@harnessforce/cli 0.1.0 → 0.2.0

package/dist/bin.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import { constants, homedir, tmpdir } from "node:os";
-import { createInterface } from "node:readline/promises";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { basename, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -10,7 +9,7 @@ import { execFile, spawn } from "node:child_process";
 import { constants as constants$1, createReadStream } from "node:fs";
 import { createServer } from "node:http";
 import { ATTR, INTERVENTION_KINDS, LOOP_KINDS, PROPOSAL_KINDS, isToken, normalizeRepository } from "@harnessforce/semconv";
-import { createInterface as createInterface$1 } from "node:readline";
+import { createInterface } from "node:readline";
 import { isDeepStrictEqual } from "node:util";
 //#region ../agent-core/src/config/canonical.ts
 const byCodeUnit$1 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -414,7 +413,54 @@ function takeStashedRuntimeEnv(env, platform) {
 	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string" && isRuntimeVariable(entry[0], platform)));
 }
 //#endregion
+//#region src/shared/messages.ts
+const INIT_MESSAGES = {
+	success: "Connected to Harnessforce. Restart Claude Code to apply the settings",
+	pluginAutoUpdateOn: "Automatic updates for the Harnessforce plugin are on. To turn them off, run `harnessforce init --no-plugin-auto-update` or use /plugin",
+	invalidUrl: "The connection URL is invalid",
+	keychainUnavailable: "The OS keychain is unavailable, so the ingest key cannot be saved",
+	linuxKeychainUnavailable: "Neither the Secret Service (GNOME Keyring or KWallet) nor the kernel keyring is available. In containers and CI, ask an Owner or Admin to distribute a Workspace ingest key through managed settings",
+	waitingForSecretService: "Waiting for the Secret Service unlock prompt (up to 60 seconds)",
+	savedToKernelKeyring: "The Secret Service is unavailable, so the ingest key was saved in the kernel keyring. It is lost on reboot or after a period of disuse. If it disappears, run `harnessforce init` again",
+	tooManyKeys: "There are too many ingest keys in the keychain, so `harnessforce init` cannot run",
+	tooManyCredentials: "There are too many ingest keys or login entries in the keychain, so `harnessforce init` cannot run",
+	settingsUnreadable: "Cannot read the Claude Code user settings",
+	network: "Communication with Harnessforce failed. Run `harnessforce init` again",
+	listenFailed: "Could not start waiting for the login",
+	timeout: "The login did not complete in time. Run `harnessforce init` again",
+	accessDenied: "The login was denied",
+	noWorkspace: "You are not a member of any Workspace. Create a Workspace or accept an invitation, then run `harnessforce init` again",
+	loginFailed: "The login failed. Run `harnessforce init` again",
+	viewer: "The view-only role cannot issue an ingest key. Contact a Workspace administrator",
+	limitOwnerAdmin: "The number of active ingest keys has reached the limit. Revoke unused keys on the ingest keys page",
+	limitMember: "The ingest key limit has been reached. Contact a Workspace administrator",
+	gateUnavailable: "Could not apply the change on the receiving side. Nothing was changed. Try again",
+	ingestUnavailable: "This environment does not receive telemetry, so an ingest key cannot be issued",
+	saveFailed: "Could not save the ingest key. Run `harnessforce init` again",
+	codexSaveFailed: "Could not write the Codex configuration. Run `harnessforce init` again",
+	contentEnabled: "Sending the prompts you type is now enabled. Values that match known patterns for secrets and personal information are masked, but not everything can be detected. Within the workspace, only you can read your stored content, and it is deleted after the content retention period (at most 30 days)",
+	contentNotOptedIn: "This workspace has not opted in to prompts you typed, so sending content was not enabled. Opt in under Data retention in the workspace settings, then run `harnessforce init --send-content` again"
+};
+const codexNotes = (configPath) => [
+	`Wrote the Codex configuration (${configPath}). Restart Codex to apply it`,
+	"Codex hooks do not run until you trust them in Codex's /hooks. Trust the harnessforce SessionStart hook in /hooks",
+	"To use the Harnessforce MCP server, log in with `codex mcp login harnessforce`"
+].join("\n");
+const nonDefaultConnectionMessage = (url) => `Connecting to ${url} (not the default production endpoint)`;
+const listenFailedMessage = (port) => `${INIT_MESSAGES.listenFailed}. Stop the process using port ${port}, or specify another port with \`harnessforce init --port\``;
+const keychainUnavailableMessage = (keychain, message = INIT_MESSAGES.keychainUnavailable) => keychain.unavailableHint ? `${message}. ${keychain.unavailableHint}` : message;
+//#endregion
 //#region src/credentials/keychain.ts
+async function openSingleStore(store) {
+	if (!await store.isAvailable()) return void 0;
+	return {
+		isKernelKeyring: false,
+		items: await store.list(),
+		set: (account, secret) => store.set(account, secret),
+		delete: (account) => store.delete(account),
+		deleteElsewhere: async () => {}
+	};
+}
 const KEYCHAIN_SERVICE = "harnessforce";
 const INGEST_KEY_SUFFIX = ":ingest-key";
 const API_TOKEN_SUFFIX = ":api-token";
@@ -422,27 +468,200 @@ const ingestKeyAccount = (workspaceId) => `${workspaceId}${INGEST_KEY_SUFFIX}`;
 const apiTokenAccount = (workspaceId) => `${workspaceId}${API_TOKEN_SUFFIX}`;
 const ingestOriginAccount = (workspaceId) => `${workspaceId}:ingest-origin`;
 const urlOriginAccount = (workspaceId) => `${workspaceId}:url-origin`;
+const workspaceAccounts = (workspaceId) => [
+	ingestKeyAccount(workspaceId),
+	apiTokenAccount(workspaceId),
+	ingestOriginAccount(workspaceId),
+	urlOriginAccount(workspaceId)
+];
 const isIngestKeyAccount = (account) => account.endsWith(INGEST_KEY_SUFFIX);
 const apiTokenWorkspaceId = (account) => account.endsWith(API_TOKEN_SUFFIX) ? account.slice(0, -10) : void 0;
 //#endregion
+//#region src/credentials/linux-keychain.ts
+const SECRET_SERVICE_TIMEOUT_MS = 6e4;
+const WAITING_NOTICE_DELAY_MS = 2e3;
+const PROBE_ACCOUNT$1 = "availability-probe";
+const PROBE_VALUE = "harnessforce";
+const MIGRATION_PROBE_TIMEOUT_MS = 200;
+const MIGRATION_BUDGET_MS = 1e3;
+const CLEANUP_TIMEOUT_MS = 200;
+const succeeds = (operation) => operation().then(() => true, () => false);
+const workspaceOf = (account) => account.slice(0, account.lastIndexOf(":"));
+function createLinuxKeychain(options) {
+	return build(options, SECRET_SERVICE_TIMEOUT_MS);
+}
+function build(options, timeoutMs) {
+	const { kernel, secretService } = options;
+	const locations = /* @__PURE__ */ new Map();
+	const locate = (workspaceId) => {
+		let located = locations.get(workspaceId);
+		if (!located) {
+			located = kernel.get(ingestKeyAccount(workspaceId), timeoutMs).then((key) => ({
+				location: key ? "kernel" : "secret-service",
+				isKernelBroken: false
+			}), () => ({
+				location: "secret-service",
+				isKernelBroken: true
+			}));
+			locations.set(workspaceId, located);
+		}
+		return located;
+	};
+	const storeAt = (location) => location === "kernel" ? kernel : secretService;
+	return {
+		unavailableHint: options.unavailableHint,
+		async isAvailable() {
+			return await succeeds(() => kernel.get(PROBE_ACCOUNT$1, timeoutMs)) || await succeeds(() => secretService.get(PROBE_ACCOUNT$1, timeoutMs));
+		},
+		async get(account) {
+			const { location, isKernelBroken } = await locate(workspaceOf(account));
+			if (location === "kernel") return kernel.get(account, timeoutMs);
+			try {
+				return await secretService.get(account, timeoutMs);
+			} catch (error) {
+				if (isKernelBroken) throw error;
+				return;
+			}
+		},
+		async set(account, secret) {
+			const { location } = await locate(workspaceOf(account));
+			await storeAt(location).set(account, secret, timeoutMs);
+		},
+		async delete(account) {
+			const { location } = await locate(workspaceOf(account));
+			await storeAt(location).delete(account, timeoutMs);
+		},
+		async migrateFromKernel(workspaceId) {
+			const { location } = await locate(workspaceId);
+			if (location !== "kernel") return;
+			await migrate(options, workspaceId).catch(() => {});
+		},
+		withTimeout: (ms) => build(options, ms),
+		openForInit: (init) => openForInit(options, timeoutMs, init)
+	};
+}
+async function openForInit({ kernel, secretService }, timeoutMs, { previousWorkspaceId, onWaiting }) {
+	const canWrite = (store) => succeeds(async () => {
+		await store.set(PROBE_ACCOUNT$1, PROBE_VALUE, timeoutMs);
+		await store.delete(PROBE_ACCOUNT$1, timeoutMs);
+	});
+	const notice = setTimeout(onWaiting, WAITING_NOTICE_DELAY_MS);
+	const usesSecretService = await canWrite(secretService).finally(() => clearTimeout(notice));
+	const readKernel = async () => {
+		if (!previousWorkspaceId) return [];
+		const accounts = [ingestKeyAccount(previousWorkspaceId), apiTokenAccount(previousWorkspaceId)];
+		const items = [];
+		for (const account of accounts) {
+			const secret = await kernel.get(account, timeoutMs);
+			if (secret !== void 0) items.push({
+				account,
+				secret
+			});
+		}
+		return items;
+	};
+	if (usesSecretService) return {
+		isKernelKeyring: false,
+		items: [...await secretService.list(timeoutMs), ...await readKernel().catch(() => [])],
+		set: (account, secret) => secretService.set(account, secret, timeoutMs),
+		delete: (account) => secretService.delete(account, timeoutMs),
+		async deleteElsewhere(workspaceId) {
+			for (const account of workspaceAccounts(workspaceId)) await kernel.delete(account, timeoutMs).catch(() => {});
+		}
+	};
+	if (!await canWrite(kernel)) return void 0;
+	return {
+		isKernelKeyring: true,
+		items: await readKernel(),
+		set: (account, secret) => kernel.set(account, secret, timeoutMs),
+		delete: (account) => kernel.delete(account, timeoutMs),
+		deleteElsewhere: async () => {}
+	};
+}
+var MigrationExpired = class extends Error {};
+const MIGRATION_ORDER = (workspaceId) => [
+	ingestOriginAccount(workspaceId),
+	urlOriginAccount(workspaceId),
+	apiTokenAccount(workspaceId),
+	ingestKeyAccount(workspaceId)
+];
+async function migrate({ kernel, secretService }, workspaceId) {
+	let isExpired = false;
+	const deadline = Date.now() + MIGRATION_BUDGET_MS;
+	const remaining = () => {
+		if (isExpired) throw new MigrationExpired();
+		return Math.max(deadline - Date.now(), 1);
+	};
+	const written = [];
+	let isVerified = false;
+	const move = async () => {
+		await secretService.get(PROBE_ACCOUNT$1, MIGRATION_PROBE_TIMEOUT_MS);
+		const items = [];
+		for (const account of MIGRATION_ORDER(workspaceId)) {
+			const secret = await kernel.get(account, remaining());
+			if (secret !== void 0) items.push({
+				account,
+				secret
+			});
+		}
+		for (const account of workspaceAccounts(workspaceId)) await secretService.delete(account, remaining());
+		for (const { account, secret } of items) {
+			written.push(account);
+			await secretService.set(account, secret, remaining());
+		}
+		for (const { account, secret } of items) if (await secretService.get(account, remaining()) !== secret) throw new Error("the Secret Service returned a different value");
+		remaining();
+		isVerified = true;
+		for (const { account } of [...items].reverse()) await kernel.delete(account, remaining());
+	};
+	let timer;
+	const expiry = new Promise((_, reject) => {
+		timer = setTimeout(() => {
+			isExpired = true;
+			reject(new MigrationExpired());
+		}, MIGRATION_BUDGET_MS);
+	});
+	try {
+		await Promise.race([move(), expiry]);
+	} catch (error) {
+		if (isVerified) throw error;
+		await Promise.allSettled(written.map((account) => secretService.delete(account, CLEANUP_TIMEOUT_MS)));
+		throw error;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+//#endregion
 //#region src/credentials/os-keychain.ts
-const SUPPORTED_PLATFORMS = /* @__PURE__ */ new Set([
-	"darwin",
-	"linux",
-	"win32"
-]);
-const ENTRY_OPTIONS = { linux: { store: "secret-service" } };
 const PROBE_ACCOUNT = "availability-probe";
-function createOsKeychain({ platform, load }) {
+function createOsKeychain({ platform, load, secretService }) {
 	let loaded;
 	const keyring = () => {
 		loaded ??= load();
 		return loaded;
 	};
-	const entry = async (account) => new (await (keyring())).Entry(KEYCHAIN_SERVICE, account, ENTRY_OPTIONS);
+	if (platform === "linux") return createLinuxKeychain({
+		kernel: kernelKeyring(keyring),
+		secretService,
+		unavailableHint: INIT_MESSAGES.linuxKeychainUnavailable
+	});
+	if (platform === "darwin" || platform === "win32") return singleStore(keyring);
+	return unsupported;
+}
+function kernelKeyring(keyring) {
+	const entry = async (account) => new (await (keyring())).Entry(KEYCHAIN_SERVICE, account, { linux: { store: "keyutils" } });
 	return {
+		get: async (account) => (await entry(account)).getPassword() ?? void 0,
+		set: async (account, secret) => (await entry(account)).setPassword(secret),
+		delete: async (account) => {
+			(await entry(account)).deleteCredential();
+		}
+	};
+}
+function singleStore(keyring) {
+	const entry = async (account) => new (await (keyring())).Entry(KEYCHAIN_SERVICE, account);
+	const keychain = {
 		async isAvailable() {
-			if (!SUPPORTED_PLATFORMS.has(platform)) return false;
 			try {
 				(await entry(PROBE_ACCOUNT)).getPassword();
 				return true;
@@ -450,17 +669,121 @@ function createOsKeychain({ platform, load }) {
 				return false;
 			}
 		},
-		async get(account) {
-			return (await entry(account)).getPassword() ?? void 0;
+		get: async (account) => (await entry(account)).getPassword() ?? void 0,
+		set: async (account, secret) => (await entry(account)).setPassword(secret),
+		delete: async (account) => {
+			(await entry(account)).deleteCredential();
 		},
-		async set(account, secret) {
-			(await entry(account)).setPassword(secret);
+		withTimeout: (ms) => limitedSingleStore(keychain, keyring, ms),
+		openForInit: () => openSingleStore({
+			...keychain,
+			list: async () => (await keyring()).findCredentials(KEYCHAIN_SERVICE).map(({ account, password }) => ({
+				account,
+				secret: password
+			}))
+		})
+	};
+	return keychain;
+}
+function limitedSingleStore(base, keyring, ms) {
+	const within = (operation) => async (account) => {
+		const entry = new (await (keyring())).AsyncEntry(KEYCHAIN_SERVICE, account);
+		let timer;
+		const timeout = new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("keychain timed out")), ms);
+		});
+		return Promise.race([operation(entry), timeout]).finally(() => clearTimeout(timer));
+	};
+	return {
+		...base,
+		get: async (account) => await within((entry) => entry.getPassword())(account) ?? void 0,
+		set: (account, secret) => within((entry) => entry.setPassword(secret))(account),
+		delete: async (account) => {
+			await within((entry) => entry.deleteCredential())(account);
+		}
+	};
+}
+const unsupportedError = async () => {
+	throw new Error("no keychain on this platform");
+};
+const unsupported = {
+	isAvailable: async () => false,
+	get: unsupportedError,
+	set: unsupportedError,
+	delete: unsupportedError,
+	withTimeout: () => unsupported,
+	openForInit: async () => void 0
+};
+//#endregion
+//#region src/credentials/secret-service-process.ts
+const CHILD_SCRIPT = `
+const [op, service, account, timeoutMs, modulePath] = process.argv.slice(1);
+setTimeout(() => process.kill(process.pid, "SIGKILL"), Number(timeoutMs));
+const chunks = [];
+process.stdin.on("data", (chunk) => chunks.push(chunk));
+process.stdin.on("end", async () => {
+	try {
+		const keyring = require(modulePath);
+		const options = { linux: { store: "secret-service" } };
+		let result = null;
+		if (op === "list") {
+			result = await keyring.findCredentialsAsync(service);
+		} else {
+			const entry = new keyring.AsyncEntry(service, account, options);
+			if (op === "get") result = (await entry.getPassword()) ?? null;
+			if (op === "set") await entry.setPassword(Buffer.concat(chunks).toString("utf8"));
+			if (op === "delete") await entry.deleteCredential();
+		}
+		process.stdout.write(JSON.stringify({ result }), () => process.exit(0));
+	} catch {
+		process.exit(1);
+	}
+});
+`;
+function createSecretServiceProcess({ execPath, resolveKeyring }) {
+	const run = (op, account, timeoutMs, input = "") => new Promise((resolve, reject) => {
+		const child = spawn(execPath, [
+			"-e",
+			CHILD_SCRIPT,
+			op,
+			KEYCHAIN_SERVICE,
+			account,
+			String(timeoutMs),
+			resolveKeyring()
+		], { stdio: [
+			"pipe",
+			"pipe",
+			"ignore"
+		] });
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		const chunks = [];
+		child.stdout.on("data", (chunk) => chunks.push(chunk));
+		child.on("error", reject);
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			if (code !== 0) return reject(/* @__PURE__ */ new Error(`Secret Service ${op} failed`));
+			try {
+				resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")).result);
+			} catch (error) {
+				reject(error);
+			}
+		});
+		child.stdin.on("error", () => {});
+		child.stdin.end(input);
+	});
+	return {
+		async get(account, timeoutMs) {
+			const secret = await run("get", account, timeoutMs);
+			return typeof secret === "string" ? secret : void 0;
 		},
-		async delete(account) {
-			(await entry(account)).deleteCredential();
+		async set(account, secret, timeoutMs) {
+			await run("set", account, timeoutMs, secret);
+		},
+		async delete(account, timeoutMs) {
+			await run("delete", account, timeoutMs);
 		},
-		async list() {
-			return (await keyring()).findCredentials(KEYCHAIN_SERVICE).map(({ account, password }) => ({
+		async list(timeoutMs) {
+			return (await run("list", "", timeoutMs)).map(({ account, password }) => ({
 				account,
 				secret: password
 			}));
@@ -519,9 +842,9 @@ async function openBrowser(url, { platform, env, cwd, restoredEnv, spawn: spawnI
