@ascenda-one/github-collector 0.1.15 → 0.1.17

package/dist/cli.js

@@ -200,6 +200,102 @@ var require_workMilestoneClassifier = __commonJS({
   }
 });
 
+// ../packages/tool-kit/out/autonomyBand.js
+var require_autonomyBand = __commonJS({
+  "../packages/tool-kit/out/autonomyBand.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.autonomyBand = autonomyBand;
+    function autonomyBand(mode) {
+      if (typeof mode !== "string")
+        return "unknown";
+      return BAND_BY_MODE[mode] ?? "unknown";
+    }
+    var BAND_BY_MODE = {
+      plan: "planning",
+      default: "supervised",
+      accept_edits: "edits_auto",
+      // Two tokens, one band — and the reason the tokens stayed two. They differ
+      // in how the user arrived at the posture rather than in how much the agent
+      // may then do unasked, so today they read the same. If that ever stops being
+      // true, this line changes and the whole corpus re-reads correctly, because
+      // the wire never collapsed them.
+      auto: "delegated",
+      dont_ask: "delegated",
+      bypass_permissions: "unsupervised"
+    };
+  }
+});
+
+// ../packages/tool-kit/out/modelClassifier.js
+var require_modelClassifier = __commonJS({
+  "../packages/tool-kit/out/modelClassifier.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.classifyModelClass = classifyModelClass;
+    function classifyModelClass(raw) {
+      const candidate = raw;
+      if (candidate === void 0 || candidate === null)
+        return void 0;
+      if (typeof candidate !== "string")
+        return "unknown";
+      const value = candidate.trim().toLowerCase();
+      if (!value)
+        return void 0;
+      if (ROUTER_SENTINEL.test(value))
+        return "router:auto";
+      const vendor = readModelVendor(value);
+      if (vendor === void 0)
+        return "unknown";
+      for (const [pattern, modelClass] of TIER_PATTERNS_BY_VENDOR[vendor]) {
+        if (pattern.test(value))
+          return modelClass;
+      }
+      return UNKNOWN_TIER_BY_VENDOR[vendor];
+    }
+    function readModelVendor(value) {
+      for (const [pattern, vendor] of VENDOR_PATTERNS) {
+        if (pattern.test(value))
+          return vendor;
+      }
+      return void 0;
+    }
+    var ROUTER_SENTINEL = /^(?:[a-z0-9][a-z0-9._-]*\/)?(?:auto|default)$/;
+    var VENDOR_PATTERNS = [
+      [/\b(anthropic|claude|opus|sonnet|haiku|fable)\b/, "anthropic"],
+      [/\b(openai|gpt|o[1-9])\b/, "openai"],
+      [/\b(google|gemini|vertex)\b/, "google"],
+      // xAI carries no corporate prefix in any observed id — the family name is
+      // the whole marker, exactly as `claude` and `gemini` are for theirs.
+      [/\b(xai|grok)\b/, "xai"],
+      [/\b(ollama|llamacpp|on[-_]?device|local)\b/, "local"]
+    ];
+    var TIER_PATTERNS_BY_VENDOR = {
+      anthropic: [
+        [/\bopus\b/, "anthropic:opus"],
+        [/\bsonnet\b/, "anthropic:sonnet"],
+        [/\bhaiku\b/, "anthropic:haiku"],
+        [/\bfable\b/, "anthropic:fable"]
+      ],
+      openai: [[/\bgpt\b/, "openai:gpt"]],
+      google: [[/\bgemini\b/, "google:gemini"]],
+      // One tier for now. The line's coding variants (`grok-code-fast-1`) are the
+      // same tier word plus a suffix, and splitting them off would be inventing a
+      // distinction the ids do not yet draw — `<vendor>:unknown` is waiting for
+      // the day one does.
+      xai: [[/\bgrok\b/, "xai:grok"]],
+      local: [[/\b(ollama|llamacpp|on[-_]?device)\b/, "local:on_device"]]
+    };
+    var UNKNOWN_TIER_BY_VENDOR = {
+      anthropic: "anthropic:unknown",
+      openai: "openai:unknown",
+      google: "google:unknown",
+      xai: "xai:unknown",
+      local: "local:unknown"
+    };
+  }
+});
+
 // ../packages/tool-kit/out/buckets.js
 var require_buckets = __commonJS({
   "../packages/tool-kit/out/buckets.js"(exports) {
@@ -294,89 +390,6 @@ var require_afterHours = __commonJS({
   }
 });
 
-// ../packages/tool-kit/out/payload.js
-var require_payload = __commonJS({
-  "../packages/tool-kit/out/payload.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.getString = getString;
-    exports.getNumber = getNumber;
-    exports.getNested = getNested;
-    exports.getNestedString = getNestedString;
-    exports.getNestedNumber = getNestedNumber;
-    exports.inferOutcome = inferOutcome;
-    exports.outcomeForHook = outcomeForHook;
-    exports.looksLikeCorrection = looksLikeCorrection;
-    function getString(input, keys) {
-      for (const key of keys) {
-        const value = input[key];
-        if (typeof value === "string" && value.trim())
-          return value;
-      }
-      return void 0;
-    }
-    function getNumber(input, keys) {
-      for (const key of keys) {
-        const value = input[key];
-        if (typeof value === "number" && Number.isFinite(value))
-          return value;
-      }
-      return void 0;
-    }
-    function getNested(input, path) {
-      let current = input;
-      for (const segment of path) {
-        if (!current || typeof current !== "object")
-          return void 0;
-        current = current[segment];
-      }
-      return current;
-    }
-    function getNestedString(input, paths) {
-      for (const path of paths) {
-        const value = getNested(input, path);
-        if (typeof value === "string" && value.trim())
-          return value;
-      }
-      return void 0;
-    }
-    function getNestedNumber(input, paths) {
-      for (const path of paths) {
-        const value = getNested(input, path);
-        if (typeof value === "number" && Number.isFinite(value))
-          return value;
-      }
-      return void 0;
-    }
-    function inferOutcome(input) {
-      const exitCode = getNumber(input, ["exitCode", "exit_code", "status"]) ?? getNestedNumber(input, [["tool_response", "exitCode"], ["tool_response", "exit_code"], ["result", "exitCode"], ["result", "exit_code"]]);
-      if (typeof exitCode === "number")
-        return exitCode === 0 ? "success" : "failure";
-      const error = getString(input, ["error", "errorMessage"]) ?? getNestedString(input, [["tool_response", "error"], ["result", "error"]]);
-      if (error)
-        return "failure";
-      return "unknown";
-    }
-    function outcomeForHook(hookName, input) {
-      if (hookName === "PostToolUseFailure") {
-        const interrupted = input["is_interrupt"] === true || getNested(input, ["tool_response", "interrupted"]) === true;
-        return interrupted ? "cancelled" : "failure";
-      }
-      if (hookName === "PostToolUse") {
-        if (getNested(input, ["tool_response", "interrupted"]) === true)
-          return "cancelled";
-        return "success";
-      }
-      return "unknown";
-    }
-    function looksLikeCorrection(text) {
-      if (!text)
-        return false;
-      return /\b(wrong|incorrect|try again|fix|not what i asked|that's not|that is not|redo|regenerate|you missed|doesn't work|does not work)\b/i.test(text);
-    }
-  }
-});
-
 // ../packages/tool-contract/out/metricKeys.js
 var require_metricKeys = __commonJS({
   "../packages/tool-contract/out/metricKeys.js"(exports) {
@@ -416,6 +429,42 @@ var require_metricKeys = __commonJS({
       linesChangedBucket: { readBy: ["backend"], backendAliases: ["linesChangedBucket", "lines_changed_bucket"] },
       // ── Read by the local handoff only ──────────────────────────────────────
       activeMinutes: { readBy: ["handoff"], unit: "minutes" },
+      /**
+       * The two halves of `activeMinutes`, and deliberately two keys.
+       *
+       * They partition it exactly, so a reader can add them — but there is no
+       * third key holding the sum, because the sum is `activeMinutes` and it
+       * already exists. Presenting one combined "active" figure in place of these
+       * is the thing the split was added to stop: an hour of typing and an hour of
+       * watching an agent work are not the same hour, and a single number says
+       * they are.
+       */
+      handsOnMinutes: {
+        readBy: ["handoff"],
+        unit: "minutes",
+        note: "Active time immediately preceding a human prompt \u2014 the only interval a transcript can show a person present for, because the prompt at its end is the evidence."
+      },
+      agentSupervisingMinutes: {
+        readBy: ["handoff"],
+        unit: "minutes",
+        note: "The remaining active time: the agent was working and the person was not typing. NOT a claim that anyone watched it \u2014 nothing in a transcript could show that. Never render as attention."
+      },
+      // The split's honesty counters. Read by neither the backend nor the handoff
+      // on purpose: they exist so a thin or posture-blind session can be told from
+      // a complete one, and a reader that ignores them is choosing to, rather than
+      // being unable to.
+      activeSplitInstants: {
+        readBy: ["diagnostic"],
+        note: "Distinct timestamps the split ran over, after collapsing ties. The denominator: two minutes off four instants and off four hundred are not the same measurement."
+      },
+      activeSplitUndatedLines: {
+        readBy: ["diagnostic"],
+        note: "Known lines carrying a timestamp that would not parse. Absent from the timeline, so both halves are short by an unknown amount and only this says so."
+      },
+      activeSplitUnposturedInstants: {
+        readBy: ["diagnostic"],
+        note: "Instants reached before any permissionMode had been declared. Their supervising time lands in the unknown band, which is a blind spot rather than a posture."
+      },
       afterHoursRequests: { readBy: ["handoff"] },
       approximateLintErrorsCount: { readBy: ["handoff"] },
       canceledCount: { readBy: ["handoff"] },
@@ -429,6 +478,11 @@ var require_metricKeys = __commonJS({
         unit: "tokens",
         note: "The measured quantity, with no assumed denominator. Prefer this to the ratio for any within-person baseline."
       },
+      contextWindowTokens: {
+        readBy: ["handoff"],
+        unit: "tokens",
+        note: "Codex only: the model_context_window the rollout itself recorded \u2014 the real denominator its contextWindowPeakPct was computed against. Claude Code records no window and its ratio assumes 200k; absent here means the store never said."
+      },
       date: { readBy: ["handoff"] },
       errorCount: { readBy: ["handoff"] },
       filesChangedCount: { readBy: ["handoff"] },
@@ -512,6 +566,10 @@ var require_metricKeys = __commonJS({
       unparsedLines: { readBy: ["diagnostic"] },
       unreadableChatSessionFiles: { readBy: ["diagnostic"] },
       unreadableHistoryFiles: { readBy: ["diagnostic"] },
+      unreadableRolloutFiles: {
+        readBy: ["diagnostic"],
+        note: "Codex only: rollout files the extractor meant to read and could not open. Summed into the import's read-failure warning, so a store that is partly unreadable says so rather than reporting a short window as the whole."
