@ascenda-one/gemini-hooks 0.1.27 → 0.1.28

package/README.md

@@ -56,6 +56,19 @@ transmitted before connecting anything. Every payload carries the UTC offset
 and an idempotency key; both come from the shared sender in `tool-kit`, so
 this adapter holds only its mapping.
 
+## Privacy defaults
+
+Metadata-only. Does not send prompts, responses, code, file paths, command
+text, repository names or branch names. Correction detection runs locally on
+prompt text; only the classification is transmitted.
+
+`setup` prints the full list before it pairs — every family this adapter sends,
+the refusals, and how to turn it off. That block is generated from the
+adapter's own declaration in `src/setup.ts`, and a guard test
+(`packages/tool-kit/tests/setupDisclosure.test.mjs`) runs the mapper and fails
+the build when the declaration claims a family the mapper does not send, or
+omits one it does.
+
 ## Event mapping
 
 See [docs/GEMINI_MAPPING.md](docs/GEMINI_MAPPING.md).

package/dist/cli.js

@@ -407,39 +407,44 @@ var require_metricKeys = __commonJS({
     exports.METRIC_KEYS = {
       // ── Read by a backend reader ────────────────────────────────────────────
       contextWindowPeakPct: {
+        family: "context",
         readBy: ["backend", "handoff"],
         backendAliases: CONTEXT_WINDOW_CANONICAL_ALIASES,
         unit: "fraction of the context window (0\u20131; uncapped for >200k contexts)",
         note: "Claude Code reports a true per-session peak. Cursor reports its composer's last known occupancy under the same key \u2014 the closest its store can answer, and not the same measurement."
       },
       contextUsagePercent: {
+        family: "context",
         readBy: ["backend", "handoff"],
         backendAliases: CONTEXT_WINDOW_CURSOR_PERCENT_ALIASES,
         unit: "percent (0\u2013100)",
         note: "Cursor's own column name. Superseded by contextWindowPeakPct on the wire; kept because the handoff reads it and imported rows carry it. Unit-explicit on the backend: always divided by 100, never put through the fraction-or-percent heuristic."
       },
-      promptCount: { readBy: ["backend", "handoff"], backendAliases: ["promptCount", "prompt_count"] },
-      sessionMinutes: { readBy: ["backend"], backendAliases: ["sessionMinutes", "session_minutes"], unit: "minutes" },
-      durationBucket: { readBy: ["backend", "handoff"], backendAliases: ["durationBucket", "duration_bucket"] },
-      afterHoursPrompts: { readBy: ["backend", "handoff"], backendAliases: ["afterHoursPrompts", "after_hours_prompts"] },
-      inputTokens: { readBy: ["backend"], backendAliases: ["inputTokens", "input_tokens"], unit: "tokens" },
-      outputTokens: { readBy: ["backend"], backendAliases: ["outputTokens", "output_tokens"], unit: "tokens" },
-      cacheReadTokens: { readBy: ["backend"], backendAliases: ["cacheReadTokens", "cache_read_tokens"], unit: "tokens" },
-      queuedPrompts: { readBy: ["backend"], backendAliases: ["queuedPrompts", "queued_prompts"] },
-      linesChangedBucket: { readBy: ["backend"], backendAliases: ["linesChangedBucket", "lines_changed_bucket"] },
+      promptCount: { family: "counts", readBy: ["backend", "handoff"], backendAliases: ["promptCount", "prompt_count"] },
+      sessionMinutes: { family: "session", readBy: ["backend"], backendAliases: ["sessionMinutes", "session_minutes"], unit: "minutes" },
+      durationBucket: { family: "session", readBy: ["backend", "handoff"], backendAliases: ["durationBucket", "duration_bucket"] },
+      afterHoursPrompts: { family: "clock", readBy: ["backend", "handoff"], backendAliases: ["afterHoursPrompts", "after_hours_prompts"] },
+      inputTokens: { family: "context", readBy: ["backend"], backendAliases: ["inputTokens", "input_tokens"], unit: "tokens" },
+      outputTokens: { family: "context", readBy: ["backend"], backendAliases: ["outputTokens", "output_tokens"], unit: "tokens" },
+      cacheReadTokens: { family: "context", readBy: ["backend"], backendAliases: ["cacheReadTokens", "cache_read_tokens"], unit: "tokens" },
+      queuedPrompts: { family: "counts", readBy: ["backend"], backendAliases: ["queuedPrompts", "queued_prompts"] },
+      linesChangedBucket: { family: "edits", readBy: ["backend"], backendAliases: ["linesChangedBucket", "lines_changed_bucket"] },
       // ── Read by the local handoff only ──────────────────────────────────────
-      activeMinutes: { readBy: ["handoff"], unit: "minutes" },
+      activeMinutes: { family: "session", readBy: ["handoff"], unit: "minutes" },
       syntheticPromptLines: {
+        family: "reading",
         readBy: ["handoff"],
         unit: "lines",
         note: "Main-thread user lines the runtime wrote on the person's behalf (notifications, its own bookkeeping, slash-command wrappers, interrupt markers) and promptCount left out. Claude Code only; the receipt for the handoff's promptBasis. Counted per transcript, so a resumed transcript's copies count again."
       },
       dispatchedPromptLines: {
+        family: "reading",
         readBy: ["handoff"],
         unit: "lines",
         note: "Main-thread user lines that read as typed but are the prompt of a chip that launched the session, so promptCount left them out. Counted once per line across the store, as prompts are. Claude Code only; written beside promptBasis: typed_once."
       },
       interruptedRuns: {
+        family: "waiting",
         readBy: ["handoff"],
         unit: "runs",
         note: "Agent turns the person cut short with an interrupt while the turn was still going. A count per session, never a rate. Claude Code only; a handoff that counted them says so with interruptedRunsCounted, and absent means not counted, never zero."
@@ -455,11 +460,13 @@ var require_metricKeys = __commonJS({
        * they are.
        */
       handsOnMinutes: {
+        family: "session",
         readBy: ["handoff"],
         unit: "minutes",
         note: "Active time immediately preceding a human prompt \u2014 the only interval a transcript can show a person present for, because the prompt at its end is the evidence."
       },
       agentSupervisingMinutes: {
+        family: "session",
         readBy: ["handoff"],
         unit: "minutes",
         note: "The remaining active time: the agent was working and the person was not typing. NOT a claim that anyone watched it \u2014 nothing in a transcript could show that. Never render as attention."
@@ -469,127 +476,147 @@ var require_metricKeys = __commonJS({
       // a complete one, and a reader that ignores them is choosing to, rather than
       // being unable to.
       activeSplitInstants: {
+        family: "session",
         readBy: ["diagnostic"],
         note: "Distinct timestamps the split ran over, after collapsing ties. The denominator: two minutes off four instants and off four hundred are not the same measurement."
       },
       activeSplitUndatedLines: {
+        family: "session",
         readBy: ["diagnostic"],
         note: "Known lines carrying a timestamp that would not parse. Absent from the timeline, so both halves are short by an unknown amount and only this says so."
       },
       activeSplitUnposturedInstants: {
+        family: "posture",
         readBy: ["diagnostic"],
         note: "Instants reached before any permissionMode had been declared. Their supervising time lands in the unknown band, which is a blind spot rather than a posture."
       },
-      afterHoursRequests: { readBy: ["handoff"] },
-      approximateLintErrorsCount: { readBy: ["handoff"] },
-      canceledCount: { readBy: ["handoff"] },
-      chatEditCount: { readBy: ["handoff"] },
+      afterHoursRequests: { family: "clock", readBy: ["handoff"] },
+      approximateLintErrorsCount: { family: "outcome", readBy: ["handoff"] },
+      canceledCount: { family: "outcome", readBy: ["handoff"] },
+      chatEditCount: { family: "edits", readBy: ["handoff"] },
       compactionCount: {
+        family: "context",
         readBy: ["handoff"],
         note: "The backend counts context_compression_* event rows, not this key. Both are emitted; this one is for the handoff."
       },
       contextWindowPeakTokens: {
+        family: "context",
         readBy: ["handoff"],
