@akasecurity/cli 0.9.12 → 0.9.13

package/native-host/host.js

@@ -492,6 +492,7 @@ var require_ignore = __commonJS({
 });
 
 // src/native-host/host.ts
+import { randomUUID as randomUUID20 } from "crypto";
 import { homedir as homedir3 } from "os";
 
 // ../../packages/persistence/src/attached-derived.ts
@@ -3458,12 +3459,12 @@ var $ZodEmail = /* @__PURE__ */ $constructor("$ZodEmail", (inst, def) => {
 });
 var URL_BAD_FORMAT = 1;
 var URL_UNPARSEABLE = 2;
-function parseURLObject(trimmed, def) {
-  if (!def.normalize && def.protocol?.source === httpProtocol.source && !/^https?:\/\//i.test(trimmed)) {
+function parseURLObject(trimmed2, def) {
+  if (!def.normalize && def.protocol?.source === httpProtocol.source && !/^https?:\/\//i.test(trimmed2)) {
     return URL_BAD_FORMAT;
   }
   try {
-    return new URL(trimmed);
+    return new URL(trimmed2);
   } catch {
     return URL_UNPARSEABLE;
   }
@@ -3484,8 +3485,8 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
   $ZodStringFormat.init(inst, def);
   inst._zod.check = (payload) => {
     try {
-      const trimmed = payload.value.trim();
-      const url2 = parseURLObject(trimmed, def);
+      const trimmed2 = payload.value.trim();
+      const url2 = parseURLObject(trimmed2, def);
       if (url2 === URL_BAD_FORMAT) {
         payload.issues.push({
           code: "invalid_format",
@@ -3529,7 +3530,7 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
           continue: !def.abort
         });
       }
-      payload.value = def.normalize ? url2.href : stripTabAndNewline(trimmed);
+      payload.value = def.normalize ? url2.href : stripTabAndNewline(trimmed2);
       return;
     } catch (_) {
       payload.issues.push({
@@ -20481,7 +20482,17 @@ var UNPRICEABLE_PROVIDERS = Object.freeze([
   "gateway",
   "unknown",
   "cli",
-  "api"
+  "api",
+  // The browser extension's native host records these as `llm_call.provider`
+  // for a web-chat turn — the web tool id, deliberately never the vendor id
+  // (`openai`/`anthropic`) the session root carries. Subscription traffic
+  // burns rate-limit budget, not dollar credits, and listing them here is
+  // what keeps that true structurally: a later maintainer who wants to price
+  // web-chat traffic at API rates has to delete this entry first, and meet
+  // the reason on the way, rather than quietly adding one to
+  // PROVIDER_PLATFORM.
+  "chatgpt",
+  "claude-ai"
 ]);
 function platformForProvider(provider) {
   return PROVIDER_PLATFORM.get(provider.trim().toLowerCase()) ?? null;
@@ -20624,7 +20635,12 @@ var HARNESS = {
   ClaudeDesktop: "claudedesktop",
   ChatGpt: "chatgpt",
   ClaudeAi: "claudeai",
-  Api: "api"
+  Api: "api",
+  // Not a coding assistant a person drives — an in-process SDK embedded in an
+  // application, so it has no IDE/CLI/desktop/web surface of its own. Carries
+  // the same id as its SOURCE_TOOL counterpart, unlike every capture-side tool
+  // whose wire spelling differs from its display spelling.
+  AiTcSdk: "ai-tc-sdk"
 };
 var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
 var SOURCE_TOOL = {
@@ -20640,9 +20656,15 @@ var SOURCE_TOOL = {
   // whose tool could not be identified both render through the read side's
   // miss path rather than as a harness of their own.
   Cli: "cli",
-  Unknown: "unknown"
+  Unknown: "unknown",
+  // The wire id an in-process, request-path SDK stamps on its own structural
+  // rows (`request_decision`) — never a capture of prompt/response/tool text,
+  // since the SDK sits in front of a model call rather than inside a coding
+  // assistant's own hook contract.
+  AiTcSdk: "ai-tc-sdk"
 };
 var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var WebSourceTool = SourceTool.extract(["ChatGpt", "ClaudeAi"]);
 var TOOL_TO_HARNESS = {
   [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
   [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
@@ -20651,7 +20673,12 @@ var TOOL_TO_HARNESS = {
   [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
   [SOURCE_TOOL.Codex]: HARNESS.Codex,
   [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
-  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi,
+  // Wire and display id are the same string here, but the row still belongs:
+  // both vocabularies carry the `AiTcSdk` member, and the join is exactly
+  // their intersection — leaving a shared member out would read as an
+  // uninstrumented tool on both surfaces, which this one is not.
+  [SOURCE_TOOL.AiTcSdk]: HARNESS.AiTcSdk
 };
 function harnessFromTool(tool) {
   return (Object.hasOwn(TOOL_TO_HARNESS, tool) ? TOOL_TO_HARNESS[tool] : void 0) ?? tool;
@@ -20688,7 +20715,8 @@ var FindingProvider = Harness.extract([
   "ClaudeAi",
   "Codex",
   "Antigravity",
-  "Api"
+  "Api",
+  "AiTcSdk"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
@@ -21065,18 +21093,41 @@ var AuditEventType = external_exports.enum([
   // 'tool_call' is the reconciler's structural row for every call, while
   // 'tool_use' exists only where a hook enforced against the arguments.
   "tool_use",
-  // One row per model REFUSAL: a switch onto a prohibited model that was
-  // denied, or a turn refused because the session was already running on one.
-  // A structural row like the ones above rather than a capture — it carries
-  // the model that was refused and nothing the user typed, because what is
-  // worth recording about a governance decision is the decision, and prompt
-  // text is the thing this product exists to keep from travelling.
+  // One row per model REFUSAL, across all four seams a prohibited model can be
+  // stopped at: a switch onto it, a turn already running on it, a subagent
+  // spawn asking for it, or a request-path refusal an embedded request-path
+  // SDK makes in-process before the call leaves the application. Which seam
+  // rides `attributes.refusal_seam`, never this member name. A structural row
+  // like the ones above rather than a capture — it carries the model that was
+  // refused and nothing the user typed, because what is worth recording about
+  // a governance decision is the decision, and prompt text is the thing this
+  // product exists to keep from travelling.
   "model_refusal",
+  // One row per request-path DECISION: a policy check an embedded request-path
+  // SDK performs in-process before a model call leaves the application, or
+  // against that call's non-streamed response. A structural row like
+  // 'model_refusal' rather than a capture — content-free in the same way:
+  // which side, which seam, what action and which field are decided rides
+  // `attributes`, never this member name, and the matched text itself never
+  // travels.
+  //
+  // A prohibited-model refusal on the request path is deliberately NOT this
+  // member: it stays 'model_refusal' with `refusal_seam: 'request'`, so it
+  // shares one bucket with the plugin's switch/turn/spawn refusals rather
+  // than splitting one governance concept across two event types. This
+  // member carries every OTHER request-path decision.
+  "request_decision",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
   // surface renders.
-  "config_scan"
+  "config_scan",
+  // One row per reported browser-extension capture status, hung off the web
+  // session root. The durable home of what one tab's network interception
+  // is doing — a write-through of the native host's in-memory tracker, so a
+  // second process (aka extension status) and a restarted host both have
+  // somewhere to read it back from.
