@inerrata-corporation/errata 2.0.19 → 2.0.20-dev.3682

package/errata.mjs

@@ -137,6 +137,9 @@ var init_castalia = __esm({
       "probe-failed"
     ];
     ROUTING_REASONS = [
+      "trusted-system-public",
+      "public-target-staged",
+      "source-membrane",
       /** Harness org (CTF lane, e2e battery, canary) — forced org-private. */
       "harness-clamp",
       "witnessed-vulnerability-private",
@@ -1388,9 +1391,9 @@ function floatSafeRemainder(val, step) {
   const stepInt = Number.parseInt(step.toFixed(decCount).replace(".", ""));
   return valInt % stepInt / 10 ** decCount;
 }
-function defineLazy(object2, key, getter) {
+function defineLazy(object3, key, getter) {
   let value = void 0;
-  Object.defineProperty(object2, key, {
+  Object.defineProperty(object3, key, {
     get() {
       if (value === EVALUATING) {
         return void 0;
@@ -1402,7 +1405,7 @@ function defineLazy(object2, key, getter) {
       return value;
     },
     set(v) {
-      Object.defineProperty(object2, key, {
+      Object.defineProperty(object3, key, {
         value: v
         // configurable: true,
       });
@@ -17175,10 +17178,10 @@ function parseManifest(path2, text) {
   if (name2.endsWith(".gemspec")) return parseGemspec(path2, text);
   return [];
 }
-function buildSpine(sha2, manifestPaths2, readText) {
+function buildSpine(sha2, manifestPaths2, readText2) {
   const manifests = {};
   for (const p of manifestPaths2) {
-    const deps = parseManifest(p, readText(p));
+    const deps = parseManifest(p, readText2(p));
     if (deps.length > 0) manifests[p] = deps;
   }
   return { sha: sha2, manifests };
@@ -21681,7 +21684,11 @@ function priorsForFile(store, relPath) {
   const resolvedProblems = [];
   const seenProblem = /* @__PURE__ */ new Set();
   const related = /* @__PURE__ */ new Map();
-  for (const e of store.inEdges(file2.id, ["ANCHORED_AT"])) {
+  const anchorEdges = [
+    ...store.inEdges(file2.id, ["ANCHORED_AT"]),
+    ...store.outEdges(file2.id, ["DEFINES"]).flatMap((d) => store.inEdges(d.to, ["ANCHORED_AT"]))
+  ];
+  for (const e of anchorEdges) {
     const n = store.getNode(e.from);
     if (!n) continue;
     if (n.label === "Problem" || n.label === "Vulnerability") {
@@ -21929,12 +21936,21 @@ function resolveDesignProblemByStatement(store, statement, fixNote, t) {
   const problemId = identityId({ kind: "DesignProblem", statement });
   return closeDesignProblem(store, problemId, fixNote, t);
 }
+function closableByCaller(node2) {
+  if (node2.attrs["source"] !== "cloud") return true;
+  const visibility = node2.attrs["visibility"];
+  return typeof visibility === "string" && MEMBER_VISIBILITIES.has(visibility);
+}
+function isVerdictable(node2) {
+  return node2.label === "Problem" && node2.attrs["resolvedAt"] == null && (node2.validTo ?? null) === null && !isConstraintProblem(node2) && node2.attrs["kind"] !== "todo";
+}
 function resolveDesignProblemById(store, id, fixNote, t) {
   return closeDesignProblem(store, id.trim(), fixNote, t);
 }
 function closeDesignProblem(store, problemId, fixNote, t) {
   const p = store.getNode(problemId);
   if (!p || p.label !== "Problem" && p.label !== "Vulnerability") return false;
+  if (!closableByCaller(p)) return false;
   if (p.attrs["resolvedAs"]) return false;
   if (fixNote?.trim() && !isFragmentFixNote(fixNote)) {
     const sols = store.outEdges(problemId, ["SOLVED_BY"]).map((e) => store.getNode(e.to)).filter((n) => n !== null);
@@ -22007,6 +22023,7 @@ function retractDesignProblemByStatement(store, statement, resolvedAs, reason, t
 function retractDesignProblem(store, problemId, resolvedAs, reason, t) {
   const p = store.getNode(problemId);
   if (!p || p.label !== "Problem" || p.attrs["resolvedAt"]) return false;
+  if (!closableByCaller(p)) return false;
   store.updateNode(problemId, {
     attrs: {
       ...p.attrs,
@@ -22142,7 +22159,7 @@ function priorExposure(store, nodeId, atSeq) {
   if ((n.attrs["evictedCount"] ?? 0) > 0) return "evicted";
   return "unshown";
 }
-var DESIGN_PROMOTE_AT, STATEMENT_ALIAS_CAP, RECURRENCE_DEBOUNCE_MS, PATTERN_DEDUP_COSINE, PATTERN_ALIAS_CAP, DEDUP_STOPWORDS, SAME_ANCHOR_DEDUP_JACCARD, EMPTY_FOLD_REPORT, SAME_ANCHOR_SCOUT_AUTO_COSINE, SAME_ANCHOR_SCOUT_MIN_COSINE, SAME_ANCHOR_NOMINATE_JACCARD, REOPEN_MIN_SOURCES, RECURRENCE_SOURCES_CAP, CITABLE_PRIOR_LABELS, MAX_ANCHOR_FILES, ENCLOSING_SYMBOL_KINDS, ENCLOSING_WALK_DEPTH, FIX_CANDIDATE_ASK_LIMIT;
+var DESIGN_PROMOTE_AT, STATEMENT_ALIAS_CAP, RECURRENCE_DEBOUNCE_MS, PATTERN_DEDUP_COSINE, PATTERN_ALIAS_CAP, DEDUP_STOPWORDS, SAME_ANCHOR_DEDUP_JACCARD, EMPTY_FOLD_REPORT, SAME_ANCHOR_SCOUT_AUTO_COSINE, SAME_ANCHOR_SCOUT_MIN_COSINE, SAME_ANCHOR_NOMINATE_JACCARD, REOPEN_MIN_SOURCES, RECURRENCE_SOURCES_CAP, CITABLE_PRIOR_LABELS, MAX_ANCHOR_FILES, ENCLOSING_SYMBOL_KINDS, ENCLOSING_WALK_DEPTH, MEMBER_VISIBILITIES, FIX_CANDIDATE_ASK_LIMIT;
 var init_design_problem = __esm({
   "../../packages/local-graph/src/design-problem.ts"() {
     "use strict";
@@ -22219,6 +22236,7 @@ var init_design_problem = __esm({
       "Property"
     ]);
     ENCLOSING_WALK_DEPTH = 8;
+    MEMBER_VISIBILITIES = /* @__PURE__ */ new Set(["project", "team", "org"]);
     FIX_CANDIDATE_ASK_LIMIT = 5;
   }
 });
@@ -25358,6 +25376,7 @@ __export(src_exports2, {
   clearAnsweredRevisits: () => clearAnsweredRevisits,
   clearRevisit: () => clearRevisit,
   clearSettledFixCandidates: () => clearSettledFixCandidates,
+  closableByCaller: () => closableByCaller,
   communityInductionRequests: () => communityInductionRequests,
   communitySeeds: () => communitySeeds,
   compareSemver: () => compareSemver,
@@ -25396,6 +25415,7 @@ __export(src_exports2, {
   isFragmentFixNote: () => isFragmentFixNote,
   isPlaceholderStatement: () => isPlaceholderStatement,
   isUnfilledPlaceholder: () => isUnfilledPlaceholder,
+  isVerdictable: () => isVerdictable,
   learnedConductance: () => learnedConductance,
   linkProblemToLanguages: () => linkProblemToLanguages,
   linkProblemToPackages: () => linkProblemToPackages,
@@ -25923,6 +25943,13 @@ function renderSnapshot(s) {
       lines.push("_Priors that speak to it \u2014 cite one with its `[handle]` if you lean on it:_");
       for (const h of si.hits) {
         lines.push(`- **${h.description}** \u2014 \`${h.id}\``);
+        if (h.verdict === "own") {
+          lines.push(
+            `  - still open \u2014 did this work settle it? fixed \u2192 (fix:[${h.id}]) \xB7 not a real problem \u2192 an \`errata-resolved\` block with \`id: ` + h.id + "`, `disposition: false_positive`, `reason: \u2026` \xB7 still open \u2192 say nothing"
+          );
+        } else if (h.verdict === "foreign") {
+          lines.push(`  - open in another membrane \u2014 not yours to close: (confirm:[${h.id}]) it held \xB7 (refute:[${h.id}] one line why)`);
+        }
       }
     }
     if (si.remoteHits?.length) {
@@ -27795,8 +27822,8 @@ var init_config = __esm({
     "use strict";
     init_paths();
     LEGACY_CLOUD_URL = "https://inerrata-gateway.onrender.com";
-    DEFAULT_CLOUD_URL = true ? "https://inerrata.dev" : DEV_CLOUD_URL;
-    DEFAULT_UPDATE_CHANNEL = true ? "latest" : "dev";
+    DEFAULT_CLOUD_URL = true ? "https://dev.inerrata.dev" : DEV_CLOUD_URL;
+    DEFAULT_UPDATE_CHANNEL = false ? "latest" : "dev";
   }
 });
 
@@ -29219,9 +29246,9 @@ var init_context = __esm({
        * })
        * ```
        */
-      json = (object2, arg, headers) => {
+      json = (object3, arg, headers) => {
         return this.#newResponse(
-          JSON.stringify(object2),
+          JSON.stringify(object3),
           arg,
           setDefaultContentType("application/json", headers)
         );
@@ -32524,7 +32551,10 @@ var init_agent_signals = __esm({
       // lean-on corroboration lived, because only corroboration had an inline path. Grammar
       // single-sourced with parseInlineTags' CONFIRM_PREFIX/REFUTE_PREFIX.
       confirm: (ref) => `(confirm:[${ref}])`,
-      refute: (ref) => `(refute:[${ref}] one line why)`
+      refute: (ref) => `(refute:[${ref}] one line why)`,
+      // RETRACT — "not a real problem": the errata-resolved block with a disposition
+      // (parseDesignResolutions, turn.ts). No inline form exists; the block is the grammar.