         unit: "tokens",
         note: "The measured quantity, with no assumed denominator. Prefer this to the ratio for any within-person baseline."
       },
       contextWindowTokens: {
+        family: "context",
         readBy: ["handoff"],
         unit: "tokens",
         note: "Codex only: the model_context_window the rollout itself recorded \u2014 the real denominator its contextWindowPeakPct was computed against. Claude Code records no window and its ratio assumes 200k; absent here means the store never said."
       },
-      date: { readBy: ["handoff"] },
-      errorCount: { readBy: ["handoff"] },
-      filesChangedCount: { readBy: ["handoff"] },
-      humanChangesCount: { readBy: ["handoff"] },
-      linesAdded: { readBy: ["handoff"] },
-      linesRemoved: { readBy: ["handoff"] },
-      primaryModel: { readBy: ["handoff"] },
-      requestCount: { readBy: ["handoff"] },
-      sessionStartedAt: { readBy: ["handoff"] },
-      subagentComposers: { readBy: ["handoff"] },
+      date: { family: "clock", readBy: ["handoff"] },
+      errorCount: { family: "outcome", readBy: ["handoff"] },
+      filesChangedCount: { family: "edits", readBy: ["handoff"] },
+      humanChangesCount: { family: "edits", readBy: ["handoff"] },
+      linesAdded: { family: "edits", readBy: ["handoff"] },
+      linesRemoved: { family: "edits", readBy: ["handoff"] },
+      primaryModel: {
+        family: "model",
+        readBy: ["backend", "handoff"],
+        backendAliases: ["primaryModel", "primary_model"],
+        note: "Read twice: the desktop's local handoff folds it, and a server-side reader resolves it to group a bucket's sessions by the model that served them. Declared handoff-only until 23 Sep 2026 \u2014 see toolName for why that direction of mistake has no symptom."
+      },
+      requestCount: { family: "counts", readBy: ["handoff"] },
+      sessionStartedAt: { family: "session", readBy: ["handoff"] },
+      subagentComposers: { family: "counts", readBy: ["handoff"] },
       subagentToolCallCount: {
+        family: "tools",
         readBy: ["handoff"],
         note: "Claude Code only: calls made inside subagent transcripts, kept out of toolCallCount so the main-loop count matches what the wire events carry."
       },
-      subagentTranscripts: { readBy: ["handoff"] },
+      subagentTranscripts: { family: "counts", readBy: ["handoff"] },
       toolCallCount: {
+        family: "tools",
         readBy: ["handoff"],
         note: "The backend counts ai_tool_call_started event rows, not this key \u2014 same split as compactionCount. Deduplicated on the tool-call id; see each extractor for what one call means in its store."
       },
       toolCallsUndated: {
+        family: "tools",
         readBy: ["handoff"],
         note: "Cursor only: calls whose every record carries an empty createdAt. Counted in toolCallCount, but no event exists for them \u2014 the wire total is smaller than this session count by exactly this number."
       },
-      toolFailureCount: { readBy: ["handoff"] },
-      totalEntryCount: { readBy: ["handoff"] },
+      toolFailureCount: { family: "outcome", readBy: ["handoff"] },
+      totalEntryCount: { family: "counts", readBy: ["handoff"] },
       userModifiedEditCount: {
+        family: "edits",
         readBy: ["handoff"],
         note: "Null, never 0 \u2014 Claude Code never sets userModified true, so 0 would assert 'no AI edit was ever corrected by hand'."
       },
       // ── Diagnostic: read by nobody, on purpose ──────────────────────────────
-      abandonedPromptCount: { readBy: ["diagnostic"] },
+      abandonedPromptCount: { family: "counts", readBy: ["diagnostic"] },
       // Epoch-marker metrics. The marker is local-only and never reaches the wire
       // (see EXTRACTION_EPOCH_KIND), but it travels as a NormalizedHistoricalEvent
       // and so is keyed by the same vocabulary.
-      windowOldest: { readBy: ["handoff"], note: "Oldest event the extraction saw \u2014 the marker's left edge." },
-      windowNewest: { readBy: ["handoff"], note: "Newest event the extraction saw \u2014 the marker's right edge." },
-      projectsWithNoReadableTranscript: { readBy: ["diagnostic"] },
-      unparsedComposerHeaders: { readBy: ["diagnostic"] },
-      unknownComposerHeaderTypes: { readBy: ["diagnostic"] },
-      orphanedBubbles: { readBy: ["diagnostic"] },
-      orphanedSubagentBubbles: { readBy: ["diagnostic"] },
-      sessionsWithoutTimeline: { readBy: ["diagnostic"] },
+      windowOldest: { family: "session", readBy: ["handoff"], note: "Oldest event the extraction saw \u2014 the marker's left edge." },
+      windowNewest: { family: "session", readBy: ["handoff"], note: "Newest event the extraction saw \u2014 the marker's right edge." },
+      projectsWithNoReadableTranscript: { family: "reading", readBy: ["diagnostic"] },
+      unparsedComposerHeaders: { family: "reading", readBy: ["diagnostic"] },
+      unknownComposerHeaderTypes: { family: "reading", readBy: ["diagnostic"] },
+      orphanedBubbles: { family: "reading", readBy: ["diagnostic"] },
+      orphanedSubagentBubbles: { family: "reading", readBy: ["diagnostic"] },
+      sessionsWithoutTimeline: { family: "reading", readBy: ["diagnostic"] },
       sessionsWithOnlyInheritedLines: {
+        family: "reading",
         readBy: ["diagnostic"],
         note: "Claude Code transcripts holding nothing but a copy of an ancestor's history, so no line's instant is theirs and no session is emitted for them. Excluded by rule, not a read failure: the work is in the transcript that owns it."
       },
-      emptyComposers: { readBy: ["diagnostic"] },
-      apiErrorCount: { readBy: ["diagnostic"] },
-      assistantTurns: { readBy: ["diagnostic"] },
-      compactionAutoCount: { readBy: ["diagnostic"] },
-      compactionManualCount: { readBy: ["diagnostic"] },
-      editDayCount: { readBy: ["diagnostic"] },
-      emptyChatSessions: { readBy: ["diagnostic"] },
-      gitBranch: { readBy: ["diagnostic"] },
-      linesChanged: { readBy: ["diagnostic"] },
-      malformedChatSessionLines: { readBy: ["diagnostic"] },
-      malformedHistoryEntries: { readBy: ["diagnostic"] },
-      mode: { readBy: ["diagnostic"] },
-      modelCount: { readBy: ["diagnostic"] },
-      modelSwitchCount: { readBy: ["diagnostic"] },
-      rapidRepromptCount: { readBy: ["diagnostic"] },
-      schemaUnreadable: { readBy: ["diagnostic"] },
-      sessionCount: { readBy: ["diagnostic"] },
-      sessionsFromBubbleTimeline: { readBy: ["diagnostic"] },
-      sessionsFromCheckpointTimeline: { readBy: ["diagnostic"] },
-      sessionsFromRecencyTimeline: { readBy: ["diagnostic"] },
-      subagentAssistantTurns: { readBy: ["diagnostic"] },
-      subagentPrompts: { readBy: ["diagnostic"] },
-      subagentTokensTotal: { readBy: ["diagnostic"] },
+      emptyComposers: { family: "reading", readBy: ["diagnostic"] },
+      apiErrorCount: { family: "outcome", readBy: ["diagnostic"] },
+      assistantTurns: { family: "counts", readBy: ["diagnostic"] },
+      compactionAutoCount: { family: "context", readBy: ["diagnostic"] },
+      compactionManualCount: { family: "context", readBy: ["diagnostic"] },
+      editDayCount: { family: "clock", readBy: ["diagnostic"] },
+      emptyChatSessions: { family: "reading", readBy: ["diagnostic"] },
+      gitBranch: { family: "repo", readBy: ["diagnostic"] },
+      linesChanged: { family: "edits", readBy: ["diagnostic"] },
+      malformedChatSessionLines: { family: "reading", readBy: ["diagnostic"] },
+      malformedHistoryEntries: { family: "reading", readBy: ["diagnostic"] },
+      mode: { family: "posture", readBy: ["diagnostic"] },
+      modelCount: { family: "model", readBy: ["diagnostic"] },
+      modelSwitchCount: { family: "model", readBy: ["diagnostic"] },
+      rapidRepromptCount: { family: "counts", readBy: ["diagnostic"] },
+      schemaUnreadable: { family: "reading", readBy: ["diagnostic"] },
+      sessionCount: { family: "session", readBy: ["diagnostic"] },
+      sessionsFromBubbleTimeline: { family: "reading", readBy: ["diagnostic"] },
+      sessionsFromCheckpointTimeline: { family: "reading", readBy: ["diagnostic"] },
