@edihasaj/recall 0.5.2

package/dist/cli.js

@@ -0,0 +1,3425 @@
+#!/usr/bin/env node
+import {
+  dispatchCodexNotify,
+  ensureDailyBackup,
+  executePromptHook,
+  executeSessionEndHook,
+  executeSessionStartHook,
+  executeToolHook,
+  formatInjectionContext,
+  formatMaintenanceBacklogContext,
+  formatPendingConfirmationsContext,
+  getHookCallStats,
+  listBackups,
+  parseInteger,
+  parseRecentToolCallsOption,
+  readClaudeCodePromptInputFromStdin,
+  readClaudeCodeSessionEndInputFromStdin,
+  readClaudeCodeSessionStartInputFromStdin,
+  readClaudeCodeToolInputFromStdin,
+  readCodexPromptInputFromStdin,
+  readCodexSessionEndInputFromStdin,
+  readCodexSessionStartInputFromStdin,
+  readCodexToolInputFromStdin,
+  restoreBackup
+} from "./chunk-AYHFPCGY.js";
+import {
+  RECALL_DB_USER_VERSION,
+  compileContext,
+  compileContextHybrid,
+  computeMetrics,
+  createActivityEvent,
+  createPolicy,
+  deletePolicy,
+  endEvalSession,
+  evaluatePolicy,
+  exportClaude,
+  exportCodex,
+  exportMarkdown,
+  formatMetricsReport,
+  formatPruneReport,
+  formatRetrievalEvalReport,
+  getDbPath,
+  getDbUserVersion,
+  getSignalStats,
+  inferRepoSlugFromPath,
+  initDb,
+  listActivityEvents,
+  listActivitySessions,
+  listHistorySnippets,
+  listPendingApprovals,
+  listPolicies,
+  loadRetrievalEvalFile,
+  pruneMemories,
+  recordSignal,
+  requestApproval,
+  resetDb,
+  resolveApproval,
+  runRetrievalEval,
+  scanAndStore,
+  searchHistorySnippets,
+  startEvalSession,
+  togglePolicy,
+  writeRepoContextArtifact
+} from "./chunk-PC43MBX5.js";
+import {
+  autoResolveContradictions,
+  computeAllHealthScores,
+  computeHealthScore,
+  detectContradictions,
+  formatHealthReport,
+  getRepoQualityProfile,
+  inferScope,
+  listContradictions,
+  processCorrection,
+  processReviewFeedback,
+  resolveContradiction
+} from "./chunk-VEPXEHRZ.js";
+import {
+  bootstrapEmbeddings,
+  confirmMemory,
+  ensureEmbeddingProviderReady,
+  formatAuditTrail,
+  getAuditTrail,
+  getEmbeddingModelInfo,
+  getMemory,
+  getRecentAudit,
+  hybridSearch,
+  listMemories,
+  listRepos,
+  loadEmbeddingConfigFromEnv,
+  queryMemories,
+  queueMemoryEmbeddingSync,
+  rebuildEmbeddingIndex,
+  rejectMemory,
+  rollbackMemory,
+  verifyEmbeddings
+} from "./chunk-IILLSHLM.js";
+import {
+  memories,
+  syncState
+} from "./chunk-A5UIRZU6.js";
+import {
+  init_keychain,
+  keychain_exports
+} from "./chunk-DNFKAHS6.js";
+import {
+  __toCommonJS
+} from "./chunk-4CV4JOE5.js";
+
+// src/cli.ts
+import { Command } from "commander";
+import { resolve as resolve6 } from "path";
+import { writeFileSync as writeFileSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join7 } from "path";
+
+// src/sync/client.ts
+import { eq, gt } from "drizzle-orm";
+import { randomUUID } from "crypto";
+function getSyncState(db) {
+  const row = db.select().from(syncState).where(eq(syncState.id, "local")).get();
+  if (row) return row;
+  db.insert(syncState).values({
+    id: "local",
+    remote_url: null,
+    team_id: null,
+    last_push_at: null,
+    last_pull_at: null,
+    last_push_version: 0,
+    last_pull_version: 0
+  }).run();
+  return db.select().from(syncState).where(eq(syncState.id, "local")).get();
+}
+function updateSyncState(db, updates) {
+  db.update(syncState).set(updates).where(eq(syncState.id, "local")).run();
+}
+async function pushMemories(db, config) {
+  const state = getSyncState(db);
+  const localMemories = db.select().from(memories).where(gt(memories.sync_version, state.last_push_version)).all();
+  if (localMemories.length === 0) {
+    return { pushed: 0, version: state.last_push_version };
+  }
+  const payload = localMemories.map((m) => ({
+    ...m,
+    origin_id: m.id,
+    evidence: typeof m.evidence === "string" ? JSON.parse(m.evidence) : m.evidence
+  }));
+  const resp = await fetch(`${config.remote_url}/api/push`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${config.api_key}`
+    },
+    body: JSON.stringify({
+      team_id: config.team_id,
+      memories: payload
+    })
+  });
+  if (!resp.ok) {
+    const err = await resp.json().catch(() => ({ error: resp.statusText }));
+    throw new Error(`Push failed: ${err.error ?? resp.statusText}`);
+  }
+  const result = await resp.json();
+  updateSyncState(db, {
+    remote_url: config.remote_url,
+    team_id: config.team_id,
+    last_push_at: (/* @__PURE__ */ new Date()).toISOString(),
+    last_push_version: Math.max(
+      ...localMemories.map((m) => m.sync_version)
+    )
+  });
+  return result;
+}
+async function pullMemories(db, config) {
+  const state = getSyncState(db);
+  const resp = await fetch(`${config.remote_url}/api/pull`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${config.api_key}`
+    },
+    body: JSON.stringify({
+      team_id: config.team_id,
+      since_version: state.last_pull_version
+    })
+  });
+  if (!resp.ok) {
+    const err = await resp.json().catch(() => ({ error: resp.statusText }));
+    throw new Error(`Pull failed: ${err.error ?? resp.statusText}`);
+  }
+  const data = await resp.json();
+  let pulled = 0;
+  let conflicts = 0;
+  for (const remote of data.memories) {
+    const localMem = db.select().from(memories).where(eq(memories.id, remote.origin_id)).get();
+    if (localMem) {
+      if (remote.updated_at > localMem.updated_at) {
+        db.update(memories).set({
+          text: remote.text,
+          status: remote.status,
+          confidence: remote.confidence,
+          evidence: remote.evidence,
+          updated_at: remote.updated_at,
+          team_id: config.team_id
+        }).where(eq(memories.id, localMem.id)).run();
+        queueMemoryEmbeddingSync(db, localMem.id);
+        pulled++;
+        conflicts++;
+      }
+    } else {
+      const memoryId = remote.origin_id ?? randomUUID();
+      db.insert(memories).values({
+        id: memoryId,
+        type: remote.type,
+        text: remote.text,
+        scope: remote.scope,
+        path_scope: remote.path_scope,
+        repo: remote.repo,
+        status: remote.status,
+        confidence: remote.confidence,
+        source: remote.source,
+        evidence: remote.evidence,
+        supersedes: remote.supersedes,
+        created_at: remote.created_at,
+        updated_at: remote.updated_at,
+        team_id: config.team_id,
+        sync_version: 0
+      }).run();
+      queueMemoryEmbeddingSync(db, memoryId);
+      pulled++;
+    }
+  }
+  updateSyncState(db, {
+    last_pull_at: (/* @__PURE__ */ new Date()).toISOString(),
+    last_pull_version: data.version
+  });
+  return { pulled, conflicts };
+}
+async function sync(db, config) {
+  const errors = [];
+  let pushed = 0;
+  let pulled = 0;
+  let conflicts = 0;
+  try {
+    const pushResult = await pushMemories(db, config);
+    pushed = pushResult.pushed;
+  } catch (err) {
+    errors.push(`push: ${err.message}`);
+  }
+  try {
+    const pullResult = await pullMemories(db, config);
+    pulled = pullResult.pulled;
+    conflicts = pullResult.conflicts;
+  } catch (err) {
+    errors.push(`pull: ${err.message}`);
+  }
+  return { pushed, pulled, conflicts, errors };
+}
+async function createTeam(config, name) {
+  const resp = await fetch(`${config.remote_url}/api/team`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${config.api_key}`
+    },
+    body: JSON.stringify({ name })
+  });
+  if (!resp.ok) throw new Error(`Failed to create team: ${resp.statusText}`);
+  const data = await resp.json();
+  return data.team_id;
+}
+async function joinTeam(config, teamId) {
+  const resp = await fetch(`${config.remote_url}/api/team/${teamId}/join`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${config.api_key}`
+    }
+  });
+  if (!resp.ok) throw new Error(`Failed to join team: ${resp.statusText}`);
+}
+
+// src/setup/local.ts
+import { existsSync as existsSync3 } from "fs";
+import { execFileSync as execFileSync3 } from "child_process";
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+
+// src/agents/claude-code.ts
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync
+} from "fs";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+
+// src/agents/utils.ts
+import { execFileSync } from "child_process";
+import { homedir } from "os";
+function resolveUserHomeDir() {
+  return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
+}
+function hasCommand(name) {
+  try {
+    execFileSync("which", [name], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/agents/claude-code.ts
+var CLAUDE_CONFIG_RELATIVE_PATH = [".claude", "settings.json"];
+var MANAGED_TAG = "recall:managed:claude-code";
+var SESSION_START_MATCHER = "startup|resume|clear|compact";
+var SESSION_END_MATCHER = "clear|resume|logout|prompt_input_exit|bypass_permissions_disabled|other";
+var configPath = () => join(resolveUserHomeDir(), ...CLAUDE_CONFIG_RELATIVE_PATH);
+function installClaudeCodeHooks(options = {}) {
+  const targetPath = options.configPath ?? configPath();
+  const current = readSettingsFile(targetPath);
+  const managedGroups = buildManagedGroups({
+    cliPath: options.cliPath,
+    nodePath: options.nodePath,
+    profile: options.profile,
+    promptInjection: options.promptInjection
+  });
+  const next = cloneSettings(current.settings);
+  const hooks = ensureHooksObject(next);
+  let changed = false;
+  for (const [eventName, groups] of Object.entries(managedGroups)) {
+    const existing = hooks[eventName] ?? [];
+    const preserved = existing.filter((group) => !isManagedGroup(group));
+    const merged = [...preserved, ...groups];
+    if (!sameJson(existing, merged)) {
+      hooks[eventName] = merged;
+      changed = true;
+    }
+  }
+  if (!changed) {
+    return {
+      ok: true,
+      changed: false,
+      config_path: targetPath,
+      message: "Claude Code hooks already installed"
+    };
+  }
+  writeSettingsFile(targetPath, current.raw, next);
+  return {
+    ok: true,
+    changed: true,
+    config_path: targetPath,
+    message: "Installed Claude Code Recall hooks"
+  };
+}
+function uninstallClaudeCodeHooks(options = {}) {
+  const targetPath = options.configPath ?? configPath();
+  if (!existsSync(targetPath)) {
+    return {
+      ok: true,
+      changed: false,
+      config_path: targetPath,
+      message: "Claude Code settings file not found"
+    };
+  }
+  const current = readSettingsFile(targetPath);
+  const next = cloneSettings(current.settings);
+  const hooks = next.hooks;
+  if (!hooks || typeof hooks !== "object") {
+    return {
+      ok: true,
+      changed: false,
+      config_path: targetPath,
+      message: "No Claude Code hooks configured"
+    };
+  }
+  let changed = false;
+  for (const eventName of Object.keys(hooks)) {
+    const existing = hooks[eventName] ?? [];
+    const preserved = existing.filter((group) => !isManagedGroup(group));
+    if (!sameJson(existing, preserved)) {
+      changed = true;
+      if (preserved.length > 0) {
+        hooks[eventName] = preserved;
+      } else {
+        delete hooks[eventName];
+      }
+    }
+  }
+  if (Object.keys(hooks).length === 0) {
+    delete next.hooks;
+  }
+  if (!changed) {
+    return {
+      ok: true,
+      changed: false,
+      config_path: targetPath,
+      message: "No Recall-managed Claude Code hooks found"
+    };
+  }
+  writeSettingsFile(targetPath, current.raw, next);
+  return {
+    ok: true,
+    changed: true,
+    config_path: targetPath,
+    message: "Removed Claude Code Recall hooks"
+  };
+}
+function buildManagedGroups(options) {
+  const installedEvents = new Set(options.profile ?? []);
+  const commandPrefix = resolveHookCommandPrefix(options);
+  const groups = {};
+  groups.SessionStart = [
+    {
+      matcher: SESSION_START_MATCHER,
+      hooks: [commandHook(`${commandPrefix} hook session-start --agent claude-code --claude-code-stdin`, "session-start")]
+    }
+  ];
+  if (installedEvents.size === 0 || installedEvents.has("prompt_submitted")) {
+    const envPrefix = options.promptInjection === false ? "RECALL_HOOK_INJECT_PROMPT=false " : "";
+    groups.UserPromptSubmit = [
+      {
+        hooks: [commandHook(`${envPrefix}${commandPrefix} hook prompt --agent claude-code --claude-code-stdin`, "prompt")]
+      }
+    ];
+  }
+  if (installedEvents.size === 0 || installedEvents.has("tool_invoked")) {
+    groups.PostToolUse = [
+      {
+        matcher: "Edit|Write|Bash",
+        hooks: [commandHook(`${commandPrefix} hook tool --agent claude-code --claude-code-stdin`, "tool")]
+      }
+    ];
+  }
+  if (installedEvents.size === 0 || installedEvents.has("session_ended")) {
+    groups.SessionEnd = [
+      {
+        matcher: SESSION_END_MATCHER,
+        hooks: [commandHook(`${commandPrefix} hook session-end --agent claude-code --claude-code-stdin`, "session-end")]
+      }
+    ];
+  }
+  return groups;
+}
+function commandHook(command, tag) {
+  return {
+    type: "command",
+    command: `${command} # ${MANAGED_TAG}:${tag}`
+  };
+}
+function resolveHookCommandPrefix(options) {
+  const nodePath = options.nodePath ?? process.env.RECALL_NODE_PATH ?? process.execPath;
+  const cliPath = options.cliPath ?? resolveCliPath();
+  return `${shellQuote(nodePath)} ${shellQuote(cliPath)}`;
+}
+function resolveCliPath() {
+  const fromEnv = process.env.RECALL_CLI_PATH;
+  if (fromEnv && existsSync(fromEnv)) {
+    return resolve(fromEnv);
+  }
+  const fromArgv = process.argv[1];
+  if (fromArgv && /(?:^|\/)cli\.[cm]?js$/.test(fromArgv) && existsSync(fromArgv)) {
+    return resolve(fromArgv);
+  }
+  const sibling = resolve(dirname(fileURLToPath(import.meta.url)), "..", "cli.js");
+  if (existsSync(sibling)) {
+    return sibling;
+  }
+  const distCli = resolve(process.cwd(), "dist", "cli.js");
+  if (existsSync(distCli)) {
+    return distCli;
+  }
+  throw new Error("Unable to resolve Recall CLI path for Claude Code hooks");
+}
+function readSettingsFile(configPath3) {
+  if (!existsSync(configPath3)) {
+    return { raw: null, settings: {} };
+  }
+  const raw = readFileSync(configPath3, "utf-8");
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Invalid Claude Code settings at ${configPath3}`);
+  }
+  return { raw, settings: parsed };
+}
+function writeSettingsFile(configPath3, previousRaw, settings) {
+  const parentDir = dirname(configPath3);
+  mkdirSync(parentDir, { recursive: true });
+  if (previousRaw != null) {
+    const backupPath = `${configPath3}.recall.bak.${Date.now()}`;
+    writeFileSync(backupPath, previousRaw);
+  }
+  const tmpPath = `${configPath3}.tmp.${process.pid}`;
+  writeFileSync(tmpPath, `${JSON.stringify(settings, null, 2)}
+`);
+  renameSync(tmpPath, configPath3);
+}
+function ensureHooksObject(settings) {
+  if (!settings.hooks) {
+    settings.hooks = {};
+  }
+  if (typeof settings.hooks !== "object" || Array.isArray(settings.hooks)) {
+    throw new Error("Claude Code hooks config must be an object");
+  }
+  return settings.hooks;
+}
+function isManagedGroup(group) {
+  return (group.hooks ?? []).some((hook) => typeof hook.command === "string" && hook.command.includes(MANAGED_TAG));
+}
+function cloneSettings(settings) {
+  return JSON.parse(JSON.stringify(settings));
+}
+function sameJson(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/agents/codex.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var CODEX_CONFIG_RELATIVE_PATH = [".codex", "config.toml"];
+var CODEX_HOOKS_RELATIVE_PATH = [".codex", "hooks.json"];
+var MANAGED_START = "# recall:managed:codex:start";
+var MANAGED_END = "# recall:managed:codex:end";
+var MANAGED_FEATURE_FLAG = "# recall:managed:codex:feature";
+var MANAGED_HOOK_TAG = "recall:managed:codex";
+var DEFAULT_MIN_CODEX_HOOKS_VERSION = "0.115.0";
+var configPath2 = () => join2(resolveUserHomeDir(), ...CODEX_CONFIG_RELATIVE_PATH);
+var hooksJsonPath = () => join2(resolveUserHomeDir(), ...CODEX_HOOKS_RELATIVE_PATH);
+function installCodexNotifyBridge(options = {}) {
+  const targetPath = options.configPath ?? configPath2();
+  const existing = existsSync2(targetPath) ? readFileSync2(targetPath, "utf-8") : "";
+  const stripped = stripManagedBlock(existing);
+  if (hasUnmanagedNotify(stripped)) {
+    return {
+      ok: false,
+      changed: false,
+      config_path: targetPath,
+      message: "Codex notify is already configured outside Recall-managed block"
+    };
+  }
+  const managedBlock = buildManagedNotifyBlock(options);
+  const next = appendManagedBlock(stripped, managedBlock);
+  if (next === existing) {
+    return {
+      ok: true,
+      changed: false,
+      config_path: targetPath,
+      message: "Codex notify bridge already installed"
+    };
+  }
+  writeConfigFile(targetPath, existing || null, next);
+  return {
+    ok: true,
+    changed: true,
+    config_path: targetPath,
+    message: "Installed Codex Recall notify bridge"
+  };
+}
+function uninstallCodexNotifyBridge(options = {}) {
+  const targetPath = options.configPath ?? configPath2();