+      retract: (id) => ["```errata-resolved", `id: ${id}`, "disposition: false_positive", "reason: why it was never a real problem", "```"].join("\n")
     };
     TAG_OPENERS = [
       ...new Set(
@@ -53491,6 +53521,7 @@ __export(webui_exports, {
   asFailedPostToolUse: () => asFailedPostToolUse,
   buildWebUi: () => buildWebUi,
   decideContextInject: () => decideContextInject,
+  editVerdict: () => editVerdict,
   errorRecallTerms: () => errorRecallTerms,
   fileRecall: () => fileRecall,
   fileUriToFsPath: () => fileUriToFsPath,
@@ -53601,6 +53632,26 @@ ${lines.join("\n")}
     card
   };
 }
+function editVerdict(store, relPath) {
+  const priors = priorsForFile(store, relPath);
+  if (!priors || priors.openProblems.length === 0) return null;
+  const ranked = rankByRelevance(store, priors.file.id, priors.openProblems.map((n) => n.id));
+  const rank = new Map(ranked.map((r, i2) => [r.id, i2]));
+  const asked = [...priors.openProblems].sort((a, b) => (rank.get(a.id) ?? 0) - (rank.get(b.id) ?? 0)).slice(0, 3);
+  const lines = asked.map(
+    (p) => closableByCaller(p) ? recallLine(p, `fixed: ${TAG_EXAMPLE.fix(p.id)} \xB7 not a real problem: retract it (block below) \xB7 still open: say nothing`) : recallLine(p, `another membrane's \u2014 not yours to close: ${TAG_EXAMPLE.confirm(p.id)} it held \xB7 ${TAG_EXAMPLE.refute(p.id)}`)
+  );
+  const retractable = asked.find((p) => closableByCaller(p));
+  const shown = asked.map(deliveredPrior);
+  const headline = `verdict asked: ${plural(shown.length, "open problem")} on ${relPath.split("/").slice(-2).join("/")}`;
+  return {
+    context: `errata \u2014 you just edited ${relPath}; ${plural(priors.openProblems.length, "open problem")} recorded on it. Give each one below a verdict in your reply:
+${lines.join("\n")}
+` + (retractable ? `Retract (not a real problem):
+${TAG_EXAMPLE.retract(retractable.id)}` : ""),
+    card: deliveredCard(store, headline, shown) ?? { headline, items: [] }
+  };
+}
 function workspacePackageIds(store) {
   const hit = wsPackagesCache.get(store);
   const now = Date.now();
@@ -53671,6 +53722,7 @@ function buildWebUi(deps) {
   const B = deps.basePath ?? "";
   const lastInjectedHash = /* @__PURE__ */ new Map();
   const fileRecallSeen = /* @__PURE__ */ new Map();
+  const editVerdictAsked = /* @__PURE__ */ new Map();
   const lastSubagentInjectAt = /* @__PURE__ */ new Map();
   const noteSessionFrom = (headerOrigin, body2, ended = false) => {
     const { sessionId, agentId } = hookAudience(body2);
@@ -53935,6 +53987,27 @@ function buildWebUi(deps) {
         }
       }
     }
+    if (event === "PostToolUse" && !recall && rel && (tool === "Edit" || tool === "MultiEdit" || tool === "Write" || tool === "NotebookEdit")) {
+      const sid = hookAudience(body2).contextKey;
+      let asked = editVerdictAsked.get(sid);
+      if (!asked) {
+        asked = /* @__PURE__ */ new Set();
+        editVerdictAsked.set(sid, asked);
+      }
+      if (!asked.has(rel)) {
+        const verdict = editVerdict(deps.store, rel);
+        if (verdict) {
+          asked.add(rel);
+          let seen = fileRecallSeen.get(sid);
+          if (!seen) {
+            seen = /* @__PURE__ */ new Set();
+            fileRecallSeen.set(sid, seen);
+          }
+          seen.add(rel);
+          recall = verdict;
+        }
+      }
+    }
     if (event === "PostToolUse" && !recall && rel && (tool === "Read" || tool === "Edit" || tool === "Write" || tool === "NotebookEdit")) {
       const sid = hookAudience(body2).contextKey;
       let seen = fileRecallSeen.get(sid);
@@ -54397,8 +54470,8 @@ var require_ignore = __commonJS({
       TMP_KEY_IGNORE = Symbol.for("node-ignore");
     }
     var KEY_IGNORE = TMP_KEY_IGNORE;
-    var define = (object2, key, value) => {
-      Object.defineProperty(object2, key, { value });
+    var define = (object3, key, value) => {
+      Object.defineProperty(object3, key, { value });
       return value;
     };
     var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;
@@ -55528,7 +55601,7 @@ var require_util = __commonJS({
     var net = __require("node:net");
     var { Blob: Blob2 } = __require("node:buffer");
     var nodeUtil = __require("node:util");
-    var { stringify } = __require("node:querystring");
+    var { stringify: stringify2 } = __require("node:querystring");
     var { EventEmitter: EE } = __require("node:events");
     var { InvalidArgumentError } = require_errors();
     var { headerNameLowerCasedRecord } = require_constants();
@@ -55572,23 +55645,23 @@ var require_util = __commonJS({
     function isStream(obj) {
       return obj && typeof obj === "object" && typeof obj.pipe === "function" && typeof obj.on === "function";
     }
-    function isBlobLike(object2) {
-      if (object2 === null) {
+    function isBlobLike(object3) {
+      if (object3 === null) {
         return false;
-      } else if (object2 instanceof Blob2) {
+      } else if (object3 instanceof Blob2) {
         return true;
-      } else if (typeof object2 !== "object") {
+      } else if (typeof object3 !== "object") {
         return false;
       } else {
-        const sTag = object2[Symbol.toStringTag];
-        return (sTag === "Blob" || sTag === "File") && ("stream" in object2 && typeof object2.stream === "function" || "arrayBuffer" in object2 && typeof object2.arrayBuffer === "function");
+        const sTag = object3[Symbol.toStringTag];
+        return (sTag === "Blob" || sTag === "File") && ("stream" in object3 && typeof object3.stream === "function" || "arrayBuffer" in object3 && typeof object3.arrayBuffer === "function");
       }
     }
     function buildURL(url2, queryParams) {
       if (url2.includes("?") || url2.includes("#")) {
         throw new Error('Query params cannot be passed when url already contains "?" or "#".');
       }
-      const stringified = stringify(queryParams);
+      const stringified = stringify2(queryParams);
       if (stringified) {
         url2 += "?" + stringified;
       }
@@ -55863,8 +55936,8 @@ var require_util = __commonJS({
         }
       );
     }
-    function isFormDataLike(object2) {
-      return object2 && typeof object2 === "object" && typeof object2.append === "function" && typeof object2.delete === "function" && typeof object2.get === "function" && typeof object2.getAll === "function" && typeof object2.has === "function" && typeof object2.set === "function" && object2[Symbol.toStringTag] === "FormData";
+    function isFormDataLike(object3) {
+      return object3 && typeof object3 === "object" && typeof object3.append === "function" && typeof object3.delete === "function" && typeof object3.get === "function" && typeof object3.getAll === "function" && typeof object3.has === "function" && typeof object3.set === "function" && object3[Symbol.toStringTag] === "FormData";
     }
     function addAbortListener(signal, listener) {
       if ("addEventListener" in signal) {
@@ -57990,7 +58063,7 @@ var require_data_url = __commonJS({
       const buffer = Buffer.from(data, "base64");
       return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
     }
-    function collectAnHTTPQuotedString(input, position, extractValue) {
+    function collectAnHTTPQuotedString(input, position, extractValue2) {
       const positionStart = position.position;
       let value = "";
       assert2(input[position.position] === '"');
@@ -58018,7 +58091,7 @@ var require_data_url = __commonJS({
           break;
         }
       }
-      if (extractValue) {
+      if (extractValue2) {
         return value;
       }
       return input.slice(positionStart, position.position);
@@ -58618,8 +58691,8 @@ var require_util2 = __commonJS({
       }
       return "allowed";
     }
-    function isErrorLike(object2) {
-      return object2 instanceof Error || (object2?.constructor?.name === "Error" || object2?.constructor?.name === "DOMException");
+    function isErrorLike(object3) {
+      return object3 instanceof Error || (object3?.constructor?.name === "Error" || object3?.constructor?.name === "DOMException");
     }
     function isValidReasonPhrase(statusText) {
       for (let i2 = 0; i2 < statusText.length; ++i2) {
@@ -59044,7 +59117,7 @@ var require_util2 = __commonJS({
         return new FastIterableIterator(target, kind);
       };
     }
-    function iteratorMixin(name2, object2, kInternalIterator, keyIndex = 0, valueIndex = 1) {
+    function iteratorMixin(name2, object3, kInternalIterator, keyIndex = 0, valueIndex = 1) {
       const makeIterator = createIterator(name2, kInternalIterator, keyIndex, valueIndex);
       const properties = {
         keys: {
@@ -59052,7 +59125,7 @@ var require_util2 = __commonJS({
           enumerable: true,
           configurable: true,
           value: function keys() {
-            webidl.brandCheck(this, object2);
+            webidl.brandCheck(this, object3);
             return makeIterator(this, "key");
           }
         },
@@ -59061,7 +59134,7 @@ var require_util2 = __commonJS({
           enumerable: true,
           configurable: true,
           value: function values() {
-            webidl.brandCheck(this, object2);
+            webidl.brandCheck(this, object3);
             return makeIterator(this, "value");
           }
         },
@@ -59070,7 +59143,7 @@ var require_util2 = __commonJS({
           enumerable: true,
           configurable: true,
           value: function entries() {
-            webidl.brandCheck(this, object2);
+            webidl.brandCheck(this, object3);
             return makeIterator(this, "key+value");
           }
         },
@@ -59079,7 +59152,7 @@ var require_util2 = __commonJS({
           enumerable: true,
           configurable: true,
           value: function forEach(callbackfn, thisArg = globalThis) {
-            webidl.brandCheck(this, object2);
+            webidl.brandCheck(this, object3);
             webidl.argumentLengthCheck(arguments, 1, `${name2}.forEach`);
             if (typeof callbackfn !== "function") {
               throw new TypeError(
@@ -59092,7 +59165,7 @@ var require_util2 = __commonJS({
           }
         }
       };
-      return Object.defineProperties(object2.prototype, {
+      return Object.defineProperties(object3.prototype, {
         ...properties,
         [Symbol.iterator]: {
           writable: true,
@@ -59492,8 +59565,8 @@ var require_file = __commonJS({
       }
     };
     webidl.converters.Blob = webidl.interfaceConverter(Blob2);
-    function isFileLike(object2) {
-      return object2 instanceof File2 || object2 && (typeof object2.stream === "function" || typeof object2.arrayBuffer === "function") && object2[Symbol.toStringTag] === "File";
