic`) the session root carries. Subscription traffic
+  // burns rate-limit budget, not dollar credits, and listing them here is
+  // what keeps that true structurally: a later maintainer who wants to price
+  // web-chat traffic at API rates has to delete this entry first, and meet
+  // the reason on the way, rather than quietly adding one to
+  // PROVIDER_PLATFORM.
+  "chatgpt",
+  "claude-ai"
 ]);
 function platformForProvider(provider) {
   return PROVIDER_PLATFORM.get(provider.trim().toLowerCase()) ?? null;
@@ -20625,7 +20635,12 @@ var HARNESS = {
   ClaudeDesktop: "claudedesktop",
   ChatGpt: "chatgpt",
   ClaudeAi: "claudeai",
-  Api: "api"
+  Api: "api",
+  // Not a coding assistant a person drives — an in-process SDK embedded in an
+  // application, so it has no IDE/CLI/desktop/web surface of its own. Carries
+  // the same id as its SOURCE_TOOL counterpart, unlike every capture-side tool
+  // whose wire spelling differs from its display spelling.
+  AiTcSdk: "ai-tc-sdk"
 };
 var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
 var SOURCE_TOOL = {
@@ -20641,9 +20656,15 @@ var SOURCE_TOOL = {
   // whose tool could not be identified both render through the read side's
   // miss path rather than as a harness of their own.
   Cli: "cli",
-  Unknown: "unknown"
+  Unknown: "unknown",
+  // The wire id an in-process, request-path SDK stamps on its own structural
+  // rows (`request_decision`) — never a capture of prompt/response/tool text,
+  // since the SDK sits in front of a model call rather than inside a coding
+  // assistant's own hook contract.
+  AiTcSdk: "ai-tc-sdk"
 };
 var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var WebSourceTool = SourceTool.extract(["ChatGpt", "ClaudeAi"]);
 var TOOL_TO_HARNESS = {
   [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
   [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
@@ -20652,7 +20673,12 @@ var TOOL_TO_HARNESS = {
   [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
   [SOURCE_TOOL.Codex]: HARNESS.Codex,
   [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
-  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi,
+  // Wire and display id are the same string here, but the row still belongs:
+  // both vocabularies carry the `AiTcSdk` member, and the join is exactly
+  // their intersection — leaving a shared member out would read as an
+  // uninstrumented tool on both surfaces, which this one is not.
+  [SOURCE_TOOL.AiTcSdk]: HARNESS.AiTcSdk
 };
 
 // ../../packages/schema/src/zod/finding.ts
@@ -20686,7 +20712,8 @@ var FindingProvider = Harness.extract([
   "ClaudeAi",
   "Codex",
   "Antigravity",
-  "Api"
+  "Api",
+  "AiTcSdk"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
@@ -21063,18 +21090,41 @@ var AuditEventType = external_exports.enum([
   // 'tool_call' is the reconciler's structural row for every call, while
   // 'tool_use' exists only where a hook enforced against the arguments.
   "tool_use",
-  // One row per model REFUSAL: a switch onto a prohibited model that was
-  // denied, or a turn refused because the session was already running on one.
-  // A structural row like the ones above rather than a capture — it carries
-  // the model that was refused and nothing the user typed, because what is
-  // worth recording about a governance decision is the decision, and prompt
-  // text is the thing this product exists to keep from travelling.
+  // One row per model REFUSAL, across all four seams a prohibited model can be
+  // stopped at: a switch onto it, a turn already running on it, a subagent
+  // spawn asking for it, or a request-path refusal an embedded request-path
+  // SDK makes in-process before the call leaves the application. Which seam
+  // rides `attributes.refusal_seam`, never this member name. A structural row
+  // like the ones above rather than a capture — it carries the model that was
+  // refused and nothing the user typed, because what is worth recording about
+  // a governance decision is the decision, and prompt text is the thing this
+  // product exists to keep from travelling.
   "model_refusal",
+  // One row per request-path DECISION: a policy check an embedded request-path
+  // SDK performs in-process before a model call leaves the application, or
+  // against that call's non-streamed response. A structural row like
+  // 'model_refusal' rather than a capture — content-free in the same way:
+  // which side, which seam, what action and which field are decided rides
+  // `attributes`, never this member name, and the matched text itself never
+  // travels.
+  //
+  // A prohibited-model refusal on the request path is deliberately NOT this
+  // member: it stays 'model_refusal' with `refusal_seam: 'request'`, so it
+  // shares one bucket with the plugin's switch/turn/spawn refusals rather
+  // than splitting one governance concept across two event types. This
+  // member carries every OTHER request-path decision.
+  "request_decision",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
   // surface renders.
-  "config_scan"
+  "config_scan",
+  // One row per reported browser-extension capture status, hung off the web
+  // session root. The durable home of what one tab's network interception
+  // is doing — a write-through of the native host's in-memory tracker, so a
+  // second process (aka extension status) and a restarted host both have
+  // somewhere to read it back from.
