@akasecurity/ai-tc-claude-code 0.9.7 → 0.9.8

package/scripts/session-start.js

@@ -50,7 +50,7 @@ var require_ignore = __commonJS({
     var REGEX_SPLITALL_CRLF = /\r?\n/g;
     var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
     var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH = "/";
+    var SLASH2 = "/";
     var TMP_KEY_IGNORE = "node-ignore";
     if (typeof Symbol !== "undefined") {
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
@@ -422,11 +422,11 @@ var require_ignore = __commonJS({
         if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
           return this.test(path);
         }
-        const slices = path.split(SLASH).filter(Boolean);
+        const slices = path.split(SLASH2).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
-            slices.join(SLASH) + SLASH,
+            slices.join(SLASH2) + SLASH2,
             this._testCache,
             true,
             slices
@@ -442,14 +442,14 @@ var require_ignore = __commonJS({
           return cache[path];
         }
         if (!slices) {
-          slices = path.split(SLASH).filter(Boolean);
+          slices = path.split(SLASH2).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
           return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
-          slices.join(SLASH) + SLASH,
+          slices.join(SLASH2) + SLASH2,
           cache,
           checkUnignored,
           slices
@@ -492,16 +492,33 @@ var require_ignore = __commonJS({
 });
 
 // src/hooks/session-start.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
+
+// ../../packages/plugin-runtime/src/attached/failure.ts
+function statusOf(err) {
+  if (typeof err !== "object" || err === null || !("status" in err)) return null;
+  const { status } = err;
+  if (typeof status !== "number" || !Number.isInteger(status)) return null;
+  return status >= 100 && status <= 599 ? status : null;
+}
+function classifyFailure(err) {
+  switch (statusOf(err)) {
+    case 401:
+      return "unauthorized";
+    case 403:
+      return "forbidden";
+    default:
+      return "unreachable";
+  }
+}
 
-// ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join8 } from "path";
+// ../../packages/plugin-runtime/src/attached/forward-drops.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join10 } from "path";
 
-// ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join2, sep } from "path";
-import { DatabaseSync } from "node:sqlite";
+// ../../packages/persistence/src/control-plane-credential.ts
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync, rmSync as rmSync2, statSync } from "fs";
+import { join } from "path";
 
 // ../../packages/schema/src/drizzle/sqlite-ddl.ts
 var SQLITE_MIGRATIONS = [
@@ -16322,6 +16339,125 @@ var ConfigScanRecord = external_exports.object({
   findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
 
+// ../../packages/schema/src/zod/control-plane.ts
+var ATTACHED_CREDENTIAL_FILENAME = "control-plane-credential.json";
+var ATTACHED_CREDENTIAL_SPEC_VERSION = 1;
+var AttachedCredential = external_exports.object({
+  specVersion: external_exports.literal(ATTACHED_CREDENTIAL_SPEC_VERSION),
+  // The control-plane endpoint this credential was minted against.
+  endpoint: external_exports.string().min(1),
+  // The bearer credential itself. Never logged, never rendered — status
+  // surfaces show `keyPrefix` and nothing else.
+  apiKey: external_exports.string().min(1),
+  // First few characters of the key, safe to display so a user can match the
+  // credential against their organization's key list.
+  keyPrefix: external_exports.string().min(1).max(16).optional(),
+  mintedAt: external_exports.iso.datetime().optional()
+});
+var MAX_DATE_MS = 253402300799999;
+var MAX_INT4 = 2147483647;
+var StorePosturePack = external_exports.object({
+  packId: external_exports.string().min(1),
+  // 'namespace/packId'
+  version: external_exports.string().min(1),
+  enabled: external_exports.boolean(),
+  // Stringified pass-through of the local store's `installed_packs.updated_at`
+  // — the column format is store-version-dependent (epoch millis vs ISO), so
+  // the wire shape assumes neither.
+  updatedAt: external_exports.string().nullable()
+}).meta({ id: "StorePosturePack" });
+var StorePosturePolicyCounts = external_exports.object({
+  total: external_exports.number().int().min(0),
+  disabled: external_exports.number().int().min(0),
+  // Exhaustive per-action map; the builder pre-fills every action with 0.
+  //
+  // Spelled out member-by-member rather than `z.record(ActionTaken, …)`. Zod
+  // enforces exhaustiveness either way, but z.record emits `propertyNames` +
+  // `additionalProperties` into a generated schema document, and a type
+  // generator renders THAT with every key optional — a sender built against
+  // the generated type would typecheck and still be rejected at runtime. An
+  // explicit object emits `properties` + `required`, so generated types
+  // demand all five.
+  //
+  // `satisfies Record<ActionTaken, …>` keeps the link to the enum: adding an
+  // ActionTaken member is a COMPILE error here instead of silent drift.
+  // `.strict()` is load-bearing — it rejects an unknown action key, which a
+  // bare object would silently STRIP, accepting a miscounted map as valid.
+  byAction: external_exports.object({
+    warn: external_exports.number().int().min(0),
+    redact: external_exports.number().int().min(0),
+    block: external_exports.number().int().min(0),
+    allow: external_exports.number().int().min(0),
+    log: external_exports.number().int().min(0)
+  }).strict()
+}).meta({ id: "StorePosturePolicyCounts" });
+var StorePosturePlugin = external_exports.object({
+  /** Package name of the reporting plugin. */
+  package: external_exports.string().min(1).max(200),
+  version: external_exports.string().min(1).max(64),
+  /** Version of the bundled core, when the build records one separately. */
+  ossVersion: external_exports.string().max(64).nullable(),
+  /**
+   * `version` of the policy bundle this machine last fetched. Bounded at 200
+   * rather than the 64 a bare sha256 hex digest needs today, so a later
+   * format with an algorithm prefix does not start rejecting the channel.
+   */
+  policyBundleVersion: external_exports.string().max(200).nullable(),
+  /** Epoch millis, on the CLIENT clock, of that fetch. */
+  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable()
+}).meta({ id: "StorePosturePlugin" });
+var StorePostureSnapshot = external_exports.object({
+  deviceId: external_exports.guid(),
+  hostname: external_exports.string().min(1).max(253),
+  // Epoch millis on the CLIENT clock. Bounded by what a receiving store
+  // accepts (see MAX_DATE_MS), not by what a JavaScript Date can hold.
+  capturedAt: external_exports.number().int().min(0).max(MAX_DATE_MS),
+  // False is a measurement, not an error state: "no local store exists on
+  // this machine".
+  storePresent: external_exports.boolean(),
+  schemaVersion: external_exports.number().int().min(0).max(MAX_INT4).nullable(),
+  // PRAGMA user_version
+  findingsTotal: external_exports.number().int().min(0).max(MAX_INT4),
+  // Epoch millis, bounded like `capturedAt` — see MAX_DATE_MS on what that
+  // bound does and does not do. Worth stating for these two specifically:
+  // they are read from the local store's own ROWS rather than from this
+  // machine's clock, so a damaged or hand-edited store is enough to produce
+  // an out-of-range value with no clock skew involved.
+  findingsFirstAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  findingsLastAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  packs: external_exports.array(StorePosturePack).max(500),
+  policyCounts: StorePosturePolicyCounts,
+  // OPTIONAL, not nullable: a reporter that predates this member keeps
+  // getting its 200 without a payload change.
+  plugin: StorePosturePlugin.optional()
+}).meta({ id: "StorePostureSnapshot" });
+var CAPTURE_VERSION_PREFIX = "capture/";
+var RecordAuditEventRequest = AuditEventInput.extend({
+  inspections: external_exports.array(ToolCallInspection).default([])
+}).refine((v) => v.inspections.every((i) => !i.ruleVersion.startsWith(CAPTURE_VERSION_PREFIX)), {
+  message: `inspections[].ruleVersion must not start with \`${CAPTURE_VERSION_PREFIX}\` \u2014 that namespace is reserved for capture definitions the control plane mints itself`,
+  path: ["inspections"]
+}).meta({ id: "RecordAuditEventRequest" });
+var IngestAck = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+});
+var PRINTABLE = /^[^\p{Cc}\p{Cf}]*$/u;
+var printable = (max) => external_exports.string().max(max).regex(PRINTABLE, "must not contain control characters");
+var PluginWhoami = external_exports.object({
+  tenantName: printable(200),
+  userEmail: printable(320),
+  role: printable(64),
+  keyKind: printable(64),
+  serverTime: printable(64)
+});
+var ControlPlaneErrorBody = external_exports.object({
+  error: external_exports.object({
+    code: external_exports.string().optional(),
+    message: external_exports.string().optional()
+  }).optional()
+});
+
 // ../../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
 var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -16624,15 +16760,15 @@ function summaryToDetectionListItem(s) {
 }
 function rowToDetectionDetail(row, findingsLast30d, update) {
   const rules = row.rules.flatMap((r) => {
-    const parsed = Matcher.safeParse(r.matcher);
-    if (!parsed.success) return [];
+    const parsed2 = Matcher.safeParse(r.matcher);
+    if (!parsed2.success) return [];
     return [
       {
         id: r.id,
         name: r.name,
         category: r.category,
         severity: r.severity,
-        matcher: parsed.data
+        matcher: parsed2.data
       }
     ];
   });
@@ -17278,8 +17414,8 @@ function toApiAction(dbVal) {
 }
 function toApiCategory(dbVal) {
   if (dbVal === "code_context") return "source_code";
-  const parsed = FindingCategory.safeParse(dbVal);
-  return parsed.success ? parsed.data : "custom";
+  const parsed2 = FindingCategory.safeParse(dbVal);
+  return parsed2.success ? parsed2.data : "custom";
 }
 function toApiProvider(sourceTool) {
   return TOOL_TO_HARNESS[sourceTool] ?? HARNESS.Api;
@@ -17912,6 +18048,9 @@ var WorkspaceSettings = external_exports.object({
 function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
 }
+function isAttached(settings) {
+  return settings.runMode === "attached" && settings.controlPlane !== void 0;
+}
 function toInventoryRow(input, id, now) {
   return {
     id,
@@ -18179,8 +18318,8 @@ function builtinPolicyIsReversible(id) {
   return BUILTIN_POLICY_SPECS[id].reversible;
 }
 function policyIdIsReversible(policyId) {
-  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
   return builtinPolicyIsReversible(id);
 }
 var DEFAULT_ACTIONS = Object.fromEntries(
@@ -18191,8 +18330,8 @@ var BUILTIN_POLICIES = Object.fromEntries(
 );
 var DEFAULT_PACK_POLICY_ID = "monitor";
 function policyIdToAction(policyId) {
-  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
   return BUILTIN_POLICIES[id].action;
 }
 var UsedByItem = external_exports.object({
@@ -18635,53 +18774,6 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
-// ../../packages/persistence/src/ids.ts
-import { createHash } from "crypto";
-function sha256Hex(input) {
-  return createHash("sha256").update(input).digest("hex");
-}
-function inventoryId(objectType, identityKey) {
-  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
-}
-function sourceProjectId(url2) {
-  return sha256Hex(canonicalIdentity(["source_project", url2]));
-}
-function classifiedDataId(cls) {
-  return sha256Hex(canonicalIdentity(["classified_data", cls]));
-}
-function inspectionDefinitionId(ruleId, version2) {
-  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
-}
-function llmCallId(sessionId, messageId) {
-  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
-}
-function toolCallId(sessionId, toolUseId) {
-  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
-}
-function inspectionFindingId(auditEventId, ruleId, spanStart, spanEnd) {
-  return sha256Hex(
-    canonicalIdentity([
-      "inspection_finding",
-      auditEventId,
-      ruleId,
-      String(spanStart),
-      String(spanEnd)
-    ])
-  );
-}
-var NO_SESSION = "no_session";
-var NO_PATH = "no_path";
-function captureId(sessionId, contentHash, filePath = null) {
-  return sha256Hex(
-    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
-  );
-}
-
-// ../../packages/persistence/src/internal/snapshot.ts
-import { randomUUID } from "crypto";
-import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
-import { basename, dirname, join } from "path";
-
 // ../../packages/persistence/src/paths.ts
 import {
   chmodSync,
@@ -18729,8 +18821,181 @@ function tightenFile(file2) {
 function tightenPerms(file2) {
   for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
 }
+function writeExclusiveOwnerOnlySync(file2, data) {
+  writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+}
+function writeOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.tmp`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  try {
+    writeExclusiveOwnerOnlySync(tmp, data);
+    renameSync(tmp, file2);
+  } finally {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+  }
+  tightenFile(file2);
+}
+function createOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.${String(threadId)}.new`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  let created;
+  try {
+    writeExclusiveOwnerOnlySync(tmp, data);
+    created = publishByLink(tmp, file2, data);
+  } finally {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+  }
+  if (created) tightenFile(file2);
+  return created;
+}
+var LINK_UNSUPPORTED = /* @__PURE__ */ new Set(["EPERM", "ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EINVAL"]);
+function publishByLink(tmp, file2, data) {
+  try {
+    linkSync(tmp, file2);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "EEXIST") return false;
+    if (!LINK_UNSUPPORTED.has(code ?? "")) throw err;
+  }
+  try {
+    writeExclusiveOwnerOnlySync(file2, data);
+    return true;
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw err;
+  }
+}
+
+// ../../packages/persistence/src/control-plane-credential.ts
+function controlPlaneCredentialPath(settingsDir2) {
+  return join(settingsDir2, ATTACHED_CREDENTIAL_FILENAME);
+}
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isSafeEndpoint(endpoint) {
+  let parsed2;
+  try {
+    parsed2 = new URL(endpoint);
+  } catch {
+    return false;
+  }
+  if (parsed2.protocol === "https:") return true;
+  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname);
+}
+function repairOrRefuseMode(file2) {
+  const link = lstatSync2(file2, { throwIfNoEntry: false });
+  if (link === void 0) return "absent";
+  if (link.isSymbolicLink()) return "untrusted";
+  const stat = statSync(file2, { throwIfNoEntry: false });
+  if (stat === void 0) return "absent";
+  const uid = process.getuid?.();
+  if (uid !== void 0 && stat.uid !== uid) return "untrusted";
+  if (process.platform !== "win32" && (stat.mode & 511) !== DATA_FILE_MODE) {
+    try {
+      chmodSync2(file2, DATA_FILE_MODE);
+    } catch {
+      return "untrusted";
+    }
+  }
+  return "ok";
+}
+function readControlPlaneCredentialState(settingsDir2, connection) {
+  const file2 = controlPlaneCredentialPath(settingsDir2);
+  let raw;
+  const gate = repairOrRefuseMode(file2);
+  if (gate === "absent") return { usable: false, reason: "absent" };
+  if (gate === "untrusted") return { usable: false, reason: "untrusted-file" };
+  try {
+    raw = readFileSync(file2, "utf8");
+  } catch (err) {
+    const code = err.code;
+    return { usable: false, reason: code === "ENOENT" ? "absent" : "unreadable" };
+  }
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(raw);
+  } catch {
+    return { usable: false, reason: "malformed" };
+  }
+  const result = AttachedCredential.safeParse(parsed2);
+  if (!result.success) return { usable: false, reason: "malformed" };
+  if (!isSafeEndpoint(result.data.endpoint)) {
+    return { usable: false, reason: "unsafe-endpoint" };
+  }
+  if (connection !== void 0 && connection.endpoint !== result.data.endpoint) {
+    return {
+      usable: false,
+      reason: "endpoint-mismatch",
+      credentialEndpoint: result.data.endpoint,
+      settingsEndpoint: connection.endpoint
+    };
+  }
+  return { usable: true, credential: result.data };
+}
+
+// ../../packages/persistence/src/database.ts
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join3, sep } from "path";
+import { DatabaseSync } from "node:sqlite";
+
+// ../../packages/persistence/src/ids.ts
+import { createHash } from "crypto";
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function inventoryId(objectType, identityKey) {
+  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+}
+function sourceProjectId(url2) {
+  return sha256Hex(canonicalIdentity(["source_project", url2]));
+}
+function classifiedDataId(cls) {
+  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+}
+function inspectionDefinitionId(ruleId, version2) {
+  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
+}
+function llmCallId(sessionId, messageId) {
+  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+}
+function toolCallId(sessionId, toolUseId) {
+  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+}
+function inspectionFindingId(auditEventId, ruleId, spanStart, spanEnd) {
+  return sha256Hex(
+    canonicalIdentity([
+      "inspection_finding",
+      auditEventId,
+      ruleId,
+      String(spanStart),
+      String(spanEnd)
+    ])
+  );
+}
+var NO_SESSION = "no_session";
+var NO_PATH = "no_path";
+function captureId(sessionId, contentHash, filePath = null) {
+  return sha256Hex(
+    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
+  );
+}
 
