@akasecurity/cli 0.9.10 → 0.9.11

package/dist/cli.js

@@ -552,7 +552,66 @@ function runInherit(command, args) {
   }
 }
 
+// ../packages/local-ops/src/semver.ts
+function parse(version2) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?$/.exec(version2.trim());
+  if (!match) return null;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    pre: match[4] ? match[4].split(".") : []
+  };
+}
+function isSemver(version2) {
+  return parse(version2) !== null;
+}
+function comparePre(a, b) {
+  if (a.length === 0 && b.length === 0) return 0;
+  if (a.length === 0) return 1;
+  if (b.length === 0) return -1;
+  const len = Math.min(a.length, b.length);
+  for (let i = 0; i < len; i++) {
+    const ai = a[i] ?? "";
+    const bi = b[i] ?? "";
+    if (ai === bi) continue;
+    const an = /^\d+$/.test(ai);
+    const bn = /^\d+$/.test(bi);
+    if (an && !bn) return -1;
+    if (!an && bn) return 1;
+    if (an && bn) return Number(ai) < Number(bi) ? -1 : 1;
+    return ai < bi ? -1 : 1;
+  }
+  return a.length === b.length ? 0 : a.length < b.length ? -1 : 1;
+}
+function compareSemver(a, b) {
+  const pa = parse(a);
+  const pb = parse(b);
+  if (!pa || !pb) return 0;
+  for (let i = 0; i < 3; i++) {
+    const av = pa.core[i] ?? 0;
+    const bv = pb.core[i] ?? 0;
+    if (av !== bv) return av < bv ? -1 : 1;
+  }
+  return comparePre(pa.pre, pb.pre);
+}
+function isNewer(latest, installed) {
+  return compareSemver(latest, installed) > 0;
+}
+
 // ../packages/local-ops/src/cli-plugin-manager.ts
+var LEADING_WRAP = /^[([{"'`]{0,2}[vV]?/;
+var TRAILING_WRAP = /[)\]}"'`,;]{0,4}$/;
+function versionTokenFrom(stdout) {
+  const [firstLine = ""] = stdout.split("\n");
+  for (const token of [...firstLine.trim().split(/\s+/), ...stdout.split(/\s+/)]) {
+    const candidate = token.replace(LEADING_WRAP, "").replace(TRAILING_WRAP, "");
+    if (isSemver(candidate)) return candidate;
+  }
+  return void 0;
+}
+function hostCliVersion(bin) {
+  const { ok, stdout } = runCapture(bin, ["--version"], 5e3);
+  return ok ? versionTokenFrom(stdout) : void 0;
+}
 var HOST_VERBS = {
   claude: {
     install: (ref) => [["plugin", "install", ref]],
@@ -1002,7 +1061,7 @@ __export(external_exports, {
   optional: () => optional,
   output: () => output,
   overwrite: () => _overwrite,
-  parse: () => parse2,
+  parse: () => parse3,
   parseAsync: () => parseAsync2,
   partialRecord: () => partialRecord,
   pipe: () => pipe,
@@ -1346,7 +1405,7 @@ __export(core_exports2, {
   memoizer: () => memoizer,
   mergeValues: () => mergeValues,
   meta: () => meta,
-  parse: () => parse,
+  parse: () => parse2,
   parseAsync: () => parseAsync,
   parseURLObject: () => parseURLObject,
   prettifyError: () => prettifyError,
@@ -2549,7 +2608,7 @@ var _parse = (_Err) => {
   };
   return fn;
 };
-var parse = /* @__PURE__ */ _parse($ZodRealError);
+var parse2 = /* @__PURE__ */ _parse($ZodRealError);
 var _parseAsync = (_Err) => {
   const fn = async (schema, value, _ctx, params) => {
     const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
@@ -5565,10 +5624,10 @@ var $ZodFunction = /* @__PURE__ */ $constructor("$ZodFunction", (inst, def) => {
       throw new Error("implement() must be called with a function");
     }
     return Object.defineProperty(function(...args) {
-      const parsedArgs = inst._def.input ? parse(inst._def.input, args) : args;
+      const parsedArgs = inst._def.input ? parse2(inst._def.input, args) : args;
       const result = Reflect.apply(func, this, parsedArgs);
       if (inst._def.output) {
-        return parse(inst._def.output, result);
+        return parse2(inst._def.output, result);
       }
       return result;
     }, "_zod", { value: inst._zod, enumerable: false });
@@ -17438,7 +17497,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, void 0
 });
 
 // ../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/parse.js
-var parse2 = /* @__PURE__ */ _parse(ZodRealError);
+var parse3 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
@@ -17575,7 +17634,7 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
     util_exports.own(this, "~standard", value);
   },
   parse: function _parse2(data, params) {
-    return parse2(this, data, params, { callee: _parse2 });
+    return parse3(this, data, params, { callee: _parse2 });
   },
   parseAsync: async function _parseAsync2(data, params) {
     return await parseAsync2(this, data, params, { callee: _parseAsync2 });
@@ -20601,6 +20660,101 @@ function epochMillisToIso(ms) {
   return new Date(ms).toISOString();
 }
 
+// ../packages/schema/src/security/recommendations.ts
+var SEVERITY_WEIGHT = {
+  critical: 4,
+  high: 3,
+  medium: 2,
+  low: 1
+};
+var SEVERITY_WEIGHT_BY_STRING = SEVERITY_WEIGHT;
+function severityWeight(severity) {
+  return SEVERITY_WEIGHT_BY_STRING[severity] ?? 0;
+}
+var ADVICE = {
+  secret: "Rotate the exposed credentials and move them out of prompts (secrets manager / env vars).",
+  pii: "Remove or mask personal data before it reaches the model.",
+  financial: "Strip card and account numbers; share only non-sensitive references.",
+  phi: "Remove protected health information \u2014 it should never reach an external model.",
+  code_context: "Confirm this proprietary code context is safe to share.",
+  code_flaw: "Review the flagged pattern and apply the secure alternative (parameterized queries, safe deserializers, etc.).",
+  config: "Review the setting \u2014 a hook conflict or an egress change applies to every session that follows.",
+  custom: "Review against your organization\u2019s custom policy."
+};
+var REC_TEMPLATE = {
+  secret: { title: "Exposed secret detected", action: "Rotate" },
+  pii: { title: "Personal data in a prompt", action: "Remove" },
+  financial: { title: "Financial data detected", action: "Strip" },
+  phi: { title: "Health information detected", action: "Remove" },
+  code_context: { title: "Proprietary code shared", action: "Review" },
+  code_flaw: { title: "Insecure code pattern", action: "Fix" },
+  config: { title: "Weakened configuration", action: "Review" },
+  custom: { title: "Custom policy match", action: "Review" }
+};
+var MAX_RECOMMENDATIONS = 10;
+function bucketizeRecommendations(findings) {
+  const byRule = /* @__PURE__ */ new Map();
+  const buckets = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const n = f.count ?? 1;
+    byRule.set(f.ruleId, (byRule.get(f.ruleId) ?? 0) + n);
+    const b = buckets.get(f.category) ?? {
+      category: f.category,
+      count: 0,
+      categoryCount: 0,
+      severity: f.severity,
+      weight: 0,
+      ruleId: f.ruleId
+    };
+    b.categoryCount += n;
+    const w = severityWeight(f.severity);
+    if (w > b.weight) {
+      b.weight = w;
+      b.severity = f.severity;
+      b.ruleId = f.ruleId;
+    }
+    buckets.set(f.category, b);
+  }
+  for (const b of buckets.values()) b.count = byRule.get(b.ruleId) ?? 0;
+  return [...buckets.values()].sort((a, b) => b.weight - a.weight || b.categoryCount - a.categoryCount).slice(0, MAX_RECOMMENDATIONS);
+}
+function buildRecommendations(findings) {
+  return bucketizeRecommendations(findings).map((b) => {
+    const copy = recommendationCopy(b.category);
+    return {
+      severity: b.severity,
+      title: copy.title,
+      description: copy.advice,
+      context: `${b.ruleId} \xB7 ${String(b.count)} finding${b.count === 1 ? "" : "s"}`,
+      action: copy.action
+    };
+  });
+}
+function recommendationCopy(category) {
+  const template = REC_TEMPLATE_BY_STRING[category] ?? {
+    title: `${category} finding`,
+    action: "Review"
+  };
+  return {
+    ...template,
+    advice: ADVICE_BY_STRING[category] ?? "Review this finding against your policy."
+  };
+}
+var ADVICE_BY_STRING = ADVICE;
+var REC_TEMPLATE_BY_STRING = REC_TEMPLATE;
+function healthScore(summary) {
+  const handled = summary.byAction.block + summary.byAction.redact + summary.byAction.warn;
+  const handledRatio = summary.findings === 0 ? 1 : handled / summary.findings;
+  return Math.round(100 * (0.6 * summary.coverage + 0.4 * handledRatio));
+}
+function findingStatus(summary) {
+  return {
+    score: healthScore(summary),
+    unreviewed: { ...summary.bySeverity },
+    openFindings: summary.findings
+  };
+}
+
 // ../packages/schema/src/token/cost-model.ts
 var PROVIDER_PLATFORM = /* @__PURE__ */ new Map([
   ["anthropic", "anthropic"],
@@ -20986,13 +21140,11 @@ var FindingGroup = external_exports.object({
   latestDetectedAt: external_exports.iso.datetime(),
   instances: external_exports.array(FindingInstance),
   // Derived from instances' statuses with open-dominates precedence (see
-  // buildFindingGroups). Undefined only when no instance carries a status.
+  // foldGroupStatus). Undefined only when no instance carries a status.
   status: FindingStatus.optional(),
-  // The distinct people across the WHOLE group, not just the `instances`
-  // preview — from the store's whole-group aggregate when it supplies one,
-  // else folded from the rows (see buildFindingGroups). Undefined when no
-  // instance carries a user, or when the store supplied whole-group folds
-  // without one.
+  // The distinct people across the WHOLE group, not just the instances
+  // carried here. Undefined when no instance carries a user, or when the
+  // store supplied whole-group folds without one.
   users: external_exports.array(FindingUser).optional()
 }).meta({ id: "FindingGroup" });
 var FindingStats = external_exports.object({
@@ -21021,21 +21173,31 @@ var FindingFacets = external_exports.object({
   // counted under no value.
   status: external_exports.array(FindingFacetItem),
   // Host tool (attributes.tool_name). Present only on the instance-level
-  // reads, which can filter by it; the grouped read omits the dimension
+  // reads, which can filter by it; the type-level read omits the dimension
   // because a group spans tools.
   tool: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
-var DEFAULT_GROUPED_FINDINGS_LIMIT = 50;
-var ListGroupedFindingsQuery = external_exports.object({
+var FindingTypeSummary = FindingGroup.omit({ instances: true, match: true }).meta({
+  id: "FindingTypeSummary"
+});
+var DEFAULT_FINDING_TYPES_LIMIT = 50;
+var MAX_FINDING_TYPES_LIMIT = 100;
+var ListFindingTypesQuery = external_exports.object({
   // NOTE: severity filters by Severity (critical/high/medium/low), not by
-  // FindingAction.
+  // FindingAction. It narrows TYPES: a type's severity is the one its newest
+  // firing version carries, and this list pages types.
+  //
+  // That is NOT a claim the findings of a type share it. A rule can hold several
+  // definition versions at different severities, so a type kept by this filter
+  // can hold findings that individually do not match — see totals.findings on
+  // ListFindingTypesResponse, which counts them all.
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
-  // Matches a group's DERIVED status (see FindingGroup.status), not its
-  // individual instances' — so a filtered group's Status column always reads
-  // one of the requested values.
+  // Matches a type's DERIVED status (see FindingGroup.status), not its
+  // individual findings' — so a filtered row's status always reads one of the
+  // requested values.
   status: external_exports.array(FindingStatus).optional(),
   q: external_exports.string().optional(),
   // Scope to findings whose event carries this session id (the Activity page's
@@ -21045,23 +21207,37 @@ var ListGroupedFindingsQuery = external_exports.object({
   // from a time-scoped page (Activity's range) can carry that scope. Absent
   // means all time — this list has no default window.
   from: external_exports.iso.datetime().optional(),
-  // A group or instance id that must appear in the page even when the cursor
-  // has already advanced past its sort position. This is what keeps the
-  // Findings page's one-shot ?finding= deep link resolving once the list
-  // paginates: the target group is appended out of sort order rather than
-  // scanning forward for it. Never affects totals, facets or the cursor.
+  // A RULE id that must appear in the page even when the cursor has already
+  // advanced past its sort position. This is what keeps the selected type
+  // visible in the list once it paginates: the target is appended out of sort
+  // order rather than scanned forward for. Never affects totals, facets or the
+  // cursor. Unlike the grouped read this replaces, it names a rule only — an
+  // instance id is resolved by `findingInstance`, which is a primary-key seek
+  // and so is not bounded by what any page happens to hold.
   includeId: external_exports.string().optional(),
-  groupBy: external_exports.literal("type").optional(),
-  limit: external_exports.coerce.number().int().min(1).max(100).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_TYPES_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
-var ListGroupedFindingsResponse = external_exports.object({
+var ListFindingTypesResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings belonging to the matching TYPES — not findings that each match
+    // the filters. The filters here select types, so a type that survives
+    // contributes its whole instanceCount.
+    //
+    // `status` is the one exception, narrowed per finding via
+    // countInstancesByStatus. `severity`, `provider` and `action` are not, so
+    // this can exceed what the instance read reports for the same filters: a
+    // rule whose severity moved between versions is kept on its newest and
+    // still counts its older findings. Narrowing the other three needs
+    // per-dimension counts the aggregate does not carry today.
     findings: external_exports.number().int().nonnegative(),
-    groups: external_exports.number().int().nonnegative()
+    // Counts TYPES, which is the unit this read pages. The instance read's
+    // own totals count findings; the two deliberately answer different
+    // questions and are never summed.
+    types: external_exports.number().int().nonnegative()
   }),
   facets: FindingFacets,
-  items: external_exports.array(FindingGroup),
+  items: external_exports.array(FindingTypeSummary),
   nextCursor: external_exports.string().nullable(),
   // Present only on session-scoped queries (`sessionId` set): per ruleId, how
   // many times that rule fired in the session's persisted transcript. Findings
@@ -21069,7 +21245,7 @@ var ListGroupedFindingsResponse = external_exports.object({
   // every firing, so the two numbers legitimately differ — this map lets a
   // session-scoped view show both.
   sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
-}).meta({ id: "ListGroupedFindingsResponse" });
+}).meta({ id: "ListFindingTypesResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
   // it, so it is excluded from the request contract. The mapping helper
@@ -21099,12 +21275,13 @@ var DEFAULT_FLAT_FINDINGS_LIMIT = 50;
 var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
-  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  // Rule ids, the same vocabulary the types list's `subtype` carries. Pinning
+  // ONE of them is how the master/detail view scopes its right-hand panel.
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   // Matches each instance's OWN derived status (deriveFindingStatus), unlike
-  // the grouped query's group-level fold.
+  // the types query's type-level fold.
   status: external_exports.array(FindingStatus).optional(),
   // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
   // where the free-text `q` can only match the rendered "via Bash" label.
@@ -21121,37 +21298,47 @@ var ListFindingInstancesQuery = external_exports.object({
 });
 var ListFindingInstancesResponse = external_exports.object({
   // Instances matching the filters across the whole scope, not just this
-  // page — cursor-independent, like the grouped list's totals.
+  // page — cursor-independent, like the types list's totals.
   totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
-  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // Counts in INSTANCES here, where the types response counts types. Each
   // dimension still excludes its own filter.
   facets: FindingFacets,
   items: external_exports.array(FindingInstanceDetail),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingInstancesResponse" });
-var FindingLocationFile = external_exports.object({
-  // Empty when the instances carried no file path (a prompt or a tool call
-  // with no file attribution).
-  file: external_exports.string(),
-  instanceCount: external_exports.number().int().nonnegative(),
-  maxSeverity: Severity,
-  latestDetectedAt: external_exports.iso.datetime(),
-  // Folded from the instances' derived statuses with the same
-  // open-dominates precedence a group uses.
-  status: FindingStatus.optional(),
-  // Distinct rules seen at this location, capped — the row shows them as
-  // chips, and the count is what conveys scale.
-  ruleIds: external_exports.array(external_exports.string())
-}).meta({ id: "FindingLocationFile" });
-var FindingLocationRepo = external_exports.object({
+var FindingLocationSummary = external_exports.object({
+  // Opaque, stable, minted from the pair by encodeLocationId. It exists
+  // because a location's identity is two values and a URL param carries one:
+  // `?loc=` names a location the way `?rule=` names a type. Only ever compared
+  // for EQUALITY — the page's selection check, this read's `includeId`, the
+  // client's page dedupe — never decoded, and never a sort key.
+  id: external_exports.string(),
   /** Empty when the instances carried no repo attribute. */
   repo: external_exports.string(),
+  // Empty when the instances carried no file path (a prompt, or a tool call
+  // with no file attribution). Both halves empty is a real location — usually
+  // the largest one in a store — and is selectable like any other.
+  file: external_exports.string(),
   instanceCount: external_exports.number().int().nonnegative(),
+  // The WORST severity present, not the first row's. It is this list's primary
+  // sort key, so it is also what explains why a row is where it is, and it is
+  // how a reader decides what to open without opening everything.
   maxSeverity: Severity,
   latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same open-dominates
+  // precedence a group uses, so it answers "is anything left to do here" and
+  // not much more: a location holding 1 open among 40 resolved reads like one
+  // holding 40 open. That loss is accepted — the panel beside this list
+  // carries each finding's own status, and instanceCount sits next to the
+  // badge.
   status: FindingStatus.optional(),
-  files: external_exports.array(FindingLocationFile)
-}).meta({ id: "FindingLocationRepo" });
+  // Every distinct rule seen at this location, UNCAPPED — so the length is a
+  // tally rather than a sample and a row can say how many there are. Bounded
+  // by the ruleset, not by the store. The view bounds what it DISPLAYS.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationSummary" });
+var DEFAULT_FINDING_LOCATIONS_LIMIT = 50;
+var MAX_FINDING_LOCATIONS_LIMIT = 100;
 var ListFindingLocationsQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
@@ -21164,18 +21351,42 @@ var ListFindingLocationsQuery = external_exports.object({
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+  // A LOCATION id (see FindingLocationSummary.id) that must appear in the page
+  // even when the cursor has already advanced past its sort position — the
+  // counterpart of ListFindingTypesQuery.includeId, and needed far more often
+  // here. Selecting a row pushes the URL, which re-renders the server and resets
+  // the client's page cache to page 0; with distinct (repo, file) pairs running
+  // into the thousands, a selection sitting off page 0 is the ordinary case
+  // rather than a deep-link corner. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_LOCATIONS_LIMIT).optional(),
+  cursor: external_exports.string().optional()
 });
 var ListFindingLocationsResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings matching the filters across the whole scope. Unlike the types
+    // read's same-named field this needs no caveat: the filters here narrow
+    // per finding, so this is the sum of every row's instanceCount.
     findings: external_exports.number().int().nonnegative(),
-    repos: external_exports.number().int().nonnegative(),
-    files: external_exports.number().int().nonnegative()
+    // Counts LOCATIONS, the unit this read pages — the number the paginator
+    // states. The facets beside it count FINDINGS (see below); a surface
+    // showing both says which is which.
+    locations: external_exports.number().int().nonnegative()
   }),
-  /** Sorted by max severity, then most recent. */
-  items: external_exports.array(FindingLocationRepo),
-  /** Whether `limit` truncated the repo list. */
-  hasMore: external_exports.boolean()
+  // Counts in FINDINGS, where the types response counts types, each dimension
+  // still excluding its own filter. Deliberately not locations: counting those
+  // needs a set of location keys per dimension per value — memory tracking the
+  // store times the vocabulary, in a read whose scan promises flat memory —
+  // and the cheap per-location version is not an approximation but WRONG. A
+  // location holding {claudecode, block} and {codex, warn} would survive
+  // provider=claudecode AND action=warn, under which no single finding
+  // matches, so the facet would contradict the instanceCount this whole view
+  // rests on. Findings also keep the toolbar in the same unit as the page
+  // tally and the panel it sits above.
+  facets: FindingFacets,
+  /** Sorted by max severity, then most recent, then (repo, file). */
+  items: external_exports.array(FindingLocationSummary),
+  nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingLocationsResponse" });
 