+      },
       unrecognisedChatSessionFiles: { readBy: ["diagnostic"] }
     };
     function backendMetricKeys() {
@@ -525,7 +583,7 @@ var require_out = __commonJS({
   "../packages/tool-contract/out/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.backendMetricKeys = exports.METRIC_KEYS = exports.ASCENDA_SEMANTIC_PROVENANCE = exports.ASCENDA_HISTORICAL_CONSENT_SCOPE = exports.ASCENDA_COLLABORATION_CONSENT_SCOPE = exports.ASCENDA_SEMANTIC_CONSENT_SCOPE = exports.ASCENDA_PROVENANCE = exports.ASCENDA_CONSENT_SCOPE = exports.EVENT_WORKLOAD_CATEGORY = exports.COLLABORATION_EVENT_TYPES = exports.SEMANTIC_WORK_SIGNAL_EVENT_TYPES = void 0;
+    exports.backendMetricKeys = exports.METRIC_KEYS = exports.ASCENDA_SEMANTIC_PROVENANCE = exports.ASCENDA_HISTORICAL_CONSENT_SCOPE = exports.ASCENDA_COLLABORATION_CONSENT_SCOPE = exports.ASCENDA_SEMANTIC_CONSENT_SCOPE = exports.ASCENDA_PROVENANCE = exports.ASCENDA_CONSENT_SCOPE = exports.EVENT_WORKLOAD_CATEGORY = exports.TOOL_EVENT_DELIVERED_STATUSES = exports.IDEMPOTENCY_KEY_MAX_LENGTH = exports.EVENT_METADATA_FIELDS = exports.COLLABORATION_EVENT_TYPES = exports.SEMANTIC_WORK_SIGNAL_EVENT_TYPES = void 0;
     exports.SEMANTIC_WORK_SIGNAL_EVENT_TYPES = [
       "approach_churn_detected",
       "goal_drift_detected",
@@ -539,6 +597,39 @@ var require_out = __commonJS({
       "review_given",
       "pull_request_opened"
     ];
+    exports.EVENT_METADATA_FIELDS = [
+      "language",
+      "fileType",
+      "durationBucket",
+      "tokenPressureBucket",
+      "linesChangedBucket",
+      "commandClass",
+      "gitAction",
+      "milestoneKind",
+      "branchHash",
+      "autonomyMode",
+      "modelClass",
+      "modelId",
+      "userModified",
+      "outcome",
+      "trigger",
+      "promptClass",
+      "reason",
+      "afterHours",
+      "activity",
+      "message",
+      "host",
+      "toolName",
+      "simulated",
+      "relatedEventType",
+      "skillVersion",
+      "taskFingerprint",
+      "importKey",
+      "extractionId",
+      "importSchema"
+    ];
+    exports.IDEMPOTENCY_KEY_MAX_LENGTH = 128;
+    exports.TOOL_EVENT_DELIVERED_STATUSES = ["accepted", "duplicate"];
     exports.EVENT_WORKLOAD_CATEGORY = {
       create_focus_session: "creation",
       ai_prompt_submitted: "creation",
@@ -594,6 +685,98 @@ var require_out = __commonJS({
   }
 });
 
+// ../packages/tool-kit/out/payload.js
+var require_payload = __commonJS({
+  "../packages/tool-kit/out/payload.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.mintIdempotencyKey = mintIdempotencyKey;
+    exports.getString = getString;
+    exports.getNumber = getNumber;
+    exports.getNested = getNested;
+    exports.getNestedString = getNestedString;
+    exports.getNestedNumber = getNestedNumber;
+    exports.inferOutcome = inferOutcome;
+    exports.outcomeForHook = outcomeForHook;
+    exports.looksLikeCorrection = looksLikeCorrection;
+    var node_crypto_1 = __require("node:crypto");
+    var tool_contract_1 = require_out();
+    function mintIdempotencyKey() {
+      const key = (0, node_crypto_1.randomUUID)();
+      if (key.length > tool_contract_1.IDEMPOTENCY_KEY_MAX_LENGTH)
+        throw new Error("idempotency key exceeds the wire limit");
+      return key;
+    }
+    function getString(input, keys) {
+      for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "string" && value.trim())
+          return value;
+      }
+      return void 0;
+    }
+    function getNumber(input, keys) {
+      for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "number" && Number.isFinite(value))
+          return value;
+      }
+      return void 0;
+    }
+    function getNested(input, path) {
+      let current = input;
+      for (const segment of path) {
+        if (!current || typeof current !== "object")
+          return void 0;
+        current = current[segment];
+      }
+      return current;
+    }
+    function getNestedString(input, paths) {
+      for (const path of paths) {
+        const value = getNested(input, path);
+        if (typeof value === "string" && value.trim())
+          return value;
+      }
+      return void 0;
+    }
+    function getNestedNumber(input, paths) {
+      for (const path of paths) {
+        const value = getNested(input, path);
+        if (typeof value === "number" && Number.isFinite(value))
+          return value;
+      }
+      return void 0;
+    }
+    function inferOutcome(input) {
+      const exitCode = getNumber(input, ["exitCode", "exit_code", "status"]) ?? getNestedNumber(input, [["tool_response", "exitCode"], ["tool_response", "exit_code"], ["result", "exitCode"], ["result", "exit_code"]]);
+      if (typeof exitCode === "number")
+        return exitCode === 0 ? "success" : "failure";
+      const error = getString(input, ["error", "errorMessage"]) ?? getNestedString(input, [["tool_response", "error"], ["result", "error"]]);
+      if (error)
+        return "failure";
+      return "unknown";
+    }
+    function outcomeForHook(hookName, input) {
+      if (hookName === "PostToolUseFailure") {
+        const interrupted = input["is_interrupt"] === true || getNested(input, ["tool_response", "interrupted"]) === true;
+        return interrupted ? "cancelled" : "failure";
+      }
+      if (hookName === "PostToolUse") {
+        if (getNested(input, ["tool_response", "interrupted"]) === true)
+          return "cancelled";
+        return "success";
+      }
+      return "unknown";
+    }
+    function looksLikeCorrection(text) {
+      if (!text)
+        return false;
+      return /\b(wrong|incorrect|try again|fix|not what i asked|that's not|that is not|redo|regenerate|you missed|doesn't work|does not work)\b/i.test(text);
+    }
+  }
+});
+
 // ../packages/tool-kit/out/eventLog.js
 var require_eventLog = __commonJS({
   "../packages/tool-kit/out/eventLog.js"(exports) {
@@ -694,6 +877,7 @@ var require_http = __commonJS({
     exports.postToolEvent = postToolEvent;
     exports.postToolEventsBatch = postToolEventsBatch;
     exports.parseIngestResponse = parseIngestResponse;
+    var tool_contract_1 = require_out();
     var AscendaApiError = class extends Error {
       status;
       errorCode;
@@ -736,6 +920,35 @@ var require_http = __commonJS({
         throw new AscendaApiError(response.status, void 0, await response.text());
       return await response.json();
     }
+    function isDeliveredStatus(value) {
+      return typeof value === "string" && tool_contract_1.TOOL_EVENT_DELIVERED_STATUSES.includes(value);
+    }
+    function readSuccessBody(body) {
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        return { duplicates: 0 };
+      }
+      if (!parsed || typeof parsed !== "object")
+        return { duplicates: 0 };
+      const single = parsed.status;
+      if (isDeliveredStatus(single))
+        return { duplicates: single === "duplicate" ? 1 : 0 };
+      const raw = parsed.results;
+      if (!Array.isArray(raw))
+        return { duplicates: 0 };
+      const results = [];
+      for (const item of raw) {
+        if (!item || typeof item !== "object")
+          continue;
+        const { index, status, reason } = item;
+        if (typeof index !== "number" || typeof status !== "string")
+          continue;
+        results.push({ index, status, ...typeof reason === "string" ? { reason } : {} });
+      }
+      return { duplicates: results.filter((item) => item.status === "duplicate").length, results };
+    }
     function isRetryableStatus(status) {
       return status === 408 || status === 429 || status !== void 0 && status >= 500 && status <= 599;
     }
@@ -762,8 +975,20 @@ var require_http = __commonJS({
       }
     }
     async function parseIngestResponse(response) {
-      if (response.ok)
-        return { result: "accepted", httpStatus: response.status };
+      if (response.ok) {
+        const outcome = { result: "accepted", httpStatus: response.status };
+        let read = { duplicates: 0 };
+        try {
+          read = readSuccessBody(await response.text());
+        } catch {
+          read = { duplicates: 0 };
+        }
+        return {
+          ...outcome,
+          ...read.duplicates > 0 ? { duplicates: read.duplicates } : {},
+          ...read.results !== void 0 ? { results: read.results } : {}
+        };
+      }
       const body = await response.text();
       let errorCode;
       try {
@@ -828,6 +1053,7 @@ var require_tokenStore = __commonJS({
     exports.ascendaHome = ascendaHome;
     exports.defaultTokenFilePath = defaultTokenFilePath2;
     exports.persistEventWriteToken = persistEventWriteToken2;
+    exports.listPersistedToolInstallationIds = listPersistedToolInstallationIds;
     exports.readTokenFile = readTokenFile2;
     exports.sanitizeFilePart = sanitizeFilePart;
     var fs = __importStar(__require("fs"));
@@ -848,6 +1074,32 @@ var require_tokenStore = __commonJS({
         fs.chmodSync(tokenFilePath, 384);
       }
     }
+    function listPersistedToolInstallationIds(toolType) {
+      const prefix = `${sanitizeFilePart(toolType)}_`;
+      const dir = path.join(ascendaHome(), "tokens");
+      let names;
+      try {
+        names = fs.readdirSync(dir);
+      } catch {
+        return [];
+      }
+      const ids = [];
+      for (const name of names.sort()) {
+        if (!name.startsWith(prefix) || name.length === prefix.length)
+          continue;
+        const file = path.join(dir, name);
+        try {
+          if (!fs.statSync(file).isFile())
+            continue;
+        } catch {
+          continue;
+        }
+        if (readTokenFile2(file) === void 0)
+          continue;
+        ids.push(`${toolType}:${name.slice(prefix.length)}`);
+      }
+      return ids;
+    }
     function readTokenFile2(tokenFilePath) {
       try {
         if (!fs.existsSync(tokenFilePath))
@@ -907,8 +1159,11 @@ var require_stateStore = __commonJS({
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.defaultStateFilePath = defaultStateFilePath;
+    exports.unresolvedToolInstallationId = unresolvedToolInstallationId;
+    exports.unresolvedStateFilePath = unresolvedStateFilePath;
     exports.readCollectorState = readCollectorState;
     exports.recordSendOutcome = recordSendOutcome;
+    exports.recordOutboxDiscard = recordOutboxDiscard;
     exports.shouldAnnounceFailure = shouldAnnounceFailure;
     exports.markFailureNotified = markFailureNotified;
     var fs = __importStar(__require("fs"));
@@ -920,6 +1175,12 @@ var require_stateStore = __commonJS({
       const base2 = dir ? dir : path.join(os.homedir(), ".ascenda", "state");
       return path.join(base2, `${(0, tokenStore_1.sanitizeFilePart)(toolInstallationId)}.json`);
     }
+    function unresolvedToolInstallationId(toolType) {
+      return `${toolType}:unresolved`;
+    }
+    function unresolvedStateFilePath(toolType) {
+      return defaultStateFilePath(unresolvedToolInstallationId(toolType));
+    }
     function readCollectorState(stateFilePath) {
       try {
         if (!fs.existsSync(stateFilePath))
@@ -952,7 +1213,28 @@ var require_stateStore = __commonJS({
         // the one already open. Carrying `notifiedFailingSince` across a
         // continuing episode is what keeps the notice to once per outage.
         ...accepted ? {} : { failingSince: previous?.failingSince ?? now },
-        ...accepted ? {} : previous?.notifiedFailingSince !== void 0 ? { notifiedFailingSince: previous.notifiedFailingSince } : {}
+        ...accepted ? {} : previous?.notifiedFailingSince !== void 0 ? { notifiedFailingSince: previous.notifiedFailingSince } : {},
+        // Cumulative by design: a send outcome, success included, never erases
+        // the record of what the outbox had to throw away.