 // ../../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { basename, dirname, join as join2 } from "path";
 function backupPath(file2, tag) {
   return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
 }
@@ -18740,15 +19005,15 @@ var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 var SNAPSHOT_STAGING_COPY = "copy";
 function createSnapshotStaging(backup) {
   const stage = `${backup}${SNAPSHOT_STAGING_SUFFIX}`;
-  rmSync2(stage, { recursive: true, force: true });
+  rmSync3(stage, { recursive: true, force: true });
   mkdirOwnerOnlySync(stage);
   tightenDir(stage);
-  return { stage, copy: join(stage, SNAPSHOT_STAGING_COPY) };
+  return { stage, copy: join2(stage, SNAPSHOT_STAGING_COPY) };
 }
 function idleMs(entry) {
-  for (const candidate of [join(entry, SNAPSHOT_STAGING_COPY), entry]) {
+  for (const candidate of [join2(entry, SNAPSHOT_STAGING_COPY), entry]) {
     try {
-      return Date.now() - statSync(candidate).mtimeMs;
+      return Date.now() - statSync2(candidate).mtimeMs;
     } catch {
     }
   }
@@ -18765,11 +19030,11 @@ function reapStalePartials(file2) {
   }
   for (const name of entries) {
     if (!name.startsWith(prefix) || !name.endsWith(STAGED_NAME_SUFFIX)) continue;
-    const staging = join(dir, name);
+    const staging = join2(dir, name);
     try {
       const idle = idleMs(staging);
       if (idle !== null && idle > STALE_PARTIAL_MS) {
-        rmSync2(staging, { recursive: true, force: true });
+        rmSync3(staging, { recursive: true, force: true });
       }
     } catch {
     }
@@ -18783,13 +19048,13 @@ function snapshotStore(db, backup) {
     renameSync2(copy, backup);
   } catch (error51) {
     try {
-      rmSync2(stage, { recursive: true, force: true });
+      rmSync3(stage, { recursive: true, force: true });
     } catch {
     }
     throw error51;
   }
   try {
-    rmSync2(stage, { recursive: true, force: true });
+    rmSync3(stage, { recursive: true, force: true });
   } catch {
   }
 }
@@ -18804,7 +19069,7 @@ function moveStoreAside(file2, backup) {
         renameSync2(sidecar, moved);
         undo.push([moved, sidecar]);
       } catch {
-        rmSync2(sidecar, { force: true });
+        rmSync3(sidecar, { force: true });
       }
     }
   } catch (error51) {
@@ -18820,14 +19085,14 @@ function moveStoreAside(file2, backup) {
 }
 function discardStore(file2, backup) {
   try {
-    rmSync2(file2, { force: true });
+    rmSync3(file2, { force: true });
     for (const sidecar of dbSidecars(file2)) {
-      rmSync2(sidecar, { force: true });
+      rmSync3(sidecar, { force: true });
     }
   } catch (error51) {
     if (existsSync(file2)) {
       try {
-        rmSync2(backup, { force: true });
+        rmSync3(backup, { force: true });
       } catch {
       }
     }
@@ -19059,10 +19324,31 @@ function applyMigrations(db, file2) {
     if (drained) applyLegacyDropMigration(db, file2);
   }
 }
+function readLegacyTables(db) {
+  let holdsRows = false;
+  const marks = [];
+  for (const table of ["events", "findings"]) {
+    try {
+      const row = db.prepare(`SELECT count(*) AS n, ifnull(max(rowid), -1) AS hi FROM ${table}`).get();
+      if (row === void 0) {
+        holdsRows = true;
+        marks.push(`${table}:unreadable`);
+        continue;
+      }
+      if (row.n > 0) holdsRows = true;
+      marks.push(`${table}:${String(row.n)}:${String(row.hi)}`);
+    } catch {
+      holdsRows = true;
+      marks.push(`${table}:unreadable`);
+    }
+  }
+  return { holdsRows, mark: marks.join("|") };
+}
 function applyLegacyDropMigration(db, file2) {
   const migration = SQLITE_MIGRATIONS.find((m) => m.tag === LEGACY_DROP_MIGRATION_TAG);
   if (!migration) return;
-  if (file2) {
+  const before = file2 === void 0 ? void 0 : readLegacyTables(db);
+  if (file2 !== void 0 && before?.holdsRows === true) {
     try {
       backupBeforeLegacyDrop(db, file2);
     } catch (error51) {
@@ -19076,6 +19362,12 @@ function applyLegacyDropMigration(db, file2) {
       () => {
         const alreadyDropped = db.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(migration.tag);
         if (alreadyDropped) return;
+        if (before !== void 0 && readLegacyTables(db).mark !== before.mark) {
+          akaWarn(
+            "legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first."
+          );
+          return;
+        }
         for (const statement of splitStatements(migration.sql)) {
           db.exec(statement);
         }
@@ -19430,8 +19722,8 @@ function safeJson(s, fallback) {
 function parseJsonObject(s) {
   if (s == null) return void 0;
   try {
-    const parsed = JSON.parse(s);
-    if (typeof parsed === "object" && parsed !== null) return parsed;
+    const parsed2 = JSON.parse(s);
+    if (typeof parsed2 === "object" && parsed2 !== null) return parsed2;
   } catch {
   }
   return void 0;
@@ -19442,16 +19734,16 @@ function encodeKeysetCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeKeysetCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && "startedAtMs" in parsed2 && "id" in parsed2 && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
   // resumes from is epoch millis, and a payload carrying ±Infinity or a
   // fraction binds cleanly rather than failing — returning an EMPTY page with
   // a null cursor, which a caller reads as "end of list". That is the one
   // outcome a cursor that does not decode must never produce, since the
   // documented behaviour above is to restart from the top. (`1e999` is valid
   // JSON and parses to Infinity; a bare `NaN` is not, so it cannot arrive.)
-  Number.isInteger(parsed.startedAtMs) && typeof parsed.id === "string") {
-    return parsed;
+  Number.isInteger(parsed2.startedAtMs) && typeof parsed2.id === "string") {
+    return parsed2;
   }
   return null;
 }
@@ -19516,18 +19808,18 @@ var DB_EVENT_TYPE_TO_KIND = {
 };
 function safeParseStringArray(raw) {
   if (!raw) return [];
-  const parsed = safeJson(raw, null);
-  return Array.isArray(parsed) ? parsed : [];
+  const parsed2 = safeJson(raw, null);
+  return Array.isArray(parsed2) ? parsed2 : [];
 }
 var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 function toHarness(raw) {
-  const parsed = Harness.safeParse(raw);
-  return parsed.success ? parsed.data : DEFAULT_HARNESS;
+  const parsed2 = Harness.safeParse(raw);
+  return parsed2.success ? parsed2.data : DEFAULT_HARNESS;
 }
 function resolveLifecycle(row, lastActivityMs, nowMs) {
   if (row.status) {
-    const parsed = SessionStatus.safeParse(row.status);
-    if (parsed.success) return { status: parsed.data, endedAtMs: row.ended_at };
+    const parsed2 = SessionStatus.safeParse(row.status);
+    if (parsed2.success) return { status: parsed2.data, endedAtMs: row.ended_at };
   }
   if (row.ended_at !== null) return { status: "completed", endedAtMs: row.ended_at };
   if (lastActivityMs >= nowMs - LIVE_ACTIVITY_WINDOW_MS) {
@@ -20486,9 +20778,9 @@ var SqliteDetectionsRepository = class {
     const ruleIds = /* @__PURE__ */ new Set();
     for (const r of rows) {
       if (intToBool(r.enabled)) active += 1;
-      const parsed = parseRules(r.rulesJson);
-      rules += parsed.length;
-      for (const rule of parsed) {
+      const parsed2 = parseRules(r.rulesJson);
+      rules += parsed2.length;
+      for (const rule of parsed2) {
         if (typeof rule.id === "string") ruleIds.add(rule.id);
       }
     }
@@ -21022,12 +21314,12 @@ function encodeGroupCursor(group) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeGroupCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && typeof parsed.sev === "string" && typeof parsed.t === "string" && typeof parsed.id === "string") {
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && typeof parsed2.sev === "string" && typeof parsed2.t === "string" && typeof parsed2.id === "string") {
     return {
-      severity: parsed.sev,
-      latestDetectedAt: parsed.t,
-      id: parsed.id
+      severity: parsed2.sev,
+      latestDetectedAt: parsed2.t,
+      id: parsed2.id
     };
   }
   return null;
@@ -22161,16 +22453,16 @@ var SqliteInstalledPacksRepository = class {
         continue;
       }
       for (const entry of raw) {
-        const parsed = Rule.safeParse(entry);
-        if (parsed.success) {
-          out.rules.push(parsed.data);
-          out.ruleActions.set(parsed.data.id, action);
-          out.ruleVersions.set(parsed.data.id, row.version);
-          if (reversible) out.reversibleRules.add(parsed.data.id);
-          else out.reversibleRules.delete(parsed.data.id);
+        const parsed2 = Rule.safeParse(entry);
+        if (parsed2.success) {
+          out.rules.push(parsed2.data);
+          out.ruleActions.set(parsed2.data.id, action);
+          out.ruleVersions.set(parsed2.data.id, row.version);
+          if (reversible) out.reversibleRules.add(parsed2.data.id);
+          else out.reversibleRules.delete(parsed2.data.id);
         } else {
           out.invalidRules += 1;
-          reject(pack, printableRuleId(entry), firstIssueReason(parsed.error));
+          reject(pack, printableRuleId(entry), firstIssueReason(parsed2.error));
         }
       }
     }
@@ -23560,15 +23852,15 @@ function encodeReuseCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeReuseCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
   // ±Infinity or a fraction binds cleanly and returns an EMPTY page with a
   // null cursor, which the caller reads as "end of list" — the one outcome a
   // malformed cursor must never produce, since restarting from the top is the
   // documented behaviour and the only recoverable one. (`1e999` is valid JSON
   // and parses to Infinity; a bare `NaN` is not, so it cannot arrive here.)
-  Number.isInteger(parsed.occurrences) && typeof parsed.pointerId === "string") {
-    return { occurrences: parsed.occurrences, pointerId: parsed.pointerId };
+  Number.isInteger(parsed2.occurrences) && typeof parsed2.pointerId === "string") {
+    return { occurrences: parsed2.occurrences, pointerId: parsed2.pointerId };
   }
   return null;
 }
@@ -25297,7 +25589,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join2(dir, DB_FILENAME);
+  const file2 = join3(dir, DB_FILENAME);
   reapStalePartials(file2);
   const {
     db,
@@ -25533,9 +25825,9 @@ import {
   closeSync,
   existsSync as existsSync2,
   openSync,
-  readFileSync,
-  rmSync as rmSync3,
-  statSync as statSync2,
+  readFileSync as readFileSync2,
+  rmSync as rmSync4,
+  statSync as statSync3,
   writeFileSync as writeFileSync2
 } from "fs";
 import { hostname as hostname3 } from "os";
@@ -25546,20 +25838,20 @@ import { createHash as createHash3 } from "crypto";
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var EXCEPTION_KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
-  return join3(dataDir2, EXCEPTION_KEY_FILENAME);
+  return join4(dataDir2, EXCEPTION_KEY_FILENAME);
 }
 function parseKeyFile(raw) {
-  const parsed = JSON.parse(raw);
-  if (typeof parsed !== "object" || parsed === null) {
+  const parsed2 = JSON.parse(raw);
+  if (typeof parsed2 !== "object" || parsed2 === null) {
     throw new Error("exception key file is corrupt: not a JSON object");
   }
-  const { version: version2, material } = parsed;
+  const { version: version2, material } = parsed2;
   if (typeof version2 !== "number" || !Number.isInteger(version2) || version2 < 1) {
     throw new Error("exception key file is corrupt: bad version");
   }
@@ -25575,7 +25867,7 @@ function parseKeyFile(raw) {
 function readFingerprintKey(dataDir2) {
   let raw;
   try {
-    raw = readFileSync2(keyFilePath(dataDir2), "utf8");
+    raw = readFileSync3(keyFilePath(dataDir2), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err instanceof Error ? err : new Error(String(err));
@@ -25587,18 +25879,25 @@ function readFingerprintKey(dataDir2) {
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function defaultDataDir() {
-  return join4(homedir(), ".aka");
+  return join5(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join4(base, "settings");
+  return join5(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join4(base, "data");
+  return join5(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join4(dataDir(base), "aka.db");
+  return join5(dataDir(base), "aka.db");
+}
+function keysDir(base = defaultDataDir()) {
+  return join5(base, "keys");
+}
+async function ensureDataDir(dir = defaultDataDir()) {
+  await mkdir(dir, { recursive: true, mode: DATA_DIR_MODE });
+  tightenDir(dir);
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -25611,8 +25910,8 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join4(dest, name);
-      renameSync3(join4(base, name), moved);
+      const moved = join5(dest, name);
+      renameSync3(join5(base, name), moved);
       tightenFile(moved);
     } catch {
     }
@@ -25620,7 +25919,7 @@ function migrateLegacyLayout(base = defaultDataDir()) {
 }
 