 // ../packages/schema/src/zod/meta.ts
@@ -22344,6 +22555,14 @@ var ControlPlaneErrorBody = external_exports.object({
     message: external_exports.string().optional()
   }).optional()
 });
+var RemoteFailureKind = external_exports.enum([
+  "unauthorized",
+  "forbidden",
+  "route-absent",
+  "invalid-request",
+  "rejected",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -23049,139 +23268,62 @@ function deriveFindingStatus(row) {
   if (row.latestResolutionStatus === "dismissed") return "dismissed";
   return "open";
 }
-function distinctUsers(instances) {
-  const seen = /* @__PURE__ */ new Set();
-  const users = [];
-  for (const i of instances) {
-    if (i.user === void 0 || seen.has(i.user.id)) continue;
-    seen.add(i.user.id);
-    users.push(i.user);
-  }
-  return users;
-}
 function sortUsers(users) {
   return [...users].sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id));
 }
-function buildFindingGroups(rows, opts = {}) {
-  const overrides = opts.overrides;
+function buildFindingTypes(aggregates, opts = {}) {
   const packNames = opts.packNames;
-  const aggregates = opts.aggregates;
-  const byRuleId = /* @__PURE__ */ new Map();
-  for (const row of rows) {
-    const existing = byRuleId.get(row.ruleId);
-    if (existing) existing.push(row);
-    else byRuleId.set(row.ruleId, [row]);
-  }
-  const groups = [];
-  for (const [ruleId, ruleRows] of byRuleId) {
-    const instances = ruleRows.map((r) => {
-      const effectiveDbAction = overrides?.get(r.id) ?? r.actionTaken;
-      return {
-        id: r.id,
-        provider: toApiProvider(r.sourceTool),
-        repo: r.repo,
-        file: r.file,
-        ...r.toolName === void 0 ? {} : { toolName: r.toolName },
-        ...r.eventId === void 0 ? {} : { eventId: r.eventId },
-        ...r.sessionId === void 0 ? {} : { sessionId: r.sessionId },
-        ...r.user === void 0 ? {} : { user: r.user },
-        action: toApiAction(effectiveDbAction),
-        detectedAt: r.occurredAt,
-        confidence: r.confidence,
-        status: r.status
-      };
-    });
-    const agg = aggregates?.get(ruleId);
-    const users = agg ? sortUsers(agg.users ?? []) : distinctUsers(instances);
-    const latestDetectedAt = agg?.latestDetectedAt ?? ruleRows.reduce(
-      (max, r) => r.occurredAt > max ? r.occurredAt : max,
-      ruleRows[0]?.occurredAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
-    );
-    const seenProviders = /* @__PURE__ */ new Set();
-    const providers = (agg ? [...new Set(agg.sourceTools.map(toApiProvider))].sort() : instances.map((i) => i.provider)).filter((p) => {
-      if (seenProviders.has(p)) return false;
-      seenProviders.add(p);
-      return true;
-    });
-    const actionSet = new Set(
-      agg ? agg.actionsTaken.map(toApiAction) : instances.map((i) => i.action)
-    );
+  const types = [];
+  for (const [ruleId, agg] of aggregates) {
+    const users = sortUsers(agg.users ?? []);
+    const providers = [...new Set(agg.sourceTools.map(toApiProvider))].sort();
+    const actionSet = new Set(agg.actionsTaken.map(toApiAction));
     const aggregateAction = actionSet.size === 1 ? [...actionSet][0] ?? null : null;
-    const severity = ruleRows[0]?.severity ?? "low";
-    const detection = {
-      id: ruleId,
-      name: packNames?.get(ruleId) ?? null
-    };
-    const apiCategory = toApiCategory(ruleRows[0]?.category ?? "custom");
-    const policy = { id: `category:${apiCategory}`, name: apiCategory };
-    const match = {
-      maskedValue: ruleRows[0]?.maskedMatch ?? "",
-      contextPrefix: ""
-      // empty (pending privacy review)
-    };
-    const status = foldGroupStatus(
-      agg ? agg.statusInputs.map(deriveFindingStatus) : instances.map((i) => i.status)
-    );
-    const group = {
+    const apiCategory = toApiCategory(agg.category ?? "custom");
+    const type = {
       id: ruleId,
       category: apiCategory,
       subtype: ruleId,
       // human label comes with pack metadata later
-      severity,
-      match,
-      detection,
-      policy,
-      instanceCount: agg?.instanceCount ?? instances.length,
+      severity: agg.severity ?? "low",
+      detection: { id: ruleId, name: packNames?.get(ruleId) ?? null },
+      policy: { id: `category:${apiCategory}`, name: apiCategory },
+      instanceCount: agg.instanceCount,
       providers,
       aggregateAction,
-      latestDetectedAt,
-      instances,
-      status,
+      latestDetectedAt: agg.latestDetectedAt,
+      status: foldGroupStatus(agg.statusInputs.map(deriveFindingStatus)),
       ...users.length > 0 ? { users } : {}
     };
-    if (agg) {
-      actionsCache.set(group, [...actionSet]);
-      if (agg.searchText !== void 0) {
-        haystackCache.set(group, buildHaystack(group, agg.searchText));
-      }
+    actionsCache.set(type, [...actionSet]);
+    if (agg.searchText !== void 0) {
+      haystackCache.set(type, buildHaystack(type, agg.searchText));
     }
-    groups.push(group);
+    types.push(type);
   }
-  return groups;
+  return types;
 }
 var haystackCache = /* @__PURE__ */ new WeakMap();
-function buildHaystack(g, extra) {
+function buildHaystack(t, extra) {
   return [
-    g.subtype,
-    g.category,
-    g.match.maskedValue,
-    g.policy.name,
-    g.id,
-    ...g.instances.map((i) => i.repo),
-    ...g.instances.map((i) => i.file),
-    ...g.instances.map((i) => i.toolName ? `via ${i.toolName}` : ""),
-    ...g.instances.map((i) => i.id),
-    // The people: the whole group's list when the store folded one, plus the
-    // preview's own — the two overlap, and a haystack does not mind.
-    ...(g.users ?? []).map((u) => u.name),
-    ...g.instances.map((i) => i.user?.name ?? ""),
+    t.subtype,
+    t.category,
+    t.policy.name,
+    t.id,
+    ...(t.users ?? []).map((u) => u.name),
     ...extra === void 0 ? [] : [extra]
   ].join(" ").toLowerCase();
 }
-function groupHaystack(g) {
-  const cached2 = haystackCache.get(g);
+function typeHaystack(t) {
+  const cached2 = haystackCache.get(t);
   if (cached2 !== void 0) return cached2;
-  const haystack = buildHaystack(g);
-  haystackCache.set(g, haystack);
+  const haystack = buildHaystack(t);
+  haystackCache.set(t, haystack);
   return haystack;
 }
 var actionsCache = /* @__PURE__ */ new WeakMap();
-function groupActions(g) {
-  const cached2 = actionsCache.get(g);
-  if (cached2 !== void 0) return cached2;
-  const actions = [...new Set(g.instances.map((i) => i.action))];
-  actionsCache.set(g, actions);
-  return actions;
+function typeActions(t) {
+  return actionsCache.get(t) ?? [];
 }
 function countInstancesByStatus(statusInputs, statuses) {
   const statusSet = new Set(statuses);
@@ -23192,8 +23334,8 @@ function countInstancesByStatus(statusInputs, statuses) {
   }
   return sum;
 }
-function applyFindingFilters(groups, opts) {
-  let filtered = groups;
+function applyFindingFilters(types, opts) {
+  let filtered = types;
   if (opts.severity && opts.severity.length > 0) {
     const sevSet = new Set(opts.severity);
     filtered = filtered.filter((g) => sevSet.has(g.severity));
@@ -23204,7 +23346,7 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.actions && opts.actions.length > 0) {
     const actionSet = new Set(opts.actions);
-    filtered = filtered.filter((g) => groupActions(g).some((a) => actionSet.has(a)));
+    filtered = filtered.filter((t) => typeActions(t).some((a) => actionSet.has(a)));
   }
   if (opts.subtype && opts.subtype.length > 0) {
     const subtypeSet = new Set(opts.subtype);
@@ -23216,7 +23358,7 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.q) {
     const q = opts.q.toLowerCase();
-    filtered = filtered.filter((g) => groupHaystack(g).includes(q));
+    filtered = filtered.filter((t) => typeHaystack(t).includes(q));
   }
   return filtered;
 }
@@ -23231,11 +23373,11 @@ function compareFindingGroupOrder(a, b) {
   if (recencyDiff !== 0) return recencyDiff;
   return a.id.localeCompare(b.id);
 }
-function sortFindingGroups(groups) {
-  return [...groups].sort(compareFindingGroupOrder);
+function sortFindingTypes(types) {
+  return [...types].sort(compareFindingGroupOrder);
 }
-function computeFindingFacets(allGroups, opts) {
-  const forSeverity = applyFindingFilters(allGroups, {
+function computeFindingFacets(allTypes, opts) {
+  const forSeverity = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     statuses: opts.statuses,
@@ -23246,7 +23388,7 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forSeverity) {
     severityMap.set(g.severity, (severityMap.get(g.severity) ?? 0) + 1);
   }
-  const forProvider = applyFindingFilters(allGroups, {
+  const forProvider = applyFindingFilters(allTypes, {
     actions: opts.actions,
     statuses: opts.statuses,
     q: opts.q,
@@ -23257,7 +23399,7 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forProvider) {
     for (const p of g.providers) providerMap.set(p, (providerMap.get(p) ?? 0) + 1);
   }
-  const forAction = applyFindingFilters(allGroups, {
+  const forAction = applyFindingFilters(allTypes, {
     providers: opts.providers,
     statuses: opts.statuses,
     q: opts.q,
@@ -23266,9 +23408,9 @@ function computeFindingFacets(allGroups, opts) {
   });
   const actionMap = /* @__PURE__ */ new Map();
   for (const g of forAction) {
-    for (const a of groupActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
+    for (const a of typeActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
   }
-  const forSubtype = applyFindingFilters(allGroups, {
+  const forSubtype = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     statuses: opts.statuses,
@@ -23277,7 +23419,7 @@ function computeFindingFacets(allGroups, opts) {
   });
   const subtypeMap = /* @__PURE__ */ new Map();
   for (const g of forSubtype) subtypeMap.set(g.subtype, (subtypeMap.get(g.subtype) ?? 0) + 1);
-  const forStatus = applyFindingFilters(allGroups, {
+  const forStatus = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     q: opts.q,
@@ -23325,10 +23467,20 @@ function matchesDimension(row, opts, dimension) {
       return !opts.statuses?.length || row.status !== void 0 && opts.statuses.includes(row.status);
     case "tools":
       return !opts.tools?.length || row.toolName !== void 0 && opts.tools.includes(row.toolName);
+    // An EMPTY value is a real filter here, not an absent one. The location
+    // list buckets a finding whose event recorded no repo — or no file — under
+    // the empty string, and selecting that bucket has to narrow the panel to
+    // exactly it. Only `undefined` means "no filter"; a caller that wants every
+    // row omits the key, which every call site already does.
+    //
+    // Reading '' as unset is what this replaced, and it failed in the one place
+    // it mattered: the no-repo/no-file bucket is often the largest in a real
+    // store, and its panel dropped both predicates and returned the WHOLE scope
+    // — a row reading 3 findings beside a panel listing every finding there is.
     case "repo":
-      return opts.repo === void 0 || opts.repo === "" || row.repo === opts.repo;
+      return opts.repo === void 0 || row.repo === opts.repo;
     case "file":
-      return opts.file === void 0 || opts.file === "" || row.file === opts.file;
+      return opts.file === void 0 || row.file === opts.file;
     case "q":
       return !opts.q || rowHaystack(row).includes(opts.q.toLowerCase());
   }
@@ -23442,6 +23594,23 @@ function addToLocation(acc, row) {
   acc.statuses.push(row.status);
   acc.ruleIds.add(row.ruleId);
 }
+function compareLocationOrder(a, b) {
+  const rankA = SEVERITY_ORDER2[a.maxSeverity] ?? -1;
+  const rankB = SEVERITY_ORDER2[b.maxSeverity] ?? -1;
+  if (rankA !== rankB) return rankA - rankB;
+  if (a.latestDetectedAt !== b.latestDetectedAt) {
+    return a.latestDetectedAt < b.latestDetectedAt ? 1 : -1;
+  }
+  if (a.repo !== b.repo) return a.repo < b.repo ? -1 : 1;
+  if (a.file !== b.file) return a.file < b.file ? -1 : 1;
+  return 0;
+}
+function encodeLocationId(repo, file2) {
+  return `${encodePart(repo)}/${encodePart(file2)}`;
+}
+function encodePart(value) {
+  return encodeURIComponent(value.replace(/[\uD800-\uDFFF]/gu, "\uFFFD"));
+}
 
 // ../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
@@ -23899,7 +24068,7 @@ function isVaultConsentValid(consent) {
 // ../packages/schema/src/zod/local.ts
 var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
-var HISTORY_SYNC_PAYLOAD_VERSION = 2;
+var HISTORY_SYNC_PAYLOAD_VERSION = 3;
 var RunMode = external_exports.enum(["standalone", "attached"]);
 var ControlPlaneConnection = external_exports.object({
   endpoint: external_exports.string().min(1),
@@ -23972,11 +24141,11 @@ var WorkspaceSettings = external_exports.object({
   // covers the current payload and must be re-granted.
   modelJudgeConsent: ModelJudgeConsent.optional(),
   // Records that the user consented to the DEFERRED send — the outbox — along
-  // with the payload shape and the endpoint they agreed to. Since payload v2
-  // that covers both the pre-attach backlog and undelivered captures (which
-  // carry prompt/reply text in `content`); the key name predates the widening.
-  // Absent until granted, and a grant for a different endpoint or an older
-  // payload no longer counts.
+  // with the payload shape and the endpoint they agreed to. Since payload v3
+  // that covers the pre-attach backlog AND undelivered captures alike, and both
+  // carry prompt/reply/tool-output text in `content`; the key name predates
+  // both widenings. Absent until granted, and a grant for a different endpoint
+  // or an older payload no longer counts.
   historySyncConsent: HistorySyncConsent.optional()
 });
 function defaultWorkspaceSettings() {
@@ -24110,6 +24279,9 @@ var ManagedSettingKey = external_exports.enum([
   "dataSharesInPlace",
   "redactFallback"
 ]).meta({ id: "ManagedSettingKey" });
+function isManagedSettingKey(value) {
+  return ManagedSettingKey.safeParse(value).success;
+}
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
   controlPlane: external_exports.object({
@@ -24134,7 +24306,27 @@ var ManagedSettings = external_exports.object({
   // Which of those the user may not change. A key here with no matching value
   // freezes whatever the user last chose; a value with no lock is a DEFAULT
   // the user may still override. The two are separable on purpose.
-  lockedFields: external_exports.array(ManagedSettingKey).default([])
+  //
+  // Parsed as NAMES rather than as the enum, and split below: a name this
+  // build does not know is dropped from the locked set and reported, never a
+  // reason to refuse the file. The same shape reaches an older build whenever
+  // an administrator locks a key a newer build added, and refusing it there
+  // ran that build entirely unmanaged — every pin and lock gone — on exactly
+  // the fleets most likely to carry a version skew. A name outside the enum
+  // is still never HONOURED: the lockable set stays explicit above.
+  lockedFields: external_exports.array(external_exports.string()).default([])
+}).transform(({ lockedFields, ...rest }) => {
+  const known = [];
+  const unknown2 = [];
+  for (const name of lockedFields) {
+    if (isManagedSettingKey(name)) known.push(name);
+    else unknown2.push(name);
+  }
+  return {
+    ...rest,
+    lockedFields: known,
+    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {}
+  };
 }).meta({ id: "ManagedSettings" });
 var NO_MANAGED_CONTEXT = { present: false, lockedFields: [] };
 
@@ -24262,7 +24454,11 @@ var FindingsTimeseriesPoint = external_exports.object({
   timestamp: external_exports.iso.date(),
   critical: external_exports.number().int().nonnegative(),
   high: external_exports.number().int().nonnegative(),
-  medium: external_exports.number().int().nonnegative()
+  medium: external_exports.number().int().nonnegative(),
+  // Optional and additive, so a producer written against the earlier
+  // three-series contract keeps validating. A consumer plotting it resolves the
+  // absent case itself — the chart point requires a number.
+  low: external_exports.number().int().nonnegative().optional()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
   range: TimeRange,
@@ -24288,6 +24484,10 @@ var ResolvedFeedItem = external_exports.object({
   findingKey: external_exports.string(),
   ruleId: external_exports.string(),
   severity: Severity,
+  // Repository slug, and the file path RELATIVE to it. The pair is what
+  // identifies the file: a bare path matches the same name in every repo.
+  // Optional and additive; empty when the event carried no repo.
+  repo: external_exports.string().optional(),
   path: external_exports.string(),
   // ISO-8601 datetime (matches FindingInstance.detectedAt / the rest of the
   // findings domain). The reader `.toISOString()`s the DB epoch-ms values.
@@ -24622,51 +24822,6 @@ function pluginRef(agent) {
   return `${agent.pluginName}@${agent.marketplace}`;
 }
 
-// ../packages/local-ops/src/semver.ts
-function parse3(version2) {
-  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?$/.exec(version2.trim());
-  if (!match) return null;
-  return {
-    core: [Number(match[1]), Number(match[2]), Number(match[3])],
-    pre: match[4] ? match[4].split(".") : []
-  };
-}
-function isSemver(version2) {
-  return parse3(version2) !== null;
-}
-function comparePre(a, b) {
-  if (a.length === 0 && b.length === 0) return 0;
-  if (a.length === 0) return 1;
-  if (b.length === 0) return -1;
-  const len = Math.min(a.length, b.length);
-  for (let i = 0; i < len; i++) {
-    const ai = a[i] ?? "";
-    const bi = b[i] ?? "";
-    if (ai === bi) continue;
-    const an = /^\d+$/.test(ai);
-    const bn = /^\d+$/.test(bi);
-    if (an && !bn) return -1;
-    if (!an && bn) return 1;
-    if (an && bn) return Number(ai) < Number(bi) ? -1 : 1;
-    return ai < bi ? -1 : 1;
-  }
-  return a.length === b.length ? 0 : a.length < b.length ? -1 : 1;
-}
-function compareSemver(a, b) {
-  const pa = parse3(a);
-  const pb = parse3(b);
-  if (!pa || !pb) return 0;
-  for (let i = 0; i < 3; i++) {
-    const av = pa.core[i] ?? 0;
-    const bv = pb.core[i] ?? 0;
-    if (av !== bv) return av < bv ? -1 : 1;
-  }
-  return comparePre(pa.pre, pb.pre);
-}
-function isNewer(latest, installed) {
-  return compareSemver(latest, installed) > 0;
-}
-
 // ../packages/local-ops/src/updates.ts
 var CLI_PACKAGE = "@akasecurity/cli";
 function isRecord(value) {
@@ -25130,6 +25285,100 @@ function installAgentPlugin(agentId, mode = "capture") {
   return runSteps(resolved.cliBin, manager3.installSteps(resolved.ref), mode);
 }
 