+  if (!existsSync2(targetPath)) {
+    return {
+      ok: true,
+      changed: false,
+      config_path: targetPath,
+      message: "Codex config.toml not found"
+    };
+  }
+  const existing = readFileSync2(targetPath, "utf-8");
+  const next = stripManagedBlock(existing);
+  if (next === existing) {
+    return {
+      ok: true,
+      changed: false,
+      config_path: targetPath,
+      message: "No Recall-managed Codex notify bridge found"
+    };
+  }
+  writeConfigFile(targetPath, existing, next);
+  return {
+    ok: true,
+    changed: true,
+    config_path: targetPath,
+    message: "Removed Codex Recall notify bridge"
+  };
+}
+function detectCodexCapability(options = {}) {
+  const required = options.minCodexHooksVersion ?? process.env.RECALL_CODEX_HOOKS_MIN_VERSION ?? DEFAULT_MIN_CODEX_HOOKS_VERSION;
+  const detected = probeCodexVersion();
+  if (!detected) {
+    return {
+      hooks_json: false,
+      detected_version: null,
+      required_version: required,
+      reason: "codex CLI not found on PATH \u2014 cannot verify hook support"
+    };
+  }
+  if (compareSemver(detected, required) < 0) {
+    return {
+      hooks_json: false,
+      detected_version: detected,
+      required_version: required,
+      reason: `codex ${detected} < ${required} (hooks.json unsupported)`
+    };
+  }
+  return {
+    hooks_json: true,
+    detected_version: detected,
+    required_version: required
+  };
+}
+function installCodexHooks(options = {}) {
+  const targetConfig = options.configPath ?? configPath2();
+  const targetHooks = options.hooksPath ?? hooksJsonPath();
+  const capability = options.forceNotifyBridge ? { hooks_json: false, detected_version: null, required_version: "n/a", reason: "forced notify bridge" } : options.forceHooks ? { hooks_json: true, detected_version: null, required_version: "n/a" } : detectCodexCapability(options);
+  if (!capability.hooks_json) {
+    const bridge = installCodexNotifyBridge(options);
+    const reason = capability.reason ?? "codex hooks unsupported";
+    return {
+      ok: bridge.ok,
+      changed: bridge.changed,
+      config_path: bridge.config_path,
+      message: `${bridge.message} (fell back to notify bridge: ${reason})`
+    };
+  }
+  uninstallCodexNotifyBridge({ configPath: targetConfig });
+  const flagResult = ensureCodexHooksFeatureFlag(targetConfig);
+  const hooksResult = writeCodexHooksJson(targetHooks, options);
+  const changed = flagResult.changed || hooksResult.changed;
+  const ok2 = flagResult.ok && hooksResult.ok;
+  const versionNote = capability.detected_version ? ` (codex ${capability.detected_version})` : "";
+  const messages = [flagResult.message, hooksResult.message].filter(Boolean).join("; ");
+  return {
+    ok: ok2,
+    changed,
+    config_path: targetHooks,
+    message: (messages || (changed ? "Installed Codex hooks.json" : "Codex hooks already installed")) + versionNote
+  };
+}
+function probeCodexVersion() {
+  if (!hasCommand("codex")) return null;
+  try {
+    const raw = execFileSync2("codex", ["--version"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    });
+    return extractSemverFromVersionString(raw);
+  } catch {
+    return null;
+  }
+}
+function extractSemverFromVersionString(raw) {
+  const match = raw.match(/(\d+)\.(\d+)\.(\d+)(?:[-+][A-Za-z0-9.-]+)?/);
+  return match ? `${match[1]}.${match[2]}.${match[3]}` : null;
+}
+function compareSemver(a, b) {
+  const pa = a.split(".").map((n) => parseInt(n, 10));
+  const pb = b.split(".").map((n) => parseInt(n, 10));
+  for (let i = 0; i < 3; i++) {
+    const av = pa[i] ?? 0;
+    const bv = pb[i] ?? 0;
+    if (av !== bv) return av < bv ? -1 : 1;
+  }
+  return 0;
+}
+function uninstallCodexHooks(options = {}) {
+  const targetConfig = options.configPath ?? configPath2();
+  const targetHooks = options.hooksPath ?? hooksJsonPath();
+  const flagResult = removeCodexHooksFeatureFlag(targetConfig);
+  const hooksResult = removeCodexHooksJson(targetHooks);
+  const legacyResult = uninstallCodexNotifyBridge({ configPath: targetConfig });
+  const changed = flagResult.changed || hooksResult.changed || legacyResult.changed;
+  const ok2 = flagResult.ok && hooksResult.ok && legacyResult.ok;
+  return {
+    ok: ok2,
+    changed,
+    config_path: targetHooks,
+    message: changed ? "Removed Codex Recall hooks" : "No Recall-managed Codex hooks found"
+  };
+}
+function writeCodexHooksJson(targetPath, options) {
+  const existing = readCodexHooksJson(targetPath);
+  const next = cloneCodexHooks(existing.parsed);
+  const hooks = ensureCodexHooksObject(next);
+  const managed = buildCodexManagedGroups(options);
+  let changed = false;
+  for (const [eventName, groups] of Object.entries(managed)) {
+    const current = hooks[eventName] ?? [];
+    const preserved = current.filter((group) => !isCodexManagedGroup(group));
+    const merged = [...preserved, ...groups];
+    if (JSON.stringify(current) !== JSON.stringify(merged)) {
+      hooks[eventName] = merged;
+      changed = true;
+    }
+  }
+  if (!changed) {
+    return {
+      ok: true,
+      changed: false,
+      config_path: targetPath,
+      message: ""
+    };
+  }
+  writeJsonFile(targetPath, existing.raw, next);
+  return {
+    ok: true,
+    changed: true,
+    config_path: targetPath,
+    message: "wrote hooks.json"
+  };
+}
+function removeCodexHooksJson(targetPath) {
+  if (!existsSync2(targetPath)) {
+    return { ok: true, changed: false, config_path: targetPath, message: "" };
+  }
+  const existing = readCodexHooksJson(targetPath);
+  const next = cloneCodexHooks(existing.parsed);
+  const hooks = next.hooks;
+  if (!hooks || typeof hooks !== "object") {
+    return { ok: true, changed: false, config_path: targetPath, message: "" };
+  }
+  let changed = false;
+  for (const eventName of Object.keys(hooks)) {
+    const current = hooks[eventName] ?? [];
+    const preserved = current.filter((group) => !isCodexManagedGroup(group));
+    if (preserved.length !== current.length) {
+      changed = true;
+      if (preserved.length > 0) {
+        hooks[eventName] = preserved;
+      } else {
+        delete hooks[eventName];
+      }
+    }
+  }
+  if (Object.keys(hooks).length === 0) delete next.hooks;
+  if (!changed) {
+    return { ok: true, changed: false, config_path: targetPath, message: "" };
+  }
+  writeJsonFile(targetPath, existing.raw, next);
+  return { ok: true, changed: true, config_path: targetPath, message: "cleaned hooks.json" };
+}
+function buildCodexManagedGroups(options) {
+  const installedEvents = new Set(options.profile ?? []);
+  const commandPrefix = resolveHookCommandPrefix2(options);
+  const groups = {};
+  groups.SessionStart = [
+    {
+      matcher: "startup|resume",
+      hooks: [commandHook2(`${commandPrefix} hook session-start --agent codex --codex-stdin`, "session-start")]
+    }
+  ];
+  if (installedEvents.size === 0 || installedEvents.has("prompt_submitted")) {
+    const envPrefix = options.promptInjection === false ? "RECALL_HOOK_INJECT_PROMPT=false " : "";
+    groups.UserPromptSubmit = [
+      {
+        hooks: [commandHook2(`${envPrefix}${commandPrefix} hook prompt --agent codex --codex-stdin`, "prompt")]
+      }
+    ];
+  }
+  if (installedEvents.size === 0 || installedEvents.has("tool_invoked")) {
+    groups.PostToolUse = [
+      {
+        matcher: "Bash",
+        hooks: [commandHook2(`${commandPrefix} hook tool --agent codex --codex-stdin`, "tool")]
+      }
+    ];
+  }
+  return groups;
+}
+function commandHook2(command, tag) {
+  return {
+    type: "command",
+    command: `${command} # ${MANAGED_HOOK_TAG}:${tag}`
+  };
+}
+function resolveHookCommandPrefix2(options) {
+  const nodePath = options.nodePath ?? process.env.RECALL_NODE_PATH ?? process.execPath;
+  const cliPath = options.cliPath ?? resolveCliPath2();
+  return `${shellQuote2(nodePath)} ${shellQuote2(cliPath)}`;
+}
+function shellQuote2(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function readCodexHooksJson(targetPath) {
+  if (!existsSync2(targetPath)) return { raw: null, parsed: {} };
+  const raw = readFileSync2(targetPath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Invalid Codex hooks.json at ${targetPath}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Codex hooks.json must be an object at ${targetPath}`);
+  }
+  return { raw, parsed };
+}
+function writeJsonFile(targetPath, previousRaw, value) {
+  const parentDir = dirname2(targetPath);
+  mkdirSync2(parentDir, { recursive: true });
+  if (previousRaw != null) {
+    writeFileSync2(`${targetPath}.recall.bak.${Date.now()}`, previousRaw);
+  }
+  const tmpPath = `${targetPath}.tmp.${process.pid}`;
+  writeFileSync2(tmpPath, `${JSON.stringify(value, null, 2)}
+`);
+  renameSync2(tmpPath, targetPath);
+}
+function ensureCodexHooksObject(file) {
+  if (!file.hooks) file.hooks = {};
+  if (typeof file.hooks !== "object" || Array.isArray(file.hooks)) {
+    throw new Error("Codex hooks.json hooks must be an object");
+  }
+  return file.hooks;
+}
+function isCodexManagedGroup(group) {
+  return (group.hooks ?? []).some(
+    (hook) => typeof hook.command === "string" && hook.command.includes(MANAGED_HOOK_TAG)
+  );
+}
+function cloneCodexHooks(file) {
+  return JSON.parse(JSON.stringify(file));
+}
+function ensureCodexHooksFeatureFlag(targetConfigPath) {
+  const existing = existsSync2(targetConfigPath) ? readFileSync2(targetConfigPath, "utf-8") : "";
+  if (/^\s*codex_hooks\s*=\s*true\b/m.test(existing)) {
+    return { ok: true, changed: false, config_path: targetConfigPath, message: "" };
+  }
+  const featureHeader = /^\[features\]\s*$/m;
+  let next;
+  if (featureHeader.test(existing)) {
+    next = existing.replace(
+      featureHeader,
+      `[features]
+codex_hooks = true ${MANAGED_FEATURE_FLAG}`
+    );
+  } else {
+    const separator = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+    next = `${existing}${separator}
+[features]
+codex_hooks = true ${MANAGED_FEATURE_FLAG}
+`;
+  }
+  writeConfigFile(targetConfigPath, existing || null, next);
+  return { ok: true, changed: true, config_path: targetConfigPath, message: "enabled codex_hooks feature flag" };
+}
+function removeCodexHooksFeatureFlag(targetConfigPath) {
+  if (!existsSync2(targetConfigPath)) {
+    return { ok: true, changed: false, config_path: targetConfigPath, message: "" };
+  }
+  const existing = readFileSync2(targetConfigPath, "utf-8");
+  const managedLine = new RegExp(
+    `^\\s*codex_hooks\\s*=\\s*true\\s*${escapeRegExp(MANAGED_FEATURE_FLAG)}\\s*$\\n?`,
+    "m"
+  );
+  if (!managedLine.test(existing)) {
+    return { ok: true, changed: false, config_path: targetConfigPath, message: "" };
+  }
+  const next = existing.replace(managedLine, "");
+  writeConfigFile(targetConfigPath, existing, next);
+  return { ok: true, changed: true, config_path: targetConfigPath, message: "removed codex_hooks flag" };
+}
+function buildManagedNotifyBlock(options) {
+  const command = [
+    options.nodePath ?? process.env.RECALL_NODE_PATH ?? process.execPath,
+    options.cliPath ?? resolveCliPath2(),
+    "hook",
+    "codex-notify"
+  ];
+  return `${MANAGED_START}
+notify = ${renderTomlStringArray(command)}
+${MANAGED_END}
+`;
+}
+function resolveCliPath2() {
+  const fromEnv = process.env.RECALL_CLI_PATH;
+  if (fromEnv && existsSync2(fromEnv)) {
+    return resolve2(fromEnv);
+  }
+  const fromArgv = process.argv[1];
+  if (fromArgv && /(?:^|\/)cli\.[cm]?js$/.test(fromArgv) && existsSync2(fromArgv)) {
+    return resolve2(fromArgv);
+  }
+  const sibling = resolve2(dirname2(fileURLToPath2(import.meta.url)), "..", "cli.js");
+  if (existsSync2(sibling)) {
+    return sibling;
+  }
+  const distCli = resolve2(process.cwd(), "dist", "cli.js");
+  if (existsSync2(distCli)) {
+    return distCli;
+  }
+  throw new Error("Unable to resolve Recall CLI path for Codex notify bridge");
+}
+function stripManagedBlock(content) {
+  if (!content.includes(MANAGED_START)) {
+    return content;
+  }
+  return content.replace(new RegExp(`${escapeRegExp(MANAGED_START)}[\\s\\S]*?${escapeRegExp(MANAGED_END)}\\n?`, "g"), "").replace(/\n{3,}/g, "\n\n").replace(/^\n+/, "").replace(/\s+$/, "");
+}
+function appendManagedBlock(content, block) {
+  const trimmed = content.trim();
+  if (trimmed.length === 0) {
+    return block;
+  }
+  return `${trimmed}
+
+${block}`;
+}
+function hasUnmanagedNotify(content) {
+  return /^\s*notify\s*=.*$/m.test(content);
+}
+function renderTomlStringArray(values) {
+  return `[${values.map((value) => JSON.stringify(value)).join(", ")}]`;
+}
+function writeConfigFile(configPathValue, previousRaw, nextRaw) {
+  const parentDir = dirname2(configPathValue);
+  mkdirSync2(parentDir, { recursive: true });
+  if (previousRaw != null) {
+    writeFileSync2(`${configPathValue}.recall.bak.${Date.now()}`, previousRaw);
+  }
+  const tmpPath = `${configPathValue}.tmp.${process.pid}`;
+  writeFileSync2(tmpPath, normalizeTrailingNewline(nextRaw));
+  renameSync2(tmpPath, configPathValue);
+}
+function normalizeTrailingNewline(content) {
+  return content.trim().length === 0 ? "" : `${content.trimEnd()}
+`;
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/setup/local.ts
+function resolveRuntimePaths(appPath) {
+  if (appPath || process.platform === "darwin" && existsSync3("/Applications/Recall.app")) {
+    const resolvedAppPath = appPath ?? "/Applications/Recall.app";
+    const runtimeRoot = join3(resolvedAppPath, "Contents", "Resources", "Runtime");
+    return {
+      appPath: resolvedAppPath,
+      runtimeNodePath: join3(runtimeRoot, "bin", "node"),
+      runtimeCliPath: join3(runtimeRoot, "dist", "cli.js"),
+      runtimeMcpPath: join3(runtimeRoot, "dist", "mcp.js")
+    };
+  }
+  const distDir = dirname3(fileURLToPath3(import.meta.url));
+  return {
+    appPath: distDir,
+    runtimeNodePath: process.execPath,
+    runtimeCliPath: join3(distDir, "cli.js"),
+    runtimeMcpPath: join3(distDir, "mcp.js")
+  };
+}
+function runLocalSetup(opts = {}) {
+  const targetCodex = opts.codex ?? true;
+  const targetClaude = opts.claude ?? true;
+  const result = runRecallSetup({
+    appPath: opts.appPath,
+    agent: [
+      ...targetCodex ? ["codex"] : [],
+      ...targetClaude ? ["claude-code"] : []
+    ],
+    hooksOnly: false,
+    mcpOnly: false,
+    scope: "global",
+    promptInjection: opts.promptInjection
+  });
+  const codex = result.agents.find((agent) => agent.agent === "codex");
+  const claude = result.agents.find((agent) => agent.agent === "claude-code");
+  return {
+    appPath: result.appPath,
+    runtimeNodePath: result.runtimeNodePath,
+    runtimeCliPath: result.runtimeCliPath,
+    runtimeMcpPath: result.runtimeMcpPath,
+    codex: codex?.mcp ?? skipped("skipped"),
+    claude: claude?.mcp ?? skipped("skipped"),
+    codex_hooks: codex?.hooks ?? skipped("skipped"),
+    claude_hooks: claude?.hooks ?? skipped("skipped")
+  };
+}
+function runRecallSetup(opts = {}) {
+  const scope = opts.scope ?? "global";
+  const dryRun = opts.dryRun ?? false;
+  const hooksOnly = opts.hooksOnly ?? false;
+  const mcpOnly = opts.mcpOnly ?? false;
+  const uninstallHooks = opts.uninstallHooks ?? false;
+  const runner = opts.runner ?? defaultRunner;
+  const paths = resolveRuntimePaths(opts.appPath);
+  if (!existsSync3(paths.runtimeNodePath)) {
+    throw new Error(`Node runtime not found at ${paths.runtimeNodePath}`);
+  }
+  if (!existsSync3(paths.runtimeCliPath)) {
+    throw new Error(`Recall CLI entry not found at ${paths.runtimeCliPath}`);
+  }
+  if (!existsSync3(paths.runtimeMcpPath)) {
+    throw new Error(`Recall MCP entry not found at ${paths.runtimeMcpPath}`);
+  }
+  const targetAgents = resolveTargetAgents(opts.agent);
+  const cwd = resolve3(opts.cwd ?? process.cwd());
+  const agents = targetAgents.map(
+    (agent) => setupAgent(agent, {
+      cwd,
+      dryRun,
+      hooksOnly,
+      mcpOnly,
+      paths,
+      runner,
+      scope,
+      uninstallHooks,
+      promptInjection: opts.promptInjection
+    })
+  );
+  return {
+    ...paths,
+    scope,
+    dry_run: dryRun,
+    hooks_only: hooksOnly,
+    mcp_only: mcpOnly,
+    uninstall_hooks: uninstallHooks,
+    agents
+  };
+}
+function setupAgent(agent, options) {
+  const detected = detectAgent(agent);
+  const hookConfigPath = resolveHookConfigPath(agent, options.scope, options.cwd);
+  const mcp = options.hooksOnly ? skipped("hooks-only") : configureMcp(agent, options);
+  const hooks = options.mcpOnly ? skipped("mcp-only") : configureHooks(agent, {
+    configPath: hookConfigPath,
+    dryRun: options.dryRun,
+    paths: options.paths,
+    uninstallHooks: options.uninstallHooks,
+    promptInjection: options.promptInjection
+  });
+  return {
+    agent,
+    detected,
+    mcp,
+    hooks,
+    hook_config_path: options.mcpOnly ? null : hookConfigPath
+  };
+}
+function configureMcp(agent, options) {
+  if (agent === "codex") {
+    if (!hasCommand("codex")) return skipped("codex not found on PATH");