+      sessionsFromRecencyTimeline: { family: "reading", readBy: ["diagnostic"] },
+      subagentAssistantTurns: { family: "counts", readBy: ["diagnostic"] },
+      subagentPrompts: { family: "counts", readBy: ["diagnostic"] },
+      subagentTokensTotal: { family: "context", readBy: ["diagnostic"] },
       toolName: {
-        readBy: ["diagnostic"],
-        note: "Set per ai_tool_call_started event by #43's extractors and shipped in wire metadata, but no reader resolves it server-side yet (the backend's ToolName column is MCP audit, not telemetry). Registered after the fact: #38 and #43 merged past each other, and the union caught it on the next compile \u2014 metaLines all over again."
+        family: "tools",
+        readBy: ["backend"],
+        backendAliases: ["toolName", "tool_name"],
+        note: "Set per ai_tool_call_started event by #43's extractors. Declared diagnostic until 23 Sep 2026 on the belief that nothing resolved it server-side; two backend readers do \u2014 one to see a sub-agent dispatch, one composing per-tool metrics. This is the inverse of the mismatch this module was written for: contextUsagePercent was a key nobody read, and a key a reader resolves without being declared drops nothing, so it has no symptom at all. What it costs is that readBy stops being a true census of what the server sees, which is what you consult when deciding what a collector should stop sending. Registered after the fact in the first place: #38 and #43 merged past each other, and the union caught it on the next compile \u2014 metaLines all over again."
       },
-      toolResultCount: { readBy: ["diagnostic"] },
-      toolResultErrorCount: { readBy: ["diagnostic"] },
-      unknownBubbles: { readBy: ["diagnostic"] },
-      unknownLines: { readBy: ["diagnostic"] },
+      toolResultCount: { family: "tools", readBy: ["diagnostic"] },
+      toolResultErrorCount: { family: "outcome", readBy: ["diagnostic"] },
+      unknownBubbles: { family: "reading", readBy: ["diagnostic"] },
+      unknownLines: { family: "reading", readBy: ["diagnostic"] },
       metaLines: {
+        family: "reading",
         readBy: ["diagnostic"],
         note: 'Recognised-but-skipped transcript machinery (file-history-snapshot, queued-command, \u2026). Split out of unknownLines by #43 so that number keeps meaning "a type nobody has looked at". Registered here after the fact: #41 and #43 merged past each other, and the union caught it on the next compile \u2014 which is this module doing its job.'
       },
-      unparsedBubbles: { readBy: ["diagnostic"] },
-      unparsedChatSessionFiles: { readBy: ["diagnostic"] },
-      unparsedHistoryFiles: { readBy: ["diagnostic"] },
-      unparsedLines: { readBy: ["diagnostic"] },
-      unreadableChatSessionFiles: { readBy: ["diagnostic"] },
-      unreadableHistoryFiles: { readBy: ["diagnostic"] },
+      unparsedBubbles: { family: "reading", readBy: ["diagnostic"] },
+      unparsedChatSessionFiles: { family: "reading", readBy: ["diagnostic"] },
+      unparsedHistoryFiles: { family: "reading", readBy: ["diagnostic"] },
+      unparsedLines: { family: "reading", readBy: ["diagnostic"] },
+      unreadableChatSessionFiles: { family: "reading", readBy: ["diagnostic"] },
+      unreadableHistoryFiles: { family: "reading", readBy: ["diagnostic"] },
       unreadableRolloutFiles: {
+        family: "reading",
         readBy: ["diagnostic"],
         note: "Codex only: rollout files the extractor meant to read and could not open. Summed into the import's read-failure warning, so a store that is partly unreadable says so rather than reporting a short window as the whole."
       },
-      unrecognisedChatSessionFiles: { readBy: ["diagnostic"] }
+      unrecognisedChatSessionFiles: { family: "reading", readBy: ["diagnostic"] }
     };
     function backendMetricKeys() {
       return Object.entries(exports.METRIC_KEYS).filter(([, spec]) => spec.readBy.includes("backend")).map(([key, spec]) => [key, spec.backendAliases ?? [key]]);
@@ -602,7 +629,7 @@ var require_out = __commonJS({
   "../packages/tool-contract/out/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.backendMetricKeys = exports.METRIC_KEYS = exports.ASCENDA_SEMANTIC_PROVENANCE = exports.ASCENDA_HISTORICAL_CONSENT_SCOPE = exports.ASCENDA_COLLABORATION_CONSENT_SCOPE = exports.ASCENDA_SEMANTIC_CONSENT_SCOPE = exports.ASCENDA_PROVENANCE = exports.ASCENDA_CONSENT_SCOPE = exports.EVENT_WORKLOAD_CATEGORY = exports.TOOL_EVENT_DELIVERED_STATUSES = exports.IDEMPOTENCY_KEY_MAX_LENGTH = exports.EVENT_METADATA_FIELDS = exports.COLLABORATION_EVENT_TYPES = exports.SEMANTIC_WORK_SIGNAL_EVENT_TYPES = exports.ASCENDA_ELAPSED_QUANTITIES = exports.ASCENDA_ACTIVE_TIME_QUANTITIES = exports.ASCENDA_TOOL_TYPES = exports.ASCENDA_TELEMETRY_SOURCES = void 0;
+    exports.backendMetricKeys = exports.METRIC_KEYS = exports.ASCENDA_SEMANTIC_PROVENANCE = exports.ASCENDA_HISTORICAL_CONSENT_SCOPE = exports.ASCENDA_COLLABORATION_CONSENT_SCOPE = exports.ASCENDA_SEMANTIC_CONSENT_SCOPE = exports.ASCENDA_PROVENANCE = exports.ASCENDA_CONSENT_SCOPE = exports.EVENT_WORKLOAD_CATEGORY = exports.TOOL_EVENT_DELIVERED_STATUSES = exports.IDEMPOTENCY_KEY_MAX_LENGTH = exports.EVENT_METADATA_FIELDS = exports.EVENT_METADATA_DISCLOSURE = exports.COLLABORATION_EVENT_TYPES = exports.SEMANTIC_WORK_SIGNAL_EVENT_TYPES = exports.ASCENDA_ELAPSED_QUANTITIES = exports.ASCENDA_ACTIVE_TIME_QUANTITIES = exports.ASCENDA_TOOL_TYPES = exports.ASCENDA_TELEMETRY_SOURCES = void 0;
     exports.combineDisjointHalves = combineDisjointHalves;
     exports.requireComparableQuantities = requireComparableQuantities;
     exports.ASCENDA_TELEMETRY_SOURCES = [
@@ -670,6 +697,51 @@ var require_out = __commonJS({
       "review_given",
       "pull_request_opened"
     ];
+    exports.EVENT_METADATA_DISCLOSURE = {
+      language: "edits",
+      fileType: "edits",
+      durationBucket: "session",
+      tokenPressureBucket: "context",
+      linesChangedBucket: "edits",
+      commandClass: "counts",
+      gitAction: "git",
+      milestoneKind: "git",
+      branchHash: "repo",
+      autonomyMode: "posture",
+      modelClass: "model",
+      modelId: "model",
+      userModified: "edits",
+      outcome: "outcome",
+      trigger: "outcome",
+      promptClass: "counts",
+      reason: "outcome",
+      afterHours: "clock",
+      activity: "counts",
+      // One constant word, from the agent itself. The session sentence names it.
+      sessionEndReason: "session",
+      interruptionKind: "waiting",
+      // Free text by type, and written by no hook mapper — the IDE extension's
+      // test signal is the only producer. The setup disclosure's third refusal
+      // line says as much, and tool-kit's guard test fails if a mapper starts.
+      message: "counts",
+      host: "session",
+      // One constant word from the host's own environment: this machine, or a
+      // hosted session. The session sentence names it.
+      runtime: "session",
+      toolName: "tools",
+      simulated: "transport",
+      relatedEventType: "transport",
+      skillVersion: "transport",
+      // A hash computed before it reaches any collector; the task itself is never
+      // seen by this code, so there is nothing about the work here to disclose.
+      taskFingerprint: "transport",
+      importKey: "transport",
+      extractionId: "transport",
+      importSchema: "transport",
+      // The version of the Ascenda collector that sent this event. Names the
+      // build, and nothing about the work it observed.
+      collectorVersion: "transport"
+    };
     exports.EVENT_METADATA_FIELDS = [
       "language",
       "fileType",
@@ -693,13 +765,17 @@ var require_out = __commonJS({
       "message",
       "host",
       "toolName",
+      "runtime",
+      "sessionEndReason",
+      "interruptionKind",
       "simulated",
       "relatedEventType",
       "skillVersion",
       "taskFingerprint",
       "importKey",
       "extractionId",
-      "importSchema"
+      "importSchema",
+      "collectorVersion"
     ];
     exports.IDEMPOTENCY_KEY_MAX_LENGTH = 128;
     exports.TOOL_EVENT_DELIVERED_STATUSES = ["accepted", "duplicate"];
@@ -865,6 +941,21 @@ var require_payload = __commonJS({
   }
 });
 
