@akasecurity/cli 0.9.10 → 0.9.11

package/native-host/host.js

@@ -494,9 +494,6 @@ var require_ignore = __commonJS({
 // src/native-host/host.ts
 import { homedir as homedir3 } from "os";
 
-// ../../packages/plugin-runtime/src/attached/egress-wire.ts
-import { createHash as createHash4 } from "crypto";
-
 // ../../packages/persistence/src/attached-derived.ts
 import { rmSync } from "fs";
 import { join } from "path";
@@ -20748,13 +20745,11 @@ var FindingGroup = external_exports.object({
   latestDetectedAt: external_exports.iso.datetime(),
   instances: external_exports.array(FindingInstance),
   // Derived from instances' statuses with open-dominates precedence (see
-  // buildFindingGroups). Undefined only when no instance carries a status.
+  // foldGroupStatus). Undefined only when no instance carries a status.
   status: FindingStatus.optional(),
-  // The distinct people across the WHOLE group, not just the `instances`
-  // preview — from the store's whole-group aggregate when it supplies one,
-  // else folded from the rows (see buildFindingGroups). Undefined when no
-  // instance carries a user, or when the store supplied whole-group folds
-  // without one.
+  // The distinct people across the WHOLE group, not just the instances
+  // carried here. Undefined when no instance carries a user, or when the
+  // store supplied whole-group folds without one.
   users: external_exports.array(FindingUser).optional()
 }).meta({ id: "FindingGroup" });
 var FindingStats = external_exports.object({
@@ -20783,21 +20778,31 @@ var FindingFacets = external_exports.object({
   // counted under no value.
   status: external_exports.array(FindingFacetItem),
   // Host tool (attributes.tool_name). Present only on the instance-level
-  // reads, which can filter by it; the grouped read omits the dimension
+  // reads, which can filter by it; the type-level read omits the dimension
   // because a group spans tools.
   tool: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
-var DEFAULT_GROUPED_FINDINGS_LIMIT = 50;
-var ListGroupedFindingsQuery = external_exports.object({
+var FindingTypeSummary = FindingGroup.omit({ instances: true, match: true }).meta({
+  id: "FindingTypeSummary"
+});
+var DEFAULT_FINDING_TYPES_LIMIT = 50;
+var MAX_FINDING_TYPES_LIMIT = 100;
+var ListFindingTypesQuery = external_exports.object({
   // NOTE: severity filters by Severity (critical/high/medium/low), not by
-  // FindingAction.
+  // FindingAction. It narrows TYPES: a type's severity is the one its newest
+  // firing version carries, and this list pages types.
+  //
+  // That is NOT a claim the findings of a type share it. A rule can hold several
+  // definition versions at different severities, so a type kept by this filter
+  // can hold findings that individually do not match — see totals.findings on
+  // ListFindingTypesResponse, which counts them all.
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
-  // Matches a group's DERIVED status (see FindingGroup.status), not its
-  // individual instances' — so a filtered group's Status column always reads
-  // one of the requested values.
+  // Matches a type's DERIVED status (see FindingGroup.status), not its
+  // individual findings' — so a filtered row's status always reads one of the
+  // requested values.
   status: external_exports.array(FindingStatus).optional(),
   q: external_exports.string().optional(),
   // Scope to findings whose event carries this session id (the Activity page's
@@ -20807,23 +20812,37 @@ var ListGroupedFindingsQuery = external_exports.object({
   // from a time-scoped page (Activity's range) can carry that scope. Absent
   // means all time — this list has no default window.
   from: external_exports.iso.datetime().optional(),
-  // A group or instance id that must appear in the page even when the cursor
-  // has already advanced past its sort position. This is what keeps the
-  // Findings page's one-shot ?finding= deep link resolving once the list
-  // paginates: the target group is appended out of sort order rather than
-  // scanning forward for it. Never affects totals, facets or the cursor.
+  // A RULE id that must appear in the page even when the cursor has already
+  // advanced past its sort position. This is what keeps the selected type
+  // visible in the list once it paginates: the target is appended out of sort
+  // order rather than scanned forward for. Never affects totals, facets or the
+  // cursor. Unlike the grouped read this replaces, it names a rule only — an
+  // instance id is resolved by `findingInstance`, which is a primary-key seek
+  // and so is not bounded by what any page happens to hold.
   includeId: external_exports.string().optional(),
-  groupBy: external_exports.literal("type").optional(),
-  limit: external_exports.coerce.number().int().min(1).max(100).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_TYPES_LIMIT).optional(),
   cursor: external_exports.string().optional()
 });
-var ListGroupedFindingsResponse = external_exports.object({
+var ListFindingTypesResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings belonging to the matching TYPES — not findings that each match
+    // the filters. The filters here select types, so a type that survives
+    // contributes its whole instanceCount.
+    //
+    // `status` is the one exception, narrowed per finding via
+    // countInstancesByStatus. `severity`, `provider` and `action` are not, so
+    // this can exceed what the instance read reports for the same filters: a
+    // rule whose severity moved between versions is kept on its newest and
+    // still counts its older findings. Narrowing the other three needs
+    // per-dimension counts the aggregate does not carry today.
     findings: external_exports.number().int().nonnegative(),
-    groups: external_exports.number().int().nonnegative()
+    // Counts TYPES, which is the unit this read pages. The instance read's
+    // own totals count findings; the two deliberately answer different
+    // questions and are never summed.
+    types: external_exports.number().int().nonnegative()
   }),
   facets: FindingFacets,
-  items: external_exports.array(FindingGroup),
+  items: external_exports.array(FindingTypeSummary),
   nextCursor: external_exports.string().nullable(),
   // Present only on session-scoped queries (`sessionId` set): per ruleId, how
   // many times that rule fired in the session's persisted transcript. Findings
@@ -20831,7 +20850,7 @@ var ListGroupedFindingsResponse = external_exports.object({
   // every firing, so the two numbers legitimately differ — this map lets a
   // session-scoped view show both.
   sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
-}).meta({ id: "ListGroupedFindingsResponse" });
+}).meta({ id: "ListFindingTypesResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
   // it, so it is excluded from the request contract. The mapping helper
@@ -20861,12 +20880,13 @@ var DEFAULT_FLAT_FINDINGS_LIMIT = 50;
 var MAX_FLAT_FINDINGS_LIMIT = 200;
 var ListFindingInstancesQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
-  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  // Rule ids, the same vocabulary the types list's `subtype` carries. Pinning
+  // ONE of them is how the master/detail view scopes its right-hand panel.
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   // Matches each instance's OWN derived status (deriveFindingStatus), unlike
-  // the grouped query's group-level fold.
+  // the types query's type-level fold.
   status: external_exports.array(FindingStatus).optional(),
   // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
   // where the free-text `q` can only match the rendered "via Bash" label.
@@ -20883,37 +20903,47 @@ var ListFindingInstancesQuery = external_exports.object({
 });
 var ListFindingInstancesResponse = external_exports.object({
   // Instances matching the filters across the whole scope, not just this
-  // page — cursor-independent, like the grouped list's totals.
+  // page — cursor-independent, like the types list's totals.
   totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
-  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // Counts in INSTANCES here, where the types response counts types. Each
   // dimension still excludes its own filter.
   facets: FindingFacets,
   items: external_exports.array(FindingInstanceDetail),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingInstancesResponse" });
-var FindingLocationFile = external_exports.object({
-  // Empty when the instances carried no file path (a prompt or a tool call
-  // with no file attribution).
-  file: external_exports.string(),
-  instanceCount: external_exports.number().int().nonnegative(),
-  maxSeverity: Severity,
-  latestDetectedAt: external_exports.iso.datetime(),
-  // Folded from the instances' derived statuses with the same
-  // open-dominates precedence a group uses.
-  status: FindingStatus.optional(),
-  // Distinct rules seen at this location, capped — the row shows them as
-  // chips, and the count is what conveys scale.
-  ruleIds: external_exports.array(external_exports.string())
-}).meta({ id: "FindingLocationFile" });
-var FindingLocationRepo = external_exports.object({
+var FindingLocationSummary = external_exports.object({
+  // Opaque, stable, minted from the pair by encodeLocationId. It exists
+  // because a location's identity is two values and a URL param carries one:
+  // `?loc=` names a location the way `?rule=` names a type. Only ever compared
+  // for EQUALITY — the page's selection check, this read's `includeId`, the
+  // client's page dedupe — never decoded, and never a sort key.
+  id: external_exports.string(),
   /** Empty when the instances carried no repo attribute. */
   repo: external_exports.string(),
+  // Empty when the instances carried no file path (a prompt, or a tool call
+  // with no file attribution). Both halves empty is a real location — usually
+  // the largest one in a store — and is selectable like any other.
+  file: external_exports.string(),
   instanceCount: external_exports.number().int().nonnegative(),
+  // The WORST severity present, not the first row's. It is this list's primary
+  // sort key, so it is also what explains why a row is where it is, and it is
+  // how a reader decides what to open without opening everything.
   maxSeverity: Severity,
   latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same open-dominates
+  // precedence a group uses, so it answers "is anything left to do here" and
+  // not much more: a location holding 1 open among 40 resolved reads like one
+  // holding 40 open. That loss is accepted — the panel beside this list
+  // carries each finding's own status, and instanceCount sits next to the
+  // badge.
   status: FindingStatus.optional(),
-  files: external_exports.array(FindingLocationFile)
-}).meta({ id: "FindingLocationRepo" });
+  // Every distinct rule seen at this location, UNCAPPED — so the length is a
+  // tally rather than a sample and a row can say how many there are. Bounded
+  // by the ruleset, not by the store. The view bounds what it DISPLAYS.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationSummary" });
+var DEFAULT_FINDING_LOCATIONS_LIMIT = 50;
+var MAX_FINDING_LOCATIONS_LIMIT = 100;
 var ListFindingLocationsQuery = external_exports.object({
   severity: external_exports.array(Severity).optional(),
   subtype: external_exports.array(external_exports.string()).optional(),
@@ -20926,18 +20956,42 @@ var ListFindingLocationsQuery = external_exports.object({
   q: external_exports.string().optional(),
   sessionId: external_exports.string().optional(),
   from: external_exports.iso.datetime().optional(),
-  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+  // A LOCATION id (see FindingLocationSummary.id) that must appear in the page
+  // even when the cursor has already advanced past its sort position — the
+  // counterpart of ListFindingTypesQuery.includeId, and needed far more often
+  // here. Selecting a row pushes the URL, which re-renders the server and resets
+  // the client's page cache to page 0; with distinct (repo, file) pairs running
+  // into the thousands, a selection sitting off page 0 is the ordinary case
+  // rather than a deep-link corner. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_FINDING_LOCATIONS_LIMIT).optional(),
+  cursor: external_exports.string().optional()
 });
 var ListFindingLocationsResponse = external_exports.object({
   totals: external_exports.object({
+    // Findings matching the filters across the whole scope. Unlike the types
+    // read's same-named field this needs no caveat: the filters here narrow
+    // per finding, so this is the sum of every row's instanceCount.
     findings: external_exports.number().int().nonnegative(),
-    repos: external_exports.number().int().nonnegative(),
-    files: external_exports.number().int().nonnegative()
+    // Counts LOCATIONS, the unit this read pages — the number the paginator
+    // states. The facets beside it count FINDINGS (see below); a surface
+    // showing both says which is which.
+    locations: external_exports.number().int().nonnegative()
   }),
-  /** Sorted by max severity, then most recent. */
-  items: external_exports.array(FindingLocationRepo),
-  /** Whether `limit` truncated the repo list. */
-  hasMore: external_exports.boolean()
+  // Counts in FINDINGS, where the types response counts types, each dimension
+  // still excluding its own filter. Deliberately not locations: counting those
+  // needs a set of location keys per dimension per value — memory tracking the
+  // store times the vocabulary, in a read whose scan promises flat memory —
+  // and the cheap per-location version is not an approximation but WRONG. A
+  // location holding {claudecode, block} and {codex, warn} would survive
+  // provider=claudecode AND action=warn, under which no single finding
+  // matches, so the facet would contradict the instanceCount this whole view
+  // rests on. Findings also keep the toolbar in the same unit as the page
+  // tally and the panel it sits above.
+  facets: FindingFacets,
+  /** Sorted by max severity, then most recent, then (repo, file). */
+  items: external_exports.array(FindingLocationSummary),
+  nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListFindingLocationsResponse" });
 
