@akasecurity/ai-tc-claude-code 0.9.3 → 0.9.4

package/scripts/apply-suppressions.js

@@ -492,13 +492,13 @@ var require_ignore = __commonJS({
 });
 
 // src/apply-suppressions.ts
-import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
 import { userInfo } from "os";
-import { dirname as dirname5, join as join14 } from "path";
+import { dirname as dirname5, join as join15 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 import { existsSync, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
 import { join, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
@@ -564,6 +564,22 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0014_drop_legacy_events_findings",
     sql: "-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside \u2014 see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read \u2014 these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--> statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--> statement-breakpoint\n-- `findings.event_id` references `events.id` \u2014 drop the child first.\nDROP TABLE `findings`;\n--> statement-breakpoint\nDROP TABLE `events`;\n--> statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set \u2014 the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") \u2014 a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape \u2014 no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open \u2014 landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--> statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name \u2014 a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either \u2014 see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` \u2014 that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"
+  },
+  {
+    tag: "0015_busy_vengeance",
+    sql: "CREATE TABLE `secret_vault` (\n	`pointer_id` text PRIMARY KEY NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`fingerprint_key_version` integer NOT NULL,\n	`key_version` integer NOT NULL,\n	`category` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`masked_match` text NOT NULL,\n	`provider` text,\n	`ciphertext` text NOT NULL,\n	`nonce` text NOT NULL,\n	`auth_tag` text NOT NULL,\n	`occurrence_count` integer DEFAULT 1 NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_value` ON `secret_vault` (`value_fingerprint`);--> statement-breakpoint\nCREATE TABLE `secret_vault_deref` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`at` integer NOT NULL,\n	`target` text NOT NULL,\n	`reason` text NOT NULL,\n	`outcome` text NOT NULL,\n	`grant_id` text,\n	`pointer_count` integer DEFAULT 1 NOT NULL\n);\n--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_pointer` ON `secret_vault_deref` (`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_reason_at` ON `secret_vault_deref` (`reason`,`at`);"
+  },
+  {
+    tag: "0016_breezy_zodiak",
+    sql: "ALTER TABLE `exceptions` ADD `capability` text DEFAULT 'suppress' NOT NULL;"
+  },
+  {
+    tag: "0017_rainy_kat_farrell",
+    sql: "CREATE TABLE `secret_vault_sighting` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`location` text NOT NULL,\n	`kind` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_sighting` ON `secret_vault_sighting` (`pointer_id`,`location`);"
+  },
+  {
+    tag: "0018_serious_tana_nile",
+    sql: "ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"
   }
 ];
 
@@ -16220,6 +16236,7 @@ var ExceptionConditions = external_exports.object({
   sourceTool: external_exports.string().optional(),
   provider: external_exports.string().optional()
 }).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
 var DetectionException = external_exports.object({
   id: external_exports.guid(),
   ruleId: external_exports.string(),
@@ -16236,6 +16253,7 @@ var DetectionException = external_exports.object({
   keyVersion: external_exports.number().int().positive(),
   // maskMatch() preview of the approved value — never the raw value.
   maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
   scope: ExceptionScope,
   expiresAt: external_exports.iso.datetime().nullable(),
   maxUses: external_exports.number().int().positive().nullable(),
@@ -16259,6 +16277,7 @@ var ExceptionBundleEntry = DetectionException.pick({
   ruleId: true,
   valueFingerprint: true,
   keyVersion: true,
+  capability: true,
   expiresAt: true,
   maxUses: true,
   useCount: true,
@@ -17368,8 +17387,120 @@ var PatchInstalledPackRequest = external_exports.object({
   message: "At least one field must be provided"
 }).meta({ id: "PatchInstalledPackRequest" });
 
