@akasecurity/ai-tc-claude-code 0.9.7 → 0.9.8

package/scripts/pre-tool-use.js

@@ -50,7 +50,7 @@ var require_ignore = __commonJS({
     var REGEX_SPLITALL_CRLF = /\r?\n/g;
     var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
     var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH = "/";
+    var SLASH2 = "/";
     var TMP_KEY_IGNORE = "node-ignore";
     if (typeof Symbol !== "undefined") {
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
@@ -422,11 +422,11 @@ var require_ignore = __commonJS({
         if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
           return this.test(path);
         }
-        const slices = path.split(SLASH).filter(Boolean);
+        const slices = path.split(SLASH2).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
-            slices.join(SLASH) + SLASH,
+            slices.join(SLASH2) + SLASH2,
             this._testCache,
             true,
             slices
@@ -442,14 +442,14 @@ var require_ignore = __commonJS({
           return cache[path];
         }
         if (!slices) {
-          slices = path.split(SLASH).filter(Boolean);
+          slices = path.split(SLASH2).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
           return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
-          slices.join(SLASH) + SLASH,
+          slices.join(SLASH2) + SLASH2,
           cache,
           checkUnignored,
           slices
@@ -492,13 +492,12 @@ var require_ignore = __commonJS({
 });
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join10 } from "path";
 
-// ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join2, sep } from "path";
-import { DatabaseSync } from "node:sqlite";
+// ../../packages/persistence/src/control-plane-credential.ts
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync, rmSync as rmSync2, statSync } from "fs";
+import { join } from "path";
 
 // ../../packages/schema/src/drizzle/sqlite-ddl.ts
 var SQLITE_MIGRATIONS = [
@@ -16202,6 +16201,125 @@ var ConfigScanRecord = external_exports.object({
   findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
 
+// ../../packages/schema/src/zod/control-plane.ts
+var ATTACHED_CREDENTIAL_FILENAME = "control-plane-credential.json";
+var ATTACHED_CREDENTIAL_SPEC_VERSION = 1;
+var AttachedCredential = external_exports.object({
+  specVersion: external_exports.literal(ATTACHED_CREDENTIAL_SPEC_VERSION),
+  // The control-plane endpoint this credential was minted against.
+  endpoint: external_exports.string().min(1),
+  // The bearer credential itself. Never logged, never rendered — status
+  // surfaces show `keyPrefix` and nothing else.
+  apiKey: external_exports.string().min(1),
+  // First few characters of the key, safe to display so a user can match the
+  // credential against their organization's key list.
+  keyPrefix: external_exports.string().min(1).max(16).optional(),
+  mintedAt: external_exports.iso.datetime().optional()
+});
+var MAX_DATE_MS = 253402300799999;
+var MAX_INT4 = 2147483647;
+var StorePosturePack = external_exports.object({
+  packId: external_exports.string().min(1),
+  // 'namespace/packId'
+  version: external_exports.string().min(1),
+  enabled: external_exports.boolean(),
+  // Stringified pass-through of the local store's `installed_packs.updated_at`
+  // — the column format is store-version-dependent (epoch millis vs ISO), so
+  // the wire shape assumes neither.
+  updatedAt: external_exports.string().nullable()
+}).meta({ id: "StorePosturePack" });
+var StorePosturePolicyCounts = external_exports.object({
+  total: external_exports.number().int().min(0),
+  disabled: external_exports.number().int().min(0),
+  // Exhaustive per-action map; the builder pre-fills every action with 0.
+  //
+  // Spelled out member-by-member rather than `z.record(ActionTaken, …)`. Zod
+  // enforces exhaustiveness either way, but z.record emits `propertyNames` +
+  // `additionalProperties` into a generated schema document, and a type
+  // generator renders THAT with every key optional — a sender built against
+  // the generated type would typecheck and still be rejected at runtime. An
+  // explicit object emits `properties` + `required`, so generated types
+  // demand all five.
+  //
+  // `satisfies Record<ActionTaken, …>` keeps the link to the enum: adding an
+  // ActionTaken member is a COMPILE error here instead of silent drift.
+  // `.strict()` is load-bearing — it rejects an unknown action key, which a
+  // bare object would silently STRIP, accepting a miscounted map as valid.
+  byAction: external_exports.object({
+    warn: external_exports.number().int().min(0),
+    redact: external_exports.number().int().min(0),
+    block: external_exports.number().int().min(0),
+    allow: external_exports.number().int().min(0),
+    log: external_exports.number().int().min(0)
+  }).strict()
+}).meta({ id: "StorePosturePolicyCounts" });
+var StorePosturePlugin = external_exports.object({
+  /** Package name of the reporting plugin. */
+  package: external_exports.string().min(1).max(200),
+  version: external_exports.string().min(1).max(64),
+  /** Version of the bundled core, when the build records one separately. */
+  ossVersion: external_exports.string().max(64).nullable(),
+  /**
+   * `version` of the policy bundle this machine last fetched. Bounded at 200
+   * rather than the 64 a bare sha256 hex digest needs today, so a later
+   * format with an algorithm prefix does not start rejecting the channel.
+   */
+  policyBundleVersion: external_exports.string().max(200).nullable(),
+  /** Epoch millis, on the CLIENT clock, of that fetch. */
+  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable()
+}).meta({ id: "StorePosturePlugin" });
+var StorePostureSnapshot = external_exports.object({
+  deviceId: external_exports.guid(),
+  hostname: external_exports.string().min(1).max(253),
+  // Epoch millis on the CLIENT clock. Bounded by what a receiving store
+  // accepts (see MAX_DATE_MS), not by what a JavaScript Date can hold.
+  capturedAt: external_exports.number().int().min(0).max(MAX_DATE_MS),
+  // False is a measurement, not an error state: "no local store exists on
+  // this machine".
+  storePresent: external_exports.boolean(),
+  schemaVersion: external_exports.number().int().min(0).max(MAX_INT4).nullable(),
+  // PRAGMA user_version
+  findingsTotal: external_exports.number().int().min(0).max(MAX_INT4),
+  // Epoch millis, bounded like `capturedAt` — see MAX_DATE_MS on what that
+  // bound does and does not do. Worth stating for these two specifically:
+  // they are read from the local store's own ROWS rather than from this
+  // machine's clock, so a damaged or hand-edited store is enough to produce
+  // an out-of-range value with no clock skew involved.
+  findingsFirstAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  findingsLastAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  packs: external_exports.array(StorePosturePack).max(500),
+  policyCounts: StorePosturePolicyCounts,
+  // OPTIONAL, not nullable: a reporter that predates this member keeps
+  // getting its 200 without a payload change.
+  plugin: StorePosturePlugin.optional()
+}).meta({ id: "StorePostureSnapshot" });
+var CAPTURE_VERSION_PREFIX = "capture/";
+var RecordAuditEventRequest = AuditEventInput.extend({
+  inspections: external_exports.array(ToolCallInspection).default([])
+}).refine((v) => v.inspections.every((i) => !i.ruleVersion.startsWith(CAPTURE_VERSION_PREFIX)), {
+  message: `inspections[].ruleVersion must not start with \`${CAPTURE_VERSION_PREFIX}\` \u2014 that namespace is reserved for capture definitions the control plane mints itself`,
+  path: ["inspections"]
+}).meta({ id: "RecordAuditEventRequest" });
+var IngestAck = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+});
+var PRINTABLE = /^[^\p{Cc}\p{Cf}]*$/u;
+var printable = (max) => external_exports.string().max(max).regex(PRINTABLE, "must not contain control characters");
+var PluginWhoami = external_exports.object({
+  tenantName: printable(200),
+  userEmail: printable(320),
+  role: printable(64),
+  keyKind: printable(64),
+  serverTime: printable(64)
+});
+var ControlPlaneErrorBody = external_exports.object({
+  error: external_exports.object({
+    code: external_exports.string().optional(),
+    message: external_exports.string().optional()
+  }).optional()
+});
+
 // ../../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
 var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -16504,15 +16622,15 @@ function summaryToDetectionListItem(s) {
 }
 function rowToDetectionDetail(row, findingsLast30d, update) {
   const rules = row.rules.flatMap((r) => {
-    const parsed = Matcher.safeParse(r.matcher);
-    if (!parsed.success) return [];
+    const parsed2 = Matcher.safeParse(r.matcher);
+    if (!parsed2.success) return [];
     return [
       {
         id: r.id,
         name: r.name,
         category: r.category,
         severity: r.severity,
-        matcher: parsed.data
+        matcher: parsed2.data
       }
     ];
   });
@@ -17158,8 +17276,8 @@ function toApiAction(dbVal) {
 }
 function toApiCategory(dbVal) {
   if (dbVal === "code_context") return "source_code";
-  const parsed = FindingCategory.safeParse(dbVal);
-  return parsed.success ? parsed.data : "custom";
+  const parsed2 = FindingCategory.safeParse(dbVal);
+  return parsed2.success ? parsed2.data : "custom";
 }
 function toApiProvider(sourceTool) {
   return TOOL_TO_HARNESS[sourceTool] ?? HARNESS.Api;
@@ -17797,6 +17915,9 @@ var WorkspaceSettings = external_exports.object({
 function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
 }
+function isAttached(settings) {
+  return settings.runMode === "attached" && settings.controlPlane !== void 0;
+}
 function toInventoryRow(input, id, now) {
   return {
     id,
@@ -18064,8 +18185,8 @@ function builtinPolicyIsReversible(id) {
   return BUILTIN_POLICY_SPECS[id].reversible;
 }
 function policyIdIsReversible(policyId) {
-  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
   return builtinPolicyIsReversible(id);
 }
 var DEFAULT_ACTIONS = Object.fromEntries(
@@ -18076,8 +18197,8 @@ var BUILTIN_POLICIES = Object.fromEntries(
 );
 var DEFAULT_PACK_POLICY_ID = "monitor";
 function policyIdToAction(policyId) {
-  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
   return BUILTIN_POLICIES[id].action;
 }
 var UsedByItem = external_exports.object({
@@ -18520,53 +18641,6 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
-// ../../packages/persistence/src/ids.ts
-import { createHash } from "crypto";
-function sha256Hex(input) {
-  return createHash("sha256").update(input).digest("hex");
-}
-function inventoryId(objectType, identityKey) {
-  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
-}
-function sourceProjectId(url2) {
-  return sha256Hex(canonicalIdentity(["source_project", url2]));
-}
-function classifiedDataId(cls) {
-  return sha256Hex(canonicalIdentity(["classified_data", cls]));
-}
-function inspectionDefinitionId(ruleId, version2) {
-  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
-}
-function llmCallId(sessionId, messageId) {
-  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
-}
-function toolCallId(sessionId, toolUseId) {
-  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
-}
-function inspectionFindingId(auditEventId, ruleId, spanStart, spanEnd) {
-  return sha256Hex(
-    canonicalIdentity([
-      "inspection_finding",
-      auditEventId,
-      ruleId,
-      String(spanStart),
-      String(spanEnd)
-    ])
-  );
-}
-var NO_SESSION = "no_session";
-var NO_PATH = "no_path";
-function captureId(sessionId, contentHash, filePath = null) {
-  return sha256Hex(
-    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
-  );
-}
-
-// ../../packages/persistence/src/internal/snapshot.ts
-import { randomUUID } from "crypto";
-import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
-import { basename, dirname, join } from "path";
-
 // ../../packages/persistence/src/paths.ts
 import {
   chmodSync,
@@ -18692,7 +18766,123 @@ function publishByLink(tmp, file2, data) {
   }
 }
 