+    function isFileLike(object3) {
+      return object3 instanceof File2 || object3 && (typeof object3.stream === "function" || typeof object3.arrayBuffer === "function") && object3[Symbol.toStringTag] === "File";
     }
     module2.exports = { FileLike, isFileLike };
   }
@@ -59941,12 +60014,12 @@ var require_body = __commonJS({
         }
       });
     }
-    function extractBody(object2, keepalive = false) {
+    function extractBody(object3, keepalive = false) {
       let stream = null;
-      if (object2 instanceof ReadableStream) {
-        stream = object2;
-      } else if (isBlobLike(object2)) {
-        stream = object2.stream();
+      if (object3 instanceof ReadableStream) {
+        stream = object3;
+      } else if (isBlobLike(object3)) {
+        stream = object3.stream();
       } else {
         stream = new ReadableStream({
           async pull(controller) {
@@ -59966,17 +60039,17 @@ var require_body = __commonJS({
       let source = null;
       let length = null;
       let type = null;
-      if (typeof object2 === "string") {
-        source = object2;
+      if (typeof object3 === "string") {
+        source = object3;
         type = "text/plain;charset=UTF-8";
-      } else if (object2 instanceof URLSearchParams) {
-        source = object2.toString();
+      } else if (object3 instanceof URLSearchParams) {
+        source = object3.toString();
         type = "application/x-www-form-urlencoded;charset=UTF-8";
-      } else if (isArrayBuffer(object2)) {
-        source = new Uint8Array(object2.slice());
-      } else if (ArrayBuffer.isView(object2)) {
-        source = new Uint8Array(object2.buffer.slice(object2.byteOffset, object2.byteOffset + object2.byteLength));
-      } else if (util.isFormDataLike(object2)) {
+      } else if (isArrayBuffer(object3)) {
+        source = new Uint8Array(object3.slice());
+      } else if (ArrayBuffer.isView(object3)) {
+        source = new Uint8Array(object3.buffer.slice(object3.byteOffset, object3.byteOffset + object3.byteLength));
+      } else if (util.isFormDataLike(object3)) {
         const boundary = `----formdata-undici-0${`${random(1e11)}`.padStart(11, "0")}`;
         const prefix = `--${boundary}\r
 Content-Disposition: form-data`;
@@ -59986,7 +60059,7 @@ Content-Disposition: form-data`;
         const rn = new Uint8Array([13, 10]);
         length = 0;
         let hasUnknownSizeValue = false;
-        for (const [name2, value] of object2) {
+        for (const [name2, value] of object3) {
           if (typeof value === "string") {
             const chunk2 = textEncoder.encode(prefix + `; name="${escape(normalizeLinefeeds(name2))}"\r
 \r
@@ -60014,7 +60087,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
         if (hasUnknownSizeValue) {
           length = null;
         }
-        source = object2;
+        source = object3;
         action = async function* () {
           for (const part of blobParts) {
             if (part.stream) {
@@ -60025,22 +60098,22 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           }
         };
         type = `multipart/form-data; boundary=${boundary}`;
-      } else if (isBlobLike(object2)) {
-        source = object2;
-        length = object2.size;
-        if (object2.type) {
-          type = object2.type;
+      } else if (isBlobLike(object3)) {
+        source = object3;
+        length = object3.size;
+        if (object3.type) {
+          type = object3.type;
         }
-      } else if (typeof object2[Symbol.asyncIterator] === "function") {
+      } else if (typeof object3[Symbol.asyncIterator] === "function") {
         if (keepalive) {
           throw new TypeError("keepalive");
         }
-        if (util.isDisturbed(object2) || object2.locked) {
+        if (util.isDisturbed(object3) || object3.locked) {
           throw new TypeError(
             "Response body object should not be disturbed or locked"
           );
         }
-        stream = object2 instanceof ReadableStream ? object2 : ReadableStreamFrom(object2);
+        stream = object3 instanceof ReadableStream ? object3 : ReadableStreamFrom(object3);
       }
       if (typeof source === "string" || util.isBuffer(source)) {
         length = Buffer.byteLength(source);
@@ -60049,7 +60122,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
         let iterator;
         stream = new ReadableStream({
           async start() {
-            iterator = action(object2)[Symbol.asyncIterator]();
+            iterator = action(object3)[Symbol.asyncIterator]();
           },
           async pull(controller) {
             const { value, done } = await iterator.next();
@@ -60077,12 +60150,12 @@ Content-Type: ${value.type || "application/octet-stream"}\r
       const body2 = { stream, source, length };
       return [body2, type];
     }
-    function safelyExtractBody(object2, keepalive = false) {
-      if (object2 instanceof ReadableStream) {
-        assert2(!util.isDisturbed(object2), "The body has already been consumed.");
-        assert2(!object2.locked, "The stream is locked.");
+    function safelyExtractBody(object3, keepalive = false) {
+      if (object3 instanceof ReadableStream) {
+        assert2(!util.isDisturbed(object3), "The body has already been consumed.");
+        assert2(!object3.locked, "The stream is locked.");
       }
-      return extractBody(object2, keepalive);
+      return extractBody(object3, keepalive);
     }
     function cloneBody(instance2, body2) {
       const [out1, out2] = body2.stream.tee();
@@ -60162,12 +60235,12 @@ Content-Type: ${value.type || "application/octet-stream"}\r
     function mixinBody(prototype) {
       Object.assign(prototype.prototype, bodyMixinMethods(prototype));
     }
-    async function consumeBody(object2, convertBytesToJSValue, instance2) {
-      webidl.brandCheck(object2, instance2);
-      if (bodyUnusable(object2)) {
+    async function consumeBody(object3, convertBytesToJSValue, instance2) {
+      webidl.brandCheck(object3, instance2);
+      if (bodyUnusable(object3)) {
         throw new TypeError("Body is unusable: Body has already been read");
       }
-      throwIfAborted(object2[kState]);
+      throwIfAborted(object3[kState]);
       const promise2 = createDeferredPromise();
       const errorSteps = (error48) => promise2.reject(error48);
       const successSteps = (data) => {
@@ -60177,15 +60250,15 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           errorSteps(e);
         }
       };
-      if (object2[kState].body == null) {
+      if (object3[kState].body == null) {
         successSteps(Buffer.allocUnsafe(0));
         return promise2.promise;
       }
-      await fullyReadBody(object2[kState].body, successSteps, errorSteps);
+      await fullyReadBody(object3[kState].body, successSteps, errorSteps);
       return promise2.promise;
     }
-    function bodyUnusable(object2) {
-      const body2 = object2[kState].body;
+    function bodyUnusable(object3) {
+      const body2 = object3[kState].body;
       return body2 != null && (body2.stream.locked || util.isDisturbed(body2.stream));
     }
     function parseJSONFromBytes(bytes) {
@@ -66232,10 +66305,10 @@ var require_headers = __commonJS({
       while (j > i2 && isHTTPWhiteSpaceCharCode(potentialValue.charCodeAt(i2))) ++i2;
       return i2 === 0 && j === potentialValue.length ? potentialValue : potentialValue.substring(i2, j);
     }
-    function fill(headers, object2) {
-      if (Array.isArray(object2)) {
-        for (let i2 = 0; i2 < object2.length; ++i2) {
-          const header = object2[i2];
+    function fill(headers, object3) {
+      if (Array.isArray(object3)) {
+        for (let i2 = 0; i2 < object3.length; ++i2) {
+          const header = object3[i2];
           if (header.length !== 2) {
             throw webidl.errors.exception({
               header: "Headers constructor",
@@ -66244,10 +66317,10 @@ var require_headers = __commonJS({
           }
           appendHeader(headers, header[0], header[1]);
         }
-      } else if (typeof object2 === "object" && object2 !== null) {
-        const keys = Object.keys(object2);
+      } else if (typeof object3 === "object" && object3 !== null) {
+        const keys = Object.keys(object3);
         for (let i2 = 0; i2 < keys.length; ++i2) {
-          appendHeader(headers, keys[i2], object2[keys[i2]]);
+          appendHeader(headers, keys[i2], object3[keys[i2]]);
         }
       } else {
         throw webidl.errors.conversionFailed({
@@ -70485,7 +70558,7 @@ var require_util6 = __commonJS({
         throw new Error("Invalid cookie max-age");
       }
     }
-    function stringify(cookie) {
+    function stringify2(cookie) {
       if (cookie.name.length === 0) {
         return null;
       }
@@ -70539,7 +70612,7 @@ var require_util6 = __commonJS({
       validateCookiePath,
       validateCookieValue,
       toIMFDate,
-      stringify
+      stringify: stringify2
     };
   }
 });
@@ -70689,7 +70762,7 @@ var require_cookies = __commonJS({
   "../../node_modules/.pnpm/undici@6.24.1/node_modules/undici/lib/web/cookies/index.js"(exports, module2) {
     "use strict";
     var { parseSetCookie } = require_parse();
-    var { stringify } = require_util6();
+    var { stringify: stringify2 } = require_util6();
     var { webidl } = require_webidl();
     var { Headers: Headers2 } = require_headers();
     function getCookies(headers) {
@@ -70732,7 +70805,7 @@ var require_cookies = __commonJS({
       webidl.argumentLengthCheck(arguments, 2, "setCookie");
       webidl.brandCheck(headers, Headers2, { strict: false });
       cookie = webidl.converters.Cookie(cookie);
-      const str = stringify(cookie);
+      const str = stringify2(cookie);
       if (str) {
         headers.append("Set-Cookie", str);
       }
@@ -73619,8 +73692,8 @@ var init_report_render = __esm({
 
 // src/cli.ts
 init_src6();
-import { closeSync as closeSync2, existsSync as existsSync39, openSync as openSync2, readFileSync as readFileSync41, renameSync as renameSync6, statSync as statSync12 } from "node:fs";
-import { join as join48, resolve as pathResolve2 } from "node:path";
+import { closeSync as closeSync2, existsSync as existsSync40, openSync as openSync2, readFileSync as readFileSync42, renameSync as renameSync7, statSync as statSync12 } from "node:fs";
+import { join as join49, resolve as pathResolve2 } from "node:path";
 import { spawn as spawn5 } from "node:child_process";
 
 // src/daemon.ts