 // ../../packages/persistence/src/managed-settings.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { posix, win32 } from "path";
 function managedSettingsPaths(platform2 = process.platform) {
   if (platform2 === "darwin") {
@@ -25638,14 +25937,14 @@ function readManagedSettings(paths = managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
-      text = readFileSync3(path, "utf8");
+      text = readFileSync4(path, "utf8");
     } catch {
       continue;
     }
     const record2 = parseJsonObject(text);
     if (!record2) continue;
-    const parsed = ManagedSettings.safeParse(record2);
-    if (parsed.success) return parsed.data;
+    const parsed2 = ManagedSettings.safeParse(record2);
+    if (parsed2.success) return parsed2.data;
   }
   return null;
 }
@@ -25685,14 +25984,14 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
   return overlayManagedSettings(readUserSettings(base), readManagedSettings());
 }
 function readUserSettings(base) {
-  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
+  const record2 = readJson(join6(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -25703,13 +26002,64 @@ function readUserSettings(base) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync4(file2, "utf8");
+    text = readFileSync5(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/store-symlinks.ts
+import { existsSync as existsSync4, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
+import { dirname as dirname2, join as join7, resolve } from "path";
+var STORE_DB = "the store database (including the prompt corpus)";
+var STORE_SETTINGS = "your settings file";
+function storeContents(home) {
+  return /* @__PURE__ */ new Map([
+    [home, "the store (including the prompt corpus in aka.db)"],
+    [settingsDir(home), STORE_SETTINGS],
+    [dataDir(home), STORE_DB],
+    [keysDir(home), "the vault key"],
+    [join7(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [dbPath(home), STORE_DB]
+  ]);
+}
+function symlinkedStorePaths(home, platform2 = process.platform) {
+  return [...storeContents(home)].flatMap(([path, holds]) => {
+    try {
+      if (!lstatSync3(path).isSymbolicLink()) return [];
+      return [
+        {
+          path,
+          target: linkTarget(path),
+          holds,
+          // existsSync follows the link, so a target that is gone reads as
+          // absent here while lstat above still sees the link itself.
+          missing: !existsSync4(path),
+          mode: targetMode(path, platform2)
+        }
+      ];
+    } catch {
+      return [];
+    }
+  });
+}
+function linkTarget(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(dirname2(path), readlinkSync(path));
+  }
+}
+function targetMode(path, platform2) {
+  if (platform2 === "win32") return void 0;
+  try {
+    return statSync4(path).mode & 511;
+  } catch {
+    return void 0;
+  }
+}
+
 // ../../packages/persistence/src/vault/crypto.ts
 import {
   createCipheriv,
@@ -25722,26 +26072,73 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync2, readFileSync as readFileSync5, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync5, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join7(dataDir2, MARKER);
-  if (existsSync4(marker)) return { capped: 0, skipped: "already-run" };
+  const marker = join9(dataDir2, MARKER);
+  if (existsSync5(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
   writeFileSync4(marker, `${new Date(Date.now()).toISOString()}
 `, { mode: DATA_FILE_MODE });
   return { capped };
 }
 
+// ../../packages/plugin-runtime/src/attached/forward-drops.ts
+var FORWARD_DROPS_FILENAME = "attached-forward-drops.json";
+function forwardDropsPath(dataDir2) {
+  return join10(dataDir2, FORWARD_DROPS_FILENAME);
+}
+function recordForwardDrops(dataDir2, count, nowMs) {
+  if (count <= 0) return;
+  try {
+    ensureDataDirSync(dataDir2);
+    const previous = readForwardDrops(dataDir2);
+    const next = {
+      droppedForwards: (previous?.droppedForwards ?? 0) + count,
+      lastDropAtMs: nowMs
+    };
+    writeOwnerOnlyFileSync(forwardDropsPath(dataDir2), `${JSON.stringify(next)}
+`);
+  } catch {
+  }
+}
+function readForwardDrops(dataDir2) {
+  try {
+    const parsed2 = JSON.parse(readFileSync7(forwardDropsPath(dataDir2), "utf8"));
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    if (typeof record2.droppedForwards !== "number" || !Number.isFinite(record2.droppedForwards)) {
+      return null;
+    }
+    if (record2.droppedForwards <= 0) return null;
+    if (typeof record2.lastDropAtMs !== "number" || !Number.isFinite(record2.lastDropAtMs)) {
+      return null;
+    }
+    return { droppedForwards: record2.droppedForwards, lastDropAtMs: record2.lastDropAtMs };
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/plugin-runtime/src/attached/forward-policy.ts
+import { randomUUID as randomUUID15 } from "crypto";
+import { readFileSync as readFileSync12 } from "fs";
+import { readFile, rename, writeFile } from "fs/promises";
+import { join as join18 } from "path";
+
+// ../../packages/plugin-sdk/src/config.ts
+import { existsSync as existsSync6 } from "fs";
+import { join as join11 } from "path";
+
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -25776,8 +26173,8 @@ function hostOf(url2) {
   }
 }
 function resolveProvider() {
-  const parsed = ProviderEnvSchema.safeParse(process.env);
-  const env = parsed.success ? parsed.data : ProviderEnvSchema.parse({});
+  const parsed2 = ProviderEnvSchema.safeParse(process.env);
+  const env = parsed2.success ? parsed2.data : ProviderEnvSchema.parse({});
   if (env.CLAUDE_CODE_USE_BEDROCK === true) return { provider: "bedrock" };
   if (env.CLAUDE_CODE_USE_VERTEX === true) return { provider: "vertex" };
   const baseUrl = env.ANTHROPIC_BASE_URL;
@@ -25794,8 +26191,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join8(settingsDir(base), "settings.json");
-    if (existsSync5(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join11(settingsDir(base), "settings.json");
+    if (existsSync6(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -25818,9 +26215,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync7, realpathSync, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename4, join as join10 } from "path";
+import { basename as basename4, join as join13 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -27592,10 +27989,10 @@ var localhost_ref_default = {
   severity: "low",
   matcher: {
     type: "regex",
-    pattern: "\\b(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|::1)\\b",
+    pattern: "(?<![A-Za-z0-9_])(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|(?<![A-Za-z0-9_]\\[)::1(?!:|\\.[0-9]))(?![A-Za-z0-9_])",
     flags: "g"
   },
-  examples: ["localhost", "127.0.0.1"]
+  examples: ["localhost", "127.0.0.1", "0.0.0.0", "::1"]
 };
 
