@inerrata-corporation/errata 2.0.22-dev.4277 → 2.0.22-dev.4293

package/errata.mjs

@@ -29565,6 +29565,78 @@ var init_src7 = __esm({
   }
 });
 
+// src/owner-only-file.ts
+import { chmodSync, statSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join as join5 } from "node:path";
+function system32(exe) {
+  return join5(process.env["SystemRoot"] ?? "C:\\Windows", "System32", exe);
+}
+function parseWhoamiSid(output) {
+  const match2 = /"(S-1-\d+(?:-\d+)+)"/.exec(output);
+  return match2 ? match2[1] : null;
+}
+function windowsAccount() {
+  if (cachedSid !== void 0) return cachedSid;
+  try {
+    const out2 = execFileSync(system32("whoami.exe"), ["/user", "/fo", "csv", "/nh"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
+      timeout: 5e3
+    });
+    const sid = parseWhoamiSid(out2);
+    cachedSid = sid ? `*${sid}` : null;
+  } catch {
+    cachedSid = null;
+  }
+  return cachedSid;
+}
+function runIcacls(args2) {
+  execFileSync(system32("icacls.exe"), args2, { stdio: "ignore", windowsHide: true, timeout: 5e3 });
+}
+function statIdentity(path3) {
+  try {
+    const stat4 = statSync(path3, { bigint: true });
+    return `${stat4.dev}:${stat4.ino}:${stat4.birthtimeNs}`;
+  } catch {
+    return null;
+  }
+}
+function restrictToOwner(path3, deps = defaultDeps) {
+  try {
+    if (deps.platform !== "win32") {
+      deps.chmod(path3, 384);
+      return "chmod";
+    }
+    const identity = deps.fileIdentity(path3);
+    if (identity !== null && restrictedThisProcess.get(path3) === identity) return "acl-cached";
+    const account = deps.account();
+    if (!account) return "skipped";
+    deps.icacls([path3, "/grant:r", `${account}:F`, `${LOCAL_SYSTEM_SID}:F`]);
+    deps.icacls([path3, "/inheritance:r"]);
+    if (identity !== null) restrictedThisProcess.set(path3, identity);
+    return "acl";
+  } catch {
+    return "failed";
+  }
+}
+var LOCAL_SYSTEM_SID, cachedSid, defaultDeps, restrictedThisProcess;
+var init_owner_only_file = __esm({
+  "src/owner-only-file.ts"() {
+    "use strict";
+    LOCAL_SYSTEM_SID = "*S-1-5-18";
+    defaultDeps = {
+      platform: process.platform,
+      chmod: chmodSync,
+      icacls: runIcacls,
+      account: windowsAccount,
+      fileIdentity: statIdentity
+    };
+    restrictedThisProcess = /* @__PURE__ */ new Map();
+  }
+});
+
 // ../../node_modules/.pnpm/env-paths@3.0.0/node_modules/env-paths/index.js
 import path2 from "node:path";
 import os from "node:os";
@@ -29640,26 +29712,26 @@ __export(paths_exports, {
   workspacePaths: () => workspacePaths
 });
 import { mkdirSync as mkdirSync5 } from "node:fs";
-import { dirname as dirname5, join as join5 } from "node:path";
+import { dirname as dirname5, join as join6 } from "node:path";
 function globalDir() {
   const p = envPaths("errata", { suffix: "" });
   return p.config;
 }
 function globalConfigPath() {
-  return process.env["ERRATA_CONFIG_PATH"] ?? join5(globalDir(), "config.json");
+  return process.env["ERRATA_CONFIG_PATH"] ?? join6(globalDir(), "config.json");
 }
 function daemonLogPath() {
   mkdirSync5(globalDir(), { recursive: true });
-  return join5(globalDir(), "daemon.log");
+  return join6(globalDir(), "daemon.log");
 }
 function globalDaemonLock() {
-  return process.env["ERRATA_DAEMON_LOCK"] ?? join5(globalDir(), "daemon.lock");
+  return process.env["ERRATA_DAEMON_LOCK"] ?? join6(globalDir(), "daemon.lock");
 }
 function sharedStorePath() {
-  return process.env["ERRATA_SHARED_DB"] ?? join5(globalDir(), "shared", "graph.db");
+  return process.env["ERRATA_SHARED_DB"] ?? join6(globalDir(), "shared", "graph.db");
 }
 function workspaceDir(workspaceRoot) {
-  return join5(workspaceRoot, ".errata");
+  return join6(workspaceRoot, ".errata");
 }
 function ensureDir(p) {
   mkdirSync5(p, { recursive: true });
@@ -29674,15 +29746,15 @@ function workspacePaths(root) {
   return {
     root,
     configDir: dir,
-    workspaceJson: join5(dir, "workspace.json"),
-    eventLog: join5(dir, "eventlog.sqlite"),
-    castalia: join5(dir, "castalia.db"),
-    reviewQueue: join5(dir, "review-queue.json"),
-    outbox: join5(dir, "outbox"),
-    daemonLock: join5(dir, "daemon.lock"),
-    identityAudit: join5(dir, "identity-audit.log"),
-    skillsDir: join5(dir, "skills"),
-    skillsManifest: join5(dir, "skills.json")
+    workspaceJson: join6(dir, "workspace.json"),
+    eventLog: join6(dir, "eventlog.sqlite"),
+    castalia: join6(dir, "castalia.db"),
+    reviewQueue: join6(dir, "review-queue.json"),
+    outbox: join6(dir, "outbox"),
+    daemonLock: join6(dir, "daemon.lock"),
+    identityAudit: join6(dir, "identity-audit.log"),
+    skillsDir: join6(dir, "skills"),
+    skillsManifest: join6(dir, "skills.json")
   };
 }
 var init_paths = __esm({
@@ -29754,7 +29826,9 @@ function loadConfig() {
 function saveConfig(cfg) {
   ensureDir(globalDir());
   const normalized = snapshotActiveInstallationProfile(cfg);
-  writeFileSync5(globalConfigPath(), JSON.stringify(normalized, null, 2), { encoding: "utf8", mode: 384 });
+  const path3 = globalConfigPath();
+  writeFileSync5(path3, JSON.stringify(normalized, null, 2), { encoding: "utf8", mode: 384 });
+  restrictToOwner(path3);
 }
 function profileFromCurrent(cfg, installationId) {
   return {
@@ -29855,6 +29929,7 @@ var LEGACY_CLOUD_URL, DEFAULT_CLOUD_URL, DEFAULT_UPDATE_CHANNEL;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
+    init_owner_only_file();
     init_paths();
     LEGACY_CLOUD_URL = "https://inerrata-gateway.onrender.com";
     DEFAULT_CLOUD_URL = true ? "https://dev.inerrata.dev" : DEV_CLOUD_URL;
@@ -32465,7 +32540,7 @@ var init_dist = __esm({
 });
 
 // src/context-baselines.ts
-import { closeSync, openSync, readSync, statSync } from "node:fs";
+import { closeSync, openSync, readSync, statSync as statSync2 } from "node:fs";
 function deliveryMarker(hash2) {
   return `<!-- errata-context ${hash2.slice(0, 16)} -->`;
 }
@@ -32477,7 +32552,7 @@ function appendedSince(path3, offset, needle) {
     return { found: false, turnRan: false };
   }
   try {
-    const size = statSync(path3).size;
+    const size = statSync2(path3).size;
     const keep = Math.max(needle.length, MODEL_TURN.length);
     const buf = Buffer.alloc(CHUNK);
     let carry = "";
@@ -32496,7 +32571,7 @@ function appendedSince(path3, offset, needle) {
 }
 function sizeOf(path3) {
   try {
-    return statSync(path3).size;
+    return statSync2(path3).size;
   } catch {
     return 0;
   }
@@ -32720,7 +32795,7 @@ var init_diagnostic_matcher = __esm({
 });
 
 // ../../packages/generalizer/src/generalizer.ts
-import { isAbsolute, join as join6, relative } from "node:path";
+import { isAbsolute, join as join7, relative } from "node:path";
 async function runGeneralizer(opts) {
   const report = {
     eventsProcessed: 0,
@@ -32828,7 +32903,7 @@ function extractDiagnostics(ev) {
 function diagRelPath(file2, cwd, workspaceRoot) {
   const norm = (p) => p.replace(/\\/g, "/");
   if (!workspaceRoot) return norm(file2);
-  const abs = isAbsolute(file2) ? file2 : join6(cwd ?? workspaceRoot, file2);
+  const abs = isAbsolute(file2) ? file2 : join7(cwd ?? workspaceRoot, file2);
   return norm(relative(workspaceRoot, abs));
 }
 function extractErrorSignature(ev) {
@@ -35117,7 +35192,7 @@ var init_recall_card = __esm({
 
 // src/recall-signal.ts
 import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function live(n) {
   return n != null && n.validTo == null && historyReadPolicy(n, { mode: "passive" }).allow;
 }
@@ -35186,14 +35261,14 @@ function contextCard(store, snapshot) {
   return deliveredCard(store, intent ? `${count} for \u201C${clipIntent(intent)}\u201D` : `${count} in context`, delivered);
 }
 function writeContextCard(root, hash2, card) {
-  writeFileSync6(join7(root, ".errata", CONTEXT_CARD_FILE), JSON.stringify({
+  writeFileSync6(join8(root, ".errata", CONTEXT_CARD_FILE), JSON.stringify({
     hash: hash2,
     card,
     line: card && recallCardEnabled() ? renderRecallLine(card) : null
   }));
 }
 function readContextCard(root, hash2) {
-  const path3 = join7(root, ".errata", CONTEXT_CARD_FILE);
+  const path3 = join8(root, ".errata", CONTEXT_CARD_FILE);
   if (!existsSync7(path3)) return null;
   try {
     const saved = JSON.parse(readFileSync5(path3, "utf8"));
@@ -35474,12 +35549,12 @@ var init_consent = __esm({
 
 // src/git-remote.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join8, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join9, resolve as resolve2 } from "node:path";
 function resolveGitDir(root) {
-  const dotGit = join8(root, ".git");
+  const dotGit = join9(root, ".git");
   try {
-    const st = statSync2(dotGit);
+    const st = statSync3(dotGit);
     if (st.isDirectory()) return dotGit;
     const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync8(dotGit, "utf8"));
     if (!m) return null;
@@ -35490,13 +35565,13 @@ function resolveGitDir(root) {
   }
 }
 function gitConfigPath(gitDir) {
-  const commondirFile = join8(gitDir, "commondir");
+  const commondirFile = join9(gitDir, "commondir");
   if (existsSync10(commondirFile)) {
     const common = readFileSync8(commondirFile, "utf8").trim();
     const commonDir = isAbsolute2(common) ? common : resolve2(gitDir, common);
-    return join8(commonDir, "config");
+    return join9(commonDir, "config");
   }
-  return join8(gitDir, "config");
+  return join9(gitDir, "config");
 }
 function readRemotes(root) {
   const gitDir = resolveGitDir(root);
@@ -35562,7 +35637,7 @@ var init_git_remote = __esm({
 // src/profile.ts
 import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function workspaceId(root) {
   return "wp_" + createHash5("sha256").update(root).digest("hex").slice(0, 12);
 }
@@ -35599,13 +35674,13 @@ function autodetectProfile(root) {
   const p = emptyProfile(id, name2);
   const locator = detectRepoLocator(root);
   if (locator) p.repoLocator = locator;
-  const pkgPath = join9(root, "package.json");
+  const pkgPath = join10(root, "package.json");
   if (existsSync11(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
       const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
       p.languages.push("javascript");
-      if (existsSync11(join9(root, "tsconfig.json")) || deps["typescript"]) {
+      if (existsSync11(join10(root, "tsconfig.json")) || deps["typescript"]) {
         p.languages.push("typescript");
       }
       const nodeVer = pkg.engines?.node?.trim();
@@ -35626,7 +35701,7 @@ function autodetectProfile(root) {
     } catch {
     }
   }
-  const pyproject = join9(root, "pyproject.toml");
+  const pyproject = join10(root, "pyproject.toml");
   if (existsSync11(pyproject)) {
     try {
       const txt = readFileSync9(pyproject, "utf8");
@@ -35640,16 +35715,16 @@ function autodetectProfile(root) {
     } catch {
     }
   }
-  const reqs = join9(root, "requirements.txt");
+  const reqs = join10(root, "requirements.txt");
   if (existsSync11(reqs)) {
     if (!p.languages.includes("python")) p.languages.push("python");
     if (!p.stack.includes("python@3")) p.stack.push("python@3");
   }
-  if (existsSync11(join9(root, "go.mod"))) {
+  if (existsSync11(join10(root, "go.mod"))) {
     p.languages.push("go");
     p.stack.push("go");
   }
-  if (existsSync11(join9(root, "Cargo.toml"))) {
+  if (existsSync11(join10(root, "Cargo.toml"))) {
     p.languages.push("rust");
     p.stack.push("rust");
   }
@@ -35755,11 +35830,11 @@ var init_identity2 = __esm({
 
 // src/checkout-root.ts
 import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
-import { basename as basename3, dirname as dirname7, isAbsolute as isAbsolute3, join as join10, resolve as resolve3 } from "node:path";
+import { basename as basename3, dirname as dirname7, isAbsolute as isAbsolute3, join as join11, resolve as resolve3 } from "node:path";
 function nearestGitRoot(dir) {
   let cur = resolve3(dir);
   for (; ; ) {
-    if (existsSync12(join10(cur, ".git"))) return cur;
+    if (existsSync12(join11(cur, ".git"))) return cur;
     const parent = dirname7(cur);
     if (parent === cur) return null;
     cur = parent;
@@ -35767,8 +35842,8 @@ function nearestGitRoot(dir) {
 }
 function mainCheckoutOfWorktree(root) {
   const gitDir = resolveGitDir(root);
-  if (!gitDir || gitDir === join10(root, ".git")) return null;
-  const commondirFile = join10(gitDir, "commondir");
+  if (!gitDir || gitDir === join11(root, ".git")) return null;
+  const commondirFile = join11(gitDir, "commondir");
   if (!existsSync12(commondirFile)) return null;
   let common;
   try {
@@ -35779,7 +35854,7 @@ function mainCheckoutOfWorktree(root) {
   const commonDir = resolve3(isAbsolute3(common) ? common : resolve3(gitDir, common));
   if (basename3(commonDir) !== ".git") return null;
   const main2 = dirname7(commonDir);
-  return existsSync12(join10(main2, ".git")) ? main2 : null;
+  return existsSync12(join11(main2, ".git")) ? main2 : null;
 }
 function checkoutRootOf(cwd) {
   const root = nearestGitRoot(cwd);
@@ -35797,7 +35872,7 @@ var init_checkout_root = __esm({
 });
 
 // src/process-identity.ts
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { readFileSync as readFileSync11 } from "node:fs";
 function readProcessIdentity(pid, fresh = false) {
   if (!Number.isSafeInteger(pid) || pid <= 0) return null;
@@ -35805,7 +35880,7 @@ function readProcessIdentity(pid, fresh = false) {
   const cached2 = recent.get(pid);
   if (!fresh && cached2 && Date.now() - cached2.at < 1e3) return cached2.value;
   try {
-    const run3 = (bin, args2) => execFileSync(bin, args2, {
+    const run3 = (bin, args2) => execFileSync2(bin, args2, {
       encoding: "utf8",
       windowsHide: true,
       timeout: 3e3,
@@ -35974,9 +36049,9 @@ var init_lock = __esm({
 
