@harnessforce/cli 0.2.0 → 0.4.0

package/dist/bin.js

@@ -3,15 +3,15 @@ import { createRequire } from "node:module";
 import { constants, homedir, tmpdir } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { basename, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { access, chmod, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, utimes, writeFile } from "node:fs/promises";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { access, chmod, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, utimes, writeFile } from "node:fs/promises";
 import { execFile, spawn } from "node:child_process";
 import { constants as constants$1, createReadStream } from "node:fs";
 import { createServer } from "node:http";
-import { ATTR, INTERVENTION_KINDS, LOOP_KINDS, PROPOSAL_KINDS, isToken, normalizeRepository } from "@harnessforce/semconv";
+import { ATTR, INTERVENTION_KINDS, LOOP_KINDS, MAX_WORK_LOCATIONS, PROPOSAL_KINDS, isToken, normalizeRepository } from "@harnessforce/semconv";
 import { createInterface } from "node:readline";
 import { isDeepStrictEqual } from "node:util";
-//#region ../agent-core/src/config/canonical.ts
+// ../agent-core/src/config/canonical.ts
 const byCodeUnit$1 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 function canonicalJson(value) {
 	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
@@ -28,11 +28,9 @@ function sortComponents(components) {
 	return [...components].sort((a, b) => byCodeUnit$1(a.kind, b.kind) || byCodeUnit$1(a.source, b.source) || byCodeUnit$1(a.id, b.id));
 }
 const snapshotId = (components) => hashValue(sortComponents(components));
-//#endregion
-//#region ../agent-core/src/object.ts
+// ../agent-core/src/object.ts
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-//#endregion
-//#region ../agent-core/src/config/files.ts
+// ../agent-core/src/config/files.ts
 const MAX_DEPTH = 8;
 const MAX_FILE_BYTES = 1048576;
 var CollectionExpired = class extends Error {};
@@ -93,8 +91,7 @@ async function listDirectories(dir, guard) {
 	for (const entry of await entries(dir, guard)) if (await kindOf(dir, entry, guard) === "directory") names.push(entry.name);
 	return names;
 }
-//#endregion
-//#region ../agent-core/src/managed.ts
+// ../agent-core/src/managed.ts
 const MANAGED_DIRS = {
 	darwin: "/Library/Application Support/ClaudeCode",
 	win32: "C:\\Program Files\\ClaudeCode"
@@ -113,8 +110,7 @@ async function readManagedEnv(managedDir, names) {
 	}
 	return values;
 }
-//#endregion
-//#region ../agent-core/src/process/lookup.ts
+// ../agent-core/src/process/lookup.ts
 const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
 const NPM_SHIM_MAX_BYTES = 65536;
 const SHEBANG_MAX_BYTES = 256;
@@ -295,8 +291,7 @@ async function commandLineFor(file, args, context, { quoteArgs = true } = {}) {
 		verbatim: true
 	};
 }
-//#endregion
-//#region ../agent-core/src/process/git.ts
+// ../agent-core/src/process/git.ts
 const GIT_TIMEOUT_MS$1 = 1e3;
 const execGit = (file, args, env, timeoutMs) => new Promise((resolve) => {
 	execFile(file, args, {
@@ -334,8 +329,7 @@ function createGitRunner({ platform, env, processCwd, excludeTarget, timeoutMs =
 		], gitEnv, timeoutMs);
 	};
 }
-//#endregion
-//#region ../agent-core/src/process/runtime-env.ts
+// ../agent-core/src/process/runtime-env.ts
 const RUNTIME_VARIABLES = [
 	"NODE_TLS_REJECT_UNAUTHORIZED",
 	"NODE_EXTRA_CA_CERTS",
@@ -412,8 +406,7 @@ function takeStashedRuntimeEnv(env, platform) {
 	if (!isObject(value)) return {};
 	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string" && isRuntimeVariable(entry[0], platform)));
 }
-//#endregion
-//#region src/shared/messages.ts
+// src/shared/messages.ts
 const INIT_MESSAGES = {
 	success: "Connected to Harnessforce. Restart Claude Code to apply the settings",
 	pluginAutoUpdateOn: "Automatic updates for the Harnessforce plugin are on. To turn them off, run `harnessforce init --no-plugin-auto-update` or use /plugin",
@@ -432,25 +425,32 @@ const INIT_MESSAGES = {
 	noWorkspace: "You are not a member of any Workspace. Create a Workspace or accept an invitation, then run `harnessforce init` again",
 	loginFailed: "The login failed. Run `harnessforce init` again",
 	viewer: "The view-only role cannot issue an ingest key. Contact a Workspace administrator",
-	limitOwnerAdmin: "The number of active ingest keys has reached the limit. Revoke unused keys on the ingest keys page",
+	limitOwnerAdmin: "The number of active ingest keys has reached the limit. Ask members to revoke unused keys in My ingest keys on their account page",
 	limitMember: "The ingest key limit has been reached. Contact a Workspace administrator",
 	gateUnavailable: "Could not apply the change on the receiving side. Nothing was changed. Try again",
 	ingestUnavailable: "This environment does not receive telemetry, so an ingest key cannot be issued",
 	saveFailed: "Could not save the ingest key. Run `harnessforce init` again",
 	codexSaveFailed: "Could not write the Codex configuration. Run `harnessforce init` again",
-	contentEnabled: "Sending the prompts you type is now enabled. Values that match known patterns for secrets and personal information are masked, but not everything can be detected. Within the workspace, only you can read your stored content, and it is deleted after the content retention period (at most 30 days)",
-	contentNotOptedIn: "This workspace has not opted in to prompts you typed, so sending content was not enabled. Opt in under Data retention in the workspace settings, then run `harnessforce init --send-content` again"
+	contentNotStored: "This workspace does not store content, so sending content was not enabled. An owner or admin can turn it on under Collection & retention in the workspace settings, then run `harnessforce init --send-content` again",
+	contentNotSent: "Content is not sent from this machine. Run `harnessforce init --send-content` to send it"
 };
 const codexNotes = (configPath) => [
 	`Wrote the Codex configuration (${configPath}). Restart Codex to apply it`,
-	"Codex hooks do not run until you trust them in Codex's /hooks. Trust the harnessforce SessionStart hook in /hooks",
+	"Codex hooks do not run until you trust them in Codex's /hooks. Trust the harnessforce SessionStart, PostToolUse, and Stop hooks in /hooks",
 	"To use the Harnessforce MCP server, log in with `codex mcp login harnessforce`"
 ].join("\n");
 const nonDefaultConnectionMessage = (url) => `Connecting to ${url} (not the default production endpoint)`;
 const listenFailedMessage = (port) => `${INIT_MESSAGES.listenFailed}. Stop the process using port ${port}, or specify another port with \`harnessforce init --port\``;
 const keychainUnavailableMessage = (keychain, message = INIT_MESSAGES.keychainUnavailable) => keychain.unavailableHint ? `${message}. ${keychain.unavailableHint}` : message;
-//#endregion
-//#region src/credentials/keychain.ts
+const CONTENT_READERS = {
+	all_members: "Everyone in the workspace can read it",
+	owners_admins_and_sender: "Owners, admins and you can read it",
+	sender_only: "Within the workspace, only you can read it"
+};
+function contentEnabledMessage(content) {
+	return `Sending ${[...content.isPromptsStored ? ["the prompts you type"] : [], ...content.isModelAndToolsStored ? ["model responses and tool input and output"] : []].join(", ")} is now enabled. Values that match known patterns for secrets and personal information are masked, but not everything can be detected. ${CONTENT_READERS[content.visibility]}. It is deleted after ${content.retentionDays} days`;
+}
+// src/credentials/keychain.ts
 async function openSingleStore(store) {
 	if (!await store.isAvailable()) return void 0;
 	return {
@@ -476,8 +476,7 @@ const workspaceAccounts = (workspaceId) => [
 ];
 const isIngestKeyAccount = (account) => account.endsWith(INGEST_KEY_SUFFIX);
 const apiTokenWorkspaceId = (account) => account.endsWith(API_TOKEN_SUFFIX) ? account.slice(0, -10) : void 0;
-//#endregion
-//#region src/credentials/linux-keychain.ts
+// src/credentials/linux-keychain.ts
 const SECRET_SERVICE_TIMEOUT_MS = 6e4;
 const WAITING_NOTICE_DELAY_MS = 2e3;
 const PROBE_ACCOUNT$1 = "availability-probe";
@@ -631,8 +630,7 @@ async function migrate({ kernel, secretService }, workspaceId) {
 		clearTimeout(timer);
 	}
 }
-//#endregion
-//#region src/credentials/os-keychain.ts
+// src/credentials/os-keychain.ts
 const PROBE_ACCOUNT = "availability-probe";
 function createOsKeychain({ platform, load, secretService }) {
 	let loaded;
@@ -714,8 +712,7 @@ const unsupported = {
 	withTimeout: () => unsupported,
 	openForInit: async () => void 0
 };
-//#endregion
-//#region src/credentials/secret-service-process.ts
+// src/credentials/secret-service-process.ts
 const CHILD_SCRIPT = `
 const [op, service, account, timeoutMs, modulePath] = process.argv.slice(1);
 setTimeout(() => process.kill(process.pid, "SIGKILL"), Number(timeoutMs));
@@ -790,8 +787,7 @@ function createSecretServiceProcess({ execPath, resolveKeyring }) {
 		}
 	};
 }
-//#endregion
-//#region src/import/repository.ts
+// src/import/repository.ts
 const GIT_TIMEOUT_MS = 5e3;
 const createImportGit = (platform, env, processCwd) => createGitRunner({
 	platform,
@@ -800,8 +796,7 @@ const createImportGit = (platform, env, processCwd) => createGitRunner({
 	excludeTarget: false,
 	timeoutMs: GIT_TIMEOUT_MS
 });
-//#endregion
-//#region src/init/browser.ts
+// src/init/browser.ts
 const STILL_RUNNING_MS = 3e3;
 function openerFor(platform, url) {
 	if (platform === "darwin") return ["open", [url]];
@@ -838,35 +833,63 @@ async function openBrowser(url, { platform, env, cwd, restoredEnv, spawn: spawnI
 		child.once("exit", (code) => finish(code === 0));
 	});
 }
-//#endregion
-//#region src/init/loopback.ts
+// src/init/loopback.ts
 const HOST = "127.0.0.1";
 const CALLBACK_PATH = "/callback";
-const page = (message) => `<!doctype html><html lang="en"><meta charset="utf-8"><title>Harnessforce</title><p>${message}</p></html>`;
-const SUCCESS_PAGE = page("Return to the terminal");
-const FAILURE_PAGE = page("The login failed. Check the terminal");
+const COMPLETION_PATH = "/cli/connected";
+function completionUrl(webOrigin, completion) {
+	const url = new URL(COMPLETION_PATH, webOrigin);
+	url.searchParams.set("status", completion.status);
+	if (completion.status === "connected" && completion.workspaceId) url.searchParams.set("workspace", completion.workspaceId);
+	return url.href;
+}
+function parseRequestUrl(target) {
+	try {
+		return new URL(target ?? "/", `http://${HOST}`);
+	} catch {
+		return;
+	}
+}
+function isSameState(received, expected) {
+	if (received === null) return false;
+	const receivedBytes = Buffer.from(received, "utf8");
+	const expectedBytes = Buffer.from(expected, "utf8");
+	return receivedBytes.length === expectedBytes.length && timingSafeEqual(receivedBytes, expectedBytes);
+}
 async function startLoopback(options) {
 	let settle = () => {};
 	const callback = new Promise((resolve) => {
 		settle = resolve;
 	});
+	let held;
 	const server = createServer((req, res) => {
-		const url = new URL(req.url ?? "/", `http://${HOST}`);
+		const url = parseRequestUrl(req.url);
+		if (url === void 0) {
+			res.writeHead(400).end();
+			return;
+		}
 		if (url.pathname !== CALLBACK_PATH) {
 			res.writeHead(404).end();
 			return;
 		}
-		const received = {
+		if (isStopped) {
+			res.writeHead(404).end();
+			return;
+		}
+		if (!isSameState(url.searchParams.get("state"), options.state)) {
+			res.writeHead(303, {
+				location: completionUrl(options.webOrigin, { status: "failed" }),
+				"cache-control": "no-store"
+			});
+			res.end();
+			return;
+		}
+		held = res;
+		stop({
 			code: url.searchParams.get("code") || void 0,
 			state: url.searchParams.get("state") ?? void 0,
 			error: url.searchParams.get("error") ?? void 0
-		};
-		const isSuccess = !received.error && Boolean(received.code) && received.state === options.state;
-		res.writeHead(200, {
-			"content-type": "text/html; charset=utf-8",
-			"cache-control": "no-store"
 		});
-		res.end(isSuccess ? SUCCESS_PAGE : FAILURE_PAGE, () => stop(received));
 	});
 	const timer = setTimeout(() => stop(void 0), options.timeoutMs);
 	let isStopped = false;
@@ -875,9 +898,19 @@ async function startLoopback(options) {
 		isStopped = true;
 		clearTimeout(timer);
 		server.close();
-		server.closeAllConnections();
+		if (!held) server.closeAllConnections();
 		settle(received);
 	}
+	function finish(completion) {
+		const response = held;
+		held = void 0;
+		if (!response) return;
+		response.writeHead(303, {
+			location: completionUrl(options.webOrigin, completion),
+			"cache-control": "no-store"
+		});
+		response.end(() => server.closeAllConnections());
+	}
 	await new Promise((resolve, reject) => {
 		server.once("error", reject);
 		server.listen(options.port, HOST, resolve);
@@ -888,11 +921,11 @@ async function startLoopback(options) {
 	const { port } = server.address();
 	return {
 		redirectUri: `http://${HOST}:${port}${CALLBACK_PATH}`,
-		callback
+		callback,
+		finish
 	};
 }
-//#endregion
-//#region ../agent-core/src/url.ts
+// ../agent-core/src/url.ts
 const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"localhost",
 	"127.0.0.1",
@@ -914,8 +947,7 @@ function underBase(base, path) {
 	return url;
 }
 const withoutExtras = (url) => `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
-//#endregion
-//#region ../agent-core/src/client-update.ts
+// ../agent-core/src/client-update.ts
 const CLIENT_UPDATE_HEADER = "harnessforce-client-update";
 const UPDATE_COMMANDS = {
 	cli: "npm install -g @harnessforce/cli@latest",
@@ -1074,8 +1106,7 @@ async function recheckClientStatus(options) {
 	}
 	return await readUpdateState(options.statePath, options.version) ?? state;
 }
-//#endregion
-//#region ../agent-core/src/ingest.ts
+// ../agent-core/src/ingest.ts
 const SEND_TIMEOUT_MS = 2e3;
 function ingestBaseFrom(endpoint) {
 	const base = parseAllowedUrl(endpoint);
@@ -1110,8 +1141,7 @@ async function postItems(destination, path, items, fetchImpl, timeoutMs = SEND_T
 		};
 	}
 }
-//#endregion
-//#region ../agent-core/src/config/hash-input.ts
+// ../agent-core/src/config/hash-input.ts
 function withoutSecrets(entry) {
 	const { env, headers, url, args: _args, ...rest } = entry;
 	const result = rest;
@@ -1143,8 +1173,7 @@ function hashInput(kind, value) {
 	if (kind === "hook" && Array.isArray(value)) return value.map(reduceHookGroup);
 	return value;
 }
-//#endregion
-//#region ../agent-core/src/config/scope.ts
+// ../agent-core/src/config/scope.ts
 const MAX_COMPONENTS = 1e3;
 var TooManyComponents = class extends Error {};
 var Sink = class {
@@ -1200,11 +1229,9 @@ function collectMcpServers$1(s, servers) {
 	if (!isObject(servers)) return;
 	for (const [name, value] of Object.entries(servers)) if (isObject(value)) s.addValue("mcp_server", name, value);
 }
-//#endregion
-//#region ../agent-core/src/plugin-auto-update.ts
+// ../agent-core/src/plugin-auto-update.ts
 const MARKETPLACE_NAME = "harnessforce-agent";
-//#endregion
-//#region src/shared/settings.ts
+// src/shared/settings.ts
 const OTEL_HEADERS_HELPER = "harnessforce otel-headers";
 const PLUGIN_ID$1 = "harnessforce@harnessforce-agent";
 const NEW_FILE_MODE = 384;
@@ -1292,8 +1319,7 @@ async function writeUserSettings(path, settings) {
 		await rm(temporary, { force: true });
 	}
 }
-//#endregion
-//#region src/destinations.ts
+// src/destinations.ts
 const NAMES = [
 	"HARNESSFORCE_URL",
 	"HARNESSFORCE_ENDPOINT",
@@ -1314,8 +1340,7 @@ async function resolveCliDestinations(env, settingsPath, defaultUrl) {
 		readApiUrl: pick("HARNESSFORCE_URL") ?? defaultUrl
 	};
 }
-//#endregion
-//#region src/client-update.ts
+// src/client-update.ts
 const updateStatePath = (homeDir) => join(homeDir, ".harnessforce", "update-status.json");
 const readCliUpdateState = (homeDir, version) => readUpdateState(updateStatePath(homeDir), version);
 /**
@@ -1348,8 +1373,7 @@ async function noticeUpdate(deps) {
 	});
 	if (line) deps.stderr(`${line}\n`);
 }
-//#endregion
-//#region src/help.ts
+// src/help.ts
 const SENDS_NOTHING_LOCAL = "Nothing. It reads local files only and makes no network request.";
 const COMMANDS$1 = {
 	init: {
@@ -1366,8 +1390,9 @@ What it does:
 
 Options:
   --port <port>     Loopback port for the login callback, 1-65535 (default 8080).