+// ../../packages/schema/src/zod/vault.ts
+var POINTER_FORMAT_VERSION = 2;
+var CATEGORY_ALTERNATION = DetectionCategory.options.join("|");
+var POINTER_TOKEN_PATTERN = new RegExp(
+  `\\[\\[aka:(?:${CATEGORY_ALTERNATION}):[A-Z2-7]{2,7}\\.[A-Z2-7]{26}\\.[A-Z2-7]{16}\\]\\]`
+);
+var POINTER_TOKEN_ANCHORED = new RegExp(`^${POINTER_TOKEN_PATTERN.source}$`);
+function pointerTokenScanner() {
+  return new RegExp(POINTER_TOKEN_PATTERN.source, "g");
+}
+var PointerToken = external_exports.string().regex(POINTER_TOKEN_ANCHORED);
+var ParsedPointer = external_exports.object({
+  category: DetectionCategory,
+  keyVersion: external_exports.number().int().positive(),
+  pointerId: external_exports.string(),
+  tag: external_exports.string()
+});
+var VaultEntry = external_exports.object({
+  pointerId: external_exports.string(),
+  // The keyed HMAC of the raw value under `exception.key`, and the epoch it was
+  // derived under. This is what a reveal-to-model grant matches on, and it rotates
+  // independently of the vault encryption key below.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  fingerprintKeyVersion: external_exports.number().int().positive(),
+  // The vault-key epoch this row's ciphertext was sealed under.
+  keyVersion: external_exports.number().int().positive(),
+  // Fixed at first mint and never updated: the same value detected later under a
+  // different rule's category keeps the category it was minted with, so one
+  // value always produces exactly one wire token.
+  category: DetectionCategory,
+  ruleId: external_exports.string(),
+  // Partial-reveal preview for badges and listings. Never the raw value.
+  maskedMatch: external_exports.string(),
+  provider: external_exports.string().optional(),
+  ciphertext: external_exports.string(),
+  nonce: external_exports.string(),
+  authTag: external_exports.string(),
+  // How many times this value has been detected on this machine — the reuse
+  // signal the vault dashboard reads. Distinct from VaultDeref.pointerCount.
+  occurrenceCount: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var PointerDescriptor = external_exports.object({
+  category: DetectionCategory,
+  provider: external_exports.string().optional(),
+  maskedMatch: external_exports.string(),
+  occurrences: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var PointerIdentity = external_exports.object({
+  ruleId: external_exports.string(),
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  fingerprintKeyVersion: external_exports.number().int().positive()
+});
+var DetokenizeTarget = external_exports.enum(["human", "model"]);
+var VaultDerefReason = external_exports.enum([
+  "display",
+  "explicit-reveal",
+  "view-render",
+  "model-input",
+  "remediation",
+  "purge"
+]);
+var VaultDerefOutcome = external_exports.enum(["revealed", "refused", "unavailable"]);
+var VaultDeref = external_exports.object({
+  id: external_exports.guid(),
+  pointerId: external_exports.string(),
+  at: external_exports.string(),
+  target: DetokenizeTarget,
+  reason: VaultDerefReason,
+  outcome: VaultDerefOutcome,
+  // Present only on a model-target crossing that a reveal grant authorized.
+  grantId: external_exports.string().optional(),
+  // How many pointers ONE batched render resolved. 1 for unbatched rows. Named
+  // apart from VaultEntry.occurrenceCount, which counts detections of a value.
+  pointerCount: external_exports.number().int().positive().default(1)
+});
+var VaultSightingKind = external_exports.enum([
+  "prompt",
+  "tool-input",
+  "tool-output",
+  "file",
+  "transcript"
+]);
+var VaultSighting = external_exports.object({
+  location: external_exports.string(),
+  kind: VaultSightingKind,
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var VaultInventoryEntry = external_exports.object({
+  pointerId: external_exports.string(),
+  category: DetectionCategory,
+  provider: external_exports.string().optional(),
+  maskedMatch: external_exports.string(),
+  occurrences: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string(),
+  // The active reveal-to-model grant covering this value, when one exists —
+  // the inventory badges it, the row links to revocation.
+  revealGrantId: external_exports.string().nullable(),
+  sightings: external_exports.array(VaultSighting)
+});
+var VaultKeyCustody = external_exports.string();
+var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
+var VaultConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  version: external_exports.number().int().positive()
+});
+
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 4;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
 var RunMode = external_exports.enum(["standalone"]);
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
@@ -17395,6 +17526,16 @@ var WorkspaceSettings = external_exports.object({
   // In-place egress extraction on the scan paths; disable to stop all Data
   // Shares writes.
   dataSharesInPlace: external_exports.boolean().default(true),
+  // Consent to keep a RECOVERABLE encrypted copy of detected values in the local
+  // vault, instead of destroying them. Absent by default: this is a custody
+  // change from one-way redaction, so it is never an assumed grant on upgrade.
+  // Revoking stops future vaulting; it does not erase what is already stored —
+  // purging the vault is the eraser.
+  vaultConsent: VaultConsent.optional(),
+  // Where the vault master key lives.
+  vaultKeyCustody: VaultKeyCustody.default("file"),
+  // How a pointer renders in assistant prose on screen (see VaultInlineReveal).
+  vaultInlineReveal: VaultInlineReveal.default("masked"),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
   onboardedAt: external_exports.iso.datetime().optional(),
   // Records that the user consented to sending findings to the model API for
@@ -19781,6 +19922,9 @@ var AmbiguousExceptionIdError = class extends Error {
 var ACTIVE_PREDICATE = `revoked_at IS NULL
      AND (expires_at IS NULL OR expires_at > :now)
      AND (max_uses IS NULL OR use_count < max_uses)`;
+var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
+     AND conditions IS NULL
+     AND ${ACTIVE_PREDICATE}`;
 var SqliteExceptionsRepository = class {
   constructor(db) {
     this.db = db;
@@ -19872,11 +20016,11 @@ var SqliteExceptionsRepository = class {
     this.db.prepare(
       `INSERT INTO exceptions (
              id, rule_id, category, value_fingerprint, key_version, masked_value,
-             scope, expires_at, max_uses, use_count, last_used_at, justification,
-             conditions, created_by, created_via, created_at, updated_at
+             capability, scope, expires_at, max_uses, use_count, last_used_at,
+             justification, conditions, created_by, created_via, created_at, updated_at
            ) VALUES (
              :id, :ruleId, :category, :valueFingerprint, :keyVersion, :maskedValue,
-             :scope, :expiresAt, :maxUses, 0, NULL, :justification,
+             :capability, :scope, :expiresAt, :maxUses, 0, NULL, :justification,
              :conditions, :createdBy, :createdVia, :now, :now
            )`
     ).run({
@@ -19886,6 +20030,7 @@ var SqliteExceptionsRepository = class {
       valueFingerprint: input.valueFingerprint,
       keyVersion: input.keyVersion,
       maskedValue: input.maskedValue,
+      capability: input.capability ?? "suppress",
       scope: input.scope,
       expiresAt: input.expiresAt === null ? null : isoToEpochMillis(input.expiresAt),
       maxUses: input.maxUses,
@@ -19979,6 +20124,7 @@ var SqliteExceptionsRepository = class {
         ruleId: row.rule_id,
         valueFingerprint: row.value_fingerprint,
         keyVersion: row.key_version,
+        capability: row.capability,
         expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
         maxUses: row.max_uses,
         useCount: row.use_count,
@@ -20033,6 +20179,35 @@ var SqliteExceptionsRepository = class {
       }))
     );
   }
+  /**
+   * The active reveal-to-model grant for a vaulted value's identity, or null.
+   * Matching is exact on (ruleId, valueFingerprint, keyVersion) — the same key
+   * suppression uses — plus the capability: a suppression grant must never
+   * authorize a reveal. Read-only: the caller does NOT consume here, because a
+   * revealed value re-enters the detection scan immediately afterward and the
+   * suppression match there claims the use — one crossing, one use.
+   *
+   * A grant with `conditions` NEVER matches here: the reveal path does not yet
+   * evaluate conditions, and a narrowing clause that is ignored would WIDEN the
+   * grant instead. Fail closed until reveal-side condition evaluation exists.
+   */
+  activeRevealGrant(ruleId, valueFingerprint, keyVersion, now = Date.now()) {
+    try {
+      const row = getRow(
+        this.db.prepare(
+          `SELECT id FROM exceptions
+            WHERE rule_id = :ruleId AND value_fingerprint = :valueFingerprint
+              AND key_version = :keyVersion
+              AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+            LIMIT 1`
+        ),
+        { ruleId, valueFingerprint, keyVersion, now }
+      );
+      return Promise.resolve(row ?? null);
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
   /**
    * Retention sweep: delete TERMINAL rows (revoked, expired, or use-budget
    * exhausted) whose last transition is older than the retention window.
@@ -20060,6 +20235,7 @@ function parseExceptionRow(row) {
     valueFingerprint: row.value_fingerprint,
     keyVersion: row.key_version,
     maskedValue: row.masked_value,
+    capability: row.capability,
     scope: row.scope,
     expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
     maxUses: row.max_uses,
@@ -22225,6 +22401,287 @@ var SqliteScanLedgerRepository = class {
   }
 };
 
