@akasecurity/cli 0.9.9 → 0.9.10

package/native-host/sync.js

@@ -21799,6 +21799,26 @@ var AttachTokenResponse = external_exports.union([
   AttachTokenExpired,
   external_exports.object({ status: printable(64) })
 ]);
+var DeviceCommandKind = external_exports.enum(["shares_rescan"]);
+var DeviceCommand = external_exports.object({
+  id: printable(128).min(1),
+  kind: DeviceCommandKind,
+  issuedAt: printable(64).min(1),
+  expiresAt: printable(64).min(1)
+}).strict();
+var DeviceCommandPollResponse = external_exports.object({ command: DeviceCommand.nullable() });
+var DeviceCommandFailureReason = external_exports.enum(["scan_failed", "no_projects", "expired"]);
+var DeviceCommandAckBody = external_exports.discriminatedUnion("outcome", [
+  external_exports.object({
+    outcome: external_exports.literal("reported"),
+    projectsScanned: external_exports.number().int().nonnegative()
+  }).strict(),
+  external_exports.object({
+    outcome: external_exports.literal("failed"),
+    reason: DeviceCommandFailureReason,
+    projectsScanned: external_exports.number().int().nonnegative()
+  }).strict()
+]);
 
 // ../../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -21965,7 +21985,7 @@ var PackManifest = external_exports.object({
 }).meta({ id: "PackManifest" });
 
 // ../../packages/schema/src/zod/detection.ts
-var OriginEnum = external_exports.enum(["library"]).meta({ id: "OriginEnum" });
+var OriginEnum = external_exports.enum(["library", "custom"]).meta({ id: "OriginEnum" });
 var DetectionFilterEnum = external_exports.enum(["all", "library", "custom", "customized", "updates"]);
 var LibraryStateEnum = external_exports.enum(["new", "imported", "update"]).meta({ id: "LibraryStateEnum" });
 var DetectionCounts = external_exports.object({
@@ -22160,8 +22180,9 @@ var Event = external_exports.object({
   metadata: EventMetadata.optional()
 }).meta({ id: "Event" });
 var IngestEvent = Event.meta({ id: "IngestEvent" });
+var INGEST_BATCH_MAX = 100;
 var IngestBatch = external_exports.object({
-  events: external_exports.array(IngestEvent).min(1).max(100),
+  events: external_exports.array(IngestEvent).min(1).max(INGEST_BATCH_MAX),
   // Dedup policy for this batch. Id-dedup ALWAYS applies. 'content-hash'
   // additionally rejects any event whose contentHash the store has already
   // recorded — for re-runnable bulk ingest (worktree scan, transcript
@@ -22287,6 +22308,225 @@ var PatchInstalledPackRequest = external_exports.object({
   message: "At least one field must be provided"
 }).meta({ id: "PatchInstalledPackRequest" });
 
+// ../../packages/schema/src/zod/policy.ts
+var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
+var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
+var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
+var PolicyProvenance = external_exports.enum(["builtin", "authored"]).meta({ id: "PolicyProvenance" });
+var Policy = external_exports.object({
+  id: external_exports.guid(),
+  scope: PolicyScope,
+  target: PolicyTarget,
+  action: ActionTaken,
+  enabled: external_exports.boolean().default(true),
+  customKeywords: external_exports.array(external_exports.string()).optional(),
+  // Display name — optional so older policy rows without name still parse.
+  // Added for the findings API (policy.name column migration).
+  name: external_exports.string().optional(),
+  // Whether an AUTHORED policy governs this row's target — not a claim about
+  // which row this is. A producer that collapses several rows onto one target
+  // must carry the marker onto whichever row survives, or the collapse decides
+  // the answer; a survivor may therefore be a built-in expansion still marked
+  // 'authored' because an authored sibling targeted the same thing.
+  // Optional so an older producer — and an older on-disk cache — still parses;
+  // absent reads as 'builtin', which is the behaviour that predates the field.
+  //
+  // Deliberately NOT `kind`/PolicyKind: that name and that enum answer which
+  // built-in archetype catalog entry a policy is, which every catalog surface
+  // reads and which a caller may state. This one is a statement the PRODUCER
+  // of a bundle makes about a row, and only the bundle builder ever stamps it
+  // — the CRUD routes neither accept nor set it.
+  //
+  // A device consumes this in exactly one direction: an 'authored' policy
+  // arriving from a control plane marks the rules it targets as not
+  // locally re-assignable. That can only ever ADD a refusal, never relax one,
+  // which is what makes it safe to honour from an unsigned cache — the same
+  // test `prohibitedModels` passes and `reversibleRuleIds` fails.
+  provenance: PolicyProvenance.optional()
+}).meta({ id: "Policy" });
+var PolicyBundle = external_exports.object({
+  version: external_exports.string(),
+  policies: external_exports.array(Policy),
+  // Rules from the installed marketplace packs (snapshotted by the
+  // control plane). The plugin registers these in addition to its bundled
+  // packs. Optional so older backends — and older on-disk caches — that omit
+  // the field still parse; consumers read `bundle.rules ?? []`.
+  rules: external_exports.array(Rule).optional(),
+  // When true, `rules` IS the complete effective ruleset and the runtime must
+  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
+  // after reading the user's installed snapshot (installed_packs, enabled
+  // packs only), which is how detection updates stay manual: new bundled
+  // rules run only after the user applies the pack update. Absent/false keeps
+  // the historical composition (bundled packs + rules) — older caches.
+  rulesComplete: external_exports.boolean().optional(),
+  // Active detection exceptions, evaluation subset only (see
+  // ExceptionBundleEntry). Optional so older bundle producers — and older
+  // on-disk caches — that omit the field still parse; consumers read
+  // `bundle.exceptions ?? []`.
+  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
+  // A second axis over the same `redact` action, carried beside the policies
+  // rather than on them: nothing writes ruleId-targeted policies to disk, so
+  // widening Policy itself would change a persisted shape to express something
+  // only the in-memory bundle needs. Optional so an older producer — or an
+  // older on-disk cache — still parses; consumers read `?? []` and get the
+  // pre-existing one-way behaviour, which is the safe direction to default.
+  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  // Model ids (the raw `model` string a harness reports, e.g.
+  // `claude-opus-4-1`) the tenant has PROHIBITED. The plugin refuses to switch
+  // a session onto one (PreModelSwitch) and refuses a turn that would run on
+  // one (UserPromptSubmit). Optional so an older backend — and an older
+  // on-disk cache — still parses; consumers read `?? []`, which is the
+  // unenforced behaviour that predates this field and the safe direction to
+  // default.
+  //
+  // Ids, not display names: the governance decision is keyed on the exact
+  // string the harness reports (`model_status_override.versionId` in the
+  // control plane), so no name resolution stands between the decision and the
+  // comparison.
+  prohibitedModels: external_exports.array(external_exports.string()).optional(),
+  customKeywords: external_exports.array(external_exports.string()),
+  fetchedAt: external_exports.iso.datetime()
+}).meta({ id: "PolicyBundle" });
+var POLICY_BUNDLE_SHAPE_ID = [
+  ...Object.keys(PolicyBundle.shape),
+  ...Object.keys(Policy.shape).map((key) => `policies.${key}`),
+  ...PolicyTarget.options.flatMap((member) => "shape" in member ? Object.keys(member.shape) : []).map((key) => `policies.target.${key}`),
+  ...Object.keys(ExceptionBundleEntry.shape).map((key) => `exceptions.${key}`)
+].sort().join(",");
+var OBSERVE_ONLY_CATEGORIES = ["config"];
+var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
+var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
+var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
+var RedactFallback = BuiltinPolicyId.extract(["monitor", "warn", "block"]).meta({
+  id: "RedactFallback"
+});
+var BUILTIN_POLICY_SPECS = {
+  monitor: {
+    name: "Monitor",
+    action: "log",
+    reversible: false,
+    description: "Log every match for audit. The request is allowed through untouched."
+  },
+  warn: {
+    name: "Warn",
+    action: "warn",
+    reversible: false,
+    description: "Allow the request, but warn the user inline before it is sent."
+  },
+  redact: {
+    name: "Redact",
+    action: "redact",
+    reversible: false,
+    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
+  },
+  vault: {
+    name: "Redact & Vault",
+    action: "redact",
+    reversible: true,
+    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
+  },
+  block: {
+    name: "Block",
+    action: "block",
+    reversible: false,
+    description: "Refuse the request entirely whenever any rule in this detection matches."
+  }
+};
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var PALETTE_WEAKEST_FIRST = [
+  ...new Set(KNOWN_BUILTIN_IDS.map(builtinPolicyToAction))
+];
+var BELOW_PALETTE = ACTION_TAKEN_KEYS.filter(
+  (action) => !PALETTE_WEAKEST_FIRST.includes(action)
+);
+var ACTION_STRENGTH_ORDER = [
+  ...BELOW_PALETTE,
+  ...PALETTE_WEAKEST_FIRST
+];
+var PackPolicyFloor = external_exports.object({
+  /**
+   * The weakest archetype the device may assign. Stated as a BuiltinPolicyId
+   * rather than a raw ActionTaken because that is the vocabulary the user
+   * picks from — a floor a UI cannot name is one it cannot explain.
+   */
+  floor: BuiltinPolicyId,
+  /**
+   * True when the organization AUTHORED a policy governing this pack rather
+   * than stating a minimum: it gave the answer, so the pack is not
+   * re-assignable locally in either direction.
+   */
+  locked: external_exports.boolean()
+}).describe("PackPolicyFloor");
+var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => !BUILTIN_POLICY_SPECS[id].reversible
+);
+var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
+  (id) => BUILTIN_POLICY_SPECS[id].reversible
+);
+var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
+var BUILTIN_POLICIES = Object.fromEntries(
+  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
+);
+var UsedByItem = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  ruleCount: external_exports.number().int().nonnegative(),
+  enabled: external_exports.boolean()
+}).meta({ id: "UsedByItem" });
+var PolicyListItem = external_exports.object({
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  usedByCount: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyListItem" });
+var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
+var PolicyDetail = external_exports.object({
+  specVersion: external_exports.literal(1),
+  id: external_exports.string(),
+  kind: PolicyKind,
+  name: external_exports.string(),
+  enabled: external_exports.boolean(),
+  description: external_exports.string(),
+  usedBy: external_exports.array(UsedByItem)
+}).meta({ id: "PolicyDetail" });
+var PolicyStatsResponse = external_exports.object({
+  policies: external_exports.number().int().nonnegative(),
+  builtin: external_exports.number().int().nonnegative(),
+  custom: external_exports.number().int().nonnegative(),
+  detectionsGoverned: external_exports.number().int().nonnegative()
+}).meta({ id: "PolicyStatsResponse" });
+
 // ../../packages/schema/src/zod/vault.ts
 var CATEGORY_ALTERNATION = DetectionCategory.options.join("|");
 var POINTER_TOKEN_PATTERN = new RegExp(
@@ -22323,6 +22563,14 @@ var VaultEntry = external_exports.object({
   // How many times this value has been detected on this machine — the reuse
   // signal the vault dashboard reads. Distinct from VaultDeref.pointerCount.
   occurrenceCount: external_exports.number().int().nonnegative(),
+  // True when a PERSON asked for this value to be replaced — the surfaced-
+  // secrets strike — rather than a pack enforcing its assignment. One value is
+  // one row however many paths vault it, so this is what tells a policy sweep
+  // that the row carries somebody's own instruction and not just an assignment
+  // that has since been lowered. STICKY and MONOTONIC: a later automatic
+  // vaulting of the same value must never clear it — what the user said about
+  // the value does not expire.
+  userAuthorized: external_exports.boolean(),
   firstSeen: external_exports.string(),
   lastSeen: external_exports.string()
 });
@@ -22439,7 +22687,7 @@ var VaultConsent = external_exports.object({
 });
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 6;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 7;
 var MODEL_JUDGE_PAYLOAD_VERSION = 1;
 var RunMode = external_exports.enum(["standalone", "attached"]);
 var ControlPlaneConnection = external_exports.object({
@@ -22481,6 +22729,19 @@ var WorkspaceSettings = external_exports.object({
   vaultKeyCustody: VaultKeyCustody.default("file"),
   // How a pointer renders in assistant prose on screen (see VaultInlineReveal).
   vaultInlineReveal: VaultInlineReveal.default("masked"),
+  // What a `redact` policy degrades to on a FIELD the host cannot rewrite in
+  // place. Not a handling policy: the policy has already resolved to redact,
+  // and this only says what happens when the host offers no channel to carry it
+  // out — Antigravity's PreToolUse has no updatedInput at all, and Codex and
+  // Claude Code decline to mask a field that EXECUTES because masking would
+  // change what runs. Per FIELD rather than per host, so a host that can
+  // rewrite some inputs keeps true redaction on those.
+  //
+  // Spelled in the built-in policy vocabulary rather than as a fresh enum, so
+  // an attached machine's merge is `strongerAction` over the one action ladder
+  // and no second rank order exists to drift from it. 'deny' is a host wire
+  // word and stays out of the stored value.
+  redactFallback: RedactFallback.default("warn"),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
   onboardedAt: external_exports.iso.datetime().optional(),
   // Records that the user consented to sending findings to the model API for
@@ -22488,10 +22749,12 @@ var WorkspaceSettings = external_exports.object({
   // Absent until granted; a stale payloadVersion means the consent no longer
   // covers the current payload and must be re-granted.
   modelJudgeConsent: ModelJudgeConsent.optional(),
-  // Records that the user consented to sending the activity already recorded on
-  // this machine to the deployment it is attached to, along with the payload
-  // shape and the endpoint they agreed to. Absent until granted, and a grant for
-  // a different endpoint or an older payload no longer counts.
+  // Records that the user consented to the DEFERRED send — the outbox — along
+  // with the payload shape and the endpoint they agreed to. Since payload v2
+  // that covers both the pre-attach backlog and undelivered captures (which
+  // carry prompt/reply text in `content`); the key name predates the widening.
+  // Absent until granted, and a grant for a different endpoint or an older
+  // payload no longer counts.
   historySyncConsent: HistorySyncConsent.optional()
 });
 function defaultWorkspaceSettings() {
@@ -22511,7 +22774,8 @@ var ManagedSettingKey = external_exports.enum([
   "vaultKeyCustody",
   "vaultInlineReveal",
   "modelJudgeConsent",
-  "dataSharesInPlace"
+  "dataSharesInPlace",
+  "redactFallback"
 ]).meta({ id: "ManagedSettingKey" });
 var ManagedSettingsValues = external_exports.object({
   runMode: external_exports.enum(["standalone", "attached"]).optional(),
@@ -22524,7 +22788,8 @@ var ManagedSettingsValues = external_exports.object({
   vaultKeyCustody: external_exports.enum(["file", "keychain"]).optional(),
   vaultInlineReveal: external_exports.enum(["masked", "full", "off"]).optional(),
   modelJudgeConsent: external_exports.boolean().optional(),
-  dataSharesInPlace: external_exports.boolean().optional()
+  dataSharesInPlace: external_exports.boolean().optional(),
+  redactFallback: RedactFallback.optional()
 }).meta({ id: "ManagedSettingsValues" });
 var ManagedSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(MANAGED_SETTINGS_SPEC_VERSION),
@@ -22539,171 +22804,6 @@ var ManagedSettings = external_exports.object({
   lockedFields: external_exports.array(ManagedSettingKey).default([])
 }).meta({ id: "ManagedSettings" });
 