-  --send-content    Also send the text of the prompts you type. Takes effect only
-                    when the Workspace has opted in. Off by default.
+  --send-content    Also send the prompts you type, model responses and tool
+                    input and output. Takes effect only for the categories the
+                    Workspace stores. Without it, init turns all of them off.
   --no-plugin-auto-update
                     Turn off automatic updates of the Harnessforce plugin in
                     Claude Code. On by default; a value you set is kept.
@@ -1377,9 +1402,9 @@ Sends:
   telemetry (token counts, tool names, timings) with that key.
 
 Does not send:
-  Prompt text (unless --send-content and the Workspace opt-in), model responses,
-  tool input or output, code diffs, and secrets. The key is never written to a
-  plain file.
+  Prompt text, model responses and tool input or output (unless --send-content
+  and the Workspace stores that category), code diffs, and secrets. The key is
+  never written to a plain file.
 
 Exit codes:
   0  Connected and configured.
@@ -1420,6 +1445,38 @@ Exit codes:
 
 Examples:
   harnessforce import
+`
+	},
+	status: {
+		summary: "Show the Workspace setup steps that remain",
+		text: `Usage: harnessforce status [--json]
+
+When to use:
+  After init, and any time you want to see which setup steps of the connected
+  Workspace remain and whether this repository is connected to the GitHub App.
+
+What it does:
+  Reads the setup checklist of the connected Workspace and the list of
+  connected repositories, and prints your role, each step (done, to do with its
+  URL, or "?" when it cannot be read), and whether the repository of the current
+  directory (its origin remote) is connected.
+
+Options:
+  --json   Print the checklist and the repository as one JSON object.
+
+Sends:
+  Read requests with the API token. It writes nothing.
+
+Does not send:
+  The URL of the origin remote: it is compared on this machine.
+
+Exit codes:
+  0  The status was read, whether or not steps remain.
+  1  Not logged in, the login expired, or communication failed.
+
+Examples:
+  harnessforce status
+  harnessforce status --json
 `
 	},
 	"otel-headers": {
@@ -1469,8 +1526,8 @@ Sends:
   The same telemetry as an agent started directly, plus the Issue identifier.
 
 Does not send:
-  Anything beyond what init configured. Prompt text is sent only if you chose
-  --send-content at init.
+  Anything beyond what init configured. Prompt text, responses and tool input
+  and output are sent only if you chose --send-content at init.
 
 Exit codes:
   The agent's own exit code when it ran.
@@ -1484,6 +1541,8 @@ Examples:
 	tune: {
 		summary: "Analyze your past sessions and report counts",
 		text: `Usage: harnessforce tune [--all] [--no-send] [--show-report] [--json]
+       harnessforce tune --report-only [--all]
+       harnessforce tune --print-schedule
        harnessforce tune record
        harnessforce tune --purge
 
@@ -1503,6 +1562,11 @@ Options:
   --show-report   Print the exact values that would be sent.
   --json          Print the result as one JSON object on stdout. Messages go to
                   stderr.
+  --report-only   Analyze and send, writing nothing to stdout (for your OS
+                  scheduler). Combines with --all only.
+  --print-schedule
+                  Print a cron line that runs --report-only every Monday at
+                  9:00. It changes nothing and sends nothing.
   record          Read one proposal as JSON from stdin and store it locally.
   --purge         Delete the analysis, proposals, and unsent results.
 
@@ -1524,6 +1588,7 @@ Exit codes:
 Examples:
   harnessforce tune
   harnessforce tune --no-send --json
+  harnessforce tune --print-schedule
   harnessforce tune --purge
 `
 	},
@@ -1561,20 +1626,26 @@ Examples:
 `
 	},
 	hook: {
-		summary: "Session-start hook (used by Codex)",
-		text: `Usage: harnessforce hook session-start
+		summary: "Session hooks (used by Codex)",
+		text: `Usage: harnessforce hook session-start|post-tool-use|stop
 
 When to use:
-  You normally never run it. Codex runs it when a session starts.
+  You normally never run it. Codex runs session-start when a session starts,
+  post-tool-use after it edits files with apply_patch, and stop at the end of
+  each turn.
 
 What it does:
-  Reads the hook input from stdin, registers the session with the Workspace, and
-  prints context for the agent (the session ID, plus a one-line warning if
-  registration failed).
+  session-start reads the hook input from stdin, registers the session with the
+  Workspace, and prints context for the agent (the session ID, plus a one-line
+  warning if registration failed).
+  post-tool-use and stop record the repository and branch of the Git working
+  trees the session worked in, and stop sends them when they changed.
 
 Sends:
   Session registration: agent, session ID, repository, branch, commit, and
   start time.
+  Work locations: agent, session ID, and the repository and branch of each
+  working tree. Paths, commits, and file names are not sent.
 
 Does not send:
   Prompt text, model responses, tool input or output, and code diffs.
@@ -1592,6 +1663,7 @@ Examples:
 const ORDER = [
 	"init",
 	"import",
+	"status",
 	"run",
 	"tune",
 	"top",
@@ -1631,8 +1703,7 @@ function resolveHelp(argv) {
 	const separator = rest.indexOf("--");
 	return (separator === -1 ? rest : rest.slice(0, separator)).some(isHelpFlag) ? COMMANDS$1[command].text : void 0;
 }
-//#endregion
-//#region ../agent-core/src/hook-warning.ts
+// ../agent-core/src/hook-warning.ts
 const RESTART_FAILED_WARNING = "Could not restart the Harnessforce hook";
 const INVALID_ENDPOINT_WARNING = "The Harnessforce destination is invalid. Run `harnessforce init` again";
 const notConfiguredWarning = (agent) => agent === "claude_code" ? "Harnessforce sending is not configured. Run `/harnessforce:setup`" : "Harnessforce sending is not configured. Run `harnessforce init`";
@@ -1643,21 +1714,17 @@ const DESTINATION_MISMATCH_WARNING = {
 	claude_code: "Telemetry is not being sent because the Harnessforce destination differs from the one saved by `harnessforce init`. Check this repository's settings or run `harnessforce init` again",
 	codex: "Sessions are not being registered because the Harnessforce destination differs from the one saved by `harnessforce init`. Run `harnessforce init` again"
 };
-//#endregion
-//#region ../agent-core/src/issue.ts
+// ../agent-core/src/issue.ts
 const isIssueIdentifier = (value) => isToken(value, 300);
-//#endregion
-//#region ../agent-core/src/using-harnessforce.ts
-const usingHarnessforceBody = "---\nname: using-harnessforce\ndescription: Use when starting a session in an environment with the Harnessforce hook, when starting work on an Issue, or when asked what is recorded or collected. The hook injects this text into the context at session start.\n---\n\n# Using Harnessforce\n\nThis session has the Harnessforce hook installed. Harnessforce links the work of people and AI to Issues and records it. Follow these rules.\n\n## What is recorded\n\n- Session registration: agent, session ID, repository, branch, commit, start time, and the first prompt ID.\n- Config snapshot: the structure of the configuration in use (Claude Code only).\n- OTel telemetry: what the user chooses to send.\n- For work on an Issue, `record-run` registers the session as a Run and closes it. It records no Plan, Decision, or Definition of Done.\n\n## What is not collected\n\n- Prompts, responses, tool input and output, and the body of code diffs arrive only when the user opts in with `--send-content` and the Workspace has opted in. They are not collected by default.\n- Never put these contents, secrets, or environment variable values in MCP tool input or in a record.\n\n## Which hook sends what\n\n- SessionStart: session registration and the config snapshot (Codex sends session registration only).\n- UserPromptSubmit: resends on the first prompt (Claude Code only).\n- A failing hook never stops the session. When the hook cannot send, it shows a one-line warning. Tell the user when a warning appears.\n\n## Which skill and tool to use, and when\n\n- For work on a specified Issue ID, or when the environment variable `HARNESSFORCE_ISSUE` is set, follow `record-run` and use `start_run`, `get_issue`, and `complete_run`. An agent that cannot load the skill calls the tools in the same order.\n- Pass the value of the `harnessforce session_id:` line in the context to `start_run`. If there are several, use the last one. If the line is missing, do not guess the session ID, and do not call `start_run` or `complete_run`.\n- Use `propose-improvements` for the analysis of `/harnessforce:tune`.\n- When no Issue is specified, do not start recording a Run.\n\n## Red Flags\n\nStop when one of these thoughts comes up.\n\n| Thought | Reality |\n| --- | --- |\n| An Issue was specified, but the work is small, so recording is unnecessary | Work on a specified Issue is recorded regardless of its size |\n| The session ID line is missing, so I will guess it and call `start_run` | Do not guess. The Run would no longer be linked to the session |\n| Summarizing the content before recording would help | Do not pass content to the tool. It goes beyond what is collected |\n| A warning appeared, but I can ignore it | Sending is not working. Tell the user |\n\n## Priority\n\n1. The user's instructions (CLAUDE.md, AGENTS.md, direct requests). If the user tells you to stop recording, stop recording the Run.\n2. This introduction.\n3. Default behavior.\n\n## Subagents\n\nA subagent that was delegated only a specific task by its parent does not register a Run by following this introduction. The parent registers the Run.\n".replace(/\r\n/g, "\n").replace(/^---\n[\s\S]*?\n---\n+/, "").trimEnd();
-//#endregion
-//#region ../agent-core/src/session-context.ts
+// ../agent-core/src/using-harnessforce.ts
+const usingHarnessforceBody = "---\nname: using-harnessforce\ndescription: Use when starting a session in an environment with the Harnessforce hook, when starting work on an Issue, or when asked what is recorded or collected. The hook injects this text into the context at session start.\n---\n\n# Using Harnessforce\n\nThis session has the Harnessforce hook installed. Harnessforce links the work of people and AI to Issues and records it. Follow these rules.\n\n## What is recorded\n\n- Session registration: agent, session ID, repository, branch, commit, start time, and the first prompt ID.\n- Work locations: the repository and branch of each Git working tree the session works in. Paths are not sent.\n- Config snapshot: the structure of the configuration in use (Claude Code only).\n- OTel telemetry: what the user chooses to send.\n- For work on an Issue, `record-run` registers the session as a Run and closes it. It records no Plan, Decision, or Definition of Done.\n\n## What is not collected\n\n- Prompts, responses, tool input and output, and the body of code diffs arrive only when the user sends them (`--send-content` or managed settings) and the Workspace stores that category. The members the Workspace chooses can read them. `harnessforce import` never sends them.\n- Never put these contents, secrets, or environment variable values in MCP tool input or in a record.\n\n## Which hook sends what\n\n- SessionStart: session registration and the config snapshot (Codex sends session registration only).\n- UserPromptSubmit: resends on the first prompt (Claude Code only).\n- Stop: sends the work locations at the end of a turn in which they changed.\n- A failing hook never stops the session. When the hook cannot send, it shows a one-line warning. Tell the user when a warning appears.\n\n## Which skill and tool to use, and when\n\n- For work on a specified Issue ID, or when the environment variable `HARNESSFORCE_ISSUE` is set, follow `record-run` and use `start_run`, `get_issue`, and `complete_run`. An agent that cannot load the skill calls the tools in the same order.\n- Pass the value of the `harnessforce session_id:` line in the context to `start_run`. If there are several, use the last one. If the line is missing, do not guess the session ID, and do not call `start_run` or `complete_run`.\n- Use `propose-improvements` for the analysis of `/harnessforce:tune`.\n- When no Issue is specified, do not start recording a Run.\n\n## Red Flags\n\nStop when one of these thoughts comes up.\n\n| Thought | Reality |\n| --- | --- |\n| An Issue was specified, but the work is small, so recording is unnecessary | Work on a specified Issue is recorded regardless of its size |\n| The session ID line is missing, so I will guess it and call `start_run` | Do not guess. The Run would no longer be linked to the session |\n| Summarizing the content before recording would help | Do not pass content to the tool. It goes beyond what is collected |\n| A warning appeared, but I can ignore it | Sending is not working. Tell the user |\n\n## Priority\n\n1. The user's instructions (CLAUDE.md, AGENTS.md, direct requests). If the user tells you to stop recording, stop recording the Run.\n2. This introduction.\n3. Default behavior.\n\n## Subagents\n\nA subagent that was delegated only a specific task by its parent does not register a Run by following this introduction. The parent registers the Run.\n".replace(/\r\n/g, "\n").replace(/^---\n[\s\S]*?\n---\n+/, "").trimEnd();
