@akasecurity/ai-tc-claude-code 0.9.4 → 0.9.5

package/scripts/pre-tool-use.js

@@ -492,13 +492,12 @@ var require_ignore = __commonJS({
 });
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID9 } from "crypto";
-import { existsSync, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
-import { join, sep } from "path";
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join2, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
 // ../../packages/schema/src/drizzle/sqlite-ddl.ts
@@ -578,6 +577,14 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0018_serious_tana_nile",
     sql: "ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"
+  },
+  {
+    tag: "0019_audit_started_at_index",
+    sql: "CREATE INDEX `idx_audit_started_at` ON `audit_events` (`started_at`);"
+  },
+  {
+    tag: "0020_secret_vault_pagination_indexes",
+    sql: "CREATE INDEX `idx_secret_vault_last_seen` ON `secret_vault` (`last_seen`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_reuse` ON `secret_vault` (`occurrence_count`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_at` ON `secret_vault_deref` (`at`,`id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_signal` ON `secret_vault_deref` (`at`,`id`) WHERE `reason` NOT IN ('display', 'view-render');"
   }
 ];
 
@@ -15315,7 +15322,17 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum(["claudecode", "claudedesktop", "cursor", "copilot", "chatgpt", "api"]).meta({ id: "FindingProvider" });
+var FindingProvider = external_exports.enum([
+  "claudecode",
+  "claudedesktop",
+  "cursor",
+  "copilot",
+  "chatgpt",
+  "claudeai",
+  "codex",
+  "antigravity",
+  "api"
+]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
@@ -15369,7 +15386,16 @@ var FindingInstance = external_exports.object({
   confidence: external_exports.number().min(0).max(1),
   // Lifecycle status (see FindingStatus). Optional so legacy callers/rows
   // that predate the resolution feature stay valid.
-  status: FindingStatus.optional()
+  status: FindingStatus.optional(),
+  // The audit event this finding was captured from. Optional so callers that
+  // do not project it stay valid. An at-rest finding is content-addressed by
+  // finding_key and its row is upserted on re-detection, so this names the
+  // MOST RECENT detection event, not the first.
+  eventId: external_exports.string().optional(),
+  // The session that event belongs to, when it has one — the seam a
+  // per-instance "view session" link needs. Absent for events captured
+  // outside a session.
+  sessionId: external_exports.string().optional()
 }).meta({ id: "FindingInstance" });
 var FindingGroup = external_exports.object({
   id: external_exports.string(),
@@ -15413,7 +15439,11 @@ var FindingFacets = external_exports.object({
   // for every instance, so every group lands in a bucket; a status-less
   // group (possible only for callers whose rows carry no statuses) is
   // counted under no value.
-  status: external_exports.array(FindingFacetItem)
+  status: external_exports.array(FindingFacetItem),
+  // Host tool (attributes.tool_name). Present only on the instance-level
+  // reads, which can filter by it; the grouped read omits the dimension
+  // because a group spans tools.
+  tool: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
 var DEFAULT_GROUPED_FINDINGS_LIMIT = 50;
 var ListGroupedFindingsQuery = external_exports.object({
@@ -15431,6 +15461,16 @@ var ListGroupedFindingsQuery = external_exports.object({
   // Scope to findings whose event carries this session id (the Activity page's
   // session → findings drilldown). Findings without a session never match.
   sessionId: external_exports.string().optional(),
+  // Inclusive lower bound on the parent event's timestamp, so a caller arriving
+  // from a time-scoped page (Activity's range) can carry that scope. Absent
+  // means all time — this list has no default window.
+  from: external_exports.iso.datetime().optional(),
+  // A group or instance id that must appear in the page even when the cursor
+  // has already advanced past its sort position. This is what keeps the
+  // Findings page's one-shot ?finding= deep link resolving once the list
+  // paginates: the target group is appended out of sort order rather than
+  // scanning forward for it. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -15475,15 +15515,110 @@ var FindingInstanceDetail = FindingInstance.extend({
   detection: FindingDetectionRef,
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
+var DEFAULT_FLAT_FINDINGS_LIMIT = 50;
+var ListFindingInstancesQuery = external_exports.object({
+  severity: external_exports.array(Severity).optional(),
+  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  subtype: external_exports.array(external_exports.string()).optional(),
+  provider: external_exports.array(FindingProvider).optional(),
+  action: external_exports.array(FindingAction).optional(),
+  // Matches each instance's OWN derived status (deriveFindingStatus), unlike
+  // the grouped query's group-level fold.
+  status: external_exports.array(FindingStatus).optional(),
+  // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
+  // where the free-text `q` can only match the rendered "via Bash" label.
+  tool: external_exports.array(external_exports.string()).optional(),
+  // Exact repository / file-path matches, for the drill-down out of the
+  // locations view. A row whose event carries no repo/file matches neither.
+  repo: external_exports.string().optional(),
+  file: external_exports.string().optional(),
+  q: external_exports.string().optional(),
+  sessionId: external_exports.string().optional(),
+  from: external_exports.iso.datetime().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListFindingInstancesResponse = external_exports.object({
+  // Instances matching the filters across the whole scope, not just this
+  // page — cursor-independent, like the grouped list's totals.
+  totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
+  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // dimension still excludes its own filter.
+  facets: FindingFacets,
+  items: external_exports.array(FindingInstanceDetail),
+  nextCursor: external_exports.string().nullable()
+}).meta({ id: "ListFindingInstancesResponse" });
+var FindingLocationFile = external_exports.object({
+  // Empty when the instances carried no file path (a prompt or a tool call
+  // with no file attribution).
+  file: external_exports.string(),
+  instanceCount: external_exports.number().int().nonnegative(),
+  maxSeverity: Severity,
+  latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same
+  // open-dominates precedence a group uses.
+  status: FindingStatus.optional(),
+  // Distinct rules seen at this location, capped — the row shows them as
+  // chips, and the count is what conveys scale.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationFile" });
+var FindingLocationRepo = external_exports.object({
+  /** Empty when the instances carried no repo attribute. */
+  repo: external_exports.string(),
+  instanceCount: external_exports.number().int().nonnegative(),
+  maxSeverity: Severity,
+  latestDetectedAt: external_exports.iso.datetime(),
+  status: FindingStatus.optional(),
+  files: external_exports.array(FindingLocationFile)
+}).meta({ id: "FindingLocationRepo" });
+var ListFindingLocationsQuery = external_exports.object({
+  severity: external_exports.array(Severity).optional(),
+  subtype: external_exports.array(external_exports.string()).optional(),
+  provider: external_exports.array(FindingProvider).optional(),
+  action: external_exports.array(FindingAction).optional(),
+  // Per-instance, as in ListFindingInstancesQuery: a location keeps the
+  // instances that match, and folds its status from those.
+  status: external_exports.array(FindingStatus).optional(),
+  tool: external_exports.array(external_exports.string()).optional(),
+  q: external_exports.string().optional(),
+  sessionId: external_exports.string().optional(),
+  from: external_exports.iso.datetime().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+});
+var ListFindingLocationsResponse = external_exports.object({
+  totals: external_exports.object({
+    findings: external_exports.number().int().nonnegative(),
+    repos: external_exports.number().int().nonnegative(),
+    files: external_exports.number().int().nonnegative()
+  }),
+  /** Sorted by max severity, then most recent. */
+  items: external_exports.array(FindingLocationRepo),
+  /** Whether `limit` truncated the repo list. */
+  hasMore: external_exports.boolean()
+}).meta({ id: "ListFindingLocationsResponse" });
 
 // ../../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum(["claudecode", "cursor", "copilot", "codex", "windsurf", "claudedesktop", "chatgpt", "api"]).meta({ id: "Harness" });
+var Harness = external_exports.enum([
+  "claudecode",
+  "cursor",
+  "copilot",
+  "codex",
+  "antigravity",
+  "windsurf",
+  "claudedesktop",
+  "chatgpt",
+  "claudeai",
+  "api"
+]).meta({ id: "Harness" });
 var TOOL_TO_HARNESS = {
   "claude-code": "claudecode",
   "claude-desktop": "claudedesktop",
   "github-copilot": "copilot",
   cursor: "cursor",
-  chatgpt: "chatgpt"
+  chatgpt: "chatgpt",
+  codex: "codex",
+  antigravity: "antigravity",
+  "claude-ai": "claudeai"
 };
 
 // ../../packages/schema/src/zod/meta.ts
@@ -15941,7 +16076,18 @@ var ActivityOverviewResponse = external_exports.object({
 // ../../packages/schema/src/zod/event.ts
 var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
+var SourceTool = external_exports.enum([
+  "claude-code",
+  "claude-desktop",
+  "cursor",
+  "chatgpt",
+  "claude-ai",
+  "github-copilot",
+  "codex",
+  "antigravity",
+  "cli",
+  "unknown"
+]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
@@ -16012,7 +16158,7 @@ var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).me
 var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
 var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
 var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex"]).meta({ id: "HarnessId" });
+var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
 var AccessCounts = external_exports.object({
   open: external_exports.number().int().nonnegative(),
   approved: external_exports.number().int().nonnegative(),
@@ -16281,6 +16427,7 @@ var ExceptionBundleEntry = DetectionException.pick({
   useCount: true,
   conditions: true
 });
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
 
 // ../../packages/schema/src/zod/rule.ts
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
@@ -17091,6 +17238,35 @@ var EgressWriteSummary = external_exports.object({
   droppedFiles: external_exports.array(external_exports.string()).default([])
 }).meta({ id: "EgressWriteSummary" });
 
+// ../../packages/schema/src/zod/exception-action.ts
+var confirmation = external_exports.string().optional();
+var ApproveBlockedInput = external_exports.object({
+  reference: external_exports.string(),
+  scope: external_exports.string(),
+  reason: external_exports.string(),
+  confirmation
+});
+var AddExceptionInput = external_exports.object({
+  ruleId: external_exports.string(),
+  value: external_exports.string(),
+  scope: external_exports.string(),
+  reason: external_exports.string(),
+  confirmation
+});
+var GrantRevealInput = external_exports.object({
+  pointer: external_exports.string(),
+  scope: external_exports.string(),
+  justification: external_exports.string(),
+  confirmation
+});
+var RevokeExceptionInput = external_exports.object({
+  id: external_exports.string(),
+  reason: external_exports.string()
+});
+var RotateKeyInput = external_exports.object({
+  confirmation: external_exports.string()
+});
+
 // ../../packages/schema/src/zod/findings-group-build.ts
 function toApiAction(dbVal) {
   const map2 = {
@@ -17146,6 +17322,8 @@ function buildFindingGroups(rows, opts = {}) {
         repo: r.repo,
         file: r.file,
         ...r.toolName === void 0 ? {} : { toolName: r.toolName },
+        ...r.eventId === void 0 ? {} : { eventId: r.eventId },
+        ...r.sessionId === void 0 ? {} : { sessionId: r.sessionId },
         action: toApiAction(effectiveDbAction),
         detectedAt: r.occurredAt,
         confidence: r.confidence,
@@ -17277,14 +17455,17 @@ function applyFindingFilters(groups, opts) {
 }
 var SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
 var SEVERITY_RANK = SEVERITY_ORDER;
+function compareFindingGroupOrder(a, b) {
+  const rankA = SEVERITY_RANK[a.severity] ?? -1;
+  const rankB = SEVERITY_RANK[b.severity] ?? -1;
+  const severityDiff = rankA - rankB;
+  if (severityDiff !== 0) return severityDiff;
+  const recencyDiff = b.latestDetectedAt.localeCompare(a.latestDetectedAt);
+  if (recencyDiff !== 0) return recencyDiff;
+  return a.id.localeCompare(b.id);
+}
 function sortFindingGroups(groups) {
-  return [...groups].sort((a, b) => {
-    const rankA = SEVERITY_RANK[a.severity] ?? -1;
-    const rankB = SEVERITY_RANK[b.severity] ?? -1;
-    const severityDiff = rankA - rankB;
-    if (severityDiff !== 0) return severityDiff;
-    return b.latestDetectedAt.localeCompare(a.latestDetectedAt);
-  });
+  return [...groups].sort(compareFindingGroupOrder);
 }
 function computeFindingFacets(allGroups, opts) {
   const forSeverity = applyFindingFilters(allGroups, {
@@ -17340,15 +17521,158 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forStatus) {
     if (g.status !== void 0) statusMap.set(g.status, (statusMap.get(g.status) ?? 0) + 1);
   }
-  const toItems = (m) => [...m.entries()].map(([value, count]) => ({ value, count }));
+  const toItems2 = (m) => [...m.entries()].map(([value, count]) => ({ value, count }));
+  return {
+    severity: toItems2(severityMap),
+    provider: toItems2(providerMap),
+    action: toItems2(actionMap),
+    subtype: toItems2(subtypeMap),
+    status: toItems2(statusMap)
+  };
+}
+
+// ../../packages/schema/src/zod/findings-flat-build.ts
+function rowHaystack(row) {
+  return [
+    row.ruleId,
+    row.category,
+    row.maskedMatch,
+    row.repo,
+    row.file,
+    row.toolName ? `via ${row.toolName}` : "",
+    row.id
+  ].join(" ").toLowerCase();
+}
+function matchesDimension(row, opts, dimension) {
+  switch (dimension) {
+    case "severity":
+      return !opts.severity?.length || opts.severity.includes(row.severity);
+    case "subtype":
+      return !opts.subtype?.length || opts.subtype.includes(row.ruleId);
+    case "providers":
+      return !opts.providers?.length || opts.providers.includes(toApiProvider(row.sourceTool));
+    case "actions":
+      return !opts.actions?.length || opts.actions.includes(toApiAction(row.actionTaken));
+    case "statuses":
+      return !opts.statuses?.length || row.status !== void 0 && opts.statuses.includes(row.status);
+    case "tools":
+      return !opts.tools?.length || row.toolName !== void 0 && opts.tools.includes(row.toolName);
+    case "repo":
+      return opts.repo === void 0 || opts.repo === "" || row.repo === opts.repo;
+    case "file":
+      return opts.file === void 0 || opts.file === "" || row.file === opts.file;
+    case "q":
+      return !opts.q || rowHaystack(row).includes(opts.q.toLowerCase());
+  }
+}
+var DIMENSIONS = [
+  "severity",
+  "subtype",
+  "providers",
+  "actions",
+  "statuses",
+  "tools",
+  "repo",
+  "file",
+  "q"
+];
+function matchesInstanceFilters(row, opts, except) {
+  for (const dimension of DIMENSIONS) {
+    if (dimension === except) continue;
+    if (!matchesDimension(row, opts, dimension)) return false;
+  }
+  return true;
+}
+function toItems(counts) {
+  return [...counts.entries()].map(([value, count]) => ({ value, count })).sort((a, b) => b.count - a.count || a.value.localeCompare(b.value));
+}
+function bump(counts, value) {
+  counts.set(value, (counts.get(value) ?? 0) + 1);
+}
+function createInstanceFacetAccumulator(opts) {
+  const severity = /* @__PURE__ */ new Map();
+  const subtype = /* @__PURE__ */ new Map();
+  const provider = /* @__PURE__ */ new Map();
+  const action = /* @__PURE__ */ new Map();
+  const status = /* @__PURE__ */ new Map();
+  const tool = /* @__PURE__ */ new Map();
   return {
-    severity: toItems(severityMap),
-    provider: toItems(providerMap),
-    action: toItems(actionMap),
-    subtype: toItems(subtypeMap),
-    status: toItems(statusMap)
+    add(row) {
+      if (matchesInstanceFilters(row, opts, "severity")) bump(severity, row.severity);
+      if (matchesInstanceFilters(row, opts, "subtype")) bump(subtype, row.ruleId);
+      if (matchesInstanceFilters(row, opts, "providers")) {
+        bump(provider, toApiProvider(row.sourceTool));
+      }
+      if (matchesInstanceFilters(row, opts, "actions")) bump(action, toApiAction(row.actionTaken));
+      if (row.status !== void 0 && matchesInstanceFilters(row, opts, "statuses")) {
+        bump(status, row.status);
+      }
+      if (row.toolName !== void 0 && matchesInstanceFilters(row, opts, "tools")) {
+        bump(tool, row.toolName);
+      }
+    },
+    facets: () => ({
+      severity: toItems(severity),
+      subtype: toItems(subtype),
+      provider: toItems(provider),
+      action: toItems(action),
+      status: toItems(status),
+      tool: toItems(tool)
+    })
+  };
+}
+function toInstanceDetail(row) {
+  const category = toApiCategory(row.category);
+  return {
+    id: row.id,
+    provider: toApiProvider(row.sourceTool),
+    repo: row.repo,
+    file: row.file,
+    ...row.toolName === void 0 ? {} : { toolName: row.toolName },
+    eventId: row.eventId,
+    ...row.sessionId === void 0 ? {} : { sessionId: row.sessionId },
+    action: toApiAction(row.actionTaken),
+    detectedAt: row.occurredAt,
+    confidence: row.confidence,
+    ...row.status === void 0 ? {} : { status: row.status },
+    groupId: row.ruleId,
+    category,
+    subtype: row.ruleId,
+    severity: row.severity,
+    match: { maskedValue: row.maskedMatch, contextPrefix: "" },
+    detection: { id: row.ruleId, name: null },
+    policy: { id: `category:${category}`, name: category }
+  };
+}
+var SEVERITY_ORDER2 = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3
+};
+function newLocationAccumulator() {
+  return {
+    instanceCount: 0,
+    // Sorts after every known severity, so the first row always wins the
+    // comparison below rather than an unknown value pinning the location.
+    maxSeverityRank: Number.MAX_SAFE_INTEGER,
+    maxSeverity: "low",
+    latestDetectedAt: "",
+    statuses: [],
+    ruleIds: /* @__PURE__ */ new Set()
   };
 }
+function addToLocation(acc, row) {
+  acc.instanceCount += 1;
+  const rank = SEVERITY_ORDER2[row.severity] ?? Number.MAX_SAFE_INTEGER - 1;
+  if (rank < acc.maxSeverityRank) {
+    acc.maxSeverityRank = rank;
+    acc.maxSeverity = row.severity;
+  }
+  if (row.occurredAt > acc.latestDetectedAt) acc.latestDetectedAt = row.occurredAt;
+  acc.statuses.push(row.status);
+  acc.ruleIds.add(row.ruleId);
+}
 