+    if (options.scope === "project") {
+      return skipped("project-scoped Codex MCP not supported by Codex CLI");
+    }
+    if (options.dryRun) {
+      return ok("would configure global Codex MCP server");
+    }
+    tryRun(options.runner, "codex", ["mcp", "remove", "recall"]);
+    options.runner("codex", ["mcp", "add", "recall", "--", options.paths.runtimeNodePath, options.paths.runtimeMcpPath]);
+    return ok("configured global Codex MCP server");
+  }
+  if (!hasCommand("claude")) return skipped("claude not found on PATH");
+  const claudeScope = options.scope === "project" ? "project" : "user";
+  if (options.dryRun) {
+    return ok(`would configure ${claudeScope} Claude MCP server`);
+  }
+  tryRun(options.runner, "claude", ["mcp", "remove", "recall", "-s", claudeScope]);
+  options.runner("claude", ["mcp", "add", "-s", claudeScope, "recall", options.paths.runtimeNodePath, options.paths.runtimeMcpPath]);
+  return ok(`configured ${claudeScope} Claude MCP server`);
+}
+function configureHooks(agent, options) {
+  if (options.dryRun) {
+    return ok(
+      options.uninstallHooks ? `would remove hooks from ${options.configPath}` : `would install hooks into ${options.configPath}${options.promptInjection === false ? " (prompt injection opt-out)" : ""}`
+    );
+  }
+  const codexHooksPath = agent === "codex" ? join3(dirname3(options.configPath), "hooks.json") : void 0;
+  const result = agent === "claude-code" ? options.uninstallHooks ? uninstallClaudeCodeHooks({ configPath: options.configPath }) : installClaudeCodeHooks({
+    configPath: options.configPath,
+    cliPath: options.paths.runtimeCliPath,
+    nodePath: options.paths.runtimeNodePath,
+    promptInjection: options.promptInjection
+  }) : options.uninstallHooks ? uninstallCodexHooks({ configPath: options.configPath, hooksPath: codexHooksPath }) : installCodexHooks({
+    configPath: options.configPath,
+    hooksPath: codexHooksPath,
+    cliPath: options.paths.runtimeCliPath,
+    nodePath: options.paths.runtimeNodePath,
+    promptInjection: options.promptInjection
+  });
+  return {
+    enabled: true,
+    ok: result.ok,
+    message: result.message
+  };
+}
+function resolveTargetAgents(target) {
+  if (target && target.length > 0) {
+    return [...new Set(target)];
+  }
+  const detected = [];
+  if (detectAgent("codex")) detected.push("codex");
+  if (detectAgent("claude-code")) detected.push("claude-code");
+  return detected;
+}
+function detectAgent(agent) {
+  if (agent === "codex") {
+    return hasCommand("codex") || existsSync3(join3(resolveUserHomeDir(), ".codex", "config.toml"));
+  }
+  return hasCommand("claude") || existsSync3(join3(resolveUserHomeDir(), ".claude", "settings.json"));
+}
+function resolveHookConfigPath(agent, scope, cwd) {
+  if (scope === "project") {
+    return agent === "codex" ? join3(cwd, ".codex", "config.toml") : join3(cwd, ".claude", "settings.json");
+  }
+  return agent === "codex" ? join3(resolveUserHomeDir(), ".codex", "config.toml") : join3(resolveUserHomeDir(), ".claude", "settings.json");
+}
+function defaultRunner(command, args) {
+  execFileSync3(command, args, stdioOpts());
+}
+function tryRun(runner, command, args) {
+  try {
+    runner(command, args);
+  } catch {
+    return;
+  }
+}
+function stdioOpts() {
+  return {
+    stdio: "ignore"
+  };
+}
+function ok(message) {
+  return { enabled: true, ok: true, message };
+}
+function skipped(message) {
+  return { enabled: false, ok: false, message };
+}
+
+// src/cli.ts
+import { createRequire } from "module";
+import { pathToFileURL } from "url";
+
+// src/doctor/report.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
+import Database from "better-sqlite3";
+
+// src/daemon/launchd.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join4, resolve as resolve4 } from "path";
+import { execFileSync as execFileSync4 } from "child_process";
+var DEFAULT_LABEL = "com.recall.daemon";
+function installLaunchAgent(opts = {}) {
+  assertDarwin();
+  const cfg = resolveConfig(opts);
+  mkdirSync3(dirname4(cfg.plistPath), { recursive: true });
+  mkdirSync3(dirname4(cfg.stdoutPath), { recursive: true });
+  writeFileSync3(cfg.plistPath, renderPlist(cfg));
+  tryRun2("launchctl", ["bootout", domainTarget(), cfg.plistPath]);
+  execFileSync4("launchctl", ["bootstrap", domainTarget(), cfg.plistPath], stdioOpts2());
+  execFileSync4("launchctl", ["enable", `${domainTarget()}/${cfg.label}`], stdioOpts2());
+  execFileSync4("launchctl", ["kickstart", "-k", `${domainTarget()}/${cfg.label}`], stdioOpts2());
+  return getLaunchAgentStatus(cfg.label);
+}
+function uninstallLaunchAgent(label = DEFAULT_LABEL) {
+  assertDarwin();
+  const cfg = resolveConfig({ label });
+  tryRun2("launchctl", ["bootout", domainTarget(), cfg.plistPath]);
+  tryRun2("launchctl", ["disable", `${domainTarget()}/${cfg.label}`]);
+  rmSync(cfg.plistPath, { force: true });
+  return getLaunchAgentStatus(cfg.label);
+}
+function startLaunchAgent(label = DEFAULT_LABEL) {
+  assertDarwin();
+  const cfg = resolveConfig({ label });
+  if (!exists(cfg.plistPath)) {
+    throw new Error(`LaunchAgent not installed: ${cfg.plistPath}`);
+  }
+  execFileSync4("launchctl", ["enable", `${domainTarget()}/${cfg.label}`], stdioOpts2());
+  tryRun2("launchctl", ["bootstrap", domainTarget(), cfg.plistPath]);
+  execFileSync4("launchctl", ["kickstart", "-k", `${domainTarget()}/${cfg.label}`], stdioOpts2());
+  return getLaunchAgentStatus(cfg.label);
+}
+function stopLaunchAgent(label = DEFAULT_LABEL) {
+  assertDarwin();
+  const cfg = resolveConfig({ label });
+  if (exists(cfg.plistPath)) {
+    tryRun2("launchctl", ["bootout", domainTarget(), cfg.plistPath]);
+  }
+  return getLaunchAgentStatus(cfg.label);
+}
+function getLaunchAgentStatus(label = DEFAULT_LABEL) {
+  assertDarwin();
+  const cfg = resolveConfig({ label });
+  const installed = exists(cfg.plistPath);
+  const output = tryOutput("launchctl", ["print", `${domainTarget()}/${cfg.label}`]);
+  return {
+    label: cfg.label,
+    plistPath: cfg.plistPath,
+    installed,
+    loaded: output.ok,
+    state: output.ok ? extractState(output.output) : void 0
+  };
+}
+function getLaunchAgentInfo(label = DEFAULT_LABEL) {
+  assertDarwin();
+  const cfg = resolveConfig({ label });
+  const status = getLaunchAgentStatus(label);
+  const installed = readInstalledConfig(cfg.plistPath);
+  const lines = [
+    `Label:      ${status.label}`,
+    `Plist:      ${cfg.plistPath}`,
+    `Installed:  ${status.installed ? "yes" : "no"}`,
+    `Loaded:     ${status.loaded ? "yes" : "no"}`
+  ];
+  if (status.state) {
+    lines.push(`State:      ${status.state}`);
+  }
+  lines.push(`Port:       ${installed?.port ?? cfg.port}`);
+  lines.push(`Data dir:   ${installed?.dataDir ?? cfg.dataDir}`);
+  if (installed?.repoRoots ?? cfg.repoRoots) {
+    lines.push(`Repos:      ${installed?.repoRoots ?? cfg.repoRoots}`);
+  }
+  if (installed?.embeddingProvider ?? cfg.embeddingProvider) {
+    lines.push(`EmbedProv:  ${installed?.embeddingProvider ?? cfg.embeddingProvider}`);
+  }
+  if (installed?.embeddingDims ?? cfg.embeddingDims) {
+    lines.push(`EmbedDims:  ${installed?.embeddingDims ?? cfg.embeddingDims}`);
+  }
+  if (installed?.embeddingsDisabled ?? cfg.embeddingsDisabled) {
+    lines.push(`EmbedOff:   ${installed?.embeddingsDisabled ?? cfg.embeddingsDisabled}`);
+  }
+  lines.push(`Node:       ${installed?.nodePath ?? cfg.nodePath}`);
+  lines.push(`Script:     ${installed?.daemonScript ?? cfg.daemonScript}`);
+  lines.push(`Maintain:   ${installed?.maintenanceIntervalSeconds ?? cfg.maintenanceIntervalSeconds}s`);
+  lines.push(`Stdout:     ${installed?.stdoutPath ?? cfg.stdoutPath}`);
+  lines.push(`Stderr:     ${installed?.stderrPath ?? cfg.stderrPath}`);
+  return lines.join("\n");
+}
+function resolveConfig(opts) {
+  const label = opts.label ?? DEFAULT_LABEL;
+  const home = homedir2();
+  const port = opts.port ?? parseInt(process.env.RECALL_PORT ?? "7890", 10);
+  const maintenanceIntervalSeconds = opts.maintenanceIntervalSeconds ?? parseInt(process.env.RECALL_MAINTENANCE_INTERVAL_SECONDS ?? "300", 10);
+  const dataDir = resolve4(
+    opts.dataDir ?? process.env.RECALL_DATA_DIR ?? join4(home, ".recall")
+  );
+  const nodePath = resolve4(opts.nodePath ?? process.execPath);
+  const daemonScript = resolve4(
+    opts.daemonScript ?? join4(process.cwd(), "dist", "daemon.js")
+  );
+  const plistPath = join4(home, "Library", "LaunchAgents", `${label}.plist`);
+  const logDir = join4(dataDir, "logs");
+  return {
+    label,
+    port,
+    maintenanceIntervalSeconds,
+    dataDir,
+    nodePath,
+    daemonScript,
+    plistPath,
+    stdoutPath: join4(logDir, "daemon.stdout.log"),
+    stderrPath: join4(logDir, "daemon.stderr.log"),
+    repoRoots: opts.repoRoots ?? process.env.RECALL_REPO_ROOTS,
+    embeddingProvider: opts.embeddingProvider ?? process.env.RECALL_EMBEDDING_PROVIDER,
+    embeddingDims: opts.embeddingDims ?? process.env.RECALL_EMBEDDING_DIMS,
+    embeddingsDisabled: opts.embeddingsDisabled ?? process.env.RECALL_EMBEDDINGS_DISABLED
+  };
+}
+function renderPlist(cfg) {
+  const env = {
+    RECALL_PORT: String(cfg.port),
+    RECALL_MAINTENANCE_INTERVAL_SECONDS: String(cfg.maintenanceIntervalSeconds),
+    RECALL_DATA_DIR: cfg.dataDir,
+    PATH: process.env.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin",
+    ...cfg.repoRoots ? { RECALL_REPO_ROOTS: cfg.repoRoots } : {},
+    ...cfg.embeddingProvider ? { RECALL_EMBEDDING_PROVIDER: cfg.embeddingProvider } : {},
+    ...cfg.embeddingDims ? { RECALL_EMBEDDING_DIMS: cfg.embeddingDims } : {},
+    ...cfg.embeddingsDisabled ? { RECALL_EMBEDDINGS_DISABLED: cfg.embeddingsDisabled } : {}
+  };
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escapeXml(cfg.label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(cfg.nodePath)}</string>
+    <string>${escapeXml(cfg.daemonScript)}</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${escapeXml(env.PATH)}</string>
+    <key>RECALL_PORT</key>
+    <string>${escapeXml(env.RECALL_PORT)}</string>
+    <key>RECALL_MAINTENANCE_INTERVAL_SECONDS</key>
+    <string>${escapeXml(env.RECALL_MAINTENANCE_INTERVAL_SECONDS)}</string>
+    <key>RECALL_DATA_DIR</key>
+    <string>${escapeXml(env.RECALL_DATA_DIR)}</string>
+${env.RECALL_REPO_ROOTS ? `    <key>RECALL_REPO_ROOTS</key>
+    <string>${escapeXml(env.RECALL_REPO_ROOTS)}</string>
+` : ""}${env.RECALL_EMBEDDING_PROVIDER ? `    <key>RECALL_EMBEDDING_PROVIDER</key>
+    <string>${escapeXml(env.RECALL_EMBEDDING_PROVIDER)}</string>
+` : ""}${env.RECALL_EMBEDDING_DIMS ? `    <key>RECALL_EMBEDDING_DIMS</key>
+    <string>${escapeXml(env.RECALL_EMBEDDING_DIMS)}</string>
+` : ""}${env.RECALL_EMBEDDINGS_DISABLED ? `    <key>RECALL_EMBEDDINGS_DISABLED</key>
+    <string>${escapeXml(env.RECALL_EMBEDDINGS_DISABLED)}</string>
+` : ""}  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>WorkingDirectory</key>
+  <string>${escapeXml(process.cwd())}</string>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(cfg.stdoutPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(cfg.stderrPath)}</string>
+</dict>
+</plist>
+`;
+}
+function domainTarget() {
+  const uid = process.getuid?.();
+  if (uid == null) {
+    throw new Error("Could not determine current macOS user id");
+  }
+  return `gui/${uid}`;
+}
+function extractState(output) {
+  const line = output.split("\n").find((item) => item.trim().startsWith("state = "));
+  if (!line) return void 0;
+  return line.split("=").slice(1).join("=").trim();
+}
+function tryRun2(cmd, args) {
+  try {
+    execFileSync4(cmd, args, stdioOpts2());
+  } catch {
+    return;
+  }
+}
+function tryOutput(cmd, args) {
+  try {
+    const output = execFileSync4(cmd, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return { ok: true, output };
+  } catch (error) {
+    return {
+      ok: false,
+      output: String(error?.stdout ?? error?.stderr ?? error?.message ?? "")
+    };
+  }
+}
+function readInstalledConfig(plistPath) {
+  if (!exists(plistPath)) return null;
+  try {
+    const raw = execFileSync4("plutil", ["-convert", "json", "-o", "-", plistPath], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const parsed = JSON.parse(raw);
+    return {
+      nodePath: parsed?.ProgramArguments?.[0],
+      daemonScript: parsed?.ProgramArguments?.[1],
+      port: parsed?.EnvironmentVariables?.RECALL_PORT,
+      maintenanceIntervalSeconds: parsed?.EnvironmentVariables?.RECALL_MAINTENANCE_INTERVAL_SECONDS,
+      dataDir: parsed?.EnvironmentVariables?.RECALL_DATA_DIR,
+      repoRoots: parsed?.EnvironmentVariables?.RECALL_REPO_ROOTS,
+      embeddingProvider: parsed?.EnvironmentVariables?.RECALL_EMBEDDING_PROVIDER,
+      embeddingDims: parsed?.EnvironmentVariables?.RECALL_EMBEDDING_DIMS,
+      embeddingsDisabled: parsed?.EnvironmentVariables?.RECALL_EMBEDDINGS_DISABLED,
+      stdoutPath: parsed?.StandardOutPath,
+      stderrPath: parsed?.StandardErrorPath
+    };
+  } catch {
+    return null;
+  }
+}
+function stdioOpts2() {
+  return {
+    stdio: "pipe"
+  };
+}
+function exists(path) {
+  return existsSync4(path);
+}
+function escapeXml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function assertDarwin() {
+  if (process.platform !== "darwin") {
+    throw new Error("launchd daemon install is only supported on macOS");
+  }
+}
+
+// src/daemon/systemd.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname5, join as join5, resolve as resolve5 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+import { execFileSync as execFileSync5 } from "child_process";
+var DEFAULT_LABEL2 = "recall-daemon";
+function installSystemdUnit(opts = {}) {
+  assertLinux();
+  const cfg = resolveConfig2(opts);
+  mkdirSync4(dirname5(cfg.unitPath), { recursive: true });
+  mkdirSync4(cfg.logDir, { recursive: true });
+  writeFileSync4(cfg.unitPath, renderUnit(cfg));
+  systemctl(["--user", "daemon-reload"]);
+  systemctl(["--user", "enable", "--now", `${cfg.label}.service`]);
+  return getSystemdStatus(cfg.label);
+}
+function uninstallSystemdUnit(label = DEFAULT_LABEL2) {
+  assertLinux();
+  const cfg = resolveConfig2({ label });
+  trySystemctl(["--user", "disable", "--now", `${cfg.label}.service`]);
+  rmSync2(cfg.unitPath, { force: true });
+  trySystemctl(["--user", "daemon-reload"]);
+  return getSystemdStatus(cfg.label);
+}
+function startSystemdUnit(label = DEFAULT_LABEL2) {
+  assertLinux();
+  const cfg = resolveConfig2({ label });
+  if (!existsSync5(cfg.unitPath)) {
+    throw new Error(`systemd unit not installed: ${cfg.unitPath}`);
+  }
+  systemctl(["--user", "start", `${cfg.label}.service`]);
+  return getSystemdStatus(cfg.label);
+}
+function stopSystemdUnit(label = DEFAULT_LABEL2) {
+  assertLinux();
+  const cfg = resolveConfig2({ label });
+  if (existsSync5(cfg.unitPath)) {
+    trySystemctl(["--user", "stop", `${cfg.label}.service`]);
+  }
+  return getSystemdStatus(cfg.label);
+}
+function getSystemdStatus(label = DEFAULT_LABEL2) {
+  assertLinux();
+  const cfg = resolveConfig2({ label });
+  const installed = existsSync5(cfg.unitPath);
+  const active = trySystemctlOutput(["--user", "is-active", `${cfg.label}.service`]);
+  const loaded = active.ok && active.output.trim() === "active";
+  const state = active.output.trim() || void 0;
+  return {
+    label: cfg.label,
+    unitPath: cfg.unitPath,
+    installed,
+    loaded,
+    state
+  };
+}
+function getSystemdInfo(label = DEFAULT_LABEL2) {
+  assertLinux();
+  const cfg = resolveConfig2({ label });
+  const status = getSystemdStatus(label);
+  const installed = readInstalledConfig2(cfg.unitPath);
+  const lines = [
+    `Label:      ${status.label}`,
+    `Unit:       ${cfg.unitPath}`,
+    `Installed:  ${status.installed ? "yes" : "no"}`,
+    `Loaded:     ${status.loaded ? "yes" : "no"}`
+  ];
+  if (status.state) lines.push(`State:      ${status.state}`);
+  lines.push(`Port:       ${installed?.port ?? cfg.port}`);
+  lines.push(`Data dir:   ${installed?.dataDir ?? cfg.dataDir}`);
+  if (installed?.repoRoots ?? cfg.repoRoots) {
+    lines.push(`Repos:      ${installed?.repoRoots ?? cfg.repoRoots}`);
+  }
+  if (installed?.embeddingProvider ?? cfg.embeddingProvider) {
+    lines.push(`EmbedProv:  ${installed?.embeddingProvider ?? cfg.embeddingProvider}`);
+  }
+  if (installed?.embeddingDims ?? cfg.embeddingDims) {
+    lines.push(`EmbedDims:  ${installed?.embeddingDims ?? cfg.embeddingDims}`);
+  }
+  if (installed?.embeddingsDisabled ?? cfg.embeddingsDisabled) {
+    lines.push(`EmbedOff:   ${installed?.embeddingsDisabled ?? cfg.embeddingsDisabled}`);
+  }
+  lines.push(`Node:       ${installed?.nodePath ?? cfg.nodePath}`);
+  lines.push(`Script:     ${installed?.daemonScript ?? cfg.daemonScript}`);
+  lines.push(`Maintain:   ${installed?.maintenanceIntervalSeconds ?? cfg.maintenanceIntervalSeconds}s`);
+  lines.push(`Logs:       journalctl --user -u ${cfg.label}.service`);
+  return lines.join("\n");