+// ../../packages/persistence/src/control-plane-credential.ts
+function controlPlaneCredentialPath(settingsDir2) {
+  return join(settingsDir2, ATTACHED_CREDENTIAL_FILENAME);
+}
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isSafeEndpoint(endpoint) {
+  let parsed2;
+  try {
+    parsed2 = new URL(endpoint);
+  } catch {
+    return false;
+  }
+  if (parsed2.protocol === "https:") return true;
+  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname);
+}
+function repairOrRefuseMode(file2) {
+  const link = lstatSync2(file2, { throwIfNoEntry: false });
+  if (link === void 0) return "absent";
+  if (link.isSymbolicLink()) return "untrusted";
+  const stat = statSync(file2, { throwIfNoEntry: false });
+  if (stat === void 0) return "absent";
+  const uid = process.getuid?.();
+  if (uid !== void 0 && stat.uid !== uid) return "untrusted";
+  if (process.platform !== "win32" && (stat.mode & 511) !== DATA_FILE_MODE) {
+    try {
+      chmodSync2(file2, DATA_FILE_MODE);
+    } catch {
+      return "untrusted";
+    }
+  }
+  return "ok";
+}
+function readControlPlaneCredentialState(settingsDir2, connection) {
+  const file2 = controlPlaneCredentialPath(settingsDir2);
+  let raw;
+  const gate = repairOrRefuseMode(file2);
+  if (gate === "absent") return { usable: false, reason: "absent" };
+  if (gate === "untrusted") return { usable: false, reason: "untrusted-file" };
+  try {
+    raw = readFileSync(file2, "utf8");
+  } catch (err) {
+    const code = err.code;
+    return { usable: false, reason: code === "ENOENT" ? "absent" : "unreadable" };
+  }
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(raw);
+  } catch {
+    return { usable: false, reason: "malformed" };
+  }
+  const result = AttachedCredential.safeParse(parsed2);
+  if (!result.success) return { usable: false, reason: "malformed" };
+  if (!isSafeEndpoint(result.data.endpoint)) {
+    return { usable: false, reason: "unsafe-endpoint" };
+  }
+  if (connection !== void 0 && connection.endpoint !== result.data.endpoint) {
+    return {
+      usable: false,
+      reason: "endpoint-mismatch",
+      credentialEndpoint: result.data.endpoint,
+      settingsEndpoint: connection.endpoint
+    };
+  }
+  return { usable: true, credential: result.data };
+}
+
+// ../../packages/persistence/src/database.ts
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join3, sep } from "path";
+import { DatabaseSync } from "node:sqlite";
+
+// ../../packages/persistence/src/ids.ts
+import { createHash } from "crypto";
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function inventoryId(objectType, identityKey) {
+  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+}
+function sourceProjectId(url2) {
+  return sha256Hex(canonicalIdentity(["source_project", url2]));
+}
+function classifiedDataId(cls) {
+  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+}
+function inspectionDefinitionId(ruleId, version2) {
+  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
+}
+function llmCallId(sessionId, messageId) {
+  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+}
+function toolCallId(sessionId, toolUseId) {
+  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+}
+function inspectionFindingId(auditEventId, ruleId, spanStart, spanEnd) {
+  return sha256Hex(
+    canonicalIdentity([
+      "inspection_finding",
+      auditEventId,
+      ruleId,
+      String(spanStart),
+      String(spanEnd)
+    ])
+  );
+}
+var NO_SESSION = "no_session";
+var NO_PATH = "no_path";
+function captureId(sessionId, contentHash, filePath = null) {
+  return sha256Hex(
+    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
+  );
+}
+
 // ../../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { basename, dirname, join as join2 } from "path";
 function backupPath(file2, tag) {
   return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
 }
@@ -18702,15 +18892,15 @@ var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 var SNAPSHOT_STAGING_COPY = "copy";
 function createSnapshotStaging(backup) {
   const stage = `${backup}${SNAPSHOT_STAGING_SUFFIX}`;
-  rmSync2(stage, { recursive: true, force: true });
+  rmSync3(stage, { recursive: true, force: true });
   mkdirOwnerOnlySync(stage);
   tightenDir(stage);
-  return { stage, copy: join(stage, SNAPSHOT_STAGING_COPY) };
+  return { stage, copy: join2(stage, SNAPSHOT_STAGING_COPY) };
 }
 function idleMs(entry) {
-  for (const candidate of [join(entry, SNAPSHOT_STAGING_COPY), entry]) {
+  for (const candidate of [join2(entry, SNAPSHOT_STAGING_COPY), entry]) {
     try {
-      return Date.now() - statSync(candidate).mtimeMs;
+      return Date.now() - statSync2(candidate).mtimeMs;
     } catch {
     }
   }
@@ -18727,11 +18917,11 @@ function reapStalePartials(file2) {
   }
   for (const name of entries) {
     if (!name.startsWith(prefix) || !name.endsWith(STAGED_NAME_SUFFIX)) continue;
-    const staging = join(dir, name);
+    const staging = join2(dir, name);
     try {
       const idle = idleMs(staging);
       if (idle !== null && idle > STALE_PARTIAL_MS) {
-        rmSync2(staging, { recursive: true, force: true });
+        rmSync3(staging, { recursive: true, force: true });
       }
     } catch {
     }
@@ -18745,13 +18935,13 @@ function snapshotStore(db, backup) {
     renameSync2(copy, backup);
   } catch (error51) {
     try {
-      rmSync2(stage, { recursive: true, force: true });
+      rmSync3(stage, { recursive: true, force: true });
     } catch {
     }
     throw error51;
   }
   try {
-    rmSync2(stage, { recursive: true, force: true });
+    rmSync3(stage, { recursive: true, force: true });
   } catch {
   }
 }
@@ -18766,7 +18956,7 @@ function moveStoreAside(file2, backup) {
         renameSync2(sidecar, moved);
         undo.push([moved, sidecar]);
       } catch {
-        rmSync2(sidecar, { force: true });
+        rmSync3(sidecar, { force: true });
       }
     }
   } catch (error51) {
@@ -18782,14 +18972,14 @@ function moveStoreAside(file2, backup) {
 }
 function discardStore(file2, backup) {
   try {
-    rmSync2(file2, { force: true });
+    rmSync3(file2, { force: true });
     for (const sidecar of dbSidecars(file2)) {
-      rmSync2(sidecar, { force: true });
+      rmSync3(sidecar, { force: true });
     }
   } catch (error51) {
     if (existsSync(file2)) {
       try {
-        rmSync2(backup, { force: true });
+        rmSync3(backup, { force: true });
       } catch {
       }
     }
@@ -19021,10 +19211,31 @@ function applyMigrations(db, file2) {
     if (drained) applyLegacyDropMigration(db, file2);
   }
 }
+function readLegacyTables(db) {
+  let holdsRows = false;
+  const marks = [];
+  for (const table of ["events", "findings"]) {
+    try {
+      const row = db.prepare(`SELECT count(*) AS n, ifnull(max(rowid), -1) AS hi FROM ${table}`).get();
+      if (row === void 0) {
+        holdsRows = true;
+        marks.push(`${table}:unreadable`);
+        continue;
+      }
+      if (row.n > 0) holdsRows = true;
+      marks.push(`${table}:${String(row.n)}:${String(row.hi)}`);
+    } catch {
+      holdsRows = true;
+      marks.push(`${table}:unreadable`);
+    }
+  }
+  return { holdsRows, mark: marks.join("|") };
+}
 function applyLegacyDropMigration(db, file2) {
   const migration = SQLITE_MIGRATIONS.find((m) => m.tag === LEGACY_DROP_MIGRATION_TAG);
   if (!migration) return;
-  if (file2) {
+  const before = file2 === void 0 ? void 0 : readLegacyTables(db);
+  if (file2 !== void 0 && before?.holdsRows === true) {
     try {
       backupBeforeLegacyDrop(db, file2);
     } catch (error51) {
@@ -19038,6 +19249,12 @@ function applyLegacyDropMigration(db, file2) {
       () => {
         const alreadyDropped = db.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(migration.tag);
         if (alreadyDropped) return;
+        if (before !== void 0 && readLegacyTables(db).mark !== before.mark) {
+          akaWarn(
+            "legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first."
+          );
+          return;
+        }
         for (const statement of splitStatements(migration.sql)) {
           db.exec(statement);
         }
@@ -19392,8 +19609,8 @@ function safeJson(s, fallback) {
 function parseJsonObject(s) {
   if (s == null) return void 0;
   try {
-    const parsed = JSON.parse(s);
-    if (typeof parsed === "object" && parsed !== null) return parsed;
+    const parsed2 = JSON.parse(s);
+    if (typeof parsed2 === "object" && parsed2 !== null) return parsed2;
   } catch {
   }
   return void 0;
@@ -19404,16 +19621,16 @@ function encodeKeysetCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeKeysetCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && "startedAtMs" in parsed2 && "id" in parsed2 && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
   // resumes from is epoch millis, and a payload carrying ±Infinity or a
   // fraction binds cleanly rather than failing — returning an EMPTY page with
   // a null cursor, which a caller reads as "end of list". That is the one
   // outcome a cursor that does not decode must never produce, since the
   // documented behaviour above is to restart from the top. (`1e999` is valid
   // JSON and parses to Infinity; a bare `NaN` is not, so it cannot arrive.)
-  Number.isInteger(parsed.startedAtMs) && typeof parsed.id === "string") {
-    return parsed;
+  Number.isInteger(parsed2.startedAtMs) && typeof parsed2.id === "string") {
+    return parsed2;
   }
   return null;
 }
@@ -19478,18 +19695,18 @@ var DB_EVENT_TYPE_TO_KIND = {
 };
 function safeParseStringArray(raw) {
   if (!raw) return [];
-  const parsed = safeJson(raw, null);
-  return Array.isArray(parsed) ? parsed : [];
+  const parsed2 = safeJson(raw, null);
+  return Array.isArray(parsed2) ? parsed2 : [];
 }
 var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 function toHarness(raw) {
-  const parsed = Harness.safeParse(raw);
-  return parsed.success ? parsed.data : DEFAULT_HARNESS;
+  const parsed2 = Harness.safeParse(raw);
+  return parsed2.success ? parsed2.data : DEFAULT_HARNESS;
 }
 function resolveLifecycle(row, lastActivityMs, nowMs) {
   if (row.status) {
-    const parsed = SessionStatus.safeParse(row.status);
-    if (parsed.success) return { status: parsed.data, endedAtMs: row.ended_at };
+    const parsed2 = SessionStatus.safeParse(row.status);
+    if (parsed2.success) return { status: parsed2.data, endedAtMs: row.ended_at };
   }
   if (row.ended_at !== null) return { status: "completed", endedAtMs: row.ended_at };
   if (lastActivityMs >= nowMs - LIVE_ACTIVITY_WINDOW_MS) {
@@ -20448,9 +20665,9 @@ var SqliteDetectionsRepository = class {
     const ruleIds = /* @__PURE__ */ new Set();
     for (const r of rows) {
       if (intToBool(r.enabled)) active += 1;
-      const parsed = parseRules(r.rulesJson);
-      rules += parsed.length;
-      for (const rule of parsed) {
+      const parsed2 = parseRules(r.rulesJson);
+      rules += parsed2.length;
+      for (const rule of parsed2) {
         if (typeof rule.id === "string") ruleIds.add(rule.id);
       }
     }
@@ -20984,12 +21201,12 @@ function encodeGroupCursor(group) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeGroupCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && typeof parsed.sev === "string" && typeof parsed.t === "string" && typeof parsed.id === "string") {
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && typeof parsed2.sev === "string" && typeof parsed2.t === "string" && typeof parsed2.id === "string") {
     return {
-      severity: parsed.sev,
-      latestDetectedAt: parsed.t,
-      id: parsed.id
+      severity: parsed2.sev,
+      latestDetectedAt: parsed2.t,
+      id: parsed2.id
     };
   }
   return null;
@@ -22123,16 +22340,16 @@ var SqliteInstalledPacksRepository = class {
         continue;
       }
       for (const entry of raw) {
-        const parsed = Rule.safeParse(entry);
-        if (parsed.success) {
-          out.rules.push(parsed.data);
-          out.ruleActions.set(parsed.data.id, action);
-          out.ruleVersions.set(parsed.data.id, row.version);
-          if (reversible) out.reversibleRules.add(parsed.data.id);
-          else out.reversibleRules.delete(parsed.data.id);
+        const parsed2 = Rule.safeParse(entry);
+        if (parsed2.success) {
+          out.rules.push(parsed2.data);
+          out.ruleActions.set(parsed2.data.id, action);
+          out.ruleVersions.set(parsed2.data.id, row.version);
+          if (reversible) out.reversibleRules.add(parsed2.data.id);
+          else out.reversibleRules.delete(parsed2.data.id);
         } else {
           out.invalidRules += 1;
-          reject(pack, printableRuleId(entry), firstIssueReason(parsed.error));
+          reject(pack, printableRuleId(entry), firstIssueReason(parsed2.error));
         }
       }
     }
@@ -23522,15 +23739,15 @@ function encodeReuseCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeReuseCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
   // ±Infinity or a fraction binds cleanly and returns an EMPTY page with a
   // null cursor, which the caller reads as "end of list" — the one outcome a
   // malformed cursor must never produce, since restarting from the top is the
   // documented behaviour and the only recoverable one. (`1e999` is valid JSON
   // and parses to Infinity; a bare `NaN` is not, so it cannot arrive here.)
-  Number.isInteger(parsed.occurrences) && typeof parsed.pointerId === "string") {
-    return { occurrences: parsed.occurrences, pointerId: parsed.pointerId };
+  Number.isInteger(parsed2.occurrences) && typeof parsed2.pointerId === "string") {
+    return { occurrences: parsed2.occurrences, pointerId: parsed2.pointerId };
   }
   return null;
 }
@@ -25259,7 +25476,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join2(dir, DB_FILENAME);
+  const file2 = join3(dir, DB_FILENAME);
   reapStalePartials(file2);
   const {
     db,
@@ -25515,9 +25732,9 @@ import {
   closeSync,
   existsSync as existsSync2,
   openSync,
-  readFileSync,
-  rmSync as rmSync3,
-  statSync as statSync2,
+  readFileSync as readFileSync2,
+  rmSync as rmSync4,
+  statSync as statSync3,
   writeFileSync as writeFileSync2
 } from "fs";
 import { hostname as hostname3 } from "os";
@@ -25535,20 +25752,20 @@ function computeFindingKey(input) {
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var EXCEPTION_KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
-  return join3(dataDir2, EXCEPTION_KEY_FILENAME);
+  return join4(dataDir2, EXCEPTION_KEY_FILENAME);
 }
 function parseKeyFile(raw) {
-  const parsed = JSON.parse(raw);
-  if (typeof parsed !== "object" || parsed === null) {
+  const parsed2 = JSON.parse(raw);
+  if (typeof parsed2 !== "object" || parsed2 === null) {
     throw new Error("exception key file is corrupt: not a JSON object");
   }
-  const { version: version2, material } = parsed;
+  const { version: version2, material } = parsed2;
   if (typeof version2 !== "number" || !Number.isInteger(version2) || version2 < 1) {
     throw new Error("exception key file is corrupt: bad version");
   }
@@ -25579,7 +25796,7 @@ var FloorUnreadableError = class extends Error {
   }
 };
 function storedKeyVersionFloor(dataDir2) {
-  const file2 = join3(dataDir2, DB_FILENAME);
+  const file2 = join4(dataDir2, DB_FILENAME);
   if (!existsSync3(file2)) return 0;
   let db;
   try {
@@ -25634,7 +25851,7 @@ function occupantMessage(file2, kind) {
 function readFingerprintKey(dataDir2) {
   let raw;
   try {
-    raw = readFileSync2(keyFilePath(dataDir2), "utf8");
+    raw = readFileSync3(keyFilePath(dataDir2), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err instanceof Error ? err : new Error(String(err));
@@ -25660,21 +25877,25 @@ function fingerprintValue(key, raw) {
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function defaultDataDir() {
-  return join4(homedir(), ".aka");
+  return join5(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join4(base, "settings");
+  return join5(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join4(base, "data");
+  return join5(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join4(dataDir(base), "aka.db");
+  return join5(dataDir(base), "aka.db");
 }
 function keysDir(base = defaultDataDir()) {
-  return join4(base, "keys");
+  return join5(base, "keys");
+}
+async function ensureDataDir(dir = defaultDataDir()) {
+  await mkdir(dir, { recursive: true, mode: DATA_DIR_MODE });
+  tightenDir(dir);
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -25687,8 +25908,8 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join4(dest, name);
-      renameSync3(join4(base, name), moved);
+      const moved = join5(dest, name);
+      renameSync3(join5(base, name), moved);
       tightenFile(moved);
     } catch {
     }
@@ -25696,7 +25917,7 @@ function migrateLegacyLayout(base = defaultDataDir()) {
 }
 
