@akasecurity/ai-tc-claude-code 0.9.4 → 0.9.5

package/scripts/stop.js

@@ -492,13 +492,12 @@ var require_ignore = __commonJS({
 });
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID9 } from "crypto";
-import { existsSync, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
-import { join, sep } from "path";
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join2, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
 // ../../packages/schema/src/exception-scope.ts
@@ -15093,7 +15092,17 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum(["claudecode", "claudedesktop", "cursor", "copilot", "chatgpt", "api"]).meta({ id: "FindingProvider" });
+var FindingProvider = external_exports.enum([
+  "claudecode",
+  "claudedesktop",
+  "cursor",
+  "copilot",
+  "chatgpt",
+  "claudeai",
+  "codex",
+  "antigravity",
+  "api"
+]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
@@ -15147,7 +15156,16 @@ var FindingInstance = external_exports.object({
   confidence: external_exports.number().min(0).max(1),
   // Lifecycle status (see FindingStatus). Optional so legacy callers/rows
   // that predate the resolution feature stay valid.
-  status: FindingStatus.optional()
+  status: FindingStatus.optional(),
+  // The audit event this finding was captured from. Optional so callers that
+  // do not project it stay valid. An at-rest finding is content-addressed by
+  // finding_key and its row is upserted on re-detection, so this names the
+  // MOST RECENT detection event, not the first.
+  eventId: external_exports.string().optional(),
+  // The session that event belongs to, when it has one — the seam a
+  // per-instance "view session" link needs. Absent for events captured
+  // outside a session.
+  sessionId: external_exports.string().optional()
 }).meta({ id: "FindingInstance" });
 var FindingGroup = external_exports.object({
   id: external_exports.string(),
@@ -15191,7 +15209,11 @@ var FindingFacets = external_exports.object({
   // for every instance, so every group lands in a bucket; a status-less
   // group (possible only for callers whose rows carry no statuses) is
   // counted under no value.
-  status: external_exports.array(FindingFacetItem)
+  status: external_exports.array(FindingFacetItem),
+  // Host tool (attributes.tool_name). Present only on the instance-level
+  // reads, which can filter by it; the grouped read omits the dimension
+  // because a group spans tools.
+  tool: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
 var ListGroupedFindingsQuery = external_exports.object({
   // NOTE: severity filters by Severity (critical/high/medium/low), not by
@@ -15208,6 +15230,16 @@ var ListGroupedFindingsQuery = external_exports.object({
   // Scope to findings whose event carries this session id (the Activity page's
   // session → findings drilldown). Findings without a session never match.
   sessionId: external_exports.string().optional(),
+  // Inclusive lower bound on the parent event's timestamp, so a caller arriving
+  // from a time-scoped page (Activity's range) can carry that scope. Absent
+  // means all time — this list has no default window.
+  from: external_exports.iso.datetime().optional(),
+  // A group or instance id that must appear in the page even when the cursor
+  // has already advanced past its sort position. This is what keeps the
+  // Findings page's one-shot ?finding= deep link resolving once the list
+  // paginates: the target group is appended out of sort order rather than
+  // scanning forward for it. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -15252,9 +15284,100 @@ var FindingInstanceDetail = FindingInstance.extend({
   detection: FindingDetectionRef,
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
+var ListFindingInstancesQuery = external_exports.object({
+  severity: external_exports.array(Severity).optional(),
+  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  subtype: external_exports.array(external_exports.string()).optional(),
+  provider: external_exports.array(FindingProvider).optional(),
+  action: external_exports.array(FindingAction).optional(),
+  // Matches each instance's OWN derived status (deriveFindingStatus), unlike
+  // the grouped query's group-level fold.
+  status: external_exports.array(FindingStatus).optional(),
+  // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
+  // where the free-text `q` can only match the rendered "via Bash" label.
+  tool: external_exports.array(external_exports.string()).optional(),
+  // Exact repository / file-path matches, for the drill-down out of the
+  // locations view. A row whose event carries no repo/file matches neither.
+  repo: external_exports.string().optional(),
+  file: external_exports.string().optional(),
+  q: external_exports.string().optional(),
+  sessionId: external_exports.string().optional(),
+  from: external_exports.iso.datetime().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListFindingInstancesResponse = external_exports.object({
+  // Instances matching the filters across the whole scope, not just this
+  // page — cursor-independent, like the grouped list's totals.
+  totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
+  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // dimension still excludes its own filter.
+  facets: FindingFacets,
+  items: external_exports.array(FindingInstanceDetail),
+  nextCursor: external_exports.string().nullable()
+}).meta({ id: "ListFindingInstancesResponse" });
+var FindingLocationFile = external_exports.object({
+  // Empty when the instances carried no file path (a prompt or a tool call
+  // with no file attribution).
+  file: external_exports.string(),
+  instanceCount: external_exports.number().int().nonnegative(),
+  maxSeverity: Severity,
+  latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same
+  // open-dominates precedence a group uses.
+  status: FindingStatus.optional(),
+  // Distinct rules seen at this location, capped — the row shows them as
+  // chips, and the count is what conveys scale.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationFile" });
+var FindingLocationRepo = external_exports.object({
+  /** Empty when the instances carried no repo attribute. */
+  repo: external_exports.string(),
+  instanceCount: external_exports.number().int().nonnegative(),
+  maxSeverity: Severity,
+  latestDetectedAt: external_exports.iso.datetime(),
+  status: FindingStatus.optional(),
+  files: external_exports.array(FindingLocationFile)
+}).meta({ id: "FindingLocationRepo" });
+var ListFindingLocationsQuery = external_exports.object({
+  severity: external_exports.array(Severity).optional(),
+  subtype: external_exports.array(external_exports.string()).optional(),
+  provider: external_exports.array(FindingProvider).optional(),
+  action: external_exports.array(FindingAction).optional(),
+  // Per-instance, as in ListFindingInstancesQuery: a location keeps the
+  // instances that match, and folds its status from those.
+  status: external_exports.array(FindingStatus).optional(),
+  tool: external_exports.array(external_exports.string()).optional(),
+  q: external_exports.string().optional(),
+  sessionId: external_exports.string().optional(),
+  from: external_exports.iso.datetime().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+});
+var ListFindingLocationsResponse = external_exports.object({
+  totals: external_exports.object({
+    findings: external_exports.number().int().nonnegative(),
+    repos: external_exports.number().int().nonnegative(),
+    files: external_exports.number().int().nonnegative()
+  }),
+  /** Sorted by max severity, then most recent. */
+  items: external_exports.array(FindingLocationRepo),
+  /** Whether `limit` truncated the repo list. */
+  hasMore: external_exports.boolean()
+}).meta({ id: "ListFindingLocationsResponse" });
 