 // ../../packages/schema/src/zod/meta.ts
@@ -22220,6 +22274,14 @@ var ControlPlaneErrorBody = external_exports.object({
     message: external_exports.string().optional()
   }).optional()
 });
+var RemoteFailureKind = external_exports.enum([
+  "unauthorized",
+  "forbidden",
+  "route-absent",
+  "invalid-request",
+  "rejected",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -22913,139 +22975,62 @@ function deriveFindingStatus(row) {
   if (row.latestResolutionStatus === "dismissed") return "dismissed";
   return "open";
 }
-function distinctUsers(instances) {
-  const seen = /* @__PURE__ */ new Set();
-  const users = [];
-  for (const i of instances) {
-    if (i.user === void 0 || seen.has(i.user.id)) continue;
-    seen.add(i.user.id);
-    users.push(i.user);
-  }
-  return users;
-}
 function sortUsers(users) {
   return [...users].sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id));
 }
-function buildFindingGroups(rows, opts = {}) {
-  const overrides = opts.overrides;
+function buildFindingTypes(aggregates, opts = {}) {
   const packNames = opts.packNames;
-  const aggregates = opts.aggregates;
-  const byRuleId = /* @__PURE__ */ new Map();
-  for (const row of rows) {
-    const existing = byRuleId.get(row.ruleId);
-    if (existing) existing.push(row);
-    else byRuleId.set(row.ruleId, [row]);
-  }
-  const groups = [];
-  for (const [ruleId, ruleRows] of byRuleId) {
-    const instances = ruleRows.map((r) => {
-      const effectiveDbAction = overrides?.get(r.id) ?? r.actionTaken;
-      return {
-        id: r.id,
-        provider: toApiProvider(r.sourceTool),
-        repo: r.repo,
-        file: r.file,
-        ...r.toolName === void 0 ? {} : { toolName: r.toolName },
-        ...r.eventId === void 0 ? {} : { eventId: r.eventId },
-        ...r.sessionId === void 0 ? {} : { sessionId: r.sessionId },
-        ...r.user === void 0 ? {} : { user: r.user },
-        action: toApiAction(effectiveDbAction),
-        detectedAt: r.occurredAt,
-        confidence: r.confidence,
-        status: r.status
-      };
-    });
-    const agg = aggregates?.get(ruleId);
-    const users = agg ? sortUsers(agg.users ?? []) : distinctUsers(instances);
-    const latestDetectedAt = agg?.latestDetectedAt ?? ruleRows.reduce(
-      (max, r) => r.occurredAt > max ? r.occurredAt : max,
-      ruleRows[0]?.occurredAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
-    );
-    const seenProviders = /* @__PURE__ */ new Set();
-    const providers = (agg ? [...new Set(agg.sourceTools.map(toApiProvider))].sort() : instances.map((i) => i.provider)).filter((p) => {
-      if (seenProviders.has(p)) return false;
-      seenProviders.add(p);
-      return true;
-    });
-    const actionSet = new Set(
-      agg ? agg.actionsTaken.map(toApiAction) : instances.map((i) => i.action)
-    );
+  const types = [];
+  for (const [ruleId, agg] of aggregates) {
+    const users = sortUsers(agg.users ?? []);
+    const providers = [...new Set(agg.sourceTools.map(toApiProvider))].sort();
+    const actionSet = new Set(agg.actionsTaken.map(toApiAction));
     const aggregateAction = actionSet.size === 1 ? [...actionSet][0] ?? null : null;
-    const severity = ruleRows[0]?.severity ?? "low";
-    const detection = {
-      id: ruleId,
-      name: packNames?.get(ruleId) ?? null
-    };
-    const apiCategory = toApiCategory(ruleRows[0]?.category ?? "custom");
-    const policy = { id: `category:${apiCategory}`, name: apiCategory };
-    const match = {
-      maskedValue: ruleRows[0]?.maskedMatch ?? "",
-      contextPrefix: ""
-      // empty (pending privacy review)
-    };
-    const status = foldGroupStatus(
-      agg ? agg.statusInputs.map(deriveFindingStatus) : instances.map((i) => i.status)
-    );
-    const group = {
+    const apiCategory = toApiCategory(agg.category ?? "custom");
+    const type = {
       id: ruleId,
       category: apiCategory,
       subtype: ruleId,
       // human label comes with pack metadata later
-      severity,
-      match,
-      detection,
-      policy,
-      instanceCount: agg?.instanceCount ?? instances.length,
+      severity: agg.severity ?? "low",
+      detection: { id: ruleId, name: packNames?.get(ruleId) ?? null },
+      policy: { id: `category:${apiCategory}`, name: apiCategory },
+      instanceCount: agg.instanceCount,
       providers,
       aggregateAction,
-      latestDetectedAt,
-      instances,
-      status,
+      latestDetectedAt: agg.latestDetectedAt,
+      status: foldGroupStatus(agg.statusInputs.map(deriveFindingStatus)),
       ...users.length > 0 ? { users } : {}
     };
-    if (agg) {
-      actionsCache.set(group, [...actionSet]);
-      if (agg.searchText !== void 0) {
-        haystackCache.set(group, buildHaystack(group, agg.searchText));
-      }
+    actionsCache.set(type, [...actionSet]);
+    if (agg.searchText !== void 0) {
+      haystackCache.set(type, buildHaystack(type, agg.searchText));
     }
-    groups.push(group);
+    types.push(type);
   }
-  return groups;
+  return types;
 }
 var haystackCache = /* @__PURE__ */ new WeakMap();
-function buildHaystack(g, extra) {
+function buildHaystack(t, extra) {
   return [
-    g.subtype,
-    g.category,
-    g.match.maskedValue,
-    g.policy.name,
-    g.id,
-    ...g.instances.map((i) => i.repo),
-    ...g.instances.map((i) => i.file),
-    ...g.instances.map((i) => i.toolName ? `via ${i.toolName}` : ""),
-    ...g.instances.map((i) => i.id),
-    // The people: the whole group's list when the store folded one, plus the
-    // preview's own — the two overlap, and a haystack does not mind.
-    ...(g.users ?? []).map((u) => u.name),
-    ...g.instances.map((i) => i.user?.name ?? ""),
+    t.subtype,
+    t.category,
+    t.policy.name,
+    t.id,
+    ...(t.users ?? []).map((u) => u.name),
     ...extra === void 0 ? [] : [extra]
   ].join(" ").toLowerCase();
 }
-function groupHaystack(g) {
-  const cached2 = haystackCache.get(g);
+function typeHaystack(t) {
+  const cached2 = haystackCache.get(t);
   if (cached2 !== void 0) return cached2;
-  const haystack = buildHaystack(g);
-  haystackCache.set(g, haystack);
+  const haystack = buildHaystack(t);
+  haystackCache.set(t, haystack);
   return haystack;
 }
 var actionsCache = /* @__PURE__ */ new WeakMap();
-function groupActions(g) {
-  const cached2 = actionsCache.get(g);
-  if (cached2 !== void 0) return cached2;
-  const actions = [...new Set(g.instances.map((i) => i.action))];
-  actionsCache.set(g, actions);
-  return actions;
+function typeActions(t) {
+  return actionsCache.get(t) ?? [];
 }
 function countInstancesByStatus(statusInputs, statuses) {
   const statusSet = new Set(statuses);
@@ -23056,8 +23041,8 @@ function countInstancesByStatus(statusInputs, statuses) {
   }
   return sum;
 }
-function applyFindingFilters(groups, opts) {
-  let filtered = groups;
+function applyFindingFilters(types, opts) {
+  let filtered = types;
   if (opts.severity && opts.severity.length > 0) {
     const sevSet = new Set(opts.severity);
     filtered = filtered.filter((g) => sevSet.has(g.severity));
@@ -23068,7 +23053,7 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.actions && opts.actions.length > 0) {
     const actionSet = new Set(opts.actions);
-    filtered = filtered.filter((g) => groupActions(g).some((a) => actionSet.has(a)));
+    filtered = filtered.filter((t) => typeActions(t).some((a) => actionSet.has(a)));
   }
   if (opts.subtype && opts.subtype.length > 0) {
     const subtypeSet = new Set(opts.subtype);
@@ -23080,7 +23065,7 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.q) {
     const q = opts.q.toLowerCase();
-    filtered = filtered.filter((g) => groupHaystack(g).includes(q));
+    filtered = filtered.filter((t) => typeHaystack(t).includes(q));
   }
   return filtered;
 }
@@ -23095,11 +23080,11 @@ function compareFindingGroupOrder(a, b) {
   if (recencyDiff !== 0) return recencyDiff;
   return a.id.localeCompare(b.id);
 }
-function sortFindingGroups(groups) {
-  return [...groups].sort(compareFindingGroupOrder);
+function sortFindingTypes(types) {
+  return [...types].sort(compareFindingGroupOrder);
 }
-function computeFindingFacets(allGroups, opts) {
-  const forSeverity = applyFindingFilters(allGroups, {
+function computeFindingFacets(allTypes, opts) {
+  const forSeverity = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     statuses: opts.statuses,
@@ -23110,7 +23095,7 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forSeverity) {
     severityMap.set(g.severity, (severityMap.get(g.severity) ?? 0) + 1);
   }
-  const forProvider = applyFindingFilters(allGroups, {
+  const forProvider = applyFindingFilters(allTypes, {
     actions: opts.actions,
     statuses: opts.statuses,
     q: opts.q,
@@ -23121,7 +23106,7 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forProvider) {
     for (const p of g.providers) providerMap.set(p, (providerMap.get(p) ?? 0) + 1);
   }
-  const forAction = applyFindingFilters(allGroups, {
+  const forAction = applyFindingFilters(allTypes, {
     providers: opts.providers,
     statuses: opts.statuses,
     q: opts.q,
@@ -23130,9 +23115,9 @@ function computeFindingFacets(allGroups, opts) {
   });
   const actionMap = /* @__PURE__ */ new Map();
   for (const g of forAction) {
-    for (const a of groupActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
+    for (const a of typeActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
   }
-  const forSubtype = applyFindingFilters(allGroups, {
+  const forSubtype = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     statuses: opts.statuses,
@@ -23141,7 +23126,7 @@ function computeFindingFacets(allGroups, opts) {
   });
   const subtypeMap = /* @__PURE__ */ new Map();
   for (const g of forSubtype) subtypeMap.set(g.subtype, (subtypeMap.get(g.subtype) ?? 0) + 1);
-  const forStatus = applyFindingFilters(allGroups, {
+  const forStatus = applyFindingFilters(allTypes, {
     providers: opts.providers,
     actions: opts.actions,
     q: opts.q,
@@ -23189,10 +23174,20 @@ function matchesDimension(row, opts, dimension) {
       return !opts.statuses?.length || row.status !== void 0 && opts.statuses.includes(row.status);
     case "tools":
       return !opts.tools?.length || row.toolName !== void 0 && opts.tools.includes(row.toolName);
+    // An EMPTY value is a real filter here, not an absent one. The location
+    // list buckets a finding whose event recorded no repo — or no file — under
+    // the empty string, and selecting that bucket has to narrow the panel to
+    // exactly it. Only `undefined` means "no filter"; a caller that wants every
+    // row omits the key, which every call site already does.
+    //
+    // Reading '' as unset is what this replaced, and it failed in the one place
+    // it mattered: the no-repo/no-file bucket is often the largest in a real
+    // store, and its panel dropped both predicates and returned the WHOLE scope
+    // — a row reading 3 findings beside a panel listing every finding there is.
     case "repo":
-      return opts.repo === void 0 || opts.repo === "" || row.repo === opts.repo;
+      return opts.repo === void 0 || row.repo === opts.repo;
     case "file":
-      return opts.file === void 0 || opts.file === "" || row.file === opts.file;
+      return opts.file === void 0 || row.file === opts.file;
     case "q":
       return !opts.q || rowHaystack(row).includes(opts.q.toLowerCase());
   }
@@ -23306,6 +23301,23 @@ function addToLocation(acc, row) {
   acc.statuses.push(row.status);
   acc.ruleIds.add(row.ruleId);
 }
+function compareLocationOrder(a, b) {
+  const rankA = SEVERITY_ORDER2[a.maxSeverity] ?? -1;
+  const rankB = SEVERITY_ORDER2[b.maxSeverity] ?? -1;
+  if (rankA !== rankB) return rankA - rankB;
+  if (a.latestDetectedAt !== b.latestDetectedAt) {
+    return a.latestDetectedAt < b.latestDetectedAt ? 1 : -1;
+  }
+  if (a.repo !== b.repo) return a.repo < b.repo ? -1 : 1;
+  if (a.file !== b.file) return a.file < b.file ? -1 : 1;
+  return 0;
+}
+function encodeLocationId(repo, file2) {
+  return `${encodePart(repo)}/${encodePart(file2)}`;
+}
+function encodePart(value) {
+  return encodeURIComponent(value.replace(/[\uD800-\uDFFF]/gu, "\uFFFD"));
+}
 