+// ../../packages/persistence/src/repositories/secret-vault.ts
+import { randomUUID as randomUUID7 } from "crypto";
+var SELECT_COLUMNS = `
+  pointer_id AS pointerId,
+  value_fingerprint AS valueFingerprint,
+  fingerprint_key_version AS fingerprintKeyVersion,
+  key_version AS keyVersion,
+  format_version AS formatVersion,
+  category,
+  rule_id AS ruleId,
+  masked_match AS maskedMatch,
+  provider,
+  ciphertext,
+  nonce,
+  auth_tag AS authTag,
+  occurrence_count AS occurrenceCount,
+  first_seen AS firstSeen,
+  last_seen AS lastSeen`;
+function toRow(raw) {
+  const { provider, ...rest } = raw;
+  return provider === null ? rest : { ...rest, provider };
+}
+var SqliteSecretVaultRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.insertStmt = db.prepare(
+      `INSERT INTO secret_vault (
+         pointer_id, value_fingerprint, fingerprint_key_version, key_version,
+         format_version, category, rule_id, masked_match, provider,
+         ciphertext, nonce, auth_tag,
+         occurrence_count, first_seen, last_seen
+       ) VALUES (
+         :pointerId, :valueFingerprint, :fingerprintKeyVersion, :keyVersion,
+         :formatVersion, :category, :ruleId, :maskedMatch, :provider,
+         :ciphertext, :nonce, :authTag,
+         1, :now, :now
+       )`
+    );
+    this.bumpStmt = db.prepare(
+      `UPDATE secret_vault
+       SET occurrence_count = occurrence_count + 1, last_seen = :now
+       WHERE value_fingerprint = :valueFingerprint`
+    );
+    this.byPointerStmt = db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM secret_vault WHERE pointer_id = :pointerId`
+    );
+    this.byFingerprintStmt = db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM secret_vault WHERE value_fingerprint = :valueFingerprint`
+    );
+    this.listStmt = db.prepare(`SELECT ${SELECT_COLUMNS} FROM secret_vault ORDER BY first_seen`);
+    this.replaceCiphertextStmt = db.prepare(
+      `UPDATE secret_vault
+       SET key_version = :keyVersion, ciphertext = :ciphertext, nonce = :nonce, auth_tag = :authTag
+       WHERE pointer_id = :pointerId`
+    );
+    this.refreshFingerprintStmt = db.prepare(
+      `UPDATE secret_vault
+       SET value_fingerprint = :valueFingerprint, fingerprint_key_version = :fingerprintKeyVersion
+       WHERE pointer_id = :pointerId`
+    );
+    this.derefStmt = db.prepare(
+      `INSERT INTO secret_vault_deref (id, pointer_id, at, target, reason, outcome, grant_id, pointer_count)
+       VALUES (:id, :pointerId, :at, :target, :reason, :outcome, :grantId, :pointerCount)`
+    );
+  }
+  db;
+  insertStmt;
+  bumpStmt;
+  byPointerStmt;
+  byFingerprintStmt;
+  listStmt;
+  replaceCiphertextStmt;
+  refreshFingerprintStmt;
+  derefStmt;
+  /**
+   * Vault a value, or record another sighting of one already vaulted. Keyed on
+   * `valueFingerprint`, never on the caller's pointer id: a value seen again
+   * bumps `occurrence_count` and `last_seen` and comes back with its ORIGINAL
+   * pointer, category and ciphertext, so the same secret always resolves to one
+   * wire token. `minted` is true only when this call created the row.
+   *
+   * The read-then-write runs in one IMMEDIATE transaction so two concurrent
+   * writers cannot both decide they are minting.
+   */
+  upsert(input, now) {
+    let minted = false;
+    withTransaction(
+      this.db,
+      () => {
+        const existing = getRow(this.byFingerprintStmt, {
+          valueFingerprint: input.valueFingerprint
+        });
+        if (existing === void 0) {
+          this.insertStmt.run(
+            bindParams({
+              pointerId: input.pointerId,
+              valueFingerprint: input.valueFingerprint,
+              fingerprintKeyVersion: input.fingerprintKeyVersion,
+              keyVersion: input.keyVersion,
+              formatVersion: input.formatVersion ?? POINTER_FORMAT_VERSION,
+              category: input.category,
+              ruleId: input.ruleId,
+              maskedMatch: input.maskedMatch,
+              provider: input.provider,
+              ciphertext: input.ciphertext,
+              nonce: input.nonce,
+              authTag: input.authTag,
+              now
+            })
+          );
+          minted = true;
+          return;
+        }
+        this.bumpStmt.run({ valueFingerprint: input.valueFingerprint, now });
+      },
+      "IMMEDIATE"
+    );
+    const row = getRow(this.byFingerprintStmt, {
+      valueFingerprint: input.valueFingerprint
+    });
+    if (row === void 0) throw new Error("vault: row vanished immediately after write");
+    return { row: toRow(row), minted };
+  }
+  byPointerId(pointerId) {
+    const raw = getRow(this.byPointerStmt, { pointerId });
+    return raw === void 0 ? null : toRow(raw);
+  }
+  byValueFingerprint(fingerprint) {
+    const raw = getRow(this.byFingerprintStmt, { valueFingerprint: fingerprint });
+    return raw === void 0 ? null : toRow(raw);
+  }
+  /** Append one audit row. Carries no raw value and no ciphertext, by shape. */
+  recordDeref(entry) {
+    this.derefStmt.run(
+      bindParams({
+        id: entry.id,
+        pointerId: entry.pointerId,
+        at: entry.at,
+        target: entry.target,
+        reason: entry.reason,
+        outcome: entry.outcome,
+        grantId: entry.grantId,
+        pointerCount: entry.pointerCount ?? 1
+      })
+    );
+  }
+  listAll() {
+    return allRows(this.listStmt).map(toRow);
+  }
+  /** Re-seal an entry under a new key epoch, leaving its identity untouched. */
+  replaceCiphertext(pointerId, next) {
+    this.replaceCiphertextStmt.run({ pointerId, ...next });
+  }
+  /** Re-derive an entry's fingerprint under a new fingerprint-key epoch. */
+  refreshFingerprint(pointerId, next) {
+    this.refreshFingerprintStmt.run({ pointerId, ...next });
+  }
+  /**
+   * Destroy every vaulted value and report how many were destroyed. The deref
+   * audit is left alone on purpose — see the table note above.
+   */
+  purgeAll() {
+    let destroyed = 0;
+    withTransaction(
+      this.db,
+      () => {
+        destroyed = this.countEntries();
+        this.db.exec("DELETE FROM secret_vault");
+      },
+      "IMMEDIATE"
+    );
+    return destroyed;
+  }
+  /**
+   * Record (or re-stamp) one place a pointer has been written. One row per
+   * (pointer, location); a re-sighting bumps last_seen. Best-effort bookkeeping
+   * on hook paths — a failure must never affect the rewrite that triggered it,