+  "capture_status"
 ]).meta({ id: "AuditEventType" });
 var AttributeBag = external_exports.record(external_exports.string(), external_exports.unknown());
 var HostAttributes = external_exports.object({
@@ -21234,6 +21284,20 @@ var CaptureAttributes = external_exports.object({
   // repeated rather than referenced because a store reader opens this file.
   redact_degraded_to: ActionTaken.optional()
 }).catchall(external_exports.unknown());
+var CaptureStatusAttributes = external_exports.object({
+  source_tool: external_exports.string().optional(),
+  patched: external_exports.boolean().optional(),
+  live: external_exports.boolean().optional(),
+  blind: external_exports.boolean().optional(),
+  sends_seen_dom: external_exports.number().int().nonnegative().optional(),
+  exchanges_seen_net: external_exports.number().int().nonnegative().optional(),
+  parse_failures: external_exports.number().int().nonnegative().optional(),
+  unparsed_bodies: external_exports.number().int().nonnegative().optional(),
+  shape_misses: external_exports.array(external_exports.string()).optional(),
+  conversation_endpoints: external_exports.number().int().nonnegative().optional(),
+  closed: external_exports.boolean().optional(),
+  enforcement: external_exports.string().optional()
+}).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
   ruleName: external_exports.string(),
@@ -22093,6 +22157,30 @@ var AttachedCredential = external_exports.object({
   keyPrefix: external_exports.string().min(1).max(16).optional(),
   mintedAt: external_exports.iso.datetime().optional()
 });
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function unsafeEndpointReason(endpoint) {
+  let parsed2;
+  try {
+    parsed2 = new URL(endpoint);
+  } catch {
+    return "unparseable";
+  }
+  if (parsed2.username !== "" || parsed2.password !== "") return "userinfo";
+  if (parsed2.search !== "" || parsed2.hash !== "") return "query-or-fragment";
+  if (parsed2.protocol === "https:") return null;
+  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname) ? null : "insecure";
+}
+function isSafeEndpoint(endpoint) {
+  return unsafeEndpointReason(endpoint) === null;
+}
+function originOnly(endpoint) {
+  try {
+    const parsed2 = new URL(endpoint);
+    return `${parsed2.protocol}//${parsed2.host}`;
+  } catch {
+    return "(unparseable endpoint)";
+  }
+}
 var MAX_DATE_MS = 253402300799999;
 var MAX_INT4 = 2147483647;
 var StorePosturePack = external_exports.object({
@@ -22247,6 +22335,11 @@ var RemoteFailureKind = external_exports.enum([
   "rejected",
   "unreachable"
 ]);
+var ControlPlaneFailure = RemoteFailureKind.extract([
+  "unauthorized",
+  "forbidden",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -22786,7 +22879,12 @@ var EventMetadata = external_exports.object({
   // in — set by the browser extension's network capture so a stored `response`
   // row can be joined to the `llm_call` leaf describing the same turn. Absent
   // on every other capture path, which has no such id.
-  messageId: external_exports.string().optional(),
+  //
+  // Non-empty for the reason WebExchange.messageId is: it is the join key, and
+  // a blank one matches no `llm_call` leaf. That refusal reaches only the
+  // places an event is PARSED; the local write path types the event and parses
+  // nothing, which is why `toCaptureAttributes` omits a blank one separately.
+  messageId: external_exports.string().min(1).optional(),
   conversationId: external_exports.string().optional(),
   // How long THIS capture's inspection blocked its caller, in whole
   // milliseconds — the plugin's own added latency, NOT the LLM call it sat in
@@ -23633,6 +23731,85 @@ function policyIdIsReversible(policyId) {
 var DEFAULT_ACTIONS = Object.fromEntries(
   DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
 );
+function ruleCategoryMap(wireRules, localRules, compiledRules) {
+  const map2 = /* @__PURE__ */ new Map();
+  for (const rule of wireRules ?? []) map2.set(rule.id, rule.category);
+  for (const rule of localRules ?? []) map2.set(rule.id, rule.category);
+  for (const rule of compiledRules) map2.set(rule.id, rule.category);
+  return map2;
+}
+function policyKey(policy) {
+  return "ruleId" in policy.target ? `rule:${policy.target.ruleId}` : `category:${policy.target.category}`;
+}
+function floorFor(policy, categoryByRuleId) {
+  const category = "category" in policy.target ? policy.target.category : categoryByRuleId.get(policy.target.ruleId);
+  return category === void 0 ? null : DEFAULT_ACTIONS[category];
+}
+function strongerOf(a, b) {
+  if (a === null) return b;
+  if (b === null) return a;
+  return strongerAction(a, b);
+}
+function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
+  const merged = /* @__PURE__ */ new Map();
+  const disabled = [];
+  const remoteCategoryAction = /* @__PURE__ */ new Map();
+  for (const policy of remotePolicies) {
+    if (!policy.enabled) continue;
+    if (!("category" in policy.target)) continue;
+    if (remoteCategoryAction.has(policy.target.category)) continue;
+    const floor = floorFor(policy, categoryByRuleId);
+    remoteCategoryAction.set(
+      policy.target.category,
+      floor !== null && !isActionAtLeast(policy.action, floor) ? floor : policy.action
+    );
+  }
+  for (const policy of localPolicies) {
+    if (!policy.enabled) {
+      disabled.push(policy);
+      continue;
+    }