 // ../../rules/core-code-context/stack-trace.json
@@ -28949,8 +29346,8 @@ function maskText(text) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { basename as basename3, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8, statSync as statSync6 } from "fs";
+import { basename as basename3, dirname as dirname3, isAbsolute, join as join12, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -29000,15 +29397,15 @@ function resolveGitBranch(cwd) {
   try {
     const root = findGitRoot(cwd);
     if (!root) return void 0;
-    const dotGit = join9(root, ".git");
+    const dotGit = join12(root, ".git");
     let gitdir;
     try {
-      gitdir = statSync4(dotGit).isDirectory() ? dotGit : resolveWorktreeGitdir(root, dotGit);
+      gitdir = statSync6(dotGit).isDirectory() ? dotGit : resolveWorktreeGitdir(root, dotGit);
     } catch {
       return void 0;
     }
     if (gitdir === void 0) return void 0;
-    const head = safeRead(join9(gitdir, "HEAD"));
+    const head = safeRead(join12(gitdir, "HEAD"));
     if (!head) return void 0;
     return /^ref:\s*refs\/heads\/(.+?)\s*$/m.exec(head)?.[1];
   } catch {
@@ -29018,41 +29415,41 @@ function resolveGitBranch(cwd) {
 function resolveWorktreeGitdir(root, dotGitFile) {
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGitFile) ?? "")?.[1];
   if (!target) return void 0;
-  return isAbsolute(target) ? target : join9(root, target);
+  return isAbsolute(target) ? target : join12(root, target);
 }
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync6(join9(dir, ".git"))) return dir;
-    const parent = dirname2(dir);
+    if (existsSync7(join12(dir, ".git"))) return dir;
+    const parent = dirname3(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join9(root, ".git");
+  const dotGit = join12(root, ".git");
   try {
-    if (statSync4(dotGit).isDirectory()) {
-      return { configPath: join9(dotGit, "config"), headRoot: root };
+    if (statSync6(dotGit).isDirectory()) {
+      return { configPath: join12(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join9(root, target);
-  if (existsSync6(join9(gitdir, "config"))) {
-    return { configPath: join9(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join12(root, target);
+  if (existsSync7(join12(gitdir, "config"))) {
+    return { configPath: join12(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join9(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join12(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join9(gitdir, commonRaw);
-  const headRoot = basename3(commonGitDir) === ".git" ? dirname2(commonGitDir) : root;
-  return { configPath: join9(commonGitDir, "config"), headRoot };
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join12(gitdir, commonRaw);
+  const headRoot = basename3(commonGitDir) === ".git" ? dirname3(commonGitDir) : root;
+  return { configPath: join12(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync6(path, "utf8");
+    return readFileSync8(path, "utf8");
   } catch {
     return void 0;
   }
@@ -29114,31 +29511,31 @@ function resolveConfigInventory(input) {
   };
   try {
     const home = input.homeDir ?? homedir2();
-    const claudeDir = join10(home, ".claude");
+    const claudeDir = join13(home, ".claude");
     const repo = resolveRepoIdentity(input.cwd);
     const repoIdentity = repo?.url ?? input.cwd;
     const projectSource = `project:${repoIdentity}`;
-    collectSettingsHooks(scan2, join10(claudeDir, "settings.json"), "user");
-    collectSettingsHooks(scan2, join10(input.cwd, ".claude", "settings.json"), "project");
-    collectSettingsHooks(scan2, join10(input.cwd, ".claude", "settings.local.json"), "local");
+    collectSettingsHooks(scan2, join13(claudeDir, "settings.json"), "user");
+    collectSettingsHooks(scan2, join13(input.cwd, ".claude", "settings.json"), "project");
+    collectSettingsHooks(scan2, join13(input.cwd, ".claude", "settings.local.json"), "local");
     const projectOrigin = { scope: "project", project: repoIdentity };
-    collectMcpFile(scan2, join10(input.cwd, ".mcp.json"), projectOrigin, { recordErrors: true });
-    collectUserClaudeJson(scan2, join10(home, ".claude.json"), input.cwd, repoIdentity);
-    collectMcpFile(scan2, join10(claudeDir, "settings.json"), { scope: "user" });
-    collectMcpFile(scan2, join10(input.cwd, ".claude", "settings.json"), projectOrigin);
-    collectMcpFile(scan2, join10(input.cwd, ".claude", "settings.local.json"), {
+    collectMcpFile(scan2, join13(input.cwd, ".mcp.json"), projectOrigin, { recordErrors: true });
+    collectUserClaudeJson(scan2, join13(home, ".claude.json"), input.cwd, repoIdentity);
+    collectMcpFile(scan2, join13(claudeDir, "settings.json"), { scope: "user" });
+    collectMcpFile(scan2, join13(input.cwd, ".claude", "settings.json"), projectOrigin);
+    collectMcpFile(scan2, join13(input.cwd, ".claude", "settings.local.json"), {
       scope: "local",
       project: repoIdentity
     });
     collectConfigFiles(scan2, claudeDir, input.cwd);
-    collectSkillsDir(scan2, join10(claudeDir, "skills"), { source: "local", scope: "user" });
-    collectSkillsDir(scan2, join10(input.cwd, ".claude", "skills"), {
+    collectSkillsDir(scan2, join13(claudeDir, "skills"), { source: "local", scope: "user" });
+    collectSkillsDir(scan2, join13(input.cwd, ".claude", "skills"), {
       source: projectSource,
       scope: "project"
     });
     collectInstalledPlugins(scan2, claudeDir);
     collectMarketplaceSkills(scan2, claudeDir);
-    collectSkillsDir(scan2, join10(input.cwd, "skills"), { source: projectSource, scope: "project" });
+    collectSkillsDir(scan2, join13(input.cwd, "skills"), { source: projectSource, scope: "project" });
     scan2.skills = dedupeSkills(scan2.skills);
     scan2.mcpServers = dedupeMcpServers(scan2.mcpServers);
   } catch (err) {
@@ -29173,9 +29570,9 @@ function collectSettingsHooks(scan2, path, scope) {
   const raw = readOptional(path);
   if (raw === void 0) return;
   try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return;
-    collectHooksObject(scan2, parsed.hooks, path, scope);
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return;
+    collectHooksObject(scan2, parsed2.hooks, path, scope);
   } catch (err) {
     scan2.errors.push({ source: path, reason: parseErrorReason(err) });
   }
@@ -29221,9 +29618,9 @@ function collectMcpFile(scan2, path, origin, opts) {
   const raw = readOptional(path);
   if (raw === void 0) return;
   try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return;
-    collectMcpObject(scan2, parsed.mcpServers, path, origin);
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return;
+    collectMcpObject(scan2, parsed2.mcpServers, path, origin);
   } catch (err) {
     if (opts?.recordErrors ?? false) {
       scan2.errors.push({ source: path, reason: parseErrorReason(err) });
@@ -29234,9 +29631,9 @@ function collectUserClaudeJson(scan2, path, cwd, repoIdentity) {
   const raw = readOptional(path);
   if (raw === void 0) return;
   try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return;
-    const rec = parsed;
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return;
+    const rec = parsed2;
     collectMcpObject(scan2, rec.mcpServers, path, { scope: "user" });
     const projects = rec.projects;
     if (typeof projects === "object" && projects !== null) {
@@ -29257,7 +29654,7 @@ function projectEntryFor(projects, cwd) {
   const trimmed = cwd.replace(/\/+$/, "");
   if (trimmed.length > 0) candidates.add(trimmed);
   try {
-    candidates.add(realpathSync(cwd));
+    candidates.add(realpathSync2(cwd));
   } catch {
   }
   for (const key of candidates) {
@@ -29267,15 +29664,15 @@ function projectEntryFor(projects, cwd) {
   return void 0;
 }
 function collectPluginManifestMcp(scan2, installPath, origin) {
-  const manifestPath = join10(installPath, ".claude-plugin", "plugin.json");
+  const manifestPath = join13(installPath, ".claude-plugin", "plugin.json");
   const raw = readOptional(manifestPath);
   if (raw === void 0) return;
   try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return;
-    const declared = parsed.mcpServers;
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return;
+    const declared = parsed2.mcpServers;
     if (typeof declared === "string" && declared.length > 0) {
-      collectMcpFile(scan2, join10(installPath, declared), origin, { recordErrors: true });
+      collectMcpFile(scan2, join13(installPath, declared), origin, { recordErrors: true });
     } else {
       collectMcpObject(scan2, declared, manifestPath, origin);
     }
@@ -29292,18 +29689,18 @@ var SETTINGS_KEY_LABELS = [
   ["statusLine", "status line"]
 ];
 function collectConfigFiles(scan2, claudeDir, cwd) {
-  settingsConfigFile(scan2, join10(claudeDir, "settings.json"), "user", "User settings");
-  settingsConfigFile(scan2, join10(cwd, ".claude", "settings.json"), "project", "Project settings");
-  settingsConfigFile(scan2, join10(cwd, ".claude", "settings.local.json"), "local", "Local overrides");
-  memoryConfigFile(scan2, join10(claudeDir, "CLAUDE.md"), "user", "User memory");
-  memoryConfigFile(scan2, join10(cwd, "CLAUDE.md"), "project", "Project memory");
-  mcpJsonConfigFile(scan2, join10(cwd, ".mcp.json"));
-  dirConfigFile(scan2, join10(cwd, ".claude", "commands"), "Slash commands", "command");
-  dirConfigFile(scan2, join10(cwd, ".claude", "agents"), "Subagents", "subagent");
+  settingsConfigFile(scan2, join13(claudeDir, "settings.json"), "user", "User settings");
+  settingsConfigFile(scan2, join13(cwd, ".claude", "settings.json"), "project", "Project settings");
+  settingsConfigFile(scan2, join13(cwd, ".claude", "settings.local.json"), "local", "Local overrides");
+  memoryConfigFile(scan2, join13(claudeDir, "CLAUDE.md"), "user", "User memory");
+  memoryConfigFile(scan2, join13(cwd, "CLAUDE.md"), "project", "Project memory");
+  mcpJsonConfigFile(scan2, join13(cwd, ".mcp.json"));
+  dirConfigFile(scan2, join13(cwd, ".claude", "commands"), "Slash commands", "command");
+  dirConfigFile(scan2, join13(cwd, ".claude", "agents"), "Subagents", "subagent");
 }
 function configFileEntry(path, scope, kind) {
   try {
-    const stat = statSync5(path);
+    const stat = statSync7(path);
     return { name: basename4(path), path, scope, kind, updatedAt: stat.mtime.toISOString() };
   } catch {
     return void 0;
@@ -29315,9 +29712,9 @@ function settingsConfigFile(scan2, path, scope, kind) {
   const raw = readOptional(path);
   if (raw !== void 0) {
     try {
-      const parsed = JSON.parse(raw);
-      if (typeof parsed === "object" && parsed !== null) {
-        const labels = SETTINGS_KEY_LABELS.filter(([key]) => key in parsed).map(
+      const parsed2 = JSON.parse(raw);
+      if (typeof parsed2 === "object" && parsed2 !== null) {
+        const labels = SETTINGS_KEY_LABELS.filter(([key]) => key in parsed2).map(
           ([, label]) => label
         );
         if (labels.length > 0) entry.detail = labels.join(", ");
@@ -29344,8 +29741,8 @@ function mcpJsonConfigFile(scan2, path) {
   const raw = readOptional(path);
   if (raw !== void 0) {
     try {
-      const parsed = JSON.parse(raw);
-      const servers = parsed?.mcpServers;
+      const parsed2 = JSON.parse(raw);
+      const servers = parsed2?.mcpServers;
       if (typeof servers === "object" && servers !== null) {
         const count = Object.values(servers).filter(
           (v) => typeof v === "object" && v !== null && (str2(v.command) !== void 0 || str2(v.url) !== void 0)
@@ -29374,7 +29771,7 @@ function countMarkdownFiles(dir, depth) {
   let count = 0;
   for (const dirent of readdirSync2(dir, { withFileTypes: true })) {
     if (dirent.name.startsWith(".")) continue;
-    if (dirent.isDirectory()) count += countMarkdownFiles(join10(dir, dirent.name), depth + 1);
+    if (dirent.isDirectory()) count += countMarkdownFiles(join13(dir, dirent.name), depth + 1);
     else if (dirent.name.endsWith(".md")) count += 1;
   }
   return count;
@@ -29387,7 +29784,7 @@ function collectSkillsDir(scan2, dir, origin) {
     return;
   }
   for (const name of names) {
-    const skillFile = join10(dir, name, "SKILL.md");
+    const skillFile = join13(dir, name, "SKILL.md");
     try {
       const raw = readOptional(skillFile);
       if (raw === void 0) continue;
@@ -29396,8 +29793,8 @@ function collectSkillsDir(scan2, dir, origin) {
         name: front.name ?? name,
         source: origin.source,
         scope: origin.scope,
-        location: join10(dir, name),
-        updatedAt: statSync5(skillFile).mtime.toISOString()
+        location: join13(dir, name),
+        updatedAt: statSync7(skillFile).mtime.toISOString()
       };
       const version2 = front.version ?? origin.defaultVersion;
       if (version2 !== void 0) entry.version = version2;
@@ -29427,13 +29824,13 @@ function parseFrontmatter(raw) {
   return out;
 }
 function collectInstalledPlugins(scan2, claudeDir) {
-  const manifestPath = join10(claudeDir, "plugins", "installed_plugins.json");
+  const manifestPath = join13(claudeDir, "plugins", "installed_plugins.json");
   const raw = readOptional(manifestPath);
   if (raw === void 0) return;
   let plugins;
   try {
-    const parsed = JSON.parse(raw);
-    const p = parsed?.plugins;
+    const parsed2 = JSON.parse(raw);
+    const p = parsed2?.plugins;
     if (typeof p !== "object" || p === null) return;
     plugins = p;
   } catch (err) {
@@ -29452,15 +29849,15 @@ function collectInstalledPlugins(scan2, claudeDir) {
       if (typeof installPath !== "string" || seen.has(installPath)) continue;
       seen.add(installPath);
       const version2 = install.version;
-      const hooksPath = join10(installPath, "hooks", "hooks.json");
+      const hooksPath = join13(installPath, "hooks", "hooks.json");
       const hooksRaw = readOptional(hooksPath);
       if (hooksRaw !== void 0) {
         try {
-          const parsed = JSON.parse(hooksRaw);
-          if (typeof parsed === "object" && parsed !== null) {
+          const parsed2 = JSON.parse(hooksRaw);
+          if (typeof parsed2 === "object" && parsed2 !== null) {
             collectHooksObject(
               scan2,
-              parsed.hooks,
+              parsed2.hooks,
               hooksPath,
               "plugin",
               pluginName
@@ -29472,22 +29869,22 @@ function collectInstalledPlugins(scan2, claudeDir) {
       }
       const origin = { source: marketplace, scope: "plugin", pluginName };
       if (typeof version2 === "string") origin.defaultVersion = version2;
-      collectSkillsDir(scan2, join10(installPath, "skills"), origin);
+      collectSkillsDir(scan2, join13(installPath, "skills"), origin);
       const mcpOrigin = { scope: "plugin", pluginName, marketplace };
-      collectMcpFile(scan2, join10(installPath, ".mcp.json"), mcpOrigin, { recordErrors: true });
+      collectMcpFile(scan2, join13(installPath, ".mcp.json"), mcpOrigin, { recordErrors: true });
       collectPluginManifestMcp(scan2, installPath, mcpOrigin);
     }
   }
 }
 function collectMarketplaceSkills(scan2, claudeDir) {
-  for (const mp of readMarketplaces(join10(claudeDir, "plugins", "known_marketplaces.json"))) {
+  for (const mp of readMarketplaces(join13(claudeDir, "plugins", "known_marketplaces.json"))) {
     if (isClaudeOfficialMarketplace(mp.name, mp.repo)) continue;
-    collectSkillsDir(scan2, join10(mp.installLocation, "skills"), {
+    collectSkillsDir(scan2, join13(mp.installLocation, "skills"), {
       source: mp.name,
       scope: "plugin"
     });
-    collectPluginSkillDirs(scan2, join10(mp.installLocation, "plugins"), mp.name);
-    collectPluginSkillDirs(scan2, join10(mp.installLocation, "external_plugins"), mp.name);
+    collectPluginSkillDirs(scan2, join13(mp.installLocation, "plugins"), mp.name);
+    collectPluginSkillDirs(scan2, join13(mp.installLocation, "external_plugins"), mp.name);
   }
 }
 function collectPluginSkillDirs(scan2, pluginsDir, marketplace) {
@@ -29498,7 +29895,7 @@ function collectPluginSkillDirs(scan2, pluginsDir, marketplace) {
     return;
   }
   for (const plugin of plugins) {
-    collectSkillsDir(scan2, join10(pluginsDir, plugin, "skills"), {
+    collectSkillsDir(scan2, join13(pluginsDir, plugin, "skills"), {
       source: marketplace,
       scope: "plugin",
       pluginName: plugin
@@ -29509,10 +29906,10 @@ function readMarketplaces(manifestPath) {
   const raw = readOptional(manifestPath);
   if (raw === void 0) return [];
   try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return [];
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return [];
     const out = [];
-    for (const [name, entry] of Object.entries(parsed)) {
+    for (const [name, entry] of Object.entries(parsed2)) {
       const rec = entry;
       const loc = rec?.installLocation;
       if (typeof loc !== "string" || loc.length === 0) continue;
@@ -29552,7 +29949,7 @@ function dedupeMcpServers(servers) {
 }
 function readOptional(path) {
   try {
-    return readFileSync7(path, "utf8");
+    return readFileSync9(path, "utf8");
   } catch {
     return void 0;
   }
@@ -29580,17 +29977,17 @@ function offersMaintenance(gateway, member) {
 import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
 
 // ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
 // ../../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join14 } from "path";
 function readIgnoreLayer(dir, filename, anchorLen) {
   try {
-    return { matcher: (0, import_ignore.default)().add(readFileSync8(join11(dir, filename), "utf8")), anchorLen };
+    return { matcher: (0, import_ignore.default)().add(readFileSync10(join14(dir, filename), "utf8")), anchorLen };
   } catch {
     return void 0;
   }
@@ -29647,17 +30044,17 @@ function resolveInventoryContext(input) {
 }
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
+import { join as join15 } from "path";
 var SESSION_START_MARKER = "session-start-last";
 function claimSessionStart(dataDir2, sessionId) {
   return claimOncePerSession(dataDir2, SESSION_START_MARKER, sessionId);
 }
 function claimOncePerSession(dataDir2, marker, sessionId) {
   if (!sessionId) return true;
-  const path = join12(dataDir2, marker);
+  const path = join15(dataDir2, marker);
   try {
-    if (readFileSync9(path, "utf8") === sessionId) return false;
+    if (readFileSync11(path, "utf8") === sessionId) return false;
   } catch {
   }
   try {
@@ -29669,12 +30066,12 @@ function claimOncePerSession(dataDir2, marker, sessionId) {
 }
 
 // ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
-import { basename as basename5, dirname as dirname3, sep as sep3 } from "path";
+import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
+import { basename as basename5, dirname as dirname4, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync8, readdirSync as readdirSync4 } from "fs";
-import { basename as basename6, join as join13 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync4 } from "fs";
+import { basename as basename6, join as join16 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -29771,8 +30168,8 @@ function resolveProjectFiles(cwd, opts = {}) {
         }
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, dirRel, entry.name, true)) continue;
-          const fullPath = join13(dir, entry.name);
-          if (existsSync8(join13(fullPath, ".git"))) continue;
+          const fullPath = join16(dir, entry.name);
+          if (existsSync9(join16(fullPath, ".git"))) continue;
           if (depth >= bounds.maxDepth) {
             walk.omitted = true;
             continue;
@@ -29844,12 +30241,12 @@ import { randomUUID as randomUUID14 } from "crypto";
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { join as join17 } from "path";
 function throttled(dataDir2, markerName, windowMs) {
-  const marker = join14(dataDir2, markerName);
+  const marker = join17(dataDir2, markerName);
   try {
-    if (Date.now() - statSync6(marker).mtimeMs < windowMs) return true;
+    if (Date.now() - statSync8(marker).mtimeMs < windowMs) return true;
   } catch {
   }
   try {
@@ -29860,25 +30257,1173 @@ function throttled(dataDir2, markerName, windowMs) {
   return false;
 }
 