+// ../packages/local-ops/src/background-schedule.ts
+import { createHash } from "crypto";
+import { mkdirSync, readFileSync as readFileSync3, rmSync, writeFileSync } from "fs";
+import { homedir as homedir3 } from "os";
+import { posix } from "path";
+var BACKGROUND_SYNC_LABEL = "com.akasecurity.aka.background-sync";
+var BACKGROUND_SYNC_INTERVAL_SECONDS = 30 * 60;
+function launchAgentsDir(deps) {
+  return posix.join((deps.homeDir ?? homedir3)(), "Library", "LaunchAgents");
+}
+function backgroundSyncLabel(base) {
+  return `${BACKGROUND_SYNC_LABEL}.${createHash("sha256").update(base).digest("hex").slice(0, 12)}`;
+}
+function plistPath(base, deps) {
+  return posix.join(launchAgentsDir(deps), `${backgroundSyncLabel(base)}.plist`);
+}
+function escapeXml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function renderPlist(label, programArguments) {
+  const args = programArguments.map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escapeXml(label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>StartInterval</key>
+  <integer>${String(BACKGROUND_SYNC_INTERVAL_SECONDS)}</integer>
+  <key>RunAtLoad</key>
+  <false/>
+  <key>ProcessType</key>
+  <string>Background</string>
+</dict>
+</plist>
+`;
+}
+function defaultReadFile(path) {
+  try {
+    return readFileSync3(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function defaultRunLaunchctl(args) {
+  return runCapture("launchctl", args).ok;
+}
+function guiDomain() {
+  const getuid = process.getuid;
+  return `gui/${String(typeof getuid === "function" ? getuid() : 0)}`;
+}
+function installBackgroundSync(base, deps = {}) {
+  try {
+    if ((deps.platform ?? process.platform) !== "darwin") return;
+    const reinvoke = (deps.reinvoke ?? reinvokeArgv)("sync-history", ["--run", "--home", base]);
+    if (reinvoke === null) return;
+    const label = backgroundSyncLabel(base);
+    const content = renderPlist(label, [reinvoke.command, ...reinvoke.args]);
+    const path = plistPath(base, deps);
+    if ((deps.readFile ?? defaultReadFile)(path) === content) return;
+    (deps.mkdir ?? ((dir) => {
+      mkdirSync(dir, { recursive: true });
+    }))(launchAgentsDir(deps));
+    (deps.writeFile ?? ((p, data) => {
+      writeFileSync(p, data);
+    }))(path, content);
+    const domain2 = guiDomain();
+    const launchctl = deps.runLaunchctl ?? defaultRunLaunchctl;
+    launchctl(["bootout", `${domain2}/${label}`]);
+    if (!launchctl(["bootstrap", domain2, path])) {
+      process.stderr.write(`[aka] background-sync: launchctl bootstrap failed for ${label}
+`);
+    }
+  } catch {
+  }
+}
+function uninstallBackgroundSync(base, deps = {}) {
+  try {
+    if ((deps.platform ?? process.platform) !== "darwin") return;
+    (deps.runLaunchctl ?? defaultRunLaunchctl)([
+      "bootout",
+      `${guiDomain()}/${backgroundSyncLabel(base)}`
+    ]);
+    (deps.removeFile ?? ((p) => {
+      rmSync(p, { force: true });
+    }))(plistPath(base, deps));
+  } catch {
+  }
+}
+
 // ../packages/local-ops/src/claude-plugin.ts
 var manager = createCliPluginManager("claude");
 var claudeAvailable = manager.available;
@@ -26949,7 +27198,7 @@ var CPU_CORROBORATION_SHARE = 0.2;
 var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
 // ../packages/persistence/src/attached-derived.ts
-import { rmSync } from "fs";
+import { rmSync as rmSync2 } from "fs";
 import { join as join3 } from "path";
 var POLICY_CACHE_FILENAME = "policy-cache.json";
 var ATTACHED_SYNC_STATE_FILENAME = "attached-sync-state.json";
@@ -26966,14 +27215,14 @@ var ATTACHED_DERIVED_FILENAMES = [
 function clearAttachmentDerivedState(dataDir2) {
   for (const name of ATTACHED_DERIVED_FILENAMES) {
     try {
-      rmSync(join3(dataDir2, name), { force: true });
+      rmSync2(join3(dataDir2, name), { force: true });
     } catch {
     }
   }
 }
 
 // ../packages/persistence/src/control-plane-credential.ts
-import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync as readFileSync3, rmSync as rmSync3, statSync } from "fs";
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync as readFileSync4, rmSync as rmSync4, statSync } from "fs";
 import { join as join4 } from "path";
 
 // ../packages/persistence/src/paths.ts
@@ -26981,10 +27230,10 @@ import {
   chmodSync,
   linkSync,
   lstatSync,
-  mkdirSync,
+  mkdirSync as mkdirSync2,
   renameSync,
-  rmSync as rmSync2,
-  writeFileSync
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync2
 } from "fs";
 import { threadId } from "worker_threads";
 var DATA_DIR_MODE = 448;
@@ -27008,7 +27257,7 @@ function tightenDir(dir) {
   chmodBestEffort(dir, DATA_DIR_MODE);
 }
 function mkdirOwnerOnlySync(dir, recursive2 = false) {
-  mkdirSync(dir, { recursive: recursive2, mode: DATA_DIR_MODE });
+  mkdirSync2(dir, { recursive: recursive2, mode: DATA_DIR_MODE });
 }
 function ensureDataDirSync(dir) {
   mkdirOwnerOnlySync(dir, true);
@@ -27024,12 +27273,12 @@ function tightenPerms(file2) {
   for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
 }
 function writeExclusiveOwnerOnlySync(file2, data) {
-  writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+  writeFileSync2(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
 }
 function writeOwnerOnlyFileSync(file2, data) {
   const tmp = `${file2}.${String(process.pid)}.tmp`;
   try {
-    rmSync2(tmp, { force: true });
+    rmSync3(tmp, { force: true });
   } catch {
   }
   try {
@@ -27037,7 +27286,7 @@ function writeOwnerOnlyFileSync(file2, data) {
     renameSync(tmp, file2);
   } finally {
     try {
-      rmSync2(tmp, { force: true });
+      rmSync3(tmp, { force: true });
     } catch {
     }
   }
@@ -27066,7 +27315,7 @@ var KeyUnclaimableError = class extends Error {
 function createOwnerOnlyFileSync(file2, data) {
   const tmp = `${file2}.${String(process.pid)}.${String(threadId)}.new`;
   try {
-    rmSync2(tmp, { force: true });
+    rmSync3(tmp, { force: true });
   } catch {
   }
   let created;
@@ -27075,7 +27324,7 @@ function createOwnerOnlyFileSync(file2, data) {
     created = publishByLink(tmp, file2, data);
   } finally {
     try {
-      rmSync2(tmp, { force: true });
+      rmSync3(tmp, { force: true });
     } catch {
     }
   }
@@ -27144,7 +27393,7 @@ function readControlPlaneCredentialFile(settingsDir2, connection) {
   if (gate === "absent") return { usable: false, reason: "absent" };
   if (gate === "untrusted") return { usable: false, reason: "untrusted-file" };
   try {
-    raw = readFileSync3(file2, "utf8");
+    raw = readFileSync4(file2, "utf8");
   } catch (err) {
     const code = err.code;
     return { usable: false, reason: code === "ENOENT" ? "absent" : "unreadable" };
@@ -27170,6 +27419,10 @@ function readControlPlaneCredentialFile(settingsDir2, connection) {
   }
   return { usable: true, credential: result.data };
 }
+function readControlPlaneCredential(settingsDir2, connection) {
+  const read = readControlPlaneCredentialFile(settingsDir2, connection);
+  return read.usable ? read.credential : null;
+}
 function writeControlPlaneCredential(settingsDir2, credential) {
   if (!isSafeEndpoint(credential.endpoint)) {
     throw new Error(
@@ -27186,7 +27439,7 @@ function writeControlPlaneCredential(settingsDir2, credential) {
 function removeControlPlaneCredential(settingsDir2) {
   const file2 = controlPlaneCredentialPath(settingsDir2);
   const existed = lstatSync2(file2, { throwIfNoEntry: false }) !== void 0;
-  rmSync3(file2, { force: true });
+  rmSync4(file2, { force: true });
   return existed;
 }
 
@@ -27196,9 +27449,9 @@ import { dirname as dirname4, join as join9, sep as sep2 } from "path";
 import { DatabaseSync } from "node:sqlite";
 
 // ../packages/persistence/src/ids.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function sha256Hex(input2) {
-  return createHash("sha256").update(input2).digest("hex");
+  return createHash2("sha256").update(input2).digest("hex");
 }
 function inventoryId(objectType, identityKey) {
   return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
@@ -27238,7 +27491,7 @@ function captureWireId(sessionId, contentHash, filePath = null) {
 
 // ../packages/persistence/src/internal/snapshot.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync3, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync4, statSync as statSync2 } from "fs";
+import { existsSync as existsSync3, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync5, statSync as statSync2 } from "fs";
 import { basename, dirname as dirname3, join as join5 } from "path";
 function backupPath(file2, tag) {
   return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
@@ -27249,7 +27502,7 @@ var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 var SNAPSHOT_STAGING_COPY = "copy";
 function createSnapshotStaging(backup) {
   const stage = `${backup}${SNAPSHOT_STAGING_SUFFIX}`;
-  rmSync4(stage, { recursive: true, force: true });
+  rmSync5(stage, { recursive: true, force: true });
   mkdirOwnerOnlySync(stage);
   tightenDir(stage);
   return { stage, copy: join5(stage, SNAPSHOT_STAGING_COPY) };
@@ -27278,7 +27531,7 @@ function reapStalePartials(file2) {
     try {
       const idle = idleMs(staging);
       if (idle !== null && idle > STALE_PARTIAL_MS) {
-        rmSync4(staging, { recursive: true, force: true });
+        rmSync5(staging, { recursive: true, force: true });
       }
     } catch {
     }
@@ -27292,13 +27545,13 @@ function snapshotStore(db, backup) {
     renameSync2(copy, backup);
   } catch (error61) {
     try {
-      rmSync4(stage, { recursive: true, force: true });
+      rmSync5(stage, { recursive: true, force: true });
     } catch {
     }
     throw error61;
   }
   try {
-    rmSync4(stage, { recursive: true, force: true });
+    rmSync5(stage, { recursive: true, force: true });
   } catch {
   }
 }
@@ -27313,7 +27566,7 @@ function moveStoreAside(file2, backup) {
         renameSync2(sidecar, moved);
         undo.push([moved, sidecar]);
       } catch {
-        rmSync4(sidecar, { force: true });
+        rmSync5(sidecar, { force: true });
       }
     }
   } catch (error61) {
@@ -27329,14 +27582,14 @@ function moveStoreAside(file2, backup) {
 }
 function discardStore(file2, backup) {
   try {
-    rmSync4(file2, { force: true });
+    rmSync5(file2, { force: true });
     for (const sidecar of dbSidecars(file2)) {
-      rmSync4(sidecar, { force: true });
+      rmSync5(sidecar, { force: true });
     }
   } catch (error61) {
     if (existsSync3(file2)) {
       try {
-        rmSync4(backup, { force: true });
+        rmSync5(backup, { force: true });
       } catch {
       }
     }
@@ -28280,7 +28533,8 @@ var SqliteActivityRepository = class {
             SELECT 1 FROM audit_events d
             WHERE d.root_session_id = audit_events.id
               AND (d.content LIKE ? ESCAPE '\\'
-                   OR json_extract(d.attributes, '$.detail') LIKE ? ESCAPE '\\')))`
+                   OR coalesce(json_extract(d.attributes, '$.detail'),
+                               json_extract(d.attributes, '$.target')) LIKE ? ESCAPE '\\')))`
       );
       params.push(pattern, pattern, pattern, pattern, pattern, pattern);
     }
@@ -29618,23 +29872,6 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 )`;
 