 // ../../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
@@ -17489,6 +17813,50 @@ var VaultInventoryEntry = external_exports.object({
   revealGrantId: external_exports.string().nullable(),
   sightings: external_exports.array(VaultSighting)
 });
+var DEFAULT_VAULT_INVENTORY_LIMIT = 50;
+var DEFAULT_VAULT_DEREFS_LIMIT = 50;
+var MAX_VAULT_PAGE_LIMIT = 200;
+var ListVaultInventoryQuery = external_exports.object({
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  // Opaque; names the last row of the page just served.
+  cursor: external_exports.string().optional()
+});
+var ListVaultInventoryResponse = external_exports.object({
+  // Vaulted values across the whole store, not just this page — cursor-
+  // independent, so paging never changes what the count claims.
+  totals: external_exports.object({ values: external_exports.number().int().nonnegative() }),
+  items: external_exports.array(VaultInventoryEntry),
+  // `null` once the last page is reached.
+  nextCursor: external_exports.string().nullable()
+});
+var ListVaultReuseQuery = external_exports.object({
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListVaultReuseResponse = external_exports.object({
+  // Reused values across the whole store — the number the section's claim
+  // ("values detected in more than one place") is about.
+  totals: external_exports.object({ reused: external_exports.number().int().nonnegative() }),
+  items: external_exports.array(VaultInventoryEntry),
+  nextCursor: external_exports.string().nullable()
+});
+var ListVaultDerefsQuery = external_exports.object({
+  // Include the batched, high-volume reasons (display, view-render). Omitted
+  // hides them and counts them into `hiddenBatched` instead, so the model
+  // crossings stay visible. A real boolean, not `z.stringbool()`: this arrives
+  // over a Server Action, which preserves the type, never as a URL param.
+  includeBatched: external_exports.boolean().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListVaultDerefsResponse = external_exports.object({
+  items: external_exports.array(VaultDeref),
+  nextCursor: external_exports.string().nullable(),
+  // Display/view-render rows the query hid, over the WHOLE trail rather than
+  // this page — it is the count the "N hidden" line and its toggle speak for.
+  // Always 0 when `includeBatched` was set, since nothing was hidden.
+  hiddenBatched: external_exports.number().int().nonnegative()
+});
 var VaultKeyCustody = external_exports.string();
 var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
 var VAULT_EVENT_NOTE_MAX_POINTERS = 8;
@@ -17866,7 +18234,7 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
   // Percent of that provider's traffic scanned in the window. 0 when unsupported.
@@ -18119,6 +18487,195 @@ function captureId(sessionId, contentHash, filePath = null) {
   );
 }
 
+// ../../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
+import { basename, dirname, join } from "path";
+
+// ../../packages/persistence/src/paths.ts
+import {
+  chmodSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { threadId } from "worker_threads";
+var DATA_DIR_MODE = 448;
+var DATA_FILE_MODE = 384;
+var DB_FILENAME = "aka.db";
+function isSymlink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function chmodBestEffort(path, mode) {
+  if (isSymlink(path)) return;
+  try {
+    chmodSync(path, mode);
+  } catch {
+  }
+}
+function tightenDir(dir) {
+  chmodBestEffort(dir, DATA_DIR_MODE);
+}
+function ensureDataDirSync(dir) {
+  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
+  tightenDir(dir);
+}
+function dbSidecars(file2) {
+  return [`${file2}-wal`, `${file2}-shm`, `${file2}-journal`];
+}
+function tightenFile(file2) {
+  chmodBestEffort(file2, DATA_FILE_MODE);
+}
+function tightenPerms(file2) {
+  for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
+}
+function classifyOccupant(file2) {
+  try {
+    if (lstatSync(file2).isSymbolicLink()) return { kind: "symlink" };
+    return { kind: "gone" };
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "gone" };
+    return { kind: "unknown", cause: err };
+  }
+}
+var KeyUnclaimableError = class extends Error {
+  code = "key-unclaimable";
+  // `cause` is installed only when there IS one. Passing { cause: undefined }
+  // defines the property anyway, so an error carrying nothing would still answer
+  // `'cause' in err` — a present-but-empty field reads as a diagnosis that was
+  // captured and then lost, which is worse than its plain absence.
+  constructor(message, cause) {
+    super(message, cause === void 0 ? void 0 : { cause });
+    this.name = "KeyUnclaimableError";
+  }
+};
+function createOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.${String(threadId)}.new`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  let created;
+  try {
+    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    created = publishByLink(tmp, file2, data);
+  } finally {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+  }
+  if (created) tightenFile(file2);
+  return created;
+}
+var LINK_UNSUPPORTED = /* @__PURE__ */ new Set(["EPERM", "ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EINVAL"]);
+function publishByLink(tmp, file2, data) {
+  try {
+    linkSync(tmp, file2);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "EEXIST") return false;
+    if (!LINK_UNSUPPORTED.has(code ?? "")) throw err;
+  }
+  try {
+    writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    return true;
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw err;
+  }
+}
+
+// ../../packages/persistence/src/internal/snapshot.ts
+function backupPath(file2, tag) {
+  return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
+}
+var STALE_PARTIAL_MS = 5 * 6e4;
+function reapStalePartials(file2) {
+  const dir = dirname(file2);
+  const prefix = `${basename(file2)}.`;
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (!name.startsWith(prefix) || !name.endsWith(".bak.partial")) continue;
+    const partial2 = join(dir, name);
+    try {
+      if (Date.now() - statSync(partial2).mtimeMs > STALE_PARTIAL_MS) {
+        rmSync2(partial2, { force: true });
+      }
+    } catch {
+    }
+  }
+}
+function snapshotStore(db, backup) {
+  const partial2 = `${backup}.partial`;
+  try {
+    rmSync2(partial2, { force: true });
+    db.prepare("VACUUM INTO ?").run(partial2);
+    tightenFile(partial2);
+    renameSync2(partial2, backup);
+  } catch (error51) {
+    try {
+      rmSync2(partial2, { force: true });
+    } catch {
+    }
+    throw error51;
+  }
+}
+function moveStoreAside(file2, backup) {
+  const undo = [];
+  renameSync2(file2, backup);
+  undo.push([backup, file2]);
+  try {
+    for (const sidecar of dbSidecars(file2)) {
+      const moved = `${backup}${sidecar.slice(file2.length)}`;
+      try {
+        renameSync2(sidecar, moved);
+        undo.push([moved, sidecar]);
+      } catch {
+        rmSync2(sidecar, { force: true });
+      }
+    }
+  } catch (error51) {
+    for (const [from, to] of undo.reverse()) {
+      try {
+        renameSync2(from, to);
+      } catch {
+      }
+    }
+    throw error51;
+  }
+  tightenPerms(backup);
+}
+function discardStore(file2, backup) {
+  try {
+    rmSync2(file2, { force: true });
+    for (const sidecar of dbSidecars(file2)) {
+      rmSync2(sidecar, { force: true });
+    }
+  } catch (error51) {
+    if (existsSync(file2)) {
+      try {
+        rmSync2(backup, { force: true });
+      } catch {
+      }
+    }
+    throw error51;
+  }
+}
+
 // ../../packages/persistence/src/internal/sql-text.ts
 function escapeLikePattern(s) {
   return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
@@ -18260,55 +18817,6 @@ function mapRowsTolerant(rows, map2) {
   return out;
 }
 
-// ../../packages/persistence/src/paths.ts
-import { chmodSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
-var DATA_DIR_MODE = 448;
-var DATA_FILE_MODE = 384;
-var DB_FILENAME = "aka.db";
-function chmodBestEffort(path, mode) {
-  try {
-    chmodSync(path, mode);
-  } catch {
-  }
-}
-function tightenDir(dir) {
-  chmodBestEffort(dir, DATA_DIR_MODE);
-}
-function ensureDataDirSync(dir) {
-  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
-  tightenDir(dir);
-}
-function dbSidecars(file2) {
-  return [`${file2}-wal`, `${file2}-shm`, `${file2}-journal`];
-}
-function tightenFile(file2) {
-  try {
-    if (lstatSync(file2).isSymbolicLink()) return;
-  } catch {
-  }
-  chmodBestEffort(file2, DATA_FILE_MODE);
-}
-function tightenPerms(file2) {
-  for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
-}
-function writeOwnerOnlyFileSync(file2, data) {
-  const tmp = `${file2}.${String(process.pid)}.tmp`;
-  try {
-    rmSync(tmp, { force: true });
-  } catch {
-  }
-  try {
-    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
-    renameSync(tmp, file2);
-  } finally {
-    try {
-      rmSync(tmp, { force: true });
-    } catch {
-    }
-  }
-  tightenFile(file2);
-}
-
 // ../../packages/persistence/src/migrations.ts
 function describeObject(object2) {
   return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
@@ -18424,9 +18932,9 @@ function applyLegacyDropMigration(db, file2) {
   }
 }
 function backupBeforeLegacyDrop(db, file2) {
-  const backup = `${file2}.pre-drop.${String(Date.now())}.bak`;
-  db.prepare("VACUUM INTO ?").run(backup);
-  tightenFile(backup);
+  reapStalePartials(file2);
+  const backup = backupPath(file2, "pre-drop");
+  snapshotStore(db, backup);
   return backup;
 }
 var TOKEN_USAGE_COLUMNS = [
@@ -18770,6 +19278,25 @@ function parseJsonObject(s) {
   return void 0;
 }
 
