@akasecurity/ai-tc-claude-code 0.9.9 → 0.9.11

package/scripts/stop.js

@@ -492,8 +492,8 @@ var require_ignore = __commonJS({
 });
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/persistence/src/attached-derived.ts
 import { rmSync } from "fs";
@@ -2320,18 +2320,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse4 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse3(schema, value, ctx, finalizeParams(fn, _params));
+    return parse4(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse4 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse3(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse4(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -20385,13 +20385,11 @@ var FindingGroup = external_exports.object({
   latestDetectedAt: external_exports.iso.datetime(),
   instances: external_exports.array(FindingInstance),
   // Derived from instances' statuses with open-dominates precedence (see
-  // buildFindingGroups). Undefined only when no instance carries a status.
+  // foldGroupStatus). Undefined only when no instance carries a status.
   status: FindingStatus.optional(),
-  // The distinct people across the WHOLE group, not just the `instances`
-  // preview — from the store's whole-group aggregate when it supplies one,
-  // else folded from the rows (see buildFindingGroups). Undefined when no
-  // instance carries a user, or when the store supplied whole-group folds
-  // without one.
+  // The distinct people across the WHOLE group, not just the instances
+  // carried here. Undefined when no instance carries a user, or when the
+  // store supplied whole-group folds without one.
   users: external_exports.array(FindingUser).optional()
 }).meta({ id: "FindingGroup" });
 var FindingStats = external_exports.object({
@@ -20420,20 +20418,30 @@ var FindingFacets = external_exports.object({
   // counted under no value.
   status: external_exports.array(FindingFacetItem),
   // Host tool (attributes.tool_name). Present only on the instance-level
-  // reads, which can filter by it; the grouped read omits the dimension
+  // reads, which can filter by it; the type-level read omits the dimension
   // because a group spans tools.
   tool: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
-var ListGroupedFindingsQuery = external_exports.object({
+var FindingTypeSummary = FindingGroup.omit({ instances: true, match: true }).meta({
+  id: "FindingTypeSummary"
+});
+var MAX_FINDING_TYPES_LIMIT = 100;
+var ListFindingTypesQuery = external_exports.object({
   // NOTE: severity filters by Severity (critical/high/medium/low), not by
-  // FindingAction.
+  // FindingAction. It narrows TYPES: a type's severity is the one its newest
+  // firing version carries, and this list pages types.
+  //
+  // That is NOT a claim the findings of a type share it. A rule can hold several
+  // definition versions at different severities, so a type kept by this filter
+  // can hold findings that individually do not match — see totals.findings on
+  // ListFindingTypesResponse, which counts them all.
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
-  // Matches a group's DERIVED status (see FindingGroup.status), not its
-  // individual instances' — so a filtered group's Status column always reads
-  // one of the requested values.
+  // Matches a type's DERIVED status (see FindingGroup.status), not its
+  // individual findings' — so a filtered row's status always reads one of the
+  // requested values.
   status: external_exports.array(FindingStatus).optional(),
   q: external_exports.string().optional(),
   // Scope to findings whose event carries this session id (the Activity page's
@@ -20443,23 +20451,37 @@ var ListGroupedFindingsQuery = external_exports.object({
   // from a time-scoped page (Activity's range) can carry that scope. Absent
   // means all time — this list has no default window.
   from: external_exports.iso.datetime().optional(),
-  // A group or instance id that must appear in the page even when the cursor
-  // has already advanced past its sort position. This is what keeps the
-  // Findings page's one-shot ?finding= deep link resolving once the list
-  // paginates: the target group is appended out of sort order rather than
-  // scanning forward for it. Never affects totals, facets or the cursor.
+  // A RULE id that must appear in the page even when the cursor has already
+  // advanced past its sort position. This is what keeps the selected type
+  // visible in the list once it paginates: the target is appended out of sort
+  // order rather than scanned forward for. Never affects totals, facets or the
+  // cursor. Unlike the grouped read this replaces, it names a rule only — an
+  // instance id is resolved by `findingInstance`, which is a primary-key seek
+  // and so is not bounded by what any page happens to hold.
   includeId: external_exports.string().optional(),
-  groupBy: external_exports.literal("type").optional(),
-  limit: external_exports.coerce.number().int().min(1).max(100).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_TYPES_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
-var ListGroupedFindingsResponse = external_exports.object({
+var ListFindingTypesResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings belonging to the matching TYPES — not findings that each match
+    // the filters. The filters here select types, so a type that survives
+    // contributes its whole instanceCount.
+    //
+    // `status` is the one exception, narrowed per finding via
+    // countInstancesByStatus. `severity`, `provider` and `action` are not, so
+    // this can exceed what the instance read reports for the same filters: a
+    // rule whose severity moved between versions is kept on its newest and
+    // still counts its older findings. Narrowing the other three needs
+    // per-dimension counts the aggregate does not carry today.
     findings: external_exports.number().int().nonnegative(),
-    groups: external_exports.number().int().nonnegative()
+    // Counts TYPES, which is the unit this read pages. The instance read's
+    // own totals count findings; the two deliberately answer different
+    // questions and are never summed.
+    types: external_exports.number().int().nonnegative()
   }),
   facets: FindingFacets,
-  items: external_exports.array(FindingGroup),
+  items: external_exports.array(FindingTypeSummary),
   nextCursor: external_exports.string().nullable(),
   // Present only on session-scoped queries (`sessionId` set): per ruleId, how
   // many times that rule fired in the session's persisted transcript. Findings
@@ -20467,7 +20489,7 @@ var ListGroupedFindingsResponse = external_exports.object({
   // every firing, so the two numbers legitimately differ — this map lets a
   // session-scoped view show both.
   sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
-}).meta({ id: "ListGroupedFindingsResponse" });
+}).meta({ id: "ListFindingTypesResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
   // it, so it is excluded from the request contract. The mapping helper
@@ -20496,12 +20518,13 @@ var FindingInstanceDetail = FindingInstance.extend({
 var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
-  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  // Rule ids, the same vocabulary the types list's `subtype` carries. Pinning
+  // ONE of them is how the master/detail view scopes its right-hand panel.
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   // Matches each instance's OWN derived status (deriveFindingStatus), unlike
-  // the grouped query's group-level fold.
+  // the types query's type-level fold.
   status: external_exports.array(FindingStatus).optional(),
   // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
   // where the free-text `q` can only match the rendered "via Bash" label.
@@ -20518,37 +20541,46 @@ var ListFindingInstancesQuery = external_exports.object({
 });
 var ListFindingInstancesResponse = external_exports.object({
   // Instances matching the filters across the whole scope, not just this
-  // page — cursor-independent, like the grouped list's totals.
+  // page — cursor-independent, like the types list's totals.
   totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
-  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // Counts in INSTANCES here, where the types response counts types. Each
   // dimension still excludes its own filter.
   facets: FindingFacets,
   items: external_exports.array(FindingInstanceDetail),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingInstancesResponse" });
-var FindingLocationFile = external_exports.object({
-  // Empty when the instances carried no file path (a prompt or a tool call
-  // with no file attribution).
-  file: external_exports.string(),
-  instanceCount: external_exports.number().int().nonnegative(),
-  maxSeverity: Severity,
-  latestDetectedAt: external_exports.iso.datetime(),
-  // Folded from the instances' derived statuses with the same
-  // open-dominates precedence a group uses.
-  status: FindingStatus.optional(),
-  // Distinct rules seen at this location, capped — the row shows them as
-  // chips, and the count is what conveys scale.
-  ruleIds: external_exports.array(external_exports.string())
-}).meta({ id: "FindingLocationFile" });
-var FindingLocationRepo = external_exports.object({
+var FindingLocationSummary = external_exports.object({
+  // Opaque, stable, minted from the pair by encodeLocationId. It exists
+  // because a location's identity is two values and a URL param carries one:
+  // `?loc=` names a location the way `?rule=` names a type. Only ever compared
+  // for EQUALITY — the page's selection check, this read's `includeId`, the
+  // client's page dedupe — never decoded, and never a sort key.
+  id: external_exports.string(),
   /** Empty when the instances carried no repo attribute. */
   repo: external_exports.string(),
+  // Empty when the instances carried no file path (a prompt, or a tool call
+  // with no file attribution). Both halves empty is a real location — usually
+  // the largest one in a store — and is selectable like any other.
+  file: external_exports.string(),
   instanceCount: external_exports.number().int().nonnegative(),
+  // The WORST severity present, not the first row's. It is this list's primary
+  // sort key, so it is also what explains why a row is where it is, and it is
+  // how a reader decides what to open without opening everything.
   maxSeverity: Severity,
   latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same open-dominates
+  // precedence a group uses, so it answers "is anything left to do here" and
+  // not much more: a location holding 1 open among 40 resolved reads like one
+  // holding 40 open. That loss is accepted — the panel beside this list
+  // carries each finding's own status, and instanceCount sits next to the
+  // badge.
   status: FindingStatus.optional(),
-  files: external_exports.array(FindingLocationFile)
-}).meta({ id: "FindingLocationRepo" });
+  // Every distinct rule seen at this location, UNCAPPED — so the length is a
+  // tally rather than a sample and a row can say how many there are. Bounded
+  // by the ruleset, not by the store. The view bounds what it DISPLAYS.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationSummary" });
+var MAX_FINDING_LOCATIONS_LIMIT = 100;
 var ListFindingLocationsQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
@@ -20561,18 +20593,42 @@ var ListFindingLocationsQuery = external_exports.object({
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+  // A LOCATION id (see FindingLocationSummary.id) that must appear in the page
+  // even when the cursor has already advanced past its sort position — the
+  // counterpart of ListFindingTypesQuery.includeId, and needed far more often
+  // here. Selecting a row pushes the URL, which re-renders the server and resets
+  // the client's page cache to page 0; with distinct (repo, file) pairs running
+  // into the thousands, a selection sitting off page 0 is the ordinary case
+  // rather than a deep-link corner. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_LOCATIONS_LIMIT).optional(),
+  cursor: external_exports.string().optional()
 });
 var ListFindingLocationsResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings matching the filters across the whole scope. Unlike the types
+    // read's same-named field this needs no caveat: the filters here narrow
+    // per finding, so this is the sum of every row's instanceCount.
     findings: external_exports.number().int().nonnegative(),
-    repos: external_exports.number().int().nonnegative(),
-    files: external_exports.number().int().nonnegative()
+    // Counts LOCATIONS, the unit this read pages — the number the paginator
+    // states. The facets beside it count FINDINGS (see below); a surface
+    // showing both says which is which.
+    locations: external_exports.number().int().nonnegative()
   }),
-  /** Sorted by max severity, then most recent. */
-  items: external_exports.array(FindingLocationRepo),
-  /** Whether `limit` truncated the repo list. */
-  hasMore: external_exports.boolean()
+  // Counts in FINDINGS, where the types response counts types, each dimension
+  // still excluding its own filter. Deliberately not locations: counting those
+  // needs a set of location keys per dimension per value — memory tracking the
+  // store times the vocabulary, in a read whose scan promises flat memory —
+  // and the cheap per-location version is not an approximation but WRONG. A
+  // location holding {claudecode, block} and {codex, warn} would survive
+  // provider=claudecode AND action=warn, under which no single finding
+  // matches, so the facet would contradict the instanceCount this whole view
+  // rests on. Findings also keep the toolbar in the same unit as the page
+  // tally and the panel it sits above.
+  facets: FindingFacets,
+  /** Sorted by max severity, then most recent, then (repo, file). */
+  items: external_exports.array(FindingLocationSummary),
+  nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingLocationsResponse" });
 