+}
+function resolveConfig2(opts) {
+  const label = opts.label ?? DEFAULT_LABEL2;
+  const home = homedir3();
+  const port = opts.port ?? parseInt(process.env.RECALL_PORT ?? "7890", 10);
+  const maintenanceIntervalSeconds = opts.maintenanceIntervalSeconds ?? parseInt(process.env.RECALL_MAINTENANCE_INTERVAL_SECONDS ?? "300", 10);
+  const dataDir = resolve5(
+    opts.dataDir ?? process.env.RECALL_DATA_DIR ?? join5(home, ".recall")
+  );
+  const nodePath = resolve5(opts.nodePath ?? process.execPath);
+  const daemonScript = resolve5(
+    opts.daemonScript ?? defaultDaemonScript()
+  );
+  const configHome = process.env.XDG_CONFIG_HOME ?? join5(home, ".config");
+  const unitPath = join5(configHome, "systemd", "user", `${label}.service`);
+  const logDir = join5(dataDir, "logs");
+  return {
+    label,
+    port,
+    maintenanceIntervalSeconds,
+    dataDir,
+    nodePath,
+    daemonScript,
+    unitPath,
+    logDir,
+    repoRoots: opts.repoRoots ?? process.env.RECALL_REPO_ROOTS,
+    embeddingProvider: opts.embeddingProvider ?? process.env.RECALL_EMBEDDING_PROVIDER,
+    embeddingDims: opts.embeddingDims ?? process.env.RECALL_EMBEDDING_DIMS,
+    embeddingsDisabled: opts.embeddingsDisabled ?? process.env.RECALL_EMBEDDINGS_DISABLED
+  };
+}
+function defaultDaemonScript() {
+  const here = dirname5(fileURLToPath4(import.meta.url));
+  return join5(here, "daemon.js");
+}
+function renderUnit(cfg) {
+  const envLines = [
+    `Environment=PATH=${process.env.PATH ?? "/usr/bin:/bin:/usr/local/bin"}`,
+    `Environment=RECALL_PORT=${cfg.port}`,
+    `Environment=RECALL_MAINTENANCE_INTERVAL_SECONDS=${cfg.maintenanceIntervalSeconds}`,
+    `Environment=RECALL_DATA_DIR=${cfg.dataDir}`
+  ];
+  if (cfg.repoRoots) envLines.push(`Environment=RECALL_REPO_ROOTS=${cfg.repoRoots}`);
+  if (cfg.embeddingProvider) envLines.push(`Environment=RECALL_EMBEDDING_PROVIDER=${cfg.embeddingProvider}`);
+  if (cfg.embeddingDims) envLines.push(`Environment=RECALL_EMBEDDING_DIMS=${cfg.embeddingDims}`);
+  if (cfg.embeddingsDisabled) envLines.push(`Environment=RECALL_EMBEDDINGS_DISABLED=${cfg.embeddingsDisabled}`);
+  return `[Unit]
+Description=Recall local daemon
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${cfg.nodePath} ${cfg.daemonScript}
+Restart=always
+RestartSec=2
+${envLines.join("\n")}
+
+[Install]
+WantedBy=default.target
+`;
+}
+function readInstalledConfig2(unitPath) {
+  if (!existsSync5(unitPath)) return null;
+  try {
+    const raw = readFileSync3(unitPath, "utf8");
+    const exec = raw.match(/^ExecStart=(.+)$/m)?.[1]?.trim().split(/\s+/);
+    const env = {};
+    for (const m of raw.matchAll(/^Environment=([^=]+)=(.+)$/gm)) {
+      env[m[1]] = m[2];
+    }
+    return {
+      nodePath: exec?.[0],
+      daemonScript: exec?.[1],
+      port: env.RECALL_PORT,
+      maintenanceIntervalSeconds: env.RECALL_MAINTENANCE_INTERVAL_SECONDS,
+      dataDir: env.RECALL_DATA_DIR,
+      repoRoots: env.RECALL_REPO_ROOTS,
+      embeddingProvider: env.RECALL_EMBEDDING_PROVIDER,
+      embeddingDims: env.RECALL_EMBEDDING_DIMS,
+      embeddingsDisabled: env.RECALL_EMBEDDINGS_DISABLED
+    };
+  } catch {
+    return null;
+  }
+}
+function systemctl(args) {
+  execFileSync5("systemctl", args, { stdio: "pipe" });
+}
+function trySystemctl(args) {
+  try {
+    execFileSync5("systemctl", args, { stdio: "pipe" });
+  } catch {
+    return;
+  }
+}
+function trySystemctlOutput(args) {
+  try {
+    const output = execFileSync5("systemctl", args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return { ok: true, output };
+  } catch (error) {
+    return {
+      ok: false,
+      output: String(error?.stdout ?? error?.stderr ?? error?.message ?? "")
+    };
+  }
+}
+function assertLinux() {
+  if (process.platform !== "linux") {
+    throw new Error("systemd daemon install is only supported on Linux");
+  }
+}
+
+// src/doctor/report.ts
+function getDoctorReport() {
+  const dbPath = getDbPath();
+  const launchd = process.platform === "darwin" ? (() => {
+    try {
+      const status = getLaunchAgentStatus();
+      return {
+        installed: status.installed,
+        loaded: status.loaded,
+        state: status.state
+      };
+    } catch {
+      return null;
+    }
+  })() : null;
+  const systemd = process.platform === "linux" ? (() => {
+    try {
+      const status = getSystemdStatus();
+      return {
+        installed: status.installed,
+        loaded: status.loaded,
+        state: status.state
+      };
+    } catch {
+      return null;
+    }
+  })() : null;
+  const agents = inspectAgentInstalls();
+  return {
+    db_path: dbPath,
+    db_user_version: getDbUserVersion(dbPath),
+    db_target_version: RECALL_DB_USER_VERSION,
+    embeddings: getEmbeddingModelInfo(),
+    launchd,
+    systemd,
+    agents,
+    upgrade: computeUpgradeSignal(agents),
+    cleanup: readCleanupHealth(dbPath),
+    dispatcher: readDispatcherHealth(dbPath)
+  };
+}
+function readDispatcherHealth(dbPath) {
+  if (!existsSync6(dbPath)) return null;
+  let sqlite = null;
+  try {
+    sqlite = new Database(dbPath, { readonly: true, fileMustExist: true });
+    const tables = sqlite.prepare(
+      "SELECT name FROM sqlite_master WHERE type='table' AND name IN ('memory_maintenance_tasks','llm_usage')"
+    ).all();
+    const names = new Set(tables.map((t) => t.name));
+    let providers = [];
+    try {
+      const { hasProviderConfigured } = (init_keychain(), __toCommonJS(keychain_exports));
+      providers = ["anthropic", "azure-openai", "openai"].filter(
+        (p) => hasProviderConfigured(p)
+      );
+    } catch {
+      providers = [];
+    }
+    const pending = {};
+    if (names.has("memory_maintenance_tasks")) {
+      const rows = sqlite.prepare(
+        "SELECT kind, COUNT(*) AS n FROM memory_maintenance_tasks WHERE status='pending' GROUP BY kind"
+      ).all();
+      for (const r of rows) pending[r.kind] = r.n;
+    }
+    let lastAt = null;
+    let lastOk = null;
+    if (names.has("llm_usage")) {
+      const row = sqlite.prepare(
+        "SELECT created_at, ok FROM llm_usage ORDER BY created_at DESC LIMIT 1"
+      ).get();
+      if (row) {
+        lastAt = row.created_at;
+        lastOk = row.ok ? "ok" : "error";
+      }
+    }
+    return {
+      providers_configured: providers,
+      pending_tasks: pending,
+      last_dispatch_at: lastAt,
+      last_dispatch_outcome: lastOk
+    };
+  } catch {
+    return null;
+  } finally {
+    sqlite?.close();
+  }
+}
+function readCleanupHealth(dbPath) {
+  if (!existsSync6(dbPath)) return null;
+  let sqlite = null;
+  try {
+    sqlite = new Database(dbPath, { readonly: true, fileMustExist: true });
+    const tables = sqlite.prepare(
+      "SELECT name FROM sqlite_master WHERE type='table' AND name IN ('maintenance_cleanup_log','memories','memory_injections')"
+    ).all();
+    const names = new Set(tables.map((t) => t.name));
+    if (!names.has("maintenance_cleanup_log")) return null;
+    const totals = sqlite.prepare(
+      "SELECT COUNT(DISTINCT run_id) AS runs, MAX(created_at) AS last_at FROM maintenance_cleanup_log"
+    ).get();
+    let lastRunId = null;
+    const actions = {};
+    if (totals.last_at) {
+      const lastRow = sqlite.prepare(
+        "SELECT run_id FROM maintenance_cleanup_log WHERE created_at = ? LIMIT 1"
+      ).get(totals.last_at);
+      lastRunId = lastRow?.run_id ?? null;
+      if (lastRunId) {
+        const rows = sqlite.prepare(
+          "SELECT action, COUNT(*) as c FROM maintenance_cleanup_log WHERE run_id = ? GROUP BY action"
+        ).all(lastRunId);
+        for (const r of rows) actions[r.action] = r.c;
+      }
+    }
+    let pending = 0;
+    if (names.has("memories")) {
+      const row = sqlite.prepare(
+        "SELECT COUNT(*) AS n FROM memories WHERE status='candidate' AND source='user_correction'"
+      ).get();
+      pending = row.n;
+    }
+    let followedRate = null;
+    let resolvedInjections = 0;
+    if (names.has("memory_injections")) {
+      const since = new Date(Date.now() - 14 * 864e5).toISOString();
+      const rows = sqlite.prepare(
+        "SELECT outcome, COUNT(*) as c FROM memory_injections WHERE injected_at >= ? GROUP BY outcome"
+      ).all(since);
+      let followed = 0;
+      for (const r of rows) {
+        if (!r.outcome) continue;
+        resolvedInjections += r.c;
+        if (r.outcome === "followed") followed += r.c;
+      }
+      followedRate = resolvedInjections > 0 ? followed / resolvedInjections : null;
+    }
+    return {
+      last_run_id: lastRunId,
+      last_run_at: totals.last_at,
+      last_run_actions: actions,
+      total_runs: totals.runs,
+      pending_candidate_corrections: pending,
+      followed_rate_resolved: followedRate,
+      resolved_injections: resolvedInjections
+    };
+  } catch {
+    return null;
+  } finally {
+    sqlite?.close();
+  }
+}
+function computeUpgradeSignal(agents) {
+  const reasons = [];
+  for (const agent of agents) {
+    if (!agent.detected) continue;
+    if (agent.legacy_notify_bridge) {
+      reasons.push(
+        `${agent.agent}: legacy notify bridge detected \u2014 upgrade to hooks.json for per-turn memory injection`
+      );
+      continue;
+    }
+    if (agent.mcp && !agent.hooks) {
+      reasons.push(
+        `${agent.agent}: MCP configured but lifecycle hooks missing \u2014 memory injection depends on the model calling query`
+      );
+    }
+  }
+  return { available: reasons.length > 0, reasons };
+}
+function inspectAgentInstalls(homeDir) {
+  const home = homeDir ?? resolveUserHomeDir();
+  return [
+    inspectClaudeCodeInstall(home),
+    inspectCodexInstall(home)
+  ];
+}
+function inspectClaudeCodeInstall(home) {
+  const configPath3 = join6(home, ".claude", "settings.json");
+  const detected = existsSync6(configPath3) || hasCommand("claude");
+  const notes = [];
+  let mcp = false;
+  let hooks = false;
+  if (existsSync6(configPath3)) {
+    try {
+      const parsed = JSON.parse(readFileSync4(configPath3, "utf-8"));
+      mcp = Boolean(parsed?.mcpServers?.recall);
+      const hookGroups = parsed?.hooks ?? {};
+      hooks = Object.values(hookGroups).some(
+        (groups) => Array.isArray(groups) && groups.some(
+          (group) => isHookGroupManagedBy(group, "recall:managed:claude-code")
+        )
+      );
+      if (!mcp) notes.push("MCP server 'recall' not registered in mcpServers");
+      if (!hooks) notes.push("No Recall-managed hooks found in settings.json");
+    } catch (err) {
+      notes.push(`Could not parse ${configPath3}: ${err.message}`);
+    }
+  } else if (detected) {
+    notes.push("Claude CLI detected but settings.json missing");
+  }
+  return {
+    agent: "claude-code",
+    detected,
+    mcp,
+    hooks,
+    config_path: configPath3,
+    notes
+  };
+}
+function inspectCodexInstall(home) {
+  const configPath3 = join6(home, ".codex", "config.toml");
+  const hooksPath = join6(home, ".codex", "hooks.json");
+  const detected = existsSync6(configPath3) || hasCommand("codex");
+  const notes = [];
+  let mcp = false;
+  let hooks = false;
+  let legacy_notify_bridge = false;
+  if (existsSync6(configPath3)) {
+    const raw = readFileSync4(configPath3, "utf-8");
+    mcp = /\[mcp_servers\.recall\]/.test(raw);
+    const featureFlagSet = /^\s*codex_hooks\s*=\s*true\b/m.test(raw);
+    const managedHooksJson = existsSync6(hooksPath) && readFileSync4(hooksPath, "utf-8").includes("recall:managed:codex");
+    hooks = featureFlagSet && managedHooksJson;
+    legacy_notify_bridge = raw.includes("# recall:managed:codex:start") && raw.includes("codex-notify");
+    if (!mcp) notes.push("MCP block [mcp_servers.recall] not in config.toml");
+    if (legacy_notify_bridge) {
+      notes.push(
+        "Legacy notify bridge present \u2014 install the new hooks.json path to enable per-turn memory injection"
+      );
+    }
+    if (!featureFlagSet) notes.push("codex_hooks = true missing from [features]");
+    if (!managedHooksJson) notes.push("No Recall-managed entries in ~/.codex/hooks.json");
+  } else if (detected) {
+    notes.push("Codex CLI detected but config.toml missing");
+  }
+  return {
+    agent: "codex",
+    detected,
+    mcp,
+    hooks,
+    legacy_notify_bridge,
+    config_path: configPath3,
+    hook_path: hooksPath,
+    notes
+  };
+}
+function isHookGroupManagedBy(group, tag) {
+  if (!group || typeof group !== "object") return false;
+  const hooks = group.hooks;
+  if (!Array.isArray(hooks)) return false;
+  return hooks.some(
+    (hook) => hook && typeof hook === "object" && typeof hook.command === "string" && hook.command.includes(tag)
+  );
+}
+function formatDoctorReport(report) {
+  const lines = [
+    "# Recall Doctor",
+    "",
+    `DB:        ${report.db_path}`,
+    `DB ver:    ${report.db_user_version}/${report.db_target_version}`
+  ];
+  if (report.embeddings) {
+    lines.push(`Embed:     ${report.embeddings.provider}`);
+    lines.push(`Model:     ${report.embeddings.model}`);
+    lines.push(`Dims:      index=${report.embeddings.index_dimensions} canonical=${report.embeddings.canonical_dimensions}`);
+    lines.push(`Cache:     ${report.embeddings.size_label} @ ${report.embeddings.cache_path}`);
+  } else {
+    lines.push("Embed:     disabled");
+  }
+  if (report.launchd) {
+    lines.push(`Launchd:   ${report.launchd.installed ? "installed" : "missing"} / ${report.launchd.loaded ? "loaded" : "not loaded"}${report.launchd.state ? ` (${report.launchd.state})` : ""}`);
+  }
+  if (report.systemd) {
+    lines.push(`Systemd:   ${report.systemd.installed ? "installed" : "missing"} / ${report.systemd.loaded ? "loaded" : "not loaded"}${report.systemd.state ? ` (${report.systemd.state})` : ""}`);
+  }
+  lines.push("", "## Agents");
+  for (const agent of report.agents) {
+    const label = agent.agent.padEnd(12);
+    if (!agent.detected) {
+      lines.push(`${label} not detected`);
+      continue;
+    }
+    const mcp = agent.mcp ? "ok" : "MISSING";
+    const hooks = agent.hooks ? "ok" : "MISSING";
+    const legacy = agent.legacy_notify_bridge ? " (legacy notify bridge)" : "";
+    lines.push(`${label} mcp:${mcp} hooks:${hooks}${legacy}`);
+    for (const note of agent.notes) {
+      lines.push(`             - ${note}`);
+    }
+  }
+  if (report.cleanup) {
+    lines.push("", "## Cleanup");
+    if (report.cleanup.last_run_at) {
+      const actions = Object.entries(report.cleanup.last_run_actions).map(([k, v]) => `${k}=${v}`).join(" ");
+      lines.push(`Last run:  ${report.cleanup.last_run_id?.slice(0, 8)} at ${report.cleanup.last_run_at.slice(0, 19)}`);
+      lines.push(`Actions:   ${actions || "(none)"}`);
+    } else {
+      lines.push("Last run:  never");
+    }
+    lines.push(`Total runs: ${report.cleanup.total_runs}`);
+    lines.push(`Pending correction candidates: ${report.cleanup.pending_candidate_corrections}`);
+    if (report.cleanup.followed_rate_resolved != null) {
+      const pct = (report.cleanup.followed_rate_resolved * 100).toFixed(1);
+      lines.push(`Followed rate (last 14d, of ${report.cleanup.resolved_injections} resolved): ${pct}%`);
+    } else {
+      lines.push(`Followed rate (last 14d): n/a (no resolved injections)`);
+    }
+  }
+  if (report.dispatcher) {
+    lines.push("", "## Dispatcher (LLM refinement)");
+    const provs = report.dispatcher.providers_configured;
+    lines.push(`Providers: ${provs.length === 0 ? "none configured (LLM tier dormant)" : provs.join(", ")}`);
+    const pendingEntries = Object.entries(report.dispatcher.pending_tasks);
+    if (pendingEntries.length === 0) {
+      lines.push("Pending tasks: 0");
+    } else {
+      const total = pendingEntries.reduce((s, [, n]) => s + n, 0);
+      lines.push(`Pending tasks: ${total} (${pendingEntries.map(([k, n]) => `${k}=${n}`).join(", ")})`);
+    }
+    if (report.dispatcher.last_dispatch_at) {
+      lines.push(`Last dispatch: ${report.dispatcher.last_dispatch_at.slice(0, 19)} (${report.dispatcher.last_dispatch_outcome ?? "unknown"})`);
+    } else {
+      lines.push("Last dispatch: never");
+    }
+    if (provs.length === 0 && pendingEntries.length > 0) {
+      lines.push("Tasks are queued but no provider is configured. Run `recall maintenance dispatch --preview` to inspect prompts, or `recall maintenance credentials set <provider> <key>` to enable.");
+    }
+  }
+  if (report.upgrade.available) {
+    lines.push("", "## Upgrade available");
+    for (const reason of report.upgrade.reasons) {
+      lines.push(`- ${reason}`);
+    }
+    lines.push("Run `recall doctor --fix` or `recall setup --yes` to apply.");
+  }
+  return lines.join("\n");
+}
+
+// src/daemon/service.ts
+var isLinux = process.platform === "linux";
+var isDarwin = process.platform === "darwin";
+function unsupported() {
+  throw new Error(
+    `Recall daemon service is only supported on macOS (launchd) and Linux (systemd). Current platform: ${process.platform}`