 // ../../packages/persistence/src/managed-settings.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { posix, win32 } from "path";
 function managedSettingsPaths(platform2 = process.platform) {
   if (platform2 === "darwin") {
@@ -25714,14 +25935,14 @@ function readManagedSettings(paths = managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
-      text = readFileSync3(path, "utf8");
+      text = readFileSync4(path, "utf8");
     } catch {
       continue;
     }
     const record2 = parseJsonObject(text);
     if (!record2) continue;
-    const parsed = ManagedSettings.safeParse(record2);
-    if (parsed.success) return parsed.data;
+    const parsed2 = ManagedSettings.safeParse(record2);
+    if (parsed2.success) return parsed2.data;
   }
   return null;
 }
@@ -25761,14 +25982,14 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
   return overlayManagedSettings(readUserSettings(base), readManagedSettings());
 }
 function readUserSettings(base) {
-  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
+  const record2 = readJson(join6(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -25779,13 +26000,64 @@ function readUserSettings(base) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync4(file2, "utf8");
+    text = readFileSync5(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/store-symlinks.ts
+import { existsSync as existsSync4, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
+import { dirname as dirname2, join as join7, resolve } from "path";
+var STORE_DB = "the store database (including the prompt corpus)";
+var STORE_SETTINGS = "your settings file";
+function storeContents(home) {
+  return /* @__PURE__ */ new Map([
+    [home, "the store (including the prompt corpus in aka.db)"],
+    [settingsDir(home), STORE_SETTINGS],
+    [dataDir(home), STORE_DB],
+    [keysDir(home), "the vault key"],
+    [join7(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [dbPath(home), STORE_DB]
+  ]);
+}
+function symlinkedStorePaths(home, platform2 = process.platform) {
+  return [...storeContents(home)].flatMap(([path, holds]) => {
+    try {
+      if (!lstatSync3(path).isSymbolicLink()) return [];
+      return [
+        {
+          path,
+          target: linkTarget(path),
+          holds,
+          // existsSync follows the link, so a target that is gone reads as
+          // absent here while lstat above still sees the link itself.
+          missing: !existsSync4(path),
+          mode: targetMode(path, platform2)
+        }
+      ];
+    } catch {
+      return [];
+    }
+  });
+}
+function linkTarget(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(dirname2(path), readlinkSync(path));
+  }
+}
+function targetMode(path, platform2) {
+  if (platform2 === "win32") return void 0;
+  try {
+    return statSync4(path).mode & 511;
+  } catch {
+    return void 0;
+  }
+}
+
 // ../../packages/persistence/src/vault/crypto.ts
 import {
   createCipheriv,
@@ -25897,8 +26169,8 @@ function formatPointer(category, keyVersion, pointerId, tag) {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync2, readFileSync as readFileSync5, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync5, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 var VAULT_OCCUPANT_REASON = {
   symlink: "the path is a symlink; remove it so a keyring can be created",
   gone: "the path was occupied but holds no keyring (removed while it was being created)",
@@ -25917,11 +26189,11 @@ var KEY_MATERIAL_BYTES2 = 32;
 var KEYCHAIN_SERVICE = "aka-vault";
 var KEYCHAIN_ACCOUNT = "keyring";
 function parseKeyring(raw) {
-  const parsed = JSON.parse(raw);
-  if (typeof parsed !== "object" || parsed === null) {
+  const parsed2 = JSON.parse(raw);
+  if (typeof parsed2 !== "object" || parsed2 === null) {
     throw new Error("vault key file is corrupt: not a JSON object");
   }
-  const { current, keys } = parsed;
+  const { current, keys } = parsed2;
   if (typeof current !== "number" || !Number.isInteger(current) || current < 1) {
     throw new Error("vault key file is corrupt: bad current version");
   }
@@ -25997,28 +26269,28 @@ function claimRotationLock(lock, owner) {
     throw asError(err);
   }
   try {
-    writeFileSync3(join6(lock, LOCK_OWNER_FILE), `${owner}
+    writeFileSync3(join8(lock, LOCK_OWNER_FILE), `${owner}
 `, { mode: DATA_FILE_MODE });
     return true;
   } catch (err) {
-    rmSync4(lock, { recursive: true, force: true });
+    rmSync5(lock, { recursive: true, force: true });
     throw asError(err);
   }
 }
 function acquireRotationLock(keysDir2) {
-  const lock = join6(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const lock = join8(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
   const owner = randomBytes2(16).toString("hex");
   if (claimRotationLock(lock, owner)) return { lock, owner };
   let held;
   try {
-    held = statSync3(lock);
+    held = statSync5(lock);
   } catch {
     throw new Error(ROTATION_IN_PROGRESS);
   }
   if (Date.now() - held.mtimeMs < ROTATION_LOCK_STALE_MS) throw new Error(ROTATION_IN_PROGRESS);
   const aside = `${lock}.stale.${owner}`;
   try {
-    const now = statSync3(lock);
+    const now = statSync5(lock);
     if (now.ino !== held.ino || now.mtimeMs !== held.mtimeMs) {
       throw new Error(ROTATION_IN_PROGRESS);
     }
@@ -26027,17 +26299,17 @@ function acquireRotationLock(keysDir2) {
     if (err instanceof Error && err.message === ROTATION_IN_PROGRESS) throw err;
     throw new Error(ROTATION_IN_PROGRESS, { cause: err });
   }
-  rmSync4(aside, { recursive: true, force: true });
+  rmSync5(aside, { recursive: true, force: true });
   if (!claimRotationLock(lock, owner)) throw new Error(ROTATION_IN_PROGRESS);
   return { lock, owner };
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync5(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync6(join8(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
-  rmSync4(lease.lock, { recursive: true, force: true });
+  rmSync5(lease.lock, { recursive: true, force: true });
 }
 function withRotationLock(keysDir2, work) {
   ensureDataDirSync(keysDir2);
@@ -26054,7 +26326,7 @@ var FileKeyProvider = class {
     this.#keysDir = keysDir2;
   }
   get filePath() {
-    return join6(this.#keysDir, VAULT_KEY_FILENAME);
+    return join8(this.#keysDir, VAULT_KEY_FILENAME);
   }
   loadOrCreate() {
     return asAsync(() => {
@@ -26084,7 +26356,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync5(this.filePath, "utf8");
+      raw = readFileSync6(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -26141,7 +26413,7 @@ var FileKeyProvider = class {
 };
 function tightenFileMode(file2) {
   try {
-    chmodSync2(file2, DATA_FILE_MODE);
+    chmodSync3(file2, DATA_FILE_MODE);
   } catch {
   }
 }
@@ -26406,25 +26678,25 @@ var SecretVault = class {
    * model. Every call that gets as far as an identified row writes an audit row.
    */
   async detokenize(token, opts) {
-    const parsed = parsePointer(token);
-    if (!parsed) return UNAVAILABLE;
+    const parsed2 = parsePointer(token);
+    if (!parsed2) return UNAVAILABLE;
     let signKey;
     try {
-      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      const epoch = await this.#keys.materialFor(parsed2.keyVersion);
       signKey = deriveSubkeys(epoch.material).sign;
     } catch {
       return UNAVAILABLE;
     }
-    if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+    if (!verifyPointerTag(signKey, parsed2.keyVersion, parsed2.pointerId, parsed2.category, parsed2.tag)) {
       return UNAVAILABLE;
     }
-    const pointerId = base32Encode(parsed.pointerId);
+    const pointerId = base32Encode(parsed2.pointerId);
     const row = this.#repo.byPointerId(pointerId);
     if (!row) {
       this.#audit(pointerId, opts, "unavailable");
       return UNAVAILABLE;
     }
-    if (row.category !== parsed.category) return UNAVAILABLE;
+    if (row.category !== parsed2.category) return UNAVAILABLE;
     if (opts.target === "model") {
       const grantId = opts.grantId;
       const verify = this.#verifyGrant;
@@ -26461,7 +26733,7 @@ var SecretVault = class {
         // moved the epoch past the one this token names, and a format bump may
         // have moved the constant past the generation this row was sealed
         // under — the AAD follows the row in both cases, never the token.
-        bindingInput(row.keyVersion, parsed.pointerId, row.category, row.formatVersion)
+        bindingInput(row.keyVersion, parsed2.pointerId, row.category, row.formatVersion)
       );
     } catch {
       raw = null;
@@ -26679,19 +26951,19 @@ var SecretVault = class {
   // preview. Verifying needs the historical epoch's key, which is why these
   // surfaces are async.
   async #rowFor(token) {
-    const parsed = parsePointer(token);
-    if (!parsed) return null;
+    const parsed2 = parsePointer(token);
+    if (!parsed2) return null;
     try {
-      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      const epoch = await this.#keys.materialFor(parsed2.keyVersion);
       const signKey = deriveSubkeys(epoch.material).sign;
-      if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+      if (!verifyPointerTag(signKey, parsed2.keyVersion, parsed2.pointerId, parsed2.category, parsed2.tag)) {
         return null;
       }
     } catch {
       return null;
     }
-    const row = this.#repo.byPointerId(base32Encode(parsed.pointerId));
-    if (row?.category !== parsed.category) return null;
+    const row = this.#repo.byPointerId(base32Encode(parsed2.pointerId));
+    if (row?.category !== parsed2.category) return null;
     return row;
   }
   #audit(pointerId, opts, outcome) {
@@ -26711,13 +26983,13 @@ var SecretVault = class {
 };
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join7(dataDir2, MARKER);
-  if (existsSync4(marker)) return { capped: 0, skipped: "already-run" };
+  const marker = join9(dataDir2, MARKER);
+  if (existsSync5(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
   writeFileSync4(marker, `${new Date(Date.now()).toISOString()}
 `, { mode: DATA_FILE_MODE });
@@ -26758,8 +27030,8 @@ function hostOf(url2) {
   }
 }
 function resolveProvider() {
-  const parsed = ProviderEnvSchema.safeParse(process.env);
-  const env = parsed.success ? parsed.data : ProviderEnvSchema.parse({});
+  const parsed2 = ProviderEnvSchema.safeParse(process.env);
+  const env = parsed2.success ? parsed2.data : ProviderEnvSchema.parse({});
   if (env.CLAUDE_CODE_USE_BEDROCK === true) return { provider: "bedrock" };
   if (env.CLAUDE_CODE_USE_VERTEX === true) return { provider: "vertex" };
   const baseUrl = env.ANTHROPIC_BASE_URL;
@@ -26776,8 +27048,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join8(settingsDir(base), "settings.json");
-    if (existsSync5(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join10(settingsDir(base), "settings.json");
+    if (existsSync6(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -26800,9 +27072,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync7, realpathSync, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join10 } from "path";
+import { basename as basename3, join as join12 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -28579,10 +28851,10 @@ var localhost_ref_default = {
   severity: "low",
   matcher: {
     type: "regex",
-    pattern: "\\b(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|::1)\\b",
+    pattern: "(?<![A-Za-z0-9_])(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|(?<![A-Za-z0-9_]\\[)::1(?!:|\\.[0-9]))(?![A-Za-z0-9_])",
     flags: "g"
   },
-  examples: ["localhost", "127.0.0.1"]
+  examples: ["localhost", "127.0.0.1", "0.0.0.0", "::1"]
 };
 
