@akasecurity/cli 0.9.7 → 0.9.8

package/dist/cli.js

@@ -51,7 +51,7 @@ var require_ignore = __commonJS({
     var REGEX_SPLITALL_CRLF = /\r?\n/g;
     var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
     var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH = "/";
+    var SLASH2 = "/";
     var TMP_KEY_IGNORE = "node-ignore";
     if (typeof Symbol !== "undefined") {
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
@@ -423,11 +423,11 @@ var require_ignore = __commonJS({
         if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
           return this.test(path);
         }
-        const slices = path.split(SLASH).filter(Boolean);
+        const slices = path.split(SLASH2).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
-            slices.join(SLASH) + SLASH,
+            slices.join(SLASH2) + SLASH2,
             this._testCache,
             true,
             slices
@@ -443,14 +443,14 @@ var require_ignore = __commonJS({
           return cache[path];
         }
         if (!slices) {
-          slices = path.split(SLASH).filter(Boolean);
+          slices = path.split(SLASH2).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
           return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
-          slices.join(SLASH) + SLASH,
+          slices.join(SLASH2) + SLASH2,
           cache,
           checkUnignored,
           slices
@@ -16451,6 +16451,125 @@ var ConfigScanRecord = external_exports.object({
   findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
 
+// ../packages/schema/src/zod/control-plane.ts
+var ATTACHED_CREDENTIAL_FILENAME = "control-plane-credential.json";
+var ATTACHED_CREDENTIAL_SPEC_VERSION = 1;
+var AttachedCredential = external_exports.object({
+  specVersion: external_exports.literal(ATTACHED_CREDENTIAL_SPEC_VERSION),
+  // The control-plane endpoint this credential was minted against.
+  endpoint: external_exports.string().min(1),
+  // The bearer credential itself. Never logged, never rendered — status
+  // surfaces show `keyPrefix` and nothing else.
+  apiKey: external_exports.string().min(1),
+  // First few characters of the key, safe to display so a user can match the
+  // credential against their organization's key list.
+  keyPrefix: external_exports.string().min(1).max(16).optional(),
+  mintedAt: external_exports.iso.datetime().optional()
+});
+var MAX_DATE_MS = 253402300799999;
+var MAX_INT4 = 2147483647;
+var StorePosturePack = external_exports.object({
+  packId: external_exports.string().min(1),
+  // 'namespace/packId'
+  version: external_exports.string().min(1),
+  enabled: external_exports.boolean(),
+  // Stringified pass-through of the local store's `installed_packs.updated_at`
+  // — the column format is store-version-dependent (epoch millis vs ISO), so
+  // the wire shape assumes neither.
+  updatedAt: external_exports.string().nullable()
+}).meta({ id: "StorePosturePack" });
+var StorePosturePolicyCounts = external_exports.object({
+  total: external_exports.number().int().min(0),
+  disabled: external_exports.number().int().min(0),
+  // Exhaustive per-action map; the builder pre-fills every action with 0.
+  //
+  // Spelled out member-by-member rather than `z.record(ActionTaken, …)`. Zod
+  // enforces exhaustiveness either way, but z.record emits `propertyNames` +
+  // `additionalProperties` into a generated schema document, and a type
+  // generator renders THAT with every key optional — a sender built against
+  // the generated type would typecheck and still be rejected at runtime. An
+  // explicit object emits `properties` + `required`, so generated types
+  // demand all five.
+  //
+  // `satisfies Record<ActionTaken, …>` keeps the link to the enum: adding an
+  // ActionTaken member is a COMPILE error here instead of silent drift.
+  // `.strict()` is load-bearing — it rejects an unknown action key, which a
+  // bare object would silently STRIP, accepting a miscounted map as valid.
+  byAction: external_exports.object({
+    warn: external_exports.number().int().min(0),
+    redact: external_exports.number().int().min(0),
+    block: external_exports.number().int().min(0),
+    allow: external_exports.number().int().min(0),
+    log: external_exports.number().int().min(0)
+  }).strict()
+}).meta({ id: "StorePosturePolicyCounts" });
+var StorePosturePlugin = external_exports.object({
+  /** Package name of the reporting plugin. */
+  package: external_exports.string().min(1).max(200),
+  version: external_exports.string().min(1).max(64),
+  /** Version of the bundled core, when the build records one separately. */
+  ossVersion: external_exports.string().max(64).nullable(),
+  /**
+   * `version` of the policy bundle this machine last fetched. Bounded at 200
+   * rather than the 64 a bare sha256 hex digest needs today, so a later
+   * format with an algorithm prefix does not start rejecting the channel.
+   */
+  policyBundleVersion: external_exports.string().max(200).nullable(),
+  /** Epoch millis, on the CLIENT clock, of that fetch. */
+  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable()
+}).meta({ id: "StorePosturePlugin" });
+var StorePostureSnapshot = external_exports.object({
+  deviceId: external_exports.guid(),
+  hostname: external_exports.string().min(1).max(253),
+  // Epoch millis on the CLIENT clock. Bounded by what a receiving store
+  // accepts (see MAX_DATE_MS), not by what a JavaScript Date can hold.
+  capturedAt: external_exports.number().int().min(0).max(MAX_DATE_MS),
+  // False is a measurement, not an error state: "no local store exists on
+  // this machine".
+  storePresent: external_exports.boolean(),
+  schemaVersion: external_exports.number().int().min(0).max(MAX_INT4).nullable(),
+  // PRAGMA user_version
+  findingsTotal: external_exports.number().int().min(0).max(MAX_INT4),
+  // Epoch millis, bounded like `capturedAt` — see MAX_DATE_MS on what that
+  // bound does and does not do. Worth stating for these two specifically:
+  // they are read from the local store's own ROWS rather than from this
+  // machine's clock, so a damaged or hand-edited store is enough to produce
+  // an out-of-range value with no clock skew involved.
+  findingsFirstAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  findingsLastAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  packs: external_exports.array(StorePosturePack).max(500),
+  policyCounts: StorePosturePolicyCounts,
+  // OPTIONAL, not nullable: a reporter that predates this member keeps
+  // getting its 200 without a payload change.
+  plugin: StorePosturePlugin.optional()
+}).meta({ id: "StorePostureSnapshot" });
+var CAPTURE_VERSION_PREFIX = "capture/";
+var RecordAuditEventRequest = AuditEventInput.extend({
+  inspections: external_exports.array(ToolCallInspection).default([])
+}).refine((v) => v.inspections.every((i) => !i.ruleVersion.startsWith(CAPTURE_VERSION_PREFIX)), {
+  message: `inspections[].ruleVersion must not start with \`${CAPTURE_VERSION_PREFIX}\` \u2014 that namespace is reserved for capture definitions the control plane mints itself`,
+  path: ["inspections"]
+}).meta({ id: "RecordAuditEventRequest" });
+var IngestAck = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+});
+var PRINTABLE = /^[^\p{Cc}\p{Cf}]*$/u;
+var printable = (max) => external_exports.string().max(max).regex(PRINTABLE, "must not contain control characters");
+var PluginWhoami = external_exports.object({
+  tenantName: printable(200),
+  userEmail: printable(320),
+  role: printable(64),
+  keyKind: printable(64),
+  serverTime: printable(64)
+});
+var ControlPlaneErrorBody = external_exports.object({
+  error: external_exports.object({
+    code: external_exports.string().optional(),
+    message: external_exports.string().optional()
+  }).optional()
+});
+
 // ../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
 var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -16753,15 +16872,15 @@ function summaryToDetectionListItem(s) {
 }
 function rowToDetectionDetail(row, findingsLast30d, update) {
   const rules = row.rules.flatMap((r) => {
-    const parsed = Matcher.safeParse(r.matcher);
-    if (!parsed.success) return [];
+    const parsed2 = Matcher.safeParse(r.matcher);
+    if (!parsed2.success) return [];
     return [
       {
         id: r.id,
         name: r.name,
         category: r.category,
         severity: r.severity,
-        matcher: parsed.data
+        matcher: parsed2.data
       }
     ];
   });
@@ -17419,8 +17538,8 @@ function toApiAction(dbVal) {
 }
 function toApiCategory(dbVal) {
   if (dbVal === "code_context") return "source_code";
-  const parsed = FindingCategory.safeParse(dbVal);
-  return parsed.success ? parsed.data : "custom";
+  const parsed2 = FindingCategory.safeParse(dbVal);
+  return parsed2.success ? parsed2.data : "custom";
 }
 function toApiProvider(sourceTool) {
   return TOOL_TO_HARNESS[sourceTool] ?? HARNESS.Api;
@@ -18024,6 +18143,9 @@ var ModelJudgeConsent = external_exports.object({
   acknowledgedAt: external_exports.iso.datetime(),
   payloadVersion: external_exports.number().int().positive()
 });
+function isModelJudgeConsentValid(consent) {
+  return consent?.payloadVersion === MODEL_JUDGE_PAYLOAD_VERSION;
+}
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
   runMode: RunMode.default("standalone"),
@@ -18057,6 +18179,12 @@ var WorkspaceSettings = external_exports.object({
 function defaultWorkspaceSettings() {
   return WorkspaceSettings.parse({});
 }
+function isAttached(settings) {
+  return settings.runMode === "attached" && settings.controlPlane !== void 0;
+}
+function controlPlaneName(connection) {
+  return connection.label ?? connection.endpoint;
+}
 function toInventoryRow(input, id, now) {
   return {
     id,
@@ -18202,6 +18330,7 @@ var ManagedSettings = external_exports.object({
   // the user may still override. The two are separable on purpose.
   lockedFields: external_exports.array(ManagedSettingKey).default([])
 }).meta({ id: "ManagedSettings" });
+var NO_MANAGED_CONTEXT = { present: false, lockedFields: [] };
 
 // ../packages/schema/src/zod/policy.ts
 var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
@@ -18324,8 +18453,8 @@ function builtinPolicyIsReversible(id) {
   return BUILTIN_POLICY_SPECS[id].reversible;
 }
 function policyIdIsReversible(policyId) {
-  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
   return builtinPolicyIsReversible(id);
 }
 var DEFAULT_ACTIONS = Object.fromEntries(
@@ -18337,12 +18466,12 @@ var BUILTIN_POLICIES = Object.fromEntries(
 var DEFAULT_PACK_POLICY_ID = "monitor";
 function policyDisplayName(policyId) {
   const id = policyId ?? DEFAULT_PACK_POLICY_ID;
-  const parsed = BuiltinPolicyId.safeParse(id);
-  return parsed.success ? BUILTIN_POLICIES[parsed.data].name : id;
+  const parsed2 = BuiltinPolicyId.safeParse(id);
+  return parsed2.success ? BUILTIN_POLICIES[parsed2.data].name : id;
 }
 function policyIdToAction(policyId) {
-  const parsed = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
-  const id = parsed.success ? parsed.data : DEFAULT_PACK_POLICY_ID;
+  const parsed2 = BuiltinPolicyId.safeParse(policyId ?? DEFAULT_PACK_POLICY_ID);
+  const id = parsed2.success ? parsed2.data : DEFAULT_PACK_POLICY_ID;
   return BUILTIN_POLICIES[id].action;
 }
 var UsedByItem = external_exports.object({
@@ -19366,8 +19495,8 @@ var installCodexPlugin = manager2.install;
 var updateCodexPlugin = manager2.update;
 
 // ../packages/local-ops/src/egress-record.ts
-import { statSync as statSync7 } from "fs";
-import { dirname as dirname6, relative, resolve } from "path";
+import { statSync as statSync9 } from "fs";
+import { dirname as dirname7, relative, resolve as resolve2 } from "path";
 
 // ../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -20160,11 +20289,11 @@ function extractEgress(text) {
     if (scheme === void 0) continue;
     const candidate = matched.replace(TRAILING_PUNCTUATION, "");
     if (candidate === "") continue;
-    const parsed = parseCandidate(candidate, scheme);
-    if (parsed === null) continue;
+    const parsed2 = parseCandidate(candidate, scheme);
+    if (parsed2 === null) continue;
     const index = lineIndexAt(lineStarts, start);
     hits.push({
-      ...parsed,
+      ...parsed2,
       method: inferMethod(text, start, start + matched.length),
       line: index + 1,
       snippet: snippetAt(index, start)
@@ -20174,9 +20303,9 @@ function extractEgress(text) {
     const start = match.index;
     if (isInsideSpan(urlSpans, start)) continue;
     const index = lineIndexAt(lineStarts, start);
-    const parsed = parseBareIp(match[0], ipContextOf(index));
-    if (parsed === null) continue;
-    hits.push({ ...parsed, method: "REF", line: index + 1, snippet: snippetAt(index, start) });
+    const parsed2 = parseBareIp(match[0], ipContextOf(index));
+    if (parsed2 === null) continue;
+    hits.push({ ...parsed2, method: "REF", line: index + 1, snippet: snippetAt(index, start) });
   }
   return hits.sort(compareHits);
 }
@@ -20188,21 +20317,21 @@ function parseCandidate(candidate, scheme) {
     placeholders2 += 1;
     return VAR_TOKEN;
   });
-  let parsed;
+  let parsed2;
   try {
-    parsed = new URL(normalized.split(VAR_TOKEN).join(VAR_SENTINEL));
+    parsed2 = new URL(normalized.split(VAR_TOKEN).join(VAR_SENTINEL));
   } catch {
     return null;
   }
-  const host = parsed.hostname.toLowerCase();
+  const host = parsed2.hostname.toLowerCase();
   if (host === "" || host.includes(VAR_SENTINEL)) return null;
-  const authority = parsed.host.toLowerCase();
-  const path = maskWebhookPath(host, parsed.pathname);
+  const authority = parsed2.host.toLowerCase();
+  const path = maskWebhookPath(host, parsed2.pathname);
   const url2 = `${transport}://${authority}${path}`.split(VAR_SENTINEL).join(VAR_TOKEN);
   return {
     url: url2,
     host,
-    port: parsed.port === "" ? null : Number(parsed.port),
+    port: parsed2.port === "" ? null : Number(parsed2.port),
     transport,
     template: placeholders2 > 0
   };
@@ -20396,15 +20525,15 @@ function makeHit(ecosystem, pkg, line, rawLine) {
   return { ecosystem, pkg, line, snippet: redactSnippet(rawLine) };
 }
 function extractPackageJson(text) {
-  const parsed = parseJson(text);
-  if (parsed === null) return [];
+  const parsed2 = parseJson(text);
+  if (parsed2 === null) return [];
   const seen = /* @__PURE__ */ new Set();
   const hits = [];
-  for (const pkg of objectKeys(parsed.dependencies)) {
+  for (const pkg of objectKeys(parsed2.dependencies)) {
     seen.add(pkg);
     hits.push(hitAtQuotedKey("npm", pkg, text, "dependencies"));
   }
-  for (const pkg of objectKeys(parsed.optionalDependencies)) {
+  for (const pkg of objectKeys(parsed2.optionalDependencies)) {
     if (seen.has(pkg)) continue;
     seen.add(pkg);
     hits.push(hitAtQuotedKey("npm", pkg, text, "optionalDependencies"));
@@ -20588,9 +20717,9 @@ function extractCargoToml(text) {
   return hits;
 }
 function extractComposerJson(text) {
-  const parsed = parseJson(text);
-  if (parsed === null) return [];
-  const pkgs = objectKeys(parsed.require).filter((pkg) => pkg !== "php" && !pkg.startsWith("ext-"));
+  const parsed2 = parseJson(text);
+  if (parsed2 === null) return [];
+  const pkgs = objectKeys(parsed2.require).filter((pkg) => pkg !== "php" && !pkg.startsWith("ext-"));
   return pkgs.map((pkg) => hitAtQuotedKey("composer", pkg, text, "require"));
 }
 var CSPROJ_PACKAGE_REFERENCE = /<PackageReference\s+Include="([^"]+)"/;
@@ -20643,14 +20772,14 @@ function eachLine(text, fn) {
   }
 }
 function parseJson(text) {
-  let parsed;
+  let parsed2;
   try {
-    parsed = JSON.parse(text);
+    parsed2 = JSON.parse(text);
   } catch {
     return null;
   }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const record2 = parsed;
+  if (typeof parsed2 !== "object" || parsed2 === null) return null;
+  const record2 = parsed2;
   return {
     dependencies: record2.dependencies,
     optionalDependencies: record2.optionalDependencies,
@@ -21171,46 +21300,9 @@ var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].m
 var CPU_CORROBORATION_SHARE = 0.2;
 var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
-// ../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join4, sep as sep2 } from "path";
-import { DatabaseSync } from "node:sqlite";
-
-// ../packages/persistence/src/ids.ts
-import { createHash } from "crypto";
-function sha256Hex(input) {
-  return createHash("sha256").update(input).digest("hex");
-}
-function inventoryId(objectType, identityKey) {
-  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
-}
-function sourceProjectId(url2) {
-  return sha256Hex(canonicalIdentity(["source_project", url2]));
-}
-function classifiedDataId(cls) {
-  return sha256Hex(canonicalIdentity(["classified_data", cls]));
-}
-function inspectionDefinitionId(ruleId, version2) {
-  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
-}
-function llmCallId(sessionId, messageId) {
-  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
-}
-function toolCallId(sessionId, toolUseId) {
-  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
-}
-var NO_SESSION = "no_session";
-var NO_PATH = "no_path";
-function captureId(sessionId, contentHash, filePath = null) {
-  return sha256Hex(
-    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
-  );
-}
-
-// ../packages/persistence/src/internal/snapshot.ts
-import { randomUUID } from "crypto";
-import { existsSync as existsSync3, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
-import { basename, dirname as dirname3, join as join3 } from "path";
+// ../packages/persistence/src/control-plane-credential.ts
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync as readFileSync3, rmSync as rmSync2, statSync } from "fs";
+import { join as join3 } from "path";
 