+// ../../packages/persistence/src/internal/keyset-cursor.ts
+function encodeKeysetCursor(payload) {
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeKeysetCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
+  // resumes from is epoch millis, and a payload carrying ±Infinity or a
+  // fraction binds cleanly rather than failing — returning an EMPTY page with
+  // a null cursor, which a caller reads as "end of list". That is the one
+  // outcome a cursor that does not decode must never produce, since the
+  // documented behaviour above is to restart from the top. (`1e999` is valid
+  // JSON and parses to Infinity; a bare `NaN` is not, so it cannot arrive.)
+  Number.isInteger(parsed.startedAtMs) && typeof parsed.id === "string") {
+    return parsed;
+  }
+  return null;
+}
+
 // ../../packages/persistence/src/repositories/activity.ts
 var DAY_MS = 864e5;
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
@@ -18815,16 +19342,6 @@ function utcWindow(nowMs) {
   const startMs = Math.floor(nowMs / DAY_MS) * DAY_MS;
   return { startMs, endMs: startMs + DAY_MS };
 }
-function encodeCursor(payload) {
-  return Buffer.from(JSON.stringify(payload)).toString("base64url");
-}
-function decodeCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
-    return parsed;
-  }
-  return null;
-}
 var DB_EVENT_TYPE_TO_KIND = {
   session: "session",
   prompt: "prompt",
@@ -18969,7 +19486,7 @@ var SqliteActivityRepository = class {
     return Promise.resolve({ sessionsToday, liveNow, toolCallsToday, findingsToday, egressToday });
   }
   listSessions(query) {
-    const cursor = query.cursor ? decodeCursor(query.cursor) : null;
+    const cursor = query.cursor ? decodeKeysetCursor(query.cursor) : null;
     const toMs = query.to ? isoToEpochMillis(query.to) : this.now();
     const fromMs = query.from ? isoToEpochMillis(query.from) : void 0;
     const conditions = [SESSION_ROOT];
@@ -19043,7 +19560,7 @@ var SqliteActivityRepository = class {
       )
     );
     const last = page[page.length - 1];
-    const nextCursor = hasMore && last ? encodeCursor({ startedAtMs: last.started_at, id: last.id }) : null;
+    const nextCursor = hasMore && last ? encodeKeysetCursor({ startedAtMs: last.started_at, id: last.id }) : null;
     return Promise.resolve({ items, nextCursor, emptyCount });
   }
   getSession(sessionId) {
@@ -19916,7 +20433,7 @@ var SqliteEventsRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/exceptions.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // ../../packages/persistence/src/internal/sqlite-errors.ts
 var SQLITE_CONSTRAINT_UNIQUE = 2067;
@@ -19952,8 +20469,9 @@ var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
      AND conditions IS NULL
      AND ${ACTIVE_PREDICATE}`;
 var SqliteExceptionsRepository = class {
-  constructor(db) {
+  constructor(db, now = () => Date.now()) {
     this.db = db;
+    this.now = now;
     this.consumeStmt = db.prepare(
       `UPDATE exceptions
           SET use_count = use_count + 1, last_used_at = :now, updated_at = :now
@@ -19971,6 +20489,7 @@ var SqliteExceptionsRepository = class {
     );
   }
   db;
+  now;
   consumeStmt;
   insertBlockedStmt;
   sweepBlockedStmt;
@@ -19997,8 +20516,8 @@ var SqliteExceptionsRepository = class {
         "provider conditions are not supported yet \u2014 a grant with one would never apply"
       );
     }
-    const id = randomUUID();
-    const now = Date.now();
+    const id = randomUUID2();
+    const now = this.now();
     try {
       this.insertExceptionRow(id, input, now);
     } catch (err) {
@@ -20076,7 +20595,7 @@ var SqliteExceptionsRepository = class {
     const where = opts?.includeTerminal ? "" : `WHERE ${ACTIVE_PREDICATE}`;
     const rows = allRows(
       this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`),
-      opts?.includeTerminal ? {} : { now: Date.now() }
+      opts?.includeTerminal ? {} : { now: this.now() }
     );
     const exceptions = mapRowsTolerant(rows, parseExceptionRow);
     return Promise.resolve(exceptions);
@@ -20111,7 +20630,7 @@ var SqliteExceptionsRepository = class {
    * already revoked.
    */
   revoke(id, revokedBy, reason) {
-    const now = Date.now();
+    const now = this.now();
     const result = this.db.prepare(
       `UPDATE exceptions
             SET revoked_at = :now, revoked_by = :revokedBy, revoke_reason = :reason, updated_at = :now
@@ -20125,7 +20644,7 @@ var SqliteExceptionsRepository = class {
    * callers must treat identically — means it does not and the detection is
    * enforced as usual. Deliberately NOT wrapped in try/catch.
    */
-  consume(id, now = Date.now()) {
+  consume(id, now = this.now()) {
     const result = this.consumeStmt.run({ id, now });
     return Promise.resolve(Number(result.changes) === 1);
   }
@@ -20134,7 +20653,7 @@ var SqliteExceptionsRepository = class {
    * version — what rides the policy bundle to the hook. Grants written under
    * a different (rotated-away) key never match, so they are excluded at read.
    */
-  activeBundleEntries(keyVersion, now = Date.now()) {
+  activeBundleEntries(keyVersion, now = this.now()) {
     const rows = allRows(
       this.db.prepare(
         `SELECT * FROM exceptions
@@ -20166,7 +20685,7 @@ var SqliteExceptionsRepository = class {
    * than the retention window on every write, so the ledger self-limits.
    */
   recordBlocked(entry) {
-    const now = Date.now();
+    const now = this.now();
     this.sweepBlockedStmt.run({ cutoff: now - BLOCKED_DETECTIONS_RETENTION_MS });
     this.insertBlockedStmt.run({
       reference: entry.reference,
@@ -20189,7 +20708,7 @@ var SqliteExceptionsRepository = class {
           WHERE blocked_at > :cutoff
           ORDER BY blocked_at DESC, rowid DESC`
       ),
-      { cutoff: Date.now() - windowMs }
+      { cutoff: this.now() - windowMs }
     );
     return Promise.resolve(
       rows.map((row) => ({
@@ -20217,8 +20736,9 @@ var SqliteExceptionsRepository = class {
    * evaluate conditions, and a narrowing clause that is ignored would WIDEN the
    * grant instead. Fail closed until reveal-side condition evaluation exists.
    */
-  activeRevealGrant(ruleId, valueFingerprint, keyVersion, now = Date.now()) {
+  activeRevealGrant(ruleId, valueFingerprint, keyVersion, now) {
     try {
+      const at = now ?? this.now();
       const row = getRow(
         this.db.prepare(
           `SELECT id FROM exceptions
@@ -20227,7 +20747,7 @@ var SqliteExceptionsRepository = class {
               AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
             LIMIT 1`
         ),
-        { ruleId, valueFingerprint, keyVersion, now }
+        { ruleId, valueFingerprint, keyVersion, now: at }
       );
       return Promise.resolve(row ?? null);
     } catch (err) {
@@ -20241,7 +20761,7 @@ var SqliteExceptionsRepository = class {
    * predicate, so correctness never depends on this sweep; it only bounds how
    * long the audit evidence is kept locally. Returns the deleted count.
    */
-  sweepTerminal(retentionMs, now = Date.now()) {
+  sweepTerminal(retentionMs, now = this.now()) {
     const result = this.db.prepare(
       `DELETE FROM exceptions
           WHERE updated_at < :cutoff
@@ -20304,6 +20824,23 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 
 // ../../packages/persistence/src/repositories/findings.ts
 var PREVIEW_INSTANCES_PER_GROUP = 200;
+var SCAN_BATCH_ROWS = 1e3;
+var DEFAULT_LOCATIONS_LIMIT = 100;
+var LOCATION_RULE_IDS_CAP = 20;
+function compareLocationOrder(a, b) {
+  return compareFindingGroupOrder(
+    {
+      severity: a.maxSeverity,
+      latestDetectedAt: a.latestDetectedAt,
+      id: ""
+    },
+    {
+      severity: b.maxSeverity,
+      latestDetectedAt: b.latestDetectedAt,
+      id: ""
+    }
+  );
+}
 var CONCAT_SEP = ",";
 var TUPLE_SEP = "|";
 function splitConcat(value) {
@@ -20316,6 +20853,33 @@ function deriveInstanceStatus(row) {
     latestResolutionStatus: row.latest_status
   });
 }
+function encodeGroupCursor(group) {
+  const payload = {
+    sev: group.severity,
+    t: group.latestDetectedAt,
+    id: group.id
+  };
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeGroupCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && typeof parsed.sev === "string" && typeof parsed.t === "string" && typeof parsed.id === "string") {
+    return {
+      severity: parsed.sev,
+      latestDetectedAt: parsed.t,
+      id: parsed.id
+    };
+  }
+  return null;
+}
+function firstAfter(sorted, cursor) {
+  const index = sorted.findIndex((g) => compareFindingGroupOrder(g, cursor) > 0);
+  return index === -1 ? sorted.length : index;
+}
+function findDeepLinked(sorted, page, id) {
+  if (page.some((g) => g.id === id || g.instances.some((i) => i.id === id))) return void 0;
+  return sorted.find((g) => g.id === id || g.instances.some((i) => i.id === id));
+}
 var DAY_MS3 = 864e5;
 var SqliteFindingsRepository = class {
   constructor(db) {
@@ -20425,8 +20989,13 @@ var SqliteFindingsRepository = class {
    */
   listGroupedFindings(query) {
     const sessionPredicate = query.sessionId ? ` AND e.root_session_id = :sessionId` : "";
-    const predicate = `WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})${sessionPredicate}`;
-    const sessionParams = query.sessionId ? { sessionId: query.sessionId } : {};
+    const fromMs = query.from === void 0 ? void 0 : isoToEpochMillis(query.from);
+    const fromPredicate = fromMs === void 0 ? "" : ` AND e.started_at >= :fromMs`;
+    const predicate = `WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})${sessionPredicate}${fromPredicate}`;
+    const sessionParams = {
+      ...query.sessionId ? { sessionId: query.sessionId } : {},
+      ...fromMs === void 0 ? {} : { fromMs }
+    };
     const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "", {
       predicate,
       params: sessionParams
@@ -20434,7 +21003,8 @@ var SqliteFindingsRepository = class {
     const rows = allRows(
       this.db.prepare(
         `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
-                occurred_at, source_tool, repo, file, tool_name, kind, finding_key, latest_status
+                occurred_at, source_tool, repo, file, tool_name, event_id, session_id,
+                kind, finding_key, latest_status
          FROM (
            SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
                   d.severity AS severity, f.masked_match AS masked_match,
@@ -20444,6 +21014,7 @@ var SqliteFindingsRepository = class {
                   json_extract(e.attributes, '$.repo') AS repo,
                   json_extract(e.attributes, '$.file_path') AS file,
                   json_extract(e.attributes, '$.tool_name') AS tool_name,
+                  f.audit_event_id AS event_id, e.root_session_id AS session_id,
                   e.event_type AS kind, f.finding_key AS finding_key,
                   latest.status AS latest_status,
                   ROW_NUMBER() OVER (
@@ -20475,6 +21046,8 @@ var SqliteFindingsRepository = class {
       repo: r.repo ?? "",
       file: r.file ?? "",
       ...r.tool_name === null ? {} : { toolName: r.tool_name },
+      eventId: r.event_id,
+      ...r.session_id === null ? {} : { sessionId: r.session_id },
       status: deriveInstanceStatus(r)
     }));
     const allGroups = buildFindingGroups(groupable, { aggregates });
@@ -20498,18 +21071,23 @@ var SqliteFindingsRepository = class {
       groups: sorted.length
     };
     const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeGroupCursor(query.cursor);
+    const start = cursor === null ? 0 : firstAfter(sorted, cursor);
+    const page = sorted.slice(start, start + limit);
+    const lastOnPage = page.at(-1);
+    const nextCursor = start + limit < sorted.length && lastOnPage ? encodeGroupCursor(lastOnPage) : null;
+    const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinked(sorted, page, query.includeId);
     const statusSet = statusFilter.length > 0 ? new Set(statusFilter) : null;
-    const items = sorted.slice(0, limit).map(
-      (g) => statusSet ? {
-        ...g,
-        instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
-      } : g
-    );
+    const narrow = (g) => statusSet ? {
+      ...g,
+      instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
+    } : g;
+    const items = [...page, ...deepLinked ? [deepLinked] : []].map(narrow);
     return Promise.resolve({
       totals,
       facets,
       items,
-      nextCursor: null,
+      nextCursor,
       ...query.sessionId ? { sessionFirings: this.sessionFirings(query.sessionId) } : {}
     });
   }
@@ -20541,6 +21119,266 @@ var SqliteFindingsRepository = class {
    * request actually carries a `q`. (Substring matching is unaffected by a
    * path repeating across tuples.)
    */
+  /**
+   * The instance-level (flat) findings list: one row per finding, newest first,
+   * paged by keyset.
+   *
+   * SQL owns SCOPE, JS owns every FILTER DIMENSION. The session and the time
+   * bound are SQL predicates: nothing counts them, so narrowing the scan by
+   * them changes no reported number. Severity, subtype, provider, action,
+   * status, tool, repo, file and `q` all stay in JS — each has a facet, and a
+   * facet excludes its own filter, so a row the filter rejects still has to be
+   * counted. Pushing any of them into SQL would silently empty its own facet.
+   * Several could not be expressed there anyway: status comes from the one
+   * shared classifier (deriveFindingStatus), and provider 'api' means "a tool
+   * none of the mappers names", which no IN-list can say.
+   *
+   * The scan runs from the top of the scope on every request, not from the
+   * cursor: `totals` and `facets` describe the whole filtered scope and must not
+   * move as the caller pages. Rows are pulled in batches so memory stays flat
+   * while the counting runs, and only the page itself is retained.
+   */
+  listFindingInstances(query) {
+    const opts = {
+      severity: query.severity,
+      subtype: query.subtype,
+      providers: query.provider,
+      actions: query.action,
+      statuses: query.status,
+      tools: query.tool,
+      repo: query.repo,
+      file: query.file,
+      q: query.q
+    };
+    const limit = query.limit ?? DEFAULT_FLAT_FINDINGS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const accumulator = createInstanceFacetAccumulator(opts);
+    const items = [];
+    let total = 0;
+    let last;
+    let hasMore = false;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from
+    })) {
+      accumulator.add(row);
+      if (!matchesInstanceFilters(row, opts)) continue;
+      total += 1;
+      if (items.length < limit) {
+        items.push(toInstanceDetail(row));
+        last = row;
+      } else {
+        hasMore = true;
+      }
+    }
+    const nextCursor = hasMore && last ? encodeKeysetCursor({ startedAtMs: isoToEpochMillis(last.occurredAt), id: last.id }) : null;
+    if (cursor !== null) {
+      const resumed = this.pageAfter(cursor, opts, limit, query);
+      return Promise.resolve({
+        totals: { findings: total },
+        facets: accumulator.facets(),
+        items: resumed.items,
+        nextCursor: resumed.nextCursor
+      });
+    }
+    return Promise.resolve({
+      totals: { findings: total },
+      facets: accumulator.facets(),
+      items,
+      nextCursor
+    });
+  }
+  /**
+   * The page of matching rows strictly after `cursor`. Separate from the
+   * counting pass because that one starts at the top of the scope by design;
+   * this one narrows the scan with the same keyset predicate the activity list
+   * uses, so a later page costs less than the first rather than more.
+   */
+  pageAfter(cursor, opts, limit, query) {
+    const items = [];
+    let last;
+    let hasMore = false;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from,
+      after: cursor
+    })) {
+      if (!matchesInstanceFilters(row, opts)) continue;
+      if (items.length < limit) {
+        items.push(toInstanceDetail(row));
+        last = row;
+      } else {
+        hasMore = true;
+        break;
+      }
+    }
+    return {
+      items,
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: isoToEpochMillis(last.occurredAt), id: last.id }) : null
+    };
+  }
+  /**
+   * The same findings folded by location: repository, then file within it.
+   *
+   * The grouping keys come from the capturing event's attributes, which is what
+   * the local store relates a finding to — there is no finding↔asset row to
+   * group by instead. A repo or file the event did not record folds into the
+   * empty-string bucket, which the view renders but does not link, since no
+   * filter can name it.
+   */
+  listFindingLocations(query) {
+    const opts = {
+      severity: query.severity,
+      subtype: query.subtype,
+      providers: query.provider,
+      actions: query.action,
+      statuses: query.status,
+      tools: query.tool,
+      q: query.q
+    };
+    const limit = query.limit ?? DEFAULT_LOCATIONS_LIMIT;
+    const byRepo = /* @__PURE__ */ new Map();
+    let total = 0;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from
+    })) {
+      if (!matchesInstanceFilters(row, opts)) continue;
+      total += 1;
+      let files = byRepo.get(row.repo);
+      if (files === void 0) {
+        files = /* @__PURE__ */ new Map();
+        byRepo.set(row.repo, files);
+      }
+      let acc = files.get(row.file);
+      if (acc === void 0) {
+        acc = newLocationAccumulator();
+        files.set(row.file, acc);
+      }
+      addToLocation(acc, row);
+    }
+    let fileCount = 0;
+    const repos = [...byRepo.entries()].map(([repo, files]) => {
+      fileCount += files.size;
+      const fileRows = [...files.entries()].map(([file2, acc]) => ({
+        file: file2,
+        instanceCount: acc.instanceCount,
+        maxSeverity: acc.maxSeverity,
+        latestDetectedAt: acc.latestDetectedAt,
+        ...foldGroupStatus(acc.statuses) === void 0 ? {} : { status: foldGroupStatus(acc.statuses) },
+        ruleIds: [...acc.ruleIds].slice(0, LOCATION_RULE_IDS_CAP)
+      })).sort(compareLocationOrder);
+      const rollup = fileRows.reduce(
+        (a, f) => ({
+          instanceCount: a.instanceCount + f.instanceCount,
+          maxSeverity: compareLocationOrder(f, a) < 0 ? f.maxSeverity : a.maxSeverity,
+          latestDetectedAt: f.latestDetectedAt > a.latestDetectedAt ? f.latestDetectedAt : a.latestDetectedAt
+        }),
+        {
+          instanceCount: 0,
+          maxSeverity: fileRows[0]?.maxSeverity ?? "low",
+          latestDetectedAt: ""
+        }
+      );
+      const statuses = fileRows.map((f) => f.status);
+      const folded = foldGroupStatus(statuses);
+      return {
+        repo,
+        instanceCount: rollup.instanceCount,
+        maxSeverity: rollup.maxSeverity,
+        latestDetectedAt: rollup.latestDetectedAt,
+        ...folded === void 0 ? {} : { status: folded },
+        files: fileRows
+      };
+    });
+    repos.sort(compareLocationOrder);
+    return Promise.resolve({
+      totals: { findings: total, repos: repos.length, files: fileCount },
+      items: repos.slice(0, limit),
+      hasMore: repos.length > limit
+    });
+  }
+  /**
+   * Every finding in scope as a FlatFindingRow, newest first, pulled in batches.
+   *
+   * A generator so a caller streams the scope without it ever being an array:
+   * the flat list counts and facets the whole filtered scope, which on a large
+   * store is far more rows than any page. Each batch advances the same keyset
+   * predicate the page read uses, so the scan is a sequence of bounded reads
+   * rather than one unbounded result set.
+   *
+   * The latest-resolution lookup is the CORRELATED form, not the derived table
+   * the grouped path joins: only `status` is needed, idx_finding_resolution_key
+   * makes it a point lookup per row, and the derived table would re-materialize
+   * a window over the whole resolution table once per batch.
+   *
+   * `scope` carries ONLY what no facet counts. A filter dimension narrowed here
+   * would be missing from its own facet, which is computed by excluding that
+   * dimension — see listFindingInstances.
+   */
+  *scanFindingRows(scope) {
+    const conditions = [`e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`];
+    const params = [];
+    if (scope.sessionId !== void 0 && scope.sessionId !== "") {
+      conditions.push("e.root_session_id = ?");
+      params.push(scope.sessionId);
+    }
+    if (scope.from !== void 0) {
+      conditions.push("e.started_at >= ?");
+      params.push(isoToEpochMillis(scope.from));
+    }
+    const sql = `SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
+              d.severity AS severity, f.masked_match AS masked_match,
+              f.action_taken AS action_taken, f.confidence AS confidence,
+              e.started_at AS occurred_at,
+              json_extract(e.attributes, '$.source_tool') AS source_tool,
+              json_extract(e.attributes, '$.repo') AS repo,
+              json_extract(e.attributes, '$.file_path') AS file,
+              json_extract(e.attributes, '$.tool_name') AS tool_name,
+              f.audit_event_id AS event_id, e.root_session_id AS session_id,
+              e.event_type AS kind, f.finding_key AS finding_key,
+              ${latestResolutionStatusSql("f")} AS latest_status
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+        WHERE ${conditions.join(" AND ")}
+          AND (e.started_at < ? OR (e.started_at = ? AND f.id < ?))
+        ORDER BY e.started_at DESC, f.id DESC
+        LIMIT ?`;
+    let after = scope.after ?? { startedAtMs: Number.MAX_SAFE_INTEGER, id: "\uFFFF" };
+    for (; ; ) {
+      const rows = allRows(this.db.prepare(sql), [
+        ...params,
+        after.startedAtMs,
+        after.startedAtMs,
+        after.id,
+        SCAN_BATCH_ROWS
+      ]);
+      for (const r of rows) {
+        yield {
+          id: r.id,
+          ruleId: r.rule_id,
+          category: r.category,
+          severity: r.severity,
+          maskedMatch: r.masked_match,
+          actionTaken: r.action_taken,
+          confidence: r.confidence,
+          occurredAt: epochMillisToIso(r.occurred_at),
+          sourceTool: r.source_tool,
+          repo: r.repo ?? "",
+          file: r.file ?? "",
+          ...r.tool_name === null ? {} : { toolName: r.tool_name },
+          eventId: r.event_id,
+          ...r.session_id === null ? {} : { sessionId: r.session_id },
+          status: deriveInstanceStatus(r)
+        };
+      }
+      if (rows.length < SCAN_BATCH_ROWS) return;
+      const lastRow = rows[rows.length - 1];
+      if (lastRow === void 0) return;
+      after = { startedAtMs: lastRow.occurred_at, id: lastRow.id };
+    }
+  }
   groupAggregates(withSearchText, scope) {
     const innerSearchColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.attributes, '$.repo')) AS repos,
            group_concat(DISTINCT json_extract(e.attributes, '$.file_path')) AS files,
@@ -20801,7 +21639,7 @@ var SqliteInspectionFindingsRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 
 // ../../packages/persistence/src/semver.ts
 function parse3(version2) {
@@ -20952,7 +21790,7 @@ var SqliteInstalledPacksRepository = class {
           let behind = false;
           for (const row of rows) {
             const params = {
-              id: randomUUID2(),
+              id: randomUUID3(),
               namespace: row.namespace,
               packId: row.packId,
               version: row.version,
@@ -20964,7 +21802,7 @@ var SqliteInstalledPacksRepository = class {
             if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
               this.upsertAvailableStmt.run({
                 ...params,
-                id: randomUUID2(),
+                id: randomUUID3(),
                 recordedBy: meta3?.recordedBy ?? null
               });
             } else {
@@ -21287,14 +22125,15 @@ var SqliteInventoryRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/inventory-assets.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var CATEGORY_ORDER = ["config", "skill", "mcp", "hook"];
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
 var WORKTREE_CHECKOUT_FILTER = "(url IS NULL OR (url NOT LIKE '%/.claude/worktrees/%' AND url NOT LIKE '%\\.claude\\worktrees\\%'))";
 var HARNESS_LABELS = {
   claudecode: "Claude Code",
   cursor: "Cursor",
-  codex: "Codex"
+  codex: "Codex",
+  antigravity: "Antigravity"
 };
 var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
 var EMPTY_PROJECT_AGG = {
@@ -21309,6 +22148,7 @@ function resolveHarnessId(attrs, row) {
   if (t.includes("claudecode") || t === "claude") return "claudecode";
   if (t.includes("cursor")) return "cursor";
   if (t.includes("codex")) return "codex";
+  if (t.includes("antigravity")) return "antigravity";
   return null;
 }
 function isLiveRealClaudeCode(rows) {
@@ -21767,7 +22607,7 @@ var SqliteInventoryAssetsRepository = class {
         `INSERT INTO file_access_override (id, project_id, path, access, created_at, updated_at)
            VALUES (:id, :projectId, :path, :access, :now, :now)
            ON CONFLICT (project_id, path) DO UPDATE SET access = excluded.access, updated_at = excluded.updated_at`
-      ).run({ id: randomUUID3(), projectId, path, access, now: Date.now() });
+      ).run({ id: randomUUID4(), projectId, path, access, now: Date.now() });
     }
     return true;
   }
@@ -21788,7 +22628,7 @@ var SqliteInventoryAssetsRepository = class {
         `INSERT INTO mcp_trust_override (id, asset_id, trust, created_at, updated_at)
            VALUES (:id, :assetId, :trust, :now, :now)
            ON CONFLICT (asset_id) DO UPDATE SET trust = excluded.trust, updated_at = excluded.updated_at`
-      ).run({ id: randomUUID3(), assetId, trust, now: Date.now() });
+      ).run({ id: randomUUID4(), assetId, trust, now: Date.now() });
     }
     this.configRowsCache = void 0;
     return "ok";
@@ -22085,7 +22925,7 @@ var SqliteInventoryAssetsRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/policies.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var SqlitePoliciesRepository = class {
   constructor(db) {
     this.db = db;
@@ -22120,7 +22960,7 @@ var SqlitePoliciesRepository = class {
     failOpenTransaction(this.db, () => {
       for (const [category, action] of Object.entries(DEFAULT_ACTIONS)) {
         stmt.run({
-          id: randomUUID4(),
+          id: randomUUID5(),
           target: JSON.stringify({ category }),
           action,
           now: Date.now()
@@ -22140,7 +22980,7 @@ var SqlitePoliciesRepository = class {
       `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
          VALUES (:id, 'global', :target, :action, 1, :now, :now)
          ON CONFLICT(scope, target) DO UPDATE SET action = excluded.action, enabled = 1, updated_at = excluded.updated_at`
-    ).run({ id: randomUUID4(), target: JSON.stringify({ category }), action, now });
+    ).run({ id: randomUUID5(), target: JSON.stringify({ category }), action, now });
   }
   // Caps every global per-category policy currently set to block/redact down
   // to warn (see warn-era-cap.ts). Rule-targeted policies are untouched.
@@ -22208,7 +23048,7 @@ var SqlitePolicyCatalogRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/project-files.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var SqliteProjectFilesRepository = class {
   constructor(db) {
     this.db = db;
@@ -22240,7 +23080,7 @@ var SqliteProjectFilesRepository = class {
     const stamp = Math.max(now, maxStamp + 1);
     for (const file2 of scan2.files) {
       this.upsertStmt.run({
-        id: randomUUID5(),
+        id: randomUUID6(),
         projectId,
         path: file2.path,
         name: file2.name,
@@ -22254,7 +23094,7 @@ var SqliteProjectFilesRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/resolutions.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 var SqliteResolutionsRepository = class {
   constructor(db, now = () => Date.now()) {
     this.db = db;
@@ -22308,7 +23148,7 @@ var SqliteResolutionsRepository = class {
    */
   insertResolution(r) {
     this.insertStmt.run({
-      id: randomUUID6(),
+      id: randomUUID7(),
       findingKey: r.findingKey,
       status: FindingStatus.parse(r.status),
       method: ResolutionMethod.parse(r.method),
@@ -22367,13 +23207,51 @@ var SqliteRuleProbeCacheRepository = class {
     this.readStmt = db.prepare(
       `SELECT verdict, worst_probe_ms AS worstProbeMs FROM rule_probe_cache WHERE rule_key = :ruleKey`
     );
+    this.countQuarantinedStmt = db.prepare(
+      `SELECT COUNT(*) AS n FROM rule_probe_cache WHERE verdict = 'quarantined'`
+    );
+    this.clearQuarantinedStmt = db.prepare(
+      `DELETE FROM rule_probe_cache WHERE verdict = 'quarantined'`
+    );
   }
   db;
   upsertStmt;
   readStmt;
+  countQuarantinedStmt;
+  clearQuarantinedStmt;
   getVerdict(ruleKey) {
     return getRow(this.readStmt, { ruleKey });
   }
+  /** How many rules are currently excluded by a cached quarantine verdict. */
+  countQuarantined() {
+    return getRow(this.countQuarantinedStmt, {})?.n ?? 0;
+  }
+  /**
+   * Forgets every quarantine verdict, so the rules behind them are measured
+   * again on the next load. This is the undo for a verdict the machine reached
+   * on its own: a rule terminated mid-scan is cached forever and dropped from
+   * every later scan, and a timing verdict is a wall-clock judgement that a
+   * loaded or slow machine can reach about a rule that is in fact fine.
+   *
+   * Only 'quarantined' rows go — a 'safe' verdict is a measurement worth
+   * keeping, and dropping it would make every rule pay the battery again.
+   *
+   * Reports `refused` from the write's own result rather than inferring it from
+   * the row count. The two are NOT the same answer: `failOpenTransaction`
+   * swallows a contended DELETE (another writer holding the lock past
+   * `busy_timeout` — reads are unaffected in WAL), and a swallowed refusal
+   * leaves the count unchanged, which is indistinguishable from "there was
+   * nothing to clear". An undo that reports success while the quarantines are
+   * still in place is worse than one that fails, because the rules it claimed
+   * to restore are silently still disabled.
+   */
+  clearQuarantined() {
+    const before = this.countQuarantined();
+    const committed = failOpenTransaction(this.db, () => {
+      this.clearQuarantinedStmt.run();
+    });
+    return { refused: !committed, cleared: before - this.countQuarantined() };
+  }
   setVerdict(ruleKey, verdict, worstProbeMs2) {
     failOpenTransaction(this.db, () => {
       this.upsertStmt.run({ ruleKey, verdict, worstProbeMs: worstProbeMs2, checkedAt: Date.now() });
@@ -22428,7 +23306,39 @@ var SqliteScanLedgerRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/secret-vault.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
+function pageLimit(requested, fallback) {
+  if (requested === void 0) return fallback;
+  return Math.min(Math.max(1, Math.trunc(requested)), MAX_VAULT_PAGE_LIMIT);
+}
+function encodeReuseCursor(payload) {
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeReuseCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
+  // ±Infinity or a fraction binds cleanly and returns an EMPTY page with a
+  // null cursor, which the caller reads as "end of list" — the one outcome a
+  // malformed cursor must never produce, since restarting from the top is the
+  // documented behaviour and the only recoverable one. (`1e999` is valid JSON
+  // and parses to Infinity; a bare `NaN` is not, so it cannot arrive here.)
+  Number.isInteger(parsed.occurrences) && typeof parsed.pointerId === "string") {
+    return { occurrences: parsed.occurrences, pointerId: parsed.pointerId };
+  }
+  return null;
+}
+var REUSED_PREDICATE = `(v.occurrence_count > 1
+     OR (SELECT count(*) FROM secret_vault_sighting s WHERE s.pointer_id = v.pointer_id) > 1)`;
+var INVENTORY_COLUMNS = `v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
+          v.occurrence_count, v.first_seen, v.last_seen`;
+function toSighting(row) {
+  return {
+    location: row.location,
+    kind: row.kind,
+    firstSeen: new Date(row.first_seen).toISOString(),
+    lastSeen: new Date(row.last_seen).toISOString()
+  };
+}
 var SELECT_COLUMNS = `
   pointer_id AS pointerId,
   value_fingerprint AS valueFingerprint,
@@ -22612,39 +23522,67 @@ var SqliteSecretVaultRepository = class {
          VALUES (:id, :pointerId, :location, :kind, :now, :now)
          ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`
     ).run({
-      id: randomUUID7(),
+      id: randomUUID8(),
       pointerId: entry.pointerId,
       location: entry.location,
       kind: entry.kind,
       now
     });
   }
-  listSightings(pointerId) {
+  /**
+   * Sightings for a whole page of pointers, in ONE query grouped in JS rather
+   * than one query per row. A pointer with no sightings still gets an entry, so
+   * the caller never has to distinguish "none" from "missing".
+   *
+   * The `IN` list is sized to the page, so this statement cannot be cached on
+   * the instance the way the fixed-shape ones in the constructor are.
+   */
+  sightingsFor(pointerIds) {
+    const byPointer = new Map(pointerIds.map((id) => [id, []]));
+    if (pointerIds.length === 0) return byPointer;
     const rows = allRows(
       this.db.prepare(
-        `SELECT location, kind, first_seen, last_seen FROM secret_vault_sighting
-          WHERE pointer_id = :pointerId ORDER BY last_seen DESC`
+        `SELECT pointer_id, location, kind, first_seen, last_seen
+           FROM secret_vault_sighting
+          WHERE pointer_id IN (${placeholders(pointerIds.length)})
+          ORDER BY last_seen DESC`
       ),
-      { pointerId }
+      pointerIds
     );
+    for (const row of rows) byPointer.get(row.pointer_id)?.push(toSighting(row));
+    return byPointer;
+  }
+  /** Hydrate a page of raw inventory rows with their sightings, batched. */
+  toInventoryEntries(rows) {
+    const sightings = this.sightingsFor(rows.map((r) => r.pointer_id));
     return rows.map((r) => ({
-      location: r.location,
-      kind: r.kind,
+      pointerId: r.pointer_id,
+      category: r.category,
+      ...r.provider === null ? {} : { provider: r.provider },
+      maskedMatch: r.masked_match,
+      occurrences: r.occurrence_count,
       firstSeen: new Date(r.first_seen).toISOString(),
-      lastSeen: new Date(r.last_seen).toISOString()
+      lastSeen: new Date(r.last_seen).toISOString(),
+      revealGrantId: r.grant_id,
+      sightings: sightings.get(r.pointer_id) ?? []
     }));
   }
   /**
-   * The dashboard inventory: every vaulted value's descriptor data joined with
-   * its sightings and the active reveal-to-model grant when one exists.
-   * Raw-free by construction — neither the fingerprint nor the ciphertext
-   * columns are selected.
+   * The dashboard inventory, newest-first, ONE PAGE at a time: every vaulted
+   * value's descriptor data joined with its sightings and the active
+   * reveal-to-model grant when one exists. Raw-free by construction — neither
+   * the fingerprint nor the ciphertext columns are selected.
+   *
+   * `totals.values` counts the whole store, not the page, so the count a reader
+   * sees never depends on how far they have paged.
    */
-  listInventory(now = Date.now()) {
+  listInventory(query = {}, now = Date.now()) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_INVENTORY_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const where = cursor === null ? "" : "WHERE (v.last_seen < :cursorLastSeen OR (v.last_seen = :cursorLastSeen AND v.pointer_id < :cursorPointerId))";
     const rows = allRows(
       this.db.prepare(
-        `SELECT v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
-                v.occurrence_count, v.first_seen, v.last_seen,
+        `SELECT ${INVENTORY_COLUMNS},
                 (SELECT e.id FROM exceptions e
                   WHERE e.rule_id = v.rule_id
                     AND e.value_fingerprint = v.value_fingerprint
@@ -22652,45 +23590,109 @@ var SqliteSecretVaultRepository = class {
                     AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
                   LIMIT 1) AS grant_id
            FROM secret_vault v
-          ORDER BY v.last_seen DESC`
+           ${where}
+          ORDER BY v.last_seen DESC, v.pointer_id DESC
+          LIMIT :limit`
       ),
-      { now }
+      bindParams({
+        now,
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorLastSeen: cursor.startedAtMs, cursorPointerId: cursor.id }
+      })
     );
-    return rows.map((r) => ({
-      pointerId: r.pointer_id,
-      category: r.category,
-      ...r.provider === null ? {} : { provider: r.provider },
-      maskedMatch: r.masked_match,
-      occurrences: r.occurrence_count,
-      firstSeen: new Date(r.first_seen).toISOString(),
-      lastSeen: new Date(r.last_seen).toISOString(),
-      revealGrantId: r.grant_id,
-      sightings: this.listSightings(r.pointer_id)
-    }));
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    return {
+      totals: { values: this.countEntries() },
+      items: this.toInventoryEntries(page),
+      // Minted from the last row of the PAGE, never the extra probe row.
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: last.last_seen, id: last.pointer_id }) : null
+    };
+  }
+  /**
+   * Values reused on this machine — detected more than once, or written to more
+   * than one location — most-reused first, one page at a time.
+   *
+   * Its own read rather than a filter over an inventory page: reuse is a
+   * property of the whole store, and deriving it from 50 newest rows would
+   * under-report exactly the values a reader most needs to see.
+   */
+  listReuse(query = {}, now = Date.now()) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_INVENTORY_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeReuseCursor(query.cursor);
+    const after = cursor === null ? "" : `AND (v.occurrence_count < :cursorOccurrences
+              OR (v.occurrence_count = :cursorOccurrences AND v.pointer_id < :cursorPointerId))`;
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT ${INVENTORY_COLUMNS},
+                (SELECT e.id FROM exceptions e
+                  WHERE e.rule_id = v.rule_id
+                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.key_version = v.fingerprint_key_version
+                    AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+                  LIMIT 1) AS grant_id
+           FROM secret_vault v
+          WHERE ${REUSED_PREDICATE} ${after}
+          ORDER BY v.occurrence_count DESC, v.pointer_id DESC
+          LIMIT :limit`
+      ),
+      bindParams({
+        now,
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorOccurrences: cursor.occurrences, cursorPointerId: cursor.pointerId }
+      })
+    );
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    return {
+      totals: { reused: this.countReused() },
+      items: this.toInventoryEntries(page),
+      nextCursor: hasMore && last ? encodeReuseCursor({ occurrences: last.occurrence_count, pointerId: last.pointer_id }) : null
+    };
   }
   /**
-   * The de-reference trail, newest first. By default the batched, high-volume
-   * reasons (display, view-render) are hidden and counted instead — the rows
-   * that matter as a signal are the model crossings, and burying them under
-   * render noise would defeat the audit's purpose.
+   * The de-reference trail, newest first, one page at a time. By default the
+   * batched, high-volume reasons (display, view-render) are hidden and counted
+   * instead — the rows that matter as a signal are the model crossings, and
+   * burying them under render noise would defeat the audit's purpose.
+   *
+   * `hiddenBatched` counts the whole trail rather than the page: it is what the
+   * view's "N hidden" line and its toggle speak for, so it must not shrink as
+   * the reader pages.
    */
-  listDerefs(opts) {
-    const limit = opts?.limit ?? 200;
-    const where = opts?.includeBatched === true ? "" : `WHERE reason NOT IN ('display', 'view-render')`;
+  listDerefs(query = {}) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_DEREFS_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const conditions = [];
+    if (query.includeBatched !== true) {
+      conditions.push(`reason NOT IN ('display', 'view-render')`);
+    }
+    if (cursor !== null) {
+      conditions.push("(at < :cursorAt OR (at = :cursorAt AND id < :cursorId))");
+    }
+    const where = conditions.length === 0 ? "" : `WHERE ${conditions.join(" AND ")}`;
     const rows = allRows(
       this.db.prepare(
         `SELECT id, pointer_id, at, target, reason, outcome, grant_id, pointer_count
            FROM secret_vault_deref ${where}
-          ORDER BY at DESC, rowid DESC LIMIT :limit`
+          ORDER BY at DESC, id DESC LIMIT :limit`
       ),
-      { limit }
+      bindParams({
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorAt: cursor.startedAtMs, cursorId: cursor.id }
+      })
     );
-    const hiddenBatched = opts?.includeBatched === true ? 0 : countScalar(
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    const hiddenBatched = query.includeBatched === true ? 0 : countScalar(
       this.db,
       `SELECT count(*) AS n FROM secret_vault_deref WHERE reason IN ('display', 'view-render')`
     );
     return {
-      rows: rows.map((r) => ({
+      items: page.map((r) => ({
         id: r.id,
         pointerId: r.pointer_id,
         at: new Date(r.at).toISOString(),
@@ -22700,12 +23702,20 @@ var SqliteSecretVaultRepository = class {
         ...r.grant_id === null ? {} : { grantId: r.grant_id },
         pointerCount: r.pointer_count
       })),
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: last.at, id: last.id }) : null,
       hiddenBatched
     };
   }
   countEntries() {
     return countScalar(this.db, "SELECT COUNT(*) AS n FROM secret_vault");
   }
+  /** Values reused on this machine — the reuse list's page-independent total. */
+  countReused() {
+    return countScalar(
+      this.db,
+      `SELECT COUNT(*) AS n FROM secret_vault v WHERE ${REUSED_PREDICATE}`
+    );
+  }
 };
 