 // ../../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum(["claudecode", "cursor", "copilot", "codex", "windsurf", "claudedesktop", "chatgpt", "api"]).meta({ id: "Harness" });
+var Harness = external_exports.enum([
+  "claudecode",
+  "cursor",
+  "copilot",
+  "codex",
+  "antigravity",
+  "windsurf",
+  "claudedesktop",
+  "chatgpt",
+  "claudeai",
+  "api"
+]).meta({ id: "Harness" });
 
 // ../../packages/schema/src/zod/meta.ts
 var InventoryObjectType = external_exports.enum(["host", "harness", "user", "skill", "hook", "mcp_server", "config_file"]).meta({ id: "InventoryObjectType" });
@@ -15708,7 +15831,18 @@ var ActivityOverviewResponse = external_exports.object({
 // ../../packages/schema/src/zod/event.ts
 var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
+var SourceTool = external_exports.enum([
+  "claude-code",
+  "claude-desktop",
+  "cursor",
+  "chatgpt",
+  "claude-ai",
+  "github-copilot",
+  "codex",
+  "antigravity",
+  "cli",
+  "unknown"
+]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
@@ -15779,7 +15913,7 @@ var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).me
 var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
 var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
 var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex"]).meta({ id: "HarnessId" });
+var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
 var AccessCounts = external_exports.object({
   open: external_exports.number().int().nonnegative(),
   approved: external_exports.number().int().nonnegative(),
@@ -16048,6 +16182,7 @@ var ExceptionBundleEntry = DetectionException.pick({
   useCount: true,
   conditions: true
 });
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
 