 // ../../packages/schema/src/zod/meta.ts
@@ -21737,6 +21793,14 @@ var ControlPlaneErrorBody = external_exports.object({
     message: external_exports.string().optional()
   }).optional()
 });
+var RemoteFailureKind = external_exports.enum([
+  "unauthorized",
+  "forbidden",
+  "route-absent",
+  "invalid-request",
+  "rejected",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -21798,6 +21862,26 @@ var AttachTokenResponse = external_exports.union([
   AttachTokenExpired,
   external_exports.object({ status: printable(64) })
 ]);
+var DeviceCommandKind = external_exports.enum(["shares_rescan"]);
+var DeviceCommand = external_exports.object({
+  id: printable(128).min(1),
+  kind: DeviceCommandKind,
+  issuedAt: printable(64).min(1),
+  expiresAt: printable(64).min(1)
+}).strict();
+var DeviceCommandPollResponse = external_exports.object({ command: DeviceCommand.nullable() });
+var DeviceCommandFailureReason = external_exports.enum(["scan_failed", "no_projects", "expired"]);
+var DeviceCommandAckBody = external_exports.discriminatedUnion("outcome", [
+  external_exports.object({
+    outcome: external_exports.literal("reported"),
+    projectsScanned: external_exports.number().int().nonnegative()
+  }).strict(),
+  external_exports.object({
+    outcome: external_exports.literal("failed"),
+    reason: DeviceCommandFailureReason,
+    projectsScanned: external_exports.number().int().nonnegative()
+  }).strict()
+]);
 
 // ../../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -21964,7 +22048,7 @@ var PackManifest = external_exports.object({
 }).meta({ id: "PackManifest" });
 
 // ../../packages/schema/src/zod/detection.ts
-var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
+var OriginEnum = external_exports.enum(["library", "custom"]).meta({ id: "OriginEnum" });
 var DetectionFilterEnum = external_exports.enum(["all", "library", "custom", "customized", "updates"]);
 var LibraryStateEnum = external_exports.enum(["new", "imported", "update"]).meta({ id: "LibraryStateEnum" });
 var DetectionCounts = external_exports.object({
@@ -22159,8 +22243,9 @@ var Event = external_exports.object({
   metadata: EventMetadata.optional()
 }).meta({ id: "Event" });
 var IngestEvent = Event.meta({ id: "IngestEvent" });
+var INGEST_BATCH_MAX = 100;
 var IngestBatch = external_exports.object({
-  events: external_exports.array(IngestEvent).min(1).max(100),
+  events: external_exports.array(IngestEvent).min(1).max(INGEST_BATCH_MAX),
   // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
   // additionally rejects any event whose contentHash the store has already
   // recorded — for re-runnable bulk ingest (worktree scan, transcript
@@ -22286,6 +22371,225 @@ var PatchInstalledPackRequest = external_exports.object({
   message: "At least one field must be provided"
 }).meta({ id: "PatchInstalledPackRequest" });
 