 //#region src/init/loopback.ts
 const HOST = "127.0.0.1";
 const CALLBACK_PATH = "/callback";
-const page = (message) => `<!doctype html><html lang="ja"><meta charset="utf-8"><title>Harnessforce</title><p>${message}</p></html>`;
-const SUCCESS_PAGE = page("ターミナルに戻ってください");
-const FAILURE_PAGE = page("ログインに失敗しました。ターミナルを確認してください");
+const page = (message) => `<!doctype html><html lang="en"><meta charset="utf-8"><title>Harnessforce</title><p>${message}</p></html>`;
+const SUCCESS_PAGE = page("Return to the terminal");
+const FAILURE_PAGE = page("The login failed. Check the terminal");
 async function startLoopback(options) {
 	let settle = () => {};
 	const callback = new Promise((resolve) => {
@@ -569,11 +892,6 @@ async function startLoopback(options) {
 	};
 }
 //#endregion
-//#region ../agent-core/src/hook-warning.ts
-const RESTART_FAILED_WARNING = "Harnessforceのhookを起動し直せませんでした";
-const INVALID_ENDPOINT_WARNING = "Harnessforceの送信先が不正です。`harnessforce init`を実行し直してください";
-const notConfiguredWarning = (agent) => agent === "claude_code" ? "Harnessforceの送信が設定されていません。`/harnessforce:setup`を実行してください" : "Harnessforceの送信が設定されていません。`harnessforce init`を実行してください";
-//#endregion
 //#region ../agent-core/src/url.ts
 const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"localhost",
@@ -597,8 +915,168 @@ function underBase(base, path) {
 }
 const withoutExtras = (url) => `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
 //#endregion
+//#region ../agent-core/src/client-update.ts
+const CLIENT_UPDATE_HEADER = "harnessforce-client-update";
+const UPDATE_COMMANDS = {
+	cli: "npm install -g @harnessforce/cli@latest",
+	"claude-code-plugin": "claude plugin update harnessforce@harnessforce-agent"
+};
+const DISPLAY_NAMES = {
+	cli: "CLI",
+	"claude-code-plugin": "plugin"
+};
+const DAY_MS$2 = 864e5;
+const RECHECK_TIMEOUT_MS = 2e3;
+const userAgentOf = (client) => `harnessforce-${client.component}${client.dev ? "-dev" : ""}/${client.version}`;
+const STATUSES = /* @__PURE__ */ new Set([
+	"current",
+	"outdated",
+	"deprecated",
+	"unsupported"
+]);
+const REASONS = /* @__PURE__ */ new Set(["security", "compatibility"]);
+function parseClientUpdateHeader(value) {
+	if (!value) return void 0;
+	const members = /* @__PURE__ */ new Map();
+	for (const member of value.split(",")) {
+		const [key, raw] = member.trim().split("=", 2);
+		if (key && raw !== void 0) members.set(key, raw);
+	}
+	const status = members.get("status");
+	if (!status || !STATUSES.has(status)) return void 0;
+	const update = { status };
+	const latest = /^"([^"\\]*)"$/.exec(members.get("latest") ?? "")?.[1];
+	if (latest) update.latest = latest;
+	const reason = members.get("reason");
+	if (reason && REASONS.has(reason)) update.reason = reason;
+	const seconds = /^@(\d+)$/.exec(members.get("deadline") ?? "")?.[1];
+	if (seconds) update.deadline = (/* @__PURE__ */ new Date(Number(seconds) * 1e3)).toISOString();
+	return isComplete(update) ? update : void 0;
+}
+function isComplete(update) {
+	switch (update.status) {
+		case "outdated": return Boolean(update.latest);
+		case "deprecated": return Boolean(update.reason) && !Number.isNaN(Date.parse(update.deadline ?? ""));
+		case "unsupported": return Boolean(update.reason);
+		default: return true;
+	}
+}
+function stateFrom(value, version) {
+	if (!isObject(value) || value.version !== version) return void 0;
+	if (typeof value.receivedAt !== "string") return void 0;
+	if (typeof value.status !== "string" || !STATUSES.has(value.status)) return void 0;
+	const state = value;
+	return isComplete(state) ? state : void 0;
+}
+async function readUpdateState(path, version) {
+	const saved = await readSavedUpdateState(path);
+	return saved?.version === version ? saved : void 0;
+}
+async function readSavedUpdateState(path) {
+	try {
+		const value = JSON.parse(await readFile(path, "utf8"));
+		return isObject(value) && typeof value.version === "string" ? stateFrom(value, value.version) : void 0;
+	} catch {
+		return;
+	}
+}
+async function writeUpdateState(path, state) {
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	await writeFile(temporary, `${JSON.stringify(state)}\n`, { mode: 384 });
+	await rename(temporary, path);
+}
+/**
+* Harnessforceへの要求に`User-Agent`を付け、応答の`Harnessforce-Client-Update`を状態のfileへ保存するfetch。
+* 保存に失敗しても要求の結果は変えない。statePathが無い（pluginのdata directoryが無い）場合は版の申告だけを行う。
+*/
+function recordingFetch(fetchImpl, client, statePath, now) {
+	return async (url, init) => {
+		const headers = {
+			...Object.fromEntries(new Headers(init.headers)),
+			"user-agent": userAgentOf(client)
+		};
+		const response = await fetchImpl(url, {
+			...init,
+			headers
+		});
+		const update = parseClientUpdateHeader(response.headers.get(CLIENT_UPDATE_HEADER));
+		if (update && statePath) {
+			const previous = await readUpdateState(statePath, client.version);
+			await writeUpdateState(statePath, {
+				...update,
+				version: client.version,
+				receivedAt: now().toISOString(),
+				...previous?.outdatedShownAt ? { outdatedShownAt: previous.outdatedShownAt } : {}
+			}).catch(() => {});
+		}
+		return response;
+	};
+}
+const utcDate = (instant) => new Intl.DateTimeFormat("en-CA", {
+	timeZone: "UTC",
+	year: "numeric",
+	month: "2-digit",
+	day: "2-digit"
+}).format(new Date(instant));
+const unsupportedLine = (component) => `This Harnessforce ${DISPLAY_NAMES[component]} version is no longer supported, so nothing is being sent to Harnessforce. Update it: \`${UPDATE_COMMANDS[component]}\``;
+function updateLine(component, update) {
+	const name = DISPLAY_NAMES[component];
+	const command = UPDATE_COMMANDS[component];
+	switch (update.status) {
+		case "unsupported": return unsupportedLine(component);
+		case "deprecated": {
+			const stops = `stops sending on ${utcDate(update.deadline ?? "")} (00:00 UTC)`;
+			return update.reason === "security" ? `A security update for Harnessforce ${name} is available. This version ${stops}. Update it: \`${command}\`` : `This Harnessforce ${name} version ${stops}. Update it: \`${command}\``;
+		}
+		case "outdated": return `Harnessforce ${name} ${update.latest} is available. Update it: \`${command}\``;
+		default: return;
+	}
+}
+function shouldShowOutdated(state, now, env) {
+	if (state.status !== "outdated" || env.NO_UPDATE_NOTIFIER || env.CI) return false;
+	const shownAt = state.outdatedShownAt ? Date.parse(state.outdatedShownAt) : NaN;
+	return Number.isNaN(shownAt) || now.getTime() - shownAt >= DAY_MS$2;
+}
+const markOutdatedShown = (path, state, now) => writeUpdateState(path, {
+	...state,
+	outdatedShownAt: now.toISOString()
+});
+/**
+* 表示する1行。outdatedは24時間に1回までとし、表示する場合はその時刻を書く。isSuppressedは、pluginを
+* Claude Codeが自動更新する間など、呼び出し側がoutdatedを示さない条件。
+*/
+async function noticeLine(component, statePath, state, options) {
+	if (state.status === "outdated") {
+		if (!shouldShowOutdated(state, options.now, options.env) || await options.isSuppressed?.()) return void 0;
+		await markOutdatedShown(statePath, state, options.now).catch(() => {});
+	}
+	return updateLine(component, state);
+}
+/**
+* unsupportedを受けてから24時間以上経っていれば、資格情報を送らずに`GET /v1/client-status`で確かめ直す
+* （client-updates.md「送信の停止」）。失敗した場合は状態を変えない。
+*/
+async function recheckClientStatus(options) {
+	const { state } = options;
+	if (state?.status !== "unsupported" || options.now().getTime() - Date.parse(state.receivedAt) < DAY_MS$2) return state;
+	try {
+		await (await options.fetch(underBase(options.ingestBase, "v1/client-status"), {
+			method: "GET",
+			redirect: "error",
+			signal: AbortSignal.timeout(RECHECK_TIMEOUT_MS)
+		})).body?.cancel();
+	} catch {
+		return state;
+	}
+	return await readUpdateState(options.statePath, options.version) ?? state;
+}
+//#endregion
 //#region ../agent-core/src/ingest.ts
-const SEND_TIMEOUT_MS$1 = 2e3;
+const SEND_TIMEOUT_MS = 2e3;
 function ingestBaseFrom(endpoint) {
 	const base = parseAllowedUrl(endpoint);
 	if (!base) return void 0;
@@ -606,8 +1084,8 @@ function ingestBaseFrom(endpoint) {
 	ingestBase.pathname = base.pathname.replace(/\/+$/, "");
 	return ingestBase;
 }
-const postItem = (destination, path, item, fetchImpl, timeoutMs = SEND_TIMEOUT_MS$1) => postItems(destination, path, [item], fetchImpl, timeoutMs);
-async function postItems(destination, path, items, fetchImpl, timeoutMs = SEND_TIMEOUT_MS$1) {
+const postItem = (destination, path, item, fetchImpl, timeoutMs = SEND_TIMEOUT_MS) => postItems(destination, path, [item], fetchImpl, timeoutMs);
+async function postItems(destination, path, items, fetchImpl, timeoutMs = SEND_TIMEOUT_MS) {
 	try {
 		const response = await fetchImpl(underBase(destination.ingestBase, path), {
 			method: "POST",
@@ -633,68 +1111,37 @@ async function postItems(destination, path, items, fetchImpl, timeoutMs = SEND_T
 	}
 }
 //#endregion
-//#region ../agent-core/src/issue.ts
-const isIssueIdentifier = (value) => isToken(value, 300);
-//#endregion
-//#region ../agent-core/src/using-harnessforce.ts
-const usingHarnessforceBody = "---\nname: using-harnessforce\ndescription: Harnessforceのhookが入った環境でsessionを始めたとき、HarnessforceのIssue（ENG-42のような識別子）に取り組む作業を始めるとき、Harnessforceが何を記録し何を収集しないかを尋ねられたときに使う。sessionの開始時にhookがこの本文をcontextへ注入する。\n---\n\n# Harnessforceを使う\n\nこのsessionにはHarnessforceのhookが入っている。Harnessforceは、人とAIの作業をIssueに結び付けて記録する。次の規則に従う。\n\n## 何を記録するか\n\n- session registration: agent、session ID、repository、branch、commit、開始時刻、最初のprompt ID。\n- config snapshot: 利用中の設定の構成（Claude Codeだけ）。\n- OTelのテレメトリ: 利用者の設定で送るもの。\n- Issueに取り組む作業で`record-run`が記録する、Plan、Decision、Definition of Doneの充足。人が承認するまで確定しない。\n\n## 何を収集しないか\n\n- prompt、応答、toolの入出力、code diffの本文は、利用者が`--send-content`で選び、Workspaceがopt-inした場合だけ届く。既定では収集しない。\n- MCPのtoolの入力にも記録にも、これらの本文、secret、環境変数の値を含めない。\n\n## どのhookが何を送るか\n\n- SessionStart: session registrationとconfig snapshot（Codexはsession registrationだけ）。\n- UserPromptSubmit: 最初のpromptでの再送（Claude Codeだけ）。\n- hookは失敗してもsessionを止めない。送れない状態のときは、hookが警告を1行表示する。警告が出たら利用者に伝える。\n\n## どのskillとtoolをいつ使うか\n\n- IssueのIDを指定された作業、または環境変数`HARNESSFORCE_ISSUE`がある作業は、`record-run`に従い、`start_run`、`get_issue`、`record_plan`、`record_decision`、`complete_run`を使う。skillを読み込めないagentは、同じ順にtoolを呼ぶ。\n- `start_run`には、contextの`harnessforce session_id:`の行の値を渡す。複数あれば最後の値を使う。行が無ければ、session IDを推測せず、`start_run`と`complete_run`を呼ばない。\n- `/harnessforce:tune`の分析は`propose-improvements`を使う。\n- Issueが指定されていない作業では、Runの記録を始めない。\n\n## Red Flags\n\n次の考えが浮かんだら、立ち止まる。\n\n| 考え | 現実 |\n| --- | --- |\n| 小さな作業なので記録は要らない | Issueが指定された作業は、大きさによらず記録する |\n| session IDの行が無いが、推測して`start_run`を呼ぶ | 推測しない。Runがsessionと結び付かなくなる |\n| 本文を要約して渡せば記録の役に立つ | 本文はtoolに渡さない。収集しない範囲を超える |\n| 警告が出たが、気にしなくてよい | 送れていない。利用者に伝える |\n\n## 優先順位\n\n1. 利用者の指示（CLAUDE.md、AGENTS.md、直接の依頼）。利用者が記録を止めるよう指示したら、Runの記録を止める。\n2. この導入文。\n3. 既定の動作。\n\n## subagent\n\n親から特定の作業だけを委譲されたsubagentは、この導入文に従ってRunを登録しない。Runの登録は親が行う。\n".replace(/\r\n/g, "\n").replace(/^---\n[\s\S]*?\n---\n+/, "").trimEnd();
-//#endregion
-//#region ../agent-core/src/session-context.ts
-const sessionContextLine = (sessionId) => `harnessforce session_id: ${sessionId}`;
-const sessionContext = (sessionId) => ({ hookSpecificOutput: {
-	hookEventName: "SessionStart",
-	additionalContext: `${sessionContextLine(sessionId)}\n\n${usingHarnessforceBody}`
-} });
-//#endregion
-//#region ../agent-core/src/vcs.ts
-async function selectRemote(cwd, git) {
-	if (await git(cwd, ["rev-parse", "--is-inside-work-tree"]) !== "true") return void 0;
-	const remotes = (await git(cwd, ["remote"]))?.split("\n") ?? [];
-	return remotes.includes("origin") ? "origin" : remotes[0];
-}
-async function resolveVcs(cwd, git) {
-	const remote = await selectRemote(cwd, git);
-	if (!remote) return void 0;
-	const [url, branch, commit] = await Promise.all([
-		git(cwd, [
-			"remote",
-			"get-url",
-			remote
-		]),
-		git(cwd, [
-			"symbolic-ref",
-			"--quiet",
-			"--short",
-			"HEAD"
-		]),
-		git(cwd, [
-			"rev-parse",
-			"--verify",
-			"--quiet",
-			"HEAD"
-		])
-	]);
-	const repository = url === void 0 ? void 0 : normalizeRepository(url);
-	return {
-		...repository === void 0 ? {} : { repository },
-		...branch === void 0 ? {} : { branch },
-		...commit === void 0 ? {} : { commit }
-	};
-}
-async function resolveRepository(cwd, git) {
-	if (!isAbsolute(cwd)) return void 0;
-	const remote = await selectRemote(cwd, git);
-	if (!remote) return void 0;
-	const url = await git(cwd, [
-		"remote",
-		"get-url",
-		remote
-	]);
-	return url === void 0 ? void 0 : normalizeRepository(url);
+//#region ../agent-core/src/config/hash-input.ts
+function withoutSecrets(entry) {
+	const { env, headers, url, args: _args, ...rest } = entry;
+	const result = rest;
+	if (isObject(env)) result.env = Object.keys(env).sort(byCodeUnit$1);
+	if (isObject(headers)) result.headers = Object.keys(headers).sort(byCodeUnit$1);
+	const strippedUrl = typeof url === "string" ? withoutCredentials(url) : void 0;
+	if (strippedUrl !== void 0) result.url = strippedUrl;
+	return result;
 }
-async function resolveProjectRoot(cwd, git) {
-	const topLevel = await git(cwd, ["rev-parse", "--show-toplevel"]);
-	return topLevel && isAbsolute(topLevel) ? topLevel : cwd;
+function withoutCredentials(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return;
+	}
+	parsed.username = "";
+	parsed.password = "";
+	parsed.search = "";
+	parsed.hash = "";
+	return parsed.href;
+}
+const reduceHookGroup = (group) => isObject(group) && Array.isArray(group.hooks) ? {
+	...group,
+	hooks: group.hooks.map((handler) => isObject(handler) ? withoutSecrets(handler) : handler)
+} : group;
+function hashInput(kind, value) {
+	if (kind === "mcp_server" && isObject(value)) return withoutSecrets(value);
+	if (kind === "hook" && Array.isArray(value)) return value.map(reduceHookGroup);
+	return value;
 }
 //#endregion
 //#region ../agent-core/src/config/scope.ts
@@ -724,7 +1171,7 @@ var Sink = class {
 		});
 		return {
 			guard: this.guard,
-			addValue: (kind, id, value) => add(kind, id, hashValue(value)),
+			addValue: (kind, id, value) => add(kind, id, hashValue(hashInput(kind, value))),
 			addFile: async (kind, id, path) => {
 				const content = await readFileIfExists(path, this.guard);
 				if (content) add(kind, id, hashFileContent(content));
@@ -754,6 +1201,9 @@ function collectMcpServers$1(s, servers) {
 	for (const [name, value] of Object.entries(servers)) if (isObject(value)) s.addValue("mcp_server", name, value);
 }
 //#endregion
+//#region ../agent-core/src/plugin-auto-update.ts
+const MARKETPLACE_NAME = "harnessforce-agent";
+//#endregion
 //#region src/shared/settings.ts
 const OTEL_HEADERS_HELPER = "harnessforce otel-headers";
 const PLUGIN_ID$1 = "harnessforce@harnessforce-agent";
@@ -782,6 +1232,37 @@ async function readUserSettings(path) {
 		return { kind: "invalid" };
 	}
 }
+const MARKETPLACE_KEYS = ["extraKnownMarketplaces", "additionalMarketplaces"];
+const MARKETPLACE_SOURCE = {
+	source: "github",
+	repo: "lambda-script/harnessforce-agent"
+};
+const isMarketplacesValid = (value) => value === void 0 || isObject(value) && (value["harnessforce-agent"] === void 0 || isObject(value["harnessforce-agent"]));
+const hasWritableMarketplaces = (settings) => MARKETPLACE_KEYS.every((key) => isMarketplacesValid(settings[key]));
+/**
+* marketplaceの登録の鍵の`harnessforce-agent`に、sourceと自動更新を書く。sourceと、利用者が切り替えた真偽値は残し、
+* turnOffのときだけ偽にする。自動更新が有効になったかも返す。
+*/
+function withPluginAutoUpdate(settings, turnOff) {
+	const key = settings.additionalMarketplaces !== void 0 && settings.extraKnownMarketplaces === void 0 ? "additionalMarketplaces" : "extraKnownMarketplaces";
+	const marketplaces = settings[key] ?? {};
+	const entry = marketplaces["harnessforce-agent"] ?? {};
+	const autoUpdate = turnOff ? false : typeof entry.autoUpdate === "boolean" ? entry.autoUpdate : true;
+	return {
+		settings: {
+			...settings,
+			[key]: {
+				...marketplaces,
+				[MARKETPLACE_NAME]: {
+					...entry,
+					source: entry.source ?? MARKETPLACE_SOURCE,
+					autoUpdate
+				}
+			}
+		},
+		isOn: autoUpdate
+	};
+}
 function mergeUserSettings(settings, env) {
 	return {
 		...settings,
@@ -834,6 +1315,399 @@ async function resolveCliDestinations(env, settingsPath, defaultUrl) {
 	};
 }
 //#endregion
+//#region src/client-update.ts
+const updateStatePath = (homeDir) => join(homeDir, ".harnessforce", "update-status.json");
+const readCliUpdateState = (homeDir, version) => readUpdateState(updateStatePath(homeDir), version);
+/**
+* 送信を伴うcommandの前に呼ぶ。unsupportedを受けてから24時間以上経っていれば資格情報を送らずに確かめ直し、
+* それでもunsupportedなら真を返す（client-updates.md「送信の停止」）。
+*/
+async function isSendingBlocked(deps) {
+	const statePath = updateStatePath(deps.homeDir);
+	const state = await readUpdateState(statePath, deps.client.version);
+	if (state?.status !== "unsupported") return false;
+	const { ingestEndpoint } = await resolveCliDestinations(deps.env, userSettingsPath(deps.env, deps.homeDir), deps.defaultUrl);
+	const ingestBase = ingestBaseFrom(ingestEndpoint);
+	return (ingestBase ? await recheckClientStatus({
+		state,
+		ingestBase,
+		fetch: deps.fetch,
+		statePath,
+		version: deps.client.version,
+		now: deps.now
+	}) : state)?.status === "unsupported";
+}
+/** commandの出力の後に、更新の状態の1行をstderrへ書く。outdatedは24時間に1回までとする。 */
+async function noticeUpdate(deps) {
+	const statePath = updateStatePath(deps.homeDir);
+	const state = await readUpdateState(statePath, deps.client.version);
+	if (!state) return;
+	const line = await noticeLine("cli", statePath, state, {
+		now: deps.now(),
+		env: deps.env
+	});
+	if (line) deps.stderr(`${line}\n`);
+}
+//#endregion
+//#region src/help.ts
+const SENDS_NOTHING_LOCAL = "Nothing. It reads local files only and makes no network request.";
+const COMMANDS$1 = {
+	init: {
+		summary: "Connect this machine to a Harnessforce Workspace",
+		text: `Usage: harnessforce init [--port <port>] [--send-content] [--no-plugin-auto-update]
+
+When to use:
+  Once per machine, before anything else, and again whenever the login expires.