 // ../../rules/core-code-context/stack-trace.json
@@ -29891,8 +30163,8 @@ function bundledDetections() {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join11, sep as sep2 } from "path";
 function resolveRepo(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -29907,36 +30179,36 @@ function resolveRepo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync6(join9(dir, ".git"))) return dir;
-    const parent = dirname2(dir);
+    if (existsSync7(join11(dir, ".git"))) return dir;
+    const parent = dirname3(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join9(root, ".git");
+  const dotGit = join11(root, ".git");
   try {
-    if (statSync4(dotGit).isDirectory()) {
-      return { configPath: join9(dotGit, "config"), headRoot: root };
+    if (statSync6(dotGit).isDirectory()) {
+      return { configPath: join11(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join9(root, target);
-  if (existsSync6(join9(gitdir, "config"))) {
-    return { configPath: join9(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join11(root, target);
+  if (existsSync7(join11(gitdir, "config"))) {
+    return { configPath: join11(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join9(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join11(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join9(gitdir, commonRaw);
-  const headRoot = basename2(commonGitDir) === ".git" ? dirname2(commonGitDir) : root;
-  return { configPath: join9(commonGitDir, "config"), headRoot };
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join11(gitdir, commonRaw);
+  const headRoot = basename2(commonGitDir) === ".git" ? dirname3(commonGitDir) : root;
+  return { configPath: join11(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync6(path, "utf8");
+    return readFileSync7(path, "utf8");
   } catch {
     return void 0;
   }
@@ -29997,7 +30269,7 @@ function buildIngestEvent(input) {
 }
 
 // ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 var ISOLATED_SCAN_BUDGET_MS = 2e3;
@@ -30011,7 +30283,7 @@ function resolveWorkerUrl() {
   for (const name of ["scan-worker.js", "scan-worker.ts"]) {
     const candidate = new URL(name, import.meta.url);
     try {
-      if (existsSync7(fileURLToPath(candidate))) {
+      if (existsSync8(fileURLToPath(candidate))) {
         resolvedWorkerUrl = candidate;
         return candidate;
       }
@@ -30196,8 +30468,8 @@ function createIsolatedScanner(data, opts = {}) {
   }
   function enqueue(spec) {
     const next = chain.then(
-      () => new Promise((resolve) => {
-        spec(resolve);
+      () => new Promise((resolve2) => {
+        spec(resolve2);
       })
     );
     chain = next.then(
@@ -30208,7 +30480,7 @@ function createIsolatedScanner(data, opts = {}) {
   }
   return {
     scan(text, context, scanOpts) {
-      return enqueue((resolve) => {
+      return enqueue((resolve2) => {
         runOne(
           {
             budgetMs,
@@ -30221,23 +30493,23 @@ function createIsolatedScanner(data, opts = {}) {
             }),
             reply: (message) => {
               if (message.kind !== "result") return false;
-              resolve({ status: "ok", findings: message.findings });
+              resolve2({ status: "ok", findings: message.findings });
               return true;
             }
           },
-          resolve
+          resolve2
         );
       });
     },
     probe(rule) {
-      return enqueue((resolve) => {
+      return enqueue((resolve2) => {
         runOne(
           {
             budgetMs: probeBudgetMs,
             build: (id) => ({ kind: "probe", id, rule }),
             reply: (message) => {
               if (message.kind !== "probed") return false;
-              resolve({
+              resolve2({
                 status: "ok",
                 verdict: message.verdict,
                 worstMs: message.worstMs,
@@ -30246,7 +30518,7 @@ function createIsolatedScanner(data, opts = {}) {
               return true;
             }
           },
-          resolve
+          resolve2
         );
       });
     },
@@ -30476,23 +30748,23 @@ function createGuardedScanner(partition, gateway, opts) {
 
 // ../../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join13 } from "path";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
-import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
+import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
+import { basename as basename4, dirname as dirname4, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync8, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join13 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join15 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -30863,8 +31135,8 @@ function createPluginRuntime(gateway, settings, opts) {
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { join as join16 } from "path";
 
 // ../../packages/plugin-sdk/src/tokenize.ts
 function redactedPlaceholder(category) {
@@ -31171,17 +31443,17 @@ var UNOPENABLE_VAULT = {
 
 // src/protocol/marker.ts
 import { randomBytes as randomBytes4 } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync10, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join15 } from "path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync11, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join17 } from "path";
 var MARKER_FILE = "protocol-marker";
 function mintMarker() {
   return randomBytes4(8).toString("hex");
 }
 function sessionProtocolMarker(dataDir2, sessionId) {
   if (!sessionId) return mintMarker();
-  const path = join15(dataDir2, MARKER_FILE);
+  const path = join17(dataDir2, MARKER_FILE);
   try {
-    const stored = JSON.parse(readFileSync10(path, "utf8"));
+    const stored = JSON.parse(readFileSync11(path, "utf8"));
     if (stored.sessionId === sessionId && typeof stored.marker === "string" && /^[0-9a-f]{16}$/.test(stored.marker)) {
       return stored.marker;
     }
@@ -31190,7 +31462,7 @@ function sessionProtocolMarker(dataDir2, sessionId) {
   const marker = mintMarker();
   try {
     mkdirSync4(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    const tmp = join15(dataDir2, `${MARKER_FILE}.tmp`);
+    const tmp = join17(dataDir2, `${MARKER_FILE}.tmp`);
     writeFileSync7(tmp, JSON.stringify({ sessionId, marker }), { mode: DATA_FILE_MODE });
     renameSync5(tmp, path);
   } catch {
@@ -31531,7 +31803,7 @@ function inputFilePath(toolInput) {
 
 // src/hooks/shared.ts
 async function readStdin() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let data = "";
     let settled = false;
     const finish = () => {
@@ -31540,7 +31812,7 @@ async function readStdin() {
       clearTimeout(timer);
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", finish);
-      resolve(data);
+      resolve2(data);
     };
     const onData = (chunk) => {
       data += chunk;
@@ -31554,8 +31826,8 @@ async function readStdin() {
 }
 function parseJson(raw) {
   try {
-    const parsed = JSON.parse(raw);
-    return typeof parsed === "object" && parsed !== null ? parsed : null;
+    const parsed2 = JSON.parse(raw);
+    return typeof parsed2 === "object" && parsed2 !== null ? parsed2 : null;
   } catch {
     return null;
   }
@@ -31565,12 +31837,12 @@ function getString(record2, key) {
   return typeof value === "string" ? value : void 0;
 }
 function emit(output) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     const finish = () => {
       if (settled) return;
       settled = true;
-      resolve();
+      resolve2();
     };
     process.stdout.on("error", finish);
     process.stdout.write(JSON.stringify(output), finish);
@@ -31586,59 +31858,1249 @@ function baseMetadata(input) {
 }
 
 // src/hooks/store-health.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
-import { join as join16 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname5, join as join23 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/failure.ts
+function statusOf(err) {
+  if (typeof err !== "object" || err === null || !("status" in err)) return null;
+  const { status } = err;
+  if (typeof status !== "number" || !Number.isInteger(status)) return null;
+  return status >= 100 && status <= 599 ? status : null;
+}
+function classifyFailure(err) {
+  switch (statusOf(err)) {
+    case 401:
+      return "unauthorized";
+    case 403:
+      return "forbidden";
+    default:
+      return "unreachable";
+  }
+}
 
-// ../../packages/plugin-runtime/src/standalone-gateway.ts
-import { randomUUID as randomUUID15 } from "crypto";
+// ../../packages/plugin-runtime/src/attached/forward-drops.ts
+import { readFileSync as readFileSync12 } from "fs";
+import { join as join18 } from "path";
+var FORWARD_DROPS_FILENAME = "attached-forward-drops.json";
+function forwardDropsPath(dataDir2) {
+  return join18(dataDir2, FORWARD_DROPS_FILENAME);
+}
+function recordForwardDrops(dataDir2, count, nowMs) {
+  if (count <= 0) return;
+  try {
+    ensureDataDirSync(dataDir2);
+    const previous = readForwardDrops(dataDir2);
+    const next = {
+      droppedForwards: (previous?.droppedForwards ?? 0) + count,
+      lastDropAtMs: nowMs
+    };
+    writeOwnerOnlyFileSync(forwardDropsPath(dataDir2), `${JSON.stringify(next)}
+`);
+  } catch {
+  }
+}
+function readForwardDrops(dataDir2) {
+  try {
+    const parsed2 = JSON.parse(readFileSync12(forwardDropsPath(dataDir2), "utf8"));
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    if (typeof record2.droppedForwards !== "number" || !Number.isFinite(record2.droppedForwards)) {
+      return null;
+    }
+    if (record2.droppedForwards <= 0) return null;
+    if (typeof record2.lastDropAtMs !== "number" || !Number.isFinite(record2.lastDropAtMs)) {
+      return null;
+    }
+    return { droppedForwards: record2.droppedForwards, lastDropAtMs: record2.lastDropAtMs };
+  } catch {
+    return null;
+  }
+}
 
-// ../../packages/plugin-runtime/src/recorder.ts
-var PLUGIN_RECORDER_BINARY = "plugin";
+// ../../packages/plugin-runtime/src/attached/forward-policy.ts
+import { randomUUID as randomUUID15 } from "crypto";
+import { readFileSync as readFileSync13 } from "fs";
+import { readFile, rename, writeFile } from "fs/promises";
+import { join as join19 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/with-timeout.ts
+var REQUEST_TIMEOUT_MS = 2e3;
+function withTimeout(promise2, ms) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error("attached gateway request timed out"));
+    }, ms);
+  });
+  promise2.catch(() => void 0);
+  return Promise.race([promise2, timeout]).finally(() => {
+    clearTimeout(timer);
+  });
+}
 
