@akasecurity/cli 0.9.4 → 0.9.6

package/dist/cli.js

@@ -539,12 +539,16 @@ function runInherit(command, args) {
   }
 }
 
-// ../packages/local-ops/src/claude-plugin.ts
-function claudeAvailable() {
-  return binExists("claude");
-}
-function ensureMarketplace(source) {
-  runCapture("claude", ["plugin", "marketplace", "add", source], 6e4);
+// ../packages/local-ops/src/cli-plugin-manager.ts
+function createCliPluginManager(bin) {
+  return {
+    available: () => binExists(bin),
+    ensureMarketplace: (source) => {
+      runCapture(bin, ["plugin", "marketplace", "add", source], 6e4);
+    },
+    install: (ref) => runInherit(bin, ["plugin", "install", ref]),
+    update: (ref) => runInherit(bin, ["plugin", "update", ref])
+  };
 }
 
 // ../packages/local-ops/src/registry.ts
@@ -557,7 +561,43 @@ var AGENT_PLUGINS = [
     npmPackage: "@akasecurity/ai-tc-claude-code",
     pluginName: "ai-tc",
     marketplace: "akasecurity",
-    marketplaceSource: "akasecurity/marketplace"
+    marketplaceSource: "akasecurity/marketplace",
+    cliBin: "claude"
+  },
+  {
+    id: "codex",
+    name: "Codex CLI",
+    sourceTool: "codex",
+    description: "Hooks Codex CLI sessions to detect + redact sensitive data in prompts, responses, and Bash tool calls.",
+    npmPackage: "@akasecurity/ai-tc-codex",
+    // Distinct from Claude Code's `pluginName: 'ai-tc'` — ids from the two
+    // registry entries flow into ONE ref-keyed `installed` lookup map
+    // (see updates.ts/installedPluginVersions and apply.ts/resolveRef); an
+    // identical ref for both would make either plugin's install ledger
+    // entry satisfy the other's "is it installed" check.
+    pluginName: "aka-codex",
+    // Codex CLI installs from this repo's own marketplace file; the canonical
+    // akasecurity/marketplace repo currently carries Claude Code only.
+    marketplace: "ai-tc",
+    marketplaceSource: "akasecurity/ai-tc",
+    cliBin: "codex"
+  },
+  {
+    id: "antigravity",
+    name: "Antigravity",
+    sourceTool: "antigravity",
+    description: "Hooks Antigravity CLI sessions to detect sensitive data in shell commands and file writes.",
+    npmPackage: "@akasecurity/ai-tc-antigravity",
+    // NO pluginName/marketplace/cliBin, deliberately. Antigravity has no plugin
+    // marketplace: `agy plugin install` takes a LOCAL DIRECTORY PATH, not a
+    // `<plugin>@<marketplace>` ref, so the generic cli-plugin-manager binding
+    // the other two entries use would emit a command `agy` does not accept.
+    // Leaving the coordinates absent is the registry's documented "installed by
+    // other means" case — buildUpdateReport skips an entry with no ref, so this
+    // agent is listed and joined to its rows by `sourceTool` without claiming an
+    // update path that does not exist. Install is documented in
+    // plugins/antigravity/skills/setup/SKILL.md.
+    installHint: "Antigravity installs plugins from a local directory rather than a marketplace:\n  npm pack @akasecurity/ai-tc-antigravity && tar -xzf akasecurity-ai-tc-antigravity-*.tgz\n  agy plugin install ./package\nThen run `aka init` to set up the local store."
   }
 ];
 function findAgent(id) {
@@ -569,7 +609,7 @@ function pluginRef(agent) {
 }
 
 // ../packages/local-ops/src/updates.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readdirSync, readFileSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
@@ -583,6 +623,9 @@ function parse(version2) {
     pre: match[4] ? match[4].split(".") : []
   };
 }
+function isSemver(version2) {
+  return parse(version2) !== null;
+}
 function comparePre(a, b) {
   if (a.length === 0 && b.length === 0) return 0;
   if (a.length === 0) return 1;
@@ -665,6 +708,43 @@ function installedPluginVersions(claudeHome = join(homedir2(), ".claude")) {
   }
   return out;
 }
+function codexPluginCacheRoot(codexHome) {
+  return join(codexHome, "plugins", "cache");
+}
+function activeCodexPluginVersion(dir) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return null;
+  }
+  if (entries.length === 0) return null;
+  if (entries.includes("local")) return "local";
+  const versions = entries.filter(isSemver);
+  if (versions.length === 0) return null;
+  return versions.reduce(
+    (best, candidate) => compareSemver(candidate, best) > 0 ? candidate : best
+  );
+}
+function installedCodexPluginVersions(codexHome = join(homedir2(), ".codex")) {
+  const out = /* @__PURE__ */ new Map();
+  const cacheRoot = codexPluginCacheRoot(codexHome);
+  for (const agent of AGENT_PLUGINS) {
+    if (agent.cliBin !== "codex") continue;
+    const ref = pluginRef(agent);
+    if (!ref || !agent.pluginName || !agent.marketplace) continue;
+    const pluginDir = join(cacheRoot, agent.marketplace, agent.pluginName);
+    const version2 = activeCodexPluginVersion(pluginDir);
+    if (version2 !== null) out.set(ref, version2);
+  }
+  return out;
+}
+function installedAgentPluginVersions(claudeHome, codexHome) {
+  return new Map([
+    ...installedPluginVersions(claudeHome),
+    ...installedCodexPluginVersions(codexHome)
+  ]);
+}
 function npmViewVersion(pkg) {
   const res = runCapture("npm", ["view", pkg, "version"], 15e3);
   if (!res.ok || !res.stdout) return null;
@@ -707,7 +787,7 @@ function gatherReport(deps) {
 function gatherReportLive() {
   return gatherReport({
     viewVersion: npmViewVersion,
-    installed: installedPluginVersions(),
+    installed: installedAgentPluginVersions(),
     cliInstalled: cliVersion()
   });
 }
@@ -728,31 +808,53 @@ function resolveRef(agentId) {
   const agent = findAgent(agentId);
   if (!agent) return { ok: false, output: `unknown agent '${agentId}'` };
   const ref = pluginRef(agent);
-  if (!ref) return { ok: false, output: `${agent.name} has no automated install path yet.` };
-  if (!claudeAvailable()) {
+  const cliBin = agent.cliBin;
+  if (!ref || !cliBin) {
+    return { ok: false, output: `${agent.name} has no automated install path yet.` };
+  }
+  const manager3 = createCliPluginManager(cliBin);
+  if (!manager3.available()) {
     return {
       ok: false,
-      output: `the \`claude\` CLI isn't on your PATH \u2014 install Claude Code, then run \`claude plugin install ${ref}\` (or update with \`claude plugin update ${ref}\`).`
+      output: `the \`${cliBin}\` CLI isn't on your PATH \u2014 install ${agent.name}, then run \`${cliBin} plugin install ${ref}\` (or update with \`${cliBin} plugin update ${ref}\`).`
     };
   }
-  return { ref, marketplaceSource: agent.marketplaceSource };
+  return { ref, cliBin, marketplaceSource: agent.marketplaceSource };
 }
 function applyPluginUpdate(agentId, mode = "capture") {
   const resolved = resolveRef(agentId);
   if ("ok" in resolved) return resolved;
-  if (resolved.marketplaceSource) ensureMarketplace(resolved.marketplaceSource);
-  return run("claude", ["plugin", "update", resolved.ref], mode);
+  if (resolved.marketplaceSource) {
+    createCliPluginManager(resolved.cliBin).ensureMarketplace(resolved.marketplaceSource);
+  }
+  return run(resolved.cliBin, ["plugin", "update", resolved.ref], mode);
 }
 function installAgentPlugin(agentId, mode = "capture") {
   const resolved = resolveRef(agentId);
   if ("ok" in resolved) return resolved;
-  if (resolved.marketplaceSource) ensureMarketplace(resolved.marketplaceSource);
-  return run("claude", ["plugin", "install", resolved.ref], mode);
+  if (resolved.marketplaceSource) {
+    createCliPluginManager(resolved.cliBin).ensureMarketplace(resolved.marketplaceSource);
+  }
+  return run(resolved.cliBin, ["plugin", "install", resolved.ref], mode);
 }
 
+// ../packages/local-ops/src/claude-plugin.ts
+var manager = createCliPluginManager("claude");
+var claudeAvailable = manager.available;
+var ensureMarketplace = manager.ensureMarketplace;
+var installClaudePlugin = manager.install;
+var updateClaudePlugin = manager.update;
+
+// ../packages/local-ops/src/codex-plugin.ts
+var manager2 = createCliPluginManager("codex");
+var codexAvailable = manager2.available;
+var ensureCodexMarketplace = manager2.ensureMarketplace;
+var installCodexPlugin = manager2.install;
+var updateCodexPlugin = manager2.update;
+
 // ../packages/local-ops/src/egress-record.ts
-import { statSync as statSync5 } from "fs";
-import { dirname as dirname4, relative as relative2, resolve } from "path";
+import { statSync as statSync7 } from "fs";
+import { dirname as dirname5, relative, resolve } from "path";
 
 // ../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -1742,11 +1844,11 @@ var EXACT_KIND_BY_BASENAME = {
   "composer.json": "composer.json",
   "packages.config": "packages.config"
 };
-function manifestKindOf(basename6) {
-  if (LOCKFILE_BASENAMES.has(basename6)) return null;
-  const exact = Object.hasOwn(EXACT_KIND_BY_BASENAME, basename6) ? EXACT_KIND_BY_BASENAME[basename6] : void 0;
+function manifestKindOf(basename7) {
+  if (LOCKFILE_BASENAMES.has(basename7)) return null;
+  const exact = Object.hasOwn(EXACT_KIND_BY_BASENAME, basename7) ? EXACT_KIND_BY_BASENAME[basename7] : void 0;
   if (exact !== void 0) return exact;
-  if (basename6.endsWith(".csproj")) return "csproj";
+  if (basename7.endsWith(".csproj")) return "csproj";
   return null;
 }
 function extractManifestSdks(text, kind) {
@@ -2161,6 +2263,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -2171,10 +2307,17 @@ var KeywordMatcher = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -2190,7 +2333,10 @@ var RegexMatcher = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -2298,11 +2444,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -2486,6 +2636,14 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0018_serious_tana_nile",
     sql: "ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"
+  },
+  {
+    tag: "0019_audit_started_at_index",
+    sql: "CREATE INDEX `idx_audit_started_at` ON `audit_events` (`started_at`);"
+  },
+  {
+    tag: "0020_secret_vault_pagination_indexes",
+    sql: "CREATE INDEX `idx_secret_vault_last_seen` ON `secret_vault` (`last_seen`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_reuse` ON `secret_vault` (`occurrence_count`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_at` ON `secret_vault_deref` (`at`,`id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_signal` ON `secret_vault_deref` (`at`,`id`) WHERE `reason` NOT IN ('display', 'view-render');"
   }
 ];
 
@@ -17346,7 +17504,17 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum(["claudecode", "claudedesktop", "cursor", "copilot", "chatgpt", "api"]).meta({ id: "FindingProvider" });
+var FindingProvider = external_exports.enum([
+  "claudecode",
+  "claudedesktop",
+  "cursor",
+  "copilot",
+  "chatgpt",
+  "claudeai",
+  "codex",
+  "antigravity",
+  "api"
+]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
@@ -17400,7 +17568,16 @@ var FindingInstance = external_exports.object({
   confidence: external_exports.number().min(0).max(1),
   // Lifecycle status (see FindingStatus). Optional so legacy callers/rows
   // that predate the resolution feature stay valid.
-  status: FindingStatus.optional()
+  status: FindingStatus.optional(),
+  // The audit event this finding was captured from. Optional so callers that
+  // do not project it stay valid. An at-rest finding is content-addressed by
+  // finding_key and its row is upserted on re-detection, so this names the
+  // MOST RECENT detection event, not the first.
+  eventId: external_exports.string().optional(),
+  // The session that event belongs to, when it has one — the seam a
+  // per-instance "view session" link needs. Absent for events captured
+  // outside a session.
+  sessionId: external_exports.string().optional()
 }).meta({ id: "FindingInstance" });
 var FindingGroup = external_exports.object({
   id: external_exports.string(),
@@ -17444,7 +17621,11 @@ var FindingFacets = external_exports.object({
   // for every instance, so every group lands in a bucket; a status-less
   // group (possible only for callers whose rows carry no statuses) is
   // counted under no value.
-  status: external_exports.array(FindingFacetItem)
+  status: external_exports.array(FindingFacetItem),
+  // Host tool (attributes.tool_name). Present only on the instance-level
+  // reads, which can filter by it; the grouped read omits the dimension
+  // because a group spans tools.
+  tool: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
 var DEFAULT_GROUPED_FINDINGS_LIMIT = 50;
 var ListGroupedFindingsQuery = external_exports.object({
@@ -17462,6 +17643,16 @@ var ListGroupedFindingsQuery = external_exports.object({
   // Scope to findings whose event carries this session id (the Activity page's
   // session → findings drilldown). Findings without a session never match.
   sessionId: external_exports.string().optional(),
+  // Inclusive lower bound on the parent event's timestamp, so a caller arriving
+  // from a time-scoped page (Activity's range) can carry that scope. Absent
+  // means all time — this list has no default window.
+  from: external_exports.iso.datetime().optional(),
+  // A group or instance id that must appear in the page even when the cursor
+  // has already advanced past its sort position. This is what keeps the
+  // Findings page's one-shot ?finding= deep link resolving once the list
+  // paginates: the target group is appended out of sort order rather than
+  // scanning forward for it. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -17506,15 +17697,110 @@ var FindingInstanceDetail = FindingInstance.extend({
   detection: FindingDetectionRef,
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
+var DEFAULT_FLAT_FINDINGS_LIMIT = 50;
+var ListFindingInstancesQuery = external_exports.object({
+  severity: external_exports.array(Severity).optional(),
+  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  subtype: external_exports.array(external_exports.string()).optional(),
+  provider: external_exports.array(FindingProvider).optional(),
+  action: external_exports.array(FindingAction).optional(),
+  // Matches each instance's OWN derived status (deriveFindingStatus), unlike
+  // the grouped query's group-level fold.
+  status: external_exports.array(FindingStatus).optional(),
+  // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
+  // where the free-text `q` can only match the rendered "via Bash" label.
+  tool: external_exports.array(external_exports.string()).optional(),
+  // Exact repository / file-path matches, for the drill-down out of the
+  // locations view. A row whose event carries no repo/file matches neither.
+  repo: external_exports.string().optional(),
+  file: external_exports.string().optional(),
+  q: external_exports.string().optional(),
+  sessionId: external_exports.string().optional(),
+  from: external_exports.iso.datetime().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListFindingInstancesResponse = external_exports.object({
+  // Instances matching the filters across the whole scope, not just this
+  // page — cursor-independent, like the grouped list's totals.
+  totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
+  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // dimension still excludes its own filter.
+  facets: FindingFacets,
+  items: external_exports.array(FindingInstanceDetail),
+  nextCursor: external_exports.string().nullable()
+}).meta({ id: "ListFindingInstancesResponse" });
+var FindingLocationFile = external_exports.object({
+  // Empty when the instances carried no file path (a prompt or a tool call
+  // with no file attribution).
+  file: external_exports.string(),
+  instanceCount: external_exports.number().int().nonnegative(),
+  maxSeverity: Severity,
+  latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same
+  // open-dominates precedence a group uses.
+  status: FindingStatus.optional(),
+  // Distinct rules seen at this location, capped — the row shows them as
+  // chips, and the count is what conveys scale.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationFile" });
+var FindingLocationRepo = external_exports.object({
+  /** Empty when the instances carried no repo attribute. */
+  repo: external_exports.string(),
+  instanceCount: external_exports.number().int().nonnegative(),
+  maxSeverity: Severity,
+  latestDetectedAt: external_exports.iso.datetime(),
+  status: FindingStatus.optional(),
+  files: external_exports.array(FindingLocationFile)
+}).meta({ id: "FindingLocationRepo" });
+var ListFindingLocationsQuery = external_exports.object({
+  severity: external_exports.array(Severity).optional(),
+  subtype: external_exports.array(external_exports.string()).optional(),
+  provider: external_exports.array(FindingProvider).optional(),
+  action: external_exports.array(FindingAction).optional(),
+  // Per-instance, as in ListFindingInstancesQuery: a location keeps the
+  // instances that match, and folds its status from those.
+  status: external_exports.array(FindingStatus).optional(),
+  tool: external_exports.array(external_exports.string()).optional(),
+  q: external_exports.string().optional(),
+  sessionId: external_exports.string().optional(),
+  from: external_exports.iso.datetime().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+});
+var ListFindingLocationsResponse = external_exports.object({
+  totals: external_exports.object({
+    findings: external_exports.number().int().nonnegative(),
+    repos: external_exports.number().int().nonnegative(),
+    files: external_exports.number().int().nonnegative()
+  }),
+  /** Sorted by max severity, then most recent. */
+  items: external_exports.array(FindingLocationRepo),
+  /** Whether `limit` truncated the repo list. */
+  hasMore: external_exports.boolean()
+}).meta({ id: "ListFindingLocationsResponse" });
 
 // ../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum(["claudecode", "cursor", "copilot", "codex", "windsurf", "claudedesktop", "chatgpt", "api"]).meta({ id: "Harness" });
+var Harness = external_exports.enum([
+  "claudecode",
+  "cursor",
+  "copilot",
+  "codex",
+  "antigravity",
+  "windsurf",
+  "claudedesktop",
+  "chatgpt",
+  "claudeai",
+  "api"
+]).meta({ id: "Harness" });
 var TOOL_TO_HARNESS = {
   "claude-code": "claudecode",
   "claude-desktop": "claudedesktop",
   "github-copilot": "copilot",
   cursor: "cursor",
-  chatgpt: "chatgpt"
+  chatgpt: "chatgpt",
+  codex: "codex",
+  antigravity: "antigravity",
+  "claude-ai": "claudeai"
 };
 
 // ../packages/schema/src/zod/meta.ts
@@ -17972,7 +18258,18 @@ var ActivityOverviewResponse = external_exports.object({
 // ../packages/schema/src/zod/event.ts
 var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
+var SourceTool = external_exports.enum([
+  "claude-code",
+  "claude-desktop",
+  "cursor",
+  "chatgpt",
+  "claude-ai",
+  "github-copilot",
+  "codex",
+  "antigravity",
+  "cli",
+  "unknown"
+]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
@@ -18043,7 +18340,7 @@ var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).me
 var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
 var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
 var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex"]).meta({ id: "HarnessId" });
+var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
 var AccessCounts = external_exports.object({
   open: external_exports.number().int().nonnegative(),
   approved: external_exports.number().int().nonnegative(),
@@ -18312,9 +18609,19 @@ var ExceptionBundleEntry = DetectionException.pick({
   useCount: true,
   conditions: true
 });
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
 function isMatchableUnder(keyVersion, key) {
   return key.status === "present" && key.version === keyVersion;
 }
+var LEDGER_WINDOW_HOURS = 24;
+function rotationBlockedLedgerNote(stillApprovable) {
+  if (stillApprovable <= 0) {
+    return "Recently blocked detections are invalidated too: the ledger outlives a rotation, so its rows stay listed as a record of what was blocked but stop being approvable. Trigger the detection again to approve it under the new key.";
+  }
+  const window = `from the last ${String(LEDGER_WINDOW_HOURS)} hours`;
+  const subject = stillApprovable === 1 ? `1 recently blocked detection ${window} is still approvable; after rotating, none are` : `${String(stillApprovable)} recently blocked detections ${window} are still approvable; after rotating, none are`;
+  return `${subject}. They stay listed as a record of what was blocked \u2014 trigger the detection again to approve under the new key.`;
+}
 
 // ../packages/schema/src/zod/rule.ts
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
@@ -19125,6 +19432,35 @@ var EgressWriteSummary = external_exports.object({
   droppedFiles: external_exports.array(external_exports.string()).default([])
 }).meta({ id: "EgressWriteSummary" });
 