 // ../packages/persistence/src/repositories/findings.ts
-var PREVIEW_INSTANCES_PER_GROUP = 200;
-var DEFAULT_LOCATIONS_LIMIT = 100;
-var LOCATION_RULE_IDS_CAP = 20;
-function compareLocationOrder(a, b) {
-  return compareFindingGroupOrder(
-    {
-      severity: a.maxSeverity,
-      latestDetectedAt: a.latestDetectedAt,
-      id: ""
-    },
-    {
-      severity: b.maxSeverity,
-      latestDetectedAt: b.latestDetectedAt,
-      id: ""
-    }
-  );
-}
 var CONCAT_SEP = ",";
 var TUPLE_SEP = "|";
 function splitConcat(value) {
@@ -29686,13 +29923,48 @@ function decodeGroupCursor(cursor) {
   return null;
 }
 function firstAfter(sorted, cursor) {
-  const index = sorted.findIndex((g) => compareFindingGroupOrder(g, cursor) > 0);
+  const index = sorted.findIndex((t) => compareFindingGroupOrder(t, cursor) > 0);
   return index === -1 ? sorted.length : index;
 }
 function findDeepLinked(sorted, page, id) {
-  if (page.some((g) => g.id === id || g.instances.some((i) => i.id === id))) return void 0;
-  return sorted.find((g) => g.id === id || g.instances.some((i) => i.id === id));
+  if (page.some((t) => t.id === id)) return void 0;
+  return sorted.find((t) => t.id === id);
+}
+function encodeLocationCursor(location) {
+  const payload = {
+    sev: location.maxSeverity,
+    t: location.latestDetectedAt,
+    r: location.repo,
+    f: location.file
+  };
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
+function decodeLocationCursor(cursor) {
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && typeof parsed2.sev === "string" && typeof parsed2.t === "string" && typeof parsed2.r === "string" && typeof parsed2.f === "string") {
+    return { maxSeverity: parsed2.sev, latestDetectedAt: parsed2.t, repo: parsed2.r, file: parsed2.f };
+  }
+  return null;
+}
+function firstLocationAfter(sorted, cursor) {
+  const index = sorted.findIndex((l) => compareLocationOrder(l, cursor) > 0);
+  return index === -1 ? sorted.length : index;
+}
+function findDeepLinkedLocation(sorted, page, id) {
+  if (page.some((l) => l.id === id)) return void 0;
+  return sorted.find((l) => l.id === id);
+}
+var FINDING_ROW_COLUMNS_SQL = `f.id AS id, d.rule_id AS rule_id, d.category AS category,
+              d.severity AS severity, f.masked_match AS masked_match,
+              f.action_taken AS action_taken, f.confidence AS confidence,
+              e.started_at AS occurred_at,
+              e.source_tool AS source_tool,
+              e.repo AS repo,
+              e.file_path AS file,
+              e.tool_name AS tool_name,
+              f.audit_event_id AS event_id, e.root_session_id AS session_id,
+              e.event_type AS kind, f.finding_key AS finding_key,
+              ${latestResolutionStatusSql("f")} AS latest_status`;
 var DAY_MS3 = 864e5;
 var SqliteFindingsRepository = class {
   constructor(db) {
@@ -29813,30 +30085,26 @@ var SqliteFindingsRepository = class {
     );
   }
   /**
-   * Grouped findings for the dashboard — joins inspection_findings⋈audit_events
-   * ⋈inspection_definitions (repo/file/toolName from the audit event's
-   * attributes bag, rule_id/category/severity from the definition), scoped to
-   * the four capture kinds (audit_events also holds structural/reconciler/scan
-   * rows this list must never surface), groups by ruleId, computes
-   * per-filter-excluded facets, applies the requested filters, and sorts by
-   * severity then recency. Filtering
-   * and faceting run in JS via the shared @akasecurity/schema helpers. `totals`
-   * reflect the full filtered set; `items` is the requested
-   * page (default 50); no cursor (nextCursor is always null). Under a `status`
-   * filter, `totals.findings` counts only instances whose derived status was
-   * requested, and each item's instance preview is narrowed the same way.
+   * Finding TYPES for the dashboard — one row per rule, scoped to the four
+   * capture kinds (audit_events also holds structural/reconciler/scan rows this
+   * list must never surface), with per-filter-excluded facets, the requested
+   * filters applied, and sorted by severity then recency. Filtering and faceting
+   * run in JS via the shared @akasecurity/schema helpers. `totals` reflect the
+   * full filtered set; `items` is the requested page (default 50), keyset-paged.
+   * Under a `status` filter, `totals.findings` counts only findings whose
+   * derived status was requested.
+   *
+   * ONE read, which materializes no findings: a single aggregate per rule_id,
+   * folding EVERY finding into the numbers a type row and the filters need
+   * (count, severity, category, providers, actions, statuses, latest, search
+   * text). The findings OF a type come from listFindingInstances scoped to
+   * `subtype`, so neither list bounds the other and no per-type cap exists.
    *
-   * Two reads, neither of which materializes a row per finding:
-   *   1. one aggregate row per rule_id, folding EVERY instance into the numbers
-   *      the group and the filters need (count, providers, actions, statuses,
-   *      latest, search text);
-   *   2. each group's newest PREVIEW_INSTANCES_PER_GROUP instances, which
-   *      populate `instances` for the table's expanded rows.
    * The aggregates carry raw DB values and are translated by the same
-   * @akasecurity/schema mappers the row path uses, so no enum mapping or status
-   * rule is ever restated in SQL.
+   * @akasecurity/schema mappers every other path uses, so no enum mapping or
+   * status rule is ever restated in SQL.
    */
-  listGroupedFindings(query) {
+  listFindingTypes(query) {
     const sessionPredicate = query.sessionId ? ` AND e.root_session_id = :sessionId` : "";
     const fromMs = query.from === void 0 ? void 0 : isoToEpochMillis(query.from);
     const fromPredicate = fromMs === void 0 ? "" : ` AND e.started_at >= :fromMs`;
@@ -29849,12 +30117,7 @@ var SqliteFindingsRepository = class {
       predicate,
       params: sessionParams
     });
-    const rows = this.previewRows(aggregates, {
-      sessionId: query.sessionId,
-      from: query.from
-    });
-    const groupable = rows.map(toFlatFindingRow);
-    const allGroups = buildFindingGroups(groupable, { aggregates });
+    const allTypes = buildFindingTypes(aggregates);
     const filterOpts = {
       severity: query.severity,
       providers: query.provider,
@@ -29863,30 +30126,25 @@ var SqliteFindingsRepository = class {
       subtype: query.subtype,
       q: query.q
     };
-    const facets = computeFindingFacets(allGroups, filterOpts);
-    const sorted = sortFindingGroups(applyFindingFilters(allGroups, filterOpts));
+    const facets = computeFindingFacets(allTypes, filterOpts);
+    const sorted = sortFindingTypes(applyFindingFilters(allTypes, filterOpts));
     const statusFilter = query.status ?? [];
     const totals = {
-      findings: sorted.reduce((acc, g) => {
-        if (statusFilter.length === 0) return acc + g.instanceCount;
-        const agg = aggregates.get(g.id);
-        return acc + (agg ? countInstancesByStatus(agg.statusInputs, statusFilter) ?? g.instanceCount : g.instanceCount);
+      findings: sorted.reduce((acc, t) => {
+        if (statusFilter.length === 0) return acc + t.instanceCount;
+        const agg = aggregates.get(t.id);
+        return acc + (agg ? countInstancesByStatus(agg.statusInputs, statusFilter) ?? t.instanceCount : t.instanceCount);
       }, 0),
-      groups: sorted.length
+      types: sorted.length
     };
-    const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
+    const limit = query.limit ?? DEFAULT_FINDING_TYPES_LIMIT;
     const cursor = query.cursor === void 0 ? null : decodeGroupCursor(query.cursor);
     const start = cursor === null ? 0 : firstAfter(sorted, cursor);
     const page = sorted.slice(start, start + limit);
     const lastOnPage = page.at(-1);
     const nextCursor = start + limit < sorted.length && lastOnPage ? encodeGroupCursor(lastOnPage) : null;
     const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinked(sorted, page, query.includeId);
-    const statusSet = statusFilter.length > 0 ? new Set(statusFilter) : null;
-    const narrow = (g) => statusSet ? {
-      ...g,
-      instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
-    } : g;
-    const items = [...page, ...deepLinked ? [deepLinked] : []].map(narrow);
+    const items = [...page, ...deepLinked ? [deepLinked] : []];
     return Promise.resolve({
       totals,
       facets,
@@ -29897,7 +30155,7 @@ var SqliteFindingsRepository = class {
   }
   /**
    * One row per rule_id, folding EVERY instance of the group into the values
-   * buildFindingGroups cannot recover from a preview. Bounded by the number of
+   * buildFindingTypes cannot recover from an aggregate. Bounded by the number of
    * distinct rule_ids (the installed packs' rules), not by the store's size.
    *
    * A single scan, folded in two levels: the inner SELECT groups by
@@ -29991,13 +30249,25 @@ var SqliteFindingsRepository = class {
     });
   }
   /**
-   * The same findings folded by location: repository, then file within it.
+   * The same findings folded by WHERE they live — one row per (repo, file) pair.
    *
    * The grouping keys come from the capturing event's attributes, which is what
-   * the local store relates a finding to — there is no finding↔asset row to
-   * group by instead. A repo or file the event did not record folds into the
-   * empty-string bucket, which the view renders but does not link, since no
-   * filter can name it.
+   * the local store relates a finding to; there is no finding↔asset row to group
+   * by instead. A repo or file the event did not record folds into the
+   * empty-string bucket, which is a real location like any other: it is listed,
+   * it is selectable, and its `?loc=` token is as good as any other row's.
+   *
+   * ONE flat list rather than repos nesting files. A rollup can only be paged by
+   * repo, which leaves the file list inside it unbounded — the shape the by-type
+   * list was rebuilt to remove — and two-level pagination inside an
+   * expand/collapse table is what pushed that view to master/detail in the first
+   * place.
+   *
+   * Every filter narrows the FINDINGS and the locations fall out of what
+   * survives, so each row's `instanceCount` is exactly what listFindingInstances
+   * reports for the same filters scoped to that pair. The view depends on it:
+   * one toolbar sits over both panels precisely because a location owns none of
+   * its fields.
    */
   listFindingLocations(query) {
     const opts = {
@@ -30009,13 +30279,16 @@ var SqliteFindingsRepository = class {
       tools: query.tool,
       q: query.q
     };
-    const limit = query.limit ?? DEFAULT_LOCATIONS_LIMIT;
+    const limit = query.limit ?? DEFAULT_FINDING_LOCATIONS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeLocationCursor(query.cursor);
     const byRepo = /* @__PURE__ */ new Map();
+    const accumulator = createInstanceFacetAccumulator(opts);
     let total = 0;
     for (const row of this.scanFindingRows({
       sessionId: query.sessionId,
       from: query.from
     })) {
+      accumulator.add(row);
       if (!matchesInstanceFilters(row, opts)) continue;
       total += 1;
       let files = byRepo.get(row.repo);
@@ -30030,103 +30303,35 @@ var SqliteFindingsRepository = class {
       }
       addToLocation(acc, row);
     }
-    let fileCount = 0;
-    const repos = [...byRepo.entries()].map(([repo, files]) => {
-      fileCount += files.size;
-      const fileRows = [...files.entries()].map(([file2, acc]) => ({
-        file: file2,
-        instanceCount: acc.instanceCount,
-        maxSeverity: acc.maxSeverity,
-        latestDetectedAt: acc.latestDetectedAt,
-        ...foldGroupStatus(acc.statuses) === void 0 ? {} : { status: foldGroupStatus(acc.statuses) },
-        ruleIds: [...acc.ruleIds].slice(0, LOCATION_RULE_IDS_CAP)
-      })).sort(compareLocationOrder);
-      const rollup = fileRows.reduce(
-        (a, f) => ({
-          instanceCount: a.instanceCount + f.instanceCount,
-          maxSeverity: compareLocationOrder(f, a) < 0 ? f.maxSeverity : a.maxSeverity,
-          latestDetectedAt: f.latestDetectedAt > a.latestDetectedAt ? f.latestDetectedAt : a.latestDetectedAt
-        }),
-        {
-          instanceCount: 0,
-          maxSeverity: fileRows[0]?.maxSeverity ?? "low",
-          latestDetectedAt: ""
-        }
-      );
-      const statuses = fileRows.map((f) => f.status);
-      const folded = foldGroupStatus(statuses);
-      return {
-        repo,
-        instanceCount: rollup.instanceCount,
-        maxSeverity: rollup.maxSeverity,
-        latestDetectedAt: rollup.latestDetectedAt,
-        ...folded === void 0 ? {} : { status: folded },
-        files: fileRows
-      };
-    });
-    repos.sort(compareLocationOrder);
+    const sorted = [];
+    for (const [repo, files] of byRepo) {
+      for (const [file2, acc] of files) {
+        const status = foldGroupStatus(acc.statuses);
+        sorted.push({
+          id: encodeLocationId(repo, file2),
+          repo,
+          file: file2,
+          instanceCount: acc.instanceCount,
+          maxSeverity: acc.maxSeverity,
+          latestDetectedAt: acc.latestDetectedAt,
+          ...status === void 0 ? {} : { status },
+          ruleIds: [...acc.ruleIds]
+        });
+      }
+    }
+    sorted.sort(compareLocationOrder);
+    const start = cursor === null ? 0 : firstLocationAfter(sorted, cursor);
+    const page = sorted.slice(start, start + limit);
+    const lastOnPage = page.at(-1);
+    const nextCursor = start + limit < sorted.length && lastOnPage ? encodeLocationCursor(lastOnPage) : null;
+    const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinkedLocation(sorted, page, query.includeId);
     return Promise.resolve({
-      totals: { findings: total, repos: repos.length, files: fileCount },
-      items: repos.slice(0, limit),
-      hasMore: repos.length > limit
+      totals: { findings: total, locations: sorted.length },
+      facets: accumulator.facets(),
+      items: [...page, ...deepLinked ? [deepLinked] : []],
+      nextCursor
     });
   }
-  /**
-   * Each group's newest instances, for the table's expanded rows.
-   *
-   * ONE index-ordered scan with early termination, and the shape is the point.
-   * The natural spelling — `ROW_NUMBER() OVER (PARTITION BY rule_id ORDER BY
-   * started_at DESC)` then `WHERE rn <= cap` — sorts EVERY finding in scope
-   * through a temp B-tree to keep a bounded preview of each group, and then
-   * sorts the survivors again for the page order. Both sorts grow with the
-   * store while the answer does not.
-   *
-   * Instead the scan walks `audit_events` newest-first off `idx_audit_started_at`
-   * (or the session or window index the scope names — see `findingScanSql`),
-   * which is already the order the page wants, and keeps rows per rule until
-   * each rule has as many as it can show. The aggregate the caller already holds
-   * says how many that is: `min(instanceCount, PREVIEW_INSTANCES_PER_GROUP)`
-   * per rule, summed, is the number of rows this scan has to find, and it stops
-   * on the last one. That sum is bounded by `rules * PREVIEW_INSTANCES_PER_GROUP`
-   * (8,000 at this repo's 40-rule bench corpus), not by a fixed row count — a
-   * store with many firing rules widens it. The bound that DOES hold
-   * unconditionally is the sorted form's floor: this scan visits at most as
-   * many rows as `ROW_NUMBER() OVER (PARTITION BY rule_id …)` would have
-   * sorted, and stops the moment every rule has its cap, where the sorted form
-   * sorts the whole scope regardless. The true worst case — the rarest rule's
-   * wanted instances sitting at the tail of the scope — is one pass over
-   * everything in scope with a block sort of the id tie-break only, never a
-   * sort of the scope, which is still that floor.
-   *
-   * A row whose rule the aggregate did not see is skipped: the two statements
-   * run without a shared snapshot, so a capture landing between them can add a
-   * rule here that has no counts there, and the counts are what the group is
-   * built from.
-   */
-  previewRows(aggregates, scope) {
-    const wanted = /* @__PURE__ */ new Map();
-    let remaining = 0;
-    for (const [ruleId, agg] of aggregates) {
-      const n = Math.min(agg.instanceCount, PREVIEW_INSTANCES_PER_GROUP);
-      wanted.set(ruleId, n);
-      remaining += n;
-    }
-    const rows = [];
-    if (remaining === 0) return rows;
-    const { sql, params } = this.findingScanSql(scope);
-    const taken = /* @__PURE__ */ new Map();
-    for (const r of iterateRows(this.db.prepare(sql), params)) {
-      const want = wanted.get(r.rule_id);
-      if (want === void 0) continue;
-      const have = taken.get(r.rule_id) ?? 0;
-      if (have >= want) continue;
-      taken.set(r.rule_id, have + 1);
-      rows.push(r);
-      remaining -= 1;
-      if (remaining === 0) break;
-    }
-    return rows;
-  }
   /**
    * Every finding in scope as a FlatFindingRow, newest first, streamed.
    *
@@ -30153,6 +30358,33 @@ var SqliteFindingsRepository = class {
       yield toFlatFindingRow(r);
     }
   }
+  /**
+   * One finding by its own id, or null when no such row exists.
+   *
+   * A primary-key seek on `inspection_findings`, so its cost does not grow with
+   * the store — and, unlike anything derived from a list page, it resolves a
+   * finding of ANY age. That is what the Findings page's one-shot `?finding=`
+   * deep link needs: the id it carries may name a finding thousands of rows
+   * older than anything a first page holds.
+   *
+   * Deliberately UNFILTERED — no capture-kind, session or time predicate. It
+   * RESOLVES an id; whether that row would survive the list's current filters is
+   * a different question, and hiding the target because a filter excludes it is
+   * worse than showing it.
+   *
+   * `groupId` on the result IS the rule id, so this one read answers both "which
+   * type should the list select?" and "what does the drawer show?".
+   */
+  findingInstance(id) {
+    const row = this.db.prepare(
+      `SELECT ${FINDING_ROW_COLUMNS_SQL}
+           FROM inspection_findings f
+           JOIN audit_events e ON e.id = f.audit_event_id
+           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+          WHERE f.id = ?`
+    ).get(id);
+    return Promise.resolve(row === void 0 ? null : toInstanceDetail(toFlatFindingRow(row)));
+  }
   /**
    * The one statement both instance-level scans run: every finding in scope,
    * joined to its event and definition, newest first.
@@ -30186,17 +30418,7 @@ var SqliteFindingsRepository = class {
       conditions.push("e.started_at >= ?");
       params.push(isoToEpochMillis(scope.from));
     }
-    const sql = `SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
-              d.severity AS severity, f.masked_match AS masked_match,
-              f.action_taken AS action_taken, f.confidence AS confidence,
-              e.started_at AS occurred_at,
-              e.source_tool AS source_tool,
-              e.repo AS repo,
-              e.file_path AS file,
-              e.tool_name AS tool_name,
-              f.audit_event_id AS event_id, e.root_session_id AS session_id,
-              e.event_type AS kind, f.finding_key AS finding_key,
-              ${latestResolutionStatusSql("f")} AS latest_status
+    const sql = `SELECT ${FINDING_ROW_COLUMNS_SQL}
          FROM audit_events e
          CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
          CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
@@ -30210,6 +30432,26 @@ var SqliteFindingsRepository = class {
            group_concat(DISTINCT 'via ' || e.tool_name) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
     const rows = this.db.prepare(
       `SELECT rule_id,
+                -- BARE columns beside max(latest_at), which is deliberate and
+                -- is SQLite's documented behaviour: with a single min()/max()
+                -- in an aggregate query, every bare column takes its value from
+                -- the row that produced the extremum. So these are the severity
+                -- and category of the definition whose finding is NEWEST, which
+                -- is what the row-based build they replaced read off its first
+                -- (newest-first) row.
+                --
+                -- min() is WRONG here and was the defect: inspection_definitions
+                -- holds one row per rule VERSION (see its writer \u2014 a version bump
+                -- mints a new row), so a rule whose severity moved between
+                -- versions has several, and min() picks the ALPHABETICALLY
+                -- smallest \u2014 'low' over 'medium', but 'critical' over 'high'.
+                -- That is arbitrary in direction, and it feeds the badge, the
+                -- filter, the facet counts and the primary sort key.
+                --
+                -- Adding a second min()/max() aggregate here would make these
+                -- bare columns ambiguous again; keep max(latest_at) the only one.
+                severity,
+                category,
                 sum(tuple_count) AS instance_count,
                 max(latest_at) AS latest_at,
                 group_concat(source_tools) AS source_tools,
@@ -30220,6 +30462,14 @@ var SqliteFindingsRepository = class {
                 group_concat(tool_names) AS tool_names
            FROM (
              SELECT d.rule_id AS rule_id,
+                    -- Severity and category are columns of the DEFINITION, and
+                    -- a rule can have SEVERAL definitions (one per version), so
+                    -- these are grouped on below and resolved to the newest
+                    -- firing version by the outer query's bare-column select.
+                    -- They ride the aggregate because the type build has no rows
+                    -- to read them off \u2014 see buildFindingTypes.
+                    d.severity AS severity,
+                    d.category AS category,
                     e.event_type || '${TUPLE_SEP}' ||
                       (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '${TUPLE_SEP}' ||
                       coalesce(latest.status, '') AS status_tuple,
@@ -30234,7 +30484,7 @@ var SqliteFindingsRepository = class {
                LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
                  ON latest.finding_key = f.finding_key
               ${scope.predicate}
-              GROUP BY d.rule_id, status_tuple
+              GROUP BY d.rule_id, d.severity, d.category, status_tuple
            )
           GROUP BY rule_id`
     ).all(scope.params);
@@ -30243,6 +30493,8 @@ var SqliteFindingsRepository = class {
         r.rule_id,
         {
           instanceCount: r.instance_count,
+          severity: r.severity,
+          category: r.category,
           sourceTools: splitConcat(r.source_tools),
           actionsTaken: splitConcat(r.actions_taken),
           statusInputs: splitConcat(r.status_inputs).map((tuple2) => {
@@ -30259,7 +30511,7 @@ var SqliteFindingsRepository = class {
           latestDetectedAt: epochMillisToIso(r.latest_at),
           // Free text only — joined and substring-matched, so group_concat's
           // commas need no unpicking (a repo/path containing one still matches).
-          // Left undefined (not '') when unfetched, so buildFindingGroups can
+          // Left undefined (not '') when unfetched, so buildFindingTypes can
           // tell "no q this request" from "a group with no repo/file at all"
           // and skip priming a haystack nothing will read.
           ...withSearchText ? {
@@ -30411,6 +30663,12 @@ var SqliteHistorySyncRepository = class {
     this.markOwedStmt = db.prepare(
       `UPDATE audit_events SET outbox_owed = 1 WHERE id = :id AND synced_at IS NULL`
     );
+    this.markCaptureBacklogOwedStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = 1
+        WHERE synced_at IS NULL
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :before`
+    );
     this.stampStmt = db.prepare(
       `UPDATE audit_events SET synced_at = :at, sync_claimed_at = NULL WHERE id = :id`
     );
@@ -30459,7 +30717,9 @@ var SqliteHistorySyncRepository = class {
     );
     this.disownCapturesStmt = db.prepare(
       `UPDATE audit_events SET outbox_owed = NULL
-        WHERE outbox_owed IS NOT NULL AND event_type IN (${CAPTURE_TYPE_LIST})`
+        WHERE outbox_owed IS NOT NULL
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :attachedAt`
     );
     this.rearmStmt = db.prepare(
       `UPDATE audit_events SET synced_at = NULL
@@ -30535,6 +30795,7 @@ var SqliteHistorySyncRepository = class {
   freezeBoundaryStmt;
   captureRowsStmt;
   markOwedStmt;
+  markCaptureBacklogOwedStmt;
   captureSkipCountStmt;
   disownCapturesStmt;
   partitionStmt;
@@ -30598,6 +30859,23 @@ var SqliteHistorySyncRepository = class {
   markCaptureOwed(id) {
     this.markOwedStmt.run({ id });
   }
+  /**
+   * Mark every capture already on disk as owed, as of `before`.
+   *
+   * The consent-time backfill, called once from `aka attach` when a human
+   * grants existing-history consent — never from an ongoing drain pass, and
+   * never inferred from a boundary that could later move. `before` is the
+   * caller's own "now" at the moment consent was granted, so what this marks
+   * is exactly the backlog the consent prompt already counted, not whatever a
+   * later re-attach or key rotation might widen it to.
+   *
+   * Returns how many rows matched, for the caller to log or test against. Not a
+   * count of NEWLY marked rows — a row still unsynced from an earlier call
+   * matches again and is counted again, the same as `UPDATE`'s own `changes`.
+   */
+  markCaptureBacklogOwed(before) {
+    return Number(this.markCaptureBacklogOwedStmt.run({ before }).changes);
+  }
   /** Record delivery. Called only AFTER the far side has accepted the rows. */
   markSynced(ids, atMs) {
     this.stampAll(ids, atMs);
@@ -30714,15 +30992,42 @@ var SqliteHistorySyncRepository = class {
    *
    * Delivery is a fact about ONE recipient: rows sent to the deployment a
    * machine has just left are undelivered as far as the new one is concerned.
-   * All three in one transaction, so a crash between them cannot leave stamps
-   * attributed to the wrong deployment, or a boundary that belongs to another.
+   * All four in one transaction, so a crash between them cannot leave stamps
+   * attributed to the wrong deployment, a boundary that belongs to another, or
+   * a disown with no re-mark to follow it.
    *
    * The boundary is written HERE and only here, which is what freezes it: a
    * re-attach to the SAME deployment (a key rotation) leaves the fingerprint
    * unchanged, so this never runs and the backlog does not widen back over rows
    * the live path has since delivered.
+   *
+   * `backfillCapturesBefore` is the caller's OWN "now" at the instant a human
+   * granted existing-history consent for the deployment this call is arming —
+   * a DIFFERENT instant from `backlogBefore`: the re-mark boundary is the GRANT
+   * instant, `backlogBefore` is the ATTACH instant, and the two can be far
+   * apart. Passed only when that grant is valid, since this method has no way
+   * to check consent itself and must not mark a row owed for a machine that
+   * never agreed to it. Applied AFTER the disown above, in the SAME
+   * transaction: what the disown clears is every marker below `backlogBefore`,
+   * which includes this deployment's OWN pre-attach rows — `aka attach` calls
+   * `seedCaptureBacklogOwed` at the attach instant, so every row it marks sits
+   * on the cleared side of that bound — and the re-mark in the same
+   * transaction is what puts those rows back. A crash between the two cannot
+   * strand the ledger disowned with nothing re-marked — the transaction either
+   * lands whole or not at all, and a fingerprint mismatch that has not yet
+   * committed re-enters this method on the very next pass. Omit it (the
+   * structural-only tests do) to exercise the disown in isolation.
+   *
+   * The disown is bounded by `backlogBefore`, which is what keeps it from
+   * touching a marker the NEW deployment's OWN live path has already set: B's
+   * live path can mark a capture owed from the moment `aka attach` writes the
+   * descriptor, before the drain's first pass ever reaches this method, and
+   * such a row sits at or after the bound rather than below it. What keeps the
+   * disown from eating THIS SAME CALL's own re-mark is the order, not the
+   * bound — disown runs first, re-mark second, both inside the one
+   * transaction above.
    */
-  rearmFor(fingerprint, backlogBefore) {
+  rearmFor(fingerprint, backlogBefore, backfillCapturesBefore) {
     this.ensureRowStmt.run();
     withTransaction(
       this.db,
@@ -30730,7 +31035,10 @@ var SqliteHistorySyncRepository = class {
         const previous = getRow(this.fingerprintStmt)?.fingerprint;
         this.rearmStmt.run();
         if (previous !== null && previous !== void 0 && previous !== fingerprint) {
-          this.disownCapturesStmt.run();
+          this.disownCapturesStmt.run({ attachedAt: backlogBefore });
+        }
+        if (backfillCapturesBefore !== void 0) {
+          this.markCaptureBacklogOwedStmt.run({ before: backfillCapturesBefore });
         }
         this.setFingerprintStmt.run({ fingerprint, backlogBefore });
       },
@@ -30928,19 +31236,19 @@ var SqliteInspectionFindingsRepository = class {
 };
 
 // ../packages/persistence/src/repositories/installed-packs.ts
-import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID4 } from "crypto";
 
 // ../packages/persistence/src/policy-floor.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { join as join8 } from "path";
 
 // ../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 function defaultDataDir() {
-  return join6(homedir3(), ".aka");
+  return join6(homedir4(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
   return join6(base, "settings");
@@ -30963,7 +31271,7 @@ function ensureLayoutDirSync(dir = defaultDataDir()) {
 }
 
 // ../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { join as join7 } from "path";
 
 // ../packages/persistence/src/file-lock.ts
@@ -30972,10 +31280,10 @@ import {
   closeSync,
   existsSync as existsSync4,
   openSync,
-  readFileSync as readFileSync4,
-  rmSync as rmSync5,
+  readFileSync as readFileSync5,
+  rmSync as rmSync6,
   statSync as statSync3,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
 import { hostname as hostname3 } from "os";
 var LOCK_SUFFIX = ".lock";
@@ -31008,7 +31316,7 @@ function lockPathFor(file2) {
 function readLockBody(lock) {
   let raw;
   try {
-    raw = readFileSync4(lock, "utf8");
+    raw = readFileSync5(lock, "utf8");
   } catch {
     return null;
   }
@@ -31039,7 +31347,7 @@ function directoryAcceptsCreates(lock) {
     return false;
   } finally {
     try {
-      rmSync5(probe, { force: true });
+      rmSync6(probe, { force: true });
     } catch {
     }
   }
@@ -31065,14 +31373,14 @@ function tryAcquire(lock, file2) {
   }
   const body = { pid: process.pid, token, at: Date.now(), host: hostname3() };
   try {
-    writeFileSync2(fd, `${JSON.stringify(body)}
+    writeFileSync3(fd, `${JSON.stringify(body)}
 `);
   } catch {
     try {
       closeSync(fd);
     } catch {
     }
-    rmSync5(lock, { force: true });
+    rmSync6(lock, { force: true });
     return null;
   }
   try {
@@ -31108,13 +31416,13 @@ function breakIfStale(lock, staleMs) {
   }
   try {
     if (!existsSync4(lock) || !isAbandoned(readLockBody(lock), lock, staleMs)) return false;
-    rmSync5(lock, { force: true });
+    rmSync6(lock, { force: true });
     return true;
   } catch {
     return false;
   } finally {
     try {
-      rmSync5(breaker2, { force: true });
+      rmSync6(breaker2, { force: true });
     } catch {
     }
   }
@@ -31123,7 +31431,7 @@ var BREAKER_ABANDONED_MS = 1e4;
 function reapAbandonedBreaker(breaker2) {
   try {
     if (Date.now() - statSync3(breaker2).mtimeMs >= BREAKER_ABANDONED_MS) {
-      rmSync5(breaker2, { force: true });
+      rmSync6(breaker2, { force: true });
     }
   } catch {
   }
@@ -31134,7 +31442,7 @@ function abandonWindow(staleMs) {
 function release(lock, token) {
   try {
     if (readLockBody(lock)?.token !== token) return;
-    rmSync5(lock, { force: true });
+    rmSync6(lock, { force: true });
   } catch {
   }
 }
@@ -31181,25 +31489,26 @@ function isThenable(value) {
 }
 