 // src/registry.ts
 import { existsSync as existsSync14, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 function registryPath() {
-  return process.env["ERRATA_REGISTRY_PATH"] ?? join11(globalDir(), "workspaces.json");
+  return process.env["ERRATA_REGISTRY_PATH"] ?? join12(globalDir(), "workspaces.json");
 }
 function read() {
   const p = registryPath();
@@ -37794,17 +37869,17 @@ var init_daemon_generalize_client = __esm({
 
 // ../../packages/indexer/src/parse-cache.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync14, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync14, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync4, writeFileSync as writeFileSync11 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function parseCacheDir() {
-  return process.env["ERRATA_PARSE_CACHE"] ?? join12(homedir3(), ".errata", "parse-cache");
+  return process.env["ERRATA_PARSE_CACHE"] ?? join13(homedir3(), ".errata", "parse-cache");
 }
 function parseCacheKey(source, providerId) {
   return createHash6("sha256").update(`${PARSE_CACHE_VERSION}:${providerId}:${source}`).digest("hex");
 }
 function entryPath(dir, key) {
-  return join12(dir, key.slice(0, 2), `${key.slice(2)}.json`);
+  return join13(dir, key.slice(0, 2), `${key.slice(2)}.json`);
 }
 function readParseCache(dir, key) {
   const file2 = entryPath(dir, key);
@@ -37828,7 +37903,7 @@ function writeParseCache(dir, key, providerId, value) {
     const body2 = JSON.stringify(envelope);
     if (body2.length > MAX_ENTRY_BYTES) return;
     const file2 = entryPath(dir, key);
-    mkdirSync6(join12(dir, key.slice(0, 2)), { recursive: true });
+    mkdirSync6(join13(dir, key.slice(0, 2)), { recursive: true });
     writeFileSync11(file2, body2);
   } catch {
   }
@@ -37840,7 +37915,7 @@ function sweepParseCacheOnce(dir, now = Date.now()) {
   try {
     if (!existsSync15(dir)) return 0;
     for (const bucket of readdirSync2(dir)) {
-      const bucketDir = join12(dir, bucket);
+      const bucketDir = join13(dir, bucket);
       let names;
       try {
         names = readdirSync2(bucketDir);
@@ -37848,9 +37923,9 @@ function sweepParseCacheOnce(dir, now = Date.now()) {
         continue;
       }
       for (const name2 of names) {
-        const file2 = join12(bucketDir, name2);
+        const file2 = join13(bucketDir, name2);
         try {
-          if (now - statSync3(file2).mtimeMs > ENTRY_TTL_MS) {
+          if (now - statSync4(file2).mtimeMs > ENTRY_TTL_MS) {
             rmSync2(file2, { force: true });
             removed++;
           }
@@ -38096,11 +38171,11 @@ var init_identity3 = __esm({
 });
 
 // ../../packages/indexer/src/pipeline.ts
-import { appendFileSync, readFileSync as readFileSync15, statSync as statSync4 } from "node:fs";
+import { appendFileSync, readFileSync as readFileSync15, statSync as statSync5 } from "node:fs";
 import { readdir } from "node:fs/promises";
-import { extname, join as join13, relative as relative2, sep } from "node:path";
+import { extname, join as join14, relative as relative2, sep } from "node:path";
 import { createHash as createHash7 } from "node:crypto";
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 function nowTs() {
   return indexNow ?? Date.now();
 }
@@ -38237,7 +38312,7 @@ async function incrementalReindex(store, rootPath, workspaceId2, changedAbsPaths
   for (const rel of [...changedRelPaths]) {
     let h;
     try {
-      h = createHash7("sha256").update(readFileSync15(join13(rootPath, rel))).digest("hex");
+      h = createHash7("sha256").update(readFileSync15(join14(rootPath, rel))).digest("hex");
     } catch {
       continue;
     }
@@ -38286,7 +38361,7 @@ async function incrementalReindex(store, rootPath, workspaceId2, changedAbsPaths
   let parsedFiles = 0;
   for (const rel of changedRelPaths) {
     if (parsedFiles++ > 0) await new Promise((r2) => setImmediate(r2));
-    const abs = join13(rootPath, ...rel.split("/"));
+    const abs = join14(rootPath, ...rel.split("/"));
     const ext = extname(abs).toLowerCase();
     const provider = providers.find((p) => p.fileExtensions.includes(ext));
     if (!provider) continue;
@@ -38609,7 +38684,7 @@ async function runIndexer(store, opts) {
     }
     let source;
     try {
-      const st = statSync4(f.absPath);
+      const st = statSync5(f.absPath);
       if (st.size > maxBytes) {
         report.filesSkipped++;
         continue;
@@ -39074,7 +39149,7 @@ async function scan(root, current, ignores, providers, out2) {
   for (const ent of entries) {
     if (ignores.has(ent.name)) continue;
     if (ent.name.startsWith(".") && ent.name !== ".") continue;
-    const abs = join13(current, ent.name);
+    const abs = join14(current, ent.name);
     if (ent.isDirectory()) {
       await scan(root, abs, ignores, providers, out2);
     } else if (ent.isFile()) {
@@ -39084,7 +39159,7 @@ async function scan(root, current, ignores, providers, out2) {
       let size = 0;
       let mtimeMs;
       try {
-        const st = statSync4(abs);
+        const st = statSync5(abs);
         size = st.size;
         mtimeMs = st.mtimeMs;
       } catch {
@@ -39104,7 +39179,7 @@ async function scan(root, current, ignores, providers, out2) {
 function gitListRelPaths(root, ignores) {
   let stdout;
   try {
-    stdout = execFileSync2(
+    stdout = execFileSync3(
       "git",
       ["-C", root, "ls-files", "--cached", "--others", "--exclude-standard", "-z"],
       {
@@ -39133,11 +39208,11 @@ function gitListFiles(root, ignores, providers) {
   if (rels === null) return null;
   const out2 = [];
   for (const rel of rels) {
-    const abs = join13(root, rel);
+    const abs = join14(root, rel);
     let size;
     let mtimeMs;
     try {
-      const st = statSync4(abs);
+      const st = statSync5(abs);
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -43545,7 +43620,7 @@ ${JSON.stringify(symbolNames, null, 2)}`);
 
 // ../../packages/indexer/src/languages/tree-sitter-loader.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname8, join as join14 } from "node:path";
+import { dirname as dirname8, join as join15 } from "node:path";
 import { existsSync as existsSync16, readdirSync as readdirSync3 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 function entryDir() {
@@ -43560,27 +43635,27 @@ function entryDir() {
 }
 function findWasmDir() {
   const here = entryDir();
-  const seaWasm = join14(here, "resources", "wasm");
-  if (existsSync16(join14(seaWasm, "tree-sitter-typescript.wasm"))) return seaWasm;
+  const seaWasm = join15(here, "resources", "wasm");
+  if (existsSync16(join15(seaWasm, "tree-sitter-typescript.wasm"))) return seaWasm;
   let dir = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const flat = join14(
+    const flat = join15(
       dir,
       "node_modules",
       "@vscode",
       "tree-sitter-wasm",
       "wasm"
     );
-    if (existsSync16(join14(flat, "tree-sitter-typescript.wasm"))) return flat;
+    if (existsSync16(join15(flat, "tree-sitter-typescript.wasm"))) return flat;
     dir = dirname8(dir);
   }
   let root = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const pnpmDir = join14(root, "node_modules", ".pnpm");
+    const pnpmDir = join15(root, "node_modules", ".pnpm");
     if (existsSync16(pnpmDir)) {
       for (const entry of readdirSync3(pnpmDir)) {
         if (entry.startsWith("@vscode+tree-sitter-wasm@")) {
-          const candidate = join14(
+          const candidate = join15(
             pnpmDir,
             entry,
             "node_modules",
@@ -43588,7 +43663,7 @@ function findWasmDir() {
             "tree-sitter-wasm",
             "wasm"
           );
-          if (existsSync16(join14(candidate, "tree-sitter-typescript.wasm"))) {
+          if (existsSync16(join15(candidate, "tree-sitter-typescript.wasm"))) {
             return candidate;
           }
         }
@@ -43602,27 +43677,27 @@ function findWasmDir() {
 }
 function findRuntimeDir() {
   const here = entryDir();
-  const seaRuntime = join14(here, "resources", "wasm");
-  if (existsSync16(join14(seaRuntime, "web-tree-sitter.wasm"))) return seaRuntime;
+  const seaRuntime = join15(here, "resources", "wasm");
+  if (existsSync16(join15(seaRuntime, "web-tree-sitter.wasm"))) return seaRuntime;
   let dir = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const flat = join14(dir, "node_modules", "web-tree-sitter");
-    if (existsSync16(join14(flat, "web-tree-sitter.wasm"))) return flat;
+    const flat = join15(dir, "node_modules", "web-tree-sitter");
+    if (existsSync16(join15(flat, "web-tree-sitter.wasm"))) return flat;
     dir = dirname8(dir);
   }
   let root = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const pnpmDir = join14(root, "node_modules", ".pnpm");
+    const pnpmDir = join15(root, "node_modules", ".pnpm");
     if (existsSync16(pnpmDir)) {
       for (const entry of readdirSync3(pnpmDir)) {
         if (entry.startsWith("web-tree-sitter@")) {
-          const candidate = join14(
+          const candidate = join15(
             pnpmDir,
             entry,
             "node_modules",
             "web-tree-sitter"
           );
-          if (existsSync16(join14(candidate, "web-tree-sitter.wasm"))) {
+          if (existsSync16(join15(candidate, "web-tree-sitter.wasm"))) {
             return candidate;
           }
         }
@@ -43639,7 +43714,7 @@ async function loadWebTreeSitter() {
     void err2;
   }
   const here = entryDir();
-  const seaResourceBase = join14(here, "resources", "_resolve.js");
+  const seaResourceBase = join15(here, "resources", "_resolve.js");
   const resourceRequire = createRequire2(seaResourceBase);
   return resourceRequire("web-tree-sitter");
 }
@@ -43654,9 +43729,9 @@ async function ensureTreeSitterReady() {
     await Parser2.init({
       locateFile: (name2) => {
         if (name2 === "tree-sitter.wasm" || name2 === "web-tree-sitter.wasm") {
-          return join14(runtime, name2);
+          return join15(runtime, name2);
         }
-        return join14(grammars, name2);
+        return join15(grammars, name2);
       }
     });
   })();
@@ -43668,7 +43743,7 @@ async function loadGrammar(name2) {
   if (cached2) return cached2;
   if (!languageClass) throw new Error("tree-sitter not initialized");
   const grammars = findWasmDir();
-  const lang = await languageClass.load(join14(grammars, `${name2}.wasm`));
+  const lang = await languageClass.load(join15(grammars, `${name2}.wasm`));
   grammarCache.set(name2, lang);
   return lang;
 }
@@ -46571,9 +46646,9 @@ var init_src11 = __esm({
 });
 
 // src/reconcile.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { readdirSync as readdirSync4, statSync as statSync5 } from "node:fs";
-import { join as join15, relative as relative3, sep as sep2 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { readdirSync as readdirSync4, statSync as statSync6 } from "node:fs";
+import { join as join16, relative as relative3, sep as sep2 } from "node:path";
 function indexerWouldScan(rel) {
   for (const seg of rel.split(/[\\/]/)) {
     if (seg.length === 0) continue;
@@ -46585,7 +46660,7 @@ function indexerWouldScan(rel) {
 function gitSourceFiles(root) {
   let stdout;
   try {
-    stdout = execFileSync3(
+    stdout = execFileSync4(
       "git",
       ["-C", root, "ls-files", "--cached", "--others", "--exclude-standard", "-z"],
       { encoding: "utf8", maxBuffer: 128 * 1024 * 1024, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }
@@ -46596,7 +46671,7 @@ function gitSourceFiles(root) {
   const out2 = [];
   for (const rel of stdout.split("\0")) {
     if (!rel || !SOURCE_RE.test(rel) || !indexerWouldScan(rel)) continue;
-    const abs = join15(root, rel);
+    const abs = join16(root, rel);
     if (IGNORED.test(abs)) continue;
     out2.push(abs);
   }
@@ -46611,7 +46686,7 @@ function* walkSource(dir) {
   }
   for (const e of entries) {
     const name2 = String(e.name);
-    const full = join15(dir, name2);
+    const full = join16(dir, name2);
     if (IGNORED.test(full)) continue;
     if (!indexerWouldScan(name2)) continue;
     if (e.isDirectory()) yield* walkSource(full);
@@ -46636,7 +46711,7 @@ async function findStaleFiles(store, rootPath, workspaceId2) {
   for (const abs of listSourceFiles(rootPath)) {
     try {
       const rel = relative3(rootPath, abs).split(sep2).join("/");
-      pending.push({ abs, id: fileNodeId(workspaceId2, rel), mtimeMs: statSync5(abs).mtimeMs });
+      pending.push({ abs, id: fileNodeId(workspaceId2, rel), mtimeMs: statSync6(abs).mtimeMs });
     } catch {
     }
     if (++scanned % SCAN_YIELD_EVERY === 0) {
@@ -48945,7 +49020,7 @@ __export(vfile_exports, {
   segmentsOf: () => segmentsOf
 });
 import { writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join16, resolve as resolve5, sep as sep3 } from "node:path";
+import { join as join17, resolve as resolve5, sep as sep3 } from "node:path";
 function segmentsOf(rawPath) {
   let p = rawPath.replace(/\\/g, "/");
   p = p.replace(/^.*\.errata\/g\//, "").replace(/^\/?g\//, "").replace(/^\/+/, "");
@@ -49019,7 +49094,7 @@ async function renderVFile(rawPath, store, ctx = {}) {
 }
 async function materializeVFile(rawPath, workspaceRoot, store, ctx = {}) {
   const segs = segmentsOf(rawPath);
-  const gRoot = join16(workspaceRoot, ".errata", "g");
+  const gRoot = join17(workspaceRoot, ".errata", "g");
   const abs = resolve5(gRoot, ...segs.length ? segs : ["index"]);
   if (abs !== gRoot && !abs.startsWith(gRoot + sep3)) {
     throw new Error(`refusing to materialize outside .errata/g: ${rawPath}`);
@@ -56453,12 +56528,12 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync13
 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { createHash as createHash15 } from "node:crypto";
 function enqueueOutbox(paths, payload) {
   ensureDir(paths.outbox);
   const id = createHash15("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
-  const file2 = join17(paths.outbox, `${Date.now()}-${id}.json`);
+  const file2 = join18(paths.outbox, `${Date.now()}-${id}.json`);
   writeFileSync13(file2, JSON.stringify(payload, null, 2), "utf8");
   return file2;
 }
@@ -56475,7 +56550,7 @@ async function flushOutbox(paths, client, store) {
     }
   };
   for (const f of entries.filter((e) => e.endsWith(".json")).sort()) {
-    const abs = join17(paths.outbox, f);
+    const abs = join18(paths.outbox, f);
     let payload;
     try {
       payload = JSON.parse(readFileSync17(abs, "utf8"));
@@ -76360,9 +76435,9 @@ __export(witness_ledger_exports, {
   witnessLedgerPath: () => witnessLedgerPath
 });
 import { appendFileSync as appendFileSync3, existsSync as existsSync27, readFileSync as readFileSync30, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 function witnessLedgerPath(configDir) {
-  return join33(configDir, "witness-ledger.jsonl");
+  return join34(configDir, "witness-ledger.jsonl");
 }
 function appendWitnessLedger(configDir, entry) {
   const path3 = witnessLedgerPath(configDir);
@@ -76818,8 +76893,8 @@ var init_report_render = __esm({
 