-// ../../packages/plugin-runtime/src/standalone-gateway.ts
-import { randomUUID as randomUUID15 } from "crypto";
-
-// ../../packages/plugin-runtime/src/recorder.ts
-var PLUGIN_RECORDER_BINARY = "plugin";
-function pluginRecordedBy(version2) {
-  return `${PLUGIN_RECORDER_BINARY}@${version2}`;
+// ../../packages/plugin-runtime/src/attached/with-timeout.ts
+var REQUEST_TIMEOUT_MS = 2e3;
+function withTimeout(promise2, ms) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error("attached gateway request timed out"));
+    }, ms);
+  });
+  promise2.catch(() => void 0);
+  return Promise.race([promise2, timeout]).finally(() => {
+    clearTimeout(timer);
+  });
 }
 
-// ../../packages/plugin-runtime/src/standalone-gateway.ts
-var StandaloneDataGateway = class {
-  db;
-  // Kept for the fingerprint key lookup (exception.key lives beside the store).
-  dataDir;
-  // One notice per gateway — see warnRulesetDiscarded.
-  warnedRulesetDiscarded = false;
-  constructor(dataDir2, detections = [], meta3) {
-    this.db = openLocalDatabase(dataDir2);
-    this.dataDir = dataDir2;
+// ../../packages/plugin-runtime/src/attached/forward-policy.ts
+function isInvalidRequest(err) {
+  return typeof err === "object" && err !== null && err.name === "RemoteRequestInvalid";
+}
+var FORWARD_BUDGET_MS = 1500;
+var DECISION_PATH_BUDGET_MS = 800;
+var BREAKER_FAILURE_THRESHOLD = 3;
+var BREAKER_COOLDOWN_MS = 3e4;
+var CLOSED = { consecutiveFailures: 0, openedAtMs: null, lastFailure: null };
+var FAILURES = /* @__PURE__ */ new Set([
+  "unauthorized",
+  "forbidden",
+  "unreachable"
+]);
+var FORWARD_STATE_FILENAME = "attached-state.json";
+var STATE_FILENAME = FORWARD_STATE_FILENAME;
+function parseBreakerState(raw, nowMs) {
+  try {
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
+    const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
+    const lastFailure = typeof record2.lastFailure === "string" && FAILURES.has(record2.lastFailure) ? record2.lastFailure : null;
+    return { consecutiveFailures: failures, openedAtMs, lastFailure };
+  } catch {
+    return null;
+  }
+}
+function createForwardPolicy(deps) {
+  const now = deps.now ?? (() => Date.now());
+  const file2 = join18(deps.dir, STATE_FILENAME);
+  let state = null;
+  let loading = null;
+  async function readState() {
+    let raw;
+    try {
+      raw = await readFile(file2, "utf8");
+    } catch {
+      return { ...CLOSED };
+    }
+    return parseBreakerState(raw, now()) ?? { ...CLOSED };
+  }
+  async function load() {
+    if (state !== null) return state;
+    loading ??= readState().then((loaded) => {
+      state = loaded;
+      loading = null;
+      return loaded;
+    });
+    return loading;
+  }
+  async function persist(next) {
+    state = next;
+    try {
+      await ensureDataDir(deps.dir);
+      const tmp = `${file2}.${randomUUID15()}.tmp`;
+      await writeFile(tmp, JSON.stringify(next), { encoding: "utf8", mode: DATA_FILE_MODE });
+      await rename(tmp, file2);
+    } catch {
+    }
+  }
+  return {
+    async run(op, opts) {
+      const budget = opts?.decisionPath === true ? DECISION_PATH_BUDGET_MS : FORWARD_BUDGET_MS;
+      let current;
+      try {
+        current = await load();
+      } catch {
+        current = { ...CLOSED };
+      }
+      const at = now();
+      if (current.openedAtMs !== null) {
+        if (at - current.openedAtMs < BREAKER_COOLDOWN_MS) {
+          return { ok: false, reason: "breaker-open" };
+        }
+        await persist({
+          consecutiveFailures: current.consecutiveFailures,
+          openedAtMs: at,
+          lastFailure: current.lastFailure
+        });
+      }
+      try {
+        const value = await withTimeout(op(), budget);
+        if (current.openedAtMs !== null || current.consecutiveFailures > 0) {
+          await persist({ ...CLOSED });
+        }
+        return { ok: true, value };
+      } catch (err) {
+        if (isInvalidRequest(err)) return { ok: false, reason: "invalid-request" };
+        const reason = classifyFailure(err);
+        const failures = current.consecutiveFailures + 1;
+        const shouldOpen = current.openedAtMs !== null || failures >= BREAKER_FAILURE_THRESHOLD;
+        await persist({
+          consecutiveFailures: failures,
+          openedAtMs: shouldOpen ? now() : null,
+          lastFailure: reason
+        });
+        return { ok: false, reason };
+      }
+    }
+  };
+}
+
+// ../../packages/plugin-runtime/src/attached/gateway.ts
+var ACTION_STRENGTH = {
+  allow: 0,
+  log: 1,
+  warn: 2,
+  redact: 3,
+  block: 4
+};
+function ruleCategoryMap(wireRules, localRules) {
+  const map2 = /* @__PURE__ */ new Map();
+  for (const rule of wireRules ?? []) map2.set(rule.id, rule.category);
+  for (const rule of localRules ?? []) map2.set(rule.id, rule.category);
+  for (const pack of bundledDetections()) {
+    for (const rule of pack.rules) map2.set(rule.id, rule.category);
+  }
+  return map2;
+}
+function strongerOf(a, b) {
+  if (a === null) return b;
+  if (b === null) return a;
+  return ACTION_STRENGTH[a] >= ACTION_STRENGTH[b] ? a : b;
+}
+function policyKey(policy) {
+  return "ruleId" in policy.target ? `rule:${policy.target.ruleId}` : `category:${policy.target.category}`;
+}
+function floorFor(policy, categoryByRuleId) {
+  const category = "category" in policy.target ? policy.target.category : categoryByRuleId.get(policy.target.ruleId);
+  return category === void 0 ? null : DEFAULT_ACTIONS[category];
+}
+function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
+  const merged = /* @__PURE__ */ new Map();
+  const disabled = [];
+  const remoteCategoryAction = /* @__PURE__ */ new Map();
+  for (const policy of remotePolicies) {
+    if (!policy.enabled) continue;
+    if (!("category" in policy.target)) continue;
+    if (remoteCategoryAction.has(policy.target.category)) continue;
+    const floor = floorFor(policy, categoryByRuleId);
+    remoteCategoryAction.set(
+      policy.target.category,
+      floor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[floor] ? floor : policy.action
+    );
+  }
+  for (const policy of localPolicies) {
+    if (!policy.enabled) {
+      disabled.push(policy);
+      continue;
+    }
+    const key = policyKey(policy);
+    if (merged.has(key)) continue;
+    let remoteFloor = null;
+    if ("ruleId" in policy.target) {
+      const category = categoryByRuleId.get(policy.target.ruleId);
+      if (category !== void 0) remoteFloor = remoteCategoryAction.get(category) ?? null;
+    }
+    merged.set(
+      key,
+      remoteFloor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[remoteFloor] ? { ...policy, action: remoteFloor } : policy
+    );
+  }
+  const localCategoryAction = /* @__PURE__ */ new Map();
+  for (const policy of merged.values()) {
+    if ("category" in policy.target) localCategoryAction.set(policy.target.category, policy.action);
+  }
+  for (const policy of remotePolicies) {
+    if (!policy.enabled) {
+      disabled.push(policy);
+      continue;
+    }
+    const key = policyKey(policy);
+    const floor = floorFor(policy, categoryByRuleId);
+    let localFloor = null;
+    if ("ruleId" in policy.target) {
+      const category = categoryByRuleId.get(policy.target.ruleId);
+      if (category !== void 0) localFloor = localCategoryAction.get(category) ?? null;
+    }
+    const effectiveFloor = strongerOf(floor, localFloor);
+    const clamped = effectiveFloor !== null && ACTION_STRENGTH[policy.action] < ACTION_STRENGTH[effectiveFloor] ? { ...policy, action: effectiveFloor } : policy;
+    const existing = merged.get(key);
+    if (existing === void 0) {
+      merged.set(key, clamped);
+      continue;
+    }
+    if (ACTION_STRENGTH[clamped.action] > ACTION_STRENGTH[existing.action]) {
+      merged.set(key, clamped);
+    }
+  }
+  return [...merged.values(), ...disabled];
+}
+var AttachedDataGateway = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  /**
+   * The control plane's OWN resolution of this session's inventory, captured by
+   * ensureInventory. Null until the first successful forward — and it stays
+   * null for the whole session when the control plane is unreachable, which is fine:
+   * reKeyForForward then leaves the event's ids alone and the control plane resolves
+   * what it can from the descriptors it already has.
+   */
+  remoteInventory = null;
+  // ---------------------------------------------------------------------
+  // Writes: local first, then forward.
+  // ---------------------------------------------------------------------
+  async recordCapture(record2) {
+    await this.deps.local.recordCapture(record2);
+    await this.deps.forward.run(
+      () => this.deps.client.ingestEvents({
+        events: [record2.event],
+        ...record2.dedupe ? { dedupe: record2.dedupe } : {}
+      }),
+      { decisionPath: true }
+    );
+  }
+  async ensureInventory(ctx) {
+    const resolved = await this.deps.local.ensureInventory(ctx);
+    const remote = await this.deps.forward.run(() => this.deps.client.ingestInventory(ctx));
+    this.remoteInventory = remote.ok ? remote.value : null;
+    const snapshot = await (async () => {
+      try {
+        return await this.deps.posture?.prepare() ?? null;
+      } catch {
+        return null;
+      }
+    })();
+    if (snapshot) {
+      try {
+        await withTimeout(
+          this.deps.posture?.send(snapshot) ?? Promise.resolve(),
+          REQUEST_TIMEOUT_MS
+        );
+      } catch {
+      }
+    }
+    return resolved;
+  }
+  // The id is minted CLIENT-side and stored verbatim: the control plane does NOT
+  // re-key it. `pgAuditValues` writes `id: event.id` and carries tenancy in
+  // its own scoping columns, so the device and the forwarded copy
+  // share one id space — which is what makes a re-post idempotent at all.
+  //
+  // Re-posts collapse via `onConflictDoUpdate` on the `id` PK, guarded by
+  // `setWhere eventType = 'session'` (NOT onConflictDoNothing). That guard is
+  // what makes an attached retry safe: a capture-stubbed session row can still
+  // be HEALED by the authoritative root, while a duplicate non-session event —
+  // a retried tool_call, exactly this path — can never stomp a populated row.
+  async recordAuditEvent(event) {
+    await this.deps.local.recordAuditEvent(event);
+    await this.deps.forward.run(
+      () => this.deps.client.recordAuditEvent(reKeyForForward(event, this.remoteInventory))
+    );
+  }
+  // Attached `llm_call` is written locally by the inner gateway, then routed to
+  // the control plane through the existing `recordAuditEvent` ingest (no dedicated
+  // client method yet) by pre-building the audit event from the natural key.
+  // The forward goes DIRECTLY to the client rather than through this.recordAuditEvent,
+  // which would write the event to the local store a second time.
+  async recordLlmCall(input) {
+    await this.deps.local.recordLlmCall(input);
+    await this.deps.forward.run(
+      () => this.deps.client.recordAuditEvent(
+        reKeyForForward(llmAuditEvent(input), this.remoteInventory)
+      )
+    );
+  }
+  /**
+   * Forward one batch, item by item, under ONE aggregate deadline.
+   *
+   * Per-item budgets bound each request and nothing bounded their sum — see
+   * BATCH_FORWARD_BUDGET_MS. When the deadline passes the remainder is dropped
+   * rather than sent: the local write has already succeeded, so every caller
+   * has a correct result to return, and a drop is the outcome this path is
+   * built to accept (G8) where a blown hook timeout is not.
+   *
+   * Serial rather than concurrent on purpose. Firing N requests at once would
+   * trade a latency problem for a burst the plane's own per-key rate limiting
+   * would answer with the refusals the breaker then counts.
+   *
+   * WHAT IS DROPPED IS COUNTED. Every other forward failure ends in
+   * `ForwardPolicy.run`'s catch and moves the breaker's file, which is what
+   * lets status call the forward unhealthy; this path returns BEFORE `run` is
+   * reached, so without the tally in `forward-drops.ts` a slow-but-answering
+   * plane produces no failures, keeps the breaker closed, renders a healthy
+   * block, and discards the tail of every batch indefinitely.
+   */
+  async forwardBatch(inputs, toEvent) {
+    const deadline = Date.now() + BATCH_FORWARD_BUDGET_MS;
+    for (let i = 0; i < inputs.length; i += 1) {
+      const now = Date.now();
+      if (now >= deadline) {
+        recordForwardDrops(this.deps.dataDir, inputs.length - i, now);
+        return;
+      }
+      const input = inputs[i];
+      await this.deps.forward.run(
+        () => this.deps.client.recordAuditEvent(reKeyForForward(toEvent(input), this.remoteInventory))
+      );
+    }
+  }
+  // Delegated as a BATCH rather than looped over recordLlmCall: the inner
+  // gateway may write the whole batch in one local transaction, and looping
+  // here would replace that with N separate local writes.
+  async recordLlmCalls(inputs) {
+    await this.deps.local.recordLlmCalls(inputs);
+    await this.forwardBatch(inputs, (input) => llmAuditEvent(input));
+  }
+  // `input.inspections` (secrets detected client-side in the tool's masked
+  // target) ride along on the request's `inspections` field — the control plane
+  // persists each as an inspection_findings row linked to this audit event
+  // (see RecordAuditEventRequest in @akasecurity/schema). The masked
+  // `target` already rides `input.attributes`, so no raw secret leaks either
+  // way — this only stops the FINDING row itself from being dropped.
+  async recordToolCalls(inputs) {
+    await this.deps.local.recordToolCalls(inputs);
+    await this.forwardBatch(inputs, (input) => toolAuditEvent(input));
+  }
+  // Forwarded as a `config_scan` audit event: there is no dedicated
+  // config-scan ingest endpoint, and the audit-event door is the one the
+  // control plane already opens for client-minted, idempotent records.
+  //
+  // ONLY `scanEvent` CROSSES, and unlike `recordCapture` the plane cannot
+  // re-derive the rest. A `ConfigScanRecord` is four things committed together
+  // locally — the inventory `items`, this audit event, and the posture
+  // `definitions`/`findings` that reference it — and three of them stay on the
+  // device. Say that plainly rather than let the asymmetry with `recordCapture`
+  // read as the same argument: there, findings are omitted BECAUSE the plane
+  // re-derives them from `Event.content`; here there is no content to re-derive
+  // from, so what is omitted is simply not sent.
+  //
+  // That is the wire contract as it stands rather than an oversight to patch
+  // here. `items` has no route at all, and `RecordAuditEventRequest.inspections`
+  // is documented as tool-call findings — widening it to carry config-scan
+  // findings is an egress change (a posture finding's `maskedMatch` holds the
+  // matched command) and a decision about what an attached deployment is
+  // entitled to, not a bug fix. An attached machine's config posture therefore
+  // reaches the plane as the event only; the dashboard's own view of it is the
+  // local store.
+  async recordConfigScan(record2) {
+    await this.deps.local.recordConfigScan(record2);
+    await this.deps.forward.run(
+      () => this.deps.client.recordAuditEvent(reKeyForForward(record2.scanEvent, this.remoteInventory))
+    );
+  }
+  async recordBlockedDetection(entry) {
+    return this.deps.local.recordBlockedDetection(entry);
+  }
+  /**
+   * LOCAL-ONLY, deliberately. The shares API is read-plus-decision-override
+   * with no egress ingest endpoint, so there is nothing to forward to; adding a
+   * forward here would be inventing a wire contract that does not exist. The
+   * local write is the whole operation, and its summary is the real one — the
+   * scanner reads a throw as a FAILED WRITE and skips its ledger commit, so
+   * returning the inner gateway's result keeps the retry semantics honest.
+   */
+  async recordProjectEgress(input) {
+    return this.deps.local.recordProjectEgress(input);
+  }
+  // ---------------------------------------------------------------------
+  // Reads and device-local ledgers: pure delegation.
+  // ---------------------------------------------------------------------
+  async configInventoryReport() {
+    return this.deps.local.configInventoryReport();
+  }
+  async readSessionProvider(sessionId) {
+    return this.deps.local.readSessionProvider(sessionId);
+  }
+  async facets() {
+    return this.deps.local.facets();
+  }
+  /**
+   * Delegated UNMODIFIED — including its refusals.
+   *
+   * This is a fail-secure boundary: it decides whether an approved exception
+   * lets a blocked action through. Under local-first the local store owns the
+   * exception ledger, so the honest answer is whatever it says; wrapping this
+   * in a fallback (`catch { return true }`, or defaulting on a timeout) would
+   * turn a store error into a granted bypass. If the inner gateway rejects,
+   * this rejects, and the runtime's own handling decides — which is asserted
+   * end-to-end through runtime.capture rather than here.
+   */
+  async consumeException(id) {
+    return this.deps.local.consumeException(id);
+  }
+  async recentFindings(opts) {
+    return this.deps.local.recentFindings(opts);
+  }
+  async healthSummary() {
+    return this.deps.local.healthSummary();
+  }
+  async activityByDay(days) {
+    return this.deps.local.activityByDay(days);
+  }
+  async tokenReports() {
+    return this.deps.local.tokenReports();
+  }
+  async knownContentHashes() {
+    return this.deps.local.knownContentHashes();
+  }
+  async scanLedger(rulesetHash) {
+    return this.deps.local.scanLedger(rulesetHash);
+  }
+  async recordScanned(entries) {
+    return this.deps.local.recordScanned(entries);
+  }
+  async getRuleProbeVerdict(ruleKey) {
+    return this.deps.local.getRuleProbeVerdict(ruleKey);
+  }
+  async setRuleProbeVerdict(ruleKey, verdict, worstProbeMs) {
+    return this.deps.local.setRuleProbeVerdict(ruleKey, verdict, worstProbeMs);
+  }
+  async openAtRestKeysForPath(path) {
+    return this.deps.local.openAtRestKeysForPath(path);
+  }
+  async resolvedAtRestKeysForPath(path) {
+    return this.deps.local.resolvedAtRestKeysForPath(path);
+  }
+  async insertResolution(input) {
+    return this.deps.local.insertResolution(input);
+  }
+  async close() {
+    return this.deps.local.close();
+  }
+  // ---------------------------------------------------------------------
+  // Policy
+  // ---------------------------------------------------------------------
+  async getPolicyBundle() {
+    const local = await this.deps.local.getPolicyBundle();
+    const cached2 = await (async () => {
+      try {
+        return await this.deps.readCachedBundle();
+      } catch {
+        return null;
+      }
+    })();
+    if (cached2 === null) return local;
+    const byRuleId = /* @__PURE__ */ new Map();
+    for (const rule of [...local.rules ?? [], ...cached2.rules ?? []]) {
+      if (!byRuleId.has(rule.id)) byRuleId.set(rule.id, rule);
+    }
+    const rules = [...byRuleId.values()];
+    return {
+      ...local,
+      // The remote version identifies the composed bundle for the poller.
+      version: cached2.version,
+      rules,
+      policies: mergeRaiseOnly(
+        local.policies,
+        cached2.policies,
+        ruleCategoryMap(cached2.rules, local.rules)
+      ),
+      customKeywords: [...local.customKeywords, ...cached2.customKeywords]
+      // `rulesComplete` is a STANDALONE-ONLY signal (the user's local installed
+      // snapshot) and is taken from the LOCAL bundle only — never from the wire
+      // or the on-disk cache. Honoring a cached one would hand the control plane, or
+      // anything able to write policy-cache.json, a kill-switch over the
+      // compiled-in bundled packs: `{ rulesComplete: true, rules: [] }` would
+      // zero local detection. Spread from `local` above, and deliberately not
+      // re-read from `cached` here.
+      //
+      // THREE MORE OF THE CACHED BUNDLE'S FIELDS ARE DROPPED, each on purpose,
+      // and each named here so a reader can tell a decision from an omission:
+      //
+      //   `exceptions`        — an exception SUPPRESSES a detection, so honoring
+      //                         one from an unsigned on-disk cache would let
+      //                         anything able to write that file turn rules off.
+      //                         Every other field this merge accepts can only
+      //                         RAISE enforcement; this is the one that cannot,
+      //                         so it stays local-only until the bundle is
+      //                         signed. Exceptions remain a device-local ledger.
+      //   `reversibleRuleIds` — the Redact & Vault archetype makes a redaction
+      //                         recoverable, which is a CUSTODY change: it puts
+      //                         the detected value in the local vault instead of
+      //                         destroying it. Taking that instruction from the
+      //                         cache would let a remote party turn one-way
+      //                         redaction into retention. Dropping it keeps the
+      //                         one-way behaviour, which the schema itself calls
+      //                         "the safe direction to default".
+      //   `ruleVersions`      — remote rules fall back to their own spec version.
+      //                         Cosmetic rather than protective: it only affects
+      //                         how a finding is version-attributed, and the two
+      //                         sides may therefore attribute org rules
+      //                         differently. Worth carrying once there is a
+      //                         reader that needs it; nothing reads it today.
+    };
+  }
+  // ---------------------------------------------------------------------
+  // LocalStoreMaintenance — by delegation (D3).
+  //
+  // Implementing these is what actually closes the skipped-local-maintenance
+  // gap: the OSS structural guard `hasLocalStoreMaintenance()` is satisfied by
+  // any object carrying all five, so the composite qualifies and SessionStart
+  // runs maintenance on the device's real store.
+  //
+  // ⚠ Two of the five are SYNCHRONOUS and must stay that way. `handle-session-start`
+  // calls `capWarnEraEnforcement` without `await` and uses `staleBinaryNotice`'s
+  // return value directly; declaring them `async` here would hand those call
+  // sites a Promise and silently break both.
+  // ---------------------------------------------------------------------
+  async sweepTerminalExceptions(retentionMs) {
+    return this.deps.local.sweepTerminalExceptions(retentionMs);
+  }
+  capWarnEraEnforcement(policyMode) {
+    return this.deps.local.capWarnEraEnforcement(policyMode);
+  }
+  async recordProjectFiles(projectId, scan2) {