+// ../agent-core/src/session-context.ts
 const sessionContextLine = (sessionId) => `harnessforce session_id: ${sessionId}`;
 const sessionContext = (sessionId) => ({ hookSpecificOutput: {
 	hookEventName: "SessionStart",
 	additionalContext: `${sessionContextLine(sessionId)}\n\n${usingHarnessforceBody}`
 } });
-//#endregion
-//#region ../agent-core/src/vcs.ts
+// ../agent-core/src/vcs.ts
 async function selectRemote(cwd, git) {
 	if (await git(cwd, ["rev-parse", "--is-inside-work-tree"]) !== "true") return void 0;
 	const remotes = (await git(cwd, ["remote"]))?.split("\n") ?? [];
@@ -1707,8 +1774,7 @@ async function resolveProjectRoot(cwd, git) {
 	const topLevel = await git(cwd, ["rev-parse", "--show-toplevel"]);
 	return topLevel && isAbsolute(topLevel) ? topLevel : cwd;
 }
-//#endregion
-//#region src/credentials/user-destination.ts
+// src/credentials/user-destination.ts
 async function resolveUserDestination(deps) {
 	const { workspaceId, ingestEndpoint } = await resolveCliDestinations(deps.env, userSettingsPath(deps.env, deps.homeDir), "");
 	if (!workspaceId && !ingestEndpoint) return { kind: "none" };
@@ -1743,14 +1809,13 @@ async function resolveUserDestination(deps) {
 		}
 	};
 }
-//#endregion
-//#region src/hook/session-start.ts
-const HOOK_USAGE = "Usage: harnessforce hook session-start\n";
+// src/hook/session-start.ts
+const HOOK_USAGE = "Usage: harnessforce hook session-start|post-tool-use|stop\n";
 const MAX_INPUT_BYTES = 1048576;
 const REGISTERING_SOURCES = /* @__PURE__ */ new Set(["startup", "clear"]);
 const KEYCHAIN_READ_TIMEOUT_MS = 1e3;
 const REVOKED_MESSAGE = "Your ingest key has been revoked. Run `harnessforce init`";
-function parseInput(raw) {
+function parseInput$1(raw) {
 	let fields;
 	try {
 		fields = JSON.parse(raw);
@@ -1766,7 +1831,7 @@ function parseInput(raw) {
 		source: typeof source === "string" ? source : void 0
 	};
 }
-const report$1 = (deps, detail) => deps.stderr(`harnessforce: session registration ${detail}\n`);
+const report$2 = (deps, detail) => deps.stderr(`harnessforce: session registration ${detail}\n`);
 const SKIPPED_WARNINGS = {
 	"not configured": notConfiguredWarning("codex"),
 	"invalid endpoint": INVALID_ENDPOINT_WARNING,
@@ -1794,11 +1859,11 @@ async function resolveDestination(deps) {
 	const resolved = await resolveWithinLimit(deps);
 	if (resolved.kind === "ok") return { destination: resolved.destination };
 	if (resolved.kind === "none") {
-		report$1(deps, "skipped (not configured)");
+		report$2(deps, "skipped (not configured)");
 		return { warning: notConfiguredWarning("codex") };
 	}
 	const detail = resolved.reason === "keychain unreadable" ? "no ingest key" : resolved.reason;
-	report$1(deps, `skipped (${detail})`);
+	report$2(deps, `skipped (${detail})`);
 	return { warning: SKIPPED_WARNINGS[resolved.reason] };
 }
 function registrationSource(env) {
@@ -1821,7 +1886,7 @@ async function register(input, deps) {
 		started_at: deps.now().toISOString()
 	};
 	const outcome = await postItem(destination, "v1/sessions", registration, deps.fetch);
-	if (outcome.kind === "failed") report$1(deps, `failed (${outcome.reason})`);
+	if (outcome.kind === "failed") report$2(deps, `failed (${outcome.reason})`);
 	return { outcome };
 }
 async function selectWarning(registered, deps) {
@@ -1836,12 +1901,12 @@ async function selectWarning(registered, deps) {
 	});
 }
 async function sessionStart(deps) {
-	const input = parseInput(await deps.readStdin(MAX_INPUT_BYTES).then((buffer) => buffer.toString("utf8")).catch(() => ""));
+	const input = parseInput$1(await deps.readStdin(MAX_INPUT_BYTES).then((buffer) => buffer.toString("utf8")).catch(() => ""));
 	if (!input) return 0;
 	const registers = input.source === void 0 || REGISTERING_SOURCES.has(input.source);
 	const blocked = registers && await isSendingBlocked(deps);
 	const registered = registers && !blocked ? await register(input, deps).catch((error) => {
-		report$1(deps, `failed (${error instanceof Error ? error.name : "unknown"})`);
+		report$2(deps, `failed (${error instanceof Error ? error.name : "unknown"})`);
 		return {};
 	}) : {};
 	const warning = registers ? await selectWarning(registered, deps) : void 0;
@@ -1852,8 +1917,185 @@ async function sessionStart(deps) {
 	})}\n`);
 	return 0;
 }
-//#endregion
-//#region src/shared/stop.ts
+// ../agent-core/src/work-location.ts
+const absolute = (value) => typeof value === "string" && isAbsolute(value) ? value : void 0;
+const toolInputOf = (fields) => isObject(fields.tool_input) ? fields.tool_input : {};
+const PATCH_FILE_LINE = /^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/;
+function patchedDirectories(command, cwd) {
+	if (typeof command !== "string") return [];
+	return command.split(/\r?\n/).flatMap((line) => {
+		const path = PATCH_FILE_LINE.exec(line)?.[1]?.trim();
+		return path ? [dirname(resolve(cwd, path))] : [];
+	});
+}
+/**
+* eventの入力から、作業位置を求めるdirectoryを返す。読むのは`new_cwd`、`file_path`、patchのfileの行のpathだけで、編集の
+* 本文を読まない。
+*/
+function observedDirectories(agent, event, fields, cwd) {
+	if (event === "stop") return [cwd];
+	if (agent === "claude_code" && event === "cwd-changed") {
+		const newCwd = absolute(fields.new_cwd);
+		return newCwd ? [newCwd] : [];
+	}
+	if (event !== "post-tool-use") return [];
+	const input = toolInputOf(fields);
+	if (agent === "codex") return fields.tool_name === "apply_patch" ? [...new Set(patchedDirectories(input.command, cwd))] : [];
+	if (fields.tool_name !== "Write" && fields.tool_name !== "Edit") return [];
+	const filePath = absolute(input.file_path);
+	return filePath ? [dirname(filePath)] : [];
+}
+const isDirectory = (path) => stat(path).then((found) => found.isDirectory(), () => false);
+/** directoryのworking treeの、その時点のrepositoryとbranch。repositoryかbranchを求められなければundefined。 */
+async function observePair(directory, git) {
+	if (!await isDirectory(directory)) return void 0;
+	const vcs = await resolveVcs(directory, git);
+	return vcs?.repository && vcs.branch ? {
+		repository: vcs.repository,
+		branch: vcs.branch
+	} : void 0;
+}
+const emptyLocationState = () => ({
+	pairs: [],
+	sent: [],
+	unauthorized: false
+});
+const pairKey = (pair) => JSON.stringify([pair.repository, pair.branch]);
+/** 組を加える。記録済みの組と、10件に達した後の組は加えない。 */
+function withObservedPair(state, pair) {
+	if (state.pairs.some((saved) => pairKey(saved) === pairKey(pair)) || state.pairs.length >= MAX_WORK_LOCATIONS) return state;
+	return {
+		...state,
+		pairs: [...state.pairs, pair]
+	};
+}
+/** 記録した組の集合が、最後に送った集合と異なる場合だけ送る組。 */
+function locationsToSend(state) {
+	if (state.unauthorized || state.pairs.length === 0) return void 0;
+	const sent = new Set(state.sent.map(pairKey));
+	return sent.size === state.pairs.length && state.pairs.every((pair) => sent.has(pairKey(pair))) ? void 0 : state.pairs;
+}
+const isPair = (value) => isObject(value) && typeof value.repository === "string" && typeof value.branch === "string";
+async function readLocationState(path) {
+	try {
+		const saved = JSON.parse(await readFile(path, "utf8"));
+		if (!isObject(saved) || !Array.isArray(saved.pairs) || !Array.isArray(saved.sent)) return emptyLocationState();
+		return {
+			pairs: saved.pairs.filter(isPair),
+			sent: saved.sent.filter(isPair),
+			unauthorized: saved.unauthorized === true
+		};
+	} catch {
+		return emptyLocationState();
+	}
+}
+async function writeLocationState(path, state) {
+	const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+	await writeFile(temporary, JSON.stringify(state), { mode: 384 });
+	await rename(temporary, path);
+}
+const FILE_SAFE_SESSION_ID = /^[A-Za-z0-9_-]+$/;
+const LOCATION_DIRECTORY = "harnessforce-locations";
+async function isPrivateDirectory(path) {
+	const found = await lstat(path).catch(() => void 0);
+	if (!found) return false;
+	const uid = process.getuid?.();
+	return found.isDirectory() && !found.isSymbolicLink() && (uid === void 0 || found.uid === uid) && (found.mode & 511) === 448;
+}
+/**
+* Codexの記録のfile。Codexのhookは`scratchpad_dir`を受け取らないため、OSの一時directoryの下に置く。macOSとLinuxでは
+* directoryの所有者とmodeを確かめ、満たさなければundefinedを返す（記録も送信もしない）。Windowsの`TEMP`は利用者ごとに分かれる。
+*/
+async function codexLocationStatePath(temporaryDirectory, sessionId, platform = process.platform) {
+	if (!FILE_SAFE_SESSION_ID.test(sessionId)) return void 0;
+	const directory = join(temporaryDirectory, LOCATION_DIRECTORY);
+	if (platform !== "win32") {
+		await mkdir(directory, { mode: 448 }).catch(() => {});
+		if (!await isPrivateDirectory(directory)) return void 0;
+	} else await mkdir(directory, { recursive: true }).catch(() => {});
+	return join(directory, `codex-${sessionId}.json`);
+}
+/** 観測したdirectoryの組を記録のfileへ加える。gitの外のdirectoryは記録しない。 */
+async function recordObservedPairs(statePath, directories, deps) {
+	const pairs = await Promise.all(directories.map((directory) => observePair(directory, deps.git)));
+	const before = await readLocationState(statePath);
+	const after = pairs.reduce((state, pair) => pair ? withObservedPair(state, pair) : state, before);
+	if (after !== before) await writeLocationState(statePath, after);
+	return after;
+}
+/**
+* 記録した組の集合が最後に送った集合と異なれば`/v1/sessions/locations`へ送る。2xxなら送った集合を記録し、401なら以後送らない
+* ことを記録する。それ以外の失敗では記録を変えず、次の`Stop`が送り直しを兼ねる。
+*/
+async function sendLocations(statePath, state, item, destination, fetchImpl) {
+	const locations = locationsToSend(state);
+	if (!locations) return { kind: "unchanged" };
+	const outcome = await postItem(destination, "v1/sessions/locations", {
+		agent: item.agent,
+		session_id: item.sessionId,
+		locations
+	}, fetchImpl);
+	if (outcome.kind === "accepted") await writeLocationState(statePath, {
+		...state,
+		sent: locations
+	});
+	if (outcome.kind === "unauthorized") await writeLocationState(statePath, {
+		...state,
+		unauthorized: true
+	});
+	return {
+		kind: "sent",
+		outcome
+	};
+}
+// src/hook/work-location.ts
+function parseInput(raw) {
+	let fields;
+	try {
+		fields = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!isObject(fields)) return void 0;
+	const { session_id: sessionId, cwd } = fields;
+	if (typeof sessionId !== "string" || !isToken(sessionId) || typeof cwd !== "string" || !isAbsolute(cwd)) return void 0;
+	return {
+		sessionId,
+		cwd,
+		fields
+	};
+}
+const report$1 = (deps, detail) => deps.stderr(`harnessforce: session location ${detail}\n`);
+async function observe(event, input, deps) {
+	const statePath = await codexLocationStatePath(deps.hookTmpDir, input.sessionId);
+	if (!statePath) return;
+	const state = await recordObservedPairs(statePath, observedDirectories("codex", event, input.fields, input.cwd), deps);
+	if (event !== "stop") return;
+	if (state.unauthorized) return;
+	if (await isSendingBlocked(deps)) return;
+	const { destination } = await resolveDestination({
+		...deps,
+		stderr: () => {}
+	});
+	if (!destination) return;
+	const sent = await sendLocations(statePath, state, {
+		agent: "codex",
+		sessionId: input.sessionId
+	}, destination, deps.fetch);