 // src/cli.ts
 init_src6();
-import { closeSync as closeSync3, existsSync as existsSync40, openSync as openSync3, readFileSync as readFileSync44, renameSync as renameSync9, statSync as statSync13 } from "node:fs";
-import { join as join51, resolve as pathResolve2 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync40, openSync as openSync3, readFileSync as readFileSync45, renameSync as renameSync9, statSync as statSync15 } from "node:fs";
+import { join as join53, resolve as pathResolve2 } from "node:path";
 import { spawn as spawn5 } from "node:child_process";
 
 // src/daemon.ts
@@ -77506,9 +77581,9 @@ function knowledgeTag(label, attrs) {
 }
 
 // src/engine.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync28, statSync as statSync9, appendFileSync as appendFileSync4, readdirSync as readdirSync11, renameSync as renameSync4, readFileSync as readFileSync32, writeFileSync as writeFileSync23 } from "node:fs";
-import { basename as basename8, join as join35, relative as relative7, sep as sep4 } from "node:path";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { existsSync as existsSync28, statSync as statSync10, appendFileSync as appendFileSync4, readdirSync as readdirSync11, renameSync as renameSync4, readFileSync as readFileSync32, writeFileSync as writeFileSync23 } from "node:fs";
+import { basename as basename8, join as join36, relative as relative7, sep as sep4 } from "node:path";
 
 // src/coalesced-file-pass.ts
 function createCoalescedFilePass(delayMs, run3, onError) {
@@ -77552,8 +77627,8 @@ function createCoalescedFilePass(delayMs, run3, onError) {
 
 // src/source-watcher.ts
 import { EventEmitter as EventEmitter2 } from "node:events";
-import { readdirSync as readdirSync6, statSync as statSync6, watch as watch2 } from "node:fs";
-import { isAbsolute as isAbsolute5, join as join20, relative as relative6 } from "node:path";
+import { readdirSync as readdirSync6, statSync as statSync7, watch as watch2 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join21, relative as relative6 } from "node:path";
 
 // ../../node_modules/.pnpm/chokidar@4.0.3/node_modules/chokidar/esm/index.js
 import { stat as statcb } from "fs";
@@ -79281,13 +79356,13 @@ var NativeSourceWatcher = class extends EventEmitter2 {
     if (this.closed || this.handles.has(target)) return;
     let isDir;
     try {
-      isDir = statSync6(target).isDirectory();
+      isDir = statSync7(target).isDirectory();
     } catch {
       return;
     }
     try {
       const h = watch2(target, { recursive: isDir, persistent: true }, (event, name2) => {
-        const path3 = isDir ? name2 ? join20(target, name2.toString()) : null : target;
+        const path3 = isDir ? name2 ? join21(target, name2.toString()) : null : target;
         if (!path3) {
           this.emit("raw", event, target, { watchedPath: target, filenameMissing: true });
           this.scheduleReconcile(target, isDir);
@@ -79340,7 +79415,7 @@ var NativeSourceWatcher = class extends EventEmitter2 {
     try {
       for (const entry of readdirSync6(target, { recursive: true, withFileTypes: true })) {
         if (!entry.isFile()) continue;
-        const path3 = join20(entry.parentPath, entry.name);
+        const path3 = join21(entry.parentPath, entry.name);
         if (!this.ignored(path3)) files.add(path3);
       }
     } catch {
@@ -79377,7 +79452,7 @@ var NativeSourceWatcher = class extends EventEmitter2 {
     if (this.closed) return;
     let isFile;
     try {
-      const s = statSync6(path3);
+      const s = statSync7(path3);
       if (s.isDirectory()) return;
       isFile = s.isFile();
     } catch {
@@ -79832,8 +79907,8 @@ init_review2();
 
 // src/turn.ts
 init_checkout_root();
-import { closeSync as closeSync2, existsSync as existsSync19, fstatSync, openSync as openSync2, readdirSync as readdirSync7, readSync as readSync2, realpathSync as realpathSync2, statSync as statSync7 } from "node:fs";
-import { basename as basename6, delimiter, dirname as dirname11, join as join21, normalize as normalize3 } from "node:path";
+import { closeSync as closeSync2, existsSync as existsSync19, fstatSync, openSync as openSync2, readdirSync as readdirSync7, readSync as readSync2, realpathSync as realpathSync2, statSync as statSync8 } from "node:fs";
+import { basename as basename6, delimiter, dirname as dirname11, join as join22, normalize as normalize3 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { createHash as createHash16 } from "node:crypto";
 function completeJsonlPrefix(buf) {
@@ -80221,7 +80296,7 @@ function turnsSince(turns, mark) {
   return at >= 0 ? turns.slice(at + 1) : turns;
 }
 function claudeProjectDir(cwd, home = homedir4()) {
-  return join21(home, ".claude", "projects", cwd.replace(/[\\/:.]/g, "-"));
+  return join22(home, ".claude", "projects", cwd.replace(/[\\/:.]/g, "-"));
 }
 function recentTranscripts(cwd, opts = {}) {
   const dir = claudeProjectDir(cwd, opts.home ?? homedir4());
@@ -80236,10 +80311,10 @@ function recentTranscripts(cwd, opts = {}) {
   const refs = [];
   for (const name2 of names) {
     if (!name2.endsWith(".jsonl")) continue;
-    const path3 = join21(dir, name2);
+    const path3 = join22(dir, name2);
     let mtimeMs;
     try {
-      mtimeMs = statSync7(path3).mtimeMs;
+      mtimeMs = statSync8(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -80251,7 +80326,7 @@ function recentTranscripts(cwd, opts = {}) {
 }
 function subagentTranscripts(mainTranscriptPath, sessionId) {
   if (!mainTranscriptPath || !sessionId) return [];
-  const dir = join21(dirname11(mainTranscriptPath), sessionId, "subagents");
+  const dir = join22(dirname11(mainTranscriptPath), sessionId, "subagents");
   if (!existsSync19(dir)) return [];
   let names;
   try {
@@ -80262,10 +80337,10 @@ function subagentTranscripts(mainTranscriptPath, sessionId) {
   const refs = [];
   for (const name2 of names) {
     if (!name2.endsWith(".jsonl")) continue;
-    const path3 = join21(dir, name2);
+    const path3 = join22(dir, name2);
     let mtimeMs;
     try {
-      mtimeMs = statSync7(path3).mtimeMs;
+      mtimeMs = statSync8(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -80281,8 +80356,8 @@ function splitPathList(value, sep6 = delimiter) {
 function codexSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_CODEX_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["CODEX_HOME"]) roots.add(join21(env2["CODEX_HOME"], "sessions"));
-  roots.add(join21(home, ".codex", "sessions"));
+  if (env2["CODEX_HOME"]) roots.add(join22(env2["CODEX_HOME"], "sessions"));
+  roots.add(join22(home, ".codex", "sessions"));
   return [...roots];
 }
 function readCodexRolloutIdentity(path3) {
@@ -80354,10 +80429,10 @@ function codexRolloutsForCwd(cwd, opts = {}) {
         continue;
       }
       for (const name2 of names) {
-        const full = join21(dir, name2);
+        const full = join22(dir, name2);
         let st;
         try {
-          st = statSync7(full);
+          st = statSync8(full);
         } catch {
           continue;
         }
@@ -80396,8 +80471,8 @@ function codexRolloutsForCwd(cwd, opts = {}) {
 function geminiSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_GEMINI_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["GEMINI_CLI_HOME"]) roots.add(join21(env2["GEMINI_CLI_HOME"], ".gemini", "tmp"));
-  roots.add(join21(home, ".gemini", "tmp"));
+  if (env2["GEMINI_CLI_HOME"]) roots.add(join22(env2["GEMINI_CLI_HOME"], ".gemini", "tmp"));
+  roots.add(join22(home, ".gemini", "tmp"));
   return [...roots];
 }
 function geminiProjectHash(cwd) {
@@ -80445,7 +80520,7 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
       continue;
     }
     for (const slug2 of slugs) {
-      const chats = join21(root, slug2, "chats");
+      const chats = join22(root, slug2, "chats");
       let names;
       try {
         names = readdirSync7(chats);
@@ -80454,10 +80529,10 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
       }
       for (const name2 of names) {
         if (!name2.startsWith("session-") || !name2.endsWith(".jsonl")) continue;
-        const full = join21(chats, name2);
+        const full = join22(chats, name2);
         let st;
         try {
-          st = statSync7(full);
+          st = statSync8(full);
         } catch {
           continue;
         }
@@ -80474,8 +80549,8 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
 function opencodeSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_OPENCODE_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["XDG_DATA_HOME"]) roots.add(join21(env2["XDG_DATA_HOME"], "opencode", "errata"));
-  roots.add(join21(home, ".local", "share", "opencode", "errata"));
+  if (env2["XDG_DATA_HOME"]) roots.add(join22(env2["XDG_DATA_HOME"], "opencode", "errata"));
+  roots.add(join22(home, ".local", "share", "opencode", "errata"));
   return [...roots];
 }
 function readOpencodeTranscriptDirectory(path3) {
@@ -80517,10 +80592,10 @@ function opencodeTranscriptsForCwd(cwd, opts = {}) {
     }
     for (const name2 of names) {
       if (!name2.endsWith(".jsonl")) continue;
-      const full = join21(root, name2);
+      const full = join22(root, name2);
       let st;
       try {
-        st = statSync7(full);
+        st = statSync8(full);
       } catch {
         continue;
       }
@@ -81836,7 +81911,7 @@ ${conversation}` }]
 init_src5();
 init_src2();
 import { existsSync as existsSync20, readFileSync as readFileSync19, readdirSync as readdirSync8, writeFileSync as writeFileSync15 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 var BACKFILL_VERSION = 1;
 var EMPTY = {
@@ -81850,7 +81925,7 @@ var EMPTY = {
   recoverable: 0
 };
 function markerPath(configDir) {
-  return join22(configDir, "constraint-backfill.json");
+  return join23(configDir, "constraint-backfill.json");
 }
 function alreadyDone(configDir) {
   const p = markerPath(configDir);
@@ -81876,7 +81951,7 @@ function replay(root) {
   for (const f of names) {
     let lines;
     try {
-      lines = readFileSync19(join22(dir, f), "utf8").split("\n");
+      lines = readFileSync19(join23(dir, f), "utf8").split("\n");
     } catch {
       continue;
     }
@@ -82004,7 +82079,7 @@ function backfillConstraintKind(store, opts) {
 init_src();
 init_src5();
 import { existsSync as existsSync21, readFileSync as readFileSync20, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function citeEdgeId(from, type, to) {
   return `edge_${digest({ from, type, to })}`.slice(0, 24);
 }
@@ -82019,7 +82094,7 @@ var EMPTY2 = {
   byType: {}
 };
 function markerPath2(configDir) {
-  return join23(configDir, "edge-repair.json");
+  return join24(configDir, "edge-repair.json");
 }
 function alreadyDone2(configDir) {
   const p = markerPath2(configDir);
@@ -82089,7 +82164,7 @@ init_reconcile();
 
 // src/pass-ledger.ts
 import { appendFileSync as appendFileSync2, existsSync as existsSync22, readFileSync as readFileSync21, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 
 // src/isolate-census.ts
 var live2 = 0;
@@ -82115,7 +82190,7 @@ var HOUR_MS = 36e5;
 var TRIM_EVERY = 50;
 var appendsSinceTrim = /* @__PURE__ */ new Map();
 function passLedgerPath(configDir) {
-  return join24(configDir, "pass-ledger.jsonl");
+  return join25(configDir, "pass-ledger.jsonl");
 }
 function appendPassLedger(configDir, kind, durationMs, counts) {
   const path3 = passLedgerPath(configDir);
@@ -82593,10 +82668,10 @@ init_src10();
 init_src();
 init_src2();
 import { readFileSync as readFileSync22 } from "node:fs";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 function loadClaimIgnorePatterns(workspaceRoot) {
   try {
-    return readFileSync22(join25(workspaceRoot, ".errataignore"), "utf8").split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#")).map((l) => l.toLowerCase());
+    return readFileSync22(join26(workspaceRoot, ".errataignore"), "utf8").split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#")).map((l) => l.toLowerCase());
   } catch {
     return [];
   }
@@ -82978,10 +83053,10 @@ async function pullCloudTriage(shared, cloud, profile, limit = 50) {
 