+    return this.deps.local.recordProjectFiles(projectId, scan2);
+  }
+  async reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot) {
+    return this.deps.local.reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot);
+  }
+  staleBinaryNotice(currentVersion) {
+    return this.deps.local.staleBinaryNotice(currentVersion);
+  }
+};
+function reKeyForForward(event, remote) {
+  if (remote === null) {
+    const stripped = { ...event };
+    delete stripped.hostId;
+    delete stripped.harnessId;
+    delete stripped.sourceProjectId;
+    return stripped;
+  }
+  const rekeyed = { ...event };
+  delete rekeyed.hostId;
+  delete rekeyed.harnessId;
+  delete rekeyed.sourceProjectId;
+  if (remote.hostId !== void 0) rekeyed.hostId = remote.hostId;
+  if (remote.harnessId !== void 0) rekeyed.harnessId = remote.harnessId;
+  if (remote.sourceProjectId !== void 0) rekeyed.sourceProjectId = remote.sourceProjectId;
+  return rekeyed;
+}
+var BATCH_FORWARD_BUDGET_MS = 3e3;
+function llmAuditEvent(input) {
+  return {
+    id: llmCallId(input.sessionId, input.messageId),
+    eventType: "llm_call",
+    startedAt: input.startedAt,
+    parentId: input.parentId,
+    rootSessionId: input.rootSessionId,
+    attributes: input.attributes
+  };
+}
+function toolAuditEvent(input) {
+  return {
+    id: toolCallId(input.sessionId, input.toolUseId),
+    eventType: "tool_call",
+    startedAt: input.startedAt,
+    parentId: input.parentId,
+    rootSessionId: input.rootSessionId,
+    attributes: input.attributes,
+    inspections: input.inspections
+  };
+}
+
+// ../../packages/plugin-runtime/src/attached/policy-store.ts
+import { randomUUID as randomUUID16 } from "crypto";
+import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
+import { join as join19 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/atomic-publish.ts
+import { rename as rename2 } from "fs/promises";
+var RETRYABLE = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
+var ATTEMPTS = 5;
+var delay = (ms) => new Promise((resolve2) => {
+  setTimeout(resolve2, ms);
+});
+async function publishByRename(tmp, file2, move = rename2) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await move(tmp, file2);
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (attempt >= ATTEMPTS || code === void 0 || !RETRYABLE.has(code)) throw err;
+      await delay(attempt * 10);
+    }
+  }
+}
+
+// ../../packages/plugin-runtime/src/attached/policy-store.ts
+function createPolicyStore(dir = dataDir()) {
+  const file2 = join19(dir, "policy-cache.json");
+  async function read() {
+    try {
+      const raw = await readFile2(file2, "utf8");
+      const parsed2 = JSON.parse(raw);
+      if (typeof parsed2 !== "object" || parsed2 === null) return null;
+      const record2 = parsed2;
+      const bundle = PolicyBundle.parse(record2.bundle);
+      const fetchedAtMs = typeof record2.fetchedAtMs === "number" ? record2.fetchedAtMs : 0;
+      const etag = typeof record2.etag === "string" ? record2.etag : void 0;
+      return { bundle, fetchedAtMs, ...etag === void 0 ? {} : { etag } };
+    } catch {
+      return null;
+    }
+  }
+  async function write(bundle, etag) {
+    await ensureDataDir(dir);
+    const stored = {
+      bundle,
+      fetchedAtMs: Date.now(),
+      ...etag === void 0 ? {} : { etag }
+    };
+    const tmp = `${file2}.${randomUUID16()}.tmp`;
+    try {
+      await writeFile2(tmp, JSON.stringify(stored), {
+        encoding: "utf8",
+        mode: DATA_FILE_MODE,
+        flag: "wx"
+      });
+      await publishByRename(tmp, file2);
+    } catch (err) {
+      await rm(tmp, { force: true }).catch(() => void 0);
+      throw err;
+    }
+  }
+  return { read, write, file: file2 };
+}
+
+// ../../packages/remote/src/http.ts
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+var RemoteRequestError = class extends Error {
+  constructor(status) {
+    super(`control-plane request failed with status ${String(status)}`);
+    this.status = status;
+    this.name = "RemoteRequestError";
+  }
+  status;
+};
+var RemoteRequestInvalid = class extends Error {
+  constructor(route, cause) {
+    super(`refusing to send a malformed body to ${route}`);
+    this.cause = cause;
+    this.name = "RemoteRequestInvalid";
+  }
+  cause;
+};
+var RemoteResponseInvalid = class extends Error {
+  constructor(route, detail) {
+    super(`control plane answered ${route} with ${detail}`);
+    this.name = "RemoteResponseInvalid";
+  }
+};
+var RemoteTransportError = class extends Error {
+  /**
+   * The status the peer sent, when headers arrived and only the BODY was
+   * refused.
+   *
+   * Undefined for the ordinary case this class was written for — no answer at
+   * all. It exists because two paths reject after a status has already been
+   * delivered: an oversized body and an aborted response. Discarding it there
+   * reported a deployment answering 401 with a verbose body as a network
+   * outage, which sends the reader to look at their network instead of their
+   * credential.
+   */
+  constructor(reason, status) {
+    super(`control-plane request did not complete: ${reason}`);
+    this.status = status;
+    this.name = "RemoteTransportError";
+  }
+  status;
+};
+async function send(options) {
+  const url2 = new URL(options.url);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const send_ = url2.protocol === "http:" ? httpRequest : httpsRequest;
+  const requestOptions = {
+    method: options.method,
+    headers: {
+      // CALLER HEADERS FIRST, so this module's own are not overridable. Spread
+      // last they win, and two of the values below are ones no caller may
+      // replace: `x-api-key` is the credential, and `content-length` is the
+      // byte count that stops a multi-byte body being truncated by the
+      // receiver. `SendOptions.headers` is a free-form record on an exported
+      // function, so "no caller does that today" is not the guarantee to rely
+      // on. The one header any caller actually passes — `if-none-match` on the
+      // conditional GET — is untouched by this order.
+      ...options.headers,
+      // The credential. One header, matching what the deployment authenticates
+      // on; a second copy in an `Authorization` header would be one more place
+      // it can be logged by an intermediary for no gain.
+      "x-api-key": options.apiKey,
+      accept: "application/json",
+      ...options.body === void 0 ? {} : {
+        "content-type": "application/json",
+        // Byte length, not string length: a multi-byte body sent with a
+        // character count is truncated by the receiver.
+        "content-length": String(Buffer.byteLength(options.body))
+      }
+    }
+  };
+  return new Promise((resolve2, reject) => {
+    let settled = false;
+    const fail = (reason, status) => {
+      if (settled) return;
+      settled = true;
+      reject(new RemoteTransportError(reason, status));
+    };
+    const req = send_(url2, requestOptions, (res) => {
+      const chunks = [];
+      let size = 0;
+      res.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_RESPONSE_BYTES) {
+          fail(`response exceeded ${String(MAX_RESPONSE_BYTES)} bytes`, res.statusCode);
+          res.destroy();
+          req.destroy();
+          return;
+        }
+        chunks.push(chunk);
+      });
+      res.on("aborted", () => {
+        fail("the response was aborted", res.statusCode);
+      });
+      res.on("end", () => {
+        if (settled) return;
+        settled = true;
+        resolve2({
+          status: res.statusCode ?? 0,
+          headers: res.headers,
+          body: Buffer.concat(chunks).toString("utf8")
+        });
+      });
+    });
+    const deadline = setTimeout(() => {
+      fail(`no response within ${String(timeoutMs)}ms`);
+      req.destroy();
+    }, timeoutMs);
+    deadline.unref();
+    req.on("upgrade", (_res, socket) => {
+      fail("the deployment answered with a protocol upgrade");
+      socket.destroy();
+    });
+    req.on("close", () => {
+      fail("the connection closed before a response was read");
+      clearTimeout(deadline);
+    });
+    req.on("error", (err) => {
+      fail(err.message);
+    });
+    if (options.body !== void 0) req.write(options.body);
+    req.end();
+  });
+}
+
+// ../../packages/remote/src/client.ts
+var ROUTES = {
+  events: "/v1/events",
+  auditEvents: "/v1/audit-events",
+  inventory: "/v1/inventory",
+  storePosture: "/v1/store-posture",
+  policyBundle: "/v1/policy-bundle",
+  whoami: "/v1/plugin/whoami"
+};
+function headerValue(response, name) {
+  const raw = response.headers[name];
+  if (raw === void 0) return void 0;
+  return Array.isArray(raw) ? raw[0] : raw;
+}
+function okBody(response) {
+  if (response.status < 200 || response.status >= 300) {
+    throw new RemoteRequestError(response.status);
+  }
+  return response.body;
+}
+function parsed(schema, body, route) {
+  let json2;
+  try {
+    json2 = JSON.parse(body);
+  } catch {
+    throw new RemoteResponseInvalid(route, "a body that is not JSON");
+  }
+  const result = schema.safeParse(json2);
+  if (!result.success) {
+    throw new RemoteResponseInvalid(route, "a body this client cannot read");
+  }
+  return result.data;
+}
+function withoutTrailingSlashes(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
+  return endpoint.slice(0, end);
+}
+var SLASH = "/".charCodeAt(0);
+function createRemoteClient(options) {
+  const base = withoutTrailingSlashes(options.endpoint);
+  const url2 = (route) => `${base}${route}`;
+  const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
+  return {
+    async ingestEvents(batch) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.events),
+        body: JSON.stringify(batch)
+      });
+      return parsed(IngestAck, okBody(response), ROUTES.events);
+    },
+    async ingestInventory(context) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.inventory),
+        body: JSON.stringify(context)
+      });
+      return parsed(ResolvedInventory, okBody(response), ROUTES.inventory);
+    },
+    async recordAuditEvent(event) {
+      const validated = RecordAuditEventRequest.safeParse(event);
+      if (!validated.success) throw new RemoteRequestInvalid(ROUTES.auditEvents, validated.error);
+      const submission = validated.data;
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.auditEvents),
+        body: JSON.stringify(submission)
+      });
+      okBody(response);
+    },
+    async reportStorePosture(snapshot) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.storePosture),
+        body: JSON.stringify(snapshot)
+      });
+      okBody(response);
+    },
+    async getPolicyBundle(etag) {
+      const response = await send({
+        ...common,
+        method: "GET",
+        url: url2(ROUTES.policyBundle),
+        ...etag === void 0 ? {} : { headers: { "if-none-match": etag } }
+      });
+      if (response.status === 304) {
+        return { changed: false, etag: headerValue(response, "etag") ?? etag };
+      }
+      const bundle = parsed(PolicyBundle, okBody(response), ROUTES.policyBundle);
+      return { changed: true, bundle, etag: headerValue(response, "etag") };
+    },
+    async whoami() {
+      const response = await send({ ...common, method: "GET", url: url2(ROUTES.whoami) });
+      return parsed(PluginWhoami, okBody(response), ROUTES.whoami);
+    }
+  };
+}
+
+// ../../packages/plugin-runtime/src/attached/posture-reporter.ts
+var POSTURE_REPORT_INTERVAL_MS = 60 * 60 * 1e3;
+function createPostureReporter(deps) {
+  async function prepare() {
+    try {
+      const state = await withTimeout(deps.store.read(), REQUEST_TIMEOUT_MS);
+      if (state === null) return null;
+      const nowMs = deps.now();
+      const elapsed = nowMs - state.lastAttemptedAtMs;
+      if (elapsed >= 0 && elapsed < POSTURE_REPORT_INTERVAL_MS) return null;
+      try {
+        await withTimeout(deps.store.markAttempted(state.deviceId, nowMs), REQUEST_TIMEOUT_MS);
+      } catch {
+      }
+      const { readError, ...measurement } = deps.readStore();
+      if (readError) return null;
+      let plugin;
+      try {
+        plugin = await deps.pluginBlock?.();
+      } catch {
+        plugin = void 0;
+      }
+      return {
+        deviceId: state.deviceId,
+        hostname: deps.hostname(),
+        capturedAt: nowMs,
+        ...measurement,
+        // Omit the key rather than spread an explicit `undefined` —
+        // exactOptionalPropertyTypes distinguishes the two, and the bridge in
+        // factory.ts keys on presence.
+        ...plugin === void 0 ? {} : { plugin }
+      };
+    } catch {
+      return null;
+    }
+  }
+  async function send2(snapshot) {
+    try {
+      await deps.report(snapshot);
+    } catch {
+    }
+  }
+  return { prepare, send: send2 };
+}
+
+// ../../packages/plugin-runtime/src/attached/posture-snapshot.ts
+import { statSync as statSync9 } from "fs";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+
+// ../../packages/plugin-runtime/src/attached/action-counts.ts
+function emptyActionCounts() {
+  return Object.fromEntries(ACTION_TAKEN_KEYS.map((a) => [a, 0]));
+}
+function isActionTaken(value) {
+  return ACTION_TAKEN_KEYS.includes(value);
+}
+
+// ../../packages/plugin-runtime/src/attached/posture-snapshot.ts
+var CAPTURE_EVENT_TYPES_SQL2 = `('prompt','response','code_change','tool_use')`;
+function isSchemaAbsent(err) {
+  return err instanceof Error && /no such table/i.test(err.message);
+}
+function emptyReadout(readError = false) {
+  const byAction = emptyActionCounts();
+  return {
+    storePresent: false,
+    schemaVersion: null,
+    findingsTotal: 0,
+    findingsFirstAt: null,
+    findingsLastAt: null,
+    packs: [],
+    policyCounts: { total: 0, disabled: 0, byAction },
+    readError
+  };
+}
+function readStorePosture(dbPath2) {
+  try {
+    statSync9(dbPath2);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return emptyReadout();
+    return emptyReadout(true);
+  }
+  let db = null;
+  let version2 = null;
+  let packs2 = [];
+  let policyCounts = {
+    total: 0,
+    disabled: 0,
+    byAction: emptyActionCounts()
+  };
+  let findingsTotal = 0;
+  let findingsFirstAt = null;
+  let findingsLastAt = null;
+  const currentReadout = () => ({
+    storePresent: true,
+    schemaVersion: version2,
+    findingsTotal,
+    findingsFirstAt,
+    findingsLastAt,
+    packs: packs2,
+    policyCounts,
+    readError: false
+  });
+  try {
+    db = new DatabaseSync3(dbPath2, { readOnly: true });
+    db.exec("PRAGMA busy_timeout = 2000");
+    version2 = db.prepare("PRAGMA user_version").get().user_version;
+    try {
+      const packRows = db.prepare(
+        `SELECT namespace, pack_id, version, enabled, updated_at FROM installed_packs ORDER BY namespace, pack_id`
+      ).all();
+      packs2 = packRows.map((r) => ({
+        packId: `${r.namespace}/${r.pack_id}`,
+        version: r.version,
+        enabled: r.enabled !== 0,
+        updatedAt: r.updated_at == null ? null : String(r.updated_at)
+      }));
+    } catch (err) {
+      if (!isSchemaAbsent(err)) throw err;
+    }
+    try {
+      const policyRows = db.prepare(`SELECT action, enabled FROM policies`).all();
+      const byAction = emptyActionCounts();
+      let disabled = 0;
+      for (const row of policyRows) {
+        if (row.enabled === 0) disabled += 1;
+        if (isActionTaken(row.action)) byAction[row.action] += 1;
+      }
+      policyCounts = { total: policyRows.length, disabled, byAction };
+    } catch (err) {
+      if (!isSchemaAbsent(err)) throw err;
+    }
+    try {
+      const agg = db.prepare(
+        `SELECT count(*) AS n, min(f.first_detected_at) AS firstAt, max(f.first_detected_at) AS lastAt
+             FROM inspection_findings f JOIN audit_events e ON e.id = f.audit_event_id
+            WHERE e.event_type IN ${CAPTURE_EVENT_TYPES_SQL2}`
+      ).get();
+      findingsTotal = agg.n;
+      findingsFirstAt = agg.firstAt;
+      findingsLastAt = agg.lastAt;
+    } catch (err) {
+      if (!isSchemaAbsent(err)) throw err;
+    }
+    return currentReadout();
+  } catch {
+    return emptyReadout(true);
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+}
+
+// ../../packages/plugin-runtime/src/attached/posture-store.ts
+import { randomUUID as randomUUID17 } from "crypto";
+import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { join as join20 } from "path";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function createPostureStore(dir = settingsDir(), legacyDir) {
+  const file2 = join20(dir, "posture-state.json");
+  const legacyFile = legacyDir === void 0 ? null : join20(legacyDir, "posture-state.json");
+  async function persist(state) {
+    await ensureDataDir(dir);
+    const tmp = `${file2}.${randomUUID17()}.tmp`;
+    try {
+      await writeFile3(tmp, JSON.stringify(state), { encoding: "utf8", mode: DATA_FILE_MODE });
+      await publishByRename(tmp, file2);
+    } catch (err) {
+      await rm2(tmp, { force: true }).catch(() => void 0);
+      throw err;
+    }
+  }
+  async function readFrom(path) {
+    let raw;
+    try {
+      raw = await readFile3(path, "utf8");
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT" || code === "ENOTDIR") return null;
+      throw err;
+    }
+    try {
+      const parsed2 = JSON.parse(raw);
+      if (typeof parsed2 === "object" && parsed2 !== null) {
+        const record2 = parsed2;
+        if (typeof record2.deviceId === "string" && UUID_RE.test(record2.deviceId)) {
+          const stamp = typeof record2.lastAttemptedAtMs === "number" ? record2.lastAttemptedAtMs : typeof record2.lastReportedAtMs === "number" ? record2.lastReportedAtMs : 0;
+          return { deviceId: record2.deviceId, lastAttemptedAtMs: stamp };
+        }
+      }
+    } catch {
+    }
+    return null;
+  }
+  async function read() {
+    const current = await readFrom(file2);
+    if (current) return current;
+    const legacy = legacyFile === null || legacyFile === file2 ? null : await readFrom(legacyFile).catch(() => null);
+    if (legacy) {
+      try {
+        await persist(legacy);
+      } catch {
+      }
+      return legacy;
+    }
+    const fresh = { deviceId: randomUUID17(), lastAttemptedAtMs: 0 };
+    try {
+      await ensureDataDir(dir);
+      if (createOwnerOnlyFileSync(file2, JSON.stringify(fresh))) return fresh;
+    } catch {
+      return null;
+    }
+    const winner = await readFrom(file2).catch(() => null);
+    if (winner) return winner;
+    try {
+      await persist(fresh);
+    } catch {
+      return null;
+    }
+    return fresh;
+  }
+  async function markAttempted(deviceId, atMs) {
+    await persist({ deviceId, lastAttemptedAtMs: atMs });
+  }
+  return { read, markAttempted, file: file2 };
+}
+
+// ../../packages/plugin-runtime/src/attached/sync-state.ts
+import { readFileSync as readFileSync13 } from "fs";
+import { join as join21 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/status.ts
+var REFUSAL_LINES = {
+  unauthorized: "KEY REJECTED \u2014 re-attach with a valid plugin key",
+  forbidden: "ACCESS REFUSED \u2014 key is valid but not permitted; ask your org admin"
+};
+var OUTCOME_LINES = {
+  ok: "policy synced",
+  "not-modified": "policy up to date",
+  unauthorized: REFUSAL_LINES.unauthorized,
+  forbidden: REFUSAL_LINES.forbidden,
+  unreachable: "control plane unreachable at last attempt",
+  "invalid-bundle": "control plane sent a policy bundle this build cannot read"
+};
+
+// ../../packages/plugin-runtime/src/attached/sync-trigger.ts
+import { spawn } from "child_process";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var SYNC_MARKER_NAME = "sync-last-attempt";
+var SYNC_SCRIPT_NAME = "sync.js";
+var SYNC_THROTTLE_MS = 15 * 60 * 1e3;
+function triggerPolicySync(config2, deps = {}) {
+  try {
+    if (!isAttached(config2.settings)) return;
+    const connection = config2.settings.controlPlane;
+    if (connection === void 0) return;
+    if (!readControlPlaneCredentialState(config2.settingsDir, connection).usable) return;
+    const isThrottled = deps.isThrottled ?? ((dir) => throttled(dir, SYNC_MARKER_NAME, SYNC_THROTTLE_MS));
+    if (isThrottled(config2.dataDir)) return;
+    const scriptPath = fileURLToPath2(deps.scriptUrl ?? new URL(SYNC_SCRIPT_NAME, import.meta.url));
+    (deps.spawnChild ?? spawnDetached)(scriptPath);
+  } catch {
+  }
+}
+function spawnDetached(scriptPath) {
+  const child = spawn(process.execPath, [scriptPath], { detached: true, stdio: "ignore" });
+  child.on("error", () => {
+  });
+  child.unref();
+}
+
+// ../../packages/plugin-runtime/src/attached/factory.ts
+import { hostname as hostname5 } from "os";
+
+// ../../packages/plugin-runtime/src/standalone-gateway.ts
+import { randomUUID as randomUUID18 } from "crypto";
+
+// ../../packages/plugin-runtime/src/recorder.ts
+var PLUGIN_RECORDER_BINARY = "plugin";
+function pluginRecordedBy(version2) {
+  return `${PLUGIN_RECORDER_BINARY}@${version2}`;
+}
+
+// ../../packages/plugin-runtime/src/standalone-gateway.ts
+var StandaloneDataGateway = class {
+  db;
+  // Kept for the fingerprint key lookup (exception.key lives beside the store).
+  dataDir;
+  // One notice per gateway — see warnRulesetDiscarded.
+  warnedRulesetDiscarded = false;
+  constructor(dataDir2, detections = [], meta3) {
+    this.db = openLocalDatabase(dataDir2);
+    this.dataDir = dataDir2;
     this.db.installedPacks.recordInventory(detections, meta3);
   }
   recordCapture(record2) {
@@ -29905,12 +31450,12 @@ var StandaloneDataGateway = class {
   // reconciler drops the whole pass and recovers it idempotently on the next read.
   recordLlmCalls(inputs) {
     if (inputs.length === 0) return Promise.resolve();
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         this.db.auditEvents.runInTransaction(() => {
           for (const input of inputs) this.db.auditEvents.insertLlmCall(input);
         });
-        resolve();
+        resolve2();
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -29922,12 +31467,12 @@ var StandaloneDataGateway = class {
   // drops the whole pass and recovers it idempotently next time.
   recordToolCalls(inputs) {
     if (inputs.length === 0) return Promise.resolve();
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         this.db.auditEvents.runInTransaction(() => {
           for (const input of inputs) this.writeToolCall(input);
         });
-        resolve();
+        resolve2();
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -30069,7 +31614,7 @@ var StandaloneDataGateway = class {
     const customKeywords = [...new Set(policies.flatMap((p) => p.customKeywords ?? []))];
     const installed = this.installedScanRules();
     const rulePolicies = installed ? [...installed.ruleActions].map(([ruleId, action]) => ({
-      id: randomUUID15(),
+      id: randomUUID18(),
       scope: "global",
       target: { ruleId },
       action,
@@ -30223,15 +31768,61 @@ var StandaloneDataGateway = class {
   }
 };
 