+	if (sent.kind !== "sent" || sent.outcome.kind === "accepted") return;
+	report$1(deps, `failed (${sent.outcome.kind === "unauthorized" ? "unauthorized" : sent.outcome.reason})`);
+}
+/**
+* correlation.md「Codexのhook」「sessionの作業位置」。Codexの`PostToolUse`と`Stop`のhookが起動する。どの失敗でもsessionを
+* 止めず、常にexit 0で終える。`Stop`はstdoutにJSONを期待するため、空のobjectだけを書く。
+*/
+async function workLocationHook(event, deps) {
+	const input = parseInput(await deps.readStdin(MAX_INPUT_BYTES).then((buffer) => buffer.toString("utf8")).catch(() => ""));
+	if (input) await observe(event, input, deps).catch((error) => report$1(deps, `failed (${error instanceof Error ? error.name : "unknown"})`));
+	if (event === "stop") deps.stdout("{}\n");
+	return 0;
+}
+// src/shared/stop.ts
 var CommandStop = class {
 	text;
 	constructor(text) {
@@ -1873,8 +2115,7 @@ async function runUntilStop(body, stderr) {
 		return 1;
 	}
 }
-//#endregion
-//#region src/credentials/api-token.ts
+// src/credentials/api-token.ts
 const NO_WHITESPACE$1 = /^\S+$/;
 const INSTANT$2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
 const isInstant = (value) => typeof value === "string" && INSTANT$2.test(value) && !Number.isNaN(Date.parse(value));
@@ -1903,8 +2144,7 @@ function parseStoredApiToken(secret, workspaceId) {
 		return;
 	}
 }
-//#endregion
-//#region src/credentials/access.ts
+// src/credentials/access.ts
 async function verifyCliAccess(deps, messages) {
 	const { keychain } = deps;
 	const stop = (message) => stopWith(messages[message]);
@@ -1928,8 +2168,7 @@ async function verifyCliAccess(deps, messages) {
 		accessToken: apiToken.accessToken
 	};
 }
-//#endregion
-//#region src/shared/http.ts
+// src/shared/http.ts
 const REQUEST_TIMEOUT_MS = 3e4;
 async function readJsonObjectBody(response) {
 	try {
@@ -1939,8 +2178,7 @@ async function readJsonObjectBody(response) {
 		return;
 	}
 }
-//#endregion
-//#region src/shared/metadata.ts
+// src/shared/metadata.ts
 const WELL_KNOWN = "/.well-known/oauth-authorization-server";
 const withoutTrailingSlash = (value) => value.replace(/\/+$/, "");
 async function fetchMetadata(base, fetchImpl) {
@@ -1975,8 +2213,7 @@ async function discoverTokenEndpoint(base, fetchImpl) {
 	const endpoint = endpointOf(await fetchMetadata(base, fetchImpl), "token_endpoint");
 	return endpoint?.origin === base.origin ? endpoint : void 0;
 }
-//#endregion
-//#region src/credentials/token-lock.ts
+// src/credentials/token-lock.ts
 const tokenLockPath = (homeDir) => join(homeDir, ".harnessforce", "token.lock");
 const LOCK_WAIT_MS$1 = 3e4;
 const STALE_LOCK_MS$1 = 6e4;
@@ -2006,8 +2243,7 @@ async function acquireTokenLock(path, deps) {
 		await deps.sleep(RETRY_INTERVAL_MS$1);
 	}
 }
-//#endregion
-//#region src/credentials/api-token-session.ts
+// src/credentials/api-token-session.ts
 const CLIENT_ID$1 = "harnessforce-cli";
 const LOCKED_KEYCHAIN_TIMEOUT_MS = 1e4;
 const isPast = (instant, now) => now >= Date.parse(instant);
@@ -2117,8 +2353,7 @@ function createApiTokenSession(deps) {
 		authorizedFetch
 	};
 }
-//#endregion
-//#region src/import/read-api.ts
+// src/import/read-api.ts
 const FAILED$1 = { kind: "failed" };
 async function getJson(url, apiToken, fetchImpl) {
 	try {
@@ -2188,8 +2423,49 @@ async function fetchSessionImportDays(base, apiToken, fetchImpl) {
 		value: days
 	} : FAILED$1;
 }
-//#endregion
-//#region src/import/record-base.ts
+const ROLES = /* @__PURE__ */ new Set([
+	"owner",
+	"admin",
+	"member",
+	"viewer"
+]);
+const STEP_STATUSES = /* @__PURE__ */ new Set([
+	"done",
+	"todo",
+	"unavailable"
+]);
+function parseSteps(value) {
+	if (!Array.isArray(value)) return void 0;
+	const steps = value.map((item) => {
+		if (typeof item !== "object" || item === null) return void 0;
+		const { step, status, url } = item;
+		return Number.isInteger(step) && step >= 2 && step <= 5 && STEP_STATUSES.has(status) && typeof url === "string" ? {
+			step,
+			status,
+			url
+		} : void 0;
+	});
+	return steps.every((step) => step !== void 0) ? steps : void 0;
+}
+async function fetchOnboarding(base, apiToken, fetchImpl) {
+	const outcome = await getJson(underBase(base, "api/v1/onboarding"), apiToken, fetchImpl);
+	if (outcome.kind !== "ok") return outcome;
+	const body = outcome.value;
+	const steps = parseSteps(body.steps);
+	const adminSteps = body.admin_steps === void 0 ? void 0 : parseSteps(body.admin_steps);
+	if (typeof body.workspace_name !== "string" || !ROLES.has(body.role) || typeof body.has_seat !== "boolean" || !steps || body.admin_steps !== void 0 && !adminSteps) return FAILED$1;
+	return {
+		kind: "ok",
+		value: {
+			workspace_name: body.workspace_name,
+			role: body.role,
+			has_seat: body.has_seat,
+			steps,
+			...adminSteps && { admin_steps: adminSteps }
+		}
+	};
+}
+// src/import/record-base.ts
 async function readSettingsEnv(path) {
 	const read = await readUserSettings(path);
 	const env = read.kind === "ok" ? read.settings.env : void 0;
@@ -2210,8 +2486,7 @@ async function recordBase(deps) {
 	const { CLAUDE_CONFIG_DIR: configDir } = await readTrustedEnv(deps, ["CLAUDE_CONFIG_DIR"]);
 	return configDir ?? join(deps.homeDir, ".claude");
 }
-//#endregion
-//#region src/import/state.ts
+// src/import/state.ts
 const STATE_VERSION = 1;
 const DIR_MODE$1 = 448;
 const FILE_MODE$3 = 384;
@@ -2268,8 +2543,7 @@ async function recordSentSessions(path, destination, sessionIds) {
 		await rm(temporary, { force: true });
 	}
 }
-//#endregion
-//#region src/import/send.ts
+// src/import/send.ts
 const BATCH_SIZE$1 = 100;
 const MAX_RESENDS = 3;
 const MAX_RETRY_AFTER_SECONDS = 60;
@@ -2486,8 +2760,7 @@ var SessionAccumulator = class {
 		};
 	}
 };
-//#endregion
-//#region src/import/rollout.ts
+// src/import/rollout.ts
 const CODEX_PARSER_VERSION = "1.0.0";
 const DETACHED$2 = "HEAD";
 const COMMIT_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
@@ -2624,8 +2897,7 @@ async function parseRollout(path) {
 	}
 	return accumulator.result(skippedLines);
 }
-//#endregion
-//#region src/import/transcript.ts
+// src/import/transcript.ts
 const PARSER_VERSION = "1.1.0";
 const isToken$1 = (value, maxLength = 256) => typeof value === "string" && value.length >= 1 && value.length <= maxLength && /^\S+$/.test(value);
 const MAX_TOOL_NAME = 128;
@@ -2902,8 +3174,7 @@ async function parseTranscriptUsage(path) {
 	const { usage, isReadable } = await readTranscript(path, new Accumulator());
 	return isReadable ? usage : void 0;
 }
-//#endregion
-//#region src/import/sessions.ts
+// src/import/sessions.ts
 const noneNotImported = () => ({
 	outOfRange: 0,
 	outsideGit: 0,
@@ -3064,10 +3335,9 @@ async function scanCodexSessions(options) {
 		compressed
 	};
 }
-//#endregion
-//#region src/import/command.ts
+// src/import/command.ts
 const DAY_MS$1 = 864e5;
-const MESSAGES = {
+const MESSAGES$1 = {
 	runInit: "Run `harnessforce init`",
 	invalidUrl: "The connection URL is invalid",
 	keychainUnavailable: INIT_MESSAGES.keychainUnavailable,
@@ -3084,15 +3354,15 @@ const limitMessage = {
 	monthly_event_limit: (count) => `Could not import ${count} session(s) because the monthly event limit was reached. Run \`harnessforce import\` again after the limit is lifted to resume importing`,
 	workspace_read_only: (count) => `Could not import ${count} session(s) because the Workspace is view-only. Run \`harnessforce import\` again after view-only mode is lifted to resume importing`
 };
-const ACCESS_MESSAGES$2 = {
-	keychainUnavailable: MESSAGES.keychainUnavailable,
-	initRequired: MESSAGES.runInit,
-	invalidUrl: MESSAGES.invalidUrl,
-	apiTokenMissing: MESSAGES.runInit
+const ACCESS_MESSAGES$3 = {
+	keychainUnavailable: MESSAGES$1.keychainUnavailable,
+	initRequired: MESSAGES$1.runInit,
+	invalidUrl: MESSAGES$1.invalidUrl,
+	apiTokenMissing: MESSAGES$1.runInit
 };
-function unwrap(outcome) {
+function unwrap$1(outcome) {
 	if (outcome.kind === "ok") return outcome.value;
-	return stopWith(outcome.kind === "unauthorized" ? MESSAGES.loginExpired : MESSAGES.readFailed);
+	return stopWith(outcome.kind === "unauthorized" ? MESSAGES$1.loginExpired : MESSAGES$1.readFailed);
 }
 const NOT_IMPORTED_LABELS = [
 	["alreadySent", "already sent"],
@@ -3108,8 +3378,8 @@ function reportNotImported(imported, notes, deps) {
 	const line = breakdownLine(notes.breakdown);
 	if (line) deps.stdout(`${line}\n`);
 	if (imported > 0) return;
-	if (notes.breakdown.notConnected > 0) deps.stdout(`${notes.connectedCount === 0 ? MESSAGES.connectNone : MESSAGES.connectOther}\n`);
-	else if (!line && !notes.otherNoticeShown) deps.stdout(`${MESSAGES.nothingFound}\n`);
+	if (notes.breakdown.notConnected > 0) deps.stdout(`${notes.connectedCount === 0 ? MESSAGES$1.connectNone : MESSAGES$1.connectOther}\n`);
+	else if (!line && !notes.otherNoticeShown) deps.stdout(`${MESSAGES$1.nothingFound}\n`);
 }
 function report(result, notes, deps) {
 	switch (result.kind) {
@@ -3125,10 +3395,10 @@ function report(result, notes, deps) {
 			deps.stderr(`${limitMessage[result.reason](result.notImported)}\n`);
 			return 1;
 		case "unauthorized":
-			deps.stderr(`${MESSAGES.revoked}\n`);
+			deps.stderr(`${MESSAGES$1.revoked}\n`);
 			return 1;
 		case "failed":
-			deps.stderr(`${MESSAGES.sendFailed}\n`);
+			deps.stderr(`${MESSAGES$1.sendFailed}\n`);
 			return 1;
 	}
 }
@@ -3138,7 +3408,7 @@ const sumNotImported = (a, b) => ({
 	notConnected: a.notConnected + b.notConnected
 });
 async function runImport(deps) {
-	const access = await verifyCliAccess(deps, ACCESS_MESSAGES$2);
+	const access = await verifyCliAccess(deps, ACCESS_MESSAGES$3);
 	const destination = {
 		workspaceId: access.workspaceId,
 		endpoint: withoutExtras(access.ingest)
@@ -3152,8 +3422,8 @@ async function runImport(deps) {
 		sleep: deps.sleep,
 		homeDir: deps.homeDir
 	}).authorizedFetch(deps.fetch);
-	const connected = unwrap(await listConnectedRepositories(access.readApiBase, access.accessToken, readFetch));
-	const days = unwrap(await fetchSessionImportDays(access.readApiBase, access.accessToken, readFetch));
+	const connected = unwrap$1(await listConnectedRepositories(access.readApiBase, access.accessToken, readFetch));
+	const days = unwrap$1(await fetchSessionImportDays(access.readApiBase, access.accessToken, readFetch));
 	const sinceMs = deps.now() - days * DAY_MS$1;
 	const claude = await scanSessions({
 		projectsDir: join(await recordBase(deps), "projects"),
@@ -3182,7 +3452,7 @@ async function runImport(deps) {
 		sessions: unsent,
 		fetch: deps.fetch,
 		sleep: deps.sleep,
-		record: (ids) => recordSentSessions(statePath, destination, ids).catch(() => stopWith(MESSAGES.stateFailed))
+		record: (ids) => recordSentSessions(statePath, destination, ids).catch(() => stopWith(MESSAGES$1.stateFailed))
 	}), {
 		breakdown: {
 			alreadySent: scanned.length - unsent.length,
@@ -3195,9 +3465,8 @@ async function runImport(deps) {
 function importCommand(deps) {
 	return runUntilStop(() => runImport(deps), deps.stderr);
 }
-//#endregion
-//#region ../../node_modules/.pnpm/@decimalturn+toml-patch@3.3.0/node_modules/@decimalturn/toml-patch/dist/toml-patch.js
-//! @decimalturn/toml-patch v3.3.0 - https://github.com/DecimalTurn/toml-patch - @license: MIT
+// ../../node_modules/.pnpm/@decimalturn+toml-patch@3.3.1/node_modules/@decimalturn/toml-patch/dist/toml-patch.js
+//! @decimalturn/toml-patch v3.3.1 - https://github.com/DecimalTurn/toml-patch - @license: MIT
 function e(e) {
 	return e.type === `Document`;
 }
@@ -4573,13 +4842,12 @@ function on(e) {
 		if (e[t] !== `\\`) continue;
 		let n = e[t + 1];
 		if (!n) return null;
-		if (n === `\\`) {
-			t++;
-			continue;
+		if (n === `\\`) t++;
+		else {
+			if (n === `x` && /^[0-9A-Fa-f]{2}$/.test(e.slice(t + 2, t + 4))) return /[A-F]/.test(e.slice(t + 2, t + 4));
+			if (n === `u` && /^[0-9A-Fa-f]{4}$/.test(e.slice(t + 2, t + 6))) return /[A-F]/.test(e.slice(t + 2, t + 6));
+			if (n === `U` && /^[0-9A-Fa-f]{8}$/.test(e.slice(t + 2, t + 10))) return /[A-F]/.test(e.slice(t + 2, t + 10));
 		}
-		if (n === `x` && /^[0-9A-Fa-f]{2}$/.test(e.slice(t + 2, t + 4))) return /[A-F]/.test(e.slice(t + 2, t + 4));
-		if (n === `u` && /^[0-9A-Fa-f]{4}$/.test(e.slice(t + 2, t + 6))) return /[A-F]/.test(e.slice(t + 2, t + 6));