 // src/retrieval-stack.ts
 init_src();
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { existsSync as existsSync23, readFileSync as readFileSync23, statSync as statSync9 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 var RETRIEVAL_STACK_CAP = 24;
 var MANIFEST_SCAN_CAP = 400;
 var RUNTIME_TOKENS = /* @__PURE__ */ new Set([
@@ -83278,44 +83353,44 @@ function loadRegistryPolicy(root, env2 = process.env, repoLocator) {
   };
   const texts = (...paths) => paths.map(read2).filter((t) => t !== null);
   const home = homedir6();
-  const npm = parseNpmrcPolicy(texts(join26(root, ".npmrc"), join26(home, ".npmrc")));
+  const npm = parseNpmrcPolicy(texts(join27(root, ".npmrc"), join27(home, ".npmrc")));
   const blocked = /* @__PURE__ */ new Set();
   if (!npm.defaultPublic) blocked.add("npm");
   if (pypiIndexIsPrivate(
     texts(
-      join26(root, "pip.conf"),
-      join26(root, "pip.ini"),
-      join26(root, "pyproject.toml"),
-      join26(root, "requirements.txt"),
-      join26(home, ".pip", "pip.conf"),
-      join26(home, ".config", "pip", "pip.conf"),
-      join26(env2["APPDATA"] ?? home, "pip", "pip.ini")
+      join27(root, "pip.conf"),
+      join27(root, "pip.ini"),
+      join27(root, "pyproject.toml"),
+      join27(root, "requirements.txt"),
+      join27(home, ".pip", "pip.conf"),
+      join27(home, ".config", "pip", "pip.conf"),
+      join27(env2["APPDATA"] ?? home, "pip", "pip.ini")
     )
   )) {
     blocked.add("pypi");
   }
   if (cargoRegistryIsPrivate(
     texts(
-      join26(root, ".cargo", "config.toml"),
-      join26(root, ".cargo", "config"),
-      join26(home, ".cargo", "config.toml"),
-      join26(home, ".cargo", "config")
+      join27(root, ".cargo", "config.toml"),
+      join27(root, ".cargo", "config"),
+      join27(home, ".cargo", "config.toml"),
+      join27(home, ".cargo", "config")
     )
   )) {
     blocked.add("cargo");
   }
   if (nugetSourcesArePrivate(
     texts(
-      join26(root, "NuGet.config"),
-      join26(root, "nuget.config"),
-      join26(root, "NuGet.Config"),
-      join26(env2["APPDATA"] ?? home, "NuGet", "NuGet.Config"),
-      join26(home, ".nuget", "NuGet", "NuGet.Config")
+      join27(root, "NuGet.config"),
+      join27(root, "nuget.config"),
+      join27(root, "NuGet.Config"),
+      join27(env2["APPDATA"] ?? home, "NuGet", "NuGet.Config"),
+      join27(home, ".nuget", "NuGet", "NuGet.Config")
     )
   )) {
     blocked.add("nuget");
   }
-  const goEnvFile = env2["GOENV"] ?? join26(env2["APPDATA"] ?? join26(home, ".config"), "go", "env");
+  const goEnvFile = env2["GOENV"] ?? join27(env2["APPDATA"] ?? join27(home, ".config"), "go", "env");
   const goEnvText = read2(goEnvFile) ?? "";
   const fromFile = ["GOPRIVATE", "GONOSUMDB", "GONOSUMCHECK"].map(
     (k) => new RegExp(`^${k}=(.*)$`, "m").exec(goEnvText)?.[1]
@@ -83326,10 +83401,10 @@ function loadRegistryPolicy(root, env2 = process.env, repoLocator) {
     env2["GONOSUMCHECK"],
     ...fromFile
   ]);
-  const gemfiles = texts(join26(root, "Gemfile"));
+  const gemfiles = texts(join27(root, "Gemfile"));
   if (gemSourceIsPrivate(gemfiles)) blocked.add("gem");
   if (mavenReposArePrivate(
-    texts(join26(root, "pom.xml"), join26(home, ".m2", "settings.xml"))
+    texts(join27(root, "pom.xml"), join27(home, ".m2", "settings.xml"))
   )) {
     blocked.add("maven");
   }
@@ -83496,10 +83571,10 @@ function readDirectDependencies(root) {
   const familiesSeen = /* @__PURE__ */ new Set();
   for (const c of LOCKFILES) {
     if (familiesSeen.has(c.family)) continue;
-    const p = join26(root, c.file);
+    const p = join27(root, c.file);
     if (!existsSync23(p)) continue;
     try {
-      const s = statSync8(p);
+      const s = statSync9(p);
       stamps.push(`${c.file}:${s.mtimeMs}:${s.size}`);
     } catch {
       continue;
@@ -83526,7 +83601,7 @@ function readDirectDependencies(root) {
 }
 function manifestPaths(root) {
   try {
-    const out2 = execFileSync4("git", ["-C", root, "ls-files", "-z"], {
+    const out2 = execFileSync5("git", ["-C", root, "ls-files", "-z"], {
       encoding: "utf8",
       maxBuffer: 128 * 1024 * 1024,
       windowsHide: true,
@@ -83560,14 +83635,14 @@ function manifestPaths(root) {
     "project.godot"
   ];
   return {
-    paths: ROOT_MANIFESTS.filter((f) => existsSync23(join26(root, f))),
+    paths: ROOT_MANIFESTS.filter((f) => existsSync23(join27(root, f))),
     tracked: false,
     truncated: false
   };
 }
 var WORKSPACE_MARKERS = ["pnpm-workspace.yaml", "lerna.json", "go.work", "settings.gradle", "settings.gradle.kts"];
 function rootDeclaresWorkspace(root, texts) {
-  if (WORKSPACE_MARKERS.some((f) => existsSync23(join26(root, f)))) return true;
+  if (WORKSPACE_MARKERS.some((f) => existsSync23(join27(root, f)))) return true;
   return /"workspaces"\s*:/.test(texts.get("package.json") ?? "") || /<modules>/.test(texts.get("pom.xml") ?? "") || /^\s*\[workspace\]/m.test(texts.get("Cargo.toml") ?? "");
 }
 var EMPTY_SCAN = { deps: [], self: [], complete: true };
@@ -83581,9 +83656,9 @@ function scanManifests(root) {
   const texts = /* @__PURE__ */ new Map();
   const stamps = [];
   for (const rel of paths) {
-    const abs = join26(root, rel);
+    const abs = join27(root, rel);
     try {
-      const s = statSync8(abs);
+      const s = statSync9(abs);
       stamps.push(`${rel}:${s.mtimeMs}:${s.size}`);
       texts.set(rel, readFileSync23(abs, "utf8"));
     } catch {
@@ -83622,7 +83697,7 @@ function readRetrievalInputs(root, repoLocator) {
 
 // src/git-sensor.ts
 import { existsSync as existsSync24, readFileSync as readFileSync24, watch as fsWatch } from "node:fs";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 function readFirstLine(path3) {
   try {
     return readFileSync24(path3, "utf8").split(/\r?\n/, 1)[0].trim();
@@ -83631,12 +83706,12 @@ function readFirstLine(path3) {
   }
 }
 function readGitRefState(gitDir) {
-  const head2 = readFirstLine(join27(gitDir, "HEAD"));
+  const head2 = readFirstLine(join28(gitDir, "HEAD"));
   const m = head2 ? /^ref:\s*refs\/heads\/(.+)$/.exec(head2) : null;
   const branch = m ? m[1] : null;
   let sha2 = null;
   if (branch) {
-    sha2 = readFirstLine(join27(gitDir, "refs", "heads", branch));
+    sha2 = readFirstLine(join28(gitDir, "refs", "heads", branch));
     if (!sha2) sha2 = shaFromPackedRefs(gitDir, `refs/heads/${branch}`);
   } else if (head2 && /^[0-9a-f]{7,40}$/i.test(head2)) {
     sha2 = head2;
@@ -83644,13 +83719,13 @@ function readGitRefState(gitDir) {
   return {
     branch,
     sha: sha2,
-    mergeHeadExists: existsSync24(join27(gitDir, "MERGE_HEAD")),
-    origHeadExists: existsSync24(join27(gitDir, "ORIG_HEAD"))
+    mergeHeadExists: existsSync24(join28(gitDir, "MERGE_HEAD")),
+    origHeadExists: existsSync24(join28(gitDir, "ORIG_HEAD"))
   };
 }
 function shaFromPackedRefs(gitDir, ref) {
   try {
-    for (const line of readFileSync24(join27(gitDir, "packed-refs"), "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync24(join28(gitDir, "packed-refs"), "utf8").split(/\r?\n/)) {
       const [sha2, name2] = line.split(/\s+/);
       if (name2 === ref && sha2) return sha2;
     }
@@ -83684,7 +83759,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
   const settle = () => {
     if (timer) clearTimeout(timer);
     timer = setTimeout(() => {
-      if (existsSync24(join27(gitDir, "index.lock"))) {
+      if (existsSync24(join28(gitDir, "index.lock"))) {
         settle();
         return;
       }
@@ -83695,7 +83770,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
     }, debounceMs);
   };
   for (const sub of ["HEAD", "logs/HEAD", "MERGE_HEAD", "ORIG_HEAD"]) {
-    const p = join27(gitDir, sub);
+    const p = join28(gitDir, sub);
     try {
       watchers.push(fsWatch(p, settle));
     } catch {
@@ -83926,7 +84001,7 @@ var TelemetryRecorder = class {
 
 // src/file-activity.ts
 import { readFileSync as readFileSync26 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 import { createHash as createHash17 } from "node:crypto";
 
 // ../../packages/privacy/src/patterns/credentials.ts
@@ -84679,7 +84754,7 @@ init_git_remote();
 init_src();
 import { execFile as execFile2 } from "node:child_process";
 import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 var DEFAULT_MAX_TOKENS = 6e3;
 var FILE_LIST_CAP = 60;
 var DIFF_FILE_CAP = 40;
@@ -84718,7 +84793,7 @@ function pathAllowedByFloor(path3) {
 function loadRepoIgnore(root, extraPatterns = []) {
   let source = "";
   try {
-    source = readFileSync25(join28(root, ".errataignore"), "utf8");
+    source = readFileSync25(join29(root, ".errataignore"), "utf8");
   } catch {
     source = "";
   }
@@ -85017,7 +85092,7 @@ function readActivityBranch(root) {
   try {
     const gitDir = resolveGitDir(root);
     if (!gitDir) return null;
-    const head2 = readFileSync26(join29(gitDir, "HEAD"), "utf8").trim();
+    const head2 = readFileSync26(join30(gitDir, "HEAD"), "utf8").trim();
     const branch = head2.startsWith("ref: refs/heads/") ? head2.slice(16) : /^[a-f0-9]{40,64}$/i.test(head2) ? "HEAD" : null;
     return branch && branch.length <= 256 && !/[\x00-\x1f\x7f]/.test(branch) ? branch : null;
   } catch {
@@ -85181,7 +85256,7 @@ import {
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync18
 } from "node:fs";
-import { basename as basename7, join as join30 } from "node:path";
+import { basename as basename7, join as join31 } from "node:path";
 function skillFileName(id) {
   return `${id.replace(/[^A-Za-z0-9_.-]/g, "_")}.md`;
 }
@@ -85212,7 +85287,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
   for (const s of res.skills) {
     const fileName = skillFileName(s.id);
     keep.add(fileName);
-    writeFileSync18(join30(paths.skillsDir, fileName), s.markdown, "utf8");
+    writeFileSync18(join31(paths.skillsDir, fileName), s.markdown, "utf8");
     rows.push({
       id: s.id,
       title: s.title,
@@ -85225,7 +85300,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     const fileName = skillFileName(p.id);
     if (keep.has(fileName)) continue;
     keep.add(fileName);
-    writeFileSync18(join30(paths.skillsDir, fileName), p.markdown, "utf8");
+    writeFileSync18(join31(paths.skillsDir, fileName), p.markdown, "utf8");
     rows.push({
       id: p.id,
       title: p.title,
@@ -85239,7 +85314,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     if (!f.endsWith(".md")) continue;
     if (keep.has(basename7(f))) continue;
     try {
-      unlinkSync4(join30(paths.skillsDir, f));
+      unlinkSync4(join31(paths.skillsDir, f));
       pruned++;
     } catch {
     }
@@ -85266,13 +85341,13 @@ import {
   symlinkSync,
   writeFileSync as writeFileSync19
 } from "node:fs";
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 var SKILL_NS = "errata-";
 var HARNESS_SKILL_DIRS = [
-  { configDir: ".claude", skillsDir: join31(".claude", "skills") },
+  { configDir: ".claude", skillsDir: join32(".claude", "skills") },
   // Cursor adopted the standard; its exact project dir is still moving — kept
   // best-effort and gated on `.cursor/` presence so we never create it blind.
-  { configDir: ".cursor", skillsDir: join31(".cursor", "skills") }
+  { configDir: ".cursor", skillsDir: join32(".cursor", "skills") }
 ];
 function skillSlug(title, id) {
   const base = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || id.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
@@ -85322,7 +85397,7 @@ function reconcileNamespaced(dir, keep) {
   for (const name2 of readdirSync10(dir)) {
     if (!name2.startsWith(SKILL_NS) || keep.has(name2)) continue;
     try {
-      rmSync3(join31(dir, name2), { recursive: true, force: true });
+      rmSync3(join32(dir, name2), { recursive: true, force: true });
       pruned++;
     } catch {
     }
@@ -85352,7 +85427,7 @@ function safeLstat(p) {
   }
 }
 function emitAndProjectSkills(root, skills) {
-  const agentsSkillsDir = join31(root, ".agents", "skills");
+  const agentsSkillsDir = join32(root, ".agents", "skills");
   mkdirSync8(agentsSkillsDir, { recursive: true });
   const slugs = [];
   const keep = /* @__PURE__ */ new Set();
@@ -85369,9 +85444,9 @@ function emitAndProjectSkills(root, skills) {
     keep.add(slug2);
     slugs.push(slug2);
     const description = deriveDescription(s.title, s.layer, body2);
-    mkdirSync8(join31(agentsSkillsDir, slug2), { recursive: true });
+    mkdirSync8(join32(agentsSkillsDir, slug2), { recursive: true });
     writeFileSync19(
-      join31(agentsSkillsDir, slug2, "SKILL.md"),
+      join32(agentsSkillsDir, slug2, "SKILL.md"),
       renderSkillMd(slug2, description, body2, skillCiteHandle(s)),
       "utf8"
     );
@@ -85380,11 +85455,11 @@ function emitAndProjectSkills(root, skills) {
   reconcileNamespaced(agentsSkillsDir, keep);
   let projected = 0;
   for (const h of HARNESS_SKILL_DIRS) {
-    if (!existsSync26(join31(root, h.configDir))) continue;
-    const dir = join31(root, h.skillsDir);
+    if (!existsSync26(join32(root, h.configDir))) continue;
+    const dir = join32(root, h.skillsDir);
     mkdirSync8(dir, { recursive: true });
     for (const slug2 of slugs) {
-      linkOrCopy(join31(dir, slug2), join31(agentsSkillsDir, slug2));
+      linkOrCopy(join32(dir, slug2), join32(agentsSkillsDir, slug2));
       projected++;
     }
     reconcileNamespaced(dir, keep);
@@ -85401,7 +85476,7 @@ function emitInputsFromManifest(erretaDir, manifestPath) {
       title: s.title ?? s.id,
       layer: s.layer ?? "technique",
       confidence: s.confidence ?? 0,
-      bodyPath: join31(erretaDir, s.file)
+      bodyPath: join32(erretaDir, s.file)
     }));
   } catch {
     return [];
@@ -85415,7 +85490,7 @@ var GITIGNORE_LINES = [
   ".cursor/skills/errata-*/"
 ];
 function ensureSkillGitignore(root) {
-  const path3 = join31(root, ".gitignore");
+  const path3 = join32(root, ".gitignore");
   let current = "";
   try {
     current = existsSync26(path3) ? readFileSync28(path3, "utf8") : "";
@@ -85522,12 +85597,12 @@ init_profile2();
 