+  );
+}
+function installService(opts = {}) {
+  if (isDarwin) return installLaunchAgent(opts);
+  if (isLinux) return installSystemdUnit(opts);
+  unsupported();
+}
+function uninstallService(label) {
+  if (isDarwin) return uninstallLaunchAgent(label);
+  if (isLinux) return uninstallSystemdUnit(label);
+  unsupported();
+}
+function startService(label) {
+  if (isDarwin) return startLaunchAgent(label);
+  if (isLinux) return startSystemdUnit(label);
+  unsupported();
+}
+function stopService(label) {
+  if (isDarwin) return stopLaunchAgent(label);
+  if (isLinux) return stopSystemdUnit(label);
+  unsupported();
+}
+function getServiceInfo(label) {
+  if (isDarwin) return getLaunchAgentInfo(label);
+  if (isLinux) return getSystemdInfo(label);
+  unsupported();
+}
+function defaultServiceLabel() {
+  return isLinux ? "recall-daemon" : "com.recall.daemon";
+}
+
+// src/cli.ts
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var program = new Command();
+program.name("recall").description("Cross-tool coding memory and instruction compiler").version(pkg.version);
+program.command("init").description("Initialize Recall database").action(() => {
+  initDb();
+  console.log("Recall initialized. Database ready.");
+});
+program.command("doctor").description("Show local Recall runtime, DB, embedding, and agent-install health").option("--json", "Emit raw JSON report").option("--fix", "Install missing hooks/MCP for detected agents").action((opts) => {
+  const report = getDoctorReport();
+  if (opts.fix) {
+    const detectedAgents = report.agents.filter((a) => a.detected && (!a.mcp || !a.hooks)).map((a) => a.agent);
+    if (detectedAgents.length === 0) {
+      if (!opts.json) console.log("Nothing to fix \u2014 all detected agents are wired.");
+    } else {
+      const fixResult = runRecallSetup({
+        agent: detectedAgents
+      });
+      if (!opts.json) {
+        console.log(`Applied fix for: ${detectedAgents.join(", ")}`);
+        for (const agent of fixResult.agents) {
+          console.log(`${formatAgentName(agent.agent)} MCP:   ${formatSetupStep(agent.mcp)}`);
+          console.log(`${formatAgentName(agent.agent)} hooks: ${formatSetupStep(agent.hooks)}`);
+        }
+        console.log("");
+      }
+    }
+  }
+  const finalReport = opts.fix ? getDoctorReport() : report;
+  if (opts.json) {
+    console.log(JSON.stringify(finalReport, null, 2));
+    return;
+  }
+  console.log(formatDoctorReport(finalReport));
+});
+var dbCmd = program.command("db").description("Manage the local Recall database");
+dbCmd.command("reset").description("Reset the local Recall database and reinitialize the clean schema").option("--yes", "Confirm destructive reset").option("--yes-i-know", "Confirm destructive reset").option("--purge-models", "Also remove the local embedding model cache").action((opts) => {
+  if (!opts.yes && !opts.yesIKnow) {
+    console.error("Refusing to reset without --yes or --yes-i-know.");
+    process.exit(1);
+  }
+  const dbPath = getDbPath();
+  resetDb(dbPath, { purgeModels: opts.purgeModels });
+  initDb(dbPath);
+  console.log(`Reset ${dbPath}`);
+  if (opts.purgeModels) {
+    console.log("Purged local embedding model cache.");
+  }
+});
+dbCmd.command("backup").description("Create a dated snapshot of the local database (idempotent per day)").option("--retention <n>", "Number of snapshots to retain", (v) => Number.parseInt(v, 10)).action((opts) => {
+  initDb();
+  const result = ensureDailyBackup({
+    retention: Number.isFinite(opts.retention) ? opts.retention : void 0
+  });
+  if (result.created) console.log(`Created ${result.created}`);
+  else console.log("Today's backup already exists.");
+  console.log(`Retained: ${result.retained.length}`);
+  for (const p of result.retained) console.log(`  ${p}`);
+  if (result.removed.length) {
+    console.log(`Removed: ${result.removed.length}`);
+    for (const p of result.removed) console.log(`  ${p}`);
+  }
+});
+dbCmd.command("backups").description("List available database snapshots").action(() => {
+  const backups = listBackups();
+  if (backups.length === 0) {
+    console.log("No backups yet.");
+    return;
+  }
+  for (const b of backups) {
+    const mb = (b.size_bytes / 1024 / 1024).toFixed(2);
+    console.log(`${b.date}  ${mb} MB  ${b.path}`);
+  }
+});
+dbCmd.command("restore <date>").description("Restore the local database from a dated snapshot (YYYY-MM-DD)").option("--yes", "Confirm overwrite").action((date, opts) => {
+  if (!opts.yes) {
+    console.error("Refusing to restore without --yes.");
+    process.exit(1);
+  }
+  const result = restoreBackup(date);
+  if (!result.restored) {
+    console.error(`No backup found at ${result.from}`);
+    process.exit(1);
+  }
+  console.log(`Restored ${result.from} -> ${result.to}`);
+});
+var setupCmd = program.command("setup").description("Setup Recall for local use");
+setupCmd.option("--app-path <path>", "Override Recall.app path", "/Applications/Recall.app").option("--hooks-only", "Install hooks only").option("--mcp-only", "Install MCP wiring only").option("--agent <agent>", "Restrict setup to a single agent (repeatable)", collectAgents, []).option("--uninstall-hooks", "Remove Recall-managed hooks while leaving MCP configured").option("--dry-run", "Show planned setup changes without writing").option("--scope <scope>", "Hook config scope: global or project", "global").option("--no-prompt-injection", "Opt out of per-prompt memory injection (writes RECALL_HOOK_INJECT_PROMPT=false inline into the agent hook command)").option("--yes", "Skip confirmation prompt").action(async (opts) => {
+  if (!opts.yes && !opts.dryRun) {
+    const confirmed = await confirmSetupWrite(opts.scope);
+    if (!confirmed) {
+      console.error("Aborted setup.");
+      process.exit(1);
+    }
+  }
+  const result = runRecallSetup({
+    appPath: opts.appPath,
+    agent: opts.agent.length > 0 ? opts.agent : void 0,
+    dryRun: opts.dryRun,
+    hooksOnly: opts.hooksOnly,
+    mcpOnly: opts.mcpOnly,
+    scope: opts.scope,
+    uninstallHooks: opts.uninstallHooks,
+    promptInjection: opts.promptInjection
+  });
+  console.log(`Recall app: ${result.appPath}`);
+  console.log(`Bundled node: ${result.runtimeNodePath}`);
+  console.log(`Bundled CLI:  ${result.runtimeCliPath}`);
+  console.log(`Bundled MCP:  ${result.runtimeMcpPath}`);
+  console.log(`Scope:        ${result.scope}${result.dry_run ? " (dry-run)" : ""}`);
+  console.log("");
+  if (result.agents.length === 0) {
+    console.log("No installed agents detected.");
+    return;
+  }
+  for (const agent of result.agents) {
+    console.log(`${formatAgentName(agent.agent)}:`);
+    console.log(`  detected: ${agent.detected ? "yes" : "no"}`);
+    console.log(`  mcp:      ${formatSetupStep(agent.mcp)}`);
+    console.log(`  hooks:    ${formatSetupStep(agent.hooks)}`);
+    if (agent.hook_config_path) {
+      console.log(`  config:   ${agent.hook_config_path}`);
+    }
+  }
+});
+setupCmd.command("local").description("Configure local agent MCP + hooks against the installed Recall.app").option("--app-path <path>", "Override Recall.app path", "/Applications/Recall.app").option("--codex-only", "Configure only Codex").option("--claude-only", "Configure only Claude").option("--no-prompt-injection", "Opt out of per-prompt memory injection (writes RECALL_HOOK_INJECT_PROMPT=false inline into the agent hook command)").action((opts) => {
+  const result = runLocalSetup({
+    appPath: opts.appPath,
+    codex: opts.claudeOnly ? false : true,
+    claude: opts.codexOnly ? false : true,
+    promptInjection: opts.promptInjection
+  });
+  console.log(`Recall app: ${result.appPath}`);
+  console.log(`Bundled node: ${result.runtimeNodePath}`);
+  console.log(`Bundled CLI:  ${result.runtimeCliPath}`);
+  console.log(`Bundled MCP:  ${result.runtimeMcpPath}`);
+  console.log("");
+  console.log(`Codex MCP:    ${formatSetupStep(result.codex)}`);
+  console.log(`Codex hooks:  ${formatSetupStep(result.codex_hooks)}`);
+  console.log(`Claude MCP:   ${formatSetupStep(result.claude)}`);
+  console.log(`Claude hooks: ${formatSetupStep(result.claude_hooks)}`);
+});
+var hookCmd = program.command("hook").description("Run lifecycle hook handlers for agent integrations");
+function safeHookAction(event, action) {
+  return async (...args) => {
+    try {
+      return await action(...args);
+    } catch (error) {
+      let logPath = "~/.recall/logs/hook-errors.log";
+      try {
+        const { appendFileSync, mkdirSync: mkdirSync5 } = await import("fs");
+        const { homedir: homedir4 } = await import("os");
+        const dir = join7(homedir4(), ".recall", "logs");
+        mkdirSync5(dir, { recursive: true });
+        logPath = join7(dir, "hook-errors.log");
+        const message = error instanceof Error ? error.stack ?? error.message : String(error);
+        appendFileSync(
+          logPath,
+          `${(/* @__PURE__ */ new Date()).toISOString()} ${event} ${message}
+`
+        );
+      } catch {
+      }
+      process.stderr.write(
+        `Recall: ${event} hook hit a snag \u2014 see ${logPath}
+`
+      );
+      process.exit(0);
+    }
+  };
+}
+hookCmd.command("prompt").description("Record a submitted prompt").option("--text <text>", "Prompt text").option("--repo <repo>", "Repository slug").option("--repo-path <path>", "Repository path").option("--session <id>", "Session ID").option("--path <path>", "File path context").option("--agent <agent>", "Agent name").option("--prev-assistant <text>", "Previous assistant turn").option("--recent-tools <json>", "Recent tool calls as a JSON array").option("--claude-code-stdin", "Read Claude Code hook JSON from stdin").option("--codex-stdin", "Read Codex hook JSON from stdin").action(safeHookAction("prompt", async (opts) => {
+  const stdinAgent = opts.claudeCodeStdin ? "claude-code" : opts.codexStdin ? "codex" : null;
+  const input = stdinAgent === "claude-code" ? await readClaudeCodePromptInputFromStdin() : stdinAgent === "codex" ? await readCodexPromptInputFromStdin() : {
+    text: opts.text,
+    repo: opts.repo,
+    repo_path: opts.repoPath,
+    session_id: opts.session,
+    path: opts.path,
+    agent: opts.agent,
+    prev_assistant_turn: opts.prevAssistant,
+    recent_tool_calls: parseRecentToolCallsOption(opts.recentTools)
+  };
+  const result = await executePromptHook(input);
+  if (stdinAgent && result.injection) {
+    const output = {
+      hookSpecificOutput: {
+        hookEventName: "UserPromptSubmit",
+        additionalContext: formatInjectionContext(result.injection)
+      }
+    };
+    process.stdout.write(`${JSON.stringify(output)}
+`);
+  }
+}));
+hookCmd.command("tool").description("Record a completed tool invocation").option("--name <name>", "Tool name").option("--exit <code>", "Tool exit code").option("--repo <repo>", "Repository slug").option("--repo-path <path>", "Repository path").option("--session <id>", "Session ID").option("--path <path>", "File path context").option("--agent <agent>", "Agent name").option("--input-summary <text>", "Tool input summary").option("--claude-code-stdin", "Read Claude Code hook JSON from stdin").option("--codex-stdin", "Read Codex hook JSON from stdin").action(safeHookAction("tool", async (opts) => {
+  const input = opts.claudeCodeStdin ? await readClaudeCodeToolInputFromStdin() : opts.codexStdin ? await readCodexToolInputFromStdin() : {
+    name: opts.name,
+    exit_code: parseInteger(opts.exit, "exit"),
+    repo: opts.repo,
+    repo_path: opts.repoPath,
+    session_id: opts.session,
+    path: opts.path,
+    agent: opts.agent,
+    input_summary: opts.inputSummary
+  };
+  await executeToolHook(input);
+}));
+hookCmd.command("session-start").description("Record session start").option("--session <id>", "Session ID").option("--agent <agent>", "Agent name").option("--repo <repo>", "Repository slug").option("--repo-path <path>", "Repository path").option("--path <path>", "File path context").option("--claude-code-stdin", "Read Claude Code hook JSON from stdin").option("--codex-stdin", "Read Codex hook JSON from stdin").action(safeHookAction("session-start", async (opts) => {
+  const stdinAgent = opts.claudeCodeStdin ? "claude-code" : opts.codexStdin ? "codex" : null;
+  const input = stdinAgent === "claude-code" ? await readClaudeCodeSessionStartInputFromStdin() : stdinAgent === "codex" ? await readCodexSessionStartInputFromStdin() : {
+    session_id: opts.session,
+    agent: opts.agent,
+    repo: opts.repo,
+    repo_path: opts.repoPath,
+    path: opts.path
+  };
+  const result = await executeSessionStartHook(input);
+  if (stdinAgent) {
+    const parts = [];
+    if (result.injection) parts.push(formatInjectionContext(result.injection));
+    if (result.maintenance_backlog) {
+      parts.push(formatMaintenanceBacklogContext(result.maintenance_backlog));
+    }
+    if (result.pending_confirmations) {
+      parts.push(formatPendingConfirmationsContext(result.pending_confirmations));
+    }
+    if (parts.length > 0) {
+      const output = {
+        hookSpecificOutput: {
+          hookEventName: "SessionStart",
+          additionalContext: parts.join("\n\n")
+        }
+      };
+      process.stdout.write(`${JSON.stringify(output)}
+`);
+    }
+  }
+}));
+hookCmd.command("session-end").description("Record session end").option("--session <id>", "Session ID").option("--repo <repo>", "Repository slug").option("--repo-path <path>", "Repository path").option("--path <path>", "File path context").option("--agent <agent>", "Agent name").option("--turn-count <count>", "Turn count").option("--claude-code-stdin", "Read Claude Code hook JSON from stdin").option("--codex-stdin", "Read Codex hook JSON from stdin").action(safeHookAction("session-end", async (opts) => {
+  const input = opts.claudeCodeStdin ? await readClaudeCodeSessionEndInputFromStdin() : opts.codexStdin ? await readCodexSessionEndInputFromStdin() : {
+    session_id: opts.session,
+    repo: opts.repo,
+    repo_path: opts.repoPath,
+    path: opts.path,
+    agent: opts.agent,
+    turn_count: opts.turnCount ? parseInteger(opts.turnCount, "turn-count") : void 0
+  };
+  await executeSessionEndHook(input);
+}));
+hookCmd.command("codex-notify").description("Bridge a Codex notify payload into Recall hook handlers").argument("[payload]", "Codex notify payload JSON").action(safeHookAction("codex-notify", async (payload) => {
+  await dispatchCodexNotify(payload);
+}));
+hookCmd.command("stats").description("Inspect local hook call telemetry").option("--agent <agent>", "Filter by agent").option("--event <event>", "Filter by event").option("--limit <n>", "Limit rows").option("--json", "Emit raw JSON").action((opts) => {
+  const db = initDb();
+  const stats = getHookCallStats(db, {
+    agent: opts.agent,
+    event: opts.event,
+    limit: opts.limit ? parseInt(opts.limit, 10) : void 0
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(stats, null, 2));
+    return;
+  }
+  if (stats.length === 0) {
+    console.log("No hook calls recorded.");
+    return;
+  }
+  for (const row of stats) {
+    console.log(
+      `${row.agent.padEnd(12)} ${row.event.padEnd(16)} total=${row.total_calls} ok=${row.ok_calls} err=${row.error_calls} avg=${row.avg_duration_ms.toFixed(1)}ms max=${row.max_duration_ms}ms last=${row.last_called_at}`
+    );
+  }
+});
+program.command("scan").description("Scan a repository and bootstrap memories").argument("[path]", "Repository path", ".").option("-s, --session <id>", "Session ID").action((path, opts) => {
+  const db = initDb();
+  const repoPath = resolve6(path);
+  const ids = scanAndStore(db, repoPath);
+  const artifact = writeRepoContextArtifact(db, {
+    repo: inferRepoSlugFromPath(repoPath),
+    repo_path: repoPath
+  });
+  const scanned = ids.map((id) => getMemory(db, id)).filter((mem) => mem != null);
+  const activeCount = scanned.filter((mem) => mem.status === "active").length;
+  const candidateCount = scanned.filter((mem) => mem.status === "candidate").length;
+  console.log(`Scanned ${repoPath}`);
+  console.log(`Created ${ids.length} memories (${activeCount} active, ${candidateCount} candidate).`);
+  if (artifact.output_path) {
+    console.log(`Updated ${artifact.output_path}`);
+  }
+  createActivityEvent(db, {
+    session_id: opts.session ?? null,
+    repo: scanned[0]?.repo ?? null,
+    source: "cli",
+    event_type: "scan",
+    memory_ids: ids,
+    request: { repo_path: repoPath },
+    result: { created: ids.length, active: activeCount, candidate: candidateCount }
+  });
+  if (ids.length > 0) {
+    console.log("\nMemories:");
+    for (const id of ids) {
+      const mem = getMemory(db, id);
+      if (mem) {
+        console.log(
+          `  [${mem.status}] (${mem.confidence.toFixed(2)}) ${mem.type}: ${mem.text}`
+        );
+      }
+    }
+    console.log(
+      "\nUse `recall confirm <id>` to promote candidates, or `recall reject <id>` to discard."