+// ../packages/tool-kit/out/collectorVersion.js
+var require_collectorVersion = __commonJS({
+  "../packages/tool-kit/out/collectorVersion.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.COLLECTOR_VERSION = exports.UNRELEASED_COLLECTOR_VERSION = void 0;
+    exports.describeCollectorVersion = describeCollectorVersion;
+    exports.UNRELEASED_COLLECTOR_VERSION = "unreleased";
+    exports.COLLECTOR_VERSION = "0.1.28" ? "0.1.28" : exports.UNRELEASED_COLLECTOR_VERSION;
+    function describeCollectorVersion(version = exports.COLLECTOR_VERSION) {
+      return version === exports.UNRELEASED_COLLECTOR_VERSION ? `${version} (built from a checkout, not a release)` : version;
+    }
+  }
+});
+
 // ../packages/tool-kit/out/eventLog.js
 var require_eventLog = __commonJS({
   "../packages/tool-kit/out/eventLog.js"(exports) {
@@ -1618,6 +1709,7 @@ var require_eventSender = __commonJS({
     var tokenStore_1 = require_tokenStore();
     var stateStore_1 = require_stateStore();
     var payload_1 = require_payload();
+    var collectorVersion_1 = require_collectorVersion();
     var AscendaSemanticEventError = class extends Error {
       constructor(message) {
         super(message);
@@ -1639,9 +1731,12 @@ var require_eventSender = __commonJS({
         provenance: tool_contract_1.ASCENDA_PROVENANCE,
         privacyMode: "metadata_only",
         ...mapped,
-        metadata: mapped.metadata ?? {}
+        metadata: withCollectorVersion(mapped.metadata)
       };
     }
+    function withCollectorVersion(metadata) {
+      return { ...metadata, collectorVersion: collectorVersion_1.COLLECTOR_VERSION };
+    }
     var DEFAULT_TIMEOUT_MS = 5e3;
     var RETRY_DELAY_MS = 250;
     var AscendaEventSender = class {
@@ -1661,6 +1756,30 @@ var require_eventSender = __commonJS({
       async send(mapped) {
         return this.post(buildEventPayload(this.config, mapped));
       }
+      /**
+       * Writes the event to the outbox and returns without touching the network.
+       * The next outbox pass delivers it, from whichever hook of this
+       * installation sends next.
+       *
+       * For a hook whose host is exiting. A process the host may kill at any
+       * moment can't wait on a send, and one killed mid-send dies before
+       * {@link post} gets to queue the payload, so the event goes with it. Here
+       * the payload is on disk before anything can go wrong.
+       *
+       * Returns whether it is. When the write fails the journal says the event
+       * was lost; nothing else could have kept it.
+       */
+      queue(mapped) {
+        const payload = buildEventPayload(this.config, mapped);
+        const queued = this.enqueue(payload);
+        if (!queued) {
+          this.lastState = (0, stateStore_1.recordSendOutcome)(this.stateFilePath(), this.config.toolInstallationId, "other", {
+            detail: `${payload.eventType}: outbox write failed, event lost`
+          });
+        }
+        this.log(payload, "not_sent", queued ? "queued" : void 0);
+        return queued;
+      }
       /**
        * Sends one of the six agent-observed types (dark-flow-gap-analysis §2.1).
        * Distinct from {@link send} rather than an option on it, because the
@@ -1701,7 +1820,7 @@ var require_eventSender = __commonJS({
           consentScope: tool_contract_1.ASCENDA_SEMANTIC_CONSENT_SCOPE,
           provenance: tool_contract_1.ASCENDA_SEMANTIC_PROVENANCE,
           privacyMode: "metadata_only",
-          metadata: mapped.metadata
+          metadata: withCollectorVersion(mapped.metadata)
         };
         return this.post(payload);
       }
@@ -1732,7 +1851,7 @@ var require_eventSender = __commonJS({
           consentScope: tool_contract_1.ASCENDA_COLLABORATION_CONSENT_SCOPE,
           provenance: tool_contract_1.ASCENDA_PROVENANCE,
           privacyMode: "metadata_only",
-          metadata: mapped.metadata ?? {}
+          metadata: withCollectorVersion(mapped.metadata)
         };
         return this.post(payload);
       }
@@ -1957,6 +2076,8 @@ var require_eventSender = __commonJS({
       }
       /** Never throws: a renewal that errors is a failed renewal, not a failed turn. */
       async renewEventToken() {
+        if (this.config.renewToken === false)
+          return false;
         try {
           const renewed = await (0, http_1.renewToolToken)(this.config.apiBaseUrl, this.eventWriteToken, this.signal());
           if (!renewed)
@@ -2169,6 +2290,7 @@ var require_credentials = __commonJS({
     exports.readMachineCredentials = readMachineCredentials;
     exports.writeMachineCredentials = writeMachineCredentials;
     exports.writeTopLevelCredentials = writeTopLevelCredentials;
+    exports.isLocalOnlyHostInstall = isLocalOnlyHostInstall;
     exports.readHostCredentials = readHostCredentials;
     exports.writeHostCredentials = writeHostCredentials;
     exports.removeHostCredentials = removeHostCredentials;
@@ -2205,6 +2327,14 @@ var require_credentials = __commonJS({
       const existing = readMachineCredentials();
       writeMachineCredentials({ ...credentials, ...existing?.tools ? { tools: existing.tools } : {} });
     }
+    function isLocalOnlyHostInstall(host, hasToken) {
+      const credentials = readHostCredentials(host);
+      if (!credentials?.localOnly)
+        return false;
+      if (process.env.ASCENDA_EVENT_WRITE_TOKEN)
+        return false;
+      return !(credentials.toolInstallationId && hasToken(credentials.toolInstallationId));
+    }
     function readHostCredentials(host) {
       const entry = readMachineCredentials()?.tools?.[host];
       if (!entry || typeof entry !== "object" || Array.isArray(entry))
@@ -2773,6 +2903,9 @@ var require_hookAdapter = __commonJS({
       if (events.length === 0)
         return;
       const notice = options.onNotice ?? ((message) => console.error(message));
+      const hasToken = (id) => (0, tokenStore_1.readTokenFile)(process.env.ASCENDA_EVENT_WRITE_TOKEN_FILE ?? (0, tokenStore_1.defaultTokenFilePath)(id)) !== void 0;
+      if (options.host && (0, credentials_1.isLocalOnlyHostInstall)(options.host, hasToken))
+        return;
       let config;
       try {
         config = loadCliAgentConfig(options.toolType, options.sessionId, options.cwd, options);
@@ -2838,6 +2971,51 @@ var require_hookAdapter = __commonJS({
   }
 });
 