+// ../../packages/schema/src/zod/policy.ts
+var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
+var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
+var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
+var PolicyProvenance = external_exports.enum(["builtin", "authored"]).meta({ id: "PolicyProvenance" });
+var Policy = external_exports.object({
+  id: external_exports.guid(),
+  scope: PolicyScope,
+  target: PolicyTarget,
+  action: ActionTaken,
+  enabled: external_exports.boolean().default(true),
+  customKeywords: external_exports.array(external_exports.string()).optional(),
+  // Display name — optional so older policy rows without name still parse.
+  // Added for the findings API (policy.name column migration).
+  name: external_exports.string().optional(),
+  // Whether an AUTHORED policy governs this row's target — not a claim about
+  // which row this is. A producer that collapses several rows onto one target
+  // must carry the marker onto whichever row survives, or the collapse decides
+  // the answer; a survivor may therefore be a built-in expansion still marked
+  // 'authored' because an authored sibling targeted the same thing.
+  // Optional so an older producer — and an older on-disk cache — still parses;
+  // absent reads as 'builtin', which is the behaviour that predates the field.
+  //
+  // Deliberately NOT `kind`/PolicyKind: that name and that enum answer which
+  // built-in archetype catalog entry a policy is, which every catalog surface
+  // reads and which a caller may state. This one is a statement the PRODUCER
+  // of a bundle makes about a row, and only the bundle builder ever stamps it
+  // — the CRUD routes neither accept nor set it.
+  //
+  // A device consumes this in exactly one direction: an 'authored' policy
+  // arriving from a control plane marks the rules it targets as not
+  // locally re-assignable. That can only ever ADD a refusal, never relax one,
+  // which is what makes it safe to honour from an unsigned cache — the same
+  // test `prohibitedModels` passes and `reversibleRuleIds` fails.
+  provenance: PolicyProvenance.optional()
+}).meta({ id: "Policy" });
+var PolicyBundle = external_exports.object({
+  version: external_exports.string(),
+  policies: external_exports.array(Policy),
+  // Rules from the installed marketplace packs (snapshotted by the
+  // control plane). The plugin registers these in addition to its bundled
+  // packs. Optional so older backends — and older on-disk caches — that omit
+  // the field still parse; consumers read `bundle.rules ?? []`.
+  rules: external_exports.array(Rule).optional(),
+  // When true, `rules` IS the complete effective ruleset and the runtime must
+  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
+  // after reading the user's installed snapshot (installed_packs, enabled
+  // packs only), which is how detection updates stay manual: new bundled
+  // rules run only after the user applies the pack update. Absent/false keeps
+  // the historical composition (bundled packs + rules) — older caches.
+  rulesComplete: external_exports.boolean().optional(),
+  // Active detection exceptions, evaluation subset only (see
+  // ExceptionBundleEntry). Optional so older bundle producers — and older
+  // on-disk caches — that omit the field still parse; consumers read
+  // `bundle.exceptions ?? []`.
+  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
+  // A second axis over the same `redact` action, carried beside the policies
+  // rather than on them: nothing writes ruleId-targeted policies to disk, so
+  // widening Policy itself would change a persisted shape to express something
+  // only the in-memory bundle needs. Optional so an older producer — or an
+  // older on-disk cache — still parses; consumers read `?? []` and get the
+  // pre-existing one-way behaviour, which is the safe direction to default.
+  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  // Model ids (the raw `model` string a harness reports, e.g.
+  // `claude-opus-4-1`) the tenant has PROHIBITED. The plugin refuses to switch
+  // a session onto one (PreModelSwitch) and refuses a turn that would run on
+  // one (UserPromptSubmit). Optional so an older backend — and an older
+  // on-disk cache — still parses; consumers read `?? []`, which is the
+  // unenforced behaviour that predates this field and the safe direction to
+  // default.
+  //
+  // Ids, not display names: the governance decision is keyed on the exact
+  // string the harness reports (`model_status_override.versionId` in the
+  // control plane), so no name resolution stands between the decision and the
+  // comparison.
+  prohibitedModels: external_exports.array(external_exports.string()).optional(),
+  customKeywords: external_exports.array(external_exports.string()),
+  fetchedAt: external_exports.iso.datetime()
+}).meta({ id: "PolicyBundle" });
+var POLICY_BUNDLE_SHAPE_ID = [
+  ...Object.keys(PolicyBundle.shape),
+  ...Object.keys(Policy.shape).map((key) => `policies.${key}`),
+  ...PolicyTarget.options.flatMap((member) => "shape" in member ? Object.keys(member.shape) : []).map((key) => `policies.target.${key}`),
+  ...Object.keys(ExceptionBundleEntry.shape).map((key) => `exceptions.${key}`)
+].sort().join(",");
+var OBSERVE_ONLY_CATEGORIES = ["config"];
+var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
+  id: "RedactFallback"
+});
+var BUILTIN_POLICY_SPECS = {
+  monitor: {
+    name: "Monitor",
+    action: "log",
+    reversible: false,
+    description: "Log every match for audit. The request is allowed through untouched."
+  },
+  warn: {
+    name: "Warn",
+    action: "warn",
+    reversible: false,
+    description: "Allow the request, but warn the user inline before it is sent."
+  },
+  redact: {
+    name: "Redact",
+    action: "redact",
+    reversible: false,
+    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
+  },
+  vault: {
+    name: "Redact & Vault",
+    action: "redact",
+    reversible: true,
+    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
+  },
+  block: {
+    name: "Block",
+    action: "block",
+    reversible: false,
+    description: "Refuse the request entirely whenever any rule in this detection matches."
+  }
+};
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var PALETTE_WEAKEST_FIRST = [
+  ...new Set(KNOWN_BUILTIN_IDS.map(builtinPolicyToAction))
+];
+var BELOW_PALETTE = ACTION_TAKEN_KEYS.filter(
+  (action) => !PALETTE_WEAKEST_FIRST.includes(action)
+);
+var ACTION_STRENGTH_ORDER = [
+  ...BELOW_PALETTE,
+  ...PALETTE_WEAKEST_FIRST
+];
+var PackPolicyFloor = external_exports.object({
+  /**
+   * The weakest archetype the device may assign. Stated as a BuiltinPolicyId
+   * rather than a raw ActionTaken because that is the vocabulary the user
+   * picks from — a floor a UI cannot name is one it cannot explain.
+   */
+  floor: BuiltinPolicyId,
+  /**
+   * True when the organization AUTHORED a policy governing this pack rather
+   * than stating a minimum: it gave the answer, so the pack is not
+   * re-assignable locally in either direction.
+   */
+  locked: external_exports.boolean()
+}).describe("PackPolicyFloor");
+var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => !BUILTIN_POLICY_SPECS[id].reversible
+);
+var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => BUILTIN_POLICY_SPECS[id].reversible
+);
+var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
+var BUILTIN_POLICIES = Object.fromEntries(
+  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
+);
+var UsedByItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  enabled: external_exports.boolean()
+}).meta({ id: "UsedByItem" });
+var PolicyListItem = external_exports.object({
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  usedByCount: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyListItem" });
+var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
+var PolicyDetail = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  description: external_exports.string(),
+  usedBy: external_exports.array(UsedByItem)
+}).meta({ id: "PolicyDetail" });
+var PolicyStatsResponse = external_exports.object({
+  policies: external_exports.number().int().nonnegative(),
+  builtin: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  detectionsGoverned: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyStatsResponse" });
+
 // ../../packages/schema/src/zod/vault.ts
 var CATEGORY_ALTERNATION = DetectionCategory.options.join("|");
 var POINTER_TOKEN_PATTERN = new RegExp(
@@ -22322,6 +22626,14 @@ var VaultEntry = external_exports.object({
   // How many times this value has been detected on this machine — the reuse
   // signal the vault dashboard reads. Distinct from VaultDeref.pointerCount.
   occurrenceCount: external_exports.number().int().nonnegative(),
+  // True when a PERSON asked for this value to be replaced — the surfaced-
+  // secrets strike — rather than a pack enforcing its assignment. One value is
+  // one row however many paths vault it, so this is what tells a policy sweep
+  // that the row carries somebody's own instruction and not just an assignment
+  // that has since been lowered. STICKY and MONOTONIC: a later automatic
+  // vaulting of the same value must never clear it — what the user said about
+  // the value does not expire.
+  userAuthorized: external_exports.boolean(),
   firstSeen: external_exports.string(),
   lastSeen: external_exports.string()
 });
@@ -22438,7 +22750,7 @@ var VaultConsent = external_exports.object({
 });
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 6;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
 var RunMode = external_exports.enum(["standalone", "attached"]);
 var ControlPlaneConnection = external_exports.object({
@@ -22480,6 +22792,19 @@ var WorkspaceSettings = external_exports.object({
   vaultKeyCustody: VaultKeyCustody.default("file"),
   // How a pointer renders in assistant prose on screen (see VaultInlineReveal).
   vaultInlineReveal: VaultInlineReveal.default("masked"),
+  // What a `redact` policy degrades to on a FIELD the host cannot rewrite in
+  // place. Not a handling policy: the policy has already resolved to redact,
+  // and this only says what happens when the host offers no channel to carry it
+  // out — Antigravity's PreToolUse has no updatedInput at all, and Codex and
+  // Claude Code decline to mask a field that EXECUTES because masking would
+  // change what runs. Per FIELD rather than per host, so a host that can
+  // rewrite some inputs keeps true redaction on those.
+  //
+  // Spelled in the built-in policy vocabulary rather than as a fresh enum, so
+  // an attached machine's merge is `strongerAction` over the one action ladder
+  // and no second rank order exists to drift from it. 'deny' is a host wire
+  // word and stays out of the stored value.
+  redactFallback: RedactFallback.default("warn"),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
   onboardedAt: external_exports.iso.datetime().optional(),
   // Records that the user consented to sending findings to the model API for
@@ -22487,10 +22812,12 @@ var WorkspaceSettings = external_exports.object({
   // Absent until granted; a stale payloadVersion means the consent no longer
   // covers the current payload and must be re-granted.
   modelJudgeConsent: ModelJudgeConsent.optional(),
-  // Records that the user consented to sending the activity already recorded on
-  // this machine to the deployment it is attached to, along with the payload
-  // shape and the endpoint they agreed to. Absent until granted, and a grant for
-  // a different endpoint or an older payload no longer counts.
+  // Records that the user consented to the DEFERRED send — the outbox — along
+  // with the payload shape and the endpoint they agreed to. Since payload v3
+  // that covers the pre-attach backlog AND undelivered captures alike, and both
+  // carry prompt/reply/tool-output text in `content`; the key name predates
+  // both widenings. Absent until granted, and a grant for a different endpoint
+  // or an older payload no longer counts.
   historySyncConsent: HistorySyncConsent.optional()
 });
 function defaultWorkspaceSettings() {
@@ -22507,8 +22834,12 @@ var ManagedSettingKey = external_exports.enum([
   "vaultKeyCustody",
   "vaultInlineReveal",
   "modelJudgeConsent",
-  "dataSharesInPlace"
+  "dataSharesInPlace",
+  "redactFallback"
 ]).meta({ id: "ManagedSettingKey" });
+function isManagedSettingKey(value) {
+  return ManagedSettingKey.safeParse(value).success;
+}
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
   controlPlane: external_exports.object({
@@ -22520,7 +22851,8 @@ var ManagedSettingsValues = external_exports.object({
   vaultKeyCustody: external_exports.enum(["file", "keychain"]).optional(),
   vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
   modelJudgeConsent: external_exports.boolean().optional(),
-  dataSharesInPlace: external_exports.boolean().optional()
+  dataSharesInPlace: external_exports.boolean().optional(),
+  redactFallback: RedactFallback.optional()
 }).meta({ id: "ManagedSettingsValues" });
 var ManagedSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
@@ -22532,174 +22864,29 @@ var ManagedSettings = external_exports.object({
   // Which of those the user may not change. A key here with no matching value
   // freezes whatever the user last chose; a value with no lock is a DEFAULT
   // the user may still override. The two are separable on purpose.
-  lockedFields: external_exports.array(ManagedSettingKey).default([])
+  //
+  // Parsed as NAMES rather than as the enum, and split below: a name this
+  // build does not know is dropped from the locked set and reported, never a
+  // reason to refuse the file. The same shape reaches an older build whenever
+  // an administrator locks a key a newer build added, and refusing it there
+  // ran that build entirely unmanaged — every pin and lock gone — on exactly
+  // the fleets most likely to carry a version skew. A name outside the enum
+  // is still never HONOURED: the lockable set stays explicit above.
+  lockedFields: external_exports.array(external_exports.string()).default([])
+}).transform(({ lockedFields, ...rest }) => {
+  const known = [];
+  const unknown2 = [];
+  for (const name of lockedFields) {
+    if (isManagedSettingKey(name)) known.push(name);
+    else unknown2.push(name);
+  }
+  return {
+    ...rest,
+    lockedFields: known,
+    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {}
+  };
 }).meta({ id: "ManagedSettings" });
 