+  "capture_status"
 ]).meta({ id: "AuditEventType" });
 var AttributeBag = external_exports.record(external_exports.string(), external_exports.unknown());
 var HostAttributes = external_exports.object({
@@ -21236,6 +21287,20 @@ var CaptureAttributes = external_exports.object({
   // repeated rather than referenced because a store reader opens this file.
   redact_degraded_to: ActionTaken.optional()
 }).catchall(external_exports.unknown());
+var CaptureStatusAttributes = external_exports.object({
+  source_tool: external_exports.string().optional(),
+  patched: external_exports.boolean().optional(),
+  live: external_exports.boolean().optional(),
+  blind: external_exports.boolean().optional(),
+  sends_seen_dom: external_exports.number().int().nonnegative().optional(),
+  exchanges_seen_net: external_exports.number().int().nonnegative().optional(),
+  parse_failures: external_exports.number().int().nonnegative().optional(),
+  unparsed_bodies: external_exports.number().int().nonnegative().optional(),
+  shape_misses: external_exports.array(external_exports.string()).optional(),
+  conversation_endpoints: external_exports.number().int().nonnegative().optional(),
+  closed: external_exports.boolean().optional(),
+  enforcement: external_exports.string().optional()
+}).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
   ruleName: external_exports.string(),
@@ -22209,6 +22274,30 @@ var AttachedCredential = external_exports.object({
   keyPrefix: external_exports.string().min(1).max(16).optional(),
   mintedAt: external_exports.iso.datetime().optional()
 });
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function unsafeEndpointReason(endpoint) {
+  let parsed2;
+  try {
+    parsed2 = new URL(endpoint);
+  } catch {
+    return "unparseable";
+  }
+  if (parsed2.username !== "" || parsed2.password !== "") return "userinfo";
+  if (parsed2.search !== "" || parsed2.hash !== "") return "query-or-fragment";
+  if (parsed2.protocol === "https:") return null;
+  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname) ? null : "insecure";
+}
+function isSafeEndpoint(endpoint) {
+  return unsafeEndpointReason(endpoint) === null;
+}
+function originOnly(endpoint) {
+  try {
+    const parsed2 = new URL(endpoint);
+    return `${parsed2.protocol}//${parsed2.host}`;
+  } catch {
+    return "(unparseable endpoint)";
+  }
+}
 var MAX_DATE_MS = 253402300799999;
 var MAX_INT4 = 2147483647;
 var StorePosturePack = external_exports.object({
@@ -22363,6 +22452,11 @@ var RemoteFailureKind = external_exports.enum([
   "rejected",
   "unreachable"
 ]);
+var ControlPlaneFailure = RemoteFailureKind.extract([
+  "unauthorized",
+  "forbidden",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -22902,7 +22996,12 @@ var EventMetadata = external_exports.object({
   // in — set by the browser extension's network capture so a stored `response`
   // row can be joined to the `llm_call` leaf describing the same turn. Absent
   // on every other capture path, which has no such id.
-  messageId: external_exports.string().optional(),
+  //
+  // Non-empty for the reason WebExchange.messageId is: it is the join key, and
+  // a blank one matches no `llm_call` leaf. That refusal reaches only the
+  // places an event is PARSED; the local write path types the event and parses
+  // nothing, which is why `toCaptureAttributes` omits a blank one separately.
+  messageId: external_exports.string().min(1).optional(),
   conversationId: external_exports.string().optional(),
   // How long THIS capture's inspection blocked its caller, in whole
   // milliseconds — the plugin's own added latency, NOT the LLM call it sat in
@@ -23749,6 +23848,85 @@ function policyIdIsReversible(policyId) {
 var DEFAULT_ACTIONS = Object.fromEntries(
   DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
 );
+function ruleCategoryMap(wireRules, localRules, compiledRules) {
+  const map2 = /* @__PURE__ */ new Map();
+  for (const rule of wireRules ?? []) map2.set(rule.id, rule.category);
+  for (const rule of localRules ?? []) map2.set(rule.id, rule.category);
+  for (const rule of compiledRules) map2.set(rule.id, rule.category);
+  return map2;
+}
+function policyKey(policy) {
+  return "ruleId" in policy.target ? `rule:${policy.target.ruleId}` : `category:${policy.target.category}`;
+}
+function floorFor(policy, categoryByRuleId) {
+  const category = "category" in policy.target ? policy.target.category : categoryByRuleId.get(policy.target.ruleId);
+  return category === void 0 ? null : DEFAULT_ACTIONS[category];
+}
+function strongerOf(a, b) {
+  if (a === null) return b;
+  if (b === null) return a;
+  return strongerAction(a, b);
+}
+function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
+  const merged = /* @__PURE__ */ new Map();
+  const disabled = [];
+  const remoteCategoryAction = /* @__PURE__ */ new Map();
+  for (const policy of remotePolicies) {
+    if (!policy.enabled) continue;
+    if (!("category" in policy.target)) continue;
+    if (remoteCategoryAction.has(policy.target.category)) continue;
+    const floor = floorFor(policy, categoryByRuleId);
+    remoteCategoryAction.set(
+      policy.target.category,
+      floor !== null && !isActionAtLeast(policy.action, floor) ? floor : policy.action
+    );
+  }
+  for (const policy of localPolicies) {
+    if (!policy.enabled) {
+      disabled.push(policy);
+      continue;
+    }
+    const key = policyKey(policy);
+    if (merged.has(key)) continue;
+    let remoteFloor = null;
+    if ("ruleId" in policy.target) {
+      const category = categoryByRuleId.get(policy.target.ruleId);
+      if (category !== void 0) remoteFloor = remoteCategoryAction.get(category) ?? null;
+    }
+    merged.set(
+      key,
+      remoteFloor !== null && !isActionAtLeast(policy.action, remoteFloor) ? { ...policy, action: remoteFloor } : policy
+    );
+  }
+  const localCategoryAction = /* @__PURE__ */ new Map();
+  for (const policy of merged.values()) {
+    if ("category" in policy.target) localCategoryAction.set(policy.target.category, policy.action);
+  }
+  for (const policy of remotePolicies) {
+    if (!policy.enabled) {
+      disabled.push(policy);
+      continue;
+    }
+    const key = policyKey(policy);
+    const floor = floorFor(policy, categoryByRuleId);
+    let localFloor = null;
+    if ("ruleId" in policy.target) {
+      const category = categoryByRuleId.get(policy.target.ruleId);
+      if (category !== void 0) localFloor = localCategoryAction.get(category) ?? null;
+    }
+    const effectiveFloor = strongerOf(floor, localFloor);
+    const clamped = effectiveFloor !== null && !isActionAtLeast(policy.action, effectiveFloor) ? { ...policy, action: effectiveFloor } : policy;
+    const existing = merged.get(key);
+    if (existing === void 0) {
+      merged.set(key, clamped);
+      continue;
+    }
+    if (actionRank(clamped.action) > actionRank(existing.action)) {
+      merged.set(key, clamped);
+    }
+  }
+  return [...merged.values(), ...disabled];
+}
 var BUILTIN_POLICIES = Object.fromEntries(
   KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
 );
@@ -23979,6 +24157,22 @@ function isHistorySyncConsentValid(consent, endpoint) {
   if (consent === void 0 || endpoint === void 0) return false;
   return consent.payloadVersion === HISTORY_SYNC_PAYLOAD_VERSION && consent.endpoint === endpoint;
 }
+var WEB_CHAT_CAPTURE_CONSENT_VERSION = 1;
+var WebChatCaptureConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  version: external_exports.number().int().positive()
+});
+var WebChatResponseCapture = external_exports.enum(["with-findings", "always", "never"]);
+var WebChatCapture = external_exports.object({
+  responses: WebChatResponseCapture.default("with-findings"),
+  account: external_exports.boolean().default(false),
+  // Absent until granted. Presence alone does not authorize anything — see
+  // isWebChatCaptureConsentValid.
+  consent: WebChatCaptureConsent.optional()
+});
+function isWebChatCaptureConsentValid(consent) {
+  return consent?.version === WEB_CHAT_CAPTURE_CONSENT_VERSION;
+}
 var BODY_RETENTION_DEFAULT_DAYS = 30;
 var BodyRetention = external_exports.object({
   enabled: external_exports.boolean().default(false),
@@ -24037,6 +24231,16 @@ var WorkspaceSettings = external_exports.object({
   // both widenings. Absent until granted, and a grant for a different endpoint
   // or an older payload no longer counts.
   historySyncConsent: HistorySyncConsent.optional(),
+  // What the browser extension may record from a web chat, and the grant that
+  // authorizes it. Absent until the user answers: recording something that was
+  // never recorded before is never an assumed grant on upgrade, so the whole
+  // block is optional rather than defaulted in. What an absent block means is
+  // webChatCaptureOf's answer, in one place.