+// ../packages/tool-kit/out/setupDisclosure.js
+var require_setupDisclosure = __commonJS({
+  "../packages/tool-kit/out/setupDisclosure.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.FREE_TEXT_KEYS = exports.REFUSALS = exports.ALWAYS_SENT = exports.FAMILY_SENTENCES = void 0;
+    exports.renderSetupDisclosure = renderSetupDisclosure;
+    exports.FAMILY_SENTENCES = {
+      session: "when a session starts and ends, the one-word reason for the end if your agent gives one, how long each turn took, and whether it ran on this machine or in a hosted cloud session",
+      counts: "how many prompts you sent, how many replies came back, and what class of command ran in a terminal \u2014 test, lint, build, git and so on",
+      tools: "the name of each tool your agent calls",
+      outcome: "whether a call succeeded, failed, or was interrupted",
+      clock: "your machine's offset from UTC, so an evening is read as an evening",
+      repo: "your project and branch as digests computed on this machine \u2014 never the names themselves",
+      model: "which model served the session, by name and by tier",
+      posture: "the permission posture your agent was working under \u2014 asking each time, accepting edits, and so on",
+      git: "that a commit, push or revert happened, and when a pull request opened or merged",
+      edits: "roughly how much a file changed, as a bucket, and whether you edited it after the agent wrote it",
+      context: "how full the context window got",
+      waiting: "that your agent stopped and waited for you, as one word: permission_request, idle_prompt, or other",
+      reading: "what the reader could not make sense of \u2014 lines it failed to parse, files it could not open, and prompts it judged machine-written rather than typed"
+    };
+    exports.ALWAYS_SENT = ["session", "counts", "tools", "outcome", "repo", "clock"];
+    exports.REFUSALS = [
+      "Never your prompts, your agent's replies, or anything inside a file.",
+      "Never a file path, a command line, or a repository or branch name.",
+      "Content is read here only to choose one of a fixed set of labels, then discarded. No mapper writes it to an event, and a test fails the build if one starts."
+    ];
+    exports.FREE_TEXT_KEYS = ["message"];
+    function renderSetupDisclosure({ sends, displayName }) {
+      const declared = /* @__PURE__ */ new Set([...exports.ALWAYS_SENT, ...sends]);
+      const ordered = Object.keys(exports.FAMILY_SENTENCES).filter((family) => declared.has(family));
+      const lines = [
+        `What this sends from ${displayName}, once paired:`,
+        ...ordered.map((family) => `  \xB7 ${exports.FAMILY_SENTENCES[family]}`),
+        "",
+        ...exports.REFUSALS.map((line) => `  ${line}`),
+        "",
+        "  Turn it off by revoking this tool in the Ascenda app."
+      ];
+      return lines.join("\n");
+    }
+  }
+});
+
 // ../packages/tool-kit/out/cliAgentSetup.js
 var require_cliAgentSetup = __commonJS({
   "../packages/tool-kit/out/cliAgentSetup.js"(exports) {
@@ -2889,9 +3067,11 @@ var require_cliAgentSetup = __commonJS({
     var fs = __importStar(__require("fs"));
     var os2 = __importStar(__require("os"));
     var path2 = __importStar(__require("path"));
+    var collectorVersion_1 = require_collectorVersion();
     var credentials_1 = require_credentials();
     var hookAdapter_1 = require_hookAdapter();
     var http_1 = require_http();
+    var setupDisclosure_1 = require_setupDisclosure();
     var tokenStore_1 = require_tokenStore();
     var MANAGEMENT_COMMANDS = /* @__PURE__ */ new Set(["setup", "install", "status", "uninstall", "-h", "--help"]);
     function isCliAgentManagementCommand2(argument) {
@@ -2912,6 +3092,7 @@ Options
   --local [port]                shorthand for the local dev server (default port 4477)
   --tool-installation-id <id>   reuse an existing pairing instead of creating one
   --token <eventWriteToken>     reuse an existing token (stored 0600, never printed)
+  --no-pair                     install without pairing: local features on, nothing sent
   --scope project|user          where hooks are registered (default project)
   --project-dir <path>          project root for --scope project (default cwd)
   --dry-run                     print what would change, write nothing
@@ -2936,14 +3117,35 @@ Options
         return uninstall(options, spec);
       const apiBaseUrl = (options.apiBaseUrl ?? (0, credentials_1.readHostCredentials)(spec.host)?.apiBaseUrl ?? hookAdapter_1.DEFAULT_API_BASE_URL).replace(/\/$/, "");
       console.log(`Ascenda setup for ${spec.displayName} \u2014 ${apiBaseUrl}`);
-      const identity = await resolveIdentity(apiBaseUrl, options, spec);
-      if (!identity)
-        return 1;
-      console.log(`  pairing      ${identity.toolInstallationId}${identity.paired ? " (new)" : " (existing)"}`);
+      console.log(`
+${(0, setupDisclosure_1.renderSetupDisclosure)({ sends: spec.sends, displayName: spec.displayName })}
+`);
+      let identity;
+      let unpairedReason;
+      if (options.skipPairing) {
+        unpairedReason = "asked not to pair (--no-pair)";
+      } else {
+        identity = await resolveIdentity(apiBaseUrl, options, spec);
+        if (identity) {
+          console.log(`  pairing      ${identity.toolInstallationId}${identity.paired ? " (new)" : " (existing)"}`);
+        } else {
+          unpairedReason = "pairing did not finish \u2014 installing the local half anyway";
+        }
+      }
+      if (unpairedReason) {
+        console.log(`  pairing      none: ${unpairedReason}`);
+        console.log("               local features on, nothing is sent");
+      }
       const binary = installBinary(spec, options.dryRun);
       console.log(`  hook binary  ${binary}`);
       if (!options.dryRun) {
-        (0, credentials_1.writeHostCredentials)(spec.host, { apiBaseUrl, toolInstallationId: identity.toolInstallationId, pairedAt: (/* @__PURE__ */ new Date()).toISOString() });
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const toolInstallationId = identity?.toolInstallationId ?? options.toolInstallationId ?? (0, credentials_1.readHostCredentials)(spec.host)?.toolInstallationId ?? `${spec.toolType}:${crypto.randomUUID()}`;
+        (0, credentials_1.writeHostCredentials)(spec.host, {
+          apiBaseUrl,
+          toolInstallationId,
+          ...identity ? { pairedAt: now } : { localOnly: true, installedAt: now }
+        });
       }
       console.log(`  credentials  ${(0, credentials_1.credentialsFilePath)()} (tools.${spec.host})`);