+        ...previous?.outboxDiscarded !== void 0 ? { outboxDiscarded: previous.outboxDiscarded } : {}
+      };
+      writeStateFile(stateFilePath, next);
+      return next;
+    }
+    function recordOutboxDiscard(stateFilePath, toolInstallationId, discard) {
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const previous = readCollectorState(stateFilePath);
+      const next = {
+        ...previous ?? { lastAttemptAt: now, consecutiveFailures: 0 },
+        toolInstallationId,
+        lastOutcome: "outbox_discarded",
+        outboxDiscarded: {
+          total: (previous?.outboxDiscarded?.total ?? 0) + discard.count,
+          lastAt: now,
+          lastCount: discard.count,
+          lastReasons: discard.reasons,
+          ...discard.oldestQueuedAt !== void 0 ? { lastOldestQueuedAt: discard.oldestQueuedAt } : {}
+        }
       };
       writeStateFile(stateFilePath, next);
       return next;
@@ -992,19 +1274,241 @@ var require_stateStore = __commonJS({
   }
 });
 
-// ../packages/tool-kit/out/eventSender.js
-var require_eventSender = __commonJS({
-  "../packages/tool-kit/out/eventSender.js"(exports) {
+// ../packages/tool-kit/out/outbox.js
+var require_outbox = __commonJS({
+  "../packages/tool-kit/out/outbox.js"(exports) {
     "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.AscendaEventSender = exports.AscendaSemanticEventError = void 0;
-    exports.buildEventPayload = buildEventPayload;
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DEFAULT_OUTBOX_DRAIN_BATCH_SIZE = exports.DEFAULT_OUTBOX_MAX_AGE_MS = exports.DEFAULT_OUTBOX_MAX_ENTRIES = exports.OUTBOX_DRAIN_ENV_VAR = void 0;
+    exports.outboxDrainEnabled = outboxDrainEnabled;
+    exports.defaultOutboxFilePath = defaultOutboxFilePath;
+    exports.appendToOutbox = appendToOutbox;
+    exports.readOutboxSummary = readOutboxSummary;
+    exports.claimOutbox = claimOutbox;
+    exports.enforceOutboxBounds = enforceOutboxBounds;
+    var fs = __importStar(__require("fs"));
+    var path = __importStar(__require("path"));
+    var stateStore_1 = require_stateStore();
+    var tokenStore_1 = require_tokenStore();
+    exports.OUTBOX_DRAIN_ENV_VAR = "ASCENDA_OUTBOX_DRAIN";
+    exports.DEFAULT_OUTBOX_MAX_ENTRIES = 1e4;
+    exports.DEFAULT_OUTBOX_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+    exports.DEFAULT_OUTBOX_DRAIN_BATCH_SIZE = 100;
+    var ORPHANED_CLAIM_AGE_MS = 6e4;
+    var CLAIM_SUFFIX = ".draining";
+    function outboxDrainEnabled(env = process.env) {
+      const value = env[exports.OUTBOX_DRAIN_ENV_VAR]?.trim().toLowerCase();
+      return value === "1" || value === "true" || value === "yes" || value === "on";
+    }
+    function defaultOutboxFilePath(toolInstallationId) {
+      const dir = path.dirname((0, stateStore_1.defaultStateFilePath)(toolInstallationId));
+      return path.join(dir, `${(0, tokenStore_1.sanitizeFilePart)(toolInstallationId)}.outbox.jsonl`);
+    }
+    function appendToOutbox(outboxFilePath, payload, now = /* @__PURE__ */ new Date()) {
+      try {
+        const dir = path.dirname(outboxFilePath);
+        fs.mkdirSync(dir, { recursive: true, mode: 448 });
+        const entry = { queuedAt: now.toISOString(), payload };
+        fs.appendFileSync(outboxFilePath, `${JSON.stringify(entry)}
+`, { encoding: "utf8", mode: 384 });
+        if (process.platform !== "win32")
+          fs.chmodSync(outboxFilePath, 384);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    function readOutboxSummary(outboxFilePath) {
+      const files = [outboxFilePath, ...listClaimFiles(outboxFilePath)].filter((file) => fs.existsSync(file));
+      if (files.length === 0)
+        return void 0;
+      let depth = 0;
+      let unreadableLines = 0;
+      let oldestQueuedAt;
+      for (const file of files) {
+        const { entries, unreadable } = readEntries(file);
+        depth += entries.length;
+        unreadableLines += unreadable;
+        for (const entry of entries) {
+          if (oldestQueuedAt === void 0 || entry.queuedAt < oldestQueuedAt)
+            oldestQueuedAt = entry.queuedAt;
+        }
+      }
+      return { depth, unreadableLines, ...oldestQueuedAt !== void 0 ? { oldestQueuedAt } : {} };
+    }
+    function claimOutbox(outboxFilePath, now = Date.now()) {
+      const claimPath = `${outboxFilePath}.${process.pid}${CLAIM_SUFFIX}`;
+      const claimed = [];
+      try {
+        fs.renameSync(outboxFilePath, claimPath);
+        claimed.push(claimPath);
+      } catch {
+      }
+      let orphanIndex = 0;
+      for (const orphan of listClaimFiles(outboxFilePath)) {
+        if (claimed.includes(orphan))
+          continue;
+        try {
+          if (now - fs.statSync(orphan).mtimeMs < ORPHANED_CLAIM_AGE_MS)
+            continue;
+          const mine = `${claimPath}.${orphanIndex++}`;
+          fs.renameSync(orphan, mine);
+          claimed.push(mine);
+        } catch {
+        }
+      }
+      if (claimed.length === 0)
+        return void 0;
+      const entries = [];
+      let unreadable = 0;
+      for (const file of claimed) {
+        const read = readEntries(file);
+        entries.push(...read.entries);
+        unreadable += read.unreadable;
+      }
+      entries.sort((a, b) => a.queuedAt < b.queuedAt ? -1 : a.queuedAt > b.queuedAt ? 1 : 0);
+      let released = false;
+      return {
+        entries,
+        unreadable,
+        release(remainder) {
+          if (released)
+            return;
+          released = true;
+          if (remainder.length > 0) {
+            try {
+              fs.mkdirSync(path.dirname(outboxFilePath), { recursive: true, mode: 448 });
+              fs.appendFileSync(outboxFilePath, remainder.map((entry) => `${JSON.stringify(entry)}
+`).join(""), { encoding: "utf8", mode: 384 });
+              if (process.platform !== "win32")
+                fs.chmodSync(outboxFilePath, 384);
+            } catch {
+              return;
+            }
+          }
+          for (const file of claimed) {
+            try {
+              fs.unlinkSync(file);
+            } catch {
+            }
+          }
+        }
+      };
+    }
+    function enforceOutboxBounds(entries, bounds, now = Date.now()) {
+      const reasons = {};
+      let oldestQueuedAt;
+      const cutoff = new Date(now - bounds.maxAgeMs).toISOString();
+      const fresh = [];
+      for (const entry of entries) {
+        if (entry.queuedAt < cutoff) {
+          reasons.age = (reasons.age ?? 0) + 1;
+          if (oldestQueuedAt === void 0 || entry.queuedAt < oldestQueuedAt)
+            oldestQueuedAt = entry.queuedAt;
+        } else {
+          fresh.push(entry);
+        }
+      }
+      const excess = Math.max(0, fresh.length - bounds.maxEntries);
+      if (excess > 0) {
+        reasons.count = excess;
+        const first = fresh[0]?.queuedAt;
+        if (first !== void 0 && (oldestQueuedAt === void 0 || first < oldestQueuedAt))
+          oldestQueuedAt = first;
+      }
+      const kept = excess > 0 ? fresh.slice(excess) : fresh;
+      const count = Object.values(reasons).reduce((sum, n) => sum + (n ?? 0), 0);
+      return { kept, discarded: { count, reasons, ...oldestQueuedAt !== void 0 ? { oldestQueuedAt } : {} } };
+    }
+    function listClaimFiles(outboxFilePath) {
+      const dir = path.dirname(outboxFilePath);
+      const prefix = `${path.basename(outboxFilePath)}.`;
+      try {
+        return fs.readdirSync(dir).filter((name) => name.startsWith(prefix) && name.includes(CLAIM_SUFFIX)).map((name) => path.join(dir, name)).sort();
+      } catch {
+        return [];
+      }
+    }
+    function readEntries(file) {
+      let raw;
+      try {
+        raw = fs.readFileSync(file, "utf8");
+      } catch {
+        return { entries: [], unreadable: 0 };
+      }
+      const entries = [];
+      let unreadable = 0;
+      for (const line of raw.split("\n")) {
+        if (!line.trim())
+          continue;
+        try {
+          const parsed = JSON.parse(line);
+          if (!parsed || typeof parsed !== "object" || typeof parsed.queuedAt !== "string" || !parsed.payload || typeof parsed.payload !== "object") {
+            unreadable += 1;
+            continue;
+          }
+          entries.push({ queuedAt: parsed.queuedAt, payload: parsed.payload });
+        } catch {
+          unreadable += 1;
+        }
+      }
+      return { entries, unreadable };
+    }
+  }
+});
+
+// ../packages/tool-kit/out/eventSender.js
+var require_eventSender = __commonJS({
+  "../packages/tool-kit/out/eventSender.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.AscendaEventSender = exports.AscendaSemanticEventError = void 0;
+    exports.buildEventPayload = buildEventPayload;
     var afterHours_1 = require_afterHours();
     var tool_contract_1 = require_out();
     var eventLog_1 = require_eventLog();
     var http_1 = require_http();
+    var outbox_1 = require_outbox();
     var tokenStore_1 = require_tokenStore();
     var stateStore_1 = require_stateStore();
+    var payload_1 = require_payload();
     var AscendaSemanticEventError = class extends Error {
       constructor(message) {
         super(message);
@@ -1017,6 +1521,7 @@ var require_eventSender = __commonJS({
         toolInstallationId: identity.toolInstallationId,
         source: identity.source,
         occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+        idempotencyKey: (0, payload_1.mintIdempotencyKey)(),
         utcOffsetMinutes: (0, afterHours_1.utcOffsetMinutesAt)(/* @__PURE__ */ new Date()),
         sessionId: identity.sessionId ?? void 0,
         workspaceHash: identity.workspaceHash ?? void 0,
@@ -1034,6 +1539,9 @@ var require_eventSender = __commonJS({
       config;
       eventWriteToken;
       lastState;
+      lastDrain;
+      /** One outbox pass per sender, i.e. per hook process. The hook is on the user's critical path. */
+      outboxServiced = false;
       constructor(config) {
         this.config = config;
         this.eventWriteToken = config.eventWriteToken;
@@ -1072,6 +1580,7 @@ var require_eventSender = __commonJS({
           source: this.config.source,
           eventType: mapped.eventType,
           occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          idempotencyKey: (0, payload_1.mintIdempotencyKey)(),
           utcOffsetMinutes: (0, afterHours_1.utcOffsetMinutesAt)(/* @__PURE__ */ new Date()),
           severity: "low",
           sessionId: this.config.sessionId ?? void 0,
@@ -1102,6 +1611,7 @@ var require_eventSender = __commonJS({
           source: this.config.source,
           eventType: mapped.eventType,
           occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          idempotencyKey: (0, payload_1.mintIdempotencyKey)(),
           utcOffsetMinutes: (0, afterHours_1.utcOffsetMinutesAt)(/* @__PURE__ */ new Date()),
           severity: "low",
           sessionId: this.config.sessionId ?? void 0,
@@ -1120,15 +1630,30 @@ var require_eventSender = __commonJS({
        * deliberate: Claude Code, Codex, the GitHub collector and the MCP server all
        * send through this method, and the defect being fixed showed up in three
        * separate components because each was left to notice its own failures.
+       *
+       * The outbox is serviced first, once per process. If that pass just watched
+       * the ingest door refuse a batch, the live event is not offered to the same
+       * door a second time in the same instant: it inherits the pass's outcome,
+       * and a retryable one puts it straight in the queue. That is what keeps a
+       * hook during an outage to one bounded round trip instead of three.
        */
       async post(payload) {
-        const outcome = await this.attempt(payload);
+        const halted = await this.serviceOutbox();
+        let outcome;
+        let queued = false;
+        if (halted) {
+          outcome = halted;
+          queued = this.isRetryable(outcome) && this.enqueue(payload);
+        } else {
+          outcome = await this.attempt(payload);
+          queued = this.isRetryable(outcome) && this.enqueue(payload);
+        }
         this.lastState = (0, stateStore_1.recordSendOutcome)(this.stateFilePath(), this.config.toolInstallationId, outcome.result, {
           httpStatus: outcome.httpStatus,
           errorCode: outcome.errorCode,
-          detail: outcome.detail
+          detail: queued ? withNote(outcome.detail, "queued in outbox") : outcome.detail
         });
-        this.log(payload, outcome.result);
+        this.log(payload, outcome.result, queued ? "queued" : void 0);
         return outcome.result;
       }
       /**
@@ -1137,6 +1662,15 @@ var require_eventSender = __commonJS({
        * error gets one retry, because the common cases (a restarting instance, a
        * proxy blip, a 429) clear in well under a second and the alternative is
        * losing the event outright.
+       *
+       * Both recoveries resend the same `payload` object, so the `idempotencyKey`
+       * minted at construction is what the server sees on every attempt. That is
+       * what lets a retry of a request the server actually processed (a timeout
+       * after the write, a 502 from a proxy in front of a 200) come back
+       * `duplicate` instead of landing twice. Never rebuild the payload here.
+       *
+       * When the retry fails too, the caller queues the payload: anything longer
+       * than the pause here is the outbox's job, not another in-process wait.
        */
       async attempt(payload) {
         const outcome = await (0, http_1.postToolEvent)(this.config.apiBaseUrl, this.eventWriteToken, payload, this.signal());
@@ -1145,12 +1679,138 @@ var require_eventSender = __commonJS({
             return outcome;
           return (0, http_1.postToolEvent)(this.config.apiBaseUrl, this.eventWriteToken, payload, this.signal());
         }
-        if (outcome.result === "transport_error" && (outcome.httpStatus === void 0 || (0, http_1.isRetryableStatus)(outcome.httpStatus))) {
+        if (this.isRetryable(outcome)) {
           await new Promise((resolve) => setTimeout(resolve, RETRY_DELAY_MS));
           return (0, http_1.postToolEvent)(this.config.apiBaseUrl, this.eventWriteToken, payload, this.signal());
         }
         return outcome;
       }
+      /** A failure that never reached a verdict. Replaying can change the answer. */
+      isRetryable(outcome) {
+        return outcome.result === "transport_error" && (outcome.httpStatus === void 0 || (0, http_1.isRetryableStatus)(outcome.httpStatus));
+      }
+      /**
+       * Keeps a refused payload for a later drain. Returns whether it is now on
+       * disk; when it is not (read-only home, full disk) the event is lost and the
+       * journal's detail says so instead of implying it was kept.
+       */
+      enqueue(payload) {
+        return (0, outbox_1.appendToOutbox)(this.outboxFilePath(), payload);
+      }
+      /**
+       * One pass over the outbox: claim it, apply the bounds, and — when sending
+       * is enabled — offer one batch, oldest first, to the batch door.
+       *
+       * Entries are deleted on `accepted` or `duplicate`, decided on `status`
+       * alone; `reason` is for a person reading their logs. A per-item `rejected`
+       * is a verdict, and replaying a verdict cannot change it, so those are
+       * discarded and journaled rather than kept forever. A whole-batch
+       * `validation_failed` is the same verdict for every item. Anything else
+       * stops the pass with everything still on disk, and is returned so the live
+       * send can skip a door that just refused.
+       *
+       * Never loops, never backs off, never sends more than one batch: the next
+       * hook invocation is usually seconds away, and a hook sitting in a retry
+       * loop delays the tool call the user is waiting on.