+// ../packages/schema/src/zod/exception-action.ts
+var confirmation = external_exports.string().optional();
+var ApproveBlockedInput = external_exports.object({
+  reference: external_exports.string(),
+  scope: external_exports.string(),
+  reason: external_exports.string(),
+  confirmation
+});
+var AddExceptionInput = external_exports.object({
+  ruleId: external_exports.string(),
+  value: external_exports.string(),
+  scope: external_exports.string(),
+  reason: external_exports.string(),
+  confirmation
+});
+var GrantRevealInput = external_exports.object({
+  pointer: external_exports.string(),
+  scope: external_exports.string(),
+  justification: external_exports.string(),
+  confirmation
+});
+var RevokeExceptionInput = external_exports.object({
+  id: external_exports.string(),
+  reason: external_exports.string()
+});
+var RotateKeyInput = external_exports.object({
+  confirmation: external_exports.string()
+});
+
 // ../packages/schema/src/zod/findings-group-build.ts
 function toApiAction(dbVal) {
   const map2 = {
@@ -19180,6 +19516,8 @@ function buildFindingGroups(rows, opts = {}) {
         repo: r.repo,
         file: r.file,
         ...r.toolName === void 0 ? {} : { toolName: r.toolName },
+        ...r.eventId === void 0 ? {} : { eventId: r.eventId },
+        ...r.sessionId === void 0 ? {} : { sessionId: r.sessionId },
         action: toApiAction(effectiveDbAction),
         detectedAt: r.occurredAt,
         confidence: r.confidence,
@@ -19311,14 +19649,17 @@ function applyFindingFilters(groups, opts) {
 }
 var SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
 var SEVERITY_RANK2 = SEVERITY_ORDER;
+function compareFindingGroupOrder(a, b) {
+  const rankA = SEVERITY_RANK2[a.severity] ?? -1;
+  const rankB = SEVERITY_RANK2[b.severity] ?? -1;
+  const severityDiff = rankA - rankB;
+  if (severityDiff !== 0) return severityDiff;
+  const recencyDiff = b.latestDetectedAt.localeCompare(a.latestDetectedAt);
+  if (recencyDiff !== 0) return recencyDiff;
+  return a.id.localeCompare(b.id);
+}
 function sortFindingGroups(groups) {
-  return [...groups].sort((a, b) => {
-    const rankA = SEVERITY_RANK2[a.severity] ?? -1;
-    const rankB = SEVERITY_RANK2[b.severity] ?? -1;
-    const severityDiff = rankA - rankB;
-    if (severityDiff !== 0) return severityDiff;
-    return b.latestDetectedAt.localeCompare(a.latestDetectedAt);
-  });
+  return [...groups].sort(compareFindingGroupOrder);
 }
 function computeFindingFacets(allGroups, opts) {
   const forSeverity = applyFindingFilters(allGroups, {
@@ -19374,15 +19715,158 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forStatus) {
     if (g.status !== void 0) statusMap.set(g.status, (statusMap.get(g.status) ?? 0) + 1);
   }
-  const toItems = (m) => [...m.entries()].map(([value, count]) => ({ value, count }));
+  const toItems2 = (m) => [...m.entries()].map(([value, count]) => ({ value, count }));
+  return {
+    severity: toItems2(severityMap),
+    provider: toItems2(providerMap),
+    action: toItems2(actionMap),
+    subtype: toItems2(subtypeMap),
+    status: toItems2(statusMap)
+  };
+}
+
+// ../packages/schema/src/zod/findings-flat-build.ts
+function rowHaystack(row) {
+  return [
+    row.ruleId,
+    row.category,
+    row.maskedMatch,
+    row.repo,
+    row.file,
+    row.toolName ? `via ${row.toolName}` : "",
+    row.id
+  ].join(" ").toLowerCase();
+}
+function matchesDimension(row, opts, dimension) {
+  switch (dimension) {
+    case "severity":
+      return !opts.severity?.length || opts.severity.includes(row.severity);
+    case "subtype":
+      return !opts.subtype?.length || opts.subtype.includes(row.ruleId);
+    case "providers":
+      return !opts.providers?.length || opts.providers.includes(toApiProvider(row.sourceTool));
+    case "actions":
+      return !opts.actions?.length || opts.actions.includes(toApiAction(row.actionTaken));
+    case "statuses":
+      return !opts.statuses?.length || row.status !== void 0 && opts.statuses.includes(row.status);
+    case "tools":
+      return !opts.tools?.length || row.toolName !== void 0 && opts.tools.includes(row.toolName);
+    case "repo":
+      return opts.repo === void 0 || opts.repo === "" || row.repo === opts.repo;
+    case "file":
+      return opts.file === void 0 || opts.file === "" || row.file === opts.file;
+    case "q":
+      return !opts.q || rowHaystack(row).includes(opts.q.toLowerCase());
+  }
+}
+var DIMENSIONS = [
+  "severity",
+  "subtype",
+  "providers",
+  "actions",
+  "statuses",
+  "tools",
+  "repo",
+  "file",
+  "q"
+];
+function matchesInstanceFilters(row, opts, except) {
+  for (const dimension of DIMENSIONS) {
+    if (dimension === except) continue;
+    if (!matchesDimension(row, opts, dimension)) return false;
+  }
+  return true;
+}
+function toItems(counts) {
+  return [...counts.entries()].map(([value, count]) => ({ value, count })).sort((a, b) => b.count - a.count || a.value.localeCompare(b.value));
+}
+function bump(counts, value) {
+  counts.set(value, (counts.get(value) ?? 0) + 1);
+}
+function createInstanceFacetAccumulator(opts) {
+  const severity = /* @__PURE__ */ new Map();
+  const subtype = /* @__PURE__ */ new Map();
+  const provider = /* @__PURE__ */ new Map();
+  const action = /* @__PURE__ */ new Map();
+  const status = /* @__PURE__ */ new Map();
+  const tool = /* @__PURE__ */ new Map();
+  return {
+    add(row) {
+      if (matchesInstanceFilters(row, opts, "severity")) bump(severity, row.severity);
+      if (matchesInstanceFilters(row, opts, "subtype")) bump(subtype, row.ruleId);
+      if (matchesInstanceFilters(row, opts, "providers")) {
+        bump(provider, toApiProvider(row.sourceTool));
+      }
+      if (matchesInstanceFilters(row, opts, "actions")) bump(action, toApiAction(row.actionTaken));
+      if (row.status !== void 0 && matchesInstanceFilters(row, opts, "statuses")) {
+        bump(status, row.status);
+      }
+      if (row.toolName !== void 0 && matchesInstanceFilters(row, opts, "tools")) {
+        bump(tool, row.toolName);
+      }
+    },
+    facets: () => ({
+      severity: toItems(severity),
+      subtype: toItems(subtype),
+      provider: toItems(provider),
+      action: toItems(action),
+      status: toItems(status),
+      tool: toItems(tool)
+    })
+  };
+}
+function toInstanceDetail(row) {
+  const category = toApiCategory(row.category);
+  return {
+    id: row.id,
+    provider: toApiProvider(row.sourceTool),
+    repo: row.repo,
+    file: row.file,
+    ...row.toolName === void 0 ? {} : { toolName: row.toolName },
+    eventId: row.eventId,
+    ...row.sessionId === void 0 ? {} : { sessionId: row.sessionId },
+    action: toApiAction(row.actionTaken),
+    detectedAt: row.occurredAt,
+    confidence: row.confidence,
+    ...row.status === void 0 ? {} : { status: row.status },
+    groupId: row.ruleId,
+    category,
+    subtype: row.ruleId,
+    severity: row.severity,
+    match: { maskedValue: row.maskedMatch, contextPrefix: "" },
+    detection: { id: row.ruleId, name: null },
+    policy: { id: `category:${category}`, name: category }
+  };
+}
+var SEVERITY_ORDER2 = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3
+};
+function newLocationAccumulator() {
   return {
-    severity: toItems(severityMap),
-    provider: toItems(providerMap),
-    action: toItems(actionMap),
-    subtype: toItems(subtypeMap),
-    status: toItems(statusMap)
+    instanceCount: 0,
+    // Sorts after every known severity, so the first row always wins the
+    // comparison below rather than an unknown value pinning the location.
+    maxSeverityRank: Number.MAX_SAFE_INTEGER,
+    maxSeverity: "low",
+    latestDetectedAt: "",
+    statuses: [],
+    ruleIds: /* @__PURE__ */ new Set()
   };
 }
+function addToLocation(acc, row) {
+  acc.instanceCount += 1;
+  const rank = SEVERITY_ORDER2[row.severity] ?? Number.MAX_SAFE_INTEGER - 1;
+  if (rank < acc.maxSeverityRank) {
+    acc.maxSeverityRank = rank;
+    acc.maxSeverity = row.severity;
+  }
+  if (row.occurredAt > acc.latestDetectedAt) acc.latestDetectedAt = row.occurredAt;
+  acc.statuses.push(row.status);
+  acc.ruleIds.add(row.ruleId);
+}
 
 // ../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
@@ -19523,6 +20007,50 @@ var VaultInventoryEntry = external_exports.object({
   revealGrantId: external_exports.string().nullable(),
   sightings: external_exports.array(VaultSighting)
 });
+var DEFAULT_VAULT_INVENTORY_LIMIT = 50;
+var DEFAULT_VAULT_DEREFS_LIMIT = 50;
+var MAX_VAULT_PAGE_LIMIT = 200;
+var ListVaultInventoryQuery = external_exports.object({
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  // Opaque; names the last row of the page just served.
+  cursor: external_exports.string().optional()
+});
+var ListVaultInventoryResponse = external_exports.object({
+  // Vaulted values across the whole store, not just this page — cursor-
+  // independent, so paging never changes what the count claims.
+  totals: external_exports.object({ values: external_exports.number().int().nonnegative() }),
+  items: external_exports.array(VaultInventoryEntry),
+  // `null` once the last page is reached.
+  nextCursor: external_exports.string().nullable()
+});
+var ListVaultReuseQuery = external_exports.object({
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListVaultReuseResponse = external_exports.object({
+  // Reused values across the whole store — the number the section's claim
+  // ("values detected in more than one place") is about.
+  totals: external_exports.object({ reused: external_exports.number().int().nonnegative() }),
+  items: external_exports.array(VaultInventoryEntry),
+  nextCursor: external_exports.string().nullable()
+});
+var ListVaultDerefsQuery = external_exports.object({
+  // Include the batched, high-volume reasons (display, view-render). Omitted
+  // hides them and counts them into `hiddenBatched` instead, so the model
+  // crossings stay visible. A real boolean, not `z.stringbool()`: this arrives
+  // over a Server Action, which preserves the type, never as a URL param.
+  includeBatched: external_exports.boolean().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListVaultDerefsResponse = external_exports.object({
+  items: external_exports.array(VaultDeref),
+  nextCursor: external_exports.string().nullable(),
+  // Display/view-render rows the query hid, over the WHOLE trail rather than
+  // this page — it is the count the "N hidden" line and its toggle speak for.
+  // Always 0 when `includeBatched` was set, since nothing was hidden.
+  hiddenBatched: external_exports.number().int().nonnegative()
+});
 var VaultKeyCustody = external_exports.string();
 var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
 var VAULT_CONSENT_VERSION = 1;
@@ -19902,7 +20430,7 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
   // Percent of that provider's traffic scanned in the window. 0 when unsupported.
@@ -20214,9 +20742,8 @@ var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].m
 );
 
 // ../packages/persistence/src/database.ts
-import { randomUUID as randomUUID9 } from "crypto";
-import { existsSync as existsSync2, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
-import { join as join2, sep } from "path";
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join3, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
 // ../packages/persistence/src/ids.ts
@@ -20250,74 +20777,280 @@ function captureId(sessionId, contentHash, filePath = null) {
   );
 }
 
-// ../packages/persistence/src/internal/sql-text.ts
-function escapeLikePattern(s) {
-  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+// ../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync2, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
+import { basename, dirname as dirname2, join as join2 } from "path";
+
+// ../packages/persistence/src/paths.ts
+import {
+  chmodSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { threadId } from "worker_threads";
+var DATA_DIR_MODE = 448;
+var DATA_FILE_MODE = 384;
+var DB_FILENAME = "aka.db";
+function isSymlink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
 }
-function placeholders(n) {
-  return Array.from({ length: n }, () => "?").join(", ");
+function chmodBestEffort(path, mode) {
+  if (isSymlink(path)) return;
+  try {
+    chmodSync(path, mode);
+  } catch {
+  }
 }
-function containsPattern(q) {
-  return `%${escapeLikePattern(q)}%`;
+function tightenDir(dir) {
+  chmodBestEffort(dir, DATA_DIR_MODE);
 }
-function likeAny(exprs) {
-  return `(${exprs.map((e) => `${e} LIKE ? ESCAPE '\\'`).join(" OR ")})`;
+function ensureDataDirSync(dir) {
+  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
+  tightenDir(dir);
 }
-
-// ../packages/persistence/src/internal/transactions.ts
-var savepointSeq = 0;
-function withTransaction(db, fn, mode = "DEFERRED") {
-  if (db.isTransaction) {
-    const savepoint = `aka_sp_${String(savepointSeq += 1)}`;
-    db.exec(`SAVEPOINT ${savepoint}`);
+function dbSidecars(file2) {
+  return [`${file2}-wal`, `${file2}-shm`, `${file2}-journal`];
+}
+function tightenFile(file2) {
+  chmodBestEffort(file2, DATA_FILE_MODE);
+}
+function tightenPerms(file2) {
+  for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
+}
+function writeOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.tmp`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  try {
+    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    renameSync(tmp, file2);
+  } finally {
     try {
-      fn();
-      db.exec(`RELEASE ${savepoint}`);
-    } catch (error51) {
-      try {
-        db.exec(`ROLLBACK TO ${savepoint}`);
-        db.exec(`RELEASE ${savepoint}`);
-      } catch {
-      }
-      throw error51;
+      rmSync(tmp, { force: true });
+    } catch {
     }
-    return;
   }
-  db.exec(mode === "IMMEDIATE" ? "BEGIN IMMEDIATE" : "BEGIN");
+  tightenFile(file2);
+}
+function classifyOccupant(file2) {
   try {
-    fn();
-    db.exec("COMMIT");
-  } catch (error51) {
+    if (lstatSync(file2).isSymbolicLink()) return { kind: "symlink" };
+    return { kind: "gone" };
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "gone" };
+    return { kind: "unknown", cause: err };
+  }
+}
+var KeyUnclaimableError = class extends Error {
+  code = "key-unclaimable";
+  // `cause` is installed only when there IS one. Passing { cause: undefined }
+  // defines the property anyway, so an error carrying nothing would still answer
+  // `'cause' in err` — a present-but-empty field reads as a diagnosis that was
+  // captured and then lost, which is worse than its plain absence.
+  constructor(message, cause) {
+    super(message, cause === void 0 ? void 0 : { cause });
+    this.name = "KeyUnclaimableError";
+  }
+};
+function createOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.${String(threadId)}.new`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  let created;
+  try {
+    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    created = publishByLink(tmp, file2, data);
+  } finally {
     try {
-      db.exec("ROLLBACK");
+      rmSync(tmp, { force: true });
     } catch {
     }
-    throw error51;
   }
+  if (created) tightenFile(file2);
+  return created;
 }
-function failOpenTransaction(db, fn, mode = "DEFERRED") {
-  const nested = db.isTransaction;
+var LINK_UNSUPPORTED = /* @__PURE__ */ new Set(["EPERM", "ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EINVAL"]);
+function publishByLink(tmp, file2, data) {
   try {
-    withTransaction(db, fn, mode);
+    linkSync(tmp, file2);
     return true;
-  } catch (error51) {
-    if (!db.isTransaction && nested) throw error51;
-    return false;
+  } catch (err) {
+    const code = err.code;
+    if (code === "EEXIST") return false;
+    if (!LINK_UNSUPPORTED.has(code ?? "")) throw err;
+  }
+  try {
+    writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    return true;
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw err;
   }
 }
 
-// ../packages/persistence/src/internal/warn.ts
-function akaWarn(message) {
-  process.stderr.write(`[aka] ${message}
-`);
+// ../packages/persistence/src/internal/snapshot.ts
+function backupPath(file2, tag) {
+  return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
 }
-
-// ../packages/persistence/src/db/migrations/introspection.ts
-function evidenceObjects(sql) {
-  const objects = [];
-  for (const m of sql.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g)) {
-    if (m[1] !== void 0 && !m[1].startsWith("__new_")) {
-      objects.push({ kind: "table", name: m[1] });
+var STALE_PARTIAL_MS = 5 * 6e4;
+function reapStalePartials(file2) {
+  const dir = dirname2(file2);
+  const prefix = `${basename(file2)}.`;
+  let entries;
+  try {
+    entries = readdirSync2(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (!name.startsWith(prefix) || !name.endsWith(".bak.partial")) continue;
+    const partial2 = join2(dir, name);
+    try {
+      if (Date.now() - statSync(partial2).mtimeMs > STALE_PARTIAL_MS) {
+        rmSync2(partial2, { force: true });
+      }
+    } catch {
+    }
+  }
+}
+function snapshotStore(db, backup) {
+  const partial2 = `${backup}.partial`;
+  try {
+    rmSync2(partial2, { force: true });
+    db.prepare("VACUUM INTO ?").run(partial2);
+    tightenFile(partial2);
+    renameSync2(partial2, backup);
+  } catch (error51) {
+    try {
+      rmSync2(partial2, { force: true });
+    } catch {
+    }
+    throw error51;
+  }
+}
+function moveStoreAside(file2, backup) {
+  const undo = [];
+  renameSync2(file2, backup);
+  undo.push([backup, file2]);
+  try {
+    for (const sidecar of dbSidecars(file2)) {
+      const moved = `${backup}${sidecar.slice(file2.length)}`;
+      try {
+        renameSync2(sidecar, moved);
+        undo.push([moved, sidecar]);
+      } catch {
+        rmSync2(sidecar, { force: true });
+      }
+    }
+  } catch (error51) {
+    for (const [from, to] of undo.reverse()) {
+      try {
+        renameSync2(from, to);
+      } catch {
+      }
+    }
+    throw error51;
+  }
+  tightenPerms(backup);
+}
+function discardStore(file2, backup) {
+  try {
+    rmSync2(file2, { force: true });
+    for (const sidecar of dbSidecars(file2)) {
+      rmSync2(sidecar, { force: true });
+    }
+  } catch (error51) {
+    if (existsSync2(file2)) {
+      try {
+        rmSync2(backup, { force: true });
+      } catch {
+      }
+    }
+    throw error51;
+  }
+}
+
+// ../packages/persistence/src/internal/sql-text.ts
+function escapeLikePattern(s) {
+  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+}
+function placeholders(n) {
+  return Array.from({ length: n }, () => "?").join(", ");
+}
+function containsPattern(q) {
+  return `%${escapeLikePattern(q)}%`;
+}
+function likeAny(exprs) {
+  return `(${exprs.map((e) => `${e} LIKE ? ESCAPE '\\'`).join(" OR ")})`;
+}
+
+// ../packages/persistence/src/internal/transactions.ts
+var savepointSeq = 0;
+function withTransaction(db, fn, mode = "DEFERRED") {
+  if (db.isTransaction) {
+    const savepoint = `aka_sp_${String(savepointSeq += 1)}`;
+    db.exec(`SAVEPOINT ${savepoint}`);
+    try {
+      fn();
+      db.exec(`RELEASE ${savepoint}`);
+    } catch (error51) {
+      try {
+        db.exec(`ROLLBACK TO ${savepoint}`);
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {
+      }
+      throw error51;
+    }
+    return;
+  }
+  db.exec(mode === "IMMEDIATE" ? "BEGIN IMMEDIATE" : "BEGIN");
+  try {
+    fn();
+    db.exec("COMMIT");
+  } catch (error51) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+    }
+    throw error51;
+  }
+}
+function failOpenTransaction(db, fn, mode = "DEFERRED") {
+  const nested = db.isTransaction;
+  try {
+    withTransaction(db, fn, mode);
+    return true;
+  } catch (error51) {
+    if (!db.isTransaction && nested) throw error51;
+    return false;
+  }
+}
+
+// ../packages/persistence/src/internal/warn.ts
+function akaWarn(message) {
+  process.stderr.write(`[aka] ${message}
+`);
+}
+
+// ../packages/persistence/src/db/migrations/introspection.ts
+function evidenceObjects(sql) {
+  const objects = [];
+  for (const m of sql.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g)) {
+    if (m[1] !== void 0 && !m[1].startsWith("__new_")) {
+      objects.push({ kind: "table", name: m[1] });
     }
   }
   for (const m of sql.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g)) {
@@ -20391,55 +21124,6 @@ function mapRowsTolerant(rows, map2) {
   return out;
 }
 