-// ../../packages/schema/src/zod/policy.ts
-var PolicyScope = external_exports.enum(["global", "repo", "user"]).meta({ id: "PolicyScope" });
-var PolicyTarget = external_exports.union([external_exports.object({ ruleId: external_exports.string() }), external_exports.object({ category: DetectionCategory })]).meta({ id: "PolicyTarget" });
-var Policy = external_exports.object({
-  id: external_exports.guid(),
-  scope: PolicyScope,
-  target: PolicyTarget,
-  action: ActionTaken,
-  enabled: external_exports.boolean().default(true),
-  customKeywords: external_exports.array(external_exports.string()).optional(),
-  // Display name — optional so older policy rows without name still parse.
-  // Added for the findings API (policy.name column migration).
-  name: external_exports.string().optional()
-}).meta({ id: "Policy" });
-var PolicyBundle = external_exports.object({
-  version: external_exports.string(),
-  policies: external_exports.array(Policy),
-  // Rules from the installed marketplace packs (snapshotted by the
-  // control plane). The plugin registers these in addition to its bundled
-  // packs. Optional so older backends — and older on-disk caches — that omit
-  // the field still parse; consumers read `bundle.rules ?? []`.
-  rules: external_exports.array(Rule).optional(),
-  // When true, `rules` IS the complete effective ruleset and the runtime must
-  // NOT merge its compiled-in bundled packs — the standalone gateway sets this
-  // after reading the user's installed snapshot (installed_packs, enabled
-  // packs only), which is how detection updates stay manual: new bundled
-  // rules run only after the user applies the pack update. Absent/false keeps
-  // the historical composition (bundled packs + rules) — older caches.
-  rulesComplete: external_exports.boolean().optional(),
-  // Active detection exceptions, evaluation subset only (see
-  // ExceptionBundleEntry). Optional so older bundle producers — and older
-  // on-disk caches — that omit the field still parse; consumers read
-  // `bundle.exceptions ?? []`.
-  exceptions: external_exports.array(ExceptionBundleEntry).optional(),
-  // Rule ids whose pack is assigned a REVERSIBLE archetype (Redact & Vault).
-  // A second axis over the same `redact` action, carried beside the policies
-  // rather than on them: nothing writes ruleId-targeted policies to disk, so
-  // widening Policy itself would change a persisted shape to express something
-  // only the in-memory bundle needs. Optional so an older producer — or an
-  // older on-disk cache — still parses; consumers read `?? []` and get the
-  // pre-existing one-way behaviour, which is the safe direction to default.
-  reversibleRuleIds: external_exports.array(external_exports.string()).optional(),
-  // Installed pack version, keyed by ruleId, for rules in `rules` that came
-  // from a versioned installed pack. Optional so older backends — and older
-  // on-disk caches — that omit the field still parse; consumers fall back to
-  // the rule's own spec version. NOT the bundle version above — see
-  // installedRuleset's ruleVersions for the source of truth.
-  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  // Model ids (the raw `model` string a harness reports, e.g.
-  // `claude-opus-4-1`) the tenant has PROHIBITED. The plugin refuses to switch
-  // a session onto one (PreModelSwitch) and refuses a turn that would run on
-  // one (UserPromptSubmit). Optional so an older backend — and an older
-  // on-disk cache — still parses; consumers read `?? []`, which is the
-  // unenforced behaviour that predates this field and the safe direction to
-  // default.
-  //
-  // Ids, not display names: the governance decision is keyed on the exact
-  // string the harness reports (`model_status_override.versionId` in the
-  // control plane), so no name resolution stands between the decision and the
-  // comparison.
-  prohibitedModels: external_exports.array(external_exports.string()).optional(),
-  customKeywords: external_exports.array(external_exports.string()),
-  fetchedAt: external_exports.iso.datetime()
-}).meta({ id: "PolicyBundle" });
-var OBSERVE_ONLY_CATEGORIES = ["config"];
-var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
-var CATEGORY_PEAK_SEVERITY = {
-  secret: "critical",
-  financial: "critical",
-  // core-financial/credit-card
-  code_flaw: "critical",
-  pii: "high",
-  phi: "high",
-  custom: "high",
-  // user-defined; conservative
-  code_context: "low",
-  config: "low"
-  // observe-only; floors to monitor regardless
-};
-function severityFloorPolicy(category) {
-  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
-  const peak = CATEGORY_PEAK_SEVERITY[category];
-  return peak === "critical" || peak === "high" ? "warn" : "monitor";
-}
-var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
-var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "vault", "block"];
-var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
-var BUILTIN_POLICY_SPECS = {
-  monitor: {
-    name: "Monitor",
-    action: "log",
-    reversible: false,
-    description: "Log every match for audit. The request is allowed through untouched."
-  },
-  warn: {
-    name: "Warn",
-    action: "warn",
-    reversible: false,
-    description: "Allow the request, but warn the user inline before it is sent."
-  },
-  redact: {
-    name: "Redact",
-    action: "redact",
-    reversible: false,
-    description: "Strip the matched value from the request and destroy it, then continue. What was removed cannot be recovered."
-  },
-  vault: {
-    name: "Redact & Vault",
-    action: "redact",
-    reversible: true,
-    description: "Strip the matched value from the request and keep an encrypted, recoverable copy in the local vault, leaving a pointer in its place. Needs the vault consent granted under Settings; without it this behaves as Redact."
-  },
-  block: {
-    name: "Block",
-    action: "block",
-    reversible: false,
-    description: "Refuse the request entirely whenever any rule in this detection matches."
-  }
-};
-function builtinPolicyToAction(id) {
-  return BUILTIN_POLICY_SPECS[id].action;
-}
-var CATEGORY_EXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
-  (id) => !BUILTIN_POLICY_SPECS[id].reversible
-);
-var CATEGORY_INEXPRESSIBLE_IDS = KNOWN_BUILTIN_IDS.filter(
-  (id) => BUILTIN_POLICY_SPECS[id].reversible
-);
-var CategoryPolicyId = external_exports.enum(CATEGORY_EXPRESSIBLE_IDS).meta({ id: "CategoryPolicyId" });
-var DEFAULT_ACTIONS = Object.fromEntries(
-  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
-);
-var BUILTIN_POLICIES = Object.fromEntries(
-  KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
-);
-var UsedByItem = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  ruleCount: external_exports.number().int().nonnegative(),
-  enabled: external_exports.boolean()
-}).meta({ id: "UsedByItem" });
-var PolicyListItem = external_exports.object({
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  usedByCount: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyListItem" });
-var ListPoliciesResponse = external_exports.object({ items: external_exports.array(PolicyListItem) }).meta({ id: "ListPoliciesResponse" });
-var PolicyDetail = external_exports.object({
-  specVersion: external_exports.literal(1),
-  id: external_exports.string(),
-  kind: PolicyKind,
-  name: external_exports.string(),
-  enabled: external_exports.boolean(),
-  description: external_exports.string(),
-  usedBy: external_exports.array(UsedByItem)
-}).meta({ id: "PolicyDetail" });
-var PolicyStatsResponse = external_exports.object({
-  policies: external_exports.number().int().nonnegative(),
-  builtin: external_exports.number().int().nonnegative(),
-  custom: external_exports.number().int().nonnegative(),
-  detectionsGoverned: external_exports.number().int().nonnegative()
-}).meta({ id: "PolicyStatsResponse" });
-
 // ../../packages/schema/src/zod/project-files.ts
 var ProjectFileInput = external_exports.object({
   path: external_exports.string().min(1),
@@ -22943,10 +23043,12 @@ var DismissRecommendedActionResponse = external_exports.object({ id: external_ex
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
 // ../../packages/schema/src/zod/settings-action.ts
+var HistorySyncConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "HistorySyncConsentChoice" });
+var ModelJudgeConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "ModelJudgeConsentChoice" });
 var SaveSettingsInput = external_exports.object({
   historicalAccess: external_exports.string(),
-  modelJudgeConsent: external_exports.boolean(),
-  historySyncConsent: external_exports.boolean(),
+  modelJudgeConsent: ModelJudgeConsentChoice,
+  historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
   vaultInlineReveal: external_exports.string()
 });
@@ -23202,8 +23304,8 @@ function readControlPlaneCredentialFile(settingsDir2, connection) {
 }
 
 // ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join4, sep } from "path";
+import { randomUUID as randomUUID11 } from "crypto";
+import { dirname as dirname2, join as join7, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
 // ../../packages/persistence/src/ids.ts
@@ -23230,6 +23332,20 @@ function parseJsonObject(s) {
 
 // ../../packages/persistence/src/repositories/activity.ts
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
+var DB_EVENT_TYPE_TO_KIND = {
+  session: "session",
+  prompt: "prompt",
+  response: "response",
+  tool_call: "tool",
+  hook: "hook",
+  detection: "detection",
+  share: "share",
+  permission: "permission",
+  commit: "commit",
+  error: "error",
+  active: "active"
+};
+var TIMELINE_EVENT_TYPES = Object.keys(DB_EVENT_TYPE_TO_KIND).map((kind) => `'${kind}'`).join(", ");
 var DEFAULT_HARNESS = HARNESS.ClaudeCode;
 
 // ../../packages/persistence/src/repositories/exceptions.ts
@@ -23246,104 +23362,55 @@ var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
 // ../../packages/persistence/src/repositories/history-sync.ts
 var STRUCTURAL_EVENT_TYPES = ["session", "llm_call", "tool_call"];
 var TYPE_LIST = STRUCTURAL_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
+var OUTBOX_CAPTURE_EVENT_TYPES = ["prompt", "response", "tool_use"];
+var CAPTURE_TYPE_LIST = OUTBOX_CAPTURE_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-
-// ../../packages/persistence/src/repositories/inventory-assets.ts
-import { randomUUID as randomUUID4 } from "crypto";
-var VALID_HARNESS_IDS = new Set(HarnessId.options);
-var HARNESS_LABELS = {
-  [HARNESS.ClaudeCode]: "Claude Code",
-  [HARNESS.Cursor]: "Cursor",
-  [HARNESS.Codex]: "Codex",
-  [HARNESS.Antigravity]: "Antigravity"
-};
-var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
-var stripSeparators = (value) => value.toLowerCase().replace(/[\s-]/g, "");
-var TITLE_NEEDLES = {
-  ClaudeCode: stripSeparators(SOURCE_TOOL.ClaudeCode),
-  Cursor: stripSeparators(SOURCE_TOOL.Cursor),
-  Codex: stripSeparators(SOURCE_TOOL.Codex),
-  Antigravity: stripSeparators(SOURCE_TOOL.Antigravity)
-};
-
-// ../../packages/persistence/src/repositories/policies.ts
-import { randomUUID as randomUUID5 } from "crypto";
-
-// ../../packages/persistence/src/repositories/project-files.ts
-import { randomUUID as randomUUID6 } from "crypto";
-
-// ../../packages/persistence/src/repositories/resolutions.ts
-import { randomUUID as randomUUID7 } from "crypto";
-
-// ../../packages/persistence/src/repositories/secret-vault.ts
-import { randomUUID as randomUUID8 } from "crypto";
-
-// ../../packages/persistence/src/repositories/security.ts
-var SCAN_COVERAGE = {
-  [HARNESS.Antigravity]: { coverage: 60, supported: true },
-  [HARNESS.Api]: { coverage: 0, supported: false },
-  [HARNESS.ChatGpt]: { coverage: 40, supported: true },
-  [HARNESS.ClaudeAi]: { coverage: 40, supported: true },
-  [HARNESS.ClaudeCode]: { coverage: 100, supported: true },
-  [HARNESS.Codex]: { coverage: 80, supported: true },
-  [HARNESS.Copilot]: { coverage: 0, supported: false },
-  [HARNESS.Cursor]: { coverage: 0, supported: false }
-};
-
-// ../../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID9 } from "crypto";
-
-// ../../packages/persistence/src/file-lock.ts
-import { randomUUID as randomUUID11 } from "crypto";
-import {
-  closeSync,
-  existsSync as existsSync2,
-  openSync,
-  readFileSync as readFileSync2,
-  rmSync as rmSync5,
-  statSync as statSync3,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { hostname as hostname3 } from "os";
-var PARK = new Int32Array(new SharedArrayBuffer(4));
-
-// ../../packages/persistence/src/finding-key.ts
-import { createHash as createHash3 } from "crypto";
-
-// ../../packages/persistence/src/fingerprint.ts
-import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join5 } from "path";
-import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
 
-// ../../packages/persistence/src/history-preview.ts
-import { existsSync as existsSync4 } from "fs";
+// ../../packages/persistence/src/policy-floor.ts
+import { readFileSync as readFileSync5 } from "fs";
 import { join as join6 } from "path";
-import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
 // ../../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join7 } from "path";
+import { join as join4 } from "path";
 function defaultDataDir() {
-  return join7(homedir(), ".aka");
+  return join4(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join7(base, "settings");
+  return join4(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join7(base, "data");
+  return join4(base, "data");
 }
 async function ensureDataDir(dir = defaultDataDir()) {
   await mkdir(dir, { recursive: true, mode: DATA_DIR_MODE });
   tightenDir(dir);
 }
 
-// ../../packages/persistence/src/managed-settings.ts
+// ../../packages/persistence/src/settings.ts
 import { readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+
+// ../../packages/persistence/src/file-lock.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import {
+  closeSync,
+  existsSync as existsSync2,
+  openSync,
+  readFileSync as readFileSync2,
+  rmSync as rmSync5,
+  statSync as statSync3,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { hostname as hostname3 } from "os";
+var PARK = new Int32Array(new SharedArrayBuffer(4));
+
+// ../../packages/persistence/src/managed-settings.ts
+import { readFileSync as readFileSync3 } from "fs";
 import { posix, win32 } from "path";
 function managedSettingsPaths(platform2 = process.platform) {
   if (platform2 === "darwin") {
@@ -23361,7 +23428,7 @@ function readManagedSettings(paths = managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
-      text = readFileSync4(path, "utf8");
+      text = readFileSync3(path, "utf8");
     } catch {
       continue;
     }
@@ -23391,6 +23458,7 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
   if (values.vaultKeyCustody !== void 0) merged.vaultKeyCustody = values.vaultKeyCustody;
   if (values.vaultInlineReveal !== void 0) merged.vaultInlineReveal = values.vaultInlineReveal;
   if (values.dataSharesInPlace !== void 0) merged.dataSharesInPlace = values.dataSharesInPlace;
+  if (values.redactFallback !== void 0) merged.redactFallback = values.redactFallback;
   if (values.vaultConsent !== void 0) {
     merged.vaultConsent = values.vaultConsent ? (
       // Keep an existing valid grant so its acknowledgedAt survives; mint one
@@ -23408,14 +23476,12 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
   return overlayManagedSettings(readUserSettings(base), readManagedSettings());
 }
 function readUserSettings(base) {
-  const record2 = readJson(join8(settingsDir(base), SETTINGS_FILENAME));
+  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -23426,16 +23492,78 @@ function readUserSettings(base) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync5(file2, "utf8");
+    text = readFileSync4(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/repositories/inventory-assets.ts
+import { randomUUID as randomUUID5 } from "crypto";
+var VALID_HARNESS_IDS = new Set(HarnessId.options);
+var HARNESS_LABELS = {
+  [HARNESS.ClaudeCode]: "Claude Code",
+  [HARNESS.Cursor]: "Cursor",
+  [HARNESS.Codex]: "Codex",
+  [HARNESS.Antigravity]: "Antigravity"
+};
+var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
+var stripSeparators = (value) => value.toLowerCase().replace(/[\s-]/g, "");
+var TITLE_NEEDLES = {
+  ClaudeCode: stripSeparators(SOURCE_TOOL.ClaudeCode),
+  Cursor: stripSeparators(SOURCE_TOOL.Cursor),
+  Codex: stripSeparators(SOURCE_TOOL.Codex),
+  Antigravity: stripSeparators(SOURCE_TOOL.Antigravity)
+};
+
+// ../../packages/persistence/src/repositories/policies.ts
+import { randomUUID as randomUUID6 } from "crypto";
+
+// ../../packages/persistence/src/repositories/project-files.ts
+import { randomUUID as randomUUID7 } from "crypto";
+
+// ../../packages/persistence/src/repositories/resolutions.ts
+import { randomUUID as randomUUID8 } from "crypto";
+
+// ../../packages/persistence/src/repositories/secret-vault.ts
+import { randomUUID as randomUUID9 } from "crypto";
+
+// ../../packages/persistence/src/repositories/security.ts
+var SCAN_COVERAGE = {
+  [HARNESS.Antigravity]: { coverage: 60, supported: true },
+  [HARNESS.Api]: { coverage: 0, supported: false },
+  [HARNESS.ChatGpt]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeAi]: { coverage: 40, supported: true },
+  [HARNESS.ClaudeCode]: { coverage: 100, supported: true },
+  [HARNESS.Codex]: { coverage: 80, supported: true },
+  [HARNESS.Copilot]: { coverage: 0, supported: false },
+  [HARNESS.Cursor]: { coverage: 0, supported: false }
+};
+
+// ../../packages/persistence/src/repositories/shares.ts
+import { randomUUID as randomUUID10 } from "crypto";
+
+// ../../packages/persistence/src/database.ts
+var CAPTURE_GRAIN = new Set(EventKind.options);
+
+// ../../packages/persistence/src/finding-key.ts
+import { createHash as createHash3 } from "crypto";
+
+// ../../packages/persistence/src/fingerprint.ts
+import { createHmac, randomBytes } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+
+// ../../packages/persistence/src/history-preview.ts
+import { existsSync as existsSync4 } from "fs";
+import { join as join9 } from "path";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+
 // ../../packages/persistence/src/store-symlinks.ts
 import { existsSync as existsSync5, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
-import { dirname as dirname2, join as join9, resolve } from "path";
+import { dirname as dirname3, join as join10, resolve } from "path";
 