+   * so callers wrap this, not the other way around.
+   */
+  recordSighting(entry, now) {
+    this.db.prepare(
+      `INSERT INTO secret_vault_sighting (id, pointer_id, location, kind, first_seen, last_seen)
+         VALUES (:id, :pointerId, :location, :kind, :now, :now)
+         ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`
+    ).run({
+      id: randomUUID7(),
+      pointerId: entry.pointerId,
+      location: entry.location,
+      kind: entry.kind,
+      now
+    });
+  }
+  listSightings(pointerId) {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT location, kind, first_seen, last_seen FROM secret_vault_sighting
+          WHERE pointer_id = :pointerId ORDER BY last_seen DESC`
+      ),
+      { pointerId }
+    );
+    return rows.map((r) => ({
+      location: r.location,
+      kind: r.kind,
+      firstSeen: new Date(r.first_seen).toISOString(),
+      lastSeen: new Date(r.last_seen).toISOString()
+    }));
+  }
+  /**
+   * The dashboard inventory: every vaulted value's descriptor data joined with
+   * its sightings and the active reveal-to-model grant when one exists.
+   * Raw-free by construction — neither the fingerprint nor the ciphertext
+   * columns are selected.
+   */
+  listInventory(now = Date.now()) {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
+                v.occurrence_count, v.first_seen, v.last_seen,
+                (SELECT e.id FROM exceptions e
+                  WHERE e.rule_id = v.rule_id
+                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.key_version = v.fingerprint_key_version
+                    AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+                  LIMIT 1) AS grant_id
+           FROM secret_vault v
+          ORDER BY v.last_seen DESC`
+      ),
+      { now }
+    );
+    return rows.map((r) => ({
+      pointerId: r.pointer_id,
+      category: r.category,
+      ...r.provider === null ? {} : { provider: r.provider },
+      maskedMatch: r.masked_match,
+      occurrences: r.occurrence_count,
+      firstSeen: new Date(r.first_seen).toISOString(),
+      lastSeen: new Date(r.last_seen).toISOString(),
+      revealGrantId: r.grant_id,
+      sightings: this.listSightings(r.pointer_id)
+    }));
+  }
+  /**
+   * The de-reference trail, newest first. By default the batched, high-volume
+   * reasons (display, view-render) are hidden and counted instead — the rows
+   * that matter as a signal are the model crossings, and burying them under
+   * render noise would defeat the audit's purpose.
+   */
+  listDerefs(opts) {
+    const limit = opts?.limit ?? 200;
+    const where = opts?.includeBatched === true ? "" : `WHERE reason NOT IN ('display', 'view-render')`;
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, pointer_id, at, target, reason, outcome, grant_id, pointer_count
+           FROM secret_vault_deref ${where}
+          ORDER BY at DESC, rowid DESC LIMIT :limit`
+      ),
+      { limit }
+    );
+    const hiddenBatched = opts?.includeBatched === true ? 0 : countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM secret_vault_deref WHERE reason IN ('display', 'view-render')`
+    );
+    return {
+      rows: rows.map((r) => ({
+        id: r.id,
+        pointerId: r.pointer_id,
+        at: new Date(r.at).toISOString(),
+        target: r.target,
+        reason: r.reason,
+        outcome: r.outcome,
+        ...r.grant_id === null ? {} : { grantId: r.grant_id },
+        pointerCount: r.pointer_count
+      })),
+      hiddenBatched
+    };
+  }
+  countEntries() {
+    return countScalar(this.db, "SELECT COUNT(*) AS n FROM secret_vault");
+  }
+};
+
 // ../../packages/persistence/src/repositories/security.ts
 var DAY_MS4 = 864e5;
 var SEVERITIES = ["critical", "high", "medium", "low"];
@@ -22570,7 +23027,7 @@ var SqliteSecurityRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
 var IN_CHUNK = 500;
 var KIND_ORDER = ["provider", "internal", "external", "ip"];
@@ -22826,7 +23283,7 @@ var SqliteSharesRepository = class {
                (id, destination_id, host, decision, created_at, updated_at)
              VALUES (:id, :destinationId, :host, :decision, :now, :now)`
         ).run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           destinationId,
           host: dest.host,
           decision,
@@ -22975,7 +23432,7 @@ var SqliteSharesRepository = class {
       let destinationId = destIds.get(hit.host);
       if (destinationId === void 0) {
         destStmt.run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           kind: hit.kind,
           name: hit.name,
           host: hit.host,
@@ -22991,7 +23448,7 @@ var SqliteSharesRepository = class {
       let endpointId = endpointIds.get(endpointKey);
       if (endpointId === void 0) {
         endpointStmt.run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           destinationId,
           method: hit.method,
           transport: hit.transport,
@@ -23004,7 +23461,7 @@ var SqliteSharesRepository = class {
         endpointIds.set(endpointKey, endpointId);
       }
       siteStmt.run({
-        id: randomUUID7(),
+        id: randomUUID8(),
         endpointId,
         project: input.project,
         projectKey: input.projectKey,
@@ -23420,6 +23877,7 @@ function openAndInitialize(file2) {
       policies,
       installedPacks,
       scanLedger: new SqliteScanLedgerRepository(db),
+      secretVault: new SqliteSecretVaultRepository(db),
       exceptions: new SqliteExceptionsRepository(db),
       resolutions: new SqliteResolutionsRepository(db),
       ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
@@ -23455,6 +23913,7 @@ function openLocalDatabase(dir) {
     policies,
     installedPacks,
     scanLedger,
+    secretVault,
     exceptions,
     resolutions,
     ruleProbeCache,
@@ -23563,7 +24022,7 @@ function openLocalDatabase(dir) {
         const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
         if (!definitionId) continue;
         inspectionFindings.insertFinding({
-          id: randomUUID8(),
+          id: randomUUID9(),
           auditEventId: record2.scanEvent.id,
           inspectionDefinitionId: definitionId,
           span: finding.span,
@@ -23640,6 +24099,7 @@ function openLocalDatabase(dir) {
     policies,
     installedPacks,
     scanLedger,
+    secretVault,
     exceptions,
     resolutions,
     ruleProbeCache,
@@ -23739,13 +24199,39 @@ function readJson(file2) {
   return parseJsonObject(text) ?? null;
 }
 
-// ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
+// ../../packages/persistence/src/vault/crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac as createHmac2,
+  hkdfSync,
+  timingSafeEqual
+} from "crypto";
+
+// ../../packages/persistence/src/vault/key-provider.ts
+import { execFileSync } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
+  renameSync as renameSync4,
+  rmSync as rmSync3,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
 import { join as join5 } from "path";
 
+// ../../packages/persistence/src/vault/vault.ts
+import { randomBytes as randomBytes3, randomUUID as randomUUID10 } from "crypto";
+
+// ../../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join6 } from "path";
+
 // ../../packages/plugin-sdk/src/config.ts
 import { existsSync as existsSync4 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -23799,7 +24285,7 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir()) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join6(settingsDir(base), "settings.json");
+    const settingsFile = join7(settingsDir(base), "settings.json");
     if (existsSync4(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
@@ -23823,9 +24309,9 @@ function resolveProviderSafe() {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
+import { readdirSync, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join8 } from "path";
+import { basename as basename2, join as join9 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -24613,12 +25099,12 @@ function redact(text, findings) {
   const regions = [];
   for (const f of sorted) {
     const rank = SEVERITY_RANK2[f.severity];
-    const open = regions[regions.length - 1];
-    if (open && f.span.start < open.end) {
-      open.end = Math.max(open.end, f.span.end);
-      if (rank > open.rank) {
-        open.rank = rank;
-        open.category = f.category;
+    const open2 = regions[regions.length - 1];
+    if (open2 && f.span.start < open2.end) {
+      open2.end = Math.max(open2.end, f.span.end);
+      if (rank > open2.rank) {
+        open2.rank = rank;
+        open2.category = f.category;
       }
     } else {
       regions.push({ start: f.span.start, end: f.span.end, category: f.category, rank });
@@ -24647,6 +25133,24 @@ function maskMatch(raw) {
   return `${raw.charAt(0)}${"*".repeat(6)}${raw.charAt(raw.length - 1)}`;
 }
 