-// ../packages/persistence/src/paths.ts
-import { chmodSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
-var DATA_DIR_MODE = 448;
-var DATA_FILE_MODE = 384;
-var DB_FILENAME = "aka.db";
-function chmodBestEffort(path, mode) {
-  try {
-    chmodSync(path, mode);
-  } catch {
-  }
-}
-function tightenDir(dir) {
-  chmodBestEffort(dir, DATA_DIR_MODE);
-}
-function ensureDataDirSync(dir) {
-  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
-  tightenDir(dir);
-}
-function dbSidecars(file2) {
-  return [`${file2}-wal`, `${file2}-shm`, `${file2}-journal`];
-}
-function tightenFile(file2) {
-  try {
-    if (lstatSync(file2).isSymbolicLink()) return;
-  } catch {
-  }
-  chmodBestEffort(file2, DATA_FILE_MODE);
-}
-function tightenPerms(file2) {
-  for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
-}
-function writeOwnerOnlyFileSync(file2, data) {
-  const tmp = `${file2}.${String(process.pid)}.tmp`;
-  try {
-    rmSync(tmp, { force: true });
-  } catch {
-  }
-  try {
-    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
-    renameSync(tmp, file2);
-  } finally {
-    try {
-      rmSync(tmp, { force: true });
-    } catch {
-    }
-  }
-  tightenFile(file2);
-}
-
 // ../packages/persistence/src/migrations.ts
 function describeObject(object2) {
   return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
@@ -20555,9 +21239,9 @@ function applyLegacyDropMigration(db, file2) {
   }
 }
 function backupBeforeLegacyDrop(db, file2) {
-  const backup = `${file2}.pre-drop.${String(Date.now())}.bak`;
-  db.prepare("VACUUM INTO ?").run(backup);
-  tightenFile(backup);
+  reapStalePartials(file2);
+  const backup = backupPath(file2, "pre-drop");
+  snapshotStore(db, backup);
   return backup;
 }
 var TOKEN_USAGE_COLUMNS = [
@@ -20901,6 +21585,25 @@ function parseJsonObject(s) {
   return void 0;
 }
 
+// ../packages/persistence/src/internal/keyset-cursor.ts
+function encodeKeysetCursor(payload) {
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeKeysetCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
+  // resumes from is epoch millis, and a payload carrying ±Infinity or a
+  // fraction binds cleanly rather than failing — returning an EMPTY page with
+  // a null cursor, which a caller reads as "end of list". That is the one
+  // outcome a cursor that does not decode must never produce, since the
+  // documented behaviour above is to restart from the top. (`1e999` is valid
+  // JSON and parses to Infinity; a bare `NaN` is not, so it cannot arrive.)
+  Number.isInteger(parsed.startedAtMs) && typeof parsed.id === "string") {
+    return parsed;
+  }
+  return null;
+}
+
 // ../packages/persistence/src/repositories/activity.ts
 var DAY_MS = 864e5;
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
@@ -20946,16 +21649,6 @@ function utcWindow(nowMs) {
   const startMs = Math.floor(nowMs / DAY_MS) * DAY_MS;
   return { startMs, endMs: startMs + DAY_MS };
 }
-function encodeCursor(payload) {
-  return Buffer.from(JSON.stringify(payload)).toString("base64url");
-}
-function decodeCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
-    return parsed;
-  }
-  return null;
-}
 var DB_EVENT_TYPE_TO_KIND = {
   session: "session",
   prompt: "prompt",
@@ -21100,7 +21793,7 @@ var SqliteActivityRepository = class {
     return Promise.resolve({ sessionsToday, liveNow, toolCallsToday, findingsToday, egressToday });
   }
   listSessions(query) {
-    const cursor = query.cursor ? decodeCursor(query.cursor) : null;
+    const cursor = query.cursor ? decodeKeysetCursor(query.cursor) : null;
     const toMs = query.to ? isoToEpochMillis(query.to) : this.now();
     const fromMs = query.from ? isoToEpochMillis(query.from) : void 0;
     const conditions = [SESSION_ROOT];
@@ -21174,7 +21867,7 @@ var SqliteActivityRepository = class {
       )
     );
     const last = page[page.length - 1];
-    const nextCursor = hasMore && last ? encodeCursor({ startedAtMs: last.started_at, id: last.id }) : null;
+    const nextCursor = hasMore && last ? encodeKeysetCursor({ startedAtMs: last.started_at, id: last.id }) : null;
     return Promise.resolve({ items, nextCursor, emptyCount });
   }
   getSession(sessionId) {
@@ -22047,7 +22740,7 @@ var SqliteEventsRepository = class {
 };
 
 // ../packages/persistence/src/repositories/exceptions.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // ../packages/persistence/src/internal/sqlite-errors.ts
 var SQLITE_CONSTRAINT_UNIQUE = 2067;
@@ -22083,8 +22776,9 @@ var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
      AND conditions IS NULL
      AND ${ACTIVE_PREDICATE}`;
 var SqliteExceptionsRepository = class {
-  constructor(db) {
+  constructor(db, now = () => Date.now()) {
     this.db = db;
+    this.now = now;
     this.consumeStmt = db.prepare(
       `UPDATE exceptions
           SET use_count = use_count + 1, last_used_at = :now, updated_at = :now
@@ -22102,6 +22796,7 @@ var SqliteExceptionsRepository = class {
     );
   }
   db;
+  now;
   consumeStmt;
   insertBlockedStmt;
   sweepBlockedStmt;
@@ -22128,8 +22823,8 @@ var SqliteExceptionsRepository = class {
         "provider conditions are not supported yet \u2014 a grant with one would never apply"
       );
     }
-    const id = randomUUID();
-    const now = Date.now();
+    const id = randomUUID2();
+    const now = this.now();
     try {
       this.insertExceptionRow(id, input, now);
     } catch (err) {
@@ -22207,7 +22902,7 @@ var SqliteExceptionsRepository = class {
     const where = opts?.includeTerminal ? "" : `WHERE ${ACTIVE_PREDICATE}`;
     const rows = allRows(
       this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`),
-      opts?.includeTerminal ? {} : { now: Date.now() }
+      opts?.includeTerminal ? {} : { now: this.now() }
     );
     const exceptions = mapRowsTolerant(rows, parseExceptionRow);
     return Promise.resolve(exceptions);
@@ -22242,7 +22937,7 @@ var SqliteExceptionsRepository = class {
    * already revoked.
    */
   revoke(id, revokedBy, reason) {
-    const now = Date.now();
+    const now = this.now();
     const result = this.db.prepare(
       `UPDATE exceptions
             SET revoked_at = :now, revoked_by = :revokedBy, revoke_reason = :reason, updated_at = :now
@@ -22256,7 +22951,7 @@ var SqliteExceptionsRepository = class {
    * callers must treat identically — means it does not and the detection is
    * enforced as usual. Deliberately NOT wrapped in try/catch.
    */
-  consume(id, now = Date.now()) {
+  consume(id, now = this.now()) {
     const result = this.consumeStmt.run({ id, now });
     return Promise.resolve(Number(result.changes) === 1);
   }
@@ -22265,7 +22960,7 @@ var SqliteExceptionsRepository = class {
    * version — what rides the policy bundle to the hook. Grants written under
    * a different (rotated-away) key never match, so they are excluded at read.
    */
-  activeBundleEntries(keyVersion, now = Date.now()) {
+  activeBundleEntries(keyVersion, now = this.now()) {
     const rows = allRows(
       this.db.prepare(
         `SELECT * FROM exceptions
@@ -22297,7 +22992,7 @@ var SqliteExceptionsRepository = class {
    * than the retention window on every write, so the ledger self-limits.
    */
   recordBlocked(entry) {
-    const now = Date.now();
+    const now = this.now();
     this.sweepBlockedStmt.run({ cutoff: now - BLOCKED_DETECTIONS_RETENTION_MS });
     this.insertBlockedStmt.run({
       reference: entry.reference,
@@ -22320,7 +23015,7 @@ var SqliteExceptionsRepository = class {
           WHERE blocked_at > :cutoff
           ORDER BY blocked_at DESC, rowid DESC`
       ),
-      { cutoff: Date.now() - windowMs }
+      { cutoff: this.now() - windowMs }
     );
     return Promise.resolve(
       rows.map((row) => ({
@@ -22348,8 +23043,9 @@ var SqliteExceptionsRepository = class {
    * evaluate conditions, and a narrowing clause that is ignored would WIDEN the
    * grant instead. Fail closed until reveal-side condition evaluation exists.
    */
-  activeRevealGrant(ruleId, valueFingerprint, keyVersion, now = Date.now()) {
+  activeRevealGrant(ruleId, valueFingerprint, keyVersion, now) {
     try {
+      const at = now ?? this.now();
       const row = getRow(
         this.db.prepare(
           `SELECT id FROM exceptions
@@ -22358,7 +23054,7 @@ var SqliteExceptionsRepository = class {
               AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
             LIMIT 1`
         ),
-        { ruleId, valueFingerprint, keyVersion, now }
+        { ruleId, valueFingerprint, keyVersion, now: at }
       );
       return Promise.resolve(row ?? null);
     } catch (err) {
@@ -22372,7 +23068,7 @@ var SqliteExceptionsRepository = class {
    * predicate, so correctness never depends on this sweep; it only bounds how
    * long the audit evidence is kept locally. Returns the deleted count.
    */
-  sweepTerminal(retentionMs, now = Date.now()) {
+  sweepTerminal(retentionMs, now = this.now()) {
     const result = this.db.prepare(
       `DELETE FROM exceptions
           WHERE updated_at < :cutoff
@@ -22435,6 +23131,23 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 
 // ../packages/persistence/src/repositories/findings.ts
 var PREVIEW_INSTANCES_PER_GROUP = 200;
+var SCAN_BATCH_ROWS = 1e3;
+var DEFAULT_LOCATIONS_LIMIT = 100;
+var LOCATION_RULE_IDS_CAP = 20;
+function compareLocationOrder(a, b) {
+  return compareFindingGroupOrder(
+    {
+      severity: a.maxSeverity,
+      latestDetectedAt: a.latestDetectedAt,
+      id: ""
+    },
+    {
+      severity: b.maxSeverity,
+      latestDetectedAt: b.latestDetectedAt,
+      id: ""
+    }
+  );
+}
 var CONCAT_SEP = ",";
 var TUPLE_SEP = "|";
 function splitConcat(value) {
@@ -22447,6 +23160,33 @@ function deriveInstanceStatus(row) {
     latestResolutionStatus: row.latest_status
   });
 }
+function encodeGroupCursor(group) {
+  const payload = {
+    sev: group.severity,
+    t: group.latestDetectedAt,
+    id: group.id
+  };
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeGroupCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && typeof parsed.sev === "string" && typeof parsed.t === "string" && typeof parsed.id === "string") {
+    return {
+      severity: parsed.sev,
+      latestDetectedAt: parsed.t,
+      id: parsed.id
+    };
+  }
+  return null;
+}
+function firstAfter(sorted, cursor) {
+  const index = sorted.findIndex((g) => compareFindingGroupOrder(g, cursor) > 0);
+  return index === -1 ? sorted.length : index;
+}
+function findDeepLinked(sorted, page, id) {
+  if (page.some((g) => g.id === id || g.instances.some((i) => i.id === id))) return void 0;
+  return sorted.find((g) => g.id === id || g.instances.some((i) => i.id === id));
+}
 var DAY_MS3 = 864e5;
 var SqliteFindingsRepository = class {
   constructor(db) {
@@ -22556,8 +23296,13 @@ var SqliteFindingsRepository = class {
    */
   listGroupedFindings(query) {
     const sessionPredicate = query.sessionId ? ` AND e.root_session_id = :sessionId` : "";
-    const predicate = `WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})${sessionPredicate}`;
-    const sessionParams = query.sessionId ? { sessionId: query.sessionId } : {};
+    const fromMs = query.from === void 0 ? void 0 : isoToEpochMillis(query.from);
+    const fromPredicate = fromMs === void 0 ? "" : ` AND e.started_at >= :fromMs`;
+    const predicate = `WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})${sessionPredicate}${fromPredicate}`;
+    const sessionParams = {
+      ...query.sessionId ? { sessionId: query.sessionId } : {},
+      ...fromMs === void 0 ? {} : { fromMs }
+    };
     const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "", {
       predicate,
       params: sessionParams
@@ -22565,7 +23310,8 @@ var SqliteFindingsRepository = class {
     const rows = allRows(
       this.db.prepare(
         `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
-                occurred_at, source_tool, repo, file, tool_name, kind, finding_key, latest_status
+                occurred_at, source_tool, repo, file, tool_name, event_id, session_id,
+                kind, finding_key, latest_status
          FROM (
            SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
                   d.severity AS severity, f.masked_match AS masked_match,
@@ -22575,6 +23321,7 @@ var SqliteFindingsRepository = class {
                   json_extract(e.attributes, '$.repo') AS repo,
                   json_extract(e.attributes, '$.file_path') AS file,
                   json_extract(e.attributes, '$.tool_name') AS tool_name,
+                  f.audit_event_id AS event_id, e.root_session_id AS session_id,
                   e.event_type AS kind, f.finding_key AS finding_key,
                   latest.status AS latest_status,
                   ROW_NUMBER() OVER (
@@ -22606,6 +23353,8 @@ var SqliteFindingsRepository = class {
       repo: r.repo ?? "",
       file: r.file ?? "",
       ...r.tool_name === null ? {} : { toolName: r.tool_name },
+      eventId: r.event_id,
+      ...r.session_id === null ? {} : { sessionId: r.session_id },
       status: deriveInstanceStatus(r)
     }));
     const allGroups = buildFindingGroups(groupable, { aggregates });
@@ -22629,18 +23378,23 @@ var SqliteFindingsRepository = class {
       groups: sorted.length
     };
     const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeGroupCursor(query.cursor);
+    const start = cursor === null ? 0 : firstAfter(sorted, cursor);
+    const page = sorted.slice(start, start + limit);
+    const lastOnPage = page.at(-1);
+    const nextCursor = start + limit < sorted.length && lastOnPage ? encodeGroupCursor(lastOnPage) : null;
+    const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinked(sorted, page, query.includeId);
     const statusSet = statusFilter.length > 0 ? new Set(statusFilter) : null;
-    const items = sorted.slice(0, limit).map(
-      (g) => statusSet ? {
-        ...g,
-        instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
-      } : g
-    );
+    const narrow = (g) => statusSet ? {
+      ...g,
+      instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
+    } : g;
+    const items = [...page, ...deepLinked ? [deepLinked] : []].map(narrow);
     return Promise.resolve({
       totals,
       facets,
       items,
-      nextCursor: null,
+      nextCursor,
       ...query.sessionId ? { sessionFirings: this.sessionFirings(query.sessionId) } : {}
     });
   }
@@ -22672,6 +23426,266 @@ var SqliteFindingsRepository = class {
    * request actually carries a `q`. (Substring matching is unaffected by a
    * path repeating across tuples.)
    */
+  /**
+   * The instance-level (flat) findings list: one row per finding, newest first,
+   * paged by keyset.
+   *
+   * SQL owns SCOPE, JS owns every FILTER DIMENSION. The session and the time
+   * bound are SQL predicates: nothing counts them, so narrowing the scan by
+   * them changes no reported number. Severity, subtype, provider, action,
+   * status, tool, repo, file and `q` all stay in JS — each has a facet, and a
+   * facet excludes its own filter, so a row the filter rejects still has to be
+   * counted. Pushing any of them into SQL would silently empty its own facet.
+   * Several could not be expressed there anyway: status comes from the one
+   * shared classifier (deriveFindingStatus), and provider 'api' means "a tool
+   * none of the mappers names", which no IN-list can say.
+   *
+   * The scan runs from the top of the scope on every request, not from the
+   * cursor: `totals` and `facets` describe the whole filtered scope and must not
+   * move as the caller pages. Rows are pulled in batches so memory stays flat
+   * while the counting runs, and only the page itself is retained.
+   */
+  listFindingInstances(query) {
+    const opts = {
+      severity: query.severity,
+      subtype: query.subtype,
+      providers: query.provider,
+      actions: query.action,
+      statuses: query.status,
+      tools: query.tool,
+      repo: query.repo,
+      file: query.file,
+      q: query.q
+    };
+    const limit = query.limit ?? DEFAULT_FLAT_FINDINGS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const accumulator = createInstanceFacetAccumulator(opts);
+    const items = [];
+    let total = 0;
+    let last;
+    let hasMore = false;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from
+    })) {
+      accumulator.add(row);
+      if (!matchesInstanceFilters(row, opts)) continue;
+      total += 1;
+      if (items.length < limit) {
+        items.push(toInstanceDetail(row));
+        last = row;
+      } else {
+        hasMore = true;
+      }
+    }
+    const nextCursor = hasMore && last ? encodeKeysetCursor({ startedAtMs: isoToEpochMillis(last.occurredAt), id: last.id }) : null;
+    if (cursor !== null) {
+      const resumed = this.pageAfter(cursor, opts, limit, query);
+      return Promise.resolve({
+        totals: { findings: total },
+        facets: accumulator.facets(),
+        items: resumed.items,
+        nextCursor: resumed.nextCursor
+      });
+    }
+    return Promise.resolve({
+      totals: { findings: total },
+      facets: accumulator.facets(),
+      items,
+      nextCursor
+    });
+  }
+  /**
+   * The page of matching rows strictly after `cursor`. Separate from the
+   * counting pass because that one starts at the top of the scope by design;
+   * this one narrows the scan with the same keyset predicate the activity list
+   * uses, so a later page costs less than the first rather than more.
+   */
+  pageAfter(cursor, opts, limit, query) {
+    const items = [];
+    let last;
+    let hasMore = false;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from,
+      after: cursor
+    })) {
+      if (!matchesInstanceFilters(row, opts)) continue;
+      if (items.length < limit) {
+        items.push(toInstanceDetail(row));
+        last = row;
+      } else {
+        hasMore = true;
+        break;
+      }
+    }
+    return {
+      items,
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: isoToEpochMillis(last.occurredAt), id: last.id }) : null
+    };
+  }
+  /**
+   * The same findings folded by location: repository, then file within it.
+   *
+   * The grouping keys come from the capturing event's attributes, which is what
+   * the local store relates a finding to — there is no finding↔asset row to
+   * group by instead. A repo or file the event did not record folds into the
+   * empty-string bucket, which the view renders but does not link, since no
+   * filter can name it.
+   */
+  listFindingLocations(query) {
+    const opts = {
+      severity: query.severity,
+      subtype: query.subtype,
+      providers: query.provider,
+      actions: query.action,
+      statuses: query.status,
+      tools: query.tool,
+      q: query.q
+    };
+    const limit = query.limit ?? DEFAULT_LOCATIONS_LIMIT;
+    const byRepo = /* @__PURE__ */ new Map();
+    let total = 0;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from
+    })) {
+      if (!matchesInstanceFilters(row, opts)) continue;
+      total += 1;
+      let files = byRepo.get(row.repo);
+      if (files === void 0) {
+        files = /* @__PURE__ */ new Map();
+        byRepo.set(row.repo, files);
+      }
+      let acc = files.get(row.file);
+      if (acc === void 0) {
+        acc = newLocationAccumulator();
+        files.set(row.file, acc);
+      }
+      addToLocation(acc, row);
+    }
+    let fileCount = 0;
+    const repos = [...byRepo.entries()].map(([repo, files]) => {
+      fileCount += files.size;
+      const fileRows = [...files.entries()].map(([file2, acc]) => ({
+        file: file2,
+        instanceCount: acc.instanceCount,
+        maxSeverity: acc.maxSeverity,
+        latestDetectedAt: acc.latestDetectedAt,
+        ...foldGroupStatus(acc.statuses) === void 0 ? {} : { status: foldGroupStatus(acc.statuses) },
+        ruleIds: [...acc.ruleIds].slice(0, LOCATION_RULE_IDS_CAP)
+      })).sort(compareLocationOrder);
+      const rollup = fileRows.reduce(
+        (a, f) => ({
+          instanceCount: a.instanceCount + f.instanceCount,
+          maxSeverity: compareLocationOrder(f, a) < 0 ? f.maxSeverity : a.maxSeverity,
+          latestDetectedAt: f.latestDetectedAt > a.latestDetectedAt ? f.latestDetectedAt : a.latestDetectedAt
+        }),
+        {
+          instanceCount: 0,
+          maxSeverity: fileRows[0]?.maxSeverity ?? "low",
+          latestDetectedAt: ""
+        }
+      );
+      const statuses = fileRows.map((f) => f.status);
+      const folded = foldGroupStatus(statuses);
+      return {
+        repo,
+        instanceCount: rollup.instanceCount,
+        maxSeverity: rollup.maxSeverity,
+        latestDetectedAt: rollup.latestDetectedAt,
+        ...folded === void 0 ? {} : { status: folded },
+        files: fileRows
+      };
+    });
+    repos.sort(compareLocationOrder);
+    return Promise.resolve({
+      totals: { findings: total, repos: repos.length, files: fileCount },
+      items: repos.slice(0, limit),
+      hasMore: repos.length > limit
+    });
+  }
+  /**
+   * Every finding in scope as a FlatFindingRow, newest first, pulled in batches.
+   *
+   * A generator so a caller streams the scope without it ever being an array:
+   * the flat list counts and facets the whole filtered scope, which on a large
+   * store is far more rows than any page. Each batch advances the same keyset
+   * predicate the page read uses, so the scan is a sequence of bounded reads
+   * rather than one unbounded result set.
+   *
+   * The latest-resolution lookup is the CORRELATED form, not the derived table
+   * the grouped path joins: only `status` is needed, idx_finding_resolution_key
+   * makes it a point lookup per row, and the derived table would re-materialize
+   * a window over the whole resolution table once per batch.
+   *
+   * `scope` carries ONLY what no facet counts. A filter dimension narrowed here
+   * would be missing from its own facet, which is computed by excluding that
+   * dimension — see listFindingInstances.
+   */
+  *scanFindingRows(scope) {
+    const conditions = [`e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`];
+    const params = [];
+    if (scope.sessionId !== void 0 && scope.sessionId !== "") {
+      conditions.push("e.root_session_id = ?");
+      params.push(scope.sessionId);
+    }
+    if (scope.from !== void 0) {
+      conditions.push("e.started_at >= ?");
+      params.push(isoToEpochMillis(scope.from));
+    }
+    const sql = `SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
+              d.severity AS severity, f.masked_match AS masked_match,
+              f.action_taken AS action_taken, f.confidence AS confidence,
+              e.started_at AS occurred_at,
+              json_extract(e.attributes, '$.source_tool') AS source_tool,
+              json_extract(e.attributes, '$.repo') AS repo,
+              json_extract(e.attributes, '$.file_path') AS file,
+              json_extract(e.attributes, '$.tool_name') AS tool_name,
+              f.audit_event_id AS event_id, e.root_session_id AS session_id,
+              e.event_type AS kind, f.finding_key AS finding_key,
+              ${latestResolutionStatusSql("f")} AS latest_status
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+        WHERE ${conditions.join(" AND ")}
+          AND (e.started_at < ? OR (e.started_at = ? AND f.id < ?))
+        ORDER BY e.started_at DESC, f.id DESC
+        LIMIT ?`;
+    let after = scope.after ?? { startedAtMs: Number.MAX_SAFE_INTEGER, id: "\uFFFF" };
+    for (; ; ) {
+      const rows = allRows(this.db.prepare(sql), [
+        ...params,
+        after.startedAtMs,
+        after.startedAtMs,
+        after.id,
+        SCAN_BATCH_ROWS
+      ]);
+      for (const r of rows) {
+        yield {
+          id: r.id,
+          ruleId: r.rule_id,
+          category: r.category,
+          severity: r.severity,
+          maskedMatch: r.masked_match,
+          actionTaken: r.action_taken,
+          confidence: r.confidence,
+          occurredAt: epochMillisToIso(r.occurred_at),
+          sourceTool: r.source_tool,
+          repo: r.repo ?? "",
+          file: r.file ?? "",
+          ...r.tool_name === null ? {} : { toolName: r.tool_name },
+          eventId: r.event_id,
+          ...r.session_id === null ? {} : { sessionId: r.session_id },
+          status: deriveInstanceStatus(r)
+        };
+      }
+      if (rows.length < SCAN_BATCH_ROWS) return;
+      const lastRow = rows[rows.length - 1];
+      if (lastRow === void 0) return;
+      after = { startedAtMs: lastRow.occurred_at, id: lastRow.id };
+    }
+  }
   groupAggregates(withSearchText, scope) {
     const innerSearchColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.attributes, '$.repo')) AS repos,
            group_concat(DISTINCT json_extract(e.attributes, '$.file_path')) AS files,
@@ -22932,7 +23946,7 @@ var SqliteInspectionFindingsRepository = class {
 };
 