+    const key = policyKey(policy);
+    if (merged.has(key)) continue;
+    let remoteFloor = null;
+    if ("ruleId" in policy.target) {
+      const category = categoryByRuleId.get(policy.target.ruleId);
+      if (category !== void 0) remoteFloor = remoteCategoryAction.get(category) ?? null;
+    }
+    merged.set(
+      key,
+      remoteFloor !== null && !isActionAtLeast(policy.action, remoteFloor) ? { ...policy, action: remoteFloor } : policy
+    );
+  }
+  const localCategoryAction = /* @__PURE__ */ new Map();
+  for (const policy of merged.values()) {
+    if ("category" in policy.target) localCategoryAction.set(policy.target.category, policy.action);
+  }
+  for (const policy of remotePolicies) {
+    if (!policy.enabled) {
+      disabled.push(policy);
+      continue;
+    }
+    const key = policyKey(policy);
+    const floor = floorFor(policy, categoryByRuleId);
+    let localFloor = null;
+    if ("ruleId" in policy.target) {
+      const category = categoryByRuleId.get(policy.target.ruleId);
+      if (category !== void 0) localFloor = localCategoryAction.get(category) ?? null;
+    }
+    const effectiveFloor = strongerOf(floor, localFloor);
+    const clamped = effectiveFloor !== null && !isActionAtLeast(policy.action, effectiveFloor) ? { ...policy, action: effectiveFloor } : policy;
+    const existing = merged.get(key);
+    if (existing === void 0) {
+      merged.set(key, clamped);
+      continue;
+    }
+    if (actionRank(clamped.action) > actionRank(existing.action)) {
+      merged.set(key, clamped);
+    }
+  }
+  return [...merged.values(), ...disabled];
+}
 var BUILTIN_POLICIES = Object.fromEntries(
   KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
 );
@@ -23866,6 +24043,18 @@ var HistorySyncConsent = external_exports.object({
   payloadVersion: external_exports.number().int().positive(),
   endpoint: external_exports.string()
 });
+var WebChatCaptureConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  version: external_exports.number().int().positive()
+});
+var WebChatResponseCapture = external_exports.enum(["with-findings", "always", "never"]);
+var WebChatCapture = external_exports.object({
+  responses: WebChatResponseCapture.default("with-findings"),
+  account: external_exports.boolean().default(false),
+  // Absent until granted. Presence alone does not authorize anything — see
+  // isWebChatCaptureConsentValid.
+  consent: WebChatCaptureConsent.optional()
+});
 var BODY_RETENTION_DEFAULT_DAYS = 30;
 var BodyRetention = external_exports.object({
   enabled: external_exports.boolean().default(false),
@@ -23924,6 +24113,16 @@ var WorkspaceSettings = external_exports.object({
   // both widenings. Absent until granted, and a grant for a different endpoint
   // or an older payload no longer counts.
   historySyncConsent: HistorySyncConsent.optional(),
+  // What the browser extension may record from a web chat, and the grant that
+  // authorizes it. Absent until the user answers: recording something that was
+  // never recorded before is never an assumed grant on upgrade, so the whole
+  // block is optional rather than defaulted in. What an absent block means is
+  // webChatCaptureOf's answer, in one place.
+  //
+  // Enforcement is NOT gated on this. A machine that has never answered still
+  // blocks, redacts and warns on what a user sends; the grant covers what is
+  // written down.
+  webChatCapture: WebChatCapture.optional(),
   // Local body expiry (see BodyRetention). Off until switched on; expiring a
   // body never removes the row or its findings.
   bodyRetention: BodyRetention.default({
@@ -24031,7 +24230,10 @@ function toCaptureAttributes(event) {
     // `.catchall(z.unknown())` carries the long tail.
     ...metadata?.model !== void 0 ? { model: metadata.model } : {},
     ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {},
-    ...metadata?.messageId !== void 0 ? { message_id: metadata.messageId } : {},
+    // A blank id is omitted rather than stored: it is a join key and `''` joins
+    // nothing. This runs on the local write path, which types the event but
+    // never parses it, so EventMetadata's own `.min(1)` does not reach here.
+    ...metadata?.messageId !== void 0 && metadata.messageId !== "" ? { message_id: metadata.messageId } : {},
     ...metadata?.conversationId !== void 0 ? { conversation_id: metadata.conversationId } : {}
   };
 }
@@ -24405,12 +24607,14 @@ var RecommendedActionIdParam = external_exports.object({ id: external_exports.st
 // ../../packages/schema/src/zod/settings-action.ts
 var HistorySyncConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "HistorySyncConsentChoice" });
 var ModelJudgeConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "ModelJudgeConsentChoice" });
+var WebChatCaptureConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "WebChatCaptureConsentChoice" });
 var SaveSettingsInput = external_exports.object({
   historicalAccess: external_exports.string(),
   modelJudgeConsent: ModelJudgeConsentChoice,
   historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
   vaultInlineReveal: external_exports.string(),
+  webChatCaptureConsent: WebChatCaptureConsentChoice,
   // Widened to `string` like its neighbours rather than typed as
   // `RedactFallback`, on this module's own layering rule: shape here, VALUE at
   // the call site, so the domain check receives the type it was written for.