+// ../../packages/detections/src/pointer-shield.ts
+function shieldPointers(text) {
+  const spans = [];
+  let out = null;
+  for (const match of text.matchAll(pointerTokenScanner())) {
+    spans.push({ start: match.index, end: match.index + match[0].length });
+    out ??= text;
+    out = out.slice(0, match.index) + " ".repeat(match[0].length) + out.slice(match.index + match[0].length);
+  }
+  return { text: out ?? text, spans };
+}
+function dropShieldedFindings(findings, spans) {
+  if (spans.length === 0) return findings;
+  return findings.filter(
+    (finding) => !spans.some((s) => finding.span.start < s.end && finding.span.end > s.start)
+  );
+}
+
 // ../../packages/detections/src/posture/config-posture.ts
 var RULE_VERSION = "1";
 var KNOWN_TOOLS = /* @__PURE__ */ new Set([
@@ -26768,7 +27272,8 @@ function scanText(text, ruleVersions) {
   if (!ensureBundledPacks()) return { masked: "[REDACTED]", findings: [] };
   try {
     const rules = getLoadedRules();
-    const matches = scan(text, rules);
+    const shielded = shieldPointers(text);
+    const matches = dropShieldedFindings(scan(shielded.text, rules), shielded.spans);
     if (matches.length === 0) return { masked: text, findings: [] };
     const byId = new Map(rules.map((r) => [r.id, r]));
     const findings = matches.map((m) => {
@@ -26794,18 +27299,18 @@ function maskText(text) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
+import { basename, dirname, isAbsolute, join as join8, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID11 } from "crypto";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname3, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
@@ -26823,8 +27328,8 @@ function applyCategoryPosture(posture, repo, mode = "fill-gaps") {
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
-import { basename as basename4, join as join10, relative, sep as sep4 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
+import { basename as basename4, join as join11, relative, sep as sep4 } from "path";
 
 // ../../packages/plugin-sdk/src/raw-egress.ts
 var RawEgressError = class extends Error {
@@ -26875,7 +27380,7 @@ function assertRawFree(text, rawValues) {
 }
 