+  //
+  // Enforcement is NOT gated on this. A machine that has never answered still
+  // blocks, redacts and warns on what a user sends; the grant covers what is
+  // written down.
+  webChatCapture: WebChatCapture.optional(),
   // Local body expiry (see BodyRetention). Off until switched on; expiring a
   // body never removes the row or its findings.
   bodyRetention: BodyRetention.default({
@@ -24047,6 +24251,9 @@ var WorkspaceSettings = external_exports.object({
 function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
 }
+function webChatCaptureOf(settings) {
+  return settings.webChatCapture ?? WebChatCapture.parse({});
+}
 function isAttached(settings) {
   return settings.runMode === "attached" && settings.controlPlane !== void 0;
 }
@@ -24144,7 +24351,10 @@ function toCaptureAttributes(event) {
     // `.catchall(z.unknown())` carries the long tail.
     ...metadata?.model !== void 0 ? { model: metadata.model } : {},
     ...metadata?.turnIndex !== void 0 ? { turn_index: metadata.turnIndex } : {},
-    ...metadata?.messageId !== void 0 ? { message_id: metadata.messageId } : {},
+    // A blank id is omitted rather than stored: it is a join key and `''` joins
+    // nothing. This runs on the local write path, which types the event but
+    // never parses it, so EventMetadata's own `.min(1)` does not reach here.
+    ...metadata?.messageId !== void 0 && metadata.messageId !== "" ? { message_id: metadata.messageId } : {},
     ...metadata?.conversationId !== void 0 ? { conversation_id: metadata.conversationId } : {}
   };
 }
@@ -24518,12 +24728,14 @@ var RecommendedActionIdParam = external_exports.object({ id: external_exports.st
 // ../../packages/schema/src/zod/settings-action.ts
 var HistorySyncConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "HistorySyncConsentChoice" });
 var ModelJudgeConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "ModelJudgeConsentChoice" });
+var WebChatCaptureConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "WebChatCaptureConsentChoice" });
 var SaveSettingsInput = external_exports.object({
   historicalAccess: external_exports.string(),
   modelJudgeConsent: ModelJudgeConsentChoice,
   historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
   vaultInlineReveal: external_exports.string(),
+  webChatCaptureConsent: WebChatCaptureConsentChoice,
   // Widened to `string` like its neighbours rather than typed as
   // `RedactFallback`, on this module's own layering rule: shape here, VALUE at
   // the call site, so the domain check receives the type it was written for.
@@ -24738,11 +24950,24 @@ var WebExchange = external_exports.object({
   turnIndex: external_exports.number().int().nonnegative().optional(),
   toolCalls: external_exports.array(WebToolCall).default([]),
   // Absent when the adapter recovered no text. Capped by the caller at
-  // RESPONSE_TEXT_MAX_BYTES; `truncated` records that the cap was reached, so a
-  // short capture is never mistaken for a short reply.
+  // RESPONSE_TEXT_MAX_BYTES, so a short capture is never mistaken for a short
+  // reply.
   responseText: external_exports.string().optional(),
+  // The stored text is short of the reply. It does NOT say which of the two
+  // ceilings on this path cut it: the caller applies its own cap on the raw
+  // bytes it reads off the wire, which can be reached by a stream whose
+  // recovered text stays well under RESPONSE_TEXT_MAX_BYTES, and applies that
+  // one to the text. A reader cannot tell them apart, and nothing downstream
+  // should branch as though it could.
   truncated: external_exports.boolean().default(false)
 });
+var WebEnforcementState = external_exports.enum([
+  "watching",
+  "composer-only",
+  "button-only",
+  "unattached",
+  "unknown"
+]);
 var RESPONSE_TEXT_MAX_BYTES = 2 * 1024 * 1024;
 var WebCaptureStatus = external_exports.object({
   patched: external_exports.boolean(),
@@ -24754,8 +24979,82 @@ var WebCaptureStatus = external_exports.object({
   unparsedBodies: external_exports.number().int().nonnegative(),
   // The adapter-declared JSON key paths that were absent from a real payload —
   // the earliest signal that a site's contract moved.
-  shapeMisses: external_exports.array(external_exports.string()).default([])
-});
+  shapeMisses: external_exports.array(external_exports.string()).default([]),
+  // How many `kind: 'conversation'` endpoints the reporting tab's adapter
+  // compiled. Zero means this build declares none for the site, so observing
+  // nothing is the design rather than a fault — the one fact that separates a
+  // site nobody has surveyed yet from one whose contract moved. Defaulted so a
+  // build predating the field is read as declaring nothing rather than refused.
+  conversationEndpoints: external_exports.number().int().nonnegative().default(0),
+  // The document that sent this report is going away. The bridge sets it on
+  // its `pagehide` report and nowhere else.
+  //
+  // A property of the REPORT rather than of capture health, which is why
+  // nothing in `deriveWebCaptureState` reads it and why it stays out of the
+  // bridge's own report signature — a closing tab's last word must not be
+  // suppressed for carrying the same health as the report before it. What
+  // reads it is the per-site fold: a document that said it was unloading stops
+  // voting on the site's state, so the reload the `blind` remediation asks for
+  // can actually clear the verdict it was shown. A document that dies without
+  // sending one is covered by CAPTURE_STATUS_DOCUMENT_QUIET_MS instead.
+  //
+  // Defaulted so a build predating the field reads as a document that never
+  // said it was closing — which keeps it voting, the same as every report that
+  // is not a final one.
+  closed: external_exports.boolean().default(false),
+  // What the DOM enforcement path is doing, which none of the counters above
+  // can say: `sendsSeenDom` rises only once a send has COMPLETED, so a tab
+  // whose watcher never bound reports zero exactly like a tab nobody typed in.
+  // Defaulted to 'unknown' rather than 'watching' so a status from a build
+  // predating the field is not read as reporting a healthy one.
+  enforcement: WebEnforcementState.default("unknown")
+});
+function webCaptureStatusObservedTurnPath(status) {
+  if (!status.patched) return true;
+  if (status.conversationEndpoints === 0) return true;
+  return status.blind || status.shapeMisses.length > 0 || status.parseFailures > 0 || status.unparsedBodies > 0 || status.exchangesSeenNet > 0;
+}
+function pickReportedCaptureStatus(candidates) {
+  return candidates.find((c) => webCaptureStatusObservedTurnPath(c.status)) ?? candidates[0];
+}
+var CAPTURE_STATUS_RECENCY_MS = 30 * 24 * 60 * 60 * 1e3;
+var CAPTURE_STATUS_RECENCY_DAYS = CAPTURE_STATUS_RECENCY_MS / (24 * 60 * 60 * 1e3);
+var CAPTURE_STATUS_DOCUMENT_QUIET_MS = 12 * 60 * 60 * 1e3;
+function toCaptureStatusAttributes(status, tool) {
+  return {
+    source_tool: tool,
+    patched: status.patched,
+    live: status.live,
+    blind: status.blind,
+    sends_seen_dom: status.sendsSeenDom,
+    exchanges_seen_net: status.exchangesSeenNet,
+    parse_failures: status.parseFailures,
+    unparsed_bodies: status.unparsedBodies,
+    shape_misses: status.shapeMisses,
+    conversation_endpoints: status.conversationEndpoints,
+    closed: status.closed,
+    enforcement: status.enforcement
+  };
+}
+function fromCaptureStatusAttributes(bag) {
+  const parsedBag = CaptureStatusAttributes.safeParse(bag);
+  if (!parsedBag.success) return null;
+  const b = parsedBag.data;
+  const parsedStatus = WebCaptureStatus.safeParse({
+    patched: b.patched,
+    live: b.live,
+    blind: b.blind,
+    sendsSeenDom: b.sends_seen_dom,
+    exchangesSeenNet: b.exchanges_seen_net,
+    parseFailures: b.parse_failures,
+    unparsedBodies: b.unparsed_bodies,
+    shapeMisses: b.shape_misses,
+    conversationEndpoints: b.conversation_endpoints,
+    closed: b.closed,
+    enforcement: b.enforcement
+  });
+  return parsedStatus.success ? parsedStatus.data : null;
+}
 
 // ../../packages/persistence/src/paths.ts
 import {
@@ -24886,17 +25185,6 @@ function publishByLink(tmp, file2, data) {
 function controlPlaneCredentialPath(settingsDir2) {
   return join2(settingsDir2, ATTACHED_CREDENTIAL_FILENAME);
 }
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
-function isSafeEndpoint(endpoint) {
-  let parsed2;
-  try {
-    parsed2 = new URL(endpoint);
-  } catch {
-    return false;
-  }
-  if (parsed2.protocol === "https:") return true;
-  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname);
-}
 function repairOrRefuseMode(file2) {
   const link = lstatSync2(file2, { throwIfNoEntry: false });
   if (link === void 0) return "absent";
@@ -26693,7 +26981,7 @@ var SESSION_ROOT = `event_type = 'session'`;
 var HAS_ACTIVITY = `EXISTS (
   SELECT 1 FROM audit_events c
   WHERE c.root_session_id = audit_events.id
-    AND c.event_type NOT IN ('hook', 'config_scan'))`;
+    AND c.event_type NOT IN ('hook', 'config_scan', 'capture_status'))`;
 var SqliteActivityRepository = class {
   constructor(db, now = () => Date.now()) {
     this.db = db;
@@ -26720,10 +27008,10 @@ var SqliteActivityRepository = class {
                SELECT id FROM audit_events WHERE event_type = 'session' AND started_at >= ?