+    );
+  }
+});
+program.command("repos").description("List repositories known to Recall").action(() => {
+  const db = initDb();
+  const repos = listRepos(db);
+  if (repos.length === 0) {
+    console.log("No repositories found.");
+    return;
+  }
+  for (const repo of repos) {
+    console.log(repo);
+  }
+  console.log(`
+${repos.length} repos total.`);
+});
+program.command("list").description("List memories").option("-r, --repo <repo>", "Filter by repository").option(
+  "-s, --status <status>",
+  "Filter by status (transient|candidate|active|rejected)"
+).option("-t, --type <type>", "Filter by type").option("-n, --limit <n>", "Limit results").option("--offset <n>", "Skip first N results", "0").action((opts) => {
+  const db = initDb();
+  const items = queryMemories(db, {
+    repo: opts.repo,
+    status: opts.status,
+    type: opts.type,
+    limit: opts.limit ? parseInt(opts.limit, 10) : void 0,
+    offset: opts.offset ? parseInt(opts.offset, 10) : void 0
+  });
+  if (items.length === 0) {
+    console.log("No memories found.");
+    return;
+  }
+  for (const m of items) {
+    const prefix = m.id.slice(0, 8);
+    console.log(
+      `${prefix}  [${m.status.padEnd(9)}] (${m.confidence.toFixed(2)}) ${m.type.padEnd(14)} ${m.text}`
+    );
+  }
+  console.log(`
+${items.length} memories total.`);
+});
+program.command("show").description("Show memory details").argument("<id>", "Memory ID (full or prefix)").action((idPrefix) => {
+  const db = initDb();
+  const mem = findByPrefix(db, idPrefix);
+  if (!mem) {
+    console.error(`Memory not found: ${idPrefix}`);
+    process.exit(1);
+  }
+  console.log(JSON.stringify(mem, null, 2));
+});
+program.command("confirm").description("Confirm a memory (promote to active)").argument("<id>", "Memory ID (full or prefix)").action((idPrefix) => {
+  const db = initDb();
+  const mem = findByPrefix(db, idPrefix);
+  if (!mem) {
+    console.error(`Memory not found: ${idPrefix}`);
+    process.exit(1);
+  }
+  const ok2 = confirmMemory(db, mem.id);
+  if (ok2) {
+    console.log(`Confirmed: ${mem.id.slice(0, 8)} \u2192 active`);
+  } else {
+    console.error("Could not confirm (may be rejected).");
+  }
+});
+program.command("reject").description("Reject a memory (never inject again)").argument("<id>", "Memory ID (full or prefix)").action((idPrefix) => {
+  const db = initDb();
+  const mem = findByPrefix(db, idPrefix);
+  if (!mem) {
+    console.error(`Memory not found: ${idPrefix}`);
+    process.exit(1);
+  }
+  rejectMemory(db, mem.id);
+  console.log(`Rejected: ${mem.id.slice(0, 8)}`);
+});
+program.command("compile").description("Compile active memories into injection pack").requiredOption("-r, --repo <repo>", "Repository name").option("-p, --path <path>", "File path for scoping").option("-q, --query <text>", "Optional query text for hybrid reranking").option("--include-candidates", "Allow strong candidate memories into hybrid ranking").option("-s, --session <id>", "Session ID").option("--threshold <n>", "Confidence threshold (default: dynamic from quality profile)").action(async (opts) => {
+  const db = initDb();
+  const result = opts.query || opts.includeCandidates ? await compileContextHybrid(db, {
+    repo: opts.repo,
+    path: opts.path,
+    query_text: opts.query,
+    config: {
+      ...opts.threshold ? { confidence_threshold: parseFloat(opts.threshold) } : {},
+      include_candidates: opts.includeCandidates ?? false
+    }
+  }) : compileContext(db, {
+    repo: opts.repo,
+    path: opts.path,
+    config: opts.threshold ? { confidence_threshold: parseFloat(opts.threshold) } : {}
+  });
+  createActivityEvent(db, {
+    session_id: opts.session ?? null,
+    repo: opts.repo,
+    path: opts.path ?? null,
+    source: "cli",
+    event_type: "compile",
+    memory_ids: result.memories_included,
+    request: {
+      threshold: opts.threshold ? parseFloat(opts.threshold) : null,
+      query_text: opts.query ?? null,
+      include_candidates: opts.includeCandidates ?? false
+    },
+    result: {
+      included: result.memories_included,
+      dropped: result.memories_dropped,
+      history_included: result.history_included,
+      token_estimate: result.token_estimate
+    }
+  });
+  if (!result.text) {
+    console.log("No context above threshold. Nothing to inject.");
+    return;
+  }
+  console.log(result.text);
+  console.log(`---`);
+  console.log(
+    `${result.memories_included.length} memories included, ${result.history_included.length} history snippets included, ${result.memories_dropped.length} dropped, ~${result.token_estimate} tokens`
+  );
+});
+program.command("correct").description("Report a correction to learn from").argument("<text>", "Correction text").option("-r, --repo <repo>", "Repository name").option("-p, --path <path>", "File path context").option("-s, --session <id>", "Session ID", "cli").action(async (text, opts) => {
+  const db = initDb();
+  const ids = await processCorrection(db, text, {
+    sessionId: opts.session,
+    repo: opts.repo,
+    path: opts.path
+  });
+  createActivityEvent(db, {
+    session_id: opts.session,
+    repo: opts.repo ?? null,
+    path: opts.path ?? null,
+    source: "cli",
+    event_type: "correction",
+    memory_ids: ids,
+    request: { text },
+    result: { created: ids }
+  });
+  if (ids.length === 0) {
+    console.log("No correction pattern detected.");
+    console.log(
+      `Try: "don't use X, use Y", "always do Z", "let's use editorconfig defaults", or "review said to use W"`
+    );
+    return;
+  }
+  console.log(`Created ${ids.length} candidate(s):`);
+  for (const id of ids) {
+    const mem = getMemory(db, id);
+    if (mem)
+      console.log(`  ${id.slice(0, 8)}: ${mem.text}`);
+  }
+});
+program.command("review").description("Report review feedback").argument("<feedback>", "Review feedback text").option("-r, --repo <repo>", "Repository name").option("-p, --path <path>", "File path context").option("-s, --session <id>", "Session ID", "cli-review").option("--reviewer <name>", "Reviewer name").action(async (feedback, opts) => {
+  const db = initDb();
+  const ids = await processReviewFeedback(db, feedback, {
+    sessionId: opts.session,
+    repo: opts.repo,
+    path: opts.path,
+    reviewer: opts.reviewer
+  });
+  createActivityEvent(db, {
+    session_id: opts.session,
+    repo: opts.repo ?? null,
+    path: opts.path ?? null,
+    source: "cli",
+    event_type: "review",
+    memory_ids: ids,
+    request: { feedback, reviewer: opts.reviewer ?? null },
+    result: { created: ids }
+  });
+  console.log(`Created ${ids.length} candidate(s) from review feedback.`);
+  for (const id of ids) {
+    const mem = getMemory(db, id);
+    if (mem) console.log(`  ${id.slice(0, 8)}: ${mem.text}`);
+  }
+});
+program.command("export").description("Export memories as markdown instruction files").requiredOption("-r, --repo <repo>", "Repository name").option(
+  "-f, --format <format>",
+  "Export format: claude | codex | markdown | context",
+  "markdown"
+).option("-o, --output <path>", "Output file path").action((opts) => {
+  const db = initDb();
+  let content;
+  switch (opts.format) {
+    case "claude":
+      content = exportClaude(db, opts.repo);
+      break;
+    case "codex":
+      content = exportCodex(db, opts.repo);
+      break;
+    case "context": {
+      const artifact = writeRepoContextArtifact(db, { repo: opts.repo });
+      if (!artifact.output_path) {
+        console.error(`Could not resolve local repo path for ${opts.repo}`);
+        process.exit(1);
+      }
+      content = readFileSync5(artifact.output_path, "utf-8");
+      if (!opts.output) {
+        console.log(content);
+        return;
+      }
+      break;
+    }
+    default:
+      content = exportMarkdown(db, opts.repo);
+  }
+  if (opts.output) {
+    writeFileSync5(opts.output, content);
+    console.log(`Exported to ${opts.output}`);
+  } else {
+    console.log(content);
+  }
+});
+program.command("publish").description("Write repo-local .recall/context.md for the current repo").argument("[path]", "Repository path", ".").action((path) => {
+  const db = initDb();
+  const repoPath = resolve6(path);
+  const artifact = writeRepoContextArtifact(db, {
+    repo: inferRepoSlugFromPath(repoPath),
+    repo_path: repoPath
+  });
+  if (!artifact.output_path) {
+    console.error(`Could not write repo-local context for ${repoPath}`);
+    process.exit(1);
+  }
+  console.log(`Wrote ${artifact.output_path}`);
+});
+var historyCmd = program.command("history").description("Inspect rolled-up history snippets");
+historyCmd.command("list").description("List history snippets").option("-r, --repo <repo>", "Filter by repository").option("-s, --session <id>", "Filter by session id").option("-k, --kind <kind>", "Filter by kind").option("-n, --limit <n>", "Limit results", "20").action((opts) => {
+  const db = initDb();
+  const items = listHistorySnippets(db, {
+    repo: opts.repo,
+    session_id: opts.session,
+    kind: opts.kind,
+    limit: parseInt(opts.limit, 10)
+  });
+  if (items.length === 0) {
+    console.log("No history snippets found.");
+    return;
+  }
+  for (const item of items) {
+    console.log(`${item.id.slice(0, 8)}  [${item.kind}] repo=${item.repo ?? "-"} session=${item.session_id ?? "-"} ${item.text.split("\n")[0]}`);
+  }
+});
+historyCmd.command("search").description("Search history snippets with hybrid lexical/vector retrieval").argument("<query>", "Search query").option("-r, --repo <repo>", "Filter by repository").option("-n, --limit <n>", "Limit results", "10").action(async (query, opts) => {
+  const db = initDb();
+  const results = await searchHistorySnippets(db, query, {
+    repo: opts.repo,
+    limit: parseInt(opts.limit, 10)
+  });
+  if (results.length === 0) {
+    console.log("No matching history snippets found.");
+    return;
+  }
+  for (const result of results) {
+    console.log(
+      `${result.snippet.id.slice(0, 8)}  (score=${result.score.toFixed(3)} vec=${result.similarity.toFixed(3)} lex=${result.lexical_score.toFixed(3)}) [${result.snippet.kind}] ${result.snippet.text.split("\n")[0]}`
+    );
+  }
+});
+program.command("serve").description("Start the MCP server (stdio transport)").action(async () => {
+  await import("./mcp.js");
+});
+var syncCmd = program.command("sync").description("Sync memories with remote server");
+syncCmd.command("push").description("Push local memories to remote").action(async () => {
+  const db = initDb();
+  const config = loadSyncConfig();
+  if (!config) {
+    console.error("No sync config. Set RECALL_SYNC_URL and RECALL_SYNC_KEY.");
+    process.exit(1);
+  }
+  const result = await sync(db, config);
+  console.log(`Pushed: ${result.pushed}, Pulled: ${result.pulled}, Conflicts: ${result.conflicts}`);
+  if (result.errors.length > 0) {
+    console.error("Errors:", result.errors.join("; "));
+  }
+});
+syncCmd.command("pull").description("Pull team memories from remote").action(async () => {
+  const db = initDb();
+  const config = loadSyncConfig();
+  if (!config) {
+    console.error("No sync config. Set RECALL_SYNC_URL and RECALL_SYNC_KEY.");
+    process.exit(1);
+  }
+  const result = await sync(db, config);
+  console.log(`Pulled: ${result.pulled}, Conflicts: ${result.conflicts}`);
+});
+var teamCmd = program.command("team").description("Manage teams");
+teamCmd.command("create").description("Create a new team").argument("<name>", "Team name").action(async (name) => {
+  const config = loadSyncConfig();
+  if (!config) {
+    console.error("No sync config.");
+    process.exit(1);
+  }
+  const teamId = await createTeam(config, name);
+  console.log(`Team created: ${teamId}`);
+  console.log(`Set RECALL_TEAM_ID=${teamId} to use this team.`);
+});
+teamCmd.command("join").description("Join an existing team").argument("<team-id>", "Team ID").action(async (teamId) => {
+  const config = loadSyncConfig();
+  if (!config) {
+    console.error("No sync config.");
+    process.exit(1);
+  }
+  await joinTeam(config, teamId);
+  console.log(`Joined team: ${teamId}`);
+});
+var evalCmd = program.command("eval").description("Evaluation metrics");
+evalCmd.command("report").description("Show evaluation metrics report").option("-r, --repo <repo>", "Filter by repo").option("--since <date>", "Since date (ISO)").action((opts) => {
+  const db = initDb();
+  const metrics = computeMetrics(db, { repo: opts.repo, since: opts.since });
+  console.log(formatMetricsReport(metrics));
+});
+evalCmd.command("start").description("Start an eval session").requiredOption("-r, --repo <repo>", "Repository name").action((opts) => {
+  const db = initDb();
+  const id = startEvalSession(db, opts.repo);
+  console.log(`Eval session started: ${id}`);
+});
+evalCmd.command("end").description("End an eval session").argument("<session-id>", "Session ID").action((sessionId) => {
+  const db = initDb();
+  endEvalSession(db, sessionId);
+  console.log(`Eval session ended: ${sessionId}`);
+});
+evalCmd.command("retrieval").description("Run retrieval eval fixtures against baseline vs hybrid retrieval").requiredOption("-f, --file <path>", "Fixture file path").option("-p, --provider <providers>", "Providers to compare (comma-separated: current,nomic,multilingual-e5,bge-small-en-v1.5)", "current").option("--json", "Emit raw JSON report").action(async (opts) => {
+  const db = initDb();
+  const input = loadRetrievalEvalFile(opts.file);
+  const providers = String(opts.provider).split(",").map((value) => value.trim()).filter(Boolean);
+  const report = await runRetrievalEval(db, input, { providers });
+  if (opts.json) {
+    console.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  console.log(formatRetrievalEvalReport(report));
+});
+var embeddingsCmd = program.command("embeddings").description("Manage canonical embedding state");
+embeddingsCmd.command("setup").description("Pre-fetch the active embedding model into the local cache").action(async () => {
+  const config = loadEmbeddingConfigFromEnv();
+  if (!config) {
+    console.error("Embeddings are disabled. Unset RECALL_EMBEDDINGS_DISABLED=true to enable local embeddings.");
+    process.exit(1);
+  }
+  const before = getEmbeddingModelInfo(config);
+  if (!before.cached) {
+    const approx = before.estimated_size_mb ? `~${before.estimated_size_mb}MB` : "download";
+    console.log(`Fetching embedding model (one-time, ${approx}) -> ${before.cache_path}`);
+  }
+  const info = await ensureEmbeddingProviderReady(config);
+  if (!info) {
+    console.error("Failed to initialize embedding provider.");
+    process.exit(1);
+  }
+  console.log(`Provider: ${info.provider}`);
+  console.log(`Model:    ${info.model}`);
+  console.log(`Cache:    ${info.cache_path}`);
+  console.log(`Size:     ${info.size_label}`);
+});
+embeddingsCmd.command("info").description("Show active embedding provider and cache details").action(() => {
+  const info = getEmbeddingModelInfo();
+  if (!info) {
+    console.error("Embeddings are disabled. Unset RECALL_EMBEDDINGS_DISABLED=true to enable local embeddings.");
+    process.exit(1);
+  }
+  console.log(`Provider: ${info.provider}`);
+  console.log(`Model:    ${info.model}`);
+  console.log(`Dims:     index=${info.index_dimensions} canonical=${info.canonical_dimensions}`);
+  console.log(`Version:  ${info.version}`);
+  console.log(`Cached:   ${info.cached ? "yes" : "no"}`);
+  console.log(`Size:     ${info.size_label}`);
+  console.log(`Cache:    ${info.cache_path}`);
+  if (info.task_prefix) {
+    console.log(`Prefix:   ${info.task_prefix}`);
+  }
+});
+embeddingsCmd.command("bootstrap").description("Generate or refresh embeddings for eligible memories").option("-r, --repo <repo>", "Limit bootstrap to one repo").action(async (opts) => {
+  const db = initDb();
+  const config = loadEmbeddingConfigFromEnv();
+  if (!config) {
+    console.error("Embeddings are disabled. Unset RECALL_EMBEDDINGS_DISABLED=true to enable local embeddings.");
+    process.exit(1);
+  }
+  const count = await bootstrapEmbeddings(db, config, {
+    repo: opts.repo
+  });
+  console.log(`Bootstrapped ${count} embeddings.`);
+});
+embeddingsCmd.command("verify").description("Verify embedding coverage and stale content hashes").option("-r, --repo <repo>", "Limit verification to one repo").action((opts) => {
+  const db = initDb();
+  const config = loadEmbeddingConfigFromEnv();
+  if (!config) {
+    console.error("Embeddings are disabled. Unset RECALL_EMBEDDINGS_DISABLED=true to enable local embeddings.");
+    process.exit(1);
+  }
+  const result = verifyEmbeddings(db, config, {
+    repo: opts.repo
+  });
+  console.log(`Eligible: ${result.eligible}`);
+  console.log(`Stored:   ${result.stored}`);
+  console.log(`Stale:    ${result.stale}`);
+  console.log(`Indexed:  ${result.indexed}`);
+  console.log(`Drift:    ${result.index_drift}`);
+  console.log(`Lexical:  ${result.lexical_indexed}`);
+  console.log(`LexDrift: ${result.lexical_drift}`);
+});
+embeddingsCmd.command("rebuild-index").description("Rebuild derived retrieval indexes from canonical memories").option("-r, --repo <repo>", "Limit rebuild to one repo").action((opts) => {
+  const db = initDb();
+  const config = loadEmbeddingConfigFromEnv();
+  const result = rebuildEmbeddingIndex(db, config, {
+    repo: opts.repo
+  });
+  console.log(`Rebuilt sqlite-vec index with ${result.vector_rows} rows.`);
+  console.log(`Rebuilt FTS5 index with ${result.lexical_rows} rows.`);
+});