 // ../../packages/persistence/src/vault/crypto.ts
 import {
@@ -23449,47 +23577,421 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync3, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join10 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join11 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
 import { existsSync as existsSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
-// ../../packages/plugin-runtime/src/attached/failure.ts
-function statusOf(err) {
-  if (typeof err !== "object" || err === null || !("status" in err)) return null;
-  const { status } = err;
-  if (typeof status !== "number" || !Number.isInteger(status)) return null;
-  return status >= 100 && status <= 599 ? status : null;
-}
-function classifyFailure(err) {
-  switch (statusOf(err)) {
-    case 401:
-      return "unauthorized";
-    case 403:
+// ../../packages/remote/src/http.ts
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+var RemoteRequestError = class extends Error {
+  constructor(status) {
+    super(`control-plane request failed with status ${String(status)}`);
+    this.status = status;
+    this.name = "RemoteRequestError";
+  }
+  status;
+};
+var RemoteRouteAbsent = class extends Error {
+  constructor(route) {
+    super(`control plane does not serve ${route}`);
+    this.route = route;
+    this.name = "RemoteRouteAbsent";
+  }
+  route;
+};
+var RemoteRequestInvalid = class extends Error {
+  constructor(route, cause) {
+    super(`refusing to send a malformed body to ${route}`);
+    this.cause = cause;
+    this.name = "RemoteRequestInvalid";
+  }
+  cause;
+};
+var RemoteResponseInvalid = class extends Error {
+  constructor(route, detail) {
+    super(`control plane answered ${route} with ${detail}`);
+    this.name = "RemoteResponseInvalid";
+  }
+};
+var RemoteTransportError = class extends Error {
+  /**
+   * The status the peer sent, when headers arrived and only the BODY was
+   * refused.
+   *
+   * Undefined for the ordinary case this class was written for — no answer at
+   * all. It exists because two paths reject after a status has already been
+   * delivered: an oversized body and an aborted response. Discarding it there
+   * reported a deployment answering 401 with a verbose body as a network
+   * outage, which sends the reader to look at their network instead of their
+   * credential.
+   */
+  constructor(reason, status) {
+    super(`control-plane request did not complete: ${reason}`);
+    this.status = status;
+    this.name = "RemoteTransportError";
+  }
+  status;
+};
+async function send(options) {
+  const url2 = new URL(options.url);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const send_ = url2.protocol === "http:" ? httpRequest : httpsRequest;
+  const requestOptions = {
+    method: options.method,
+    headers: {
+      // CALLER HEADERS FIRST, so this module's own are not overridable. Spread
+      // last they win, and two of the values below are ones no caller may
+      // replace: `x-api-key` is the credential, and `content-length` is the
+      // byte count that stops a multi-byte body being truncated by the
+      // receiver. `SendOptions.headers` is a free-form record on an exported
+      // function, so "no caller does that today" is not the guarantee to rely
+      // on. The one header any caller actually passes — `if-none-match` on the
+      // conditional GET — is untouched by this order.
+      ...options.headers,
+      // The credential. One header, matching what the deployment authenticates
+      // on; a second copy in an `Authorization` header would be one more place
+      // it can be logged by an intermediary for no gain.
+      //
+      // Spread conditionally rather than assigned as `undefined`: Node's header
+      // handling and `content-length` bookkeeping treat a present-but-undefined
+      // key differently from an absent one, and "the header is not there" is
+      // the property the attach flow needs.
+      ...options.apiKey === void 0 ? {} : { "x-api-key": options.apiKey },
+      accept: "application/json",
+      ...options.body === void 0 ? {} : {
+        "content-type": "application/json",
+        // Byte length, not string length: a multi-byte body sent with a
+        // character count is truncated by the receiver.
+        "content-length": String(Buffer.byteLength(options.body))
+      }
+    }
+  };
+  return new Promise((resolve2, reject) => {
+    let settled = false;
+    const fail = (reason, status) => {
+      if (settled) return;
+      settled = true;
+      reject(new RemoteTransportError(reason, status));
+    };
+    const req = send_(url2, requestOptions, (res) => {
+      const chunks = [];
+      let size = 0;
+      res.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_RESPONSE_BYTES) {
+          fail(`response exceeded ${String(MAX_RESPONSE_BYTES)} bytes`, res.statusCode);
+          res.destroy();
+          req.destroy();
+          return;
+        }
+        chunks.push(chunk);
+      });
+      res.on("aborted", () => {
+        fail("the response was aborted", res.statusCode);
+      });
+      res.on("end", () => {
+        if (settled) return;
+        settled = true;
+        resolve2({
+          status: res.statusCode ?? 0,
+          headers: res.headers,
+          body: Buffer.concat(chunks).toString("utf8")
+        });
+      });
+    });
+    const deadline = setTimeout(() => {
+      fail(`no response within ${String(timeoutMs)}ms`);
+      req.destroy();
+    }, timeoutMs);
+    deadline.unref();
+    req.on("upgrade", (_res, socket) => {
+      fail("the deployment answered with a protocol upgrade");
+      socket.destroy();
+    });
+    req.on("close", () => {
+      fail("the connection closed before a response was read");
+      clearTimeout(deadline);
+    });
+    req.on("error", (err) => {
+      fail(err.message);
+    });
+    if (options.body !== void 0) req.write(options.body);
+    req.end();
+  });
+}
+
+// ../../packages/remote/src/client.ts
+var ROUTES = {
+  events: "/v1/events",
+  auditEvents: "/v1/audit-events",
+  auditEventsBatch: "/v1/audit-events/batch",
+  inventory: "/v1/inventory",
+  storePosture: "/v1/store-posture",
+  policyBundle: "/v1/policy-bundle",
+  whoami: "/v1/plugin/whoami",
+  shares: "/v1/shares",
+  commands: "/v1/plugin/commands"
+};
+function ackRoute(id) {
+  return `${ROUTES.commands}/${encodeURIComponent(id)}/ack`;
+}
+function headerValue(response, name) {
+  const raw = response.headers[name];
+  if (raw === void 0) return void 0;
+  return Array.isArray(raw) ? raw[0] : raw;
+}
+function okBody(response) {
+  if (response.status < 200 || response.status >= 300) {
+    throw new RemoteRequestError(response.status);
+  }
+  return response.body;
+}
+function parsed(schema, body, route) {
+  let json2;
+  try {
+    json2 = JSON.parse(body);
+  } catch {
+    throw new RemoteResponseInvalid(route, "a body that is not JSON");
+  }
+  const result = schema.safeParse(json2);
+  if (!result.success) {
+    throw new RemoteResponseInvalid(route, "a body this client cannot read");
+  }
+  return result.data;
+}
+function withoutTrailingSlashes(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
+  return endpoint.slice(0, end);
+}
+var SLASH = "/".charCodeAt(0);
+function createRemoteClient(options) {
+  const base = withoutTrailingSlashes(options.endpoint);
+  const url2 = (route) => `${base}${route}`;
+  const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
+  const sendOne = async (event) => {
+    const validated = RecordAuditEventRequest.safeParse(event);
+    if (!validated.success) throw new RemoteRequestInvalid(ROUTES.auditEvents, validated.error);
+    const response = await send({
+      ...common,
+      method: "POST",
+      url: url2(ROUTES.auditEvents),
+      body: JSON.stringify(validated.data)
+    });
+    okBody(response);
+  };
+  return {
+    async ingestEvents(batch) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.events),
+        body: JSON.stringify(batch)
+      });
+      return parsed(IngestAck, okBody(response), ROUTES.events);
+    },
+    async ingestInventory(context) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.inventory),
+        body: JSON.stringify(context)
+      });
+      return parsed(ResolvedInventory, okBody(response), ROUTES.inventory);
+    },
+    async recordAuditEvent(event) {
+      await sendOne(event);
+    },
+    async recordAuditEvents(events, opts) {
+      const validated = RecordAuditEventBatch.safeParse({ events });
+      if (!validated.success) {
+        throw new RemoteRequestInvalid(ROUTES.auditEventsBatch, validated.error);
+      }
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.auditEventsBatch),
+        body: JSON.stringify(validated.data)
+      });
+      if (response.status === 404) {
+        if (opts?.fallbackToSingleEvents !== true) {
+          throw new RemoteRouteAbsent(ROUTES.auditEventsBatch);
+        }
+        for (const event of validated.data.events) await sendOne(event);
+        return { accepted: validated.data.events.length };
+      }
+      return parsed(AuditEventBatchAck, okBody(response), ROUTES.auditEventsBatch);
+    },
+    async reportStorePosture(snapshot) {
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.storePosture),
+        body: JSON.stringify(snapshot)
+      });
+      okBody(response);
+    },
+    async getPolicyBundle(etag) {
+      const response = await send({
+        ...common,
+        method: "GET",
+        url: url2(ROUTES.policyBundle),
+        ...etag === void 0 ? {} : { headers: { "if-none-match": etag } }
+      });
+      if (response.status === 304) {
+        return { changed: false, etag: headerValue(response, "etag") ?? etag };
+      }
+      const bundle = parsed(PolicyBundle, okBody(response), ROUTES.policyBundle);
+      return { changed: true, bundle, etag: headerValue(response, "etag") };
+    },
+    async whoami() {
+      const response = await send({ ...common, method: "GET", url: url2(ROUTES.whoami) });
+      return parsed(PluginWhoami, okBody(response), ROUTES.whoami);
+    },
+    async recordProjectEgress(request) {
+      const validated = EgressIngestRequest.safeParse(request);
+      if (!validated.success) throw new RemoteRequestInvalid(ROUTES.shares, validated.error);
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(ROUTES.shares),
+        body: JSON.stringify(validated.data)
+      });
+      okBody(response);
+    },
+    async pollCommand() {
+      const response = await send({ ...common, method: "GET", url: url2(ROUTES.commands) });
+      if (response.status === 404) return null;
+      return parsed(DeviceCommandPollResponse, okBody(response), ROUTES.commands).command;
+    },
+    async ackCommand(id, body) {
+      const validated = DeviceCommandAckBody.safeParse(body);
+      const route = ackRoute(id);
+      if (!validated.success) throw new RemoteRequestInvalid(route, validated.error);
+      const response = await send({
+        ...common,
+        method: "POST",
+        url: url2(route),
+        body: JSON.stringify(validated.data)
+      });
+      okBody(response);
+    }
+  };
+}
+
+// ../../packages/plugin-runtime/src/attached/failure.ts
+function statusOf(err) {
+  if (typeof err !== "object" || err === null || !("status" in err)) return null;
+  const { status } = err;
+  if (typeof status !== "number" || !Number.isInteger(status)) return null;
+  return status >= 100 && status <= 599 ? status : null;
+}
+function classifyFailure(err) {
+  switch (statusOf(err)) {
+    case 401:
+      return "unauthorized";
+    case 403:
       return "forbidden";
     default:
       return "unreachable";
   }
 }
 