 // ../../packages/persistence/src/repositories/security.ts
@@ -22720,7 +23730,9 @@ var ENFORCEMENT_KINDS = ["blocked", "redacted", "warned"];
 var SCAN_COVERAGE = [
   { provider: "claudecode", coverage: 100, supported: true },
   { provider: "cursor", coverage: 0, supported: false },
-  { provider: "codex", coverage: 0, supported: false },
+  { provider: "codex", coverage: 80, supported: true },
+  { provider: "antigravity", coverage: 60, supported: true },
+  { provider: "claudeai", coverage: 0, supported: false },
   { provider: "chatgpt", coverage: 0, supported: false },
   { provider: "copilot", coverage: 0, supported: false },
   { provider: "api", coverage: 0, supported: false }
@@ -23053,7 +24065,7 @@ var SqliteSecurityRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
 var IN_CHUNK = 500;
 var KIND_ORDER = ["provider", "internal", "external", "ip"];
@@ -23309,7 +24321,7 @@ var SqliteSharesRepository = class {
                (id, destination_id, host, decision, created_at, updated_at)
              VALUES (:id, :destinationId, :host, :decision, :now, :now)`
         ).run({
-          id: randomUUID8(),
+          id: randomUUID9(),
           destinationId,
           host: dest.host,
           decision,
@@ -23458,7 +24470,7 @@ var SqliteSharesRepository = class {
       let destinationId = destIds.get(hit.host);
       if (destinationId === void 0) {
         destStmt.run({
-          id: randomUUID8(),
+          id: randomUUID9(),
           kind: hit.kind,
           name: hit.name,
           host: hit.host,
@@ -23474,7 +24486,7 @@ var SqliteSharesRepository = class {
       let endpointId = endpointIds.get(endpointKey);
       if (endpointId === void 0) {
         endpointStmt.run({
-          id: randomUUID8(),
+          id: randomUUID9(),
           destinationId,
           method: hit.method,
           transport: hit.transport,
@@ -23487,7 +24499,7 @@ var SqliteSharesRepository = class {
         endpointIds.set(endpointKey, endpointId);
       }
       siteStmt.run({
-        id: randomUUID8(),
+        id: randomUUID9(),
         endpointId,
         project: input.project,
         projectKey: input.projectKey,
@@ -23852,6 +24864,9 @@ function purgeSampleData(db) {
 }
 