 // ../../packages/schema/src/zod/rule.ts
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
@@ -16773,6 +16908,35 @@ var EgressWriteSummary = external_exports.object({
   droppedFiles: external_exports.array(external_exports.string()).default([])
 }).meta({ id: "EgressWriteSummary" });
 
+// ../../packages/schema/src/zod/exception-action.ts
+var confirmation = external_exports.string().optional();
+var ApproveBlockedInput = external_exports.object({
+  reference: external_exports.string(),
+  scope: external_exports.string(),
+  reason: external_exports.string(),
+  confirmation
+});
+var AddExceptionInput = external_exports.object({
+  ruleId: external_exports.string(),
+  value: external_exports.string(),
+  scope: external_exports.string(),
+  reason: external_exports.string(),
+  confirmation
+});
+var GrantRevealInput = external_exports.object({
+  pointer: external_exports.string(),
+  scope: external_exports.string(),
+  justification: external_exports.string(),
+  confirmation
+});
+var RevokeExceptionInput = external_exports.object({
+  id: external_exports.string(),
+  reason: external_exports.string()
+});
+var RotateKeyInput = external_exports.object({
+  confirmation: external_exports.string()
+});
+
 // ../../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
   id: external_exports.guid(),
@@ -16904,6 +17068,48 @@ var VaultInventoryEntry = external_exports.object({
   revealGrantId: external_exports.string().nullable(),
   sightings: external_exports.array(VaultSighting)
 });
+var MAX_VAULT_PAGE_LIMIT = 200;
+var ListVaultInventoryQuery = external_exports.object({
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  // Opaque; names the last row of the page just served.
+  cursor: external_exports.string().optional()
+});
+var ListVaultInventoryResponse = external_exports.object({
+  // Vaulted values across the whole store, not just this page — cursor-
+  // independent, so paging never changes what the count claims.
+  totals: external_exports.object({ values: external_exports.number().int().nonnegative() }),
+  items: external_exports.array(VaultInventoryEntry),
+  // `null` once the last page is reached.
+  nextCursor: external_exports.string().nullable()
+});
+var ListVaultReuseQuery = external_exports.object({
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListVaultReuseResponse = external_exports.object({
+  // Reused values across the whole store — the number the section's claim
+  // ("values detected in more than one place") is about.
+  totals: external_exports.object({ reused: external_exports.number().int().nonnegative() }),
+  items: external_exports.array(VaultInventoryEntry),
+  nextCursor: external_exports.string().nullable()
+});
+var ListVaultDerefsQuery = external_exports.object({
+  // Include the batched, high-volume reasons (display, view-render). Omitted
+  // hides them and counts them into `hiddenBatched` instead, so the model
+  // crossings stay visible. A real boolean, not `z.stringbool()`: this arrives
+  // over a Server Action, which preserves the type, never as a URL param.
+  includeBatched: external_exports.boolean().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListVaultDerefsResponse = external_exports.object({
+  items: external_exports.array(VaultDeref),
+  nextCursor: external_exports.string().nullable(),
+  // Display/view-render rows the query hid, over the WHOLE trail rather than
+  // this page — it is the count the "N hidden" line and its toggle speak for.
+  // Always 0 when `includeBatched` was set, since nothing was hidden.
+  hiddenBatched: external_exports.number().int().nonnegative()
+});
 var VaultKeyCustody = external_exports.string();
 var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
 var VaultConsent = external_exports.object({
@@ -17163,7 +17369,7 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
   // Percent of that provider's traffic scanned in the window. 0 when unsupported.
@@ -17331,11 +17537,33 @@ var SetupHandoffOffer = external_exports.object({
 // ../../packages/persistence/src/ids.ts
 import { createHash } from "crypto";
 