 // ../../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/plugin-sdk/src/suppressions.ts
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -26915,8 +27420,8 @@ async function applySetupTriageSuppressions(entries, writer, opts) {
 }
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
 
 // src/command-registry.ts
 import { readdirSync as readdirSync4 } from "fs";
@@ -27031,12 +27536,12 @@ function show(body) {
 }
 
 // src/triage/gate-display.ts
-function findContext(entry, join15) {
-  const byFingerprint = join15.find(
+function findContext(entry, join16) {
+  const byFingerprint = join16.find(
     (j) => j.valueFingerprint !== void 0 && j.valueFingerprint === entry.valueFingerprint
   );
   if (byFingerprint) return byFingerprint.maskedContext;
-  const byRuleAndMask = join15.find(
+  const byRuleAndMask = join16.find(
     (j) => j.ruleId === entry.ruleId && j.maskedMatch === entry.maskedValue
   );
   return byRuleAndMask?.maskedContext;
@@ -27107,13 +27612,13 @@ function renderShowcase(showcase) {
 
 ${blocks.join("\n\n")}`;
 }
-function renderSuppressionGate(entries, join15) {
+function renderSuppressionGate(entries, join16) {
   if (entries.length === 0) {
     return "No false-positive suppressions to confirm \u2014 nothing will be written.";
   }
   const header = entries.length === 1 ? "This looks like a false positive \u2014 take a look before I suppress it:" : `These ${String(entries.length)} look like false positives \u2014 take a look before I suppress them:`;
   const blocks = entries.map((entry, i) => {
-    const context = findContext(entry, join15);
+    const context = findContext(entry, join16);
     const lines = [
       `${String(i + 1)}. ${entry.ruleId} [${entry.category}]`,
       `   value:   ${entry.maskedValue}`,
@@ -27343,9 +27848,9 @@ function mergeRecommendations(verdicts) {
 }
 
 // src/triage/plan-file.ts
-import { mkdtempSync, readFileSync as readFileSync7, rmdirSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync8, rmdirSync, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename5, dirname as dirname3, join as join12 } from "path";
+import { basename as basename5, dirname as dirname3, join as join13 } from "path";
 var SuppressionEntrySchema = external_exports.object({
   ruleId: external_exports.string(),
   category: DetectionCategory,
@@ -27400,18 +27905,18 @@ function serializePlan(plan, current) {
 function writePlanFile(plan, current, rawValues, deps = {}) {
   const serialized = serializePlan(plan, current);
   assertRawFree(serialized, rawValues);
-  const dir = (deps.mkTempDir ?? (() => mkdtempSync(join12(tmpdir(), "aka-plan-"))))();
-  const path = join12(dir, "setup-plan.json");
-  writeFileSync5(path, serialized, { encoding: "utf8", mode: 384 });
+  const dir = (deps.mkTempDir ?? (() => mkdtempSync(join13(tmpdir(), "aka-plan-"))))();
+  const path = join13(dir, "setup-plan.json");
+  writeFileSync6(path, serialized, { encoding: "utf8", mode: 384 });
   return path;
 }
 function readPlanFile(path) {
-  const text = readFileSync7(path, "utf8");
+  const text = readFileSync8(path, "utf8");
   const json2 = JSON.parse(text);
   return PersistedPlanSchema.parse(json2);
 }
 function deletePlanFile(path) {
-  rmSync3(path, { force: true });
+  rmSync4(path, { force: true });
   const dir = dirname3(path);
   if (!basename5(dir).startsWith("aka-plan-")) return;
   try {
@@ -27480,8 +27985,8 @@ function buildJoinEntries(hits) {
 }
 
 // src/triage/resolve.ts
-function resolveSuppressions(rec, join15) {
-  const byId = new Map(join15.map((e) => [e.id, e]));
+function resolveSuppressions(rec, join16) {
+  const byId = new Map(join16.map((e) => [e.id, e]));
   const entries = [];
   const skipped = [];
   for (const cat of rec.perCategory) {
@@ -27583,7 +28088,7 @@ function parseTriageStream(text) {
   return { hits, status: "complete" };
 }
 function planTriageWriteback(hits, rec) {
-  const join15 = buildJoinEntries(hits);
+  const join16 = buildJoinEntries(hits);
   const rawValues = hits.map((h) => h.rawMatch);
   const skipped = [];
   const posture = {};
@@ -27623,7 +28128,7 @@ function planTriageWriteback(hits, rec) {
   }
   const { entries, skipped: resolveSkips } = resolveSuppressions(
     { perCategory: safeCategories, notes: rec.notes },
-    join15
+    join16
   );
   skipped.push(...resolveSkips);
   let notes = rec.notes;
@@ -27633,7 +28138,7 @@ function planTriageWriteback(hits, rec) {
     if (err instanceof RawEgressError) notes = SCRUBBED_NOTES;
     else throw err;
   }
-  return { entries, posture, showcase, join: join15, notes, skipped };
+  return { entries, posture, showcase, join: join16, notes, skipped };
 }
 function recommendedPosture(evidence) {
   return { ...severityFloorPosture(), ...evidence };
@@ -27889,10 +28394,10 @@ async function runConfirm(deps, planIO) {
 }
 