-		if (n === `U` && /^[0-9A-Fa-f]{8}$/.test(e.slice(t + 2, t + 10))) return /[A-F]/.test(e.slice(t + 2, t + 10));
 	}
 	return null;
 }
@@ -4891,14 +5159,11 @@ function qn(e, t) {
 		if (e === t) return r;
 		if (a(e)) return n(e.value, r);
 		if (d(e)) return n(e.item, r);
-		if (u(e) || f(e)) {
-			for (let t of e.items) {
-				let e = n(t, r + 1);
-				if (e !== void 0) return e;
-			}
-			return;
+		if (u(e) || f(e)) for (let t of e.items) {
+			let e = n(t, r + 1);
+			if (e !== void 0) return e;
 		}
-		if (m(e)) for (let t of e.items) {
+		else if (m(e)) for (let t of e.items) {
 			let e = n(t, r);
 			if (e !== void 0) return e;
 		}
@@ -4910,14 +5175,11 @@ function Jn(e, t) {
 		if (e === t) return r;
 		if (a(e)) return n(e.value, r);
 		if (d(e)) return n(e.item, r);
-		if (u(e) || f(e)) {
-			for (let t of e.items) {
-				let r = n(t, e);
-				if (r) return r;
-			}
-			return;
+		if (u(e) || f(e)) for (let t of e.items) {
+			let r = n(t, e);
+			if (r) return r;
 		}
-		if (m(e)) for (let t of e.items) {
+		else if (m(e)) for (let t of e.items) {
 			let e = n(t, r);
 			if (e) return e;
 		}
@@ -5617,25 +5879,17 @@ function Nr(e) {
 		let r = e[n + 1];
 		if (!r) continue;
 		let i = kr(r);
-		if (i !== null) {
-			i !== `
+		if (i !== null) i !== `
 ` && i !== `\r` && !t.has(i) && t.set(i, `\\` + r), n += 1;
-			continue;
-		}
-		if (r === `x` && /^[0-9A-Fa-f]{2}$/.test(e.slice(n + 2, n + 4))) {
+		else if (r === `x` && /^[0-9A-Fa-f]{2}$/.test(e.slice(n + 2, n + 4))) {
 			let r = e.slice(n, n + 4), i = Number.parseInt(e.slice(n + 2, n + 4), 16), a = String.fromCharCode(i);
 			t.has(a) || t.set(a, r), n += 3;
-			continue;
-		}
-		if (r === `u` && /^[0-9A-Fa-f]{4}$/.test(e.slice(n + 2, n + 6))) {
+		} else if (r === `u` && /^[0-9A-Fa-f]{4}$/.test(e.slice(n + 2, n + 6))) {
 			let r = e.slice(n, n + 6), i = Number.parseInt(e.slice(n + 2, n + 6), 16), a = String.fromCodePoint(i);
 			t.has(a) || t.set(a, r), n += 5;
-			continue;
-		}
-		if (r === `U` && /^[0-9A-Fa-f]{8}$/.test(e.slice(n + 2, n + 10))) {
+		} else if (r === `U` && /^[0-9A-Fa-f]{8}$/.test(e.slice(n + 2, n + 10))) {
 			let r = e.slice(n, n + 10), i = Number.parseInt(e.slice(n + 2, n + 10), 16), a = String.fromCodePoint(i);
 			t.has(a) || t.set(a, r), n += 9;
-			continue;
 		}
 	}
 	return t;
@@ -5644,11 +5898,7 @@ function Pr(e, t, n, r) {
 	let i = ``;
 	for (let a of e) {
 		let e = t.get(a);
-		if (e) {
-			i += e;
-			continue;
-		}
-		i += jr(a, n, r);
+		i += e || jr(a, n, r);
 	}
 	return i;
 }
@@ -6052,7 +6302,7 @@ function oi(e) {
 	return !f(e) || e.items.length === 0 ? !1 : e.items[e.items.length - 1].comma === !0;
 }
 function si(e, t) {
-	return t.inlineTableStart === 0 ? e : (e.items.filter((e) => {
+	return t.inlineTableStart === 0 || (e.items.filter((e) => {
 		if (!a(e)) return !1;
 		let n = f(e.value), r = u(e.value) && e.value.items.length > 0 && e.value.items.every((e) => f(e.item));
 		if (n || r) {
@@ -6064,7 +6314,7 @@ function si(e, t) {
 		V(e, e, n), f(n.value) ? n.value.items.length === 0 ? B(e, e, W(n.key.value)) : B(e, e, ci(n, t.bracketSpacing, t.escapeSequenceUpperCase)) : li(n, t.bracketSpacing, t.escapeSequenceUpperCase).forEach((t) => {
 			B(e, e, t);
 		});
-	}), H(e), e);
+	}), H(e)), e;
 }
 function ci(e, t, n) {
 	let r = W(e.key.value, n);
@@ -7101,11 +7351,7 @@ function ia(e, t, n = [], r = {}) {
 			let h = 0;
 			for (let t = e; t < o.length; t++) o[t] === r && h++;
 			let g = p > h;
-			if (s && (o.indexOf(a[e]) === -1 || g)) {
-				i.push(d(e + l)), a.splice(e, 1), c.splice(e, 1), l++, e--;
-				continue;
-			}
-			if (l > 0 && g) {
+			if (s && (o.indexOf(a[e]) === -1 || g) || l > 0 && g) {
 				i.push(d(e + l)), a.splice(e, 1), c.splice(e, 1), l++, e--;
 				continue;
 			}
@@ -7136,14 +7382,10 @@ function ia(e, t, n = [], r = {}) {
 			for (let n = e; n < o.length; n++) o[n] === t && r++;
 			h = n > r;
 		}
-		if (!p && h) {
-			Vt(i, $i(c[e], t[e], n.concat(e), r)), a[e] = f, c[e] = t[e];
-			continue;
-		}
-		i.push({
+		!p && h ? (Vt(i, $i(c[e], t[e], n.concat(e), r)), a[e] = f, c[e] = t[e]) : (i.push({
 			type: `Add`,
 			path: n.concat(e)
-		}), u = !0, a.splice(e, 0, f), c.splice(e, 0, t[e]), l > 0 && l--;
+		}), u = !0, a.splice(e, 0, f), c.splice(e, 0, t[e]), l > 0 && l--);
 	}
 	for (let e = o.length; e < a.length; e++) i.push(d(e + l));
 	return i;
@@ -7229,19 +7471,10 @@ function pa(e) {
 	let n = !1, r = !1;
 	for (let i = t + 1; i < e.raw.length; i++) {
 		let t = e.raw[i];
-		if (t === `\\`) {
-			i++;
-			continue;
-		}
-		if (!r && t === `"`) {
-			n = !n;
-			continue;
-		}
-		if (!n && t === `'`) {
-			r = !r;
-			continue;
-		}
-		if (!n && !r && t === `#`) return !0;
+		if (t === `\\`) i++;
+		else if (!r && t === `"`) n = !n;
+		else if (!n && t === `'`) r = !r;
+		else if (!n && !r && t === `#`) return !0;
 	}
 	return !1;
 }
@@ -7509,13 +7742,7 @@ function Ta(t, n, r, i) {
 				e && (e.lines = 0, e.columns = 0);
 			}
 			H(t), p && h && r.loc.end.line > r.loc.start.line && (r.loc.end.column = h.column, d(r) && g && r.item.loc.end.line > r.item.loc.start.line && (r.item.loc.end.column = g.column));
-			for (let { node: e, start: t, end: n, endOnly: r, equals: i } of _) {
-				if (r) {
-					e.loc.end.column = n.column;
-					continue;
-				}
-				e.loc.start.column = t.column, e.loc.end.line === e.loc.start.line && (e.loc.end.column = n.column), i !== void 0 && a(e) && (e.equals = i);
-			}
+			for (let { node: e, start: t, end: n, endOnly: r, equals: i } of _) r ? e.loc.end.column = n.column : (e.loc.start.column = t.column, e.loc.end.line === e.loc.start.line && (e.loc.end.column = n.column), i !== void 0 && a(e) && (e.equals = i));
 			for (let { owner: t, ownerOriginalStart: n, comments: i } of l) {
 				let a;
 				t === r ? (a = {
@@ -7640,11 +7867,7 @@ function Ea(e) {
 			continue;
 		}
 		let e = t(i.member) || r(i.member), a = n[n.length - 1];
-		if (a && a.kind === `member` && i.key !== void 0 && a.key === i.key) {
-			a.groups.push(i), a.endLine = i.endLine, a.items = a.items.concat(i.items);
-			continue;
-		}
-		n.push({
+		a && a.kind === `member` && i.key !== void 0 && a.key === i.key ? (a.groups.push(i), a.endLine = i.endLine, a.items = a.items.concat(i.items)) : n.push({
 			kind: `member`,
 			key: i.key,
 			isSection: e,
@@ -7869,23 +8092,11 @@ function Ua(e, t, n) {
 	return r.columns + (i || a ? 2 : 0) + (s ? 1 + (c ? -1 : 0) : 0);
 }
 function Wa(e, n = []) {
-	for (let i of e.items) {
-		if (p(i)) {
-			n.push(i);
-			continue;
-		}
-		(t(i) || r(i)) && Wa(i, n);
-	}
+	for (let i of e.items) p(i) ? n.push(i) : (t(i) || r(i)) && Wa(i, n);
 	return n;
 }
 function Ga(e, n = /* @__PURE__ */ new Set()) {
-	for (let i of e.items) {
-		if (a(i) && f(i.value) && i.loc.start.line === i.loc.end.line) {
-			n.add(i.loc.end.line);
-			continue;
-		}
-		(t(i) || r(i)) && Ga(i, n);
-	}
+	for (let i of e.items) a(i) && f(i.value) && i.loc.start.line === i.loc.end.line ? n.add(i.loc.end.line) : (t(i) || r(i)) && Ga(i, n);
 	return n;
 }
 function Ka(e) {
@@ -8257,11 +8468,7 @@ function so(e) {
 	let t = [], n = 0, r, i = !1;
 	for (let a = 0; a < e.length; a++) {
 		let o = e[a];
-		if (r) {
-			r === `"` && i ? i = !1 : r === `"` && o === `\\` ? i = !0 : o === r && (r = void 0);
-			continue;
-		}
-		o === `"` || o === `'` ? r = o : o === `.` && (t.push(e.slice(n, a)), n = a + 1);
+		r ? r === `"` && i ? i = !1 : r === `"` && o === `\\` ? i = !0 : o === r && (r = void 0) : o === `"` || o === `'` ? r = o : o === `.` && (t.push(e.slice(n, a)), n = a + 1);
 	}
 	return t.push(e.slice(n)), t;
 }
@@ -9013,11 +9220,20 @@ function yo(n, i, s, c, l = !1, g = /* @__PURE__ */ new WeakSet(), _ = void 0, v
 					for (let e of s) Q(n, l, e);
 				}
 				if ((t(o) || r(o)) && m(l)) {
-					let e = o.key.item.value, i = l.items, s = [];
-					for (let n of i) {
-						if (n === o) continue;
-						let i = a(n) ? n.key.value : t(n) || r(n) ? n.key.item.value : void 0;
-						i && i.length > e.length && F(i.slice(0, e.length), e) && s.push(n);
+					let e = o.key.item.value, i = l.items, s = [], c = r(o), u = i.indexOf(o), d = i.length;
+					if (c) for (let t = u + 1; t < i.length; t++) {
+						let n = i[t];
+						if (!r(n)) continue;
+						let a = n.key.item.value;
+						if (a.length <= e.length && F(a, e.slice(0, a.length))) {
+							d = t;
+							break;
+						}
+					}
+					for (let [n, l] of i.entries()) {
+						if (l === o || c && (n < u || n >= d)) continue;
+						let i = a(l) ? l.key.value : t(l) || r(l) ? l.key.item.value : void 0;
+						i && i.length > e.length && F(i.slice(0, e.length), e) && s.push(l);
 					}
 					for (let e of s) Q(n, l, e);
 				}
@@ -9403,23 +9619,18 @@ function To(e, n, i, o, s, c, l) {
 					let n = s.items.find((e) => a(e) && F(e.key.value, t.key.value));
 					n ? pr(e, s, n, t) : B(e, s, t, void 0);
 				};
-				for (let e of m) {
-					if (a(e)) {
-						h(e);
-						continue;
-					}
-					if (t(e)) {
-						let t = e.key.item.value;
-						for (let n of e.items) {
-							if (!a(n)) continue;
-							let e = n.key.raw, r = t.concat(n.key.value);
-							n.key.value = r, n.key.raw = Ur(r, o.escapeSequenceUpperCase).raw;
-							let i = n.key.raw.length - e.length;
-							n.key.loc.end.column = n.key.loc.start.column + n.key.raw.length, n.equals += i, U(n.value, {
-								lines: 0,
-								columns: i
-							}, { first_line_only: !0 }), n.loc.end.line === n.loc.start.line && (n.loc.end.column += i), h(n);
-						}
+				for (let e of m) if (a(e)) h(e);
+				else if (t(e)) {
+					let t = e.key.item.value;
+					for (let n of e.items) {
+						if (!a(n)) continue;
+						let e = n.key.raw, r = t.concat(n.key.value);
+						n.key.value = r, n.key.raw = Ur(r, o.escapeSequenceUpperCase).raw;
+						let i = n.key.raw.length - e.length;
+						n.key.loc.end.column = n.key.loc.start.column + n.key.raw.length, n.equals += i, U(n.value, {
+							lines: 0,
+							columns: i
+						}, { first_line_only: !0 }), n.loc.end.line === n.loc.start.line && (n.loc.end.column += i), h(n);
 					}
 				}
 				return;
@@ -9438,51 +9649,51 @@ function To(e, n, i, o, s, c, l) {
 		if (o) {
 			for (let t of i.items) B(e, o, t, void 0);
 			v ||= o;
-			continue;
-		}
-		if (a(i) && f(i.value)) {
-			let o = i.key.value, s = e.items.find((e) => t(e) && F(e.key.item.value, o));
-			if (s) {
-				for (let t of i.value.items) B(e, s, d(t) ? t.item : t, void 0);
-				v ||= s;
-				continue;
-			}
-			if ($(e, o).filter((e) => a(e) || t(e) || r(e)).length > 0) {
-				for (let t of i.value.items) {
-					let r = d(t) ? t.item : t;
-					if (a(r)) {
-						let e = r.key.raw, t = o.concat(r.key.value);
-						r.key.value = t, r.key.raw = t.map((e) => A.test(e) ? e : JSON.stringify(e).replace(/\x7f/g, `\\u007f`)).join(`.`);
-						let n = r.key.raw.length - e.length;
-						r.key.loc.end.column = r.key.loc.start.column + r.key.raw.length, r.equals += n, U(r.value, {
-							lines: 0,
-							columns: n
-						}, { first_line_only: !0 }), r.loc.end.line === r.loc.start.line && (r.loc.end.column += n);
+		} else {
+			if (a(i) && f(i.value)) {
+				let o = i.key.value, s = e.items.find((e) => t(e) && F(e.key.item.value, o));
+				if (s) {
+					for (let t of i.value.items) B(e, s, d(t) ? t.item : t, void 0);
+					v ||= s;
+					continue;
+				}
+				if ($(e, o).filter((e) => a(e) || t(e) || r(e)).length > 0) {
+					for (let t of i.value.items) {
+						let r = d(t) ? t.item : t;
+						if (a(r)) {
+							let e = r.key.raw, t = o.concat(r.key.value);
+							r.key.value = t, r.key.raw = t.map((e) => A.test(e) ? e : JSON.stringify(e).replace(/\x7f/g, `\\u007f`)).join(`.`);
+							let n = r.key.raw.length - e.length;
+							r.key.loc.end.column = r.key.loc.start.column + r.key.raw.length, r.equals += n, U(r.value, {
+								lines: 0,
+								columns: n
+							}, { first_line_only: !0 }), r.loc.end.line === r.loc.start.line && (r.loc.end.column += n);
+						}
+						B(e, e, r, n === 0 ? _ : void 0), v ||= r;
 					}
-					B(e, e, r, n === 0 ? _ : void 0), v ||= r;
+					continue;
 				}
-				continue;
 			}
-		}
-		if (t(i)) {
-			let t = i.key.item.value;
-			if ($(e, t).filter((e) => a(e)).length > 0) {
-				for (let r of i.items) {
-					if (a(r)) {
-						let e = r.key.raw, n = t.concat(r.key.value);