                UNION
                SELECT root_session_id FROM audit_events INDEXED BY idx_audit_started_at
-                WHERE started_at >= ?
+                WHERE started_at >= ? AND event_type <> 'capture_status'
                UNION
                SELECT root_session_id FROM audit_events INDEXED BY idx_audit_ended_at
-                WHERE ended_at >= ?)`,
+                WHERE ended_at >= ? AND event_type <> 'capture_status')`,
       [liveThreshold, liveThreshold, liveThreshold]
     );
     const toolCallsToday = countScalar(
@@ -27130,7 +27418,10 @@ var SqliteAuditEventsRepository = class {
          attributes = excluded.attributes,
          ended_at   = excluded.ended_at
        WHERE COALESCE(json_extract(excluded.attributes, '$.output_tokens'), 0)
-           > COALESCE(json_extract(audit_events.attributes, '$.output_tokens'), 0)`
+           > COALESCE(json_extract(audit_events.attributes, '$.output_tokens'), 0)
+          OR (json_extract(excluded.attributes, '$.usage_source') IS NOT NULL
+              AND json_extract(excluded.attributes, '$.output_tokens') IS NULL
+              AND excluded.attributes <> audit_events.attributes)`
     );
     this.upsertSessionRootStmt = db.prepare(
       `INSERT OR IGNORE INTO audit_events
@@ -27398,6 +27689,87 @@ var SqliteBodyRetentionRepository = class {
   }
 };
 
+// ../../packages/persistence/src/repositories/capture-status.ts
+var STATUS_LOOKBACK_ROWS = 128;
+var SqliteCaptureStatusRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.recentStmt = db.prepare(
+      `SELECT a.started_at AS startedAt,
+              a.attributes AS attributes,
+              a.root_session_id AS rootSessionId
+         FROM audit_events a
+        WHERE a.event_type = 'capture_status'
+          AND a.source_tool = ?
+          AND a.started_at >= ?
+        ORDER BY a.started_at DESC, a.id DESC
+        LIMIT ?`
+    );
+  }
+  db;
+  recentStmt;
+  /**
+   * Every document that reported for a site, in registry order by site, from
+   * the last `CAPTURE_STATUS_RECENCY_MS`.
+   *
+   * SEVERAL per site, not one: a browser is many documents and each reports
+   * for itself, so one row per site is a choice about which of them a user
+   * sees — and the newest is the wrong one, since a healthy tab writing a
+   * fresh report would hide a drifting tab's verdict, which is the whole
+   * reason these rows exist. The pick WITHIN a document is made here (the
+   * unchanged `pickReportedCaptureStatus`, over that document's own rows);
+   * choosing between documents belongs where the state semantics live, and
+   * that is `reportedCaptureDocumentForSite` in `@akasecurity/detections` —
+   * this package may not import it.
+   *
+   * `now` is a required argument rather than a `Date.now()` read, so a caller
+   * that already holds a render instant passes THAT one and a test can drive
+   * the window without moving the wall clock.
+   *
+   * A site whose reports have all aged out contributes nothing, so it derives
+   * to `unreported`. That is the point: nothing but the browser extension ever
+   * writes these rows, so an uninstalled extension's last verdict would
+   * otherwise stand as a live claim for ever with no later report able to
+   * clear it.
+   */
+  latest(now) {
+    const since = now - CAPTURE_STATUS_RECENCY_MS;
+    const documents = [];
+    for (const tool of WebSourceTool.options) {
+      const rows = /* @__PURE__ */ new Map();
+      const lastWord = /* @__PURE__ */ new Map();
+      for (const row of allRows(this.recentStmt, [
+        tool,
+        since,
+        STATUS_LOOKBACK_ROWS
+      ])) {
+        const status = fromCaptureStatusAttributes(parseJsonObject(row.attributes));
+        if (status === null) continue;
+        const record2 = { tool, observedAt: epochMillisToIso(row.startedAt), status };
+        const group = rows.get(row.rootSessionId);
+        if (group === void 0) {
+          rows.set(row.rootSessionId, [record2]);
+          lastWord.set(row.rootSessionId, { at: record2.observedAt, closed: status.closed });
+        } else {
+          group.push(record2);
+        }
+      }
+      for (const [root, candidates] of rows) {
+        const picked = pickReportedCaptureStatus(candidates);
+        const last = lastWord.get(root);
+        if (picked === void 0 || last === void 0) continue;
+        documents.push({
+          ...picked,
+          ...root === null ? {} : { rootSessionId: root },
+          lastReportAt: last.at,
+          closed: last.closed
+        });
+      }
+    }
+    return documents;
+  }
+};
+
 // ../../packages/persistence/src/repositories/classified-data.ts
 var SqliteClassifiedDataRepository = class {
   constructor(db) {
@@ -32975,6 +33347,7 @@ function openAndInitialize(file2, base, skipTags) {
       activity: new SqliteActivityRepository(db),
       sourceProject: new SqliteSourceProjectRepository(db),
       auditEvents: new SqliteAuditEventsRepository(db),
+      captureStatus: new SqliteCaptureStatusRepository(db),
       classifiedData: new SqliteClassifiedDataRepository(db),
       inspectionDefinitions: new SqliteInspectionDefinitionsRepository(db),
       inspectionFindings: new SqliteInspectionFindingsRepository(db),
@@ -33015,6 +33388,7 @@ function openLocalDatabase(dir, options = {}) {
     activity,
     sourceProject,
     auditEvents,
+    captureStatus,
     classifiedData,
     inspectionDefinitions,
     inspectionFindings,
@@ -33232,6 +33606,7 @@ function openLocalDatabase(dir, options = {}) {
     activity,
     sourceProject,
     auditEvents,
+    captureStatus,
     classifiedData,
     inspectionDefinitions,
     inspectionFindings,
@@ -33274,12 +33649,12 @@ function trimSlashes(path) {
   return path.slice(start, end);
 }
 function canonicalGitUrl(url2) {
-  const trimmed = url2.trim();
-  if (DOS_DRIVE.test(trimmed) || FILE_URL.test(trimmed)) return trimmed;
-  const scheme = SCHEME_FORM.exec(trimmed);
-  const scp = scheme === null ? SCP_FORM.exec(trimmed) : null;
+  const trimmed2 = url2.trim();
+  if (DOS_DRIVE.test(trimmed2) || FILE_URL.test(trimmed2)) return trimmed2;
+  const scheme = SCHEME_FORM.exec(trimmed2);
+  const scp = scheme === null ? SCP_FORM.exec(trimmed2) : null;
   const host = (scheme?.[1] ?? scp?.[1])?.toLowerCase();
-  if (host === void 0) return trimmed;
+  if (host === void 0) return trimmed2;
   const path = (scheme === null ? scp?.[2] : scheme[2]) ?? "";
   const bare = trimSlashes(path);
   const cleaned = bare.endsWith(GIT_SUFFIX) ? bare.slice(0, -GIT_SUFFIX.length) : bare;
@@ -33457,11 +33832,6 @@ function fingerprintValue(key, raw) {
 // ../../packages/persistence/src/forward-health.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { join as join9 } from "path";