+// ../../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
+import { basename, dirname, join } from "path";
+
 // ../../packages/persistence/src/paths.ts
-import { chmodSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
+import {
+  chmodSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { threadId } from "worker_threads";
 var DATA_DIR_MODE = 448;
 var DATA_FILE_MODE = 384;
+function isSymlink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
 function chmodBestEffort(path, mode) {
+  if (isSymlink(path)) return;
   try {
     chmodSync(path, mode);
   } catch {
@@ -17349,13 +17577,12 @@ function ensureDataDirSync(dir) {
   tightenDir(dir);
 }
 function tightenFile(file2) {
-  try {
-    if (lstatSync(file2).isSymbolicLink()) return;
-  } catch {
-  }
   chmodBestEffort(file2, DATA_FILE_MODE);
 }
 
+// ../../packages/persistence/src/internal/snapshot.ts
+var STALE_PARTIAL_MS = 5 * 6e4;
+
 // ../../packages/persistence/src/internal/json.ts
 function parseJsonObject(s) {
   if (s == null) return void 0;
@@ -17371,7 +17598,7 @@ function parseJsonObject(s) {
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
 
 // ../../packages/persistence/src/repositories/exceptions.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 var BLOCKED_DETECTIONS_TTL_MS = 30 * 60 * 1e3;
 var BLOCKED_DETECTIONS_RETENTION_MS = 24 * 60 * 60 * 1e3;
 var ACTIVE_PREDICATE = `revoked_at IS NULL
@@ -17382,53 +17609,67 @@ var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
      AND ${ACTIVE_PREDICATE}`;
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 
 // ../../packages/persistence/src/repositories/inventory-assets.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
 var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/persistence/src/repositories/policies.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // ../../packages/persistence/src/repositories/project-files.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // ../../packages/persistence/src/repositories/resolutions.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 
 // ../../packages/persistence/src/repositories/secret-vault.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 
 // ../../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
+
+// ../../packages/persistence/src/file-lock.ts
+import { randomUUID as randomUUID11 } from "crypto";
+import {
+  closeSync,
+  existsSync as existsSync2,
+  openSync,
+  readFileSync,
+  rmSync as rmSync3,
+  statSync as statSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { hostname as hostname3 } from "os";
+var PARK = new Int32Array(new SharedArrayBuffer(4));
 
 // ../../packages/persistence/src/finding-key.ts
 import { createHash as createHash3 } from "crypto";
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
 // ../../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function defaultDataDir() {
-  return join3(homedir(), ".aka");
+  return join4(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join3(base, "settings");
+  return join4(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join3(base, "data");
+  return join4(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join3(dataDir(base), "aka.db");
+  return join4(dataDir(base), "aka.db");
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -17441,8 +17682,8 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join3(dest, name);
-      renameSync3(join3(base, name), moved);
+      const moved = join4(dest, name);
+      renameSync3(join4(base, name), moved);
       tightenFile(moved);
     } catch {
     }
@@ -17450,10 +17691,11 @@ function migrateLegacyLayout(base = defaultDataDir()) {
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join5 } from "path";
+var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
-  const record2 = readJson(join4(settingsDir(base), "settings.json"));
+  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -17464,7 +17706,7 @@ function readWorkspaceSettings(base = defaultDataDir()) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync2(file2, "utf8");
+    text = readFileSync3(file2, "utf8");
   } catch {
     return null;
   }
@@ -17486,20 +17728,20 @@ import { randomBytes as randomBytes2 } from "crypto";
 import {
   chmodSync as chmodSync2,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   renameSync as renameSync4,
-  rmSync as rmSync3,
-  statSync,
-  writeFileSync as writeFileSync2
+  rmSync as rmSync4,
+  statSync as statSync3,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
-import { randomBytes as randomBytes3, randomUUID as randomUUID10 } from "crypto";
+import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -17550,11 +17792,11 @@ function resolveProvider() {
 }
 