+
+What it does:
+  Opens your browser to log in to a Workspace, then stores a user ingest key and
+  an API token in the OS keychain. It configures Claude Code (user settings) and
+  Codex (config.toml) to export telemetry to the Workspace.
+
+Options:
+  --port <port>     Loopback port for the login callback, 1-65535 (default 8080).
+  --send-content    Also send the text of the prompts you type. Takes effect only
+                    when the Workspace has opted in. Off by default.
+  --no-plugin-auto-update
+                    Turn off automatic updates of the Harnessforce plugin in
+                    Claude Code. On by default; a value you set is kept.
+
+Sends:
+  The login exchange with the Workspace. After init, the agents you run send
+  telemetry (token counts, tool names, timings) with that key.
+
+Does not send:
+  Prompt text (unless --send-content and the Workspace opt-in), model responses,
+  tool input or output, code diffs, and secrets. The key is never written to a
+  plain file.
+
+Exit codes:
+  0  Connected and configured.
+  1  Failed (login cancelled or timed out, keychain unavailable, or a write
+     failed). The reason is printed to stderr.
+
+Examples:
+  harnessforce init
+  harnessforce init --send-content
+  harnessforce init --port 8081
+`
+	},
+	import: {
+		summary: "Send past local sessions to the Workspace",
+		text: `Usage: harnessforce import
+
+When to use:
+  Right after init, to backfill sessions that ran before Harnessforce was
+  connected. It is safe to run again; sessions already sent are skipped.
+
+What it does:
+  Reads Claude Code and Codex session records on this machine, keeps the
+  sessions of repositories connected to the Workspace and inside its import
+  window, and sends a summary of each. When it imports nothing, it prints why
+  and what to do next.
+
+Sends:
+  Per session: agent, session ID, repository, branch, commit, start and end
+  time, model, input and output token counts, and tool call counts.
+
+Does not send:
+  Prompt text, model responses, tool input or output, and code diffs. Sessions
+  of repositories that are not connected are not sent.
+
+Exit codes:
+  0  Finished (including "nothing to import").
+  1  Not logged in, keychain unavailable, a limit was reached, or sending failed.
+
+Examples:
+  harnessforce import
+`
+	},
+	"otel-headers": {
+		summary: "Print the telemetry auth header (used by Claude Code)",
+		text: `Usage: harnessforce otel-headers
+
+When to use:
+  You normally never run it. Claude Code calls it as its otelHeadersHelper.
+
+What it does:
+  Reads the ingest key from the keychain and prints {"Authorization": "Bearer <key>"}
+  as JSON on stdout.
+
+Sends:
+  ${SENDS_NOTHING_LOCAL}
+
+Does not send:
+  Anything. Do not paste its output into chats or logs: it contains the key.
+
+Exit codes:
+  0  Header printed.
+  1  No usable key (not logged in, keychain unavailable, or the destination was
+     not verified). Nothing is printed to stdout.
+
+Examples:
+  harnessforce otel-headers
+`
+	},
+	run: {
+		summary: "Start an agent tied to an Issue",
+		text: `Usage: harnessforce run --issue <identifier> -- <agent> [args]
+
+When to use:
+  When the branch name does not contain the Issue identifier and you want the
+  work tied to the Issue anyway.
+
+What it does:
+  Starts <agent> (for example claude or codex) with your arguments, with the
+  Issue identifier added to the telemetry it exports. Everything after "--" is
+  passed to the agent unchanged, including "--help". The agent's exit code is
+  returned.
+
+Options:
+  --issue <identifier>   The Issue identifier, for example ABC-123.
+
+Sends:
+  The same telemetry as an agent started directly, plus the Issue identifier.
+
+Does not send:
+  Anything beyond what init configured. Prompt text is sent only if you chose
+  --send-content at init.
+
+Exit codes:
+  The agent's own exit code when it ran.
+  1  Could not start: not logged in, bad arguments, or the agent was not found.
+
+Examples:
+  harnessforce run --issue ABC-123 -- claude
+  harnessforce run --issue ABC-123 -- codex --model gpt-5
+`
+	},
+	tune: {
+		summary: "Analyze your past sessions and report counts",
+		text: `Usage: harnessforce tune [--all] [--no-send] [--show-report] [--json]
+       harnessforce tune record
+       harnessforce tune --purge
+
+When to use:
+  Periodically (or through /harnessforce:tune) to see where human intervention,
+  repeated work, and MCP or tool usage could improve. It needs at least 10
+  sessions.
+
+What it does:
+  Imports sessions that were not sent yet, analyzes the local session records,
+  and prints the result. Files it writes live under ~/.harnessforce/tune/.
+
+Options:
+  --all           Analyze sessions of repositories not connected too (they are
+                  never sent).
+  --no-send       Analyze only; send nothing.
+  --show-report   Print the exact values that would be sent.
+  --json          Print the result as one JSON object on stdout. Messages go to
+                  stderr.
+  record          Read one proposal as JSON from stdin and store it locally.
+  --purge         Delete the analysis, proposals, and unsent results.
+
+Sends:
+  Counts computed by public rules (no text), for connected repositories only.
+  It also runs the same session import as "harnessforce import".
+
+Does not send:
+  Prompt text, model responses, tool input or output, and code diffs. Usage
+  statistics and proposals stay on this machine.
+
+Exit codes:
+  0  Done (including "not enough data" and "nothing sent").
+  1  Not logged in, keychain unavailable, another tune is running, or a local
+     write failed.
+  2  Bad option, or invalid input to "record".
+  3  Analysis shown, but sending is not possible until you run "harnessforce init".
+
+Examples:
+  harnessforce tune
+  harnessforce tune --no-send --json
+  harnessforce tune --purge
+`
+	},
+	top: {
+		summary: "Show running and recent sessions on this machine",
+		text: `Usage: harnessforce top [--once] [--json] [--ascii] [--theme <auto|light|dark|ansi>]
+
+When to use:
+  To watch what your agents are doing right now. In a terminal it is a live
+  view; with --once or --json it prints a snapshot and exits.
+
+What it does:
+  Reads Claude Code and Codex session records on this machine and shows each
+  session's state, repository, branch, tokens, and tool calls.
+
+Options:
+  --once    Print one snapshot and exit.
+  --json    Print one snapshot as JSON and exit.
+  --ascii   Use plain ASCII instead of box-drawing characters.
+  --theme   Color theme: auto (default), light, dark, or ansi.
+
+Sends:
+  ${SENDS_NOTHING_LOCAL}
+
+Does not send:
+  Anything. It never changes any file.
+
+Exit codes:
+  0  Done (including quitting the live view).
+  1  Bad arguments.
+
+Examples:
+  harnessforce top
+  harnessforce top --once --json
+`
+	},
+	hook: {
+		summary: "Session-start hook (used by Codex)",
+		text: `Usage: harnessforce hook session-start
+
+When to use:
+  You normally never run it. Codex runs it when a session starts.
+
+What it does:
+  Reads the hook input from stdin, registers the session with the Workspace, and
+  prints context for the agent (the session ID, plus a one-line warning if
+  registration failed).
+
+Sends:
+  Session registration: agent, session ID, repository, branch, commit, and
+  start time.
+
+Does not send:
+  Prompt text, model responses, tool input or output, and code diffs.
+
+Exit codes:
+  0  Always, even on failure: a hook must never stop your session. A failure is
+     shown as a one-line warning.
+  1  Wrong arguments.
+
+Examples:
+  harnessforce hook session-start < hook-input.json
+`
+	}
+};
+const ORDER = [
+	"init",
+	"import",
+	"run",
+	"tune",
+	"top",
+	"otel-headers",
+	"hook"
+];
+const NAME_WIDTH = Math.max(...ORDER.map((name) => name.length)) + 2;
+const OVERVIEW = `Usage: harnessforce <command> [options]
+
+Connect your AI coding agents to a Harnessforce Workspace.
+
+Commands:
+${ORDER.map((name) => `  ${name.padEnd(NAME_WIDTH)}${COMMANDS$1[name].summary}`).join("\n")}
+
+Run "harnessforce <command> --help" for what a command does, what it sends and
+does not send, and its exit codes.
+
+Options:
+  -h, --help     Show this help.
+  --version      Show the version.
+`;
+const UNKNOWN_COMMAND_HINT = `Usage: harnessforce <command> [options]
+Run "harnessforce --help" to list the commands.
+`;
+const isCommand = (name) => name !== void 0 && Object.hasOwn(COMMANDS$1, name);
+const isHelpFlag = (arg) => arg === "--help" || arg === "-h";
+function resolveHelp(argv) {
+	const [command, ...rest] = argv;
+	if (command === void 0) return void 0;
+	if (isHelpFlag(command) && rest.length === 0) return OVERVIEW;
+	if (command === "help") {
+		if (rest.length === 0) return OVERVIEW;
+		if (rest.length === 1 && isCommand(rest[0])) return COMMANDS$1[rest[0]].text;
+		return;
+	}
+	if (!isCommand(command)) return void 0;
+	const separator = rest.indexOf("--");
+	return (separator === -1 ? rest : rest.slice(0, separator)).some(isHelpFlag) ? COMMANDS$1[command].text : void 0;
+}
+//#endregion
+//#region ../agent-core/src/hook-warning.ts
+const RESTART_FAILED_WARNING = "Could not restart the Harnessforce hook";
+const INVALID_ENDPOINT_WARNING = "The Harnessforce destination is invalid. Run `harnessforce init` again";
+const notConfiguredWarning = (agent) => agent === "claude_code" ? "Harnessforce sending is not configured. Run `/harnessforce:setup`" : "Harnessforce sending is not configured. Run `harnessforce init`";
+const stopped = (agent) => agent === "claude_code" ? "telemetry is not being sent" : "sessions are not being registered";
+const keyMissingWarning = (agent) => `Harnessforce cannot find your ingest key, so ${stopped(agent)}. Run \`harnessforce init\``;
+const keyUnreadableWarning = (agent) => `Harnessforce could not read your ingest key from the OS keychain, so ${agent === "claude_code" ? "telemetry may not be sent" : "sessions may not be registered"}. Unlock the keychain or run \`harnessforce init\``;
+const DESTINATION_MISMATCH_WARNING = {
+	claude_code: "Telemetry is not being sent because the Harnessforce destination differs from the one saved by `harnessforce init`. Check this repository's settings or run `harnessforce init` again",
+	codex: "Sessions are not being registered because the Harnessforce destination differs from the one saved by `harnessforce init`. Run `harnessforce init` again"
+};
+//#endregion
+//#region ../agent-core/src/issue.ts
+const isIssueIdentifier = (value) => isToken(value, 300);
+//#endregion
+//#region ../agent-core/src/using-harnessforce.ts
+const usingHarnessforceBody = "---\nname: using-harnessforce\ndescription: Use when starting a session in an environment with the Harnessforce hook, when starting work on an Issue, or when asked what is recorded or collected. The hook injects this text into the context at session start.\n---\n\n# Using Harnessforce\n\nThis session has the Harnessforce hook installed. Harnessforce links the work of people and AI to Issues and records it. Follow these rules.\n\n## What is recorded\n\n- Session registration: agent, session ID, repository, branch, commit, start time, and the first prompt ID.\n- Config snapshot: the structure of the configuration in use (Claude Code only).\n- OTel telemetry: what the user chooses to send.\n- For work on an Issue, `record-run` registers the session as a Run and closes it. It records no Plan, Decision, or Definition of Done.\n\n## What is not collected\n\n- Prompts, responses, tool input and output, and the body of code diffs arrive only when the user opts in with `--send-content` and the Workspace has opted in. They are not collected by default.\n- Never put these contents, secrets, or environment variable values in MCP tool input or in a record.\n\n## Which hook sends what\n\n- SessionStart: session registration and the config snapshot (Codex sends session registration only).\n- UserPromptSubmit: resends on the first prompt (Claude Code only).\n- A failing hook never stops the session. When the hook cannot send, it shows a one-line warning. Tell the user when a warning appears.\n\n## Which skill and tool to use, and when\n\n- For work on a specified Issue ID, or when the environment variable `HARNESSFORCE_ISSUE` is set, follow `record-run` and use `start_run`, `get_issue`, and `complete_run`. An agent that cannot load the skill calls the tools in the same order.\n- Pass the value of the `harnessforce session_id:` line in the context to `start_run`. If there are several, use the last one. If the line is missing, do not guess the session ID, and do not call `start_run` or `complete_run`.\n- Use `propose-improvements` for the analysis of `/harnessforce:tune`.\n- When no Issue is specified, do not start recording a Run.\n\n## Red Flags\n\nStop when one of these thoughts comes up.\n\n| Thought | Reality |\n| --- | --- |\n| An Issue was specified, but the work is small, so recording is unnecessary | Work on a specified Issue is recorded regardless of its size |\n| The session ID line is missing, so I will guess it and call `start_run` | Do not guess. The Run would no longer be linked to the session |\n| Summarizing the content before recording would help | Do not pass content to the tool. It goes beyond what is collected |\n| A warning appeared, but I can ignore it | Sending is not working. Tell the user |\n\n## Priority\n\n1. The user's instructions (CLAUDE.md, AGENTS.md, direct requests). If the user tells you to stop recording, stop recording the Run.\n2. This introduction.\n3. Default behavior.\n\n## Subagents\n\nA subagent that was delegated only a specific task by its parent does not register a Run by following this introduction. The parent registers the Run.\n".replace(/\r\n/g, "\n").replace(/^---\n[\s\S]*?\n---\n+/, "").trimEnd();
+//#endregion
+//#region ../agent-core/src/session-context.ts
+const sessionContextLine = (sessionId) => `harnessforce session_id: ${sessionId}`;
+const sessionContext = (sessionId) => ({ hookSpecificOutput: {
+	hookEventName: "SessionStart",
+	additionalContext: `${sessionContextLine(sessionId)}\n\n${usingHarnessforceBody}`
+} });
+//#endregion
+//#region ../agent-core/src/vcs.ts
+async function selectRemote(cwd, git) {
+	if (await git(cwd, ["rev-parse", "--is-inside-work-tree"]) !== "true") return void 0;
+	const remotes = (await git(cwd, ["remote"]))?.split("\n") ?? [];
+	return remotes.includes("origin") ? "origin" : remotes[0];
+}
+async function resolveVcs(cwd, git) {
+	const remote = await selectRemote(cwd, git);
+	if (!remote) return void 0;
+	const [url, branch, commit] = await Promise.all([
+		git(cwd, [
+			"remote",
+			"get-url",
+			remote
+		]),
+		git(cwd, [
+			"symbolic-ref",
+			"--quiet",
+			"--short",
+			"HEAD"
+		]),
+		git(cwd, [
+			"rev-parse",
+			"--verify",
+			"--quiet",
+			"HEAD"
+		])
+	]);
+	const repository = url === void 0 ? void 0 : normalizeRepository(url);
+	return {
+		...repository === void 0 ? {} : { repository },
+		...branch === void 0 ? {} : { branch },
+		...commit === void 0 ? {} : { commit }
+	};
+}
+async function resolveRepository(cwd, git) {
+	if (!isAbsolute(cwd)) return void 0;
+	const remote = await selectRemote(cwd, git);
+	if (!remote) return void 0;
+	const url = await git(cwd, [
+		"remote",
+		"get-url",
+		remote
+	]);
+	return url === void 0 ? void 0 : normalizeRepository(url);
+}
+async function resolveProjectRoot(cwd, git) {
+	const topLevel = await git(cwd, ["rev-parse", "--show-toplevel"]);
+	return topLevel && isAbsolute(topLevel) ? topLevel : cwd;
+}
+//#endregion
 //#region src/credentials/user-destination.ts
 async function resolveUserDestination(deps) {
 	const { workspaceId, ingestEndpoint } = await resolveCliDestinations(deps.env, userSettingsPath(deps.env, deps.homeDir), "");
@@ -849,7 +1723,7 @@ async function resolveUserDestination(deps) {
 	};
 	if (!await deps.keychain.isAvailable()) return {
 		kind: "skipped",
-		reason: "no ingest key"
+		reason: "keychain unreadable"
 	};
 	const key = await deps.keychain.get(ingestKeyAccount(workspaceId));
 	if (!key) return {
@@ -872,9 +1746,10 @@ async function resolveUserDestination(deps) {
 //#endregion
 //#region src/hook/session-start.ts
 const HOOK_USAGE = "Usage: harnessforce hook session-start\n";
-const MAX_INPUT_BYTES$1 = 1048576;
+const MAX_INPUT_BYTES = 1048576;
 const REGISTERING_SOURCES = /* @__PURE__ */ new Set(["startup", "clear"]);
-const REVOKED_MESSAGE = "送信キーが失効しています。`harnessforce init`を実行してください";
+const KEYCHAIN_READ_TIMEOUT_MS = 1e3;
+const REVOKED_MESSAGE = "Your ingest key has been revoked. Run `harnessforce init`";
 function parseInput(raw) {
 	let fields;
 	try {
@@ -891,17 +1766,40 @@ function parseInput(raw) {
 		source: typeof source === "string" ? source : void 0