 // ../packages/persistence/src/managed-settings.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { posix, win32 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { posix as posix2, win32 } from "path";
 function managedSettingsPaths(platform3 = process.platform) {
   if (platform3 === "darwin") {
     return [
-      posix.join("/Library", "Application Support", "AKASecurity", MANAGED_SETTINGS_FILENAME),
-      posix.join("/Library", "Managed Preferences", MANAGED_SETTINGS_FILENAME)
+      posix2.join("/Library", "Application Support", "AKASecurity", MANAGED_SETTINGS_FILENAME),
+      posix2.join("/Library", "Managed Preferences", MANAGED_SETTINGS_FILENAME)
     ];
   }
   if (platform3 === "win32") {
     return [win32.join("C:\\", "ProgramData", "AKASecurity", MANAGED_SETTINGS_FILENAME)];
   }
-  return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
+  return [posix2.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
 }
-function readManagedSettings(paths = managedSettingsPaths()) {
+var testOnlyManagedPaths = null;
+function readManagedSettings(paths = testOnlyManagedPaths ?? managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
-      text = readFileSync5(path, "utf8");
+      text = readFileSync6(path, "utf8");
     } catch {
       continue;
     }
@@ -31215,7 +31524,8 @@ function managedContextOf(managed) {
   return {
     present: true,
     ...managed.organization === void 0 ? {} : { organization: managed.organization },
-    lockedFields: managed.lockedFields
+    lockedFields: managed.lockedFields,
+    ...managed.unknownLockedFields === void 0 ? {} : { unknownLockedFields: managed.unknownLockedFields }
   };
 }
 function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ new Date()) {
@@ -31368,7 +31678,7 @@ function applyOnboarding(answers, base = defaultDataDir(), managedOverride) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync6(file2, "utf8");
+    text = readFileSync7(file2, "utf8");
   } catch {
     return null;
   }
@@ -31408,7 +31718,7 @@ var PolicyFloorError = class extends Error {
 };
 function readCachedPolicyBundle(base = defaultDataDir()) {
   try {
-    const raw = readFileSync7(join8(dataDir(base), POLICY_CACHE_FILENAME), "utf8");
+    const raw = readFileSync8(join8(dataDir(base), POLICY_CACHE_FILENAME), "utf8");
     const parsed2 = JSON.parse(raw);
     if (typeof parsed2 !== "object" || parsed2 === null) return null;
     return PolicyBundle.parse(parsed2.bundle);
@@ -31532,7 +31842,7 @@ function inventorySignature(packs2) {
   return packs2.map((p) => `${p.namespace}/${p.packId}@${p.version}#${hashRules(p.rulesJson)}`).sort().join(",");
 }
 function hashRules(rulesJson) {
-  return createHash2("sha256").update(rulesJson).digest("hex");
+  return createHash3("sha256").update(rulesJson).digest("hex");
 }
 function parseVersion(v) {
   const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
@@ -33780,7 +34090,7 @@ function toUtcDateString(ms) {
   return new Date(ms).toISOString().slice(0, 10);
 }
 function isTimeseriesSeverity(s) {
-  return s === "critical" || s === "high" || s === "medium";
+  return s === "critical" || s === "high" || s === "medium" || s === "low";
 }
 var SqliteSecurityRepository = class {
   constructor(db, now = () => Date.now()) {
@@ -33909,12 +34219,16 @@ var SqliteSecurityRepository = class {
     const now = this.now();
     const windowStart = startOfUtcDay2(now) - (lenDays - 1) * DAY_MS4;
     const rows = this.findingsInRange(windowStart, now);
-    const points = Array.from({ length: numBuckets }, (_, i) => ({
-      timestamp: toUtcDateString(windowStart + i * bucketMs),
-      critical: 0,
-      high: 0,
-      medium: 0
-    }));
+    const points = Array.from(
+      { length: numBuckets },
+      (_, i) => ({
+        timestamp: toUtcDateString(windowStart + i * bucketMs),
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0
+      })
+    );
     for (const r of rows) {
       const idx = Math.floor((r.occurredAt - windowStart) / bucketMs);
       const bucket = points[idx];
@@ -34132,6 +34446,7 @@ var SqliteSecurityRepository = class {
         `SELECT f.finding_key AS finding_key,
                 d.rule_id AS rule_id,
                 d.severity AS severity,
+                e.repo AS repo,
                 e.file_path AS path,
                 COALESCE(f.first_detected_at, e.started_at) AS first_detected_at,
                 latest.resolved_at AS latest_resolved_at
@@ -34151,6 +34466,7 @@ var SqliteSecurityRepository = class {
     const items = rows.map((r) => ({
       findingKey: r.finding_key,
       ruleId: r.rule_id,
+      repo: r.repo ?? "",
       severity: r.severity,
       path: r.path ?? "",
       resolvedAt: new Date(r.latest_resolved_at).toISOString(),
@@ -34160,13 +34476,66 @@ var SqliteSecurityRepository = class {
     }));
     return Promise.resolve({ items });
   }
+  /**
+   * Per-rule tallies of the findings that are still OPEN, whole-store.
+   *
+   * Scoped by status rather than by time, because the card this feeds is a to-do
+   * list: a secret committed three weeks ago and never rotated is still the most
+   * important thing to fix, and any window hides it. It carried a "newest N
+   * findings" cap and then a range; the first meant a different span on every
+   * machine, and the second reported "no recommendations" over live exposure.
+   *
+   * `open` mirrors `deriveFindingStatus` — at-rest, minus resolved and dismissed —
+   * so a row's count is exactly what `?status=open&type=<rule>` returns. Note that
+   * is NOT `severitySummary`'s `openAtRest`, which keeps dismissed findings (a
+   * dismissal is a judgement, not a remediation) and drops untracked legacy rows.
+   * The two answer different questions and only this one has to match a link.
+   *
+   * Aggregated in SQL: the result is O(distinct rule × category × severity), so a
+   * whole-store scope costs a grouped scan rather than a row per finding.
+   */
+  recommendationInputs() {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT d.rule_id AS rule_id,
+                d.category AS category,
+                d.severity AS severity,
+                COUNT(*) AS count
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+           ON latest.finding_key = f.finding_key
+         WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+           AND e.event_type = 'code_change'
+           AND (
+             f.finding_key IS NULL
+             OR latest.status IS NULL
+             OR latest.status NOT IN ('resolved', 'dismissed')
+           )
+         GROUP BY d.rule_id, d.category, d.severity`
+      )
+    );
+    return Promise.resolve(
+      rows.map((r) => ({
+        ruleId: r.rule_id,
+        category: r.category,
+        severity: r.severity,
+        count: r.count
+      }))
+    );
+  }
   // Findings whose parent event occurred in [fromMs, toMs), with the parent's
   // epoch-millis timestamp. started_at is an INTEGER column, so the bounds stay
   // numeric and the JS aggregations bucket/split on ms directly.
   findingsInRange(fromMs, toMs) {
     const rows = allRows(
       this.db.prepare(
-        `SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken
+        // `rule_id`/`category` cost nothing extra: inspection_definitions is already
+        // joined for `severity`, so they are two more columns off a row this read
+        // already fetches. They feed the recommended-actions rollup.
+        `SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken,
+                d.rule_id AS rule_id, d.category AS category
          FROM inspection_findings f
          JOIN audit_events e ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
@@ -34179,7 +34548,9 @@ var SqliteSecurityRepository = class {
     return rows.map((r) => ({
       occurredAt: r.occurred_at,
       severity: r.severity,
-      actionTaken: r.action_taken
+      actionTaken: r.action_taken,
+      ruleId: r.rule_id,
+      category: r.category
     }));
   }
 };
@@ -35349,19 +35720,56 @@ function openLocalDatabase(dir) {
   };
 }
 
+// ../packages/persistence/src/egress-wire.ts
+import { createHash as createHash4 } from "crypto";
+function hashProjectKey(projectKey) {
+  return createHash4("sha256").update(projectKey, "utf8").digest("hex");
+}
+function toIngestHit(hit) {
+  return {
+    host: hit.host,
+    kind: hit.kind,
+    name: hit.name,
+    category: hit.category,
+    trust: hit.trust,
+    network: hit.network,
+    method: hit.method,
+    transport: hit.transport,
+    url: hit.url,
+    template: hit.template,
+    dataClass: hit.dataClass,
+    site: {
+      file: hit.site.file,
+      line: hit.site.line,
+      dynamic: hit.site.dynamic,
+      vendored: hit.site.vendored
+    }
+  };
+}
+function toEgressIngestRequest(input2) {
+  const { hits, droppedFiles } = capHits(input2.hits, input2.reconcile.mode);
+  const reconcile = withoutDroppedFiles(input2.reconcile, droppedFiles);
+  return {
+    projectKey: hashProjectKey(input2.projectKey),
+    project: input2.project,
+    reconcile,
+    hits: hits.map(toIngestHit)
+  };
+}
+
 // ../packages/persistence/src/finding-key.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function normalizeFilePath(filePath) {
   return filePath.replaceAll("\\", "/");
 }
 function computeFindingKey(input2) {
   const normalizedPath = normalizeFilePath(input2.filePath);
-  return createHash3("sha256").update(`${input2.ruleId}\0${normalizedPath}\0${input2.valueFingerprint}`).digest("hex");
+  return createHash5("sha256").update(`${input2.ruleId}\0${normalizedPath}\0${input2.valueFingerprint}`).digest("hex");
 }
 
 // ../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync9 } from "fs";
 import { join as join10 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var EXCEPTION_KEY_FILENAME = "exception.key";
@@ -35466,7 +35874,7 @@ function occupantMessage(file2, kind) {
 function readFingerprintKey(dataDir2) {
   let raw;
   try {
-    raw = readFileSync8(keyFilePath(dataDir2), "utf8");
+    raw = readFileSync9(keyFilePath(dataDir2), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err instanceof Error ? err : new Error(String(err));
@@ -35501,15 +35909,31 @@ function keyStateOf(key) {
   return key === null ? { status: "absent" } : { status: "present", version: key.version };
 }
 
-// ../packages/persistence/src/history-preview.ts
+// ../packages/persistence/src/history-backfill.ts
 import { existsSync as existsSync6 } from "fs";
 import { join as join11 } from "path";
+function seedCaptureBacklogOwed(dataDir2, beforeMs) {
+  if (!existsSync6(join11(dataDir2, DB_FILENAME))) return;
+  try {
+    const db = openLocalDatabase(dataDir2);
+    try {
+      db.historySync.markCaptureBacklogOwed(beforeMs);
+    } finally {
+      db.close();
+    }
+  } catch {
+  }
+}
+
+// ../packages/persistence/src/history-preview.ts
+import { existsSync as existsSync7 } from "fs";
+import { join as join12 } from "path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 var PREVIEW_BUSY_TIMEOUT_MS = 250;
 var MS_PER_DAY = 864e5;
 function readLocalHistoryPreview(dataDir2, nowMs = Date.now()) {
-  const file2 = join11(dataDir2, DB_FILENAME);
-  if (!existsSync6(file2)) return { sessions: 0, days: 0 };
+  const file2 = join12(dataDir2, DB_FILENAME);
+  if (!existsSync7(file2)) return { sessions: 0, days: 0 };
   let db;
   try {
     db = new DatabaseSync3(file2, { readOnly: true });
@@ -35535,8 +35959,8 @@ function readLocalHistoryPreview(dataDir2, nowMs = Date.now()) {
 }
 
 // ../packages/persistence/src/store-symlinks.ts
-import { existsSync as existsSync7, lstatSync as lstatSync3, readlinkSync, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
-import { dirname as dirname5, join as join12, resolve } from "path";
+import { existsSync as existsSync8, lstatSync as lstatSync3, readlinkSync, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { dirname as dirname5, join as join13, resolve } from "path";
 var STORE_DB = "the store database (including the prompt corpus)";
 var STORE_SETTINGS = "your settings file";
 function storeContents(home) {
@@ -35545,7 +35969,7 @@ function storeContents(home) {
     [settingsDir(home), STORE_SETTINGS],
     [dataDir(home), STORE_DB],
     [keysDir(home), "the vault key"],
-    [join12(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [join13(settingsDir(home), "settings.json"), STORE_SETTINGS],
     [dbPath(home), STORE_DB]
   ]);
 }
@@ -35563,7 +35987,7 @@ function symlinkedStorePaths(home, platform3 = process.platform) {
           holds,
           // existsSync follows the link, so a target that is gone reads as
           // absent here while lstat above still sees the link itself.
-          missing: !existsSync7(path),
+          missing: !existsSync8(path),
           mode: targetMode(path, platform3)
         }
       ];
@@ -35699,8 +36123,8 @@ function formatPointer(category, keyVersion, pointerId, tag) {
 // ../packages/persistence/src/vault/key-provider.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync3, readFileSync as readFileSync9, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join13 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync10, renameSync as renameSync4, rmSync as rmSync7, statSync as statSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join14 } from "path";
 var VAULT_OCCUPANT_REASON = {
   symlink: "the path is a symlink; remove it so a keyring can be created",
   gone: "the path was occupied but holds no keyring (removed while it was being created)",
@@ -35799,16 +36223,16 @@ function claimRotationLock(lock, owner) {
     throw asError(err);
   }
   try {
-    writeFileSync3(join13(lock, LOCK_OWNER_FILE), `${owner}
+    writeFileSync4(join14(lock, LOCK_OWNER_FILE), `${owner}
 `, { mode: DATA_FILE_MODE });
     return true;
   } catch (err) {
-    rmSync6(lock, { recursive: true, force: true });
+    rmSync7(lock, { recursive: true, force: true });
     throw asError(err);
   }
 }
 function acquireRotationLock(keysDir2) {
-  const lock = join13(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const lock = join14(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
   const owner = randomBytes2(16).toString("hex");
   if (claimRotationLock(lock, owner)) return { lock, owner };
   let held;
@@ -35829,17 +36253,17 @@ function acquireRotationLock(keysDir2) {
     if (err instanceof Error && err.message === ROTATION_IN_PROGRESS) throw err;
     throw new Error(ROTATION_IN_PROGRESS, { cause: err });
   }
-  rmSync6(aside, { recursive: true, force: true });
+  rmSync7(aside, { recursive: true, force: true });
   if (!claimRotationLock(lock, owner)) throw new Error(ROTATION_IN_PROGRESS);
   return { lock, owner };
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync9(join13(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync10(join14(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
-  rmSync6(lease.lock, { recursive: true, force: true });
+  rmSync7(lease.lock, { recursive: true, force: true });
 }
 function withRotationLock(keysDir2, work) {
   ensureDataDirSync(keysDir2);
@@ -35856,7 +36280,7 @@ var FileKeyProvider = class {
     this.#keysDir = keysDir2;
   }
   get filePath() {
-    return join13(this.#keysDir, VAULT_KEY_FILENAME);
+    return join14(this.#keysDir, VAULT_KEY_FILENAME);
   }
   loadOrCreate() {
     return asAsync(() => {
@@ -35886,7 +36310,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync9(this.filePath, "utf8");
+      raw = readFileSync10(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -36521,12 +36945,12 @@ var SecretVault = class {
 };
 
 // ../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync8, writeFileSync as writeFileSync4 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync9, writeFileSync as writeFileSync5 } from "fs";
+import { join as join15 } from "path";
 
 // ../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync9 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { join as join16 } from "path";
 
 // ../packages/plugin-sdk/src/provider-env.ts
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -36547,9 +36971,9 @@ var providerEnvShape = {
 var ProviderEnvSchema = external_exports.object(providerEnvShape);
 
 // ../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync11, realpathSync as realpathSync3, statSync as statSync7 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename3, join as join17 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, realpathSync as realpathSync3, statSync as statSync7 } from "fs";
+import { homedir as homedir5 } from "os";
+import { basename as basename3, join as join18 } from "path";
 
 // ../rules/code-flaws/auth-jwt-no-verify.json
 var auth_jwt_no_verify_default = {
@@ -38584,8 +39008,8 @@ function bundledDetections() {
 }
 
 // ../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync10, readFileSync as readFileSync10, statSync as statSync6 } from "fs";
-import { basename as basename2, dirname as dirname6, isAbsolute, join as join16, sep as sep3 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync11, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname6, isAbsolute, join as join17, sep as sep3 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -38623,36 +39047,36 @@ function resolveHeadRoot(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync10(join16(dir, ".git"))) return dir;
+    if (existsSync11(join17(dir, ".git"))) return dir;
     const parent = dirname6(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join16(root, ".git");
+  const dotGit = join17(root, ".git");
   try {
     if (statSync6(dotGit).isDirectory()) {
-      return { configPath: join16(dotGit, "config"), headRoot: root };
+      return { configPath: join17(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join16(root, target);
-  if (existsSync10(join16(gitdir, "config"))) {
-    return { configPath: join16(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join17(root, target);
+  if (existsSync11(join17(gitdir, "config"))) {
+    return { configPath: join17(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join16(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join17(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join16(gitdir, commonRaw);
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join17(gitdir, commonRaw);
   const headRoot = basename2(commonGitDir) === ".git" ? dirname6(commonGitDir) : root;
-  return { configPath: join16(commonGitDir, "config"), headRoot };
+  return { configPath: join17(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync10(path, "utf8");
+    return readFileSync11(path, "utf8");
   } catch {
     return void 0;
   }
@@ -38690,20 +39114,104 @@ function slugFromUrl(url2) {
 }
 
 // ../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID13 } from "crypto";
 
 // ../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Worker } from "worker_threads";
 
+// ../packages/plugin-sdk/src/host-floor.ts
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join20 } from "path";
+
+// ../packages/plugin-sdk/src/model-governance.ts
+import {
+  closeSync as closeSync2,
+  fstatSync,
+  mkdirSync as mkdirSync3,
+  openSync as openSync2,
+  readFileSync as readFileSync13,
+  readSync,
+  writeFileSync as writeFileSync6
+} from "fs";
+import { join as join19 } from "path";
+var TAIL_BYTES = 256 * 1024;
+
+// ../packages/plugin-sdk/src/host-floor.ts
+var HOST_FEATURE = {
+  ModelSwitch: "model-switch",
+  VaultPointerDisplay: "vault-pointer-display"
+};
+var HOST_FLOORS = {
+  [HOST_FEATURE.ModelSwitch]: {
+    label: "model-switch protection",
+    hookEvents: ["PreModelSwitch", "PostModelSwitch"],
+    since: "2.1.251"
+  },
+  [HOST_FEATURE.VaultPointerDisplay]: {
+    label: "vault pointer display",
+    hookEvents: ["MessageDisplay"],
+    since: "2.1.152"
+  }
+};
+function hostFloorGaps(hostVersion) {
+  if (hostVersion === void 0) return [];
+  const gaps = [];
+  for (const [feature, row] of Object.entries(HOST_FLOORS)) {
+    if (compareBinaryVersions(hostVersion, row.since) < 0) {
+      gaps.push({ feature, label: row.label, since: row.since });
+    }
+  }
+  return gaps;
+}
+function requiredHostVersion(gaps) {
+  let highest;
+  for (const gap of gaps) {
+    if (highest === void 0 || compareBinaryVersions(gap.since, highest) > 0) highest = gap.since;
+  }
+  return highest;
+}
+var MAX_TESTED_HOST = "2.1.260";
+function hostCeilingNotice(hostVersion) {
+  if (hostVersion === void 0) return null;
+  if (compareBinaryVersions(hostVersion, MAX_TESTED_HOST) <= 0) return null;
+  return `This Claude Code (${hostVersion}) is newer than AKA has been tested against (${MAX_TESTED_HOST}). If something here looks wrong, that is the likely cause \u2014 we'll look into it.`;
+}
+function hostCompatibilityLines(cache) {
+  if (cache === null) return [];
+  const lines = [`Claude Code: ${cache.version} (last seen)`];
+  const gaps = hostFloorGaps(cache.version);
+  const required2 = requiredHostVersion(gaps);
+  if (required2 !== void 0) {
+    lines.push(`  inactive: ${gaps.map((g) => g.label).join(", ")}`);
+    lines.push(`  update Claude Code to ${required2} or newer to turn them on`);
+  }
+  const ceiling = hostCeilingNotice(cache.version);
+  if (ceiling !== null) lines.push(`  ${ceiling}`);
+  return lines;
+}
+var HOST_VERSION_MARKER = "host-version.json";
+function readHostVersionCache(dataDir2) {
+  try {
+    const parsed2 = JSON.parse(readFileSync14(join20(dataDir2, HOST_VERSION_MARKER), "utf8"));
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const { version: version2, observedAt } = parsed2;
+    if (typeof version2 !== "string" || !isParseableBinaryVersion(version2)) return null;
+    if (typeof observedAt !== "number" || !Number.isFinite(observedAt)) return null;
+    return { version: version2, observedAt };
+  } catch {
+    return null;
+  }
+}
+
 // ../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync12 } from "fs";
-import { join as join18 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join21 } from "path";
 function readIgnoreLayer(dir, filename, anchorLen) {
   try {
-    return { matcher: (0, import_ignore.default)().add(readFileSync12(join18(dir, filename), "utf8")), anchorLen };
+    return { matcher: (0, import_ignore.default)().add(readFileSync15(join21(dir, filename), "utf8")), anchorLen };
   } catch {
     return void 0;
   }
@@ -38733,22 +39241,9 @@ function withLayer(layers, layer) {
 // ../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release as release2 } from "os";
 