       const settingsFile = spec.settings.settingsPath(options.scope, options.projectDir);
@@ -2957,6 +3159,9 @@ Options
       }
       console.log(`
 Done. ${spec.restartHint}`);
+      if (!identity) {
+        console.log(`Pair later:     npx ${spec.packageName} setup`);
+      }
       console.log(`Check anytime:  npx ${spec.packageName} status`);
       return 0;
     }
@@ -2965,6 +3170,7 @@ Done. ${spec.restartHint}`);
         scope: "project",
         projectDir: process.cwd(),
         dryRun: false,
+        skipPairing: false,
         action: "install"
       };
       for (let i = 0; i < argv.length; i++) {
@@ -3014,6 +3220,14 @@ Done. ${spec.restartHint}`);
           case "--dry-run":
             options.dryRun = true;
             break;
+          case "--no-pair":
+          // `--no-pairing` is the spelling this landed under first. Both appeared
+          // only in an unreleased changelog, so this alias exists to spare anyone
+          // reading that draft, and `--no-pair` — the Claude Code adapter's own
+          // spelling — is the documented one.
+          case "--no-pairing":
+            options.skipPairing = true;
+            break;
           case "-h":
           case "--help":
             options.action = "help";
@@ -3165,9 +3379,11 @@ ${serialised}`);
       const settings = readSettings(settingsFile);
       const registered = spec.hookEvents.filter((event) => (settings.hooks?.[event] ?? []).some((entry) => isOurs(entry, spec))).length;
       const stale = findStaleHookCommands(settings, binary, spec);
+      const localOnly = (0, credentials_1.isLocalOnlyHostInstall)(spec.host, (id) => (0, tokenStore_1.readTokenFile)((0, tokenStore_1.defaultTokenFilePath)(id)) !== void 0);
+      console.log(`version        ${(0, collectorVersion_1.describeCollectorVersion)()}`);
       console.log(`api base url   ${credentials?.apiBaseUrl ?? "\u2014 not configured"}`);
-      console.log(`pairing        ${credentials?.toolInstallationId ?? "\u2014 not paired"}`);
-      console.log(`token          ${tokenFile && (0, tokenStore_1.readTokenFile)(tokenFile) ? "present" : "\u2014 missing"}`);
+      console.log(`pairing        ${credentials?.toolInstallationId ?? "\u2014 not paired"}${localOnly ? " (installed, not paired \u2014 local features active, telemetry inactive)" : ""}`);
+      console.log(`token          ${localOnly ? "\u2014 none needed until this install is paired" : tokenFile && (0, tokenStore_1.readTokenFile)(tokenFile) ? "present" : "\u2014 missing"}`);
       console.log(`hook binary    ${fs.existsSync(binary) ? binary : "\u2014 not installed"}`);
       console.log(`hooks          ${registered}/${spec.hookEvents.length} registered in ${settingsFile}`);
       if (stale.length) {
@@ -3176,7 +3392,8 @@ ${serialised}`);
           console.log(`               ${command}`);
         console.log(`               Remove them from ${settingsFile} by hand; setup cannot tell them from a hook you wrote.`);
       }
-      const healthy = credentials?.toolInstallationId && registered === spec.hookEvents.length && fs.existsSync(binary) && !stale.length;
+      const paired = localOnly || credentials?.toolInstallationId !== void 0;
+      const healthy = paired && registered === spec.hookEvents.length && fs.existsSync(binary) && !stale.length;
       return healthy ? 0 : 1;
     }
     function uninstall(options, spec) {
@@ -3467,9 +3684,9 @@ var require_out2 = __commonJS({
   "../packages/tool-kit/out/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.consumeTurnDurationMs = exports.writeTopLevelCredentials = exports.writeMachineCredentials = exports.writeHostCredentials = exports.removeHostCredentials = exports.readMachineCredentials = exports.readHostCredentials = exports.credentialsFilePath = exports.writeHookSettings = exports.runCliAgentSetup = exports.isCliAgentManagementCommand = exports.findStaleHookCommands = exports.cliAgentHookBinPath = exports.resolveContextHashes = exports.resolveCliAgentInstallationId = exports.loadCliAgentConfig = exports.deliverHookEvents = exports.MissingInstallationIdError = exports.DEFAULT_API_BASE_URL = exports.resolveEventLogPath = exports.expandUserPath = exports.appendEventLog = exports.EVENT_LOG_ENV_VAR = exports.buildEventPayload = exports.AscendaSemanticEventError = exports.AscendaEventSender = exports.mintIdempotencyKey = exports.looksLikeCorrection = exports.outcomeForHook = exports.inferOutcome = exports.getNestedNumber = exports.getNestedString = exports.getNested = exports.getNumber = exports.getString = exports.localHourAt = exports.utcOffsetMinutesAt = exports.BUSINESS_DAY = exports.isOutsideBusinessHours = exports.isAfterHours = exports.bucketDurationMs = exports.bucketLinesChanged = exports.classifyModelClass = exports.autonomyBand = exports.invitesDebrief = exports.classifyWorkMilestone = exports.isReworkGitAction = exports.classifyGitAction = exports.isVerificationCommand = exports.classifyCommand = void 0;
-    exports.getPairingStatus = exports.createPairingSession = exports.AscendaApiError = exports.liveBusSocketCandidates = exports.liveBusSocketPath = exports.bucketPromptSize = exports.emitLiveSignal = exports.recordForgeProjectAlias = exports.forgeFullNameFromConfig = exports.readForgeFullName = exports.parseForgeFullName = exports.forgeProjectHash = exports.workContextRegistryFilePath = exports.readWorkContextRegistry = exports.recordWorkContextAlias = exports.recordWorkContext = exports.readBranchName = exports.normalizeBranchName = exports.deriveBranchHashForCwd = exports.deriveBranchHash = exports.deriveWorkContext = exports.hashWithMachineSalt = exports.readOrCreateMachineSalt = exports.machineSaltFilePath = exports.fixedTimeProvider = exports.systemTimeProvider = exports.enforceOutboxBounds = exports.claimOutbox = exports.readOutboxSummary = exports.appendToOutbox = exports.defaultOutboxFilePath = exports.outboxDrainEnabled = exports.DEFAULT_OUTBOX_DRAIN_BATCH_SIZE = exports.DEFAULT_OUTBOX_MAX_AGE_MS = exports.DEFAULT_OUTBOX_MAX_ENTRIES = exports.OUTBOX_DRAIN_ENV_VAR = exports.recordOutboxDiscard = exports.unresolvedToolInstallationId = exports.unresolvedStateFilePath = exports.markFailureNotified = exports.shouldAnnounceFailure = exports.recordSendOutcome = exports.readCollectorState = exports.defaultStateFilePath = exports.readTokenFile = exports.persistEventWriteToken = exports.listPersistedToolInstallationIds = exports.defaultTokenFilePath = exports.ascendaHome = exports.recordTurnStart = void 0;
-    exports.isRetryableStatus = exports.parseIngestResponse = exports.postToolEventsBatch = exports.postToolEvent = exports.renewToolToken = void 0;