 // ../packages/persistence/src/repositories/installed-packs.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 
 // ../packages/persistence/src/semver.ts
 function parse4(version2) {
@@ -23083,7 +24097,7 @@ var SqliteInstalledPacksRepository = class {
           let behind = false;
           for (const row of rows) {
             const params = {
-              id: randomUUID2(),
+              id: randomUUID3(),
               namespace: row.namespace,
               packId: row.packId,
               version: row.version,
@@ -23095,7 +24109,7 @@ var SqliteInstalledPacksRepository = class {
             if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
               this.upsertAvailableStmt.run({
                 ...params,
-                id: randomUUID2(),
+                id: randomUUID3(),
                 recordedBy: meta3?.recordedBy ?? null
               });
             } else {
@@ -23418,14 +24432,15 @@ var SqliteInventoryRepository = class {
 };
 
 // ../packages/persistence/src/repositories/inventory-assets.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var CATEGORY_ORDER = ["config", "skill", "mcp", "hook"];
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
 var WORKTREE_CHECKOUT_FILTER = "(url IS NULL OR (url NOT LIKE '%/.claude/worktrees/%' AND url NOT LIKE '%\\.claude\\worktrees\\%'))";
 var HARNESS_LABELS = {
   claudecode: "Claude Code",
   cursor: "Cursor",
-  codex: "Codex"
+  codex: "Codex",
+  antigravity: "Antigravity"
 };
 var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
 var EMPTY_PROJECT_AGG = {
@@ -23440,6 +24455,7 @@ function resolveHarnessId(attrs, row) {
   if (t.includes("claudecode") || t === "claude") return "claudecode";
   if (t.includes("cursor")) return "cursor";
   if (t.includes("codex")) return "codex";
+  if (t.includes("antigravity")) return "antigravity";
   return null;
 }
 function isLiveRealClaudeCode(rows) {
@@ -23898,7 +24914,7 @@ var SqliteInventoryAssetsRepository = class {
         `INSERT INTO file_access_override (id, project_id, path, access, created_at, updated_at)
            VALUES (:id, :projectId, :path, :access, :now, :now)
            ON CONFLICT (project_id, path) DO UPDATE SET access = excluded.access, updated_at = excluded.updated_at`
-      ).run({ id: randomUUID3(), projectId, path, access, now: Date.now() });
+      ).run({ id: randomUUID4(), projectId, path, access, now: Date.now() });
     }
     return true;
   }
@@ -23919,7 +24935,7 @@ var SqliteInventoryAssetsRepository = class {
         `INSERT INTO mcp_trust_override (id, asset_id, trust, created_at, updated_at)
            VALUES (:id, :assetId, :trust, :now, :now)
            ON CONFLICT (asset_id) DO UPDATE SET trust = excluded.trust, updated_at = excluded.updated_at`
-      ).run({ id: randomUUID3(), assetId, trust, now: Date.now() });
+      ).run({ id: randomUUID4(), assetId, trust, now: Date.now() });
     }
     this.configRowsCache = void 0;
     return "ok";
@@ -24216,7 +25232,7 @@ var SqliteInventoryAssetsRepository = class {
 };
 
 // ../packages/persistence/src/repositories/policies.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var SqlitePoliciesRepository = class {
   constructor(db) {
     this.db = db;
@@ -24251,7 +25267,7 @@ var SqlitePoliciesRepository = class {
     failOpenTransaction(this.db, () => {
       for (const [category, action] of Object.entries(DEFAULT_ACTIONS)) {
         stmt.run({
-          id: randomUUID4(),
+          id: randomUUID5(),
           target: JSON.stringify({ category }),
           action,
           now: Date.now()
@@ -24271,7 +25287,7 @@ var SqlitePoliciesRepository = class {
       `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
          VALUES (:id, 'global', :target, :action, 1, :now, :now)
          ON CONFLICT(scope, target) DO UPDATE SET action = excluded.action, enabled = 1, updated_at = excluded.updated_at`
-    ).run({ id: randomUUID4(), target: JSON.stringify({ category }), action, now });
+    ).run({ id: randomUUID5(), target: JSON.stringify({ category }), action, now });
   }
   // Caps every global per-category policy currently set to block/redact down
   // to warn (see warn-era-cap.ts). Rule-targeted policies are untouched.
@@ -24339,7 +25355,7 @@ var SqlitePolicyCatalogRepository = class {
 };
 
 // ../packages/persistence/src/repositories/project-files.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var SqliteProjectFilesRepository = class {
   constructor(db) {
     this.db = db;
@@ -24371,7 +25387,7 @@ var SqliteProjectFilesRepository = class {
     const stamp = Math.max(now, maxStamp + 1);
     for (const file2 of scan2.files) {
       this.upsertStmt.run({
-        id: randomUUID5(),
+        id: randomUUID6(),
         projectId,
         path: file2.path,
         name: file2.name,
@@ -24385,7 +25401,7 @@ var SqliteProjectFilesRepository = class {
 };
 
 // ../packages/persistence/src/repositories/resolutions.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 var SqliteResolutionsRepository = class {
   constructor(db, now = () => Date.now()) {
     this.db = db;
@@ -24439,7 +25455,7 @@ var SqliteResolutionsRepository = class {
    */
   insertResolution(r) {
     this.insertStmt.run({
-      id: randomUUID6(),
+      id: randomUUID7(),
       findingKey: r.findingKey,
       status: FindingStatus.parse(r.status),
       method: ResolutionMethod.parse(r.method),
@@ -24498,13 +25514,51 @@ var SqliteRuleProbeCacheRepository = class {
     this.readStmt = db.prepare(
       `SELECT verdict, worst_probe_ms AS worstProbeMs FROM rule_probe_cache WHERE rule_key = :ruleKey`
     );
+    this.countQuarantinedStmt = db.prepare(
+      `SELECT COUNT(*) AS n FROM rule_probe_cache WHERE verdict = 'quarantined'`
+    );
+    this.clearQuarantinedStmt = db.prepare(
+      `DELETE FROM rule_probe_cache WHERE verdict = 'quarantined'`
+    );
   }
   db;
   upsertStmt;
   readStmt;
+  countQuarantinedStmt;
+  clearQuarantinedStmt;
   getVerdict(ruleKey) {
     return getRow(this.readStmt, { ruleKey });
   }
+  /** How many rules are currently excluded by a cached quarantine verdict. */
+  countQuarantined() {
+    return getRow(this.countQuarantinedStmt, {})?.n ?? 0;
+  }
+  /**
+   * Forgets every quarantine verdict, so the rules behind them are measured
+   * again on the next load. This is the undo for a verdict the machine reached
+   * on its own: a rule terminated mid-scan is cached forever and dropped from
+   * every later scan, and a timing verdict is a wall-clock judgement that a
+   * loaded or slow machine can reach about a rule that is in fact fine.
+   *
+   * Only 'quarantined' rows go — a 'safe' verdict is a measurement worth
+   * keeping, and dropping it would make every rule pay the battery again.
+   *
+   * Reports `refused` from the write's own result rather than inferring it from
+   * the row count. The two are NOT the same answer: `failOpenTransaction`
+   * swallows a contended DELETE (another writer holding the lock past
+   * `busy_timeout` — reads are unaffected in WAL), and a swallowed refusal
+   * leaves the count unchanged, which is indistinguishable from "there was
+   * nothing to clear". An undo that reports success while the quarantines are
+   * still in place is worse than one that fails, because the rules it claimed
+   * to restore are silently still disabled.
+   */
+  clearQuarantined() {
+    const before = this.countQuarantined();
+    const committed = failOpenTransaction(this.db, () => {
+      this.clearQuarantinedStmt.run();
+    });
+    return { refused: !committed, cleared: before - this.countQuarantined() };
+  }
   setVerdict(ruleKey, verdict, worstProbeMs) {
     failOpenTransaction(this.db, () => {
       this.upsertStmt.run({ ruleKey, verdict, worstProbeMs, checkedAt: Date.now() });
@@ -24559,7 +25613,39 @@ var SqliteScanLedgerRepository = class {
 };
 
 // ../packages/persistence/src/repositories/secret-vault.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
+function pageLimit(requested, fallback) {
+  if (requested === void 0) return fallback;
+  return Math.min(Math.max(1, Math.trunc(requested)), MAX_VAULT_PAGE_LIMIT);
+}
+function encodeReuseCursor(payload) {
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeReuseCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
+  // ±Infinity or a fraction binds cleanly and returns an EMPTY page with a
+  // null cursor, which the caller reads as "end of list" — the one outcome a
+  // malformed cursor must never produce, since restarting from the top is the
+  // documented behaviour and the only recoverable one. (`1e999` is valid JSON
+  // and parses to Infinity; a bare `NaN` is not, so it cannot arrive here.)
+  Number.isInteger(parsed.occurrences) && typeof parsed.pointerId === "string") {
+    return { occurrences: parsed.occurrences, pointerId: parsed.pointerId };
+  }
+  return null;
+}
+var REUSED_PREDICATE = `(v.occurrence_count > 1
+     OR (SELECT count(*) FROM secret_vault_sighting s WHERE s.pointer_id = v.pointer_id) > 1)`;
+var INVENTORY_COLUMNS = `v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
+          v.occurrence_count, v.first_seen, v.last_seen`;
+function toSighting(row) {
+  return {
+    location: row.location,
+    kind: row.kind,
+    firstSeen: new Date(row.first_seen).toISOString(),
+    lastSeen: new Date(row.last_seen).toISOString()
+  };
+}
 var SELECT_COLUMNS = `
   pointer_id AS pointerId,
   value_fingerprint AS valueFingerprint,
@@ -24743,39 +25829,67 @@ var SqliteSecretVaultRepository = class {
          VALUES (:id, :pointerId, :location, :kind, :now, :now)
          ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`
     ).run({
-      id: randomUUID7(),
+      id: randomUUID8(),
       pointerId: entry.pointerId,
       location: entry.location,
       kind: entry.kind,
       now
     });
   }
-  listSightings(pointerId) {
+  /**
+   * Sightings for a whole page of pointers, in ONE query grouped in JS rather
+   * than one query per row. A pointer with no sightings still gets an entry, so
+   * the caller never has to distinguish "none" from "missing".
+   *
+   * The `IN` list is sized to the page, so this statement cannot be cached on
+   * the instance the way the fixed-shape ones in the constructor are.
+   */
+  sightingsFor(pointerIds) {
+    const byPointer = new Map(pointerIds.map((id) => [id, []]));
+    if (pointerIds.length === 0) return byPointer;
     const rows = allRows(
       this.db.prepare(
-        `SELECT location, kind, first_seen, last_seen FROM secret_vault_sighting
-          WHERE pointer_id = :pointerId ORDER BY last_seen DESC`
+        `SELECT pointer_id, location, kind, first_seen, last_seen
+           FROM secret_vault_sighting
+          WHERE pointer_id IN (${placeholders(pointerIds.length)})
+          ORDER BY last_seen DESC`
       ),
-      { pointerId }
+      pointerIds
     );
+    for (const row of rows) byPointer.get(row.pointer_id)?.push(toSighting(row));
+    return byPointer;
+  }
+  /** Hydrate a page of raw inventory rows with their sightings, batched. */
+  toInventoryEntries(rows) {
+    const sightings = this.sightingsFor(rows.map((r) => r.pointer_id));
     return rows.map((r) => ({
-      location: r.location,
-      kind: r.kind,
+      pointerId: r.pointer_id,
+      category: r.category,
+      ...r.provider === null ? {} : { provider: r.provider },
+      maskedMatch: r.masked_match,
+      occurrences: r.occurrence_count,
       firstSeen: new Date(r.first_seen).toISOString(),
-      lastSeen: new Date(r.last_seen).toISOString()
+      lastSeen: new Date(r.last_seen).toISOString(),
+      revealGrantId: r.grant_id,
+      sightings: sightings.get(r.pointer_id) ?? []
     }));
   }
   /**
-   * The dashboard inventory: every vaulted value's descriptor data joined with
-   * its sightings and the active reveal-to-model grant when one exists.
-   * Raw-free by construction — neither the fingerprint nor the ciphertext
-   * columns are selected.
+   * The dashboard inventory, newest-first, ONE PAGE at a time: every vaulted
+   * value's descriptor data joined with its sightings and the active
+   * reveal-to-model grant when one exists. Raw-free by construction — neither
+   * the fingerprint nor the ciphertext columns are selected.
+   *
+   * `totals.values` counts the whole store, not the page, so the count a reader
+   * sees never depends on how far they have paged.
    */
-  listInventory(now = Date.now()) {
+  listInventory(query = {}, now = Date.now()) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_INVENTORY_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const where = cursor === null ? "" : "WHERE (v.last_seen < :cursorLastSeen OR (v.last_seen = :cursorLastSeen AND v.pointer_id < :cursorPointerId))";
     const rows = allRows(
       this.db.prepare(
-        `SELECT v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
-                v.occurrence_count, v.first_seen, v.last_seen,
+        `SELECT ${INVENTORY_COLUMNS},
                 (SELECT e.id FROM exceptions e
                   WHERE e.rule_id = v.rule_id
                     AND e.value_fingerprint = v.value_fingerprint
@@ -24783,45 +25897,109 @@ var SqliteSecretVaultRepository = class {
                     AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
                   LIMIT 1) AS grant_id
            FROM secret_vault v
-          ORDER BY v.last_seen DESC`
+           ${where}
+          ORDER BY v.last_seen DESC, v.pointer_id DESC
+          LIMIT :limit`
       ),
-      { now }
+      bindParams({
+        now,
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorLastSeen: cursor.startedAtMs, cursorPointerId: cursor.id }
+      })
     );
-    return rows.map((r) => ({
-      pointerId: r.pointer_id,
-      category: r.category,
-      ...r.provider === null ? {} : { provider: r.provider },
-      maskedMatch: r.masked_match,
-      occurrences: r.occurrence_count,
-      firstSeen: new Date(r.first_seen).toISOString(),
-      lastSeen: new Date(r.last_seen).toISOString(),
-      revealGrantId: r.grant_id,
-      sightings: this.listSightings(r.pointer_id)
-    }));
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    return {
+      totals: { values: this.countEntries() },
+      items: this.toInventoryEntries(page),
+      // Minted from the last row of the PAGE, never the extra probe row.
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: last.last_seen, id: last.pointer_id }) : null
+    };
+  }
+  /**
+   * Values reused on this machine — detected more than once, or written to more
+   * than one location — most-reused first, one page at a time.
+   *
+   * Its own read rather than a filter over an inventory page: reuse is a
+   * property of the whole store, and deriving it from 50 newest rows would
+   * under-report exactly the values a reader most needs to see.
+   */
+  listReuse(query = {}, now = Date.now()) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_INVENTORY_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeReuseCursor(query.cursor);
+    const after = cursor === null ? "" : `AND (v.occurrence_count < :cursorOccurrences
+              OR (v.occurrence_count = :cursorOccurrences AND v.pointer_id < :cursorPointerId))`;
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT ${INVENTORY_COLUMNS},
+                (SELECT e.id FROM exceptions e
+                  WHERE e.rule_id = v.rule_id
+                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.key_version = v.fingerprint_key_version
+                    AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+                  LIMIT 1) AS grant_id
+           FROM secret_vault v
+          WHERE ${REUSED_PREDICATE} ${after}
+          ORDER BY v.occurrence_count DESC, v.pointer_id DESC
+          LIMIT :limit`
+      ),
+      bindParams({
+        now,
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorOccurrences: cursor.occurrences, cursorPointerId: cursor.pointerId }
+      })
+    );
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    return {
+      totals: { reused: this.countReused() },
+      items: this.toInventoryEntries(page),
+      nextCursor: hasMore && last ? encodeReuseCursor({ occurrences: last.occurrence_count, pointerId: last.pointer_id }) : null
+    };
   }
   /**
-   * The de-reference trail, newest first. By default the batched, high-volume
-   * reasons (display, view-render) are hidden and counted instead — the rows
-   * that matter as a signal are the model crossings, and burying them under
-   * render noise would defeat the audit's purpose.
+   * The de-reference trail, newest first, one page at a time. By default the
+   * batched, high-volume reasons (display, view-render) are hidden and counted
+   * instead — the rows that matter as a signal are the model crossings, and
+   * burying them under render noise would defeat the audit's purpose.
+   *
+   * `hiddenBatched` counts the whole trail rather than the page: it is what the
+   * view's "N hidden" line and its toggle speak for, so it must not shrink as
+   * the reader pages.
    */
-  listDerefs(opts) {
-    const limit = opts?.limit ?? 200;
-    const where = opts?.includeBatched === true ? "" : `WHERE reason NOT IN ('display', 'view-render')`;
+  listDerefs(query = {}) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_DEREFS_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const conditions = [];
+    if (query.includeBatched !== true) {
+      conditions.push(`reason NOT IN ('display', 'view-render')`);
+    }
+    if (cursor !== null) {
+      conditions.push("(at < :cursorAt OR (at = :cursorAt AND id < :cursorId))");
+    }
+    const where = conditions.length === 0 ? "" : `WHERE ${conditions.join(" AND ")}`;
     const rows = allRows(
       this.db.prepare(
         `SELECT id, pointer_id, at, target, reason, outcome, grant_id, pointer_count
            FROM secret_vault_deref ${where}
-          ORDER BY at DESC, rowid DESC LIMIT :limit`
+          ORDER BY at DESC, id DESC LIMIT :limit`
       ),
-      { limit }
+      bindParams({
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorAt: cursor.startedAtMs, cursorId: cursor.id }
+      })
     );
-    const hiddenBatched = opts?.includeBatched === true ? 0 : countScalar(
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    const hiddenBatched = query.includeBatched === true ? 0 : countScalar(
       this.db,
       `SELECT count(*) AS n FROM secret_vault_deref WHERE reason IN ('display', 'view-render')`
     );
     return {
-      rows: rows.map((r) => ({
+      items: page.map((r) => ({
         id: r.id,
         pointerId: r.pointer_id,
         at: new Date(r.at).toISOString(),
@@ -24831,12 +26009,20 @@ var SqliteSecretVaultRepository = class {
         ...r.grant_id === null ? {} : { grantId: r.grant_id },
         pointerCount: r.pointer_count
       })),
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: last.at, id: last.id }) : null,
       hiddenBatched
     };
   }
   countEntries() {
     return countScalar(this.db, "SELECT COUNT(*) AS n FROM secret_vault");
   }
+  /** Values reused on this machine — the reuse list's page-independent total. */
+  countReused() {
+    return countScalar(
+      this.db,
+      `SELECT COUNT(*) AS n FROM secret_vault v WHERE ${REUSED_PREDICATE}`
+    );
+  }
 };
 