 // ../../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
@@ -23751,7 +23763,7 @@ var VaultConsent = external_exports.object({
 // ../../packages/schema/src/zod/local.ts
 var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
-var HISTORY_SYNC_PAYLOAD_VERSION = 2;
+var HISTORY_SYNC_PAYLOAD_VERSION = 3;
 var RunMode = external_exports.enum(["standalone", "attached"]);
 var ControlPlaneConnection = external_exports.object({
   endpoint: external_exports.string().min(1),
@@ -23817,11 +23829,11 @@ var WorkspaceSettings = external_exports.object({
   // covers the current payload and must be re-granted.
   modelJudgeConsent: ModelJudgeConsent.optional(),
   // Records that the user consented to the DEFERRED send — the outbox — along
-  // with the payload shape and the endpoint they agreed to. Since payload v2
-  // that covers both the pre-attach backlog and undelivered captures (which
-  // carry prompt/reply text in `content`); the key name predates the widening.
-  // Absent until granted, and a grant for a different endpoint or an older
-  // payload no longer counts.
+  // with the payload shape and the endpoint they agreed to. Since payload v3
+  // that covers the pre-attach backlog AND undelivered captures alike, and both
+  // carry prompt/reply/tool-output text in `content`; the key name predates
+  // both widenings. Absent until granted, and a grant for a different endpoint
+  // or an older payload no longer counts.
   historySyncConsent: HistorySyncConsent.optional()
 });
 function defaultWorkspaceSettings() {
@@ -23952,6 +23964,9 @@ var ManagedSettingKey = external_exports.enum([
   "dataSharesInPlace",
   "redactFallback"
 ]).meta({ id: "ManagedSettingKey" });
+function isManagedSettingKey(value) {
+  return ManagedSettingKey.safeParse(value).success;
+}
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
   controlPlane: external_exports.object({
@@ -23976,7 +23991,27 @@ var ManagedSettings = external_exports.object({
   // Which of those the user may not change. A key here with no matching value
   // freezes whatever the user last chose; a value with no lock is a DEFAULT
   // the user may still override. The two are separable on purpose.
-  lockedFields: external_exports.array(ManagedSettingKey).default([])
+  //
+  // Parsed as NAMES rather than as the enum, and split below: a name this
+  // build does not know is dropped from the locked set and reported, never a
+  // reason to refuse the file. The same shape reaches an older build whenever
+  // an administrator locks a key a newer build added, and refusing it there
+  // ran that build entirely unmanaged — every pin and lock gone — on exactly
+  // the fleets most likely to carry a version skew. A name outside the enum
+  // is still never HONOURED: the lockable set stays explicit above.
+  lockedFields: external_exports.array(external_exports.string()).default([])
+}).transform(({ lockedFields, ...rest }) => {
+  const known = [];
+  const unknown2 = [];
+  for (const name2 of lockedFields) {
+    if (isManagedSettingKey(name2)) known.push(name2);
+    else unknown2.push(name2);
+  }
+  return {
+    ...rest,
+    lockedFields: known,
+    ...unknown2.length > 0 ? { unknownLockedFields: unknown2 } : {}
+  };
 }).meta({ id: "ManagedSettings" });
 
 // ../../packages/schema/src/zod/project-files.ts
@@ -24100,7 +24135,11 @@ var FindingsTimeseriesPoint = external_exports.object({
   timestamp: external_exports.iso.date(),
   critical: external_exports.number().int().nonnegative(),
   high: external_exports.number().int().nonnegative(),
-  medium: external_exports.number().int().nonnegative()
+  medium: external_exports.number().int().nonnegative(),
+  // Optional and additive, so a producer written against the earlier
+  // three-series contract keeps validating. A consumer plotting it resolves the
+  // absent case itself — the chart point requires a number.
+  low: external_exports.number().int().nonnegative().optional()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
   range: TimeRange,
@@ -24126,6 +24165,10 @@ var ResolvedFeedItem = external_exports.object({
   findingKey: external_exports.string(),
   ruleId: external_exports.string(),
   severity: Severity,
+  // Repository slug, and the file path RELATIVE to it. The pair is what
+  // identifies the file: a bare path matches the same name in every repo.
+  // Optional and additive; empty when the event carried no repo.
+  repo: external_exports.string().optional(),
   path: external_exports.string(),
   // ISO-8601 datetime (matches FindingInstance.detectedAt / the rest of the
   // findings domain). The reader `.toISOString()`s the DB epoch-ms values.
@@ -25703,7 +25746,8 @@ var SqliteActivityRepository = class {
             SELECT 1 FROM audit_events d
             WHERE d.root_session_id = audit_events.id
               AND (d.content LIKE ? ESCAPE '\\'
-                   OR json_extract(d.attributes, '$.detail') LIKE ? ESCAPE '\\')))`
+                   OR coalesce(json_extract(d.attributes, '$.detail'),
+                               json_extract(d.attributes, '$.target')) LIKE ? ESCAPE '\\')))`
       );
       params.push(pattern, pattern, pattern, pattern, pattern, pattern);
     }
@@ -27041,23 +27085,6 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 )`;
 