 // ../packages/persistence/src/paths.ts
 import {
@@ -21337,7 +21429,131 @@ function publishByLink(tmp, file2, data) {
   }
 }
 
+// ../packages/persistence/src/control-plane-credential.ts
+function controlPlaneCredentialPath(settingsDir2) {
+  return join3(settingsDir2, ATTACHED_CREDENTIAL_FILENAME);
+}
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isSafeEndpoint(endpoint) {
+  let parsed2;
+  try {
+    parsed2 = new URL(endpoint);
+  } catch {
+    return false;
+  }
+  if (parsed2.protocol === "https:") return true;
+  return parsed2.protocol === "http:" && LOOPBACK_HOSTS.has(parsed2.hostname);
+}
+function repairOrRefuseMode(file2) {
+  const link = lstatSync2(file2, { throwIfNoEntry: false });
+  if (link === void 0) return "absent";
+  if (link.isSymbolicLink()) return "untrusted";
+  const stat = statSync(file2, { throwIfNoEntry: false });
+  if (stat === void 0) return "absent";
+  const uid = process.getuid?.();
+  if (uid !== void 0 && stat.uid !== uid) return "untrusted";
+  if (process.platform !== "win32" && (stat.mode & 511) !== DATA_FILE_MODE) {
+    try {
+      chmodSync2(file2, DATA_FILE_MODE);
+    } catch {
+      return "untrusted";
+    }
+  }
+  return "ok";
+}
+function readControlPlaneCredentialState(settingsDir2, connection) {
+  const file2 = controlPlaneCredentialPath(settingsDir2);
+  let raw;
+  const gate = repairOrRefuseMode(file2);
+  if (gate === "absent") return { usable: false, reason: "absent" };
+  if (gate === "untrusted") return { usable: false, reason: "untrusted-file" };
+  try {
+    raw = readFileSync3(file2, "utf8");
+  } catch (err) {
+    const code = err.code;
+    return { usable: false, reason: code === "ENOENT" ? "absent" : "unreadable" };
+  }
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(raw);
+  } catch {
+    return { usable: false, reason: "malformed" };
+  }
+  const result = AttachedCredential.safeParse(parsed2);
+  if (!result.success) return { usable: false, reason: "malformed" };
+  if (!isSafeEndpoint(result.data.endpoint)) {
+    return { usable: false, reason: "unsafe-endpoint" };
+  }
+  if (connection !== void 0 && connection.endpoint !== result.data.endpoint) {
+    return {
+      usable: false,
+      reason: "endpoint-mismatch",
+      credentialEndpoint: result.data.endpoint,
+      settingsEndpoint: connection.endpoint
+    };
+  }
+  return { usable: true, credential: result.data };
+}
+function writeControlPlaneCredential(settingsDir2, credential) {
+  if (!isSafeEndpoint(credential.endpoint)) {
+    throw new Error(
+      `refusing to store a control-plane credential for a non-HTTPS endpoint: ${credential.endpoint}`
+    );
+  }
+  ensureDataDirSync(settingsDir2);
+  writeOwnerOnlyFileSync(
+    controlPlaneCredentialPath(settingsDir2),
+    `${JSON.stringify(credential, null, 2)}
+`
+  );
+}
+function removeControlPlaneCredential(settingsDir2) {
+  const file2 = controlPlaneCredentialPath(settingsDir2);
+  const existed = lstatSync2(file2, { throwIfNoEntry: false }) !== void 0;
+  rmSync2(file2, { force: true });
+  return existed;
+}
+
+// ../packages/persistence/src/database.ts
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join5, sep as sep2 } from "path";
+import { DatabaseSync } from "node:sqlite";
+
+// ../packages/persistence/src/ids.ts
+import { createHash } from "crypto";
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function inventoryId(objectType, identityKey) {
+  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+}
+function sourceProjectId(url2) {
+  return sha256Hex(canonicalIdentity(["source_project", url2]));
+}
+function classifiedDataId(cls) {
+  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+}
+function inspectionDefinitionId(ruleId, version2) {
+  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
+}
+function llmCallId(sessionId, messageId) {
+  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+}
+function toolCallId(sessionId, toolUseId) {
+  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+}
+var NO_SESSION = "no_session";
+var NO_PATH = "no_path";
+function captureId(sessionId, contentHash, filePath = null) {
+  return sha256Hex(
+    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
+  );
+}
+
 // ../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync3, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { basename, dirname as dirname3, join as join4 } from "path";
 function backupPath(file2, tag) {
   return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
 }
@@ -21347,15 +21563,15 @@ var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 var SNAPSHOT_STAGING_COPY = "copy";
 function createSnapshotStaging(backup) {
   const stage = `${backup}${SNAPSHOT_STAGING_SUFFIX}`;
-  rmSync2(stage, { recursive: true, force: true });
+  rmSync3(stage, { recursive: true, force: true });
   mkdirOwnerOnlySync(stage);
   tightenDir(stage);
-  return { stage, copy: join3(stage, SNAPSHOT_STAGING_COPY) };
+  return { stage, copy: join4(stage, SNAPSHOT_STAGING_COPY) };
 }
 function idleMs(entry) {
-  for (const candidate of [join3(entry, SNAPSHOT_STAGING_COPY), entry]) {
+  for (const candidate of [join4(entry, SNAPSHOT_STAGING_COPY), entry]) {
     try {
-      return Date.now() - statSync(candidate).mtimeMs;
+      return Date.now() - statSync2(candidate).mtimeMs;
     } catch {
     }
   }
@@ -21372,11 +21588,11 @@ function reapStalePartials(file2) {
   }
   for (const name of entries) {
     if (!name.startsWith(prefix) || !name.endsWith(STAGED_NAME_SUFFIX)) continue;
-    const staging = join3(dir, name);
+    const staging = join4(dir, name);
     try {
       const idle = idleMs(staging);
       if (idle !== null && idle > STALE_PARTIAL_MS) {
-        rmSync2(staging, { recursive: true, force: true });
+        rmSync3(staging, { recursive: true, force: true });
       }
     } catch {
     }
@@ -21390,13 +21606,13 @@ function snapshotStore(db, backup) {
     renameSync2(copy, backup);
   } catch (error51) {
     try {
-      rmSync2(stage, { recursive: true, force: true });
+      rmSync3(stage, { recursive: true, force: true });
     } catch {
     }
     throw error51;
   }
   try {
-    rmSync2(stage, { recursive: true, force: true });
+    rmSync3(stage, { recursive: true, force: true });
   } catch {
   }
 }
@@ -21411,7 +21627,7 @@ function moveStoreAside(file2, backup) {
         renameSync2(sidecar, moved);
         undo.push([moved, sidecar]);
       } catch {
-        rmSync2(sidecar, { force: true });
+        rmSync3(sidecar, { force: true });
       }
     }
   } catch (error51) {
@@ -21427,14 +21643,14 @@ function moveStoreAside(file2, backup) {
 }
 function discardStore(file2, backup) {
   try {
-    rmSync2(file2, { force: true });
+    rmSync3(file2, { force: true });
     for (const sidecar of dbSidecars(file2)) {
-      rmSync2(sidecar, { force: true });
+      rmSync3(sidecar, { force: true });
     }
   } catch (error51) {
     if (existsSync3(file2)) {
       try {
-        rmSync2(backup, { force: true });
+        rmSync3(backup, { force: true });
       } catch {
       }
     }
@@ -21666,10 +21882,31 @@ function applyMigrations(db, file2) {
     if (drained) applyLegacyDropMigration(db, file2);
   }
 }
+function readLegacyTables(db) {
+  let holdsRows = false;
+  const marks = [];
+  for (const table of ["events", "findings"]) {
+    try {
+      const row = db.prepare(`SELECT count(*) AS n, ifnull(max(rowid), -1) AS hi FROM ${table}`).get();
+      if (row === void 0) {
+        holdsRows = true;
+        marks.push(`${table}:unreadable`);
+        continue;
+      }
+      if (row.n > 0) holdsRows = true;
+      marks.push(`${table}:${String(row.n)}:${String(row.hi)}`);
+    } catch {
+      holdsRows = true;
+      marks.push(`${table}:unreadable`);
+    }
+  }
+  return { holdsRows, mark: marks.join("|") };
+}
 function applyLegacyDropMigration(db, file2) {
   const migration = SQLITE_MIGRATIONS.find((m) => m.tag === LEGACY_DROP_MIGRATION_TAG);
   if (!migration) return;
-  if (file2) {
+  const before = file2 === void 0 ? void 0 : readLegacyTables(db);
+  if (file2 !== void 0 && before?.holdsRows === true) {
     try {
       backupBeforeLegacyDrop(db, file2);
     } catch (error51) {
@@ -21683,6 +21920,12 @@ function applyLegacyDropMigration(db, file2) {
       () => {
         const alreadyDropped = db.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(migration.tag);
         if (alreadyDropped) return;
+        if (before !== void 0 && readLegacyTables(db).mark !== before.mark) {
+          akaWarn(
+            "legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first."
+          );
+          return;
+        }
         for (const statement of splitStatements(migration.sql)) {
           db.exec(statement);
         }
@@ -22037,8 +22280,8 @@ function safeJson(s, fallback) {
 function parseJsonObject(s) {
   if (s == null) return void 0;
   try {
-    const parsed = JSON.parse(s);
-    if (typeof parsed === "object" && parsed !== null) return parsed;
+    const parsed2 = JSON.parse(s);
+    if (typeof parsed2 === "object" && parsed2 !== null) return parsed2;
   } catch {
   }
   return void 0;
@@ -22049,16 +22292,16 @@ function encodeKeysetCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeKeysetCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && "startedAtMs" in parsed2 && "id" in parsed2 && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
   // resumes from is epoch millis, and a payload carrying ±Infinity or a
   // fraction binds cleanly rather than failing — returning an EMPTY page with
   // a null cursor, which a caller reads as "end of list". That is the one
   // outcome a cursor that does not decode must never produce, since the
   // documented behaviour above is to restart from the top. (`1e999` is valid
   // JSON and parses to Infinity; a bare `NaN` is not, so it cannot arrive.)
-  Number.isInteger(parsed.startedAtMs) && typeof parsed.id === "string") {
-    return parsed;
+  Number.isInteger(parsed2.startedAtMs) && typeof parsed2.id === "string") {
+    return parsed2;
   }
   return null;
 }
@@ -22123,18 +22366,18 @@ var DB_EVENT_TYPE_TO_KIND = {
 };
 function safeParseStringArray(raw) {
   if (!raw) return [];
-  const parsed = safeJson(raw, null);
-  return Array.isArray(parsed) ? parsed : [];
+  const parsed2 = safeJson(raw, null);
+  return Array.isArray(parsed2) ? parsed2 : [];
 }
 var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 function toHarness(raw) {
-  const parsed = Harness.safeParse(raw);
-  return parsed.success ? parsed.data : DEFAULT_HARNESS;
+  const parsed2 = Harness.safeParse(raw);
+  return parsed2.success ? parsed2.data : DEFAULT_HARNESS;
 }
 function resolveLifecycle(row, lastActivityMs, nowMs) {
   if (row.status) {
-    const parsed = SessionStatus.safeParse(row.status);
-    if (parsed.success) return { status: parsed.data, endedAtMs: row.ended_at };
+    const parsed2 = SessionStatus.safeParse(row.status);
+    if (parsed2.success) return { status: parsed2.data, endedAtMs: row.ended_at };
   }
   if (row.ended_at !== null) return { status: "completed", endedAtMs: row.ended_at };
   if (lastActivityMs >= nowMs - LIVE_ACTIVITY_WINDOW_MS) {
@@ -23093,9 +23336,9 @@ var SqliteDetectionsRepository = class {
     const ruleIds = /* @__PURE__ */ new Set();
     for (const r of rows) {
       if (intToBool(r.enabled)) active += 1;
-      const parsed = parseRules(r.rulesJson);
-      rules += parsed.length;
-      for (const rule of parsed) {
+      const parsed2 = parseRules(r.rulesJson);
+      rules += parsed2.length;
+      for (const rule of parsed2) {
         if (typeof rule.id === "string") ruleIds.add(rule.id);
       }
     }
@@ -23629,12 +23872,12 @@ function encodeGroupCursor(group) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeGroupCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && typeof parsed.sev === "string" && typeof parsed.t === "string" && typeof parsed.id === "string") {
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && typeof parsed2.sev === "string" && typeof parsed2.t === "string" && typeof parsed2.id === "string") {
     return {
-      severity: parsed.sev,
-      latestDetectedAt: parsed.t,
-      id: parsed.id
+      severity: parsed2.sev,
+      latestDetectedAt: parsed2.t,
+      id: parsed2.id
     };
   }
   return null;
@@ -24768,16 +25011,16 @@ var SqliteInstalledPacksRepository = class {
         continue;
       }
       for (const entry of raw) {
-        const parsed = Rule.safeParse(entry);
-        if (parsed.success) {
-          out.rules.push(parsed.data);
-          out.ruleActions.set(parsed.data.id, action);
-          out.ruleVersions.set(parsed.data.id, row.version);
-          if (reversible) out.reversibleRules.add(parsed.data.id);
-          else out.reversibleRules.delete(parsed.data.id);
+        const parsed2 = Rule.safeParse(entry);
+        if (parsed2.success) {
+          out.rules.push(parsed2.data);
+          out.ruleActions.set(parsed2.data.id, action);
+          out.ruleVersions.set(parsed2.data.id, row.version);
+          if (reversible) out.reversibleRules.add(parsed2.data.id);
+          else out.reversibleRules.delete(parsed2.data.id);
         } else {
           out.invalidRules += 1;
-          reject(pack, printableRuleId(entry), firstIssueReason(parsed.error));
+          reject(pack, printableRuleId(entry), firstIssueReason(parsed2.error));
         }
       }
     }
@@ -26167,15 +26410,15 @@ function encodeReuseCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeReuseCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
+  const parsed2 = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed2 !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
   // ±Infinity or a fraction binds cleanly and returns an EMPTY page with a
   // null cursor, which the caller reads as "end of list" — the one outcome a
   // malformed cursor must never produce, since restarting from the top is the
   // documented behaviour and the only recoverable one. (`1e999` is valid JSON
   // and parses to Infinity; a bare `NaN` is not, so it cannot arrive here.)
-  Number.isInteger(parsed.occurrences) && typeof parsed.pointerId === "string") {
-    return { occurrences: parsed.occurrences, pointerId: parsed.pointerId };
+  Number.isInteger(parsed2.occurrences) && typeof parsed2.pointerId === "string") {
+    return { occurrences: parsed2.occurrences, pointerId: parsed2.pointerId };
   }
   return null;
 }
@@ -27904,7 +28147,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join4(dir, DB_FILENAME);
+  const file2 = join5(dir, DB_FILENAME);
   reapStalePartials(file2);
   const {
     db,
@@ -28140,9 +28383,9 @@ import {
   closeSync,
   existsSync as existsSync4,
   openSync,
-  readFileSync as readFileSync3,
-  rmSync as rmSync3,
-  statSync as statSync2,
+  readFileSync as readFileSync4,
+  rmSync as rmSync4,
+  statSync as statSync3,
   writeFileSync as writeFileSync2
 } from "fs";
 import { hostname as hostname3 } from "os";
@@ -28176,13 +28419,13 @@ function lockPathFor(file2) {
 function readLockBody(lock) {
   let raw;
   try {
-    raw = readFileSync3(lock, "utf8");
+    raw = readFileSync4(lock, "utf8");
   } catch {
     return null;
   }
   try {
-    const parsed = JSON.parse(raw);
-    const { pid, token, at, host } = parsed;
+    const parsed2 = JSON.parse(raw);
+    const { pid, token, at, host } = parsed2;
     if (typeof pid !== "number" || typeof token !== "string" || typeof at !== "number") return null;
     return { pid, token, at, host: typeof host === "string" ? host : "" };
   } catch {
@@ -28207,7 +28450,7 @@ function directoryAcceptsCreates(lock) {
     return false;
   } finally {
     try {
-      rmSync3(probe, { force: true });
+      rmSync4(probe, { force: true });
     } catch {
     }
   }
@@ -28240,7 +28483,7 @@ function tryAcquire(lock, file2) {
       closeSync(fd);
     } catch {
     }
-    rmSync3(lock, { force: true });
+    rmSync4(lock, { force: true });
     return null;
   }
   try {
@@ -28252,7 +28495,7 @@ function tryAcquire(lock, file2) {
 function isAbandoned(body, lock, staleMs) {
   if (!body) {
     try {
-      return Date.now() - statSync2(lock).mtimeMs >= staleMs;
+      return Date.now() - statSync3(lock).mtimeMs >= staleMs;
     } catch {
       return false;
     }
@@ -28276,13 +28519,13 @@ function breakIfStale(lock, staleMs) {
   }
   try {
     if (!existsSync4(lock) || !isAbandoned(readLockBody(lock), lock, staleMs)) return false;
-    rmSync3(lock, { force: true });
+    rmSync4(lock, { force: true });
     return true;
   } catch {
     return false;
   } finally {
     try {
-      rmSync3(breaker, { force: true });
+      rmSync4(breaker, { force: true });
     } catch {
     }
   }
@@ -28290,8 +28533,8 @@ function breakIfStale(lock, staleMs) {
 var BREAKER_ABANDONED_MS = 1e4;
 function reapAbandonedBreaker(breaker) {
   try {
-    if (Date.now() - statSync2(breaker).mtimeMs >= BREAKER_ABANDONED_MS) {
-      rmSync3(breaker, { force: true });
+    if (Date.now() - statSync3(breaker).mtimeMs >= BREAKER_ABANDONED_MS) {
+      rmSync4(breaker, { force: true });
     }
   } catch {
   }
@@ -28302,7 +28545,7 @@ function abandonWindow(staleMs) {
 function release(lock, token) {
   try {
     if (readLockBody(lock)?.token !== token) return;
-    rmSync3(lock, { force: true });
+    rmSync4(lock, { force: true });
   } catch {
   }
 }
@@ -28360,20 +28603,20 @@ function computeFindingKey(input) {
 