-var FAILURES = /* @__PURE__ */ new Set([
-  "unauthorized",
-  "forbidden",
-  "unreachable"
-]);
 var BREAKER_COOLDOWN_MS = 3e4;
 function parseForwardHealth(raw, nowMs) {
   try {
@@ -33470,7 +33840,8 @@ function parseForwardHealth(raw, nowMs) {
     const record2 = parsed2;
     const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
     const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
-    const lastFailure = typeof record2.lastFailure === "string" && FAILURES.has(record2.lastFailure) ? record2.lastFailure : null;
+    const parsedFailure = ControlPlaneFailure.safeParse(record2.lastFailure);
+    const lastFailure = parsedFailure.success ? parsedFailure.data : null;
     return { consecutiveFailures: failures, openedAtMs, lastFailure };
   } catch {
     return null;
@@ -33560,6 +33931,12 @@ var RemoteRequestInvalid = class extends Error {
   }
   cause;
 };
+var RemoteEndpointRefused = class extends Error {
+  constructor(endpoint) {
+    super(`refusing to talk to an unsafe control-plane endpoint: ${originOnly(endpoint)}`);
+    this.name = "RemoteEndpointRefused";
+  }
+};
 var RemoteResponseInvalid = class extends Error {
   constructor(route, detail) {
     super(`control plane answered ${route} with ${detail}`);
@@ -33712,14 +34089,15 @@ function parsed(schema, body, route) {
   }
   return result.data;
 }
-function withoutTrailingSlashes(endpoint) {
+function resolveBaseUrl(endpoint) {
+  if (!isSafeEndpoint(endpoint)) throw new RemoteEndpointRefused(endpoint);
   let end = endpoint.length;
   while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH2) end -= 1;
   return endpoint.slice(0, end);
 }
 var SLASH2 = "/".charCodeAt(0);
 function createRemoteClient(options) {
-  const base = withoutTrailingSlashes(options.endpoint);
+  const base = resolveBaseUrl(options.endpoint);
   const url2 = (route) => `${base}${route}`;
   const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
   const sendOne = async (event) => {
@@ -33849,6 +34227,7 @@ function classifyRemoteFailure(err) {
     case "RemoteRouteAbsent":
       return "route-absent";
     case "RemoteRequestInvalid":
+    case "RemoteEndpointRefused":
       return "invalid-request";
     case "RemoteResponseInvalid":
       return "rejected";
@@ -34786,8 +35165,8 @@ function isCorroborated(candidate, candidates, text) {
       "label",
       req,
       () => labels.map((label) => {
-        const trimmed = label.trim();
-        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+        const trimmed2 = label.trim();
+        return trimmed2.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed2)}(?![A-Za-z0-9])`, "i");
       })
     )) {
       if (re?.test(haystack)) return true;
@@ -35047,6 +35426,96 @@ function whole(command) {
   return { start: 0, end: command.length };
 }
 
+// ../../packages/detections/src/posture/web-capture-posture.ts
+var RULE_VERSION2 = "1";
+var DRIFT_MIN_PARSE_FAILURES = 2;
+var WEB_CAPTURE_DRIFT_STATES = /* @__PURE__ */ new Set([
+  "blind",
+  "degraded"
+]);
+var WEB_CAPTURE_DRIFT_RULE = {
+  ruleId: "web-capture-drift",
+  version: RULE_VERSION2,
+  name: "Web chat capture is not reading the site",
+  category: "config",
+  severity: "medium",
+  definition: JSON.stringify({
+    kind: "web-capture-drift",
+    states: [...WEB_CAPTURE_DRIFT_STATES],
+    minParseFailures: DRIFT_MIN_PARSE_FAILURES
+  })
+};
+function deriveWebCaptureState(status) {
+  if (status === void 0) return "unreported";
+  if (status.conversationEndpoints === 0) return "standby";
+  if (!status.patched) return "unpatched";
+  if (status.blind) return "blind";
+  if (status.shapeMisses.length > 0) return "degraded";
+  if (status.parseFailures >= DRIFT_MIN_PARSE_FAILURES) return "degraded";
+  return status.live ? "active" : "idle";
+}
+var STATE_SEVERITY = {
+  blind: 0,
+  degraded: 1,
+  unpatched: 2,
+  idle: 3,
+  standby: 4,
+  active: 5,
+  unreported: 6
+};
+function worseThan(a, b) {
+  const sa = STATE_SEVERITY[deriveWebCaptureState(a.status)];
+  const sb = STATE_SEVERITY[deriveWebCaptureState(b.status)];
+  if (sa !== sb) return sa < sb;
+  if (a.observedAt !== b.observedAt) return a.observedAt > b.observedAt;
+  return (a.rootSessionId ?? "") > (b.rootSessionId ?? "");
+}
+function reportedCaptureDocumentForSite(documents) {
+  let newestReport = "";
+  for (const d of documents) if (d.lastReportAt > newestReport) newestReport = d.lastReportAt;
+  const retired = (d) => {
+    if (d.closed) return true;
+    const behind = Date.parse(newestReport) - Date.parse(d.lastReportAt);
+    return Number.isFinite(behind) && behind > CAPTURE_STATUS_DOCUMENT_QUIET_MS;
+  };
+  const voting = documents.filter((d) => !retired(d));
+  const tested = voting.some((d) => webCaptureStatusObservedTurnPath(d.status));
+  const pool = tested ? voting : documents;
+  let worst;
+  for (const d of pool) if (worst === void 0 || worseThan(d, worst)) worst = d;
+  return worst;
+}
+var STATIC_COPY = {
+  active: { headline: "turns are being observed on this site" },
+  unreported: {
+    // Says "recently" rather than "yet": the store read is bounded to
+    // CAPTURE_STATUS_RECENCY_MS, so this state covers a site nothing has ever
+    // reported for AND one whose last report has aged out. The two are the
+    // same fact to a reader — nobody has confirmed anything lately — and the
+    // copy may not claim the stronger of them.
+    headline: `no report in the last ${String(CAPTURE_STATUS_RECENCY_DAYS)} days \u2014 open the site in Chrome with the extension loaded`
+  },
+  standby: {
+    headline: "this build declares no endpoints for the site, so nothing is observed yet"
+  },
+  unpatched: {
+    // Says what the flags say and no more. `patched` is false both for a tap
+    // that installed and hooked neither transport and for one that never ran
+    // at all — a page reports the same status either way, so the copy may not
+    // assert one of them.
+    headline: "the page tap captured neither fetch nor XHR \u2014 it may not have installed; reload the extension at chrome://extensions"
+  },
+  idle: { headline: "watching; no turn has been observed yet" },
+  blind: {
+    headline: "messages were sent in the page that the network capture never saw",
+    remediation: "reload the tab. If it persists after `aka update` and reloading the extension at chrome://extensions, the site's send path has changed and needs a new extension build."
+  },
+  degraded: {
+    headline: "the site's payloads no longer carry the fields the extension reads",
+    remediation: "run `aka update`, then reload the extension at chrome://extensions. If it stays degraded after an update, the site's contract has changed and needs a new extension build."