 // src/witness-queue.ts
 import { readFileSync as readFileSync29, renameSync as renameSync3, writeFileSync as writeFileSync20 } from "node:fs";
-import { dirname as dirname12, join as join32 } from "node:path";
+import { dirname as dirname12, join as join33 } from "node:path";
 var WITNESS_QUEUE_CAP = 500;
 var WITNESS_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
 var WITNESS_MAX_ATTEMPTS = 5;
 function witnessQueuePath(workspaceConfigDir) {
-  return join32(workspaceConfigDir, "witness-queue.json");
+  return join33(workspaceConfigDir, "witness-queue.json");
 }
 function loadWitnessQueueWithLosses(path3) {
   let raw2;
@@ -85545,7 +85620,7 @@ function loadWitnessQueueWithLosses(path3) {
 }
 function saveWitnessQueue(path3, queue) {
   try {
-    const tmp = join32(dirname12(path3), `.${Date.now()}.witness-queue.tmp`);
+    const tmp = join33(dirname12(path3), `.${Date.now()}.witness-queue.tmp`);
     writeFileSync20(tmp, JSON.stringify(queue), "utf8");
     renameSync3(tmp, path3);
   } catch {
@@ -85856,7 +85931,7 @@ function maybeFlushDigests() {
 // src/liveness-watch.ts
 init_src5();
 import { readFileSync as readFileSync31, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 
 // src/loop-lag.ts
 var HEARTBEAT_MS = 500;
@@ -85987,7 +86062,7 @@ function watchCensusLine(c = watchCensus(), now = Date.now()) {
 var LIVENESS_WATCH_INTERVAL_MS = 60 * 60 * 1e3;
 var ALARM_RENOTIFY_MS = 24 * 60 * 60 * 1e3;
 function alarmStatePath(configDir) {
-  return join34(configDir, "liveness-alarms.json");
+  return join35(configDir, "liveness-alarms.json");
 }
 function loadAlarmState(path3) {
   try {
@@ -86227,7 +86302,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.22-dev.4277" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.22-dev.4293" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -86239,7 +86314,7 @@ var CODEX_SWEEP_LOOKBACK_MS = 10 * 6e4;
 function appendIdentityAudit(path3, record2, line) {
   if (!record2.accepted && record2.score <= 0) return;
   try {
-    if (existsSync28(path3) && statSync9(path3).size >= IDENTITY_AUDIT_MAX_BYTES) {
+    if (existsSync28(path3) && statSync10(path3).size >= IDENTITY_AUDIT_MAX_BYTES) {
       renameSync4(path3, `${path3}.1`);
     }
     appendFileSync4(path3, line);
@@ -86282,7 +86357,7 @@ function saveTurnCursors(path3, cursors, offsets) {
 function gitSourceWatchTargets(root) {
   const SOURCE = /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i;
   try {
-    const lsOut = execFileSync5("git", ["-C", root, "ls-files", "-z"], {
+    const lsOut = execFileSync6("git", ["-C", root, "ls-files", "-z"], {
       encoding: "utf8",
       maxBuffer: 128 * 1024 * 1024,
       windowsHide: true,
@@ -86292,12 +86367,12 @@ function gitSourceWatchTargets(root) {
     if (sourceFiles.length === 0) throw new Error("no tracked source");
     let ignoredDirs = [];
     try {
-      const igOut = execFileSync5(
+      const igOut = execFileSync6(
         "git",
         ["-C", root, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"],
         { encoding: "utf8", maxBuffer: 256 * 1024 * 1024, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }
       );
-      ignoredDirs = igOut.split("\0").filter(Boolean).map((d) => d.replace(/\/+$/, "")).filter((d) => !IGNORED_PATH.test(join35(root, d) + sep4));
+      ignoredDirs = igOut.split("\0").filter(Boolean).map((d) => d.replace(/\/+$/, "")).filter((d) => !IGNORED_PATH.test(join36(root, d) + sep4));
     } catch {
     }
     const hasIgnoredChild = (dir) => ignoredDirs.some((ig) => ig.startsWith(dir + "/"));
@@ -86309,19 +86384,19 @@ function gitSourceWatchTargets(root) {
         if (!f.startsWith(prefix)) continue;
         const rest2 = f.slice(prefix.length);
         if (rest2.includes("/")) children.add(dir === "" ? rest2.slice(0, rest2.indexOf("/")) : dir + "/" + rest2.slice(0, rest2.indexOf("/")));
-        else targets.add(join35(root, f));
+        else targets.add(join36(root, f));
       }
       for (const c of children) {
-        if (IGNORED_PATH.test(join35(root, c) + sep4)) continue;
+        if (IGNORED_PATH.test(join36(root, c) + sep4)) continue;
         if (hasIgnoredChild(c)) addUnder(c);
-        else targets.add(join35(root, c));
+        else targets.add(join36(root, c));
       }
     };
     addUnder("");
     if (targets.size > 0) return [...targets];
   } catch {
   }
-  return readdirSync11(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_PATH.test(join35(root, String(e.name)) + sep4)).map((e) => join35(root, String(e.name)));
+  return readdirSync11(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_PATH.test(join36(root, String(e.name)) + sep4)).map((e) => join36(root, String(e.name)));
 }
 function createWorkspaceEngine(opts) {
   const paths = workspacePaths(opts.workspaceRoot);
@@ -86413,7 +86488,7 @@ function createWorkspaceEngine(opts) {
       }
       let size = 0;
       try {
-        size = statSync9(path3).size;
+        size = statSync10(path3).size;
       } catch {
       }
       lastActivityTs = Date.now();
@@ -86520,7 +86595,7 @@ function createWorkspaceEngine(opts) {
       const srcPaths = diff.changedPaths.filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(p));
       let episodeId2;
       if (srcPaths.length > 0) {
-        const abs = srcPaths.map((p) => join35(opts.workspaceRoot, p));
+        const abs = srcPaths.map((p) => join36(opts.workspaceRoot, p));
         try {
           const r = await runReindexPass(
             `git-reindex:${profile.name} (${abs.length} files)`,
@@ -86556,7 +86631,7 @@ function createWorkspaceEngine(opts) {
         `[errata] git: ${ev.kind} ${ev.newSha.slice(0, 7)} by ${meta3.authorName} \u2014 ${diff.changedPaths.length} file(s), ${diff.renames.length} rename(s)`
       );
     };
-    const gitDir = join35(opts.workspaceRoot, ".git");
+    const gitDir = join36(opts.workspaceRoot, ".git");
     if (existsSync28(gitDir)) {
       stopGit = startGitSensor(gitDir, (ev) => {
         void handleGitEvent(ev).catch((err2) => {
@@ -86613,7 +86688,7 @@ function createWorkspaceEngine(opts) {
     },
     onAlarms: (alarms) => {
       toastLivenessAlarms(
-        sharedAlarmToastGate(join35(globalDir(), "liveness-toasts.json")),
+        sharedAlarmToastGate(join36(globalDir(), "liveness-toasts.json")),
         { root: opts.workspaceRoot, name: profile.name },
         alarms,
         (body2, key) => notifyEvent("mechanism-stalled", body2, { key }),
@@ -86630,7 +86705,7 @@ function createWorkspaceEngine(opts) {
   let subagentBase = null;
   let subagentBaseVersion = 0;
   const subagentRenders = /* @__PURE__ */ new Map();
-  const sessions = createSessionRegistry({ originsPath: join35(paths.configDir, "session-origins.json") });
+  const sessions = createSessionRegistry({ originsPath: join36(paths.configDir, "session-origins.json") });
   const sessionRenders = /* @__PURE__ */ new Map();
   const selfCiteSkipsBySession = /* @__PURE__ */ new Map();
   const toolRuns = createToolRunState();
@@ -86722,7 +86797,7 @@ function createWorkspaceEngine(opts) {
     const elicit = isEdgeElicitationEnabled();
     const snapOpts = {
       profile,
-      atCommit: readGitRefState(join35(opts.workspaceRoot, ".git")).sha ?? void 0,
+      atCommit: readGitRefState(join36(opts.workspaceRoot, ".git")).sha ?? void 0,
       reviewCount: pendingCount(paths),
       reviewUiUrl: opts.reviewUrl(),
       workingFile: workingFiles.mostRecent() ?? void 0,
@@ -86736,7 +86811,7 @@ function createWorkspaceEngine(opts) {
       );
       return null;
     }) : null;
-    if (snapOpts.atCommit !== (readGitRefState(join35(opts.workspaceRoot, ".git")).sha ?? void 0)) {
+    if (snapOpts.atCommit !== (readGitRefState(join36(opts.workspaceRoot, ".git")).sha ?? void 0)) {
       contextDirty = true;
       return;
     }
@@ -86782,10 +86857,10 @@ function createWorkspaceEngine(opts) {
     } catch (err2) {
       console.warn("[errata] context card failed:", err2.message?.slice(0, 120));
     }
-    const target = join35(opts.workspaceRoot, "AGENTS.md");
+    const target = join36(opts.workspaceRoot, "AGENTS.md");
     writeManagedBlock(target, { body: AGENTS_POINTER_BODY, stable: true, force: true });
     if (elicit) {
-      writePrimingHandles(join35(paths.configDir, "priming-handles.json"), [
+      writePrimingHandles(join36(paths.configDir, "priming-handles.json"), [
         ...snapshot.recentProblems.map((r) => r.node),
         // Resolved-band handles: the ✓ problem AND its Solution are citable
         // (a fix tag on an already-resolved problem no-ops idempotently; the
@@ -87093,8 +87168,8 @@ function createWorkspaceEngine(opts) {
     const cached2 = subagentRenders.get(a.agentId);
     if (cached2?.key === key) return cached2.block;
     const elicit = isEdgeElicitationEnabled();
-    const handlesPath = join35(paths.configDir, "priming-handles.json");
-    const atCommit = readGitRefState(join35(opts.workspaceRoot, ".git")).sha ?? void 0;
+    const handlesPath = join36(paths.configDir, "priming-handles.json");
+    const atCommit = readGitRefState(join36(opts.workspaceRoot, ".git")).sha ?? void 0;
     const block = renderSubagentBlock({
       store,
       entry,
@@ -87148,7 +87223,7 @@ function createWorkspaceEngine(opts) {
     const cached2 = sessionRenders.get(sessionId);
     if (cached2?.key === key) return cached2.block;
     const elicit = isEdgeElicitationEnabled();
-    const atCommit = readGitRefState(join35(opts.workspaceRoot, ".git")).sha ?? void 0;
+    const atCommit = readGitRefState(join36(opts.workspaceRoot, ".git")).sha ?? void 0;
     const scoped = scopeSnapshot(structuredClone(subagentBase), (n) => !hiddenFrom(n, sessionId, sessions, now));
     delete scoped.workingFile;
     if (workingFile) {
@@ -87189,7 +87264,7 @@ function createWorkspaceEngine(opts) {
       ]
     };
     if (elicit && block.handleNodes.length) {
-      writePrimingHandles(join35(paths.configDir, "priming-handles.json"), block.handleNodes);
+      writePrimingHandles(join36(paths.configDir, "priming-handles.json"), block.handleNodes);
     }
     sessionRenders.delete(sessionId);
     sessionRenders.set(sessionId, { key, block });
@@ -87249,7 +87324,7 @@ function createWorkspaceEngine(opts) {
       resultSummary: { exitCode: e.exitCode ?? 1, errorTokens: e.errorTokens }
     });
   };
-  const turnCursorPath = join35(paths.configDir, "turn-cursors.json");
+  const turnCursorPath = join36(paths.configDir, "turn-cursors.json");
   const lastTurnUuid = loadTurnCursors(turnCursorPath);
   const turnOffset = loadTurnOffsets(turnCursorPath);
   const readLosses = { parseFailures: 0, ioFailures: 0, bytesUnreachable: 0, sliceGuardHits: 0 };
@@ -87311,7 +87386,7 @@ function createWorkspaceEngine(opts) {
     let processedTurns = 0;
     const seqAtStart = store.currentIngestSeq();
     const elicit = isEdgeElicitationEnabled();
-    const handleMap = elicit ? readPrimingHandles(join35(paths.configDir, "priming-handles.json")) : {};
+    const handleMap = elicit ? readPrimingHandles(join36(paths.configDir, "priming-handles.json")) : {};
     const wsRoot = (opts.workspaceRoot ?? "").replace(/\\/g, "/");
     const toRel = (abs) => {
       const p = abs.replace(/\\/g, "/");
@@ -87522,7 +87597,7 @@ function createWorkspaceEngine(opts) {
             let anchorReadFailed = false;
             if (p.location) {
               try {
-                fileText = readFileSync32(join35(opts.workspaceRoot, p.location.path), "utf8");
+                fileText = readFileSync32(join36(opts.workspaceRoot, p.location.path), "utf8");
               } catch {
                 anchorReadFailed = true;
               }
@@ -87684,10 +87759,10 @@ function createWorkspaceEngine(opts) {
                 let enclosing = {};
                 if (p.location?.line !== void 0) {
                   try {
-                    const headSha = readGitRefState(join35(opts.workspaceRoot, ".git")).sha ?? void 0;
+                    const headSha = readGitRefState(join36(opts.workspaceRoot, ".git")).sha ?? void 0;
                     enclosing = {
                       line: p.location.line,
-                      fileText: readFileSync32(join35(opts.workspaceRoot, anchorPath), "utf8"),
+                      fileText: readFileSync32(join36(opts.workspaceRoot, anchorPath), "utf8"),
                       ...headSha ? { headSha } : {}
                     };
                   } catch {
@@ -88526,7 +88601,7 @@ B: ${b}`,
     try {
       const inputs = emitInputsFromManifest(paths.configDir, paths.skillsManifest);
       emitAndProjectSkills(opts.workspaceRoot, inputs);
-      writePrimingHandles(join35(paths.configDir, "priming-handles.json"), skillHandleNodes(inputs));
+      writePrimingHandles(join36(paths.configDir, "priming-handles.json"), skillHandleNodes(inputs));
     } catch (err2) {
       console.warn("[skills] agent-skills projection failed (non-fatal):", err2 instanceof Error ? err2.message : err2);
     }
@@ -89219,7 +89294,7 @@ async function linkRegisteredWorkspaces(cfg, loggedInProfile = cfg.activeInstall
 
 // src/edge-park.ts
 import { readFileSync as readFileSync33, renameSync as renameSync5, writeFileSync as writeFileSync25 } from "node:fs";
-import { dirname as dirname13, join as join36 } from "node:path";
+import { dirname as dirname13, join as join37 } from "node:path";
 var EDGE_PARK_CAP = 2e3;
 var EDGE_PARK_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
 var EDGE_PARK_MAX_ATTEMPTS = 6;
@@ -89234,7 +89309,7 @@ function wireEdgeKey(from, type, to) {
   return JSON.stringify([from, type, to]);
 }
 function edgeParkPath(workspaceConfigDir, destinationKey) {
-  return join36(workspaceConfigDir, `edge-park.${destinationKey.slice(0, 16)}.json`);
+  return join37(workspaceConfigDir, `edge-park.${destinationKey.slice(0, 16)}.json`);
 }
 function loadEdgePark(path3) {
   let raw2;
@@ -89250,7 +89325,7 @@ function loadEdgePark(path3) {
 }
 function saveEdgePark(path3, queue) {
   try {
-    const tmp = join36(dirname13(path3), `.${Date.now()}.edge-park.tmp`);
+    const tmp = join37(dirname13(path3), `.${Date.now()}.edge-park.tmp`);
     writeFileSync25(tmp, JSON.stringify(queue), "utf8");
     renameSync5(tmp, path3);
   } catch {
@@ -89594,7 +89669,7 @@ init_reconcile();
 // src/lockfile-auto.ts
 init_src();
 import { existsSync as existsSync30, readFileSync as readFileSync34 } from "node:fs";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 
 // src/package-index.ts
 init_src();
@@ -89746,7 +89821,7 @@ function runLockfilePass(opts) {
     { file: "package-lock.json", parse: parsePackageLockJson }
   ];
   for (const c of candidates) {
-    const p = join37(opts.root, c.file);
+    const p = join38(opts.root, c.file);
     if (!existsSync30(p)) continue;
     let sbom;
     try {
@@ -89812,7 +89887,7 @@ init_session_registry();
 