+program.command("search").description("Hybrid lexical + vector search across memories").argument("<query>", "Search query").option("-r, --repo <repo>", "Filter by repo").option("-n, --limit <n>", "Max results", "10").action(async (query, opts) => {
+  const db = initDb();
+  const config = loadEmbeddingConfigFromEnv();
+  const results = await hybridSearch(db, query, config, {
+    repo: opts.repo,
+    limit: parseInt(opts.limit)
+  });
+  if (results.length === 0) {
+    console.log("No matching memories found.");
+    return;
+  }
+  for (const r of results) {
+    console.log(
+      `${r.memory.id.slice(0, 8)}  (score=${r.score.toFixed(3)} vec=${r.similarity.toFixed(3)} lex=${r.lexical_score.toFixed(3)}) [${r.memory.status}] ${r.memory.text}`
+    );
+  }
+});
+program.command("signal").description("Record an implicit feedback signal").argument("<memory-id>", "Memory ID").argument("<signal>", "Signal type: test_pass|test_fail|file_unchanged|file_rewritten|task_accepted|task_rejected").option("-s, --session <id>", "Session ID", "cli").action((memoryIdPrefix, signal, opts) => {
+  const db = initDb();
+  const mem = findByPrefix(db, memoryIdPrefix);
+  if (!mem) {
+    console.error(`Memory not found: ${memoryIdPrefix}`);
+    process.exit(1);
+  }
+  const validSignals = ["test_pass", "test_fail", "file_unchanged", "file_rewritten", "task_accepted", "task_rejected"];
+  if (!validSignals.includes(signal)) {
+    console.error(`Invalid signal. Use: ${validSignals.join(", ")}`);
+    process.exit(1);
+  }
+  const id = recordSignal(db, mem.id, opts.session, signal);
+  createActivityEvent(db, {
+    session_id: opts.session,
+    repo: mem.repo,
+    path: mem.path_scope,
+    source: "cli",
+    event_type: "signal",
+    memory_ids: [mem.id],
+    request: { signal },
+    result: { signal_id: id }
+  });
+  console.log(`Signal recorded: ${id.slice(0, 8)}`);
+  const stats = getSignalStats(db, mem.id);
+  console.log("Stats:", JSON.stringify(stats));
+});
+program.command("scope").description("Analyze scope of a correction text").argument("<text>", "Correction text").option("-p, --path <path>", "Context file path").action((text, opts) => {
+  const result = inferScope(text, opts.path);
+  console.log(`Scope:       ${result.scope}`);
+  console.log(`Path scope:  ${result.path_scope ?? "(none)"}`);
+  console.log(`Confidence:  ${result.confidence_modifier > 0 ? "+" : ""}${result.confidence_modifier}`);
+  console.log(`Reason:      ${result.reason}`);
+});
+var policyCmd = program.command("policy").description("Org-level policy management");
+policyCmd.command("create").description("Create a policy rule").requiredOption("--org <id>", "Organization ID").requiredOption("--type <type>", "Rule type: min_confidence|require_approval|allowed_sources|blocked_scopes|max_active_per_repo|require_evidence_count|auto_approve_pattern").requiredOption("--config <json>", "Rule config as JSON").action((opts) => {
+  const db = initDb();
+  const config = JSON.parse(opts.config);
+  const id = createPolicy(db, opts.org, opts.type, config);
+  console.log(`Policy created: ${id.slice(0, 8)}`);
+});
+policyCmd.command("list").description("List policies for an org").requiredOption("--org <id>", "Organization ID").action((opts) => {
+  const db = initDb();
+  const rules = listPolicies(db, opts.org);
+  if (rules.length === 0) {
+    console.log("No policies.");
+    return;
+  }
+  for (const r of rules) {
+    console.log(`${r.id.slice(0, 8)}  [${r.enabled ? "on" : "off"}] ${r.rule_type}  ${JSON.stringify(r.config)}`);
+  }
+});
+policyCmd.command("toggle").description("Enable/disable a policy").argument("<id>", "Policy ID").argument("<state>", "on or off").action((id, state) => {
+  const db = initDb();
+  togglePolicy(db, id, state === "on");
+  console.log(`Policy ${id.slice(0, 8)} ${state === "on" ? "enabled" : "disabled"}.`);
+});
+policyCmd.command("delete").description("Delete a policy").argument("<id>", "Policy ID").action((id) => {
+  const db = initDb();
+  deletePolicy(db, id);
+  console.log(`Policy ${id.slice(0, 8)} deleted.`);
+});
+policyCmd.command("check").description("Check a memory against org policies").requiredOption("--org <id>", "Organization ID").argument("<memory-id>", "Memory ID").action((memoryId, opts) => {
+  const db = initDb();
+  const mem = findByPrefix(db, memoryId);
+  if (!mem) {
+    console.error(`Memory not found: ${memoryId}`);
+    process.exit(1);
+  }
+  const violations = evaluatePolicy(db, opts.org, mem);
+  if (violations.length === 0) {
+    console.log("No policy violations.");
+  } else {
+    for (const v of violations) {
+      console.log(`[${v.blocking ? "BLOCK" : "WARN"}] ${v.rule_type}: ${v.message}`);
+    }
+  }
+});
+var approvalCmd = program.command("approval").description("Approval queue management");
+approvalCmd.command("request").description("Request approval for a memory").argument("<memory-id>", "Memory ID").requiredOption("--org <id>", "Organization ID").option("--by <name>", "Requested by", "cli").action((memoryId, opts) => {
+  const db = initDb();
+  const mem = findByPrefix(db, memoryId);
+  if (!mem) {
+    console.error(`Memory not found: ${memoryId}`);
+    process.exit(1);
+  }
+  const id = requestApproval(db, mem.id, opts.org, opts.by);
+  console.log(`Approval requested: ${id.slice(0, 8)}`);
+});
+approvalCmd.command("list").description("List pending approvals").requiredOption("--org <id>", "Organization ID").action((opts) => {
+  const db = initDb();
+  const pending = listPendingApprovals(db, opts.org);
+  if (pending.length === 0) {
+    console.log("No pending approvals.");
+    return;
+  }
+  for (const a of pending) {
+    console.log(`${a.id.slice(0, 8)}  memory:${a.memory_id.slice(0, 8)}  by:${a.requested_by}  ${a.created_at}`);
+  }
+});
+approvalCmd.command("resolve").description("Approve or deny a request").argument("<approval-id>", "Approval ID").argument("<decision>", "approved or denied").option("--by <name>", "Reviewed by", "cli").option("--reason <reason>", "Reason").action((approvalId, decision, opts) => {
+  const db = initDb();
+  const ok2 = resolveApproval(db, approvalId, decision, opts.by, opts.reason);
+  if (ok2) {
+    console.log(`Approval ${approvalId.slice(0, 8)} \u2192 ${decision}`);
+  } else {
+    console.error("Approval not found.");
+  }
+});
+program.command("health").description("Memory health scoring report").option("-r, --repo <repo>", "Filter by repo").option("--id <id>", "Score a single memory").action((opts) => {
+  const db = initDb();
+  if (opts.id) {
+    const mem = findByPrefix(db, opts.id);
+    if (!mem) {
+      console.error(`Memory not found: ${opts.id}`);
+      process.exit(1);
+    }
+    const score = computeHealthScore(db, mem.id);
+    if (score) {
+      console.log(`Score:      ${(score.score * 100).toFixed(0)}%`);
+      console.log(`Confidence: ${(score.confidence_component * 100).toFixed(0)}%`);
+      console.log(`Freshness:  ${(score.freshness_component * 100).toFixed(0)}%`);
+      console.log(`Follow:     ${(score.follow_rate_component * 100).toFixed(0)}%`);
+      console.log(`Signal:     ${(score.signal_ratio_component * 100).toFixed(0)}%`);
+    }
+    return;
+  }
+  const scores = computeAllHealthScores(db, opts.repo);
+  console.log(formatHealthReport(scores));
+});
+var contradictCmd = program.command("contradictions").description("Detect and resolve contradictions");
+contradictCmd.command("detect").description("Scan for contradictions").option("-r, --repo <repo>", "Filter by repo").action((opts) => {
+  const db = initDb();
+  const found = detectContradictions(db, opts.repo);
+  if (found.length === 0) {
+    console.log("No new contradictions detected.");
+    return;
+  }
+  for (const c of found) {
+    console.log(`${c.id.slice(0, 8)}  [${c.severity}] ${c.contradiction_type}: ${c.description}`);
+  }
+  console.log(`
+${found.length} contradiction(s) found.`);
+});
+contradictCmd.command("list").description("List contradictions").option("--resolved", "Show resolved only").option("--unresolved", "Show unresolved only").action((opts) => {
+  const db = initDb();
+  const resolved = opts.resolved ? true : opts.unresolved ? false : void 0;
+  const items = listContradictions(db, { resolved });
+  if (items.length === 0) {
+    console.log("No contradictions.");
+    return;
+  }
+  for (const c of items) {
+    const status = c.resolved ? "resolved" : "open";
+    console.log(`${c.id.slice(0, 8)}  [${status}] ${c.severity} ${c.contradiction_type}: ${c.description}`);
+  }
+});
+contradictCmd.command("resolve").description("Resolve a contradiction by keeping one memory").argument("<contradiction-id>", "Contradiction ID").argument("<keep-memory-id>", "Memory ID to keep").option("--actor <name>", "Who resolved", "cli").option("--reason <reason>", "Resolution reason").action((cId, keepId, opts) => {
+  const db = initDb();
+  const ok2 = resolveContradiction(db, cId, keepId, opts.actor, opts.reason);
+  if (ok2) {
+    console.log(`Contradiction ${cId.slice(0, 8)} resolved. Kept ${keepId.slice(0, 8)}.`);
+  } else {
+    console.error("Contradiction not found.");
+  }
+});
+contradictCmd.command("auto-resolve").description("Auto-resolve contradictions (higher confidence wins)").option("-r, --repo <repo>", "Filter by repo").action((opts) => {
+  const db = initDb();
+  const count = autoResolveContradictions(db, opts.repo);
+  console.log(`Auto-resolved ${count} contradiction(s).`);
+});
+program.command("prune").description("Auto-prune stale and unhealthy memories").option("-r, --repo <repo>", "Limit pruning to one repo").option("--stale-days <n>", "Days before rejecting stale memories", "90").option("--rejected-days <n>", "Days before deleting rejected memories", "30").option("--transient-days <n>", "Days before deleting transient memories", "7").option("--min-health <n>", "Min health score for active memories", "0.2").option("--dry-run", "Preview without making changes").action((opts) => {
+  const db = initDb();
+  const result = pruneMemories(db, {
+    repo: opts.repo,
+    stale_days: parseInt(opts.staleDays),
+    rejected_retention_days: parseInt(opts.rejectedDays),
+    transient_retention_days: parseInt(opts.transientDays),
+    min_health_score: parseFloat(opts.minHealth),
+    dry_run: opts.dryRun ?? false
+  });
+  console.log(formatPruneReport(result, opts.dryRun ?? false));
+});
+var auditCmd = program.command("audit").description("View audit trail and rollback");
+auditCmd.command("show").description("Show audit trail for a memory").argument("<memory-id>", "Memory ID").action((memoryId) => {
+  const db = initDb();
+  const mem = findByPrefix(db, memoryId);
+  if (!mem) {
+    console.error(`Memory not found: ${memoryId}`);
+    process.exit(1);
+  }
+  const entries = getAuditTrail(db, mem.id);
+  console.log(formatAuditTrail(entries));
+});
+auditCmd.command("recent").description("Show recent audit entries").option("-n, --limit <n>", "Max entries", "50").action((opts) => {
+  const db = initDb();
+  const entries = getRecentAudit(db, parseInt(opts.limit));
+  console.log(formatAuditTrail(entries));
+});
+auditCmd.command("rollback").description("Rollback a memory to a previous state").argument("<memory-id>", "Memory ID").argument("<audit-entry-id>", "Audit entry ID to rollback to").option("--actor <name>", "Who performed rollback", "cli").action((memoryId, auditEntryId, opts) => {
+  const db = initDb();
+  const mem = findByPrefix(db, memoryId);
+  if (!mem) {
+    console.error(`Memory not found: ${memoryId}`);
+    process.exit(1);
+  }
+  const ok2 = rollbackMemory(db, mem.id, auditEntryId, opts.actor);
+  if (ok2) {
+    console.log(`Memory ${mem.id.slice(0, 8)} rolled back.`);
+  } else {
+    console.error("Rollback failed. Audit entry not found or no snapshot.");
+  }
+});
+program.command("quality").description("Show repo quality profile and dynamic thresholds").option("-r, --repo <repo>", "Repository name").action((opts) => {
+  const db = initDb();
+  const profile = getRepoQualityProfile(db, opts.repo);
+  console.log(`Stage:                  ${profile.stage}`);
+  console.log(`Quality score:          ${(profile.score * 100).toFixed(0)}%`);
+  console.log(`Active memories:        ${profile.active_count}`);
+  console.log(`Total memories:         ${profile.total_count}`);
+  console.log(`Avg health:             ${(profile.avg_health * 100).toFixed(0)}%`);
+  console.log(`Override rate:          ${(profile.override_rate * 100).toFixed(0)}%`);
+  console.log(`Contradiction rate:     ${(profile.contradiction_rate * 100).toFixed(0)}%`);
+  console.log(`---`);
+  console.log(`Repeat sessions needed: ${profile.repeat_sessions_required}`);
+  console.log(`Compile threshold:      ${profile.compile_confidence_threshold.toFixed(2)}`);
+  console.log(`Dedup similarity:       ${profile.dedup_similarity_threshold.toFixed(2)}`);
+});
+program.command("activity").description("List recent activity events").option("-r, --repo <repo>", "Filter by repo").option("-s, --session <id>", "Filter by session ID").option("--source <source>", "Filter by source: cli|daemon|mcp|system").option("--type <type>", "Filter by event type: compile|query|scan|correction|review|feedback|signal|session_start|session_event|session_end").option("--since <iso>", "Filter by created_at >= ISO timestamp").option("-n, --limit <n>", "Max events", "20").action((opts) => {
+  const db = initDb();
+  const events = listActivityEvents(db, {
+    repo: opts.repo,
+    session_id: opts.session,
+    source: opts.source,
+    event_type: opts.type,
+    since: opts.since,
+    limit: parseInt(opts.limit, 10)
+  });
+  if (events.length === 0) {
+    console.log("No activity found.");
+    return;
+  }
+  for (const event of events) {
+    console.log(
+      `${event.created_at}  ${event.source}/${event.event_type}  session:${event.session_id ?? "-"}  repo:${event.repo ?? "-"}  memories:${event.memory_ids.length}`
+    );
+  }
+  console.log(`
+${events.length} activity events total.`);
+});
+program.command("sessions").description("List recent activity sessions").option("-r, --repo <repo>", "Filter by repo").option("--source <source>", "Filter by source: cli|daemon|mcp|system").option("--type <type>", "Filter by event type: compile|query|scan|correction|review|feedback|signal|session_start|session_event|session_end").option("--since <iso>", "Filter by created_at >= ISO timestamp").option("-n, --limit <n>", "Max sessions", "20").action((opts) => {
+  const db = initDb();
+  const sessions = listActivitySessions(db, {
+    repo: opts.repo,
+    source: opts.source,
+    event_type: opts.type,
+    since: opts.since,
+    limit: parseInt(opts.limit, 10)
+  });
+  if (sessions.length === 0) {
+    console.log("No sessions found.");
+    return;
+  }
+  for (const session of sessions) {
+    console.log(
+      `${session.last_at}  ${session.session_id}  repo:${session.repo ?? "-"}  events:${session.event_count}  types:${session.event_types.join(",")}`
+    );
+  }
+  console.log(`
+${sessions.length} sessions total.`);
+});
+var defaultLabel = defaultServiceLabel();
+var daemonCmd = program.command("daemon").description("Manage the local Recall HTTP daemon (launchd on macOS, systemd --user on Linux)");
+daemonCmd.command("install").description("Install and start the user service").option("--port <port>", "Daemon port", "7890").option("--data-dir <dir>", "Recall data dir").option("--label <label>", "Service label", defaultLabel).option("--node-path <path>", "Node executable path override").option("--daemon-script <path>", "Daemon script path override").action((opts) => {
+  const status = installService({
+    label: opts.label,
+    port: parseInt(opts.port, 10),
+    dataDir: opts.dataDir,
+    nodePath: opts.nodePath,
+    daemonScript: opts.daemonScript
+  });
+  console.log(getServiceInfo(status.label));
+});
+daemonCmd.command("start").description("Start the installed service").option("--label <label>", "Service label", defaultLabel).action((opts) => {
+  const status = startService(opts.label);
+  console.log(getServiceInfo(status.label));
+});
+daemonCmd.command("stop").description("Stop the service").option("--label <label>", "Service label", defaultLabel).action((opts) => {
+  const status = stopService(opts.label);
+  console.log(getServiceInfo(status.label));
+});
+daemonCmd.command("restart").description("Restart the service").option("--label <label>", "Service label", defaultLabel).action((opts) => {
+  stopService(opts.label);
+  const status = startService(opts.label);
+  console.log(getServiceInfo(status.label));
+});
+daemonCmd.command("status").description("Show service status").option("--label <label>", "Service label", defaultLabel).action((opts) => {
+  console.log(getServiceInfo(opts.label));
+});
+daemonCmd.command("uninstall").description("Remove the service").option("--label <label>", "Service label", defaultLabel).action((opts) => {
+  const status = uninstallService(opts.label);
+  console.log(getServiceInfo(status.label));
+});
+var maintenanceCmd = program.command("maintenance").description("Inspect and manage the delegated maintenance task queue");
+maintenanceCmd.command("stats").description("Show backlog counts, completion stats, and mean latency").action(async () => {
+  const { getTaskStats } = await import("./tasks-UOLSPXJQ.js");
+  const db = initDb();
+  const stats = getTaskStats(db);
+  console.log(`Total tasks:            ${stats.total}`);
+  console.log(`---`);
+  console.log(`Pending:                ${stats.by_status.pending}`);
+  console.log(`Claimed:                ${stats.by_status.claimed}`);