-// ../packages/plugin-sdk/src/model-governance.ts
-import {
-  closeSync as closeSync2,
-  fstatSync,
-  mkdirSync as mkdirSync2,
-  openSync as openSync2,
-  readFileSync as readFileSync13,
-  readSync,
-  writeFileSync as writeFileSync5
-} from "fs";
-import { join as join19 } from "path";
-var TAIL_BYTES = 256 * 1024;
-
 // ../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
-import { join as join20 } from "path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
+import { join as join22 } from "path";
 
 // ../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync4, realpathSync as realpathSync4 } from "fs";
@@ -38785,8 +39280,8 @@ function resolveNonGitProject(startDir, recognizeMarker) {
 }
 
 // ../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync12, readdirSync as readdirSync5 } from "fs";
-import { basename as basename5, join as join21 } from "path";
+import { existsSync as existsSync13, readdirSync as readdirSync5 } from "fs";
+import { basename as basename5, join as join23 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -38883,8 +39378,8 @@ function resolveProjectFiles(cwd, opts = {}) {
         }
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, dirRel, entry.name, true)) continue;
-          const fullPath = join21(dir, entry.name);
-          if (existsSync12(join21(fullPath, ".git"))) continue;
+          const fullPath = join23(dir, entry.name);
+          if (existsSync13(join23(fullPath, ".git"))) continue;
           if (depth >= bounds.maxDepth) {
             walk.omitted = true;
             continue;
@@ -38956,8 +39451,8 @@ import { randomUUID as randomUUID14 } from "crypto";
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join22 } from "path";
+import { mkdirSync as mkdirSync5, statSync as statSync8, writeFileSync as writeFileSync8 } from "fs";
+import { join as join24 } from "path";
 
 // ../packages/local-ops/src/egress-record.ts
 function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
@@ -38991,24 +39486,68 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
       if (file2.startsWith(".") || file2.includes("/.")) continue;
       files.push({ ...hit, file: file2, vendored: isVendoredPath(file2) });
     }
-    const summary = db.shares.recordProjectEgress({
+    const input2 = {
       projectKey,
       project,
       projectId,
       reconcile: { mode: "walk", walkedPrefix: toPosix(relative(root, abs)) },
       hits: resolveEgress(files)
-    });
-    return { ...summary, project };
+    };
+    const summary = db.shares.recordProjectEgress(input2);
+    return { ...summary, project: input2.project, input: input2 };
   } catch {
     return null;
   }
 }
 
 // ../packages/local-ops/src/fs-scan.ts
-import { createHash as createHash5, randomUUID as randomUUID15 } from "crypto";
-import { readdirSync as readdirSync6, readFileSync as readFileSync15, statSync as statSync10 } from "fs";
-import { basename as basename6, extname, join as join23, resolve as resolve3 } from "path";
+import { createHash as createHash7, randomUUID as randomUUID15 } from "crypto";
+import { readdirSync as readdirSync6, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync10 } from "fs";
+import { homedir as homedir6 } from "os";
+import { basename as basename6, extname, join as join25, resolve as resolve3, sep as sep5 } from "path";
 var AKAIGNORE_FILENAME = ".akaignore";
+function protectedPaths(home, akaHome) {
+  const akaHomeDirname = basename6(defaultDataDir());
+  return [
+    ...new Set(
+      [
+        resolve3(home, ".claude", "ide"),
+        resolve3(home, ".claude", ".credentials.json"),
+        resolve3(home, ".codex", "auth.json"),
+        // The home this invocation was pointed at, the machine's own default,
+        // and the default under whichever OS home this call was given — a
+        // caller that redirects `home` gets that home's AKA directory covered
+        // with it. All three are the same path for a caller on the real home.
+        resolve3(akaHome),
+        defaultDataDir(),
+        resolve3(home, akaHomeDirname)
+      ].map(canonicalize)
+    )
+  ];
+}
+function canonicalize(path) {
+  try {
+    return realpathSync5.native(path);
+  } catch {
+    return resolve3(path);
+  }
+}
+function isProtected(canonical, roots) {
+  return roots.some((root) => canonical === root || canonical.startsWith(root + sep5));
+}
+var PROTECTED_TARGET_ERROR_CODE = "AKA_PROTECTED_SCAN_TARGET";
+var ProtectedTargetError = class extends Error {
+  code = PROTECTED_TARGET_ERROR_CODE;
+  path;
+  constructor(path) {
+    super(`refusing to scan ${path}: it holds credentials this scanner must never read`);
+    this.name = "ProtectedTargetError";
+    this.path = path;
+  }
+};
+function isProtectedTarget(err) {
+  return typeof err === "object" && err !== null && err.code === PROTECTED_TARGET_ERROR_CODE;
+}
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -39020,21 +39559,24 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "out"
 ]);
 var MAX_BYTES = 1e6;
-function* collectFiles(target) {
+function* collectFiles(target, opts = {}) {
+  const protectedRoots = protectedPaths(opts.home ?? homedir6(), opts.akaHome ?? defaultDataDir());
+  const canonicalTarget = canonicalize(target);
   let st;
   try {
     st = statSync10(target);
   } catch {
     return;
   }
+  if (isProtected(canonicalTarget, protectedRoots)) throw new ProtectedTargetError(target);
   if (st.isFile()) {
     if (st.size <= MAX_BYTES) yield { path: target, gitignored: false };
     return;
   }
   if (!st.isDirectory()) return;
-  yield* visit2(target, "", [], [], false);
+  yield* visit2(target, canonicalTarget, "", [], [], false, protectedRoots);
 }
-function* visit2(dir, dirRel, markLayers, skipLayers, inIgnoredDir) {
+function* visit2(dir, dirCanonical, dirRel, markLayers, skipLayers, inIgnoredDir, protectedRoots) {
   let dirents;
   try {
     dirents = readdirSync6(dir, { withFileTypes: true });
@@ -39051,15 +39593,26 @@ function* visit2(dir, dirRel, markLayers, skipLayers, inIgnoredDir) {
     readIgnoreLayer(dir, AKAIGNORE_FILENAME, dirRel.length)
   );
   for (const entry of dirents) {
-    const path = join23(dir, entry.name);
+    const path = join25(dir, entry.name);
+    const canonical = dirCanonical === dir ? path : join25(dirCanonical, entry.name);
     if (entry.isDirectory()) {
+      if (isProtected(canonical, protectedRoots)) continue;
       const skipState = evaluateIgnore(dirSkipLayers, dirRel, entry.name, true);
       if (skipState !== "unignored" && (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".") || skipState === "ignored")) {
         continue;
       }
       const dirIgnored = inIgnoredDir || evaluateIgnore(dirMarkLayers, dirRel, entry.name, true) === "ignored";
-      yield* visit2(path, childRel(dirRel, entry.name), dirMarkLayers, dirSkipLayers, dirIgnored);
+      yield* visit2(
+        path,
+        canonical,
+        childRel(dirRel, entry.name),
+        dirMarkLayers,
+        dirSkipLayers,
+        dirIgnored,
+        protectedRoots
+      );
     } else if (entry.isFile()) {
+      if (isProtected(canonical, protectedRoots)) continue;
       if (evaluateIgnore(dirSkipLayers, dirRel, entry.name, false) === "ignored") continue;
       let size;
       try {
@@ -39102,10 +39655,12 @@ async function scanPathIntoStore(db, target, opts = {}) {
     }
     return fingerprintKey;
   }
-  for (const { path: file2, gitignored } of collectFiles(resolve3(target))) {
+  for (const { path: file2, gitignored } of collectFiles(resolve3(target), {
+    akaHome: opts.akaHome
+  })) {
     let text;
     try {
-      text = readFileSync15(file2, "utf8");
+      text = readFileSync17(file2, "utf8");
     } catch {
       continue;
     }
@@ -39128,7 +39683,7 @@ async function scanPathIntoStore(db, target, opts = {}) {
       sourceTool: opts.sourceTool ?? SOURCE_TOOL.Cli,
       kind: "code_change",
       occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
-      contentHash: createHash5("sha256").update(text).digest("hex"),
+      contentHash: createHash7("sha256").update(text).digest("hex"),
       // Only the enforced spans. `redact` folds overlapping findings into one
       // disjoint region, so narrowing its input narrows those regions too —
       // which is the intended reading rather than a hazard: an enforced span is
@@ -39202,19 +39757,53 @@ function recordProjectInventory(db, target) {
   }
 }
 
+// ../packages/local-ops/src/shares-forward.ts
+var FORWARD_FAILURE_LINES = {
+  unauthorized: "key rejected; re-attach with a valid plugin key",
+  forbidden: "key is valid but not permitted for Data Shares ingest; a key minted before Data Shares ingest existed needs a re-attach, otherwise ask your org admin",
+  "route-absent": "the deployment predates Data Shares ingest; upgrade it, then re-run the scan",
+  "invalid-request": "this build assembled a request the contract refuses; please report it",
+  rejected: "the deployment refused the request body; this build and the deployment are out of step \u2014 upgrade one of them",
+  unreachable: "control plane unreachable (timeout or server error); the next scan retries"
+};
+async function forwardProjectEgress(base, input2, deps) {
+  let endpointName = null;
+  try {
+    const settings = readWorkspaceSettings(base);
+    const connection = settings.controlPlane;
+    if (!isAttached(settings) || connection === void 0) return { status: "not-attached" };
+    const endpoint = controlPlaneName(connection);
+    endpointName = endpoint;
+    if (deps.enabled === false) return { status: "disabled", endpoint, reason: "opt-out" };
+    if (!settings.dataSharesInPlace) {
+      return { status: "disabled", endpoint, reason: "data-shares-off" };
+    }
+    const credential = readControlPlaneCredential(settingsDir(base), connection);
+    if (credential === null) return { status: "no-credential", endpoint };
+    const request = toEgressIngestRequest(input2);
+    const result = await deps.send(
+      { endpoint: connection.endpoint, apiKey: credential.apiKey },
+      request
+    );
+    return result.ok ? { status: "forwarded", endpoint, callSites: request.hits.length } : { status: "failed", endpoint, kind: result.kind };
+  } catch {
+    return endpointName === null ? { status: "not-attached" } : { status: "failed", endpoint: endpointName, kind: "unreachable" };
+  }
+}
+
 // ../packages/local-ops/src/update-cache.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync16, rmSync as rmSync7 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync18, rmSync as rmSync8 } from "fs";
+import { join as join26 } from "path";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 function cachePath(home) {
-  return join24(dataDir(home), "update-check.json");
+  return join26(dataDir(home), "update-check.json");
 }
 function readCache(home) {
   const path = cachePath(home);
-  if (!existsSync13(path)) return null;
+  if (!existsSync14(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync16(path, "utf8"));
+    const raw = JSON.parse(readFileSync18(path, "utf8"));
     if (!isRecord(raw) || typeof raw.checkedAt !== "number" || !isRecord(raw.report)) return null;
     return raw;
   } catch {
@@ -39222,7 +39811,7 @@ function readCache(home) {
   }
 }
 function writeCache(home, cache) {
-  if (!existsSync13(dataDir(home))) return;
+  if (!existsSync14(dataDir(home))) return;
   try {
     writeOwnerOnlyFileSync(cachePath(home), `${JSON.stringify(cache, null, 2)}
 `);
@@ -39234,7 +39823,7 @@ function isStale(cache, ttlMs = CHECK_TTL_MS) {
 }
 function clearCache(home) {
   try {
-    rmSync7(cachePath(home), { force: true });
+    rmSync8(cachePath(home), { force: true });
   } catch {
   }
 }
@@ -39336,7 +39925,13 @@ var COMMAND_SPECS = [
     name: "scan",
     argHint: "[path]",
     summary: "Scan a file or directory and record findings (default: .)",
-    completesFiles: true
+    completesFiles: true,
+    flags: [
+      {
+        name: "--no-forward",
+        summary: "Record locally only; skip forwarding the Data Shares register to an attached deployment."
+      }
+    ]
   },
   { name: "stats", summary: "Print findings / enforcement / detections from the local store" },
   {
@@ -39410,12 +40005,15 @@ var GLOBAL_FLAGS = ["--home", "--no-update-check", "--version", "--help"];
 function commandsHelp() {
   const label = (s) => s.argHint ? `${s.name} ${s.argHint}` : s.name;
   const width = Math.max(...COMMAND_SPECS.map((s) => label(s).length)) + 1;
-  return COMMAND_SPECS.map((s) => `  ${label(s).padEnd(width)}${s.summary}`).join("\n");
+  return COMMAND_SPECS.flatMap((s) => [
+    `  ${label(s).padEnd(width)}${s.summary}`,
+    // Under its own command, indented past the summary column, because a
+    // command-only flag listed in the shared Options block would read as one
+    // every command takes.
+    ...(s.flags ?? []).map((f) => `  ${"".padEnd(width)}${f.name}  ${f.summary}`)
+  ]).join("\n");
 }
 
-// ../packages/plugin-runtime/src/attached/egress-wire.ts
-import { createHash as createHash6 } from "crypto";
-
 // ../packages/remote/src/http.ts
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
@@ -39695,6 +40293,7 @@ function createRemoteClient(options) {
         url: url2(ROUTES.shares),
         body: JSON.stringify(validated.data)
       });
+      if (response.status === 404) throw new RemoteRouteAbsent(ROUTES.shares);
       okBody(response);
     },
     async pollCommand() {
@@ -39746,16 +40345,67 @@ function createAttachClient(options) {
   };
 }
 
+// ../packages/remote/src/failure-kind.ts
+function statusOf(err) {
+  if (typeof err !== "object" || err === null || !("status" in err)) return null;
+  const { status } = err;
+  if (typeof status !== "number" || !Number.isInteger(status)) return null;
+  return status >= 100 && status <= 599 ? status : null;
+}
+function nameOf(err) {
+  if (typeof err !== "object" || err === null || !("name" in err)) return null;
+  return typeof err.name === "string" ? err.name : null;
+}
+function classifyRemoteFailure(err) {
+  switch (nameOf(err)) {
+    case "RemoteRouteAbsent":
+      return "route-absent";
+    case "RemoteRequestInvalid":
+      return "invalid-request";
+    case "RemoteResponseInvalid":
+      return "rejected";
+    default:
+      break;
+  }
+  const status = statusOf(err);
+  if (status === null) return "unreachable";
+  switch (status) {
+    case 401:
+      return "unauthorized";
+    case 403:
+      return "forbidden";
+    case 429:
+      return "unreachable";
+    case 404:
+      return "unreachable";
+    default:
+      return status >= 400 && status <= 499 ? "rejected" : "unreachable";
+  }
+}
+
+// ../packages/remote/src/shares-sender.ts
+var SHARES_FORWARD_TIMEOUT_MS = 15e3;
+function createSharesSender(timeoutMs = SHARES_FORWARD_TIMEOUT_MS) {
+  return async (connection, request) => {
+    try {
+      await createRemoteClient({ ...connection, timeoutMs }).recordProjectEgress(request);
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, kind: classifyRemoteFailure(err) };
+    }
+  };
+}
+
 // ../packages/plugin-runtime/src/attached/forward-drops.ts
-import { readFileSync as readFileSync17 } from "fs";
-import { join as join25 } from "path";
+import { readFileSync as readFileSync19 } from "fs";
+import { join as join27 } from "path";
 var FORWARD_DROPS_FILENAME = ATTACHED_FORWARD_DROPS_FILENAME;
 function forwardDropsPath(dataDir2) {
-  return join25(dataDir2, FORWARD_DROPS_FILENAME);
+  return join27(dataDir2, FORWARD_DROPS_FILENAME);
 }
 function readForwardDrops(dataDir2) {
   try {
-    const parsed2 = JSON.parse(readFileSync17(forwardDropsPath(dataDir2), "utf8"));
+    const parsed2 = JSON.parse(readFileSync19(forwardDropsPath(dataDir2), "utf8"));
     if (typeof parsed2 !== "object" || parsed2 === null) return null;
     const record2 = parsed2;
     if (typeof record2.droppedForwards !== "number" || !Number.isFinite(record2.droppedForwards)) {
@@ -39773,9 +40423,9 @@ function readForwardDrops(dataDir2) {
 
 // ../packages/plugin-runtime/src/attached/forward-policy.ts
 import { randomUUID as randomUUID16 } from "crypto";
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 import { readFile, rename, writeFile } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join28 } from "path";
 var BREAKER_COOLDOWN_MS = 3e4;
 var FAILURES = /* @__PURE__ */ new Set([
   "unauthorized",
@@ -39799,15 +40449,15 @@ function parseBreakerState(raw, nowMs) {
 }
 function readForwardHealth(dir, nowMs = Date.now()) {
   try {
-    return parseBreakerState(readFileSync18(join26(dir, STATE_FILENAME), "utf8"), nowMs);
+    return parseBreakerState(readFileSync20(join28(dir, STATE_FILENAME), "utf8"), nowMs);
   } catch {
     return null;
   }
 }
 
 // ../packages/plugin-runtime/src/attached/history-state.ts
-import { readFileSync as readFileSync19 } from "fs";
-import { join as join27 } from "path";
+import { readFileSync as readFileSync21 } from "fs";
+import { join as join29 } from "path";
 var HISTORY_SYNC_STATE_FILENAME = ATTACHED_HISTORY_SYNC_STATE_FILENAME;
 var PHASES = /* @__PURE__ */ new Set(["filling", "complete"]);
 var OUTCOMES = /* @__PURE__ */ new Set([
@@ -39818,7 +40468,7 @@ var OUTCOMES = /* @__PURE__ */ new Set([
 ]);
 var SPEC_VERSION = 1;
 function historySyncStatePath(dataDir2) {
-  return join27(dataDir2, HISTORY_SYNC_STATE_FILENAME);
+  return join29(dataDir2, HISTORY_SYNC_STATE_FILENAME);
 }
 function writeHistorySyncState(dataDir2, state) {
   try {
@@ -39831,7 +40481,7 @@ function writeHistorySyncState(dataDir2, state) {
 }
 function readHistorySyncState(dataDir2) {
   try {
-    const parsed2 = JSON.parse(readFileSync19(historySyncStatePath(dataDir2), "utf8"));
+    const parsed2 = JSON.parse(readFileSync21(historySyncStatePath(dataDir2), "utf8"));
     if (typeof parsed2 !== "object" || parsed2 === null) return null;
     const r = parsed2;
     if (r.specVersion !== SPEC_VERSION) return null;
@@ -39863,7 +40513,7 @@ function isNullableCount(v) {
 }
 
 // ../packages/plugin-runtime/src/attached/history-sync.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import { hostname as hostname5 } from "os";
 