@@ -24625,11 +24829,24 @@ var WebExchange = external_exports.object({
   turnIndex: external_exports.number().int().nonnegative().optional(),
   toolCalls: external_exports.array(WebToolCall).default([]),
   // Absent when the adapter recovered no text. Capped by the caller at
-  // RESPONSE_TEXT_MAX_BYTES; `truncated` records that the cap was reached, so a
-  // short capture is never mistaken for a short reply.
+  // RESPONSE_TEXT_MAX_BYTES, so a short capture is never mistaken for a short
+  // reply.
   responseText: external_exports.string().optional(),
+  // The stored text is short of the reply. It does NOT say which of the two
+  // ceilings on this path cut it: the caller applies its own cap on the raw
+  // bytes it reads off the wire, which can be reached by a stream whose
+  // recovered text stays well under RESPONSE_TEXT_MAX_BYTES, and applies that
+  // one to the text. A reader cannot tell them apart, and nothing downstream
+  // should branch as though it could.
   truncated: external_exports.boolean().default(false)
 });
+var WebEnforcementState = external_exports.enum([
+  "watching",
+  "composer-only",
+  "button-only",
+  "unattached",
+  "unknown"
+]);
 var RESPONSE_TEXT_MAX_BYTES = 2 * 1024 * 1024;
 var WebCaptureStatus = external_exports.object({
   patched: external_exports.boolean(),
@@ -24641,8 +24858,66 @@ var WebCaptureStatus = external_exports.object({
   unparsedBodies: external_exports.number().int().nonnegative(),
   // The adapter-declared JSON key paths that were absent from a real payload —
   // the earliest signal that a site's contract moved.
-  shapeMisses: external_exports.array(external_exports.string()).default([])
-});
+  shapeMisses: external_exports.array(external_exports.string()).default([]),
+  // How many `kind: 'conversation'` endpoints the reporting tab's adapter
+  // compiled. Zero means this build declares none for the site, so observing
+  // nothing is the design rather than a fault — the one fact that separates a
+  // site nobody has surveyed yet from one whose contract moved. Defaulted so a
+  // build predating the field is read as declaring nothing rather than refused.
+  conversationEndpoints: external_exports.number().int().nonnegative().default(0),
+  // The document that sent this report is going away. The bridge sets it on
+  // its `pagehide` report and nowhere else.
+  //
+  // A property of the REPORT rather than of capture health, which is why
+  // nothing in `deriveWebCaptureState` reads it and why it stays out of the
+  // bridge's own report signature — a closing tab's last word must not be
+  // suppressed for carrying the same health as the report before it. What
+  // reads it is the per-site fold: a document that said it was unloading stops
+  // voting on the site's state, so the reload the `blind` remediation asks for
+  // can actually clear the verdict it was shown. A document that dies without
+  // sending one is covered by CAPTURE_STATUS_DOCUMENT_QUIET_MS instead.
+  //
+  // Defaulted so a build predating the field reads as a document that never
+  // said it was closing — which keeps it voting, the same as every report that
+  // is not a final one.
+  closed: external_exports.boolean().default(false),
+  // What the DOM enforcement path is doing, which none of the counters above
+  // can say: `sendsSeenDom` rises only once a send has COMPLETED, so a tab
+  // whose watcher never bound reports zero exactly like a tab nobody typed in.
+  // Defaulted to 'unknown' rather than 'watching' so a status from a build
+  // predating the field is not read as reporting a healthy one.
+  enforcement: WebEnforcementState.default("unknown")
+});
+function webCaptureStatusObservedTurnPath(status) {
+  if (!status.patched) return true;
+  if (status.conversationEndpoints === 0) return true;
+  return status.blind || status.shapeMisses.length > 0 || status.parseFailures > 0 || status.unparsedBodies > 0 || status.exchangesSeenNet > 0;
+}
+function pickReportedCaptureStatus(candidates) {
+  return candidates.find((c) => webCaptureStatusObservedTurnPath(c.status)) ?? candidates[0];
+}
+var CAPTURE_STATUS_RECENCY_MS = 30 * 24 * 60 * 60 * 1e3;
+var CAPTURE_STATUS_RECENCY_DAYS = CAPTURE_STATUS_RECENCY_MS / (24 * 60 * 60 * 1e3);
+var CAPTURE_STATUS_DOCUMENT_QUIET_MS = 12 * 60 * 60 * 1e3;
+function fromCaptureStatusAttributes(bag) {
+  const parsedBag = CaptureStatusAttributes.safeParse(bag);
+  if (!parsedBag.success) return null;
+  const b = parsedBag.data;
+  const parsedStatus = WebCaptureStatus.safeParse({
+    patched: b.patched,
+    live: b.live,
+    blind: b.blind,
+    sendsSeenDom: b.sends_seen_dom,
+    exchangesSeenNet: b.exchanges_seen_net,
+    parseFailures: b.parse_failures,
+    unparsedBodies: b.unparsed_bodies,
+    shapeMisses: b.shape_misses,
+    conversationEndpoints: b.conversation_endpoints,
+    closed: b.closed,
+    enforcement: b.enforcement
+  });
+  return parsedStatus.success ? parsedStatus.data : null;
+}
 
 // ../../packages/persistence/src/paths.ts
 import {
@@ -24773,17 +25048,6 @@ function publishByLink(tmp, file2, data) {
 function controlPlaneCredentialPath(settingsDir2) {
   return join2(settingsDir2, ATTACHED_CREDENTIAL_FILENAME);
 }
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
-function isSafeEndpoint(endpoint) {
-  let parsed2;
-  try {
-    parsed2 = new URL(endpoint);
-  } catch {
-    return false;
-  }
-  if (parsed2.protocol === "https:") return true;
-  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname);
-}
 function repairOrRefuseMode(file2) {
   const link = lstatSync2(file2, { throwIfNoEntry: false });
   if (link === void 0) return "absent";
@@ -26576,7 +26840,7 @@ var SESSION_ROOT = `event_type = 'session'`;
 var HAS_ACTIVITY = `EXISTS (
   SELECT 1 FROM audit_events c
   WHERE c.root_session_id = audit_events.id
-    AND c.event_type NOT IN ('hook', 'config_scan'))`;
+    AND c.event_type NOT IN ('hook', 'config_scan', 'capture_status'))`;
 var SqliteActivityRepository = class {
   constructor(db, now = () => Date.now()) {
     this.db = db;
@@ -26603,10 +26867,10 @@ var SqliteActivityRepository = class {
                SELECT id FROM audit_events WHERE event_type = 'session' AND started_at >= ?