 // ../../packages/persistence/src/database.ts
+var UNSAFE_TEST_ONLY_RAW_HANDLE = /* @__PURE__ */ Symbol(
+  "aka.persistence.unsafeTestOnlyRawHandle"
+);
 function linkHost(input, hostId) {
   return hostId ? { ...input, hostId } : input;
 }
@@ -23873,21 +24888,34 @@ function openWithPragmas(file2) {
   }
   return db;
 }
-function backupLegacyStore(file2) {
-  const backup = `${file2}.legacy.${String(Date.now())}.bak`;
-  renameSync2(file2, backup);
-  tightenFile(backup);
-  for (const sidecar of dbSidecars(file2)) {
-    if (existsSync(sidecar)) rmSync2(sidecar);
+function backupLegacyStore(db, file2) {
+  reapStalePartials(file2);
+  const backup = backupPath(file2, "legacy");
+  let snapshotted = false;
+  let snapshotError;
+  try {
+    snapshotStore(db, backup);
+    snapshotted = true;
+  } catch (error51) {
+    snapshotError = error51;
+  } finally {
+    db.close();
   }
+  if (!snapshotted) {
+    akaWarn(
+      `Could not snapshot the incompatible ${DB_FILENAME} (${String(snapshotError)}); moving the store aside with its sidecars instead.`
+    );
+    moveStoreAside(file2, backup);
+    return backup;
+  }
+  discardStore(file2, backup);
   return backup;
 }
 function openAndInitialize(file2) {
   let db = openWithPragmas(file2);
   try {
     if (isForeignSqliteLineage(db)) {
-      db.close();
-      const backup = backupLegacyStore(file2);
+      const backup = backupLegacyStore(db, file2);
       db = openWithPragmas(file2);
       akaWarn(
         `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
@@ -23931,7 +24959,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join(dir, DB_FILENAME);
+  const file2 = join2(dir, DB_FILENAME);
   const {
     db,
     events,
@@ -24048,7 +25076,7 @@ function openLocalDatabase(dir) {
         const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
         if (!definitionId) continue;
         inspectionFindings.insertFinding({
-          id: randomUUID9(),
+          id: randomUUID10(),
           auditEventId: record2.scanEvent.id,
           inspectionDefinitionId: definitionId,
           span: finding.span,
@@ -24154,7 +25182,9 @@ function openLocalDatabase(dir) {
     transaction,
     close: () => {
       db.close();
-    }
+    },
+    // Last, and a plain value rather than a getter, so `{ ...db }` carries it.
+    [UNSAFE_TEST_ONLY_RAW_HANDLE]: db
   };
 }
 
@@ -24178,6 +25208,20 @@ var UserGrantPolicyProvider = class {
   }
 };
 