 // src/triage/judge.ts
-import { execFileSync } from "child_process";
-import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, rmSync as rmSync5 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname4, join as join13 } from "path";
+import { dirname as dirname4, join as join14 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/triage/parse-verdict.ts
@@ -27906,7 +28411,7 @@ function parseRecommendation(text) {
 
 // src/triage/judge.ts
 var TRIAGE_DIR = dirname4(fileURLToPath2(import.meta.url));
-var DEFAULT_RUBRIC_PATH = join13(TRIAGE_DIR, "..", "..", "eval", "prompt.md");
+var DEFAULT_RUBRIC_PATH = join14(TRIAGE_DIR, "..", "..", "eval", "prompt.md");
 function parseVerdict(stdout) {
   let envelope;
   try {
@@ -27925,20 +28430,20 @@ function parseVerdict(stdout) {
     throw new Error("claude -p returned an unparseable TriageRecommendation");
   }
 }
-function judgeEnv() {
+function judgeEnv(platform2 = process.platform) {
   const env = {
     // eslint-disable-next-line n/no-process-env -- subprocess must inherit PATH/auth
     ...process.env,
     CLAUDE_CODE_SKIP_PROMPT_HISTORY: "1",
     CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
   };
-  if (process.platform === "darwin") {
-    env.CLAUDE_CONFIG_DIR = mkdtempSync2(join13(tmpdir2(), "aka-judge-cfg-"));
+  if (platform2 === "darwin") {
+    env.CLAUDE_CONFIG_DIR = mkdtempSync2(join14(tmpdir2(), "aka-judge-cfg-"));
   }
   return env;
 }
 function spawnClaude(argv, env, stdin) {
-  return execFileSync("claude", [...argv], {
+  return execFileSync2("claude", [...argv], {
     env,
     input: stdin,
     encoding: "utf8",
@@ -27962,7 +28467,10 @@ function toJudgePayload(hit) {
   return payload;
 }
 function runJudge(hits, deps) {
-  const rubric = deps.loadRubric?.() ?? readFileSync8(DEFAULT_RUBRIC_PATH, "utf8");
+  if (typeof deps.spawn !== "function") {
+    throw new TypeError("runJudge requires deps.spawn \u2014 there is no live-spawn fallback");
+  }
+  const rubric = deps.loadRubric?.() ?? readFileSync9(DEFAULT_RUBRIC_PATH, "utf8");
   const hitsJsonl = hits.map((h) => JSON.stringify(toJudgePayload(h))).join("\n");
   const fullPrompt = `${rubric}
 
@@ -27973,7 +28481,8 @@ ${hitsJsonl}
 \`\`\`
 `;
   const argv = ["-p", "--no-session-persistence", "--output-format", "json"];
-  const env = judgeEnv();
+  const platform2 = deps.platform ?? process.platform;
+  const env = judgeEnv(platform2);
   try {
     let stdout;
     try {
@@ -27983,8 +28492,11 @@ ${hitsJsonl}
     }
     return parseVerdict(stdout);
   } finally {
-    if (process.platform === "darwin" && env.CLAUDE_CONFIG_DIR) {
-      rmSync4(env.CLAUDE_CONFIG_DIR, { recursive: true, force: true });
+    if (platform2 === "darwin" && env.CLAUDE_CONFIG_DIR) {
+      try {
+        rmSync5(env.CLAUDE_CONFIG_DIR, { recursive: true, force: true });
+      } catch {
+      }
     }
   }
 }
@@ -28004,9 +28516,9 @@ function resolveCreatedBy() {
 }
 function loadRubric() {
   const here = dirname5(fileURLToPath3(import.meta.url));
-  const shipped = join14(here, "triage-rubric.md");
-  if (existsSync7(shipped)) return readFileSync9(shipped, "utf8");
-  return readFileSync9(join14(here, "..", "eval", "prompt.md"), "utf8");
+  const shipped = join15(here, "triage-rubric.md");
+  if (existsSync7(shipped)) return readFileSync10(shipped, "utf8");
+  return readFileSync10(join15(here, "..", "eval", "prompt.md"), "utf8");
 }
 async function main() {
   const argv = process.argv.slice(2);
@@ -28014,7 +28526,7 @@ async function main() {
     argv,
     // fd 0 = stdin; the wizard pipes `backfill.js --triage` into this on preview.
     // Called only on the preview path — the confirm path never reads a stream.
-    readStream: (streamPath) => streamPath !== void 0 ? readFileSync9(streamPath, "utf8") : readFileSync9(0, "utf8"),
+    readStream: (streamPath) => streamPath !== void 0 ? readFileSync10(streamPath, "utf8") : readFileSync10(0, "utf8"),
     runJudge: (hits) => runJudge(hits, { spawn: spawnClaude, loadRubric }),
     // The distinct model-judge egress consent, read from settings.json. When it
     // is absent or stale the preview skips the judge instead of sending findings