-						r.key.value = n, r.key.raw = n.map((e) => A.test(e) ? e : JSON.stringify(e).replace(/\x7f/g, `\\u007f`)).join(`.`);
-						let i = r.key.raw.length - e.length;
-						r.key.loc.end.column = r.key.loc.start.column + r.key.raw.length, r.equals += i, U(r.value, {
-							lines: 0,
-							columns: i
-						}, { first_line_only: !0 }), r.loc.end.line === r.loc.start.line && (r.loc.end.column += i);
+			if (t(i)) {
+				let t = i.key.item.value;
+				if ($(e, t).filter((e) => a(e)).length > 0) {
+					for (let r of i.items) {
+						if (a(r)) {
+							let e = r.key.raw, n = t.concat(r.key.value);
+							r.key.value = n, r.key.raw = n.map((e) => A.test(e) ? e : JSON.stringify(e).replace(/\x7f/g, `\\u007f`)).join(`.`);
+							let i = r.key.raw.length - e.length;
+							r.key.loc.end.column = r.key.loc.start.column + r.key.raw.length, r.equals += i, U(r.value, {
+								lines: 0,
+								columns: i
+							}, { first_line_only: !0 }), r.loc.end.line === r.loc.start.line && (r.loc.end.column += i);
+						}
+						B(e, e, r, n === 0 ? _ : void 0), v ||= r;
 					}
-					B(e, e, r, n === 0 ? _ : void 0), v ||= r;
+					continue;
 				}
-				continue;
 			}
+			n > 0 && v && t(v) && a(i) ? B(e, v, i, void 0) : B(e, e, i, n === 0 ? _ : void 0), v ||= i;
 		}
-		n > 0 && v && t(v) && a(i) ? B(e, v, i, void 0) : B(e, e, i, n === 0 ? _ : void 0), v ||= i;
 	}
 	let y = v;
 	t(y) && l.add(y), c.add(y);
@@ -9665,11 +9876,26 @@ function Ko(e, t) {
 		temporal: (t == null ? void 0 : t.temporal) ?? !1
 	});
 }
-//#endregion
-//#region src/shared/codex-config.ts
-const HOOK_COMMAND = "harnessforce hook session-start";
-const HOOK_COMMAND_WINDOWS = "harnessforce.cmd hook session-start";
+// src/shared/codex-config.ts
 const HOOK_TIMEOUT_SECONDS = 10;
+const HOOKS = [
+	{
+		event: "SessionStart",
+		subcommand: "session-start"
+	},
+	{
+		event: "PostToolUse",
+		subcommand: "post-tool-use",
+		matcher: "^apply_patch$",
+		isAsync: true
+	},
+	{
+		event: "Stop",
+		subcommand: "stop",
+		isAsync: true
+	}
+];
+const hookCommand = (spec) => `harnessforce hook ${spec.subcommand}`;
 const FILE_MODE$2 = 384;
 function codexConfigPath(env, homeDir) {
 	return join(absoluteEnv(env.CODEX_HOME) ?? join(homeDir, ".codex"), "config.toml");
@@ -9705,11 +9931,14 @@ function withHarnessforce(config, input) {
 		headers: { Authorization: `Bearer ${input.ingestKey}` },
 		protocol: "binary"
 	} };
-	if (input.logUserPrompt) otel.log_user_prompt = true;
+	otel.log_user_prompt = input.logUserPrompt;
+	otel.log_agent_responses = input.logAgentResponses;
 	const hooks = tableAt(config, "hooks");
-	const groups = hooks.SessionStart ?? [];
-	if (!Array.isArray(groups)) throw new Error("SessionStart");
-	hooks.SessionStart = withHandler(groups);
+	for (const spec of HOOKS) {
+		const groups = hooks[spec.event] ?? [];
+		if (!Array.isArray(groups)) throw new Error(spec.event);
+		hooks[spec.event] = withHandler(groups, spec);
+	}
 	const servers = tableAt(config, "mcp_servers");
 	const existing = servers.harnessforce;
 	if (existing !== void 0 && !isObject(existing)) throw new Error("server");
@@ -9725,16 +9954,21 @@ function tableAt(parent, key) {
 	parent[key] = value;
 	return value;
 }
-const isOurs = (handler) => isObject(handler) && handler.command === HOOK_COMMAND;
-const hasOurs = (group) => isObject(group) && Array.isArray(group.hooks) && group.hooks.some(isOurs);
-function withHandler(groups) {
+function withHandler(groups, spec) {
+	const command = hookCommand(spec);
+	const isOurs = (entry) => isObject(entry) && entry.command === command;
+	const hasOurs = (group) => isObject(group) && Array.isArray(group.hooks) && group.hooks.some(isOurs);
 	const handler = {
 		type: "command",
-		command: HOOK_COMMAND,
-		commandWindows: HOOK_COMMAND_WINDOWS,
-		timeout: HOOK_TIMEOUT_SECONDS
-	};
-	if (!groups.some(hasOurs)) return [...groups, { hooks: [handler] }];
+		command,
+		commandWindows: `harnessforce.cmd hook ${spec.subcommand}`,
+		timeout: HOOK_TIMEOUT_SECONDS,
+		...spec.isAsync ? { async: true } : {}
+	};
+	if (!groups.some(hasOurs)) return [...groups, {
+		...spec.matcher === void 0 ? {} : { matcher: spec.matcher },
+		hooks: [handler]
+	}];
 	return groups.map((group) => hasOurs(group) ? {
 		...group,
 		hooks: group.hooks.map((entry) => isOurs(entry) ? handler : entry)
@@ -9754,8 +9988,29 @@ async function writeCodexConfig(path, text) {
 		await rm(temporary, { force: true });
 	}
 }
-//#endregion
-//#region src/init/credentials-api.ts
+// src/init/credentials-api.ts
+const VISIBILITIES = /* @__PURE__ */ new Set([
+	"all_members",
+	"owners_admins_and_sender",
+	"sender_only"
+]);
+const RETENTION_DAYS = /* @__PURE__ */ new Set([
+	7,
+	14,
+	30
+]);
+function parseContent(value) {
+	if (!isObject(value)) return void 0;
+	const { prompts, model_and_tools: modelAndTools, visibility } = value;
+	const retentionDays = value.retention_days;
+	if (typeof prompts !== "boolean" || typeof modelAndTools !== "boolean" || typeof visibility !== "string" || !VISIBILITIES.has(visibility) || typeof retentionDays !== "number" || !RETENTION_DAYS.has(retentionDays)) return void 0;
+	return {
+		isPromptsStored: prompts,
+		isModelAndToolsStored: modelAndTools,
+		visibility,
+		retentionDays
+	};
+}
 const WORKSPACE_ID = /^[A-Za-z0-9-]{1,128}$/;
 const NO_WHITESPACE = /^\S+$/;
 const LIMIT_ROLES = /* @__PURE__ */ new Set([
@@ -9764,15 +10019,16 @@ const LIMIT_ROLES = /* @__PURE__ */ new Set([
 	"member"
 ]);
 function parseIssued(body) {
-	const { workspace_id: workspaceId, ingest_key: ingestKey, ingest_endpoint: ingestEndpoint, content_opt_in: contentOptIn } = body;
-	if (typeof workspaceId !== "string" || typeof ingestKey !== "string" || typeof ingestEndpoint !== "string" || typeof contentOptIn !== "boolean" || !WORKSPACE_ID.test(workspaceId)) return void 0;
+	const { workspace_id: workspaceId, ingest_key: ingestKey, ingest_endpoint: ingestEndpoint, content } = body;
+	if (typeof workspaceId !== "string" || typeof ingestKey !== "string" || typeof ingestEndpoint !== "string" || !WORKSPACE_ID.test(workspaceId)) return void 0;
 	const apiToken = parseTokenPair(body, workspaceId);
-	return ingestKey.startsWith(`hf_ik_${workspaceId}_`) && NO_WHITESPACE.test(ingestKey) && apiToken !== void 0 && parseAllowedUrl(ingestEndpoint) !== void 0 && apiToken ? {
+	const parsedContent = parseContent(content);
+	return ingestKey.startsWith(`hf_ik_${workspaceId}_`) && NO_WHITESPACE.test(ingestKey) && apiToken !== void 0 && parsedContent !== void 0 && parseAllowedUrl(ingestEndpoint) !== void 0 && apiToken && parsedContent ? {
 		workspaceId,
 		ingestKey,
 		apiToken,
 		ingestEndpoint,
-		contentOptIn
+		content: parsedContent
 	} : void 0;
 }
 function classify(status, body) {
@@ -9812,8 +10068,7 @@ async function requestCredentials(base, request, fetchImpl) {
 		return { kind: "unexpected" };
 	}
 }
-//#endregion
-//#region src/init/pkce.ts
+// src/init/pkce.ts
 const RANDOM_BYTES = 32;
 const codeChallenge = (codeVerifier) => createHash("sha256").update(codeVerifier).digest("base64url");
 function createLoginSecrets() {
@@ -9824,8 +10079,7 @@ function createLoginSecrets() {
 		state: randomBytes(RANDOM_BYTES).toString("base64url")
 	};
 }
-//#endregion
-//#region src/init/init.ts
+// src/init/init.ts
 const CLIENT_ID = "harnessforce-cli";
 const DEFAULT_PORT = 8080;
 const MAX_REVOKE_HASHES = 100;
@@ -9856,28 +10110,43 @@ async function runInit(args, deps) {
 	if (settings.kind === "invalid" || !hasWritableMarketplaces(settings.settings)) stop$1("settingsUnreadable");
 	const authorizationEndpoint = await discoverAuthorizationEndpoint(base, deps.fetch) ?? stop$1("network");
 	const secrets = createLoginSecrets();
-	const { code, redirectUri } = await logIn(authorizationEndpoint, secrets, port, deps);
-	const issued = issuedOrStop(await requestCredentials(base, {
-		code,
-		code_verifier: secrets.codeVerifier,
-		client_id: CLIENT_ID,
-		redirect_uri: redirectUri,
-		revoke_key_hashes: revoke.keyHashes,
-		revoke_api_token_hashes: revoke.apiTokenHashes
-	}, deps.fetch));
-	const isPluginAutoUpdateOn = await save(issued, recordedUrl, settingsPath, args, store).catch((error) => {
-		if (isStop(error)) throw error;
-		return stop$1("saveFailed");
-	});
-	const codexPath = codexConfigPath(deps.env, deps.homeDir);
-	await saveCodexConfig(issued, recordedUrl, codexPath, args.sendContent).catch(() => stop$1("codexSaveFailed"));
-	if (args.sendContent) deps.stdout(`${issued.contentOptIn ? INIT_MESSAGES.contentEnabled : INIT_MESSAGES.contentNotOptedIn}\n`);
-	return {
-		codexPath,
-		connection: recordedUrl,
-		isKernelKeyring: store.isKernelKeyring,
-		isPluginAutoUpdateOn
-	};
+	const { code, redirectUri, loopback } = await logIn(authorizationEndpoint, secrets, port, new URL(recordedUrl).origin, deps);
+	let completion = "failed";
+	try {
+		const outcome = await requestCredentials(base, {
+			code,
+			code_verifier: secrets.codeVerifier,
+			client_id: CLIENT_ID,
+			redirect_uri: redirectUri,
+			revoke_key_hashes: revoke.keyHashes,
+			revoke_api_token_hashes: revoke.apiTokenHashes
+		}, deps.fetch);
+		if (outcome.kind === "viewer") completion = "viewer";
+		const issued = issuedOrStop(outcome);
+		const isPluginAutoUpdateOn = await save(issued, recordedUrl, settingsPath, args, store).catch((error) => {
+			if (isStop(error)) throw error;
+			return stop$1("saveFailed");
+		});
+		const codexPath = codexConfigPath(deps.env, deps.homeDir);
+		await saveCodexConfig(issued, recordedUrl, codexPath, args.sendContent).catch(() => stop$1("codexSaveFailed"));
+		completion = "connected";
+		loopback.finish({
+			status: completion,
+			workspaceId: issued.workspaceId
+		});
+		return finishInit(issued, args, deps, {
+			codexPath,
+			connection: recordedUrl,
+			isKernelKeyring: store.isKernelKeyring,
+			isPluginAutoUpdateOn
+		});
+	} finally {
+		loopback.finish({ status: completion });
+	}
+}
+function finishInit(issued, args, deps, result) {
+	deps.stdout(`${contentNotice(issued.content, args.sendContent)}\n`);
+	return result;
 }
 async function openKeychain(deps, previousWorkspaceId) {
 	return await deps.keychain.openForInit({
@@ -9899,11 +10168,12 @@ function revokeHashes({ items }) {
 		apiTokenHashes
 	};
 }
-async function logIn(authorizationEndpoint, secrets, port, deps) {
+async function logIn(authorizationEndpoint, secrets, port, webOrigin, deps) {
 	const loopback = await deps.startLoopback({
 		state: secrets.state,
 		timeoutMs: deps.callbackTimeoutMs,
-		port
+		port,
+		webOrigin
 	}).catch(() => stopWith(listenFailedMessage(port)));
 	const authorization = new URL(authorizationEndpoint);
 	for (const [name, value] of Object.entries({
@@ -9915,10 +10185,23 @@ async function logIn(authorizationEndpoint, secrets, port, deps) {
 		state: secrets.state
 	})) authorization.searchParams.set(name, value);
 	if (!await deps.openBrowser(authorization.href)) deps.stderr(`${authorization.href}\n`);
-	return {
-		code: codeOrStop(await loopback.callback ?? stop$1("timeout"), secrets.state),
-		redirectUri: loopback.redirectUri
-	};
+	const callback = await loopback.callback ?? stop$1("timeout");
+	try {
+		return {
+			code: codeOrStop(callback, secrets.state),
+			redirectUri: loopback.redirectUri,
+			loopback
+		};
+	} catch (error) {
+		loopback.finish({ status: callbackFailure(callback, secrets.state) });
+		throw error;
+	}
+}
+function callbackFailure(callback, state) {
+	if (callback.state !== state) return "failed";
+	if (callback.error === "access_denied") return "denied";
+	if (callback.error === "no_workspace") return "no_workspace";
+	return "failed";
 }
 function codeOrStop(callback, state) {
 	if (callback.state !== state) return stop$1("loginFailed");
@@ -9961,21 +10244,35 @@ async function save(issued, connection, settingsPath, args, store) {
 		OTEL_TRACES_EXPORTER: "otlp",
 		OTEL_EXPORTER_OTLP_PROTOCOL: "http/protobuf"
 	};
-	if (args.sendContent && issued.contentOptIn) env.OTEL_LOG_USER_PROMPTS = "1";
+	Object.assign(env, contentEnv(issued.content, args.sendContent));
 	const { settings, isOn } = withPluginAutoUpdate(mergeUserSettings(current.settings, env), args.noPluginAutoUpdate);
 	await writeUserSettings(settingsPath, settings);