+    exports.renderSetupDisclosure = exports.REFUSALS = exports.FREE_TEXT_KEYS = exports.FAMILY_SENTENCES = exports.ALWAYS_SENT = exports.writeHookSettings = exports.runCliAgentSetup = exports.isCliAgentManagementCommand = exports.findStaleHookCommands = exports.cliAgentHookBinPath = exports.resolveContextHashes = exports.resolveCliAgentInstallationId = exports.loadCliAgentConfig = exports.deliverHookEvents = exports.MissingInstallationIdError = exports.DEFAULT_API_BASE_URL = exports.resolveEventLogPath = exports.expandUserPath = exports.appendEventLog = exports.EVENT_LOG_ENV_VAR = exports.buildEventPayload = exports.AscendaSemanticEventError = exports.AscendaEventSender = exports.describeCollectorVersion = exports.UNRELEASED_COLLECTOR_VERSION = exports.COLLECTOR_VERSION = exports.mintIdempotencyKey = exports.looksLikeCorrection = exports.outcomeForHook = exports.inferOutcome = exports.getNestedNumber = exports.getNestedString = exports.getNested = exports.getNumber = exports.getString = exports.localHourAt = exports.utcOffsetMinutesAt = exports.BUSINESS_DAY = exports.isOutsideBusinessHours = exports.isAfterHours = exports.bucketDurationMs = exports.bucketLinesChanged = exports.classifyModelClass = exports.autonomyBand = exports.invitesDebrief = exports.classifyWorkMilestone = exports.isReworkGitAction = exports.classifyGitAction = exports.isVerificationCommand = exports.classifyCommand = void 0;
+    exports.readForgeFullName = exports.parseForgeFullName = exports.forgeProjectHash = exports.workContextRegistryFilePath = exports.readWorkContextRegistry = exports.recordWorkContextAlias = exports.recordWorkContext = exports.readBranchName = exports.normalizeBranchName = exports.deriveBranchHashForCwd = exports.deriveBranchHash = exports.deriveWorkContext = exports.hashWithMachineSalt = exports.readOrCreateMachineSalt = exports.machineSaltFilePath = exports.fixedTimeProvider = exports.systemTimeProvider = exports.enforceOutboxBounds = exports.claimOutbox = exports.readOutboxSummary = exports.appendToOutbox = exports.defaultOutboxFilePath = exports.outboxDrainEnabled = exports.DEFAULT_OUTBOX_DRAIN_BATCH_SIZE = exports.DEFAULT_OUTBOX_MAX_AGE_MS = exports.DEFAULT_OUTBOX_MAX_ENTRIES = exports.OUTBOX_DRAIN_ENV_VAR = exports.recordOutboxDiscard = exports.unresolvedToolInstallationId = exports.unresolvedStateFilePath = exports.markFailureNotified = exports.shouldAnnounceFailure = exports.recordSendOutcome = exports.readCollectorState = exports.defaultStateFilePath = exports.readTokenFile = exports.persistEventWriteToken = exports.listPersistedToolInstallationIds = exports.defaultTokenFilePath = exports.ascendaHome = exports.recordTurnStart = exports.consumeTurnDurationMs = exports.writeTopLevelCredentials = exports.writeMachineCredentials = exports.writeHostCredentials = exports.removeHostCredentials = exports.readMachineCredentials = exports.readHostCredentials = exports.isLocalOnlyHostInstall = exports.credentialsFilePath = void 0;
+    exports.isRetryableStatus = exports.parseIngestResponse = exports.postToolEventsBatch = exports.postToolEvent = exports.renewToolToken = exports.getPairingStatus = exports.createPairingSession = exports.AscendaApiError = exports.liveBusSocketCandidates = exports.liveBusSocketPath = exports.bucketPromptSize = exports.emitLiveSignal = exports.recordForgeProjectAlias = exports.forgeFullNameFromConfig = void 0;
     var commandClassifier_1 = require_commandClassifier();
     Object.defineProperty(exports, "classifyCommand", { enumerable: true, get: function() {
       return commandClassifier_1.classifyCommand;
@@ -3550,6 +3767,16 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "mintIdempotencyKey", { enumerable: true, get: function() {
       return payload_1.mintIdempotencyKey;
     } });
+    var collectorVersion_1 = require_collectorVersion();
+    Object.defineProperty(exports, "COLLECTOR_VERSION", { enumerable: true, get: function() {
+      return collectorVersion_1.COLLECTOR_VERSION;
+    } });
+    Object.defineProperty(exports, "UNRELEASED_COLLECTOR_VERSION", { enumerable: true, get: function() {
+      return collectorVersion_1.UNRELEASED_COLLECTOR_VERSION;
+    } });
+    Object.defineProperty(exports, "describeCollectorVersion", { enumerable: true, get: function() {
+      return collectorVersion_1.describeCollectorVersion;
+    } });
     var eventSender_1 = require_eventSender();
     Object.defineProperty(exports, "AscendaEventSender", { enumerable: true, get: function() {
       return eventSender_1.AscendaEventSender;
@@ -3608,10 +3835,29 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "writeHookSettings", { enumerable: true, get: function() {
       return cliAgentSetup_1.writeHookSettings;
     } });
+    var setupDisclosure_1 = require_setupDisclosure();
+    Object.defineProperty(exports, "ALWAYS_SENT", { enumerable: true, get: function() {
+      return setupDisclosure_1.ALWAYS_SENT;
+    } });
+    Object.defineProperty(exports, "FAMILY_SENTENCES", { enumerable: true, get: function() {
+      return setupDisclosure_1.FAMILY_SENTENCES;
+    } });
+    Object.defineProperty(exports, "FREE_TEXT_KEYS", { enumerable: true, get: function() {
+      return setupDisclosure_1.FREE_TEXT_KEYS;
+    } });
+    Object.defineProperty(exports, "REFUSALS", { enumerable: true, get: function() {
+      return setupDisclosure_1.REFUSALS;
+    } });
+    Object.defineProperty(exports, "renderSetupDisclosure", { enumerable: true, get: function() {
+      return setupDisclosure_1.renderSetupDisclosure;
+    } });
     var credentials_1 = require_credentials();
     Object.defineProperty(exports, "credentialsFilePath", { enumerable: true, get: function() {
       return credentials_1.credentialsFilePath;
     } });
+    Object.defineProperty(exports, "isLocalOnlyHostInstall", { enumerable: true, get: function() {
+      return credentials_1.isLocalOnlyHostInstall;
+    } });
     Object.defineProperty(exports, "readHostCredentials", { enumerable: true, get: function() {
       return credentials_1.readHostCredentials;
     } });
@@ -3939,6 +4185,9 @@ var SETUP = {
   binaryName: "ascenda-gemini-hook",
   hookEvents: HOOK_EVENTS,
   restartHint: "Restart Gemini CLI to load the hooks.",
+  // Nothing beyond the shared set: Gemini's hooks expose no posture, no
+  // model, no git action and no context figure.
+  sends: [],
   settings: {
     settingsPath: (scope, projectDir) => scope === "user" ? path.join(os.homedir(), ".gemini", "settings.json") : path.join(projectDir, ".gemini", "settings.json"),
     // Gemini nests one level deeper than the other agents: each event maps to