 // ../../packages/persistence/src/repositories/findings.ts
-var PREVIEW_INSTANCES_PER_GROUP = 200;
-var DEFAULT_LOCATIONS_LIMIT = 100;
-var LOCATION_RULE_IDS_CAP = 20;
-function compareLocationOrder(a, b) {
-  return compareFindingGroupOrder(
-    {
-      severity: a.maxSeverity,
-      latestDetectedAt: a.latestDetectedAt,
-      id: ""
-    },
-    {
-      severity: b.maxSeverity,
-      latestDetectedAt: b.latestDetectedAt,
-      id: ""
-    }
-  );
-}
 var CONCAT_SEP = ",";
 var TUPLE_SEP = "|";
 function splitConcat(value) {
@@ -27109,13 +27136,48 @@ function decodeGroupCursor(cursor) {
   return null;
 }
 function firstAfter(sorted, cursor) {
-  const index = sorted.findIndex((g) => compareFindingGroupOrder(g, cursor) > 0);
+  const index = sorted.findIndex((t) => compareFindingGroupOrder(t, cursor) > 0);
   return index === -1 ? sorted.length : index;
 }
 function findDeepLinked(sorted, page, id) {
-  if (page.some((g) => g.id === id || g.instances.some((i) => i.id === id))) return void 0;
-  return sorted.find((g) => g.id === id || g.instances.some((i) => i.id === id));
+  if (page.some((t) => t.id === id)) return void 0;
+  return sorted.find((t) => t.id === id);
 }
+function encodeLocationCursor(location) {
+  const payload = {
+    sev: location.maxSeverity,
+    t: location.latestDetectedAt,
+    r: location.repo,
+    f: location.file
+  };
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeLocationCursor(cursor) {
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && typeof parsed2.sev === "string" && typeof parsed2.t === "string" && typeof parsed2.r === "string" && typeof parsed2.f === "string") {
+    return { maxSeverity: parsed2.sev, latestDetectedAt: parsed2.t, repo: parsed2.r, file: parsed2.f };
+  }
+  return null;
+}
+function firstLocationAfter(sorted, cursor) {
+  const index = sorted.findIndex((l) => compareLocationOrder(l, cursor) > 0);
+  return index === -1 ? sorted.length : index;
+}
+function findDeepLinkedLocation(sorted, page, id) {
+  if (page.some((l) => l.id === id)) return void 0;
+  return sorted.find((l) => l.id === id);
+}
+var FINDING_ROW_COLUMNS_SQL = `f.id AS id, d.rule_id AS rule_id, d.category AS category,
+              d.severity AS severity, f.masked_match AS masked_match,
+              f.action_taken AS action_taken, f.confidence AS confidence,
+              e.started_at AS occurred_at,
+              e.source_tool AS source_tool,
+              e.repo AS repo,
+              e.file_path AS file,
+              e.tool_name AS tool_name,
+              f.audit_event_id AS event_id, e.root_session_id AS session_id,
+              e.event_type AS kind, f.finding_key AS finding_key,
+              ${latestResolutionStatusSql("f")} AS latest_status`;
 var DAY_MS3 = 864e5;
 var SqliteFindingsRepository = class {
   constructor(db) {
@@ -27236,30 +27298,26 @@ var SqliteFindingsRepository = class {
     );
   }
   /**
-   * Grouped findings for the dashboard — joins inspection_findings⋈audit_events
-   * ⋈inspection_definitions (repo/file/toolName from the audit event's
-   * attributes bag, rule_id/category/severity from the definition), scoped to
-   * the four capture kinds (audit_events also holds structural/reconciler/scan
-   * rows this list must never surface), groups by ruleId, computes
-   * per-filter-excluded facets, applies the requested filters, and sorts by
-   * severity then recency. Filtering
-   * and faceting run in JS via the shared @akasecurity/schema helpers. `totals`
-   * reflect the full filtered set; `items` is the requested
-   * page (default 50); no cursor (nextCursor is always null). Under a `status`
-   * filter, `totals.findings` counts only instances whose derived status was
-   * requested, and each item's instance preview is narrowed the same way.
+   * Finding TYPES for the dashboard — one row per rule, scoped to the four
+   * capture kinds (audit_events also holds structural/reconciler/scan rows this
+   * list must never surface), with per-filter-excluded facets, the requested
+   * filters applied, and sorted by severity then recency. Filtering and faceting
+   * run in JS via the shared @akasecurity/schema helpers. `totals` reflect the
+   * full filtered set; `items` is the requested page (default 50), keyset-paged.
+   * Under a `status` filter, `totals.findings` counts only findings whose
+   * derived status was requested.
+   *
+   * ONE read, which materializes no findings: a single aggregate per rule_id,
+   * folding EVERY finding into the numbers a type row and the filters need
+   * (count, severity, category, providers, actions, statuses, latest, search
+   * text). The findings OF a type come from listFindingInstances scoped to
+   * `subtype`, so neither list bounds the other and no per-type cap exists.
    *
-   * Two reads, neither of which materializes a row per finding:
-   *   1. one aggregate row per rule_id, folding EVERY instance into the numbers
-   *      the group and the filters need (count, providers, actions, statuses,
-   *      latest, search text);
-   *   2. each group's newest PREVIEW_INSTANCES_PER_GROUP instances, which
-   *      populate `instances` for the table's expanded rows.
    * The aggregates carry raw DB values and are translated by the same
-   * @akasecurity/schema mappers the row path uses, so no enum mapping or status
-   * rule is ever restated in SQL.
+   * @akasecurity/schema mappers every other path uses, so no enum mapping or
+   * status rule is ever restated in SQL.
    */
-  listGroupedFindings(query) {
+  listFindingTypes(query) {
     const sessionPredicate = query.sessionId ? ` AND e.root_session_id = :sessionId` : "";
     const fromMs = query.from === void 0 ? void 0 : isoToEpochMillis(query.from);
     const fromPredicate = fromMs === void 0 ? "" : ` AND e.started_at >= :fromMs`;
@@ -27272,12 +27330,7 @@ var SqliteFindingsRepository = class {
       predicate,
       params: sessionParams
     });
-    const rows = this.previewRows(aggregates, {
-      sessionId: query.sessionId,
-      from: query.from
-    });
-    const groupable = rows.map(toFlatFindingRow);
-    const allGroups = buildFindingGroups(groupable, { aggregates });
+    const allTypes = buildFindingTypes(aggregates);
     const filterOpts = {
       severity: query.severity,
       providers: query.provider,
@@ -27286,30 +27339,25 @@ var SqliteFindingsRepository = class {
       subtype: query.subtype,
       q: query.q
     };
-    const facets = computeFindingFacets(allGroups, filterOpts);
-    const sorted = sortFindingGroups(applyFindingFilters(allGroups, filterOpts));
+    const facets = computeFindingFacets(allTypes, filterOpts);
+    const sorted = sortFindingTypes(applyFindingFilters(allTypes, filterOpts));
     const statusFilter = query.status ?? [];
     const totals = {
-      findings: sorted.reduce((acc, g) => {
-        if (statusFilter.length === 0) return acc + g.instanceCount;
-        const agg = aggregates.get(g.id);
-        return acc + (agg ? countInstancesByStatus(agg.statusInputs, statusFilter) ?? g.instanceCount : g.instanceCount);
+      findings: sorted.reduce((acc, t) => {
+        if (statusFilter.length === 0) return acc + t.instanceCount;
+        const agg = aggregates.get(t.id);
+        return acc + (agg ? countInstancesByStatus(agg.statusInputs, statusFilter) ?? t.instanceCount : t.instanceCount);
       }, 0),
-      groups: sorted.length
+      types: sorted.length
     };
-    const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
+    const limit = query.limit ?? DEFAULT_FINDING_TYPES_LIMIT;
     const cursor = query.cursor === void 0 ? null : decodeGroupCursor(query.cursor);
     const start = cursor === null ? 0 : firstAfter(sorted, cursor);
     const page = sorted.slice(start, start + limit);
     const lastOnPage = page.at(-1);
     const nextCursor = start + limit < sorted.length && lastOnPage ? encodeGroupCursor(lastOnPage) : null;
     const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinked(sorted, page, query.includeId);
-    const statusSet = statusFilter.length > 0 ? new Set(statusFilter) : null;
-    const narrow = (g) => statusSet ? {
-      ...g,
-      instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
-    } : g;
-    const items = [...page, ...deepLinked ? [deepLinked] : []].map(narrow);
+    const items = [...page, ...deepLinked ? [deepLinked] : []];
     return Promise.resolve({
       totals,
       facets,
@@ -27320,7 +27368,7 @@ var SqliteFindingsRepository = class {
   }
   /**
    * One row per rule_id, folding EVERY instance of the group into the values
-   * buildFindingGroups cannot recover from a preview. Bounded by the number of
+   * buildFindingTypes cannot recover from an aggregate. Bounded by the number of
    * distinct rule_ids (the installed packs' rules), not by the store's size.
    *
    * A single scan, folded in two levels: the inner SELECT groups by
@@ -27414,13 +27462,25 @@ var SqliteFindingsRepository = class {
     });
   }
   /**
-   * The same findings folded by location: repository, then file within it.
+   * The same findings folded by WHERE they live — one row per (repo, file) pair.
    *
    * The grouping keys come from the capturing event's attributes, which is what
-   * the local store relates a finding to — there is no finding↔asset row to
-   * group by instead. A repo or file the event did not record folds into the
-   * empty-string bucket, which the view renders but does not link, since no
-   * filter can name it.
+   * the local store relates a finding to; there is no finding↔asset row to group
+   * by instead. A repo or file the event did not record folds into the
+   * empty-string bucket, which is a real location like any other: it is listed,
+   * it is selectable, and its `?loc=` token is as good as any other row's.
+   *
+   * ONE flat list rather than repos nesting files. A rollup can only be paged by
+   * repo, which leaves the file list inside it unbounded — the shape the by-type
+   * list was rebuilt to remove — and two-level pagination inside an
+   * expand/collapse table is what pushed that view to master/detail in the first
+   * place.
+   *
+   * Every filter narrows the FINDINGS and the locations fall out of what
+   * survives, so each row's `instanceCount` is exactly what listFindingInstances
+   * reports for the same filters scoped to that pair. The view depends on it:
+   * one toolbar sits over both panels precisely because a location owns none of
+   * its fields.
    */
   listFindingLocations(query) {
     const opts = {
@@ -27432,13 +27492,16 @@ var SqliteFindingsRepository = class {
       tools: query.tool,
       q: query.q
     };
-    const limit = query.limit ?? DEFAULT_LOCATIONS_LIMIT;
+    const limit = query.limit ?? DEFAULT_FINDING_LOCATIONS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeLocationCursor(query.cursor);
     const byRepo = /* @__PURE__ */ new Map();
+    const accumulator = createInstanceFacetAccumulator(opts);
     let total = 0;
     for (const row of this.scanFindingRows({
       sessionId: query.sessionId,
       from: query.from
     })) {
+      accumulator.add(row);
       if (!matchesInstanceFilters(row, opts)) continue;
       total += 1;
       let files = byRepo.get(row.repo);
@@ -27453,103 +27516,35 @@ var SqliteFindingsRepository = class {
       }
       addToLocation(acc, row);
     }
-    let fileCount = 0;
-    const repos = [...byRepo.entries()].map(([repo, files]) => {
-      fileCount += files.size;
-      const fileRows = [...files.entries()].map(([file2, acc]) => ({
-        file: file2,
-        instanceCount: acc.instanceCount,
-        maxSeverity: acc.maxSeverity,
-        latestDetectedAt: acc.latestDetectedAt,
-        ...foldGroupStatus(acc.statuses) === void 0 ? {} : { status: foldGroupStatus(acc.statuses) },
-        ruleIds: [...acc.ruleIds].slice(0, LOCATION_RULE_IDS_CAP)
-      })).sort(compareLocationOrder);
-      const rollup = fileRows.reduce(
-        (a, f) => ({
-          instanceCount: a.instanceCount + f.instanceCount,
-          maxSeverity: compareLocationOrder(f, a) < 0 ? f.maxSeverity : a.maxSeverity,
-          latestDetectedAt: f.latestDetectedAt > a.latestDetectedAt ? f.latestDetectedAt : a.latestDetectedAt
-        }),
-        {
-          instanceCount: 0,
-          maxSeverity: fileRows[0]?.maxSeverity ?? "low",
-          latestDetectedAt: ""
-        }
-      );
-      const statuses = fileRows.map((f) => f.status);
-      const folded = foldGroupStatus(statuses);
-      return {
-        repo,
-        instanceCount: rollup.instanceCount,
-        maxSeverity: rollup.maxSeverity,
-        latestDetectedAt: rollup.latestDetectedAt,
-        ...folded === void 0 ? {} : { status: folded },
-        files: fileRows
-      };
-    });
-    repos.sort(compareLocationOrder);
+    const sorted = [];
+    for (const [repo, files] of byRepo) {
+      for (const [file2, acc] of files) {
+        const status = foldGroupStatus(acc.statuses);
+        sorted.push({
+          id: encodeLocationId(repo, file2),
+          repo,
+          file: file2,
+          instanceCount: acc.instanceCount,
+          maxSeverity: acc.maxSeverity,
+          latestDetectedAt: acc.latestDetectedAt,
+          ...status === void 0 ? {} : { status },
+          ruleIds: [...acc.ruleIds]
+        });
+      }
+    }
+    sorted.sort(compareLocationOrder);
+    const start = cursor === null ? 0 : firstLocationAfter(sorted, cursor);
+    const page = sorted.slice(start, start + limit);
+    const lastOnPage = page.at(-1);
+    const nextCursor = start + limit < sorted.length && lastOnPage ? encodeLocationCursor(lastOnPage) : null;
+    const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinkedLocation(sorted, page, query.includeId);
     return Promise.resolve({
-      totals: { findings: total, repos: repos.length, files: fileCount },
-      items: repos.slice(0, limit),
-      hasMore: repos.length > limit
+      totals: { findings: total, locations: sorted.length },
+      facets: accumulator.facets(),
+      items: [...page, ...deepLinked ? [deepLinked] : []],
+      nextCursor
     });
   }
-  /**
-   * Each group's newest instances, for the table's expanded rows.
-   *
-   * ONE index-ordered scan with early termination, and the shape is the point.
-   * The natural spelling — `ROW_NUMBER() OVER (PARTITION BY rule_id ORDER BY
-   * started_at DESC)` then `WHERE rn <= cap` — sorts EVERY finding in scope
-   * through a temp B-tree to keep a bounded preview of each group, and then
-   * sorts the survivors again for the page order. Both sorts grow with the
-   * store while the answer does not.
-   *
-   * Instead the scan walks `audit_events` newest-first off `idx_audit_started_at`
-   * (or the session or window index the scope names — see `findingScanSql`),
-   * which is already the order the page wants, and keeps rows per rule until
-   * each rule has as many as it can show. The aggregate the caller already holds
-   * says how many that is: `min(instanceCount, PREVIEW_INSTANCES_PER_GROUP)`
-   * per rule, summed, is the number of rows this scan has to find, and it stops
-   * on the last one. That sum is bounded by `rules * PREVIEW_INSTANCES_PER_GROUP`
-   * (8,000 at this repo's 40-rule bench corpus), not by a fixed row count — a
-   * store with many firing rules widens it. The bound that DOES hold
-   * unconditionally is the sorted form's floor: this scan visits at most as
-   * many rows as `ROW_NUMBER() OVER (PARTITION BY rule_id …)` would have
-   * sorted, and stops the moment every rule has its cap, where the sorted form
-   * sorts the whole scope regardless. The true worst case — the rarest rule's
-   * wanted instances sitting at the tail of the scope — is one pass over
-   * everything in scope with a block sort of the id tie-break only, never a
-   * sort of the scope, which is still that floor.
-   *
-   * A row whose rule the aggregate did not see is skipped: the two statements
-   * run without a shared snapshot, so a capture landing between them can add a
-   * rule here that has no counts there, and the counts are what the group is
-   * built from.
-   */
-  previewRows(aggregates, scope) {
-    const wanted = /* @__PURE__ */ new Map();
-    let remaining = 0;
-    for (const [ruleId, agg] of aggregates) {
-      const n = Math.min(agg.instanceCount, PREVIEW_INSTANCES_PER_GROUP);
-      wanted.set(ruleId, n);
-      remaining += n;
-    }
-    const rows = [];
-    if (remaining === 0) return rows;
-    const { sql, params } = this.findingScanSql(scope);
-    const taken = /* @__PURE__ */ new Map();
-    for (const r of iterateRows(this.db.prepare(sql), params)) {
-      const want = wanted.get(r.rule_id);
-      if (want === void 0) continue;
-      const have = taken.get(r.rule_id) ?? 0;
-      if (have >= want) continue;
-      taken.set(r.rule_id, have + 1);
-      rows.push(r);
-      remaining -= 1;
-      if (remaining === 0) break;
-    }
-    return rows;
-  }
   /**
    * Every finding in scope as a FlatFindingRow, newest first, streamed.
    *
@@ -27576,6 +27571,33 @@ var SqliteFindingsRepository = class {
       yield toFlatFindingRow(r);
     }
   }
+  /**
+   * One finding by its own id, or null when no such row exists.
+   *
+   * A primary-key seek on `inspection_findings`, so its cost does not grow with
+   * the store — and, unlike anything derived from a list page, it resolves a
+   * finding of ANY age. That is what the Findings page's one-shot `?finding=`
+   * deep link needs: the id it carries may name a finding thousands of rows
+   * older than anything a first page holds.
+   *
+   * Deliberately UNFILTERED — no capture-kind, session or time predicate. It
+   * RESOLVES an id; whether that row would survive the list's current filters is
+   * a different question, and hiding the target because a filter excludes it is
+   * worse than showing it.
+   *
+   * `groupId` on the result IS the rule id, so this one read answers both "which
+   * type should the list select?" and "what does the drawer show?".
+   */
+  findingInstance(id) {
+    const row = this.db.prepare(
+      `SELECT ${FINDING_ROW_COLUMNS_SQL}
+           FROM inspection_findings f
+           JOIN audit_events e ON e.id = f.audit_event_id
+           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+          WHERE f.id = ?`
+    ).get(id);
+    return Promise.resolve(row === void 0 ? null : toInstanceDetail(toFlatFindingRow(row)));
+  }
   /**
    * The one statement both instance-level scans run: every finding in scope,
    * joined to its event and definition, newest first.
@@ -27609,17 +27631,7 @@ var SqliteFindingsRepository = class {
       conditions.push("e.started_at >= ?");
       params.push(isoToEpochMillis(scope.from));
     }
-    const sql = `SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
-              d.severity AS severity, f.masked_match AS masked_match,
-              f.action_taken AS action_taken, f.confidence AS confidence,
-              e.started_at AS occurred_at,
-              e.source_tool AS source_tool,
-              e.repo AS repo,
-              e.file_path AS file,
-              e.tool_name AS tool_name,
-              f.audit_event_id AS event_id, e.root_session_id AS session_id,
-              e.event_type AS kind, f.finding_key AS finding_key,
-              ${latestResolutionStatusSql("f")} AS latest_status
+    const sql = `SELECT ${FINDING_ROW_COLUMNS_SQL}
          FROM audit_events e
          CROSS JOIN inspection_findings f ON f.audit_event_id = e.id
          CROSS JOIN inspection_definitions d ON d.id = f.inspection_definition_id
@@ -27633,6 +27645,26 @@ var SqliteFindingsRepository = class {
            group_concat(DISTINCT 'via ' || e.tool_name) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
     const rows = this.db.prepare(
       `SELECT rule_id,
+                -- BARE columns beside max(latest_at), which is deliberate and
+                -- is SQLite's documented behaviour: with a single min()/max()
+                -- in an aggregate query, every bare column takes its value from
+                -- the row that produced the extremum. So these are the severity
+                -- and category of the definition whose finding is NEWEST, which
+                -- is what the row-based build they replaced read off its first
+                -- (newest-first) row.
+                --
+                -- min() is WRONG here and was the defect: inspection_definitions
+                -- holds one row per rule VERSION (see its writer \u2014 a version bump
+                -- mints a new row), so a rule whose severity moved between
+                -- versions has several, and min() picks the ALPHABETICALLY
+                -- smallest \u2014 'low' over 'medium', but 'critical' over 'high'.
+                -- That is arbitrary in direction, and it feeds the badge, the
+                -- filter, the facet counts and the primary sort key.
+                --
+                -- Adding a second min()/max() aggregate here would make these
+                -- bare columns ambiguous again; keep max(latest_at) the only one.
+                severity,
+                category,
                 sum(tuple_count) AS instance_count,
                 max(latest_at) AS latest_at,
                 group_concat(source_tools) AS source_tools,
@@ -27643,6 +27675,14 @@ var SqliteFindingsRepository = class {
                 group_concat(tool_names) AS tool_names
            FROM (
              SELECT d.rule_id AS rule_id,
+                    -- Severity and category are columns of the DEFINITION, and
+                    -- a rule can have SEVERAL definitions (one per version), so
+                    -- these are grouped on below and resolved to the newest
+                    -- firing version by the outer query's bare-column select.
+                    -- They ride the aggregate because the type build has no rows
+                    -- to read them off \u2014 see buildFindingTypes.
+                    d.severity AS severity,
+                    d.category AS category,
                     e.event_type || '${TUPLE_SEP}' ||
                       (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '${TUPLE_SEP}' ||
                       coalesce(latest.status, '') AS status_tuple,
@@ -27657,7 +27697,7 @@ var SqliteFindingsRepository = class {
                LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
                  ON latest.finding_key = f.finding_key
               ${scope.predicate}
-              GROUP BY d.rule_id, status_tuple
+              GROUP BY d.rule_id, d.severity, d.category, status_tuple
            )
           GROUP BY rule_id`
     ).all(scope.params);
@@ -27666,6 +27706,8 @@ var SqliteFindingsRepository = class {
         r.rule_id,
         {
           instanceCount: r.instance_count,
+          severity: r.severity,
+          category: r.category,
           sourceTools: splitConcat(r.source_tools),
           actionsTaken: splitConcat(r.actions_taken),
           statusInputs: splitConcat(r.status_inputs).map((tuple2) => {
@@ -27682,7 +27724,7 @@ var SqliteFindingsRepository = class {
           latestDetectedAt: epochMillisToIso(r.latest_at),
           // Free text only — joined and substring-matched, so group_concat's
           // commas need no unpicking (a repo/path containing one still matches).
-          // Left undefined (not '') when unfetched, so buildFindingGroups can
+          // Left undefined (not '') when unfetched, so buildFindingTypes can
           // tell "no q this request" from "a group with no repo/file at all"
           // and skip priming a haystack nothing will read.
           ...withSearchText ? {
@@ -27834,6 +27876,12 @@ var SqliteHistorySyncRepository = class {
     this.markOwedStmt = db.prepare(
       `UPDATE audit_events SET outbox_owed = 1 WHERE id = :id AND synced_at IS NULL`
     );
+    this.markCaptureBacklogOwedStmt = db.prepare(
+      `UPDATE audit_events SET outbox_owed = 1
+        WHERE synced_at IS NULL
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :before`
+    );
     this.stampStmt = db.prepare(
       `UPDATE audit_events SET synced_at = :at, sync_claimed_at = NULL WHERE id = :id`
     );
@@ -27882,7 +27930,9 @@ var SqliteHistorySyncRepository = class {
     );
     this.disownCapturesStmt = db.prepare(
       `UPDATE audit_events SET outbox_owed = NULL
-        WHERE outbox_owed IS NOT NULL AND event_type IN (${CAPTURE_TYPE_LIST})`
+        WHERE outbox_owed IS NOT NULL
+          AND event_type IN (${CAPTURE_TYPE_LIST})
+          AND started_at < :attachedAt`
     );
     this.rearmStmt = db.prepare(
       `UPDATE audit_events SET synced_at = NULL
@@ -27958,6 +28008,7 @@ var SqliteHistorySyncRepository = class {
   freezeBoundaryStmt;
   captureRowsStmt;
   markOwedStmt;
+  markCaptureBacklogOwedStmt;
   captureSkipCountStmt;
   disownCapturesStmt;
   partitionStmt;
@@ -28021,6 +28072,23 @@ var SqliteHistorySyncRepository = class {
   markCaptureOwed(id) {
     this.markOwedStmt.run({ id });
   }
+  /**
+   * Mark every capture already on disk as owed, as of `before`.
+   *
+   * The consent-time backfill, called once from `aka attach` when a human
+   * grants existing-history consent — never from an ongoing drain pass, and
+   * never inferred from a boundary that could later move. `before` is the
+   * caller's own "now" at the moment consent was granted, so what this marks
+   * is exactly the backlog the consent prompt already counted, not whatever a
+   * later re-attach or key rotation might widen it to.
+   *
+   * Returns how many rows matched, for the caller to log or test against. Not a
+   * count of NEWLY marked rows — a row still unsynced from an earlier call
+   * matches again and is counted again, the same as `UPDATE`'s own `changes`.
+   */
+  markCaptureBacklogOwed(before) {
+    return Number(this.markCaptureBacklogOwedStmt.run({ before }).changes);
+  }
   /** Record delivery. Called only AFTER the far side has accepted the rows. */
   markSynced(ids, atMs) {
     this.stampAll(ids, atMs);
@@ -28137,15 +28205,42 @@ var SqliteHistorySyncRepository = class {
    *
    * Delivery is a fact about ONE recipient: rows sent to the deployment a
    * machine has just left are undelivered as far as the new one is concerned.
-   * All three in one transaction, so a crash between them cannot leave stamps
-   * attributed to the wrong deployment, or a boundary that belongs to another.
+   * All four in one transaction, so a crash between them cannot leave stamps
+   * attributed to the wrong deployment, a boundary that belongs to another, or
+   * a disown with no re-mark to follow it.
    *
    * The boundary is written HERE and only here, which is what freezes it: a
    * re-attach to the SAME deployment (a key rotation) leaves the fingerprint
    * unchanged, so this never runs and the backlog does not widen back over rows
    * the live path has since delivered.
+   *
+   * `backfillCapturesBefore` is the caller's OWN "now" at the instant a human
+   * granted existing-history consent for the deployment this call is arming —
+   * a DIFFERENT instant from `backlogBefore`: the re-mark boundary is the GRANT
+   * instant, `backlogBefore` is the ATTACH instant, and the two can be far
+   * apart. Passed only when that grant is valid, since this method has no way
+   * to check consent itself and must not mark a row owed for a machine that
+   * never agreed to it. Applied AFTER the disown above, in the SAME
+   * transaction: what the disown clears is every marker below `backlogBefore`,
+   * which includes this deployment's OWN pre-attach rows — `aka attach` calls
+   * `seedCaptureBacklogOwed` at the attach instant, so every row it marks sits
+   * on the cleared side of that bound — and the re-mark in the same
+   * transaction is what puts those rows back. A crash between the two cannot
+   * strand the ledger disowned with nothing re-marked — the transaction either
+   * lands whole or not at all, and a fingerprint mismatch that has not yet
+   * committed re-enters this method on the very next pass. Omit it (the
+   * structural-only tests do) to exercise the disown in isolation.
+   *
+   * The disown is bounded by `backlogBefore`, which is what keeps it from
+   * touching a marker the NEW deployment's OWN live path has already set: B's
+   * live path can mark a capture owed from the moment `aka attach` writes the
+   * descriptor, before the drain's first pass ever reaches this method, and
+   * such a row sits at or after the bound rather than below it. What keeps the
+   * disown from eating THIS SAME CALL's own re-mark is the order, not the
+   * bound — disown runs first, re-mark second, both inside the one
+   * transaction above.
    */
-  rearmFor(fingerprint, backlogBefore) {
+  rearmFor(fingerprint, backlogBefore, backfillCapturesBefore) {
     this.ensureRowStmt.run();
     withTransaction(
       this.db,
@@ -28153,7 +28248,10 @@ var SqliteHistorySyncRepository = class {
         const previous = getRow(this.fingerprintStmt)?.fingerprint;
         this.rearmStmt.run();
         if (previous !== null && previous !== void 0 && previous !== fingerprint) {
-          this.disownCapturesStmt.run();
+          this.disownCapturesStmt.run({ attachedAt: backlogBefore });
+        }
+        if (backfillCapturesBefore !== void 0) {
+          this.markCaptureBacklogOwedStmt.run({ before: backfillCapturesBefore });
         }
         this.setFingerprintStmt.run({ fingerprint, backlogBefore });
       },
@@ -28430,7 +28528,8 @@ function managedSettingsPaths(platform2 = process.platform) {
   }
   return [posix.join("/etc", "aka", MANAGED_SETTINGS_FILENAME)];
 }
-function readManagedSettings(paths = managedSettingsPaths()) {
+var testOnlyManagedPaths = null;
+function readManagedSettings(paths = testOnlyManagedPaths ?? managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
@@ -30910,7 +31009,7 @@ function toUtcDateString(ms) {
   return new Date(ms).toISOString().slice(0, 10);
 }
 function isTimeseriesSeverity(s) {
-  return s === "critical" || s === "high" || s === "medium";
+  return s === "critical" || s === "high" || s === "medium" || s === "low";
 }
 var SqliteSecurityRepository = class {
   constructor(db, now = () => Date.now()) {
@@ -31039,12 +31138,16 @@ var SqliteSecurityRepository = class {
     const now = this.now();
     const windowStart = startOfUtcDay2(now) - (lenDays - 1) * DAY_MS4;
     const rows = this.findingsInRange(windowStart, now);
-    const points = Array.from({ length: numBuckets }, (_, i) => ({
-      timestamp: toUtcDateString(windowStart + i * bucketMs),
-      critical: 0,
-      high: 0,
-      medium: 0
-    }));
+    const points = Array.from(
+      { length: numBuckets },
+      (_, i) => ({
+        timestamp: toUtcDateString(windowStart + i * bucketMs),
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0
+      })
+    );
     for (const r of rows) {
       const idx = Math.floor((r.occurredAt - windowStart) / bucketMs);
       const bucket = points[idx];
@@ -31262,6 +31365,7 @@ var SqliteSecurityRepository = class {
         `SELECT f.finding_key AS finding_key,
                 d.rule_id AS rule_id,
                 d.severity AS severity,
+                e.repo AS repo,
                 e.file_path AS path,
                 COALESCE(f.first_detected_at, e.started_at) AS first_detected_at,
                 latest.resolved_at AS latest_resolved_at
@@ -31281,6 +31385,7 @@ var SqliteSecurityRepository = class {
     const items = rows.map((r) => ({
       findingKey: r.finding_key,
       ruleId: r.rule_id,
+      repo: r.repo ?? "",
       severity: r.severity,
       path: r.path ?? "",
       resolvedAt: new Date(r.latest_resolved_at).toISOString(),
@@ -31290,13 +31395,66 @@ var SqliteSecurityRepository = class {
     }));
     return Promise.resolve({ items });
   }
+  /**
+   * Per-rule tallies of the findings that are still OPEN, whole-store.
+   *
+   * Scoped by status rather than by time, because the card this feeds is a to-do
+   * list: a secret committed three weeks ago and never rotated is still the most
+   * important thing to fix, and any window hides it. It carried a "newest N
+   * findings" cap and then a range; the first meant a different span on every
+   * machine, and the second reported "no recommendations" over live exposure.
+   *
+   * `open` mirrors `deriveFindingStatus` — at-rest, minus resolved and dismissed —
+   * so a row's count is exactly what `?status=open&type=<rule>` returns. Note that
+   * is NOT `severitySummary`'s `openAtRest`, which keeps dismissed findings (a
+   * dismissal is a judgement, not a remediation) and drops untracked legacy rows.
+   * The two answer different questions and only this one has to match a link.
+   *
+   * Aggregated in SQL: the result is O(distinct rule × category × severity), so a
+   * whole-store scope costs a grouped scan rather than a row per finding.
+   */
+  recommendationInputs() {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT d.rule_id AS rule_id,
+                d.category AS category,
+                d.severity AS severity,
+                COUNT(*) AS count
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+         LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+           ON latest.finding_key = f.finding_key
+         WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})
+           AND e.event_type = 'code_change'
+           AND (
+             f.finding_key IS NULL
+             OR latest.status IS NULL
+             OR latest.status NOT IN ('resolved', 'dismissed')
+           )
+         GROUP BY d.rule_id, d.category, d.severity`
+      )
+    );
+    return Promise.resolve(
+      rows.map((r) => ({
+        ruleId: r.rule_id,
+        category: r.category,
+        severity: r.severity,
+        count: r.count
+      }))
+    );
+  }
   // Findings whose parent event occurred in [fromMs, toMs), with the parent's
   // epoch-millis timestamp. started_at is an INTEGER column, so the bounds stay
   // numeric and the JS aggregations bucket/split on ms directly.
   findingsInRange(fromMs, toMs) {
     const rows = allRows(
       this.db.prepare(
-        `SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken
+        // `rule_id`/`category` cost nothing extra: inspection_definitions is already
+        // joined for `severity`, so they are two more columns off a row this read
+        // already fetches. They feed the recommended-actions rollup.
+        `SELECT e.started_at AS occurred_at, d.severity AS severity, f.action_taken AS action_taken,
+                d.rule_id AS rule_id, d.category AS category
          FROM inspection_findings f
          JOIN audit_events e ON e.id = f.audit_event_id
          JOIN inspection_definitions d ON d.id = f.inspection_definition_id
@@ -31309,7 +31467,9 @@ var SqliteSecurityRepository = class {
     return rows.map((r) => ({
       occurredAt: r.occurred_at,
       severity: r.severity,
-      actionTaken: r.action_taken
+      actionTaken: r.action_taken,
+      ruleId: r.rule_id,
+      category: r.category
     }));
   }
 };
@@ -32479,14 +32639,51 @@ function openLocalDatabase(dir) {
   };
 }
 