 	return isOn;
 }
+function contentEnv(content, sendContent) {
+	const flag = (isStored) => sendContent && isStored ? "1" : "0";
+	const modelAndTools = flag(content.isModelAndToolsStored);
+	return {
+		OTEL_LOG_USER_PROMPTS: flag(content.isPromptsStored),
+		OTEL_LOG_ASSISTANT_RESPONSES: modelAndTools,
+		OTEL_LOG_TOOL_DETAILS: modelAndTools,
+		OTEL_LOG_TOOL_CONTENT: modelAndTools
+	};
+}
+function contentNotice(content, sendContent) {
+	if (!sendContent) return INIT_MESSAGES.contentNotSent;
+	return content.isPromptsStored || content.isModelAndToolsStored ? contentEnabledMessage(content) : INIT_MESSAGES.contentNotStored;
+}
 async function saveCodexConfig(issued, connection, path, sendContent) {
 	await writeCodexConfig(path, mergeCodexConfig(await readCodexConfig(path), {
 		connection,
 		ingestEndpoint: issued.ingestEndpoint,
 		ingestKey: issued.ingestKey,
-		logUserPrompt: sendContent && issued.contentOptIn
+		logUserPrompt: sendContent && issued.content.isPromptsStored,
+		logAgentResponses: sendContent && issued.content.isModelAndToolsStored
 	}));
 }
-//#endregion
-//#region src/otel-headers.ts
+// src/otel-headers.ts
 const DESTINATION_VARIABLES = [
 	"HARNESSFORCE_ENDPOINT",
 	"OTEL_EXPORTER_OTLP_ENDPOINT",
@@ -10029,8 +10326,7 @@ async function selectKey(env, managedDir, unlimited) {
 function isPinnedDestination(env, pinnedOrigin) {
 	return DESTINATION_VARIABLES.map((name) => env[name]).filter((value) => Boolean(value)).every((value) => parseAllowedUrl(value)?.origin === pinnedOrigin);
 }
-//#endregion
-//#region ../agent-core/src/config/plugins.ts
+// ../agent-core/src/config/plugins.ts
 const NON_MARKETPLACE_ORIGINS = /* @__PURE__ */ new Set([
 	"inline",
 	"skills-dir",
@@ -10071,8 +10367,7 @@ async function collectPlugins(pluginsRoot, settingsByPrecedence, scope, guard) {
 		collectMcpServers$1(s, (await readJsonObjectFile(join(root, ".mcp.json"), guard))?.mcpServers);
 	}
 }
-//#endregion
-//#region ../agent-core/src/config/collect.ts
+// ../agent-core/src/config/collect.ts
 const COLLECT_BUDGET_MS = 1e3;
 async function readManagedSettings(managedDir, guard) {
 	let merged = await readJsonObjectFile(join(managedDir, "managed-settings.json"), guard);
@@ -10206,8 +10501,7 @@ async function collectConfig(options) {
 		components: sortComponents(sink.components)
 	};
 }
-//#endregion
-//#region src/run/context.ts
+// src/run/context.ts
 async function resolveConfigVersion(options) {
 	const startedMs = options.now().getTime();
 	const result = await collectConfig({
@@ -10227,8 +10521,7 @@ async function resolveLaunchContext(options) {
 		...configVersion === void 0 ? {} : { configVersion }
 	};
 }
-//#endregion
-//#region src/run/issues.ts
+// src/run/issues.ts
 const MAX_CANDIDATES = 10;
 const DOT_SEGMENT = /^\.{1,2}$/;
 async function get(url, apiToken, fetchImpl, timeoutMs) {
@@ -10287,8 +10580,7 @@ async function resolveIssue(base, identifier, apiToken, fetchImpl, timeoutMs = R
 	}
 	return fetchCandidates(base, identifier, apiToken, fetchImpl, timeoutMs);
 }
-//#endregion
-//#region src/run/launch.ts
+// src/run/launch.ts
 const STRIPPED_FROM_SHELL = /* @__PURE__ */ new Set(["OTEL_EXPORTER_OTLP_HEADERS", ...[
 	"TRACES",
 	"LOGS",
@@ -10350,8 +10642,7 @@ function buildLaunch(request) {
 		...isClaudeCode(request.agent) ? { settingsEnv: injectedEnv } : {}
 	};
 }
-//#endregion
-//#region src/run/messages.ts
+// src/run/messages.ts
 const RUN_MESSAGES = {
 	keychainUnavailable: INIT_MESSAGES.keychainUnavailable,
 	initRequired: "Run `harnessforce init`",
@@ -10364,22 +10655,21 @@ const RUN_MESSAGES = {
 	candidatesHeader: "Could not resolve the Issue. Candidates:"
 };
 const launchFailedMessage = (agent) => `Could not start ${agent}`;
-//#endregion
-//#region src/run/run.ts
+// src/run/run.ts
 const stop = (message) => stopWith(RUN_MESSAGES[message]);
 const printable = (text) => text.replace(/\p{Cc}/gu, "");
 function candidateList(candidates) {
 	const lines = candidates.map(({ identifier, title }) => `${printable(identifier)}  ${printable(title)}`);
 	return [RUN_MESSAGES.candidatesHeader, ...lines].join("\n");
 }
-const ACCESS_MESSAGES$1 = {
+const ACCESS_MESSAGES$2 = {
 	keychainUnavailable: RUN_MESSAGES.keychainUnavailable,
 	initRequired: RUN_MESSAGES.initRequired,
 	invalidUrl: RUN_MESSAGES.invalidUrl,
 	apiTokenMissing: RUN_MESSAGES.issueInitRequired
 };
 async function prepareLaunch(args, deps) {
-	const { workspaceId, ingestEndpoint, readApiBase, accessToken } = await verifyCliAccess(deps, ACCESS_MESSAGES$1);
+	const { workspaceId, ingestEndpoint, readApiBase, accessToken } = await verifyCliAccess(deps, ACCESS_MESSAGES$2);
 	if (!isIssueIdentifier(args.issue)) stop("invalidIssue");
 	const readFetch = createApiTokenSession({
 		keychain: deps.keychain,
@@ -10444,8 +10734,88 @@ async function runWithoutHarnessforce(args, deps) {
 	deps.stderr(`${launchFailedMessage(args.agent)}\n`);
 	return 1;
 }
-//#endregion
-//#region src/top/args.ts
+// src/status/command.ts
+const STATUS_USAGE = "Usage: harnessforce status [--json]\n";
+const MESSAGES = {
+	failed: "Could not read the Harnessforce status. Run `harnessforce init` and try again.",
+	loginExpired: "Your login has expired. Run `harnessforce init`"
+};
+const ACCESS_MESSAGES$1 = {
+	keychainUnavailable: INIT_MESSAGES.keychainUnavailable,
+	initRequired: MESSAGES.failed,
+	invalidUrl: MESSAGES.failed,
+	apiTokenMissing: MESSAGES.failed
+};
+const STEP_TITLES = {
+	2: "Connect the GitHub App",
+	3: "Assign repositories to a project",
+	4: "Set up telemetry",
+	5: "Wait for your first run"
+};
+const STATUS_MARKS = {
+	done: "✓",
+	todo: "・",
+	unavailable: "?"
+};
+function unwrap(outcome) {
+	if (outcome.kind === "ok") return outcome.value;
+	return stopWith(outcome.kind === "unauthorized" ? MESSAGES.loginExpired : MESSAGES.failed);
+}
+async function originRepository(cwd, git) {
+	const url = await git(cwd, [
+		"remote",
+		"get-url",
+		"origin"
+	]);
+	return url === void 0 ? void 0 : normalizeRepository(url);
+}
+function stepLine(step) {
+	const parts = [STATUS_MARKS[step.status], STEP_TITLES[step.step]];
+	if (step.status === "todo") parts.push(step.url);
+	return parts.join(" ");
+}
+async function runStatus(json, deps) {
+	const access = await verifyCliAccess(deps, ACCESS_MESSAGES$1);
+	const readFetch = createApiTokenSession({
+		keychain: deps.keychain,
+		workspaceId: access.workspaceId,
+		readBase: access.readApiBase,
+		fetch: deps.fetch,
+		now: deps.now,
+		sleep: deps.sleep,
+		homeDir: deps.homeDir
+	}).authorizedFetch(deps.fetch);
+	const onboarding = unwrap(await fetchOnboarding(access.readApiBase, access.accessToken, readFetch));
+	const name = await originRepository(deps.cwd, deps.git);
+	const repository = name === void 0 ? null : {
+		name,
+		connected: unwrap(await listConnectedRepositories(access.readApiBase, access.accessToken, readFetch)).has(name)
+	};
+	if (json) {
+		deps.stdout(`${JSON.stringify({
+			...onboarding,
+			repository
+		})}\n`);
+		return 0;
+	}
+	const lines = [...onboarding.admin_steps ?? [], ...onboarding.steps].sort((a, b) => a.step - b.step).map(stepLine);
+	const repositoryLine = repository && `This repository (${repository.name}) is ${repository.connected ? "connected" : "not connected"} to the GitHub App`;
+	deps.stdout(`${[
+		`${onboarding.workspace_name} (${onboarding.role})`,
+		...lines,
+		...repositoryLine ? [repositoryLine] : []
+	].join("\n")}\n`);
+	return 0;
+}
+function statusCommand(args, deps) {
+	const json = args.length === 1 && args[0] === "--json";
+	if (args.length > 0 && !json) {
+		deps.stderr(STATUS_USAGE);
+		return Promise.resolve(1);
+	}
+	return runUntilStop(() => runStatus(json, deps), deps.stderr);
+}
+// src/top/args.ts
 const TOP_USAGE = "Usage: harnessforce top [--once] [--json] [--ascii] [--theme <auto|light|dark|ansi>]\n";
 const THEMES = [
 	"auto",
@@ -10474,8 +10844,7 @@ function parseTopArgs(args) {
 		theme
 	};
 }
-//#endregion
-//#region src/top/width.ts
+// src/top/width.ts
 const SGR = /\x1b\[[0-9;]*m/g;
 const stripSgr = (text) => text.replace(SGR, "");
 const WIDE_RANGES = [
@@ -10540,8 +10909,7 @@ function truncate(text, maxWidth, ambiguousWide, ellipsis) {
 function padEnd(text, width, ambiguousWide) {
 	return text + " ".repeat(Math.max(0, width - displayWidth(text, ambiguousWide)));
 }
-//#endregion
-//#region src/top/frame.ts
+// src/top/frame.ts
 const plainPainter = {
 	color: (_token, text) => text,
 	bold: (text) => text,
@@ -10741,8 +11109,7 @@ function renderDetail(row, options) {
 	];
 }
 const skippedNotice = (snapshot) => snapshot.skippedLines > 0 || snapshot.skippedFiles > 0 ? [`Skipped ${snapshot.skippedLines} unreadable line(s) and ${snapshot.skippedFiles} unreadable file(s)`] : [];
-//#endregion
-//#region src/top/codex-session.ts
+// src/top/codex-session.ts
 const DETACHED = "HEAD";
 const SHELL = "shell";
 const COUNTED_CALLS = /* @__PURE__ */ new Set(["function_call", "custom_tool_call"]);
@@ -10860,8 +11227,7 @@ var CodexSessionAccumulator = class {
 		};
 	}
 };
-//#endregion
-//#region src/top/reader.ts
+// src/top/reader.ts
 const WINDOW_MS = 864e5;
 const freshState = (newAccumulator) => ({
 	offset: 0,
@@ -10986,8 +11352,7 @@ function createTopReader({ projectsDir, codexSessionsDir, git }) {
 		};
 	} };
 }
-//#endregion
-//#region src/top/color.ts
+// src/top/color.ts
 const MIN_CONTRAST = 3;
 const TOKEN_VALUES = {
 	good: [[
@@ -11126,8 +11491,7 @@ function createPainter(input) {
 		dim: (text) => open$1("2", text, "22")
 	};
 }
-//#endregion
-//#region src/top/screen.ts
+// src/top/screen.ts
 const ENTER = "\x1B[?1049h\x1B[?25l";
 const RESTORE = "\x1B[?25h\x1B[?1049l";
 const HOME = "\x1B[H";
@@ -11237,7 +11601,7 @@ async function runScreen(options) {
 	};
 	const indexOfSelected = (rows) => {
 		const index = rows.findIndex((row) => row.sessionId === selectedId);
-		return index >= 0 ? index : 0;
+		return Math.max(index, 0);
 	};
 	const select = (rows, index) => {
 		selectedId = rows[Math.max(0, Math.min(index, rows.length - 1))]?.sessionId;
@@ -11347,8 +11711,7 @@ async function runScreen(options) {
 		render();
 	});
 }
-//#endregion
-//#region src/top/settings.ts
+// src/top/settings.ts
 const DEFAULT_SETTINGS = {
 	ambiguousWide: false,
 	braille: false
@@ -11383,8 +11746,7 @@ async function readTopSettings(homeDir) {
 		braille: braille === true
 	} };
 }
-//#endregion
-//#region src/top/command.ts
+// src/top/command.ts
 const iso$1 = (ms) => new Date(ms).toISOString();
 function toJson(row, nowMs) {
 	return {
@@ -11447,8 +11809,7 @@ async function topCommand(args, deps) {
 	deps.stdout(`${lines.join("\n")}\n`);
 	return 0;
 }
-//#endregion
-//#region src/tune/mcp-config.ts
+// src/tune/mcp-config.ts
 const UNLISTED = "unlisted";
 const PLUGIN_SERVER = /^([A-Za-z0-9._-]+)@[A-Za-z0-9._-]+:(.+)$/;
 const toToolName = (name) => name.replace(/[^A-Za-z0-9_-]/g, "_");
@@ -11468,8 +11829,7 @@ function mcpConfigOf(identifiers) {
 		}
 	};
 }
-//#endregion
-//#region src/tune/vocabulary.ts
+// src/tune/vocabulary.ts
 const CONTINUE_PHRASES = /* @__PURE__ */ new Set([
 	"continue",
 	"go",
@@ -11530,8 +11890,7 @@ const EDIT_TOOLS = /* @__PURE__ */ new Set([
 	"NotebookEdit"
 ]);
 const ISSUE_TOOL = /^mcp__.+__get_issue$/;
-//#endregion
-//#region src/tune/analyze.ts
+// src/tune/analyze.ts
 const ANALYZER_VERSION = "1.1.0";
 const NOT_MEASURED_INTERVENTIONS = /* @__PURE__ */ new Set(["approval", "answer"]);
 const emptyProposalCounts = () => Object.fromEntries(PROPOSAL_KINDS.map((kind) => [kind, {
@@ -11720,8 +12079,7 @@ function analyzeSession(input) {
 		records_skipped: input.skippedLines
 	};
 }
-//#endregion
-//#region src/tune/config-snapshot.ts
+// src/tune/config-snapshot.ts
 async function collectAt(projectRoot, deps, startedMs = deps.now()) {
 	const result = await collectConfig({
 		projectRoot,
@@ -11740,8 +12098,7 @@ async function collectMcpServers(cwd, git, deps) {
 	if (collected.kind === "fixed_failure") return [];
 	return [...new Set(collected.components.filter((c) => c.kind === "mcp_server").map((c) => c.id))];
 }
-//#endregion
-//#region src/tune/applied.ts
+// src/tune/applied.ts
 async function detectApplied(proposals, snapshot) {
 	const byRoot = /* @__PURE__ */ new Map();