+// ../../packages/plugin-runtime/src/attached/with-timeout.ts
+function withTimeout(promise2, ms) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error("attached gateway request timed out"));
+    }, ms);
+  });
+  promise2.catch(() => void 0);
+  return Promise.race([promise2, timeout]).finally(() => {
+    clearTimeout(timer);
+  });
+}
+
+// ../../packages/plugin-runtime/src/attached/command-sync.ts
+var COMMAND_REQUEST_TIMEOUT_MS = 3e4;
+var SCAN_THREW = "scan_failed";
+var SCAN_FOUND_NOTHING = "no_projects";
+var COMMAND_EXPIRED = "expired";
+function hasExpired(expiresAt, atMs) {
+  const deadlineMs = Date.parse(expiresAt);
+  return Number.isFinite(deadlineMs) && deadlineMs <= atMs;
+}
+var SERVICE = {
+  shares_rescan: (scan2) => scan2()
+};
+async function runCommandSync(deps) {
+  if (deps.scan === void 0) return null;
+  const settings = readWorkspaceSettings(deps.base);
+  const connection = isAttached(settings) ? settings.controlPlane : void 0;
+  const state = connection === void 0 ? void 0 : readControlPlaneCredentialFile(deps.settingsDir, connection);
+  if (connection === void 0 || !state?.usable) return null;
+  const client = createRemoteClient({
+    endpoint: connection.endpoint,
+    apiKey: state.credential.apiKey,
+    timeoutMs: COMMAND_REQUEST_TIMEOUT_MS
+  });
+  let command;
+  try {
+    command = await withTimeout(client.pollCommand(), COMMAND_REQUEST_TIMEOUT_MS);
+  } catch (err) {
+    const failure = classifyFailure(err);
+    return failure === "unreachable" ? "unreachable" : failure;
+  }
+  if (command === null) return "none";
+  let projects = 0;
+  let reason = null;
+  if (hasExpired(command.expiresAt, (deps.now ?? Date.now)())) {
+    reason = COMMAND_EXPIRED;
+  } else {
+    try {
+      projects = (await SERVICE[command.kind](deps.scan)).projects;
+      if (projects === 0) reason = SCAN_FOUND_NOTHING;
+    } catch {
+      reason = SCAN_THREW;
+    }
+  }
+  try {
+    await withTimeout(
+      reason === null ? client.ackCommand(command.id, { outcome: "reported", projectsScanned: projects }) : client.ackCommand(command.id, {
+        outcome: "failed",
+        reason,
+        projectsScanned: projects
+      }),
+      COMMAND_REQUEST_TIMEOUT_MS
+    );
+  } catch (err) {
+    const failure = classifyFailure(err);
+    return failure === "unreachable" ? "unreachable" : failure;
+  }
+  return reason === null ? "reported" : "failed";
+}
+
 // ../../packages/plugin-runtime/src/attached/forward-drops.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join12 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join13 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/forward-policy.ts
 import { randomUUID as randomUUID15 } from "crypto";
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { readFile, rename, writeFile } from "fs/promises";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 
 // ../../packages/plugin-sdk/src/config.ts
 import { existsSync as existsSync7 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -23510,9 +24012,9 @@ var providerEnvShape = {
 var ProviderEnvSchema = external_exports.object(providerEnvShape);
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join15 } from "path";
+import { basename as basename3, join as join16 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -24009,637 +24511,359 @@ var PROVIDER_REGISTRY = [
     }
   },
   {
-    id: "huggingface",
-    name: "Hugging Face",
-    category: "LLM provider",
-    hostSuffixes: ["huggingface.co"],
-    apiBase: "https://api-inference.huggingface.co",
-    defaultDataClasses: ["source"],
-    sdks: {
-      npm: ["@huggingface/inference"],
-      pypi: ["huggingface-hub", "transformers"],
-      rubygems: ["hugging-face"]
-    }
-  },
-  {
-    id: "cohere",
-    name: "Cohere",
-    category: "LLM provider",
-    hostSuffixes: ["cohere.com", "cohere.ai"],
-    apiBase: "https://api.cohere.com",
-    defaultDataClasses: ["pii", "source"],
-    sdks: {
-      npm: ["cohere-ai"],
-      pypi: ["cohere"],
-      go: ["github.com/cohere-ai/cohere-go"]
-    }
-  },
-  {
-    id: "mistral",
-    name: "Mistral AI",
-    category: "LLM provider",
-    hostSuffixes: ["mistral.ai"],
-    apiBase: "https://api.mistral.ai",
-    defaultDataClasses: ["pii", "source"],
-    sdks: {
-      npm: ["@mistralai/mistralai"],
-      pypi: ["mistralai"],
-      go: ["github.com/gage-technologies/mistral-go"]
-    }
-  }
-];
-var EGRESS_VERSION_MATERIAL = `${EXTRACTOR_VERSION}
-${JSON.stringify(PROVIDER_REGISTRY)}`;
-
-// ../../packages/detections/src/egress/extract.ts
-var SECRET_KEY_NAMES = "api[_-]?key|apikey|private[_-]?key|access[_-]?key|access[_-]?token|token|secret|credentials?|password|passwd|pwd|authorization|sig|signature|sas|assertion";
-var AUTH_SCHEMES = "Bearer|Basic|Token|Digest|ApiKey|SSWS|AWS4-HMAC-SHA256";
-var SECRET_VALUE = new RegExp(
-  `((?:${SECRET_KEY_NAMES})['"\`]?\\s*[:=]\\s*['"\`]?)(?!(?:${AUTH_SCHEMES})[\\s'"\`])[^\\s'"\`&]+`,
-  "gi"
-);
-var AUTH_SCHEME_VALUE = new RegExp(
-  `((?:${SECRET_KEY_NAMES})['"\`]?\\s*[:=]\\s*['"\`]?)(${AUTH_SCHEMES})\\s+[^\\s'"\`]+`,
-  "gi"
-);
-var WEBHOOK_SECRET_PATHS = [
-  { hosts: ["hooks.slack.com"], prefix: "/services/" },
-  {
-    hosts: ["discord.com", "discordapp.com", "ptb.discord.com", "canary.discord.com"],
-    prefix: "/api/webhooks/"
-  },
-  { hosts: ["hooks.zapier.com"], prefix: "/hooks/" },
-  { hosts: ["outlook.office.com", "outlook.office365.com"], prefix: "/webhook/" }
-];
-function escapeRegExp(literal2) {
-  return literal2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-var WEBHOOK_URL = new RegExp(
-  `(https?://(?:${WEBHOOK_SECRET_PATHS.flatMap(
-    (entry) => entry.hosts.map((host) => `${escapeRegExp(host)}${escapeRegExp(entry.prefix)}`)
-  ).join("|")}))[^\\s'"\`<>()[\\]{},;]+`,
-  "gi"
-);
-
-// ../../packages/detections/src/escape-regexp.ts
-function escapeRegExp2(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-// ../../packages/detections/src/regex-cache.ts
-var singles = /* @__PURE__ */ new WeakMap();
-var keywordLists = /* @__PURE__ */ new WeakMap();
-var labelLists = /* @__PURE__ */ new WeakMap();
-function listCache(kind) {
-  return kind === "keyword" ? keywordLists : labelLists;
-}
-function memoizedRegExp(owner, build) {
-  const cached2 = singles.get(owner);
-  if (cached2 !== void 0) {
-    cached2.lastIndex = 0;
-    return cached2;
-  }
-  const compiled = build();
-  singles.set(owner, compiled);
-  return compiled;
-}
-function memoizedRegExpList(kind, owner, build) {
-  const cache = listCache(kind);
-  const cached2 = cache.get(owner);
-  if (cached2 !== void 0) {
-    if (cached2.stateful) {
-      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
-    }
-    return cached2.entries;
-  }
-  const entries = build();
-  cache.set(owner, {
-    entries,
-    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
-  });
-  return entries;
-}
-
-// ../../packages/detections/src/matchers/limits.ts
-var MAX_MATCHES_PER_RULE = 1e4;
-var MAX_REGEX_INPUT_LENGTH = 2e5;
-
-// ../../packages/detections/src/matchers/keyword.ts
-var KeywordMatcher2 = class {
-  match(text, rule) {
-    if (rule.matcher.type !== "keyword") return [];
-    const { keywords, caseSensitive } = rule.matcher;
-    const spans = [];
-    const compiled = memoizedRegExpList(
-      "keyword",
-      rule.matcher,
-      () => keywords.map((kw) => {
-        if (kw.length === 0) return void 0;
-        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
-      })
-    );
-    for (const re of compiled) {
-      if (re === void 0) continue;
-      if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      let m;
-      while ((m = re.exec(text)) !== null) {
-        spans.push({ start: m.index, end: m.index + m[0].length });
-        if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      }
-    }
-    return spans;
-  }
-};
-
-// ../../packages/detections/src/matchers/regex.ts
-var RegexMatcher2 = class {
-  match(text, rule) {
-    if (rule.matcher.type !== "regex") return [];
-    const { pattern, flags, captureGroup } = rule.matcher;
-    const re = memoizedRegExp(
-      rule.matcher,
-      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
-    );
-    const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
-    const spans = [];
-    let m;
-    const maxIterations = scanText2.length + 1;
-    let iterations = 0;
-    while ((m = re.exec(scanText2)) !== null) {
-      if (++iterations > maxIterations) break;
-      const group = captureGroup != null ? m[captureGroup] : m[0];
-      if (m[0].length === 0) re.lastIndex++;
-      if (group && spans.length < MAX_MATCHES_PER_RULE) {
-        const groupIndices = captureGroup != null ? m.indices?.[captureGroup] : void 0;
-        const start = groupIndices ? groupIndices[0] : m.index;
-        spans.push({ start, end: start + group.length });
-      }
-      if (!flags.includes("g") || spans.length >= MAX_MATCHES_PER_RULE) break;
-    }
-    return spans;
-  }
-};
-
-// ../../packages/detections/src/engine.ts
-var keywordMatcher = new KeywordMatcher2();
-var regexMatcher = new RegexMatcher2();
-
-// ../../packages/detections/src/posture/config-posture.ts
-var RULE_VERSION = "1";
-var KNOWN_TOOLS = /* @__PURE__ */ new Set([
-  "prettier",
-  "eslint",
-  "biome",
-  "black",
-  "ruff",
-  "gofmt",
-  "rustfmt",
-  "node",
-  "npx",
-  "npm",
-  "pnpm",
-  "yarn",
-  "make",
-  "git",
-  "jq",
-  "echo"
-]);
-var EGRESS_RE = /\b(curl|wget|nc|ncat|netcat|ssh|scp|rsync)\b|https?:\/\//;
-var MUTATION_RE = /(--write|--fix|\s-w\b|\s-i\b|(?<![\d&>])>\s?\S)/;
-var CONFIG_POSTURE_RULES = [
-  {
-    ruleId: "hook-conflict",
-    version: RULE_VERSION,
-    name: "Overlapping hooks \u2014 run order is undefined",
-    category: "config",
-    severity: "medium",
-    definition: JSON.stringify({
-      kind: "hook-conflict",
-      mutation: MUTATION_RE.source,
-      note: "two hooks on the same event with overlapping matchers, both mutating the tool target"
-    })
+    id: "huggingface",
+    name: "Hugging Face",
+    category: "LLM provider",
+    hostSuffixes: ["huggingface.co"],
+    apiBase: "https://api-inference.huggingface.co",
+    defaultDataClasses: ["source"],
+    sdks: {
+      npm: ["@huggingface/inference"],
+      pypi: ["huggingface-hub", "transformers"],
+      rubygems: ["hugging-face"]
+    }
   },
   {
-    ruleId: "hook-unknown",
-    version: RULE_VERSION,
-    name: "Unknown hook \u2014 not attributable to a plugin or known tool",
-    category: "config",
-    // medium, not high: with a deliberately tiny allowlist this v1 heuristic
-    // fires on ordinary interpreter hooks (python3 x.py) and compound commands
-    // (cd … && tool); 'high' is reserved for egress, which is genuinely
-    // dangerous. Revisit when the known-hooks registry replaces the allowlist.
-    severity: "medium",
-    definition: JSON.stringify({ kind: "hook-unknown", knownTools: [...KNOWN_TOOLS] })
+    id: "cohere",
+    name: "Cohere",
+    category: "LLM provider",
+    hostSuffixes: ["cohere.com", "cohere.ai"],
+    apiBase: "https://api.cohere.com",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["cohere-ai"],
+      pypi: ["cohere"],
+      go: ["github.com/cohere-ai/cohere-go"]