-// ../../packages/persistence/src/finding-key.ts
+// ../../packages/persistence/src/egress-wire.ts
 import { createHash as createHash3 } from "crypto";
+function hashProjectKey(projectKey) {
+  return createHash3("sha256").update(projectKey, "utf8").digest("hex");
+}
+function toIngestHit(hit) {
+  return {
+    host: hit.host,
+    kind: hit.kind,
+    name: hit.name,
+    category: hit.category,
+    trust: hit.trust,
+    network: hit.network,
+    method: hit.method,
+    transport: hit.transport,
+    url: hit.url,
+    template: hit.template,
+    dataClass: hit.dataClass,
+    site: {
+      file: hit.site.file,
+      line: hit.site.line,
+      dynamic: hit.site.dynamic,
+      vendored: hit.site.vendored
+    }
+  };
+}
+function toEgressIngestRequest(input2) {
+  const { hits, droppedFiles } = capHits(input2.hits, input2.reconcile.mode);
+  const reconcile = withoutDroppedFiles(input2.reconcile, droppedFiles);
+  return {
+    projectKey: hashProjectKey(input2.projectKey),
+    project: input2.project,
+    reconcile,
+    hits: hits.map(toIngestHit)
+  };
+}
+
+// ../../packages/persistence/src/finding-key.ts
+import { createHash as createHash4 } from "crypto";
 function normalizeFilePath(filePath) {
   return filePath.replaceAll("\\", "/");
 }
 function computeFindingKey(input2) {
   const normalizedPath = normalizeFilePath(input2.filePath);
-  return createHash3("sha256").update(`${input2.ruleId}\0${normalizedPath}\0${input2.valueFingerprint}`).digest("hex");
+  return createHash4("sha256").update(`${input2.ruleId}\0${normalizedPath}\0${input2.valueFingerprint}`).digest("hex");
 }
 