@@ -82706,7 +82779,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.19" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.20-dev.3682" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -83167,7 +83240,8 @@ function createWorkspaceEngine(opts) {
         id: h.node.id,
         label: h.node.label,
         description: h.node.description,
-        coverage: h.coverage
+        coverage: h.coverage,
+        ...isVerdictable(h.node) ? { verdict: closableByCaller(h.node) ? "own" : "foreign" } : {}
       })),
       ...collective && collective.hits.length > 0 ? {
         remoteHits: collective.hits.slice(0, 4).map((n) => ({ id: n.id, label: n.label, description: n.description }))
@@ -84176,7 +84250,11 @@ function createWorkspaceEngine(opts) {
           const closed = resolveDesignProblemById(store, pid, fx.fixNote, t);
           if (!closed) {
             const n = store.getNode(pid);
-            if (!n || n.label !== "Problem" && n.label !== "Vulnerability" || n.attrs["resolvedAs"] != null) {
+            if (n && n.attrs["resolvedAt"] == null && !closableByCaller(n)) {
+              console.warn(
+                `[errata] fix tag not applied: ${pid.slice(0, 32)} belongs to a membrane you are not in \u2014 a verdict closes only your own problems; cite it with (confirm:[id]) or (refute:[id] why) instead`
+              );
+            } else if (!n || n.label !== "Problem" && n.label !== "Vulnerability" || n.attrs["resolvedAs"] != null) {
               console.warn(
                 `[errata] fix tag went nowhere: ${!n ? `id ${pid.slice(0, 32)} unknown` : n.label !== "Problem" ? `${pid.slice(0, 32)} is a ${n.label}, not a Problem` : "the problem was retracted \u2014 a retraction is not fixable"} \u2014 the fix was NOT recorded`
               );
@@ -88253,7 +88331,7 @@ async function historicalAnchors(input) {
     if (m) beforeTokens.set(m[2], m[1]);
   }
   const parsed = /* @__PURE__ */ new Map();
-  const parse4 = (commit, token) => {
+  const parse5 = (commit, token) => {
     const path2 = input.bundle.pathTokens[token];
     if (!path2 || /[\r\n]/.test(path2) || !pathAllowedByFloor(path2) || isPathBlocked(ignore2, path2)) return Promise.resolve(null);
     const provider = providers.find((p) => p.fileExtensions.includes(extname4(path2).toLowerCase()));
@@ -88292,7 +88370,7 @@ async function historicalAnchors(input) {
         const commit = side === "after" ? input.unit.sha : input.unit.parents[0];
         const token = side === "after" ? block.pathToken : beforeTokens.get(block.pathToken);
         if (commit && /^[a-f0-9]{40,64}$/.test(commit) && token) {
-          const file2 = await parse4(commit, token);
+          const file2 = await parse5(commit, token);
           const row = (side === "after" ? after : before) - 1;
           const start2 = file2?.offsets[row], stop2 = file2?.offsets[row + 1];
           if (file2 && start2 !== void 0 && stop2 !== void 0) {
@@ -92519,18 +92597,836 @@ function consolidationGapMs(lastPassMs, policy) {
   return Math.max(policy.baseFloorMs, lastPassMs * policy.dutyFactor);
 }
 
+// src/codex-context-plugin.ts
+import { createHash as createHash20 } from "node:crypto";
+import { cpSync as cpSync2, existsSync as existsSync36, mkdirSync as mkdirSync10, readFileSync as readFileSync38, renameSync as renameSync6, writeFileSync as writeFileSync28 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join45 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/error.js
+function getLineColFromPtr(string4, ptr) {
+  let lines = string4.slice(0, ptr).split(/\r\n|\n|\r/g);
+  return [lines.length, lines.pop().length + 1];
+}
+function makeCodeBlock(string4, line, column) {
+  let lines = string4.split(/\r\n|\n|\r/g);
+  let codeblock = "";
+  let numberLen = (Math.log10(line + 1) | 0) + 1;
+  for (let i2 = line - 1; i2 <= line + 1; i2++) {
+    let l = lines[i2 - 1];
+    if (!l)
+      continue;
+    codeblock += i2.toString().padEnd(numberLen, " ");
+    codeblock += ":  ";
+    codeblock += l;
+    codeblock += "\n";
+    if (i2 === line) {
+      codeblock += " ".repeat(numberLen + column + 2);
+      codeblock += "^\n";
+    }
+  }
+  return codeblock;
+}
+var TomlError = class extends Error {
+  line;
+  column;
+  codeblock;
+  constructor(message2, options) {
+    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+    const codeblock = makeCodeBlock(options.toml, line, column);
+    super(`Invalid TOML document: ${message2}
+
+${codeblock}`, options);
+    this.line = line;
+    this.column = column;
+    this.codeblock = codeblock;
+  }
+};
+
+// ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/util.js
+function isEscaped(str, ptr) {
+  let i2 = 0;
+  while (str[ptr - ++i2] === "\\")
+    ;
+  return --i2 && i2 % 2;
+}
+function indexOfNewline(str, start2 = 0, end = str.length) {
+  let idx = str.indexOf("\n", start2);
+  if (str[idx - 1] === "\r")
+    idx--;
+  return idx <= end ? idx : -1;
+}
+function skipComment(str, ptr) {
+  for (let i2 = ptr; i2 < str.length; i2++) {
+    let c = str[i2];
+    if (c === "\n")
+      return i2;
+    if (c === "\r" && str[i2 + 1] === "\n")
+      return i2 + 1;
+    if (c < " " && c !== "	" || c === "\x7F") {
+      throw new TomlError("control characters are not allowed in comments", {
+        toml: str,
+        ptr
+      });
+    }
+  }
+  return str.length;
+}
+function skipVoid(str, ptr, banNewLines, banComments) {
+  let c;
+  while (1) {
+    while ((c = str[ptr]) === " " || c === "	" || !banNewLines && (c === "\n" || c === "\r" && str[ptr + 1] === "\n"))
+      ptr++;
+    if (banComments || c !== "#")
+      break;
+    ptr = skipComment(str, ptr);
+  }
+  return ptr;
+}
+function skipUntil(str, ptr, sep6, end, banNewLines = false) {
+  if (!end) {
+    ptr = indexOfNewline(str, ptr);
+    return ptr < 0 ? str.length : ptr;
+  }
+  for (let i2 = ptr; i2 < str.length; i2++) {
+    let c = str[i2];
+    if (c === "#") {
+      i2 = indexOfNewline(str, i2);
+    } else if (c === sep6) {
+      return i2 + 1;
+    } else if (c === end || banNewLines && (c === "\n" || c === "\r" && str[i2 + 1] === "\n")) {
+      return i2;
+    }
+  }
+  throw new TomlError("cannot find end of structure", {
+    toml: str,
+    ptr
+  });
+}
+function getStringEnd(str, seek) {
+  let first = str[seek];
+  let target = first === str[seek + 1] && str[seek + 1] === str[seek + 2] ? str.slice(seek, seek + 3) : first;
+  seek += target.length - 1;
+  do
+    seek = str.indexOf(target, ++seek);
+  while (seek > -1 && first !== "'" && isEscaped(str, seek));
+  if (seek > -1) {
+    seek += target.length;
+    if (target.length > 1) {
+      if (str[seek] === first)
+        seek++;
+      if (str[seek] === first)
+        seek++;
+    }
+  }
+  return seek;
+}
+
+// ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/date.js
+var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i;
+var TomlDate = class _TomlDate extends Date {
+  #hasDate = false;
+  #hasTime = false;
+  #offset = null;
+  constructor(date5) {
+    let hasDate = true;
+    let hasTime = true;
+    let offset = "Z";
+    if (typeof date5 === "string") {
+      let match2 = date5.match(DATE_TIME_RE);
+      if (match2) {
+        if (!match2[1]) {
+          hasDate = false;
+          date5 = `0000-01-01T${date5}`;
+        }
+        hasTime = !!match2[2];
+        hasTime && date5[10] === " " && (date5 = date5.replace(" ", "T"));
+        if (match2[2] && +match2[2] > 23) {
+          date5 = "";
+        } else {
+          offset = match2[3] || null;
+          date5 = date5.toUpperCase();
+          if (!offset && hasTime)
+            date5 += "Z";
+        }
+      } else {
+        date5 = "";
+      }
+    }
+    super(date5);
+    if (!isNaN(this.getTime())) {
+      this.#hasDate = hasDate;
+      this.#hasTime = hasTime;
+      this.#offset = offset;
+    }
+  }
+  isDateTime() {
+    return this.#hasDate && this.#hasTime;
+  }
+  isLocal() {
+    return !this.#hasDate || !this.#hasTime || !this.#offset;
+  }
+  isDate() {
+    return this.#hasDate && !this.#hasTime;
+  }
+  isTime() {
+    return this.#hasTime && !this.#hasDate;
+  }
+  isValid() {
+    return this.#hasDate || this.#hasTime;
+  }
+  toISOString() {
+    let iso = super.toISOString();
+    if (this.isDate())
+      return iso.slice(0, 10);
+    if (this.isTime())
+      return iso.slice(11, 23);
+    if (this.#offset === null)
+      return iso.slice(0, -1);
+    if (this.#offset === "Z")
+      return iso;
+    let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+    offset = this.#offset[0] === "-" ? offset : -offset;
+    let offsetDate = new Date(this.getTime() - offset * 6e4);
+    return offsetDate.toISOString().slice(0, -1) + this.#offset;
+  }
+  static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+    let date5 = new _TomlDate(jsDate);
+    date5.#offset = offset;
+    return date5;
+  }
+  static wrapAsLocalDateTime(jsDate) {
+    let date5 = new _TomlDate(jsDate);
+    date5.#offset = null;
+    return date5;
+  }
+  static wrapAsLocalDate(jsDate) {
+    let date5 = new _TomlDate(jsDate);
+    date5.#hasTime = false;
+    date5.#offset = null;
+    return date5;
+  }
+  static wrapAsLocalTime(jsDate) {
+    let date5 = new _TomlDate(jsDate);
+    date5.#hasDate = false;
+    date5.#offset = null;
+    return date5;
+  }
+};
+
+// ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/primitive.js
+var INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
+var FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
+var LEADING_ZERO = /^[+-]?0[0-9_]/;
+var ESCAPE_REGEX = /^[0-9a-f]{2,8}$/i;
+var ESC_MAP = {
+  b: "\b",
+  t: "	",
+  n: "\n",
+  f: "\f",
+  r: "\r",
+  e: "\x1B",
+  '"': '"',
+  "\\": "\\"
+};
+function parseString(str, ptr = 0, endPtr = str.length) {
+  let isLiteral = str[ptr] === "'";
+  let isMultiline = str[ptr++] === str[ptr] && str[ptr] === str[ptr + 1];
+  if (isMultiline) {
+    endPtr -= 2;
+    if (str[ptr += 2] === "\r")
+      ptr++;
+    if (str[ptr] === "\n")
+      ptr++;
+  }
+  let tmp = 0;
+  let isEscape;
+  let parsed = "";
+  let sliceStart = ptr;
+  while (ptr < endPtr - 1) {
+    let c = str[ptr++];
+    if (c === "\n" || c === "\r" && str[ptr] === "\n") {
+      if (!isMultiline) {
+        throw new TomlError("newlines are not allowed in strings", {
+          toml: str,
+          ptr: ptr - 1
+        });
+      }
+    } else if (c < " " && c !== "	" || c === "\x7F") {
+      throw new TomlError("control characters are not allowed in strings", {
+        toml: str,
+        ptr: ptr - 1
+      });
+    }
+    if (isEscape) {
+      isEscape = false;
+      if (c === "x" || c === "u" || c === "U") {
+        let code = str.slice(ptr, ptr += c === "x" ? 2 : c === "u" ? 4 : 8);