+       */
+      async serviceOutbox() {
+        if (this.outboxServiced)
+          return void 0;
+        this.outboxServiced = true;
+        const sendEnabled = this.config.outboxDrain ?? (0, outbox_1.outboxDrainEnabled)();
+        const claimed = (0, outbox_1.claimOutbox)(this.outboxFilePath());
+        if (!claimed) {
+          this.lastDrain = { found: 0, discarded: 0, delivered: 0, remaining: 0, sendEnabled };
+          return void 0;
+        }
+        const found = claimed.entries.length + claimed.unreadable;
+        const { kept, discarded } = (0, outbox_1.enforceOutboxBounds)(claimed.entries, {
+          maxEntries: this.config.outboxMaxEntries ?? outbox_1.DEFAULT_OUTBOX_MAX_ENTRIES,
+          maxAgeMs: this.config.outboxMaxAgeMs ?? outbox_1.DEFAULT_OUTBOX_MAX_AGE_MS
+        });
+        if (claimed.unreadable > 0) {
+          discarded.count += claimed.unreadable;
+          discarded.reasons.unreadable = claimed.unreadable;
+        }
+        let discardedTotal = this.journalDiscard(discarded);
+        if (!sendEnabled || kept.length === 0) {
+          claimed.release(kept);
+          this.lastDrain = { found, discarded: discardedTotal, delivered: 0, remaining: kept.length, sendEnabled };
+          return void 0;
+        }
+        const batchSize = this.config.outboxDrainBatchSize ?? outbox_1.DEFAULT_OUTBOX_DRAIN_BATCH_SIZE;
+        const batch = kept.slice(0, batchSize);
+        const rest = kept.slice(batchSize);
+        const outcome = await this.attemptBatch(batch.map((entry) => entry.payload));
+        let delivered = [];
+        let rejected = [];
+        let undecided = [];
+        let halted;
+        if (outcome.result === "accepted") {
+          if (outcome.results === void 0) {
+            delivered = batch;
+          } else {
+            const byIndex = new Map(outcome.results.map((item) => [item.index, item.status]));
+            for (const [index, entry] of batch.entries()) {
+              const status = byIndex.get(index);
+              if (status !== void 0 && tool_contract_1.TOOL_EVENT_DELIVERED_STATUSES.includes(status))
+                delivered.push(entry);
+              else if (status === "rejected")
+                rejected.push(entry);
+              else
+                undecided.push(entry);
+            }
+          }
+        } else if (outcome.result === "validation_failed") {
+          rejected = batch;
+        } else {
+          undecided = batch;
+          halted = outcome;
+        }
+        if (rejected.length > 0) {
+          discardedTotal += this.journalDiscard({ count: rejected.length, reasons: { rejected: rejected.length }, oldestQueuedAt: rejected[0]?.queuedAt });
+        }
+        if (!halted) {
+          this.lastState = (0, stateStore_1.recordSendOutcome)(this.stateFilePath(), this.config.toolInstallationId, outcome.result, {
+            httpStatus: outcome.httpStatus,
+            errorCode: outcome.errorCode,
+            detail: withNote(outcome.detail, `outbox drain: ${delivered.length} delivered`)
+          });
+        }
+        for (const entry of delivered)
+          this.log(entry.payload, "accepted", "drained");
+        const remainder = [...undecided, ...rest];
+        claimed.release(remainder);
+        this.lastDrain = {
+          found,
+          discarded: discardedTotal,
+          delivered: delivered.length,
+          remaining: remainder.length,
+          sendEnabled,
+          ...halted ? { halted: halted.result } : {}
+        };
+        return halted;
+      }
+      /** The batch door, with the same single token renewal as the live path and no in-process retry. */
+      async attemptBatch(payloads) {
+        const outcome = await (0, http_1.postToolEventsBatch)(this.config.apiBaseUrl, this.eventWriteToken, payloads, this.signal());
+        if (outcome.result !== "auth_failed")
+          return outcome;
+        if (!await this.renewEventToken())
+          return outcome;
+        return (0, http_1.postToolEventsBatch)(this.config.apiBaseUrl, this.eventWriteToken, payloads, this.signal());
+      }
+      journalDiscard(discard) {
+        if (discard.count === 0)
+          return 0;
+        const reasons = discard.reasons;
+        this.lastState = (0, stateStore_1.recordOutboxDiscard)(this.stateFilePath(), this.config.toolInstallationId, {
+          count: discard.count,
+          reasons,
+          oldestQueuedAt: discard.oldestQueuedAt
+        });
+        return discard.count;
+      }
       /**
        * The state written by the most recent send, so a caller can decide whether
        * to surface a one-time notice without re-reading the journal it just wrote.
@@ -1158,10 +1818,16 @@ var require_eventSender = __commonJS({
       get state() {
         return this.lastState;
       }
+      /** What this sender's one outbox pass did; undefined before the first send. */
+      get drain() {
+        return this.lastDrain;
+      }
       stateFilePath() {
         return this.config.stateFilePath ?? (0, stateStore_1.defaultStateFilePath)(this.config.toolInstallationId);
       }
-      /** Never throws: a renewal that errors is a failed renewal, not a failed turn. */
+      outboxFilePath() {
+        return this.config.outboxFilePath ?? (0, outbox_1.defaultOutboxFilePath)(this.config.toolInstallationId);
+      }
       /**
        * Every send path funnels through {@link post}, so semantic and
        * collaboration signals are logged on the same terms as host events — the
@@ -1171,12 +1837,13 @@ var require_eventSender = __commonJS({
        * It is now `transport_error` through the ordinary path, because the
        * transport returns that outcome instead of throwing.
        */
-      log(payload, delivery) {
+      log(payload, delivery, outbox) {
         const logFile = this.config.eventLogFile === void 0 ? (0, eventLog_1.resolveEventLogPath)() : this.config.eventLogFile;
         if (!logFile)
           return;
-        (0, eventLog_1.appendEventLog)(logFile, { loggedAt: (/* @__PURE__ */ new Date()).toISOString(), delivery, payload });
+        (0, eventLog_1.appendEventLog)(logFile, { loggedAt: (/* @__PURE__ */ new Date()).toISOString(), delivery, payload, ...outbox ? { outbox } : {} });
       }
+      /** Never throws: a renewal that errors is a failed renewal, not a failed turn. */
       async renewEventToken() {
         try {
           const renewed = await (0, http_1.renewToolToken)(this.config.apiBaseUrl, this.eventWriteToken, this.signal());
@@ -1194,6 +1861,9 @@ var require_eventSender = __commonJS({
       }
     };
     exports.AscendaEventSender = AscendaEventSender2;
+    function withNote(detail, note) {
+      return detail ? `${detail} (${note})` : note;
+    }
   }
 });
 
@@ -1272,72 +1942,335 @@ var require_contextRegistry = __commonJS({
       }
       return upsert(updates, options);
     }
-    function recordWorkContextAlias(hash2, label, observedPath, options) {
-      if (!hash2 || !label)
+    function recordWorkContextAlias(hash, label, observedPath, options) {
+      if (!hash || !label)
         return false;
-      return upsert([{ hash: hash2, kind: "alias", label, observedPath: observedPath ?? null }], options);
+      return upsert([{ hash, kind: "alias", label, observedPath: observedPath ?? null }], options);
     }
     function upsert(updates, options) {
       if (updates.length === 0)
         return false;
       try {
-        const registryFilePath = options?.registryFilePath ?? workContextRegistryFilePath();
-        const nowIso = (options?.now ?? /* @__PURE__ */ new Date()).toISOString();
-        const registry = readWorkContextRegistry(registryFilePath);
-        let dirty = false;
-        for (const update of updates) {
-          const existing = registry.contexts[update.hash];
-          if (!existing) {
-            registry.contexts[update.hash] = {
-              kind: update.kind,
-              label: update.label,
-              paths: update.observedPath ? [update.observedPath] : [],
-              firstSeenAt: nowIso,
-              lastSeenAt: nowIso
-            };
-            dirty = true;
+        const registryFilePath = options?.registryFilePath ?? workContextRegistryFilePath();
+        const nowIso = (options?.now ?? /* @__PURE__ */ new Date()).toISOString();
+        const registry = readWorkContextRegistry(registryFilePath);
+        let dirty = false;
+        for (const update of updates) {
+          const existing = registry.contexts[update.hash];
+          if (!existing) {
+            registry.contexts[update.hash] = {
+              kind: update.kind,
+              label: update.label,
+              paths: update.observedPath ? [update.observedPath] : [],
+              firstSeenAt: nowIso,
+              lastSeenAt: nowIso
+            };
+            dirty = true;
+            continue;
+          }
+          if (existing.kind === "alias" && update.kind !== "alias") {
+            existing.kind = update.kind;
+            dirty = true;
+          }
+          if (existing.label !== update.label && update.kind !== "alias") {
+            existing.label = update.label;
+            dirty = true;
+          }
+          if (update.observedPath && !existing.paths.includes(update.observedPath)) {
+            if (existing.paths.length < MAX_PATHS_PER_ENTRY)
+              existing.paths.push(update.observedPath);
+            dirty = true;
+          }
+          if (dayOf(existing.lastSeenAt) !== dayOf(nowIso)) {
+            existing.lastSeenAt = nowIso;
+            dirty = true;
+          }
+        }
+        if (!dirty)
+          return false;
+        writeRegistry(registryFilePath, registry);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    function dayOf(iso) {
+      return iso.slice(0, 10);
+    }
+    function writeRegistry(registryFilePath, registry) {
+      const dir = path.dirname(registryFilePath);
+      fs.mkdirSync(dir, { recursive: true, mode: 448 });
+      const tmp = `${registryFilePath}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, `${JSON.stringify(registry, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+      fs.renameSync(tmp, registryFilePath);
+      if (process.platform !== "win32") {
+        fs.chmodSync(registryFilePath, 384);
+      }
+    }
+  }
+});
+
+// ../packages/tool-kit/out/credentials.js
+var require_credentials = __commonJS({
+  "../packages/tool-kit/out/credentials.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.credentialsFilePath = credentialsFilePath;
+    exports.readMachineCredentials = readMachineCredentials;
+    exports.writeMachineCredentials = writeMachineCredentials;
+    exports.writeTopLevelCredentials = writeTopLevelCredentials;
+    exports.readHostCredentials = readHostCredentials;
+    exports.writeHostCredentials = writeHostCredentials;
+    exports.removeHostCredentials = removeHostCredentials;
+    var fs = __importStar(__require("fs"));
+    var path = __importStar(__require("path"));
+    var tokenStore_1 = require_tokenStore();
+    function credentialsFilePath() {
+      return path.join((0, tokenStore_1.ascendaHome)(), "credentials.json");
+    }
+    function readMachineCredentials() {
+      try {
+        const raw = fs.readFileSync(credentialsFilePath(), "utf8").trim();
+        if (!raw)
+          return void 0;
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+          return void 0;
+        return parsed;
+      } catch {
+        return void 0;
+      }
+    }
+    function writeMachineCredentials(credentials) {
+      const file = credentialsFilePath();
+      fs.mkdirSync(path.dirname(file), { recursive: true, mode: 448 });
+      fs.writeFileSync(file, `${JSON.stringify(credentials, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+      if (process.platform !== "win32") {
+        fs.chmodSync(path.dirname(file), 448);
+        fs.chmodSync(file, 384);
+      }
+    }
+    function writeTopLevelCredentials(credentials) {
+      const existing = readMachineCredentials();
+      writeMachineCredentials({ ...credentials, ...existing?.tools ? { tools: existing.tools } : {} });
+    }
+    function readHostCredentials(host) {
+      const entry = readMachineCredentials()?.tools?.[host];
+      if (!entry || typeof entry !== "object" || Array.isArray(entry))
+        return void 0;
+      return entry;
+    }
+    function writeHostCredentials(host, credentials) {
+      const existing = readMachineCredentials() ?? {};
+      writeMachineCredentials({ ...existing, tools: { ...existing.tools ?? {}, [host]: credentials } });
+    }
+    function removeHostCredentials(host) {
+      const existing = readMachineCredentials();
+      if (!existing?.tools || !(host in existing.tools))
+        return;
+      const tools = { ...existing.tools };
+      delete tools[host];
+      const next = { ...existing };
+      if (Object.keys(tools).length)
+        next.tools = tools;
+      else
+        delete next.tools;
+      writeMachineCredentials(next);
+    }
+  }
+});
+
+// ../packages/tool-kit/out/forgeProject.js
+var require_forgeProject = __commonJS({
+  "../packages/tool-kit/out/forgeProject.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.forgeProjectHash = forgeProjectHash2;
+    exports.parseForgeFullName = parseForgeFullName;
+    exports.readForgeFullName = readForgeFullName;
+    exports.forgeFullNameFromConfig = forgeFullNameFromConfig;
+    exports.recordForgeProjectAlias = recordForgeProjectAlias;
+    var fs = __importStar(__require("fs"));
+    var path = __importStar(__require("path"));
+    var contextRegistry_1 = require_contextRegistry();
+    function forgeProjectHash2(value) {
+      let h = 2166136261;
+      for (let i = 0; i < value.length; i++) {
+        h ^= value.charCodeAt(i);
+        h = Math.imul(h, 16777619) >>> 0;
+      }
+      return h.toString(16).padStart(8, "0");
+    }
+    function parseForgeFullName(remoteUrl) {
+      if (!remoteUrl)
+        return null;
+      const trimmed = remoteUrl.trim();
+      if (!trimmed)
+        return null;
+      const scp = /^(?:[^@/]+@)?([^/:]+):(.+)$/.exec(trimmed);
+      const scheme = /^([a-z][a-z0-9+.-]*):\/\/(?:[^@/]*@)?([^/:]+)(?::\d+)?\/(.+)$/i.exec(trimmed);
+      let host;
+      let repoPath;
+      if (scheme) {
+        host = scheme[2];
+        repoPath = scheme[3];
+      } else if (scp && !/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) {
+        host = scp[1];
+        repoPath = scp[2];
+      } else {
+        return null;
+      }
+      const normalizedHost = host.toLowerCase().replace(/^www\./, "");
+      if (normalizedHost !== "github.com")
+        return null;
+      const segments = repoPath.split("/").filter((segment) => segment.length > 0);
+      if (segments.length < 2)
+        return null;