                UNION
                SELECT root_session_id FROM audit_events INDEXED BY idx_audit_started_at
-                WHERE started_at >= ?
+                WHERE started_at >= ? AND event_type <> 'capture_status'
                UNION
                SELECT root_session_id FROM audit_events INDEXED BY idx_audit_ended_at
-                WHERE ended_at >= ?)`,
+                WHERE ended_at >= ? AND event_type <> 'capture_status')`,
       [liveThreshold, liveThreshold, liveThreshold]
     );
     const toolCallsToday = countScalar(
@@ -27013,7 +27277,10 @@ var SqliteAuditEventsRepository = class {
          attributes = excluded.attributes,
          ended_at   = excluded.ended_at
        WHERE COALESCE(json_extract(excluded.attributes, '$.output_tokens'), 0)
-           > COALESCE(json_extract(audit_events.attributes, '$.output_tokens'), 0)`
+           > COALESCE(json_extract(audit_events.attributes, '$.output_tokens'), 0)
+          OR (json_extract(excluded.attributes, '$.usage_source') IS NOT NULL
+              AND json_extract(excluded.attributes, '$.output_tokens') IS NULL
+              AND excluded.attributes <> audit_events.attributes)`
     );
     this.upsertSessionRootStmt = db.prepare(
       `INSERT OR IGNORE INTO audit_events
@@ -27281,6 +27548,87 @@ var SqliteBodyRetentionRepository = class {
   }
 };
 
+// ../../packages/persistence/src/repositories/capture-status.ts
+var STATUS_LOOKBACK_ROWS = 128;
+var SqliteCaptureStatusRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.recentStmt = db.prepare(
+      `SELECT a.started_at AS startedAt,
+              a.attributes AS attributes,
+              a.root_session_id AS rootSessionId
+         FROM audit_events a
+        WHERE a.event_type = 'capture_status'
+          AND a.source_tool = ?
+          AND a.started_at >= ?
+        ORDER BY a.started_at DESC, a.id DESC
+        LIMIT ?`
+    );
+  }
+  db;
+  recentStmt;
+  /**
+   * Every document that reported for a site, in registry order by site, from
+   * the last `CAPTURE_STATUS_RECENCY_MS`.
+   *
+   * SEVERAL per site, not one: a browser is many documents and each reports
+   * for itself, so one row per site is a choice about which of them a user
+   * sees — and the newest is the wrong one, since a healthy tab writing a
+   * fresh report would hide a drifting tab's verdict, which is the whole
+   * reason these rows exist. The pick WITHIN a document is made here (the
+   * unchanged `pickReportedCaptureStatus`, over that document's own rows);
+   * choosing between documents belongs where the state semantics live, and
+   * that is `reportedCaptureDocumentForSite` in `@akasecurity/detections` —
+   * this package may not import it.
+   *
+   * `now` is a required argument rather than a `Date.now()` read, so a caller
+   * that already holds a render instant passes THAT one and a test can drive
+   * the window without moving the wall clock.
+   *
+   * A site whose reports have all aged out contributes nothing, so it derives
+   * to `unreported`. That is the point: nothing but the browser extension ever
+   * writes these rows, so an uninstalled extension's last verdict would
+   * otherwise stand as a live claim for ever with no later report able to
+   * clear it.