+  }
+};
+
 // ../../packages/detections/src/security/redos-probe.ts
 var BUDGET_MS = 100;
 var EXPONENTIAL_UNITS = [
@@ -37545,8 +38014,8 @@ function collectUserClaudeJson(scan2, path, cwd, repoIdentity) {
 }
 function projectEntryFor(projects, cwd) {
   const candidates = /* @__PURE__ */ new Set([cwd]);
-  const trimmed = cwd.replace(/\/+$/, "");
-  if (trimmed.length > 0) candidates.add(trimmed);
+  const trimmed2 = cwd.replace(/\/+$/, "");
+  if (trimmed2.length > 0) candidates.add(trimmed2);
   try {
     candidates.add(realpathSync2(cwd));
   } catch {
@@ -37623,8 +38092,8 @@ function memoryConfigFile(scan2, path, scope, kind) {
   if (!entry) return;
   const raw = readOptional(path);
   if (raw !== void 0) {
-    const trimmed = raw.endsWith("\n") ? raw.slice(0, -1) : raw;
-    const lines = trimmed === "" ? 0 : trimmed.split("\n").length;
+    const trimmed2 = raw.endsWith("\n") ? raw.slice(0, -1) : raw;
+    const lines = trimmed2 === "" ? 0 : trimmed2.split("\n").length;
     entry.detail = `${String(lines)} lines`;
   }
   scan2.configFiles.push(entry);
@@ -37866,6 +38335,9 @@ function str2(value) {
 function offersMaintenance(gateway, member) {
   return typeof gateway[member] === "function";
 }
+function offersCaptureStatusReader(gateway) {
+  return typeof gateway.readCaptureStatuses === "function";
+}
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash5, randomUUID as randomUUID13 } from "crypto";
@@ -39205,86 +39677,10 @@ function createForwardPolicy(deps) {
 }
 
 // ../../packages/plugin-runtime/src/attached/gateway.ts
-function strongerOf(a, b) {
-  if (a === null) return b;
-  if (b === null) return a;
-  return strongerAction(a, b);
-}
-function ruleCategoryMap(wireRules, localRules) {
-  const map2 = /* @__PURE__ */ new Map();
-  for (const rule of wireRules ?? []) map2.set(rule.id, rule.category);
-  for (const rule of localRules ?? []) map2.set(rule.id, rule.category);
-  for (const pack of bundledDetections()) {
-    for (const rule of pack.rules) map2.set(rule.id, rule.category);
-  }
-  return map2;
-}
-function policyKey(policy) {
-  return "ruleId" in policy.target ? `rule:${policy.target.ruleId}` : `category:${policy.target.category}`;
-}
-function floorFor(policy, categoryByRuleId) {
-  const category = "category" in policy.target ? policy.target.category : categoryByRuleId.get(policy.target.ruleId);
-  return category === void 0 ? null : DEFAULT_ACTIONS[category];
-}
-function mergeRaiseOnly(localPolicies, remotePolicies, categoryByRuleId) {
-  const merged = /* @__PURE__ */ new Map();
-  const disabled = [];
-  const remoteCategoryAction = /* @__PURE__ */ new Map();
-  for (const policy of remotePolicies) {
-    if (!policy.enabled) continue;
-    if (!("category" in policy.target)) continue;
-    if (remoteCategoryAction.has(policy.target.category)) continue;
-    const floor = floorFor(policy, categoryByRuleId);
-    remoteCategoryAction.set(
-      policy.target.category,
-      floor !== null && !isActionAtLeast(policy.action, floor) ? floor : policy.action
-    );
-  }
-  for (const policy of localPolicies) {
-    if (!policy.enabled) {
-      disabled.push(policy);
-      continue;
-    }
-    const key = policyKey(policy);
-    if (merged.has(key)) continue;
-    let remoteFloor = null;
-    if ("ruleId" in policy.target) {
-      const category = categoryByRuleId.get(policy.target.ruleId);
-      if (category !== void 0) remoteFloor = remoteCategoryAction.get(category) ?? null;
-    }
-    merged.set(
-      key,
-      remoteFloor !== null && !isActionAtLeast(policy.action, remoteFloor) ? { ...policy, action: remoteFloor } : policy
-    );
-  }
-  const localCategoryAction = /* @__PURE__ */ new Map();
-  for (const policy of merged.values()) {
-    if ("category" in policy.target) localCategoryAction.set(policy.target.category, policy.action);
-  }
-  for (const policy of remotePolicies) {
-    if (!policy.enabled) {
-      disabled.push(policy);
-      continue;
-    }
-    const key = policyKey(policy);
-    const floor = floorFor(policy, categoryByRuleId);
-    let localFloor = null;
-    if ("ruleId" in policy.target) {
-      const category = categoryByRuleId.get(policy.target.ruleId);
-      if (category !== void 0) localFloor = localCategoryAction.get(category) ?? null;
-    }
-    const effectiveFloor = strongerOf(floor, localFloor);
-    const clamped = effectiveFloor !== null && !isActionAtLeast(policy.action, effectiveFloor) ? { ...policy, action: effectiveFloor } : policy;
-    const existing = merged.get(key);
-    if (existing === void 0) {
-      merged.set(key, clamped);
-      continue;
-    }
-    if (actionRank(clamped.action) > actionRank(existing.action)) {
-      merged.set(key, clamped);
-    }
-  }
-  return [...merged.values(), ...disabled];
+var bundledRulesFlatCache;
+function bundledRulesFlat() {
+  bundledRulesFlatCache ??= bundledDetections().flatMap((pack) => pack.rules);
+  return bundledRulesFlatCache;
 }
 var AttachedDataGateway = class {
   constructor(deps) {
@@ -39604,6 +40000,9 @@ var AttachedDataGateway = class {
   async readSessionProvider(sessionId) {
     return this.deps.local.readSessionProvider(sessionId);
   }
+  async readCaptureStatuses() {
+    return this.deps.local.readCaptureStatuses();
+  }
   async facets() {
     return this.deps.local.facets();
   }
@@ -39686,7 +40085,7 @@ var AttachedDataGateway = class {
       policies: mergeRaiseOnly(
         local.policies,
         cached2.policies,
-        ruleCategoryMap(cached2.rules, local.rules)
+        ruleCategoryMap(cached2.rules, local.rules, bundledRulesFlat())
       ),
       customKeywords: [...local.customKeywords, ...cached2.customKeywords],
       // TAKEN FROM THE CACHE, unlike the two fields below — and the asymmetry
@@ -39911,10 +40310,15 @@ import { join as join27 } from "path";
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
 var RETRYABLE = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
-var ATTEMPTS = 5;
+var IMMEDIATE_RETRIES = 8;
+var TIMED_RETRIES = 4;
+var ATTEMPTS = 1 + IMMEDIATE_RETRIES + TIMED_RETRIES;
 var delay = (ms) => new Promise((resolve2) => {
   setTimeout(resolve2, ms);
 });
+var yieldToLoop = () => new Promise((resolve2) => {
+  setImmediate(resolve2);
+});
 async function publishByRename(tmp, file2, move = rename2) {
   for (let attempt = 1; ; attempt += 1) {
     try {
@@ -39923,7 +40327,7 @@ async function publishByRename(tmp, file2, move = rename2) {
     } catch (err) {
       const code = err.code;
       if (attempt >= ATTEMPTS || code === void 0 || !RETRYABLE.has(code)) throw err;
-      await delay(attempt * 10);
+      await (attempt <= IMMEDIATE_RETRIES ? yieldToLoop() : delay((attempt - IMMEDIATE_RETRIES) * 10));
     }
   }
 }
@@ -40431,6 +40835,9 @@ var StandaloneDataGateway = class {
   readSessionProvider(sessionId) {
     return Promise.resolve(this.db.auditEvents.sessionProvider(sessionId));
   }
+  readCaptureStatuses() {
+    return Promise.resolve(this.db.captureStatus.latest(Date.now()));
+  }
   facets() {
     return Promise.resolve(this.db.facets());
   }
@@ -40915,8 +41322,120 @@ function buildSessionRoot(sessionId, input2, ctx, resolved, provider, branch) {
 var name = "@akasecurity/plugin-browser-extension";
 var version2 = "0.9.4";
 
+// src/native-host/exchange.ts
+var MAX_TARGET_LEN = 500;
+var truncateTarget = (s) => s.length > MAX_TARGET_LEN ? `${s.slice(0, MAX_TARGET_LEN)}\u2026` : s;
+var TARGET_SCAN_MAX_BYTES = 64 * 1024;
+var MAX_TOOL_CALLS = 256;
+function cutToBytes(text, maxBytes) {
+  const bytes = new TextEncoder().encode(text);
+  if (bytes.byteLength <= maxBytes) return { text, truncated: false };
+  let end = maxBytes;
+  while (end > 0 && ((bytes[end] ?? 0) & 192) === 128) end -= 1;
+  return { text: new TextDecoder().decode(bytes.subarray(0, end)), truncated: true };
+}
+function capResponseText(exchange, maxBytes = RESPONSE_TEXT_MAX_BYTES) {
+  if (exchange.responseText === void 0) return exchange;
+  const cut = cutToBytes(exchange.responseText, maxBytes);
+  return {
+    ...exchange,
+    responseText: cut.text,
+    // OR, never assign: a text already marked truncated upstream (the tap's
+    // raw-byte cut, or the bridge's own text cut) must stay truncated even
+    // when this cut has nothing left to do.