+        if (!ESCAPE_REGEX.test(code)) {
+          throw new TomlError("invalid unicode escape", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+        try {
+          parsed += String.fromCodePoint(parseInt(code, 16));
+        } catch {
+          throw new TomlError("invalid unicode escape", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+      } else if (isMultiline && (c === "\n" || c === " " || c === "	" || c === "\r")) {
+        ptr = skipVoid(str, ptr - 1, true);
+        if (str[ptr] !== "\n" && str[ptr] !== "\r") {
+          throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
+            toml: str,
+            ptr: tmp
+          });
+        }
+        ptr = skipVoid(str, ptr);
+      } else if (c in ESC_MAP) {
+        parsed += ESC_MAP[c];
+      } else {
+        throw new TomlError("unrecognized escape sequence", {
+          toml: str,
+          ptr: tmp
+        });
+      }
+      sliceStart = ptr;
+    } else if (!isLiteral && c === "\\") {
+      tmp = ptr - 1;
+      isEscape = true;
+      parsed += str.slice(sliceStart, tmp);
+    }
+  }
+  return parsed + str.slice(sliceStart, endPtr - 1);
+}
+function parseValue(value, toml, ptr, integersAsBigInt) {
+  if (value === "true")
+    return true;
+  if (value === "false")
+    return false;
+  if (value === "-inf")
+    return -Infinity;
+  if (value === "inf" || value === "+inf")
+    return Infinity;
+  if (value === "nan" || value === "+nan" || value === "-nan")
+    return NaN;
+  if (value === "-0")
+    return integersAsBigInt ? 0n : 0;
+  let isInt = INT_REGEX.test(value);
+  if (isInt || FLOAT_REGEX.test(value)) {
+    if (LEADING_ZERO.test(value)) {
+      throw new TomlError("leading zeroes are not allowed", {
+        toml,
+        ptr
+      });
+    }
+    value = value.replace(/_/g, "");
+    let numeric = +value;
+    if (isNaN(numeric)) {
+      throw new TomlError("invalid number", {
+        toml,
+        ptr
+      });
+    }
+    if (isInt) {
+      if ((isInt = !Number.isSafeInteger(numeric)) && !integersAsBigInt) {
+        throw new TomlError("integer value cannot be represented losslessly", {
+          toml,
+          ptr
+        });
+      }
+      if (isInt || integersAsBigInt === true)
+        numeric = BigInt(value);
+    }
+    return numeric;
+  }
+  const date5 = new TomlDate(value);
+  if (!date5.isValid()) {
+    throw new TomlError("invalid value", {
+      toml,
+      ptr
+    });
+  }
+  return date5;
+}
+
+// ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/extract.js
+function sliceAndTrimEndOf(str, startPtr, endPtr) {
+  let value = str.slice(startPtr, endPtr);
+  let commentIdx = value.indexOf("#");
+  if (commentIdx > -1) {
+    skipComment(str, commentIdx);
+    value = value.slice(0, commentIdx);
+  }
+  return [value.trimEnd(), commentIdx];
+}
+function extractValue(str, ptr, end, depth, integersAsBigInt) {
+  if (depth === 0) {
+    throw new TomlError("document contains excessively nested structures. aborting.", {
+      toml: str,
+      ptr
+    });
+  }
+  let c = str[ptr];
+  if (c === "[" || c === "{") {
+    let [value, endPtr2] = c === "[" ? parseArray(str, ptr, depth, integersAsBigInt) : parseInlineTable(str, ptr, depth, integersAsBigInt);
+    if (end) {
+      endPtr2 = skipVoid(str, endPtr2);
+      if (str[endPtr2] === ",")
+        endPtr2++;
+      else if (str[endPtr2] !== end) {
+        throw new TomlError("expected comma or end of structure", {
+          toml: str,
+          ptr: endPtr2
+        });
+      }
+    }
+    return [value, endPtr2];
+  }
+  let endPtr;
+  if (c === '"' || c === "'") {
+    endPtr = getStringEnd(str, ptr);
+    let parsed = parseString(str, ptr, endPtr);
+    if (end) {
+      endPtr = skipVoid(str, endPtr);
+      if (str[endPtr] && str[endPtr] !== "," && str[endPtr] !== end && str[endPtr] !== "\n" && str[endPtr] !== "\r") {
+        throw new TomlError("unexpected character encountered", {
+          toml: str,
+          ptr: endPtr
+        });
+      }
+      endPtr += +(str[endPtr] === ",");
+    }
+    return [parsed, endPtr];
+  }
+  endPtr = skipUntil(str, ptr, ",", end);
+  let slice = sliceAndTrimEndOf(str, ptr, endPtr - +(str[endPtr - 1] === ","));
+  if (!slice[0]) {
+    throw new TomlError("incomplete key-value declaration: no value specified", {
+      toml: str,
+      ptr
+    });
+  }
+  if (end && slice[1] > -1) {
+    endPtr = skipVoid(str, ptr + slice[1]);
+    endPtr += +(str[endPtr] === ",");
+  }
+  return [
+    parseValue(slice[0], str, ptr, integersAsBigInt),
+    endPtr
+  ];
+}
+
+// ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/struct.js
+var KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
+function parseKey(str, ptr, end = "=") {
+  let dot = ptr - 1;
+  let parsed = [];
+  let endPtr = str.indexOf(end, ptr);
+  if (endPtr < 0) {
+    throw new TomlError("incomplete key-value: cannot find end of key", {
+      toml: str,
+      ptr
+    });
+  }
+  do {
+    let c = str[ptr = ++dot];
+    if (c !== " " && c !== "	") {
+      if (c === '"' || c === "'") {
+        if (c === str[ptr + 1] && c === str[ptr + 2]) {
+          throw new TomlError("multiline strings are not allowed in keys", {
+            toml: str,
+            ptr
+          });
+        }
+        let eos = getStringEnd(str, ptr);
+        if (eos < 0) {
+          throw new TomlError("unfinished string encountered", {
+            toml: str,
+            ptr
+          });
+        }
+        dot = str.indexOf(".", eos);
+        let strEnd = str.slice(eos, dot < 0 || dot > endPtr ? endPtr : dot);
+        let newLine = indexOfNewline(strEnd);
+        if (newLine > -1) {
+          throw new TomlError("newlines are not allowed in keys", {
+            toml: str,
+            ptr: ptr + dot + newLine
+          });
+        }
+        if (strEnd.trimStart()) {
+          throw new TomlError("found extra tokens after the string part", {
+            toml: str,
+            ptr: eos
+          });
+        }
+        if (endPtr < eos) {
+          endPtr = str.indexOf(end, eos);
+          if (endPtr < 0) {
+            throw new TomlError("incomplete key-value: cannot find end of key", {
+              toml: str,
+              ptr
+            });
+          }
+        }
+        parsed.push(parseString(str, ptr, eos));
+      } else {
+        dot = str.indexOf(".", ptr);
+        let part = str.slice(ptr, dot < 0 || dot > endPtr ? endPtr : dot);
+        if (!KEY_PART_RE.test(part)) {
+          throw new TomlError("only letter, numbers, dashes and underscores are allowed in keys", {
+            toml: str,
+            ptr
+          });
+        }
+        parsed.push(part.trimEnd());
+      }
+    }
+  } while (dot + 1 && dot < endPtr);
+  return [parsed, skipVoid(str, endPtr + 1, true, true)];
+}
+function parseInlineTable(str, ptr, depth, integersAsBigInt) {
+  let res = {};
+  let seen = /* @__PURE__ */ new Set();
+  let c;
+  ptr++;
+  while ((c = str[ptr++]) !== "}" && c) {
+    if (c === ",") {
+      throw new TomlError("expected value, found comma", {
+        toml: str,
+        ptr: ptr - 1
+      });
+    } else if (c === "#")
+      ptr = skipComment(str, ptr);
+    else if (c !== " " && c !== "	" && c !== "\n" && c !== "\r") {
+      let k;
+      let t = res;
+      let hasOwn = false;
+      let [key, keyEndPtr] = parseKey(str, ptr - 1);
+      for (let i2 = 0; i2 < key.length; i2++) {
+        if (i2)
+          t = hasOwn ? t[k] : t[k] = {};
+        k = key[i2];
+        if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) {
+          throw new TomlError("trying to redefine an already defined value", {
+            toml: str,
+            ptr
+          });
+        }
+        if (!hasOwn && k === "__proto__") {
+          Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+        }
+      }
+      if (hasOwn) {
+        throw new TomlError("trying to redefine an already defined value", {
+          toml: str,
+          ptr
+        });
+      }
+      let [value, valueEndPtr] = extractValue(str, keyEndPtr, "}", depth - 1, integersAsBigInt);
+      seen.add(value);
+      t[k] = value;
+      ptr = valueEndPtr;
+    }
+  }
+  if (!c) {
+    throw new TomlError("unfinished table encountered", {
+      toml: str,
+      ptr
+    });
+  }
+  return [res, ptr];
+}
+function parseArray(str, ptr, depth, integersAsBigInt) {
+  let res = [];
+  let c;
+  ptr++;
+  while ((c = str[ptr++]) !== "]" && c) {
+    if (c === ",") {
+      throw new TomlError("expected value, found comma", {
+        toml: str,
+        ptr: ptr - 1
+      });
+    } else if (c === "#")
+      ptr = skipComment(str, ptr);
+    else if (c !== " " && c !== "	" && c !== "\n" && c !== "\r") {
+      let e = extractValue(str, ptr - 1, "]", depth - 1, integersAsBigInt);
+      res.push(e[0]);
+      ptr = e[1];
+    }
+  }
+  if (!c) {
+    throw new TomlError("unfinished array encountered", {
+      toml: str,
+      ptr
+    });
+  }
+  return [res, ptr];
+}
+
+// ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/parse.js
+function peekTable(key, table, meta3, type) {
+  let t = table;
+  let m = meta3;
+  let k;
+  let hasOwn = false;
+  let state;
+  for (let i2 = 0; i2 < key.length; i2++) {
+    if (i2) {
+      t = hasOwn ? t[k] : t[k] = {};
+      m = (state = m[k]).c;
+      if (type === 0 && (state.t === 1 || state.t === 2)) {
+        return null;
+      }
+      if (state.t === 2) {
+        let l = t.length - 1;
+        t = t[l];
+        m = m[l].c;
+      }
+    }
+    k = key[i2];
+    if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) {
+      return null;
+    }
+    if (!hasOwn) {
+      if (k === "__proto__") {
+        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+        Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
+      }
+      m[k] = {
+        t: i2 < key.length - 1 && type === 2 ? 3 : type,
+        d: false,
+        i: 0,
+        c: {}
+      };
+    }
+  }
+  state = m[k];
+  if (state.t !== type && !(type === 1 && state.t === 3)) {
+    return null;
+  }
+  if (type === 2) {
+    if (!state.d) {
+      state.d = true;
+      t[k] = [];
+    }
+    t[k].push(t = {});
+    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: {} };
+  }
+  if (state.d) {
+    return null;
+  }
+  state.d = true;
+  if (type === 1) {
+    t = hasOwn ? t[k] : t[k] = {};
+  } else if (type === 0 && hasOwn) {
+    return null;
+  }
+  return [k, t, state.c];
+}
+function parse4(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
+  let res = {};
+  let meta3 = {};
+  let tbl = res;
+  let m = meta3;
+  for (let ptr = skipVoid(toml, 0); ptr < toml.length; ) {