-// ../../packages/plugin-runtime/src/standalone-gateway.ts
-var StandaloneDataGateway = class {
-  db;
-  // Kept for the fingerprint key lookup (exception.key lives beside the store).
-  dataDir;
-  // One notice per gateway — see warnRulesetDiscarded.
-  warnedRulesetDiscarded = false;
-  constructor(dataDir2, detections = [], meta3) {
-    this.db = openLocalDatabase(dataDir2);
-    this.dataDir = dataDir2;
-    this.db.installedPacks.recordInventory(detections, meta3);
-  }
-  recordCapture(record2) {
-    this.db.recordCapture(record2.event, record2.findings);
-    return Promise.resolve();
+// ../../packages/plugin-runtime/src/attached/forward-policy.ts
+function isInvalidRequest(err) {
+  return typeof err === "object" && err !== null && err.name === "RemoteRequestInvalid";
+}
+var FORWARD_BUDGET_MS = 1500;
+var DECISION_PATH_BUDGET_MS = 800;
+var BREAKER_FAILURE_THRESHOLD = 3;
+var BREAKER_COOLDOWN_MS = 3e4;
+var CLOSED = { consecutiveFailures: 0, openedAtMs: null, lastFailure: null };
+var FAILURES = /* @__PURE__ */ new Set([
+  "unauthorized",
+  "forbidden",
+  "unreachable"
+]);
+var FORWARD_STATE_FILENAME = "attached-state.json";
+var STATE_FILENAME = FORWARD_STATE_FILENAME;
+function parseBreakerState(raw, nowMs) {
+  try {
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
+    const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
+    const lastFailure = typeof record2.lastFailure === "string" && FAILURES.has(record2.lastFailure) ? record2.lastFailure : null;
+    return { consecutiveFailures: failures, openedAtMs, lastFailure };
+  } catch {
+    return null;
   }
-  ensureInventory(ctx) {
-    return Promise.resolve(this.db.ensureInventory(ctx));
+}
+function createForwardPolicy(deps) {
+  const now = deps.now ?? (() => Date.now());
+  const file2 = join19(deps.dir, STATE_FILENAME);
+  let state = null;
+  let loading = null;
+  async function readState() {
+    let raw;
+    try {
+      raw = await readFile(file2, "utf8");
+    } catch {
+      return { ...CLOSED };
+    }
+    return parseBreakerState(raw, now()) ?? { ...CLOSED };
   }
-  recordAuditEvent(event) {
-    this.db.auditEvents.insertAuditEvent(event);
-    return Promise.resolve();
+  async function load() {
+    if (state !== null) return state;
+    loading ??= readState().then((loaded) => {
+      state = loaded;
+      loading = null;
+      return loaded;
+    });
+    return loading;
   }
-  // The id is minted inside the repository from the natural key — the plugin can't
-  // import @akasecurity/persistence to compute it, so the gateway is the boundary that
-  // hands the natural key across. UPSERT-take-MAX → idempotent re-reads that also
-  // converge a streaming partial/final split (see insertLlmCall).
-  recordLlmCall(input) {
-    this.db.auditEvents.insertLlmCall(input);
-    return Promise.resolve();
+  async function persist(next) {
+    state = next;
+    try {
+      await ensureDataDir(deps.dir);
+      const tmp = `${file2}.${randomUUID15()}.tmp`;
+      await writeFile(tmp, JSON.stringify(next), { encoding: "utf8", mode: DATA_FILE_MODE });
+      await rename(tmp, file2);
+    } catch {
+    }
   }
-  // One reconcile pass = one transaction. All leaves commit together
-  // (single lock + WAL fsync); a contended SQLITE_BUSY rolls back and rejects so the
-  // reconciler drops the whole pass and recovers it idempotently on the next read.
-  recordLlmCalls(inputs) {
-    if (inputs.length === 0) return Promise.resolve();
-    return new Promise((resolve, reject) => {
+  return {
+    async run(op, opts) {
+      const budget = opts?.decisionPath === true ? DECISION_PATH_BUDGET_MS : FORWARD_BUDGET_MS;
+      let current;
       try {
-        this.db.auditEvents.runInTransaction(() => {
-          for (const input of inputs) this.db.auditEvents.insertLlmCall(input);
+        current = await load();
+      } catch {
+        current = { ...CLOSED };
+      }
+      const at = now();
+      if (current.openedAtMs !== null) {
+        if (at - current.openedAtMs < BREAKER_COOLDOWN_MS) {
+          return { ok: false, reason: "breaker-open" };
+        }
+        await persist({
+          consecutiveFailures: current.consecutiveFailures,
+          openedAtMs: at,
+          lastFailure: current.lastFailure
         });
-        resolve();
-      } catch (err) {
-        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+      try {
+        const value = await withTimeout(op(), budget);
+        if (current.openedAtMs !== null || current.consecutiveFailures > 0) {
+          await persist({ ...CLOSED });
+        }
+        return { ok: true, value };
+      } catch (err) {
+        if (isInvalidRequest(err)) return { ok: false, reason: "invalid-request" };
+        const reason = classifyFailure(err);
+        const failures = current.consecutiveFailures + 1;
+        const shouldOpen = current.openedAtMs !== null || failures >= BREAKER_FAILURE_THRESHOLD;
+        await persist({
+          consecutiveFailures: failures,
+          openedAtMs: shouldOpen ? now() : null,
+          lastFailure: reason
+        });
+        return { ok: false, reason };
+      }
+    }
+  };
+}
+
+// ../../packages/plugin-runtime/src/attached/gateway.ts
+var ACTION_STRENGTH = {
+  allow: 0,
+  log: 1,
+  warn: 2,
+  redact: 3,
+  block: 4
+};
+function ruleCategoryMap(wireRules, localRules) {
+  const map2 = /* @__PURE__ */ new Map();
+  for (const rule of wireRules ?? []) map2.set(rule.id, rule.category);
+  for (const rule of localRules ?? []) map2.set(rule.id, rule.category);
+  for (const pack of bundledDetections()) {
+    for (const rule of pack.rules) map2.set(rule.id, rule.category);
+  }
+  return map2;
+}
+function strongerOf(a, b) {
+  if (a === null) return b;
+  if (b === null) return a;
+  return ACTION_STRENGTH[a] >= ACTION_STRENGTH[b] ? a : b;
+}
+function policyKey(policy) {
+  return "ruleId" in policy.target ? `rule:${policy.target.ruleId}` : `category:${policy.target.category}`;
+}
+function floorFor(policy, categoryByRuleId) {
+  const category = "category" in policy.target ? policy.target.category : categoryByRuleId.get(policy.target.ruleId);
+  return category === void 0 ? null : DEFAULT_ACTIONS[category];
+}
+function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
+  const merged = /* @__PURE__ */ new Map();
+  const disabled = [];
+  const remoteCategoryAction = /* @__PURE__ */ new Map();
+  for (const policy of remotePolicies) {
+    if (!policy.enabled) continue;
+    if (!("category" in policy.target)) continue;
+    if (remoteCategoryAction.has(policy.target.category)) continue;
+    const floor = floorFor(policy, categoryByRuleId);
+    remoteCategoryAction.set(
+      policy.target.category,
+      floor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[floor] ? floor : policy.action
+    );
+  }
+  for (const policy of localPolicies) {
+    if (!policy.enabled) {
+      disabled.push(policy);
+      continue;
+    }
+    const key = policyKey(policy);
+    if (merged.has(key)) continue;
+    let remoteFloor = null;
+    if ("ruleId" in policy.target) {
+      const category = categoryByRuleId.get(policy.target.ruleId);
+      if (category !== void 0) remoteFloor = remoteCategoryAction.get(category) ?? null;
+    }
+    merged.set(
+      key,
+      remoteFloor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[remoteFloor] ? { ...policy, action: remoteFloor } : policy
+    );
+  }
+  const localCategoryAction = /* @__PURE__ */ new Map();
+  for (const policy of merged.values()) {
+    if ("category" in policy.target) localCategoryAction.set(policy.target.category, policy.action);
+  }
+  for (const policy of remotePolicies) {
+    if (!policy.enabled) {
+      disabled.push(policy);
+      continue;
+    }
+    const key = policyKey(policy);
+    const floor = floorFor(policy, categoryByRuleId);
+    let localFloor = null;
+    if ("ruleId" in policy.target) {
+      const category = categoryByRuleId.get(policy.target.ruleId);
+      if (category !== void 0) localFloor = localCategoryAction.get(category) ?? null;
+    }
+    const effectiveFloor = strongerOf(floor, localFloor);
+    const clamped = effectiveFloor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[effectiveFloor] ? { ...policy, action: effectiveFloor } : policy;
+    const existing = merged.get(key);
+    if (existing === void 0) {
+      merged.set(key, clamped);
+      continue;
+    }
+    if (ACTION_STRENGTH[clamped.action] > ACTION_STRENGTH[existing.action]) {
+      merged.set(key, clamped);
+    }
+  }
+  return [...merged.values(), ...disabled];
+}
+var AttachedDataGateway = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  /**
+   * The control plane's OWN resolution of this session's inventory, captured by
+   * ensureInventory. Null until the first successful forward — and it stays
+   * null for the whole session when the control plane is unreachable, which is fine:
+   * reKeyForForward then leaves the event's ids alone and the control plane resolves
+   * what it can from the descriptors it already has.
+   */
+  remoteInventory = null;
+  // ---------------------------------------------------------------------
+  // Writes: local first, then forward.
+  // ---------------------------------------------------------------------
+  async recordCapture(record2) {
+    await this.deps.local.recordCapture(record2);
+    await this.deps.forward.run(
+      () => this.deps.client.ingestEvents({
+        events: [record2.event],
+        ...record2.dedupe ? { dedupe: record2.dedupe } : {}
+      }),
+      { decisionPath: true }
+    );
+  }
+  async ensureInventory(ctx) {
+    const resolved = await this.deps.local.ensureInventory(ctx);
+    const remote = await this.deps.forward.run(() => this.deps.client.ingestInventory(ctx));
+    this.remoteInventory = remote.ok ? remote.value : null;
+    const snapshot = await (async () => {
+      try {
+        return await this.deps.posture?.prepare() ?? null;
+      } catch {
+        return null;
+      }
+    })();
+    if (snapshot) {
+      try {
+        await withTimeout(
+          this.deps.posture?.send(snapshot) ?? Promise.resolve(),
+          REQUEST_TIMEOUT_MS
+        );
+      } catch {
+      }
+    }
+    return resolved;
+  }
+  // The id is minted CLIENT-side and stored verbatim: the control plane does NOT
+  // re-key it. `pgAuditValues` writes `id: event.id` and carries tenancy in
+  // its own scoping columns, so the device and the forwarded copy
+  // share one id space — which is what makes a re-post idempotent at all.
+  //
+  // Re-posts collapse via `onConflictDoUpdate` on the `id` PK, guarded by
+  // `setWhere eventType = 'session'` (NOT onConflictDoNothing). That guard is
+  // what makes an attached retry safe: a capture-stubbed session row can still
+  // be HEALED by the authoritative root, while a duplicate non-session event —
+  // a retried tool_call, exactly this path — can never stomp a populated row.
+  async recordAuditEvent(event) {
+    await this.deps.local.recordAuditEvent(event);
+    await this.deps.forward.run(
+      () => this.deps.client.recordAuditEvent(reKeyForForward(event, this.remoteInventory))
+    );
+  }
+  // Attached `llm_call` is written locally by the inner gateway, then routed to
+  // the control plane through the existing `recordAuditEvent` ingest (no dedicated
+  // client method yet) by pre-building the audit event from the natural key.
+  // The forward goes DIRECTLY to the client rather than through this.recordAuditEvent,
+  // which would write the event to the local store a second time.
+  async recordLlmCall(input) {
+    await this.deps.local.recordLlmCall(input);
+    await this.deps.forward.run(
+      () => this.deps.client.recordAuditEvent(
+        reKeyForForward(llmAuditEvent(input), this.remoteInventory)
+      )
+    );
+  }
+  /**
+   * Forward one batch, item by item, under ONE aggregate deadline.
+   *
+   * Per-item budgets bound each request and nothing bounded their sum — see
+   * BATCH_FORWARD_BUDGET_MS. When the deadline passes the remainder is dropped
+   * rather than sent: the local write has already succeeded, so every caller
+   * has a correct result to return, and a drop is the outcome this path is
+   * built to accept (G8) where a blown hook timeout is not.
+   *
+   * Serial rather than concurrent on purpose. Firing N requests at once would
+   * trade a latency problem for a burst the plane's own per-key rate limiting
+   * would answer with the refusals the breaker then counts.
+   *
+   * WHAT IS DROPPED IS COUNTED. Every other forward failure ends in
+   * `ForwardPolicy.run`'s catch and moves the breaker's file, which is what
+   * lets status call the forward unhealthy; this path returns BEFORE `run` is
+   * reached, so without the tally in `forward-drops.ts` a slow-but-answering
+   * plane produces no failures, keeps the breaker closed, renders a healthy
+   * block, and discards the tail of every batch indefinitely.
+   */
+  async forwardBatch(inputs, toEvent) {
+    const deadline = Date.now() + BATCH_FORWARD_BUDGET_MS;
+    for (let i = 0; i < inputs.length; i += 1) {
+      const now = Date.now();
+      if (now >= deadline) {
+        recordForwardDrops(this.deps.dataDir, inputs.length - i, now);
+        return;
+      }
+      const input = inputs[i];
+      await this.deps.forward.run(
+        () => this.deps.client.recordAuditEvent(reKeyForForward(toEvent(input), this.remoteInventory))
+      );
+    }
+  }
+  // Delegated as a BATCH rather than looped over recordLlmCall: the inner
+  // gateway may write the whole batch in one local transaction, and looping
+  // here would replace that with N separate local writes.
+  async recordLlmCalls(inputs) {
+    await this.deps.local.recordLlmCalls(inputs);
+    await this.forwardBatch(inputs, (input) => llmAuditEvent(input));
+  }
+  // `input.inspections` (secrets detected client-side in the tool's masked
+  // target) ride along on the request's `inspections` field — the control plane
+  // persists each as an inspection_findings row linked to this audit event
+  // (see RecordAuditEventRequest in @akasecurity/schema). The masked
+  // `target` already rides `input.attributes`, so no raw secret leaks either
+  // way — this only stops the FINDING row itself from being dropped.
+  async recordToolCalls(inputs) {
+    await this.deps.local.recordToolCalls(inputs);
+    await this.forwardBatch(inputs, (input) => toolAuditEvent(input));
+  }
+  // Forwarded as a `config_scan` audit event: there is no dedicated
+  // config-scan ingest endpoint, and the audit-event door is the one the
+  // control plane already opens for client-minted, idempotent records.
+  //
+  // ONLY `scanEvent` CROSSES, and unlike `recordCapture` the plane cannot
+  // re-derive the rest. A `ConfigScanRecord` is four things committed together
+  // locally — the inventory `items`, this audit event, and the posture
+  // `definitions`/`findings` that reference it — and three of them stay on the
+  // device. Say that plainly rather than let the asymmetry with `recordCapture`
+  // read as the same argument: there, findings are omitted BECAUSE the plane
+  // re-derives them from `Event.content`; here there is no content to re-derive
+  // from, so what is omitted is simply not sent.
+  //
+  // That is the wire contract as it stands rather than an oversight to patch
+  // here. `items` has no route at all, and `RecordAuditEventRequest.inspections`
+  // is documented as tool-call findings — widening it to carry config-scan
+  // findings is an egress change (a posture finding's `maskedMatch` holds the
+  // matched command) and a decision about what an attached deployment is
+  // entitled to, not a bug fix. An attached machine's config posture therefore
+  // reaches the plane as the event only; the dashboard's own view of it is the
+  // local store.
+  async recordConfigScan(record2) {
+    await this.deps.local.recordConfigScan(record2);
+    await this.deps.forward.run(
+      () => this.deps.client.recordAuditEvent(reKeyForForward(record2.scanEvent, this.remoteInventory))
+    );
+  }
+  async recordBlockedDetection(entry) {
+    return this.deps.local.recordBlockedDetection(entry);
+  }
+  /**
+   * LOCAL-ONLY, deliberately. The shares API is read-plus-decision-override
+   * with no egress ingest endpoint, so there is nothing to forward to; adding a
+   * forward here would be inventing a wire contract that does not exist. The
+   * local write is the whole operation, and its summary is the real one — the
+   * scanner reads a throw as a FAILED WRITE and skips its ledger commit, so
+   * returning the inner gateway's result keeps the retry semantics honest.
+   */
+  async recordProjectEgress(input) {
+    return this.deps.local.recordProjectEgress(input);
+  }
+  // ---------------------------------------------------------------------
+  // Reads and device-local ledgers: pure delegation.
+  // ---------------------------------------------------------------------
+  async configInventoryReport() {
+    return this.deps.local.configInventoryReport();
+  }
+  async readSessionProvider(sessionId) {
+    return this.deps.local.readSessionProvider(sessionId);
+  }
+  async facets() {
+    return this.deps.local.facets();
+  }
+  /**
+   * Delegated UNMODIFIED — including its refusals.
+   *
+   * This is a fail-secure boundary: it decides whether an approved exception
+   * lets a blocked action through. Under local-first the local store owns the
+   * exception ledger, so the honest answer is whatever it says; wrapping this
+   * in a fallback (`catch { return true }`, or defaulting on a timeout) would
+   * turn a store error into a granted bypass. If the inner gateway rejects,
+   * this rejects, and the runtime's own handling decides — which is asserted
+   * end-to-end through runtime.capture rather than here.
+   */
+  async consumeException(id) {
+    return this.deps.local.consumeException(id);
+  }
+  async recentFindings(opts) {
+    return this.deps.local.recentFindings(opts);
+  }
+  async healthSummary() {
+    return this.deps.local.healthSummary();
+  }
+  async activityByDay(days) {
+    return this.deps.local.activityByDay(days);
+  }
+  async tokenReports() {
+    return this.deps.local.tokenReports();
+  }
+  async knownContentHashes() {
+    return this.deps.local.knownContentHashes();
+  }
+  async scanLedger(rulesetHash) {
+    return this.deps.local.scanLedger(rulesetHash);
+  }
+  async recordScanned(entries) {
+    return this.deps.local.recordScanned(entries);
+  }
+  async getRuleProbeVerdict(ruleKey) {
+    return this.deps.local.getRuleProbeVerdict(ruleKey);
+  }
+  async setRuleProbeVerdict(ruleKey, verdict, worstProbeMs2) {
+    return this.deps.local.setRuleProbeVerdict(ruleKey, verdict, worstProbeMs2);
+  }
+  async openAtRestKeysForPath(path) {
+    return this.deps.local.openAtRestKeysForPath(path);
+  }
+  async resolvedAtRestKeysForPath(path) {
+    return this.deps.local.resolvedAtRestKeysForPath(path);
+  }
+  async insertResolution(input) {
+    return this.deps.local.insertResolution(input);
+  }
+  async close() {
+    return this.deps.local.close();
+  }
+  // ---------------------------------------------------------------------
+  // Policy
+  // ---------------------------------------------------------------------
+  async getPolicyBundle() {
+    const local = await this.deps.local.getPolicyBundle();
+    const cached2 = await (async () => {
+      try {
+        return await this.deps.readCachedBundle();
+      } catch {
+        return null;
+      }
+    })();
+    if (cached2 === null) return local;
+    const byRuleId = /* @__PURE__ */ new Map();
+    for (const rule of [...local.rules ?? [], ...cached2.rules ?? []]) {
+      if (!byRuleId.has(rule.id)) byRuleId.set(rule.id, rule);
+    }
+    const rules = [...byRuleId.values()];
+    return {
+      ...local,
+      // The remote version identifies the composed bundle for the poller.
+      version: cached2.version,
+      rules,
+      policies: mergeRaiseOnly(
+        local.policies,
+        cached2.policies,
+        ruleCategoryMap(cached2.rules, local.rules)
+      ),
+      customKeywords: [...local.customKeywords, ...cached2.customKeywords]
+      // `rulesComplete` is a STANDALONE-ONLY signal (the user's local installed
+      // snapshot) and is taken from the LOCAL bundle only — never from the wire
+      // or the on-disk cache. Honoring a cached one would hand the control plane, or
+      // anything able to write policy-cache.json, a kill-switch over the
+      // compiled-in bundled packs: `{ rulesComplete: true, rules: [] }` would
+      // zero local detection. Spread from `local` above, and deliberately not
+      // re-read from `cached` here.
+      //
+      // THREE MORE OF THE CACHED BUNDLE'S FIELDS ARE DROPPED, each on purpose,
+      // and each named here so a reader can tell a decision from an omission:
+      //
+      //   `exceptions`        — an exception SUPPRESSES a detection, so honoring
+      //                         one from an unsigned on-disk cache would let
+      //                         anything able to write that file turn rules off.
+      //                         Every other field this merge accepts can only
+      //                         RAISE enforcement; this is the one that cannot,
+      //                         so it stays local-only until the bundle is
+      //                         signed. Exceptions remain a device-local ledger.
+      //   `reversibleRuleIds` — the Redact & Vault archetype makes a redaction
+      //                         recoverable, which is a CUSTODY change: it puts
+      //                         the detected value in the local vault instead of
+      //                         destroying it. Taking that instruction from the
+      //                         cache would let a remote party turn one-way
+      //                         redaction into retention. Dropping it keeps the
+      //                         one-way behaviour, which the schema itself calls
+      //                         "the safe direction to default".
+      //   `ruleVersions`      — remote rules fall back to their own spec version.
+      //                         Cosmetic rather than protective: it only affects
+      //                         how a finding is version-attributed, and the two
+      //                         sides may therefore attribute org rules
+      //                         differently. Worth carrying once there is a
+      //                         reader that needs it; nothing reads it today.
+    };
+  }
+  // ---------------------------------------------------------------------
+  // LocalStoreMaintenance — by delegation (D3).
+  //
+  // Implementing these is what actually closes the skipped-local-maintenance
+  // gap: the OSS structural guard `hasLocalStoreMaintenance()` is satisfied by
+  // any object carrying all five, so the composite qualifies and SessionStart
+  // runs maintenance on the device's real store.
+  //
+  // ⚠ Two of the five are SYNCHRONOUS and must stay that way. `handle-session-start`
+  // calls `capWarnEraEnforcement` without `await` and uses `staleBinaryNotice`'s