 // ../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var EXCEPTION_KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
-  return join5(dataDir2, EXCEPTION_KEY_FILENAME);
+  return join6(dataDir2, EXCEPTION_KEY_FILENAME);
 }
 function parseKeyFile(raw) {
-  const parsed = JSON.parse(raw);
-  if (typeof parsed !== "object" || parsed === null) {
+  const parsed2 = JSON.parse(raw);
+  if (typeof parsed2 !== "object" || parsed2 === null) {
     throw new Error("exception key file is corrupt: not a JSON object");
   }
-  const { version: version2, material } = parsed;
+  const { version: version2, material } = parsed2;
   if (typeof version2 !== "number" || !Number.isInteger(version2) || version2 < 1) {
     throw new Error("exception key file is corrupt: bad version");
   }
@@ -28404,7 +28647,7 @@ var FloorUnreadableError = class extends Error {
   }
 };
 function storedKeyVersionFloor(dataDir2) {
-  const file2 = join5(dataDir2, DB_FILENAME);
+  const file2 = join6(dataDir2, DB_FILENAME);
   if (!existsSync5(file2)) return 0;
   let db;
   try {
@@ -28465,7 +28708,7 @@ function occupantMessage(file2, kind) {
 function readFingerprintKey(dataDir2) {
   let raw;
   try {
-    raw = readFileSync4(keyFilePath(dataDir2), "utf8");
+    raw = readFileSync5(keyFilePath(dataDir2), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err instanceof Error ? err : new Error(String(err));
@@ -28504,28 +28747,32 @@ function keyStateOf(key) {
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 function defaultDataDir() {
-  return join6(homedir3(), ".aka");
+  return join7(homedir3(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join6(base, "settings");
+  return join7(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join6(base, "data");
+  return join7(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join6(dataDir(base), "aka.db");
+  return join7(dataDir(base), "aka.db");
 }
 function keysDir(base = defaultDataDir()) {
-  return join6(base, "keys");
+  return join7(base, "keys");
+}
+async function ensureDataDir(dir = defaultDataDir()) {
+  await mkdir(dir, { recursive: true, mode: DATA_DIR_MODE });
+  tightenDir(dir);
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
 }
 
 // ../packages/persistence/src/managed-settings.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { posix, win32 } from "path";
 function managedSettingsPaths(platform2 = process.platform) {
   if (platform2 === "darwin") {
@@ -28543,17 +28790,25 @@ function readManagedSettings(paths = managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
-      text = readFileSync5(path, "utf8");
+      text = readFileSync6(path, "utf8");
     } catch {
       continue;
     }
     const record2 = parseJsonObject(text);
     if (!record2) continue;
-    const parsed = ManagedSettings.safeParse(record2);
-    if (parsed.success) return parsed.data;
+    const parsed2 = ManagedSettings.safeParse(record2);
+    if (parsed2.success) return parsed2.data;
   }
   return null;
 }
+function managedContextOf(managed) {
+  if (!managed) return NO_MANAGED_CONTEXT;
+  return {
+    present: true,
+    ...managed.organization === void 0 ? {} : { organization: managed.organization },
+    lockedFields: managed.lockedFields
+  };
+}
 function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ new Date()) {
   if (!managed) return settings;
   const { values } = managed;
@@ -28588,16 +28843,20 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
   }
   return merged;
 }
+function lockedAmong(context, requested) {
+  if (!context.present) return [];
+  return requested.filter((key) => context.lockedFields.includes(key));
+}
 