+    }
   },
   {
-    ruleId: "hook-external-egress",
-    version: RULE_VERSION,
-    name: "Hook command can send data externally",
-    category: "config",
-    severity: "high",
-    definition: JSON.stringify({ kind: "hook-external-egress", pattern: EGRESS_RE.source })
-  }
-];
-
-// ../../packages/detections/src/security/redos-probe.ts
-var BUDGET_MS = 100;
-var EXPONENTIAL_UNITS = [
-  "a",
-  "0",
-  " ",
-  "x",
-  "ab",
-  "a.",
-  "a-",
-  "a_",
-  "a@",
-  "a/",
-  "a:",
-  "a=",
-  "a;",
-  "aA0",
-  "	"
-];
-var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
-  (unit) => [23, 25].map((len) => unit.repeat(Math.ceil(len / unit.length)).slice(0, len) + "!")
-);
-var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
-  (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
-);
-var CPU_CORROBORATION_SHARE = 0.2;
-var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
-
-// ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, statSync as statSync6 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute, join as join14, sep as sep2 } from "path";
-
-// ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash5, randomUUID as randomUUID13 } from "crypto";
-
-// ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync9 } from "fs";
-import { fileURLToPath } from "url";
-import { Worker } from "worker_threads";
-
-// ../../packages/plugin-sdk/src/ignore-layers.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join16 } from "path";
-
-// ../../packages/plugin-sdk/src/inventory-resolver.ts
-import { arch, hostname as hostname4, platform, release } from "os";
-
-// ../../packages/plugin-sdk/src/model-governance.ts
-import {
-  closeSync as closeSync2,
-  fstatSync,
-  mkdirSync as mkdirSync2,
-  openSync as openSync2,
-  readFileSync as readFileSync11,
-  readSync,
-  writeFileSync as writeFileSync5
-} from "fs";
-import { join as join17 } from "path";
-var TAIL_BYTES = 256 * 1024;
-
-// ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "fs";
-import { join as join18 } from "path";
-
-// ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
-import { basename as basename4, dirname as dirname4, sep as sep3 } from "path";
-
-// ../../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync10, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join19 } from "path";
-
-// ../../packages/plugin-sdk/src/provider-env-antigravity.ts
-var optionalBaseUrl2 = external_exports.preprocess((v) => {
-  if (typeof v === "string" && v.trim() === "") return void 0;
-  return v;
-}, external_exports.string().optional()).catch(void 0);
-var optionalFlag = external_exports.preprocess((v) => {
-  if (typeof v !== "string") return false;
-  const normalized = v.trim().toLowerCase();
-  return normalized !== "" && normalized !== "0" && normalized !== "false";
-}, external_exports.boolean()).catch(false);
-var antigravityProviderEnvShape = {
-  GOOGLE_GENAI_USE_VERTEXAI: optionalFlag,
-  GOOGLE_GEMINI_BASE_URL: optionalBaseUrl2
-};
-var AntigravityProviderEnvSchema = external_exports.object(antigravityProviderEnvShape);
-
-// ../../packages/plugin-sdk/src/provider-env-codex.ts
-var optionalBaseUrl3 = external_exports.preprocess((v) => {
-  if (typeof v === "string" && v.trim() === "") return void 0;
-  return v;
-}, external_exports.string().optional()).catch(void 0);
-var codexProviderEnvShape = {
-  OPENAI_BASE_URL: optionalBaseUrl3
-};
-var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
-
-// ../../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID14 } from "crypto";
-
-// ../../packages/plugin-sdk/src/suppressions.ts
-var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
-
-// ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
-import { join as join20 } from "path";
-
-// ../../packages/plugin-runtime/src/attached/with-timeout.ts
-function withTimeout(promise2, ms) {
-  let timer;
-  const timeout = new Promise((_, reject) => {
-    timer = setTimeout(() => {
-      reject(new Error("attached gateway request timed out"));
-    }, ms);
-  });
-  promise2.catch(() => void 0);
-  return Promise.race([promise2, timeout]).finally(() => {
-    clearTimeout(timer);
-  });
-}
-
-// ../../packages/plugin-runtime/src/attached/history-state.ts
-import { readFileSync as readFileSync14 } from "fs";
-import { join as join22 } from "path";
-
-// ../../packages/plugin-runtime/src/attached/history-sync.ts
-import { createHash as createHash6 } from "crypto";
-import { hostname as hostname5 } from "os";
-
-// ../../packages/remote/src/http.ts
-import { request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-var DEFAULT_TIMEOUT_MS = 1e4;
-var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
-var RemoteRequestError = class extends Error {
-  constructor(status) {
-    super(`control-plane request failed with status ${String(status)}`);
-    this.status = status;
-    this.name = "RemoteRequestError";
-  }
-  status;
-};
-var RemoteRequestInvalid = class extends Error {
-  constructor(route, cause) {
-    super(`refusing to send a malformed body to ${route}`);
-    this.cause = cause;
-    this.name = "RemoteRequestInvalid";
-  }
-  cause;
-};
-var RemoteResponseInvalid = class extends Error {
-  constructor(route, detail) {
-    super(`control plane answered ${route} with ${detail}`);
-    this.name = "RemoteResponseInvalid";
-  }
-};
-var RemoteTransportError = class extends Error {
-  /**
-   * The status the peer sent, when headers arrived and only the BODY was
-   * refused.
-   *
-   * Undefined for the ordinary case this class was written for — no answer at
-   * all. It exists because two paths reject after a status has already been
-   * delivered: an oversized body and an aborted response. Discarding it there
-   * reported a deployment answering 401 with a verbose body as a network
-   * outage, which sends the reader to look at their network instead of their
-   * credential.
-   */
-  constructor(reason, status) {
-    super(`control-plane request did not complete: ${reason}`);
-    this.status = status;
-    this.name = "RemoteTransportError";
-  }
-  status;
-};
-async function send(options) {
-  const url2 = new URL(options.url);
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const send_ = url2.protocol === "http:" ? httpRequest : httpsRequest;
-  const requestOptions = {
-    method: options.method,
-    headers: {
-      // CALLER HEADERS FIRST, so this module's own are not overridable. Spread
-      // last they win, and two of the values below are ones no caller may
-      // replace: `x-api-key` is the credential, and `content-length` is the
-      // byte count that stops a multi-byte body being truncated by the
-      // receiver. `SendOptions.headers` is a free-form record on an exported
-      // function, so "no caller does that today" is not the guarantee to rely
-      // on. The one header any caller actually passes — `if-none-match` on the
-      // conditional GET — is untouched by this order.
-      ...options.headers,
-      // The credential. One header, matching what the deployment authenticates
-      // on; a second copy in an `Authorization` header would be one more place
-      // it can be logged by an intermediary for no gain.
-      //
-      // Spread conditionally rather than assigned as `undefined`: Node's header
-      // handling and `content-length` bookkeeping treat a present-but-undefined
-      // key differently from an absent one, and "the header is not there" is
-      // the property the attach flow needs.
-      ...options.apiKey === void 0 ? {} : { "x-api-key": options.apiKey },
-      accept: "application/json",
-      ...options.body === void 0 ? {} : {
-        "content-type": "application/json",
-        // Byte length, not string length: a multi-byte body sent with a
-        // character count is truncated by the receiver.
-        "content-length": String(Buffer.byteLength(options.body))
-      }
+    id: "mistral",
+    name: "Mistral AI",
+    category: "LLM provider",
+    hostSuffixes: ["mistral.ai"],
+    apiBase: "https://api.mistral.ai",
+    defaultDataClasses: ["pii", "source"],
+    sdks: {
+      npm: ["@mistralai/mistralai"],
+      pypi: ["mistralai"],
+      go: ["github.com/gage-technologies/mistral-go"]
     }
-  };
-  return new Promise((resolve2, reject) => {
-    let settled = false;
-    const fail = (reason, status) => {
-      if (settled) return;
-      settled = true;
-      reject(new RemoteTransportError(reason, status));
-    };
-    const req = send_(url2, requestOptions, (res) => {
-      const chunks = [];
-      let size = 0;
-      res.on("data", (chunk) => {
-        size += chunk.length;
-        if (size > MAX_RESPONSE_BYTES) {
-          fail(`response exceeded ${String(MAX_RESPONSE_BYTES)} bytes`, res.statusCode);
-          res.destroy();
-          req.destroy();
-          return;
-        }
-        chunks.push(chunk);
-      });
-      res.on("aborted", () => {
-        fail("the response was aborted", res.statusCode);
-      });
-      res.on("end", () => {
-        if (settled) return;
-        settled = true;
-        resolve2({
-          status: res.statusCode ?? 0,
-          headers: res.headers,
-          body: Buffer.concat(chunks).toString("utf8")
-        });
-      });
-    });
-    const deadline = setTimeout(() => {
-      fail(`no response within ${String(timeoutMs)}ms`);
-      req.destroy();
-    }, timeoutMs);
-    deadline.unref();
-    req.on("upgrade", (_res, socket) => {
-      fail("the deployment answered with a protocol upgrade");
-      socket.destroy();
-    });
-    req.on("close", () => {
-      fail("the connection closed before a response was read");
-      clearTimeout(deadline);
-    });
-    req.on("error", (err) => {
-      fail(err.message);
-    });
-    if (options.body !== void 0) req.write(options.body);
-    req.end();
-  });
+  }
+];
+var EGRESS_VERSION_MATERIAL = `${EXTRACTOR_VERSION}
+${JSON.stringify(PROVIDER_REGISTRY)}`;
+
+// ../../packages/detections/src/egress/extract.ts
+var SECRET_KEY_NAMES = "api[_-]?key|apikey|private[_-]?key|access[_-]?key|access[_-]?token|token|secret|credentials?|password|passwd|pwd|authorization|sig|signature|sas|assertion";
+var AUTH_SCHEMES = "Bearer|Basic|Token|Digest|ApiKey|SSWS|AWS4-HMAC-SHA256";
+var SECRET_VALUE = new RegExp(
+  `((?:${SECRET_KEY_NAMES})['"\`]?\\s*[:=]\\s*['"\`]?)(?!(?:${AUTH_SCHEMES})[\\s'"\`])[^\\s'"\`&]+`,
+  "gi"
+);
+var AUTH_SCHEME_VALUE = new RegExp(
+  `((?:${SECRET_KEY_NAMES})['"\`]?\\s*[:=]\\s*['"\`]?)(${AUTH_SCHEMES})\\s+[^\\s'"\`]+`,
+  "gi"
+);
+var WEBHOOK_SECRET_PATHS = [
+  { hosts: ["hooks.slack.com"], prefix: "/services/" },
+  {
+    hosts: ["discord.com", "discordapp.com", "ptb.discord.com", "canary.discord.com"],
+    prefix: "/api/webhooks/"
+  },
+  { hosts: ["hooks.zapier.com"], prefix: "/hooks/" },
+  { hosts: ["outlook.office.com", "outlook.office365.com"], prefix: "/webhook/" }
+];
+function escapeRegExp(literal2) {
+  return literal2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+var WEBHOOK_URL = new RegExp(
+  `(https?://(?:${WEBHOOK_SECRET_PATHS.flatMap(
+    (entry) => entry.hosts.map((host) => `${escapeRegExp(host)}${escapeRegExp(entry.prefix)}`)
+  ).join("|")}))[^\\s'"\`<>()[\\]{},;]+`,
+  "gi"
+);
 