 	const collect = (root) => {
@@ -11765,8 +12122,7 @@ async function detectApplied(proposals, snapshot) {
 	}
 	return detected;
 }
-//#endregion
-//#region src/tune/usage.ts
+// src/tune/usage.ts
 const USAGE_KINDS = [
 	"frequent_compaction",
 	"low_cache_reuse",
@@ -11837,8 +12193,7 @@ function modelShares(usages) {
 		subagent: shares(subagent)
 	};
 }
-//#endregion
-//#region src/tune/display.ts
+// src/tune/display.ts
 const median = (values) => {
 	if (values.length === 0) return null;
 	const sorted = [...values].sort((a, b) => a - b);
@@ -11906,8 +12261,7 @@ function localIso(ms) {
 	const pad = (n) => String(n).padStart(2, "0");
 	return `${new Date(ms + offsetMinutes * 6e4).toISOString().slice(0, 19)}${sign}${pad(Math.floor(absolute / 60))}:${pad(absolute % 60)}`;
 }
-//#endregion
-//#region src/tune/followups.ts
+// src/tune/followups.ts
 const PERIOD_MS = 12096e5;
 const MIN_SESSIONS = 5;
 const ratio = (numerator, denominator) => denominator === 0 ? null : numerator / denominator;
@@ -12011,8 +12365,7 @@ function computeFollowups(proposals, sessions, nowMs, rangeSinceMs) {
 		ended
 	};
 }
-//#endregion
-//#region src/tune/lock.ts
+// src/tune/lock.ts
 const LOCK_WAIT_MS = 3e4;
 const STALE_LOCK_MS = 6e4;
 const HEARTBEAT_MS = 1e4;
@@ -12047,8 +12400,7 @@ async function acquireTuneLock(path, deps) {
 		await deps.sleep(RETRY_INTERVAL_MS);
 	}
 }
-//#endregion
-//#region src/tune/messages.ts
+// src/tune/messages.ts
 const NOTICE_ORDER = [
 	"insufficient",
 	"outOfRange",
@@ -12096,7 +12448,7 @@ const TUNE_MESSAGES = {
 	unwritable: "Cannot write to `~/.harnessforce/tune/`, so the analysis results are not sent",
 	recordFailed: "Could not record the suggestion",
 	recordInvalid: (field) => `The suggestion record input is invalid: ${field}`,
-	usage: "Usage: harnessforce tune [--all] [--no-send] [--show-report] [--json], harnessforce tune record, or harnessforce tune --purge",
+	usage: "Usage: harnessforce tune [--all] [--no-send] [--show-report] [--json], harnessforce tune --report-only [--all], harnessforce tune --print-schedule, harnessforce tune record, or harnessforce tune --purge",
 	purged: "Deleted the analysis results, suggestions and unsent analysis results in `~/.harnessforce/tune/`",
 	purgeFailed: "Could not delete some files in `~/.harnessforce/tune/`"
 };
@@ -12122,8 +12474,7 @@ var Notices = class {
 		return code;
 	}
 };
-//#endregion
-//#region src/tune/store.ts
+// src/tune/store.ts
 const tuneDir = (homeDir) => join(homeDir, ".harnessforce", "tune");
 const tunePaths = (homeDir) => {
 	const dir = tuneDir(homeDir);
@@ -12169,8 +12520,7 @@ async function writeFileAtomic(path, content) {
 	}
 }
 const writeJsonFile = (path, value) => writeFileAtomic(path, `${JSON.stringify(value)}\n`);
-//#endregion
-//#region src/tune/proposals.ts
+// src/tune/proposals.ts
 const isRecord = (value) => isObject(value) && typeof value.proposal_id === "string" && typeof value.change_type === "string" && PROPOSAL_KINDS.includes(value.change_type) && Array.isArray(value.evidence_session_ids) && (value.attribution === "pending" || value.attribution === "decided");
 async function readProposals(path) {
 	const value = await readJsonFile(path);
@@ -12209,8 +12559,7 @@ function countProposals(proposals, sessionId) {
 	}
 	return counts;
 }
-//#endregion
-//#region src/tune/saved-state.ts
+// src/tune/saved-state.ts
 async function readDestinations(path) {
 	const value = await readJsonFile(path);
 	return isObject(value) && isObject(value.destinations) ? value.destinations : {};
@@ -12269,8 +12618,7 @@ const writeSessionConfigs = (path, configs) => writeJsonFile(path, {
 		transcript_path: config.transcriptPath
 	}]))
 });
-//#endregion
-//#region src/tune/send.ts
+// src/tune/send.ts
 const BATCH_SIZE = 100;
 const READ_ONLY = "workspace_read_only";
 function parseReply(body, size) {
@@ -12371,8 +12719,7 @@ async function sendReports(options) {
 	result.invalid.reasons = [...reasons];
 	return result;
 }
-//#endregion
-//#region src/tune/sessions.ts
+// src/tune/sessions.ts
 const byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 async function readSubagentUsages(transcriptPath) {
 	const dir = join(dirname(transcriptPath), basename(transcriptPath, ".jsonl"), "subagents");
@@ -12421,8 +12768,7 @@ async function readTuneSessions(options) {
 	}
 	return [...sessions.values()].sort((a, b) => Date.parse(a.session.startedAt) - Date.parse(b.session.startedAt) || byCodeUnit(a.session.sessionId, b.session.sessionId));
 }
-//#endregion
-//#region src/tune/settings.ts
+// src/tune/settings.ts
 const tuneConfigPath = (homeDir) => join(homeDir, ".harnessforce", "config.json");
 const isMissing = (error) => error?.code === "ENOENT";
 async function readSendSetting(homeDir) {
@@ -12447,8 +12793,7 @@ async function readSendSetting(homeDir) {
 	if (typeof sendReport !== "boolean") return "unreadable";
 	return sendReport ? "send" : "no_send";
 }
-//#endregion
-//#region src/tune/command.ts
+// src/tune/command.ts
 const DAY_MS = 864e5;
 const DEFAULT_RANGE_DAYS = 30;
 const SKIPPED_RATIO = .05;
@@ -12689,7 +13034,7 @@ async function analyzeUnderLock(options, access, paths, deps) {
 	]).then(() => true, () => false);
 	if (!isWritten) notices.add("unwritable", TUNE_MESSAGES.unwritable, 1);
 	if (options.json) deps.stdout(`${asciiJson(output)}\n`);
-	else {
+	else if (!options.reportOnly) {
 		deps.stdout(renderAnalysis(analyzed.map((a) => a.report), analyzed.map((a) => a.tune.usage), {
 			sessionCount: analyzed.length,
 			analyzerVersion: ANALYZER_VERSION,
@@ -12730,8 +13075,7 @@ function analyzeCommand(options, deps) {
 		}
 	}, deps.stderr);
 }
-//#endregion
-//#region src/tune/purge.ts
+// src/tune/purge.ts
 async function purgeTuneFiles(paths) {
 	const targets = [
 		paths.repositories,
@@ -12746,8 +13090,7 @@ async function purgeTuneFiles(paths) {
 		force: true
 	})))).every((r) => r.status === "fulfilled");
 }
-//#endregion
-//#region src/tune/analysis-file.ts
+// src/tune/analysis-file.ts
 async function readAnalysisSessions(path) {
 	const value = await readJsonFile(path);
 	const sessions = isObject(value) && Array.isArray(value.sessions) ? value.sessions : [];
@@ -12762,8 +13105,7 @@ async function readAnalysisSessions(path) {
 	}
 	return found;
 }
-//#endregion
-//#region src/tune/record.ts
+// src/tune/record.ts
 const MAX_RECORD_INPUT_BYTES = 1048576;
 const SCOPES = [
 	"user",
@@ -12927,33 +13269,41 @@ async function recordProposal(text, paths, now) {
 		attributed_session_id: record.attributed_session_id
 	};
 }
-//#endregion
-//#region src/tune/tune.ts
+// src/tune/tune.ts
 const FLAGS = {
 	"--all": "all",
 	"--no-send": "noSend",
 	"--show-report": "showReport",
-	"--json": "json"
+	"--json": "json",
+	"--report-only": "reportOnly"
 };
+const REPORT_ONLY = "--report-only";
 function parseArgs(args) {
 	if (args.length === 1 && args[0] === "record") return { kind: "record" };
 	if (args.length === 1 && args[0] === "--purge") return { kind: "purge" };
+	if (args.length === 1 && args[0] === "--print-schedule") return { kind: "printSchedule" };
 	const options = {
 		all: false,
 		noSend: false,
 		showReport: false,
-		json: false
+		json: false,
+		reportOnly: false
 	};
 	for (const arg of args) {
 		const key = FLAGS[arg];
 		if (key === void 0 || options[key]) return void 0;
 		options[key] = true;
 	}
+	if (options.reportOnly && (options.noSend || options.showReport || options.json)) return void 0;
 	return {
 		kind: "analyze",
 		options
 	};
 }
+function cronCommandPath(path) {
+	return (/^[A-Za-z0-9_./-]+$/.test(path) ? path : `'${path.replaceAll("'", "'\\''")}'`).replaceAll("%", "\\%");
+}
+const scheduleLine = (selfPath) => `0 9 * * 1 ${cronCommandPath(selfPath)} tune ${REPORT_ONLY}\n`;
 function canTuneSend(args) {
 	const parsed = parseArgs(args);
 	return parsed?.kind === "analyze" && !parsed.options.noSend;
@@ -13003,6 +13353,10 @@ async function tuneCommand(args, deps) {
 		return 2;
 	}
 	if (parsed.kind === "record") return record(deps);
+	if (parsed.kind === "printSchedule") {
+		deps.stdout(scheduleLine(deps.selfPath));
+		return 0;
+	}
 	if (parsed.kind === "purge") return underLock(deps, TUNE_MESSAGES.purgeFailed, async (paths) => {
 		if (!await purgeTuneFiles(paths)) return stopWith(TUNE_MESSAGES.purgeFailed);
 		deps.stderr(`${TUNE_MESSAGES.purged}\n`);
@@ -13010,8 +13364,7 @@ async function tuneCommand(args, deps) {
 	});
 	return analyzeCommand(parsed.options, deps);
 }
-//#endregion
-//#region src/main.ts
+// src/main.ts
 const { version } = createRequire(import.meta.url)("../package.json");
 const EXIT_CLIENT_UNSUPPORTED = 5;
 function parseInitArgs(args) {
@@ -13108,17 +13461,19 @@ async function run(argv, deps) {
 		git: cli.importGit,
 		now: () => cli.now().getTime()
 	}));
+	if (command === "status") return guarded(() => statusCommand(rest, {
+		...cli,
+		git: cli.importGit,
+		now: () => cli.now().getTime()
+	}));
 	if (command === "tune") return guarded(() => tuneCommand(rest, {
 		...cli,
 		git: cli.importGit,
 		now: () => cli.now().getTime()
 	}));
 	if (command === "hook") {
-		if (rest.length !== 1 || rest[0] !== "session-start") {
-			cli.stderr(HOOK_USAGE);
-			return 1;
-		}
-		return sessionStart({
+		const [event] = rest;
+		const hookDeps = {
 			env: cli.env,
 			homeDir: cli.homeDir,
 			now: cli.now,
@@ -13130,7 +13485,14 @@ async function run(argv, deps) {
 			stderr: cli.stderr,
 			client,
 			defaultUrl: cli.defaultUrl
+		};
+		if (rest.length === 1 && event === "session-start") return sessionStart(hookDeps);
+		if (rest.length === 1 && (event === "post-tool-use" || event === "stop")) return workLocationHook(event, {
+			...hookDeps,
+			hookTmpDir: cli.hookTmpDir
 		});
+		cli.stderr(HOOK_USAGE);
+		return 1;
 	}
 	if (command === "top") return topCommand(rest, {
 		homeDir: cli.homeDir,
@@ -13156,12 +13518,12 @@ async function run(argv, deps) {
 	cli.stderr(UNKNOWN_COMMAND_HINT);
 	return 1;
 }
-//#endregion
-//#region src/relaunch.ts
+// src/relaunch.ts
 const SENDING_COMMANDS = /* @__PURE__ */ new Set([
 	"init",
 	"run",
 	"import",
+	"status",
 	"hook"
 ]);
 const isSending = (argv) => SENDING_COMMANDS.has(argv[0] ?? "") || argv[0] === "tune" && canTuneSend(argv.slice(1));
@@ -13185,8 +13547,7 @@ async function relaunchHf(argv, deps) {
 	deps.stderr(`${RESTART_FAILED}\n`);
 	return 1;
 }
-//#endregion
-//#region src/run/command.ts
+// src/run/command.ts
 const hasSeparator = (command, platform) => platform === "win32" ? /[\\/]/.test(command) : command.includes("/");
 const contextFor = ({ platform, env, cwd, fs }) => ({
 	platform,
@@ -13202,8 +13563,7 @@ async function resolveAgentFile(command, options) {
 function commandLine(file, args, options) {
 	return commandLineFor(file, args, contextFor(options));
 }
-//#endregion
-//#region src/run/process.ts
+// src/run/process.ts
 const IGNORED_WHILE_RUNNING = ["SIGINT", "SIGQUIT"];
 const FORWARDED = ["SIGTERM", "SIGHUP"];
 const FAILED = { kind: "failed" };
@@ -13265,8 +13625,7 @@ function spawnAndWait(command, env) {
 		}));
 	});
 }
-//#endregion
-//#region src/top/process-io.ts
+// src/top/process-io.ts
 const EXIT_SIGNALS = ["SIGTERM", "SIGHUP"];
 function createProcessIo(proc = process) {
 	const { stdin, stdout } = proc;
@@ -13327,8 +13686,7 @@ function createProcessIo(proc = process) {
 		}
 	};
 }
-//#endregion
-//#region src/bin.ts
+// src/bin.ts
 const require = createRequire(import.meta.url);
 const { url: defaultUrl, isDefault } = require("./build-config.json");
 const CALLBACK_TIMEOUT_MS = 3e5;
@@ -13368,6 +13726,7 @@ process.exitCode = relaunched ?? await run(argv, {
 	devBuild: !isDefault,
 	callbackTimeoutMs: CALLBACK_TIMEOUT_MS,
 	cwd: process.cwd(),
+	selfPath: process.argv[1],
 	git: createGitRunner({
 		platform: process.platform,
 		env: process.env,
@@ -13390,6 +13749,7 @@ process.exitCode = relaunched ?? await run(argv, {
 		processCwd: process.cwd(),
 		excludeTarget: true
 	}),
+	hookTmpDir: tmpdir(),
 	sleep: (ms) => setTimeout$1(ms),
 	top: createProcessIo(),
 	readStdin: async (maxBytes) => {
@@ -13403,5 +13763,4 @@ process.exitCode = relaunched ?? await run(argv, {
 		return Buffer.concat(chunks);
 	}
 });
-//#endregion
 export {};