package/dist/liveSignal.js

@@ -1,8 +1,7 @@
 import { bucketPromptSize, getString, inferOutcome } from "@ascenda-one/tool-kit";
 /**
  * Maps Gemini CLI hooks onto the desktop waterline's much smaller vocabulary
- * (`LiveBusEvent` in `@ascenda-one/tool-kit`;
- * `docs/MACOS_LIVE_DEMAND_WATERLINE.md` in the app repo).
+ * (`LiveBusEvent` in `@ascenda-one/tool-kit`).
  *
  * This is **not** the telemetry mapping and shares nothing with
  * `mapGeminiEvent`. That one feeds daily buckets read hours later; this one

package/dist/liveSignal.js.map

@@ -1 +1 @@
-{"version":3,"file":"liveSignal.js","sourceRoot":"","sources":["../src/liveSignal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAOlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,aAAa,CAAC,QAA6B,EAAE,KAAsB;IACjF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5C,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,uCAAuC;YACvC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpI,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACjD,KAAK,WAAW,CAAC,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,KAAK,aAAa,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACnD,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC5C,OAAO,CAAC,CAAC,OAAO,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;GAMG"}
+{"version":3,"file":"liveSignal.js","sourceRoot":"","sources":["../src/liveSignal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAOlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,aAAa,CAAC,QAA6B,EAAE,KAAsB;IACjF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5C,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,uCAAuC;YACvC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpI,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACjD,KAAK,WAAW,CAAC,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,KAAK,aAAa,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACnD,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC5C,OAAO,CAAC,CAAC,OAAO,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;GAMG"}

package/dist/setup.js

@@ -22,6 +22,9 @@ export const SETUP = {
     binaryName: "ascenda-gemini-hook",
     hookEvents: HOOK_EVENTS,
     restartHint: "Restart Gemini CLI to load the hooks.",
+    // Nothing beyond the shared set: Gemini's hooks expose no posture, no
+    // model, no git action and no context figure.
+    sends: [],
     settings: {
         settingsPath: (scope, projectDir) => scope === "user" ? path.join(os.homedir(), ".gemini", "settings.json") : path.join(projectDir, ".gemini", "settings.json"),
         // Gemini nests one level deeper than the other agents: each event maps to

package/dist/setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,CAAU,CAAC;AAE1I;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAI/B,MAAM,CAAC,MAAM,KAAK,GAAsB;IACtC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,iBAAiB;IAC3B,WAAW,EAAE,2BAA2B;IACxC,UAAU,EAAE,qBAAqB;IACjC,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,uCAAuC;IACpD,QAAQ,EAAE;QACR,YAAY,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAClC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC;QAC5H,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;QAC9F,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACnB,MAAM,KAAK,GAAG,KAAoC,CAAC;YACnD,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO,CAAC;YACzF,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,CAAC;KACF;CACF,CAAC"}
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,CAAU,CAAC;AAE1I;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAI/B,MAAM,CAAC,MAAM,KAAK,GAAsB;IACtC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,iBAAiB;IAC3B,WAAW,EAAE,2BAA2B;IACxC,UAAU,EAAE,qBAAqB;IACjC,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,uCAAuC;IACpD,sEAAsE;IACtE,8CAA8C;IAC9C,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACR,YAAY,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAClC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC;QAC5H,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;QAC9F,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACnB,MAAM,KAAK,GAAG,KAAoC,CAAC;YACnD,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO,CAAC;YACzF,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,CAAC;KACF;CACF,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "publishConfig": { "access": "public" },
   "name": "@ascenda-one/gemini-hooks",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "Gemini CLI hooks adapter for Ascenda AI workload telemetry",
   "repository": {
     "type": "git",
@@ -16,7 +16,7 @@
   },
   "scripts": {
     "build": "tsc -p ./ && npm run bundle",
-    "bundle": "esbuild src/cli.ts --bundle --platform=node --format=esm --banner:js=\"import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);\" --outfile=dist/cli.js",
+    "bundle": "node ../scripts/esbuild-collector.mjs src/cli.ts --bundle --platform=node --format=esm --banner:js=\"import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);\" --outfile=dist/cli.js",
     "watch": "tsc -w -p ./",
     "test": "node --test"
   },