 // ../../packages/persistence/src/fingerprint.ts
@@ -32612,14 +32809,18 @@ function fingerprintValue(key, raw) {
   return createHmac("sha256", key.material).update(raw, "utf8").digest("hex");
 }
 
-// ../../packages/persistence/src/history-preview.ts
+// ../../packages/persistence/src/history-backfill.ts
 import { existsSync as existsSync4 } from "fs";
 import { join as join9 } from "path";
+
+// ../../packages/persistence/src/history-preview.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join10 } from "path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
 // ../../packages/persistence/src/store-symlinks.ts
-import { existsSync as existsSync5, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
-import { dirname as dirname3, join as join10, resolve } from "path";
+import { existsSync as existsSync6, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
+import { dirname as dirname3, join as join11, resolve } from "path";
 
 // ../../packages/persistence/src/vault/crypto.ts
 import {
@@ -32634,61 +32835,25 @@ import {
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
 import { chmodSync as chmodSync3, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join13 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join12(dataDir2, MARKER);
-  if (existsSync6(marker)) return { capped: 0, skipped: "already-run" };
+  const marker = join13(dataDir2, MARKER);
+  if (existsSync7(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
   writeFileSync4(marker, `${new Date(Date.now()).toISOString()}
 `, { mode: DATA_FILE_MODE });
   return { capped };
 }
 
-// ../../packages/plugin-runtime/src/attached/egress-wire.ts
-function hashProjectKey(projectKey) {
-  return createHash4("sha256").update(projectKey, "utf8").digest("hex");
-}
-function toIngestHit(hit) {
-  return {
-    host: hit.host,
-    kind: hit.kind,
-    name: hit.name,
-    category: hit.category,
-    trust: hit.trust,
-    network: hit.network,
-    method: hit.method,
-    transport: hit.transport,
-    url: hit.url,
-    template: hit.template,
-    dataClass: hit.dataClass,
-    site: {
-      file: hit.site.file,
-      line: hit.site.line,
-      dynamic: hit.site.dynamic,
-      vendored: hit.site.vendored
-    }
-  };
-}
-function toEgressIngestRequest(input2) {
-  const { hits, droppedFiles } = capHits(input2.hits, input2.reconcile.mode);
-  const reconcile = withoutDroppedFiles(input2.reconcile, droppedFiles);
-  return {
-    projectKey: hashProjectKey(input2.projectKey),
-    project: input2.project,
-    reconcile,
-    hits: hits.map(toIngestHit)
-  };
-}
-
 // ../../packages/remote/src/http.ts
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
@@ -32968,6 +33133,7 @@ function createRemoteClient(options) {
         url: url2(ROUTES.shares),
         body: JSON.stringify(validated.data)
       });
+      if (response.status === 404) throw new RemoteRouteAbsent(ROUTES.shares);
       okBody(response);
     },
     async pollCommand() {
@@ -32990,19 +33156,51 @@ function createRemoteClient(options) {
   };
 }
 
-// ../../packages/plugin-runtime/src/attached/failure.ts
+// ../../packages/remote/src/failure-kind.ts
 function statusOf(err) {
   if (typeof err !== "object" || err === null || !("status" in err)) return null;
   const { status } = err;
   if (typeof status !== "number" || !Number.isInteger(status)) return null;
   return status >= 100 && status <= 599 ? status : null;
 }
-function classifyFailure(err) {
-  switch (statusOf(err)) {
+function nameOf(err) {
+  if (typeof err !== "object" || err === null || !("name" in err)) return null;
+  return typeof err.name === "string" ? err.name : null;
+}
+function classifyRemoteFailure(err) {
+  switch (nameOf(err)) {
+    case "RemoteRouteAbsent":
+      return "route-absent";
+    case "RemoteRequestInvalid":
+      return "invalid-request";
+    case "RemoteResponseInvalid":
+      return "rejected";
+    default:
+      break;
+  }
+  const status = statusOf(err);
+  if (status === null) return "unreachable";
+  switch (status) {
     case 401:
       return "unauthorized";
     case 403:
       return "forbidden";
+    case 429:
+      return "unreachable";
+    case 404:
+      return "unreachable";
+    default:
+      return status >= 400 && status <= 499 ? "rejected" : "unreachable";
+  }
+}
+
+// ../../packages/plugin-runtime/src/attached/failure.ts
+function classifyFailure(err) {
+  switch (classifyRemoteFailure(err)) {
+    case "unauthorized":
+      return "unauthorized";
+    case "forbidden":
+      return "forbidden";
     default:
       return "unreachable";
   }
@@ -33025,10 +33223,10 @@ function withTimeout(promise2, ms) {
 