+// ../../packages/plugin-runtime/src/attached/factory.ts
+function resolveGatewayForConfig(config2, meta3) {
+  const local = new StandaloneDataGateway(config2.dataDir, bundledDetections(), meta3);
+  try {
+    if (!isAttached(config2.settings)) return local;
+    const connection = config2.settings.controlPlane;
+    if (connection === void 0) return local;
+    const state = readControlPlaneCredentialState(config2.settingsDir, connection);
+    if (!state.usable) return local;
+    const client = createRemoteClient({
+      endpoint: connection.endpoint,
+      apiKey: state.credential.apiKey
+    });
+    const store = createPolicyStore(config2.dataDir);
+    const postureStore = createPostureStore(config2.settingsDir, config2.dataDir);
+    const forward = createForwardPolicy({ dir: config2.dataDir });
+    return new AttachedDataGateway({
+      local,
+      client,
+      dataDir: config2.dataDir,
+      readCachedBundle: () => store.read().then((cached2) => cached2?.bundle ?? null),
+      forward,
+      posture: createPostureReporter({
+        // THROUGH THE BREAKER, and wrapped HERE rather than around
+        // `PostureReporter.send`. The reporter swallows every error by
+        // contract, so a wrap outside it would hand `forward.run` a resolved
+        // promise for a send that failed — recording a SUCCESS, clearing
+        // `consecutiveFailures` and `lastFailure`, and telling `aka status` the
+        // forward recovered when nothing did. Wrapping the raw client call puts
+        // the breaker above the swallow, where it can see the truth.
+        //
+        // What it buys: once the breaker is open — the plane already confirmed
+        // down by the gateway's own writes — this stops paying a request
+        // timeout per throttle interval to re-learn it.
+        report: (snapshot) => forward.run(() => client.reportStorePosture(snapshot)).then(() => void 0),
+        store: postureStore,
+        readStore: () => readStorePosture(config2.dbPath),
+        hostname: () => hostname5(),
+        now: () => Date.now()
+      })
+    });
+  } catch {
+    return local;
+  }
+}
+
 // ../../packages/plugin-runtime/src/resolve.ts
-var standaloneGatewayFactory = (config2, meta3) => new StandaloneDataGateway(config2.dataDir, bundledDetections(), meta3);
-var defaultGatewayFactory = standaloneGatewayFactory;
+var configuredGatewayFactory = (config2, meta3) => resolveGatewayForConfig(config2, meta3);
+var defaultGatewayFactory = configuredGatewayFactory;
 function resolveDataGateway(config2, meta3, gatewayFactory = defaultGatewayFactory) {
   return gatewayFactory(config2, meta3);
 }
 