+    truncated: exchange.truncated || cut.truncated
+  };
+}
+function trimmed(value) {
+  if (value === void 0) return void 0;
+  const t = value.trim();
+  return t === "" ? void 0 : t;
+}
+function setNum(attrs, key, value) {
+  if (typeof value === "number" && Number.isFinite(value)) attrs[key] = value;
+}
+function toLlmCallInput(exchange, sessionId, tool) {
+  const messageId = trimmed(exchange.messageId);
+  if (messageId === void 0) return null;
+  const attrs = { provider: tool, message_id: messageId };
+  const model = trimmed(exchange.model);
+  if (model !== void 0) attrs.model = model;
+  if (exchange.usageSource === "site") {
+    setNum(attrs, "input_tokens", exchange.usage?.inputTokens);
+    setNum(attrs, "output_tokens", exchange.usage?.outputTokens);
+    setNum(attrs, "cache_read_input_tokens", exchange.usage?.cacheReadInputTokens);
+    setNum(attrs, "cache_creation_input_tokens", exchange.usage?.cacheCreationInputTokens);
+  } else if (exchange.usageSource === "estimated") {
+    setNum(attrs, "estimated_input_tokens", exchange.usage?.inputTokens);
+    setNum(attrs, "estimated_output_tokens", exchange.usage?.outputTokens);
+  }
+  attrs.usage_source = exchange.usageSource;
+  const stopReason = trimmed(exchange.stopReason);
+  if (stopReason !== void 0) attrs.stop_reason = stopReason;
+  const conversationId = trimmed(exchange.conversationId);
+  if (conversationId !== void 0) {
+    attrs.run_key = conversationId;
+    attrs.site_conversation_id = conversationId;
+  }
+  if (exchange.turnIndex !== void 0) attrs.turn_index = exchange.turnIndex;
+  if (exchange.truncated) attrs.response_truncated = true;
+  return {
+    sessionId,
+    messageId,
+    parentId: sessionId,
+    rootSessionId: sessionId,
+    startedAt: exchange.startedAt,
+    attributes: attrs
+  };
+}
+function toToolCallInputs(exchange, sessionId, scanTarget) {
+  const conversationId = trimmed(exchange.conversationId);
+  const seen = /* @__PURE__ */ new Set();
+  const inputs = [];
+  const toolCalls = exchange.toolCalls ?? [];
+  for (const tc of toolCalls.slice(0, MAX_TOOL_CALLS)) {
+    const toolUseId = trimmed(tc.toolUseId);
+    if (toolUseId === void 0) continue;
+    if (seen.has(toolUseId)) continue;
+    seen.add(toolUseId);
+    const attrs = { tool_use_id: toolUseId };
+    const toolName = trimmed(tc.toolName);
+    if (toolName !== void 0) attrs.tool_name = toolName;
+    let inspections = [];
+    if (tc.target !== void 0) {
+      const { masked, findings } = scanTarget(cutToBytes(tc.target, TARGET_SCAN_MAX_BYTES).text);
+      if (masked !== "") attrs.target = truncateTarget(masked);
+      inspections = findings.map((f) => ({
+        ruleId: f.ruleId,
+        ruleName: f.ruleName,
+        ruleVersion: f.ruleVersion,
+        category: f.category,
+        severity: f.severity,
+        span: f.span,
+        maskedMatch: f.maskedMatch,
+        actionTaken: "log",
+        confidence: f.confidence
+      }));
+    }
+    if (tc.isError !== void 0) attrs.is_error = tc.isError;
+    if (tc.inputSize !== void 0) attrs.input_size = tc.inputSize;
+    if (tc.outputSize !== void 0) attrs.output_size = tc.outputSize;
+    if (conversationId !== void 0) attrs.run_key = conversationId;
+    inputs.push({
+      sessionId,
+      toolUseId,
+      parentId: sessionId,
+      rootSessionId: sessionId,
+      startedAt: exchange.startedAt,
+      attributes: attrs,
+      inspections
+    });
+  }
+  return inputs;
+}
+
 // src/native-host/protocol.ts
-var WEB_SOURCE_TOOLS = [SOURCE_TOOL.ChatGpt, SOURCE_TOOL.ClaudeAi];
+var WEB_SOURCE_TOOLS = WebSourceTool.options;
 function isWebSourceTool(value) {
   return WEB_SOURCE_TOOLS.includes(value);
 }
@@ -40932,6 +41451,16 @@ function isHostRequest(value) {
       return typeof v.sessionId === "string" && isWebSourceTool(v.tool) && typeof v.hostname === "string";
     case "capture":
       return typeof v.sessionId === "string" && isWebSourceTool(v.tool) && isEventKind(v.kind) && typeof v.text === "string";
+    // A successful safeParse proves the payload is ACCEPTABLE, not that the
+    // narrowed object carries the schema's defaults — `toolCalls` and
+    // `truncated` are `.default(...)`, and a guard does not rewrite its input.
+    // The handler re-parses and reads `parsed.data`; nothing may read
+    // `request.exchange` / `request.status` directly.
+    case "exchange":
+      return typeof v.sessionId === "string" && isWebSourceTool(v.tool) && WebExchange.safeParse(v.exchange).success;
+    case "capture_status":
+      return typeof v.sessionId === "string" && isWebSourceTool(v.tool) && WebCaptureStatus.safeParse(v.status).success;
+    case "capture_state":
     case "ping":
     case "health":
       return true;
@@ -40978,7 +41507,60 @@ var WEB_TOOL_TO_SOURCE = {
   [SOURCE_TOOL.ChatGpt]: SOURCE_TOOL.ChatGpt,
   [SOURCE_TOOL.ClaudeAi]: SOURCE_TOOL.ClaudeAi
 };
+var WEB_SOURCE_TOOLS2 = Object.keys(WEB_TOOL_TO_SOURCE);
 var PLUGIN_BUILD = { package: name, version: version2 };
+var MAX_TRACKED_SESSIONS = 32;
+var captureStatuses = /* @__PURE__ */ new Map();
+function readCaptureStatus(sessionId) {
+  return captureStatuses.get(sessionId);
+}
+function recordCaptureStatus(sessionId, record2) {
+  captureStatuses.delete(sessionId);
+  captureStatuses.set(sessionId, record2);
+  while (captureStatuses.size > MAX_TRACKED_SESSIONS) {
+    const oldest = captureStatuses.keys().next().value;
+    if (oldest === void 0) break;
+    captureStatuses.delete(oldest);
+  }
+}
+function trackedFor(tool) {
+  return [...captureStatuses.entries()].filter(([, record2]) => record2.tool === tool).map(([sessionId, record2]) => ({
+    tool: record2.tool,
+    observedAt: record2.observedAt,
+    status: record2.status,
+    rootSessionId: sessionId,
+    // One entry per session and every report overwrites it, so this IS the
+    // document's last word — there is no older row here to pick between.