 // ../../packages/plugin-sdk/src/config.ts
-function loadConfig(base = defaultDataDir()) {
+function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join7(settingsDir(base), "settings.json");
-    if (existsSync4(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join8(settingsDir(base), "settings.json");
+    if (existsSync5(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -17565,21 +17807,21 @@ function loadConfig(base = defaultDataDir()) {
     dbPath: dbPath(base),
     settingsDir: settingsDir(base),
     onboarded: settings.onboardedAt != null,
-    provider: resolveProviderSafe()
+    provider: resolveProviderSafe(resolveProviderFn)
   };
 }
-function resolveProviderSafe() {
+function resolveProviderSafe(resolveProviderFn) {
   try {
-    return resolveProvider();
+    return resolveProviderFn();
   } catch {
     return { provider: "anthropic" };
   }
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync, statSync as statSync5 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join9 } from "path";
+import { basename as basename3, join as join10 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -18290,46 +18532,77 @@ var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].m
 );
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
-import { basename, dirname, isAbsolute, join as join8, sep as sep2 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
+
+// ../../packages/plugin-sdk/src/isolated-scan.ts
+import { existsSync as existsSync7 } from "fs";
+import { fileURLToPath } from "url";
+import { Worker } from "worker_threads";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
-import { arch, hostname as hostname3, platform, release } from "os";
+import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
-import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
+import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
+import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
-import { basename as basename4, join as join11, relative, sep as sep4 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
+import { basename as basename5, join as join12, relative, sep as sep4 } from "path";
+
+// ../../packages/plugin-sdk/src/provider-env-antigravity.ts
+var optionalBaseUrl2 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var optionalFlag = external_exports.preprocess((v) => {
+  if (typeof v !== "string") return false;
+  const normalized = v.trim().toLowerCase();
+  return normalized !== "" && normalized !== "0" && normalized !== "false";
+}, external_exports.boolean()).catch(false);
+var antigravityProviderEnvShape = {
+  GOOGLE_GENAI_USE_VERTEXAI: optionalFlag,
+  GOOGLE_GEMINI_BASE_URL: optionalBaseUrl2
+};
+var AntigravityProviderEnvSchema = external_exports.object(antigravityProviderEnvShape);
+
+// ../../packages/plugin-sdk/src/provider-env-codex.ts
+var optionalBaseUrl3 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var codexProviderEnvShape = {
+  OPENAI_BASE_URL: optionalBaseUrl3
+};
+var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
 
 // ../../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 
 // ../../packages/plugin-sdk/src/suppressions.ts
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
 function throttled(dataDir2, markerName, windowMs) {
-  const marker = join12(dataDir2, markerName);
+  const marker = join13(dataDir2, markerName);
   try {
-    if (Date.now() - statSync4(marker).mtimeMs < windowMs) return true;
+    if (Date.now() - statSync6(marker).mtimeMs < windowMs) return true;
   } catch {
   }
   try {
     mkdirSync4(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    writeFileSync5(marker, String(Date.now()), { mode: DATA_FILE_MODE });
+    writeFileSync6(marker, String(Date.now()), { mode: DATA_FILE_MODE });
   } catch {
   }
   return false;
@@ -18337,21 +18610,21 @@ function throttled(dataDir2, markerName, windowMs) {
 
 // src/history/reconcile-trigger.ts
 import { spawn } from "child_process";
-import { dirname as dirname3, join as join14 } from "path";
-import { fileURLToPath } from "url";
+import { dirname as dirname4, join as join15 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/history/tail.ts
 import { createHash as createHash5 } from "crypto";
 import {
-  closeSync,
+  closeSync as closeSync2,
   fstatSync,
   mkdirSync as mkdirSync5,
-  openSync,
-  readFileSync as readFileSync8,
+  openSync as openSync2,
+  readFileSync as readFileSync9,
   readSync,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
 function safeSessionId(sessionId) {
   if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
@@ -18367,8 +18640,8 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
   try {
     const marker = `${RECONCILE_MARKER_PREFIX}-${safeSessionId(sessionId)}`;
     if (throttled(dataDir2, marker, RECONCILE_THROTTLE_MS)) return;
-    const here = dirname3(fileURLToPath(import.meta.url));
-    const child = spawn(process.execPath, [join14(here, "reconcile.js"), sessionId, transcriptPath], {
+    const here = dirname4(fileURLToPath2(import.meta.url));
+    const child = spawn(process.execPath, [join15(here, "reconcile.js"), sessionId, transcriptPath], {
       detached: true,
       stdio: "ignore"
     });