+  // return value directly; declaring them `async` here would hand those call
+  // sites a Promise and silently break both.
+  // ---------------------------------------------------------------------
+  async sweepTerminalExceptions(retentionMs) {
+    return this.deps.local.sweepTerminalExceptions(retentionMs);
+  }
+  capWarnEraEnforcement(policyMode) {
+    return this.deps.local.capWarnEraEnforcement(policyMode);
+  }
+  async recordProjectFiles(projectId, scan2) {
+    return this.deps.local.recordProjectFiles(projectId, scan2);
+  }
+  async reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot) {
+    return this.deps.local.reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot);
+  }
+  staleBinaryNotice(currentVersion) {
+    return this.deps.local.staleBinaryNotice(currentVersion);
+  }
+};
+function reKeyForForward(event, remote) {
+  if (remote === null) {
+    const stripped = { ...event };
+    delete stripped.hostId;
+    delete stripped.harnessId;
+    delete stripped.sourceProjectId;
+    return stripped;
+  }
+  const rekeyed = { ...event };
+  delete rekeyed.hostId;
+  delete rekeyed.harnessId;
+  delete rekeyed.sourceProjectId;
+  if (remote.hostId !== void 0) rekeyed.hostId = remote.hostId;
+  if (remote.harnessId !== void 0) rekeyed.harnessId = remote.harnessId;
+  if (remote.sourceProjectId !== void 0) rekeyed.sourceProjectId = remote.sourceProjectId;
+  return rekeyed;
+}
+var BATCH_FORWARD_BUDGET_MS = 3e3;
+function llmAuditEvent(input) {
+  return {
+    id: llmCallId(input.sessionId, input.messageId),
+    eventType: "llm_call",
+    startedAt: input.startedAt,
+    parentId: input.parentId,
+    rootSessionId: input.rootSessionId,
+    attributes: input.attributes
+  };
+}
+function toolAuditEvent(input) {
+  return {
+    id: toolCallId(input.sessionId, input.toolUseId),
+    eventType: "tool_call",
+    startedAt: input.startedAt,
+    parentId: input.parentId,
+    rootSessionId: input.rootSessionId,
+    attributes: input.attributes,
+    inspections: input.inspections
+  };
+}
+
+// ../../packages/plugin-runtime/src/attached/policy-store.ts
+import { randomUUID as randomUUID16 } from "crypto";
+import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
+import { join as join20 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/atomic-publish.ts
+import { rename as rename2 } from "fs/promises";
+var RETRYABLE = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
+var ATTEMPTS = 5;
+var delay = (ms) => new Promise((resolve2) => {
+  setTimeout(resolve2, ms);
+});
+async function publishByRename(tmp, file2, move = rename2) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await move(tmp, file2);
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (attempt >= ATTEMPTS || code === void 0 || !RETRYABLE.has(code)) throw err;
+      await delay(attempt * 10);
+    }
+  }
+}
+
+// ../../packages/plugin-runtime/src/attached/policy-store.ts
+function createPolicyStore(dir = dataDir()) {
+  const file2 = join20(dir, "policy-cache.json");
+  async function read() {
+    try {
+      const raw = await readFile2(file2, "utf8");
+      const parsed2 = JSON.parse(raw);
+      if (typeof parsed2 !== "object" || parsed2 === null) return null;
+      const record2 = parsed2;
+      const bundle = PolicyBundle.parse(record2.bundle);
+      const fetchedAtMs = typeof record2.fetchedAtMs === "number" ? record2.fetchedAtMs : 0;
+      const etag = typeof record2.etag === "string" ? record2.etag : void 0;
+      return { bundle, fetchedAtMs, ...etag === void 0 ? {} : { etag } };
+    } catch {
+      return null;
+    }
+  }
+  async function write(bundle, etag) {
+    await ensureDataDir(dir);
+    const stored = {
+      bundle,
+      fetchedAtMs: Date.now(),
+      ...etag === void 0 ? {} : { etag }
+    };
+    const tmp = `${file2}.${randomUUID16()}.tmp`;
+    try {
+      await writeFile2(tmp, JSON.stringify(stored), {
+        encoding: "utf8",
+        mode: DATA_FILE_MODE,
+        flag: "wx"
+      });
+      await publishByRename(tmp, file2);
+    } catch (err) {
+      await rm(tmp, { force: true }).catch(() => void 0);
+      throw err;
+    }
+  }
+  return { read, write, file: file2 };
+}
+
+// ../../packages/remote/src/http.ts
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+var RemoteRequestError = class extends Error {
+  constructor(status) {
+    super(`control-plane request failed with status ${String(status)}`);
+    this.status = status;
+    this.name = "RemoteRequestError";
+  }
+  status;
+};
+var RemoteRequestInvalid = class extends Error {
+  constructor(route, cause) {
+    super(`refusing to send a malformed body to ${route}`);
+    this.cause = cause;
+    this.name = "RemoteRequestInvalid";
+  }
+  cause;
+};
+var RemoteResponseInvalid = class extends Error {
+  constructor(route, detail) {
+    super(`control plane answered ${route} with ${detail}`);
+    this.name = "RemoteResponseInvalid";
+  }
+};
+var RemoteTransportError = class extends Error {
+  /**
+   * The status the peer sent, when headers arrived and only the BODY was
+   * refused.
+   *
+   * Undefined for the ordinary case this class was written for — no answer at
+   * all. It exists because two paths reject after a status has already been
+   * delivered: an oversized body and an aborted response. Discarding it there
+   * reported a deployment answering 401 with a verbose body as a network
+   * outage, which sends the reader to look at their network instead of their
+   * credential.
+   */
+  constructor(reason, status) {
+    super(`control-plane request did not complete: ${reason}`);
+    this.status = status;
+    this.name = "RemoteTransportError";
+  }
+  status;
+};
+async function send(options) {
+  const url2 = new URL(options.url);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const send_ = url2.protocol === "http:" ? httpRequest : httpsRequest;
+  const requestOptions = {
+    method: options.method,
+    headers: {
+      // CALLER HEADERS FIRST, so this module's own are not overridable. Spread
+      // last they win, and two of the values below are ones no caller may
+      // replace: `x-api-key` is the credential, and `content-length` is the
+      // byte count that stops a multi-byte body being truncated by the
+      // receiver. `SendOptions.headers` is a free-form record on an exported
+      // function, so "no caller does that today" is not the guarantee to rely
+      // on. The one header any caller actually passes — `if-none-match` on the
+      // conditional GET — is untouched by this order.
+      ...options.headers,
+      // The credential. One header, matching what the deployment authenticates
+      // on; a second copy in an `Authorization` header would be one more place
+      // it can be logged by an intermediary for no gain.
+      "x-api-key": options.apiKey,
+      accept: "application/json",
+      ...options.body === void 0 ? {} : {
+        "content-type": "application/json",
+        // Byte length, not string length: a multi-byte body sent with a
+        // character count is truncated by the receiver.
+        "content-length": String(Buffer.byteLength(options.body))
+      }
+    }
+  };
+  return new Promise((resolve2, reject) => {
+    let settled = false;
+    const fail = (reason, status) => {
+      if (settled) return;
+      settled = true;
+      reject(new RemoteTransportError(reason, status));
+    };
+    const req = send_(url2, requestOptions, (res) => {
+      const chunks = [];
+      let size = 0;
+      res.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_RESPONSE_BYTES) {
+          fail(`response exceeded ${String(MAX_RESPONSE_BYTES)} bytes`, res.statusCode);
+          res.destroy();
+          req.destroy();
+          return;
+        }
+        chunks.push(chunk);
+      });
+      res.on("aborted", () => {
+        fail("the response was aborted", res.statusCode);
+      });
+      res.on("end", () => {
+        if (settled) return;
+        settled = true;
+        resolve2({
+          status: res.statusCode ?? 0,
+          headers: res.headers,
+          body: Buffer.concat(chunks).toString("utf8")
+        });
+      });
+    });
+    const deadline = setTimeout(() => {
+      fail(`no response within ${String(timeoutMs)}ms`);
+      req.destroy();
+    }, timeoutMs);
+    deadline.unref();
+    req.on("upgrade", (_res, socket) => {
+      fail("the deployment answered with a protocol upgrade");
+      socket.destroy();
+    });
+    req.on("close", () => {
+      fail("the connection closed before a response was read");
+      clearTimeout(deadline);
+    });
+    req.on("error", (err) => {
+      fail(err.message);
+    });
+    if (options.body !== void 0) req.write(options.body);
+    req.end();
+  });
+}
+
+// ../../packages/remote/src/client.ts
+var ROUTES = {
+  events: "/v1/events",
+  auditEvents: "/v1/audit-events",
+  inventory: "/v1/inventory",
+  storePosture: "/v1/store-posture",
+  policyBundle: "/v1/policy-bundle",
+  whoami: "/v1/plugin/whoami"
+};
+function headerValue(response, name) {
+  const raw = response.headers[name];
+  if (raw === void 0) return void 0;
+  return Array.isArray(raw) ? raw[0] : raw;
+}
+function okBody(response) {
+  if (response.status < 200 || response.status >= 300) {
+    throw new RemoteRequestError(response.status);
+  }
+  return response.body;
+}
+function parsed(schema, body, route) {
+  let json2;
+  try {
+    json2 = JSON.parse(body);
+  } catch {
+    throw new RemoteResponseInvalid(route, "a body that is not JSON");
+  }
+  const result = schema.safeParse(json2);
+  if (!result.success) {
+    throw new RemoteResponseInvalid(route, "a body this client cannot read");
+  }
+  return result.data;
+}
+function withoutTrailingSlashes(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
+  return endpoint.slice(0, end);
+}
+var SLASH = "/".charCodeAt(0);
+function createRemoteClient(options) {
+  const base = withoutTrailingSlashes(options.endpoint);
+  const url2 = (route) => `${base}${route}`;
+  const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
+  return {
+    async ingestEvents(batch) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.events),
+        body: JSON.stringify(batch)
+      });
+      return parsed(IngestAck, okBody(response), ROUTES.events);
+    },
+    async ingestInventory(context) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.inventory),
+        body: JSON.stringify(context)
+      });
+      return parsed(ResolvedInventory, okBody(response), ROUTES.inventory);
+    },
+    async recordAuditEvent(event) {
+      const validated = RecordAuditEventRequest.safeParse(event);
+      if (!validated.success) throw new RemoteRequestInvalid(ROUTES.auditEvents, validated.error);
+      const submission = validated.data;
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.auditEvents),
+        body: JSON.stringify(submission)
+      });
+      okBody(response);
+    },
+    async reportStorePosture(snapshot) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.storePosture),
+        body: JSON.stringify(snapshot)
+      });
+      okBody(response);
+    },
+    async getPolicyBundle(etag) {
+      const response = await send({
+        ...common,
+        method: "GET",
+        url: url2(ROUTES.policyBundle),
+        ...etag === void 0 ? {} : { headers: { "if-none-match": etag } }
+      });
+      if (response.status === 304) {
+        return { changed: false, etag: headerValue(response, "etag") ?? etag };
+      }
+      const bundle = parsed(PolicyBundle, okBody(response), ROUTES.policyBundle);
+      return { changed: true, bundle, etag: headerValue(response, "etag") };
+    },
+    async whoami() {
+      const response = await send({ ...common, method: "GET", url: url2(ROUTES.whoami) });
+      return parsed(PluginWhoami, okBody(response), ROUTES.whoami);
+    }
+  };
+}
+
+// ../../packages/plugin-runtime/src/attached/posture-reporter.ts
+var POSTURE_REPORT_INTERVAL_MS = 60 * 60 * 1e3;
+function createPostureReporter(deps) {
+  async function prepare() {
+    try {
+      const state = await withTimeout(deps.store.read(), REQUEST_TIMEOUT_MS);
+      if (state === null) return null;
+      const nowMs = deps.now();
+      const elapsed = nowMs - state.lastAttemptedAtMs;
+      if (elapsed >= 0 && elapsed < POSTURE_REPORT_INTERVAL_MS) return null;
+      try {
+        await withTimeout(deps.store.markAttempted(state.deviceId, nowMs), REQUEST_TIMEOUT_MS);
+      } catch {
+      }
+      const { readError, ...measurement } = deps.readStore();
+      if (readError) return null;
+      let plugin;
+      try {
+        plugin = await deps.pluginBlock?.();
+      } catch {
+        plugin = void 0;
+      }
+      return {
+        deviceId: state.deviceId,
+        hostname: deps.hostname(),
+        capturedAt: nowMs,
+        ...measurement,
+        // Omit the key rather than spread an explicit `undefined` —
+        // exactOptionalPropertyTypes distinguishes the two, and the bridge in
+        // factory.ts keys on presence.
+        ...plugin === void 0 ? {} : { plugin }
+      };
+    } catch {
+      return null;
+    }
+  }
+  async function send2(snapshot) {
+    try {
+      await deps.report(snapshot);
+    } catch {
+    }
+  }
+  return { prepare, send: send2 };
+}
+
+// ../../packages/plugin-runtime/src/attached/posture-snapshot.ts
+import { statSync as statSync9 } from "fs";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+
+// ../../packages/plugin-runtime/src/attached/action-counts.ts
+function emptyActionCounts() {
+  return Object.fromEntries(ACTION_TAKEN_KEYS.map((a) => [a, 0]));
+}
+function isActionTaken(value) {
+  return ACTION_TAKEN_KEYS.includes(value);
+}
+
+// ../../packages/plugin-runtime/src/attached/posture-snapshot.ts
+var CAPTURE_EVENT_TYPES_SQL2 = `('prompt','response','code_change','tool_use')`;
+function isSchemaAbsent(err) {
+  return err instanceof Error && /no such table/i.test(err.message);
+}
+function emptyReadout(readError = false) {
+  const byAction = emptyActionCounts();
+  return {
+    storePresent: false,
+    schemaVersion: null,
+    findingsTotal: 0,
+    findingsFirstAt: null,
+    findingsLastAt: null,
+    packs: [],
+    policyCounts: { total: 0, disabled: 0, byAction },
+    readError
+  };
+}
+function readStorePosture(dbPath2) {
+  try {
+    statSync9(dbPath2);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return emptyReadout();
+    return emptyReadout(true);
+  }
+  let db = null;
+  let version2 = null;
+  let packs2 = [];
+  let policyCounts = {
+    total: 0,
+    disabled: 0,
+    byAction: emptyActionCounts()
+  };
+  let findingsTotal = 0;
+  let findingsFirstAt = null;
+  let findingsLastAt = null;
+  const currentReadout = () => ({
+    storePresent: true,
+    schemaVersion: version2,
+    findingsTotal,
+    findingsFirstAt,
+    findingsLastAt,
+    packs: packs2,
+    policyCounts,
+    readError: false
+  });
+  try {
+    db = new DatabaseSync3(dbPath2, { readOnly: true });
+    db.exec("PRAGMA busy_timeout = 2000");
+    version2 = db.prepare("PRAGMA user_version").get().user_version;
+    try {
+      const packRows = db.prepare(
+        `SELECT namespace, pack_id, version, enabled, updated_at FROM installed_packs ORDER BY namespace, pack_id`
+      ).all();
+      packs2 = packRows.map((r) => ({
+        packId: `${r.namespace}/${r.pack_id}`,
+        version: r.version,
+        enabled: r.enabled !== 0,
+        updatedAt: r.updated_at == null ? null : String(r.updated_at)
+      }));
+    } catch (err) {
+      if (!isSchemaAbsent(err)) throw err;
+    }
+    try {
+      const policyRows = db.prepare(`SELECT action, enabled FROM policies`).all();
+      const byAction = emptyActionCounts();
+      let disabled = 0;
+      for (const row of policyRows) {
+        if (row.enabled === 0) disabled += 1;
+        if (isActionTaken(row.action)) byAction[row.action] += 1;
+      }
+      policyCounts = { total: policyRows.length, disabled, byAction };
+    } catch (err) {
+      if (!isSchemaAbsent(err)) throw err;
+    }
+    try {
+      const agg = db.prepare(
+        `SELECT count(*) AS n, min(f.first_detected_at) AS firstAt, max(f.first_detected_at) AS lastAt
+             FROM inspection_findings f JOIN audit_events e ON e.id = f.audit_event_id
+            WHERE e.event_type IN ${CAPTURE_EVENT_TYPES_SQL2}`
+      ).get();
+      findingsTotal = agg.n;
+      findingsFirstAt = agg.firstAt;
+      findingsLastAt = agg.lastAt;
+    } catch (err) {
+      if (!isSchemaAbsent(err)) throw err;
+    }
+    return currentReadout();
+  } catch {
+    return emptyReadout(true);
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+}
+
+// ../../packages/plugin-runtime/src/attached/posture-store.ts
+import { randomUUID as randomUUID17 } from "crypto";
+import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { join as join21 } from "path";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function createPostureStore(dir = settingsDir(), legacyDir) {
+  const file2 = join21(dir, "posture-state.json");
+  const legacyFile = legacyDir === void 0 ? null : join21(legacyDir, "posture-state.json");
+  async function persist(state) {
+    await ensureDataDir(dir);
+    const tmp = `${file2}.${randomUUID17()}.tmp`;
+    try {
+      await writeFile3(tmp, JSON.stringify(state), { encoding: "utf8", mode: DATA_FILE_MODE });
+      await publishByRename(tmp, file2);
+    } catch (err) {
+      await rm2(tmp, { force: true }).catch(() => void 0);
+      throw err;
+    }
+  }
+  async function readFrom(path) {
+    let raw;
+    try {
+      raw = await readFile3(path, "utf8");
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT" || code === "ENOTDIR") return null;
+      throw err;
+    }
+    try {
+      const parsed2 = JSON.parse(raw);
+      if (typeof parsed2 === "object" && parsed2 !== null) {
+        const record2 = parsed2;
+        if (typeof record2.deviceId === "string" && UUID_RE.test(record2.deviceId)) {
+          const stamp = typeof record2.lastAttemptedAtMs === "number" ? record2.lastAttemptedAtMs : typeof record2.lastReportedAtMs === "number" ? record2.lastReportedAtMs : 0;
+          return { deviceId: record2.deviceId, lastAttemptedAtMs: stamp };
+        }
+      }
+    } catch {
+    }
+    return null;
+  }
+  async function read() {
+    const current = await readFrom(file2);
+    if (current) return current;
+    const legacy = legacyFile === null || legacyFile === file2 ? null : await readFrom(legacyFile).catch(() => null);
+    if (legacy) {
+      try {
+        await persist(legacy);
+      } catch {
+      }
+      return legacy;
+    }
+    const fresh = { deviceId: randomUUID17(), lastAttemptedAtMs: 0 };
+    try {
+      await ensureDataDir(dir);
+      if (createOwnerOnlyFileSync(file2, JSON.stringify(fresh))) return fresh;
+    } catch {
+      return null;
+    }
+    const winner = await readFrom(file2).catch(() => null);
+    if (winner) return winner;
+    try {
+      await persist(fresh);
+    } catch {
+      return null;
+    }
+    return fresh;
+  }
+  async function markAttempted(deviceId, atMs) {
+    await persist({ deviceId, lastAttemptedAtMs: atMs });
+  }
+  return { read, markAttempted, file: file2 };
+}
+
+// ../../packages/plugin-runtime/src/attached/sync-state.ts
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join22 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/status.ts
+var REFUSAL_LINES = {
+  unauthorized: "KEY REJECTED \u2014 re-attach with a valid plugin key",
+  forbidden: "ACCESS REFUSED \u2014 key is valid but not permitted; ask your org admin"
+};
+var OUTCOME_LINES = {
+  ok: "policy synced",
+  "not-modified": "policy up to date",
+  unauthorized: REFUSAL_LINES.unauthorized,
+  forbidden: REFUSAL_LINES.forbidden,
+  unreachable: "control plane unreachable at last attempt",
+  "invalid-bundle": "control plane sent a policy bundle this build cannot read"
+};
+
+// ../../packages/plugin-runtime/src/attached/sync-trigger.ts
+import { spawn } from "child_process";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var SYNC_THROTTLE_MS = 15 * 60 * 1e3;
+
+// ../../packages/plugin-runtime/src/attached/factory.ts
+import { hostname as hostname5 } from "os";
+
+// ../../packages/plugin-runtime/src/standalone-gateway.ts
+import { randomUUID as randomUUID18 } from "crypto";
+
+// ../../packages/plugin-runtime/src/recorder.ts
+var PLUGIN_RECORDER_BINARY = "plugin";
+
+// ../../packages/plugin-runtime/src/standalone-gateway.ts
+var StandaloneDataGateway = class {
+  db;
+  // Kept for the fingerprint key lookup (exception.key lives beside the store).
+  dataDir;
+  // One notice per gateway — see warnRulesetDiscarded.
+  warnedRulesetDiscarded = false;
+  constructor(dataDir2, detections = [], meta3) {
+    this.db = openLocalDatabase(dataDir2);
+    this.dataDir = dataDir2;
+    this.db.installedPacks.recordInventory(detections, meta3);
+  }
+  recordCapture(record2) {
+    this.db.recordCapture(record2.event, record2.findings);
+    return Promise.resolve();
+  }
+  ensureInventory(ctx) {
+    return Promise.resolve(this.db.ensureInventory(ctx));
+  }
+  recordAuditEvent(event) {
+    this.db.auditEvents.insertAuditEvent(event);
+    return Promise.resolve();
+  }
+  // The id is minted inside the repository from the natural key — the plugin can't
+  // import @akasecurity/persistence to compute it, so the gateway is the boundary that
+  // hands the natural key across. UPSERT-take-MAX → idempotent re-reads that also
+  // converge a streaming partial/final split (see insertLlmCall).
+  recordLlmCall(input) {
+    this.db.auditEvents.insertLlmCall(input);
+    return Promise.resolve();
+  }
+  // One reconcile pass = one transaction. All leaves commit together
+  // (single lock + WAL fsync); a contended SQLITE_BUSY rolls back and rejects so the
+  // reconciler drops the whole pass and recovers it idempotently on the next read.
+  recordLlmCalls(inputs) {
+    if (inputs.length === 0) return Promise.resolve();
+    return new Promise((resolve2, reject) => {
+      try {
+        this.db.auditEvents.runInTransaction(() => {
+          for (const input of inputs) this.db.auditEvents.insertLlmCall(input);
+        });
+        resolve2();
+      } catch (err) {
+        reject(err instanceof Error ? err : new Error(String(err)));
       }
     });
   }
@@ -31648,12 +33110,12 @@ var StandaloneDataGateway = class {
   // drops the whole pass and recovers it idempotently next time.
   recordToolCalls(inputs) {
     if (inputs.length === 0) return Promise.resolve();
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         this.db.auditEvents.runInTransaction(() => {
           for (const input of inputs) this.writeToolCall(input);
         });
-        resolve();
+        resolve2();
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -31795,7 +33257,7 @@ var StandaloneDataGateway = class {
     const customKeywords = [...new Set(policies.flatMap((p) => p.customKeywords ?? []))];
     const installed = this.installedScanRules();
     const rulePolicies = installed ? [...installed.ruleActions].map(([ruleId, action]) => ({
-      id: randomUUID15(),
+      id: randomUUID18(),
       scope: "global",
       target: { ruleId },
       action,
@@ -31949,19 +33411,66 @@ var StandaloneDataGateway = class {
   }
 };
 