 // ../packages/persistence/src/repositories/security.ts
@@ -24851,7 +26037,9 @@ var ENFORCEMENT_KINDS = ["blocked", "redacted", "warned"];
 var SCAN_COVERAGE = [
   { provider: "claudecode", coverage: 100, supported: true },
   { provider: "cursor", coverage: 0, supported: false },
-  { provider: "codex", coverage: 0, supported: false },
+  { provider: "codex", coverage: 80, supported: true },
+  { provider: "antigravity", coverage: 60, supported: true },
+  { provider: "claudeai", coverage: 0, supported: false },
   { provider: "chatgpt", coverage: 0, supported: false },
   { provider: "copilot", coverage: 0, supported: false },
   { provider: "api", coverage: 0, supported: false }
@@ -25184,7 +26372,7 @@ var SqliteSecurityRepository = class {
 };
 
 // ../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
 var IN_CHUNK = 500;
 var KIND_ORDER = ["provider", "internal", "external", "ip"];
@@ -25440,7 +26628,7 @@ var SqliteSharesRepository = class {
                (id, destination_id, host, decision, created_at, updated_at)
              VALUES (:id, :destinationId, :host, :decision, :now, :now)`
         ).run({
-          id: randomUUID8(),
+          id: randomUUID9(),
           destinationId,
           host: dest.host,
           decision,
@@ -25589,7 +26777,7 @@ var SqliteSharesRepository = class {
       let destinationId = destIds.get(hit.host);
       if (destinationId === void 0) {
         destStmt.run({
-          id: randomUUID8(),
+          id: randomUUID9(),
           kind: hit.kind,
           name: hit.name,
           host: hit.host,
@@ -25605,7 +26793,7 @@ var SqliteSharesRepository = class {
       let endpointId = endpointIds.get(endpointKey);
       if (endpointId === void 0) {
         endpointStmt.run({
-          id: randomUUID8(),
+          id: randomUUID9(),
           destinationId,
           method: hit.method,
           transport: hit.transport,
@@ -25618,7 +26806,7 @@ var SqliteSharesRepository = class {
         endpointIds.set(endpointKey, endpointId);
       }
       siteStmt.run({
-        id: randomUUID8(),
+        id: randomUUID9(),
         endpointId,
         project: input.project,
         projectKey: input.projectKey,
@@ -25983,6 +27171,9 @@ function purgeSampleData(db) {
 }
 
 // ../packages/persistence/src/database.ts
+var UNSAFE_TEST_ONLY_RAW_HANDLE = /* @__PURE__ */ Symbol(
+  "aka.persistence.unsafeTestOnlyRawHandle"
+);
 function linkHost(input, hostId) {
   return hostId ? { ...input, hostId } : input;
 }
@@ -26004,21 +27195,34 @@ function openWithPragmas(file2) {
   }
   return db;
 }
-function backupLegacyStore(file2) {
-  const backup = `${file2}.legacy.${String(Date.now())}.bak`;
-  renameSync2(file2, backup);
-  tightenFile(backup);
-  for (const sidecar of dbSidecars(file2)) {
-    if (existsSync2(sidecar)) rmSync2(sidecar);
+function backupLegacyStore(db, file2) {
+  reapStalePartials(file2);
+  const backup = backupPath(file2, "legacy");
+  let snapshotted = false;
+  let snapshotError;
+  try {
+    snapshotStore(db, backup);
+    snapshotted = true;
+  } catch (error51) {
+    snapshotError = error51;
+  } finally {
+    db.close();
+  }
+  if (!snapshotted) {
+    akaWarn(
+      `Could not snapshot the incompatible ${DB_FILENAME} (${String(snapshotError)}); moving the store aside with its sidecars instead.`
+    );
+    moveStoreAside(file2, backup);
+    return backup;
   }
+  discardStore(file2, backup);
   return backup;
 }
 function openAndInitialize(file2) {
   let db = openWithPragmas(file2);
   try {
     if (isForeignSqliteLineage(db)) {
-      db.close();
-      const backup = backupLegacyStore(file2);
+      const backup = backupLegacyStore(db, file2);
       db = openWithPragmas(file2);
       akaWarn(
         `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
@@ -26062,7 +27266,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join2(dir, DB_FILENAME);
+  const file2 = join3(dir, DB_FILENAME);
   const {
     db,
     events,
@@ -26179,7 +27383,7 @@ function openLocalDatabase(dir) {
         const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
         if (!definitionId) continue;
         inspectionFindings.insertFinding({
-          id: randomUUID9(),
+          id: randomUUID10(),
           auditEventId: record2.scanEvent.id,
           inspectionDefinitionId: definitionId,
           span: finding.span,
@@ -26285,8 +27489,224 @@ function openLocalDatabase(dir) {
     transaction,
     close: () => {
       db.close();
+    },
+    // Last, and a plain value rather than a getter, so `{ ...db }` carries it.
+    [UNSAFE_TEST_ONLY_RAW_HANDLE]: db
+  };
+}
+
+// ../packages/persistence/src/file-lock.ts
+import { randomUUID as randomUUID11 } from "crypto";
+import {
+  closeSync,
+  existsSync as existsSync3,
+  openSync,
+  readFileSync as readFileSync2,
+  rmSync as rmSync3,
+  statSync as statSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { hostname as hostname3 } from "os";
+var LOCK_SUFFIX = ".lock";
+var DEFAULT_TIMEOUT_MS = 5e3;
+var DEFAULT_STALE_MS = 2e3;
+var RETRY_INTERVAL_MS = 5;
+var RETRYABLE_CREATE_ERRNOS = /* @__PURE__ */ new Set(["EEXIST", "EACCES", "EPERM", "EBUSY"]);
+var PARK = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync(ms) {
+  Atomics.wait(PARK, 0, 0, ms);
+}
+var FileLockError = class extends Error {
+  reason;
+  file;
+  holderPid;
+  constructor(reason, file2, detail, holderPid, options) {
+    super(
+      `cannot lock ${file2} for writing: ${detail}` + (holderPid === void 0 ? "" : ` (held by pid ${String(holderPid)})`),
+      options
+    );
+    this.name = "FileLockError";
+    this.reason = reason;
+    this.file = file2;
+    this.holderPid = holderPid;
+  }
+};
+function lockPathFor(file2) {
+  return `${file2}${LOCK_SUFFIX}`;
+}
+function readLockBody(lock) {
+  let raw;
+  try {
+    raw = readFileSync2(lock, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const { pid, token, at, host } = parsed;
+    if (typeof pid !== "number" || typeof token !== "string" || typeof at !== "number") return null;
+    return { pid, token, at, host: typeof host === "string" ? host : "" };
+  } catch {
+    return null;
+  }
+}
+function holderIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code !== "ESRCH";
+  }
+}
+function directoryAcceptsCreates(lock) {
+  const probe = `${lock}.probe-${randomUUID11()}`;
+  try {
+    closeSync(openSync(probe, "wx", DATA_FILE_MODE));
+    return true;
+  } catch {
+    return false;
+  } finally {
+    try {
+      rmSync3(probe, { force: true });
+    } catch {
+    }
+  }
+}
+function tryAcquire(lock, file2) {
+  const token = randomUUID11();
+  let fd;
+  try {
+    fd = openSync(lock, "wx", DATA_FILE_MODE);
+  } catch (err) {
+    const code = err.code ?? "";
+    if (code === "EEXIST") return null;
+    if (RETRYABLE_CREATE_ERRNOS.has(code) && (existsSync3(lock) || directoryAcceptsCreates(lock))) {
+      return null;
+    }
+    throw new FileLockError(
+      "unavailable",
+      file2,
+      err instanceof Error ? err.message : String(err),
+      void 0,
+      { cause: err }
+    );
+  }
+  const body = { pid: process.pid, token, at: Date.now(), host: hostname3() };
+  try {
+    writeFileSync2(fd, `${JSON.stringify(body)}
+`);
+  } catch {
+    try {
+      closeSync(fd);
+    } catch {
+    }
+    rmSync3(lock, { force: true });
+    return null;
+  }
+  try {
+    closeSync(fd);
+  } catch {
+  }
+  return token;
+}
+function isAbandoned(body, lock, staleMs) {
+  if (!body) {
+    try {
+      return Date.now() - statSync2(lock).mtimeMs >= staleMs;
+    } catch {
+      return false;
+    }
+  }
+  if (Date.now() - body.at < staleMs) return false;
+  if (body.host !== hostname3() || !holderIsAlive(body.pid)) return true;
+  return Date.now() - body.at >= abandonWindow(staleMs);
+}
+function breakIfStale(lock, staleMs) {
+  const breaker = `${lock}.break`;
+  let fd;
+  try {
+    fd = openSync(breaker, "wx", DATA_FILE_MODE);
+  } catch {
+    reapAbandonedBreaker(breaker);
+    return false;
+  }
+  try {
+    closeSync(fd);
+  } catch {
+  }
+  try {
+    if (!existsSync3(lock) || !isAbandoned(readLockBody(lock), lock, staleMs)) return false;
+    rmSync3(lock, { force: true });
+    return true;
+  } catch {
+    return false;
+  } finally {
+    try {
+      rmSync3(breaker, { force: true });
+    } catch {
     }
-  };
+  }
+}
+var BREAKER_ABANDONED_MS = 1e4;
+function reapAbandonedBreaker(breaker) {
+  try {
+    if (Date.now() - statSync2(breaker).mtimeMs >= BREAKER_ABANDONED_MS) {
+      rmSync3(breaker, { force: true });
+    }
+  } catch {
+  }
+}
+function abandonWindow(staleMs) {
+  return Math.max(staleMs * 30, 6e4);
+}
+function release(lock, token) {
+  try {
+    if (readLockBody(lock)?.token !== token) return;
+    rmSync3(lock, { force: true });
+  } catch {
+  }
+}
+function withFileLock(file2, fn, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+  const lock = lockPathFor(file2);
+  const deadline = Date.now() + timeoutMs;
+  let token = tryAcquire(lock, file2);
+  while (token === null) {
+    if (breakIfStale(lock, staleMs)) {
+      token = tryAcquire(lock, file2);
+      continue;
+    }
+    if (Date.now() >= deadline) {
+      throw new FileLockError(
+        "timeout",
+        file2,
+        `still held after ${String(timeoutMs)}ms`,
+        readLockBody(lock)?.pid
+      );
+    }
+    sleepSync(RETRY_INTERVAL_MS);
+    token = tryAcquire(lock, file2);
+  }
+  try {
+    const result = fn();
+    if (isThenable(result)) {
+      void result.then(
+        () => void 0,
+        () => void 0
+      );
+      throw new TypeError(
+        `withFileLock(${file2}) was given an async body; the lock is released as soon as it returns, so the awaited work would run unguarded. Pass a synchronous function.`
+      );
+    }
+    return result;
+  } finally {
+    release(lock, token);
+  }
+}
+function isThenable(value) {
+  return typeof value === "object" && value !== null && typeof value.then === "function";
 }
 
 // ../packages/persistence/src/finding-key.ts
@@ -26301,13 +27721,13 @@ function computeFindingKey(input) {
 
 // ../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-var KEY_FILENAME = "exception.key";
+var EXCEPTION_KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
-  return join3(dataDir2, KEY_FILENAME);
+  return join4(dataDir2, EXCEPTION_KEY_FILENAME);
 }
 function parseKeyFile(raw) {
   const parsed = JSON.parse(raw);
@@ -26345,8 +27765,8 @@ var FloorUnreadableError = class extends Error {
   }
 };
 function storedKeyVersionFloor(dataDir2) {
-  const file2 = join3(dataDir2, DB_FILENAME);
-  if (!existsSync3(file2)) return 0;
+  const file2 = join4(dataDir2, DB_FILENAME);
+  if (!existsSync4(file2)) return 0;
   let db;
   try {
     db = new DatabaseSync2(file2, { readOnly: true });
@@ -26371,18 +27791,42 @@ function storedKeyVersionFloor(dataDir2) {
     db?.close();
   }
 }
+function serializeKey(key) {
+  return JSON.stringify({ version: key.version, material: key.material.toString("base64") });
+}
 function writeKeyFile(dataDir2, key) {
   ensureDataDirSync(dataDir2);
-  const file2 = keyFilePath(dataDir2);
-  const body = JSON.stringify({ version: key.version, material: key.material.toString("base64") });
-  writeOwnerOnlyFileSync(file2, `${body}
+  writeOwnerOnlyFileSync(keyFilePath(dataDir2), `${serializeKey(key)}
 `);
   return key;
 }
+function createKeyFile(dataDir2, key) {
+  ensureDataDirSync(dataDir2);
+  const file2 = keyFilePath(dataDir2);
+  if (createOwnerOnlyFileSync(file2, `${serializeKey(key)}
+`)) return key;
+  const winner = readFingerprintKey(dataDir2);
+  if (winner) {
+    tightenFile(file2);
+    return winner;
+  }
+  const occupant = classifyOccupant(file2);
+  throw new KeyUnclaimableError(occupantMessage(file2, occupant.kind), occupant.cause);
+}
+function occupantMessage(file2, kind) {
+  switch (kind) {
+    case "symlink":
+      return `exception key file is a symlink (${file2}); remove it so a key can be created`;
+    case "gone":
+      return "exception key file was removed while it was being created";
+    case "unknown":
+      return `exception key file (${file2}) is occupied but cannot be inspected; check the permissions on its directory`;
+  }
+}
 function readFingerprintKey(dataDir2) {
   let raw;
   try {
-    raw = readFileSync2(keyFilePath(dataDir2), "utf8");
+    raw = readFileSync3(keyFilePath(dataDir2), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err instanceof Error ? err : new Error(String(err));
@@ -26395,7 +27839,7 @@ function loadOrCreateFingerprintKey(dataDir2) {
     tightenFile(keyFilePath(dataDir2));
     return existing;
   }
-  return writeKeyFile(dataDir2, {
+  return createKeyFile(dataDir2, {
     version: storedKeyVersionFloor(dataDir2) + 1,
     material: randomBytes(KEY_MATERIAL_BYTES)
   });
@@ -26421,31 +27865,32 @@ function keyStateOf(key) {
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function defaultDataDir() {
-  return join4(homedir3(), ".aka");
+  return join5(homedir3(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join4(base, "settings");
+  return join5(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join4(base, "data");
+  return join5(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join4(dataDir(base), "aka.db");
+  return join5(dataDir(base), "aka.db");
 }
 function keysDir(base = defaultDataDir()) {
-  return join4(base, "keys");
+  return join5(base, "keys");
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
 }
 
 // ../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
+var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
-  const record2 = readJson(join5(settingsDir(base), "settings.json"));
+  const record2 = readJson(join6(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -26456,7 +27901,7 @@ function readWorkspaceSettings(base = defaultDataDir()) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync3(file2, "utf8");
+    text = readFileSync4(file2, "utf8");
   } catch {
     return null;
   }
@@ -26577,13 +28022,18 @@ import { randomBytes as randomBytes2 } from "crypto";
 import {
   chmodSync as chmodSync2,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync as renameSync4,
-  rmSync as rmSync3,
-  statSync,
-  writeFileSync as writeFileSync2
+  rmSync as rmSync4,
+  statSync as statSync3,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
+var VAULT_OCCUPANT_REASON = {
+  symlink: "the path is a symlink; remove it so a keyring can be created",
+  gone: "the path was occupied but holds no keyring (removed while it was being created)",
+  unknown: "the path is occupied but cannot be inspected; check the permissions on its directory"
+};
 var VaultKeyEpochMissingError = class extends Error {
   version;
   constructor(version2) {
@@ -26676,28 +28126,28 @@ function claimRotationLock(lock, owner) {
     throw asError(err);
   }
   try {
-    writeFileSync2(join6(lock, LOCK_OWNER_FILE), `${owner}
+    writeFileSync3(join7(lock, LOCK_OWNER_FILE), `${owner}
 `, { mode: DATA_FILE_MODE });
     return true;
   } catch (err) {
-    rmSync3(lock, { recursive: true, force: true });
+    rmSync4(lock, { recursive: true, force: true });
     throw asError(err);
   }
 }
 function acquireRotationLock(keysDir2) {
-  const lock = join6(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const lock = join7(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
   const owner = randomBytes2(16).toString("hex");
   if (claimRotationLock(lock, owner)) return { lock, owner };
   let held;
   try {
-    held = statSync(lock);
+    held = statSync3(lock);
   } catch {
     throw new Error(ROTATION_IN_PROGRESS);
   }
   if (Date.now() - held.mtimeMs < ROTATION_LOCK_STALE_MS) throw new Error(ROTATION_IN_PROGRESS);
   const aside = `${lock}.stale.${owner}`;
   try {
-    const now = statSync(lock);
+    const now = statSync3(lock);
     if (now.ino !== held.ino || now.mtimeMs !== held.mtimeMs) {
       throw new Error(ROTATION_IN_PROGRESS);
     }
@@ -26706,17 +28156,17 @@ function acquireRotationLock(keysDir2) {
     if (err instanceof Error && err.message === ROTATION_IN_PROGRESS) throw err;
     throw new Error(ROTATION_IN_PROGRESS, { cause: err });
   }
-  rmSync3(aside, { recursive: true, force: true });
+  rmSync4(aside, { recursive: true, force: true });
   if (!claimRotationLock(lock, owner)) throw new Error(ROTATION_IN_PROGRESS);
   return { lock, owner };
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync4(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync5(join7(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
-  rmSync3(lease.lock, { recursive: true, force: true });
+  rmSync4(lease.lock, { recursive: true, force: true });
 }
 function withRotationLock(keysDir2, work) {
   ensureDataDirSync(keysDir2);
@@ -26733,7 +28183,7 @@ var FileKeyProvider = class {
     this.#keysDir = keysDir2;
   }
   get filePath() {
-    return join6(this.#keysDir, VAULT_KEY_FILENAME);
+    return join7(this.#keysDir, VAULT_KEY_FILENAME);
   }
   loadOrCreate() {
     return asAsync(() => {
@@ -26763,7 +28213,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync4(this.filePath, "utf8");
+      raw = readFileSync5(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -26771,34 +28221,32 @@ var FileKeyProvider = class {
     return parseKeyring(raw);
   }
   /**
-   * First mint: the keyring is created at its FINAL path with a
-   * creation-exclusive write, so two processes racing a fresh machine cannot
-   * each mint a different epoch 1 — with tmp + rename the loser's replace
-   * would orphan everything the winner had already sealed. On EEXIST the
-   * loser re-reads and adopts the winner's keyring; it minted nothing.
-   * Atomic replace is unnecessary here: nothing can be mid-read of a file
-   * that did not exist, and a torn exclusive write parses as corrupt on the
-   * next read and fails secure rather than being re-minted over.
+   * First mint: the keyring is CREATED, never replaced, so two processes racing
+   * a fresh machine cannot each mint a different epoch 1 — with tmp + rename
+   * the loser's replace would orphan everything the winner had already sealed.
+   * The loser re-reads and adopts the winner's keyring; it minted nothing.
+   *
+   * `createOwnerOnlyFileSync` publishes by link rather than by an exclusive open
+   * at the final path, so the keyring never exists at zero length: a reader —
+   * including the loser, re-reading in order to adopt — sees the file absent or
+   * whole, and never mistakes a live keyring for a corrupt one. A corrupt file
+   * still throws from the parse and is never re-minted over.
    */
   #createExclusive() {
     ensureDataDirSync(this.#keysDir);
     const keyring = mintKeyring();
-    try {
-      writeFileSync2(this.filePath, `${serializeKeyring(keyring)}
-`, {
-        flag: "wx",
-        mode: DATA_FILE_MODE
-      });
-    } catch (err) {
-      if (err.code !== "EEXIST") throw asError(err);
-      const winner = this.#read();
-      if (!winner) {
-        throw new Error("vault: key file vanished during first mint", { cause: err });
-      }
-      return winner;
+    if (createOwnerOnlyFileSync(this.filePath, `${serializeKeyring(keyring)}
+`)) return keyring;
+    const winner = this.#read();
+    if (!winner) {
+      const occupant = classifyOccupant(this.filePath);
+      throw new KeyUnclaimableError(
+        `vault: cannot create a key file at ${this.filePath} \u2014 ${VAULT_OCCUPANT_REASON[occupant.kind]}`,
+        occupant.cause
+      );
     }
     tightenFileMode(this.filePath);
-    return keyring;
+    return winner;
   }
   /**
    * Atomic tmp + rename so a crash mid-write cannot truncate the keyring.
@@ -26809,7 +28257,7 @@ var FileKeyProvider = class {
     ensureDataDirSync(this.#keysDir);
     const file2 = this.filePath;
     const tmp = `${file2}.tmp`;
-    writeFileSync2(tmp, `${serializeKeyring(keyring)}
+    writeFileSync3(tmp, `${serializeKeyring(keyring)}
 `, { mode: DATA_FILE_MODE });
     renameSync4(tmp, file2);
     tightenFileMode(file2);
@@ -26935,7 +28383,7 @@ function createKeyProvider(custody, keysDir2) {
 }
 