+      const owner = segments[0];
+      const repo = segments[1].replace(/\.git$/, "");
+      if (!owner || !repo)
+        return null;
+      return `${owner}/${repo}`;
+    }
+    function readForgeFullName(repositoryRoot) {
+      if (!repositoryRoot)
+        return null;
+      let config;
+      try {
+        config = fs.readFileSync(path.join(repositoryRoot, ".git", "config"), "utf8");
+      } catch {
+        return null;
+      }
+      return forgeFullNameFromConfig(config);
+    }
+    function forgeFullNameFromConfig(config) {
+      const remotes = /* @__PURE__ */ new Map();
+      let currentRemote = null;
+      for (const rawLine of config.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#") || line.startsWith(";"))
+          continue;
+        const section = /^\[([^\]]*)\]$/.exec(line);
+        if (section) {
+          const remote = /^remote\s+"(.*)"$/.exec(section[1].trim());
+          currentRemote = remote ? remote[1] : null;
+          continue;
+        }
+        if (!currentRemote)
+          continue;
+        const entry = /^url\s*=\s*(.*)$/.exec(line);
+        if (entry && !remotes.has(currentRemote))
+          remotes.set(currentRemote, entry[1].trim());
+      }
+      const ordered = [
+        ...remotes.has("origin") ? ["origin"] : [],
+        ...remotes.has("upstream") ? ["upstream"] : [],
+        ...[...remotes.keys()].filter((name) => name !== "origin" && name !== "upstream")
+      ];
+      for (const name of ordered) {
+        const fullName = parseForgeFullName(remotes.get(name));
+        if (fullName)
+          return fullName;
+      }
+      return null;
+    }
+    function recordForgeProjectAlias(context, options) {
+      try {
+        if (!context?.projectHash || !context.projectLabel || !context.projectPath)
+          return false;
+        const fullName = readForgeFullName(context.projectPath);
+        if (!fullName)
+          return false;
+        const variants = [fullName, fullName.toLowerCase()].filter((value, index, all) => all.indexOf(value) === index);
+        let wrote = false;
+        for (const variant of variants) {
+          const hash = forgeProjectHash2(variant);
+          if (hash === context.projectHash || hash === context.workspaceHash)
             continue;
-          }
-          if (existing.kind === "alias" && update.kind !== "alias") {
-            existing.kind = update.kind;
-            dirty = true;
-          }
-          if (existing.label !== update.label && update.kind !== "alias") {
-            existing.label = update.label;
-            dirty = true;
-          }
-          if (update.observedPath && !existing.paths.includes(update.observedPath)) {
-            if (existing.paths.length < MAX_PATHS_PER_ENTRY)
-              existing.paths.push(update.observedPath);
-            dirty = true;
-          }
-          if (dayOf(existing.lastSeenAt) !== dayOf(nowIso)) {
-            existing.lastSeenAt = nowIso;
-            dirty = true;
-          }
+          if ((0, contextRegistry_1.recordWorkContextAlias)(hash, context.projectLabel, context.projectPath, options))
+            wrote = true;
         }
-        if (!dirty)
-          return false;
-        writeRegistry(registryFilePath, registry);
-        return true;
+        return wrote;
       } catch {
         return false;
       }
     }
-    function dayOf(iso) {
-      return iso.slice(0, 10);
-    }
-    function writeRegistry(registryFilePath, registry) {
-      const dir = path.dirname(registryFilePath);
-      fs.mkdirSync(dir, { recursive: true, mode: 448 });
-      const tmp = `${registryFilePath}.${process.pid}.tmp`;
-      fs.writeFileSync(tmp, `${JSON.stringify(registry, null, 2)}
-`, { encoding: "utf8", mode: 384 });
-      fs.renameSync(tmp, registryFilePath);
-      if (process.platform !== "win32") {
-        fs.chmodSync(registryFilePath, 384);
-      }
-    }
   }
 });
 
@@ -1467,6 +2400,10 @@ var require_workContext = __commonJS({
     }();
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.deriveWorkContext = deriveWorkContext;
+    exports.normalizeBranchName = normalizeBranchName;
+    exports.deriveBranchHash = deriveBranchHash;
+    exports.readBranchName = readBranchName;
+    exports.deriveBranchHashForCwd = deriveBranchHashForCwd;
     var fs = __importStar(__require("fs"));
     var path = __importStar(__require("path"));
     var salt_1 = require_salt();
@@ -1481,6 +2418,8 @@ var require_workContext = __commonJS({
       } catch {
         roots = null;
       }
+      if (!roots)
+        roots = inferRootsFromPath(startPath);
       const workspacePath = roots?.checkoutRoot ?? startPath;
       const workspaceLabel = basenameOf(workspacePath);
       if (!workspaceLabel)
@@ -1509,9 +2448,12 @@ var require_workContext = __commonJS({
           stat = null;
         }
         if (stat?.isDirectory())
-          return { checkoutRoot: dir, canonicalRoot: dir };
-        if (stat?.isFile())
-          return { checkoutRoot: dir, canonicalRoot: worktreeParentRoot(dotGit, dir) ?? dir };
+          return { checkoutRoot: dir, canonicalRoot: dir, gitDir: dotGit };
+        if (stat?.isFile()) {
+          const gitDir = readGitdirPointer(dotGit, dir);
+          const canonicalRoot = (gitDir ? worktreeParentRoot(gitDir) : null) ?? dir;
+          return { checkoutRoot: dir, canonicalRoot, gitDir };
+        }
         const parent = path.dirname(dir);
         if (parent === dir)
           return null;
@@ -1519,22 +2461,45 @@ var require_workContext = __commonJS({
       }
       return null;
     }
-    function worktreeParentRoot(dotGitFile, containingDir) {
-      let gitdir;
+    function readGitdirPointer(dotGitFile, containingDir) {
       try {
         const match = /^gitdir:\s*(.+)\s*$/m.exec(fs.readFileSync(dotGitFile, "utf8"));
         if (!match)
           return null;
-        gitdir = match[1].trim();
+        return path.resolve(containingDir, match[1].trim());
       } catch {
         return null;
       }
-      const resolved = path.resolve(containingDir, gitdir);
+    }
+    function worktreeParentRoot(resolvedGitDir) {
       const marker = `${path.sep}.git${path.sep}worktrees${path.sep}`;
-      const idx = resolved.indexOf(marker);
+      const idx = resolvedGitDir.indexOf(marker);
       if (idx === -1)
         return null;
-      return resolved.slice(0, idx);
+      return resolvedGitDir.slice(0, idx);
+    }
+    function inferRootsFromPath(startPath) {
+      const sep = startPath.includes("\\") && !startPath.includes("/") ? "\\" : "/";
+      const leading = /^[\\/]/.test(startPath) ? sep : "";
+      const segments = startPath.split(/[\\/]/).filter(Boolean);
+      const join = (count) => leading + segments.slice(0, count).join(sep);
+      for (let i = 0; i + 2 < segments.length; i++) {
+        if (segments[i] === ".claude" && segments[i + 1] === "worktrees") {
+          if (i === 0)
+            return null;
+          return { checkoutRoot: join(i + 3), canonicalRoot: join(i), gitDir: null };
+        }
+      }
+      for (let i = 0; i + 1 < segments.length; i++) {
+        const folder = segments[i];
+        const suffix = ["-worktrees", "-wt"].find((s) => folder.endsWith(s) && folder.length > s.length);
+        if (!suffix)
+          continue;
+        const repoName = folder.slice(0, -suffix.length);
+        const canonicalRoot = leading + [...segments.slice(0, i), repoName].join(sep);
+        return { checkoutRoot: join(i + 2), canonicalRoot, gitDir: null };
+      }
+      return null;
     }
     function stripTrailingSeparators(value) {
       let end = value.length;
@@ -1546,6 +2511,55 @@ var require_workContext = __commonJS({
       const segment = value.split(/[\\/]/).filter(Boolean).pop() ?? null;
       return segment && segment.length > 0 ? segment : null;
     }
+    var REFS_HEADS_PREFIX = "refs/heads/";
+    function normalizeBranchName(branch) {
+      if (!branch)
+        return null;
+      let name = branch.trim();
+      if (name.startsWith(REFS_HEADS_PREFIX))
+        name = name.slice(REFS_HEADS_PREFIX.length).trim();
+      if (!name || name === "HEAD")
+        return null;
+      return name;
+    }
+    function deriveBranchHash(branch, saltFilePath) {
+      const name = normalizeBranchName(branch);
+      if (!name)
+        return null;
+      try {
+        return (0, salt_1.hashWithMachineSalt)(name, saltFilePath);
+      } catch {
+        return null;
+      }
+    }
+    function readBranchName(cwd) {
+      if (!cwd || !cwd.trim())
+        return null;
+      let gitDir = null;
+      try {
+        gitDir = resolveRepositoryRoots(stripTrailingSeparators(cwd.trim()))?.gitDir ?? null;
+      } catch {
+        gitDir = null;
+      }
+      if (!gitDir)
+        return null;
+      let head;
+      try {
+        head = fs.readFileSync(path.join(gitDir, "HEAD"), "utf8").trim();
+      } catch {
+        return null;
+      }
+      const match = /^ref:\s*(.+)$/.exec(head);
+      if (!match)
+        return null;
+      const ref = match[1].trim();
+      if (!ref.startsWith(REFS_HEADS_PREFIX))
+        return null;
+      return normalizeBranchName(ref);
+    }
+    function deriveBranchHashForCwd(cwd, saltFilePath) {
+      return deriveBranchHash(readBranchName(cwd), saltFilePath);
+    }
   }
 });
 
@@ -1554,35 +2568,69 @@ var require_hookAdapter = __commonJS({
   "../packages/tool-kit/out/hookAdapter.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.DEFAULT_API_BASE_URL = void 0;
+    exports.MissingInstallationIdError = exports.DEFAULT_API_BASE_URL = void 0;
+    exports.resolveCliAgentInstallationId = resolveCliAgentInstallationId;
     exports.resolveContextHashes = resolveContextHashes;
     exports.loadCliAgentConfig = loadCliAgentConfig;
     exports.deliverHookEvents = deliverHookEvents;
     var contextRegistry_1 = require_contextRegistry();
+    var credentials_1 = require_credentials();
+    var forgeProject_1 = require_forgeProject();
     var eventLog_1 = require_eventLog();
     var eventSender_1 = require_eventSender();
+    var stateStore_1 = require_stateStore();
     var tokenStore_1 = require_tokenStore();
     var workContext_1 = require_workContext();
     exports.DEFAULT_API_BASE_URL = "https://api.ascenda.one";
+    var MissingInstallationIdError = class extends Error {
+      /** The token files that were considered — none, or too many to pick from. */
+      candidates;
+      toolType;
+      constructor(toolType, candidates, setupCommand) {
+        super(candidates.length === 0 ? `Not configured: no ASCENDA_TOOL_INSTALLATION_ID, no pairing in ~/.ascenda/credentials.json, and no ${toolType} token in ~/.ascenda/tokens/. Run: ${setupCommand}` : `Not configured: no ASCENDA_TOOL_INSTALLATION_ID, no pairing in ~/.ascenda/credentials.json, and ${candidates.length} ${toolType} tokens in ~/.ascenda/tokens/ (${candidates.join(", ")}) \u2014 refusing to guess. Export ASCENDA_TOOL_INSTALLATION_ID to choose one, or run: ${setupCommand}`);
+        this.name = "MissingInstallationIdError";
+        this.toolType = toolType;
+        this.candidates = candidates;
+      }
+    };
+    exports.MissingInstallationIdError = MissingInstallationIdError;
+    function resolveCliAgentInstallationId(toolType, identity = {}) {
+      const fromEnv = process.env.ASCENDA_TOOL_INSTALLATION_ID?.trim();
+      if (fromEnv)
+        return { toolInstallationId: qualify(toolType, fromEnv), source: "env" };
+      const fromCredentials = identity.host ? (0, credentials_1.readHostCredentials)(identity.host)?.toolInstallationId?.trim() : void 0;
+      if (fromCredentials)
+        return { toolInstallationId: qualify(toolType, fromCredentials), source: "credentials" };
+      const candidates = (0, tokenStore_1.listPersistedToolInstallationIds)(toolType);
+      if (candidates.length === 1)
+        return { toolInstallationId: candidates[0], source: "disk" };
+      throw new MissingInstallationIdError(toolType, candidates, identity.setupCommand ?? defaultSetupCommand(identity.host));
+    }
+    function defaultSetupCommand(host) {
+      return host ? `npx @ascenda-one/${host.replace(/_cli$/, "")}-hooks setup` : "the agent's setup command";
+    }
+    function qualify(toolType, value) {
+      return value.includes(":") ? value : `${toolType}:${value}`;
+    }
     function resolveContextHashes(cwd) {
       const workspaceOverride = process.env.ASCENDA_WORKSPACE_HASH?.trim() || null;
       const projectOverride = process.env.ASCENDA_PROJECT_HASH?.trim() || null;
       if (workspaceOverride && projectOverride)
         return { workspaceHash: workspaceOverride, projectHash: projectOverride };
       const context = (0, workContext_1.deriveWorkContext)(cwd ?? process.cwd());
-      if (context)
+      if (context) {
         (0, contextRegistry_1.recordWorkContext)(context);
+        (0, forgeProject_1.recordForgeProjectAlias)(context);
+      }
       return {
         workspaceHash: workspaceOverride ?? context?.workspaceHash ?? null,
         projectHash: projectOverride ?? context?.projectHash ?? null
       };
     }
-    function loadCliAgentConfig(toolType, sessionIdFromHook, cwd) {
-      const apiBaseUrl = (process.env.ASCENDA_API_BASE_URL ?? exports.DEFAULT_API_BASE_URL).replace(/\/$/, "");
-      const toolInstallationIdRaw = process.env.ASCENDA_TOOL_INSTALLATION_ID;
-      if (!toolInstallationIdRaw)
-        throw new Error("Missing ASCENDA_TOOL_INSTALLATION_ID");
-      const toolInstallationId = toolInstallationIdRaw.trim().includes(":") ? toolInstallationIdRaw.trim() : `${toolType}:${toolInstallationIdRaw.trim()}`;
+    function loadCliAgentConfig(toolType, sessionIdFromHook, cwd, identity = {}) {
+      const credentials = identity.host ? (0, credentials_1.readHostCredentials)(identity.host) : void 0;
+      const apiBaseUrl = (process.env.ASCENDA_API_BASE_URL ?? credentials?.apiBaseUrl ?? exports.DEFAULT_API_BASE_URL).replace(/\/$/, "");
+      const { toolInstallationId } = resolveCliAgentInstallationId(toolType, identity);
       const tokenFilePath = process.env.ASCENDA_EVENT_WRITE_TOKEN_FILE ?? (0, tokenStore_1.defaultTokenFilePath)(toolInstallationId);
       const fileToken = (0, tokenStore_1.readTokenFile)(tokenFilePath);
       const eventWriteToken = fileToken ?? process.env.ASCENDA_EVENT_WRITE_TOKEN;
@@ -1596,7 +2644,10 @@ var require_hookAdapter = __commonJS({
         toolInstallationId,
         eventWriteToken,
         tokenFilePath,
-        sessionId: process.env.ASCENDA_SESSION_ID ?? sessionIdFromHook ?? null,
+        // An empty ASCENDA_SESSION_ID is "unset", not "override with nothing":
+        // read raw, `ASCENDA_SESSION_ID=""` beat a real hook session and shipped
+        // an empty string, grouping unrelated rows under a value naming no session.