 // ../../packages/plugin-runtime/src/handle-session-start.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 async function handleSessionStart(input, config2 = loadConfig()) {
   const silent = { staleBinaryNotice: null };
@@ -30295,6 +31886,7 @@ async function handleSessionStart(input, config2 = loadConfig()) {
         } catch {
         }
       }
+      triggerPolicySync(config2);
       if (input.harnessVersion !== void 0 && offersMaintenance(gateway, "staleBinaryNotice")) {
         return { staleBinaryNotice: gateway.staleBinaryNotice(input.harnessVersion) };
       }
@@ -30320,7 +31912,7 @@ async function recordConfigInventory(gateway, sessionId, cwd, homeDir) {
 }
 function buildConfigScanEvent(sessionId, scan2) {
   return {
-    id: randomUUID16(),
+    id: randomUUID19(),
     eventType: "config_scan",
     startedAt: scan2.scannedAt,
     parentId: sessionId,
@@ -30369,9 +31961,9 @@ function buildSessionRoot(sessionId, input, ctx, resolved, provider, branch) {
 }
 
 // src/history/reconcile-trigger.ts
-import { spawn } from "child_process";
-import { dirname as dirname4, join as join16 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { spawn as spawn2 } from "child_process";
+import { dirname as dirname5, join as join23 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/history/tail.ts
 import { createHash as createHash5 } from "crypto";
@@ -30380,11 +31972,11 @@ import {
   fstatSync,
   mkdirSync as mkdirSync4,
   openSync as openSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync14,
   readSync,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join15 } from "path";
+import { join as join22 } from "path";
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
 function safeSessionId(sessionId) {
   if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
@@ -30400,8 +31992,8 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
   try {
     const marker = `${RECONCILE_MARKER_PREFIX}-${safeSessionId(sessionId)}`;
     if (throttled(dataDir2, marker, RECONCILE_THROTTLE_MS)) return;
-    const here = dirname4(fileURLToPath2(import.meta.url));
-    const child = spawn(process.execPath, [join16(here, "reconcile.js"), sessionId, transcriptPath], {
+    const here = dirname5(fileURLToPath3(import.meta.url));
+    const child = spawn2(process.execPath, [join23(here, "reconcile.js"), sessionId, transcriptPath], {
       detached: true,
       stdio: "ignore"
     });
@@ -30412,17 +32004,17 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
 
 // src/protocol/marker.ts
 import { randomBytes as randomBytes4 } from "crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync5, writeFileSync as writeFileSync8 } from "fs";
-import { join as join17 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync15, renameSync as renameSync5, writeFileSync as writeFileSync8 } from "fs";
+import { join as join24 } from "path";
 var MARKER_FILE = "protocol-marker";
 function mintMarker() {
   return randomBytes4(8).toString("hex");
 }
 function sessionProtocolMarker(dataDir2, sessionId) {
   if (!sessionId) return mintMarker();
-  const path = join17(dataDir2, MARKER_FILE);
+  const path = join24(dataDir2, MARKER_FILE);
   try {
-    const stored = JSON.parse(readFileSync11(path, "utf8"));
+    const stored = JSON.parse(readFileSync15(path, "utf8"));
     if (stored.sessionId === sessionId && typeof stored.marker === "string" && /^[0-9a-f]{16}$/.test(stored.marker)) {
       return stored.marker;
     }
@@ -30431,7 +32023,7 @@ function sessionProtocolMarker(dataDir2, sessionId) {
   const marker = mintMarker();
   try {
     mkdirSync5(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    const tmp = join17(dataDir2, `${MARKER_FILE}.tmp`);
+    const tmp = join24(dataDir2, `${MARKER_FILE}.tmp`);
     writeFileSync8(tmp, JSON.stringify({ sessionId, marker }), { mode: DATA_FILE_MODE });
     renameSync5(tmp, path);
   } catch {
@@ -30447,7 +32039,7 @@ function standingBrief(opts) {
 
 // src/hooks/shared.ts
 async function readStdin() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let data = "";
     let settled = false;
     const finish = () => {
@@ -30456,7 +32048,7 @@ async function readStdin() {
       clearTimeout(timer);
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", finish);
-      resolve(data);
+      resolve2(data);
     };
     const onData = (chunk) => {
       data += chunk;
@@ -30470,8 +32062,8 @@ async function readStdin() {
 }
 function parseJson(raw) {
   try {
-    const parsed = JSON.parse(raw);
-    return typeof parsed === "object" && parsed !== null ? parsed : null;
+    const parsed2 = JSON.parse(raw);
+    return typeof parsed2 === "object" && parsed2 !== null ? parsed2 : null;
   } catch {
     return null;
   }
@@ -30481,24 +32073,83 @@ function getString(record2, key) {
   return typeof value === "string" ? value : void 0;
 }
 function emit(output) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     const finish = () => {
       if (settled) return;
       settled = true;
-      resolve();
+      resolve2();
     };
     process.stdout.on("error", finish);
     process.stdout.write(JSON.stringify(output), finish);
   });
 }
 
+// src/hooks/store-health.ts
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname6, join as join25 } from "path";
+var STORE_REDIRECT_MARKER = "store-redirect-last-session";
+function markerDirs(dataDir2) {
+  return [dataDir2, dirname6(dataDir2)];
+}
+function alreadyClaimed(dirs, marker, sessionId) {
+  return dirs.some((dir) => {
+    try {
+      return readFileSync16(join25(dir, marker), "utf8") === sessionId;
+    } catch {
+      return false;
+    }
+  });
+}
+function recordClaim(dirs, marker, sessionId) {
+  for (const dir of dirs) {
+    try {
+      mkdirSync6(dir, { recursive: true, mode: DATA_DIR_MODE });
+      writeFileSync9(join25(dir, marker), sessionId, { mode: DATA_FILE_MODE });
+      return;
+    } catch {
+    }
+  }
+}
+function storeRedirectedMessage(paths, platform2 = process.platform) {
+  const where = paths.map(({ path, target, holds, missing, mode }) => {
+    if (missing) return `${path} -> ${target} (which does not exist; ${holds} cannot land there)`;
+    const loose = mode !== void 0 && (mode & 63) !== 0 ? ", NOT owner-only" : "";
+    const inherited = mode === void 0 ? "" : ` (${formatMode(mode)}${loose})`;
+    return `${path} -> ${target}${inherited}, holding ${holds}`;
+  }).join("; ");
+  const subject = paths.length === 1 ? "a store path is a symlink" : `${String(paths.length)} store paths are symlinks`;
+  const anyResolves = paths.some(({ missing }) => !missing);
+  const lead = anyResolves ? `${subject}, so AKA is writing into the target instead: ${where}. ` : `${subject} resolving nowhere, so AKA cannot write there: ${where}. `;
+  const kept = anyResolves && platform2 !== "win32" ? "Permissions are never changed through a symlink, so the store keeps whatever the target already had. " : "";
+  return `[aka] ${lead}${kept}If you did not create that link, treat it as untrusted and run \`aka init\` for the full report.
+`;
+}
+function formatMode(mode) {
+  return `0${mode.toString(8).padStart(3, "0")}`;
+}
+function warnIfStoreRedirected(config2, sessionId, write = (message2) => void process.stderr.write(message2)) {
+  try {
+    const paths = symlinkedStorePaths(dirname6(config2.dataDir));
+    if (paths.length === 0) return;
+    if (!sessionId) {
+      write(storeRedirectedMessage(paths));
+      return;
+    }
+    const dirs = markerDirs(config2.dataDir);
+    if (alreadyClaimed(dirs, STORE_REDIRECT_MARKER, sessionId)) return;
+    write(storeRedirectedMessage(paths));
+    recordClaim(dirs, STORE_REDIRECT_MARKER, sessionId);
+  } catch {
+  }
+}
+
 // src/hooks/session-start.ts
 function harnessVersion() {
   const manifestPath = process.argv[2];
   if (!manifestPath) return void 0;
   try {
-    const manifest = JSON.parse(readFileSync12(manifestPath, "utf8"));
+    const manifest = JSON.parse(readFileSync17(manifestPath, "utf8"));
     return typeof manifest.version === "string" ? manifest.version : void 0;
   } catch {
     return void 0;
@@ -30524,6 +32175,7 @@ async function main() {
   }
   const transcriptPath = input ? getString(input, "transcript_path") : void 0;
   const config2 = loadConfig();
+  warnIfStoreRedirected(config2, sessionId);
   if (sessionId !== void 0 && transcriptPath !== void 0) {
     triggerReconcile(config2.dataDir, sessionId, transcriptPath);
   }