 // src/public-symbols.ts
 import { readFileSync as readFileSync35, readdirSync as readdirSync12, existsSync as existsSync31 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 var HEAD_BYTES = 8 * 1024;
 var INDEX_TTL_MS = 10 * 60 * 1e3;
 var MIN_SYMBOL_LEN = 4;
@@ -89845,7 +89920,7 @@ function bindingNames(clause) {
 function internalPackageNames(workspaceRoot) {
   const names = /* @__PURE__ */ new Set();
   const tryRead = (dir) => {
-    const pj = join38(dir, "package.json");
+    const pj = join39(dir, "package.json");
     if (!existsSync31(pj)) return;
     try {
       const name2 = JSON.parse(readFileSync35(pj, "utf8")).name;
@@ -89855,10 +89930,10 @@ function internalPackageNames(workspaceRoot) {
   };
   tryRead(workspaceRoot);
   for (const group of ["packages", "apps"]) {
-    const groupDir = join38(workspaceRoot, group);
+    const groupDir = join39(workspaceRoot, group);
     if (!existsSync31(groupDir)) continue;
     try {
-      for (const entry of readdirSync12(groupDir)) tryRead(join38(groupDir, entry));
+      for (const entry of readdirSync12(groupDir)) tryRead(join39(groupDir, entry));
     } catch {
     }
   }
@@ -89897,7 +89972,7 @@ function publicSymbolIndex(store, workspaceRoot, deps = {}) {
   }
   const symbols = /* @__PURE__ */ new Set();
   for (const rel of files) {
-    const head2 = readHead(join38(workspaceRoot, rel));
+    const head2 = readHead(join39(workspaceRoot, rel));
     if (!head2) continue;
     for (const re of [NAMED_IMPORT_RE, REQUIRE_RE]) {
       re.lastIndex = 0;
@@ -90882,7 +90957,7 @@ init_config();
 
 // src/update.ts
 import { spawn as spawn2 } from "node:child_process";
-import { isAbsolute as isAbsolute6, join as join39 } from "node:path";
+import { isAbsolute as isAbsolute6, join as join40 } from "node:path";
 var PACKAGE_NAME = "@inerrata-corporation/errata";
 function parse3(v) {
   const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z][0-9A-Za-z.-]*))?/.exec(v.trim());
@@ -91029,7 +91104,7 @@ async function runInstalledHookRefresh() {
   });
   if (!isAbsolute6(root)) return 1;
   return new Promise((resolve10) => {
-    const child = spawn2(process.execPath, [join39(root, PACKAGE_NAME, "errata.mjs"), "install-hooks", "codex", "--refresh-existing"], {
+    const child = spawn2(process.execPath, [join40(root, PACKAGE_NAME, "errata.mjs"), "install-hooks", "codex", "--refresh-existing"], {
       windowsHide: true,
       stdio: "inherit",
       timeout: 3e4
@@ -91176,11 +91251,11 @@ function landCloudEdge(store, e, from, to) {
 
 // src/causal-edge-queue.ts
 import { readFileSync as readFileSync36, renameSync as renameSync6, writeFileSync as writeFileSync26 } from "node:fs";
-import { dirname as dirname14, join as join40 } from "node:path";
+import { dirname as dirname14, join as join41 } from "node:path";
 var CAUSAL_EDGE_QUEUE_CAP = 5e3;
 var CAUSAL_EDGE_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function causalEdgeQueuePath(workspaceConfigDir) {
-  return join40(workspaceConfigDir, "causal-edge-queue.json");
+  return join41(workspaceConfigDir, "causal-edge-queue.json");
 }
 function parkedEdgeKey(e) {
   return `${e.from}|${e.type}|${e.to}`;
@@ -91199,7 +91274,7 @@ function loadCausalEdgeQueue(path3) {
 }
 function saveCausalEdgeQueue(path3, queue) {
   try {
-    const tmp = join40(dirname14(path3), `.${Date.now()}.causal-edge-queue.tmp`);
+    const tmp = join41(dirname14(path3), `.${Date.now()}.causal-edge-queue.tmp`);
     writeFileSync26(tmp, JSON.stringify(queue), "utf8");
     renameSync6(tmp, path3);
   } catch {
@@ -91873,7 +91948,7 @@ init_src7();
 init_src();
 import { execFile as execFile6 } from "node:child_process";
 import { readFileSync as readFileSync37 } from "node:fs";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 
 // src/history-walk.ts
@@ -92425,7 +92500,7 @@ async function defaultGit(root, args2) {
 function readIgnoreLines(root, profile) {
   let lines = [];
   try {
-    lines = readFileSync37(join41(root, ".errataignore"), "utf8").split("\n");
+    lines = readFileSync37(join42(root, ".errataignore"), "utf8").split("\n");
   } catch {
   }
   return [...lines, ...profile.ignoreExtra ?? []].map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
@@ -93000,9 +93075,9 @@ async function startHistoryStage(root, input, client, walk11 = {}) {
 // src/link-flow.ts
 init_cloud_auth();
 import { createHash as createHash19 } from "node:crypto";
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 import { existsSync as existsSync32, writeFileSync as writeFileSync27 } from "node:fs";
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 
 // src/device-poll.ts
 var THROTTLED_POLL_MIN_WAIT_MS = 11e3;
@@ -93389,7 +93464,7 @@ async function linkThroughConsole(opts) {
 function collectRepoFacts(root) {
   const git3 = (args2) => {
     try {
-      return execFileSync6("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+      return execFileSync7("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     } catch {
       return null;
     }
@@ -93461,7 +93536,7 @@ function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
   delete nextProfile.projectLinkHold;
   let wroteIgnore = false;
   if (decision.writeIgnoreStarter !== false) {
-    const target = join42(root, ".errataignore");
+    const target = join43(root, ".errataignore");
     if (!existsSync32(target)) {
       writeFileSync27(target, IGNORE_STARTER, "utf8");
       wroteIgnore = true;
@@ -93477,11 +93552,11 @@ init_registry();
 // src/adopt.ts
 init_git_remote();
 import { existsSync as existsSync33 } from "node:fs";
-import { dirname as dirname15, join as join43 } from "node:path";
+import { dirname as dirname15, join as join44 } from "node:path";
 function findGitRoot(absPath) {
   let dir = absPath;
   for (let depth = 0; depth < 64; depth++) {
-    if (existsSync33(join43(dir, ".git"))) return dir;
+    if (existsSync33(join44(dir, ".git"))) return dir;
     const parent = dirname15(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -96105,15 +96180,15 @@ function shouldUseOAuthLogin(flags2, env2 = process.env) {
 import { spawnSync as spawnSync2 } from "node:child_process";
 
 // src/codex-runtime.ts
-import { readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
-import { join as join44 } from "node:path";
+import { readdirSync as readdirSync13, statSync as statSync11 } from "node:fs";
+import { join as join45 } from "node:path";
 function resolveCodexExecutable(options = {}) {
   const platform = options.platform ?? process.platform;
   const env2 = options.env ?? process.env;
   if (platform !== "win32") return "codex";
   const fileTime = (path3) => {
     try {
-      const s = statSync10(path3);
+      const s = statSync11(path3);
       return s.isFile() ? s.mtimeMs : null;
     } catch {
       return null;
@@ -96121,13 +96196,13 @@ function resolveCodexExecutable(options = {}) {
   };
   for (const dir of (env2["PATH"] ?? env2["Path"] ?? "").split(";")) {
     if (!dir.trim()) continue;
-    const path3 = join44(dir.trim().replace(/^"|"$/g, ""), "codex.exe");
+    const path3 = join45(dir.trim().replace(/^"|"$/g, ""), "codex.exe");
     if (fileTime(path3) !== null) return path3;
   }
   if (!env2["LOCALAPPDATA"]) return "codex";
-  const root = join44(env2["LOCALAPPDATA"], "OpenAI", "Codex", "bin");
+  const root = join45(env2["LOCALAPPDATA"], "OpenAI", "Codex", "bin");
   try {
-    const candidates = readdirSync13(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join44(root, entry.name, "codex.exe")).map((path3) => ({ path: path3, mtime: fileTime(path3) })).filter((candidate) => candidate.mtime !== null).sort((a, b) => b.mtime - a.mtime || a.path.localeCompare(b.path));
+    const candidates = readdirSync13(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join45(root, entry.name, "codex.exe")).map((path3) => ({ path: path3, mtime: fileTime(path3) })).filter((candidate) => candidate.mtime !== null).sort((a, b) => b.mtime - a.mtime || a.path.localeCompare(b.path));
     return candidates[0]?.path ?? "codex";
   } catch {
     return "codex";
@@ -96184,6 +96259,7 @@ async function diagnoseInstallation(cfg, dependencies) {
   checks.push(
     credentialType === "none" ? { id: "credential", status: "fail", detail: "No credential is installed" } : { id: "credential", status: "pass", detail: `${credentialType} credential is present` }
   );
+  if (dependencies.credentialHygiene) checks.push(dependencies.credentialHygiene());
   const authorityMatches = !profile || profile.cloudUrl === cfg.cloudUrl && profile.apiKey === cfg.apiKey && profile.accessToken === cfg.accessToken && profile.refreshToken === cfg.refreshToken;
   checks.push(
     authorityMatches ? {
@@ -96264,16 +96340,219 @@ async function diagnoseInstallation(cfg, dependencies) {
   };
 }
 
+// src/credential-scan.ts
+import { readFileSync as readFileSync39, statSync as statSync12 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join47 } from "node:path";
+
+// src/claude-statusline.ts
+import { existsSync as existsSync35, mkdirSync as mkdirSync9, readFileSync as readFileSync38, writeFileSync as writeFileSync29 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { dirname as dirname16, join as join46 } from "node:path";
+var STATUSLINE_RELAY_SOURCE = String.raw`// errata-managed: regenerated by errata init / install-hooks claude
+import { readFileSync } from 'node:fs';
+
+try {
+  const port = Number(process.argv[2]);
+  const route = process.argv[3] === 'subagents' ? '/api/statusline/subagents' : '/api/statusline';
+  if (Number.isInteger(port) && port > 0 && port < 65536) {
+    const response = await fetch('http://127.0.0.1:' + port + route, {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: readFileSync(0, 'utf8') || '{}', signal: AbortSignal.timeout(800),
+    });
+    if (response.ok) process.stdout.write(await response.text());
+  }
+} catch { /* An unavailable daemon leaves the status line empty. */ }
+`;
+var STATUSLINE_RELAY_FILE = "errata-statusline.mjs";
+function buildStatusLine(port, nodePath, relayPath) {
+  return { type: "command", command: relayCommand(port, nodePath, relayPath), padding: 0 };
+}
+function buildSubagentStatusLine(port, nodePath, relayPath) {
+  return { type: "command", command: `${relayCommand(port, nodePath, relayPath)} subagents` };
+}
+function relayCommand(port, nodePath, relayPath) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid status line port");
+  const q = (p) => {
+    if (/["$`\r\n]/.test(p)) throw new Error("Unsupported character in status line path");
+    return `"${p.replace(/\\/g, "/")}"`;
+  };
+  return `${q(nodePath)} ${q(relayPath)} ${port}`;
+}
+function isErrataStatusLine(value) {
+  return !!value && typeof value === "object" && typeof value["command"] === "string" && value["command"].includes(STATUSLINE_RELAY_FILE);
+}
+function removeProjectStatusLine(settings) {
+  let removed = false;
+  for (const key of ["statusLine", "subagentStatusLine"]) {
+    if (!isErrataStatusLine(settings[key])) continue;
+    delete settings[key];
+    removed = true;
+  }
+  return removed;
+}
+function isSameInstall(value, relay) {
+  const command = value["command"].replace(/\\/g, "/").toLowerCase();
+  return command.includes(relay.replace(/\\/g, "/").toLowerCase());
+}
+function userClaudeSettingsPath() {
+  const base = process.env["CLAUDE_CONFIG_DIR"] ?? join46(homedir7(), ".claude");
+  return join46(base, "settings.json");
+}
+function ensureUserStatusLine(opts) {
+  const env2 = opts.env ?? process.env;
+  const off2 = (env2["ERRATA_STATUSLINE"] ?? "").trim().toLowerCase();
+  if (off2 === "0" || off2 === "off" || off2 === "false" || off2 === "no") return "disabled";
+  const settingsPath = opts.userSettingsPath ?? userClaudeSettingsPath();
+  let settings = {};
+  if (existsSync35(settingsPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync38(settingsPath, "utf8"));
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "unreadable";
+      settings = parsed;
+    } catch {
+      return "unreadable";
+    }
+  }
+  const relay = join46(opts.relayDir, STATUSLINE_RELAY_FILE);
+  const keep = (value) => value !== void 0 && (!isErrataStatusLine(value) || !isSameInstall(value, relay));
+  const ownMain = keep(settings["statusLine"]);
+  const ownRows = keep(settings["subagentStatusLine"]);
+  if (ownMain && ownRows) return "kept-own";
+  mkdirSync9(opts.relayDir, { recursive: true });
+  if (!existsSync35(relay) || readFileSync38(relay, "utf8") !== STATUSLINE_RELAY_SOURCE) {
+    writeFileSync29(relay, STATUSLINE_RELAY_SOURCE, "utf8");
+  }
+  const nodePath = opts.nodePath ?? process.execPath;
+  const next = {
+    ...ownMain ? {} : { statusLine: buildStatusLine(opts.port, nodePath, relay) },
+    ...ownRows ? {} : { subagentStatusLine: buildSubagentStatusLine(opts.port, nodePath, relay) }
+  };
+  if (Object.entries(next).every(([k, v]) => JSON.stringify(settings[k]) === JSON.stringify(v))) {
+    return ownMain ? "kept-own" : "unchanged";
+  }
+  Object.assign(settings, next);
+  mkdirSync9(dirname16(settingsPath), { recursive: true });
+  writeFileSync29(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  return "installed";
+}
+function describeStatusLineOutcome(outcome) {
+  switch (outcome) {
+    case "installed":
+      return "status line: errata recall card in colour (user settings; ERRATA_STATUSLINE=off opts out)";
+    case "unchanged":
+      return "status line: errata recall card already set up";
+    case "kept-own":
+      return "status line: kept your own \u2014 errata's recall card shows inline only";
+    case "disabled":
+      return "status line: skipped (ERRATA_STATUSLINE=off)";
+    case "unreadable":
+      return "status line: skipped \u2014 ~/.claude/settings.json is not valid JSON";
+  }
+}
+
+// src/credential-scan.ts
+var KEY_RE = /(?<![A-Za-z0-9_-])(?:errk_[A-Za-z0-9_-]{32,}|err_[a-f0-9]{6}_[a-f0-9]{32})(?![A-Za-z0-9_-])/;
+var ENV_ASSIGNMENT_RE = /(?:^|[\s{,"'])INERRATA_API_KEY["']?\s*[:=]\s*["']([^"']*)["']/;
+function isReference(value) {
+  return value.trim() === "" || /[$<{]/.test(value);
+}
+var MAX_SCAN_BYTES = 8 * 1024 * 1024;
+var MAX_LISTED_FINDINGS = 5;
+function findCredentialLines(text) {
+  const lines = [];
+  text.split(/\r?\n/).forEach((line, index) => {
+    if (KEY_RE.test(line)) {
+      lines.push(index + 1);
+      return;
+    }
+    const assignment = ENV_ASSIGNMENT_RE.exec(line);
+    if (assignment && !isReference(assignment[1])) lines.push(index + 1);
+  });
+  return lines;
+}
+function harnessConfigPaths(root) {
+  const env2 = process.env;
+  const home = homedir8();
+  const codexHome = env2["CODEX_HOME"] || join47(home, ".codex");
+  const geminiHome = join47(env2["GEMINI_CLI_HOME"] ?? home, ".gemini");
+  return [
+    // Claude Code: user settings, `claude mcp add` (local/user scope), project.
+    userClaudeSettingsPath(),
+    join47(env2["CLAUDE_CONFIG_DIR"] ?? home, ".claude.json"),
+    join47(root, ".claude", "settings.json"),
+    join47(root, ".claude", "settings.local.json"),
+    join47(root, ".mcp.json"),
+    // Codex
+    join47(codexHome, "config.toml"),
+    join47(root, ".codex", "config.toml"),
+    // Gemini CLI
+    join47(geminiHome, "settings.json"),
+    join47(root, ".gemini", "settings.json"),
+    // Cursor
+    join47(home, ".cursor", "mcp.json"),
+    join47(root, ".cursor", "mcp.json"),
+    // VS Code (user profile mcp.json + workspace)
+    join47(vscodeUserDir(home, env2), "mcp.json"),
+    join47(root, ".vscode", "mcp.json"),
+    // OpenCode (XDG on every platform; the daemon's installer writes the project one)
+    join47(env2["XDG_CONFIG_HOME"] ?? join47(home, ".config"), "opencode", "opencode.json"),
+    join47(root, "opencode.json")
+  ];
+}
+function vscodeUserDir(home, env2) {
+  if (process.platform === "win32") return join47(env2["APPDATA"] ?? join47(home, "AppData", "Roaming"), "Code", "User");
+  if (process.platform === "darwin") return join47(home, "Library", "Application Support", "Code", "User");
+  return join47(env2["XDG_CONFIG_HOME"] ?? join47(home, ".config"), "Code", "User");
+}
+function scanHarnessConfigs(paths, read2 = readBounded) {
+  const findings = [];
+  let scanned = 0;
+  for (const file2 of new Set(paths)) {
+    const text = read2(file2);
+    if (text === null) continue;
+    scanned++;
+    for (const line of findCredentialLines(text)) findings.push({ file: file2, line });
+  }
+  return { scanned, findings };
+}
+function readBounded(path3) {
+  try {
+    const stat4 = statSync12(path3);
+    if (!stat4.isFile() || stat4.size > MAX_SCAN_BYTES) return null;
+    return readFileSync39(path3, "utf8");
+  } catch {
+    return null;
+  }
+}
+function credentialHygieneCheck(scan2) {
+  if (scan2.findings.length === 0) {
+    return {
+      id: "credential_hygiene",
+      status: "pass",
+      detail: `No plaintext errata credentials in ${scan2.scanned} harness config file(s)`
+    };
+  }
+  const shown = scan2.findings.slice(0, MAX_LISTED_FINDINGS).map((finding) => `${finding.file}:${finding.line}`);
+  const more = scan2.findings.length - shown.length;
+  const where = shown.join(", ") + (more > 0 ? ` (+${more} more)` : "");
+  return {
+    id: "credential_hygiene",
+    status: "warn",
+    detail: `Plaintext errata credential in ${where} \u2014 remove it, revoke that key in the console, and run errata login (or reference an environment variable set outside committed/synced settings)`
+  };
+}
+
 // src/codex-doctor.ts
 import { spawn as spawn4 } from "node:child_process";
-import { readFileSync as readFileSync39, statSync as statSync11 } from "node:fs";
-import { join as join46 } from "node:path";
+import { readFileSync as readFileSync41, statSync as statSync13 } from "node:fs";
+import { join as join49 } from "node:path";
 import { createInterface } from "node:readline";
 