-// ../../packages/remote/src/client.ts
-var ROUTES = {
-  events: "/v1/events",
-  auditEvents: "/v1/audit-events",
-  auditEventsBatch: "/v1/audit-events/batch",
-  inventory: "/v1/inventory",
-  storePosture: "/v1/store-posture",
-  policyBundle: "/v1/policy-bundle",
-  whoami: "/v1/plugin/whoami",
-  shares: "/v1/shares"
-};
-function headerValue(response, name) {
-  const raw = response.headers[name];
-  if (raw === void 0) return void 0;
-  return Array.isArray(raw) ? raw[0] : raw;
+// ../../packages/detections/src/escape-regexp.ts
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function okBody(response) {
-  if (response.status < 200 || response.status >= 300) {
-    throw new RemoteRequestError(response.status);
-  }
-  return response.body;
+
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
 }
-function parsed(schema, body, route) {
-  let json2;
-  try {
-    json2 = JSON.parse(body);
-  } catch {
-    throw new RemoteResponseInvalid(route, "a body that is not JSON");
-  }
-  const result = schema.safeParse(json2);
-  if (!result.success) {
-    throw new RemoteResponseInvalid(route, "a body this client cannot read");
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
   }
-  return result.data;
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
 }
-function withoutTrailingSlashes(endpoint) {
-  let end = endpoint.length;
-  while (end > 0 && endpoint.charCodeAt(end - 1) === SLASH) end -= 1;
-  return endpoint.slice(0, end);
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
 }
-var SLASH = "/".charCodeAt(0);
-function createRemoteClient(options) {
-  const base = withoutTrailingSlashes(options.endpoint);
-  const url2 = (route) => `${base}${route}`;
-  const common = { apiKey: options.apiKey, timeoutMs: options.timeoutMs };
-  const sendOne = async (event) => {
-    const validated = RecordAuditEventRequest.safeParse(event);
-    if (!validated.success) throw new RemoteRequestInvalid(ROUTES.auditEvents, validated.error);
-    const response = await send({
-      ...common,
-      method: "POST",
-      url: url2(ROUTES.auditEvents),
-      body: JSON.stringify(validated.data)
-    });
-    okBody(response);
-  };
-  return {
-    async ingestEvents(batch) {
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.events),
-        body: JSON.stringify(batch)
-      });
-      return parsed(IngestAck, okBody(response), ROUTES.events);
-    },
-    async ingestInventory(context) {
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.inventory),
-        body: JSON.stringify(context)
-      });
-      return parsed(ResolvedInventory, okBody(response), ROUTES.inventory);
-    },
-    async recordAuditEvent(event) {
-      await sendOne(event);
-    },
-    async recordAuditEvents(events) {
-      const validated = RecordAuditEventBatch.safeParse({ events });
-      if (!validated.success) {
-        throw new RemoteRequestInvalid(ROUTES.auditEventsBatch, validated.error);
-      }
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.auditEventsBatch),
-        body: JSON.stringify(validated.data)
-      });
-      if (response.status === 404) {
-        for (const event of validated.data.events) await sendOne(event);
-        return { accepted: validated.data.events.length };
-      }
-      return parsed(AuditEventBatchAck, okBody(response), ROUTES.auditEventsBatch);
-    },
-    async reportStorePosture(snapshot) {
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.storePosture),
-        body: JSON.stringify(snapshot)
-      });
-      okBody(response);
-    },
-    async getPolicyBundle(etag) {
-      const response = await send({
-        ...common,
-        method: "GET",
-        url: url2(ROUTES.policyBundle),
-        ...etag === void 0 ? {} : { headers: { "if-none-match": etag } }
-      });
-      if (response.status === 304) {
-        return { changed: false, etag: headerValue(response, "etag") ?? etag };
+
+// ../../packages/detections/src/matchers/limits.ts
+var MAX_MATCHES_PER_RULE = 1e4;
+var MAX_REGEX_INPUT_LENGTH = 2e5;
+
+// ../../packages/detections/src/matchers/keyword.ts
+var KeywordMatcher2 = class {
+  match(text, rule) {
+    if (rule.matcher.type !== "keyword") return [];
+    const { keywords, caseSensitive } = rule.matcher;
+    const spans = [];
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
+      if (spans.length >= MAX_MATCHES_PER_RULE) break;
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        spans.push({ start: m.index, end: m.index + m[0].length });
+        if (spans.length >= MAX_MATCHES_PER_RULE) break;
       }
-      const bundle = parsed(PolicyBundle, okBody(response), ROUTES.policyBundle);
-      return { changed: true, bundle, etag: headerValue(response, "etag") };
-    },
-    async whoami() {
-      const response = await send({ ...common, method: "GET", url: url2(ROUTES.whoami) });
-      return parsed(PluginWhoami, okBody(response), ROUTES.whoami);
-    },
-    async recordProjectEgress(request) {
-      const validated = EgressIngestRequest.safeParse(request);
-      if (!validated.success) throw new RemoteRequestInvalid(ROUTES.shares, validated.error);
-      const response = await send({
-        ...common,
-        method: "POST",
-        url: url2(ROUTES.shares),
-        body: JSON.stringify(validated.data)
-      });
-      okBody(response);
     }
-  };
-}
+    return spans;
+  }
+};
+
+// ../../packages/detections/src/matchers/regex.ts
+var RegexMatcher2 = class {
+  match(text, rule) {
+    if (rule.matcher.type !== "regex") return [];
+    const { pattern, flags, captureGroup } = rule.matcher;
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
+    const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
+    const spans = [];
+    let m;
+    const maxIterations = scanText2.length + 1;
+    let iterations = 0;
+    while ((m = re.exec(scanText2)) !== null) {
+      if (++iterations > maxIterations) break;
+      const group = captureGroup != null ? m[captureGroup] : m[0];
+      if (m[0].length === 0) re.lastIndex++;
+      if (group && spans.length < MAX_MATCHES_PER_RULE) {
+        const groupIndices = captureGroup != null ? m.indices?.[captureGroup] : void 0;
+        const start = groupIndices ? groupIndices[0] : m.index;
+        spans.push({ start, end: start + group.length });
+      }
+      if (!flags.includes("g") || spans.length >= MAX_MATCHES_PER_RULE) break;
+    }
+    return spans;
+  }
+};
+
+// ../../packages/detections/src/engine.ts
+var keywordMatcher = new KeywordMatcher2();
+var regexMatcher = new RegexMatcher2();
+
+// ../../packages/detections/src/posture/config-posture.ts
+var RULE_VERSION = "1";
+var KNOWN_TOOLS = /* @__PURE__ */ new Set([
+  "prettier",
+  "eslint",
+  "biome",
+  "black",
+  "ruff",
+  "gofmt",
+  "rustfmt",
+  "node",
+  "npx",
+  "npm",
+  "pnpm",
+  "yarn",
+  "make",
+  "git",
+  "jq",
+  "echo"
+]);
+var EGRESS_RE = /\b(curl|wget|nc|ncat|netcat|ssh|scp|rsync)\b|https?:\/\//;
+var MUTATION_RE = /(--write|--fix|\s-w\b|\s-i\b|(?<![\d&>])>\s?\S)/;
+var CONFIG_POSTURE_RULES = [
+  {
+    ruleId: "hook-conflict",
+    version: RULE_VERSION,
+    name: "Overlapping hooks \u2014 run order is undefined",
+    category: "config",
+    severity: "medium",
+    definition: JSON.stringify({
+      kind: "hook-conflict",
+      mutation: MUTATION_RE.source,
+      note: "two hooks on the same event with overlapping matchers, both mutating the tool target"
+    })
+  },
+  {
+    ruleId: "hook-unknown",
+    version: RULE_VERSION,
+    name: "Unknown hook \u2014 not attributable to a plugin or known tool",
+    category: "config",
+    // medium, not high: with a deliberately tiny allowlist this v1 heuristic
+    // fires on ordinary interpreter hooks (python3 x.py) and compound commands
+    // (cd … && tool); 'high' is reserved for egress, which is genuinely
+    // dangerous. Revisit when the known-hooks registry replaces the allowlist.
+    severity: "medium",
+    definition: JSON.stringify({ kind: "hook-unknown", knownTools: [...KNOWN_TOOLS] })
+  },
+  {
+    ruleId: "hook-external-egress",
+    version: RULE_VERSION,
+    name: "Hook command can send data externally",
+    category: "config",
+    severity: "high",
+    definition: JSON.stringify({ kind: "hook-external-egress", pattern: EGRESS_RE.source })
+  }
+];
+
+// ../../packages/detections/src/security/redos-probe.ts
+var BUDGET_MS = 100;
+var EXPONENTIAL_UNITS = [
+  "a",
+  "0",
+  " ",
+  "x",
+  "ab",
+  "a.",
+  "a-",
+  "a_",
+  "a@",
+  "a/",
+  "a:",
+  "a=",
+  "a;",
+  "aA0",
+  "	"
+];
+var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
+  (unit) => [23, 25].map((len) => unit.repeat(Math.ceil(len / unit.length)).slice(0, len) + "!")
+);
+var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
+  (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
+);
+var CPU_CORROBORATION_SHARE = 0.2;
+var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
+
+// ../../packages/plugin-sdk/src/repo.ts
+import { existsSync as existsSync8, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname4, isAbsolute, join as join15, sep as sep2 } from "path";
+
+// ../../packages/plugin-sdk/src/events.ts
+import { createHash as createHash5, randomUUID as randomUUID13 } from "crypto";
+
+// ../../packages/plugin-sdk/src/isolated-scan.ts
+import { existsSync as existsSync9 } from "fs";
+import { fileURLToPath } from "url";
+import { Worker } from "worker_threads";
+
+// ../../packages/plugin-sdk/src/ignore-layers.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { readFileSync as readFileSync11 } from "fs";
+import { join as join17 } from "path";
+
+// ../../packages/plugin-sdk/src/inventory-resolver.ts
+import { arch, hostname as hostname4, platform, release } from "os";
+
+// ../../packages/plugin-sdk/src/model-governance.ts
+import {
+  closeSync as closeSync2,
+  fstatSync,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync12,
+  readSync,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { join as join18 } from "path";
+var TAIL_BYTES = 256 * 1024;
+
+// ../../packages/plugin-sdk/src/nudge.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
+import { join as join19 } from "path";
+
+// ../../packages/plugin-sdk/src/paths.ts
+import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
+import { basename as basename4, dirname as dirname5, sep as sep3 } from "path";
+
+// ../../packages/plugin-sdk/src/project-files.ts
+import { existsSync as existsSync10, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join20 } from "path";
+
+// ../../packages/plugin-sdk/src/provider-env-antigravity.ts
+var optionalBaseUrl2 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var optionalFlag = external_exports.preprocess((v) => {
+  if (typeof v !== "string") return false;
+  const normalized = v.trim().toLowerCase();
+  return normalized !== "" && normalized !== "0" && normalized !== "false";
+}, external_exports.boolean()).catch(false);
+var antigravityProviderEnvShape = {
+  GOOGLE_GENAI_USE_VERTEXAI: optionalFlag,
+  GOOGLE_GEMINI_BASE_URL: optionalBaseUrl2
+};
+var AntigravityProviderEnvSchema = external_exports.object(antigravityProviderEnvShape);
+
+// ../../packages/plugin-sdk/src/provider-env-codex.ts
+var optionalBaseUrl3 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var codexProviderEnvShape = {
+  OPENAI_BASE_URL: optionalBaseUrl3
+};
+var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
+
+// ../../packages/plugin-sdk/src/runtime.ts
+import { randomUUID as randomUUID14 } from "crypto";
+
+// ../../packages/plugin-sdk/src/suppressions.ts
+var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+
+// ../../packages/plugin-sdk/src/throttle.ts
+import { mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync7 } from "fs";
+import { join as join21 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/history-state.ts
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join23 } from "path";
+
+// ../../packages/plugin-runtime/src/attached/history-sync.ts
+import { createHash as createHash6 } from "crypto";
+import { hostname as hostname5 } from "os";
+
+// ../../packages/plugin-runtime/src/attached/capture-rebuild.ts
+var CORRELATION_ID = EventMetadata.shape.correlationId;
+var TRACE_ID = EventMetadata.shape.traceId;
+var EXCEPTION_ID = EventMetadata.shape.exceptionIds.unwrap().element;
 