+// ../../packages/persistence/src/file-lock.ts
+import { randomUUID as randomUUID11 } from "crypto";
+import {
+  closeSync,
+  existsSync as existsSync2,
+  openSync,
+  readFileSync,
+  rmSync as rmSync3,
+  statSync as statSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { hostname as hostname3 } from "os";
+var PARK = new Int32Array(new SharedArrayBuffer(4));
+
 // ../../packages/persistence/src/finding-key.ts
 import { createHash as createHash3 } from "crypto";
 function normalizeFilePath(filePath) {
@@ -24190,13 +25234,13 @@ function computeFindingKey(input) {
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-var KEY_FILENAME = "exception.key";
+var EXCEPTION_KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
-  return join2(dataDir2, KEY_FILENAME);
+  return join3(dataDir2, EXCEPTION_KEY_FILENAME);
 }
 function parseKeyFile(raw) {
   const parsed = JSON.parse(raw);
@@ -24234,8 +25278,8 @@ var FloorUnreadableError = class extends Error {
   }
 };
 function storedKeyVersionFloor(dataDir2) {
-  const file2 = join2(dataDir2, DB_FILENAME);
-  if (!existsSync2(file2)) return 0;
+  const file2 = join3(dataDir2, DB_FILENAME);
+  if (!existsSync3(file2)) return 0;
   let db;
   try {
     db = new DatabaseSync2(file2, { readOnly: true });
@@ -24260,18 +25304,36 @@ function storedKeyVersionFloor(dataDir2) {
     db?.close();
   }
 }
-function writeKeyFile(dataDir2, key) {
+function serializeKey(key) {
+  return JSON.stringify({ version: key.version, material: key.material.toString("base64") });
+}
+function createKeyFile(dataDir2, key) {
   ensureDataDirSync(dataDir2);
   const file2 = keyFilePath(dataDir2);
-  const body = JSON.stringify({ version: key.version, material: key.material.toString("base64") });
-  writeOwnerOnlyFileSync(file2, `${body}
-`);
-  return key;
+  if (createOwnerOnlyFileSync(file2, `${serializeKey(key)}
+`)) return key;
+  const winner = readFingerprintKey(dataDir2);
+  if (winner) {
+    tightenFile(file2);
+    return winner;
+  }
+  const occupant = classifyOccupant(file2);
+  throw new KeyUnclaimableError(occupantMessage(file2, occupant.kind), occupant.cause);
+}
+function occupantMessage(file2, kind) {
+  switch (kind) {
+    case "symlink":
+      return `exception key file is a symlink (${file2}); remove it so a key can be created`;
+    case "gone":
+      return "exception key file was removed while it was being created";
+    case "unknown":
+      return `exception key file (${file2}) is occupied but cannot be inspected; check the permissions on its directory`;
+  }
 }
 function readFingerprintKey(dataDir2) {
   let raw;
   try {
-    raw = readFileSync(keyFilePath(dataDir2), "utf8");
+    raw = readFileSync2(keyFilePath(dataDir2), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err instanceof Error ? err : new Error(String(err));
@@ -24284,7 +25346,7 @@ function loadOrCreateFingerprintKey(dataDir2) {
     tightenFile(keyFilePath(dataDir2));
     return existing;
   }
-  return writeKeyFile(dataDir2, {
+  return createKeyFile(dataDir2, {
     version: storedKeyVersionFloor(dataDir2) + 1,
     material: randomBytes(KEY_MATERIAL_BYTES)
   });
@@ -24297,21 +25359,21 @@ function fingerprintValue(key, raw) {
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function defaultDataDir() {
-  return join3(homedir(), ".aka");
+  return join4(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join3(base, "settings");
+  return join4(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join3(base, "data");
+  return join4(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join3(dataDir(base), "aka.db");
+  return join4(dataDir(base), "aka.db");
 }
 function keysDir(base = defaultDataDir()) {
-  return join3(base, "keys");
+  return join4(base, "keys");
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -24324,8 +25386,8 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join3(dest, name);
-      renameSync3(join3(base, name), moved);
+      const moved = join4(dest, name);
+      renameSync3(join4(base, name), moved);
       tightenFile(moved);
     } catch {
     }
@@ -24333,10 +25395,11 @@ function migrateLegacyLayout(base = defaultDataDir()) {
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join5 } from "path";
+var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
-  const record2 = readJson(join4(settingsDir(base), "settings.json"));
+  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -24347,7 +25410,7 @@ function readWorkspaceSettings(base = defaultDataDir()) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync2(file2, "utf8");
+    text = readFileSync3(file2, "utf8");
   } catch {
     return null;
   }
@@ -24468,13 +25531,18 @@ import { randomBytes as randomBytes2 } from "crypto";
 import {
   chmodSync as chmodSync2,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   renameSync as renameSync4,
-  rmSync as rmSync3,
-  statSync,
-  writeFileSync as writeFileSync2
+  rmSync as rmSync4,
+  statSync as statSync3,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
+var VAULT_OCCUPANT_REASON = {
+  symlink: "the path is a symlink; remove it so a keyring can be created",
+  gone: "the path was occupied but holds no keyring (removed while it was being created)",
+  unknown: "the path is occupied but cannot be inspected; check the permissions on its directory"
+};
 var VaultKeyEpochMissingError = class extends Error {
   version;
   constructor(version2) {
@@ -24567,28 +25635,28 @@ function claimRotationLock(lock, owner) {
     throw asError(err);
   }
   try {
-    writeFileSync2(join5(lock, LOCK_OWNER_FILE), `${owner}
+    writeFileSync3(join6(lock, LOCK_OWNER_FILE), `${owner}
 `, { mode: DATA_FILE_MODE });
     return true;
   } catch (err) {
-    rmSync3(lock, { recursive: true, force: true });
+    rmSync4(lock, { recursive: true, force: true });
     throw asError(err);
   }
 }
 function acquireRotationLock(keysDir2) {
-  const lock = join5(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const lock = join6(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
   const owner = randomBytes2(16).toString("hex");
   if (claimRotationLock(lock, owner)) return { lock, owner };
   let held;
   try {
-    held = statSync(lock);
+    held = statSync3(lock);
   } catch {
     throw new Error(ROTATION_IN_PROGRESS);
   }
   if (Date.now() - held.mtimeMs < ROTATION_LOCK_STALE_MS) throw new Error(ROTATION_IN_PROGRESS);
   const aside = `${lock}.stale.${owner}`;
   try {
-    const now = statSync(lock);
+    const now = statSync3(lock);
     if (now.ino !== held.ino || now.mtimeMs !== held.mtimeMs) {
       throw new Error(ROTATION_IN_PROGRESS);
     }
@@ -24597,17 +25665,17 @@ function acquireRotationLock(keysDir2) {
     if (err instanceof Error && err.message === ROTATION_IN_PROGRESS) throw err;
     throw new Error(ROTATION_IN_PROGRESS, { cause: err });
   }
-  rmSync3(aside, { recursive: true, force: true });
+  rmSync4(aside, { recursive: true, force: true });
   if (!claimRotationLock(lock, owner)) throw new Error(ROTATION_IN_PROGRESS);
   return { lock, owner };
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync3(join5(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync4(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
-  rmSync3(lease.lock, { recursive: true, force: true });
+  rmSync4(lease.lock, { recursive: true, force: true });
 }
 function withRotationLock(keysDir2, work) {
   ensureDataDirSync(keysDir2);
@@ -24624,7 +25692,7 @@ var FileKeyProvider = class {
     this.#keysDir = keysDir2;
   }
   get filePath() {
-    return join5(this.#keysDir, VAULT_KEY_FILENAME);
+    return join6(this.#keysDir, VAULT_KEY_FILENAME);
   }
   loadOrCreate() {
     return asAsync(() => {
@@ -24654,7 +25722,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync3(this.filePath, "utf8");
+      raw = readFileSync4(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -24662,34 +25730,32 @@ var FileKeyProvider = class {
     return parseKeyring(raw);
   }
   /**
-   * First mint: the keyring is created at its FINAL path with a
-   * creation-exclusive write, so two processes racing a fresh machine cannot
-   * each mint a different epoch 1 — with tmp + rename the loser's replace
-   * would orphan everything the winner had already sealed. On EEXIST the
-   * loser re-reads and adopts the winner's keyring; it minted nothing.
-   * Atomic replace is unnecessary here: nothing can be mid-read of a file
-   * that did not exist, and a torn exclusive write parses as corrupt on the
-   * next read and fails secure rather than being re-minted over.
+   * First mint: the keyring is CREATED, never replaced, so two processes racing
+   * a fresh machine cannot each mint a different epoch 1 — with tmp + rename
+   * the loser's replace would orphan everything the winner had already sealed.
+   * The loser re-reads and adopts the winner's keyring; it minted nothing.
+   *
+   * `createOwnerOnlyFileSync` publishes by link rather than by an exclusive open
+   * at the final path, so the keyring never exists at zero length: a reader —
+   * including the loser, re-reading in order to adopt — sees the file absent or
+   * whole, and never mistakes a live keyring for a corrupt one. A corrupt file
+   * still throws from the parse and is never re-minted over.
    */
   #createExclusive() {
     ensureDataDirSync(this.#keysDir);
     const keyring = mintKeyring();
-    try {
-      writeFileSync2(this.filePath, `${serializeKeyring(keyring)}
-`, {
-        flag: "wx",
-        mode: DATA_FILE_MODE
-      });
-    } catch (err) {
-      if (err.code !== "EEXIST") throw asError(err);
-      const winner = this.#read();
-      if (!winner) {
-        throw new Error("vault: key file vanished during first mint", { cause: err });
-      }
-      return winner;
+    if (createOwnerOnlyFileSync(this.filePath, `${serializeKeyring(keyring)}
+`)) return keyring;
+    const winner = this.#read();
+    if (!winner) {
+      const occupant = classifyOccupant(this.filePath);
+      throw new KeyUnclaimableError(
+        `vault: cannot create a key file at ${this.filePath} \u2014 ${VAULT_OCCUPANT_REASON[occupant.kind]}`,
+        occupant.cause
+      );
     }
     tightenFileMode(this.filePath);
-    return keyring;
+    return winner;
   }
   /**
    * Atomic tmp + rename so a crash mid-write cannot truncate the keyring.
@@ -24700,7 +25766,7 @@ var FileKeyProvider = class {
     ensureDataDirSync(this.#keysDir);
     const file2 = this.filePath;
     const tmp = `${file2}.tmp`;
-    writeFileSync2(tmp, `${serializeKeyring(keyring)}
+    writeFileSync3(tmp, `${serializeKeyring(keyring)}
 `, { mode: DATA_FILE_MODE });
     renameSync4(tmp, file2);
     tightenFileMode(file2);
@@ -24826,7 +25892,7 @@ function createKeyProvider(custody, keysDir2) {
 }
 
 // ../../packages/persistence/src/vault/vault.ts
-import { randomBytes as randomBytes3, randomUUID as randomUUID10 } from "crypto";
+import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 var CONSENT_ABSENT = /* @__PURE__ */ Symbol("aka.vault.consentAbsent");
 var UNAVAILABLE = /* @__PURE__ */ Symbol("aka.vault.unavailable");
 var VAULT_PURGE_POINTER_ID = "*";
@@ -24853,14 +25919,12 @@ function parsePointer(token) {
 var SecretVault = class {
   #repo;
   #keys;
-  #fingerprintKey;
   #isConsented;
   #verifyGrant;
   #now;
   constructor(deps) {
     this.#repo = deps.repo;
     this.#keys = deps.keys;
-    this.#fingerprintKey = deps.fingerprintKey;
     this.#isConsented = deps.isConsented;
     this.#verifyGrant = deps.verifyGrant;
     this.#now = deps.now ?? (() => Date.now());
@@ -24869,10 +25933,23 @@ var SecretVault = class {
    * Store a value and return the pointer that stands for it. The same value
    * always yields the same pointer on this machine — one row, one pointer id,
    * one category — which is what makes dedup and reuse counting work.
+   *
+   * `fingerprintKey` is the exception-key epoch this value's fingerprint is
+   * derived under — a different key from the vault's, with different rotation
+   * semantics. It is a parameter of the WRITE rather than a constructor dep,
+   * and a thunk rather than a value, so that the only way to reach a key is to
+   * store something: a read-only caller never names it, and a caller whose
+   * source mints on absence mints only once consent has actually opened the
+   * write. `refreshFingerprints` takes its key the same way, for the same
+   * reason.
+   *
+   * Resolved once per call, so the fingerprint and the version it is recorded
+   * under can never come from two different epochs.
    */
-  async tokenize(raw, meta3) {
+  async tokenize(raw, meta3, fingerprintKey) {
     if (!this.#isConsented()) return CONSENT_ABSENT;
-    const valueFingerprint = fingerprintValue(this.#fingerprintKey, raw);
+    const fpKey = fingerprintKey();
+    const valueFingerprint = fingerprintValue(fpKey, raw);
     const existing = this.#repo.byValueFingerprint(valueFingerprint);
     const now = this.#now();
     if (existing) {
@@ -24888,7 +25965,7 @@ var SecretVault = class {
       {
         pointerId: base32Encode(pointerId),
         valueFingerprint,
-        fingerprintKeyVersion: this.#fingerprintKey.version,
+        fingerprintKeyVersion: fpKey.version,
         keyVersion: version2,
         // Recorded so the row stays OPENABLE if the wire-format constant ever
         // moves: it is part of this row's AEAD AAD. It is not a tag input —
@@ -25132,7 +26209,7 @@ var SecretVault = class {
   purgeVault() {
     const destroyed = this.#repo.purgeAll();
     this.#repo.recordDeref({
-      id: randomUUID10(),
+      id: randomUUID12(),
       pointerId: VAULT_PURGE_POINTER_ID,
       at: this.#now(),
       target: "human",
@@ -25201,7 +26278,7 @@ var SecretVault = class {
   }
   #audit(pointerId, opts, outcome) {
     this.#repo.recordDeref({
-      id: randomUUID10(),
+      id: randomUUID12(),
       pointerId,
       at: this.#now(),
       target: opts.target,
@@ -25216,15 +26293,15 @@ var SecretVault = class {
 };
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join6(dataDir2, MARKER);
-  if (existsSync3(marker)) return { capped: 0, skipped: "already-run" };
+  const marker = join7(dataDir2, MARKER);
+  if (existsSync4(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
-  writeFileSync3(marker, `${new Date(Date.now()).toISOString()}
+  writeFileSync4(marker, `${new Date(Date.now()).toISOString()}
 `, { mode: DATA_FILE_MODE });
   return { capped };
 }
@@ -25278,11 +26355,11 @@ function resolveProvider() {
 }
 
 // ../../packages/plugin-sdk/src/config.ts
-function loadConfig(base = defaultDataDir()) {
+function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join7(settingsDir(base), "settings.json");
-    if (existsSync4(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join8(settingsDir(base), "settings.json");
+    if (existsSync5(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -25293,21 +26370,21 @@ function loadConfig(base = defaultDataDir()) {
     dbPath: dbPath(base),
     settingsDir: settingsDir(base),
     onboarded: settings.onboardedAt != null,
-    provider: resolveProviderSafe()
+    provider: resolveProviderSafe(resolveProviderFn)
   };
 }
-function resolveProviderSafe() {
+function resolveProviderSafe(resolveProviderFn) {
   try {
-    return resolveProvider();
+    return resolveProviderFn();
   } catch {
     return { provider: "anthropic" };
   }
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync, statSync as statSync5 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join9 } from "path";
+import { basename as basename3, join as join10 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -27964,7 +29041,7 @@ var gcp_service_account_default = {
   severity: "critical",
   matcher: {
     type: "regex",
-    pattern: "\\b[a-z0-9][a-z0-9-]{2,60}@[a-z0-9][a-z0-9-]{2,60}\\.iam\\.gserviceaccount\\.com\\b",
+    pattern: "(?<![a-z0-9-])[a-z0-9-]{3,}@[a-z0-9][a-z0-9-]{2,60}\\.iam\\.gserviceaccount\\.com\\b",
     flags: "g"
   },
   examples: [
@@ -28343,15 +29420,15 @@ function bundledDetections() {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
-import { basename, dirname, isAbsolute, join as join8, sep as sep2 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
 function resolveRepo(cwd) {
   try {
     const root = findGitRoot(cwd);
     if (!root) return void 0;
     const ctx = resolveGitContext(root);
     const url2 = ctx ? remoteUrl(ctx) : void 0;
-    return (url2 ? slugFromUrl(url2) : void 0) ?? basename(ctx?.headRoot ?? root);
+    return (url2 ? slugFromUrl(url2) : void 0) ?? basename2(ctx?.headRoot ?? root);
   } catch {
     return void 0;
   }
@@ -28359,36 +29436,36 @@ function resolveRepo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync5(join8(dir, ".git"))) return dir;
-    const parent = dirname(dir);
+    if (existsSync6(join9(dir, ".git"))) return dir;
+    const parent = dirname2(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join8(root, ".git");
+  const dotGit = join9(root, ".git");
   try {
-    if (statSync2(dotGit).isDirectory()) {
-      return { configPath: join8(dotGit, "config"), headRoot: root };
+    if (statSync4(dotGit).isDirectory()) {
+      return { configPath: join9(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join8(root, target);
-  if (existsSync5(join8(gitdir, "config"))) {
-    return { configPath: join8(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join9(root, target);
+  if (existsSync6(join9(gitdir, "config"))) {
+    return { configPath: join9(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join8(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join9(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join8(gitdir, commonRaw);
-  const headRoot = basename(commonGitDir) === ".git" ? dirname(commonGitDir) : root;
-  return { configPath: join8(commonGitDir, "config"), headRoot };
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join9(gitdir, commonRaw);
+  const headRoot = basename2(commonGitDir) === ".git" ? dirname2(commonGitDir) : root;
+  return { configPath: join9(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync4(path, "utf8");
+    return readFileSync5(path, "utf8");
   } catch {
     return void 0;
   }
@@ -28426,13 +29503,13 @@ function slugFromUrl(url2) {
 }
 
 // ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
 function contentHashOf(text) {
   return createHash4("sha256").update(text).digest("hex");
 }
 function buildIngestEvent(input) {
   return {
-    id: randomUUID11(),
+    id: randomUUID13(),
     sourceTool: input.sourceTool,
     kind: input.kind,
     occurredAt: input.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString(),
@@ -28443,82 +29520,507 @@ function buildIngestEvent(input) {
     // SDK boot in the fail-open hook path). Preserve any id the caller already set.
     metadata: {
       ...input.metadata,
-      correlationId: input.metadata?.correlationId ?? randomUUID11()
+      correlationId: input.metadata?.correlationId ?? randomUUID13()
     }
   };
 }
 
-// ../../packages/plugin-sdk/src/inventory-resolver.ts
-import { arch, hostname as hostname3, platform, release } from "os";
-
-// ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
-
-// ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
-import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
-
-// ../../packages/plugin-sdk/src/project-files.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
-import { basename as basename4, join as join11, relative, sep as sep4 } from "path";
+// ../../packages/plugin-sdk/src/isolated-scan.ts
+import { existsSync as existsSync7 } from "fs";
+import { fileURLToPath } from "url";
+import { Worker } from "worker_threads";
+var ISOLATED_SCAN_BUDGET_MS = 2e3;
+var ISOLATED_PROBE_BUDGET_MS = 1e3;
+var ISOLATED_START_BUDGET_MS = 5e3;
+var ATTRIBUTION_MIN_RULE_MS = 500;
+var ATTRIBUTION_MIN_SHARE = 0.5;
+var resolvedWorkerUrl;
+function resolveWorkerUrl() {
+  if (resolvedWorkerUrl !== void 0) return resolvedWorkerUrl ?? void 0;
+  for (const name of ["scan-worker.js", "scan-worker.ts"]) {
+    const candidate = new URL(name, import.meta.url);
+    try {
+      if (existsSync7(fileURLToPath(candidate))) {
+        resolvedWorkerUrl = candidate;
+        return candidate;
+      }
+    } catch {
+    }
+  }
+  resolvedWorkerUrl = null;
+  return void 0;
+}
+function messageOf(error51) {
+  return error51 instanceof Error ? error51.message : String(error51);
+}
+function createIsolatedScanner(data, opts = {}) {
+  const budgetMs = opts.budgetMs ?? ISOLATED_SCAN_BUDGET_MS;
+  const probeBudgetMs = opts.probeBudgetMs ?? ISOLATED_PROBE_BUDGET_MS;
+  const startBudgetMs = opts.startBudgetMs ?? ISOLATED_START_BUDGET_MS;
+  const minAttributionMs = opts.minAttributionMs ?? ATTRIBUTION_MIN_RULE_MS;
+  let worker;
+  let readyWorker;
+  let broken;
+  let closed = false;
+  let nextJobId = 1;
+  let pending;
+  const terminating = /* @__PURE__ */ new Set();
+  let chain = Promise.resolve();
+  function clearTimers(job) {
+    if (job.startupTimer !== void 0) clearTimeout(job.startupTimer);
+    if (job.timer !== void 0) clearTimeout(job.timer);
+  }
+  function take() {
+    const job = pending;
+    if (!job) return void 0;
+    pending = void 0;
+    clearTimers(job);
+    worker?.unref();
+    return job;
+  }
+  function failPending(outcome) {
+    take()?.fail(outcome);
+  }
+  function kill(dead) {
+    if (worker === dead) worker = void 0;
+    if (readyWorker === dead) readyWorker = void 0;
+    const done = dead.terminate().catch(() => void 0);
+    terminating.add(done);
+    void done.finally(() => terminating.delete(done));
+  }
+  function onDeadline(job) {
+    if (pending !== job) return;
+    const now = performance.now();
+    const runningMs = now - job.progressAt;
+    const elapsedMs = now - job.startedAt;
+    const blamed = job.progressIndex >= 0 && runningMs >= minAttributionMs && runningMs >= elapsedMs * ATTRIBUTION_MIN_SHARE;
+    const culpritIndex = blamed ? job.progressIndex : void 0;
+    kill(job.worker);
+    failPending({ status: "timeout", culpritIndex, elapsedMs });
+  }
+  function ensureWorker() {
+    if (worker) return worker;
+    const url2 = opts.workerUrl ?? resolveWorkerUrl();
+    if (!url2) {
+      return {
+        error: "the scan worker script was not found next to this bundle"
+      };
+    }
+    let started;
+    try {
+      started = new Worker(url2, { workerData: data });
+    } catch (error51) {
+      return { error: `could not start the scan worker: ${messageOf(error51)}` };
+    }
+    opts.onWorkerStart?.(started.threadId);
+    started.on("message", (message) => {
+      if (worker !== started) return;
+      if (message.kind === "ready") {
+        readyWorker = started;
+        if (pending?.worker === started) beginDeadline(pending);
+        return;
+      }
+      if (message.kind === "progress") {
+        if (pending?.worker === started) {
+          pending.progressIndex = message.index;
+          pending.progressAt = performance.now();
+        }
+        return;
+      }
+      if (pending?.id !== message.id) return;
+      if (message.kind === "failed") {
+        failPending({
+          status: "unavailable",
+          reason: `the scan worker failed: ${message.message}`
+        });
+        return;
+      }
+      const job = take();
+      if (job && !job.reply(message)) {
+        job.fail({ status: "unavailable", reason: "the scan worker answered the wrong job" });
+      }
+    });
+    started.on("error", (error51) => {
+      if (worker !== started) return;
+      broken = messageOf(error51);
+      worker = void 0;
+      if (readyWorker === started) readyWorker = void 0;
+      failPending({ status: "unavailable", reason: `the scan worker crashed: ${broken}` });
+    });
+    started.on("exit", () => {
+      if (worker !== started) return;
+      broken ??= "the scan worker exited before answering";
+      worker = void 0;
+      if (readyWorker === started) readyWorker = void 0;
+      failPending({ status: "unavailable", reason: "the scan worker exited before answering" });
+    });
+    started.unref();
+    worker = started;
+    return started;
+  }
+  function beginDeadline(job) {
+    if (job.startupTimer !== void 0) {
+      clearTimeout(job.startupTimer);
+      job.startupTimer = void 0;
+    }
+    if (job.timer !== void 0) return;
+    job.startedAt = performance.now();
+    job.progressAt = job.startedAt;
+    job.timer = setTimeout(() => {
+      onDeadline(job);
+    }, job.budgetMs);
+  }
+  function runOne(spec, fail) {
+    if (closed) {
+      fail({ status: "unavailable", reason: "the scan worker is closed" });
+      return;
+    }
+    if (broken !== void 0) {
+      fail({ status: "unavailable", reason: `the scan worker crashed: ${broken}` });
+      return;
+    }
+    const started = ensureWorker();
+    if (!(started instanceof Worker)) {
+      broken = started.error;
+      fail({ status: "unavailable", reason: started.error });
+      return;
+    }
+    const id = nextJobId++;
+    const now = performance.now();
+    const job = {
+      id,
+      worker: started,
+      budgetMs: spec.budgetMs,
+      startedAt: now,
+      progressIndex: -1,
+      progressAt: now,
+      startupTimer: void 0,
+      timer: void 0,
+      reply: spec.reply,
+      fail
+    };
+    pending = job;
+    started.ref();
+    if (readyWorker === started) {
+      beginDeadline(job);
+    } else {
+      job.startupTimer = setTimeout(() => {
+        if (pending !== job) return;
+        kill(job.worker);
+        failPending({
+          status: "unavailable",
+          reason: `the scan worker did not start within ${String(startBudgetMs)}ms`
+        });
+      }, startBudgetMs);
+    }
+    try {
+      started.postMessage(spec.build(id));
+    } catch (error51) {
+      failPending({
+        // The thread went away between the ref and the post.
+        status: "unavailable",
+        reason: `could not reach the scan worker: ${messageOf(error51)}`
+      });
+    }
+  }
+  function enqueue(spec) {
+    const next = chain.then(
+      () => new Promise((resolve) => {
+        spec(resolve);
+      })
+    );
+    chain = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  }
+  return {
+    scan(text, context, scanOpts) {
+      return enqueue((resolve) => {
+        runOne(
+          {
+            budgetMs,
+            build: (id) => ({
+              kind: "scan",
+              id,
+              text,
+              filePath: context?.filePath,
+              attribute: scanOpts?.attribute === true
+            }),
+            reply: (message) => {
+              if (message.kind !== "result") return false;
+              resolve({ status: "ok", findings: message.findings });
+              return true;
+            }
+          },
+          resolve
+        );
+      });
+    },
+    probe(rule) {
+      return enqueue((resolve) => {
+        runOne(
+          {
+            budgetMs: probeBudgetMs,
+            build: (id) => ({ kind: "probe", id, rule }),
+            reply: (message) => {
+              if (message.kind !== "probed") return false;
+              resolve({ status: "ok", safe: message.safe, worstMs: message.worstMs });
+              return true;
+            }
+          },
+          resolve
+        );
+      });
+    },
+    async close() {
+      closed = true;
+      const live = worker;
+      worker = void 0;
+      readyWorker = void 0;
+      failPending({ status: "unavailable", reason: "the scan worker is closed" });
+      if (live) kill(live);
+      await Promise.all([...terminating]);
+    }
+  };
+}
 
 // ../../packages/plugin-sdk/src/rule-quarantine.ts
 var PASS_BUDGET_MS = 2e3;
+var UNQUARANTINE_HINT = "clear it with `aka detections unquarantine`";
 function ruleProbeKey(rule) {
   if (rule.matcher.type !== "regex") return void 0;
   return contentHashOf(`${rule.matcher.pattern} ${rule.matcher.flags}`);
 }
-function warnQuarantined(rule, worstMs) {
-  const timing = worstMs === void 0 ? "not verified in time" : `${worstMs.toFixed(1)}ms`;
+function warn(rule, verb, detail, recoverable) {
+  const hint = recoverable ? ` (${UNQUARANTINE_HINT})` : "";
+  process.stderr.write(`[aka] ${verb} rule "${rule.id}": ${detail}${hint}
+`);
+}
+function warnQuarantined(rule, worstMs, cached2) {
+  warn(
+    rule,
+    "quarantined",
+    Number.isFinite(worstMs) ? `regex matcher exceeded the ReDoS timing budget (${worstMs.toFixed(1)}ms); excluded from this scan.` : "the timing battery failed while measuring its regex matcher; excluded from this scan.",
+    cached2
+  );
+}
+function warnUnmeasured(rule) {
+  warn(
+    rule,
+    "skipped",
+    "the timing pre-flight ran out of time before this rule could be measured; excluded for the rest of this run, and measured again next time.",
+    false
+  );
+}
+function warnUnmeasurable(reason, count) {
   process.stderr.write(
-    `[aka] quarantined rule "${rule.id}": regex matcher exceeded the ReDoS timing budget (${timing}); excluded from this scan.
+    `[aka] ${String(count)} pulled/custom-pack rule(s) could not be time-checked: ${reason}. That is a problem with this install, not with the rules \u2014 until it is fixed they are excluded from every scan on this machine. Nothing was quarantined, so reinstalling AKA brings them straight back.
 `
   );
 }
+async function quarantineRule(gateway, rule, worstMs, detail) {
+  const key = ruleProbeKey(rule);
+  let cached2 = false;
+  if (key !== void 0) {
+    try {
+      await gateway.setRuleProbeVerdict(key, "quarantined", worstMs);
+      cached2 = true;
+    } catch {
+    }
+  }
+  warn(rule, "quarantined", detail, cached2);
+}
 async function filterUnsafeRules(rules, gateway, opts) {
   const passBudgetMs = opts?.passBudgetMs ?? PASS_BUDGET_MS;
+  const prober = opts?.prober;
   const passStart = performance.now();
   const safe = [];
-  for (const rule of rules) {
-    const key = ruleProbeKey(rule);
-    if (key === void 0) {
-      safe.push(rule);
-      continue;
+  const unmeasurable = /* @__PURE__ */ new Map();
+  try {
+    for (const rule of rules) {
+      const key = ruleProbeKey(rule);
+      if (key === void 0) {
+        safe.push(rule);
+        continue;
+      }
+      let cached2;
+      try {
+        cached2 = await gateway.getRuleProbeVerdict(key);
+      } catch {
+        cached2 = void 0;
+      }
+      if (cached2) {
+        if (cached2.verdict === "safe") safe.push(rule);
+        else warnQuarantined(rule, cached2.worstProbeMs, true);
+        continue;
+      }
+      if (performance.now() - passStart >= passBudgetMs) {
+        warnUnmeasured(rule);
+        continue;
+      }
+      let isSafe;
+      let worstMs;
+      if (prober) {
+        const outcome = await prober.probe(rule);
+        if (outcome.status === "unavailable") {
+          unmeasurable.set(outcome.reason, (unmeasurable.get(outcome.reason) ?? 0) + 1);
+          continue;
+        }
+        isSafe = outcome.status === "ok" ? outcome.safe : false;
+        worstMs = outcome.status === "ok" ? outcome.worstMs : outcome.elapsedMs;
+      } else {
+        try {
+          ({ safe: isSafe, worstMs } = checkRuleTiming(rule));
+        } catch {
+          isSafe = false;
+          worstMs = Number.POSITIVE_INFINITY;
+        }
+      }
+      let persisted = false;
+      try {
+        await gateway.setRuleProbeVerdict(key, isSafe ? "safe" : "quarantined", worstMs);
+        persisted = true;
+      } catch {
+      }
+      if (isSafe) safe.push(rule);
+      else warnQuarantined(rule, worstMs, persisted);
     }
-    let cached2;
+  } finally {
+    for (const [reason, count] of unmeasurable) warnUnmeasurable(reason, count);
+  }
+  return safe;
+}
+
+// ../../packages/plugin-sdk/src/guarded-scan.ts
+var DEFAULT_DEGRADE_SCOPE = "the rest of this process";
+function warnDegraded(scope, dropped, detail) {
+  process.stderr.write(
+    `[aka] isolated scanning is off for ${scope}: ${detail}. ${String(dropped)} pulled/custom-pack rule(s) are excluded; the built-in packs still run.
+`
+  );
+}
+function createGuardedScanner(partition, gateway, opts) {
+  const degradeScope = opts?.degradeScope ?? DEFAULT_DEGRADE_SCOPE;
+  const verified = partition.verified;
+  let unverified = partition.unverified;
+  let isolated = unverified.length > 0 ? createIsolatedScanner({ verified, unverified }, opts) : void 0;
+  let retired = false;
+  function inProcess(text, context) {
+    return scan(text, verified, context);
+  }
+  async function retire() {
+    const live = isolated;
+    isolated = void 0;
+    unverified = [];
+    if (live) await live.close();
+  }
+  async function degrade() {
+    retired = true;
+    await retire();
+  }
+  async function attempt(active, text, context, attribute) {
     try {
-      cached2 = await gateway.getRuleProbeVerdict(key);
-    } catch {
-      cached2 = void 0;
-    }
-    if (cached2) {
-      if (cached2.verdict === "safe") safe.push(rule);
-      else warnQuarantined(rule, cached2.worstProbeMs);
-      continue;
-    }
-    if (performance.now() - passStart >= passBudgetMs) {
-      warnQuarantined(rule, void 0);
-      continue;
+      return await active.scan(text, context, { attribute });
+    } catch (error51) {
+      return {
+        status: "unavailable",
+        reason: error51 instanceof Error ? error51.message : "the scan worker failed unexpectedly"
+      };
     }
-    let isSafe;
-    let worstMs;
-    try {
-      ({ safe: isSafe, worstMs } = checkRuleTiming(rule));
-    } catch {
-      isSafe = false;
-      worstMs = Number.POSITIVE_INFINITY;
+  }
+  async function guardedScan(text, context) {
+    const active = isolated;
+    if (!active) return inProcess(text, context);
+    let outcome = await attempt(active, text, context, false);
+    if (outcome.status === "ok") return outcome.findings;
+    if (outcome.status === "timeout") outcome = await attempt(active, text, context, true);
+    const dropped = unverified.length;
+    if (outcome.status === "ok") {
+      warnDegraded(
+        degradeScope,
+        dropped,
+        "a scan overran its bound once and no rule could be held responsible"
+      );
+      const findings = outcome.findings;
+      await degrade();
+      return findings;
+    }
+    if (outcome.status === "timeout") {
+      const culprit = outcome.culpritIndex === void 0 ? void 0 : unverified[outcome.culpritIndex];
+      if (culprit) {
+        await quarantineRule(
+          gateway,
+          culprit,
+          outcome.elapsedMs,
+          `it did not finish within the ${outcome.elapsedMs.toFixed(0)}ms isolated-scan bound and was terminated; excluded from every later scan.`
+        );
+      }
+      warnDegraded(
+        degradeScope,
+        dropped,
+        culprit ? `rule "${culprit.id}" had to be terminated mid-scan` : `a scan was terminated at the ${outcome.elapsedMs.toFixed(0)}ms bound and no single rule could be held responsible, so nothing was quarantined and the next process will try these rules again`
+      );
+    } else {
+      warnDegraded(degradeScope, dropped, outcome.reason);
     }
-    await gateway.setRuleProbeVerdict(key, isSafe ? "safe" : "quarantined", worstMs);
-    if (isSafe) safe.push(rule);
-    else warnQuarantined(rule, worstMs);
+    await degrade();
+    return inProcess(text, context);
   }
-  return safe;
+  return {
+    scan: guardedScan,
+    degraded: () => retired,
+    async close() {
+      await retire();
+    }
+  };
 }
 