 // ../../packages/plugin-runtime/src/attached/forward-drops.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var FORWARD_DROPS_FILENAME = ATTACHED_FORWARD_DROPS_FILENAME;
 function forwardDropsPath(dataDir2) {
-  return join13(dataDir2, FORWARD_DROPS_FILENAME);
+  return join14(dataDir2, FORWARD_DROPS_FILENAME);
 }
 function recordForwardDrops(dataDir2, count, nowMs) {
   if (count <= 0) return;
@@ -33064,13 +33262,13 @@ function readForwardDrops(dataDir2) {
 
 // ../../packages/plugin-runtime/src/attached/forward-policy.ts
 import { randomUUID as randomUUID15 } from "crypto";
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { readFile, rename, writeFile } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join24 } from "path";
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { join as join15 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -33124,8 +33322,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join14(settingsDir(base), "settings.json");
-    if (existsSync7(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join15(settingsDir(base), "settings.json");
+    if (existsSync8(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -33150,7 +33348,7 @@ function resolveProviderSafe(resolveProviderFn) {
 // ../../packages/plugin-sdk/src/config-inventory.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename4, join as join16 } from "path";
+import { basename as basename4, join as join17 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -36366,8 +36564,8 @@ function maskText(text) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
-import { basename as basename3, dirname as dirname4, isAbsolute, join as join15, sep as sep2 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
+import { basename as basename3, dirname as dirname4, isAbsolute, join as join16, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -36417,7 +36615,7 @@ function resolveGitBranch(cwd) {
   try {
     const root = findGitRoot(cwd);
     if (!root) return void 0;
-    const dotGit = join15(root, ".git");
+    const dotGit = join16(root, ".git");
     let gitdir;
     try {
       gitdir = statSync6(dotGit).isDirectory() ? dotGit : resolveWorktreeGitdir(root, dotGit);
@@ -36425,7 +36623,7 @@ function resolveGitBranch(cwd) {
       return void 0;
     }
     if (gitdir === void 0) return void 0;
-    const head = safeRead(join15(gitdir, "HEAD"));
+    const head = safeRead(join16(gitdir, "HEAD"));
     if (!head) return void 0;
     return /^ref:\s*refs\/heads\/(.+?)\s*$/m.exec(head)?.[1];
   } catch {
@@ -36435,37 +36633,37 @@ function resolveGitBranch(cwd) {
 function resolveWorktreeGitdir(root, dotGitFile) {
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGitFile) ?? "")?.[1];
   if (!target) return void 0;
-  return isAbsolute(target) ? target : join15(root, target);
+  return isAbsolute(target) ? target : join16(root, target);
 }
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync8(join15(dir, ".git"))) return dir;
+    if (existsSync9(join16(dir, ".git"))) return dir;
     const parent = dirname4(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join15(root, ".git");
+  const dotGit = join16(root, ".git");
   try {
     if (statSync6(dotGit).isDirectory()) {
-      return { configPath: join15(dotGit, "config"), headRoot: root };
+      return { configPath: join16(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join15(root, target);
-  if (existsSync8(join15(gitdir, "config"))) {
-    return { configPath: join15(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join16(root, target);
+  if (existsSync9(join16(gitdir, "config"))) {
+    return { configPath: join16(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join15(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join16(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join15(gitdir, commonRaw);
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join16(gitdir, commonRaw);
   const headRoot = basename3(commonGitDir) === ".git" ? dirname4(commonGitDir) : root;
-  return { configPath: join15(commonGitDir, "config"), headRoot };
+  return { configPath: join16(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
@@ -36531,31 +36729,31 @@ function resolveConfigInventory(input2) {
   };
   try {
     const home = input2.homeDir ?? homedir2();
-    const claudeDir = join16(home, ".claude");
+    const claudeDir = join17(home, ".claude");
     const repo = resolveRepoIdentity(input2.cwd);
     const repoIdentity = repo?.url ?? input2.cwd;
     const projectSource = `project:${repoIdentity}`;
-    collectSettingsHooks(scan2, join16(claudeDir, "settings.json"), "user");
-    collectSettingsHooks(scan2, join16(input2.cwd, ".claude", "settings.json"), "project");
-    collectSettingsHooks(scan2, join16(input2.cwd, ".claude", "settings.local.json"), "local");
+    collectSettingsHooks(scan2, join17(claudeDir, "settings.json"), "user");
+    collectSettingsHooks(scan2, join17(input2.cwd, ".claude", "settings.json"), "project");
+    collectSettingsHooks(scan2, join17(input2.cwd, ".claude", "settings.local.json"), "local");
     const projectOrigin = { scope: "project", project: repoIdentity };
-    collectMcpFile(scan2, join16(input2.cwd, ".mcp.json"), projectOrigin, { recordErrors: true });
-    collectUserClaudeJson(scan2, join16(home, ".claude.json"), input2.cwd, repoIdentity);
-    collectMcpFile(scan2, join16(claudeDir, "settings.json"), { scope: "user" });
-    collectMcpFile(scan2, join16(input2.cwd, ".claude", "settings.json"), projectOrigin);
-    collectMcpFile(scan2, join16(input2.cwd, ".claude", "settings.local.json"), {
+    collectMcpFile(scan2, join17(input2.cwd, ".mcp.json"), projectOrigin, { recordErrors: true });
+    collectUserClaudeJson(scan2, join17(home, ".claude.json"), input2.cwd, repoIdentity);
+    collectMcpFile(scan2, join17(claudeDir, "settings.json"), { scope: "user" });
+    collectMcpFile(scan2, join17(input2.cwd, ".claude", "settings.json"), projectOrigin);
+    collectMcpFile(scan2, join17(input2.cwd, ".claude", "settings.local.json"), {
       scope: "local",
       project: repoIdentity
     });
     collectConfigFiles(scan2, claudeDir, input2.cwd);
-    collectSkillsDir(scan2, join16(claudeDir, "skills"), { source: "local", scope: "user" });
-    collectSkillsDir(scan2, join16(input2.cwd, ".claude", "skills"), {
+    collectSkillsDir(scan2, join17(claudeDir, "skills"), { source: "local", scope: "user" });
+    collectSkillsDir(scan2, join17(input2.cwd, ".claude", "skills"), {
       source: projectSource,
       scope: "project"
     });
     collectInstalledPlugins(scan2, claudeDir);
     collectMarketplaceSkills(scan2, claudeDir);
-    collectSkillsDir(scan2, join16(input2.cwd, "skills"), { source: projectSource, scope: "project" });
+    collectSkillsDir(scan2, join17(input2.cwd, "skills"), { source: projectSource, scope: "project" });
     scan2.skills = dedupeSkills(scan2.skills);
     scan2.mcpServers = dedupeMcpServers(scan2.mcpServers);
   } catch (err) {
@@ -36684,7 +36882,7 @@ function projectEntryFor(projects, cwd) {
   return void 0;
 }
 function collectPluginManifestMcp(scan2, installPath, origin) {
-  const manifestPath = join16(installPath, ".claude-plugin", "plugin.json");
+  const manifestPath = join17(installPath, ".claude-plugin", "plugin.json");
   const raw = readOptional(manifestPath);
   if (raw === void 0) return;
   try {
@@ -36692,7 +36890,7 @@ function collectPluginManifestMcp(scan2, installPath, origin) {
     if (typeof parsed2 !== "object" || parsed2 === null) return;
     const declared = parsed2.mcpServers;
     if (typeof declared === "string" && declared.length > 0) {
-      collectMcpFile(scan2, join16(installPath, declared), origin, { recordErrors: true });
+      collectMcpFile(scan2, join17(installPath, declared), origin, { recordErrors: true });
     } else {
       collectMcpObject(scan2, declared, manifestPath, origin);
     }
@@ -36709,14 +36907,14 @@ var SETTINGS_KEY_LABELS = [
   ["statusLine", "status line"]
 ];
 function collectConfigFiles(scan2, claudeDir, cwd) {
-  settingsConfigFile(scan2, join16(claudeDir, "settings.json"), "user", "User settings");
-  settingsConfigFile(scan2, join16(cwd, ".claude", "settings.json"), "project", "Project settings");
-  settingsConfigFile(scan2, join16(cwd, ".claude", "settings.local.json"), "local", "Local overrides");
-  memoryConfigFile(scan2, join16(claudeDir, "CLAUDE.md"), "user", "User memory");
-  memoryConfigFile(scan2, join16(cwd, "CLAUDE.md"), "project", "Project memory");
-  mcpJsonConfigFile(scan2, join16(cwd, ".mcp.json"));
-  dirConfigFile(scan2, join16(cwd, ".claude", "commands"), "Slash commands", "command");
-  dirConfigFile(scan2, join16(cwd, ".claude", "agents"), "Subagents", "subagent");
+  settingsConfigFile(scan2, join17(claudeDir, "settings.json"), "user", "User settings");
+  settingsConfigFile(scan2, join17(cwd, ".claude", "settings.json"), "project", "Project settings");
+  settingsConfigFile(scan2, join17(cwd, ".claude", "settings.local.json"), "local", "Local overrides");
+  memoryConfigFile(scan2, join17(claudeDir, "CLAUDE.md"), "user", "User memory");
+  memoryConfigFile(scan2, join17(cwd, "CLAUDE.md"), "project", "Project memory");
+  mcpJsonConfigFile(scan2, join17(cwd, ".mcp.json"));
+  dirConfigFile(scan2, join17(cwd, ".claude", "commands"), "Slash commands", "command");
+  dirConfigFile(scan2, join17(cwd, ".claude", "agents"), "Subagents", "subagent");
 }
 function configFileEntry(path, scope, kind) {
   try {
@@ -36791,7 +36989,7 @@ function countMarkdownFiles(dir, depth) {
   let count = 0;
   for (const dirent of readdirSync2(dir, { withFileTypes: true })) {
     if (dirent.name.startsWith(".")) continue;
-    if (dirent.isDirectory()) count += countMarkdownFiles(join16(dir, dirent.name), depth + 1);
+    if (dirent.isDirectory()) count += countMarkdownFiles(join17(dir, dirent.name), depth + 1);
     else if (dirent.name.endsWith(".md")) count += 1;
   }
   return count;
@@ -36804,7 +37002,7 @@ function collectSkillsDir(scan2, dir, origin) {
     return;
   }
   for (const name2 of names) {
-    const skillFile = join16(dir, name2, "SKILL.md");
+    const skillFile = join17(dir, name2, "SKILL.md");
     try {
       const raw = readOptional(skillFile);
       if (raw === void 0) continue;
@@ -36813,7 +37011,7 @@ function collectSkillsDir(scan2, dir, origin) {
         name: front.name ?? name2,
         source: origin.source,
         scope: origin.scope,
-        location: join16(dir, name2),
+        location: join17(dir, name2),
         updatedAt: statSync7(skillFile).mtime.toISOString()
       };
       const version3 = front.version ?? origin.defaultVersion;
@@ -36844,7 +37042,7 @@ function parseFrontmatter(raw) {
   return out;
 }
 function collectInstalledPlugins(scan2, claudeDir) {
-  const manifestPath = join16(claudeDir, "plugins", "installed_plugins.json");
+  const manifestPath = join17(claudeDir, "plugins", "installed_plugins.json");
   const raw = readOptional(manifestPath);
   if (raw === void 0) return;
   let plugins;
@@ -36869,7 +37067,7 @@ function collectInstalledPlugins(scan2, claudeDir) {
       if (typeof installPath !== "string" || seen.has(installPath)) continue;
       seen.add(installPath);
       const version3 = install.version;
-      const hooksPath = join16(installPath, "hooks", "hooks.json");
+      const hooksPath = join17(installPath, "hooks", "hooks.json");
       const hooksRaw = readOptional(hooksPath);
       if (hooksRaw !== void 0) {
         try {
@@ -36889,22 +37087,22 @@ function collectInstalledPlugins(scan2, claudeDir) {
       }
       const origin = { source: marketplace, scope: "plugin", pluginName };
       if (typeof version3 === "string") origin.defaultVersion = version3;
-      collectSkillsDir(scan2, join16(installPath, "skills"), origin);
+      collectSkillsDir(scan2, join17(installPath, "skills"), origin);
       const mcpOrigin = { scope: "plugin", pluginName, marketplace };
-      collectMcpFile(scan2, join16(installPath, ".mcp.json"), mcpOrigin, { recordErrors: true });
+      collectMcpFile(scan2, join17(installPath, ".mcp.json"), mcpOrigin, { recordErrors: true });
       collectPluginManifestMcp(scan2, installPath, mcpOrigin);
     }
   }
 }
 function collectMarketplaceSkills(scan2, claudeDir) {
-  for (const mp of readMarketplaces(join16(claudeDir, "plugins", "known_marketplaces.json"))) {
+  for (const mp of readMarketplaces(join17(claudeDir, "plugins", "known_marketplaces.json"))) {
     if (isClaudeOfficialMarketplace(mp.name, mp.repo)) continue;
-    collectSkillsDir(scan2, join16(mp.installLocation, "skills"), {
+    collectSkillsDir(scan2, join17(mp.installLocation, "skills"), {
       source: mp.name,
       scope: "plugin"
     });
-    collectPluginSkillDirs(scan2, join16(mp.installLocation, "plugins"), mp.name);
-    collectPluginSkillDirs(scan2, join16(mp.installLocation, "external_plugins"), mp.name);
+    collectPluginSkillDirs(scan2, join17(mp.installLocation, "plugins"), mp.name);
+    collectPluginSkillDirs(scan2, join17(mp.installLocation, "external_plugins"), mp.name);
   }
 }
 function collectPluginSkillDirs(scan2, pluginsDir, marketplace) {
@@ -36915,7 +37113,7 @@ function collectPluginSkillDirs(scan2, pluginsDir, marketplace) {
     return;
   }
   for (const plugin of plugins) {
-    collectSkillsDir(scan2, join16(pluginsDir, plugin, "skills"), {
+    collectSkillsDir(scan2, join17(pluginsDir, plugin, "skills"), {
       source: marketplace,
       scope: "plugin",
       pluginName: plugin
@@ -37022,7 +37220,7 @@ function buildIngestEvent(input2) {
 }
 
 // ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 var ISOLATED_SCAN_BUDGET_MS = 2e3;
@@ -37036,7 +37234,7 @@ function resolveWorkerUrl() {
   for (const name2 of ["scan-worker.js", "scan-worker.ts"]) {
     const candidate = new URL(name2, import.meta.url);
     try {
-      if (existsSync9(fileURLToPath(candidate))) {
+      if (existsSync10(fileURLToPath(candidate))) {
         resolvedWorkerUrl = candidate;
         return candidate;
       }
@@ -37499,13 +37697,48 @@ function createGuardedScanner(partition, gateway, opts) {
   };
 }
 
+// ../../packages/plugin-sdk/src/host-floor.ts
+import { readFileSync as readFileSync12 } from "fs";
+import { join as join19 } from "path";
+
+// ../../packages/plugin-sdk/src/model-governance.ts
+import {
+  closeSync as closeSync2,
+  fstatSync,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync11,
+  readSync,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { join as join18 } from "path";
+var TAIL_BYTES = 256 * 1024;
+
+// ../../packages/plugin-sdk/src/host-floor.ts
+var HOST_FEATURE = {
+  ModelSwitch: "model-switch",
+  VaultPointerDisplay: "vault-pointer-display"
+};
+var HOST_FLOORS = {
+  [HOST_FEATURE.ModelSwitch]: {
+    label: "model-switch protection",
+    hookEvents: ["PreModelSwitch", "PostModelSwitch"],
+    since: "2.1.251"
+  },
+  [HOST_FEATURE.VaultPointerDisplay]: {
+    label: "vault pointer display",
+    hookEvents: ["MessageDisplay"],
+    since: "2.1.152"
+  }
+};
+
 // ../../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync11 } from "fs";
-import { join as join17 } from "path";
+import { readFileSync as readFileSync13 } from "fs";
+import { join as join20 } from "path";
 function readIgnoreLayer(dir, filename, anchorLen) {
   try {
-    return { matcher: (0, import_ignore.default)().add(readFileSync11(join17(dir, filename), "utf8")), anchorLen };
+    return { matcher: (0, import_ignore.default)().add(readFileSync13(join20(dir, filename), "utf8")), anchorLen };
   } catch {
     return void 0;
   }
@@ -37561,31 +37794,18 @@ function resolveInventoryContext(input2) {
   return ctx;
 }
 
-// ../../packages/plugin-sdk/src/model-governance.ts
-import {
-  closeSync as closeSync2,
-  fstatSync,
-  mkdirSync as mkdirSync2,
-  openSync as openSync2,
-  readFileSync as readFileSync12,
-  readSync,
-  writeFileSync as writeFileSync5
-} from "fs";
-import { join as join18 } from "path";
-var TAIL_BYTES = 256 * 1024;
-
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { join as join19 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import { join as join21 } from "path";
 var SESSION_START_MARKER = "session-start-last";
 function claimSessionStart(dataDir2, sessionId) {
   return claimOncePerSession(dataDir2, SESSION_START_MARKER, sessionId);
 }
 function claimOncePerSession(dataDir2, marker, sessionId) {
   if (!sessionId) return true;
-  const path = join19(dataDir2, marker);
+  const path = join21(dataDir2, marker);
   try {
-    if (readFileSync13(path, "utf8") === sessionId) return false;
+    if (readFileSync14(path, "utf8") === sessionId) return false;
   } catch {
   }
   try {
@@ -37636,8 +37856,8 @@ function createPolicyResolver(bundle) {
 }
 
 // ../../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync10, readdirSync as readdirSync4 } from "fs";
-import { basename as basename6, join as join20 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync4 } from "fs";
+import { basename as basename6, join as join22 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -37734,8 +37954,8 @@ function resolveProjectFiles(cwd, opts = {}) {
         }
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, dirRel, entry.name, true)) continue;
-          const fullPath = join20(dir, entry.name);
-          if (existsSync10(join20(fullPath, ".git"))) continue;
+          const fullPath = join22(dir, entry.name);
+          if (existsSync11(join22(fullPath, ".git"))) continue;
           if (depth >= bounds.maxDepth) {
             walk.omitted = true;
             continue;
@@ -37803,6 +38023,14 @@ var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID14 } from "crypto";
 var ENFORCEMENT_CEILING_ENABLED = false;
+function applyEnforcementCeiling(action, policyMode, enabled) {
+  if (!enabled || policyMode !== "warn") return action;
+  return action === "block" || action === "redact" ? "warn" : action;
+}
+function resolveEnforcedAction(action, opts) {
+  const degraded = !opts.rewritable && action === "redact" ? builtinPolicyToAction(opts.redactFallback) : action;
+  return applyEnforcementCeiling(degraded, opts.policyMode, opts.ceilingEnabled);
+}
 function startTiming() {
   try {
     return performance.now();
@@ -37911,12 +38139,12 @@ function createPluginRuntime(gateway, settings, opts) {
   }
   function actionForFinding(finding2, excepted, rewritable = true) {
     if (excepted?.has(finding2)) return "allow";
-    const action = resolveAction(finding2.ruleId, finding2.category);
-    if (!rewritable && action === "redact") return builtinPolicyToAction(redactFallback);
-    if (ENFORCEMENT_CEILING_ENABLED && policyMode === "warn" && (action === "block" || action === "redact")) {
-      return "warn";
-    }
-    return action;
+    return resolveEnforcedAction(resolveAction(finding2.ruleId, finding2.category), {
+      policyMode,
+      redactFallback,
+      rewritable,
+      ceilingEnabled: ENFORCEMENT_CEILING_ENABLED
+    });
   }
   function decide(findings, text, excepted, rewritable = true) {
     if (findings.length === 0) return { action: "log", text, findings: [] };
@@ -38165,9 +38393,9 @@ var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
 import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join21 } from "path";
+import { join as join23 } from "path";
 function throttled(dataDir2, markerName, windowMs) {
-  const marker = join21(dataDir2, markerName);
+  const marker = join23(dataDir2, markerName);
   try {
     if (Date.now() - statSync8(marker).mtimeMs < windowMs) return true;
   } catch {
@@ -38218,7 +38446,7 @@ function parseBreakerState(raw, nowMs) {
 }
 function createForwardPolicy(deps) {
   const now = deps.now ?? (() => Date.now());
-  const file2 = join22(deps.dir, STATE_FILENAME);
+  const file2 = join24(deps.dir, STATE_FILENAME);
   let state = null;
   let loading = null;
   async function readState() {
@@ -38940,8 +39168,8 @@ function toolAuditEvent(input2) {
 }
 
 // ../../packages/plugin-runtime/src/attached/history-state.ts
-import { readFileSync as readFileSync15 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync16 } from "fs";
+import { join as join25 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/history-sync.ts
 import { createHash as createHash6 } from "crypto";
@@ -38982,7 +39210,7 @@ function spawnDetached(scriptPath) {
 }
 
 // ../../packages/plugin-runtime/src/attached/plugin-block.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 function createPluginBlock(build, policyStore) {
   return async () => {
     const cached2 = await policyStore.read();
@@ -39001,7 +39229,7 @@ function createPluginBlock(build, policyStore) {
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 import { randomUUID as randomUUID16 } from "crypto";
 import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join26 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
@@ -39025,7 +39253,7 @@ async function publishByRename(tmp, file2, move = rename2) {
 
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 function createPolicyStore(dir = dataDir()) {
-  const file2 = join24(dir, "policy-cache.json");
+  const file2 = join26(dir, "policy-cache.json");
   async function read() {
     try {
       const raw = await readFile2(file2, "utf8");
@@ -39256,11 +39484,11 @@ function readStorePosture(dbPath2) {
 // ../../packages/plugin-runtime/src/attached/posture-store.ts
 import { randomUUID as randomUUID17 } from "crypto";
 import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join27 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function createPostureStore(dir = settingsDir(), legacyDir) {
-  const file2 = join25(dir, "posture-state.json");
-  const legacyFile = legacyDir === void 0 ? null : join25(legacyDir, "posture-state.json");
+  const file2 = join27(dir, "posture-state.json");
+  const legacyFile = legacyDir === void 0 ? null : join27(legacyDir, "posture-state.json");
   async function persist(state) {
     await ensureDataDir(dir);
     const tmp = `${file2}.${randomUUID17()}.tmp`;
@@ -39328,8 +39556,8 @@ function createPostureStore(dir = settingsDir(), legacyDir) {
 }
 
 // ../../packages/plugin-runtime/src/attached/sync-state.ts
-import { readFileSync as readFileSync17 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync18 } from "fs";
+import { join as join28 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/status.ts
 var REFUSAL_LINES = {