+// ../../packages/plugin-runtime/src/attached/factory.ts
+function resolveGatewayForConfig(config2, meta3) {
+  const local = new StandaloneDataGateway(config2.dataDir, bundledDetections(), meta3);
+  try {
+    if (!isAttached(config2.settings)) return local;
+    const connection = config2.settings.controlPlane;
+    if (connection === void 0) return local;
+    const state = readControlPlaneCredentialState(config2.settingsDir, connection);
+    if (!state.usable) return local;
+    const client = createRemoteClient({
+      endpoint: connection.endpoint,
+      apiKey: state.credential.apiKey
+    });
+    const store = createPolicyStore(config2.dataDir);
+    const postureStore = createPostureStore(config2.settingsDir, config2.dataDir);
+    const forward = createForwardPolicy({ dir: config2.dataDir });
+    return new AttachedDataGateway({
+      local,
+      client,
+      dataDir: config2.dataDir,
+      readCachedBundle: () => store.read().then((cached2) => cached2?.bundle ?? null),
+      forward,
+      posture: createPostureReporter({
+        // THROUGH THE BREAKER, and wrapped HERE rather than around
+        // `PostureReporter.send`. The reporter swallows every error by
+        // contract, so a wrap outside it would hand `forward.run` a resolved
+        // promise for a send that failed — recording a SUCCESS, clearing
+        // `consecutiveFailures` and `lastFailure`, and telling `aka status` the
+        // forward recovered when nothing did. Wrapping the raw client call puts
+        // the breaker above the swallow, where it can see the truth.
+        //
+        // What it buys: once the breaker is open — the plane already confirmed
+        // down by the gateway's own writes — this stops paying a request
+        // timeout per throttle interval to re-learn it.
+        report: (snapshot) => forward.run(() => client.reportStorePosture(snapshot)).then(() => void 0),
+        store: postureStore,
+        readStore: () => readStorePosture(config2.dbPath),
+        hostname: () => hostname5(),
+        now: () => Date.now()
+      })
+    });
+  } catch {
+    return local;
+  }
+}
+
 // ../../packages/plugin-runtime/src/resolve.ts
-var standaloneGatewayFactory = (config2, meta3) => new StandaloneDataGateway(config2.dataDir, bundledDetections(), meta3);
-var defaultGatewayFactory = standaloneGatewayFactory;
+var configuredGatewayFactory = (config2, meta3) => resolveGatewayForConfig(config2, meta3);
+var defaultGatewayFactory = configuredGatewayFactory;
 function resolveDataGateway(config2, meta3, gatewayFactory = defaultGatewayFactory) {
   return gatewayFactory(config2, meta3);
 }
 