 // ../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
   return overlayManagedSettings(readUserSettings(base), readManagedSettings());
 }
 function readUserSettings(base) {
-  const record2 = readJson(join7(settingsDir(base), SETTINGS_FILENAME));
+  const record2 = readJson(join8(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -28605,16 +28864,153 @@ function readUserSettings(base) {
     return defaultWorkspaceSettings();
   }
 }
+var ManagedFieldError = class extends Error {
+  fields;
+  constructor(fields) {
+    super(`refusing to write administratively locked settings: ${fields.join(", ")}`);
+    this.name = "ManagedFieldError";
+    this.fields = fields;
+  }
+};
+function lockableKeysTouched(current, applied) {
+  const keys = [];
+  const changed = (key) => key in applied && applied[key] !== current[key];
+  const descriptorChanged = "controlPlane" in applied && (applied.controlPlane?.endpoint !== current.controlPlane?.endpoint || applied.controlPlane?.label !== current.controlPlane?.label);
+  if (changed("runMode") || descriptorChanged) keys.push("runMode");
+  if (changed("historicalAccess")) keys.push("historicalAccess");
+  if (changed("vaultKeyCustody")) keys.push("vaultKeyCustody");
+  if (changed("vaultInlineReveal")) keys.push("vaultInlineReveal");
+  if (changed("dataSharesInPlace")) keys.push("dataSharesInPlace");
+  if ("vaultConsent" in applied && isVaultConsentValid(applied.vaultConsent) !== isVaultConsentValid(current.vaultConsent)) {
+    keys.push("vaultConsent");
+  }
+  if ("modelJudgeConsent" in applied && isModelJudgeConsentValid(applied.modelJudgeConsent) !== isModelJudgeConsentValid(current.modelJudgeConsent)) {
+    keys.push("modelJudgeConsent");
+  }
+  return keys;
+}
+function pinnedKeys(managed) {
+  if (!managed) return [];
+  const { values } = managed;
+  const keys = [];
+  if (values.runMode !== void 0 || values.controlPlane !== void 0) keys.push("runMode");
+  if (values.historicalAccess !== void 0) keys.push("historicalAccess");
+  if (values.vaultConsent !== void 0) keys.push("vaultConsent");
+  if (values.vaultKeyCustody !== void 0) keys.push("vaultKeyCustody");
+  if (values.vaultInlineReveal !== void 0) keys.push("vaultInlineReveal");
+  if (values.modelJudgeConsent !== void 0) keys.push("modelJudgeConsent");
+  if (values.dataSharesInPlace !== void 0) keys.push("dataSharesInPlace");
+  return keys;
+}
+function withoutManagedKeys(applied, managed, pinned, touched) {
+  if (!managed.present) return applied;
+  const strip = (key) => (managed.lockedFields.includes(key) || pinned.includes(key)) && !touched.includes(key);
+  const out = { ...applied };
+  if (strip("runMode")) {
+    delete out.runMode;
+    delete out.controlPlane;
+  }
+  if (strip("historicalAccess")) delete out.historicalAccess;
+  if (strip("vaultConsent")) delete out.vaultConsent;
+  if (strip("vaultKeyCustody")) delete out.vaultKeyCustody;
+  if (strip("vaultInlineReveal")) delete out.vaultInlineReveal;
+  if (strip("modelJudgeConsent")) delete out.modelJudgeConsent;
+  if (strip("dataSharesInPlace")) delete out.dataSharesInPlace;
+  return out;
+}
+function applyOnboarding(answers, base = defaultDataDir(), managedOverride) {
+  const dir = settingsDir(base);
+  ensureDataDirSync(dir);
+  const file2 = join8(dir, SETTINGS_FILENAME);
+  const managedSettings = managedOverride === void 0 ? readManagedSettings() : managedOverride;
+  const managed = managedContextOf(managedSettings);
+  return withFileLock(file2, () => {
+    const current = readUserSettings(base);
+    const applied = typeof answers === "function" ? answers(current) : answers;
+    const effective = overlayManagedSettings(current, managedSettings);
+    const touched = lockableKeysTouched(effective, applied);
+    const refused = lockedAmong(managed, touched);
+    if (refused.length > 0) throw new ManagedFieldError(refused);
+    const merged = WorkspaceSettings.parse({
+      ...current,
+      // Locked keys are stripped rather than merged. Everything still here is,
+      // by the refusal above, an unchanged ECHO of the administrator's value —
+      // so dropping it discards no answer of the user's, and writing it would
+      // persist the pin into their file, where it would outlive the managed
+      // file and read as their own choice once the lock was gone.
+      ...withoutManagedKeys(applied, managed, pinnedKeys(managedSettings), touched),
+      // First setup stamps the time; later edits keep the original completion mark.
+      onboardedAt: applied.onboardedAt ?? current.onboardedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    });
+    writeOwnerOnlyFileSync(file2, `${JSON.stringify(merged, null, 2)}
+`);
+    return merged;
+  });
+}
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync6(file2, "utf8");
+    text = readFileSync7(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../packages/persistence/src/store-symlinks.ts
+import { existsSync as existsSync6, lstatSync as lstatSync3, readlinkSync, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { dirname as dirname4, join as join9, resolve } from "path";
+var STORE_DB = "the store database (including the prompt corpus)";
+var STORE_SETTINGS = "your settings file";
+function storeContents(home) {
+  return /* @__PURE__ */ new Map([
+    [home, "the store (including the prompt corpus in aka.db)"],
+    [settingsDir(home), STORE_SETTINGS],
+    [dataDir(home), STORE_DB],
+    [keysDir(home), "the vault key"],
+    [join9(settingsDir(home), "settings.json"), STORE_SETTINGS],
+    [dbPath(home), STORE_DB]
+  ]);
+}
+function storeTargets(home) {
+  return [...storeContents(home).keys()];
+}
+function symlinkedStorePaths(home, platform2 = process.platform) {
+  return [...storeContents(home)].flatMap(([path, holds]) => {
+    try {
+      if (!lstatSync3(path).isSymbolicLink()) return [];
+      return [
+        {
+          path,
+          target: linkTarget(path),
+          holds,
+          // existsSync follows the link, so a target that is gone reads as
+          // absent here while lstat above still sees the link itself.
+          missing: !existsSync6(path),
+          mode: targetMode(path, platform2)
+        }
+      ];
+    } catch {
+      return [];
+    }
+  });
+}
+function linkTarget(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return resolve(dirname4(path), readlinkSync(path));
+  }
+}
+function targetMode(path, platform2) {
+  if (platform2 === "win32") return void 0;
+  try {
+    return statSync4(path).mode & 511;
+  } catch {
+    return void 0;
+  }
+}
+
 // ../packages/persistence/src/vault/crypto.ts
 import {
   createCipheriv,
@@ -28726,8 +29122,8 @@ function formatPointer(category, keyVersion, pointerId, tag) {
 // ../packages/persistence/src/vault/key-provider.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync2, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join8 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync8, renameSync as renameSync4, rmSync as rmSync5, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join10 } from "path";
 var VAULT_OCCUPANT_REASON = {
   symlink: "the path is a symlink; remove it so a keyring can be created",
   gone: "the path was occupied but holds no keyring (removed while it was being created)",
@@ -28746,11 +29142,11 @@ var KEY_MATERIAL_BYTES2 = 32;
 var KEYCHAIN_SERVICE = "aka-vault";
 var KEYCHAIN_ACCOUNT = "keyring";
 function parseKeyring(raw) {
-  const parsed = JSON.parse(raw);
-  if (typeof parsed !== "object" || parsed === null) {
+  const parsed2 = JSON.parse(raw);
+  if (typeof parsed2 !== "object" || parsed2 === null) {
     throw new Error("vault key file is corrupt: not a JSON object");
   }
-  const { current, keys } = parsed;
+  const { current, keys } = parsed2;
   if (typeof current !== "number" || !Number.isInteger(current) || current < 1) {
     throw new Error("vault key file is corrupt: bad current version");
   }
@@ -28826,28 +29222,28 @@ function claimRotationLock(lock, owner) {
     throw asError(err);
   }
   try {
-    writeFileSync3(join8(lock, LOCK_OWNER_FILE), `${owner}
+    writeFileSync3(join10(lock, LOCK_OWNER_FILE), `${owner}
 `, { mode: DATA_FILE_MODE });
     return true;
   } catch (err) {
-    rmSync4(lock, { recursive: true, force: true });
+    rmSync5(lock, { recursive: true, force: true });
     throw asError(err);
   }
 }
 function acquireRotationLock(keysDir2) {
-  const lock = join8(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const lock = join10(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
   const owner = randomBytes2(16).toString("hex");
   if (claimRotationLock(lock, owner)) return { lock, owner };
   let held;
   try {
-    held = statSync3(lock);
+    held = statSync5(lock);
   } catch {
     throw new Error(ROTATION_IN_PROGRESS);
   }
   if (Date.now() - held.mtimeMs < ROTATION_LOCK_STALE_MS) throw new Error(ROTATION_IN_PROGRESS);
   const aside = `${lock}.stale.${owner}`;
   try {
-    const now = statSync3(lock);
+    const now = statSync5(lock);
     if (now.ino !== held.ino || now.mtimeMs !== held.mtimeMs) {
       throw new Error(ROTATION_IN_PROGRESS);
     }
@@ -28856,17 +29252,17 @@ function acquireRotationLock(keysDir2) {
     if (err instanceof Error && err.message === ROTATION_IN_PROGRESS) throw err;
     throw new Error(ROTATION_IN_PROGRESS, { cause: err });
   }
-  rmSync4(aside, { recursive: true, force: true });
+  rmSync5(aside, { recursive: true, force: true });
   if (!claimRotationLock(lock, owner)) throw new Error(ROTATION_IN_PROGRESS);
   return { lock, owner };
 }
 function releaseRotationLock(lease) {
   try {
-    if (readFileSync7(join8(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+    if (readFileSync8(join10(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
   } catch {
     return;
   }
-  rmSync4(lease.lock, { recursive: true, force: true });
+  rmSync5(lease.lock, { recursive: true, force: true });
 }
 function withRotationLock(keysDir2, work) {
   ensureDataDirSync(keysDir2);
@@ -28883,7 +29279,7 @@ var FileKeyProvider = class {
     this.#keysDir = keysDir2;
   }
   get filePath() {
-    return join8(this.#keysDir, VAULT_KEY_FILENAME);
+    return join10(this.#keysDir, VAULT_KEY_FILENAME);
   }
   loadOrCreate() {
     return asAsync(() => {
@@ -28913,7 +29309,7 @@ var FileKeyProvider = class {
   #read() {
     let raw;
     try {
-      raw = readFileSync7(this.filePath, "utf8");
+      raw = readFileSync8(this.filePath, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err instanceof Error ? err : new Error(String(err));
@@ -28970,7 +29366,7 @@ var FileKeyProvider = class {
 };
 function tightenFileMode(file2) {
   try {
-    chmodSync2(file2, DATA_FILE_MODE);
+    chmodSync3(file2, DATA_FILE_MODE);
   } catch {
   }
 }
@@ -29235,25 +29631,25 @@ var SecretVault = class {
    * model. Every call that gets as far as an identified row writes an audit row.
    */
   async detokenize(token, opts) {
-    const parsed = parsePointer(token);
-    if (!parsed) return UNAVAILABLE;
+    const parsed2 = parsePointer(token);
+    if (!parsed2) return UNAVAILABLE;
     let signKey;
     try {
-      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      const epoch = await this.#keys.materialFor(parsed2.keyVersion);
       signKey = deriveSubkeys(epoch.material).sign;
     } catch {
       return UNAVAILABLE;
     }
-    if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+    if (!verifyPointerTag(signKey, parsed2.keyVersion, parsed2.pointerId, parsed2.category, parsed2.tag)) {
       return UNAVAILABLE;
     }
-    const pointerId = base32Encode(parsed.pointerId);
+    const pointerId = base32Encode(parsed2.pointerId);
     const row = this.#repo.byPointerId(pointerId);
     if (!row) {
       this.#audit(pointerId, opts, "unavailable");
       return UNAVAILABLE;
     }
-    if (row.category !== parsed.category) return UNAVAILABLE;
+    if (row.category !== parsed2.category) return UNAVAILABLE;
     if (opts.target === "model") {
       const grantId = opts.grantId;
       const verify = this.#verifyGrant;
@@ -29290,7 +29686,7 @@ var SecretVault = class {
         // moved the epoch past the one this token names, and a format bump may
         // have moved the constant past the generation this row was sealed
         // under — the AAD follows the row in both cases, never the token.
-        bindingInput(row.keyVersion, parsed.pointerId, row.category, row.formatVersion)
+        bindingInput(row.keyVersion, parsed2.pointerId, row.category, row.formatVersion)
       );
     } catch {
       raw = null;
@@ -29508,19 +29904,19 @@ var SecretVault = class {
   // preview. Verifying needs the historical epoch's key, which is why these
   // surfaces are async.
   async #rowFor(token) {
-    const parsed = parsePointer(token);
-    if (!parsed) return null;
+    const parsed2 = parsePointer(token);
+    if (!parsed2) return null;
     try {
-      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      const epoch = await this.#keys.materialFor(parsed2.keyVersion);
       const signKey = deriveSubkeys(epoch.material).sign;
-      if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+      if (!verifyPointerTag(signKey, parsed2.keyVersion, parsed2.pointerId, parsed2.category, parsed2.tag)) {
         return null;
       }
     } catch {
       return null;
     }
-    const row = this.#repo.byPointerId(base32Encode(parsed.pointerId));
-    if (row?.category !== parsed.category) return null;
+    const row = this.#repo.byPointerId(base32Encode(parsed2.pointerId));
+    if (row?.category !== parsed2.category) return null;
     return row;
   }
   #audit(pointerId, opts, outcome) {
@@ -29540,12 +29936,12 @@ var SecretVault = class {
 };
 
 // ../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11 } from "path";
 
 // ../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { join as join12 } from "path";
 
 // ../packages/plugin-sdk/src/provider-env.ts
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -29566,9 +29962,9 @@ var providerEnvShape = {
 var ProviderEnvSchema = external_exports.object(providerEnvShape);
 
 // ../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync10, realpathSync as realpathSync3, statSync as statSync7 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename3, join as join12 } from "path";
+import { basename as basename3, join as join14 } from "path";
 
 // ../rules/code-flaws/auth-jwt-no-verify.json
 var auth_jwt_no_verify_default = {
@@ -30291,10 +30687,10 @@ var localhost_ref_default = {
   severity: "low",
   matcher: {
     type: "regex",
-    pattern: "\\b(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|::1)\\b",
+    pattern: "(?<![A-Za-z0-9_])(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|(?<![A-Za-z0-9_]\\[)::1(?!:|\\.[0-9]))(?![A-Za-z0-9_])",
     flags: "g"
   },
-  examples: ["localhost", "127.0.0.1"]
+  examples: ["localhost", "127.0.0.1", "0.0.0.0", "::1"]
 };
 
 // ../rules/core-code-context/stack-trace.json
@@ -31603,8 +31999,8 @@ function bundledDetections() {
 }
 
 // ../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, statSync as statSync4 } from "fs";
-import { basename as basename2, dirname as dirname4, isAbsolute, join as join11, sep as sep3 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname5, isAbsolute, join as join13, sep as sep3 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -31642,36 +32038,36 @@ function resolveHeadRoot(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync8(join11(dir, ".git"))) return dir;
-    const parent = dirname4(dir);
+    if (existsSync9(join13(dir, ".git"))) return dir;
+    const parent = dirname5(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join11(root, ".git");
+  const dotGit = join13(root, ".git");
   try {
-    if (statSync4(dotGit).isDirectory()) {
-      return { configPath: join11(dotGit, "config"), headRoot: root };
+    if (statSync6(dotGit).isDirectory()) {
+      return { configPath: join13(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join11(root, target);
-  if (existsSync8(join11(gitdir, "config"))) {
-    return { configPath: join11(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join13(root, target);
+  if (existsSync9(join13(gitdir, "config"))) {
+    return { configPath: join13(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join11(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join13(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join11(gitdir, commonRaw);
-  const headRoot = basename2(commonGitDir) === ".git" ? dirname4(commonGitDir) : root;
-  return { configPath: join11(commonGitDir, "config"), headRoot };
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join13(gitdir, commonRaw);
+  const headRoot = basename2(commonGitDir) === ".git" ? dirname5(commonGitDir) : root;
+  return { configPath: join13(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync8(path, "utf8");
+    return readFileSync9(path, "utf8");
   } catch {
     return void 0;
   }
@@ -31712,17 +32108,17 @@ function slugFromUrl(url2) {
 import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
 
 // ../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Worker } from "worker_threads";
 
 // ../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync11 } from "fs";
+import { join as join15 } from "path";
 function readIgnoreLayer(dir, filename, anchorLen) {
   try {
-    return { matcher: (0, import_ignore.default)().add(readFileSync10(join13(dir, filename), "utf8")), anchorLen };
+    return { matcher: (0, import_ignore.default)().add(readFileSync11(join15(dir, filename), "utf8")), anchorLen };
   } catch {
     return void 0;
   }
@@ -31753,12 +32149,12 @@ function withLayer(layers, layer) {
 import { arch, hostname as hostname4, platform, release as release2 } from "os";
 
 // ../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
+import { join as join16 } from "path";
 
 // ../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync4, realpathSync as realpathSync3 } from "fs";
-import { basename as basename4, dirname as dirname5, sep as sep4 } from "path";
+import { readdirSync as readdirSync4, realpathSync as realpathSync4 } from "fs";
+import { basename as basename4, dirname as dirname6, sep as sep4 } from "path";
 function toPosix(path) {
   return path.split(sep4).join("/");
 }
@@ -31768,7 +32164,7 @@ function findProjectRoot(startDir, recognizeMarker) {
   let root = null;
   for (let level = 0; level < MAX_PROJECT_ROOT_LEVELS; level += 1) {
     if (directoryHasMarker(dir, recognizeMarker)) root = dir;
-    const parent = dirname5(dir);
+    const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -31786,13 +32182,13 @@ function directoryHasMarker(dir, recognizeMarker) {
 }
 function resolveNonGitProject(startDir, recognizeMarker) {
   const projectRoot = findProjectRoot(startDir, recognizeMarker);
-  const realRoot = realpathSync3(projectRoot);
+  const realRoot = realpathSync4(projectRoot);
   return { root: projectRoot, projectKey: `path:${realRoot}`, project: basename4(realRoot) };
 }
 
 // ../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync10, readdirSync as readdirSync5 } from "fs";
-import { basename as basename5, join as join15 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync5 } from "fs";
+import { basename as basename5, join as join17 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -31889,8 +32285,8 @@ function resolveProjectFiles(cwd, opts = {}) {
         }
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, dirRel, entry.name, true)) continue;
-          const fullPath = join15(dir, entry.name);
-          if (existsSync10(join15(fullPath, ".git"))) continue;
+          const fullPath = join17(dir, entry.name);
+          if (existsSync11(join17(fullPath, ".git"))) continue;
           if (depth >= bounds.maxDepth) {
             walk.omitted = true;
             continue;
@@ -31962,15 +32358,15 @@ import { randomUUID as randomUUID14 } from "crypto";
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join16 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { join as join18 } from "path";
 
 // ../packages/local-ops/src/egress-record.ts
 function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
   try {
     if (!readWorkspaceSettings(base).dataSharesInPlace) return null;
-    const abs = resolve(target);
-    const targetDir = statSync7(abs).isDirectory() ? abs : dirname6(abs);
+    const abs = resolve2(target);
+    const targetDir = statSync9(abs).isDirectory() ? abs : dirname7(abs);
     const identity = resolveRepoIdentity(abs);
     const worktreeRoot = resolveWorktreeRoot(abs);
     let root;
@@ -32012,8 +32408,8 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
 
 // ../packages/local-ops/src/fs-scan.ts
 import { createHash as createHash5, randomUUID as randomUUID15 } from "crypto";
-import { readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
-import { basename as basename6, extname, join as join17, resolve as resolve2 } from "path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync13, statSync as statSync10 } from "fs";
+import { basename as basename6, extname, join as join19, resolve as resolve3 } from "path";
 var AKAIGNORE_FILENAME = ".akaignore";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
@@ -32029,7 +32425,7 @@ var MAX_BYTES = 1e6;
 function* collectFiles(target) {
   let st;
   try {
-    st = statSync8(target);
+    st = statSync10(target);
   } catch {
     return;
   }
@@ -32057,7 +32453,7 @@ function* visit(dir, dirRel, markLayers, skipLayers, inIgnoredDir) {
     readIgnoreLayer(dir, AKAIGNORE_FILENAME, dirRel.length)
   );
   for (const entry of dirents) {
-    const path = join17(dir, entry.name);
+    const path = join19(dir, entry.name);
     if (entry.isDirectory()) {
       const skipState = evaluateIgnore(dirSkipLayers, dirRel, entry.name, true);
       if (skipState !== "unignored" && (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".") || skipState === "ignored")) {
@@ -32069,7 +32465,7 @@ function* visit(dir, dirRel, markLayers, skipLayers, inIgnoredDir) {
       if (evaluateIgnore(dirSkipLayers, dirRel, entry.name, false) === "ignored") continue;
       let size;
       try {
-        size = statSync8(path).size;
+        size = statSync10(path).size;
       } catch {
         continue;
       }
@@ -32108,10 +32504,10 @@ async function scanPathIntoStore(db, target, opts = {}) {
     }
     return fingerprintKey;
   }
-  for (const { path: file2, gitignored } of collectFiles(resolve2(target))) {
+  for (const { path: file2, gitignored } of collectFiles(resolve3(target))) {
     let text;
     try {
-      text = readFileSync12(file2, "utf8");
+      text = readFileSync13(file2, "utf8");
     } catch {
       continue;
     }
@@ -32164,12 +32560,12 @@ async function scanPathIntoStore(db, target, opts = {}) {
 }
 