 	};
 }
-const report$1 = (deps, detail) => deps.stderr(`harnessforce: session registration ${detail}\n`);
+const report$1 = (deps, detail) => deps.stderr(`harnessforce: session registration ${detail}\n`);
+const SKIPPED_WARNINGS = {
+	"not configured": notConfiguredWarning("codex"),
+	"invalid endpoint": INVALID_ENDPOINT_WARNING,
+	"no ingest key": keyMissingWarning("codex"),
+	"keychain unreadable": keyUnreadableWarning("codex"),
+	"destination not verified": DESTINATION_MISMATCH_WARNING.codex
+};
+function resolveWithinLimit(deps) {
+	let timer;
+	const slow = new Promise((resolve) => {
+		timer = setTimeout(() => resolve({
+			kind: "skipped",
+			reason: "keychain unreadable"
+		}), KEYCHAIN_READ_TIMEOUT_MS);
+	});
+	return Promise.race([resolveUserDestination({
+		...deps,
+		keychain: deps.keychain.withTimeout(KEYCHAIN_READ_TIMEOUT_MS)
+	}).catch(() => ({
+		kind: "skipped",
+		reason: "keychain unreadable"
+	})), slow]).finally(() => clearTimeout(timer));
+}
 async function resolveDestination(deps) {
-	const resolved = await resolveUserDestination(deps);
+	const resolved = await resolveWithinLimit(deps);
 	if (resolved.kind === "ok") return { destination: resolved.destination };
 	if (resolved.kind === "none") {
 		report$1(deps, "skipped (not configured)");
 		return { warning: notConfiguredWarning("codex") };
 	}
-	report$1(deps, `skipped (${resolved.reason})`);
-	if (resolved.reason === "not configured") return { warning: notConfiguredWarning("codex") };
-	return resolved.reason === "invalid endpoint" ? { warning: INVALID_ENDPOINT_WARNING } : {};
+	const detail = resolved.reason === "keychain unreadable" ? "no ingest key" : resolved.reason;
+	report$1(deps, `skipped (${detail})`);
+	return { warning: SKIPPED_WARNINGS[resolved.reason] };
 }
 function registrationSource(env) {
 	const issue = env.HARNESSFORCE_ISSUE;
@@ -926,20 +1824,32 @@ async function register(input, deps) {
 	if (outcome.kind === "failed") report$1(deps, `failed (${outcome.reason})`);
 	return { outcome };
 }
+async function selectWarning(registered, deps) {
+	if (registered.outcome?.kind === "unauthorized") return REVOKED_MESSAGE;
+	const state = await readCliUpdateState(deps.homeDir, deps.client.version);
+	if (state?.status === "unsupported") return updateLine("cli", state);
+	const sending = registered.warning ?? (registered.outcome?.kind === "failed" ? "Harnessforce session registration failed. Check your network connection" : void 0);
+	if (sending !== void 0 || !state) return sending;
+	return noticeLine("cli", updateStatePath(deps.homeDir), state, {
+		now: deps.now(),
+		env: deps.env
+	});
+}
 async function sessionStart(deps) {
-	const input = parseInput(await deps.readStdin(MAX_INPUT_BYTES$1).then((buffer) => buffer.toString("utf8")).catch(() => ""));
+	const input = parseInput(await deps.readStdin(MAX_INPUT_BYTES).then((buffer) => buffer.toString("utf8")).catch(() => ""));
 	if (!input) return 0;
-	const registered = input.source === void 0 || REGISTERING_SOURCES.has(input.source) ? await register(input, deps).catch((error) => {
+	const registers = input.source === void 0 || REGISTERING_SOURCES.has(input.source);
+	const blocked = registers && await isSendingBlocked(deps);
+	const registered = registers && !blocked ? await register(input, deps).catch((error) => {
 		report$1(deps, `failed (${error instanceof Error ? error.name : "unknown"})`);
 		return {};
 	}) : {};
-	const warning = registered.outcome?.kind === "unauthorized" ? REVOKED_MESSAGE : registered.warning ?? (registered.outcome?.kind === "failed" ? "Harnessforceへのsession登録に失敗しました。通信を確かめてください" : void 0);
-	if (warning !== void 0) {
-		deps.stderr(`${warning}\n`);
-		deps.stdout(`${sessionContextLine(input.sessionId)}\n${usingHarnessforceBody}\n${warning}\n`);
-		return 0;
-	}
-	deps.stdout(`${JSON.stringify(sessionContext(input.sessionId))}\n`);
+	const warning = registers ? await selectWarning(registered, deps) : void 0;
+	if (warning !== void 0) deps.stderr(`${warning}\n`);
+	deps.stdout(`${JSON.stringify({
+		...sessionContext(input.sessionId),
+		...warning === void 0 ? {} : { systemMessage: warning }
+	})}\n`);
 	return 0;
 }
 //#endregion
@@ -998,7 +1908,7 @@ function parseStoredApiToken(secret, workspaceId) {
 async function verifyCliAccess(deps, messages) {
 	const { keychain } = deps;
 	const stop = (message) => stopWith(messages[message]);
-	if (!await keychain.isAvailable().catch(() => false)) stop("keychainUnavailable");
+	if (!await keychain.isAvailable().catch(() => false)) stopWith(keychainUnavailableMessage(keychain, messages.keychainUnavailable));
 	const read = (account) => keychain.get(account).catch(() => stop("keychainUnavailable"));
 	const destinations = await resolveCliDestinations(deps.env, userSettingsPath(deps.env, deps.homeDir), deps.defaultUrl);
 	const workspaceId = destinations.workspaceId ?? stop("initRequired");
@@ -1072,7 +1982,7 @@ const LOCK_WAIT_MS$1 = 3e4;
 const STALE_LOCK_MS$1 = 6e4;
 const RETRY_INTERVAL_MS$1 = 100;
 const DIR_MODE$2 = 448;
-const FILE_MODE$5 = 384;
+const FILE_MODE$4 = 384;
 const isAlreadyExists$1 = (error) => error?.code === "EEXIST";
 async function removeIfStale$1(path, now) {
 	const created = await stat(path).catch(() => void 0);
@@ -1087,7 +1997,7 @@ async function acquireTokenLock(path, deps) {
 	const deadline = deps.now() + LOCK_WAIT_MS$1;
 	while (deps.now() < deadline) {
 		try {
-			await (await open(path, "wx", FILE_MODE$5)).close();
+			await (await open(path, "wx", FILE_MODE$4)).close();
 			return () => rm(path, { force: true });
 		} catch (error) {
 			if (!isAlreadyExists$1(error)) throw error;
@@ -1099,6 +2009,7 @@ async function acquireTokenLock(path, deps) {
 //#endregion
 //#region src/credentials/api-token-session.ts
 const CLIENT_ID$1 = "harnessforce-cli";
+const LOCKED_KEYCHAIN_TIMEOUT_MS = 1e4;
 const isPast = (instant, now) => now >= Date.parse(instant);
 async function requestRefresh(endpoint, refreshToken, workspaceId, fetchImpl) {
 	try {
@@ -1127,11 +2038,11 @@ async function requestRefresh(endpoint, refreshToken, workspaceId, fetchImpl) {
 		return { kind: "failed" };
 	}
 }
-function tokenStore(deps) {
+function tokenStore(deps, keychain) {
 	const account = apiTokenAccount(deps.workspaceId);
 	return {
-		read: async () => parseStoredApiToken(await deps.keychain.get(account).catch(() => void 0), deps.workspaceId),
-		save: (token) => deps.keychain.set(account, serializeApiToken(token)).then(() => true).catch(() => false)
+		read: async () => parseStoredApiToken(await keychain.get(account).catch(() => void 0), deps.workspaceId),
+		save: (token) => keychain.set(account, serializeApiToken(token)).then(() => true).catch(() => false)
 	};
 }
 async function exchange(stored, deps, store) {
@@ -1144,7 +2055,8 @@ async function exchange(stored, deps, store) {
 	const reread = await store.read();
 	return reread && reread.refreshToken !== stored.refreshToken ? reread : void 0;
 }
-async function refreshUnderLock(used, deps, store) {
+async function refreshUnderLock(used, deps) {
+	const store = tokenStore(deps, deps.keychain.withTimeout(LOCKED_KEYCHAIN_TIMEOUT_MS));
 	const release = await acquireTokenLock(tokenLockPath(deps.homeDir), {
 		now: deps.now,
 		sleep: deps.sleep
@@ -1159,8 +2071,8 @@ async function refreshUnderLock(used, deps, store) {
 	}
 }
 function createApiTokenSession(deps) {
-	const store = tokenStore(deps);
-	const refresh = (used) => refreshUnderLock(used, deps, store);
+	const store = tokenStore(deps, deps.keychain);
+	const refresh = (used) => refreshUnderLock(used, deps);
 	let current;
 	async function withToken(request, isUnauthorized) {
 		let token = current ?? await store.read();
@@ -1206,37 +2118,6 @@ function createApiTokenSession(deps) {
 	};
 }
 //#endregion
-//#region src/shared/messages.ts
-const INIT_MESSAGES = {
-	success: "Harnessforceに接続しました。Claude Codeを再起動すると設定が反映されます",
-	invalidUrl: "接続先のURLが不正です",
-	keychainUnavailable: "OSのキーチェーンを利用できないため、送信キーを保存できません",
-	tooManyKeys: "keychainにある送信キーが多すぎるため、`harnessforce init`を実行できません",
-	tooManyCredentials: "keychainにある送信キーまたはログインの情報が多すぎるため、`harnessforce init`を実行できません",
-	settingsUnreadable: "Claude Codeのuser settingsを読めません",
-	network: "Harnessforceとの通信に失敗しました。もう一度`harnessforce init`を実行してください",
-	listenFailed: "ログインの待ち受けを開始できませんでした",
-	timeout: "ログインが時間内に完了しませんでした。もう一度`harnessforce init`を実行してください",
-	accessDenied: "ログインが拒否されました",
-	noWorkspace: "参加しているWorkspaceがありません。Workspaceを作成するか招待を受諾してから、もう一度`harnessforce init`を実行してください",
-	loginFailed: "ログインに失敗しました。もう一度`harnessforce init`を実行してください",
-	viewer: "閲覧のみのロールでは送信キーを発行できません。Workspaceの管理者に連絡してください",
-	limitOwnerAdmin: "有効な送信キーの数が上限に達しました。送信キーの画面で使っていないキーを失効してください",
-	limitMember: "送信キーの上限に達しています。Workspaceの管理者に連絡してください",
-	gateUnavailable: "受信側へ反映できませんでした。変更はしていません。もう一度お試しください",
-	ingestUnavailable: "この環境はテレメトリを受信しないため、送信キーを発行できません",
-	saveFailed: "送信キーを保存できませんでした。もう一度`harnessforce init`を実行してください",
-	codexSaveFailed: "Codexの設定を書き込めませんでした。もう一度`harnessforce init`を実行してください",
-	contentEnabled: "入力した指示の本文を送る設定を有効にしました。パターンに一致した秘密値と個人情報を伏せ字にしますが、すべてを検出できるとは限りません。保存した本文は、Workspaceのメンバーの中ではあなただけが読め、本文データの保持期間（最大30日）が過ぎると削除されます",
-	contentNotOptedIn: "このWorkspaceは本文データをopt-inしていないため、本文を送る設定は有効にしませんでした。Workspaceの設定のデータの保持でopt-inしてから、もう一度`harnessforce init --send-content`を実行してください"
-};
-const codexNotes = (configPath) => [
-	`Codexの設定を書き込みました（${configPath}）。Codexを再起動すると反映されます`,
-	"Codexのhookは、Codexの/hooksで内容をtrustするまで実行されません。/hooksでharnessforceのSessionStartのhookをtrustしてください",
-	"HarnessforceのMCPを使う場合は、`codex mcp login harnessforce`でログインしてください"
-].join("\n");
-const listenFailedMessage = (port) => `${INIT_MESSAGES.listenFailed}。ポート ${port}を使っているプロセスを終えるか、\`harnessforce init --port\`で別のポートを指定してください`;
-//#endregion
 //#region src/import/read-api.ts
 const FAILED$1 = { kind: "failed" };
 async function getJson(url, apiToken, fetchImpl) {
@@ -1333,7 +2214,7 @@ async function recordBase(deps) {
 //#region src/import/state.ts
 const STATE_VERSION = 1;
 const DIR_MODE$1 = 448;
-const FILE_MODE$4 = 384;
+const FILE_MODE$3 = 384;
 const sessionStateKey = (session) => session.agent === "claude_code" ? session.session_id : `${session.agent}:${session.session_id}`;
 const importStatePath = (homeDir) => join(homeDir, ".harnessforce", "import-state.json");
 const keyOf = ({ workspaceId, endpoint }) => `${workspaceId} ${endpoint}`;
@@ -1378,10 +2259,10 @@ async function recordSentSessions(path, destination, sessionIds) {
 	const temporary = `${path}.${randomUUID()}.tmp`;
 	try {
 		await writeFile(temporary, `${JSON.stringify(next)}\n`, {
-			mode: FILE_MODE$4,
+			mode: FILE_MODE$3,
 			flag: "wx"
 		});
-		await chmod(temporary, FILE_MODE$4);
+		await chmod(temporary, FILE_MODE$3);
 		await rename(temporary, path);
 	} finally {
 		await rm(temporary, { force: true });
@@ -1719,7 +2600,7 @@ async function parseRollout(path) {
 	const accumulator = new Accumulator$1();
 	let skippedLines = 0;
 	try {
-		const lines = createInterface$1({
+		const lines = createInterface({
 			input: createReadStream(path, { encoding: "utf8" }),
 			crlfDelay: Number.POSITIVE_INFINITY
 		});
@@ -1948,7 +2829,7 @@ async function readTranscript(path, accumulator) {
 	let lines = 0;
 	let skippedLines = 0;
 	try {
-		const reader = createInterface$1({
+		const reader = createInterface({
 			input: createReadStream(path, { encoding: "utf8" }),
 			crlfDelay: Number.POSITIVE_INFINITY
 		});
@@ -2023,6 +2904,11 @@ async function parseTranscriptUsage(path) {
 }
 //#endregion
 //#region src/import/sessions.ts
+const noneNotImported = () => ({
+	outOfRange: 0,
+	outsideGit: 0,
+	notConnected: 0
+});
 const readDir$1 = (dir) => readdir(dir, { withFileTypes: true }).catch(() => []);
 async function listTranscripts(projectsDir) {
 	const projects = (await readDir$1(projectsDir)).filter((entry) => entry.isDirectory());
@@ -2049,33 +2935,49 @@ function toSessionImport(session, repository) {
 	};
 }
 const sortedSessions = (sessions) => [...sessions.values()].sort((a, b) => Date.parse(a.started_at) - Date.parse(b.started_at) || (a.session_id < b.session_id ? -1 : a.session_id > b.session_id ? 1 : 0));
-async function scanSessions(options) {
+const cachedRepositoryOf = (git) => {
 	const repositories = /* @__PURE__ */ new Map();
-	const repositoryOf = (cwd) => {
-		const cached = repositories.get(cwd) ?? resolveRepository(cwd, options.git);
+	return (cwd) => {
+		const cached = repositories.get(cwd) ?? resolveRepository(cwd, git);
 		repositories.set(cwd, cached);
 		return cached;
 	};
+};
+async function judge(session, options, repositoryOf) {
+	if (Date.parse(session.endedAt) < options.sinceMs) return { kind: "outOfRange" };
+	const repository = session.cwd ? await repositoryOf(session.cwd) : void 0;
+	if (repository === void 0) return { kind: "outsideGit" };
+	return options.connected.has(repository) ? {
+		kind: "import",
+		repository
+	} : { kind: "notConnected" };
+}
+async function scanSessions(options) {
+	const repositoryOf = cachedRepositoryOf(options.git);
 	const sessions = /* @__PURE__ */ new Map();
+	const notImported = noneNotImported();
 	let skippedLines = 0;
 	let skippedFiles = 0;
 	for (const file of await listTranscripts(options.projectsDir)) {
 		const modifiedMs = (await stat(file).catch(() => void 0))?.mtimeMs;
-		if (modifiedMs !== void 0 && modifiedMs < options.sinceMs) continue;
+		if (modifiedMs !== void 0 && modifiedMs < options.sinceMs) {
+			notImported.outOfRange += 1;
+			continue;
+		}
 		const result = await parseTranscript(file);
 		skippedLines += result.skippedLines;
 		if (result.kind === "unreadable") skippedFiles += 1;
 		if (result.kind !== "session") continue;
 		const { session } = result;
-		if (Date.parse(session.endedAt) < options.sinceMs || !session.cwd) continue;
-		const repository = await repositoryOf(session.cwd);
-		if (repository === void 0 || !options.connected.has(repository)) continue;
-		if (!sessions.has(session.sessionId)) sessions.set(session.sessionId, toSessionImport(session, repository));
+		const verdict = await judge(session, options, repositoryOf);
+		if (verdict.kind !== "import") notImported[verdict.kind] += 1;
+		else if (!sessions.has(session.sessionId)) sessions.set(session.sessionId, toSessionImport(session, verdict.repository));
 	}
 	return {
 		sessions: sortedSessions(sessions),
 		skippedLines,
-		skippedFiles
+		skippedFiles,
+		notImported
 	};
 }
 const numericName = (name, length) => name.length === length && /^\d+$/.test(name) ? Number(name) : void 0;
@@ -2125,43 +3027,39 @@ function toCodexSessionImport(session, repository) {
 	};
 }
 async function scanCodexSessions(options) {
-	const repositories = /* @__PURE__ */ new Map();
-	const repositoryOf = (cwd) => {
-		const cached = repositories.get(cwd) ?? resolveRepository(cwd, options.git);
-		repositories.set(cwd, cached);
-		return cached;
-	};
-	const isSent = async (cwd) => {
-		if (!cwd) return void 0;
-		const repository = await repositoryOf(cwd);
-		return repository !== void 0 && options.connected.has(repository) ? repository : void 0;
-	};
+	const repositoryOf = cachedRepositoryOf(options.git);
 	const { files, compressed } = await listRollouts$1(join(options.codexDir, "sessions"), localDayKey(options.sinceMs));
 	const sessions = /* @__PURE__ */ new Map();
+	const notImported = noneNotImported();
 	let skippedLines = 0;
 	let skippedFiles = 0;
 	let unextractable = 0;
 	for (const file of files) {
 		const modifiedMs = (await stat(file).catch(() => void 0))?.mtimeMs;
-		if (modifiedMs !== void 0 && modifiedMs < options.sinceMs) continue;
+		if (modifiedMs !== void 0 && modifiedMs < options.sinceMs) {
+			notImported.outOfRange += 1;
+			continue;
+		}
 		const result = await parseRollout(file);
 		skippedLines += result.skippedLines;
 		if (result.kind === "unreadable") skippedFiles += 1;
 		if (result.kind === "unextractable") {
-			if (Date.parse(result.endedAt) >= options.sinceMs && await isSent(result.cwd)) unextractable += 1;
+			const verdict = await judge(result, options, repositoryOf);
+			if (verdict.kind === "import") unextractable += 1;
+			else notImported[verdict.kind] += 1;
 			continue;
 		}
 		if (result.kind !== "session") continue;
 		const { session } = result;
-		if (Date.parse(session.endedAt) < options.sinceMs) continue;
-		const repository = await isSent(session.cwd);
-		if (repository === void 0) continue;
-		if (!sessions.has(session.sessionId)) sessions.set(session.sessionId, toCodexSessionImport(session, repository));
+		const verdict = await judge(session, options, repositoryOf);
+		if (verdict.kind !== "import") notImported[verdict.kind] += 1;
+		else if (!sessions.has(session.sessionId)) sessions.set(session.sessionId, toCodexSessionImport(session, verdict.repository));
 	}