+   */
+  latest(now) {
+    const since = now - CAPTURE_STATUS_RECENCY_MS;
+    const documents = [];
+    for (const tool of WebSourceTool.options) {
+      const rows = /* @__PURE__ */ new Map();
+      const lastWord = /* @__PURE__ */ new Map();
+      for (const row of allRows(this.recentStmt, [
+        tool,
+        since,
+        STATUS_LOOKBACK_ROWS
+      ])) {
+        const status = fromCaptureStatusAttributes(parseJsonObject(row.attributes));
+        if (status === null) continue;
+        const record2 = { tool, observedAt: epochMillisToIso(row.startedAt), status };
+        const group = rows.get(row.rootSessionId);
+        if (group === void 0) {
+          rows.set(row.rootSessionId, [record2]);
+          lastWord.set(row.rootSessionId, { at: record2.observedAt, closed: status.closed });
+        } else {
+          group.push(record2);
+        }
+      }
+      for (const [root, candidates] of rows) {
+        const picked = pickReportedCaptureStatus(candidates);
+        const last = lastWord.get(root);
+        if (picked === void 0 || last === void 0) continue;
+        documents.push({
+          ...picked,
+          ...root === null ? {} : { rootSessionId: root },
+          lastReportAt: last.at,
+          closed: last.closed
+        });
+      }
+    }
+    return documents;
+  }
+};
+
 // ../../packages/persistence/src/repositories/classified-data.ts
 var SqliteClassifiedDataRepository = class {
   constructor(db) {
@@ -32861,6 +33209,7 @@ function openAndInitialize(file2, base, skipTags) {
       activity: new SqliteActivityRepository(db),
       sourceProject: new SqliteSourceProjectRepository(db),
       auditEvents: new SqliteAuditEventsRepository(db),
+      captureStatus: new SqliteCaptureStatusRepository(db),
       classifiedData: new SqliteClassifiedDataRepository(db),
       inspectionDefinitions: new SqliteInspectionDefinitionsRepository(db),
       inspectionFindings: new SqliteInspectionFindingsRepository(db),
@@ -32901,6 +33250,7 @@ function openLocalDatabase(dir, options = {}) {
     activity,
     sourceProject,
     auditEvents,
+    captureStatus,
     classifiedData,
     inspectionDefinitions,
     inspectionFindings,
@@ -33118,6 +33468,7 @@ function openLocalDatabase(dir, options = {}) {
     activity,
     sourceProject,
     auditEvents,
+    captureStatus,
     classifiedData,
     inspectionDefinitions,
     inspectionFindings,
@@ -33363,11 +33714,6 @@ function fingerprintValue(key, raw) {
 // ../../packages/persistence/src/forward-health.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { join as join9 } from "path";
-var FAILURES = /* @__PURE__ */ new Set([
-  "unauthorized",
-  "forbidden",
-  "unreachable"
-]);
 var BREAKER_COOLDOWN_MS = 3e4;
 function parseForwardHealth(raw, nowMs) {
   try {
@@ -33376,7 +33722,8 @@ function parseForwardHealth(raw, nowMs) {
     const record2 = parsed2;
     const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
     const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
-    const lastFailure = typeof record2.lastFailure === "string" && FAILURES.has(record2.lastFailure) ? record2.lastFailure : null;
+    const parsedFailure = ControlPlaneFailure.safeParse(record2.lastFailure);
+    const lastFailure = parsedFailure.success ? parsedFailure.data : null;
     return { consecutiveFailures: failures, openedAtMs, lastFailure };
   } catch {
     return null;
@@ -35417,6 +35764,56 @@ var CONFIG_POSTURE_RULES = [
   }
 ];
 
+// ../../packages/detections/src/posture/web-capture-posture.ts
+var RULE_VERSION2 = "1";
+var DRIFT_MIN_PARSE_FAILURES = 2;
+var WEB_CAPTURE_DRIFT_STATES = /* @__PURE__ */ new Set([
+  "blind",
+  "degraded"
+]);
+var WEB_CAPTURE_DRIFT_RULE = {
+  ruleId: "web-capture-drift",
+  version: RULE_VERSION2,
+  name: "Web chat capture is not reading the site",
+  category: "config",
+  severity: "medium",
+  definition: JSON.stringify({
+    kind: "web-capture-drift",
+    states: [...WEB_CAPTURE_DRIFT_STATES],
+    minParseFailures: DRIFT_MIN_PARSE_FAILURES
+  })
+};
+var STATIC_COPY = {
+  active: { headline: "turns are being observed on this site" },
+  unreported: {
+    // Says "recently" rather than "yet": the store read is bounded to
+    // CAPTURE_STATUS_RECENCY_MS, so this state covers a site nothing has ever
+    // reported for AND one whose last report has aged out. The two are the
+    // same fact to a reader — nobody has confirmed anything lately — and the
+    // copy may not claim the stronger of them.
+    headline: `no report in the last ${String(CAPTURE_STATUS_RECENCY_DAYS)} days \u2014 open the site in Chrome with the extension loaded`
+  },
+  standby: {
+    headline: "this build declares no endpoints for the site, so nothing is observed yet"
+  },
+  unpatched: {
+    // Says what the flags say and no more. `patched` is false both for a tap
+    // that installed and hooked neither transport and for one that never ran
+    // at all — a page reports the same status either way, so the copy may not
+    // assert one of them.