 // ../packages/local-ops/src/project-inventory.ts
-import { statSync as statSync9 } from "fs";
-import { resolve as resolve3 } from "path";
+import { statSync as statSync11 } from "fs";
+import { resolve as resolve4 } from "path";
 function recordProjectInventory(db, target) {
   try {
-    const abs = resolve3(target);
-    statSync9(abs);
+    const abs = resolve4(target);
+    statSync11(abs);
     const identity = resolveRepoIdentity(abs);
     if (!identity) return null;
     const sourceProjectId2 = db.sourceProject.upsert({
@@ -32198,17 +32594,17 @@ function recordProjectInventory(db, target) {
 
 // ../packages/local-ops/src/update-cache.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync13, rmSync as rmSync5 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync14, rmSync as rmSync6 } from "fs";
+import { join as join20 } from "path";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 function cachePath(home) {
-  return join18(dataDir(home), "update-check.json");
+  return join20(dataDir(home), "update-check.json");
 }
 function readCache(home) {
   const path = cachePath(home);
-  if (!existsSync11(path)) return null;
+  if (!existsSync12(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync13(path, "utf8"));
+    const raw = JSON.parse(readFileSync14(path, "utf8"));
     if (!isRecord(raw) || typeof raw.checkedAt !== "number" || !isRecord(raw.report)) return null;
     return raw;
   } catch {
@@ -32216,7 +32612,7 @@ function readCache(home) {
   }
 }
 function writeCache(home, cache) {
-  if (!existsSync11(dataDir(home))) return;
+  if (!existsSync12(dataDir(home))) return;
   try {
     writeOwnerOnlyFileSync(cachePath(home), `${JSON.stringify(cache, null, 2)}
 `);
@@ -32228,7 +32624,7 @@ function isStale(cache, ttlMs = CHECK_TTL_MS) {
 }
 function clearCache(home) {
   try {
-    rmSync5(cachePath(home), { force: true });
+    rmSync6(cachePath(home), { force: true });
   } catch {
   }
 }
@@ -32361,6 +32757,16 @@ var COMMAND_SPECS = [
     summary: "Reveal a vaulted secret by its pointer (every reveal is audited)",
     args: ["show"]
   },
+  {
+    name: "attach",
+    argHint: "--url <url>",
+    summary: "Register this machine against your organization's AKA deployment"
+  },
+  { name: "detach", summary: "Stop reporting to a deployment; record locally only" },
+  {
+    name: "status",
+    summary: "Show what this machine is attached to, and whether policy is current"
+  },
   {
     name: "tui",
     argHint: "[view]",
@@ -32391,18 +32797,872 @@ function commandsHelp() {
   return COMMAND_SPECS.map((s) => `  ${label(s).padEnd(width)}${s.summary}`).join("\n");
 }
 