+  console.log(`Completed:              ${stats.by_status.completed}`);
+  console.log(`Abandoned:              ${stats.by_status.abandoned}`);
+  console.log(`---`);
+  console.log(`Last 24h completed:     ${stats.completed_last_24h}`);
+  console.log(`Last 24h abandoned:     ${stats.abandoned_last_24h}`);
+  if (stats.mean_completion_ms != null) {
+    console.log(`Mean completion:        ${(stats.mean_completion_ms / 1e3).toFixed(1)}s`);
+  }
+  if (stats.pending_oldest_created_at) {
+    console.log(`Oldest pending:         ${stats.pending_oldest_created_at}`);
+  }
+  console.log(`---`);
+  console.log(`By kind:`);
+  for (const [kind, count] of Object.entries(stats.by_kind)) {
+    if (count === 0) continue;
+    console.log(`  ${kind.padEnd(22)} ${count}`);
+  }
+});
+maintenanceCmd.command("list").description("List tasks (default: pending)").option("-s, --status <status>", "pending|claimed|completed|abandoned", "pending").option("-k, --kind <kind>", "Filter by kind").option("-r, --repo <repo>", "Filter by repo").option("-n, --limit <n>", "Max entries", "20").action(async (opts) => {
+  const { listTasks } = await import("./tasks-UOLSPXJQ.js");
+  const db = initDb();
+  const tasks = listTasks(db, {
+    status: opts.status,
+    kinds: opts.kind ? [opts.kind] : void 0,
+    repo: opts.repo,
+    limit: parseInt(opts.limit, 10)
+  });
+  if (tasks.length === 0) {
+    console.log(`No ${opts.status} tasks.`);
+    return;
+  }
+  for (const t of tasks) {
+    const age = t.created_at.slice(0, 19);
+    const prefix = t.id.slice(0, 8);
+    const repo = t.repo ?? "-";
+    const attempts = t.attempts > 0 ? ` attempts=${t.attempts}` : "";
+    const reason = t.failure_reason ? ` (${t.failure_reason.slice(0, 60)})` : "";
+    console.log(`${prefix}  p${t.priority}  ${t.kind.padEnd(20)} ${t.status.padEnd(10)} ${repo.padEnd(30)} ${age}${attempts}${reason}`);
+  }
+});
+maintenanceCmd.command("drop").description("Delete a task by id (or id prefix)").argument("<task-id>", "Task id or prefix").action(async (taskIdArg) => {
+  const { deleteTask, listTasks } = await import("./tasks-UOLSPXJQ.js");
+  const db = initDb();
+  const all = listTasks(db, { limit: 1e4 });
+  const matches = all.filter((t) => t.id === taskIdArg || t.id.startsWith(taskIdArg));
+  if (matches.length === 0) {
+    console.error(`No task matching "${taskIdArg}".`);
+    process.exit(1);
+  }
+  if (matches.length > 1) {
+    console.error(`Ambiguous prefix "${taskIdArg}". Matches:`);
+    for (const t of matches) console.error(`  ${t.id}  ${t.kind}  ${t.status}`);
+    process.exit(1);
+  }
+  const ok2 = deleteTask(db, matches[0].id);
+  if (ok2) console.log(`Dropped task ${matches[0].id}.`);
+  else console.error("Drop failed.");
+});
+var credentialsCmd = maintenanceCmd.command("credentials").description("Manage LLM provider API keys in macOS Keychain (env fallback on other platforms)");
+credentialsCmd.command("list", { isDefault: true }).description("Show which providers have credentials available").action(async () => {
+  const { listCredentials } = await import("./keychain-5QG52ANO.js");
+  const creds = listCredentials();
+  if (creds.length === 0) {
+    console.log("No API keys configured. Set one with:");
+    console.log("  recall maintenance credentials set openai <key>");
+    console.log("  recall maintenance credentials set anthropic <key>");
+    return;
+  }
+  for (const cred of creds) {
+    const detail = cred.detail ? `  ${cred.detail}` : "";
+    console.log(`${cred.provider.padEnd(14)} ${cred.source.padEnd(8)} ${cred.preview}${detail}`);
+  }
+});
+credentialsCmd.command("set").description("Store credentials for an LLM provider in the macOS Keychain").argument("<provider>", "openai|anthropic|azure").argument("[key]", "API key (prompts via stdin if omitted; required for openai/anthropic and for azure unless --stdin-json is used)").option("--endpoint <url>", "Azure OpenAI resource endpoint (e.g. https://myresource.openai.azure.com)").option("--deployment <name>", "Azure OpenAI deployment name").option("--api-version <version>", "Azure OpenAI api-version (e.g. 2024-10-21)").option("--stdin-json", "Read the azure config (endpoint/deployment/api_version/key) as a JSON object from stdin").action(async (providerArg, keyArg, opts) => {
+  const { setApiKey, setAzureConfig } = await import("./keychain-5QG52ANO.js");
+  const provider = providerArg === "azure" ? "azure-openai" : providerArg;
+  if (provider === "openai" || provider === "anthropic") {
+    const key = keyArg ?? await readStdinKey();
+    if (!key) {
+      console.error("No API key provided (pass as argument or pipe via stdin).");
+      process.exit(1);
+    }
+    try {
+      setApiKey(provider, key);
+      console.log(`Stored ${provider} API key in Keychain (service com.recall.llm).`);
+    } catch (err) {
+      console.error(`Failed to store key: ${err.message}`);
+      process.exit(1);
+    }
+    return;
+  }
+  if (provider === "azure-openai") {
+    let azureConfig;
+    if (opts.stdinJson) {
+      const body = await readStdinText();
+      if (!body) {
+        console.error("No JSON payload received on stdin.");
+        process.exit(1);
+      }
+      try {
+        azureConfig = JSON.parse(body);
+      } catch (err) {
+        console.error(`Failed to parse stdin JSON: ${err.message}`);
+        process.exit(1);
+      }
+    } else {
+      const key = keyArg ?? await readStdinKey();
+      if (!opts.endpoint || !opts.deployment || !opts.apiVersion || !key) {
+        console.error(
+          "Azure setup requires --endpoint, --deployment, --api-version, and a key.\nExample: recall maintenance credentials set azure \\\n  --endpoint https://myresource.openai.azure.com \\\n  --deployment gpt-4o-mini \\\n  --api-version 2024-10-21 \\\n  <key>"
+        );
+        process.exit(1);
+      }
+      azureConfig = {
+        endpoint: opts.endpoint,
+        deployment: opts.deployment,
+        api_version: opts.apiVersion,
+        key
+      };
+    }
+    try {
+      setAzureConfig(azureConfig);
+      console.log(`Stored azure-openai config in Keychain (service com.recall.llm).`);
+      console.log(`  endpoint:    ${azureConfig.endpoint}`);
+      console.log(`  deployment:  ${azureConfig.deployment}`);
+      console.log(`  api_version: ${azureConfig.api_version}`);
+    } catch (err) {
+      console.error(`Failed to store azure config: ${err.message}`);
+      process.exit(1);
+    }
+    return;
+  }
+  console.error(`Provider must be "openai", "anthropic", or "azure", got "${providerArg}".`);
+  process.exit(1);
+});
+credentialsCmd.command("clear").description("Remove provider credentials from the macOS Keychain").argument("<provider>", "openai|anthropic|azure").action(async (providerArg) => {
+  const { deleteApiKey } = await import("./keychain-5QG52ANO.js");
+  const provider = providerArg === "azure" ? "azure-openai" : providerArg;
+  if (provider !== "openai" && provider !== "anthropic" && provider !== "azure-openai") {
+    console.error(`Provider must be "openai", "anthropic", or "azure", got "${providerArg}".`);
+    process.exit(1);
+  }
+  const removed = deleteApiKey(provider);
+  if (removed) console.log(`Removed ${provider} credentials from Keychain.`);
+  else console.log(`No ${provider} credentials found in Keychain.`);
+});
+maintenanceCmd.command("dispatch").description("Run the daemon-owned dispatcher once against pending maintenance tasks (requires a configured LLM provider)").option("--provider <provider>", "openai|anthropic|azure-openai (defaults to whichever is configured)").option("--model <model>", "Model override").option("--kind <kind>", "Restrict to a single task kind (repeatable)", (value, acc = []) => [...acc, value], []).option("--repo <repo>", "Restrict to a single repo").option("--max <n>", "Max tasks to run this round", "5").option("--dry-run", "Show which tasks would be dispatched; do not call the LLM").option("--preview", "Show the actual prompts that would be sent (no provider needed; no LLM call)").option("--json", "Emit the raw JSON report").action(async (opts) => {
+  const { dispatchPendingTasks, formatDispatchReport, buildPrompt } = await import("./dispatcher-UGMU6THT.js");
+  const { listTasks } = await import("./tasks-UOLSPXJQ.js");
+  const db = initDb();
+  if (opts.preview) {
+    const pending = listTasks(db, {
+      status: "pending",
+      kinds: opts.kind.length > 0 ? opts.kind : void 0,
+      repo: opts.repo,
+      limit: parseInt(opts.max, 10)
+    });
+    const previews = pending.map((task) => ({
+      task_id: task.id,
+      kind: task.kind,
+      repo: task.repo,
+      prompt: buildPrompt(task)
+    }));
+    if (opts.json) {
+      console.log(JSON.stringify(previews, null, 2));
+      return;
+    }
+    if (previews.length === 0) {
+      console.log("No pending tasks to preview.");
+      return;
+    }
+    for (const p of previews) {
+      console.log(`# ${p.task_id.slice(0, 8)}  ${p.kind}  ${p.repo ?? "-"}`);
+      if (!p.prompt) {
+        console.log("  (no prompt builder for this kind)\n");
+        continue;
+      }
+      console.log(`## system
+${p.prompt.system}
+`);
+      console.log(`## user
+${p.prompt.user}
+`);
+      if (p.prompt.max_output_tokens) console.log(`## max_output_tokens
+${p.prompt.max_output_tokens}
+`);
+      console.log("---");
+    }
+    return;
+  }
+  const report = await dispatchPendingTasks(db, {
+    provider: opts.provider,
+    model: opts.model,
+    kinds: opts.kind.length > 0 ? opts.kind : void 0,
+    repo: opts.repo,
+    maxTasks: parseInt(opts.max, 10),
+    dryRun: Boolean(opts.dryRun)
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  console.log(formatDispatchReport(report));
+});
+maintenanceCmd.command("cleanup").description("Run deterministic, LLM-free cleanup: exact-text dedupe, fragment rejection, repeat-correction promotion").option("--apply", "Persist changes (default is dry-run)").option("--only <action>", "Restrict to one action: dedupe_exact_merge|reject_fragment_candidate|promote_repeat_correction").option("--revert <run-id>", "Revert a previous cleanup run (id or 8-char prefix)").option("--list", "List recent cleanup runs").option("--json", "Emit the raw JSON report").action(async (opts) => {
+  const { runDeterministicCleanup, formatCleanupReport, revertCleanupRun, listCleanupRuns } = await import("./cleanup-TVOX2S2S.js");
+  const db = initDb();
+  if (opts.list) {
+    const runs = listCleanupRuns(db);
+    if (opts.json) {
+      console.log(JSON.stringify(runs, null, 2));
+      return;
+    }
+    if (runs.length === 0) {
+      console.log("No cleanup runs recorded.");
+      return;
+    }
+    for (const r of runs) {
+      const flag = r.reverted === r.total && r.total > 0 ? " [reverted]" : r.reverted > 0 ? ` [partial-revert ${r.reverted}/${r.total}]` : "";
+      const actions = Object.entries(r.by_action).map(([k, v]) => `${k}=${v}`).join(" ");
+      console.log(`${r.run_id.slice(0, 8)}  ${r.finished_at.slice(0, 19)}  total=${r.total}  ${actions}${flag}`);
+    }
+    return;
+  }
+  if (opts.revert) {
+    const all = listCleanupRuns(db, 1e4);
+    const match = all.find((r) => r.run_id === opts.revert || r.run_id.startsWith(opts.revert));
+    if (!match) {
+      console.error(`No cleanup run matching "${opts.revert}".`);
+      process.exit(1);
+    }
+    const result = revertCleanupRun(db, match.run_id);
+    if (opts.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    console.log(`Reverted ${result.reverted} entries from run ${result.run_id.slice(0, 8)}; skipped ${result.skipped}.`);
+    for (const [reason, count] of Object.entries(result.reasons)) {
+      console.log(`  ${reason}: ${count}`);
+    }
+    return;
+  }
+  const report = runDeterministicCleanup(db, {
+    dryRun: !opts.apply,
+    only: opts.only
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  console.log(formatCleanupReport(report));
+});
+maintenanceCmd.command("quality").description("Show injection outcome distribution and followed-rate over a window").option("--since <iso>", "Window start (default: last 14 days)").option("--snapshot", "Persist this report as a baseline for later comparison").option("--note <text>", "Optional note attached to a snapshot").option("--history", "List recent snapshots and the diff against the latest one").option("--json", "Emit raw JSON").action(async (opts) => {
+  const {
+    computeQualityReport,
+    formatQualityReport,
+    recordQualitySnapshot,
+    listQualitySnapshots,
+    diffQualitySnapshots
+  } = await import("./quality-Z7LPMMBC.js");
+  const db = initDb();
+  if (opts.history) {
+    const snaps = listQualitySnapshots(db);
+    if (opts.json) {
+      console.log(JSON.stringify(snaps, null, 2));
+      return;
+    }
+    if (snaps.length === 0) {
+      console.log("No quality snapshots recorded.");
+      return;
+    }
+    for (const s of snaps) {
+      const rate = s.followed_rate_resolved != null ? `${(s.followed_rate_resolved * 100).toFixed(1)}%` : "n/a";
+      console.log(`${s.taken_at.slice(0, 19)}  followed=${rate}  resolved=${s.injections_resolved}  history=${s.history_injections_total}  rules=${s.active_rule_count}  cand=${s.candidate_correction_count}${s.notes ? `  (${s.notes})` : ""}`);
+    }
+    if (snaps.length >= 2) {
+      const diff = diffQualitySnapshots(snaps[snaps.length - 1], snaps[0]);
+      console.log("");
+      console.log(`\u0394 since first snapshot (${diff.days_apart.toFixed(1)}d):`);
+      console.log(`  followed rate:   ${diff.followed_rate_delta_pp >= 0 ? "+" : ""}${diff.followed_rate_delta_pp.toFixed(1)}pp`);
+      console.log(`  resolved:        ${diff.resolved_delta >= 0 ? "+" : ""}${diff.resolved_delta}`);
+      console.log(`  followed:        ${diff.followed_delta >= 0 ? "+" : ""}${diff.followed_delta}`);
+      console.log(`  contradicted:    ${diff.contradicted_delta >= 0 ? "+" : ""}${diff.contradicted_delta}`);
+      console.log(`  active rules:    ${diff.active_rule_delta >= 0 ? "+" : ""}${diff.active_rule_delta}`);
+      console.log(`  candidates:      ${diff.candidate_delta >= 0 ? "+" : ""}${diff.candidate_delta}`);
+      console.log(`  history injects: ${diff.history_injections_delta >= 0 ? "+" : ""}${diff.history_injections_delta}`);
+      console.log(`  history snippets:${diff.history_snippets_delta >= 0 ? "+" : ""}${diff.history_snippets_delta}`);
+    }
+    return;
+  }
+  const report = computeQualityReport(db, { sinceIso: opts.since });
+  if (opts.snapshot) {
+    const row = recordQualitySnapshot(db, report, opts.note);
+    if (opts.json) {
+      console.log(JSON.stringify({ snapshot: row, report }, null, 2));
+      return;
+    }
+    console.log(formatQualityReport(report));
+    console.log("");
+    console.log(`Recorded snapshot ${row.id.slice(0, 8)} at ${row.taken_at.slice(0, 19)}`);
+    return;
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  console.log(formatQualityReport(report));
+});
+maintenanceCmd.command("usage").description("Summarize LLM API usage (tokens, cost) across recent maintenance runs").option("--since <iso>", "Window start (default: last 30 days)").option("--limit <n>", "Recent-call rows to show", "10").option("--json", "Emit raw JSON summary").action(async (opts) => {
+  const { summarizeUsage, formatUsageReport } = await import("./usage-CY3V72YN.js");
+  const db = initDb();
+  const summary = summarizeUsage(db, {
+    sinceIso: opts.since,
+    recentLimit: parseInt(opts.limit, 10)
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(summary, null, 2));
+    return;
+  }
+  console.log(formatUsageReport(summary));
+});
+async function readStdinKey() {
+  const raw = await readStdinText();
+  if (!raw) return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+async function readStdinText() {
+  if (process.stdin.isTTY) return null;
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  const text = Buffer.concat(chunks).toString("utf-8");
+  return text.length > 0 ? text : null;
+}
+function loadSyncConfig() {
+  const url = process.env.RECALL_SYNC_URL;
+  const key = process.env.RECALL_SYNC_KEY;
+  if (!url || !key) return null;
+  return {
+    remote_url: url,
+    api_key: key,
+    team_id: process.env.RECALL_TEAM_ID,
+    auto_sync: false,
+    sync_interval_seconds: 300
+  };
+}
+function formatSetupStep(step) {
+  if (!step.enabled) return `skipped (${step.message})`;
+  return step.ok ? `ok (${step.message})` : `error (${step.message})`;
+}
+function formatAgentName(agent) {
+  return agent === "claude-code" ? "Claude Code" : "Codex";
+}
+function collectAgents(value, previous) {
+  return [...previous, value];
+}
+async function confirmSetupWrite(scope) {
+  const { createInterface } = await import("readline/promises");
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    const answer = await rl.question(`Update ${scope} agent config files for Recall? [y/N] `);
+    return /^(y|yes)$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+function findByPrefix(db, prefix) {
+  const exact = getMemory(db, prefix);
+  if (exact) return exact;
+  const all = listMemories(db);
+  const matches = all.filter((m) => m.id.startsWith(prefix));
+  if (matches.length === 1) return matches[0];
+  if (matches.length > 1) {
+    console.error(`Ambiguous prefix "${prefix}". Matches:`);
+    for (const m of matches) console.error(`  ${m.id}`);
+    process.exit(1);
+  }
+  return void 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await program.parseAsync(process.argv);
+}
+export {
+  program
+};
+//# sourceMappingURL=cli.js.map