 // ../../packages/plugin-runtime/src/handle-session-start.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/hooks/store-health.ts
 var STORE_WARNING_MARKER = "store-warning-last-session";
+var STORE_REDIRECT_MARKER = "store-redirect-last-session";
 function openGatewayOrNull(config2) {
   try {
     return resolveDataGateway(config2);
@@ -31974,17 +33483,64 @@ function storeUnavailableMessage(dbPath2) {
 }
 function claimStoreUnavailableWarning(dataDir2, sessionId) {
   if (!sessionId) return true;
-  const path = join16(dataDir2, STORE_WARNING_MARKER);
-  try {
-    if (readFileSync11(path, "utf8") === sessionId) return false;
-  } catch {
+  const dirs = markerDirs(dataDir2);
+  if (alreadyClaimed(dirs, STORE_WARNING_MARKER, sessionId)) return false;
+  recordClaim(dirs, STORE_WARNING_MARKER, sessionId);
+  return true;
+}
+function markerDirs(dataDir2) {
+  return [dataDir2, dirname5(dataDir2)];
+}
+function alreadyClaimed(dirs, marker, sessionId) {
+  return dirs.some((dir) => {
+    try {
+      return readFileSync15(join23(dir, marker), "utf8") === sessionId;
+    } catch {
+      return false;
+    }
+  });
+}
+function recordClaim(dirs, marker, sessionId) {
+  for (const dir of dirs) {
+    try {
+      mkdirSync5(dir, { recursive: true, mode: DATA_DIR_MODE });
+      writeFileSync8(join23(dir, marker), sessionId, { mode: DATA_FILE_MODE });
+      return;
+    } catch {
+    }
   }
+}
+function storeRedirectedMessage(paths, platform2 = process.platform) {
+  const where = paths.map(({ path, target, holds, missing, mode }) => {
+    if (missing) return `${path} -> ${target} (which does not exist; ${holds} cannot land there)`;
+    const loose = mode !== void 0 && (mode & 63) !== 0 ? ", NOT owner-only" : "";
+    const inherited = mode === void 0 ? "" : ` (${formatMode(mode)}${loose})`;
+    return `${path} -> ${target}${inherited}, holding ${holds}`;
+  }).join("; ");
+  const subject = paths.length === 1 ? "a store path is a symlink" : `${String(paths.length)} store paths are symlinks`;
+  const anyResolves = paths.some(({ missing }) => !missing);
+  const lead = anyResolves ? `${subject}, so AKA is writing into the target instead: ${where}. ` : `${subject} resolving nowhere, so AKA cannot write there: ${where}. `;
+  const kept = anyResolves && platform2 !== "win32" ? "Permissions are never changed through a symlink, so the store keeps whatever the target already had. " : "";
+  return `[aka] ${lead}${kept}If you did not create that link, treat it as untrusted and run \`aka init\` for the full report.
+`;
+}
+function formatMode(mode) {
+  return `0${mode.toString(8).padStart(3, "0")}`;
+}
+function warnIfStoreRedirected(config2, sessionId, write = (message) => void process.stderr.write(message)) {
   try {
-    mkdirSync5(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    writeFileSync8(path, sessionId, { mode: DATA_FILE_MODE });
+    const paths = symlinkedStorePaths(dirname5(config2.dataDir));
+    if (paths.length === 0) return;
+    if (!sessionId) {
+      write(storeRedirectedMessage(paths));
+      return;
+    }
+    const dirs = markerDirs(config2.dataDir);
+    if (alreadyClaimed(dirs, STORE_REDIRECT_MARKER, sessionId)) return;
+    write(storeRedirectedMessage(paths));
+    recordClaim(dirs, STORE_REDIRECT_MARKER, sessionId);
   } catch {
   }
-  return true;
 }
 
 // src/hooks/pre-tool-use.ts
@@ -31999,6 +33555,7 @@ async function main() {
   if (fields.length === 0) return;
   const config2 = loadConfig();
   const sessionId = getString(input, "session_id");
+  warnIfStoreRedirected(config2, sessionId);
   const consented = isVaultConsentValid(config2.settings.vaultConsent);
   const vaultGlue = consented ? createVaultGlue() : null;
   const pointerFields = [];