+    headline: "the page tap captured neither fetch nor XHR \u2014 it may not have installed; reload the extension at chrome://extensions"
+  },
+  idle: { headline: "watching; no turn has been observed yet" },
+  blind: {
+    headline: "messages were sent in the page that the network capture never saw",
+    remediation: "reload the tab. If it persists after `aka update` and reloading the extension at chrome://extensions, the site's send path has changed and needs a new extension build."
+  },
+  degraded: {
+    headline: "the site's payloads no longer carry the fields the extension reads",
+    remediation: "run `aka update`, then reload the extension at chrome://extensions. If it stays degraded after an update, the site's contract has changed and needs a new extension build."
+  }
+};
+
 // ../../packages/detections/src/security/redos-probe.ts
 var BUDGET_MS = 100;
 var EXPONENTIAL_UNITS = [
@@ -38200,10 +38597,31 @@ function matchProhibitedSpawnModel(requested, prohibited) {
   });
 }
 var TAIL_BYTES = 256 * 1024;
+var SWITCH_MODEL_REMEDY = "Switch to an approved model with /model";
+var WORDING = {
+  switch: {
+    subject: (model) => `Cannot switch to ${model}`,
+    remedy: SWITCH_MODEL_REMEDY
+  },
+  turn: {
+    subject: (model) => `This session is running on ${model}, which cannot be used`,
+    remedy: SWITCH_MODEL_REMEDY
+  },
+  spawn: {
+    subject: (model) => `Cannot start a subagent on ${model}`,
+    remedy: "Name an approved model on the subagent"
+  },
+  request: {
+    subject: (model) => `Cannot use ${model} for this request`,
+    remedy: "Change the model this application requests"
+  }
+};
+function lookupWording(action) {
+  return Object.hasOwn(WORDING, action) ? WORDING[action] : void 0;
+}
 function prohibitedModelMessage(model, action) {
-  const subject = action === "switch" ? `Cannot switch to ${model}` : action === "spawn" ? `Cannot start a subagent on ${model}` : `This session is running on ${model}, which cannot be used`;
-  const remedy = action === "spawn" ? "Name an approved model on the subagent" : "Switch to an approved model with /model";
-  return `${subject} \u2014 your organization has prohibited this model. ${remedy}, or ask an administrator to change its status in AKA under Govern \u2192 LLM Providers.`;
+  const { subject, remedy } = lookupWording(action) ?? WORDING.turn;
+  return `${subject(model)} \u2014 your organization has prohibited this model. ${remedy}, or ask an administrator to change its status in AKA under Govern \u2192 LLM Providers.`;
 }
 function buildModelRefusalEvent(input2) {
   return {
@@ -39591,6 +40009,12 @@ var RemoteRequestInvalid = class extends Error {
   }
   cause;
 };
+var RemoteEndpointRefused = class extends Error {
+  constructor(endpoint) {
+    super(`refusing to talk to an unsafe control-plane endpoint: ${originOnly(endpoint)}`);
+    this.name = "RemoteEndpointRefused";
+  }
+};
 var RemoteResponseInvalid = class extends Error {
   constructor(route, detail) {
     super(`control plane answered ${route} with ${detail}`);
@@ -39743,14 +40167,15 @@ function parsed(schema, body, route) {
   }
   return result.data;
 }
-function withoutTrailingSlashes(endpoint) {
+function resolveBaseUrl(endpoint) {
+  if (!isSafeEndpoint(endpoint)) throw new RemoteEndpointRefused(endpoint);
   let end = endpoint.length;
   while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH2) end -= 1;
   return endpoint.slice(0, end);
 }
 var SLASH2 = "/".charCodeAt(0);
 function createRemoteClient(options) {
-  const base = withoutTrailingSlashes(options.endpoint);
+  const base = resolveBaseUrl(options.endpoint);
   const url2 = (route) => `${base}${route}`;
   const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
   const sendOne = async (event) => {
@@ -39880,6 +40305,7 @@ function classifyRemoteFailure(err) {
     case "RemoteRouteAbsent":
       return "route-absent";
     case "RemoteRequestInvalid":
+    case "RemoteEndpointRefused":
       return "invalid-request";
     case "RemoteResponseInvalid":
       return "rejected";
@@ -40083,86 +40509,10 @@ function createForwardPolicy(deps) {
 }
 
 // ../../packages/plugin-runtime/src/attached/gateway.ts
-function strongerOf(a, b) {
-  if (a === null) return b;
-  if (b === null) return a;
-  return strongerAction(a, b);
-}
-function ruleCategoryMap(wireRules, localRules) {
-  const map2 = /* @__PURE__ */ new Map();
-  for (const rule of wireRules ?? []) map2.set(rule.id, rule.category);
-  for (const rule of localRules ?? []) map2.set(rule.id, rule.category);
-  for (const pack of bundledDetections()) {
-    for (const rule of pack.rules) map2.set(rule.id, rule.category);
-  }
-  return map2;
-}
-function policyKey(policy) {
-  return "ruleId" in policy.target ? `rule:${policy.target.ruleId}` : `category:${policy.target.category}`;
-}