+// ../../packages/plugin-sdk/src/inventory-resolver.ts
+import { arch, hostname as hostname4, platform, release } from "os";
+
+// ../../packages/plugin-sdk/src/nudge.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11 } from "path";
+
+// ../../packages/plugin-sdk/src/paths.ts
+import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
+import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
+
+// ../../packages/plugin-sdk/src/project-files.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
+import { basename as basename5, join as join12, relative, sep as sep4 } from "path";
+
+// ../../packages/plugin-sdk/src/provider-env-antigravity.ts
+var optionalBaseUrl2 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var optionalFlag = external_exports.preprocess((v) => {
+  if (typeof v !== "string") return false;
+  const normalized = v.trim().toLowerCase();
+  return normalized !== "" && normalized !== "0" && normalized !== "false";
+}, external_exports.boolean()).catch(false);
+var antigravityProviderEnvShape = {
+  GOOGLE_GENAI_USE_VERTEXAI: optionalFlag,
+  GOOGLE_GEMINI_BASE_URL: optionalBaseUrl2
+};
+var AntigravityProviderEnvSchema = external_exports.object(antigravityProviderEnvShape);
+
+// ../../packages/plugin-sdk/src/provider-env-codex.ts
+var optionalBaseUrl3 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var codexProviderEnvShape = {
+  OPENAI_BASE_URL: optionalBaseUrl3
+};
+var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
+
 // ../../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 var ENFORCEMENT_CEILING_ENABLED = false;
 var ACTION_PRIORITY = ["block", "redact", "warn", "log", "allow"];
 function entryIsActive(entry, now) {
@@ -28543,6 +30045,7 @@ function createPluginRuntime(gateway, settings, opts) {
   const dataDir2 = opts?.dataDir;
   let policies = [];
   let rules = [];
+  let scanner;
   let bundleExceptions = [];
   let initialized = false;
   const ruleActionIndex = /* @__PURE__ */ new Map();
@@ -28568,8 +30071,24 @@ function createPluginRuntime(gateway, settings, opts) {
       return key !== void 0 && bundledProbeKeys.has(key);
     });
     const needsGate = incoming.filter((rule) => !ciVerified.includes(rule));
-    const safeBundleRules = [...ciVerified, ...await filterUnsafeRules(needsGate, gateway)];
-    rules = bundle.rulesComplete ? safeBundleRules : [...getLoadedRules(), ...safeBundleRules];
+    let prober;
+    const gated = await filterUnsafeRules(needsGate, gateway, {
+      prober: {
+        probe: (rule) => {
+          prober ??= createIsolatedScanner({ verified: [], unverified: [] }, opts?.scanIsolation);
+          return prober.probe(rule);
+        }
+      }
+    });
+    await prober?.close();
+    const verified = bundle.rulesComplete ? [...ciVerified] : [...getLoadedRules(), ...ciVerified];
+    const unverified = [];
+    for (const rule of gated) {
+      if (rule.matcher.type === "regex") unverified.push(rule);
+      else verified.push(rule);
+    }
+    rules = [...verified, ...unverified];
+    scanner = createGuardedScanner({ verified, unverified }, gateway, opts?.scanIsolation);
     bundleExceptions = bundle.exceptions ?? [];
     initialized = true;
   }
@@ -28709,7 +30228,7 @@ function createPluginRuntime(gateway, settings, opts) {
         const pair = `${finding.ruleId}:${fp}`;
         if (seen.has(pair)) continue;
         seen.add(pair);
-        const reference = randomUUID12().replaceAll("-", "").slice(0, 6);
+        const reference = randomUUID14().replaceAll("-", "").slice(0, 6);
         const maskedValue = maskMatch(finding.rawMatch);
         try {
           await gateway.recordBlockedDetection({
@@ -28733,8 +30252,10 @@ function createPluginRuntime(gateway, settings, opts) {
   async function evaluate(text, context, ctx) {
     try {
       await ensureInitialized();
+      if (!scanner) throw new Error("the runtime initialized without a scanner");
       const shielded = shieldPointers(text);
-      const findings = dropShieldedFindings(scan(shielded.text, rules, context), shielded.spans);
+      const matched = await scanner.scan(shielded.text, context);
+      const findings = dropShieldedFindings(matched, shielded.spans);
       const fpCache = /* @__PURE__ */ new Map();
       const { excepted, exceptionIds } = await applyExceptions(findings, ctx, fpCache);
       const decision = decide(findings, text, excepted);
@@ -28791,7 +30312,7 @@ function createPluginRuntime(gateway, settings, opts) {
           valueFingerprint: findingKeyFingerprintKey ? fingerprintOf(findingKeyFingerprintKey, match, findingKeyFpCache) : maskedMatch
         }) : void 0;
         return {
-          id: randomUUID12(),
+          id: randomUUID14(),
           eventId: event.id,
           ruleId: match.ruleId,
           category: match.category,
@@ -28817,21 +30338,28 @@ function createPluginRuntime(gateway, settings, opts) {
       const sorted = [...rules].sort((a, b) => a.id.localeCompare(b.id));
       return contentHashOf(JSON.stringify(sorted));
     } catch {
-      return `unresolved-${randomUUID12()}`;
+      return `unresolved-${randomUUID14()}`;
     }
   }
+  function scanIsolationDegraded() {
+    return scanner?.degraded() ?? false;
+  }
   async function close() {
+    try {
+      await scanner?.close();
+    } catch {
+    }
     await gateway.close();
   }
-  return { processText, capture, rulesetFingerprint, close };
+  return { processText, capture, rulesetFingerprint, scanIsolationDegraded, close };
 }
 
 // ../../packages/plugin-sdk/src/suppressions.ts
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
 
 // ../../packages/plugin-sdk/src/tokenize.ts
 function redactedPlaceholder(category) {
@@ -29076,7 +30604,6 @@ function createVaultGlue(options) {
     const vault = new SecretVault({
       repo: db.secretVault,
       keys: createKeyProvider(settings.vaultKeyCustody, keysDir(base)),
-      fingerprintKey: loadOrCreateFingerprintKey(dir),
       // Read live so a revocation applies to the very next call, not the next
       // process.
       isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent),
@@ -29097,8 +30624,10 @@ function createVaultGlue(options) {
         return decision.allow;
       }
     });
+    let fingerprintKey;
+    const fingerprintKeyForWrite = () => fingerprintKey ??= loadOrCreateFingerprintKey(dir);
     const vaultWithSightings = {
-      tokenize: (raw, meta3) => vault.tokenize(raw, meta3),
+      tokenize: (raw, meta3) => vault.tokenize(raw, meta3, fingerprintKeyForWrite),
       detokenize: (token, opts) => vault.detokenize(token, opts),
       describePointer: (token) => vault.describePointer(token),
       resolvePointerIdentity: (token) => vault.resolvePointerIdentity(token),
@@ -29133,17 +30662,17 @@ var UNOPENABLE_VAULT = {
 
 // src/protocol/marker.ts
 import { randomBytes as randomBytes4 } from "crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, renameSync as renameSync5, writeFileSync as writeFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync9, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join14 } from "path";
 var MARKER_FILE = "protocol-marker";
 function mintMarker() {
   return randomBytes4(8).toString("hex");
 }
 function sessionProtocolMarker(dataDir2, sessionId) {
   if (!sessionId) return mintMarker();
-  const path = join13(dataDir2, MARKER_FILE);
+  const path = join14(dataDir2, MARKER_FILE);
   try {
-    const stored = JSON.parse(readFileSync8(path, "utf8"));
+    const stored = JSON.parse(readFileSync9(path, "utf8"));
     if (stored.sessionId === sessionId && typeof stored.marker === "string" && /^[0-9a-f]{16}$/.test(stored.marker)) {
       return stored.marker;
     }
@@ -29152,8 +30681,8 @@ function sessionProtocolMarker(dataDir2, sessionId) {
   const marker = mintMarker();
   try {
     mkdirSync5(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    const tmp = join13(dataDir2, `${MARKER_FILE}.tmp`);
-    writeFileSync6(tmp, JSON.stringify({ sessionId, marker }), { mode: DATA_FILE_MODE });
+    const tmp = join14(dataDir2, `${MARKER_FILE}.tmp`);
+    writeFileSync7(tmp, JSON.stringify({ sessionId, marker }), { mode: DATA_FILE_MODE });
     renameSync5(tmp, path);
   } catch {
   }
@@ -29322,6 +30851,7 @@ function exceptionPointer(references) {
 
 // src/hooks/pre-tool-use-decision.ts
 var EXECUTABLE_REDACT_NOTE = "Masking inside an executable command would silently change what runs, so a redact policy blocks it instead.";
+var UNREDACTABLE_NOTE = "The redacted form of this input was unavailable, so the call is blocked rather than sent unmasked.";
 function pointerCategory(token) {
   const match = /^\[\[aka:([a-z_]+):/.exec(token);
   return match?.[1] ?? "secret";
@@ -29333,6 +30863,7 @@ async function decidePreToolUse(toolName, toolInput, scanned, tokenizeField) {
   const blockedReferences = [];
   const redactedReferences = [];
   let escalated = false;
+  let escalatedUnredactable = false;
   let updatedInput = null;
   const realized = { pointers: [], degraded: [] };
   for (const { spec, text, result } of scanned) {
@@ -29343,8 +30874,6 @@ async function decidePreToolUse(toolName, toolInput, scanned, tokenizeField) {
       for (const finding of result.findings) blockedRules.add(finding.ruleId);
       if (result.blockedReferences) blockedReferences.push(...result.blockedReferences);
     } else if (action === "redact") {
-      for (const finding of result.findings) redactedRules.add(finding.ruleId);
-      if (result.blockedReferences) redactedReferences.push(...result.blockedReferences);
       let rewritten = result.text;
       const enforced = result.enforcedFindings ?? [];
       if (tokenizeField && enforced.length > 0) {
@@ -29358,7 +30887,13 @@ async function decidePreToolUse(toolName, toolInput, scanned, tokenizeField) {
         } catch {
         }
       }
-      if (rewritten !== null) {
+      if (rewritten === null) {
+        escalatedUnredactable = true;
+        for (const finding of result.findings) blockedRules.add(finding.ruleId);
+        if (result.blockedReferences) blockedReferences.push(...result.blockedReferences);
+      } else {
+        for (const finding of result.findings) redactedRules.add(finding.ruleId);
+        if (result.blockedReferences) redactedReferences.push(...result.blockedReferences);
         updatedInput = replaceAtPath(updatedInput ?? toolInput, spec.path, rewritten);
       }
     } else if (action === "warn") {
@@ -29375,7 +30910,7 @@ async function decidePreToolUse(toolName, toolInput, scanned, tokenizeField) {
             subject: `${toolName} call`,
             ruleIds: [...blockedRules].join(", "),
             blockedRef: blockedReferences[0],
-            note: escalated ? EXECUTABLE_REDACT_NOTE : void 0
+            note: escalated ? EXECUTABLE_REDACT_NOTE : escalatedUnredactable ? UNREDACTABLE_NOTE : void 0
           })
         }
       },
@@ -29541,11 +31076,11 @@ function baseMetadata(input) {
 }
 
 // src/hooks/store-health.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { join as join15 } from "path";
 
 // ../../packages/plugin-runtime/src/standalone-gateway.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 
 // ../../packages/plugin-runtime/src/recorder.ts
 var PLUGIN_RECORDER_BINARY = "plugin";
@@ -29707,7 +31242,7 @@ var StandaloneDataGateway = class {
     const customKeywords = [...new Set(policies.flatMap((p) => p.customKeywords ?? []))];
     const installed = this.installedScanRules();
     const rulePolicies = installed ? [...installed.ruleActions].map(([ruleId, action]) => ({
-      id: randomUUID13(),
+      id: randomUUID15(),
       scope: "global",
       target: { ruleId },
       action,
@@ -29860,7 +31395,7 @@ function resolveDataGateway(config2, meta3, gatewayFactory = standaloneGatewayFa
 }
 
 // ../../packages/plugin-runtime/src/handle-session-start.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/hooks/store-health.ts
@@ -29877,14 +31412,14 @@ function storeUnavailableMessage(dbPath2) {
 }
 function claimStoreUnavailableWarning(dataDir2, sessionId) {
   if (!sessionId) return true;
-  const path = join14(dataDir2, STORE_WARNING_MARKER);
+  const path = join15(dataDir2, STORE_WARNING_MARKER);
   try {
-    if (readFileSync9(path, "utf8") === sessionId) return false;
+    if (readFileSync10(path, "utf8") === sessionId) return false;
   } catch {
   }
   try {
     mkdirSync6(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    writeFileSync7(path, sessionId, { mode: DATA_FILE_MODE });
+    writeFileSync8(path, sessionId, { mode: DATA_FILE_MODE });
   } catch {
   }
   return true;