+    if (toml[ptr] === "[") {
+      let isTableArray = toml[++ptr] === "[";
+      let k = parseKey(toml, ptr += +isTableArray, "]");
+      if (isTableArray) {
+        if (toml[k[1] - 1] !== "]") {
+          throw new TomlError("expected end of table declaration", {
+            toml,
+            ptr: k[1] - 1
+          });
+        }
+        k[1]++;
+      }
+      let p = peekTable(
+        k[0],
+        res,
+        meta3,
+        isTableArray ? 2 : 1
+        /* Type.EXPLICIT */
+      );
+      if (!p) {
+        throw new TomlError("trying to redefine an already defined table or value", {
+          toml,
+          ptr
+        });
+      }
+      m = p[2];
+      tbl = p[1];
+      ptr = k[1];
+    } else {
+      let k = parseKey(toml, ptr);
+      let p = peekTable(
+        k[0],
+        tbl,
+        m,
+        0
+        /* Type.DOTTED */
+      );
+      if (!p) {
+        throw new TomlError("trying to redefine an already defined table or value", {
+          toml,
+          ptr
+        });
+      }
+      let v = extractValue(toml, k[1], void 0, maxDepth, integersAsBigInt);
+      p[1][p[0]] = v[0];
+      ptr = v[1];
+    }
+    ptr = skipVoid(toml, ptr, true);
+    if (toml[ptr] && toml[ptr] !== "\n" && toml[ptr] !== "\r") {
+      throw new TomlError("each key-value declaration must be followed by an end-of-line", {
+        toml,
+        ptr
+      });
+    }
+    ptr = skipVoid(toml, ptr);
+  }
+  return res;
+}
+
+// src/codex-context-plugin.ts
+var NAME = "errata-context";
+var PREFIX2 = `./.errata/plugins/${NAME}/`;
+var object2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+function readText(file2) {
+  return existsSync36(file2) ? readFileSync38(file2, "utf8") : "";
+}
+function writeChanged(file2, content) {
+  if (readText(file2) === content) return;
+  const temp = `${file2}.${process.pid}.tmp`;
+  writeFileSync28(temp, content, "utf8");
+  renameSync6(temp, file2);
+}
+function bundledContextPlugin() {
+  const packaged = fileURLToPath2(new URL("./resources/context-plugin/", import.meta.url));
+  if (existsSync36(join45(packaged, ".codex-plugin/plugin.json"))) return packaged;
+  return fileURLToPath2(new URL("../dist/resources/context-plugin/", import.meta.url));
+}
+function refreshCodexContextPlugin(root) {
+  const file2 = join45(root, ".agents", "plugins", "marketplace.json");
+  if (!existsSync36(file2)) return false;
+  const marketplace = JSON.parse(readFileSync38(file2, "utf8"));
+  const entries = Array.isArray(marketplace.plugins) ? marketplace.plugins : [];
+  const entry = entries.map(object2).find((value) => value.name === NAME && String(object2(value.source).path).startsWith(PREFIX2));
+  if (!entry) return false;
+  const before = object2(entry.source).path;
+  const installed = installCodexContextPlugin(root);
+  return String(before) !== `${PREFIX2}${installed.plugin.split(/[\\/]/).at(-1)}`;
+}
+function installCodexContextPlugin(root, options = {}) {
+  const bundle = options.bundle ?? bundledContextPlugin();
+  const manifest = JSON.parse(
+    readFileSync38(join45(bundle, ".codex-plugin/plugin.json"), "utf8")
+  );
+  if (manifest.name !== NAME || typeof manifest.version !== "string" || !/^[\w.-]+$/.test(manifest.version)) {
+    throw new Error("Invalid bundled Errata Context manifest.");
+  }
+  const checksums = readFileSync38(join45(bundle, "SHA256SUMS"), "utf8");
+  for (const line of checksums.trim().split("\n")) {
+    const match2 = /^([a-f0-9]{64})  ([\w./-]+)$/.exec(line);
+    if (!match2 || match2[2].startsWith("/") || match2[2].split("/").includes("..")) {
+      throw new Error("Invalid bundled Errata Context checksum manifest.");
+    }
+    const actual = createHash20("sha256").update(readFileSync38(join45(bundle, match2[2]))).digest("hex");
+    if (actual !== match2[1])
+      throw new Error(`Bundled Errata Context checksum mismatch: ${match2[2]}`);
+  }
+  const release = `${manifest.version}-${createHash20("sha256").update(checksums).digest("hex").slice(0, 12)}`;
+  const plugin = join45(root, ".errata", "plugins", NAME, release);
+  const marketplaceFile = join45(root, ".agents", "plugins", "marketplace.json");
+  const priorMarketplace = readText(marketplaceFile);
+  const marketplace = priorMarketplace ? JSON.parse(priorMarketplace) : {
+    name: "errata-local",
+    interface: { displayName: "Errata" },
+    plugins: []
+  };
+  if (typeof marketplace.name !== "string" || !/^[\w.-]+$/.test(marketplace.name) || !Array.isArray(marketplace.plugins)) {
+    throw new Error(`Invalid marketplace at ${marketplaceFile}; preserved it.`);
+  }
+  const entries = marketplace.plugins;
+  const matches = entries.filter((entry2) => entry2.name === NAME);
+  if (matches.length > 1)
+    throw new Error("Duplicate Errata Context marketplace entries; preserved them.");
+  const prior = matches[0];
+  if (prior && !(object2(prior.source).source === "local" && String(object2(prior.source).path).startsWith(PREFIX2))) {
+    throw new Error(
+      "An independently managed Errata Context entry already exists in this marketplace; preserved it."
+    );
+  }
+  const key = `${NAME}@${marketplace.name}`;
+  const configFile = join45(root, ".codex", "config.toml");
+  const config2 = readText(configFile);
+  const parsed = parse4(config2);
+  const plugins = object2(parsed.plugins);
+  const codexHome = options.codexHome ?? process.env["CODEX_HOME"] ?? join45(homedir8(), ".codex");
+  const globalPlugins = object2(parse4(readText(join45(codexHome, "config.toml"))).plugins);
+  const disabledGlobally = Object.entries(globalPlugins).some(
+    ([name2, value]) => (name2 === NAME || name2.startsWith(`${NAME}@`)) && object2(value).enabled === false
+  );
+  const policyDisabled = object2(prior?.policy).installation === "NOT_AVAILABLE";
+  const localSetting = object2(plugins[key]);
+  const hasLocalSetting = Object.hasOwn(plugins, key);
+  const enabled = !policyDisabled && (hasLocalSetting ? localSetting.enabled !== false : !disabledGlobally);
+  const nextConfig = hasLocalSetting ? config2 : config2.trimEnd() + (config2.trim() ? "\n\n" : "") + `# Errata Context: installed by errata's Codex setup.
+[plugins.${JSON.stringify(key)}]
+enabled = ${enabled}
+`;
+  parse4(nextConfig);
+  const entry = {
+    ...prior,
+    name: NAME,
+    source: { source: "local", path: `${PREFIX2}${release}` },
+    policy: prior?.policy ?? { installation: "AVAILABLE", authentication: "ON_INSTALL" },
+    category: prior?.category ?? "Productivity"
+  };
+  marketplace.plugins = [...entries.filter((item2) => item2.name !== NAME), entry];
+  mkdirSync10(plugin, { recursive: true });
+  cpSync2(bundle, plugin, { recursive: true });
+  writeChanged(
+    join45(plugin, ".mcp.json"),
+    JSON.stringify(
+      {
+        mcpServers: {
+          errata_context: {
+            command: options.nodePath ?? process.execPath,
+            args: [join45(plugin, "dist", "mcp-server.mjs")],
+            env: { ERRATA_WORKSPACE: root, ERRATA_CONTEXT_VERSION: manifest.version }
+          }
+        }
+      },
+      null,
+      2
+    ) + "\n"
+  );
+  mkdirSync10(join45(root, ".agents", "plugins"), { recursive: true });
+  mkdirSync10(join45(root, ".codex"), { recursive: true });
+  writeChanged(marketplaceFile, JSON.stringify(marketplace, null, 2) + "\n");
+  writeChanged(configFile, nextConfig);
+  return { plugin, enabled, marketplace: marketplaceFile };
+}
+
 // src/codex-hook-refresh.ts
 init_checkout_root();
-import { existsSync as existsSync36, readdirSync as readdirSync13, readFileSync as readFileSync38 } from "node:fs";
-import { dirname as dirname13, join as join45, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync37, readdirSync as readdirSync13, readFileSync as readFileSync39 } from "node:fs";
+import { dirname as dirname13, join as join46, resolve as resolve8 } from "node:path";
 init_registry();
 function codexHookRoots(roots) {
   const found = new Set(roots.map((root) => resolve8(root)));
   for (const root of [...found]) {
     const main2 = mainCheckoutOfWorktree(root) ?? root;
     found.add(main2);
-    const dir = join45(main2, ".git", "worktrees");
-    if (!existsSync36(dir)) continue;
+    const dir = join46(main2, ".git", "worktrees");
+    if (!existsSync37(dir)) continue;
     let names;
     try {
       names = readdirSync13(dir);
@@ -92539,7 +93435,7 @@ function codexHookRoots(roots) {
     }
     for (const name2 of names) {
       try {
-        const checkout = dirname13(readFileSync38(join45(dir, name2, "gitdir"), "utf8").trim());
+        const checkout = dirname13(readFileSync39(join46(dir, name2, "gitdir"), "utf8").trim());
         if (mainCheckoutOfWorktree(checkout) === main2) found.add(checkout);
       } catch {
       }
@@ -92561,9 +93457,9 @@ function refreshInstalledCodexRelays(roots = listWorkspaceEntries().map((entry)
 }
 
 // src/claude-statusline.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync10, readFileSync as readFileSync39, writeFileSync as writeFileSync28 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname14, join as join46 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync11, readFileSync as readFileSync40, writeFileSync as writeFileSync29 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname14, join as join47 } from "node:path";
 var STATUSLINE_RELAY_SOURCE = String.raw`// errata-managed: regenerated by errata init / install-hooks claude
 import { readFileSync } from 'node:fs';
 
@@ -92611,8 +93507,8 @@ function isSameInstall(value, relay) {
   return command.includes(relay.replace(/\\/g, "/").toLowerCase());
 }
 function userClaudeSettingsPath() {
-  const base = process.env["CLAUDE_CONFIG_DIR"] ?? join46(homedir8(), ".claude");
-  return join46(base, "settings.json");
+  const base = process.env["CLAUDE_CONFIG_DIR"] ?? join47(homedir9(), ".claude");
+  return join47(base, "settings.json");
 }
 function ensureUserStatusLine(opts) {
   const env2 = opts.env ?? process.env;
@@ -92620,23 +93516,23 @@ function ensureUserStatusLine(opts) {
   if (off2 === "0" || off2 === "off" || off2 === "false" || off2 === "no") return "disabled";
   const settingsPath = opts.userSettingsPath ?? userClaudeSettingsPath();
   let settings = {};
-  if (existsSync37(settingsPath)) {
+  if (existsSync38(settingsPath)) {
     try {
-      const parsed = JSON.parse(readFileSync39(settingsPath, "utf8"));
+      const parsed = JSON.parse(readFileSync40(settingsPath, "utf8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "unreadable";
       settings = parsed;
     } catch {
       return "unreadable";
     }
   }