-// src/commands/check-updates.ts
-import { existsSync as existsSync12 } from "fs";
-import { parseArgs } from "util";
+// src/commands/attach.ts
+import { rmSync as rmSync7 } from "fs";
+import { join as join26 } from "path";
+
+// ../packages/plugin-runtime/src/attached/forward-drops.ts
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join21 } from "path";
+var FORWARD_DROPS_FILENAME = "attached-forward-drops.json";
+function forwardDropsPath(dataDir2) {
+  return join21(dataDir2, FORWARD_DROPS_FILENAME);
+}
+function readForwardDrops(dataDir2) {
+  try {
+    const parsed2 = JSON.parse(readFileSync15(forwardDropsPath(dataDir2), "utf8"));
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    if (typeof record2.droppedForwards !== "number" || !Number.isFinite(record2.droppedForwards)) {
+      return null;
+    }
+    if (record2.droppedForwards <= 0) return null;
+    if (typeof record2.lastDropAtMs !== "number" || !Number.isFinite(record2.lastDropAtMs)) {
+      return null;
+    }
+    return { droppedForwards: record2.droppedForwards, lastDropAtMs: record2.lastDropAtMs };
+  } catch {
+    return null;
+  }
+}
+
+// ../packages/plugin-runtime/src/attached/forward-policy.ts
+import { randomUUID as randomUUID16 } from "crypto";
+import { readFileSync as readFileSync16 } from "fs";
+import { readFile, rename, writeFile } from "fs/promises";
+import { join as join22 } from "path";
+var FAILURES = /* @__PURE__ */ new Set([
+  "unauthorized",
+  "forbidden",
+  "unreachable"
+]);
+var FORWARD_STATE_FILENAME = "attached-state.json";
+var STATE_FILENAME = FORWARD_STATE_FILENAME;
+function parseBreakerState(raw, nowMs) {
+  try {
+    const parsed2 = JSON.parse(raw);
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    const failures = typeof record2.consecutiveFailures === "number" && record2.consecutiveFailures >= 0 ? record2.consecutiveFailures : 0;
+    const openedAtMs = typeof record2.openedAtMs === "number" && Number.isFinite(record2.openedAtMs) && record2.openedAtMs <= nowMs ? record2.openedAtMs : null;
+    const lastFailure = typeof record2.lastFailure === "string" && FAILURES.has(record2.lastFailure) ? record2.lastFailure : null;
+    return { consecutiveFailures: failures, openedAtMs, lastFailure };
+  } catch {
+    return null;
+  }
+}
+function readForwardHealth(dir, nowMs = Date.now()) {
+  try {
+    return parseBreakerState(readFileSync16(join22(dir, STATE_FILENAME), "utf8"), nowMs);
+  } catch {
+    return null;
+  }
+}
+
+// ../packages/plugin-runtime/src/attached/policy-store.ts
+import { randomUUID as randomUUID17 } from "crypto";
+import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
+import { join as join23 } from "path";
+
+// ../packages/plugin-runtime/src/attached/atomic-publish.ts
+import { rename as rename2 } from "fs/promises";
+var RETRYABLE = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
+var ATTEMPTS = 5;
+var delay = (ms) => new Promise((resolve6) => {
+  setTimeout(resolve6, ms);
+});
+async function publishByRename(tmp, file2, move = rename2) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await move(tmp, file2);
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (attempt >= ATTEMPTS || code === void 0 || !RETRYABLE.has(code)) throw err;
+      await delay(attempt * 10);
+    }
+  }
+}
+
+// ../packages/plugin-runtime/src/attached/policy-store.ts
+function createPolicyStore(dir = dataDir()) {
+  const file2 = join23(dir, "policy-cache.json");
+  async function read() {
+    try {
+      const raw = await readFile2(file2, "utf8");
+      const parsed2 = JSON.parse(raw);
+      if (typeof parsed2 !== "object" || parsed2 === null) return null;
+      const record2 = parsed2;
+      const bundle = PolicyBundle.parse(record2.bundle);
+      const fetchedAtMs = typeof record2.fetchedAtMs === "number" ? record2.fetchedAtMs : 0;
+      const etag = typeof record2.etag === "string" ? record2.etag : void 0;
+      return { bundle, fetchedAtMs, ...etag === void 0 ? {} : { etag } };
+    } catch {
+      return null;
+    }
+  }
+  async function write(bundle, etag) {
+    await ensureDataDir(dir);
+    const stored = {
+      bundle,
+      fetchedAtMs: Date.now(),
+      ...etag === void 0 ? {} : { etag }
+    };
+    const tmp = `${file2}.${randomUUID17()}.tmp`;
+    try {
+      await writeFile2(tmp, JSON.stringify(stored), {
+        encoding: "utf8",
+        mode: DATA_FILE_MODE,
+        flag: "wx"
+      });
+      await publishByRename(tmp, file2);
+    } catch (err) {
+      await rm(tmp, { force: true }).catch(() => void 0);
+      throw err;
+    }
+  }
+  return { read, write, file: file2 };
+}
+
+// ../packages/remote/src/http.ts
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var DEFAULT_TIMEOUT_MS2 = 1e4;
+var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+var RemoteRequestError = class extends Error {
+  constructor(status) {
+    super(`control-plane request failed with status ${String(status)}`);
+    this.status = status;
+    this.name = "RemoteRequestError";
+  }
+  status;
+};
+var RemoteRequestInvalid = class extends Error {
+  constructor(route, cause) {
+    super(`refusing to send a malformed body to ${route}`);
+    this.cause = cause;
+    this.name = "RemoteRequestInvalid";
+  }
+  cause;
+};
+var RemoteResponseInvalid = class extends Error {
+  constructor(route, detail) {
+    super(`control plane answered ${route} with ${detail}`);
+    this.name = "RemoteResponseInvalid";
+  }
+};
+var RemoteTransportError = class extends Error {
+  /**
+   * The status the peer sent, when headers arrived and only the BODY was
+   * refused.
+   *
+   * Undefined for the ordinary case this class was written for — no answer at
+   * all. It exists because two paths reject after a status has already been
+   * delivered: an oversized body and an aborted response. Discarding it there
+   * reported a deployment answering 401 with a verbose body as a network
+   * outage, which sends the reader to look at their network instead of their
+   * credential.
+   */
+  constructor(reason, status) {
+    super(`control-plane request did not complete: ${reason}`);
+    this.status = status;
+    this.name = "RemoteTransportError";
+  }
+  status;
+};
+async function send(options) {
+  const url2 = new URL(options.url);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const send_ = url2.protocol === "http:" ? httpRequest : httpsRequest;
+  const requestOptions = {
+    method: options.method,
+    headers: {
+      // CALLER HEADERS FIRST, so this module's own are not overridable. Spread
+      // last they win, and two of the values below are ones no caller may
+      // replace: `x-api-key` is the credential, and `content-length` is the
+      // byte count that stops a multi-byte body being truncated by the
+      // receiver. `SendOptions.headers` is a free-form record on an exported
+      // function, so "no caller does that today" is not the guarantee to rely
+      // on. The one header any caller actually passes — `if-none-match` on the
+      // conditional GET — is untouched by this order.
+      ...options.headers,
+      // The credential. One header, matching what the deployment authenticates
+      // on; a second copy in an `Authorization` header would be one more place
+      // it can be logged by an intermediary for no gain.
+      "x-api-key": options.apiKey,
+      accept: "application/json",
+      ...options.body === void 0 ? {} : {
+        "content-type": "application/json",
+        // Byte length, not string length: a multi-byte body sent with a
+        // character count is truncated by the receiver.
+        "content-length": String(Buffer.byteLength(options.body))
+      }
+    }
+  };
+  return new Promise((resolve6, reject) => {
+    let settled = false;
+    const fail = (reason, status) => {
+      if (settled) return;
+      settled = true;
+      reject(new RemoteTransportError(reason, status));
+    };
+    const req = send_(url2, requestOptions, (res) => {
+      const chunks = [];
+      let size = 0;
+      res.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_RESPONSE_BYTES) {
+          fail(`response exceeded ${String(MAX_RESPONSE_BYTES)} bytes`, res.statusCode);
+          res.destroy();
+          req.destroy();
+          return;
+        }
+        chunks.push(chunk);
+      });
+      res.on("aborted", () => {
+        fail("the response was aborted", res.statusCode);
+      });
+      res.on("end", () => {
+        if (settled) return;
+        settled = true;
+        resolve6({
+          status: res.statusCode ?? 0,
+          headers: res.headers,
+          body: Buffer.concat(chunks).toString("utf8")
+        });
+      });
+    });
+    const deadline = setTimeout(() => {
+      fail(`no response within ${String(timeoutMs)}ms`);
+      req.destroy();
+    }, timeoutMs);
+    deadline.unref();
+    req.on("upgrade", (_res, socket) => {
+      fail("the deployment answered with a protocol upgrade");
+      socket.destroy();
+    });
+    req.on("close", () => {
+      fail("the connection closed before a response was read");
+      clearTimeout(deadline);
+    });
+    req.on("error", (err) => {
+      fail(err.message);
+    });
+    if (options.body !== void 0) req.write(options.body);
+    req.end();
+  });
+}
+
+// ../packages/remote/src/client.ts
+var ROUTES = {
+  events: "/v1/events",
+  auditEvents: "/v1/audit-events",
+  inventory: "/v1/inventory",
+  storePosture: "/v1/store-posture",
+  policyBundle: "/v1/policy-bundle",
+  whoami: "/v1/plugin/whoami"
+};
+function headerValue(response, name) {
+  const raw = response.headers[name];
+  if (raw === void 0) return void 0;
+  return Array.isArray(raw) ? raw[0] : raw;
+}
+function okBody(response) {
+  if (response.status < 200 || response.status >= 300) {
+    throw new RemoteRequestError(response.status);
+  }
+  return response.body;
+}
+function parsed(schema, body, route) {
+  let json2;
+  try {
+    json2 = JSON.parse(body);
+  } catch {
+    throw new RemoteResponseInvalid(route, "a body that is not JSON");
+  }
+  const result = schema.safeParse(json2);
+  if (!result.success) {
+    throw new RemoteResponseInvalid(route, "a body this client cannot read");
+  }
+  return result.data;
+}
+function withoutTrailingSlashes(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
+  return endpoint.slice(0, end);
+}
+var SLASH = "/".charCodeAt(0);
+function createRemoteClient(options) {
+  const base = withoutTrailingSlashes(options.endpoint);
+  const url2 = (route) => `${base}${route}`;
+  const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
+  return {
+    async ingestEvents(batch) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.events),
+        body: JSON.stringify(batch)
+      });
+      return parsed(IngestAck, okBody(response), ROUTES.events);
+    },
+    async ingestInventory(context) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.inventory),
+        body: JSON.stringify(context)
+      });
+      return parsed(ResolvedInventory, okBody(response), ROUTES.inventory);
+    },
+    async recordAuditEvent(event) {
+      const validated = RecordAuditEventRequest.safeParse(event);
+      if (!validated.success) throw new RemoteRequestInvalid(ROUTES.auditEvents, validated.error);
+      const submission = validated.data;
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.auditEvents),
+        body: JSON.stringify(submission)
+      });
+      okBody(response);
+    },
+    async reportStorePosture(snapshot) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.storePosture),
+        body: JSON.stringify(snapshot)
+      });
+      okBody(response);
+    },
+    async getPolicyBundle(etag) {
+      const response = await send({
+        ...common,
+        method: "GET",
+        url: url2(ROUTES.policyBundle),
+        ...etag === void 0 ? {} : { headers: { "if-none-match": etag } }
+      });
+      if (response.status === 304) {
+        return { changed: false, etag: headerValue(response, "etag") ?? etag };
+      }
+      const bundle = parsed(PolicyBundle, okBody(response), ROUTES.policyBundle);
+      return { changed: true, bundle, etag: headerValue(response, "etag") };
+    },
+    async whoami() {
+      const response = await send({ ...common, method: "GET", url: url2(ROUTES.whoami) });
+      return parsed(PluginWhoami, okBody(response), ROUTES.whoami);
+    }
+  };
+}
+
+// ../packages/plugin-runtime/src/attached/posture-reporter.ts
+var POSTURE_REPORT_INTERVAL_MS = 60 * 60 * 1e3;
+
+// ../packages/plugin-runtime/src/attached/posture-snapshot.ts
+import { statSync as statSync12 } from "fs";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+
+// ../packages/plugin-runtime/src/attached/posture-store.ts
+import { randomUUID as randomUUID18 } from "crypto";
+import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { join as join24 } from "path";
+
+// ../packages/plugin-runtime/src/attached/sync-state.ts
+import { readFileSync as readFileSync17 } from "fs";
+import { join as join25 } from "path";
+var SYNC_STATE_FILENAME = "attached-sync-state.json";
+var OUTCOMES = /* @__PURE__ */ new Set([
+  "ok",
+  "not-modified",
+  "unauthorized",
+  "forbidden",
+  "unreachable",
+  "invalid-bundle"
+]);
+function syncStatePath(dataDir2) {
+  return join25(dataDir2, SYNC_STATE_FILENAME);
+}
+function readSyncState(dataDir2) {
+  try {
+    const parsed2 = JSON.parse(readFileSync17(syncStatePath(dataDir2), "utf8"));
+    if (typeof parsed2 !== "object" || parsed2 === null) return null;
+    const record2 = parsed2;
+    if (typeof record2.outcome !== "string" || !OUTCOMES.has(record2.outcome)) return null;
+    if (typeof record2.atMs !== "number") return null;
+    return { outcome: record2.outcome, atMs: record2.atMs };
+  } catch {
+    return null;
+  }
+}
+
+// ../packages/plugin-runtime/src/attached/status.ts
+var REFUSAL_LINES = {
+  unauthorized: "KEY REJECTED \u2014 re-attach with a valid plugin key",
+  forbidden: "ACCESS REFUSED \u2014 key is valid but not permitted; ask your org admin"
+};
+var OUTCOME_LINES = {
+  ok: "policy synced",
+  "not-modified": "policy up to date",
+  unauthorized: REFUSAL_LINES.unauthorized,
+  forbidden: REFUSAL_LINES.forbidden,
+  unreachable: "control plane unreachable at last attempt",
+  "invalid-bundle": "control plane sent a policy bundle this build cannot read"
+};
+function ageLine(fromMs, nowMs) {
+  const deltaMs = Math.max(0, nowMs - fromMs);
+  const minutes = Math.floor(deltaMs / 6e4);
+  if (minutes < 1) return "just now";
+  if (minutes < 60) return `${String(minutes)}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${String(hours)}h ago`;
+  return `${String(Math.floor(hours / 24))}d ago`;
+}
+function renderAttachedStatus(deps) {
+  try {
+    const nowMs = (deps.now ?? (() => Date.now()))();
+    const settings = readWorkspaceSettings(deps.base);
+    if (!isAttached(settings) || settings.controlPlane === void 0) {
+      return ["AKA: standalone (not attached)", "  no control plane configured"].join("\n");
+    }
+    const connection = settings.controlPlane;
+    const state = readControlPlaneCredentialState(deps.settingsDir, connection);
+    const lines = [
+      // The mismatch case earns its own headline. An administrator can repoint
+      // `controlPlane` across a fleet and cannot write the credential file, so
+      // this is an ordinary migration rather than a fault — and reporting it as
+      // a bare "not attached" would send every affected user looking for a file
+      // that is present and intact.
+      state.usable ? "AKA: attached" : state.reason === "endpoint-mismatch" ? "AKA: attached \u2014 credential is for another deployment, re-attach" : "AKA: attached \u2014 no usable credential, re-attach",
+      // ALLOW-LISTED, field by field. The credential itself is deliberately
+      // absent and must stay that way; `keyPrefix` is the non-secret half.
+      //
+      // And every one of them goes through `printable`, which is about the
+      // field's CONTENT rather than which fields appear. The allow-list above
+      // decides what is rendered; it says nothing about what those strings
+      // hold. None of these is authored by this machine — `label` comes from
+      // `aka attach --label` or from a `settings.json` an administrator can pin
+      // fleet-wide, and the endpoint and `keyPrefix` come off the credential
+      // file — and all of them land in a status block a user reads to decide
+      // whether their machine is managed. An ANSI escape in any of them can
+      // repaint that block or hide a line, which is the same argument
+      // `printable` was written for one field over.
+      `  plane      ${printable2(controlPlaneName(connection))}`,
+      `  attached   ${printable2(connection.attachedAt, 40)}`
+    ];
+    if (state.usable && state.credential.keyPrefix !== void 0) {
+      lines.push(`  key        ${printable2(state.credential.keyPrefix, 16)}\u2026`);
+    }
+    if (!state.usable && state.reason === "endpoint-mismatch") {
+      lines.push(`  credential ${printable2(state.credentialEndpoint, 200)}`);
+    }
+    return [
+      ...lines,
+      ...policyLines(deps.dataDir, nowMs),
+      ...forwardLines(deps.dataDir, nowMs)
+    ].join("\n");
+  } catch {
+    return "AKA: status unavailable";
+  }
+}
+function policyLines(dataDir2, nowMs) {
+  const lines = [];
+  const state = readSyncState(dataDir2);
+  if (state) {
+    lines.push(`  sync       ${OUTCOME_LINES[state.outcome]} (${ageLine(state.atMs, nowMs)})`);
+  } else {
+    lines.push("  sync       no attempt recorded yet");
+  }
+  return lines;
+}
+function dropLines(dataDir2, nowMs) {
+  const drops = readForwardDrops(dataDir2);
+  if (!drops) return [];
+  return [
+    `             at least ${String(drops.droppedForwards)} events dropped past the batch budget, last ${ageLine(drops.lastDropAtMs, nowMs)}`
+  ];
+}
+function forwardLines(dataDir2, nowMs) {
+  const drops = dropLines(dataDir2, nowMs);
+  const health = readForwardHealth(dataDir2, nowMs);
+  if (!health) return ["  forward    no failures recorded", ...drops];
+  const { consecutiveFailures, openedAtMs, lastFailure } = health;
+  if (openedAtMs === null && consecutiveFailures === 0) {
+    return ["  forward    reporting normally", ...drops];
+  }
+  const lines = openedAtMs !== null ? (
+    // `openedAtMs` is re-stamped on every half-open probe, so the gap to now
+    // is bounded by one cooldown however long the control plane has been down — it
+    // dates the last ATTEMPT, never the outage. The failure count is the
+    // part that grows, so that is the number shown as the magnitude.
+    [
+      `  forward    NOT REPORTING \u2014 ${String(consecutiveFailures)} consecutive failures, last tried ${ageLine(openedAtMs, nowMs)}`
+    ]
+  ) : (
+    // Closed but non-zero: failing without having reached the threshold yet.
+    [`  forward    ${String(consecutiveFailures)} failures since the last success`]
+  );
+  if (lastFailure === "unauthorized" || lastFailure === "forbidden") {
+    lines.push(`             ${REFUSAL_LINES[lastFailure]}`);
+  }
+  return [...lines, ...drops];
+}
+function printable2(value, max = 80) {
+  const stripped = value.replace(/[\p{Cc}\p{Cf}]/gu, "");
+  return stripped.length > max ? `${stripped.slice(0, max)}\u2026` : stripped;
+}
+async function renderPolicyLine(dataDir2, nowMs = Date.now()) {
+  try {
+    const cached2 = await createPolicyStore(dataDir2).read();
+    if (!cached2) return "  policy     none cached";
+    return `  policy     ${printable2(cached2.bundle.version)} (fetched ${ageLine(cached2.fetchedAtMs, nowMs)})`;
+  } catch {
+    return "  policy     unreadable";
+  }
+}
+
+// ../packages/plugin-runtime/src/attached/sync-trigger.ts
+import { spawn as spawn2 } from "child_process";
+import { fileURLToPath as fileURLToPath3 } from "url";
+var SYNC_THROTTLE_MS = 15 * 60 * 1e3;
+
+// ../packages/plugin-runtime/src/attached/factory.ts
+import { hostname as hostname5 } from "os";
+
+// ../packages/plugin-runtime/src/standalone-gateway.ts
+import { randomUUID as randomUUID19 } from "crypto";
+
+// ../packages/plugin-runtime/src/handle-session-start.ts
+import { randomUUID as randomUUID20 } from "crypto";
+var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/lib/args.ts
-import { resolve as resolve4 } from "path";
+import { resolve as resolve5 } from "path";
 var HOME_OPTION = { home: { type: "string" } };
 function homeBase(home) {
-  return home === void 0 ? defaultDataDir() : resolve4(home);
+  return home === void 0 ? defaultDataDir() : resolve5(home);
+}
+
+// src/lib/prompter.ts
+import { createInterface } from "readline";
+function processHiddenChar(state, ch) {
+  if (state.done) return state;
+  if (state.esc === "esc") {
+    return ch === "[" || ch === "O" ? { ...state, esc: "seq" } : { ...state, esc: "none" };
+  }
+  if (state.esc === "seq") {
+    return ch >= "@" && ch <= "~" ? { ...state, esc: "none" } : state;
+  }
+  if (ch === "\r" || ch === "\n") return { ...state, done: "submit" };
+  if (ch === "") return { ...state, done: "cancel" };
+  if (ch === "\x7F" || ch === "\b") return { ...state, value: state.value.slice(0, -1) };
+  if (ch === "\x1B") return { ...state, esc: "esc" };
+  if (ch < " ") return state;
+  return { ...state, value: state.value + ch };
+}
+var CLEANUP_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+function processIo() {
+  return {
+    input: process.stdin,
+    output: process.stdout,
+    errorOutput: process.stderr,
+    signals: {
+      once: (signal, handler) => {
+        process.once(signal, handler);
+      },
+      off: (signal, handler) => {
+        process.removeListener(signal, handler);
+      },
+      raise: (signal) => {
+        process.kill(process.pid, signal);
+      }
+    }
+  };
+}
+function terminalPrompter(io = processIo()) {
+  return {
+    out: (text) => {
+      io.output.write(text);
+    },
+    err: (text) => {
+      io.errorOutput.write(text);
+    },
+    isInteractive: io.input.isTTY && io.output.isTTY,
+    ask(question) {
+      return new Promise((resolve6) => {
+        const rl = createInterface({ input: io.input, output: io.output });
+        rl.question(question, (answer) => {
+          rl.close();
+          resolve6(answer);
+        });
+      });
+    },
+    // Raw mode so nothing is echoed; characters are folded through
+    // processHiddenChar. The captured value stays in this closure and is
+    // handed to the caller only — never written anywhere. TTY restoration is
+    // guaranteed via a one-shot `restore` that also runs on stdin errors and
+    // fatal signals: a security tool must never brick the terminal it was
+    // invoked from.
+    askHidden(question) {
+      return new Promise((resolve6, reject) => {
+        const stdin = io.input;
+        io.output.write(question);
+        stdin.setRawMode(true);
+        stdin.resume();
+        let state = { value: "", esc: "none" };
+        let restored = false;
+        const restore = () => {
+          if (restored) return;
+          restored = true;
+          stdin.removeListener("data", onData);
+          stdin.removeListener("error", onError);
+          for (const sig of CLEANUP_SIGNALS) io.signals.off(sig, onSignal);
+          try {
+            stdin.setRawMode(false);
+          } catch {
+          }
+          stdin.pause();
+        };
+        const finish = (err) => {
+          restore();
+          io.output.write("\n");
+          if (err) reject(err);
+          else resolve6(state.value);
+        };
+        const onError = (err) => {
+          finish(err);
+        };
+        const onSignal = (sig) => {
+          restore();
+          io.signals.raise(sig);
+        };
+        const onData = (chunk) => {
+          try {
+            for (const ch of chunk.toString("utf8")) {
+              state = processHiddenChar(state, ch);
+              if (state.done === "submit") {
+                finish();
+                return;
+              }
+              if (state.done === "cancel") {
+                finish(new Error("cancelled"));
+                return;
+              }
+            }
+          } catch (err) {
+            finish(err instanceof Error ? err : new Error(String(err)));
+          }
+        };
+        stdin.on("data", onData);
+        stdin.once("error", onError);
+        for (const sig of CLEANUP_SIGNALS) io.signals.once(sig, onSignal);
+      });
+    },
+    async readAllStdin() {
+      const chunks = [];
+      for await (const chunk of io.input) {
+        chunks.push(chunk);
+      }
+      return Buffer.concat(chunks).toString("utf8");
+    }
+  };
+}
+
+// src/commands/attach.ts
+var POLICY_CACHE_FILENAME = "policy-cache.json";
+var USAGE = `Usage: aka attach --url <https-url> [--label <name>] [--key-stdin]
+
+Registers this machine against your organization's AKA deployment.
+
+  --url <url>     Where the deployment lives. https, or http on loopback.
+  --label <name>  What to call it on screen. Defaults to the URL.
+  --key-stdin     Read the access key from stdin instead of prompting.
+  --home <dir>    Use an alternate AKA home instead of ~/.aka.
+
+The key is never accepted as a command-line argument \u2014 it would be visible to
+every process on this machine and recorded in your shell history.`;
+function parseAttachArgs(argv) {
+  const parsed2 = { keyStdin: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--key" || arg?.startsWith("--key=")) {
+      return {
+        error: "aka attach does not take --key: a key on the command line is visible to every process on this machine and is written to your shell history. Run without it to be prompted, or pipe the key in with --key-stdin."
+      };
+    }
+    if (arg === "--key-stdin") {
+      parsed2.keyStdin = true;
+    } else if (arg === "--url") {
+      parsed2.url = argv[++i];
+    } else if (arg?.startsWith("--url=")) {
+      parsed2.url = arg.slice("--url=".length);
+    } else if (arg === "--label") {
+      parsed2.label = argv[++i];
+    } else if (arg?.startsWith("--label=")) {
+      parsed2.label = arg.slice("--label=".length);
+    } else if (arg === "--home") {
+      parsed2.home = argv[++i];
+    } else if (arg?.startsWith("--home=")) {
+      parsed2.home = arg.slice("--home=".length);
+    } else {
+      return { error: `unknown option ${String(arg)}` };
+    }
+  }
+  if (parsed2.label !== void 0 && CONTROL_CHARS.test(parsed2.label)) {
+    return {
+      error: "aka attach does not take a --label containing control characters. The label is printed into `aka status`, which a user reads to decide whether their machine is managed, and an escape sequence there can repaint or hide lines of that block."
+    };
+  }
+  return parsed2;
+}
+var CONTROL_CHARS = /[\p{Cc}\p{Cf}]/u;
+var isError = (v) => "error" in v;
+async function runAttach(argv, deps = {}) {
+  const io = deps.prompter ?? terminalPrompter();
+  const exit = deps.exit ?? ((code) => process.exit(code));
+  const args = parseAttachArgs(argv);
+  if (isError(args)) {
+    io.err(`${args.error}
+
+${USAGE}`);
+    exit(2);
+    return;
+  }
+  const base = deps.base ?? homeBase(args.home);
+  const endpoint = args.url;
+  if (endpoint === void 0 || endpoint === "") {
+    io.err(USAGE);
+    exit(2);
+    return;
+  }
+  if (!isSafeEndpoint(endpoint)) {
+    io.err(
+      `refusing to attach to ${endpoint}: an access key must not travel in the clear. Use an https URL (http is accepted only for a loopback deployment).`
+    );
+    exit(2);
+    return;
+  }
+  const apiKey = (args.keyStdin ? (await io.readAllStdin()).trim() : io.isInteractive ? (await io.askHidden("Access key (input hidden): ")).trim() : "").trim();
+  if (apiKey === "") {
+    io.err(
+      io.isInteractive || args.keyStdin ? "no access key was provided; nothing was changed." : "no terminal to prompt on. Pipe the key in with --key-stdin."
+    );
+    exit(2);
+    return;
+  }
+  let identity;
+  try {
+    identity = await (deps.verify ?? verifyWithControlPlane)(endpoint, apiKey);
+  } catch {
+    io.err(
+      `could not verify that key against ${endpoint}. Nothing was changed \u2014 check the URL and that the key has not been revoked.`
+    );
+    exit(1);
+    return;
+  }
+  const previous = readControlPlaneCredentialState(settingsDir(base));
+  try {
+    writeControlPlaneCredential(settingsDir(base), {
+      specVersion: 1,
+      endpoint,
+      apiKey,
+      mintedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    applyOnboarding(
+      {
+        runMode: "attached",
+        controlPlane: {
+          endpoint,
+          attachedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          ...args.label === void 0 ? {} : { label: args.label }
+        }
+      },
+      base
+    );
+  } catch (err) {
+    try {
+      if (previous.usable) writeControlPlaneCredential(settingsDir(base), previous.credential);
+      else removeControlPlaneCredential(settingsDir(base));
+    } catch {
+    }
+    io.err(
+      err instanceof ManagedFieldError ? "your organization manages this setting on this machine, so it cannot be attached here." : "could not save the attachment; this machine is left as it was."
+    );
+    exit(1);
+    return;
+  }
+  io.out(
+    [
+      `Attached to ${args.label ?? endpoint}.`,
+      `  organization  ${identity.tenantName}`,
+      `  you           ${identity.userEmail}`,
+      "",
+      "Policy arrives on the next session. Run `aka status` to see it.",
+      ""
+    ].join("\n")
+  );
+}
+async function verifyWithControlPlane(endpoint, apiKey) {
+  const who = await createRemoteClient({ endpoint, apiKey }).whoami();
+  return { tenantName: who.tenantName, userEmail: who.userEmail };
+}
+function runDetach(argv, deps = {}) {
+  const io = deps.prompter ?? terminalPrompter();
+  const exit = deps.exit ?? ((code) => process.exit(code));
+  const args = parseAttachArgs(argv);
+  if (isError(args)) {
+    io.err(args.error);
+    exit(2);
+    return;
+  }
+  const base = deps.base ?? homeBase(args.home);
+  const had = readControlPlaneCredentialState(settingsDir(base)).usable;
+  try {
+    applyOnboarding({ runMode: "standalone", controlPlane: void 0 }, base);
+  } catch (err) {
+    io.err(
+      err instanceof ManagedFieldError ? "your organization manages this setting on this machine, so it cannot be detached here." : "could not clear the attachment; this machine is left as it was."
+    );
+    exit(1);
+    return;
+  }
+  removeControlPlaneCredential(settingsDir(base));
+  clearDerived(dataDir(base));
+  io.out(
+    had ? "Detached. This machine records locally only; that deployment is sent nothing.\n" : "This machine was not attached; nothing to do.\n"
+  );
+}
+function clearDerived(dir) {
+  for (const name of [
+    POLICY_CACHE_FILENAME,
+    SYNC_STATE_FILENAME,
+    FORWARD_STATE_FILENAME,
+    FORWARD_DROPS_FILENAME
+  ]) {
+    rmSync7(join26(dir, name), { force: true });
+  }
+}
+async function runStatus(argv, deps = {}) {
+  const io = deps.prompter ?? terminalPrompter();
+  const args = parseAttachArgs(argv);
+  if (isError(args)) {
+    io.err(args.error);
+    (deps.exit ?? ((code) => process.exit(code)))(2);
+    return;
+  }
+  const base = deps.base ?? homeBase(args.home);
+  const dataDir2 = dataDir(base);
+  const block = renderAttachedStatus({ base, settingsDir: settingsDir(base), dataDir: dataDir2 });
+  const attached = !block.startsWith("AKA: standalone");
+  io.out(attached ? `${block}
+${await renderPolicyLine(dataDir2)}
+` : `${block}
+`);
 }
 