 	return {
 		sessions: sortedSessions(sessions),
 		skippedLines,
 		skippedFiles,
+		notImported,
 		unextractable,
 		compressed
 	};
@@ -2169,49 +3067,78 @@ async function scanCodexSessions(options) {
 //#endregion
 //#region src/import/command.ts
 const DAY_MS$1 = 864e5;
-const MESSAGES$1 = {
-	runInit: "`harnessforce init`を実行してください",
-	invalidUrl: "接続先のURLが不正です",
+const MESSAGES = {
+	runInit: "Run `harnessforce init`",
+	invalidUrl: "The connection URL is invalid",
 	keychainUnavailable: INIT_MESSAGES.keychainUnavailable,
-	readFailed: "Harnessforceとの通信に失敗しました。もう一度`harnessforce import`を実行してください",
-	sendFailed: "Harnessforceとの通信に失敗しました。もう一度`harnessforce import`を実行すると続きから取り込みます",
-	revoked: "送信キーが失効しています。`harnessforce init`を実行してください",
-	loginExpired: "ログインの有効期限が切れました。`harnessforce init`を実行してください",
-	stateFailed: "取り込みの状態を保存できませんでした"
+	readFailed: "Communication with Harnessforce failed. Run `harnessforce import` again",
+	sendFailed: "Communication with Harnessforce failed. Run `harnessforce import` again to resume importing",
+	revoked: "Your ingest key has been revoked. Run `harnessforce init`",
+	loginExpired: "Your login has expired. Run `harnessforce init`",
+	stateFailed: "Could not save the import state",
+	connectNone: "No GitHub repository is connected to the Workspace. Connect the GitHub App in Harnessforce to import sessions with `harnessforce import`",
+	connectOther: "The session's repository is not connected to the Workspace. Connect that repository to the GitHub App in Harnessforce to import it with `harnessforce import`",
+	nothingFound: "No session records to import were found"
 };
 const limitMessage = {
-	monthly_event_limit: (count) => `月間イベント数の上限に達したため、${count}件のセッションを取り込めませんでした。上限が解除された後に\`harnessforce import\`を再実行すると続きから取り込みます`,
-	workspace_read_only: (count) => `Workspaceが閲覧のみのため、${count}件のセッションを取り込めませんでした。閲覧のみが解除された後に\`harnessforce import\`を再実行すると続きから取り込みます`
+	monthly_event_limit: (count) => `Could not import ${count} session(s) because the monthly event limit was reached. Run \`harnessforce import\` again after the limit is lifted to resume importing`,
+	workspace_read_only: (count) => `Could not import ${count} session(s) because the Workspace is view-only. Run \`harnessforce import\` again after view-only mode is lifted to resume importing`
 };
-const ACCESS_MESSAGES$3 = {
-	keychainUnavailable: MESSAGES$1.keychainUnavailable,
-	initRequired: MESSAGES$1.runInit,
-	invalidUrl: MESSAGES$1.invalidUrl,
-	apiTokenMissing: MESSAGES$1.runInit
+const ACCESS_MESSAGES$2 = {
+	keychainUnavailable: MESSAGES.keychainUnavailable,
+	initRequired: MESSAGES.runInit,
+	invalidUrl: MESSAGES.invalidUrl,
+	apiTokenMissing: MESSAGES.runInit
 };
 function unwrap(outcome) {
 	if (outcome.kind === "ok") return outcome.value;
-	return stopWith(outcome.kind === "unauthorized" ? MESSAGES$1.loginExpired : MESSAGES$1.readFailed);
+	return stopWith(outcome.kind === "unauthorized" ? MESSAGES.loginExpired : MESSAGES.readFailed);
 }
-function report(result, deps) {
+const NOT_IMPORTED_LABELS = [
+	["alreadySent", "already sent"],
+	["outOfRange", "outside the period"],
+	["outsideGit", "outside a git repository"],
+	["notConnected", "in a repository not connected to the Workspace"]
+];
+function breakdownLine(breakdown) {
+	const parts = NOT_IMPORTED_LABELS.filter(([key]) => breakdown[key] > 0).map(([key, label]) => `${label} ${breakdown[key]}`);
+	return parts.length > 0 ? `Sessions not imported: ${parts.join(", ")}` : void 0;
+}
+function reportNotImported(imported, notes, deps) {
+	const line = breakdownLine(notes.breakdown);
+	if (line) deps.stdout(`${line}\n`);
+	if (imported > 0) return;
+	if (notes.breakdown.notConnected > 0) deps.stdout(`${notes.connectedCount === 0 ? MESSAGES.connectNone : MESSAGES.connectOther}\n`);
+	else if (!line && !notes.otherNoticeShown) deps.stdout(`${MESSAGES.nothingFound}\n`);
+}
+function report(result, notes, deps) {
 	switch (result.kind) {
 		case "done":
-			deps.stdout(`${result.imported}件のセッションを取り込みました\n`);
-			if (result.invalid > 0) deps.stdout(`形式が不正なため${result.invalid}件のセッションを取り込めませんでした\n`);
+			deps.stdout(`Sessions imported: ${result.imported}\n`);
+			if (result.invalid > 0) deps.stdout(`Could not import ${result.invalid} session(s) because their format is invalid\n`);
+			reportNotImported(result.imported, {
+				...notes,
+				otherNoticeShown: notes.otherNoticeShown || result.invalid > 0
+			}, deps);
 			return 0;
 		case "limited":
 			deps.stderr(`${limitMessage[result.reason](result.notImported)}\n`);
 			return 1;
 		case "unauthorized":
-			deps.stderr(`${MESSAGES$1.revoked}\n`);
+			deps.stderr(`${MESSAGES.revoked}\n`);
 			return 1;
 		case "failed":
-			deps.stderr(`${MESSAGES$1.sendFailed}\n`);
+			deps.stderr(`${MESSAGES.sendFailed}\n`);
 			return 1;
 	}
 }
+const sumNotImported = (a, b) => ({
+	outOfRange: a.outOfRange + b.outOfRange,
+	outsideGit: a.outsideGit + b.outsideGit,
+	notConnected: a.notConnected + b.notConnected
+});
 async function runImport(deps) {
-	const access = await verifyCliAccess(deps, ACCESS_MESSAGES$3);
+	const access = await verifyCliAccess(deps, ACCESS_MESSAGES$2);
 	const destination = {
 		workspaceId: access.workspaceId,
 		endpoint: withoutExtras(access.ingest)
@@ -2242,20 +3169,28 @@ async function runImport(deps) {
 	});
 	const skippedLines = claude.skippedLines + codex.skippedLines;
 	const skippedFiles = claude.skippedFiles + codex.skippedFiles;
-	if (skippedLines > 0 || skippedFiles > 0) deps.stdout(`読めなかった${skippedLines}行と${skippedFiles}個のファイルを読み飛ばしました\n`);
-	if (codex.unextractable > 0) deps.stdout(`modelまたはtoken数を読めないCodexのセッション${codex.unextractable}個は取り込みませんでした\n`);
-	if (codex.compressed > 0) deps.stdout(`圧縮されたCodexのセッションの記録${codex.compressed}個は読めないため取り込みませんでした\n`);
+	if (skippedLines > 0 || skippedFiles > 0) deps.stdout(`Skipped ${skippedLines} unreadable line(s) and ${skippedFiles} unreadable file(s)\n`);
+	if (codex.unextractable > 0) deps.stdout(`Did not import ${codex.unextractable} Codex session(s) whose model or token count could not be read\n`);
+	if (codex.compressed > 0) deps.stdout(`Did not import ${codex.compressed} compressed Codex session record(s) because they cannot be read\n`);
 	const scanned = [...claude.sessions, ...codex.sessions];
 	const statePath = importStatePath(deps.homeDir);
 	const sent = await readSentSessions(statePath, destination);
+	const unsent = scanned.filter((s) => !sent.has(sessionStateKey(s)));
 	return report(await sendSessions({
 		endpoint: access.ingest,
 		ingestKey: access.ingestKey,
-		sessions: scanned.filter((s) => !sent.has(sessionStateKey(s))),
+		sessions: unsent,
 		fetch: deps.fetch,
 		sleep: deps.sleep,
-		record: (ids) => recordSentSessions(statePath, destination, ids).catch(() => stopWith(MESSAGES$1.stateFailed))
-	}), deps);
+		record: (ids) => recordSentSessions(statePath, destination, ids).catch(() => stopWith(MESSAGES.stateFailed))
+	}), {
+		breakdown: {
+			alreadySent: scanned.length - unsent.length,
+			...sumNotImported(claude.notImported, codex.notImported)
+		},
+		otherNoticeShown: skippedLines > 0 || skippedFiles > 0 || codex.unextractable > 0 || codex.compressed > 0,
+		connectedCount: connected.size
+	}, deps);
 }
 function importCommand(deps) {
 	return runUntilStop(() => runImport(deps), deps.stderr);
@@ -8735,7 +9670,7 @@ function Ko(e, t) {
 const HOOK_COMMAND = "harnessforce hook session-start";
 const HOOK_COMMAND_WINDOWS = "harnessforce.cmd hook session-start";
 const HOOK_TIMEOUT_SECONDS = 10;
-const FILE_MODE$3 = 384;
+const FILE_MODE$2 = 384;
 function codexConfigPath(env, homeDir) {
 	return join(absoluteEnv(env.CODEX_HOME) ?? join(homeDir, ".codex"), "config.toml");
 }
@@ -8810,10 +9745,10 @@ async function writeCodexConfig(path, text) {
 	const temporary = `${path}.${randomUUID()}.tmp`;
 	try {
 		await writeFile(temporary, text, {
-			mode: FILE_MODE$3,
+			mode: FILE_MODE$2,
 			flag: "wx"
 		});
-		await chmod(temporary, FILE_MODE$3);
+		await chmod(temporary, FILE_MODE$2);
 		await rename(temporary, path);
 	} finally {
 		await rm(temporary, { force: true });
@@ -8898,8 +9833,15 @@ const stop$1 = (message) => stopWith(INIT_MESSAGES[message]);
 const sha256Hex = (value) => createHash("sha256").update(value, "utf8").digest("hex");
 function init(args, deps) {
 	return runUntilStop(async () => {
-		const codexPath = await runInit(args, deps);
-		deps.stdout(`${INIT_MESSAGES.success}\n${codexNotes(codexPath)}\n`);
+		const { codexPath, connection, isKernelKeyring, isPluginAutoUpdateOn } = await runInit(args, deps);
+		if (connection !== withoutExtras(new URL(deps.defaultUrl))) deps.stdout(`${nonDefaultConnectionMessage(connection)}\n`);
+		const lines = [
+			INIT_MESSAGES.success,
+			...isKernelKeyring ? [INIT_MESSAGES.savedToKernelKeyring] : [],
+			...isPluginAutoUpdateOn ? [INIT_MESSAGES.pluginAutoUpdateOn] : [],
+			codexNotes(codexPath)
+		];
+		deps.stdout(`${lines.join("\n")}\n`);
 		return 0;
 	}, deps.stderr);
 }
@@ -8907,9 +9849,11 @@ async function runInit(args, deps) {
 	const port = args.port ?? DEFAULT_PORT;
 	const base = parseAllowedUrl(args.url ?? deps.defaultUrl) ?? stop$1("invalidUrl");
 	const recordedUrl = withoutExtras(base);
-	const revoke = await readRevokeHashes(deps.keychain);
 	const settingsPath = userSettingsPath(deps.env, deps.homeDir);
-	if ((await readUserSettings(settingsPath)).kind === "invalid") stop$1("settingsUnreadable");
+	const store = await openKeychain(deps, (await readSettingsEnv$1(settingsPath)).HARNESSFORCE_WORKSPACE_ID);
+	const revoke = revokeHashes(store);
+	const settings = await readUserSettings(settingsPath);
+	if (settings.kind === "invalid" || !hasWritableMarketplaces(settings.settings)) stop$1("settingsUnreadable");
 	const authorizationEndpoint = await discoverAuthorizationEndpoint(base, deps.fetch) ?? stop$1("network");
 	const secrets = createLoginSecrets();
 	const { code, redirectUri } = await logIn(authorizationEndpoint, secrets, port, deps);
@@ -8921,18 +9865,27 @@ async function runInit(args, deps) {
 		revoke_key_hashes: revoke.keyHashes,
 		revoke_api_token_hashes: revoke.apiTokenHashes
 	}, deps.fetch));
-	await save(issued, recordedUrl, settingsPath, args.sendContent, deps).catch((error) => {
+	const isPluginAutoUpdateOn = await save(issued, recordedUrl, settingsPath, args, store).catch((error) => {
 		if (isStop(error)) throw error;
 		return stop$1("saveFailed");
 	});
 	const codexPath = codexConfigPath(deps.env, deps.homeDir);
 	await saveCodexConfig(issued, recordedUrl, codexPath, args.sendContent).catch(() => stop$1("codexSaveFailed"));
 	if (args.sendContent) deps.stdout(`${issued.contentOptIn ? INIT_MESSAGES.contentEnabled : INIT_MESSAGES.contentNotOptedIn}\n`);
-	return codexPath;
+	return {
+		codexPath,
+		connection: recordedUrl,
+		isKernelKeyring: store.isKernelKeyring,
+		isPluginAutoUpdateOn
+	};
+}
+async function openKeychain(deps, previousWorkspaceId) {
+	return await deps.keychain.openForInit({
+		previousWorkspaceId,
+		onWaiting: () => deps.stderr(`${INIT_MESSAGES.waitingForSecretService}\n`)
+	}).catch(() => stop$1("keychainUnavailable")) ?? stopWith(keychainUnavailableMessage(deps.keychain));
 }
-async function readRevokeHashes(keychain) {
-	if (!await keychain.isAvailable()) stop$1("keychainUnavailable");
-	const items = await keychain.list().catch(() => void 0) ?? stop$1("keychainUnavailable");
+function revokeHashes({ items }) {
 	const keyHashes = items.filter((item) => isIngestKeyAccount(item.account)).map((item) => sha256Hex(item.secret));
 	if (keyHashes.length > MAX_REVOKE_HASHES) stop$1("tooManyKeys");
 	const apiTokenHashes = items.flatMap((item) => {
@@ -8985,15 +9938,16 @@ function issuedOrStop(outcome) {
 		case "unexpected": return stop$1("network");
 	}
 }
-async function save(issued, connection, settingsPath, sendContent, deps) {
-	await deps.keychain.delete(ingestOriginAccount(issued.workspaceId));
-	await deps.keychain.delete(urlOriginAccount(issued.workspaceId));
-	await deps.keychain.set(ingestKeyAccount(issued.workspaceId), issued.ingestKey);
-	await deps.keychain.set(apiTokenAccount(issued.workspaceId), serializeApiToken(issued.apiToken));
-	await deps.keychain.set(ingestOriginAccount(issued.workspaceId), new URL(issued.ingestEndpoint).origin);
-	await deps.keychain.set(urlOriginAccount(issued.workspaceId), new URL(connection).origin);
+async function save(issued, connection, settingsPath, args, store) {
+	await store.delete(ingestOriginAccount(issued.workspaceId));
+	await store.delete(urlOriginAccount(issued.workspaceId));
+	await store.set(ingestKeyAccount(issued.workspaceId), issued.ingestKey);
+	await store.set(apiTokenAccount(issued.workspaceId), serializeApiToken(issued.apiToken));
+	await store.set(ingestOriginAccount(issued.workspaceId), new URL(issued.ingestEndpoint).origin);
+	await store.set(urlOriginAccount(issued.workspaceId), new URL(connection).origin);
+	await store.deleteElsewhere(issued.workspaceId);
 	const current = await readUserSettings(settingsPath);
-	if (current.kind === "invalid") return stop$1("saveFailed");
+	if (current.kind === "invalid" || !hasWritableMarketplaces(current.settings)) return stop$1("saveFailed");
 	const env = {
 		HARNESSFORCE_URL: connection,
 		HARNESSFORCE_ENDPOINT: issued.ingestEndpoint,
@@ -9007,8 +9961,10 @@ async function save(issued, connection, settingsPath, sendContent, deps) {
 		OTEL_TRACES_EXPORTER: "otlp",
 		OTEL_EXPORTER_OTLP_PROTOCOL: "http/protobuf"
 	};
-	if (sendContent && issued.contentOptIn) env.OTEL_LOG_USER_PROMPTS = "1";
-	await writeUserSettings(settingsPath, mergeUserSettings(current.settings, env));
+	if (args.sendContent && issued.contentOptIn) env.OTEL_LOG_USER_PROMPTS = "1";
+	const { settings, isOn } = withPluginAutoUpdate(mergeUserSettings(current.settings, env), args.noPluginAutoUpdate);
+	await writeUserSettings(settingsPath, settings);
+	return isOn;
 }
 async function saveCodexConfig(issued, connection, path, sendContent) {
 	await writeCodexConfig(path, mergeCodexConfig(await readCodexConfig(path), {
@@ -9028,27 +9984,46 @@ const DESTINATION_VARIABLES = [
 	"OTEL_EXPORTER_OTLP_METRICS_ENDPOINT"
 ];
 const WITHHELD = "harnessforce: user key withheld (destination not verified)\n";
-async function otelHeaders(env, managedDir, keychain, stdout, stderr) {
-	const selection = await selectKey(env, managedDir, keychain).catch(() => ({ kind: "none" }));
-	if (selection.kind === "withheld") stderr(WITHHELD);
-	if (selection.kind !== "key") return 1;
+const EXIT_KEY_MISSING = 3;
+const EXIT_WITHHELD = 4;
+const EXIT_FAILED = 1;
+async function otelHeaders(env, managedDir, keychain, stdout, stderr, endStdout) {
+	const selection = await selectKey(env, managedDir, keychain).catch(() => ({ kind: "failed" }));
+	if (selection.kind === "withheld") {
+		stderr(WITHHELD);
+		return EXIT_WITHHELD;
+	}
+	if (selection.kind === "missing") return EXIT_KEY_MISSING;
+	if (selection.kind === "failed") return EXIT_FAILED;
 	stdout(`${JSON.stringify({ Authorization: `Bearer ${selection.key}` })}\n`);
+	const { user } = selection;
+	if (user && !env.HARNESSFORCE_NO_MIGRATE) {
+		await endStdout();
+		await user.keychain.migrateFromKernel?.(user.workspaceId).catch(() => {});
+	}
 	return 0;
 }
-async function selectKey(env, managedDir, keychain) {
+const HOOK_READ_TIMEOUT_MS = 1e3;
+async function selectKey(env, managedDir, unlimited) {
 	const managed = await readManagedEnv(managedDir, ["HARNESSFORCE_INGEST_KEY"]);
 	if (managed.HARNESSFORCE_INGEST_KEY) return {
 		kind: "key",
 		key: managed.HARNESSFORCE_INGEST_KEY
 	};
 	const workspaceId = env.HARNESSFORCE_WORKSPACE_ID;
-	if (!workspaceId || !await keychain.isAvailable()) return { kind: "none" };
+	if (!workspaceId) return { kind: "missing" };
+	const keychain = unlimited.withTimeout(HOOK_READ_TIMEOUT_MS);
+	if (!await keychain.isAvailable()) return { kind: "failed" };
 	const key = await keychain.get(ingestKeyAccount(workspaceId));
-	if (!key) return { kind: "none" };
+	if (!key) return { kind: "missing" };
 	const pinnedOrigin = await keychain.get(ingestOriginAccount(workspaceId));
 	return pinnedOrigin && isPinnedDestination(env, pinnedOrigin) ? {
 		kind: "key",
-		key
+		key,
+		user: {
+			keychain,
+			workspaceId
+		}
 	} : { kind: "withheld" };
 }
 function isPinnedDestination(env, pinnedOrigin) {
@@ -9379,16 +10354,16 @@ function buildLaunch(request) {
 //#region src/run/messages.ts
 const RUN_MESSAGES = {
 	keychainUnavailable: INIT_MESSAGES.keychainUnavailable,
-	initRequired: "`harnessforce init`を実行してください",
+	initRequired: "Run `harnessforce init`",
 	invalidUrl: INIT_MESSAGES.invalidUrl,
-	invalidIssue: "Issueの識別子が不正です",
-	issueInitRequired: "Issueを解決できませんでした。`harnessforce init`を実行してください",
-	loginExpired: "ログインの有効期限が切れました。`harnessforce init`を実行してください",