 // ../packages/plugin-runtime/src/attached/capture-rebuild.ts
@@ -40027,7 +40677,7 @@ var CAPTURE_BATCH_SIZE = INGEST_BATCH_MAX;
 var STRUCTURAL_BUDGET_SHARE = 0.7;
 var BATCH_SIZE = AUDIT_EVENT_BATCH_MAX;
 function endpointFingerprint(endpoint) {
-  return createHash7("sha256").update(endpoint).digest("hex");
+  return createHash8("sha256").update(endpoint).digest("hex");
 }
 var didNotRun = (reason) => ({
   attempted: false,
@@ -40044,9 +40694,12 @@ async function runHistorySync(deps) {
     if (!isAttached(settings)) return didNotRun("not-attached");
     const connection = settings.controlPlane;
     if (connection === void 0) return didNotRun("not-attached");
-    if (!isHistorySyncConsentValid(settings.historySyncConsent, connection.endpoint)) {
+    const consent = settings.historySyncConsent;
+    if (!isHistorySyncConsentValid(consent, connection.endpoint) || consent === void 0) {
       return didNotRun("no-consent");
     }
+    const consentAcknowledgedAtMs = Date.parse(consent.acknowledgedAt);
+    if (!Number.isFinite(consentAcknowledgedAtMs)) return didNotRun("attachment-unreadable");
     const state = readControlPlaneCredentialFile(deps.settingsDir, connection);
     if (!state.usable) return didNotRun("credential-unusable");
     const nowMs = now();
@@ -40062,7 +40715,7 @@ async function runHistorySync(deps) {
     const recorded = ledger.deployment();
     let backlogBefore;
     if (recorded.fingerprint !== fingerprint) {
-      ledger.rearmFor(fingerprint, attachedAtMs);
+      ledger.rearmFor(fingerprint, attachedAtMs, consentAcknowledgedAtMs);
       backlogBefore = attachedAtMs;
     } else if (recorded.backlogBefore === void 0) {
       ledger.freezeBoundary(attachedAtMs);
@@ -40438,12 +41091,12 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 var HISTORY_SYNC_THROTTLE_MS = 5 * 60 * 1e3;
 
 // ../packages/plugin-runtime/src/attached/plugin-block.ts
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 
 // ../packages/plugin-runtime/src/attached/policy-store.ts
 import { randomUUID as randomUUID17 } from "crypto";
 import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join28 } from "path";
+import { join as join30 } from "path";
 
 // ../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
@@ -40467,7 +41120,7 @@ async function publishByRename(tmp, file2, move = rename2) {
 
 // ../packages/plugin-runtime/src/attached/policy-store.ts
 function createPolicyStore(dir = dataDir()) {
-  const file2 = join28(dir, "policy-cache.json");
+  const file2 = join30(dir, "policy-cache.json");
   async function read() {
     try {
       const raw = await readFile2(file2, "utf8");
@@ -40546,11 +41199,11 @@ import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 // ../packages/plugin-runtime/src/attached/posture-store.ts
 import { randomUUID as randomUUID18 } from "crypto";
 import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join29 } from "path";
+import { join as join31 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function createPostureStore(dir = settingsDir(), legacyDir) {
-  const file2 = join29(dir, "posture-state.json");
-  const legacyFile = legacyDir === void 0 ? null : join29(legacyDir, "posture-state.json");
+  const file2 = join31(dir, "posture-state.json");
+  const legacyFile = legacyDir === void 0 ? null : join31(legacyDir, "posture-state.json");
   async function persist(state) {
     await ensureDataDir(dir);
     const tmp = `${file2}.${randomUUID18()}.tmp`;
@@ -40622,8 +41275,8 @@ async function readDeviceIdentity(dir) {
 }
 
 // ../packages/plugin-runtime/src/attached/sync-state.ts
-import { readFileSync as readFileSync21 } from "fs";
-import { join as join30 } from "path";
+import { readFileSync as readFileSync23 } from "fs";
+import { join as join32 } from "path";
 var SYNC_STATE_FILENAME = ATTACHED_SYNC_STATE_FILENAME;
 var OUTCOMES2 = /* @__PURE__ */ new Set([
   "ok",
@@ -40634,11 +41287,11 @@ var OUTCOMES2 = /* @__PURE__ */ new Set([
   "invalid-bundle"
 ]);
 function syncStatePath(dataDir2) {
-  return join30(dataDir2, SYNC_STATE_FILENAME);
+  return join32(dataDir2, SYNC_STATE_FILENAME);
 }
 function readSyncState(dataDir2) {
   try {
-    const parsed2 = JSON.parse(readFileSync21(syncStatePath(dataDir2), "utf8"));
+    const parsed2 = JSON.parse(readFileSync23(syncStatePath(dataDir2), "utf8"));
     if (typeof parsed2 !== "object" || parsed2 === null) return null;
     const record2 = parsed2;
     if (typeof record2.outcome !== "string" || !OUTCOMES2.has(record2.outcome)) return null;
@@ -41001,7 +41654,7 @@ async function attachByDeviceCode(deps) {
       ...deps.label === void 0 ? {} : { label: deps.label }
     });
   } catch (err) {
-    if (statusOf3(err) === 404) return { kind: "not-offered" };
+    if (statusOf(err) === 404) return { kind: "not-offered" };
     return { kind: "not-offered", reason: describe3(err) };
   }
   deps.io.out(
@@ -41037,7 +41690,7 @@ async function attachByDeviceCode(deps) {
     try {
       answer = await deps.client.poll(grant2.deviceCode);
     } catch (err) {
-      if (statusOf3(err) === 429) {
+      if (statusOf(err) === 429) {
         waitSeconds = Math.min(waitSeconds * 2, 60);
         continue;
       }
@@ -41105,13 +41758,9 @@ async function confirmAndReturn(deps, apiKey) {
   }
   return { kind: "attached", apiKey, identity };
 }
-function statusOf3(err) {
-  const status = err?.status;
-  return typeof status === "number" ? status : void 0;
-}
 function describe3(err) {
-  const status = statusOf3(err);
-  if (status !== void 0) return `the deployment answered ${String(status)}.`;
+  const status = statusOf(err);
+  if (status !== null) return `the deployment answered ${String(status)}.`;
   return "the deployment could not be reached.";
 }
 function stringField(body, key) {
@@ -41273,6 +41922,7 @@ ${USAGE}`);
   }
   const historyConsent = await askAboutHistory(io, args.syncHistory, base, endpoint, identity);
   const previous = readControlPlaneCredentialFile(settingsDir(base));
+  const attachedAt = /* @__PURE__ */ new Date();
   try {
     writeControlPlaneCredential(settingsDir(base), {
       specVersion: 1,
@@ -41285,7 +41935,7 @@ ${USAGE}`);
         runMode: "attached",
         controlPlane: {
           endpoint,
-          attachedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          attachedAt: attachedAt.toISOString(),
           ...args.label === void 0 ? {} : { label: args.label }
         },
         // SPELLED, never omitted. `undefined` on an optional key is how this
@@ -41310,6 +41960,10 @@ ${USAGE}`);
     exit(1);
     return;
   }
+  if (historyConsent !== void 0) {
+    seedCaptureBacklogOwed(dataDir(base), attachedAt.getTime());
+  }
+  (deps.installBackgroundSync ?? installBackgroundSync)(base);
   io.out(
     [
       `Attached to ${args.label ?? endpoint}.`,
@@ -41349,6 +42003,10 @@ async function askAboutHistory(io, flag, base, endpoint, identity) {
       `Verified against ${identity.tenantName}.`,
       "",
       "Activity from here on is sent to that deployment automatically.",
+      // The register a scan records crosses under this same attachment, and
+      // `aka scan` is a verb people reasonably think of as local — so consent
+      // is where it gets named, and named with what it does and does not carry.
+      "So is the Data Shares register a scan records \u2014 destinations and call sites, never source text.",
       ...backlog === void 0 ? [] : [backlog],
       "AKA can also keep anything a live send fails to deliver, instead of",
       "dropping it.",
@@ -41356,9 +42014,10 @@ async function askAboutHistory(io, flag, base, endpoint, identity) {
       ...backlog === void 0 ? [] : [
         "What that history sends: which sessions ran, when, in which project,",
         "                  repo and git branch; token usage and model per call;",
-        "                  which tools were called, with their inputs truncated",
-        "                  and every detected secret already masked; and what",
-        "                  AKA detected in those tool inputs.",
+        "                  which tools were called, with their inputs truncated;",
+        "                  what AKA detected in those tool inputs; and the",
+        "                  prompts, assistant replies and tool results",
+        "                  themselves.",
         ""
       ],
       // The masking half is CONDITIONAL and has to read that way. A drained
@@ -41366,16 +42025,25 @@ async function askAboutHistory(io, flag, base, endpoint, identity) {
       // where the policy assigned its detection is redact or block — so copy
       // promising that every detected secret is masked first would be false
       // under monitor and warn, which is every detection until the user
-      // promotes one. Saying so is the point of asking.
-      "And, for anything a live send could not deliver \u2014 the deployment was",
-      "unreachable, or refused the key \u2014 what was captured, which for a prompt,",
-      "an assistant reply or a tool result INCLUDES ITS TEXT. What is masked in",
-      "that text follows the policy assigned to the detection that flagged the",
-      "value: it is masked before it is stored or sent only where that policy",
-      "is redact or block. Under monitor or warn the value goes as it was seen,",
-      "and every detection ships on monitor, so on a default install nothing in",
-      "that text is masked. Everything outside a flagged span goes as written",
-      "either way.",
+      // promotes one. Saying so is the point of asking, and it now covers BOTH
+      // buckets alike: once granted, that history is sent through the same
+      // outbox mark and the same drain as an undelivered live send, so the
+      // same masking rule applies to both.
+      ...backlog === void 0 ? [
+        "For anything a live send could not deliver \u2014 the deployment was",
+        "unreachable, or refused the key \u2014 what was captured, which for a"
+      ] : [
+        "For that history, and for anything a later live send could not",
+        "deliver \u2014 the deployment was unreachable, or refused the key \u2014 what",
+        "was captured, which for a"
+      ],
+      "prompt, an assistant reply or a tool result INCLUDES ITS TEXT. What is",
+      "masked in that text follows the policy assigned to the detection that",
+      "flagged the value: it is masked before it is stored or sent",
+      "only where that policy is redact or block. Under monitor or warn the",
+      "value goes as it was seen, and every detection ships on monitor, so on",
+      "a default install nothing in that text is masked. Everything outside a",
+      "flagged span goes as written either way.",
       "",
       "Saying no does not stop live sending \u2014 that is part of being attached.",
       "It means an undelivered item is dropped rather than kept and retried.",
@@ -41418,6 +42086,7 @@ function runDetach(argv, deps = {}) {
   }
   removeControlPlaneCredential(settingsDir(base));
   clearDerived(dataDir(base));
+  (deps.uninstallBackgroundSync ?? uninstallBackgroundSync)(base);
   io.out(
     had ? "Detached. This machine records locally only; that deployment is sent nothing.\n" : "This machine was not attached; nothing to do.\n"
   );
@@ -41452,6 +42121,9 @@ async function runStatus(argv, deps = {}) {
   io.out(attached ? `${block}
 ${await renderPolicyLine(dataDir2)}
 ` : `${block}
+`);
+  const hostLines = hostCompatibilityLines(readHostVersionCache(dataDir2));
+  if (hostLines.length > 0) io.out(`${hostLines.join("\n")}
 `);
 }
 function managedRefusal(base, endpoint, label, managedOverride) {
@@ -41503,7 +42175,7 @@ async function runDeviceAttach(input2) {
 }
 
 // src/commands/check-updates.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { parseArgs } from "util";
 function runCheckUpdates(argv) {
   const { values } = parseArgs({ args: argv, options: HOME_OPTION });
@@ -41526,7 +42198,7 @@ function runCheckUpdates(argv) {
     out.write(`${String(ups.length)} update(s) available \u2014 run \`aka update\` to apply.
 `);
   }
-  if (existsSync14(dataDir(home))) {
+  if (existsSync15(dataDir(home))) {
     const notifiedPluginIds = readCache(home)?.notifiedPluginIds ?? [];
     writeCache(home, { checkedAt: Date.now(), report, notifiedPluginIds });
   }
@@ -41534,8 +42206,11 @@ function runCheckUpdates(argv) {
 
 // src/commands/completion.ts
 var topNames = COMMAND_SPECS.map((s) => s.name);
+var flagSpecs = COMMAND_SPECS.filter((s) => (s.flags ?? []).length > 0);
 function zshScript() {
-  const describe5 = COMMAND_SPECS.map((s) => `    '${s.name}:${s.summary}'`).join("\n");
+  const zq = (text) => text.replace(/'/g, "'\\''");
+  const describe5 = COMMAND_SPECS.map((s) => `    '${zq(s.name)}:${zq(s.summary)}'`).join("\n");
+  const flagArms = flagSpecs.map((s) => `      ${s.name}) _aka_flags+=(${(s.flags ?? []).map((f) => f.name).join(" ")}) ;;`).join("\n");
   const argArms = COMMAND_SPECS.flatMap(
     (s) => s.args ? [`      ${s.name}) _values '${s.name}' ${s.args.join(" ")} ;;`] : []
   );
@@ -41562,9 +42237,15 @@ ${describe5}
 
   # Flags may follow any command; complete them whenever the current word starts
   # with '-'. Checked BEFORE the positional switch so a command with no arg case
-  # (e.g. \`aka stats --\`) still offers them \u2014 matching the bash script.
+  # (e.g. \`aka stats --\`) still offers them \u2014 matching the bash script. A
+  # command that owns flags of its own adds them here and nowhere else.
   if [[ $words[CURRENT] == -* ]]; then
-    compadd -- ${GLOBAL_FLAGS.join(" ")}
+    local -a _aka_flags
+    _aka_flags=(${GLOBAL_FLAGS.join(" ")})
+    case $words[2] in
+${flagArms}
+    esac
+    compadd -- $_aka_flags
     return
   fi
 
@@ -41590,6 +42271,9 @@ compdef _aka aka
 `;
 }
 function bashScript() {
+  const flagArms = flagSpecs.map(
+    (s) => `      ${s.name}) flags="$flags ${(s.flags ?? []).map((f) => f.name).join(" ")}" ;;`
+  ).join("\n");
   const argArms = COMMAND_SPECS.flatMap(
     (s) => s.args ? [`      ${s.name}) COMPREPLY=( $(compgen -W "${s.args.join(" ")}" -- "$cur") ); return ;;`] : []
   ).join("\n");
@@ -41608,9 +42292,14 @@ _aka() {
   fi
 
   # Flags may follow any command \u2014 checked before the positional switch so every
-  # command offers them (matches the zsh script).
+  # command offers them (matches the zsh script). A command that owns flags of
+  # its own adds them here and nowhere else.
   if [[ "$cur" == -* ]]; then
-    COMPREPLY=( $(compgen -W "${GLOBAL_FLAGS.join(" ")}" -- "$cur") )
+    local flags="${GLOBAL_FLAGS.join(" ")}"
+    case "$cmd" in
+${flagArms}
+    esac
+    COMPREPLY=( $(compgen -W "$flags" -- "$cur") )
     return
   fi
 
@@ -41680,17 +42369,17 @@ function runCompletion(argv) {
 
 // src/commands/dashboard.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { createServer } from "net";
-import { dirname as dirname9, join as join31 } from "path";
+import { dirname as dirname9, join as join33 } from "path";
 import { fileURLToPath as fileURLToPath5, pathToFileURL } from "url";
 import { parseArgs as parseArgs2 } from "util";
 var require3 = createRequire2(import.meta.url);
 var here = dirname9(fileURLToPath5(import.meta.url));
 var BIND_HOST = "127.0.0.1";
 function pkgBase() {
-  return isSea() ? dirname9(process.execPath) : join31(here, "..");
+  return isSea() ? dirname9(process.execPath) : join33(here, "..");
 }
 function isPortFree(port) {
   return new Promise((resolve7) => {
@@ -41744,9 +42433,9 @@ async function runDashboard(argv) {
   refreshUpdateMirror(dataDir());
   const base = pkgBase();
   const bundledServer = [
-    join31(base, "web-ui", "server.js"),
-    join31(base, "web-ui", "web-ui", "server.js")
-  ].find((p) => existsSync15(p));
+    join33(base, "web-ui", "server.js"),
+    join33(base, "web-ui", "web-ui", "server.js")
+  ].find((p) => existsSync16(p));
   if (bundledServer) {
     launchStandalone(bundledServer, port, shouldOpen, url2);
     return;
@@ -41765,7 +42454,7 @@ async function runDashboard(argv) {
     onReadyOpen(child, shouldOpen, url2, `Starting the AKA dashboard at ${url2}
 `);
   };
-  if (existsSync15(join31(webUiDir, ".next", "BUILD_ID"))) {
+  if (existsSync16(join33(webUiDir, ".next", "BUILD_ID"))) {
     startNext();
     return;
   }
@@ -42810,15 +43499,15 @@ async function runException(argv, io = terminalPrompter()) {
 
 // src/commands/extension.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync22, renameSync as renameSync5, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync24, renameSync as renameSync5, writeFileSync as writeFileSync9 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname10, join as join32 } from "path";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname10, join as join34 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 var require4 = createRequire3(import.meta.url);
 var here2 = dirname10(fileURLToPath6(import.meta.url));
 function cliRoot() {
-  return isSea() ? dirname10(process.execPath) : join32(here2, "..");
+  return isSea() ? dirname10(process.execPath) : join34(here2, "..");
 }
 var EXTENSION_IDS = [
   // Derived from the "key" in plugins/browser-extension/manifest.json.
@@ -42835,31 +43524,31 @@ function nativeHostManifest(hostPath) {
   };
 }
 function resolveHostScript(root = cliRoot()) {
-  const bundled = join32(root, "native-host", "host.js");
-  if (existsSync16(bundled)) return bundled;
+  const bundled = join34(root, "native-host", "host.js");
+  if (existsSync17(bundled)) return bundled;
   try {
     const pkgJson = require4.resolve("@akasecurity/plugin-browser-extension/package.json");
-    const devBuilt = join32(dirname10(pkgJson), "native-host", "host.js");
-    if (existsSync16(devBuilt)) return devBuilt;
+    const devBuilt = join34(dirname10(pkgJson), "native-host", "host.js");
+    if (existsSync17(devBuilt)) return devBuilt;
   } catch {
   }
   return null;
 }
 function resolveExtensionDist(root = cliRoot()) {
-  const bundled = join32(root, "extension");
-  if (existsSync16(bundled)) return bundled;
+  const bundled = join34(root, "extension");
+  if (existsSync17(bundled)) return bundled;
   try {
     const pkgJson = require4.resolve("@akasecurity/plugin-browser-extension/package.json");
-    const devDist = join32(dirname10(pkgJson), "dist");
-    if (existsSync16(devDist)) return devDist;
+    const devDist = join34(dirname10(pkgJson), "dist");
+    if (existsSync17(devDist)) return devDist;
   } catch {
   }
   return null;
 }
 function chromeManifestDir(platform3 = process.platform) {
   if (platform3 === "darwin") {
-    return join32(
-      homedir5(),
+    return join34(
+      homedir7(),
       "Library",
       "Application Support",
       "Google",
@@ -42868,9 +43557,9 @@ function chromeManifestDir(platform3 = process.platform) {
     );
   }
   if (platform3 === "win32") {
-    return join32(homedir5(), ".aka", "native-messaging");
+    return join34(homedir7(), ".aka", "native-messaging");
   }
-  return join32(homedir5(), ".config", "google-chrome", "NativeMessagingHosts");
+  return join34(homedir7(), ".config", "google-chrome", "NativeMessagingHosts");
 }
 function resolveNodeForLauncher() {
   if (!isSea()) return process.execPath;
@@ -42884,7 +43573,7 @@ function resolveNodeForLauncher() {
   }
 }
 function launcherPath(manifestDir, platform3) {
-  return join32(
+  return join34(
     manifestDir,
     platform3 === "win32" ? `${NATIVE_HOST_NAME}.cmd` : `${NATIVE_HOST_NAME}.sh`
   );
@@ -42899,11 +43588,11 @@ function writeLauncher(manifestDir, hostScript, nodePath, platform3) {
   const path = launcherPath(manifestDir, platform3);
   const tmp = `${path}.tmp`;
   if (platform3 === "win32") {
-    writeFileSync8(tmp, `@echo off\r
+    writeFileSync9(tmp, `@echo off\r
 ${cmdQuote(nodePath)} ${cmdQuote(hostScript)} %*\r
 `);
   } else {
-    writeFileSync8(tmp, `#!/bin/sh
+    writeFileSync9(tmp, `#!/bin/sh
 exec ${posixQuote(nodePath)} ${posixQuote(hostScript)} "$@"
 `, {
       mode: 493
@@ -42959,11 +43648,11 @@ function runInstall(manifestDir, hostScript = resolveHostScript(), extensionDist
     process.exitCode = 1;
     return;
   }
-  mkdirSync5(manifestDir, { recursive: true });
+  mkdirSync6(manifestDir, { recursive: true });
   const launcher = writeLauncher(manifestDir, hostScript, nodePath, process.platform);
-  const manifestPath = join32(manifestDir, `${NATIVE_HOST_NAME}.json`);
+  const manifestPath = join34(manifestDir, `${NATIVE_HOST_NAME}.json`);
   const tmp = `${manifestPath}.tmp`;
-  writeFileSync8(tmp, `${JSON.stringify(nativeHostManifest(launcher), null, 2)}
+  writeFileSync9(tmp, `${JSON.stringify(nativeHostManifest(launcher), null, 2)}
 `, {
     mode: DATA_FILE_MODE
   });
@@ -42998,7 +43687,7 @@ Next: load the extension in Chrome \u2014
 function manifestFault(manifestPath) {
   let parsed2;
   try {
-    parsed2 = JSON.parse(readFileSync22(manifestPath, "utf8"));
+    parsed2 = JSON.parse(readFileSync24(manifestPath, "utf8"));
   } catch (err) {
     return `could not be read (${err instanceof Error ? err.message : String(err)})`;
   }
@@ -43009,8 +43698,8 @@ function manifestFault(manifestPath) {
   return `does not grant ${missing.length === 1 ? "the extension id" : "the extension ids"} ${missing.join(", ")}`;
 }
 function runStatus2(manifestDir) {
-  const manifestPath = join32(manifestDir, `${NATIVE_HOST_NAME}.json`);
-  if (!existsSync16(manifestPath)) {
+  const manifestPath = join34(manifestDir, `${NATIVE_HOST_NAME}.json`);
+  if (!existsSync17(manifestPath)) {
     process.stdout.write(
       `native-messaging host: not installed
   manifest: ${manifestPath}
@@ -43032,21 +43721,18 @@ function runStatus2(manifestDir) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync18, lstatSync as lstatSync4, readdirSync as readdirSync7, statSync as statSync13 } from "fs";
-import { join as join33 } from "path";
+import { existsSync as existsSync19, lstatSync as lstatSync4, readdirSync as readdirSync7, statSync as statSync13 } from "fs";
+import { join as join35 } from "path";
 import * as readline from "readline/promises";
 import { parseArgs as parseArgs6 } from "util";
 