+        sessionId: process.env.ASCENDA_SESSION_ID?.trim() || sessionIdFromHook || null,
         workspaceHash: contextHashes.workspaceHash,
         projectHash: contextHashes.projectHash,
         // Agents await command hooks; fail fast rather than stall the user's turn.
@@ -1609,8 +2660,10 @@ var require_hookAdapter = __commonJS({
       const notice = options.onNotice ?? ((message) => console.error(message));
       let config;
       try {
-        config = loadCliAgentConfig(options.toolType, options.sessionId, options.cwd);
+        config = loadCliAgentConfig(options.toolType, options.sessionId, options.cwd, options);
       } catch (error) {
+        if (error instanceof MissingInstallationIdError)
+          journalSkippedSend(options.host, error);
         const logFile = (0, eventLog_1.resolveEventLogPath)();
         if (!logFile)
           throw error;
@@ -1650,13 +2703,19 @@ var require_hookAdapter = __commonJS({
         } else if (result === "auth_failed") {
           notice("Ascenda telemetry paused: connection revoked or expired. Re-pair via an Ascenda IDE extension or pairing-sim.");
         } else if (result === "transport_error") {
-          notice("Ascenda telemetry paused: the ingest endpoint could not be reached. Your work is unaffected.");
+          notice("Ascenda telemetry paused: the ingest endpoint could not be reached; the event is kept in the outbox. Your work is unaffected.");
         } else {
           notice(`Ascenda telemetry rejected: ${result}`);
         }
         return;
       }
     }
+    function journalSkippedSend(host, error) {
+      const who = host ? `${host}: ` : "";
+      (0, stateStore_1.recordSendOutcome)((0, stateStore_1.unresolvedStateFilePath)(error.toolType), (0, stateStore_1.unresolvedToolInstallationId)(error.toolType), "skipped_no_installation_id", {
+        detail: error.candidates.length === 0 ? `${who}no ASCENDA_TOOL_INSTALLATION_ID, no credentials.json pairing, no ${error.toolType} token file` : `${who}no ASCENDA_TOOL_INSTALLATION_ID, no credentials.json pairing, ${error.candidates.length} ${error.toolType} token files (${error.candidates.join(", ")})`
+      });
+    }
     function parsePositiveInt(value) {
       const n = Number(value);
       return Number.isInteger(n) && n > 0 ? n : void 0;
@@ -1664,6 +2723,387 @@ var require_hookAdapter = __commonJS({
   }
 });
 
+// ../packages/tool-kit/out/cliAgentSetup.js
+var require_cliAgentSetup = __commonJS({
+  "../packages/tool-kit/out/cliAgentSetup.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.isCliAgentManagementCommand = isCliAgentManagementCommand;
+    exports.cliAgentHookBinPath = cliAgentHookBinPath;
+    exports.runCliAgentSetup = runCliAgentSetup;
+    exports.writeHookSettings = writeHookSettings;
+    exports.findStaleHookCommands = findStaleHookCommands;
+    var crypto = __importStar(__require("crypto"));
+    var fs = __importStar(__require("fs"));
+    var os = __importStar(__require("os"));
+    var path = __importStar(__require("path"));
+    var credentials_1 = require_credentials();
+    var hookAdapter_1 = require_hookAdapter();
+    var http_1 = require_http();
+    var tokenStore_1 = require_tokenStore();
+    var MANAGEMENT_COMMANDS = /* @__PURE__ */ new Set(["setup", "install", "status", "uninstall", "-h", "--help"]);
+    function isCliAgentManagementCommand(argument) {
+      return argument !== void 0 && MANAGEMENT_COMMANDS.has(argument);
+    }
+    function cliAgentHookBinPath(binaryName) {
+      return path.join((0, tokenStore_1.ascendaHome)(), "bin", binaryName);
+    }
+    function usage(spec) {
+      return `${spec.binaryName} setup \u2014 wire ${spec.displayName} to Ascenda telemetry
+
+  npx ${spec.packageName} setup [options]
+  npx ${spec.packageName} status
+  npx ${spec.packageName} uninstall
+
+Options
+  --api-base-url <url>          ingest host (default ${hookAdapter_1.DEFAULT_API_BASE_URL})
+  --local [port]                shorthand for the local dev server (default port 4477)
+  --tool-installation-id <id>   reuse an existing pairing instead of creating one
+  --token <eventWriteToken>     reuse an existing token (stored 0600, never printed)
+  --scope project|user          where hooks are registered (default project)
+  --project-dir <path>          project root for --scope project (default cwd)
+  --dry-run                     print what would change, write nothing
+  -h, --help
+`;
+    }
+    async function runCliAgentSetup(argv, spec) {
+      let options;
+      try {
+        options = parseArgs(argv, spec);
+      } catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 1;
+      }
+      if (options.action === "help") {
+        console.log(usage(spec));
+        return 0;
+      }
+      if (options.action === "status")
+        return printStatus(options, spec);
+      if (options.action === "uninstall")
+        return uninstall(options, spec);
+      const apiBaseUrl = (options.apiBaseUrl ?? (0, credentials_1.readHostCredentials)(spec.host)?.apiBaseUrl ?? hookAdapter_1.DEFAULT_API_BASE_URL).replace(/\/$/, "");
+      console.log(`Ascenda setup for ${spec.displayName} \u2014 ${apiBaseUrl}`);
+      const identity = await resolveIdentity(apiBaseUrl, options, spec);
+      if (!identity)
+        return 1;
+      console.log(`  pairing      ${identity.toolInstallationId}${identity.paired ? " (new)" : " (existing)"}`);
+      const binary = installBinary(spec, options.dryRun);
+      console.log(`  hook binary  ${binary}`);
+      if (!options.dryRun) {
+        (0, credentials_1.writeHostCredentials)(spec.host, { apiBaseUrl, toolInstallationId: identity.toolInstallationId, pairedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      }
+      console.log(`  credentials  ${(0, credentials_1.credentialsFilePath)()} (tools.${spec.host})`);
+      const settingsFile = spec.settings.settingsPath(options.scope, options.projectDir);
+      const written = writeHookSettings(settingsFile, binary, spec, options.dryRun);
+      if (written === null)
+        return 1;
+      console.log(`  hooks        ${settingsFile} (${spec.hookEvents.length} events${written ? "" : ", already current"})`);
+      if (options.dryRun) {
+        console.log("\nDry run \u2014 nothing was written.");
+        return 0;
+      }
+      console.log(`
+Done. ${spec.restartHint}`);
+      console.log(`Check anytime:  npx ${spec.packageName} status`);
+      return 0;
+    }
+    function parseArgs(argv, spec) {
+      const options = {
+        scope: "project",
+        projectDir: process.cwd(),
+        dryRun: false,
+        action: "install"
+      };
+      for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        const next = () => {
+          const value = argv[++i];
+          if (value === void 0)
+            throw new Error(`${arg} needs a value`);
+          return value;
+        };
+        switch (arg) {
+          case "setup":
+          case "install":
+            options.action = "install";
+            break;
+          case "status":
+            options.action = "status";
+            break;
+          case "uninstall":
+            options.action = "uninstall";
+            break;
+          case "--api-base-url":
+            options.apiBaseUrl = next();
+            break;
+          case "--local": {
+            const peek = argv[i + 1];
+            const port = peek && /^\d+$/.test(peek) ? argv[++i] : "4477";
+            options.apiBaseUrl = `http://localhost:${port}`;
+            break;
+          }
+          case "--tool-installation-id":
+            options.toolInstallationId = next();
+            break;
+          case "--token":
+            options.token = next();
+            break;
+          case "--scope": {
+            const value = next();
+            if (value !== "project" && value !== "user")
+              throw new Error(`--scope must be project or user, got ${value}`);
+            options.scope = value;
+            break;
+          }
+          case "--project-dir":
+            options.projectDir = path.resolve(next());
+            break;
+          case "--dry-run":
+            options.dryRun = true;
+            break;
+          case "-h":
+          case "--help":
+            options.action = "help";
+            break;
+          default:
+            throw new Error(`unknown argument: ${arg}
+
+${usage(spec)}`);
+        }
+      }
+      return options;
+    }
+    async function resolveIdentity(apiBaseUrl, options, spec) {
+      const existingId = options.toolInstallationId ?? (0, credentials_1.readHostCredentials)(spec.host)?.toolInstallationId;
+      if (existingId && options.token) {
+        if (!options.dryRun)
+          (0, tokenStore_1.persistEventWriteToken)((0, tokenStore_1.defaultTokenFilePath)(existingId), options.token);
+        return { toolInstallationId: existingId, paired: false };
+      }
+      if (existingId && (0, tokenStore_1.readTokenFile)((0, tokenStore_1.defaultTokenFilePath)(existingId))) {
+        return { toolInstallationId: existingId, paired: false };
+      }
+      if (options.dryRun) {
+        return { toolInstallationId: existingId ?? `${spec.toolType}:<paired at run time>`, paired: false };
+      }
+      const toolInstallationId = existingId ?? `${spec.toolType}:${crypto.randomUUID()}`;
+      let session;
+      try {
+        session = await (0, http_1.createPairingSession)(apiBaseUrl, toolInstallationId, spec.toolType, `${spec.displayName} on ${os.hostname()}`);
+      } catch (error) {
+        console.error(`
+Could not reach ${apiBaseUrl} to pair: ${error instanceof Error ? error.message : String(error)}`);
+        console.error("Start the local dev server and use --local, or pass --api-base-url for your backend.");
+        return void 0;
+      }
+      const token = await pollForToken(apiBaseUrl, session.pairingSessionId, session.code, session.expiresAt);
+      if (!token)
+        return void 0;
+      (0, tokenStore_1.persistEventWriteToken)((0, tokenStore_1.defaultTokenFilePath)(toolInstallationId), token);
+      return { toolInstallationId, paired: true };
+    }
+    async function pollForToken(apiBaseUrl, pairingSessionId, code, expiresAt) {
+      const deadline = Math.min(Date.parse(expiresAt) || Date.now() + 3e5, Date.now() + 3e5);
+      let announced = false;
+      while (Date.now() < deadline) {
+        const status = await (0, http_1.getPairingStatus)(apiBaseUrl, pairingSessionId);
+        if (status.status === "paired" && status.eventWriteToken)
+          return status.eventWriteToken;
+        if (status.status === "expired" || status.status === "cancelled") {
+          console.error(`
+Pairing ${status.status}. Run setup again.`);
+          return void 0;
+        }
+        if (!announced) {
+          console.log(`
+  Confirm in the Ascenda app \u2014 code ${code}`);
+          console.log("  Waiting...");
+          announced = true;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 2e3));
+      }
+      console.error("\nPairing timed out. Run setup again.");
+      return void 0;
+    }
+    function installBinary(spec, dryRun) {
+      const target = cliAgentHookBinPath(spec.binaryName);
+      if (dryRun)
+        return target;
+      const source = process.argv[1];
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      if (path.resolve(source) !== path.resolve(target)) {
+        fs.copyFileSync(source, target);
+      }
+      if (process.platform !== "win32")
+        fs.chmodSync(target, 493);
+      return target;
+    }