-	issueFailed: "Issueを解決できず、候補も取得できませんでした",
-	noMatch: "一致するIssueがありません",
-	candidatesHeader: "Issueを解決できませんでした。候補:"
+	invalidIssue: "The Issue identifier is invalid",
+	issueInitRequired: "Could not resolve the Issue. Run `harnessforce init`",
+	loginExpired: "Your login has expired. Run `harnessforce init`",
+	issueFailed: "Could not resolve the Issue or fetch candidates",
+	noMatch: "No matching Issue",
+	candidatesHeader: "Could not resolve the Issue. Candidates:"
 };
-const launchFailedMessage = (agent) => `${agent}を起動できませんでした`;
+const launchFailedMessage = (agent) => `Could not start ${agent}`;
 //#endregion
 //#region src/run/run.ts
 const stop = (message) => stopWith(RUN_MESSAGES[message]);
@@ -9397,14 +10372,14 @@ function candidateList(candidates) {
 	const lines = candidates.map(({ identifier, title }) => `${printable(identifier)}  ${printable(title)}`);
 	return [RUN_MESSAGES.candidatesHeader, ...lines].join("\n");
 }
-const ACCESS_MESSAGES$2 = {
+const ACCESS_MESSAGES$1 = {
 	keychainUnavailable: RUN_MESSAGES.keychainUnavailable,
 	initRequired: RUN_MESSAGES.initRequired,
 	invalidUrl: RUN_MESSAGES.invalidUrl,
 	apiTokenMissing: RUN_MESSAGES.issueInitRequired
 };
 async function prepareLaunch(args, deps) {
-	const { workspaceId, ingestEndpoint, readApiBase, accessToken } = await verifyCliAccess(deps, ACCESS_MESSAGES$2);
+	const { workspaceId, ingestEndpoint, readApiBase, accessToken } = await verifyCliAccess(deps, ACCESS_MESSAGES$1);
 	if (!isIssueIdentifier(args.issue)) stop("invalidIssue");
 	const readFetch = createApiTokenSession({
 		keychain: deps.keychain,
@@ -9455,6 +10430,20 @@ function runIssue(args, deps) {
 		return 1;
 	}, deps.stderr);
 }
+async function runWithoutHarnessforce(args, deps) {
+	const env = Object.fromEntries(Object.entries({
+		...deps.env,
+		...deps.restoredEnv
+	}).filter((entry) => entry[1] !== void 0));
+	const outcome = await deps.launch({
+		command: args.agent,
+		args: [...args.agentArgs],
+		env
+	});
+	if (outcome.kind === "exited") return outcome.code;
+	deps.stderr(`${launchFailedMessage(args.agent)}\n`);
+	return 1;
+}
 //#endregion
 //#region src/top/args.ts
 const TOP_USAGE = "Usage: harnessforce top [--once] [--json] [--ascii] [--theme <auto|light|dark|ansi>]\n";
@@ -9690,7 +10679,7 @@ function renderList(sessions, options) {
 		const active = sessions.filter((s) => sessionState(s.lastEventAtMs, options.nowMs) === "active").length;
 		return [clip(`${sessions.length} sessions, ${active} active`, options)];
 	}
-	const body = sessions.length === 0 ? ["直近24時間に記録のあるsessionはありません"].map((t) => clip(t, options)) : options.width >= COMPACT_WIDTH ? table(sessions, options, options.width >= FULL_WIDTH) : shortRows(sessions, options);
+	const body = sessions.length === 0 ? ["No sessions recorded in the last 24 hours"].map((t) => clip(t, options)) : options.width >= COMPACT_WIDTH ? table(sessions, options, options.width >= FULL_WIDTH) : shortRows(sessions, options);
 	return [
 		header(sessions, options),
 		...body,
@@ -9751,7 +10740,7 @@ function renderDetail(row, options) {
 		clip(options.painter.dim(DETAIL_HINT), options)
 	];
 }
-const skippedNotice = (snapshot) => snapshot.skippedLines > 0 || snapshot.skippedFiles > 0 ? [`読めなかった${snapshot.skippedLines}行と${snapshot.skippedFiles}個のファイルを読み飛ばしました`] : [];
+const skippedNotice = (snapshot) => snapshot.skippedLines > 0 || snapshot.skippedFiles > 0 ? [`Skipped ${snapshot.skippedLines} unreadable line(s) and ${snapshot.skippedFiles} unreadable file(s)`] : [];
 //#endregion
 //#region src/top/codex-session.ts
 const DETACHED = "HEAD";
@@ -10366,7 +11355,7 @@ const DEFAULT_SETTINGS = {
 };
 const unreadable = {
 	settings: DEFAULT_SETTINGS,
-	notice: "端末の設定（~/.harnessforce/config.json）を読めないため、既定の表示にします"
+	notice: "Cannot read the device settings (`~/.harnessforce/config.json`), so the default display is used"
 };
 async function readTopSettings(homeDir) {
 	let text;
@@ -10856,7 +11845,9 @@ const median = (values) => {
 	const middle = Math.floor(sorted.length / 2);
 	return sorted.length % 2 === 1 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2;
 };
-const secondsText = (value) => value === null ? "—" : `${value.toFixed(1)}秒`;
+const escapeForTerminal = (text) => text.replace(/[^\x20-\x7e]/gu, (c) => `\\u{${c.codePointAt(0).toString(16)}}`);
+const asciiJson = (value, space) => JSON.stringify(value, null, space).replace(/[^\n\x20-\x7e]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+const secondsText = (value) => value === null ? "—" : `${value.toFixed(1)}s`;
 function summarize(reports, group, kind, countField, medianField) {
 	const values = reports.map((r) => r[group][kind]).filter((v) => v?.measurement === "measured");
 	if (values.length === 0) return void 0;
@@ -10869,16 +11860,16 @@ function summarize(reports, group, kind, countField, medianField) {
 	};
 }
 function renderAnalysis(reports, usages, header) {
-	const lines = [`分析したsession: ${header.sessionCount}件（analyzer ${header.analyzerVersion}、parser ${header.parserVersion}）`, "人の介入（回数、待ち時間のsessionごとの中央値の中央値）:"];
+	const lines = [`Sessions analyzed: ${header.sessionCount} (analyzer ${header.analyzerVersion}, parser ${header.parserVersion})`, "Human interventions (count, median of per-session median wait time):"];
 	for (const kind of INTERVENTION_KINDS) {
 		const s = summarize(reports, "interventions", kind, "count", "wait_seconds_median");
-		lines.push(s === void 0 ? `  ${kind}: 未計測` : `  ${kind}: ${s.total}回、${secondsText(s.median)}`);
+		lines.push(s === void 0 ? `  ${kind}: not measured` : `  ${kind}: ${s.total} time(s), ${secondsText(s.median)}`);
 	}
-	lines.push("ループにできる繰り返し（回数、その間の介入、所要時間の中央値の中央値）:");
+	lines.push("Repeatable loops (count, interventions during them, median of median duration):");
 	for (const kind of LOOP_KINDS) {
 		const s = summarize(reports, "loops", kind, "occurrences", "duration_seconds_median");
 		const interventions = s?.values.reduce((sum, v) => sum + (v.interventions ?? 0), 0) ?? 0;
-		lines.push(s === void 0 ? `  ${kind}: 未計測` : `  ${kind}: ${s.total}回、介入${interventions}回、${secondsText(s.median)}`);
+		lines.push(s === void 0 ? `  ${kind}: not measured` : `  ${kind}: ${s.total} time(s), ${interventions} intervention(s), ${secondsText(s.median)}`);
 	}
 	const servers = /* @__PURE__ */ new Map();
 	for (const report of reports) for (const s of report.mcp_servers) {
@@ -10893,19 +11884,19 @@ function renderAnalysis(reports, usages, header) {
 			configured: current.configured + (s.configured ? 1 : 0)
 		});
 	}
-	lines.push("MCP server（呼び出し、失敗、設定されていたsession）:");
-	if (servers.size === 0) lines.push("  なし");
-	for (const [server, s] of [...servers].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) lines.push(`  ${server}: ${s.calls === null ? "未計測" : `${s.calls}回`}、${s.failures === null ? "未計測" : `${s.failures}回`}、${s.configured}件`);
+	lines.push("MCP servers (calls, failures, sessions where configured):");
+	if (servers.size === 0) lines.push("  none");
+	for (const [server, s] of [...servers].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) lines.push(`  ${escapeForTerminal(server)}: ${s.calls === null ? "not measured" : `${s.calls} call(s)`}, ${s.failures === null ? "not measured" : `${s.failures} failure(s)`}, ${s.configured} session(s)`);
 	lines.push(...renderUsage(usages));
 	return `${lines.join("\n")}\n`;
 }
 const percent = (share) => `${(share * 100).toFixed(1)}%`;
 function renderUsage(usages) {
-	const lines = ["使い方（端末だけの値。送信しません）:"];
+	const lines = ["Usage (this device only; not sent):"];
 	for (const kind of ["frequent_compaction", "low_cache_reuse"]) lines.push(`  ${kind}: ${usages.filter((u) => u.kinds.includes(kind)).length} session`);
 	const shares = modelShares(usages);
-	const parts = shares && [...shares.main.map((m) => `本体 ${m.model} ${percent(m.share)}`), ...shares.subagent.map((m) => `subagent ${m.model} ${percent(m.share)}`)];
-	lines.push(`  model（output_tokensの割合）: ${parts ? parts.join("、") : "なし"}`);
+	const parts = shares && [...shares.main.map((m) => `main ${escapeForTerminal(m.model)} ${percent(m.share)}`), ...shares.subagent.map((m) => `subagent ${escapeForTerminal(m.model)} ${percent(m.share)}`)];
+	lines.push(`  model (share of output_tokens): ${parts ? parts.join(", ") : "none"}`);
 	return lines;
 }
 function localIso(ms) {
@@ -11026,7 +12017,7 @@ const LOCK_WAIT_MS = 3e4;
 const STALE_LOCK_MS = 6e4;
 const HEARTBEAT_MS = 1e4;
 const RETRY_INTERVAL_MS = 100;
-const FILE_MODE$2 = 384;
+const FILE_MODE$1 = 384;
 const isAlreadyExists = (error) => error?.code === "EEXIST";
 async function removeIfStale(path, now) {
 	const current = await stat(path).catch(() => void 0);
@@ -11036,7 +12027,7 @@ async function acquireTuneLock(path, deps) {
 	const deadline = deps.now() + LOCK_WAIT_MS;
 	while (deps.now() < deadline) {
 		try {
-			const handle = await open(path, "wx", FILE_MODE$2);
+			const handle = await open(path, "wx", FILE_MODE$1);
 			const token = randomUUID();
 			await handle.writeFile(token);
 			await handle.close();
@@ -11081,33 +12072,33 @@ const NOTICE_ORDER = [
 ];
 const TUNE_MESSAGES = {
 	keychainUnavailable: INIT_MESSAGES.keychainUnavailable,
-	initRequired: "`harnessforce init`を実行してください。Viewerのロールでは`harnessforce tune`を利用できません",
-	invalidUrl: "接続先のURLが不正です",
-	locked: "別の`harnessforce tune`が実行中のため、実行できません",
-	insufficient: (count) => `データ不足: 分析したセッションは${count}件です。提案には10件以上が必要です（あと${10 - count}件）`,
-	outOfRange: (days, count) => `送信の範囲外: 開始が${days}日より前の${count}件のセッションは送信しません`,
-	notConnected: (count) => `接続済みでないリポジトリの${count}件のセッションは送信しません`,
-	partlyUnreadable: (lines, skipped) => `記録の一部を読めていない: 読んだ${lines}行のうち${skipped}行を読み飛ばしました`,
-	savedList: (fetchedAt) => `接続済みのリポジトリの一覧を取得できないため、${fetchedAt}に保存した一覧を使います`,
-	noList: "接続済みのリポジトリを確認できないため送信しません",
-	noSend: "送信しない設定のため、分析結果を送信しません",
-	settingUnreadable: "端末の設定（`~/.harnessforce/config.json`）を読めないため、分析結果を送信しません",
-	importLimited: (count) => `月間イベント数の上限または閲覧のみのため、${count}件のセッションを取り込めませんでした。分析結果は送信し、取り込みは解除の後の実行でやり直します`,
-	importFailed: "送信の前のセッションの取り込みに失敗しました。分析結果は送信し、取り込みは次の実行でやり直します",
-	sent: (count) => `${count}件の分析結果を送信しました`,
-	unreachable: (count) => `Harnessforceへ送信できませんでした。${count}件の分析結果は次の実行で送ります`,
-	expiredUnsent: (count) => `送信の範囲外になった未送信の分析結果${count}件を削除しました`,
-	readOnly: (count) => `Workspaceが閲覧のみのため、${count}件の分析結果を送信できませんでした。次の実行で送ります`,
-	invalidReports: (count, reasons) => `形式が不正なため${count}件の分析結果を送信せずに削除しました（${reasons.join("、")}）`,
-	rejected: (status, count) => `Harnessforceが送信を拒否しました（HTTP ${status}）。${count}件の分析結果を送信せずに削除しました`,
-	keyUnusable: (count) => `送信キーを使えません。未送信の分析結果${count}件を削除しました。\`harnessforce init\`を実行してください`,
-	loginExpired: "ログインの有効期限が切れました。`harnessforce init`を実行してください",
-	unwritable: "`~/.harnessforce/tune/`に書き込めないため、分析結果を送信しません",
-	recordFailed: "提案を記録できませんでした",
-	recordInvalid: (field) => `提案の記録の入力が不正です: ${field}`,
-	usage: "使い方: harnessforce tune [--all] [--no-send] [--show-report] [--json] ｜ harnessforce tune record ｜ harnessforce tune --purge",
-	purged: "`~/.harnessforce/tune/`の分析結果、提案、未送信の分析結果を削除しました",
-	purgeFailed: "`~/.harnessforce/tune/`の一部のファイルを削除できませんでした"
+	initRequired: "Run `harnessforce init`. The Viewer role cannot use `harnessforce tune`",
+	invalidUrl: "The connection URL is invalid",
+	locked: "Another `harnessforce tune` is running, so this run cannot start",
+	insufficient: (count) => `Not enough data: ${count} session(s) analyzed. Suggestions need at least 10 (${10 - count} more needed)`,
+	outOfRange: (days, count) => `Outside the sending range: ${count} session(s) that started more than ${days} days ago will not be sent`,
+	notConnected: (count) => `${count} session(s) in repositories that are not connected will not be sent`,
+	partlyUnreadable: (lines, skipped) => `Some records could not be read: skipped ${skipped} of ${lines} lines read`,
+	savedList: (fetchedAt) => `Could not fetch the list of connected repositories, so the list saved at ${fetchedAt} is used`,
+	noList: "Could not verify the connected repositories, so nothing is sent",
+	noSend: "Sending is turned off, so the analysis results are not sent",
+	settingUnreadable: "Cannot read the device settings (`~/.harnessforce/config.json`), so the analysis results are not sent",
+	importLimited: (count) => `Could not import ${count} session(s) because of the monthly event limit or view-only mode. The analysis results are sent; importing is retried in a run after the restriction is lifted`,
+	importFailed: "Importing sessions before sending failed. The analysis results are sent; importing is retried in the next run",
+	sent: (count) => `Sent ${count} analysis result(s)`,
+	unreachable: (count) => `Could not send to Harnessforce. ${count} analysis result(s) will be sent in the next run`,
+	expiredUnsent: (count) => `Deleted ${count} unsent analysis result(s) that fell outside the sending range`,
+	readOnly: (count) => `Could not send ${count} analysis result(s) because the Workspace is view-only. They will be sent in the next run`,
+	invalidReports: (count, reasons) => `Deleted ${count} analysis result(s) without sending because their format is invalid (${reasons.join(", ")})`,
+	rejected: (status, count) => `Harnessforce rejected the submission (HTTP ${status}). Deleted ${count} analysis result(s) without sending`,
+	keyUnusable: (count) => `The ingest key cannot be used. Deleted ${count} unsent analysis result(s). Run \`harnessforce init\``,
+	loginExpired: "Your login has expired. Run `harnessforce init`",
+	unwritable: "Cannot write to `~/.harnessforce/tune/`, so the analysis results are not sent",
+	recordFailed: "Could not record the suggestion",
+	recordInvalid: (field) => `The suggestion record input is invalid: ${field}`,
+	usage: "Usage: harnessforce tune [--all] [--no-send] [--show-report] [--json], harnessforce tune record, or harnessforce tune --purge",
+	purged: "Deleted the analysis results, suggestions and unsent analysis results in `~/.harnessforce/tune/`",
+	purgeFailed: "Could not delete some files in `~/.harnessforce/tune/`"
 };
 var Notices = class {
 	entries = /* @__PURE__ */ new Map();
@@ -11148,7 +12139,7 @@ const tunePaths = (homeDir) => {
 	};
 };
 const DIR_MODE = 448;
-const FILE_MODE$1 = 384;
+const FILE_MODE = 384;
 const destinationKey = ({ workspaceId, endpoint }) => `${workspaceId} ${endpoint}`;
 async function readJsonFile(path) {
 	try {
@@ -11168,10 +12159,10 @@ async function writeFileAtomic(path, content) {
 	const temporary = `${path}.${randomUUID()}.tmp`;
 	try {
 		await writeFile(temporary, content, {
-			mode: FILE_MODE$1,
+			mode: FILE_MODE,
 			flag: "wx"
 		});
-		await chmod(temporary, FILE_MODE$1);
+		await chmod(temporary, FILE_MODE);
 		await rename(temporary, path);
 	} finally {
 		await rm(temporary, { force: true });
@@ -11461,7 +12452,7 @@ async function readSendSetting(homeDir) {
 const DAY_MS = 864e5;
 const DEFAULT_RANGE_DAYS = 30;
 const SKIPPED_RATIO = .05;
-const ACCESS_MESSAGES$1 = {
+const ACCESS_MESSAGES = {
 	keychainUnavailable: TUNE_MESSAGES.keychainUnavailable,
 	initRequired: TUNE_MESSAGES.initRequired,
 	invalidUrl: TUNE_MESSAGES.invalidUrl,
@@ -11697,14 +12688,14 @@ async function analyzeUnderLock(options, access, paths, deps) {
 		writeSessionConfigs(paths.sessionConfigs, configs)
 	]).then(() => true, () => false);
 	if (!isWritten) notices.add("unwritable", TUNE_MESSAGES.unwritable, 1);
-	if (options.json) deps.stdout(`${JSON.stringify(output)}\n`);
+	if (options.json) deps.stdout(`${asciiJson(output)}\n`);
 	else {
 		deps.stdout(renderAnalysis(analyzed.map((a) => a.report), analyzed.map((a) => a.tune.usage), {
 			sessionCount: analyzed.length,
 			analyzerVersion: ANALYZER_VERSION,
 			parserVersion: PARSER_VERSION
 		}));
-		if (options.showReport) deps.stdout(`${JSON.stringify(analyzed.filter((a) => a.sendable === true).map((a) => a.report), null, 2)}\n`);
+		if (options.showReport) deps.stdout(`${asciiJson(analyzed.filter((a) => a.sendable === true).map((a) => a.report), 2)}\n`);
 	}
 	if (analyzed.length < 10) notices.add("insufficient", TUNE_MESSAGES.insufficient(analyzed.length));
 	const lines = analyzed.reduce((sum, a) => sum + a.tune.lines, 0);
@@ -11727,7 +12718,7 @@ async function analyzeUnderLock(options, access, paths, deps) {
 }
 function analyzeCommand(options, deps) {
 	return runUntilStop(async () => {
-		const access = await verifyCliAccess(deps, ACCESS_MESSAGES$1);
+		const access = await verifyCliAccess(deps, ACCESS_MESSAGES);
 		const paths = tunePaths(deps.homeDir);
 		await ensureDir(paths.dir).catch(() => stopWith(TUNE_MESSAGES.unwritable));
 		const release = await acquireTuneLock(paths.lock, deps).catch(() => stopWith(TUNE_MESSAGES.unwritable));
@@ -11856,7 +12847,7 @@ const sha256 = (text) => createHash("sha256").update(Buffer.from(text, "utf8")).