 // ../packages/persistence/src/vault/vault.ts
-import { randomBytes as randomBytes3, randomUUID as randomUUID10 } from "crypto";
+import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 var CONSENT_ABSENT = /* @__PURE__ */ Symbol("aka.vault.consentAbsent");
 var UNAVAILABLE = /* @__PURE__ */ Symbol("aka.vault.unavailable");
 var VAULT_PURGE_POINTER_ID = "*";
@@ -26962,14 +28410,12 @@ function parsePointer(token) {
 var SecretVault = class {
   #repo;
   #keys;
-  #fingerprintKey;
   #isConsented;
   #verifyGrant;
   #now;
   constructor(deps) {
     this.#repo = deps.repo;
     this.#keys = deps.keys;
-    this.#fingerprintKey = deps.fingerprintKey;
     this.#isConsented = deps.isConsented;
     this.#verifyGrant = deps.verifyGrant;
     this.#now = deps.now ?? (() => Date.now());
@@ -26978,10 +28424,23 @@ var SecretVault = class {
    * Store a value and return the pointer that stands for it. The same value
    * always yields the same pointer on this machine — one row, one pointer id,
    * one category — which is what makes dedup and reuse counting work.
+   *
+   * `fingerprintKey` is the exception-key epoch this value's fingerprint is
+   * derived under — a different key from the vault's, with different rotation
+   * semantics. It is a parameter of the WRITE rather than a constructor dep,
+   * and a thunk rather than a value, so that the only way to reach a key is to
+   * store something: a read-only caller never names it, and a caller whose
+   * source mints on absence mints only once consent has actually opened the
+   * write. `refreshFingerprints` takes its key the same way, for the same
+   * reason.
+   *
+   * Resolved once per call, so the fingerprint and the version it is recorded
+   * under can never come from two different epochs.
    */
-  async tokenize(raw, meta3) {
+  async tokenize(raw, meta3, fingerprintKey) {
     if (!this.#isConsented()) return CONSENT_ABSENT;
-    const valueFingerprint = fingerprintValue(this.#fingerprintKey, raw);
+    const fpKey = fingerprintKey();
+    const valueFingerprint = fingerprintValue(fpKey, raw);
     const existing = this.#repo.byValueFingerprint(valueFingerprint);
     const now = this.#now();
     if (existing) {
@@ -26997,7 +28456,7 @@ var SecretVault = class {
       {
         pointerId: base32Encode(pointerId),
         valueFingerprint,
-        fingerprintKeyVersion: this.#fingerprintKey.version,
+        fingerprintKeyVersion: fpKey.version,
         keyVersion: version2,
         // Recorded so the row stays OPENABLE if the wire-format constant ever
         // moves: it is part of this row's AEAD AAD. It is not a tag input —
@@ -27241,7 +28700,7 @@ var SecretVault = class {
   purgeVault() {
     const destroyed = this.#repo.purgeAll();
     this.#repo.recordDeref({
-      id: randomUUID10(),
+      id: randomUUID12(),
       pointerId: VAULT_PURGE_POINTER_ID,
       at: this.#now(),
       target: "human",
@@ -27310,7 +28769,7 @@ var SecretVault = class {
   }
   #audit(pointerId, opts, outcome) {
     this.#repo.recordDeref({
-      id: randomUUID10(),
+      id: randomUUID12(),
       pointerId,
       at: this.#now(),
       target: opts.target,
@@ -27325,12 +28784,12 @@ var SecretVault = class {
 };
 
 // ../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 
 // ../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join9 } from "path";
 
 // ../packages/plugin-sdk/src/provider-env.ts
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -27351,9 +28810,9 @@ var providerEnvShape = {
 var ProviderEnvSchema = external_exports.object(providerEnvShape);
 
 // ../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync, readFileSync as readFileSync6, realpathSync, statSync as statSync3 } from "fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync7, realpathSync, statSync as statSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename2, join as join10 } from "path";
+import { basename as basename3, join as join11 } from "path";
 
 // ../rules/code-flaws/auth-jwt-no-verify.json
 var auth_jwt_no_verify_default = {
@@ -29009,7 +30468,7 @@ var gcp_service_account_default = {
   severity: "critical",
   matcher: {
     type: "regex",
-    pattern: "\\b[a-z0-9][a-z0-9-]{2,60}@[a-z0-9][a-z0-9-]{2,60}\\.iam\\.gserviceaccount\\.com\\b",
+    pattern: "(?<![a-z0-9-])[a-z0-9-]{3,}@[a-z0-9][a-z0-9-]{2,60}\\.iam\\.gserviceaccount\\.com\\b",
     flags: "g"
   },
   examples: [
@@ -29388,8 +30847,8 @@ function bundledDetections() {
 }
 
 // ../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import { basename, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join10, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -29402,7 +30861,7 @@ function resolveRepoIdentity(cwd) {
       // win32) so the persistence layer's `/`-separated checkout-path patterns
       // (the ghost sweep + the read-side worktree filter) match it as written.
       url: url2 ?? headRoot.split(sep2).join("/"),
-      name: (url2 ? slugFromUrl(url2) : void 0) ?? basename(headRoot)
+      name: (url2 ? slugFromUrl(url2) : void 0) ?? basename2(headRoot)
     };
   } catch {
     return void 0;
@@ -29427,36 +30886,36 @@ function resolveHeadRoot(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync6(join9(dir, ".git"))) return dir;
-    const parent = dirname2(dir);
+    if (existsSync7(join10(dir, ".git"))) return dir;
+    const parent = dirname3(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join9(root, ".git");
+  const dotGit = join10(root, ".git");
   try {
-    if (statSync2(dotGit).isDirectory()) {
-      return { configPath: join9(dotGit, "config"), headRoot: root };
+    if (statSync4(dotGit).isDirectory()) {
+      return { configPath: join10(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join9(root, target);
-  if (existsSync6(join9(gitdir, "config"))) {
-    return { configPath: join9(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join10(root, target);
+  if (existsSync7(join10(gitdir, "config"))) {
+    return { configPath: join10(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join9(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join10(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join9(gitdir, commonRaw);
-  const headRoot = basename(commonGitDir) === ".git" ? dirname2(commonGitDir) : root;
-  return { configPath: join9(commonGitDir, "config"), headRoot };
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join10(gitdir, commonRaw);
+  const headRoot = basename2(commonGitDir) === ".git" ? dirname3(commonGitDir) : root;
+  return { configPath: join10(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return void 0;
   }
@@ -29494,18 +30953,23 @@ function slugFromUrl(url2) {
 }
 
 // ../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
+
+// ../packages/plugin-sdk/src/isolated-scan.ts
+import { existsSync as existsSync8 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { Worker } from "worker_threads";
 
 // ../packages/plugin-sdk/src/inventory-resolver.ts
-import { arch, hostname as hostname3, platform, release } from "os";
+import { arch, hostname as hostname4, platform, release as release2 } from "os";
 
 // ../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
 
 // ../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
-import { basename as basename3, dirname as dirname3, sep as sep3 } from "path";
+import { readdirSync as readdirSync4, realpathSync as realpathSync2 } from "fs";
+import { basename as basename4, dirname as dirname4, sep as sep3 } from "path";
 function toPosix(path) {
   return path.split(sep3).join("/");
 }
@@ -29515,7 +30979,7 @@ function findProjectRoot(startDir, recognizeMarker) {
   let root = null;
   for (let level = 0; level < MAX_PROJECT_ROOT_LEVELS; level += 1) {
     if (directoryHasMarker(dir, recognizeMarker)) root = dir;
-    const parent = dirname3(dir);
+    const parent = dirname4(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -29523,7 +30987,7 @@ function findProjectRoot(startDir, recognizeMarker) {
 }
 function directoryHasMarker(dir, recognizeMarker) {
   try {
-    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
       if (entry.isFile() && recognizeMarker(entry.name) != null) return true;
     }
   } catch {
@@ -29534,13 +30998,13 @@ function directoryHasMarker(dir, recognizeMarker) {
 function resolveNonGitProject(startDir, recognizeMarker) {
   const projectRoot = findProjectRoot(startDir, recognizeMarker);
   const realRoot = realpathSync2(projectRoot);
-  return { root: projectRoot, projectKey: `path:${realRoot}`, project: basename3(realRoot) };
+  return { root: projectRoot, projectKey: `path:${realRoot}`, project: basename4(realRoot) };
 }
 
 // ../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
-import { basename as basename4, join as join12, relative, sep as sep4 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync5, readFileSync as readFileSync9 } from "fs";
+import { basename as basename5, join as join13 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -29558,23 +31022,28 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".cache"
 ]);
 var MAX_FILES = 2e4;
-function readIgnoreLayer(dir) {
+function readIgnoreLayer(dir, anchorLen) {
   try {
-    const content = readFileSync8(join12(dir, ".gitignore"), "utf8");
-    return { base: dir, matcher: (0, import_ignore.default)().add(content) };
+    const content = readFileSync9(join13(dir, ".gitignore"), "utf8");
+    return { matcher: (0, import_ignore.default)().add(content), anchorLen };
   } catch {
     return void 0;
   }
 }
-function isIgnored(layers, absPath, isDir) {
-  let ignored = false;
-  for (const layer of layers) {
-    const rel = relative(layer.base, absPath).split(sep4).join("/") + (isDir ? "/" : "");
-    const verdict = layer.matcher.test(rel);
-    if (verdict.ignored) ignored = true;
-    else if (verdict.unignored) ignored = false;
+function relToAnchor(dirRel, anchorLen, name) {
+  if (anchorLen === dirRel.length) return name;
+  return `${dirRel.slice(anchorLen === 0 ? 0 : anchorLen + 1)}/${name}`;
+}
+function isIgnored(layers, dirRel, name, isDir) {
+  const suffix = isDir ? "/" : "";
+  for (let i = layers.length - 1; i >= 0; i--) {
+    const layer = layers[i];
+    if (layer === void 0) continue;
+    const verdict = layer.matcher.test(relToAnchor(dirRel, layer.anchorLen, name) + suffix);
+    if (verdict.ignored) return true;
+    if (verdict.unignored) return false;
   }
-  return ignored;
+  return false;
 }
 var GENERATED_FILES = /* @__PURE__ */ new Set([
   "pnpm-lock.yaml",
@@ -29627,32 +31096,33 @@ function classifyOrigin(relPath, name) {
 }
 function resolveProjectFiles(cwd) {
   try {
-    let visit3 = function(dir, layers) {
+    let visit3 = function(dir, dirRel, layers) {
       let dirents;
       try {
-        dirents = readdirSync3(dir, { withFileTypes: true, encoding: "utf8" });
+        dirents = readdirSync5(dir, { withFileTypes: true, encoding: "utf8" });
       } catch {
         walk.lostSubtree = true;
         return false;
       }
-      const layer = readIgnoreLayer(dir);
+      const layer = readIgnoreLayer(dir, dirRel.length);
       const dirLayers = layer ? [...layers, layer] : layers;
       for (const entry of dirents) {
-        const fullPath = join12(dir, entry.name);
         if (entry.isDirectory()) {
-          if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, fullPath, true)) continue;
-          if (existsSync7(join12(fullPath, ".git"))) continue;
-          if (visit3(fullPath, dirLayers)) return true;
+          if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, dirRel, entry.name, true)) continue;
+          const fullPath = join13(dir, entry.name);
+          if (existsSync9(join13(fullPath, ".git"))) continue;
+          const childRel = dirRel === "" ? entry.name : `${dirRel}/${entry.name}`;
+          if (visit3(fullPath, childRel, dirLayers)) return true;
           continue;
         }
         if (!entry.isFile()) continue;
         if (entry.name === ".git") continue;
-        if (isIgnored(dirLayers, fullPath, false)) continue;
+        if (isIgnored(dirLayers, dirRel, entry.name, false)) continue;
         if (files.length >= MAX_FILES) return true;
-        const relPath = relative(root, fullPath).split(sep4).join("/");
+        const relPath = dirRel === "" ? entry.name : `${dirRel}/${entry.name}`;
         files.push({
           path: relPath,
-          name: basename4(entry.name),
+          name: basename5(entry.name),
           origin: classifyOrigin(relPath, entry.name),
           defaultAccess: "approved"
         });
@@ -29666,7 +31136,7 @@ function resolveProjectFiles(cwd) {
     const isLinkedCheckout = resolveHeadRoot(cwd) !== worktree;
     const files = [];
     const walk = { lostSubtree: false };
-    const truncated = visit3(root, []) || walk.lostSubtree || isLinkedCheckout;
+    const truncated = visit3(root, "", []) || walk.lostSubtree || isLinkedCheckout;
     if (files.length === 0) return void 0;
     files.sort((a, b) => a.path.localeCompare(b.path));
     return { files, truncated, scannedAt: (/* @__PURE__ */ new Date()).toISOString() };
@@ -29675,22 +31145,48 @@ function resolveProjectFiles(cwd) {
   }
 }
 
+// ../packages/plugin-sdk/src/provider-env-antigravity.ts
+var optionalBaseUrl2 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var optionalFlag = external_exports.preprocess((v) => {
+  if (typeof v !== "string") return false;
+  const normalized = v.trim().toLowerCase();
+  return normalized !== "" && normalized !== "0" && normalized !== "false";
+}, external_exports.boolean()).catch(false);
+var antigravityProviderEnvShape = {
+  GOOGLE_GENAI_USE_VERTEXAI: optionalFlag,
+  GOOGLE_GEMINI_BASE_URL: optionalBaseUrl2
+};
+var AntigravityProviderEnvSchema = external_exports.object(antigravityProviderEnvShape);
+
+// ../packages/plugin-sdk/src/provider-env-codex.ts
+var optionalBaseUrl3 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var codexProviderEnvShape = {
+  OPENAI_BASE_URL: optionalBaseUrl3
+};
+var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
+
 // ../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 
 // ../packages/plugin-sdk/src/suppressions.ts
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join13 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join14 } from "path";
 
 // ../packages/local-ops/src/egress-record.ts
 function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
   try {
     if (!readWorkspaceSettings(base).dataSharesInPlace) return null;
     const abs = resolve(target);
-    const targetDir = statSync5(abs).isDirectory() ? abs : dirname4(abs);
+    const targetDir = statSync7(abs).isDirectory() ? abs : dirname5(abs);
     const identity = resolveRepoIdentity(abs);
     const worktreeRoot = resolveWorktreeRoot(abs);
     let root;
@@ -29712,7 +31208,7 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
     }
     const files = [];
     for (const hit of egress.files) {
-      const file2 = toPosix(relative2(root, hit.file));
+      const file2 = toPosix(relative(root, hit.file));
       if (file2 === "" || file2.startsWith("../")) continue;
       if (file2.startsWith(".") || file2.includes("/.")) continue;
       files.push({ ...hit, file: file2, vendored: isVendoredPath(file2) });
@@ -29721,7 +31217,7 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
       projectKey,
       project,
       projectId,
-      reconcile: { mode: "walk", walkedPrefix: toPosix(relative2(root, abs)) },
+      reconcile: { mode: "walk", walkedPrefix: toPosix(relative(root, abs)) },
       hits: resolveEgress(files)
     });
     return { ...summary, project };
@@ -29731,9 +31227,9 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
 }
 
 // ../packages/local-ops/src/fs-scan.ts
-import { createHash as createHash5, randomUUID as randomUUID13 } from "crypto";
-import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
-import { basename as basename5, extname, join as join14, relative as relative3, resolve as resolve2 } from "path";
+import { createHash as createHash5, randomUUID as randomUUID15 } from "crypto";
+import { readdirSync as readdirSync6, readFileSync as readFileSync10, statSync as statSync8 } from "fs";
+import { basename as basename6, extname, join as join15, relative as relative2, resolve as resolve2 } from "path";
 var import_ignore2 = __toESM(require_ignore(), 1);
 var AKAIGNORE_FILENAME = ".akaignore";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
@@ -29749,7 +31245,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 var MAX_BYTES = 1e6;
 function readIgnoreLayer2(dir, filename) {
   try {
-    const content = readFileSync9(join14(dir, filename), "utf8");
+    const content = readFileSync10(join15(dir, filename), "utf8");
     return { base: dir, matcher: (0, import_ignore2.default)().add(content) };
   } catch {
     return void 0;
@@ -29758,7 +31254,7 @@ function readIgnoreLayer2(dir, filename) {
 function evaluate(layers, absPath, isDir) {
   let state = "unmatched";
   for (const layer of layers) {
-    const rel = toPosix(relative3(layer.base, absPath)) + (isDir ? "/" : "");
+    const rel = toPosix(relative2(layer.base, absPath)) + (isDir ? "/" : "");
     const verdict = layer.matcher.test(rel);
     if (verdict.ignored) state = "ignored";
     else if (verdict.unignored) state = "unignored";
@@ -29768,7 +31264,7 @@ function evaluate(layers, absPath, isDir) {
 function* collectFiles(target) {
   let st;
   try {
-    st = statSync6(target);
+    st = statSync8(target);
   } catch {
     return;
   }
@@ -29784,8 +31280,8 @@ function* visit(dir, markLayers, skipLayers, inIgnoredDir) {
   const dirMarkLayers = markLayer ? [...markLayers, markLayer] : markLayers;
   const skipLayer = readIgnoreLayer2(dir, AKAIGNORE_FILENAME);
   const dirSkipLayers = skipLayer ? [...skipLayers, skipLayer] : skipLayers;
-  for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-    const path = join14(dir, entry.name);
+  for (const entry of readdirSync6(dir, { withFileTypes: true })) {
+    const path = join15(dir, entry.name);
     if (entry.isDirectory()) {
       const skipState = evaluate(dirSkipLayers, path, true);
       if (skipState !== "unignored" && (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".") || skipState === "ignored")) {
@@ -29797,7 +31293,7 @@ function* visit(dir, markLayers, skipLayers, inIgnoredDir) {
       if (evaluate(dirSkipLayers, path, false) === "ignored") continue;
       let size;
       try {
-        size = statSync6(path).size;
+        size = statSync8(path).size;
       } catch {
         continue;
       }
@@ -29811,7 +31307,7 @@ function* visit(dir, markLayers, skipLayers, inIgnoredDir) {
 }
 function extractFileEgress(file2, text) {
   if (text.includes("\0")) return null;
-  const name = basename5(file2);
+  const name = basename6(file2);
   if (LOCKFILE_BASENAMES.has(name)) return null;
   const kind = manifestKindOf(name);
   const sdkHits = kind === null ? [] : extractManifestSdks(text, kind);
@@ -29819,7 +31315,8 @@ function extractFileEgress(file2, text) {
   if (endpoints.length === 0 && sdkHits.length === 0) return null;
   return { file: file2, vendored: isVendoredPath(toPosix(file2)), endpoints, sdkHits };
 }
-function scanPathIntoStore(db, target, opts = {}) {
+async function scanPathIntoStore(db, target, opts = {}) {
+  const matchText = opts.scanText ?? ((text) => Promise.resolve(scan(text, opts.rules)));
   let scanned = 0;
   let findingCount = 0;
   const files = [];
@@ -29838,7 +31335,7 @@ function scanPathIntoStore(db, target, opts = {}) {
   for (const { path: file2, gitignored } of collectFiles(resolve2(target))) {
     let text;
     try {
-      text = readFileSync9(file2, "utf8");
+      text = readFileSync10(file2, "utf8");
     } catch {
       continue;
     }
@@ -29846,9 +31343,9 @@ function scanPathIntoStore(db, target, opts = {}) {
     const fileEgress = extractFileEgress(file2, text);
     if (fileEgress) egressFiles.push(fileEgress);
     const shielded = shieldPointers(text);
-    const matches = dropShieldedFindings(scan(shielded.text, opts.rules), shielded.spans);
+    const matches = dropShieldedFindings(await matchText(shielded.text), shielded.spans);
     if (matches.length === 0) continue;
-    const eventId = randomUUID13();
+    const eventId = randomUUID15();
     const metadata = { filePath: file2 };
     if (gitignored) metadata.gitignored = true;
     const event = {
@@ -29866,7 +31363,7 @@ function scanPathIntoStore(db, target, opts = {}) {
       const key = resolveFingerprintKey();
       const valueFingerprint = key ? fingerprintValue(key, m.rawMatch) : maskedMatch;
       return {
-        id: randomUUID13(),
+        id: randomUUID15(),
         eventId,
         ruleId: m.ruleId,
         category: m.category,
@@ -29891,12 +31388,12 @@ function scanPathIntoStore(db, target, opts = {}) {
 }
 