 // src/commands/check-updates.ts
+import { existsSync as existsSync13 } from "fs";
+import { parseArgs } from "util";
 function runCheckUpdates(argv) {
   const { values } = parseArgs({ args: argv, options: HOME_OPTION });
   const home = homeBase(values.home);
@@ -32424,7 +33684,7 @@ function runCheckUpdates(argv) {
     out.write(`${String(ups.length)} update(s) available \u2014 run \`aka update\` to apply.
 `);
   }
-  if (existsSync12(dataDir(home))) {
+  if (existsSync13(dataDir(home))) {
     const notifiedPluginIds = readCache(home)?.notifiedPluginIds ?? [];
     writeCache(home, { checkedAt: Date.now(), report, notifiedPluginIds });
   }
@@ -32577,16 +33837,16 @@ function runCompletion(argv) {
 }
 
 // src/commands/dashboard.ts
-import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync13 } from "fs";
+import { spawn as spawn4 } from "child_process";
+import { existsSync as existsSync14 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { createServer } from "net";
-import { dirname as dirname7, join as join19 } from "path";
-import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
+import { dirname as dirname8, join as join27 } from "path";
+import { fileURLToPath as fileURLToPath4, pathToFileURL } from "url";
 import { parseArgs as parseArgs2 } from "util";
 
 // src/lib/open-url.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 function openUrlCommand(platform2, url2) {
   if (platform2 === "darwin") return { command: "open", args: [url2] };
   if (platform2 === "win32") return { command: "cmd", args: ["/c", "start", "", url2] };
@@ -32596,7 +33856,7 @@ var DETACHED = Object.freeze({ stdio: "ignore", detached: true });
 function openUrl(url2, deps = {}) {
   const { command, args } = openUrlCommand(deps.platform ?? process.platform, url2);
   try {
-    const child = (deps.spawn ?? spawn2)(command, [...args], DETACHED);
+    const child = (deps.spawn ?? spawn3)(command, [...args], DETACHED);
     child.on("error", () => {
     });
     child.unref();
@@ -32606,10 +33866,10 @@ function openUrl(url2, deps = {}) {
 
 // src/commands/dashboard.ts
 var require3 = createRequire2(import.meta.url);
-var here = dirname7(fileURLToPath3(import.meta.url));
+var here = dirname8(fileURLToPath4(import.meta.url));
 var BIND_HOST = "127.0.0.1";
 function pkgBase() {
-  return isSea() ? dirname7(process.execPath) : join19(here, "..");
+  return isSea() ? dirname8(process.execPath) : join27(here, "..");
 }
 function isPortFree(port) {
   return new Promise((resolve6) => {
@@ -32663,17 +33923,17 @@ async function runDashboard(argv) {
   refreshUpdateMirror(dataDir());
   const base = pkgBase();
   const bundledServer = [
-    join19(base, "web-ui", "server.js"),
-    join19(base, "web-ui", "web-ui", "server.js")
-  ].find((p) => existsSync13(p));
+    join27(base, "web-ui", "server.js"),
+    join27(base, "web-ui", "web-ui", "server.js")
+  ].find((p) => existsSync14(p));
   if (bundledServer) {
     launchStandalone(bundledServer, port, shouldOpen, url2);
     return;
   }
-  const webUiDir = dirname7(require3.resolve("@akasecurity/web-ui/package.json"));
+  const webUiDir = dirname8(require3.resolve("@akasecurity/web-ui/package.json"));
   const nextBin = require3.resolve("next/dist/bin/next", { paths: [webUiDir] });
   const startNext = () => {
-    const child = spawn3(
+    const child = spawn4(
       process.execPath,
       [nextBin, "start", "--port", port, "--hostname", BIND_HOST],
       {
@@ -32684,12 +33944,12 @@ async function runDashboard(argv) {
     onReadyOpen(child, shouldOpen, url2, `Starting the AKA dashboard at ${url2}
 `);
   };
-  if (existsSync13(join19(webUiDir, ".next", "BUILD_ID"))) {
+  if (existsSync14(join27(webUiDir, ".next", "BUILD_ID"))) {
     startNext();
     return;
   }
   process.stdout.write("Building the web-ui (first run \u2014 this can take a minute)\u2026\n");
-  const build = spawn3(process.execPath, [nextBin, "build"], { cwd: webUiDir, stdio: "inherit" });
+  const build = spawn4(process.execPath, [nextBin, "build"], { cwd: webUiDir, stdio: "inherit" });
   build.on("exit", (code) => {
     if (code !== 0) {
       process.stderr.write("aka dashboard: web-ui build failed\n");
@@ -32706,8 +33966,8 @@ function launchStandalone(serverJs, port, shouldOpen, url2) {
     process.exitCode = 1;
     return;
   }
-  const child = spawn3(reinvoke.command, reinvoke.args, {
-    cwd: dirname7(serverJs),
+  const child = spawn4(reinvoke.command, reinvoke.args, {
+    cwd: dirname8(serverJs),
     stdio: ["inherit", "pipe", "inherit"],
     // Inherit the parent env so the child server sees PATH etc.; PORT/HOSTNAME tell
     // Next's standalone server where to bind (its only port input).
@@ -32946,131 +34206,6 @@ function formatTimestamp(iso) {
   return iso.slice(0, 16).replace("T", " ");
 }
 
-// src/lib/prompter.ts
-import { createInterface } from "readline";
-function processHiddenChar(state, ch) {
-  if (state.done) return state;
-  if (state.esc === "esc") {
-    return ch === "[" || ch === "O" ? { ...state, esc: "seq" } : { ...state, esc: "none" };
-  }
-  if (state.esc === "seq") {
-    return ch >= "@" && ch <= "~" ? { ...state, esc: "none" } : state;
-  }
-  if (ch === "\r" || ch === "\n") return { ...state, done: "submit" };
-  if (ch === "") return { ...state, done: "cancel" };
-  if (ch === "\x7F" || ch === "\b") return { ...state, value: state.value.slice(0, -1) };
-  if (ch === "\x1B") return { ...state, esc: "esc" };
-  if (ch < " ") return state;
-  return { ...state, value: state.value + ch };
-}
-var CLEANUP_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
-function processIo() {
-  return {
-    input: process.stdin,
-    output: process.stdout,
-    errorOutput: process.stderr,
-    signals: {
-      once: (signal, handler) => {
-        process.once(signal, handler);
-      },
-      off: (signal, handler) => {
-        process.removeListener(signal, handler);
-      },
-      raise: (signal) => {
-        process.kill(process.pid, signal);
-      }
-    }
-  };
-}
-function terminalPrompter(io = processIo()) {
-  return {
-    out: (text) => {
-      io.output.write(text);
-    },
-    err: (text) => {
-      io.errorOutput.write(text);
-    },
-    isInteractive: io.input.isTTY && io.output.isTTY,
-    ask(question) {
-      return new Promise((resolve6) => {
-        const rl = createInterface({ input: io.input, output: io.output });
-        rl.question(question, (answer) => {
-          rl.close();
-          resolve6(answer);
-        });
-      });
-    },
-    // Raw mode so nothing is echoed; characters are folded through
-    // processHiddenChar. The captured value stays in this closure and is
-    // handed to the caller only — never written anywhere. TTY restoration is
-    // guaranteed via a one-shot `restore` that also runs on stdin errors and
-    // fatal signals: a security tool must never brick the terminal it was
-    // invoked from.
-    askHidden(question) {
-      return new Promise((resolve6, reject) => {
-        const stdin = io.input;
-        io.output.write(question);
-        stdin.setRawMode(true);
-        stdin.resume();
-        let state = { value: "", esc: "none" };
-        let restored = false;
-        const restore = () => {
-          if (restored) return;
-          restored = true;
-          stdin.removeListener("data", onData);
-          stdin.removeListener("error", onError);
-          for (const sig of CLEANUP_SIGNALS) io.signals.off(sig, onSignal);
-          try {
-            stdin.setRawMode(false);
-          } catch {
-          }
-          stdin.pause();
-        };
-        const finish = (err) => {
-          restore();
-          io.output.write("\n");
-          if (err) reject(err);
-          else resolve6(state.value);
-        };
-        const onError = (err) => {
-          finish(err);
-        };
-        const onSignal = (sig) => {
-          restore();
-          io.signals.raise(sig);
-        };
-        const onData = (chunk) => {
-          try {
-            for (const ch of chunk.toString("utf8")) {
-              state = processHiddenChar(state, ch);
-              if (state.done === "submit") {
-                finish();
-                return;
-              }
-              if (state.done === "cancel") {
-                finish(new Error("cancelled"));
-                return;
-              }
-            }
-          } catch (err) {
-            finish(err instanceof Error ? err : new Error(String(err)));
-          }
-        };
-        stdin.on("data", onData);
-        stdin.once("error", onError);
-        for (const sig of CLEANUP_SIGNALS) io.signals.once(sig, onSignal);
-      });
-    },
-    async readAllStdin() {
-      const chunks = [];
-      for await (const chunk of io.input) {
-        chunks.push(chunk);
-      }
-      return Buffer.concat(chunks).toString("utf8");
-    }
-  };
-}
-
 // src/commands/exception.ts
 var EXCEPTION_HELP = `Manage detection exceptions (explicit, audited bypasses).
 