 // ../../packages/plugin-runtime/src/attached/history-sync-trigger.ts
 import { spawn } from "child_process";
@@ -24647,12 +24871,12 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 var HISTORY_SYNC_THROTTLE_MS = 5 * 60 * 1e3;
 
 // ../../packages/plugin-runtime/src/attached/plugin-block.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 import { randomUUID as randomUUID16 } from "crypto";
 import { readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/atomic-publish.ts
 import { rename as rename2 } from "fs/promises";
@@ -24676,7 +24900,7 @@ async function publishByRename(tmp, file2, move = rename2) {
 
 // ../../packages/plugin-runtime/src/attached/policy-store.ts
 function createPolicyStore(dir = dataDir()) {
-  const file2 = join23(dir, "policy-cache.json");
+  const file2 = join24(dir, "policy-cache.json");
   async function read() {
     try {
       const raw = await readFile2(file2, "utf8");
@@ -24685,22 +24909,32 @@ function createPolicyStore(dir = dataDir()) {
       const record2 = parsed2;
       const bundle = PolicyBundle.parse(record2.bundle);
       const fetchedAtMs = typeof record2.fetchedAtMs === "number" ? record2.fetchedAtMs : 0;
-      const etag = typeof record2.etag === "string" ? record2.etag : void 0;
+      const stored = typeof record2.etag === "string" ? record2.etag : void 0;
+      const replayable = record2.shapeId === POLICY_BUNDLE_SHAPE_ID || knowsMoreThanThisBuild(record2.shapeId);
+      const etag = replayable ? stored : void 0;
       return { bundle, fetchedAtMs, ...etag === void 0 ? {} : { etag } };
     } catch {
       return null;
     }
   }
-  async function write(bundle, etag) {
-    await ensureDataDir(dir);
-    const stored = {
-      bundle,
-      fetchedAtMs: Date.now(),
-      ...etag === void 0 ? {} : { etag }
-    };
+  function knowsMoreThanThisBuild(shapeId) {
+    if (typeof shapeId !== "string" || shapeId === "") return false;
+    const theirs = new Set(shapeId.split(","));
+    const ours = new Set(POLICY_BUNDLE_SHAPE_ID.split(","));
+    return theirs.size > ours.size && [...ours].every((key) => theirs.has(key));
+  }
+  async function priorRecord() {
+    try {
+      const parsed2 = JSON.parse(await readFile2(file2, "utf8"));
+      return typeof parsed2 === "object" && parsed2 !== null ? parsed2 : null;
+    } catch {
+      return null;
+    }
+  }
+  async function publishRecord(record2) {
     const tmp = `${file2}.${randomUUID16()}.tmp`;
     try {
-      await writeFile2(tmp, JSON.stringify(stored), {
+      await writeFile2(tmp, JSON.stringify(record2), {
         encoding: "utf8",
         mode: DATA_FILE_MODE,
         flag: "wx"
@@ -24711,6 +24945,27 @@ function createPolicyStore(dir = dataDir()) {
       throw err;
     }
   }
+  async function write(bundle, etag) {
+    await ensureDataDir(dir);
+    const prior = await priorRecord();
+    const priorVersion = prior?.bundle?.version;
+    if (prior !== null && knowsMoreThanThisBuild(prior.shapeId) && priorVersion === bundle.version) {
+      await publishRecord({
+        ...prior,
+        fetchedAtMs: Date.now()
+      });
+      return;
+    }
+    await publishRecord({
+      bundle,
+      fetchedAtMs: Date.now(),
+      // Stamped on EVERY write, the 304 arm's included: that arm hands back the
+      // bundle it already holds, and the point of the stamp is to describe the
+      // build that last narrowed those bytes, which is this one.
+      shapeId: POLICY_BUNDLE_SHAPE_ID,
+      ...etag === void 0 ? {} : { etag }
+    });
+  }
   return { read, write, file: file2 };
 }
 
@@ -24773,14 +25028,14 @@ import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 // ../../packages/plugin-runtime/src/attached/posture-store.ts
 import { randomUUID as randomUUID17 } from "crypto";
 import { readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 
 // ../../packages/plugin-runtime/src/attached/sync-state.ts
-import { readFileSync as readFileSync16 } from "fs";
-import { join as join25 } from "path";
+import { readFileSync as readFileSync17 } from "fs";
+import { join as join26 } from "path";
 var SYNC_STATE_FILENAME = ATTACHED_SYNC_STATE_FILENAME;
 function syncStatePath(dataDir2) {
-  return join25(dataDir2, SYNC_STATE_FILENAME);
+  return join26(dataDir2, SYNC_STATE_FILENAME);
 }
 function writeSyncState(dataDir2, result) {
   try {
@@ -24807,14 +25062,23 @@ var OUTCOME_LINES = {
 };
 
 // ../../packages/plugin-runtime/src/attached/sync-entry.ts
-async function runAttachedSync(base = defaultDataDir()) {
+async function runAttachedSync(base = defaultDataDir(), deps = {}) {
+  let policyOutcome = null;
   try {
     const result = await runPolicySync({
       base,
       settingsDir: settingsDir(base),
       dataDir: dataDir(base)
     });
-    if (result !== null) writeSyncState(dataDir(base), result);
+    if (result !== null) {
+      policyOutcome = result.outcome;
+      writeSyncState(dataDir(base), result);
+    }
+  } catch {
+  }
+  if (policyOutcome === "unauthorized") return;
+  try {
+    await runCommandSync({ base, settingsDir: settingsDir(base), scan: deps.scan });
   } catch {
   }
 }