-  const relay = join46(opts.relayDir, STATUSLINE_RELAY_FILE);
+  const relay = join47(opts.relayDir, STATUSLINE_RELAY_FILE);
   const keep = (value) => value !== void 0 && (!isErrataStatusLine(value) || !isSameInstall(value, relay));
   const ownMain = keep(settings["statusLine"]);
   const ownRows = keep(settings["subagentStatusLine"]);
   if (ownMain && ownRows) return "kept-own";
-  mkdirSync10(opts.relayDir, { recursive: true });
-  if (!existsSync37(relay) || readFileSync39(relay, "utf8") !== STATUSLINE_RELAY_SOURCE) {
-    writeFileSync28(relay, STATUSLINE_RELAY_SOURCE, "utf8");
+  mkdirSync11(opts.relayDir, { recursive: true });
+  if (!existsSync38(relay) || readFileSync40(relay, "utf8") !== STATUSLINE_RELAY_SOURCE) {
+    writeFileSync29(relay, STATUSLINE_RELAY_SOURCE, "utf8");
   }
   const nodePath = opts.nodePath ?? process.execPath;
   const next = {
@@ -92647,8 +93543,8 @@ function ensureUserStatusLine(opts) {
     return ownMain ? "kept-own" : "unchanged";
   }
   Object.assign(settings, next);
-  mkdirSync10(dirname14(settingsPath), { recursive: true });
-  writeFileSync28(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  mkdirSync11(dirname14(settingsPath), { recursive: true });
+  writeFileSync29(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
   return "installed";
 }
 function describeStatusLineOutcome(outcome) {
@@ -92667,15 +93563,15 @@ function describeStatusLineOutcome(outcome) {
 }
 
 // src/claude-mods.ts
-import { createHash as createHash20 } from "node:crypto";
-import { cpSync as cpSync2, existsSync as existsSync38, mkdirSync as mkdirSync11, readFileSync as readFileSync40, readdirSync as readdirSync14, rmSync as rmSync4, statSync as statSync11, writeFileSync as writeFileSync29 } from "node:fs";
-import { delimiter as delimiter2, dirname as dirname15, join as join47, relative as relative7, resolve as resolve9, sep as sep5 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { createHash as createHash21 } from "node:crypto";
+import { cpSync as cpSync3, existsSync as existsSync39, mkdirSync as mkdirSync12, readFileSync as readFileSync41, readdirSync as readdirSync14, rmSync as rmSync4, statSync as statSync11, writeFileSync as writeFileSync30 } from "node:fs";
+import { delimiter as delimiter2, dirname as dirname15, join as join48, relative as relative7, resolve as resolve9, sep as sep5 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 var CLAUDE_PLUGIN_DIRS_ENV = "CLAUDE_CODE_PLUGIN_DIRS";
 var HASH_FILE = ".errata-mod-hash";
 function bundledClaudeModsDir() {
   const rel = import.meta.url.endsWith(".mjs") ? "./resources/claude-mods/" : "../claude-mods/";
-  return fileURLToPath2(new URL(rel, import.meta.url));
+  return fileURLToPath3(new URL(rel, import.meta.url));
 }
 function isEngineOwned(relPath) {
   const p = relPath.split(sep5).join("/");
@@ -92684,7 +93580,7 @@ function isEngineOwned(relPath) {
 function listFiles(root, dir = root) {
   const out2 = [];
   for (const name2 of readdirSync14(dir)) {
-    const abs = join47(dir, name2);
+    const abs = join48(dir, name2);
     if (isEngineOwned(relative7(root, abs))) continue;
     if (statSync11(abs).isDirectory()) out2.push(...listFiles(root, abs));
     else out2.push(abs);
@@ -92692,18 +93588,18 @@ function listFiles(root, dir = root) {
   return out2;
 }
 function modHash(dir) {
-  const h = createHash20("sha256");
+  const h = createHash21("sha256");
   for (const abs of listFiles(dir).sort()) {
     h.update(relative7(dir, abs).split(sep5).join("/"));
     h.update("\0");
-    h.update(readFileSync40(abs));
+    h.update(readFileSync41(abs));
     h.update("\0");
   }
   return h.digest("hex");
 }
 function bundledMods(bundleDir) {
-  if (!existsSync38(bundleDir)) return [];
-  return readdirSync14(bundleDir).filter((name2) => existsSync38(join47(bundleDir, name2, ".claude-plugin", "plugin.json")));
+  if (!existsSync39(bundleDir)) return [];
+  return readdirSync14(bundleDir).filter((name2) => existsSync39(join48(bundleDir, name2, ".claude-plugin", "plugin.json")));
 }
 function sameDir(a, b) {
   const norm = (p) => resolve9(p).replace(/[\\/]+$/, "").toLowerCase();
@@ -92718,9 +93614,9 @@ function off(env2) {
   return v === "0" || v === "off" || v === "false" || v === "no";
 }
 function readSettings(path2) {
-  if (!existsSync38(path2)) return {};
+  if (!existsSync39(path2)) return {};
   try {
-    const parsed = JSON.parse(readFileSync40(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync41(path2, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
@@ -92744,13 +93640,13 @@ function currentDirs(settings) {
   return raw2.split(delimiter2).map((s) => s.trim()).filter(Boolean);
 }
 function writeSettings(path2, settings) {
-  mkdirSync11(dirname15(path2), { recursive: true });
-  writeFileSync29(path2, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  mkdirSync12(dirname15(path2), { recursive: true });
+  writeFileSync30(path2, JSON.stringify(settings, null, 2) + "\n", "utf8");
 }
 function ensureClaudeMods(opts) {
   const env2 = opts.env ?? process.env;
   const settingsPath = opts.userSettingsPath ?? userClaudeSettingsPath();
-  const modsRoot = join47(opts.installRoot, "claude-mods");
+  const modsRoot = join48(opts.installRoot, "claude-mods");
   if (off(env2)) {
     const settings2 = readSettings(settingsPath);
     if (!settings2) return { kind: "unreadable" };
@@ -92767,14 +93663,14 @@ function ensureClaudeMods(opts) {
   let changed = false;
   const installed = [];
   for (const name2 of names) {
-    const src = join47(bundleDir, name2);
-    const dest = join47(modsRoot, name2);
+    const src = join48(bundleDir, name2);
+    const dest = join48(modsRoot, name2);
     const hash2 = modHash(src);
-    const hashFile = join47(dest, HASH_FILE);
-    if (!existsSync38(hashFile) || readFileSync40(hashFile, "utf8") !== hash2) {
+    const hashFile = join48(dest, HASH_FILE);
+    if (!existsSync39(hashFile) || readFileSync41(hashFile, "utf8") !== hash2) {
       rmSync4(dest, { recursive: true, force: true });
-      cpSync2(src, dest, { recursive: true, filter: (p) => !isEngineOwned(relative7(src, p)) });
-      writeFileSync29(hashFile, hash2, "utf8");
+      cpSync3(src, dest, { recursive: true, filter: (p) => !isEngineOwned(relative7(src, p)) });
+      writeFileSync30(hashFile, hash2, "utf8");
       changed = true;
     }
     installed.push(dest);
@@ -93195,9 +94091,9 @@ function resolveHookPort(explicit) {
       }
     }
   }
-  const settingsPath = join48(ROOT, ".claude", "settings.json");
+  const settingsPath = join49(ROOT, ".claude", "settings.json");
   try {
-    if (existsSync39(settingsPath)) return installedHookPort(readFileSync41(settingsPath, "utf8")) ?? 7891;
+    if (existsSync40(settingsPath)) return installedHookPort(readFileSync42(settingsPath, "utf8")) ?? 7891;
   } catch {
   }
   return 7891;
@@ -93222,14 +94118,14 @@ async function cmdInit() {
   if (!skipHooks) {
     console.log("");
     console.log("installing harness hooks...");
-    const { existsSync: existsSync40 } = await import("node:fs");
-    const { join: join49 } = await import("node:path");
+    const { existsSync: existsSync41 } = await import("node:fs");
+    const { join: join50 } = await import("node:path");
     try {
       await installClaudeHooks(port);
     } catch (err2) {
       console.warn(`  \u26A0\uFE0F  Claude hook install failed: ${err2 instanceof Error ? err2.message : err2}`);
     }
-    if (existsSync40(join49(ROOT, ".cursor"))) {
+    if (existsSync41(join50(ROOT, ".cursor"))) {
       try {
         await installCursorMcpConfig();
       } catch (err2) {
@@ -93444,9 +94340,9 @@ async function cmdStatus() {
     console.log(`    stack:     ${profile.stack.join(", ") || "(none)"}`);
     console.log(`    languages: ${profile.languages.join(", ") || "(none)"}`);
   }
-  console.log(`  graph db:  ${existsSync39(paths.castalia) ? "yes" : "no"} (${paths.castalia})`);
-  console.log(`  event log: ${existsSync39(paths.eventLog) ? "yes" : "no"} (${paths.eventLog})`);
-  if (existsSync39(paths.castalia)) {
+  console.log(`  graph db:  ${existsSync40(paths.castalia) ? "yes" : "no"} (${paths.castalia})`);
+  console.log(`  event log: ${existsSync40(paths.eventLog) ? "yes" : "no"} (${paths.eventLog})`);
+  if (existsSync40(paths.castalia)) {
     try {
       const { openGraphStore: openGraphStore2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
       const store = openGraphStore2({ path: paths.castalia });
@@ -94440,11 +95336,11 @@ async function cmdInstallationProfile(args2) {
 }
 async function cmdReview() {
   const paths = workspacePaths(ROOT);
-  if (!existsSync39(paths.reviewQueue)) {
+  if (!existsSync40(paths.reviewQueue)) {
     console.log("(review queue empty)");
     return;
   }
-  const queue = JSON.parse(readFileSync41(paths.reviewQueue, "utf8"));
+  const queue = JSON.parse(readFileSync42(paths.reviewQueue, "utf8"));
   if (queue.length === 0) {
     console.log("(review queue empty)");
     return;
@@ -95115,7 +96011,7 @@ async function gatherRepo(store, ws) {
   };
 }
 async function gatherReportData(generatedAt) {
-  const { existsSync: existsSync40 } = await import("node:fs");
+  const { existsSync: existsSync41 } = await import("node:fs");
   const { openGraphStore: openGraphStore2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
   const cfg = loadConfig();
   const outbound = cfg.consent.sync ? "auto" : "off";
@@ -95123,7 +96019,7 @@ async function gatherReportData(generatedAt) {
   for (const ws of listWorkspaces()) {
     if (ws.missing) continue;
     const dbPath = workspacePaths(ws.path).castalia;
-    if (!existsSync40(dbPath)) continue;
+    if (!existsSync41(dbPath)) continue;
     let store = null;
     try {
       store = openGraphStore2({ path: dbPath });
@@ -95154,7 +96050,7 @@ async function gatherReportData(generatedAt) {
   };
 }
 async function cmdReport(args2) {
-  const { mkdirSync: mkdirSync12, writeFileSync: writeFileSync30 } = await import("node:fs");
+  const { mkdirSync: mkdirSync13, writeFileSync: writeFileSync31 } = await import("node:fs");
   const { renderReport: renderReport2 } = await Promise.resolve().then(() => (init_report_render(), report_render_exports));
   const includeFutureVerbs = args2.includes("--future-verbs");
   const now = /* @__PURE__ */ new Date();
@@ -95165,10 +96061,10 @@ async function cmdReport(args2) {
     process.exit(2);
   }
   const outDir = workspacePaths(ROOT).configDir;
-  mkdirSync12(outDir, { recursive: true });
+  mkdirSync13(outDir, { recursive: true });
   const files = renderReport2(data, { includeFutureVerbs });
-  for (const f of files) writeFileSync30(join48(outDir, f.name), f.html, "utf8");