+    lastReportAt: record2.observedAt,
+    closed: record2.status.closed
+  }));
+}
+function mergeCaptureDocuments(stored, tracked) {
+  const byDocument = /* @__PURE__ */ new Map();
+  for (const document of [...stored, ...tracked]) {
+    const group = byDocument.get(document.rootSessionId);
+    if (group === void 0) byDocument.set(document.rootSessionId, [document]);
+    else group.push(document);
+  }
+  const merged = [];
+  for (const group of byDocument.values()) {
+    const ordered = [...group].sort(
+      (a, b) => a.observedAt < b.observedAt ? 1 : a.observedAt > b.observedAt ? -1 : 0
+    );
+    const picked = pickReportedCaptureStatus(ordered);
+    if (picked === void 0) continue;
+    let lastReportAt = picked.lastReportAt;
+    let closed = picked.closed;
+    for (const document of group) {
+      if (document.lastReportAt > lastReportAt) {
+        lastReportAt = document.lastReportAt;
+        closed = document.closed;
+      }
+    }
+    merged.push({ ...picked, lastReportAt, closed });
+  }
+  return merged;
+}
 function resolveWebProvider(tool) {
   return () => tool === "chatgpt" ? { provider: "openai" } : { provider: "anthropic" };
 }
@@ -41053,6 +41635,200 @@ async function handleRequest(request, configForTool = defaultConfigForTool) {
         ...result.blockedReferences ? { blockedReferences: result.blockedReferences } : {}
       };
     }
+    case "exchange": {
+      const config2 = configForTool(request.tool);
+      const webChat = webChatCaptureOf(config2.settings);
+      if (!isWebChatCaptureConsentValid(webChat.consent)) {
+        return {
+          type: "exchange",
+          requestId: request.requestId,
+          ok: true,
+          accepted: false,
+          skipped: "no-consent",
+          llmCalls: 0,
+          toolCalls: 0,
+          ruleIds: []
+        };
+      }
+      const parsed2 = WebExchange.safeParse(request.exchange);
+      if (!parsed2.success) {
+        return {
+          type: "error",
+          requestId: request.requestId,
+          ok: false,
+          message: "malformed exchange payload"
+        };
+      }
+      const exchange = capResponseText(parsed2.data);
+      const llm = toLlmCallInput(exchange, request.sessionId, request.tool);
+      let llmCalls = 0;
+      let toolCalls = 0;
+      if (llm !== null) {
+        let gateway;
+        try {
+          gateway = resolveDataGateway(config2);
+          await gateway.recordAuditEvent({
+            id: request.sessionId,
+            eventType: "session",
+            startedAt: exchange.startedAt
+          });
+          await gateway.recordLlmCall(llm);
+          llmCalls = 1;
+          let ruleVersions;
+          try {
+            ruleVersions = (await gateway.getPolicyBundle()).ruleVersions;
+          } catch {
+            ruleVersions = void 0;
+          }
+          const tools = toToolCallInputs(
+            exchange,
+            request.sessionId,
+            (text2) => scanText(text2, ruleVersions)
+          );
+          if (tools.length > 0) {
+            await gateway.recordToolCalls(tools);
+            toolCalls = tools.length;
+          }
+        } catch {
+        } finally {
+          await gateway?.close();
+        }
+      }
+      const text = exchange.responseText;
+      let responseAction = {};
+      let ruleIds = [];
+      const model = llm === null ? trimmed(exchange.model) : llm.attributes.model;
+      const conversationId = llm === null ? trimmed(exchange.conversationId) : llm.attributes.site_conversation_id;
+      if (text !== void 0 && text.length > 0 && webChat.responses !== "never") {
+        const result = await handleCapture(
+          {
+            kind: "response",
+            sourceTool: WEB_TOOL_TO_SOURCE[request.tool],
+            text,
+            occurredAt: exchange.startedAt,
+            metadata: {
+              sessionId: request.sessionId,
+              ...model !== void 0 ? { model } : {},
+              // Omitted for an unkeyable exchange rather than blanked: this is
+              // correlation metadata, and an empty id correlates to nothing
+              // while reading as an id that exists.
+              ...llm !== null ? { messageId: llm.messageId } : {},
+              ...conversationId !== void 0 ? { conversationId } : {},
+              ...exchange.turnIndex !== void 0 ? { turnIndex: exchange.turnIndex } : {}
+            }
+          },
+          config2,
+          // No rewritable: false. Nothing about a response is rewritable in
+          // the sense that field means (a host input it must not mutate) —
+          // saying so here would degrade a resolved redact to
+          // settings.redactFallback, trading a meaningless decision for a
+          // real leak at rest. No dedupe, no preAuthorizedGrantIds either.
+          { persist: webChat.responses === "always" ? "always" : "with-findings" }
+        );
+        responseAction = { responseAction: result.action };
+        ruleIds = [...new Set(result.findings.map((f) => f.ruleId))];
+      }
+      return {
+        type: "exchange",
+        requestId: request.requestId,
+        ok: true,
+        // `accepted` is about the LEAVES, which an unkeyable exchange writes
+        // none of — the response capture above may still have recorded a
+        // finding, which `ruleIds` and `responseAction` report either way.
+        accepted: llm !== null,
+        ...llm === null ? { skipped: "unkeyable" } : {},
+        llmCalls,
+        toolCalls,
+        ...responseAction,
+        ruleIds
+      };
+    }
+    case "capture_status": {
+      const config2 = configForTool(request.tool);
+      const webChat = webChatCaptureOf(config2.settings);
+      if (!isWebChatCaptureConsentValid(webChat.consent)) {
+        return {
+          type: "capture_status",
+          requestId: request.requestId,
+          ok: true,
+          accepted: false,
+          skipped: "no-consent"
+        };
+      }
+      const parsed2 = WebCaptureStatus.safeParse(request.status);
+      if (!parsed2.success) {
+        return {
+          type: "error",
+          requestId: request.requestId,
+          ok: false,
+          message: "malformed capture status payload"
+        };
+      }
+      const observedAt = (/* @__PURE__ */ new Date()).toISOString();
+      recordCaptureStatus(request.sessionId, {
+        tool: request.tool,
+        status: parsed2.data,
+        observedAt
+      });
+      const gateway = resolveDataGateway(config2);
+      try {
+        await gateway.recordAuditEvent({
+          id: randomUUID20(),
+          eventType: "capture_status",
+          startedAt: observedAt,
+          parentId: request.sessionId,
+          rootSessionId: request.sessionId,
+          attributes: toCaptureStatusAttributes(parsed2.data, request.tool)
+        });
+      } catch {
+      } finally {
+        await gateway.close();
+      }
+      return { type: "capture_status", requestId: request.requestId, ok: true, accepted: true };
+    }
+    case "capture_state": {
+      const config2 = configForTool(void 0);
+      const webChat = webChatCaptureOf(config2.settings);
+      let stored = [];
+      let gateway;
+      try {
+        gateway = resolveDataGateway(config2);
+        if (offersCaptureStatusReader(gateway)) stored = await gateway.readCaptureStatuses();
+      } catch {
+        stored = [];
+      } finally {
+        await gateway?.close();
+      }
+      const sites = WEB_SOURCE_TOOLS2.map((tool) => {
+        const record2 = reportedCaptureDocumentForSite(
+          mergeCaptureDocuments(
+            stored.filter((s) => s.tool === tool),
+            trackedFor(tool)
+          )
+        );
+        return {
+          tool,
+          state: deriveWebCaptureState(record2?.status),
+          ...record2 !== void 0 ? { enforcement: record2.status.enforcement, observedAt: record2.observedAt } : {}
+        };
+      });
+      return {
+        type: "capture_state",
+        requestId: request.requestId,
+        ok: true,
+        consented: isWebChatCaptureConsentValid(webChat.consent),
+        sites
+      };
+    }
+    default: {
+      const unrecognized = request;
+      return {
+        type: "error",
+        requestId: unrecognized.requestId,
+        ok: false,
+        message: `unsupported request type: ${unrecognized.type}`
+      };
+    }
   }
 }
 async function runHost(stdin, stdout, configForTool = defaultConfigForTool) {
@@ -41092,5 +41868,6 @@ main().catch(() => {
 });
 export {
   handleRequest,
+  readCaptureStatus,
   runHost
 };