-// ../../packages/schema/src/zod/policy.ts
-var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
-var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
-var Policy = external_exports.object({
-  id: external_exports.guid(),
-  scope: PolicyScope,
-  target: PolicyTarget,
-  action: ActionTaken,
-  enabled: external_exports.boolean().default(true),
-  customKeywords: external_exports.array(external_exports.string()).optional(),
-  // Display name — optional so older policy rows without name still parse.
-  // Added for the findings API (policy.name column migration).
-  name: external_exports.string().optional()
-}).meta({ id: "Policy" });
-var PolicyBundle = external_exports.object({
-  version: external_exports.string(),
-  policies: external_exports.array(Policy),
-  // Rules from the installed marketplace packs (snapshotted by the
-  // control plane). The plugin registers these in addition to its bundled
-  // packs. Optional so older backends — and older on-disk caches — that omit
-  // the field still parse; consumers read `bundle.rules ?? []`.
-  rules: external_exports.array(Rule).optional(),
-  // When true, `rules` IS the complete effective ruleset and the runtime must
-  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
-  // after reading the user's installed snapshot (installed_packs, enabled
-  // packs only), which is how detection updates stay manual: new bundled
-  // rules run only after the user applies the pack update. Absent/false keeps
-  // the historical composition (bundled packs + rules) — older caches.
-  rulesComplete: external_exports.boolean().optional(),
-  // Active detection exceptions, evaluation subset only (see
-  // ExceptionBundleEntry). Optional so older bundle producers — and older
-  // on-disk caches — that omit the field still parse; consumers read
-  // `bundle.exceptions ?? []`.
-  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
-  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
-  // A second axis over the same `redact` action, carried beside the policies
-  // rather than on them: nothing writes ruleId-targeted policies to disk, so
-  // widening Policy itself would change a persisted shape to express something
-  // only the in-memory bundle needs. Optional so an older producer — or an
-  // older on-disk cache — still parses; consumers read `?? []` and get the
-  // pre-existing one-way behaviour, which is the safe direction to default.
-  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
-  // Installed pack version, keyed by ruleId, for rules in `rules` that came
-  // from a versioned installed pack. Optional so older backends — and older
-  // on-disk caches — that omit the field still parse; consumers fall back to
-  // the rule's own spec version. NOT the bundle version above — see
-  // installedRuleset's ruleVersions for the source of truth.
-  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  // Model ids (the raw `model` string a harness reports, e.g.
-  // `claude-opus-4-1`) the tenant has PROHIBITED. The plugin refuses to switch
-  // a session onto one (PreModelSwitch) and refuses a turn that would run on
-  // one (UserPromptSubmit). Optional so an older backend — and an older
-  // on-disk cache — still parses; consumers read `?? []`, which is the
-  // unenforced behaviour that predates this field and the safe direction to
-  // default.
-  //
-  // Ids, not display names: the governance decision is keyed on the exact
-  // string the harness reports (`model_status_override.versionId` in the
-  // control plane), so no name resolution stands between the decision and the
-  // comparison.
-  prohibitedModels: external_exports.array(external_exports.string()).optional(),
-  customKeywords: external_exports.array(external_exports.string()),
-  fetchedAt: external_exports.iso.datetime()
-}).meta({ id: "PolicyBundle" });
-var OBSERVE_ONLY_CATEGORIES = ["config"];
-var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
-var CATEGORY_PEAK_SEVERITY = {
-  secret: "critical",
-  financial: "critical",
-  // core-financial/credit-card
-  code_flaw: "critical",
-  pii: "high",
-  phi: "high",
-  custom: "high",
-  // user-defined; conservative
-  code_context: "low",
-  config: "low"
-  // observe-only; floors to monitor regardless
-};
-function severityFloorPolicy(category) {
-  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
-  const peak = CATEGORY_PEAK_SEVERITY[category];
-  return peak === "critical" || peak === "high" ? "warn" : "monitor";
-}
-var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var BUILTIN_POLICY_SPECS = {
-  monitor: {
-    name: "Monitor",
-    action: "log",
-    reversible: false,
-    description: "Log every match for audit. The request is allowed through untouched."
-  },
-  warn: {
-    name: "Warn",
-    action: "warn",
-    reversible: false,
-    description: "Allow the request, but warn the user inline before it is sent."
-  },
-  redact: {
-    name: "Redact",
-    action: "redact",
-    reversible: false,
-    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
-  },
-  vault: {
-    name: "Redact & Vault",
-    action: "redact",
-    reversible: true,
-    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
-  },
-  block: {
-    name: "Block",
-    action: "block",
-    reversible: false,
-    description: "Refuse the request entirely whenever any rule in this detection matches."
-  }
-};
-function builtinPolicyToAction(id) {
-  return BUILTIN_POLICY_SPECS[id].action;
-}
-var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
-  (id) => !BUILTIN_POLICY_SPECS[id].reversible
-);
-var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
-  (id) => BUILTIN_POLICY_SPECS[id].reversible
-);
-var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
-var DEFAULT_ACTIONS = Object.fromEntries(
-  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
-);
-var BUILTIN_POLICIES = Object.fromEntries(
-  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
-);
-var UsedByItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  enabled: external_exports.boolean()
-}).meta({ id: "UsedByItem" });
-var PolicyListItem = external_exports.object({
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  usedByCount: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyListItem" });
-var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
-var PolicyDetail = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  description: external_exports.string(),
-  usedBy: external_exports.array(UsedByItem)
-}).meta({ id: "PolicyDetail" });
-var PolicyStatsResponse = external_exports.object({
-  policies: external_exports.number().int().nonnegative(),
-  builtin: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  detectionsGoverned: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyStatsResponse" });
-
 // ../../packages/schema/src/zod/project-files.ts
 var ProjectFileInput = external_exports.object({
   path: external_exports.string().min(1),
@@ -22815,7 +23002,11 @@ var FindingsTimeseriesPoint = external_exports.object({
   timestamp: external_exports.iso.date(),
   critical: external_exports.number().int().nonnegative(),
   high: external_exports.number().int().nonnegative(),
-  medium: external_exports.number().int().nonnegative()
+  medium: external_exports.number().int().nonnegative(),
+  // Optional and additive, so a producer written against the earlier
+  // three-series contract keeps validating. A consumer plotting it resolves the
+  // absent case itself — the chart point requires a number.
+  low: external_exports.number().int().nonnegative().optional()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
   range: TimeRange,
@@ -22841,6 +23032,10 @@ var ResolvedFeedItem = external_exports.object({
   findingKey: external_exports.string(),
   ruleId: external_exports.string(),
   severity: Severity,
+  // Repository slug, and the file path RELATIVE to it. The pair is what
+  // identifies the file: a bare path matches the same name in every repo.
+  // Optional and additive; empty when the event carried no repo.
+  repo: external_exports.string().optional(),
   path: external_exports.string(),
   // ISO-8601 datetime (matches FindingInstance.detectedAt / the rest of the
   // findings domain). The reader `.toISOString()`s the DB epoch-ms values.
@@ -22939,10 +23134,12 @@ var DismissRecommendedActionResponse = external_exports.object({ id: external_ex
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
 // ../../packages/schema/src/zod/settings-action.ts
+var HistorySyncConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "HistorySyncConsentChoice" });
+var ModelJudgeConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "ModelJudgeConsentChoice" });
 var SaveSettingsInput = external_exports.object({
   historicalAccess: external_exports.string(),
-  modelJudgeConsent: external_exports.boolean(),
-  historySyncConsent: external_exports.boolean(),
+  modelJudgeConsent: ModelJudgeConsentChoice,
+  historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
   vaultInlineReveal: external_exports.string()
 });
@@ -23110,10 +23307,30 @@ function ensureDataDirSync(dir) {
 function tightenFile(file2) {
   chmodBestEffort(file2, DATA_FILE_MODE);
 }
+function writeExclusiveOwnerOnlySync(file2, data) {
+  writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+}
+function writeOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.tmp`;
+  try {
+    rmSync2(tmp, { force: true });
+  } catch {
+  }
+  try {
+    writeExclusiveOwnerOnlySync(tmp, data);
+    renameSync(tmp, file2);
+  } finally {
+    try {
+      rmSync2(tmp, { force: true });
+    } catch {
+    }
+  }
+  tightenFile(file2);
+}
 
 // ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join4, sep } from "path";
+import { randomUUID as randomUUID11 } from "crypto";
+import { dirname as dirname2, join as join7, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
 // ../../packages/persistence/src/ids.ts
@@ -23140,6 +23357,20 @@ function parseJsonObject(s) {
 
 // ../../packages/persistence/src/repositories/activity.ts
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
+var DB_EVENT_TYPE_TO_KIND = {
+  session: "session",
+  prompt: "prompt",
+  response: "response",
+  tool_call: "tool",
+  hook: "hook",
+  detection: "detection",
+  share: "share",
+  permission: "permission",
+  commit: "commit",
+  error: "error",
+  active: "active"
+};
+var TIMELINE_EVENT_TYPES = Object.keys(DB_EVENT_TYPE_TO_KIND).map((kind) => `'${kind}'`).join(", ");
 var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 
 // ../../packages/persistence/src/repositories/exceptions.ts
@@ -23153,105 +23384,64 @@ var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
      AND conditions IS NULL
      AND ${ACTIVE_PREDICATE}`;
 
+// ../../packages/persistence/src/repositories/resolution-sql.ts
+function latestResolutionColumnSql(column, findingsAlias) {
+  return `(
+    SELECT fr.${column} FROM finding_resolution fr
+     WHERE fr.finding_key = ${findingsAlias}.finding_key
+     ORDER BY fr.created_at DESC, fr.rowid DESC
+     LIMIT 1
+  )`;
+}
+function latestResolutionStatusSql(findingsAlias) {
+  return latestResolutionColumnSql("status", findingsAlias);
+}
+
+// ../../packages/persistence/src/repositories/findings.ts
+var FINDING_ROW_COLUMNS_SQL = `f.id AS id, d.rule_id AS rule_id, d.category AS category,
+              d.severity AS severity, f.masked_match AS masked_match,
+              f.action_taken AS action_taken, f.confidence AS confidence,
+              e.started_at AS occurred_at,
+              e.source_tool AS source_tool,
+              e.repo AS repo,
+              e.file_path AS file,
+              e.tool_name AS tool_name,
+              f.audit_event_id AS event_id, e.root_session_id AS session_id,
+              e.event_type AS kind, f.finding_key AS finding_key,
+              ${latestResolutionStatusSql("f")} AS latest_status`;
+
 // ../../packages/persistence/src/repositories/history-sync.ts
 var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
 var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
+var CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
 
-// ../../packages/persistence/src/repositories/inventory-assets.ts
-import { randomUUID as randomUUID4 } from "crypto";
-var VALID_HARNESS_IDS = new Set(HarnessId.options);
-var HARNESS_LABELS = {
-  [HARNESS.ClaudeCode]: "Claude Code",
-  [HARNESS.Cursor]: "Cursor",
-  [HARNESS.Codex]: "Codex",
-  [HARNESS.Antigravity]: "Antigravity"
-};
-var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
-var stripSeparators = (value) => value.toLowerCase().replace(/[\s-]/g, "");
-var TITLE_NEEDLES = {
-  ClaudeCode: stripSeparators(SOURCE_TOOL.ClaudeCode),
-  Cursor: stripSeparators(SOURCE_TOOL.Cursor),
-  Codex: stripSeparators(SOURCE_TOOL.Codex),
-  Antigravity: stripSeparators(SOURCE_TOOL.Antigravity)
-};
-
-// ../../packages/persistence/src/repositories/policies.ts
-import { randomUUID as randomUUID5 } from "crypto";
-
-// ../../packages/persistence/src/repositories/project-files.ts
-import { randomUUID as randomUUID6 } from "crypto";
-
-// ../../packages/persistence/src/repositories/resolutions.ts
-import { randomUUID as randomUUID7 } from "crypto";
-
-// ../../packages/persistence/src/repositories/secret-vault.ts
-import { randomUUID as randomUUID8 } from "crypto";
-
-// ../../packages/persistence/src/repositories/security.ts
-var SCAN_COVERAGE = {
-  [HARNESS.Antigravity]: { coverage: 60, supported: true },
-  [HARNESS.Api]: { coverage: 0, supported: false },
-  [HARNESS.ChatGpt]: { coverage: 40, supported: true },
-  [HARNESS.ClaudeAi]: { coverage: 40, supported: true },
-  [HARNESS.ClaudeCode]: { coverage: 100, supported: true },
-  [HARNESS.Codex]: { coverage: 80, supported: true },
-  [HARNESS.Copilot]: { coverage: 0, supported: false },
-  [HARNESS.Cursor]: { coverage: 0, supported: false }
-};
-
-// ../../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID9 } from "crypto";
-
-// ../../packages/persistence/src/file-lock.ts
-import { randomUUID as randomUUID11 } from "crypto";
-import {
-  closeSync,
-  existsSync as existsSync2,
-  openSync,
-  readFileSync as readFileSync2,
-  rmSync as rmSync5,
-  statSync as statSync3,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { hostname as hostname3 } from "os";
-var PARK = new Int32Array(new SharedArrayBuffer(4));
-
-// ../../packages/persistence/src/finding-key.ts
-import { createHash as createHash3 } from "crypto";
-
-// ../../packages/persistence/src/fingerprint.ts
-import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join5 } from "path";
-import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-
-// ../../packages/persistence/src/history-preview.ts
-import { existsSync as existsSync4 } from "fs";
+// ../../packages/persistence/src/policy-floor.ts
+import { readFileSync as readFileSync5 } from "fs";
 import { join as join6 } from "path";
-import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
 // ../../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join7 } from "path";
+import { join as join4 } from "path";
 function defaultDataDir() {
-  return join7(homedir(), ".aka");
+  return join4(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join7(base, "settings");
+  return join4(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join7(base, "data");
+  return join4(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join7(dataDir(base), "aka.db");
+  return join4(dataDir(base), "aka.db");
 }
 function keysDir(base = defaultDataDir()) {
-  return join7(base, "keys");
+  return join4(base, "keys");
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -23264,16 +23454,34 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join7(dest, name);
-      renameSync3(join7(base, name), moved);
+      const moved = join4(dest, name);
+      renameSync3(join4(base, name), moved);
       tightenFile(moved);
     } catch {
     }
   }
 }
 