 // src/commands/plugins.ts
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { parseArgs as parseArgs5 } from "util";
-function runPlugins(argv) {
+function runPlugins(argv, deps = {}) {
   const [sub, ...rest] = argv;
   if (!sub || sub === "list") return listPlugins(rest);
-  if (sub === "install") {
-    installPlugin(rest);
-    return;
-  }
+  if (sub === "install") return installPlugin(rest, deps);
   process.stderr.write(`aka plugins: unknown subcommand '${sub}' (try: list, install <agent>)
 `);
   process.exitCode = 1;
@@ -43055,7 +43741,7 @@ async function listPlugins(argv) {
   const { values } = parseArgs5({ args: argv, options: HOME_OPTION });
   const home = homeBase(values.home);
   const active = /* @__PURE__ */ new Set();
-  if (existsSync17(dbPath(home))) {
+  if (existsSync18(dbPath(home))) {
     const db = openLocalDatabase(dataDir(home));
     try {
       const recent = await db.findings.recentFindings({ limit: 1e3 });
@@ -43079,7 +43765,7 @@ async function listPlugins(argv) {
   out.write("\nInstall:  aka plugins install <agent>\n");
   out.write("Update:   aka update            (or: aka check-updates)\n");
 }
-function installPlugin(argv) {
+async function installPlugin(argv, deps) {
   const { positionals } = parseArgs5({ args: argv, options: HOME_OPTION, allowPositionals: true });
   const id = positionals[0];
   if (!id) {
@@ -43119,6 +43805,27 @@ Then run \`aka init\` to set up the local store.
     );
     return;
   }
+  if (cliBin === "claude") {
+    const version2 = (deps.hostVersion ?? hostCliVersion)(cliBin);
+    const gaps = hostFloorGaps(version2);
+    const required2 = requiredHostVersion(gaps);
+    if (version2 !== void 0 && required2 !== void 0) {
+      const io = deps.prompter ?? terminalPrompter();
+      io.out(
+        `This ${cliBin} is ${version2}, which is older than AKA needs for ${gaps.map((g) => g.label).join(", ")}.
+Those protections will be inactive until you update Claude Code to ${required2} or newer. Everything else AKA does works normally.
+`
+      );
+      if (io.isInteractive && deps.assumeYes !== true) {
+        const answer = (await io.ask("Install anyway? [y/N] ")).trim().toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+          io.out("Not installed. Update Claude Code, then run this again.\n");
+          if (deps.declineIsFailure !== false) process.exitCode = 1;
+          return;
+        }
+      }
+    }
+  }
   const plan = manager3.installSpawnPlan(ref, agent.marketplaceSource, agent.marketplace);
   process.stdout.write(
     `Installing ${agent.name} via ${cliBin}, running:
@@ -43152,7 +43859,7 @@ function storeModeTargets(home) {
     try {
       for (const entry of readdirSync7(dir, { withFileTypes: true })) {
         if (entry.name.endsWith(".partial") && !entry.isDirectory()) continue;
-        targets.add(join33(dir, entry.name));
+        targets.add(join35(dir, entry.name));
       }
     } catch {
     }
@@ -43197,7 +43904,7 @@ function assertStoreLinksResolve(home) {
 }
 function isBrokenLink(path) {
   try {
-    return lstatSync4(path).isSymbolicLink() && !existsSync18(path);
+    return lstatSync4(path).isSymbolicLink() && !existsSync19(path);
   } catch {
     return false;
   }
@@ -43234,12 +43941,12 @@ async function runInit(argv) {
   ensureLayoutDirSync(home);
   const settings = settingsDir(home);
   ensureLayoutDirSync(settings);
-  const settingsFile = join33(settings, "settings.json");
+  const settingsFile = join35(settings, "settings.json");
   let settingsCreated = false;
-  if (!existsSync18(settingsFile)) {
+  if (!existsSync19(settingsFile)) {
     try {
       settingsCreated = withFileLock(settingsFile, () => {
-        if (existsSync18(settingsFile)) return false;
+        if (existsSync19(settingsFile)) return false;
         writeOwnerOnlyFileSync(
           settingsFile,
           `${JSON.stringify(defaultWorkspaceSettings(), null, 2)}
@@ -43268,7 +43975,7 @@ async function runInit(argv) {
   const symlinked = symlinkedStorePaths(home);
   process.stdout.write(
     `\u2713 Initialized AKA at ${home}
-  settings: ${settingsFile}${settingsCreated ? "" : existsSync18(settingsFile) ? " (kept existing)" : " (not written \u2014 another process was writing it)"}
+  settings: ${settingsFile}${settingsCreated ? "" : existsSync19(settingsFile) ? " (kept existing)" : " (not written \u2014 another process was writing it)"}
   database: ${dbPath(home)}
   seeded ${String(policyCount)} default policies, ${String(packCount)} detection pack(s)
 ` + (updatesAvailable > 0 ? `  \u2B06 ${String(updatesAvailable)} detection pack update(s) available \u2014 review with \`aka detections\`, apply with \`aka detections update --all\`
@@ -43305,7 +44012,10 @@ Install the ${PRODUCT_NAME} plugin for Claude Code now (via the marketplace)? [y
       return;
     }
   }
-  await runPlugins(["install", "claude-code"]);
+  await runPlugins(["install", "claude-code"], {
+    assumeYes: autoYes,
+    declineIsFailure: false
+  });
 }
 async function confirm(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -43332,13 +44042,29 @@ function renderEgressLine(egress) {
   const cap = egress.truncated ? ` (capped at ${String(MAX_EGRESS_CALL_SITES_PER_PROJECT)} call sites)` : "";
   return `Data shares: ${String(egress.destinations)} destination(s) \xB7 ${String(egress.endpoints)} endpoint(s) \xB7 ${String(egress.callSites)} call site(s)${cap}`;
 }
-async function runScan(argv) {
+function reportedForward(outcome) {
+  return outcome === null || outcome.status === "not-attached" ? null : outcome;
+}
+function renderForwardLine(outcome) {
+  switch (outcome.status) {
+    case "disabled":
+      return outcome.reason === "opt-out" ? "Data shares: not forwarded (--no-forward)" : "Data shares: not forwarded (Data Shares is off in Settings)";
+    case "no-credential":
+      return `Data shares: not forwarded to ${outcome.endpoint} \u2014 no usable credential; re-attach with \`aka attach\``;
+    case "forwarded":
+      return `Data shares: forwarded to ${outcome.endpoint} \xB7 ${String(outcome.callSites)} call site(s)`;
+    case "failed":
+      return `Data shares: not forwarded to ${outcome.endpoint} \u2014 ${FORWARD_FAILURE_LINES[outcome.kind]}`;
+  }
+}
+async function runScan(argv, deps = {}) {
   const { values, positionals } = parseArgs7({
     args: argv,
     options: {
       ...HOME_OPTION,
       format: { type: "string" },
-      "fail-on": { type: "string" }
+      "fail-on": { type: "string" },
+      "no-forward": { type: "boolean" }
     },
     allowPositionals: true
   });
@@ -43383,14 +44109,39 @@ async function runScan(argv) {
     result = await scanPathIntoStore(db, target, {
       ruleActions,
       sourceTool: SOURCE_TOOL.Cli,
-      dataDir: storeDir
+      dataDir: storeDir,
+      // The AKA home this invocation is actually using, so the scanner's
+      // protected-path exclusion covers a `--home` store rather than the
+      // literal `~/.aka` the default would name. `home` is the same base
+      // `recordProjectEgress` takes below, for the same reason.
+      akaHome: home
     });
     inventory = recordProjectInventory(db, target);
     egress = recordProjectEgress(db, target, result.egress, home);
+  } catch (err) {
+    if (!isProtectedTarget(err)) throw err;
+    process.stderr.write(`aka scan: ${err.message}
+`);
+    process.exitCode = 1;
+    return;
   } finally {
     db.close();
   }
+  const recorded = egress;
+  const runForward = async () => {
+    if (recorded === null) return null;
+    try {
+      return await forwardProjectEgress(home, recorded.input, {
+        send: deps.send ?? createSharesSender(),
+        enabled: values["no-forward"] !== true
+      });
+    } catch {
+      process.stderr.write("aka scan: forward failed unexpectedly\n");
+      return null;
+    }
+  };
   if (format === "json") {
+    const forward = await runForward();
     const findings = result.files.flatMap(
       (f) => f.findings.map((d) => ({
         file: f.path,
@@ -43416,9 +44167,17 @@ async function runScan(argv) {
       callSites: egress.callSites,
       truncated: egress.truncated
     } : null;
+    const forwardJson = reportedForward(forward);
     process.stdout.write(
       `${JSON.stringify(
-        { target, scanned: result.scanned, findings, inventory: inventoryJson, egress: egressJson },
+        {
+          target,
+          scanned: result.scanned,
+          findings,
+          inventory: inventoryJson,
+          egress: egressJson,
+          forward: forwardJson
+        },
         null,
         2
       )}
@@ -43432,6 +44191,9 @@ async function runScan(argv) {
     if (inventory) process.stdout.write(`${renderInventoryLine(inventory)}
 `);
     if (egress) process.stdout.write(`${renderEgressLine(egress)}
+`);
+    const reported = reportedForward(await runForward());
+    if (reported !== null) process.stdout.write(`${renderForwardLine(reported)}
 `);
   }
   if (failOn !== void 0) {
@@ -43635,8 +44397,9 @@ function grant(io, exit, base, settings) {
     exit(1);
     return false;
   }
+  const grantedAt = Date.now();
   const consent = {
-    acknowledgedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    acknowledgedAt: new Date(grantedAt).toISOString(),
     payloadVersion: HISTORY_SYNC_PAYLOAD_VERSION,
     endpoint: settings.controlPlane.endpoint
   };
@@ -43647,14 +44410,15 @@ function grant(io, exit, base, settings) {
     exit(1);
     return false;
   }
+  seedCaptureBacklogOwed(dataDir(base), grantedAt);
   io.out(
     `Sending this machine's unsent activity to ${controlPlaneName(settings.controlPlane)}.
-That is the activity recorded before it attached, and anything a live send could not
-deliver \u2014 which for a captured prompt, reply or tool result includes its text. A value
-in that text is masked only where the policy assigned to the detection that flagged it
-is redact or block; under monitor or warn it goes as it was seen, and every detection
-ships on monitor. It goes in the background, a little at a time, starting with your
-next session. Anything already sent cannot be recalled.
+That is the activity recorded before it attached and anything a live send could not
+deliver, alike: for a captured prompt, reply or tool result, either one includes its
+text. A value in that text is masked only where the policy assigned to the detection
+that flagged it is redact or block; under monitor or warn it goes as it was seen, and
+every detection ships on monitor. It goes in the background, a little at a time,
+starting with your next session. Anything already sent cannot be recalled.
 `
   );
   return true;
@@ -43685,9 +44449,10 @@ function describe4(settings) {
 Run \`aka sync-history --on\` to send it.`;
   }
   return isHistorySyncConsentStale(settings.historySyncConsent, settings.controlPlane.endpoint) ? `Not sending this machine's unsent activity to ${where}: your grant predates a change.
-It now also covers the text of captured prompts, replies and tool results that no
-live send delivered, in which a value is masked only where the detection that
-flagged it is set to redact or block \u2014 and every detection ships on monitor.
+It now also covers the text of the activity recorded before this machine attached \u2014
+not just what a live send failed to deliver afterward \u2014 in which a value is masked
+only where the detection that flagged it is set to redact or block, and every
+detection ships on monitor.
 Run \`aka sync-history --on\` to grant it again.` : `Not sending this machine's unsent activity to ${where}: the earlier grant no longer
 applies. Run \`aka sync-history --on\` to grant it again.`;
 }
@@ -44150,71 +44915,6 @@ function Dashboard({
   ] });
 }
 
-// ../packages/dashboard-ui/src/security/recommendations.ts
-var SEVERITY_WEIGHT = { critical: 4, high: 3, medium: 2, low: 1 };
-var ADVICE = {
-  secret: "Rotate the exposed credentials and move them out of prompts (secrets manager / env vars).",
-  pii: "Remove or mask personal data before it reaches the model.",
-  financial: "Strip card and account numbers; share only non-sensitive references.",
-  phi: "Remove protected health information \u2014 it should never reach an external model.",
-  code_context: "Confirm this proprietary code context is safe to share.",
-  custom: "Review against your organization\u2019s custom policy."
-};
-var REC_TEMPLATE = {
-  secret: { title: "Exposed secret detected", action: "Rotate" },
-  pii: { title: "Personal data in a prompt", action: "Remove" },
-  financial: { title: "Financial data detected", action: "Strip" },
-  phi: { title: "Health information detected", action: "Remove" },
-  code_context: { title: "Proprietary code shared", action: "Review" },
-  custom: { title: "Custom policy match", action: "Review" }
-};
-var MAX_RECOMMENDATIONS = 10;
-function healthScore(summary) {
-  const handled = summary.byAction.block + summary.byAction.redact + summary.byAction.warn;
-  const handledRatio = summary.findings === 0 ? 1 : handled / summary.findings;
-  return Math.round(100 * (0.6 * summary.coverage + 0.4 * handledRatio));
-}
-function findingStatus(summary) {
-  return {
-    score: healthScore(summary),
-    unreviewed: { ...summary.bySeverity },
-    openFindings: summary.findings
-  };
-}
-function bucketize(findings) {
-  const buckets = /* @__PURE__ */ new Map();
-  for (const f of findings) {
-    const b = buckets.get(f.category) ?? {
-      category: f.category,
-      count: 0,
-      severity: f.severity,
-      weight: 0,
-      ruleId: f.ruleId
-    };
-    b.count++;
-    const w = SEVERITY_WEIGHT[f.severity] ?? 0;
-    if (w > b.weight) {
-      b.weight = w;
-      b.severity = f.severity;
-      b.ruleId = f.ruleId;
-    }
-    buckets.set(f.category, b);
-  }
-  return [...buckets.values()].sort((a, b) => b.weight - a.weight || b.count - a.count).slice(0, MAX_RECOMMENDATIONS);
-}
-function buildRecommendations(findings) {
-  return bucketize(findings).map((b) => {
-    const t = REC_TEMPLATE[b.category] ?? { title: `${b.category} finding`, action: "Review" };
-    return {
-      severity: b.severity,
-      title: t.title,
-      description: ADVICE[b.category] ?? "Review this finding against your policy.",
-      context: `${b.ruleId} \xB7 ${String(b.count)} finding${b.count === 1 ? "" : "s"}`,
-      action: t.action
-    };
-  });
-}
-
 // src/tui/report.ts
 var WEEKDAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
 function weekday(isoDay2) {
@@ -44470,30 +45170,30 @@ import { parseArgs as parseArgs12 } from "util";
 import {
   lstatSync as lstatSync5,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync23,
-  realpathSync as realpathSync5,
+  readFileSync as readFileSync25,
+  realpathSync as realpathSync6,
   renameSync as renameSync6,
-  rmSync as rmSync8,
+  rmSync as rmSync9,
   statSync as statSync15,
-  writeFileSync as writeFileSync9
+  writeFileSync as writeFileSync10
 } from "fs";
-import { homedir as homedir6 } from "os";
-import { basename as basename7, dirname as dirname12, isAbsolute as isAbsolute2, join as join34, relative as relative2, resolve as resolve6 } from "path";
+import { homedir as homedir8 } from "os";
+import { basename as basename7, dirname as dirname12, isAbsolute as isAbsolute2, join as join36, relative as relative2, resolve as resolve6 } from "path";
 var DEFAULT_MAX_REWRITE_BYTES = 32 * 1024 * 1024;
 function transcriptRoots(userHome) {
-  return [join34(userHome ?? homedir6(), ".claude", "projects")];
+  return [join36(userHome ?? homedir8(), ".claude", "projects")];
 }
 function readContainedFile(realPath, maxBytes = DEFAULT_MAX_REWRITE_BYTES) {
   try {
     if (statSync15(realPath).size > maxBytes) return null;
-    return readFileSync23(realPath, "utf8");
+    return readFileSync25(realPath, "utf8");
   } catch {
     return null;
   }
 }
 function realPathOrNull(path) {
   try {
-    return realpathSync5(path);
+    return realpathSync6(path);
   } catch {
     return null;
   }
@@ -44537,9 +45237,9 @@ function sweepStrandedTemps(realPath) {
     const pid = Number(pidPart);
     if (pid !== process.pid && isProcessAlive(pid)) continue;
     try {
-      const stranded = join34(dir, name);
+      const stranded = join36(dir, name);
       if (!lstatSync5(stranded).isFile()) continue;
-      rmSync8(stranded, { force: true });
+      rmSync9(stranded, { force: true });
     } catch {
     }
   }
@@ -44551,7 +45251,7 @@ async function rewriteContainedFile(realPath, transform2, maxBytes = DEFAULT_MAX
     before = statSync15(realPath);
     if (before.size > maxBytes)
       return { status: "aborted", reason: "file is larger than the read cap" };
-    content = readFileSync23(realPath, "utf8");
+    content = readFileSync25(realPath, "utf8");
   } catch {
     return { status: "aborted", reason: "unreadable" };
   }
@@ -44566,16 +45266,16 @@ async function rewriteContainedFile(realPath, transform2, maxBytes = DEFAULT_MAX
   if (result.text === content) return { status: "unchanged" };
   const tmpPath = tempPathFor(realPath);
   try {
-    writeFileSync9(tmpPath, result.text, { mode: before.mode & 511, flag: "wx" });
+    writeFileSync10(tmpPath, result.text, { mode: before.mode & 511, flag: "wx" });
     const now = statSync15(realPath);
     if (now.size !== before.size || now.mtimeMs !== before.mtimeMs) {
-      rmSync8(tmpPath, { force: true, recursive: true });
+      rmSync9(tmpPath, { force: true, recursive: true });
       return { status: "aborted", reason: "the file changed while it was being read" };
     }
     renameSync6(tmpPath, realPath);
   } catch {
     try {
-      rmSync8(tmpPath, { force: true, recursive: true });
+      rmSync9(tmpPath, { force: true, recursive: true });
     } catch {
     }
     return { status: "aborted", reason: "the rewrite could not be written" };