 // ../packages/local-ops/src/project-inventory.ts
-import { statSync as statSync7 } from "fs";
+import { statSync as statSync9 } from "fs";
 import { resolve as resolve3 } from "path";
 function recordProjectInventory(db, target) {
   try {
     const abs = resolve3(target);
-    statSync7(abs);
+    statSync9(abs);
     const identity = resolveRepoIdentity(abs);
     if (!identity) return null;
     const sourceProjectId2 = db.sourceProject.upsert({
@@ -29945,17 +31442,17 @@ function reinvokeArgv(subcommand, extraArgs = []) {
 
 // ../packages/local-ops/src/update-cache.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync10, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync11, rmSync as rmSync5 } from "fs";
+import { join as join16 } from "path";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 function cachePath(home) {
-  return join15(dataDir(home), "update-check.json");
+  return join16(dataDir(home), "update-check.json");
 }
 function readCache(home) {
   const path = cachePath(home);
-  if (!existsSync8(path)) return null;
+  if (!existsSync10(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync10(path, "utf8"));
+    const raw = JSON.parse(readFileSync11(path, "utf8"));
     if (!isRecord(raw) || typeof raw.checkedAt !== "number" || !isRecord(raw.report)) return null;
     return raw;
   } catch {
@@ -29963,9 +31460,9 @@ function readCache(home) {
   }
 }
 function writeCache(home, cache) {
-  if (!existsSync8(dataDir(home))) return;
+  if (!existsSync10(dataDir(home))) return;
   try {
-    writeFileSync6(cachePath(home), `${JSON.stringify(cache, null, 2)}
+    writeOwnerOnlyFileSync(cachePath(home), `${JSON.stringify(cache, null, 2)}
 `);
   } catch {
   }
@@ -29975,7 +31472,7 @@ function isStale(cache, ttlMs = CHECK_TTL_MS) {
 }
 function clearCache(home) {
   try {
-    rmSync4(cachePath(home), { force: true });
+    rmSync5(cachePath(home), { force: true });
   } catch {
   }
 }
@@ -30082,9 +31579,9 @@ var COMMAND_SPECS = [
   { name: "stats", summary: "Print findings / enforcement / detections from the local store" },
   {
     name: "detections",
-    argHint: "[update]",
+    argHint: "[update|unquarantine]",
     summary: "List installed detection packs + available updates (updates are manual)",
-    args: ["update"]
+    args: ["update", "unquarantine"]
   },
   {
     name: "plugins",
@@ -30092,6 +31589,11 @@ var COMMAND_SPECS = [
     args: ["list", "install"]
   },
   { name: "dashboard", summary: "Launch the local web dashboard and open it in the browser" },
+  {
+    name: "extension",
+    summary: "Install/check the native-messaging host for the browser extension (Chrome)",
+    args: ["install", "status"]
+  },
   {
     name: "exception",
     summary: "Manage detection exceptions (approve, add, list, show, revoke, rotate-key)",
@@ -30134,13 +31636,14 @@ function commandsHelp() {
 }
 
 // src/commands/check-updates.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { parseArgs } from "util";
 
 // src/lib/args.ts
+import { resolve as resolve4 } from "path";
 var HOME_OPTION = { home: { type: "string" } };
 function homeBase(home) {
-  return home ?? defaultDataDir();
+  return home === void 0 ? defaultDataDir() : resolve4(home);
 }
 
 // src/commands/check-updates.ts
@@ -30165,7 +31668,7 @@ function runCheckUpdates(argv) {
     out.write(`${String(ups.length)} update(s) available \u2014 run \`aka update\` to apply.
 `);
   }
-  if (existsSync9(dataDir(home))) {
+  if (existsSync11(dataDir(home))) {
     const notifiedPluginIds = readCache(home)?.notifiedPluginIds ?? [];
     writeCache(home, { checkedAt: Date.now(), report, notifiedPluginIds });
   }
@@ -30319,41 +31822,48 @@ function runCompletion(argv) {
 
 // src/commands/dashboard.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { createServer } from "net";
-import { dirname as dirname5, join as join16 } from "path";
-import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
+import { dirname as dirname6, join as join17 } from "path";
+import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 import { parseArgs as parseArgs2 } from "util";
 
 // src/lib/open-url.ts
 import { spawn as spawn2 } from "child_process";
-function openUrl(url2) {
-  const platform2 = process.platform;
-  const command = platform2 === "darwin" ? "open" : platform2 === "win32" ? "cmd" : "xdg-open";
-  const args = platform2 === "win32" ? ["/c", "start", "", url2] : [url2];
+function openUrlCommand(platform2, url2) {
+  if (platform2 === "darwin") return { command: "open", args: [url2] };
+  if (platform2 === "win32") return { command: "cmd", args: ["/c", "start", "", url2] };
+  return { command: "xdg-open", args: [url2] };
+}
+var DETACHED = Object.freeze({ stdio: "ignore", detached: true });
+function openUrl(url2, deps = {}) {
+  const { command, args } = openUrlCommand(deps.platform ?? process.platform, url2);
   try {
-    spawn2(command, args, { stdio: "ignore", detached: true }).unref();
+    const child = (deps.spawn ?? spawn2)(command, [...args], DETACHED);
+    child.on("error", () => {
+    });
+    child.unref();
   } catch {
   }
 }
 
 // src/commands/dashboard.ts
 var require3 = createRequire2(import.meta.url);
-var here = dirname5(fileURLToPath2(import.meta.url));
+var here = dirname6(fileURLToPath3(import.meta.url));
 var BIND_HOST = "127.0.0.1";
 function pkgBase() {
-  return isSea() ? dirname5(process.execPath) : join16(here, "..");
+  return isSea() ? dirname6(process.execPath) : join17(here, "..");
 }
 function isPortFree(port) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     const probe = createServer();
     probe.once("error", () => {
-      resolve4(false);
+      resolve6(false);
     });
     probe.once("listening", () => {
       probe.close(() => {
-        resolve4(true);
+        resolve6(true);
       });
     });
     probe.listen(port, BIND_HOST);
@@ -30397,14 +31907,14 @@ async function runDashboard(argv) {
   refreshUpdateMirror(dataDir());
   const base = pkgBase();
   const bundledServer = [
-    join16(base, "web-ui", "server.js"),
-    join16(base, "web-ui", "web-ui", "server.js")
-  ].find((p) => existsSync10(p));
+    join17(base, "web-ui", "server.js"),
+    join17(base, "web-ui", "web-ui", "server.js")
+  ].find((p) => existsSync12(p));
   if (bundledServer) {
     launchStandalone(bundledServer, port, shouldOpen, url2);
     return;
   }
-  const webUiDir = dirname5(require3.resolve("@akasecurity/web-ui/package.json"));
+  const webUiDir = dirname6(require3.resolve("@akasecurity/web-ui/package.json"));
   const nextBin = require3.resolve("next/dist/bin/next", { paths: [webUiDir] });
   const startNext = () => {
     const child = spawn3(
@@ -30418,7 +31928,7 @@ async function runDashboard(argv) {
     onReadyOpen(child, shouldOpen, url2, `Starting the AKA dashboard at ${url2}
 `);
   };
-  if (existsSync10(join16(webUiDir, ".next", "BUILD_ID"))) {
+  if (existsSync12(join17(webUiDir, ".next", "BUILD_ID"))) {
     startNext();
     return;
   }
@@ -30441,7 +31951,7 @@ function launchStandalone(serverJs, port, shouldOpen, url2) {
     return;
   }
   const child = spawn3(reinvoke.command, reinvoke.args, {
-    cwd: dirname5(serverJs),
+    cwd: dirname6(serverJs),
     stdio: ["inherit", "pipe", "inherit"],
     // Inherit the parent env so the child server sees PATH etc.; PORT/HOSTNAME tell
     // Next's standalone server where to bind (its only port input).
@@ -30484,16 +31994,18 @@ function onReadyOpen(child, shouldOpen, url2, banner) {
 
 // src/commands/detections.ts
 import { parseArgs as parseArgs3 } from "util";
+var SUBCOMMANDS = ["update", "unquarantine"];
 async function runDetections(argv) {
   const { values, positionals } = parseArgs3({
     args: argv,
     options: { ...HOME_OPTION, all: { type: "boolean" } },
     allowPositionals: true
   });
-  const sub = positionals[0] === "update" ? "update" : "list";
+  const named = SUBCOMMANDS.find((s) => s === positionals[0]);
+  const sub = named ?? "list";
   if (sub === "list" && positionals.length > 0) {
     process.stderr.write(
-      `aka detections: unknown subcommand '${positionals[0] ?? ""}' (did you mean \`aka detections update\`?)
+      `aka detections: unknown subcommand '${positionals[0] ?? ""}' (expected one of: ${SUBCOMMANDS.join(", ")})
 `
     );
     process.exitCode = 1;
@@ -30505,6 +32017,8 @@ async function runDetections(argv) {
     db.installedPacks.recordInventory(bundledDetections(), cliRecordedBy());
     if (sub === "update") {
       await runUpdateSub(db, positionals.slice(1), values.all === true);
+    } else if (sub === "unquarantine") {
+      runUnquarantineSub(db);
     } else {
       await runListSub(db);
     }
@@ -30527,6 +32041,15 @@ async function runListSub(db) {
 ${String(items.length)} pack(s) \xB7 ${String(items.reduce((n, i) => n + i.ruleCount, 0))} rule(s) \xB7 ${String(active)} enabled
 `
   );
+  const quarantined = db.ruleProbeCache.countQuarantined();
+  if (quarantined > 0) {
+    out.write(
+      `
+\u26A0 ${String(quarantined)} rule(s) quarantined for exceeding the ReDoS timing budget \u2014 they are excluded from every scan.
+  aka detections unquarantine          # forget the verdicts and measure them again
+`
+    );
+  }
   if (counts.updates > 0) {
     out.write(
       `
@@ -30539,6 +32062,20 @@ ${String(items.length)} pack(s) \xB7 ${String(items.reduce((n, i) => n + i.ruleC
     out.write("\n\u2713 All detection packs are up to date with this CLI.\n");
   }
 }
+function runUnquarantineSub(db) {
+  const { refused, cleared } = db.ruleProbeCache.clearQuarantined();
+  if (refused) {
+    process.stderr.write(
+      "aka detections unquarantine: the store refused the write (another process may be holding it). Nothing was cleared \u2014 try again.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  process.stdout.write(
+    cleared === 0 ? "\u2713 No quarantined rules \u2014 nothing to clear.\n" : `\u2713 Cleared ${String(cleared)} quarantine verdict(s). Each rule is measured again the next time it loads, and is re-quarantined if it still exceeds the budget.
+`
+  );
+}
 async function runUpdateSub(db, ids, all) {
   const { items } = await db.detections.listDetections({ filter: "all" });
   const byId = new Map(items.map((i) => [i.id, i]));
@@ -30650,21 +32187,39 @@ function processHiddenChar(state, ch) {
   return { ...state, value: state.value + ch };
 }
 var CLEANUP_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
-function terminalPrompter() {
+function processIo() {
+  return {
+    input: process.stdin,
+    output: process.stdout,
+    errorOutput: process.stderr,
+    signals: {
+      once: (signal, handler) => {
+        process.once(signal, handler);
+      },
+      off: (signal, handler) => {
+        process.removeListener(signal, handler);
+      },
+      raise: (signal) => {
+        process.kill(process.pid, signal);
+      }
+    }
+  };
+}
+function terminalPrompter(io = processIo()) {
   return {
     out: (text) => {
-      process.stdout.write(text);
+      io.output.write(text);
     },
     err: (text) => {
-      process.stderr.write(text);
+      io.errorOutput.write(text);
     },
-    isInteractive: process.stdin.isTTY && process.stdout.isTTY,
+    isInteractive: io.input.isTTY && io.output.isTTY,
     ask(question) {
-      return new Promise((resolve4) => {
-        const rl = createInterface({ input: process.stdin, output: process.stdout });
+      return new Promise((resolve6) => {
+        const rl = createInterface({ input: io.input, output: io.output });
         rl.question(question, (answer) => {
           rl.close();
-          resolve4(answer);
+          resolve6(answer);
         });
       });
     },
@@ -30675,9 +32230,9 @@ function terminalPrompter() {
     // fatal signals: a security tool must never brick the terminal it was
     // invoked from.
     askHidden(question) {
-      return new Promise((resolve4, reject) => {
-        const stdin = process.stdin;
-        process.stdout.write(question);
+      return new Promise((resolve6, reject) => {
+        const stdin = io.input;
+        io.output.write(question);
         stdin.setRawMode(true);
         stdin.resume();
         let state = { value: "", esc: "none" };
@@ -30687,7 +32242,7 @@ function terminalPrompter() {
           restored = true;
           stdin.removeListener("data", onData);
           stdin.removeListener("error", onError);
-          for (const sig of CLEANUP_SIGNALS) process.removeListener(sig, onSignal);
+          for (const sig of CLEANUP_SIGNALS) io.signals.off(sig, onSignal);
           try {
             stdin.setRawMode(false);
           } catch {
@@ -30696,16 +32251,16 @@ function terminalPrompter() {
         };
         const finish = (err) => {
           restore();
-          process.stdout.write("\n");
+          io.output.write("\n");
           if (err) reject(err);
-          else resolve4(state.value);
+          else resolve6(state.value);
         };
         const onError = (err) => {
           finish(err);
         };
         const onSignal = (sig) => {
           restore();
-          process.kill(process.pid, sig);
+          io.signals.raise(sig);
         };
         const onData = (chunk) => {
           try {
@@ -30726,12 +32281,12 @@ function terminalPrompter() {
         };
         stdin.on("data", onData);
         stdin.once("error", onError);
-        for (const sig of CLEANUP_SIGNALS) process.once(sig, onSignal);
+        for (const sig of CLEANUP_SIGNALS) io.signals.once(sig, onSignal);
       });
     },
     async readAllStdin() {
       const chunks = [];
-      for await (const chunk of process.stdin) {
+      for await (const chunk of io.input) {
         chunks.push(chunk);
       }
       return Buffer.concat(chunks).toString("utf8");
@@ -31052,7 +32607,6 @@ async function runApproveReveal(pointer, values, io, base) {
     const vault = new SecretVault({
       repo: db.secretVault,
       keys: createKeyProvider(readWorkspaceSettings(base).vaultKeyCustody, keysDir(base)),
-      fingerprintKey: loadOrCreateFingerprintKey(dir),
       // Read live so a consent revocation applies to the very next call.
       isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent)
     });
@@ -31344,11 +32898,11 @@ async function runShow(argv, io) {
     ensurePacks();
     const rule = getLoadedRules().find((r) => r.id === ex.ruleId);
     const ruleLine = rule ? `${ex.ruleId} (${ex.category} \xB7 ${rule.severity})` : `${ex.ruleId} (${ex.category})`;
-    const fp = `${ex.valueFingerprint.slice(0, 4)}\u2026${ex.valueFingerprint.slice(-4)}`;
     const label = (name) => `  ${name.padEnd(10)}`;
     const lines = [
+      `${label("Id")}${shortId(ex.id)}`,
       `${label("Rule")}${ruleLine}`,
-      `${label("Value")}${ex.maskedValue}   fingerprint ${fp} (key v${String(ex.keyVersion)})`,
+      `${label("Value")}${ex.maskedValue} (fingerprint key v${String(ex.keyVersion)})`,
       `${label("Scope")}${scopeSummary(ex)}${ex.maxUses !== null ? ` \xB7 max ${String(ex.maxUses)} use${ex.maxUses === 1 ? "" : "s"}` : ""}`,
       `${label("Reason")}"${ex.justification}"`,
       `${label("Created")}${formatTimestamp(ex.createdAt)} by ${ex.createdBy} via ${viaLabel(ex.createdVia)}`,
@@ -31412,6 +32966,17 @@ async function runRevoke(argv, io) {
     db.close();
   }
 }
+async function countApprovableBlocked(db, dir) {
+  const key = (() => {
+    try {
+      return keyStateOf(readFingerprintKey(dir));
+    } catch {
+      return { status: "unreadable" };
+    }
+  })();
+  const rows = await db.exceptions.recentBlocked(BLOCKED_DETECTIONS_RETENTION_MS);
+  return rows.filter((row) => isMatchableUnder(row.keyVersion, key)).length;
+}
 async function runRotateKey(argv, io) {
   const { values } = parseArgs4({
     args: argv,
@@ -31438,6 +33003,10 @@ written under the old key simply stop matching. They remain listed for audit.
 `);
       }
     }
+    io.out(`
+${rotationBlockedLedgerNote(await countApprovableBlocked(db, dir))}
+
+`);
     if (values.yes !== true) {
       if (!io.isInteractive) {
         throw new Error("pass --yes to rotate non-interactively");
@@ -31466,7 +33035,6 @@ Existing grants no longer match; re-approve deliberately where still needed.
       const vault = new SecretVault({
         repo: db.secretVault,
         keys: createKeyProvider(readWorkspaceSettings(base).vaultKeyCustody, keysDir(base)),
-        fingerprintKey: next,
         isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent)
       });
       const refreshed = await vault.refreshFingerprints(next);
@@ -31507,14 +33075,208 @@ async function runException(argv, io = terminalPrompter()) {
   await handler(rest, io);
 }
 