-// ../../packages/persistence/src/managed-settings.ts
+// ../../packages/persistence/src/settings.ts
 import { readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+
+// ../../packages/persistence/src/file-lock.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import {
+  closeSync,
+  existsSync as existsSync2,
+  openSync,
+  readFileSync as readFileSync2,
+  rmSync as rmSync5,
+  statSync as statSync3,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { hostname as hostname3 } from "os";
+var PARK = new Int32Array(new SharedArrayBuffer(4));
+
+// ../../packages/persistence/src/managed-settings.ts
+import { readFileSync as readFileSync3 } from "fs";
 import { posix, win32 } from "path";
 function managedSettingsPaths(platform2 = process.platform) {
   if (platform2 === "darwin") {
@@ -23287,11 +23495,12 @@ function managedSettingsPaths(platform2 = process.platform) {
   }
   return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
 }
-function readManagedSettings(paths = managedSettingsPaths()) {
+var testOnlyManagedPaths = null;
+function readManagedSettings(paths = testOnlyManagedPaths ?? managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
-      text = readFileSync4(path, "utf8");
+      text = readFileSync3(path, "utf8");
     } catch {
       continue;
     }
@@ -23321,6 +23530,7 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
   if (values.vaultKeyCustody !== void 0) merged.vaultKeyCustody = values.vaultKeyCustody;
   if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
   if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
+  if (values.redactFallback !== void 0) merged.redactFallback = values.redactFallback;
   if (values.vaultConsent !== void 0) {
     merged.vaultConsent = values.vaultConsent ? (
       // Keep an existing valid grant so its acknowledgedAt survives; mint one
@@ -23338,14 +23548,12 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
   return overlayManagedSettings(readUserSettings(base), readManagedSettings());
 }
 function readUserSettings(base) {
-  const record2 = readJson(join8(settingsDir(base), SETTINGS_FILENAME));
+  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -23356,16 +23564,127 @@ function readUserSettings(base) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync5(file2, "utf8");
+    text = readFileSync4(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/semver.ts
+function parse3(version2) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?$/.exec(version2.trim());
+  if (!match) return null;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    pre: match[4] ? match[4].split(".") : []
+  };
+}
+function comparePre(a, b) {
+  if (a.length === 0 && b.length === 0) return 0;
+  if (a.length === 0) return 1;
+  if (b.length === 0) return -1;
+  const len = Math.min(a.length, b.length);
+  for (let i = 0; i < len; i++) {
+    const ai = a[i] ?? "";
+    const bi = b[i] ?? "";
+    if (ai === bi) continue;
+    const an = /^\d+$/.test(ai);
+    const bn = /^\d+$/.test(bi);
+    if (an && !bn) return -1;
+    if (!an && bn) return 1;
+    if (an && bn) return Number(ai) < Number(bi) ? -1 : 1;
+    return ai < bi ? -1 : 1;
+  }
+  return a.length === b.length ? 0 : a.length < b.length ? -1 : 1;
+}
+function compareBinaryVersions(a, b) {
+  const pa = parse3(a);
+  const pb = parse3(b);
+  if (!pa || !pb) return 0;
+  for (let i = 0; i < 3; i++) {
+    const av = pa.core[i] ?? 0;
+    const bv = pb.core[i] ?? 0;
+    if (av !== bv) return av < bv ? -1 : 1;
+  }
+  return comparePre(pa.pre, pb.pre);
+}
+function isParseableBinaryVersion(version2) {
+  return parse3(version2) !== null;
+}
+
+// ../../packages/persistence/src/repositories/inventory-assets.ts
+import { randomUUID as randomUUID5 } from "crypto";
+var VALID_HARNESS_IDS = new Set(HarnessId.options);
+var HARNESS_LABELS = {
+  [HARNESS.ClaudeCode]: "Claude Code",
+  [HARNESS.Cursor]: "Cursor",
+  [HARNESS.Codex]: "Codex",
+  [HARNESS.Antigravity]: "Antigravity"
+};
+var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
+var stripSeparators = (value) => value.toLowerCase().replace(/[\s-]/g, "");
+var TITLE_NEEDLES = {
+  ClaudeCode: stripSeparators(SOURCE_TOOL.ClaudeCode),
+  Cursor: stripSeparators(SOURCE_TOOL.Cursor),
+  Codex: stripSeparators(SOURCE_TOOL.Codex),
+  Antigravity: stripSeparators(SOURCE_TOOL.Antigravity)
+};
+
+// ../../packages/persistence/src/repositories/policies.ts
+import { randomUUID as randomUUID6 } from "crypto";
+
+// ../../packages/persistence/src/repositories/project-files.ts
+import { randomUUID as randomUUID7 } from "crypto";
+
+// ../../packages/persistence/src/repositories/resolutions.ts
+import { randomUUID as randomUUID8 } from "crypto";
+
+// ../../packages/persistence/src/repositories/secret-vault.ts
+import { randomUUID as randomUUID9 } from "crypto";
+
+// ../../packages/persistence/src/repositories/security.ts
+var SCAN_COVERAGE = {
+  [HARNESS.Antigravity]: { coverage: 60, supported: true },
+  [HARNESS.Api]: { coverage: 0, supported: false },
+  [HARNESS.ChatGpt]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeAi]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeCode]: { coverage: 100, supported: true },
+  [HARNESS.Codex]: { coverage: 80, supported: true },
+  [HARNESS.Copilot]: { coverage: 0, supported: false },
+  [HARNESS.Cursor]: { coverage: 0, supported: false }
+};
+
+// ../../packages/persistence/src/repositories/shares.ts
+import { randomUUID as randomUUID10 } from "crypto";
+
+// ../../packages/persistence/src/database.ts
+var CAPTURE_GRAIN = new Set(EventKind.options);
+
+// ../../packages/persistence/src/egress-wire.ts
+import { createHash as createHash3 } from "crypto";
+
+// ../../packages/persistence/src/finding-key.ts
+import { createHash as createHash4 } from "crypto";
+
+// ../../packages/persistence/src/fingerprint.ts
+import { createHmac, randomBytes } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+
+// ../../packages/persistence/src/history-backfill.ts
+import { existsSync as existsSync4 } from "fs";
+import { join as join9 } from "path";
+
+// ../../packages/persistence/src/history-preview.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join10 } from "path";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+
 // ../../packages/persistence/src/store-symlinks.ts
-import { existsSync as existsSync5, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
-import { dirname as dirname2, join as join9, resolve } from "path";
+import { existsSync as existsSync6, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
+import { dirname as dirname3, join as join11, resolve } from "path";
 var STORE_DB = "the store database (including the prompt corpus)";
 var STORE_SETTINGS = "your settings file";
 function storeContents(home) {
@@ -23374,7 +23693,7 @@ function storeContents(home) {
     [settingsDir(home), STORE_SETTINGS],
     [dataDir(home), STORE_DB],
     [keysDir(home), "the vault key"],
-    [join9(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [join11(settingsDir(home), "settings.json"), STORE_SETTINGS],
     [dbPath(home), STORE_DB]
   ]);
 }
@@ -23389,7 +23708,7 @@ function symlinkedStorePaths(home, platform2 = process.platform) {
           holds,
           // existsSync follows the link, so a target that is gone reads as
           // absent here while lstat above still sees the link itself.
-          missing: !existsSync5(path),
+          missing: !existsSync6(path),
           mode: targetMode(path, platform2)
         }
       ];
@@ -23402,7 +23721,7 @@ function linkTarget(path) {
   try {
     return realpathSync(path);
   } catch {
-    return resolve(dirname2(path), readlinkSync(path));
+    return resolve(dirname3(path), readlinkSync(path));
   }
 }
 function targetMode(path, platform2) {
@@ -23426,15 +23745,15 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync3, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join10 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join12 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join13 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -23488,8 +23807,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join12(settingsDir(base), "settings.json");
-    if (existsSync7(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join14(settingsDir(base), "settings.json");
+    if (existsSync8(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -23512,9 +23831,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join14 } from "path";
+import { basename as basename3, join as join16 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -24272,24 +24591,20 @@ var CPU_CORROBORATION_SHARE = 0.2;
 var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, statSync as statSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute, join as join13, sep as sep2 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync8, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname4, isAbsolute, join as join15, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID13 } from "crypto";
 
 // ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
-// ../../packages/plugin-sdk/src/ignore-layers.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync9 } from "fs";
-import { join as join15 } from "path";
-
-// ../../packages/plugin-sdk/src/inventory-resolver.ts
-import { arch, hostname as hostname4, platform, release } from "os";
+// ../../packages/plugin-sdk/src/host-floor.ts
+import { readFileSync as readFileSync11 } from "fs";
+import { join as join18 } from "path";
 
 // ../../packages/plugin-sdk/src/model-governance.ts
 import {
@@ -24301,20 +24616,142 @@ import {
   readSync,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var TAIL_BYTES = 256 * 1024;
+function readTail(path) {
+  const fd = openSync2(path, "r");
+  try {
+    const { size } = fstatSync(fd);
+    if (size <= TAIL_BYTES) return { text: readFileSync10(fd, "utf8"), truncated: false };
+    const buffer = Buffer.allocUnsafe(TAIL_BYTES);
+    let filled = 0;
+    while (filled < TAIL_BYTES) {
+      const n = readSync(fd, buffer, filled, TAIL_BYTES - filled, size - TAIL_BYTES + filled);
+      if (n === 0) break;
+      filled += n;
+    }
+    return { text: buffer.subarray(0, filled).toString("utf8"), truncated: true };
+  } finally {
+    closeSync2(fd);
+  }
+}
+function modelFromTranscriptTail(transcriptPath, fromRecord) {
+  if (transcriptPath === void 0 || transcriptPath === "") return void 0;
+  try {
+    const { text: slice, truncated } = readTail(transcriptPath);
+    const lines = slice.split("\n");
+    if (truncated) lines.shift();
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i];
+      if (line === void 0 || line === "") continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      const model = fromRecord(parsed);
+      if (model !== void 0 && model !== "") return model;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// ../../packages/plugin-sdk/src/host-floor.ts
+var HOST_FEATURE = {
+  ModelSwitch: "model-switch",
+  VaultPointerDisplay: "vault-pointer-display"
+};
+var HOST_FLOORS = {
+  [HOST_FEATURE.ModelSwitch]: {
+    label: "model-switch protection",
+    hookEvents: ["PreModelSwitch", "PostModelSwitch"],
+    since: "2.1.251"
+  },
+  [HOST_FEATURE.VaultPointerDisplay]: {
+    label: "vault pointer display",
+    hookEvents: ["MessageDisplay"],
+    since: "2.1.152"
+  }
+};
+var hostVersionFromRecord = (record2) => {
+  if (typeof record2 !== "object" || record2 === null) return void 0;
+  const { version: version2 } = record2;
+  return typeof version2 === "string" && version2 !== "" ? version2 : void 0;
+};
+function hostVersionFromTranscript(transcriptPath) {
+  return modelFromTranscriptTail(transcriptPath, hostVersionFromRecord);
+}
+function hostFloorGaps(hostVersion) {
+  if (hostVersion === void 0) return [];
+  const gaps = [];
+  for (const [feature, row] of Object.entries(HOST_FLOORS)) {
+    if (compareBinaryVersions(hostVersion, row.since) < 0) {
+      gaps.push({ feature, label: row.label, since: row.since });
+    }
+  }
+  return gaps;
+}
+function requiredHostVersion(gaps) {
+  let highest;
+  for (const gap of gaps) {
+    if (highest === void 0 || compareBinaryVersions(gap.since, highest) > 0) highest = gap.since;
+  }
+  return highest;
+}
+function hostFloorNotice(hostVersion) {
+  if (hostVersion === void 0) return null;
+  const gaps = hostFloorGaps(hostVersion);
+  const required2 = requiredHostVersion(gaps);
+  if (required2 === void 0) return null;
+  return `This Claude Code (${hostVersion}) is older than AKA needs \u2014 some of AKA's protections are inactive in this session. Update Claude Code to ${required2} or newer to turn them on. Everything else AKA does is working normally. Run \`aka status\` for detail.`;
+}
+var HOST_VERSION_MARKER = "host-version.json";
+function recordHostVersion(dataDir2, version2) {
+  if (version2 === void 0 || !isParseableBinaryVersion(version2)) return;
+  try {
+    const current = readHostVersionCache(dataDir2);
+    if (current !== null && compareBinaryVersions(version2, current.version) <= 0) return;
+    const cache = { version: version2, observedAt: Date.now() };
+    ensureDataDirSync(dataDir2);
+    writeOwnerOnlyFileSync(join18(dataDir2, HOST_VERSION_MARKER), JSON.stringify(cache));
+  } catch {
+  }
+}
+function readHostVersionCache(dataDir2) {
+  try {
+    const parsed = JSON.parse(readFileSync11(join18(dataDir2, HOST_VERSION_MARKER), "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const { version: version2, observedAt } = parsed;
+    if (typeof version2 !== "string" || !isParseableBinaryVersion(version2)) return null;
+    if (typeof observedAt !== "number" || !Number.isFinite(observedAt)) return null;
+    return { version: version2, observedAt };
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/plugin-sdk/src/ignore-layers.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { readFileSync as readFileSync12 } from "fs";
+import { join as join19 } from "path";
+
+// ../../packages/plugin-sdk/src/inventory-resolver.ts
+import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import { join as join17 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
+import { join as join20 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
-import { basename as basename4, dirname as dirname4, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname5, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync10, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join18 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join21 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -24350,9 +24787,9 @@ var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
 import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join19 } from "path";
+import { join as join22 } from "path";
 function throttled(dataDir2, markerName, windowMs) {
-  const marker = join19(dataDir2, markerName);
+  const marker = join22(dataDir2, markerName);
   try {
     if (Date.now() - statSync8(marker).mtimeMs < windowMs) return true;
   } catch {
@@ -24367,27 +24804,27 @@ function throttled(dataDir2, markerName, windowMs) {
 
 // src/history/reconcile-trigger.ts
 import { spawn } from "child_process";
-import { dirname as dirname5, join as join21 } from "path";
+import { dirname as dirname6, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/history/tail.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import {
   closeSync as closeSync3,
   fstatSync as fstatSync2,
   mkdirSync as mkdirSync5,
   openSync as openSync3,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync14,
   readSync as readSync2,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join20 } from "path";
+import { join as join23 } from "path";
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
 function safeSessionId(sessionId) {
   if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
     return sessionId;
   }
-  return createHash5("sha256").update(sessionId).digest("hex");
+  return createHash6("sha256").update(sessionId).digest("hex");
 }
 