@@ -33854,15 +34989,15 @@ async function runException(argv, io = terminalPrompter()) {
 
 // src/commands/extension.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, readFileSync as readFileSync18, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
 import { createRequire as createRequire3 } from "module";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname8, join as join20 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { dirname as dirname9, join as join28 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 var require4 = createRequire3(import.meta.url);
-var here2 = dirname8(fileURLToPath4(import.meta.url));
+var here2 = dirname9(fileURLToPath5(import.meta.url));
 function cliRoot() {
-  return isSea() ? dirname8(process.execPath) : join20(here2, "..");
+  return isSea() ? dirname9(process.execPath) : join28(here2, "..");
 }
 var EXTENSION_IDS = [
   // Derived from the "key" in plugins/browser-extension/manifest.json.
@@ -33879,30 +35014,30 @@ function nativeHostManifest(hostPath) {
   };
 }
 function resolveHostScript(root = cliRoot()) {
-  const bundled = join20(root, "native-host", "host.js");
-  if (existsSync14(bundled)) return bundled;
+  const bundled = join28(root, "native-host", "host.js");
+  if (existsSync15(bundled)) return bundled;
   try {
     const pkgJson = require4.resolve("@akasecurity/plugin-browser-extension/package.json");
-    const devBuilt = join20(dirname8(pkgJson), "native-host", "host.js");
-    if (existsSync14(devBuilt)) return devBuilt;
+    const devBuilt = join28(dirname9(pkgJson), "native-host", "host.js");
+    if (existsSync15(devBuilt)) return devBuilt;
   } catch {
   }
   return null;
 }
 function resolveExtensionDist(root = cliRoot()) {
-  const bundled = join20(root, "extension");
-  if (existsSync14(bundled)) return bundled;
+  const bundled = join28(root, "extension");
+  if (existsSync15(bundled)) return bundled;
   try {
     const pkgJson = require4.resolve("@akasecurity/plugin-browser-extension/package.json");
-    const devDist = join20(dirname8(pkgJson), "dist");
-    if (existsSync14(devDist)) return devDist;
+    const devDist = join28(dirname9(pkgJson), "dist");
+    if (existsSync15(devDist)) return devDist;
   } catch {
   }
   return null;
 }
 function chromeManifestDir(platform2 = process.platform) {
   if (platform2 === "darwin") {
-    return join20(
+    return join28(
       homedir5(),
       "Library",
       "Application Support",
@@ -33912,9 +35047,9 @@ function chromeManifestDir(platform2 = process.platform) {
     );
   }
   if (platform2 === "win32") {
-    return join20(homedir5(), ".aka", "native-messaging");
+    return join28(homedir5(), ".aka", "native-messaging");
   }
-  return join20(homedir5(), ".config", "google-chrome", "NativeMessagingHosts");
+  return join28(homedir5(), ".config", "google-chrome", "NativeMessagingHosts");
 }
 function resolveNodeForLauncher() {
   if (!isSea()) return process.execPath;
@@ -33928,7 +35063,7 @@ function resolveNodeForLauncher() {
   }
 }
 function launcherPath(manifestDir, platform2) {
-  return join20(
+  return join28(
     manifestDir,
     platform2 === "win32" ? `${NATIVE_HOST_NAME}.cmd` : `${NATIVE_HOST_NAME}.sh`
   );
@@ -33978,7 +35113,7 @@ function runExtension(argv) {
     return;
   }
   if (sub === "status") {
-    runStatus(chromeManifestDir());
+    runStatus2(chromeManifestDir());
     return;
   }
   process.stderr.write(
@@ -34005,7 +35140,7 @@ function runInstall(manifestDir, hostScript = resolveHostScript(), extensionDist
   }
   mkdirSync4(manifestDir, { recursive: true });
   const launcher = writeLauncher(manifestDir, hostScript, nodePath, process.platform);
-  const manifestPath = join20(manifestDir, `${NATIVE_HOST_NAME}.json`);
+  const manifestPath = join28(manifestDir, `${NATIVE_HOST_NAME}.json`);
   const tmp = `${manifestPath}.tmp`;
   writeFileSync7(tmp, `${JSON.stringify(nativeHostManifest(launcher), null, 2)}
 `, {
@@ -34040,21 +35175,21 @@ Next: load the extension in Chrome \u2014
   );
 }
 function manifestFault(manifestPath) {
-  let parsed;
+  let parsed2;
   try {
-    parsed = JSON.parse(readFileSync14(manifestPath, "utf8"));
+    parsed2 = JSON.parse(readFileSync18(manifestPath, "utf8"));
   } catch (err) {
     return `could not be read (${err instanceof Error ? err.message : String(err)})`;
   }
-  const granted = parsed?.allowed_origins;
+  const granted = parsed2?.allowed_origins;
   if (!Array.isArray(granted)) return "has no allowed_origins list";
   const missing = EXTENSION_IDS.filter((id) => !granted.includes(`chrome-extension://${id}/`));
   if (missing.length === 0) return null;
   return `does not grant ${missing.length === 1 ? "the extension id" : "the extension ids"} ${missing.join(", ")}`;
 }
-function runStatus(manifestDir) {
-  const manifestPath = join20(manifestDir, `${NATIVE_HOST_NAME}.json`);
-  if (!existsSync14(manifestPath)) {
+function runStatus2(manifestDir) {
+  const manifestPath = join28(manifestDir, `${NATIVE_HOST_NAME}.json`);
+  if (!existsSync15(manifestPath)) {
     process.stdout.write(
       `native-messaging host: not installed
   manifest: ${manifestPath}
@@ -34076,13 +35211,13 @@ function runStatus(manifestDir) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync16, lstatSync as lstatSync2, readdirSync as readdirSync7, readlinkSync, realpathSync as realpathSync4, statSync as statSync10 } from "fs";
-import { dirname as dirname9, join as join21, resolve as resolve5 } from "path";
+import { existsSync as existsSync17, lstatSync as lstatSync4, readdirSync as readdirSync7, statSync as statSync13 } from "fs";
+import { join as join29 } from "path";
 import * as readline from "readline/promises";
 import { parseArgs as parseArgs6 } from "util";
 
 // src/commands/plugins.ts
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { parseArgs as parseArgs5 } from "util";
 function runPlugins(argv) {
   const [sub, ...rest] = argv;
@@ -34099,7 +35234,7 @@ async function listPlugins(argv) {
   const { values } = parseArgs5({ args: argv, options: HOME_OPTION });
   const home = homeBase(values.home);
   const active = /* @__PURE__ */ new Set();
-  if (existsSync15(dbPath(home))) {
+  if (existsSync16(dbPath(home))) {
     const db = openLocalDatabase(dataDir(home));
     try {
       const recent = await db.findings.recentFindings({ limit: 1e3 });
@@ -34190,28 +35325,13 @@ Then run \`aka init\` to set up the local store.
 
 // src/commands/init.ts
 var PLUGIN_OFFER_IDENTITY = `${PRODUCT_NAME} \u2014 ${PRODUCT_TAGLINE}`;
-var STORE_DB = "the store database (including the prompt corpus)";
-var STORE_SETTINGS = "your settings file";
-function storeContents(home) {
-  return /* @__PURE__ */ new Map([
-    [home, "the store (including the prompt corpus in aka.db)"],
-    [settingsDir(home), STORE_SETTINGS],
-    [dataDir(home), STORE_DB],
-    [keysDir(home), "the vault key"],
-    [join21(settingsDir(home), "settings.json"), STORE_SETTINGS],
-    [dbPath(home), STORE_DB]
-  ]);
-}
-function storeTargets(home) {
-  return [...storeContents(home).keys()];
-}
 function storeModeTargets(home) {
   const targets = new Set(storeTargets(home));
   for (const dir of [dataDir(home), keysDir(home)]) {
     try {
       for (const entry of readdirSync7(dir, { withFileTypes: true })) {
         if (entry.name.endsWith(".partial") && !entry.isDirectory()) continue;
-        targets.add(join21(dir, entry.name));
+        targets.add(join29(dir, entry.name));
       }
     } catch {
     }
@@ -34222,48 +35342,13 @@ function looseStorePaths(home) {
   if (process.platform === "win32") return [];
   return storeModeTargets(home).filter((p) => {
     try {
-      if (lstatSync2(p).isSymbolicLink()) return false;
-      return (statSync10(p).mode & 63) !== 0;
+      if (lstatSync4(p).isSymbolicLink()) return false;
+      return (statSync13(p).mode & 63) !== 0;
     } catch {
       return false;
     }
   });
 }
-function symlinkedStorePaths(home, platform2 = process.platform) {
-  return [...storeContents(home)].flatMap(([path, holds]) => {
-    try {
-      if (!lstatSync2(path).isSymbolicLink()) return [];
-      return [
-        {
-          path,
-          target: linkTarget(path),
-          holds,
-          // existsSync follows the link, so a target that is gone reads as
-          // absent here while lstat above still sees the link itself.
-          missing: !existsSync16(path),
-          mode: targetMode(path, platform2)
-        }
-      ];
-    } catch {
-      return [];
-    }
-  });
-}
-function linkTarget(path) {
-  try {
-    return realpathSync4(path);
-  } catch {
-    return resolve5(dirname9(path), readlinkSync(path));
-  }
-}
-function targetMode(path, platform2) {
-  if (platform2 === "win32") return void 0;
-  try {
-    return statSync10(path).mode & 511;
-  } catch {
-    return void 0;
-  }
-}
 function symlinkWarnings(paths, platform2 = process.platform) {
   const seeAlso = '(see the "Data at rest" note in SECURITY.md)';
   return paths.map(({ path, target, holds, missing, mode }) => {
@@ -34291,7 +35376,7 @@ function assertStoreLinksResolve(home) {
 }
 function isBrokenLink(path) {
   try {
-    return lstatSync2(path).isSymbolicLink() && !existsSync16(path);
+    return lstatSync4(path).isSymbolicLink() && !existsSync17(path);
   } catch {
     return false;
   }
@@ -34305,14 +35390,14 @@ function assertStorePathsAreDirectories(home) {
 }
 function isSymlink2(path) {
   try {
-    return lstatSync2(path).isSymbolicLink();
+    return lstatSync4(path).isSymbolicLink();
   } catch {
     return false;
   }
 }
 function existsAsNonDirectory(path) {
   try {
-    return !statSync10(path).isDirectory();
+    return !statSync13(path).isDirectory();
   } catch {
     return false;
   }
@@ -34328,12 +35413,12 @@ async function runInit(argv) {
   ensureLayoutDirSync(home);
   const settings = settingsDir(home);
   ensureLayoutDirSync(settings);
-  const settingsFile = join21(settings, "settings.json");
+  const settingsFile = join29(settings, "settings.json");
   let settingsCreated = false;
-  if (!existsSync16(settingsFile)) {
+  if (!existsSync17(settingsFile)) {
     try {
       settingsCreated = withFileLock(settingsFile, () => {
-        if (existsSync16(settingsFile)) return false;
+        if (existsSync17(settingsFile)) return false;
         writeOwnerOnlyFileSync(
           settingsFile,
           `${JSON.stringify(defaultWorkspaceSettings(), null, 2)}
@@ -34362,7 +35447,7 @@ async function runInit(argv) {
   const symlinked = symlinkedStorePaths(home);
   process.stdout.write(
     `\u2713 Initialized AKA at ${home}
-  settings: ${settingsFile}${settingsCreated ? "" : existsSync16(settingsFile) ? " (kept existing)" : " (not written \u2014 another process was writing it)"}
+  settings: ${settingsFile}${settingsCreated ? "" : existsSync17(settingsFile) ? " (kept existing)" : " (not written \u2014 another process was writing it)"}
   database: ${dbPath(home)}
   seeded ${String(policyCount)} default policies, ${String(packCount)} detection pack(s)
 ` + (updatesAvailable > 0 ? `  \u2B06 ${String(updatesAvailable)} detection pack update(s) available \u2014 review with \`aka detections\`, apply with \`aka detections update --all\`
@@ -34412,7 +35497,7 @@ async function confirm(question) {
 }
 
 // src/commands/scan.ts
-import { statSync as statSync11 } from "fs";
+import { statSync as statSync14 } from "fs";
 import { parseArgs as parseArgs7 } from "util";
 function severityRank(s) {
   return Severity.options.indexOf(s);
@@ -34447,8 +35532,8 @@ async function runScan(argv) {
   }
   let failOn;
   if (values["fail-on"] !== void 0) {
-    const parsed = Severity.safeParse(values["fail-on"]);
-    if (!parsed.success) {
+    const parsed2 = Severity.safeParse(values["fail-on"]);
+    if (!parsed2.success) {
       process.stderr.write(
         `aka scan: invalid --fail-on '${values["fail-on"]}' (expected ${Severity.options.join(", ")})
 `
@@ -34456,10 +35541,10 @@ async function runScan(argv) {
       process.exitCode = 1;
       return;
     }
-    failOn = parsed.data;
+    failOn = parsed2.data;
   }
   try {
-    statSync11(target);
+    statSync14(target);
   } catch {
     process.stderr.write(`aka scan: no such file or directory: ${target}
 `);
@@ -35266,10 +36351,10 @@ import { parseArgs as parseArgs10 } from "util";
 
 // src/lib/install-origin.ts
 import { dirname as dirname10 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { fileURLToPath as fileURLToPath6 } from "url";
 function cliInstallOrigin() {
   try {
-    return { moduleDir: dirname10(fileURLToPath5(import.meta.url)) };
+    return { moduleDir: dirname10(fileURLToPath6(import.meta.url)) };
   } catch {
     return { moduleDir: void 0 };
   }
@@ -35445,8 +36530,8 @@ async function runShow2(argv, io) {
   if (candidate === void 0 || candidate === "") {
     throw new Error(`usage: aka vault show '[[aka:...]]'`);
   }
-  const parsed = PointerToken.safeParse(candidate);
-  if (!parsed.success) {
+  const parsed2 = PointerToken.safeParse(candidate);
+  if (!parsed2.success) {
     throw new Error(
       "that is not a vault pointer \u2014 expected the full [[aka:...]] token (quote it in the shell)"
     );
@@ -35461,7 +36546,7 @@ async function runShow2(argv, io) {
       // Read live so a consent revocation applies to the very next call.
       isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent)
     });
-    const value = await vault.detokenize(parsed.data, {
+    const value = await vault.detokenize(parsed2.data, {
       target: "human",
       reason: "explicit-reveal"
     });
@@ -35470,7 +36555,7 @@ async function runShow2(argv, io) {
     }
     io.out(`${value}
 `);
-    const descriptor = await vault.describePointer(parsed.data);
+    const descriptor = await vault.describePointer(parsed2.data);
     if (descriptor) io.out(`${descriptorLine(descriptor)}
 `);
   } finally {
@@ -35517,12 +36602,12 @@ function signalExitCode(signal) {
   return number4 === void 0 ? 1 : 128 + number4;
 }
 function dispatchExternal(command, argv, deps = {}) {
-  const spawn4 = deps.spawn ?? spawnSync2;
+  const spawn5 = deps.spawn ?? spawnSync2;
   const platform2 = deps.platform ?? process.platform;
   const exists = deps.exists ?? commandOnPath;
   if (!externalDispatchSupported(platform2)) return { found: false, status: 1 };
   const target = `aka-${command}`;
-  const result = spawn4(target, argv, { stdio: "inherit" });
+  const result = spawn5(target, argv, { stdio: "inherit" });
   if (result.error) {
     if (result.error.code === "ENOENT" && !exists(target)) return { found: false, status: 1 };
     process.stderr.write(`aka: ${target}: ${result.error.message}
@@ -35548,6 +36633,11 @@ var COMMANDS = {
   extension: runExtension,
   exception: (argv) => runException(argv),
   vault: (argv) => runVault(argv),
+  attach: (argv) => runAttach(argv),
+  detach: (argv) => {
+    runDetach(argv);
+  },
+  status: (argv) => runStatus(argv),
   tui: runTui,
   update: runUpdate,
   "check-updates": runCheckUpdates,
@@ -35570,7 +36660,7 @@ var SKIP_NOTICE = /* @__PURE__ */ new Set([
   "__dashboard-server",
   "completion"
 ]);
-var USAGE = `aka \u2014 AI Traffic Control (local-first, everything stays on your machine)
+var USAGE2 = `aka \u2014 AI Traffic Control (local-first; see the egress footnote in the README)
 
 Usage: aka <command> [options]
 
@@ -35602,7 +36692,7 @@ async function main(argv = process.argv.slice(2), dispatchDeps = {}) {
   }
   const [command, ...rawRest] = argv;
   if (!command || command === "-h" || command === "--help") {
-    process.stdout.write(USAGE);
+    process.stdout.write(USAGE2);
     return;
   }
   const noUpdateCheck = rawRest.includes("--no-update-check");
@@ -35618,7 +36708,7 @@ async function main(argv = process.argv.slice(2), dispatchDeps = {}) {
   if (!handler) {
     process.stderr.write(`aka: unknown command '${command}'
 
-${USAGE}`);
+${USAGE2}`);
     process.exitCode = 1;
     return;
   }