+// src/commands/extension.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
+import { createRequire as createRequire3 } from "module";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname7, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+var require4 = createRequire3(import.meta.url);
+var here2 = dirname7(fileURLToPath4(import.meta.url));
+function cliRoot() {
+  return isSea() ? dirname7(process.execPath) : join18(here2, "..");
+}
+var EXTENSION_ID = "mdoiaiemcnjnaokmcmgbikcdhgiemdof";
+var NATIVE_HOST_NAME = "com.akasecurity.aka";
+function nativeHostManifest(hostPath) {
+  return {
+    name: NATIVE_HOST_NAME,
+    description: "AI Traffic Control native messaging host \u2014 bridges the browser extension to the local ~/.aka SQLite store.",
+    path: hostPath,
+    type: "stdio",
+    allowed_origins: [`chrome-extension://${EXTENSION_ID}/`]
+  };
+}
+function resolveHostScript(root = cliRoot()) {
+  const bundled = join18(root, "native-host", "host.js");
+  if (existsSync13(bundled)) return bundled;
+  try {
+    const pkgJson = require4.resolve("@akasecurity/plugin-browser-extension/package.json");
+    const devBuilt = join18(dirname7(pkgJson), "native-host", "host.js");
+    if (existsSync13(devBuilt)) return devBuilt;
+  } catch {
+  }
+  return null;
+}
+function resolveExtensionDist(root = cliRoot()) {
+  const bundled = join18(root, "extension");
+  if (existsSync13(bundled)) return bundled;
+  try {
+    const pkgJson = require4.resolve("@akasecurity/plugin-browser-extension/package.json");
+    const devDist = join18(dirname7(pkgJson), "dist");
+    if (existsSync13(devDist)) return devDist;
+  } catch {
+  }
+  return null;
+}
+function chromeManifestDir(platform2 = process.platform) {
+  if (platform2 === "darwin") {
+    return join18(
+      homedir5(),
+      "Library",
+      "Application Support",
+      "Google",
+      "Chrome",
+      "NativeMessagingHosts"
+    );
+  }
+  if (platform2 === "win32") {
+    return join18(homedir5(), ".aka", "native-messaging");
+  }
+  return join18(homedir5(), ".config", "google-chrome", "NativeMessagingHosts");
+}
+function resolveNodeForLauncher() {
+  if (!isSea()) return process.execPath;
+  try {
+    const probe = process.platform === "win32" ? "where" : "which";
+    const out = execFileSync3(probe, ["node"], { encoding: "utf8" }).split(/\r?\n/)[0]?.trim();
+    if (out === void 0 || out === "") return null;
+    return out;
+  } catch {
+    return null;
+  }
+}
+function launcherPath(manifestDir, platform2) {
+  return join18(
+    manifestDir,
+    platform2 === "win32" ? `${NATIVE_HOST_NAME}.cmd` : `${NATIVE_HOST_NAME}.sh`
+  );
+}
+function posixQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function cmdQuote(value) {
+  return `"${value.replaceAll("%", "%%")}"`;
+}
+function writeLauncher(manifestDir, hostScript, nodePath, platform2) {
+  const path = launcherPath(manifestDir, platform2);
+  const tmp = `${path}.tmp`;
+  if (platform2 === "win32") {
+    writeFileSync7(tmp, `@echo off\r
+${cmdQuote(nodePath)} ${cmdQuote(hostScript)} %*\r
+`);
+  } else {
+    writeFileSync7(tmp, `#!/bin/sh
+exec ${posixQuote(nodePath)} ${posixQuote(hostScript)} "$@"
+`, {
+      mode: 493
+    });
+  }
+  renameSync5(tmp, path);
+  return path;
+}
+function windowsRegistryKey() {
+  return `HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts\\${NATIVE_HOST_NAME}`;
+}
+function registerWindowsHost(manifestPath) {
+  execFileSync3("reg", [
+    "add",
+    windowsRegistryKey(),
+    "/ve",
+    "/t",
+    "REG_SZ",
+    "/d",
+    manifestPath,
+    "/f"
+  ]);
+}
+function runExtension(argv) {
+  const sub = argv[0];
+  if (sub === "install") {
+    runInstall(chromeManifestDir());
+    return;
+  }
+  if (sub === "status") {
+    runStatus(chromeManifestDir());
+    return;
+  }
+  process.stderr.write(
+    `aka extension: unknown subcommand '${sub ?? ""}'
+Usage: aka extension <install|status>
+`
+  );
+  process.exitCode = 1;
+}
+function runInstall(manifestDir, hostScript = resolveHostScript(), extensionDist = resolveExtensionDist(), nodePath = resolveNodeForLauncher()) {
+  if (!hostScript) {
+    process.stderr.write(
+      "aka extension install: could not find the native-messaging host script.\n  In a workspace checkout, build it first: pnpm --filter @akasecurity/plugin-browser-extension build\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (!nodePath) {
+    process.stderr.write(
+      "aka extension install: no Node.js runtime found to run the native-messaging host.\n  The host runs under Node; install Node.js (so `node` resolves on PATH) and re-run.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  mkdirSync5(manifestDir, { recursive: true });
+  const launcher = writeLauncher(manifestDir, hostScript, nodePath, process.platform);
+  const manifestPath = join18(manifestDir, `${NATIVE_HOST_NAME}.json`);
+  const tmp = `${manifestPath}.tmp`;
+  writeFileSync7(tmp, `${JSON.stringify(nativeHostManifest(launcher), null, 2)}
+`, {
+    mode: DATA_FILE_MODE
+  });
+  renameSync5(tmp, manifestPath);
+  if (process.platform === "win32") {
+    try {
+      registerWindowsHost(manifestPath);
+    } catch (err) {
+      process.stderr.write(
+        `aka extension install: could not register the Windows registry key (${err instanceof Error ? err.message : String(err)}) \u2014 the native host won't be discoverable by Chrome until this is fixed.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+  }
+  process.stdout.write(
+    `\u2713 Installed the AKA native-messaging host
+  host script: ${hostScript}
+  launcher:    ${launcher}
+  manifest:    ${manifestPath}
+` + (process.platform === "win32" ? `  registry:    ${windowsRegistryKey()}
+` : "") + `
+Next: load the extension in Chrome \u2014
+  1. Open chrome://extensions
+  2. Enable "Developer mode" (top right)
+  3. Click "Load unpacked" and select:
+     ${extensionDist ?? "<run: pnpm --filter @akasecurity/plugin-browser-extension build>"}
+`
+  );
+}
+function runStatus(manifestDir) {
+  const manifestPath = join18(manifestDir, `${NATIVE_HOST_NAME}.json`);
+  const installed = existsSync13(manifestPath);
+  process.stdout.write(
+    `native-messaging host: ${installed ? "installed" : "not installed"}
+  manifest: ${manifestPath}
+` + (installed ? "" : "  run `aka extension install` to set it up\n")
+  );
+}
+
 // src/commands/init.ts
-import { existsSync as existsSync12, statSync as statSync8 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync15, lstatSync as lstatSync2, readdirSync as readdirSync7, readlinkSync, realpathSync as realpathSync3, statSync as statSync10 } from "fs";
+import { dirname as dirname8, join as join19, resolve as resolve5 } from "path";
 import * as readline from "readline/promises";
 import { parseArgs as parseArgs6 } from "util";
 
 // src/commands/plugins.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { parseArgs as parseArgs5 } from "util";
 function runPlugins(argv) {
   const [sub, ...rest] = argv;
@@ -31531,7 +33293,7 @@ async function listPlugins(argv) {
   const { values } = parseArgs5({ args: argv, options: HOME_OPTION });
   const home = homeBase(values.home);
   const active = /* @__PURE__ */ new Set();
-  if (existsSync11(dbPath(home))) {
+  if (existsSync14(dbPath(home))) {
     const db = openLocalDatabase(dataDir(home));
     try {
       const recent = await db.findings.recentFindings({ limit: 1e3 });
@@ -31540,7 +33302,7 @@ async function listPlugins(argv) {
       db.close();
     }
   }
-  const installed = installedPluginVersions();
+  const installed = installedAgentPluginVersions();
   const out = process.stdout;
   out.write("Agent plugins (the CLI is an optional hub \u2014 plugins also self-install):\n\n");
   for (const a of AGENT_PLUGINS) {
@@ -31571,42 +33333,44 @@ function installPlugin(argv) {
     return;
   }
   const ref = pluginRef(agent);
-  if (!ref) {
+  const cliBin = agent.cliBin;
+  if (!ref || !cliBin) {
     process.stdout.write(
-      `${agent.name} has no automated install path yet \u2014 install it from the AKA marketplace in Claude Code, then run \`aka init\`.
+      agent.installHint ? `${agent.installHint}
+` : `${agent.name} has no automated install path yet \u2014 install it from the AKA marketplace in ${agent.name}, then run \`aka init\`.
 `
     );
     return;
   }
-  if (!claudeAvailable()) {
+  if (!createCliPluginManager(cliBin).available()) {
     process.stdout.write(
       `Installing ${agent.name}\u2026
 
-The \`claude\` CLI isn't on your PATH, so I can't install it automatically.
-Install it from inside Claude Code:
-  /plugin marketplace add ${agent.marketplaceSource ?? ""}
-  /plugin install ${ref}
+The \`${cliBin}\` CLI isn't on your PATH, so I can't install it automatically.
+Install it from inside ${agent.name}:
+  ${cliBin} plugin marketplace add ${agent.marketplaceSource ?? ""}
+  ${cliBin} plugin install ${ref}
 
 Then run \`aka init\` to set up the local store.
 `
     );
     return;
   }
-  process.stdout.write(`Installing ${agent.name} via Claude Code\u2026
+  process.stdout.write(`Installing ${agent.name} via ${cliBin}\u2026
 `);
   const { ok } = installAgentPlugin(agent.id, "inherit");
   if (ok) {
     process.stdout.write(
       `
 \u2713 Installed ${agent.name}.
-  \u21BB Restart Claude Code to load it.
+  \u21BB Restart ${agent.name} to load it.
   Run \`aka init\` to scaffold your local store (if you haven't already).
 `
     );
   } else {
     process.stderr.write(
       `
-\u2717 Install failed \u2014 see the output above, or add it in Claude Code with \`/plugin install ${ref}\`.
+\u2717 Install failed \u2014 see the output above, or add it in ${agent.name} with \`${cliBin} plugin install ${ref}\`.
 `
     );
     process.exitCode = 1;
@@ -31615,40 +33379,159 @@ Then run \`aka init\` to set up the local store.
 
 // src/commands/init.ts
 var PLUGIN_OFFER_IDENTITY = `${PRODUCT_NAME} \u2014 ${PRODUCT_TAGLINE}`;
+var STORE_DB = "the store database (including the prompt corpus)";
+var STORE_SETTINGS = "your settings file";
+function storeContents(home) {
+  return /* @__PURE__ */ new Map([
+    [home, "the store (including the prompt corpus in aka.db)"],
+    [settingsDir(home), STORE_SETTINGS],
+    [dataDir(home), STORE_DB],
+    [keysDir(home), "the vault key"],
+    [join19(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [dbPath(home), STORE_DB]
+  ]);
+}
+function storeTargets(home) {
+  return [...storeContents(home).keys()];
+}
+function storeModeTargets(home) {
+  const targets = new Set(storeTargets(home));
+  const data = dataDir(home);
+  try {
+    for (const name of readdirSync7(data)) {
+      if (name.endsWith(".partial")) continue;
+      targets.add(join19(data, name));
+    }
+  } catch {
+  }
+  return [...targets];
+}
 function looseStorePaths(home) {
   if (process.platform === "win32") return [];
-  const targets = [
-    home,
-    settingsDir(home),
-    dataDir(home),
-    join17(settingsDir(home), "settings.json"),
-    dbPath(home)
-  ];
-  return targets.filter((p) => {
+  return storeModeTargets(home).filter((p) => {
     try {
-      return (statSync8(p).mode & 63) !== 0;
+      if (lstatSync2(p).isSymbolicLink()) return false;
+      return (statSync10(p).mode & 63) !== 0;
     } catch {
       return false;
     }
   });
 }
+function symlinkedStorePaths(home, platform2 = process.platform) {
+  return [...storeContents(home)].flatMap(([path, holds]) => {
+    try {
+      if (!lstatSync2(path).isSymbolicLink()) return [];
+      return [
+        {
+          path,
+          target: linkTarget(path),
+          holds,
+          // existsSync follows the link, so a target that is gone reads as
+          // absent here while lstat above still sees the link itself.
+          missing: !existsSync15(path),
+          mode: targetMode(path, platform2)
+        }
+      ];
+    } catch {
+      return [];
+    }
+  });
+}
+function linkTarget(path) {
+  try {
+    return realpathSync3(path);
+  } catch {
+    return resolve5(dirname8(path), readlinkSync(path));
+  }
+}
+function targetMode(path, platform2) {
+  if (platform2 === "win32") return void 0;
+  try {
+    return statSync10(path).mode & 511;
+  } catch {
+    return void 0;
+  }
+}
+function symlinkWarnings(paths, platform2 = process.platform) {
+  const seeAlso = '(see the "Data at rest" note in SECURITY.md)';
+  return paths.map(({ path, target, holds, missing, mode }) => {
+    if (missing) {
+      return `  \u26A0 ${path} is a symlink to ${target}, which does not exist \u2014 ${holds} cannot be written there until you create that target or remove the link ${seeAlso}
+`;
+    }
+    const inherited = mode === void 0 ? "" : ` (currently ${formatMode(mode)}${(mode & 63) !== 0 ? ", NOT owner-only" : ""})`;
+    const kept = platform2 === "win32" ? "" : "permissions are never changed through a symlink, so ";
+    const under = platform2 === "win32" ? "" : " under that target's own permissions";
+    return `  \u26A0 ${path} is a symlink to ${target}${inherited} \u2014 ${kept}${holds} is written there${under} ${seeAlso}
+`;
+  }).join("");
+}
+function formatMode(mode) {
+  return `0${mode.toString(8).padStart(3, "0")}`;
+}
+function assertStoreLinksResolve(home) {
+  for (const dir of [home, settingsDir(home), dataDir(home)]) {
+    if (!isBrokenLink(dir)) continue;
+    throw new Error(
+      `${dir} is a symlink to ${linkTarget(dir)}, which does not exist \u2014 create that target or remove the link, then re-run \`aka init\``
+    );
+  }
+}
+function isBrokenLink(path) {
+  try {
+    return lstatSync2(path).isSymbolicLink() && !existsSync15(path);
+  } catch {
+    return false;
+  }
+}
+function assertStorePathsAreDirectories(home) {
+  for (const dir of [home, settingsDir(home), dataDir(home), keysDir(home)]) {
+    if (!existsAsNonDirectory(dir)) continue;
+    const occupant = isSymlink2(dir) ? `is a symlink to ${linkTarget(dir)}, which is not a directory \u2014 remove the link` : "exists but is not a directory \u2014 move that file aside or remove it";
+    throw new Error(`${dir} ${occupant}. AKA keeps its store there; re-run \`aka init\` after.`);
+  }
+}
+function isSymlink2(path) {
+  try {
+    return lstatSync2(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function existsAsNonDirectory(path) {
+  try {
+    return !statSync10(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
 async function runInit(argv) {
   const { values } = parseArgs6({
     args: argv,
     options: { ...HOME_OPTION, yes: { type: "boolean", short: "y" } }
   });
   const home = homeBase(values.home);
+  assertStoreLinksResolve(home);
+  assertStorePathsAreDirectories(home);
   ensureLayoutDirSync(home);
   const settings = settingsDir(home);
   ensureLayoutDirSync(settings);
-  const settingsFile = join17(settings, "settings.json");
-  const settingsCreated = !existsSync12(settingsFile);
-  if (settingsCreated) {
-    writeOwnerOnlyFileSync(
-      settingsFile,
-      `${JSON.stringify(defaultWorkspaceSettings(), null, 2)}
+  const settingsFile = join19(settings, "settings.json");
+  let settingsCreated = false;
+  if (!existsSync15(settingsFile)) {
+    try {
+      settingsCreated = withFileLock(settingsFile, () => {
+        if (existsSync15(settingsFile)) return false;
+        writeOwnerOnlyFileSync(
+          settingsFile,
+          `${JSON.stringify(defaultWorkspaceSettings(), null, 2)}
 `
-    );
+        );
+        return true;
+      });
+    } catch (err) {
+      if (!(err instanceof FileLockError) || err.reason !== "timeout") throw err;
+    }
   }
   tightenFile(settingsFile);
   const db = openLocalDatabase(dataDir(home));
@@ -31664,14 +33547,15 @@ async function runInit(argv) {
     db.close();
   }
   const loose = looseStorePaths(home);
+  const symlinked = symlinkedStorePaths(home);
   process.stdout.write(
     `\u2713 Initialized AKA at ${home}
-  settings: ${settingsFile}${settingsCreated ? "" : " (kept existing)"}
+  settings: ${settingsFile}${settingsCreated ? "" : existsSync15(settingsFile) ? " (kept existing)" : " (not written \u2014 another process was writing it)"}
   database: ${dbPath(home)}
   seeded ${String(policyCount)} default policies, ${String(packCount)} detection pack(s)
 ` + (updatesAvailable > 0 ? `  \u2B06 ${String(updatesAvailable)} detection pack update(s) available \u2014 review with \`aka detections\`, apply with \`aka detections update --all\`
 ` : "") + (loose.length > 0 ? `  \u26A0 could not enforce owner-only permissions on ${loose.join(", ")} \u2014 this filesystem rejects chmod, so the store has no at-rest protection here (see the "Data at rest" note in SECURITY.md)
-` : "")
+` : "") + symlinkWarnings(symlinked)
   );
   await offerPluginInstall(values.yes === true);
 }
@@ -31716,7 +33600,7 @@ async function confirm(question) {
 }
 
 // src/commands/scan.ts
-import { statSync as statSync9 } from "fs";
+import { statSync as statSync11 } from "fs";
 import { parseArgs as parseArgs7 } from "util";
 function severityRank(s) {
   return Severity.options.indexOf(s);
@@ -31730,7 +33614,7 @@ function renderEgressLine(egress) {
   const cap = egress.truncated ? ` (capped at ${String(MAX_EGRESS_CALL_SITES_PER_PROJECT)} call sites)` : "";
   return `Data shares: ${String(egress.destinations)} destination(s) \xB7 ${String(egress.endpoints)} endpoint(s) \xB7 ${String(egress.callSites)} call site(s)${cap}`;
 }
-function runScan(argv) {
+async function runScan(argv) {
   const { values, positionals } = parseArgs7({
     args: argv,
     options: {
@@ -31763,7 +33647,7 @@ function runScan(argv) {
     failOn = parsed.data;
   }
   try {
-    statSync9(target);
+    statSync11(target);
   } catch {
     process.stderr.write(`aka scan: no such file or directory: ${target}
 `);
@@ -31778,7 +33662,11 @@ function runScan(argv) {
   let egress;
   try {
     const { ruleActions } = db.installedPacks.installedRuleset();
-    result = scanPathIntoStore(db, target, { ruleActions, sourceTool: "cli", dataDir: storeDir });
+    result = await scanPathIntoStore(db, target, {
+      ruleActions,
+      sourceTool: "cli",
+      dataDir: storeDir
+    });
     inventory = recordProjectInventory(db, target);
     egress = recordProjectEgress(db, target, result.egress, home);
   } finally {
@@ -32649,19 +34537,20 @@ function applyCliUpdate2() {
 function applyPluginUpdate2(status) {
   const agent = findAgent(status.id);
   const ref = agent ? pluginRef(agent) : void 0;
-  if (!agent || !ref) {
+  const cliBin = agent?.cliBin;
+  if (!agent || !ref || !cliBin) {
     process.stderr.write(`\u2717 ${status.name}: no update coordinates in the registry.
 `);
     return false;
   }
-  if (!claudeAvailable()) {
+  if (!createCliPluginManager(cliBin).available()) {
     process.stderr.write(
-      `\u2717 ${status.name}: the \`claude\` CLI isn't on your PATH \u2014 install Claude Code, then run \`claude plugin update ${ref}\`.
+      `\u2717 ${status.name}: the \`${cliBin}\` CLI isn't on your PATH \u2014 install ${agent.name}, then run \`${cliBin} plugin update ${ref}\`.
 `
     );
     return false;
   }
-  process.stdout.write(`Updating ${status.name} (claude plugin update ${ref})\u2026
+  process.stdout.write(`Updating ${status.name} (${cliBin} plugin update ${ref})\u2026
 `);
   const { ok } = applyPluginUpdate(status.id, "inherit");
   process.stdout.write(ok ? `\u2713 ${status.name} updated.
@@ -32719,7 +34608,6 @@ async function runShow2(argv, io) {
     const vault = new SecretVault({
       repo: db.secretVault,
       keys: createKeyProvider(readWorkspaceSettings(base).vaultKeyCustody, keysDir(base)),
-      fingerprintKey: loadOrCreateFingerprintKey(dir),
       // Read live so a consent revocation applies to the very next call.
       isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent)
     });
@@ -32807,6 +34695,7 @@ var COMMANDS = {
   detections: runDetections,
   plugins: runPlugins,
   dashboard: runDashboard,
+  extension: runExtension,
   exception: (argv) => runException(argv),
   vault: (argv) => runVault(argv),
   tui: runTui,