-  const indexPath = join48(outDir, "report.html");
+  for (const f of files) writeFileSync31(join49(outDir, f.name), f.html, "utf8");
+  const indexPath = join49(outDir, "report.html");
   console.log(`report \u2192 ${indexPath}`);
   console.log(
     `  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`
@@ -95224,7 +96120,7 @@ function spawnDaemonDetached(options = {}) {
   try {
     const logPath = daemonLogPath();
     try {
-      if (statSync12(logPath).size > 5 * 1024 * 1024) renameSync6(logPath, `${logPath}.1`);
+      if (statSync12(logPath).size > 5 * 1024 * 1024) renameSync7(logPath, `${logPath}.1`);
     } catch {
     }
     out2 = openSync2(logPath, "a");
@@ -95293,24 +96189,24 @@ async function cmdInstallHooks(args2) {
   }
 }
 async function installOpencodePlugin(port) {
-  const { mkdirSync: mkdirSync12, existsSync: existsSync40, readFileSync: readFileSync42, writeFileSync: writeFileSync30 } = await import("node:fs");
-  const { join: join49 } = await import("node:path");
-  const dir = join49(ROOT, ".opencode", "plugin");
-  if (!existsSync40(dir)) mkdirSync12(dir, { recursive: true });
-  const file2 = join49(dir, "inerrata.js");
-  if (existsSync40(file2)) {
-    const head2 = readFileSync42(file2, "utf8").split("\n")[0] ?? "";
+  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync43, writeFileSync: writeFileSync31 } = await import("node:fs");
+  const { join: join50 } = await import("node:path");
+  const dir = join50(ROOT, ".opencode", "plugin");
+  if (!existsSync41(dir)) mkdirSync13(dir, { recursive: true });
+  const file2 = join50(dir, "inerrata.js");
+  if (existsSync41(file2)) {
+    const head2 = readFileSync43(file2, "utf8").split("\n")[0] ?? "";
     if (head2.trim() !== OPENCODE_PLUGIN_MARKER) {
       console.error(`refusing to overwrite ${file2}: not an errata-managed plugin (line 1 lacks the marker)`);
       process.exit(2);
     }
   }
-  writeFileSync30(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
-  const cfgFile = join49(ROOT, "opencode.json");
+  writeFileSync31(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
+  const cfgFile = join50(ROOT, "opencode.json");
   let cfg = { $schema: "https://opencode.ai/config.json" };
-  if (existsSync40(cfgFile)) {
+  if (existsSync41(cfgFile)) {
     try {
-      cfg = JSON.parse(readFileSync42(cfgFile, "utf8"));
+      cfg = JSON.parse(readFileSync43(cfgFile, "utf8"));
     } catch {
       console.error(`refusing to touch invalid JSON at ${cfgFile} \u2014 fix it and re-run`);
       process.exit(2);
@@ -95321,7 +96217,7 @@ async function installOpencodePlugin(port) {
   if (!hadErrata) {
     const inv = errataMcpInvocation();
     cfg.mcp["errata"] = { type: "local", command: [inv.command, ...inv.args] };
-    writeFileSync30(cfgFile, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+    writeFileSync31(cfgFile, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   }
   console.log(`installed OpenCode plugin \u2192 ${file2}`);
   if (hadErrata) console.log(`  mcp.errata already present in ${cfgFile} \u2014 left untouched`);
@@ -95356,15 +96252,15 @@ function installClaudeMods() {
   }
 }
 async function installClaudeHooks(port) {
-  const { mkdirSync: mkdirSync12, existsSync: existsSync40, readFileSync: readFileSync42, writeFileSync: writeFileSync30 } = await import("node:fs");
-  const { join: join49 } = await import("node:path");
-  const dir = join49(ROOT, ".claude");
-  if (!existsSync40(dir)) mkdirSync12(dir, { recursive: true });
-  const file2 = join49(dir, "settings.json");
+  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync43, writeFileSync: writeFileSync31 } = await import("node:fs");
+  const { join: join50 } = await import("node:path");
+  const dir = join50(ROOT, ".claude");
+  if (!existsSync41(dir)) mkdirSync13(dir, { recursive: true });
+  const file2 = join50(dir, "settings.json");
   let settings = {};
-  if (existsSync40(file2)) {
+  if (existsSync41(file2)) {
     try {
-      settings = JSON.parse(readFileSync42(file2, "utf8"));
+      settings = JSON.parse(readFileSync43(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -95413,12 +96309,12 @@ async function installClaudeHooks(port) {
     list.push({ hooks: [{ type: "command", command: injectCmd }] });
   }
   removeProjectStatusLine(settings);
-  writeFileSync30(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  writeFileSync31(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code hooks \u2192 ${file2}`);
   console.log(`  ${ensureStatusLine(port)}`);
   console.log(`  ${installClaudeMods().line}`);
   await installClaudeMcpConfig();
-  const claudeMd = join49(ROOT, "CLAUDE.md");
+  const claudeMd = join50(ROOT, "CLAUDE.md");
   const recall = writeManagedBlock(claudeMd, { body: RECALL_FIRST_BLOCK });
   if (recall.kind === "collision") {
     console.warn(
@@ -95430,15 +96326,15 @@ async function installClaudeHooks(port) {
   console.log(`  endpoint: http://127.0.0.1:${port}/api/hook`);
 }
 async function installClaudeMcpConfig() {
-  const { mkdirSync: mkdirSync12, existsSync: existsSync40, readFileSync: readFileSync42, writeFileSync: writeFileSync30 } = await import("node:fs");
-  const { join: join49, dirname: dirname16 } = await import("node:path");
-  const file2 = join49(ROOT, ".mcp.json");
+  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync43, writeFileSync: writeFileSync31 } = await import("node:fs");
+  const { join: join50, dirname: dirname16 } = await import("node:path");
+  const file2 = join50(ROOT, ".mcp.json");
   const dir = dirname16(file2);
-  if (!existsSync40(dir)) mkdirSync12(dir, { recursive: true });
+  if (!existsSync41(dir)) mkdirSync13(dir, { recursive: true });
   let cfg = {};
-  if (existsSync40(file2)) {
+  if (existsSync41(file2)) {
     try {
-      cfg = JSON.parse(readFileSync42(file2, "utf8"));
+      cfg = JSON.parse(readFileSync43(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -95446,21 +96342,21 @@ async function installClaudeMcpConfig() {
   }
   cfg.mcpServers ??= {};
   cfg.mcpServers["errata"] = errataMcpInvocation();
-  writeFileSync30(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  writeFileSync31(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code MCP server config \u2192 ${file2}`);
   console.log(`  Claude Code will spawn \`errata mcp\` on workspace open.`);
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses / show / similar`);
 }
 async function installCursorMcpConfig() {
-  const { mkdirSync: mkdirSync12, existsSync: existsSync40, readFileSync: readFileSync42, writeFileSync: writeFileSync30 } = await import("node:fs");
-  const { join: join49 } = await import("node:path");
-  const dir = join49(ROOT, ".cursor");
-  if (!existsSync40(dir)) mkdirSync12(dir, { recursive: true });
-  const file2 = join49(dir, "mcp.json");
+  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync43, writeFileSync: writeFileSync31 } = await import("node:fs");
+  const { join: join50 } = await import("node:path");
+  const dir = join50(ROOT, ".cursor");
+  if (!existsSync41(dir)) mkdirSync13(dir, { recursive: true });
+  const file2 = join50(dir, "mcp.json");
   let cfg = {};
-  if (existsSync40(file2)) {
+  if (existsSync41(file2)) {
     try {
-      cfg = JSON.parse(readFileSync42(file2, "utf8"));
+      cfg = JSON.parse(readFileSync43(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -95468,7 +96364,7 @@ async function installCursorMcpConfig() {
   }
   cfg.mcpServers ??= {};
   cfg.mcpServers["errata"] = errataMcpInvocation();
-  writeFileSync30(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  writeFileSync31(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   console.log(`installed Cursor MCP server config \u2192 ${file2}`);
   console.log(`  Cursor will spawn \`errata mcp\` on workspace open.`);
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses`);
@@ -95479,11 +96375,14 @@ async function installCodexHooks(port) {
   const gitRoot = nearestGitRoot(process.cwd());
   const hookRoot = gitRoot && mainCheckoutOfWorktree(gitRoot) ? gitRoot : ROOT;
   const file2 = writeCodexHooks(hookRoot, port);
-  const instructions = writeManagedBlock(join48(hookRoot, "AGENTS.md"), {
+  const instructions = writeManagedBlock(join49(hookRoot, "AGENTS.md"), {
     body: AGENTS_POINTER_BODY,
     stable: true
   });
   console.log(`installed Codex hooks \u2192 ${file2}`);
+  const panel = installCodexContextPlugin(hookRoot);
+  console.log(`installed Errata Context plugin \u2192 ${panel.plugin}`);
+  console.log(panel.enabled ? "  Codex will load the panel on its next marketplace refresh; reopen the app if it is already running." : "  Errata Context remains disabled by your existing plugin settings.");
   if (instructions.kind === "collision") {
     console.warn("  AGENTS.md's Errata block was edited; preserved it. Add an explicit instruction to read .errata/context.md each turn.");
   } else {
@@ -95509,6 +96408,13 @@ function refreshExistingCodexHooks() {
     if (result.status === "error") {
       ok = false;
       console.warn(`Codex relay refresh needs attention in ${result.root}: ${result.detail}`);
+    } else {
+      try {
+        if (refreshCodexContextPlugin(result.root)) console.log(`updated existing Errata Context plugin \u2192 ${result.root}`);
+      } catch (error48) {
+        ok = false;
+        console.warn(`Errata Context refresh needs attention in ${result.root}: ${error48 instanceof Error ? error48.message : error48}`);
+      }
     }
   }
   return ok;
@@ -95915,9 +96821,9 @@ async function cmdDash(args2) {
       await yieldToLoop2();
       try {
         const items = selectDurableMemory(handle2.sharedStore, r.engine.profile, {
-          atCommit: readGitRefState(join48(r.root, ".git")).sha ?? void 0
+          atCommit: readGitRefState(join49(r.root, ".git")).sha ?? void 0
         });
-        const res = bleedRules(join48(r.root, ".claude", "rules"), items);
+        const res = bleedRules(join49(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(
             `[rules:${r.entry.name}] ${res.written} collective principle(s) \u2192 .claude/rules` + (res.pruned ? `, ${res.pruned} pruned` : "")
@@ -96160,4 +97066,41 @@ undici/lib/web/websocket/frame.js:
 
 chokidar/esm/index.js:
   (*! chokidar - MIT License (c) 2012 Paul Miller (paulmillr.com) *)
+
+smol-toml/dist/error.js:
+smol-toml/dist/util.js:
+smol-toml/dist/date.js:
+smol-toml/dist/primitive.js:
+smol-toml/dist/extract.js:
+smol-toml/dist/struct.js:
+smol-toml/dist/parse.js:
+smol-toml/dist/stringify.js:
+smol-toml/dist/index.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
 */