+    function writeHookSettings(settingsFile, binary, spec, dryRun) {
+      let settings = { ...spec.settings.scaffold ?? {} };
+      const exists = fs.existsSync(settingsFile);
+      if (exists) {
+        const raw = fs.readFileSync(settingsFile, "utf8").trim();
+        if (raw) {
+          try {
+            settings = JSON.parse(raw);
+          } catch {
+            console.error(`
+${settingsFile} is not valid JSON. Fix or move it, then run setup again.`);
+            return null;
+          }
+        }
+      }
+      const command = hookCommand(binary);
+      const hooks = { ...settings.hooks ?? {} };
+      for (const event of spec.hookEvents) {
+        const kept = (hooks[event] ?? []).filter((entry) => !isOurs(entry, spec));
+        hooks[event] = [...kept, spec.settings.entry(command, event)];
+      }
+      const updated = { ...settings, hooks };
+      const serialised = `${JSON.stringify(updated, null, 2)}
+`;
+      if (exists && fs.readFileSync(settingsFile, "utf8") === serialised)
+        return false;
+      if (dryRun) {
+        console.log(`
+--- ${settingsFile} (dry run) ---
+${serialised}`);
+        return true;
+      }
+      if (exists)
+        fs.copyFileSync(settingsFile, `${settingsFile}.ascenda-backup`);
+      fs.mkdirSync(path.dirname(settingsFile), { recursive: true });
+      fs.writeFileSync(settingsFile, serialised, "utf8");
+      return true;
+    }
+    function hookCommand(binary) {
+      return `"${process.execPath}" "${binary}"`;
+    }
+    function isOurs(entry, spec) {
+      const command = spec.settings.commandOf(entry);
+      return typeof command === "string" && command.includes(spec.binaryName);
+    }
+    function findStaleHookCommands(settings, binary, spec) {
+      const stale = /* @__PURE__ */ new Set();
+      for (const entries of Object.values(settings.hooks ?? {})) {
+        for (const entry of entries ?? []) {
+          const command = spec.settings.commandOf(entry);
+          if (typeof command !== "string")
+            continue;
+          if (!/ascenda/i.test(command) || command.includes(binary))
+            continue;
+          stale.add(command);
+        }
+      }
+      return [...stale];
+    }
+    function readSettings(settingsFile) {
+      try {
+        return JSON.parse(fs.readFileSync(settingsFile, "utf8"));
+      } catch {
+        return {};
+      }
+    }
+    function printStatus(options, spec) {
+      const credentials = (0, credentials_1.readHostCredentials)(spec.host);
+      const settingsFile = spec.settings.settingsPath(options.scope, options.projectDir);
+      const binary = cliAgentHookBinPath(spec.binaryName);
+      const tokenFile = credentials?.toolInstallationId ? (0, tokenStore_1.defaultTokenFilePath)(credentials.toolInstallationId) : void 0;
+      const settings = readSettings(settingsFile);
+      const registered = spec.hookEvents.filter((event) => (settings.hooks?.[event] ?? []).some((entry) => isOurs(entry, spec))).length;
+      const stale = findStaleHookCommands(settings, binary, spec);
+      console.log(`api base url   ${credentials?.apiBaseUrl ?? "\u2014 not configured"}`);
+      console.log(`pairing        ${credentials?.toolInstallationId ?? "\u2014 not paired"}`);
+      console.log(`token          ${tokenFile && (0, tokenStore_1.readTokenFile)(tokenFile) ? "present" : "\u2014 missing"}`);
+      console.log(`hook binary    ${fs.existsSync(binary) ? binary : "\u2014 not installed"}`);
+      console.log(`hooks          ${registered}/${spec.hookEvents.length} registered in ${settingsFile}`);
+      if (stale.length) {
+        console.log(`stale hooks    ${stale.length} not pointing at the installed binary \u2014 each one fails silently per event:`);
+        for (const command of stale)
+          console.log(`               ${command}`);
+        console.log(`               Remove them from ${settingsFile} by hand; setup cannot tell them from a hook you wrote.`);
+      }
+      const healthy = credentials?.toolInstallationId && registered === spec.hookEvents.length && fs.existsSync(binary) && !stale.length;
+      return healthy ? 0 : 1;
+    }
+    function uninstall(options, spec) {
+      const settingsFile = spec.settings.settingsPath(options.scope, options.projectDir);
+      if (fs.existsSync(settingsFile)) {
+        try {
+          const settings = JSON.parse(fs.readFileSync(settingsFile, "utf8"));
+          const hooks = { ...settings.hooks ?? {} };
+          for (const event of Object.keys(hooks)) {
+            const kept = hooks[event].filter((entry) => !isOurs(entry, spec));
+            if (kept.length)
+              hooks[event] = kept;
+            else
+              delete hooks[event];
+          }
+          const updated = { ...settings, hooks };
+          if (!Object.keys(hooks).length)
+            delete updated.hooks;
+          fs.copyFileSync(settingsFile, `${settingsFile}.ascenda-backup`);
+          fs.writeFileSync(settingsFile, `${JSON.stringify(updated, null, 2)}
+`, "utf8");
+          console.log(`hooks removed from ${settingsFile}`);
+        } catch {
+          console.error(`could not parse ${settingsFile} \u2014 remove the ascenda hook entries by hand`);
+          return 1;
+        }
+      }
+      const binary = cliAgentHookBinPath(spec.binaryName);
+      if (fs.existsSync(binary)) {
+        fs.rmSync(binary);
+        console.log(`removed ${binary}`);
+      }
+      if ((0, credentials_1.readHostCredentials)(spec.host)) {
+        (0, credentials_1.removeHostCredentials)(spec.host);
+        console.log(`removed tools.${spec.host} from ${(0, credentials_1.credentialsFilePath)()}`);
+      }
+      console.log(`tokens left in ${path.join((0, tokenStore_1.ascendaHome)(), "tokens")} \u2014 revoke in the Ascenda app to invalidate them`);
+      return 0;
+    }
+  }
+});
+
 // ../packages/tool-kit/out/turnState.js
 var require_turnState = __commonJS({
   "../packages/tool-kit/out/turnState.js"(exports) {
@@ -1877,8 +3317,9 @@ var require_out2 = __commonJS({
   "../packages/tool-kit/out/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.readWorkContextRegistry = exports.recordWorkContextAlias = exports.recordWorkContext = exports.deriveWorkContext = exports.hashWithMachineSalt = exports.readOrCreateMachineSalt = exports.machineSaltFilePath = exports.markFailureNotified = exports.shouldAnnounceFailure = exports.recordSendOutcome = exports.readCollectorState = exports.defaultStateFilePath = exports.readTokenFile = exports.persistEventWriteToken = exports.defaultTokenFilePath = exports.ascendaHome = exports.recordTurnStart = exports.consumeTurnDurationMs = exports.resolveContextHashes = exports.loadCliAgentConfig = exports.deliverHookEvents = exports.DEFAULT_API_BASE_URL = exports.resolveEventLogPath = exports.expandUserPath = exports.appendEventLog = exports.EVENT_LOG_ENV_VAR = exports.buildEventPayload = exports.AscendaSemanticEventError = exports.AscendaEventSender = exports.looksLikeCorrection = exports.outcomeForHook = exports.inferOutcome = exports.getNestedNumber = exports.getNestedString = exports.getNested = exports.getNumber = exports.getString = exports.localHourAt = exports.utcOffsetMinutesAt = exports.BUSINESS_DAY = exports.isOutsideBusinessHours = exports.isAfterHours = exports.bucketDurationMs = exports.bucketLinesChanged = exports.invitesDebrief = exports.classifyWorkMilestone = exports.isReworkGitAction = exports.classifyGitAction = exports.isVerificationCommand = exports.classifyCommand = void 0;
-    exports.isRetryableStatus = exports.parseIngestResponse = exports.postToolEventsBatch = exports.postToolEvent = exports.renewToolToken = exports.getPairingStatus = exports.createPairingSession = exports.AscendaApiError = exports.liveBusSocketCandidates = exports.liveBusSocketPath = exports.bucketPromptSize = exports.emitLiveSignal = exports.workContextRegistryFilePath = void 0;
+    exports.consumeTurnDurationMs = exports.writeTopLevelCredentials = exports.writeMachineCredentials = exports.writeHostCredentials = exports.removeHostCredentials = exports.readMachineCredentials = exports.readHostCredentials = exports.credentialsFilePath = exports.writeHookSettings = exports.runCliAgentSetup = exports.isCliAgentManagementCommand = exports.findStaleHookCommands = exports.cliAgentHookBinPath = exports.resolveContextHashes = exports.resolveCliAgentInstallationId = exports.loadCliAgentConfig = exports.deliverHookEvents = exports.MissingInstallationIdError = exports.DEFAULT_API_BASE_URL = exports.resolveEventLogPath = exports.expandUserPath = exports.appendEventLog = exports.EVENT_LOG_ENV_VAR = exports.buildEventPayload = exports.AscendaSemanticEventError = exports.AscendaEventSender = exports.mintIdempotencyKey = exports.looksLikeCorrection = exports.outcomeForHook = exports.inferOutcome = exports.getNestedNumber = exports.getNestedString = exports.getNested = exports.getNumber = exports.getString = exports.localHourAt = exports.utcOffsetMinutesAt = exports.BUSINESS_DAY = exports.isOutsideBusinessHours = exports.isAfterHours = exports.bucketDurationMs = exports.bucketLinesChanged = exports.classifyModelClass = exports.autonomyBand = exports.invitesDebrief = exports.classifyWorkMilestone = exports.isReworkGitAction = exports.classifyGitAction = exports.isVerificationCommand = exports.classifyCommand = void 0;
+    exports.postToolEvent = exports.renewToolToken = exports.getPairingStatus = exports.createPairingSession = exports.AscendaApiError = exports.liveBusSocketCandidates = exports.liveBusSocketPath = exports.bucketPromptSize = exports.emitLiveSignal = exports.recordForgeProjectAlias = exports.forgeFullNameFromConfig = exports.readForgeFullName = exports.parseForgeFullName = exports.forgeProjectHash = exports.workContextRegistryFilePath = exports.readWorkContextRegistry = exports.recordWorkContextAlias = exports.recordWorkContext = exports.readBranchName = exports.normalizeBranchName = exports.deriveBranchHashForCwd = exports.deriveBranchHash = exports.deriveWorkContext = exports.hashWithMachineSalt = exports.readOrCreateMachineSalt = exports.machineSaltFilePath = exports.enforceOutboxBounds = exports.claimOutbox = exports.readOutboxSummary = exports.appendToOutbox = exports.defaultOutboxFilePath = exports.outboxDrainEnabled = exports.DEFAULT_OUTBOX_DRAIN_BATCH_SIZE = exports.DEFAULT_OUTBOX_MAX_AGE_MS = exports.DEFAULT_OUTBOX_MAX_ENTRIES = exports.OUTBOX_DRAIN_ENV_VAR = exports.recordOutboxDiscard = exports.unresolvedToolInstallationId = exports.unresolvedStateFilePath = exports.markFailureNotified = exports.shouldAnnounceFailure = exports.recordSendOutcome = exports.readCollectorState = exports.defaultStateFilePath = exports.readTokenFile = exports.persistEventWriteToken = exports.listPersistedToolInstallationIds = exports.defaultTokenFilePath = exports.ascendaHome = exports.recordTurnStart = void 0;
+    exports.isRetryableStatus = exports.parseIngestResponse = exports.postToolEventsBatch = void 0;
     var commandClassifier_1 = require_commandClassifier();
     Object.defineProperty(exports, "classifyCommand", { enumerable: true, get: function() {
       return commandClassifier_1.classifyCommand;
@@ -1900,6 +3341,14 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "invitesDebrief", { enumerable: true, get: function() {
       return workMilestoneClassifier_1.invitesDebrief;
     } });
+    var autonomyBand_1 = require_autonomyBand();
+    Object.defineProperty(exports, "autonomyBand", { enumerable: true, get: function() {
+      return autonomyBand_1.autonomyBand;
+    } });
+    var modelClassifier_1 = require_modelClassifier();