 function expectedHash(input, component) {
 	if (component !== null && VALUE_KINDS.has(component.kind)) {
 		if (!("value" in input)) return invalid("value");
-		return hashValue(input.value);
+		return hashValue(hashInput(component.kind, input.value));
 	}
 	if (typeof input.content !== "string") return invalid("content");
 	return hashFileContent(Buffer.from(input.content, "utf8"));
@@ -11963,6 +12954,10 @@ function parseArgs(args) {
 		options
 	};
 }
+function canTuneSend(args) {
+	const parsed = parseArgs(args);
+	return parsed?.kind === "analyze" && !parsed.options.noSend;
+}
 async function underLock(deps, failure, body) {
 	return runUntilStop(async () => {
 		const paths = tunePaths(deps.homeDir);
@@ -12016,464 +13011,14 @@ async function tuneCommand(args, deps) {
 	return analyzeCommand(parsed.options, deps);
 }
 //#endregion
-//#region src/usage-limits/consent.ts
-const consentUrl = (base) => underBase(base, "api/v1/cli/usage-limits/consent");
-async function call(base, fetchImpl, method, body) {
-	try {
-		return await fetchImpl(consentUrl(base), {
-			method,
-			headers: {
-				accept: "application/json",
-				...body ? { "content-type": "application/json" } : {}
-			},
-			...body ? { body: JSON.stringify(body) } : {},
-			redirect: "manual",
-			signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
-		});
-	} catch {
-		return;
-	}
-}
-async function readConsent(base, fetchImpl) {
-	const response = await call(base, fetchImpl, "GET");
-	if (response?.status === 401) return { kind: "unauthorized" };
-	if (response?.status !== 200) return { kind: "failed" };
-	const body = await readJsonObjectBody(response);
-	if (typeof body?.workspace_opted_in !== "boolean" || typeof body.shared !== "boolean" || typeof body.current_text_version !== "number") return { kind: "failed" };
-	return {
-		kind: "ok",
-		state: {
-			workspaceOptedIn: body.workspace_opted_in,
-			shared: body.shared,
-			currentTextVersion: body.current_text_version
-		}
-	};
-}
-async function recordConsent(base, fetchImpl, textVersion) {
-	const response = await call(base, fetchImpl, "PUT", { text_version: textVersion });
-	if (!response) return { kind: "failed" };
-	if (response.status === 204) return { kind: "ok" };
-	if (response.status === 401) return { kind: "unauthorized" };
-	const body = await readJsonObjectBody(response);
-	if (response.status === 400 && body?.code === "invalid_text_version") return { kind: "invalid_text_version" };
-	if (response.status === 403) return body?.code === "workspace_read_only" ? { kind: "read_only" } : { kind: "viewer" };
-	return { kind: "failed" };
-}
-async function revokeConsent(base, fetchImpl) {
-	const response = await call(base, fetchImpl, "DELETE");
-	if (response?.status === 204) return { kind: "ok" };
-	return response?.status === 401 ? { kind: "unauthorized" } : { kind: "failed" };
-}
-//#endregion
-//#region src/usage-limits/files.ts
-const DIRECTORY_MODE = 448;
-const FILE_MODE = 384;
-const markPath = (homeDir) => join(homeDir, ".harnessforce", "usage-limits.json");
-const statePath = (homeDir) => join(homeDir, ".harnessforce", "usage-limits-state.json");
-async function readJson(path) {
-	try {
-		return JSON.parse(await readFile(path, "utf8"));
-	} catch {
-		return;
-	}
-}
-async function readMark(homeDir) {
-	const value = await readJson(markPath(homeDir));
-	if (!isObject(value)) return void 0;
-	const { consented, text_version: textVersion, original } = value;
-	if (typeof consented !== "boolean" || typeof textVersion !== "number" || !(original === null || isObject(original))) return void 0;
-	return {
-		consented,
-		text_version: textVersion,
-		original
-	};
-}
-async function readSendState(homeDir) {
-	const value = await readJson(statePath(homeDir));
-	if (!isObject(value) || typeof value.sent_at !== "number") return void 0;
-	const resets = value.resets_at;
-	if (!isObject(resets)) return void 0;
-	const entries = Object.entries(resets);
-	if (entries.some(([, at]) => typeof at !== "number")) return void 0;
-	return {
-		sent_at: value.sent_at,
-		resets_at: Object.fromEntries(entries)
-	};
-}
-async function writeOwnerOnly(path, value) {
-	await mkdir(dirname(path), {
-		recursive: true,
-		mode: DIRECTORY_MODE
-	});
-	const temporary = `${path}.${randomUUID()}.tmp`;
-	try {
-		await writeFile(temporary, `${JSON.stringify(value)}\n`, {
-			mode: FILE_MODE,
-			flag: "wx"
-		});
-		await chmod(temporary, FILE_MODE);
-		await rename(temporary, path);
-	} finally {
-		await rm(temporary, { force: true });
-	}
-}
-const writeSendState = (homeDir, state) => writeOwnerOnly(statePath(homeDir), state);
-const writeMark = (homeDir, mark) => writeOwnerOnly(markPath(homeDir), mark);
-async function removeMarkAndState(homeDir) {
-	await rm(markPath(homeDir), { force: true });
-	await rm(statePath(homeDir), { force: true });
-}
-//#endregion
-//#region src/usage-limits/messages.ts
-const CONSENT_TEXT = {
-	ja: "あなたの名前とともに、あなたの利用枠（5時間・7日などの窓の使用率とリセット時刻だけ）を、このWorkspaceのメンバー全員が見られます。プロンプトなどの本文は送りません。いつでもやめられ、やめると保存済みの値も削除します。メンバーの順位づけには使いません。",
-	en: "Everyone in this workspace can see your usage limits together with your name (only the usage percentage and reset time of each window, such as 5 hours and 7 days). No prompt or other content is sent. You can stop at any time, and stopping deletes the stored values. They are not used to rank members."
-};
-const CONSENT_PROMPT = {
-	ja: "同意しますか? [y/N] ",
-	en: "Do you agree? [y/N] "
-};
-const MESSAGES = {
-	windows: "この版のWindowsでは、利用枠の共有を設定できません",
-	settingsUnreadable: "Claude Codeのuser settingsを読めません",
-	statusLineUnsupported: "このstatusLineは組み込めません",
-	noUserKey: "この端末には利用者用の送信キーがありません。`harnessforce init`を実行してください",
-	keychainUnavailable: "OSのキーチェーンを利用できないため、利用枠の共有を設定できません",
-	invalidUrl: "接続先のURLが不正です",
-	loginExpired: "ログインの有効期限が切れました。`harnessforce init`をもう一度実行してください",
-	notAgreed: "同意されなかったため、何も変えませんでした",
-	invalidTextVersion: "このCLIの利用枠の文面が古いか新しすぎます。`harnessforce`を更新してください",
-	viewer: "閲覧のみのロールでは、利用枠を共有できません。Workspaceの管理者に連絡してください",
-	readOnly: "このWorkspaceは閲覧のみのため、利用枠の共有を設定できません",
-	failed: "Harnessforceとの通信に失敗しました。もう一度お試しください",
-	saveFailed: "端末の設定を書き込めなかったため、同意を取り消しました。もう一度お試しください",
-	revokeFailedAfterSave: "端末の設定を書き込めず、同意の取り消しにも失敗しました。`harnessforce usage-limits status`で状態を確かめ、`harnessforce usage-limits off`を実行してください",
-	notOptedIn: "同意を記録しました。Workspaceが利用枠の記録をopt-inするまで、値は保存されません",
-	enabled: "利用枠の共有を有効にしました。Claude Codeを再起動すると反映されます",
-	disabled: "利用枠の共有をやめ、保存済みの値の削除を依頼しました",
-	revokedButNotRestored: "同意は撤回しましたが、statusLineを元に戻せませんでした。`harnessforce usage-limits off`をもう一度実行してください",
-	usage: "Usage: harnessforce usage-limits on [--yes] | harnessforce usage-limits off | harnessforce usage-limits status | harnessforce usage-limits statusline\n"
-};
-const STATUS_LABELS = {
-	consent: {
-		shared: "同意している",
-		notShared: "同意していない",
-		outdated: "文面が古い",
-		unknown: "確認できません"
-	},
-	optIn: {
-		on: "有効",
-		off: "無効",
-		unknown: "確認できません"
-	},
-	statusLine: {
-		embeddedWithOriginal: "組み込まれている（元のcommandあり）",
-		embeddedWithoutOriginal: "組み込まれている（元のcommandなし）",
-		notEmbedded: "組み込まれていない"
-	}
-};
-//#endregion
-//#region src/usage-limits/statusline-settings.ts
-const STATUSLINE_COMMAND = "harnessforce usage-limits statusline";
-const isEmbedded = (statusLine) => isObject(statusLine) && statusLine.command === STATUSLINE_COMMAND;
-function canEmbed(settings) {
-	const { statusLine } = settings;
-	if (statusLine === void 0) return true;
-	return isObject(statusLine) && statusLine.type === "command" && typeof statusLine.command === "string";
-}
-function originalFor(settings, mark) {
-	const { statusLine } = settings;
-	if (isEmbedded(statusLine)) return mark ? mark.original : null;
-	return isObject(statusLine) ? statusLine : null;
-}
-function embedStatusLine(settings) {
-	const { statusLine } = settings;
-	if (isEmbedded(statusLine)) return settings;
-	return {
-		...settings,
-		statusLine: isObject(statusLine) ? {
-			...statusLine,
-			command: STATUSLINE_COMMAND
-		} : {
-			type: "command",
-			command: STATUSLINE_COMMAND
-		}
-	};
-}
-function restoreStatusLine(settings, original) {
-	if (!isEmbedded(settings.statusLine)) return settings;
-	const { statusLine: _embedded, ...rest } = settings;
-	return original === null ? rest : {
-		...settings,
-		statusLine: original
-	};
-}
-const isStatusLineEmbedded = (settings) => isEmbedded(settings.statusLine);
-//#endregion
-//#region src/usage-limits/manage.ts
-const ACCESS_MESSAGES = {
-	keychainUnavailable: MESSAGES.keychainUnavailable,
-	initRequired: MESSAGES.noUserKey,
-	invalidUrl: MESSAGES.invalidUrl,
-	apiTokenMissing: MESSAGES.noUserKey
-};
-function language(env) {
-	return (env.LC_ALL || env.LC_MESSAGES || env.LANG || "").toLowerCase().startsWith("ja") ? "ja" : "en";
-}
-function consentClient(deps, access) {
-	const authorized = createApiTokenSession({
-		keychain: deps.keychain,
-		workspaceId: access.workspaceId,
-		readBase: access.readApiBase,
-		fetch: deps.fetch,
-		now: () => deps.now().getTime(),
-		sleep: deps.sleep,
-		homeDir: deps.homeDir
-	}).authorizedFetch(deps.fetch);
-	const base = access.readApiBase;
-	return {
-		read: () => readConsent(base, authorized),
-		record: () => recordConsent(base, authorized, 1),
-		revoke: () => revokeConsent(base, authorized)
-	};
-}
-const settingsPathOf = (deps) => userSettingsPath(deps.env, deps.homeDir);
-async function runOn(yes, deps) {
-	if (deps.platform === "win32") return stopWith(MESSAGES.windows);
-	const client = consentClient(deps, await verifyCliAccess(deps, ACCESS_MESSAGES));
-	const read = await readUserSettings(settingsPathOf(deps));
-	if (read.kind === "invalid") return stopWith(MESSAGES.settingsUnreadable);
-	if (!canEmbed(read.settings)) return stopWith(MESSAGES.statusLineUnsupported);
-	const settings = read.settings;
-	const before = await client.read();
-	const lang = language(deps.env);
-	deps.stdout(`${CONSENT_TEXT[lang]}\n`);
-	if (!yes && (await deps.ask(CONSENT_PROMPT[lang])).trim() !== "y") return stopWith(MESSAGES.notAgreed);
-	const recorded = await client.record();
-	if (recorded.kind === "unauthorized") return stopWith(MESSAGES.loginExpired);
-	if (recorded.kind === "invalid_text_version") return stopWith(MESSAGES.invalidTextVersion);
-	if (recorded.kind === "viewer") return stopWith(MESSAGES.viewer);
-	if (recorded.kind === "read_only") return stopWith(MESSAGES.readOnly);
-	if (recorded.kind === "failed") return stopWith(MESSAGES.failed);
-	const mark = await readMark(deps.homeDir);
-	const undo = async () => {
-		await (mark ? writeMark(deps.homeDir, {
-			...mark,
-			consented: false
-		}) : removeMarkAndState(deps.homeDir)).catch(() => {});
-		const revoked = await client.revoke();
-		return stopWith(revoked.kind === "ok" ? MESSAGES.saveFailed : MESSAGES.revokeFailedAfterSave);
-	};
-	try {
-		await writeMark(deps.homeDir, {
-			consented: true,
-			text_version: 1,
-			original: originalFor(settings, mark)
-		});
-	} catch {
-		return undo();
-	}
-	try {
-		await writeUserSettings(settingsPathOf(deps), embedStatusLine(settings));
-	} catch {
-		return undo();
-	}
-	const optedOut = before.kind === "ok" && !before.state.workspaceOptedIn;
-	deps.stdout(`${optedOut ? MESSAGES.notOptedIn : MESSAGES.enabled}\n`);
-	return 0;
-}
-async function runOff(deps) {
-	const revoked = await consentClient(deps, await verifyCliAccess(deps, ACCESS_MESSAGES)).revoke();
-	if (revoked.kind === "unauthorized") return stopWith(MESSAGES.loginExpired);
-	if (revoked.kind === "failed") return stopWith(MESSAGES.failed);
-	const mark = await readMark(deps.homeDir);
-	const read = await readUserSettings(settingsPathOf(deps));
-	const keepWithoutConsent = async () => {
-		if (mark) await writeMark(deps.homeDir, {
-			...mark,
-			consented: false
-		}).catch(() => {});
-		return stopWith(MESSAGES.revokedButNotRestored);
-	};
-	if (read.kind === "invalid") return keepWithoutConsent();
-	if (isStatusLineEmbedded(read.settings)) try {
-		await writeUserSettings(settingsPathOf(deps), restoreStatusLine(read.settings, mark?.original ?? null));
-	} catch {
-		return keepWithoutConsent();
-	}
-	await removeMarkAndState(deps.homeDir).catch(() => {});
-	deps.stdout(`${MESSAGES.disabled}\n`);
-	return 0;
-}
-function consentLabel(result, mark) {
-	if (result.kind !== "ok") return STATUS_LABELS.consent.unknown;
-	if (result.state.shared) return STATUS_LABELS.consent.shared;
-	return mark?.consented === true && mark.text_version !== result.state.currentTextVersion ? STATUS_LABELS.consent.outdated : STATUS_LABELS.consent.notShared;
-}
-async function runStatus(deps) {
-	const mark = await readMark(deps.homeDir);
-	const read = await readUserSettings(settingsPathOf(deps));
-	const statusLine = !(read.kind === "ok" && isStatusLineEmbedded(read.settings)) ? STATUS_LABELS.statusLine.notEmbedded : mark?.original ? STATUS_LABELS.statusLine.embeddedWithOriginal : STATUS_LABELS.statusLine.embeddedWithoutOriginal;
-	const result = await readRemote(deps);
-	deps.stdout([
-		`本人の同意: ${consentLabel(result, mark)}`,
-		`Workspaceのopt-in: ${result.kind !== "ok" ? STATUS_LABELS.optIn.unknown : result.state.workspaceOptedIn ? STATUS_LABELS.optIn.on : STATUS_LABELS.optIn.off}`,
-		`statusLineの組み込み: ${statusLine}`,
-		""
-	].join("\n"));
-	return 0;
-}
-async function readRemote(deps) {
-	try {
-		return await consentClient(deps, await verifyCliAccess(deps, ACCESS_MESSAGES)).read();
-	} catch (error) {
-		if (isStop(error)) return { kind: "failed" };
-		throw error;
-	}
-}
-function onCommand(yes, deps) {
-	return runUntilStop(() => runOn(yes, deps), deps.stderr);
-}