 // src/codex-hooks.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync9, readFileSync as readFileSync38, renameSync as renameSync7, unlinkSync as unlinkSync5, writeFileSync as writeFileSync29 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join45 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync10, readFileSync as readFileSync40, renameSync as renameSync7, unlinkSync as unlinkSync5, writeFileSync as writeFileSync30 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { join as join48 } from "node:path";
 
 // src/hook-commands.ts
 function hookCurlCommand(port, path3 = "/api/hook") {
@@ -96477,34 +96756,34 @@ function buildCodexRelaySource(workspaceRoot) {
 init_checkout_root();
 var CODEX_HOOK_REVIEW_HELP = "Codex desktop: Settings > Hooks, select this project, expand each event and Trust the Errata hook. CLI users can use /hooks.";
 function writeRelay(file2, source) {
-  if (existsSync35(file2) && readFileSync38(file2, "utf8") === source) return;
+  if (existsSync36(file2) && readFileSync40(file2, "utf8") === source) return;
   const temp = `${file2}.${process.pid}.tmp`;
   try {
-    writeFileSync29(temp, source, { encoding: "utf8", mode: 384 });
+    writeFileSync30(temp, source, { encoding: "utf8", mode: 384 });
     renameSync7(temp, file2);
   } finally {
-    if (existsSync35(temp)) unlinkSync5(temp);
+    if (existsSync36(temp)) unlinkSync5(temp);
   }
 }
 function refreshCodexRelay(root) {
-  const config2 = join45(root, ".codex", "config.toml");
-  if (!existsSync35(config2)) return "absent";
-  const existing = readFileSync38(config2, "utf8");
+  const config2 = join48(root, ".codex", "config.toml");
+  if (!existsSync36(config2)) return "absent";
+  const existing = readFileSync40(config2, "utf8");
   if (!existing.includes(CODEX_HOOKS_BEGIN) && !existing.includes(CODEX_HOOKS_END)) return "absent";
   replaceCodexHooks(existing, "");
-  const relay = join45(root, ".codex", "hooks", "errata-relay.mjs");
-  const prior = existsSync35(relay) ? readFileSync38(relay, "utf8") : "";
+  const relay = join48(root, ".codex", "hooks", "errata-relay.mjs");
+  const prior = existsSync36(relay) ? readFileSync40(relay, "utf8") : "";
   if (prior && !prior.startsWith("// errata-managed: regenerated by errata install-hooks codex")) {
     throw new Error("Codex relay is not Errata-managed; preserved it. Run errata install-hooks codex to explicitly replace it.");
   }
   const source = buildCodexRelaySource(checkoutRootOf(root));
   if (prior === source) return "current";
-  mkdirSync9(join45(root, ".codex", "hooks"), { recursive: true });
+  mkdirSync10(join48(root, ".codex", "hooks"), { recursive: true });
   writeRelay(relay, source);
   return "updated";
 }
-function hasCodexConfig(root, codexHome = process.env["CODEX_HOME"] || join45(homedir7(), ".codex")) {
-  return existsSync35(join45(root, ".codex")) || existsSync35(codexHome);
+function hasCodexConfig(root, codexHome = process.env["CODEX_HOME"] || join48(homedir9(), ".codex")) {
+  return existsSync36(join48(root, ".codex")) || existsSync36(codexHome);
 }
 function replaceCodexHooks(existing, block) {
   const begin = existing.indexOf(CODEX_HOOKS_BEGIN);
@@ -96520,14 +96799,14 @@ function replaceCodexHooks(existing, block) {
   return existing.trimEnd() + (existing.trim() ? "\n\n" : "") + block;
 }
 function writeCodexHooks(root, port, nodePath = process.execPath) {
-  const dir = join45(root, ".codex");
-  const file2 = join45(dir, "config.toml");
-  const relay = join45(dir, "hooks", "errata-relay.mjs");
+  const dir = join48(root, ".codex");
+  const file2 = join48(dir, "config.toml");
+  const relay = join48(dir, "hooks", "errata-relay.mjs");
   const block = buildCodexHooksToml(port, { nodePath, relayPath: relay });
-  const final = replaceCodexHooks(existsSync35(file2) ? readFileSync38(file2, "utf8") : "", block);
-  mkdirSync9(join45(dir, "hooks"), { recursive: true });
+  const final = replaceCodexHooks(existsSync36(file2) ? readFileSync40(file2, "utf8") : "", block);
+  mkdirSync10(join48(dir, "hooks"), { recursive: true });
   writeRelay(relay, buildCodexRelaySource(checkoutRootOf(root)));
-  if (!existsSync35(file2) || readFileSync38(file2, "utf8") !== final) writeFileSync29(file2, final, "utf8");
+  if (!existsSync36(file2) || readFileSync40(file2, "utf8") !== final) writeFileSync30(file2, final, "utf8");
   return file2;
 }
 
@@ -96536,7 +96815,7 @@ init_checkout_root();
 function inspectCodexRelay(cwd) {
   const root = nearestGitRoot(cwd) ?? cwd;
   try {
-    const source = readFileSync39(join46(root, ".codex", "hooks", "errata-relay.mjs"), "utf8");
+    const source = readFileSync41(join49(root, ".codex", "hooks", "errata-relay.mjs"), "utf8");
     if (source === buildCodexRelaySource(checkoutRootOf(root))) {
       return { id: "codex_relay", status: "pass", detail: "Installed Codex relay matches this Errata version" };
     }
@@ -96547,8 +96826,8 @@ function inspectCodexRelay(cwd) {
 function inspectCodexContext(cwd) {
   const root = checkoutRootOf(nearestGitRoot(cwd) ?? cwd);
   try {
-    const file2 = join46(root, ".errata", "context.md");
-    if (statSync11(file2).size <= 128 * 1024 && readFileSync39(file2, "utf8").trim()) {
+    const file2 = join49(root, ".errata", "context.md");
+    if (statSync13(file2).size <= 128 * 1024 && readFileSync41(file2, "utf8").trim()) {
       return { id: "codex_context", status: "pass", detail: "Saved workspace context is readable by the relay; this does not prove live daemon freshness" };
     }
   } catch {
@@ -96726,9 +97005,9 @@ function consolidationGapMs(lastPassMs, policy) {
 
 // src/codex-context-plugin.ts
 import { createHash as createHash20 } from "node:crypto";
-import { cpSync as cpSync2, existsSync as existsSync36, mkdirSync as mkdirSync10, readFileSync as readFileSync40, renameSync as renameSync8, writeFileSync as writeFileSync30 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { join as join47 } from "node:path";
+import { cpSync as cpSync2, existsSync as existsSync37, mkdirSync as mkdirSync11, readFileSync as readFileSync42, renameSync as renameSync8, writeFileSync as writeFileSync31 } from "node:fs";
+import { homedir as homedir10 } from "node:os";
+import { join as join50 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/error.js
@@ -97426,23 +97705,23 @@ var NAME = "errata-context";
 var PREFIX2 = `./.errata/plugins/${NAME}/`;
 var object2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 function readText(file2) {
-  return existsSync36(file2) ? readFileSync40(file2, "utf8") : "";
+  return existsSync37(file2) ? readFileSync42(file2, "utf8") : "";
 }
 function writeChanged(file2, content) {
   if (readText(file2) === content) return;
   const temp = `${file2}.${process.pid}.tmp`;
-  writeFileSync30(temp, content, "utf8");
+  writeFileSync31(temp, content, "utf8");
   renameSync8(temp, file2);
 }
 function bundledContextPlugin() {
   const packaged = fileURLToPath2(new URL("./resources/context-plugin/", import.meta.url));
-  if (existsSync36(join47(packaged, ".codex-plugin/plugin.json"))) return packaged;
+  if (existsSync37(join50(packaged, ".codex-plugin/plugin.json"))) return packaged;
   return fileURLToPath2(new URL("../dist/resources/context-plugin/", import.meta.url));
 }
 function refreshCodexContextPlugin(root) {
-  const file2 = join47(root, ".agents", "plugins", "marketplace.json");
-  if (!existsSync36(file2)) return false;
-  const marketplace = JSON.parse(readFileSync40(file2, "utf8"));
+  const file2 = join50(root, ".agents", "plugins", "marketplace.json");
+  if (!existsSync37(file2)) return false;
+  const marketplace = JSON.parse(readFileSync42(file2, "utf8"));
   const entries = Array.isArray(marketplace.plugins) ? marketplace.plugins : [];
   const entry = entries.map(object2).find((value) => value.name === NAME && String(object2(value.source).path).startsWith(PREFIX2));
   if (!entry) return false;
@@ -97453,24 +97732,24 @@ function refreshCodexContextPlugin(root) {
 function installCodexContextPlugin(root, options = {}) {
   const bundle = options.bundle ?? bundledContextPlugin();
   const manifest = JSON.parse(
-    readFileSync40(join47(bundle, ".codex-plugin/plugin.json"), "utf8")
+    readFileSync42(join50(bundle, ".codex-plugin/plugin.json"), "utf8")
   );
   if (manifest.name !== NAME || typeof manifest.version !== "string" || !/^[\w.-]+$/.test(manifest.version)) {
     throw new Error("Invalid bundled Errata Context manifest.");
   }
-  const checksums = readFileSync40(join47(bundle, "SHA256SUMS"), "utf8");
+  const checksums = readFileSync42(join50(bundle, "SHA256SUMS"), "utf8");
   for (const line of checksums.trim().split("\n")) {
     const match2 = /^([a-f0-9]{64})  ([\w./-]+)$/.exec(line);
     if (!match2 || match2[2].startsWith("/") || match2[2].split("/").includes("..")) {
       throw new Error("Invalid bundled Errata Context checksum manifest.");
     }
-    const actual = createHash20("sha256").update(readFileSync40(join47(bundle, match2[2]))).digest("hex");
+    const actual = createHash20("sha256").update(readFileSync42(join50(bundle, match2[2]))).digest("hex");
     if (actual !== match2[1])
       throw new Error(`Bundled Errata Context checksum mismatch: ${match2[2]}`);
   }
   const release = `${manifest.version}-${createHash20("sha256").update(checksums).digest("hex").slice(0, 12)}`;
-  const plugin = join47(root, ".errata", "plugins", NAME, release);
-  const marketplaceFile = join47(root, ".agents", "plugins", "marketplace.json");
+  const plugin = join50(root, ".errata", "plugins", NAME, release);
+  const marketplaceFile = join50(root, ".agents", "plugins", "marketplace.json");
   const priorMarketplace = readText(marketplaceFile);
   const marketplace = priorMarketplace ? JSON.parse(priorMarketplace) : {
     name: "errata-local",
@@ -97491,12 +97770,12 @@ function installCodexContextPlugin(root, options = {}) {
     );
   }
   const key = `${NAME}@${marketplace.name}`;
-  const configFile = join47(root, ".codex", "config.toml");
+  const configFile = join50(root, ".codex", "config.toml");
   const config2 = readText(configFile);
   const parsed = parse4(config2);
   const plugins = object2(parsed.plugins);
-  const codexHome = options.codexHome ?? process.env["CODEX_HOME"] ?? join47(homedir8(), ".codex");
-  const globalPlugins = object2(parse4(readText(join47(codexHome, "config.toml"))).plugins);
+  const codexHome = options.codexHome ?? process.env["CODEX_HOME"] ?? join50(homedir10(), ".codex");
+  const globalPlugins = object2(parse4(readText(join50(codexHome, "config.toml"))).plugins);
   const disabledGlobally = Object.entries(globalPlugins).some(
     ([name2, value]) => (name2 === NAME || name2.startsWith(`${NAME}@`)) && object2(value).enabled === false
   );
@@ -97517,16 +97796,16 @@ enabled = ${enabled}
     category: prior?.category ?? "Productivity"
   };
   marketplace.plugins = [...entries.filter((item2) => item2.name !== NAME), entry];
-  mkdirSync10(plugin, { recursive: true });
+  mkdirSync11(plugin, { recursive: true });
   cpSync2(bundle, plugin, { recursive: true });
   writeChanged(
-    join47(plugin, ".mcp.json"),
+    join50(plugin, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
           errata_context: {
             command: options.nodePath ?? process.execPath,
-            args: [join47(plugin, "dist", "mcp-server.mjs")],
+            args: [join50(plugin, "dist", "mcp-server.mjs")],
             env: { ERRATA_WORKSPACE: root, ERRATA_CONTEXT_VERSION: manifest.version }
           }
         }
@@ -97535,8 +97814,8 @@ enabled = ${enabled}
       2
     ) + "\n"
   );
-  mkdirSync10(join47(root, ".agents", "plugins"), { recursive: true });
-  mkdirSync10(join47(root, ".codex"), { recursive: true });
+  mkdirSync11(join50(root, ".agents", "plugins"), { recursive: true });
+  mkdirSync11(join50(root, ".codex"), { recursive: true });
   writeChanged(marketplaceFile, JSON.stringify(marketplace, null, 2) + "\n");
   writeChanged(configFile, nextConfig);
   return { plugin, enabled, marketplace: marketplaceFile };
@@ -97544,16 +97823,16 @@ enabled = ${enabled}
 