+    Object.defineProperty(exports, "classifyModelClass", { enumerable: true, get: function() {
+      return modelClassifier_1.classifyModelClass;
+    } });
     var buckets_1 = require_buckets();
     Object.defineProperty(exports, "bucketLinesChanged", { enumerable: true, get: function() {
       return buckets_1.bucketLinesChanged;
@@ -1948,6 +3397,9 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "looksLikeCorrection", { enumerable: true, get: function() {
       return payload_1.looksLikeCorrection;
     } });
+    Object.defineProperty(exports, "mintIdempotencyKey", { enumerable: true, get: function() {
+      return payload_1.mintIdempotencyKey;
+    } });
     var eventSender_1 = require_eventSender();
     Object.defineProperty(exports, "AscendaEventSender", { enumerable: true, get: function() {
       return eventSender_1.AscendaEventSender;
@@ -1975,15 +3427,59 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "DEFAULT_API_BASE_URL", { enumerable: true, get: function() {
       return hookAdapter_1.DEFAULT_API_BASE_URL;
     } });
+    Object.defineProperty(exports, "MissingInstallationIdError", { enumerable: true, get: function() {
+      return hookAdapter_1.MissingInstallationIdError;
+    } });
     Object.defineProperty(exports, "deliverHookEvents", { enumerable: true, get: function() {
       return hookAdapter_1.deliverHookEvents;
     } });
     Object.defineProperty(exports, "loadCliAgentConfig", { enumerable: true, get: function() {
       return hookAdapter_1.loadCliAgentConfig;
     } });
+    Object.defineProperty(exports, "resolveCliAgentInstallationId", { enumerable: true, get: function() {
+      return hookAdapter_1.resolveCliAgentInstallationId;
+    } });
     Object.defineProperty(exports, "resolveContextHashes", { enumerable: true, get: function() {
       return hookAdapter_1.resolveContextHashes;
     } });
+    var cliAgentSetup_1 = require_cliAgentSetup();
+    Object.defineProperty(exports, "cliAgentHookBinPath", { enumerable: true, get: function() {
+      return cliAgentSetup_1.cliAgentHookBinPath;
+    } });
+    Object.defineProperty(exports, "findStaleHookCommands", { enumerable: true, get: function() {
+      return cliAgentSetup_1.findStaleHookCommands;
+    } });
+    Object.defineProperty(exports, "isCliAgentManagementCommand", { enumerable: true, get: function() {
+      return cliAgentSetup_1.isCliAgentManagementCommand;
+    } });
+    Object.defineProperty(exports, "runCliAgentSetup", { enumerable: true, get: function() {
+      return cliAgentSetup_1.runCliAgentSetup;
+    } });
+    Object.defineProperty(exports, "writeHookSettings", { enumerable: true, get: function() {
+      return cliAgentSetup_1.writeHookSettings;
+    } });
+    var credentials_1 = require_credentials();
+    Object.defineProperty(exports, "credentialsFilePath", { enumerable: true, get: function() {
+      return credentials_1.credentialsFilePath;
+    } });
+    Object.defineProperty(exports, "readHostCredentials", { enumerable: true, get: function() {
+      return credentials_1.readHostCredentials;
+    } });
+    Object.defineProperty(exports, "readMachineCredentials", { enumerable: true, get: function() {
+      return credentials_1.readMachineCredentials;
+    } });
+    Object.defineProperty(exports, "removeHostCredentials", { enumerable: true, get: function() {
+      return credentials_1.removeHostCredentials;
+    } });
+    Object.defineProperty(exports, "writeHostCredentials", { enumerable: true, get: function() {
+      return credentials_1.writeHostCredentials;
+    } });
+    Object.defineProperty(exports, "writeMachineCredentials", { enumerable: true, get: function() {
+      return credentials_1.writeMachineCredentials;
+    } });
+    Object.defineProperty(exports, "writeTopLevelCredentials", { enumerable: true, get: function() {
+      return credentials_1.writeTopLevelCredentials;
+    } });
     var turnState_1 = require_turnState();
     Object.defineProperty(exports, "consumeTurnDurationMs", { enumerable: true, get: function() {
       return turnState_1.consumeTurnDurationMs;
@@ -1998,6 +3494,9 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "defaultTokenFilePath", { enumerable: true, get: function() {
       return tokenStore_1.defaultTokenFilePath;
     } });
+    Object.defineProperty(exports, "listPersistedToolInstallationIds", { enumerable: true, get: function() {
+      return tokenStore_1.listPersistedToolInstallationIds;
+    } });
     Object.defineProperty(exports, "persistEventWriteToken", { enumerable: true, get: function() {
       return tokenStore_1.persistEventWriteToken;
     } });
@@ -2020,6 +3519,46 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "markFailureNotified", { enumerable: true, get: function() {
       return stateStore_1.markFailureNotified;
     } });
+    Object.defineProperty(exports, "unresolvedStateFilePath", { enumerable: true, get: function() {
+      return stateStore_1.unresolvedStateFilePath;
+    } });
+    Object.defineProperty(exports, "unresolvedToolInstallationId", { enumerable: true, get: function() {
+      return stateStore_1.unresolvedToolInstallationId;
+    } });
+    Object.defineProperty(exports, "recordOutboxDiscard", { enumerable: true, get: function() {
+      return stateStore_1.recordOutboxDiscard;
+    } });
+    var outbox_1 = require_outbox();
+    Object.defineProperty(exports, "OUTBOX_DRAIN_ENV_VAR", { enumerable: true, get: function() {
+      return outbox_1.OUTBOX_DRAIN_ENV_VAR;
+    } });
+    Object.defineProperty(exports, "DEFAULT_OUTBOX_MAX_ENTRIES", { enumerable: true, get: function() {
+      return outbox_1.DEFAULT_OUTBOX_MAX_ENTRIES;
+    } });
+    Object.defineProperty(exports, "DEFAULT_OUTBOX_MAX_AGE_MS", { enumerable: true, get: function() {
+      return outbox_1.DEFAULT_OUTBOX_MAX_AGE_MS;
+    } });
+    Object.defineProperty(exports, "DEFAULT_OUTBOX_DRAIN_BATCH_SIZE", { enumerable: true, get: function() {
+      return outbox_1.DEFAULT_OUTBOX_DRAIN_BATCH_SIZE;
+    } });
+    Object.defineProperty(exports, "outboxDrainEnabled", { enumerable: true, get: function() {
+      return outbox_1.outboxDrainEnabled;
+    } });
+    Object.defineProperty(exports, "defaultOutboxFilePath", { enumerable: true, get: function() {
+      return outbox_1.defaultOutboxFilePath;
+    } });
+    Object.defineProperty(exports, "appendToOutbox", { enumerable: true, get: function() {
+      return outbox_1.appendToOutbox;
+    } });
+    Object.defineProperty(exports, "readOutboxSummary", { enumerable: true, get: function() {
+      return outbox_1.readOutboxSummary;
+    } });
+    Object.defineProperty(exports, "claimOutbox", { enumerable: true, get: function() {
+      return outbox_1.claimOutbox;
+    } });
+    Object.defineProperty(exports, "enforceOutboxBounds", { enumerable: true, get: function() {
+      return outbox_1.enforceOutboxBounds;
+    } });
     var salt_1 = require_salt();
     Object.defineProperty(exports, "machineSaltFilePath", { enumerable: true, get: function() {
       return salt_1.machineSaltFilePath;
@@ -2034,6 +3573,18 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "deriveWorkContext", { enumerable: true, get: function() {
       return workContext_1.deriveWorkContext;
     } });
+    Object.defineProperty(exports, "deriveBranchHash", { enumerable: true, get: function() {
+      return workContext_1.deriveBranchHash;
+    } });
+    Object.defineProperty(exports, "deriveBranchHashForCwd", { enumerable: true, get: function() {
+      return workContext_1.deriveBranchHashForCwd;
+    } });
+    Object.defineProperty(exports, "normalizeBranchName", { enumerable: true, get: function() {
+      return workContext_1.normalizeBranchName;
+    } });
+    Object.defineProperty(exports, "readBranchName", { enumerable: true, get: function() {
+      return workContext_1.readBranchName;
+    } });
     var contextRegistry_1 = require_contextRegistry();
     Object.defineProperty(exports, "recordWorkContext", { enumerable: true, get: function() {
       return contextRegistry_1.recordWorkContext;
@@ -2047,6 +3598,22 @@ var require_out2 = __commonJS({
     Object.defineProperty(exports, "workContextRegistryFilePath", { enumerable: true, get: function() {
       return contextRegistry_1.workContextRegistryFilePath;
     } });
+    var forgeProject_1 = require_forgeProject();
+    Object.defineProperty(exports, "forgeProjectHash", { enumerable: true, get: function() {
+      return forgeProject_1.forgeProjectHash;
+    } });
+    Object.defineProperty(exports, "parseForgeFullName", { enumerable: true, get: function() {
+      return forgeProject_1.parseForgeFullName;
+    } });
+    Object.defineProperty(exports, "readForgeFullName", { enumerable: true, get: function() {
+      return forgeProject_1.readForgeFullName;
+    } });
+    Object.defineProperty(exports, "forgeFullNameFromConfig", { enumerable: true, get: function() {
+      return forgeProject_1.forgeFullNameFromConfig;
+    } });
+    Object.defineProperty(exports, "recordForgeProjectAlias", { enumerable: true, get: function() {
+      return forgeProject_1.recordForgeProjectAlias;
+    } });
     var liveBus_1 = require_liveBus();
     Object.defineProperty(exports, "emitLiveSignal", { enumerable: true, get: function() {
       return liveBus_1.emitLiveSignal;
@@ -2089,7 +3656,7 @@ var require_out2 = __commonJS({
 });
 
 // src/cli.ts
-var import_tool_kit2 = __toESM(require_out2(), 1);
+var import_tool_kit3 = __toESM(require_out2(), 1);
 import { readFile } from "node:fs/promises";
 
 // src/config.ts
@@ -2119,6 +3686,7 @@ function normalizeToolInstallationId(value) {
 }
 
 // src/mapForgeEvent.ts
+var import_tool_kit2 = __toESM(require_out2(), 1);
 function mapForgeEvent(eventName, payload, viewerLogin) {
   if (!eventName || !viewerLogin) return [];
   const action = str(payload["action"]);
@@ -2170,20 +3738,20 @@ function base(payload) {
     host: "github",
     // Hashed, never the name. "Is it always the same repository" stays
     // answerable; which repository does not travel.
-    ...repo ? { projectHash: hash(repo) } : {}
+    //
+    // The digest is an UNSALTED FNV-1a of `owner/repo`, and this step stays
+    // deliberately salt-free: it runs in CI from a webhook payload, where the
+    // only place a machine salt could come from is a repository secret — which
+    // is to say, from everyone who can read the repository's settings. The
+    // function now lives in tool-kit so a developer's own machine, which holds
+    // both identities, can compute this exact digest and file it beside its
+    // own; nothing about what this step emits has changed.
+    ...repo ? { projectHash: (0, import_tool_kit2.forgeProjectHash)(repo) } : {}
   };
 }
 function reviewState(state) {
   return state?.toLowerCase() === "approved" ? "success" : "unknown";
 }
-function hash(value) {
-  let h = 2166136261;
-  for (let i = 0; i < value.length; i++) {
-    h ^= value.charCodeAt(i);
-    h = Math.imul(h, 16777619) >>> 0;
-  }
-  return h.toString(16).padStart(8, "0");
-}
 function obj(value) {
   return value && typeof value === "object" ? value : {};
 }
@@ -2199,7 +3767,7 @@ async function main() {
   if (!payload) return;
   const events = mapForgeEvent(eventName, payload, config.viewerLogin);
   if (events.length === 0) return;
-  const sender = new import_tool_kit2.AscendaEventSender({
+  const sender = new import_tool_kit3.AscendaEventSender({
     apiBaseUrl: config.apiBaseUrl,
     toolInstallationId: config.toolInstallationId,
     source: "code_forge",