-function offCommand(deps) {
-	return runUntilStop(() => runOff(deps), deps.stderr);
-}
-const statusCommand = runStatus;
-//#endregion
-//#region src/usage-limits/summary.ts
-const WINDOWS = [{
-	name: "five_hour",
-	minutes: 300
-}, {
-	name: "seven_day",
-	minutes: 10080
-}];
-const MIN_SEND_INTERVAL_MS = 3e5;
-const instant = (ms) => new Date(ms).toISOString().replace(".000Z", "Z");
-function windowFrom(value, minutes, nowMs) {
-	if (!isObject(value)) return void 0;
-	const { used_percentage: used, resets_at: resetsAt } = value;
-	if (typeof used !== "number" || !(used >= 0 && used <= 100)) return void 0;
-	if (typeof resetsAt !== "number" || !Number.isFinite(resetsAt)) return void 0;
-	const resetsAtMs = Math.floor(resetsAt) * 1e3;
-	if (resetsAtMs <= nowMs) return void 0;
-	return {
-		window_minutes: minutes,
-		used_percent: used,
-		resets_at: instant(resetsAtMs)
-	};
-}
-function summaryFrom(stdin, nowMs) {
-	let json;
-	try {
-		json = JSON.parse(stdin);
-	} catch {
-		return;
-	}
-	const limits = isObject(json) ? json.rate_limits : void 0;
-	if (!isObject(limits)) return void 0;
-	const windows = WINDOWS.flatMap(({ name, minutes }) => {
-		const window = windowFrom(limits[name], minutes, nowMs);
-		return window ? [window] : [];
-	});
-	return windows.length === 0 ? void 0 : {
-		agent: "claude_code",
-		observed_at: instant(Math.floor(nowMs / 1e3) * 1e3),
-		windows
-	};
-}
-const resetSeconds = (window) => Date.parse(window.resets_at) / 1e3;
-function isDue(summary, state, nowMs) {
-	if (!state) return true;
-	return summary.windows.some((window) => state.resets_at[String(window.window_minutes)] !== resetSeconds(window)) || nowMs - state.sent_at >= MIN_SEND_INTERVAL_MS;
-}
-const stateFor = (summary, nowMs) => ({
-	sent_at: nowMs,
-	resets_at: Object.fromEntries(summary.windows.map((window) => [String(window.window_minutes), resetSeconds(window)]))
-});
-function parseSummary(raw) {
-	let value;
-	try {
-		value = JSON.parse(raw);
-	} catch {
-		return;
-	}
-	if (!isObject(value) || value.agent !== "claude_code") return void 0;
-	const { observed_at: observedAt, windows } = value;
-	if (typeof observedAt !== "string" || !Array.isArray(windows)) return void 0;
-	const rebuilt = windows.flatMap((window) => {
-		if (!isObject(window)) return [];
-		const { window_minutes: minutes, used_percent: used } = window;
-		const resetsAt = window.resets_at;
-		return WINDOWS.some((w) => w.minutes === minutes) && typeof minutes === "number" && typeof used === "number" && used >= 0 && used <= 100 && typeof resetsAt === "string" && !Number.isNaN(Date.parse(resetsAt)) ? [{
-			window_minutes: minutes,
-			used_percent: used,
-			resets_at: resetsAt
-		}] : [];
-	});
-	return rebuilt.length > 0 && rebuilt.length === windows.length ? {
-		agent: "claude_code",
-		observed_at: observedAt,
-		windows: rebuilt
-	} : void 0;
-}
-//#endregion
-//#region src/usage-limits/send.ts
-const SEND_TIMEOUT_MS = 5e3;
-async function sendUsageLimits(raw, deps) {
-	const summary = parseSummary(raw);
-	if (!summary) return 0;
-	const mark = await readMark(deps.homeDir);
-	if (!mark?.consented || mark.text_version !== 1) return 0;
-	const resolved = await resolveUserDestination(deps).catch(() => void 0);
-	if (resolved?.kind !== "ok") return 0;
-	await postItem(resolved.destination, "v1/usage-limits", summary, deps.fetch, SEND_TIMEOUT_MS);
-	return 0;
-}
-//#endregion
-//#region src/usage-limits/statusline.ts
-const MAX_INPUT_BYTES = Number.MAX_SAFE_INTEGER;
-function originalCommand(original) {
-	const command = original?.command;
-	return isObject(original) && typeof command === "string" && command !== "" ? command : void 0;
-}
-async function statusline(deps) {
-	const input = await deps.readStdin(MAX_INPUT_BYTES).catch(() => Buffer.alloc(0));
-	const mark = await readMark(deps.homeDir);
-	const command = originalCommand(mark?.original ?? null);
-	const code = command ? await deps.runOriginal(command, input) : void 0;
-	await sendIfDue(deps, input, mark).catch(() => {});
-	return code ?? 0;
-}
-async function sendIfDue(deps, input, mark) {
-	if (!mark?.consented || mark.text_version !== 1) return;
-	const nowMs = deps.now().getTime();
-	const summary = summaryFrom(input.toString("utf8"), nowMs);
-	if (!summary) return;
-	if (!isDue(summary, await readSendState(deps.homeDir), nowMs)) return;
-	await writeSendState(deps.homeDir, stateFor(summary, nowMs));
-	deps.spawnSender(JSON.stringify(summary));
-}
-//#endregion
-//#region src/usage-limits/command.ts
-async function usageLimitsCommand(args, deps) {
-	const [subcommand, payload] = args;
-	if (subcommand === "statusline" && args.length === 1) return statusline(deps);
-	if (subcommand === "send" && payload !== void 0 && args.length === 2) return sendUsageLimits(payload, deps);
-	const isYes = args[1] === "--yes";
-	if (subcommand === "on" && (args.length === 1 || args.length === 2 && isYes)) return onCommand(isYes, deps);
-	if (subcommand === "off" && args.length === 1) return offCommand(deps);
-	if (subcommand === "status" && args.length === 1) return statusCommand(deps);
-	deps.stderr(MESSAGES.usage);
-	return 1;
-}
-//#endregion
 //#region src/main.ts
 const { version } = createRequire(import.meta.url)("../package.json");
-const USAGE = "Usage: harnessforce --version | harnessforce init [--url <base URL>] [--port <port>] [--send-content] | harnessforce import | harnessforce otel-headers | harnessforce run --issue <identifier> -- <agent> [args] | harnessforce tune [--all] [--no-send] [--show-report] [--json] | harnessforce tune record | harnessforce tune --purge | harnessforce hook session-start | harnessforce top [--once] [--json] [--ascii] [--theme <auto|light|dark|ansi>] | harnessforce usage-limits on [--yes] | harnessforce usage-limits off | harnessforce usage-limits status | harnessforce usage-limits statusline\n";
+const EXIT_CLIENT_UNSUPPORTED = 5;
 function parseInitArgs(args) {
 	let url;
 	let port;
 	let sendContent = false;
+	let noPluginAutoUpdate = false;
 	for (let i = 0; i < args.length;) {
 		if (args[i] === "--url") {
 			if (url !== void 0 || args[i + 1] === void 0) return void 0;
@@ -12496,12 +13041,19 @@ function parseInitArgs(args) {
 			i += 1;
 			continue;
 		}
+		if (args[i] === "--no-plugin-auto-update") {
+			if (noPluginAutoUpdate) return void 0;
+			noPluginAutoUpdate = true;
+			i += 1;
+			continue;
+		}
 		return;
 	}
 	return {
 		url,
 		port,
-		sendContent
+		sendContent,
+		noPluginAutoUpdate
 	};
 }
 function parseRunArgs(args) {
@@ -12514,55 +13066,94 @@ function parseRunArgs(args) {
 	} : void 0;
 }
 async function run(argv, deps) {
+	const help = resolveHelp(argv);
+	if (help !== void 0) {
+		deps.stdout(help);
+		return 0;
+	}
 	const [command, ...rest] = argv;
 	if (command === "--version" && rest.length === 0) {
 		deps.stdout(`${version}\n`);
 		return 0;
 	}
-	if (command === "otel-headers" && rest.length === 0) return otelHeaders(deps.env, deps.managedDir, deps.keychain, deps.stdout, deps.stderr);
-	if (command === "import" && rest.length === 0) return importCommand({
-		...deps,
-		git: deps.importGit,
-		now: () => deps.now().getTime()
-	});
-	if (command === "tune") return tuneCommand(rest, {
+	const client = {
+		component: "cli",
+		version,
+		dev: deps.devBuild
+	};
+	const cli = {
 		...deps,
-		git: deps.importGit,
-		now: () => deps.now().getTime()
-	});
+		fetch: recordingFetch(deps.fetch, client, updateStatePath(deps.homeDir), deps.now)
+	};
+	const updateDeps = {
+		...cli,
+		client
+	};
+	const unsupported = async () => (await readCliUpdateState(deps.homeDir, version))?.status === "unsupported";
+	const guarded = async (command) => {
+		if (await isSendingBlocked(updateDeps)) {
+			await noticeUpdate(updateDeps);
+			return 1;
+		}
+		const code = await command();
+		await noticeUpdate(updateDeps);
+		return code;
+	};
+	if (command === "otel-headers" && rest.length === 0) {
+		if (await unsupported()) return EXIT_CLIENT_UNSUPPORTED;
+		return otelHeaders(cli.env, cli.managedDir, cli.keychain, cli.stdout, cli.stderr, cli.endStdout);
+	}
+	if (command === "import" && rest.length === 0) return guarded(() => importCommand({
+		...cli,
+		git: cli.importGit,
+		now: () => cli.now().getTime()
+	}));
+	if (command === "tune") return guarded(() => tuneCommand(rest, {
+		...cli,
+		git: cli.importGit,
+		now: () => cli.now().getTime()
+	}));
 	if (command === "hook") {
 		if (rest.length !== 1 || rest[0] !== "session-start") {
-			deps.stderr(HOOK_USAGE);
+			cli.stderr(HOOK_USAGE);
 			return 1;
 		}
 		return sessionStart({
-			env: deps.env,
-			homeDir: deps.homeDir,
-			now: deps.now,
-			git: deps.hookGit,
-			fetch: deps.fetch,
-			keychain: deps.keychain,
-			readStdin: deps.readStdin,
-			stdout: deps.stdout,
-			stderr: deps.stderr
+			env: cli.env,
+			homeDir: cli.homeDir,
+			now: cli.now,
+			git: cli.hookGit,
+			fetch: cli.fetch,
+			keychain: cli.keychain,
+			readStdin: cli.readStdin,
+			stdout: cli.stdout,
+			stderr: cli.stderr,
+			client,
+			defaultUrl: cli.defaultUrl
 		});
 	}
 	if (command === "top") return topCommand(rest, {
-		homeDir: deps.homeDir,
-		managedDir: deps.managedDir,
-		env: deps.env,
-		stdout: deps.stdout,
-		stderr: deps.stderr,
-		now: () => deps.now().getTime(),
-		git: deps.importGit,
-		top: deps.top
+		homeDir: cli.homeDir,
+		managedDir: cli.managedDir,
+		env: cli.env,
+		stdout: cli.stdout,
+		stderr: cli.stderr,
+		now: () => cli.now().getTime(),
+		git: cli.importGit,
+		top: cli.top
 	});
-	if (command === "usage-limits") return usageLimitsCommand(rest, deps);
 	const initArgs = command === "init" ? parseInitArgs(rest) : void 0;
-	if (initArgs) return init(initArgs, deps);
+	if (initArgs) return guarded(() => init(initArgs, cli));
 	const runArgs = command === "run" ? parseRunArgs(rest) : void 0;
-	if (runArgs) return runIssue(runArgs, deps);
-	deps.stderr(USAGE);
+	if (runArgs) {
+		if (await isSendingBlocked(updateDeps)) {
+			await noticeUpdate(updateDeps);
+			return runWithoutHarnessforce(runArgs, cli);
+		}
+		await noticeUpdate(updateDeps);
+		return runIssue(runArgs, cli);
+	}
+	cli.stderr(UNKNOWN_COMMAND_HINT);
 	return 1;
 }
 //#endregion
@@ -12573,9 +13164,9 @@ const SENDING_COMMANDS = /* @__PURE__ */ new Set([
 	"import",
 	"hook"
 ]);
-const isSending = (argv) => SENDING_COMMANDS.has(argv[0] ?? "") || argv[0] === "usage-limits" && argv[1] !== "statusline";
+const isSending = (argv) => SENDING_COMMANDS.has(argv[0] ?? "") || argv[0] === "tune" && canTuneSend(argv.slice(1));
 const HOOK_RESTART_FAILED = "harnessforce: session registration skipped (restart failed)";
-const RESTART_FAILED = "harnessforceを起動し直せませんでした";
+const RESTART_FAILED = "Could not restart harnessforce";
 async function relaunchHf(argv, deps) {
 	if (!isSending(argv)) return void 0;
 	const outcome = await relaunchWithoutRuntimeVariables({
@@ -12737,42 +13328,9 @@ function createProcessIo(proc = process) {
 	};
 }
 //#endregion
-//#region src/usage-limits/original.ts
-function runOriginalCommand(command, input) {
-	return new Promise((resolve) => {
-		let child;
-		try {
-			child = spawn("sh", ["-c", command], { stdio: [
-				"pipe",
-				"inherit",
-				"inherit"
-			] });
-		} catch {
-			return resolve(void 0);
-		}
-		child.once("error", () => resolve(void 0));
-		child.once("exit", (code, signal) => resolve(code ?? 128 + (signal ? constants.signals[signal] : 0)));
-		child.stdin?.on("error", () => {});
-		child.stdin?.end(input);
-	});
-}
-//#endregion
-//#region src/usage-limits/spawn-sender.ts
-function spawnUsageSender(payload) {
-	spawn(process.execPath, [
-		...process.execArgv,
-		...process.argv.slice(1, 2),
-		"usage-limits",
-		"send",
-		payload
-	], {
-		detached: true,
-		stdio: "ignore"
-	}).unref();
-}
-//#endregion
 //#region src/bin.ts
-const { url: defaultUrl } = createRequire(import.meta.url)("./build-config.json");
+const require = createRequire(import.meta.url);
+const { url: defaultUrl, isDefault } = require("./build-config.json");
 const CALLBACK_TIMEOUT_MS = 3e5;
 const argv = process.argv.slice(2);
 const restoredEnv = takeStashedRuntimeEnv(process.env, process.platform);
@@ -12787,10 +13345,15 @@ process.exitCode = relaunched ?? await run(argv, {
 	env: process.env,
 	keychain: createOsKeychain({
 		platform: process.platform,
-		load: () => import("@napi-rs/keyring")
+		load: () => import("@napi-rs/keyring"),
+		secretService: createSecretServiceProcess({
+			execPath: process.execPath,
+			resolveKeyring: () => require.resolve("@napi-rs/keyring")
+		})
 	}),
 	stdout: (text) => process.stdout.write(text),
 	stderr: (text) => process.stderr.write(text),
+	endStdout: () => new Promise((resolve) => process.stdout.end(() => resolve())),
 	fetch: (url, init) => fetch(url, init),
 	openBrowser: (url) => openBrowser(url, {
 		platform: process.platform,
@@ -12802,6 +13365,7 @@ process.exitCode = relaunched ?? await run(argv, {
 	homeDir: homedir(),
 	managedDir: managedDirFor(process.platform),
 	defaultUrl,
+	devBuild: !isDefault,
 	callbackTimeoutMs: CALLBACK_TIMEOUT_MS,
 	cwd: process.cwd(),
 	git: createGitRunner({
@@ -12828,19 +13392,6 @@ process.exitCode = relaunched ?? await run(argv, {
 	}),
 	sleep: (ms) => setTimeout$1(ms),
 	top: createProcessIo(),
-	runOriginal: runOriginalCommand,
-	spawnSender: spawnUsageSender,
-	ask: async (question) => {
-		const lines = createInterface({
-			input: process.stdin,
-			output: process.stdout
-		});
-		try {
-			return await lines.question(question);
-		} finally {
-			lines.close();
-		}
-	},
 	readStdin: async (maxBytes) => {
 		const chunks = [];
 		let size = 0;