 // src/history/reconcile-trigger.ts
@@ -24397,8 +24834,8 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
   try {
     const marker = `${RECONCILE_MARKER_PREFIX}-${safeSessionId(sessionId)}`;
     if (throttled(dataDir2, marker, RECONCILE_THROTTLE_MS)) return;
-    const here = dirname5(fileURLToPath2(import.meta.url));
-    const child = spawn(process.execPath, [join21(here, "reconcile.js"), sessionId, transcriptPath], {
+    const here = dirname6(fileURLToPath2(import.meta.url));
+    const child = spawn(process.execPath, [join24(here, "reconcile.js"), sessionId, transcriptPath], {
       detached: true,
       stdio: "ignore"
     });
@@ -24407,6 +24844,68 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
   }
 }
 
+// src/hooks/host-floor-notice.ts
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync5, rmSync as rmSync7, statSync as statSync9, writeFileSync as writeFileSync9 } from "fs";
+import { join as join25 } from "path";
+var CLAIM_DIR = "host-floor-claims";
+var CLAIM_TTL_MS = 12 * 60 * 60 * 1e3;
+var CLAIM_SWEEP_MS = 7 * 24 * 60 * 60 * 1e3;
+function sweep(dir) {
+  try {
+    for (const name of readdirSync5(dir)) {
+      const path = join25(dir, name);
+      try {
+        if (Date.now() - statSync9(path).mtimeMs > CLAIM_SWEEP_MS) rmSync7(path, { force: true });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function tryClaim(dataDir2, sessionId) {
+  if (sessionId === void 0 || sessionId === "") return () => void 0;
+  const dir = join25(dataDir2, CLAIM_DIR);
+  const path = join25(dir, encodeURIComponent(sessionId));
+  try {
+    if (Date.now() - statSync9(path).mtimeMs < CLAIM_TTL_MS) return null;
+    rmSync7(path, { force: true });
+  } catch {
+  }
+  try {
+    mkdirSync6(dir, { recursive: true, mode: DATA_DIR_MODE });
+    writeFileSync9(path, String(Date.now()), { flag: "wx", mode: DATA_FILE_MODE });
+  } catch (err) {
+    if (err.code === "EEXIST") return null;
+    return () => void 0;
+  }
+  sweep(dir);
+  return () => {
+    try {
+      rmSync7(path, { force: true });
+    } catch {
+    }
+  };
+}
+function warnIfHostBelowFloor(config2, sessionId, transcriptPath, write = (message) => void process.stderr.write(message)) {
+  try {
+    const release2 = tryClaim(config2.dataDir, sessionId);
+    if (release2 === null) return;
+    let settled = false;
+    try {
+      const version2 = hostVersionFromTranscript(transcriptPath);
+      if (version2 === void 0) return;
+      recordHostVersion(config2.dataDir, version2);
+      const notice = hostFloorNotice(version2);
+      if (notice !== null) write(`[aka] ${notice}
+`);
+      settled = true;
+    } finally {
+      if (!settled) release2();
+    }
+  } catch {
+  }
+}
+
 // src/hooks/shared.ts
 async function readStdin() {
   return new Promise((resolve2) => {
@@ -24453,37 +24952,39 @@ function parseStopPayload(input2) {
 }
 
 // src/hooks/store-health.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname6, join as join28 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname7, join as join32 } from "path";
 
-// ../../packages/plugin-runtime/src/attached/egress-wire.ts
-import { createHash as createHash6 } from "crypto";
+// ../../packages/remote/src/http.ts
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+
+// ../../packages/remote/src/client.ts
+var SLASH = "/".charCodeAt(0);
 
 // ../../packages/plugin-runtime/src/attached/forward-drops.ts
-import { readFileSync as readFileSync13 } from "fs";
-import { join as join22 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join26 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/forward-policy.ts
 import { randomUUID as randomUUID15 } from "crypto";
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { readFile, rename, writeFile } from "fs/promises";
-import { join as join23 } from "path";
+import { join as join27 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/history-state.ts
-import { readFileSync as readFileSync15 } from "fs";
-import { join as join24 } from "path";
+import { readFileSync as readFileSync17 } from "fs";
+import { join as join28 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/history-sync.ts
 import { createHash as createHash7 } from "crypto";
 import { hostname as hostname5 } from "os";
 
-// ../../packages/remote/src/http.ts
-import { request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
-
-// ../../packages/remote/src/client.ts
-var SLASH = "/".charCodeAt(0);
+// ../../packages/plugin-runtime/src/attached/capture-rebuild.ts
+var CORRELATION_ID = EventMetadata.shape.correlationId;
+var TRACE_ID = EventMetadata.shape.traceId;
+var EXCEPTION_ID = EventMetadata.shape.exceptionIds.unwrap().element;
 
 // ../../packages/plugin-runtime/src/attached/history-sync-trigger.ts
 import { spawn as spawn2 } from "child_process";
@@ -24491,12 +24992,12 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 var HISTORY_SYNC_THROTTLE_MS = 5 * 60 * 1e3;
 
 // ../../packages/plugin-runtime/src/attached/plugin-block.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 import { randomUUID as randomUUID16 } from "crypto";
 import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join29 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
@@ -24505,17 +25006,17 @@ import { rename as rename2 } from "fs/promises";
 var POSTURE_REPORT_INTERVAL_MS = 60 * 60 * 1e3;
 
 // ../../packages/plugin-runtime/src/attached/posture-snapshot.ts
-import { statSync as statSync9 } from "fs";
+import { statSync as statSync10 } from "fs";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 
 // ../../packages/plugin-runtime/src/attached/posture-store.ts
 import { randomUUID as randomUUID17 } from "crypto";
 import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join30 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/sync-state.ts
-import { readFileSync as readFileSync17 } from "fs";
-import { join as join27 } from "path";
+import { readFileSync as readFileSync19 } from "fs";
+import { join as join31 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/status.ts
 var REFUSAL_LINES = {
@@ -24549,12 +25050,12 @@ var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 // src/hooks/store-health.ts
 var STORE_REDIRECT_MARKER = "store-redirect-last-session";
 function markerDirs(dataDir2) {
-  return [dataDir2, dirname6(dataDir2)];
+  return [dataDir2, dirname7(dataDir2)];
 }
 function alreadyClaimed(dirs, marker, sessionId) {
   return dirs.some((dir) => {
     try {
-      return readFileSync18(join28(dir, marker), "utf8") === sessionId;
+      return readFileSync20(join32(dir, marker), "utf8") === sessionId;
     } catch {
       return false;
     }
@@ -24563,8 +25064,8 @@ function alreadyClaimed(dirs, marker, sessionId) {
 function recordClaim(dirs, marker, sessionId) {
   for (const dir of dirs) {
     try {
-      mkdirSync6(dir, { recursive: true, mode: DATA_DIR_MODE });
-      writeFileSync9(join28(dir, marker), sessionId, { mode: DATA_FILE_MODE });
+      mkdirSync7(dir, { recursive: true, mode: DATA_DIR_MODE });
+      writeFileSync10(join32(dir, marker), sessionId, { mode: DATA_FILE_MODE });
       return;
     } catch {
     }
@@ -24589,7 +25090,7 @@ function formatMode(mode) {
 }
 function warnIfStoreRedirected(config2, sessionId, write = (message) => void process.stderr.write(message)) {
   try {
-    const paths = symlinkedStorePaths(dirname6(config2.dataDir));
+    const paths = symlinkedStorePaths(dirname7(config2.dataDir));
     if (paths.length === 0) return;
     if (!sessionId) {
       write(storeRedirectedMessage(paths));
@@ -24609,6 +25110,7 @@ async function main() {
   if (trigger === void 0) return;
   const config2 = loadConfig();
   warnIfStoreRedirected(config2, trigger.sessionId);
+  warnIfHostBelowFloor(config2, trigger.sessionId, trigger.transcriptPath);
   triggerReconcile(config2.dataDir, trigger.sessionId, trigger.transcriptPath);
 }
 try {