-function floorFor(policy, categoryByRuleId) {
-  const category = "category" in policy.target ? policy.target.category : categoryByRuleId.get(policy.target.ruleId);
-  return category === void 0 ? null : DEFAULT_ACTIONS[category];
-}
-function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
-  const merged = /* @__PURE__ */ new Map();
-  const disabled = [];
-  const remoteCategoryAction = /* @__PURE__ */ new Map();
-  for (const policy of remotePolicies) {
-    if (!policy.enabled) continue;
-    if (!("category" in policy.target)) continue;
-    if (remoteCategoryAction.has(policy.target.category)) continue;
-    const floor = floorFor(policy, categoryByRuleId);
-    remoteCategoryAction.set(
-      policy.target.category,
-      floor !== null && !isActionAtLeast(policy.action, floor) ? floor : policy.action
-    );
-  }
-  for (const policy of localPolicies) {
-    if (!policy.enabled) {
-      disabled.push(policy);
-      continue;
-    }
-    const key = policyKey(policy);
-    if (merged.has(key)) continue;
-    let remoteFloor = null;
-    if ("ruleId" in policy.target) {
-      const category = categoryByRuleId.get(policy.target.ruleId);
-      if (category !== void 0) remoteFloor = remoteCategoryAction.get(category) ?? null;
-    }
-    merged.set(
-      key,
-      remoteFloor !== null && !isActionAtLeast(policy.action, remoteFloor) ? { ...policy, action: remoteFloor } : policy
-    );
-  }
-  const localCategoryAction = /* @__PURE__ */ new Map();
-  for (const policy of merged.values()) {
-    if ("category" in policy.target) localCategoryAction.set(policy.target.category, policy.action);
-  }
-  for (const policy of remotePolicies) {
-    if (!policy.enabled) {
-      disabled.push(policy);
-      continue;
-    }
-    const key = policyKey(policy);
-    const floor = floorFor(policy, categoryByRuleId);
-    let localFloor = null;
-    if ("ruleId" in policy.target) {
-      const category = categoryByRuleId.get(policy.target.ruleId);
-      if (category !== void 0) localFloor = localCategoryAction.get(category) ?? null;
-    }
-    const effectiveFloor = strongerOf(floor, localFloor);
-    const clamped = effectiveFloor !== null && !isActionAtLeast(policy.action, effectiveFloor) ? { ...policy, action: effectiveFloor } : policy;
-    const existing = merged.get(key);
-    if (existing === void 0) {
-      merged.set(key, clamped);
-      continue;
-    }
-    if (actionRank(clamped.action) > actionRank(existing.action)) {
-      merged.set(key, clamped);
-    }
-  }
-  return [...merged.values(), ...disabled];
+var bundledRulesFlatCache;
+function bundledRulesFlat() {
+  bundledRulesFlatCache ??= bundledDetections().flatMap((pack) => pack.rules);
+  return bundledRulesFlatCache;
 }
 var AttachedDataGateway = class {
   constructor(deps) {
@@ -40482,6 +40832,9 @@ var AttachedDataGateway = class {
   async readSessionProvider(sessionId) {
     return this.deps.local.readSessionProvider(sessionId);
   }
+  async readCaptureStatuses() {
+    return this.deps.local.readCaptureStatuses();
+  }
   async facets() {
     return this.deps.local.facets();
   }
@@ -40564,7 +40917,7 @@ var AttachedDataGateway = class {
       policies: mergeRaiseOnly(
         local.policies,
         cached2.policies,
-        ruleCategoryMap(cached2.rules, local.rules)
+        ruleCategoryMap(cached2.rules, local.rules, bundledRulesFlat())
       ),
       customKeywords: [...local.customKeywords, ...cached2.customKeywords],
       // TAKEN FROM THE CACHE, unlike the two fields below — and the asymmetry
@@ -40765,10 +41118,15 @@ import { join as join29 } from "path";
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
 var RETRYABLE = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
-var ATTEMPTS = 5;
+var IMMEDIATE_RETRIES = 8;
+var TIMED_RETRIES = 4;
+var ATTEMPTS = 1 + IMMEDIATE_RETRIES + TIMED_RETRIES;
 var delay = (ms) => new Promise((resolve2) => {
   setTimeout(resolve2, ms);
 });
+var yieldToLoop = () => new Promise((resolve2) => {
+  setImmediate(resolve2);
+});
 async function publishByRename(tmp, file2, move = rename2) {
   for (let attempt = 1; ; attempt += 1) {
     try {
@@ -40777,7 +41135,7 @@ async function publishByRename(tmp, file2, move = rename2) {
     } catch (err) {
       const code = err.code;
       if (attempt >= ATTEMPTS || code === void 0 || !RETRYABLE.has(code)) throw err;
-      await delay(attempt * 10);
+      await (attempt <= IMMEDIATE_RETRIES ? yieldToLoop() : delay((attempt - IMMEDIATE_RETRIES) * 10));
     }
   }
 }
@@ -41241,6 +41599,9 @@ var StandaloneDataGateway = class {
   readSessionProvider(sessionId) {
     return Promise.resolve(this.db.auditEvents.sessionProvider(sessionId));
   }
+  readCaptureStatuses() {
+    return Promise.resolve(this.db.captureStatus.latest(Date.now()));
+  }
   facets() {
     return Promise.resolve(this.db.facets());
   }