 // src/codex-hook-refresh.ts
 init_checkout_root();
-import { existsSync as existsSync37, readdirSync as readdirSync14, readFileSync as readFileSync41 } from "node:fs";
-import { dirname as dirname16, join as join48, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync38, readdirSync as readdirSync14, readFileSync as readFileSync43 } from "node:fs";
+import { dirname as dirname17, join as join51, resolve as resolve8 } from "node:path";
 init_registry();
 function codexHookRoots(roots) {
   const found = new Set(roots.map((root) => resolve8(root)));
   for (const root of [...found]) {
     const main2 = mainCheckoutOfWorktree(root) ?? root;
     found.add(main2);
-    const dir = join48(main2, ".git", "worktrees");
-    if (!existsSync37(dir)) continue;
+    const dir = join51(main2, ".git", "worktrees");
+    if (!existsSync38(dir)) continue;
     let names;
     try {
       names = readdirSync14(dir);
@@ -97562,7 +97841,7 @@ function codexHookRoots(roots) {
     }
     for (const name2 of names) {
       try {
-        const checkout = dirname16(readFileSync41(join48(dir, name2, "gitdir"), "utf8").trim());
+        const checkout = dirname17(readFileSync43(join51(dir, name2, "gitdir"), "utf8").trim());
         if (mainCheckoutOfWorktree(checkout) === main2) found.add(checkout);
       } catch {
       }
@@ -97583,116 +97862,10 @@ function refreshInstalledCodexRelays(roots = listWorkspaceEntries().map((entry)
   return results;
 }
 
-// src/claude-statusline.ts
-import { existsSync as existsSync38, mkdirSync as mkdirSync11, readFileSync as readFileSync42, writeFileSync as writeFileSync31 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { dirname as dirname17, join as join49 } from "node:path";
-var STATUSLINE_RELAY_SOURCE = String.raw`// errata-managed: regenerated by errata init / install-hooks claude
-import { readFileSync } from 'node:fs';
-
-try {
-  const port = Number(process.argv[2]);
-  const route = process.argv[3] === 'subagents' ? '/api/statusline/subagents' : '/api/statusline';
-  if (Number.isInteger(port) && port > 0 && port < 65536) {
-    const response = await fetch('http://127.0.0.1:' + port + route, {
-      method: 'POST', headers: { 'Content-Type': 'application/json' },
-      body: readFileSync(0, 'utf8') || '{}', signal: AbortSignal.timeout(800),
-    });
-    if (response.ok) process.stdout.write(await response.text());
-  }
-} catch { /* An unavailable daemon leaves the status line empty. */ }
-`;
-var STATUSLINE_RELAY_FILE = "errata-statusline.mjs";
-function buildStatusLine(port, nodePath, relayPath) {
-  return { type: "command", command: relayCommand(port, nodePath, relayPath), padding: 0 };
-}
-function buildSubagentStatusLine(port, nodePath, relayPath) {
-  return { type: "command", command: `${relayCommand(port, nodePath, relayPath)} subagents` };
-}
-function relayCommand(port, nodePath, relayPath) {
-  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid status line port");
-  const q = (p) => {
-    if (/["$`\r\n]/.test(p)) throw new Error("Unsupported character in status line path");
-    return `"${p.replace(/\\/g, "/")}"`;
-  };
-  return `${q(nodePath)} ${q(relayPath)} ${port}`;
-}
-function isErrataStatusLine(value) {
-  return !!value && typeof value === "object" && typeof value["command"] === "string" && value["command"].includes(STATUSLINE_RELAY_FILE);
-}
-function removeProjectStatusLine(settings) {
-  let removed = false;
-  for (const key of ["statusLine", "subagentStatusLine"]) {
-    if (!isErrataStatusLine(settings[key])) continue;
-    delete settings[key];
-    removed = true;
-  }
-  return removed;
-}
-function isSameInstall(value, relay) {
-  const command = value["command"].replace(/\\/g, "/").toLowerCase();
-  return command.includes(relay.replace(/\\/g, "/").toLowerCase());
-}
-function userClaudeSettingsPath() {
-  const base = process.env["CLAUDE_CONFIG_DIR"] ?? join49(homedir9(), ".claude");
-  return join49(base, "settings.json");
-}
-function ensureUserStatusLine(opts) {
-  const env2 = opts.env ?? process.env;
-  const off2 = (env2["ERRATA_STATUSLINE"] ?? "").trim().toLowerCase();
-  if (off2 === "0" || off2 === "off" || off2 === "false" || off2 === "no") return "disabled";
-  const settingsPath = opts.userSettingsPath ?? userClaudeSettingsPath();
-  let settings = {};
-  if (existsSync38(settingsPath)) {
-    try {
-      const parsed = JSON.parse(readFileSync42(settingsPath, "utf8"));
-      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "unreadable";
-      settings = parsed;
-    } catch {
-      return "unreadable";
-    }
-  }
-  const relay = join49(opts.relayDir, STATUSLINE_RELAY_FILE);
-  const keep = (value) => value !== void 0 && (!isErrataStatusLine(value) || !isSameInstall(value, relay));
-  const ownMain = keep(settings["statusLine"]);
-  const ownRows = keep(settings["subagentStatusLine"]);
-  if (ownMain && ownRows) return "kept-own";
-  mkdirSync11(opts.relayDir, { recursive: true });
-  if (!existsSync38(relay) || readFileSync42(relay, "utf8") !== STATUSLINE_RELAY_SOURCE) {
-    writeFileSync31(relay, STATUSLINE_RELAY_SOURCE, "utf8");
-  }
-  const nodePath = opts.nodePath ?? process.execPath;
-  const next = {
-    ...ownMain ? {} : { statusLine: buildStatusLine(opts.port, nodePath, relay) },
-    ...ownRows ? {} : { subagentStatusLine: buildSubagentStatusLine(opts.port, nodePath, relay) }
-  };
-  if (Object.entries(next).every(([k, v]) => JSON.stringify(settings[k]) === JSON.stringify(v))) {
-    return ownMain ? "kept-own" : "unchanged";
-  }
-  Object.assign(settings, next);
-  mkdirSync11(dirname17(settingsPath), { recursive: true });
-  writeFileSync31(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
-  return "installed";
-}
-function describeStatusLineOutcome(outcome) {
-  switch (outcome) {
-    case "installed":
-      return "status line: errata recall card in colour (user settings; ERRATA_STATUSLINE=off opts out)";
-    case "unchanged":
-      return "status line: errata recall card already set up";
-    case "kept-own":
-      return "status line: kept your own \u2014 errata's recall card shows inline only";
-    case "disabled":
-      return "status line: skipped (ERRATA_STATUSLINE=off)";
-    case "unreadable":
-      return "status line: skipped \u2014 ~/.claude/settings.json is not valid JSON";
-  }
-}
-
 // src/claude-mods.ts
 import { createHash as createHash21 } from "node:crypto";
-import { cpSync as cpSync3, existsSync as existsSync39, mkdirSync as mkdirSync12, readFileSync as readFileSync43, readdirSync as readdirSync15, rmSync as rmSync4, statSync as statSync12, writeFileSync as writeFileSync32 } from "node:fs";
-import { delimiter as delimiter2, dirname as dirname18, join as join50, relative as relative8, resolve as resolve9, sep as sep5 } from "node:path";
+import { cpSync as cpSync3, existsSync as existsSync39, mkdirSync as mkdirSync12, readFileSync as readFileSync44, readdirSync as readdirSync15, rmSync as rmSync4, statSync as statSync14, writeFileSync as writeFileSync32 } from "node:fs";
+import { delimiter as delimiter2, dirname as dirname18, join as join52, relative as relative8, resolve as resolve9, sep as sep5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var CLAUDE_PLUGIN_DIRS_ENV = "CLAUDE_CODE_PLUGIN_DIRS";
 var HASH_FILE = ".errata-mod-hash";
@@ -97707,9 +97880,9 @@ function isEngineOwned(relPath) {
 function listFiles(root, dir = root) {
   const out2 = [];
   for (const name2 of readdirSync15(dir)) {
-    const abs = join50(dir, name2);
+    const abs = join52(dir, name2);
     if (isEngineOwned(relative8(root, abs))) continue;
-    if (statSync12(abs).isDirectory()) out2.push(...listFiles(root, abs));
+    if (statSync14(abs).isDirectory()) out2.push(...listFiles(root, abs));
     else out2.push(abs);
   }
   return out2;
@@ -97719,14 +97892,14 @@ function modHash(dir) {
   for (const abs of listFiles(dir).sort()) {
     h.update(relative8(dir, abs).split(sep5).join("/"));
     h.update("\0");
-    h.update(readFileSync43(abs));
+    h.update(readFileSync44(abs));
     h.update("\0");
   }
   return h.digest("hex");
 }
 function bundledMods(bundleDir) {
   if (!existsSync39(bundleDir)) return [];
-  return readdirSync15(bundleDir).filter((name2) => existsSync39(join50(bundleDir, name2, ".claude-plugin", "plugin.json")));
+  return readdirSync15(bundleDir).filter((name2) => existsSync39(join52(bundleDir, name2, ".claude-plugin", "plugin.json")));
 }
 function sameDir(a, b) {
   const norm = (p) => resolve9(p).replace(/[\\/]+$/, "").toLowerCase();
@@ -97743,7 +97916,7 @@ function off(env2) {
 function readSettings(path3) {
   if (!existsSync39(path3)) return {};
   try {
-    const parsed = JSON.parse(readFileSync43(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync44(path3, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
@@ -97773,7 +97946,7 @@ function writeSettings(path3, settings) {
 function ensureClaudeMods(opts) {
   const env2 = opts.env ?? process.env;
   const settingsPath = opts.userSettingsPath ?? userClaudeSettingsPath();
-  const modsRoot = join50(opts.installRoot, "claude-mods");
+  const modsRoot = join52(opts.installRoot, "claude-mods");
   if (off(env2)) {
     const settings2 = readSettings(settingsPath);
     if (!settings2) return { kind: "unreadable" };
@@ -97790,11 +97963,11 @@ function ensureClaudeMods(opts) {
   let changed = false;
   const installed = [];
   for (const name2 of names) {
-    const src = join50(bundleDir, name2);
-    const dest = join50(modsRoot, name2);
+    const src = join52(bundleDir, name2);
+    const dest = join52(modsRoot, name2);
     const hash2 = modHash(src);
-    const hashFile = join50(dest, HASH_FILE);
-    if (!existsSync39(hashFile) || readFileSync43(hashFile, "utf8") !== hash2) {
+    const hashFile = join52(dest, HASH_FILE);
+    if (!existsSync39(hashFile) || readFileSync44(hashFile, "utf8") !== hash2) {
       rmSync4(dest, { recursive: true, force: true });
       cpSync3(src, dest, { recursive: true, filter: (p) => !isEngineOwned(relative8(src, p)) });
       writeFileSync32(hashFile, hash2, "utf8");
@@ -98218,9 +98391,9 @@ function resolveHookPort(explicit) {
       }
     }
   }
-  const settingsPath = join51(ROOT, ".claude", "settings.json");
+  const settingsPath = join53(ROOT, ".claude", "settings.json");
   try {
-    if (existsSync40(settingsPath)) return installedHookPort(readFileSync44(settingsPath, "utf8")) ?? 7891;
+    if (existsSync40(settingsPath)) return installedHookPort(readFileSync45(settingsPath, "utf8")) ?? 7891;
   } catch {
   }
   return 7891;
@@ -98246,13 +98419,13 @@ async function cmdInit() {
     console.log("");
     console.log("installing harness hooks...");
     const { existsSync: existsSync41 } = await import("node:fs");
-    const { join: join52 } = await import("node:path");
+    const { join: join54 } = await import("node:path");
     try {
       await installClaudeHooks(port);
     } catch (err2) {
       console.warn(`  \u26A0\uFE0F  Claude hook install failed: ${err2 instanceof Error ? err2.message : err2}`);
     }
-    if (existsSync41(join52(ROOT, ".cursor"))) {
+    if (existsSync41(join54(ROOT, ".cursor"))) {
       try {
         await installCursorMcpConfig();
       } catch (err2) {
@@ -98754,6 +98927,7 @@ async function cmdDoctor(args2) {
       const lock = readDaemonLock(lockPath);
       return daemonDoctorCheck({ lock, state: daemonLockState(lock, true), selfVersion: DAEMON_VERSION, lockPath });
     },
+    credentialHygiene: () => credentialHygieneCheck(scanHarnessConfigs(harnessConfigPaths(ROOT))),
     inspect: () => inspectCloudEndpoint(cfg.cloudUrl),
     authenticate: async () => {
       const me = await authedCloudClient(cfg).me();
@@ -99474,7 +99648,7 @@ async function cmdReview() {
     console.log("(review queue empty)");
     return;
   }
-  const queue = JSON.parse(readFileSync44(paths.reviewQueue, "utf8"));
+  const queue = JSON.parse(readFileSync45(paths.reviewQueue, "utf8"));
   if (queue.length === 0) {
     console.log("(review queue empty)");
     return;
@@ -100226,8 +100400,8 @@ async function cmdReport(args2) {
   const outDir = workspacePaths(ROOT).configDir;
   mkdirSync13(outDir, { recursive: true });
   const files = renderReport2(data, { includeFutureVerbs });
-  for (const f of files) writeFileSync33(join51(outDir, f.name), f.html, "utf8");
-  const indexPath = join51(outDir, "report.html");
+  for (const f of files) writeFileSync33(join53(outDir, f.name), f.html, "utf8");
+  const indexPath = join53(outDir, "report.html");
   console.log(`report \u2192 ${indexPath}`);
   console.log(
     `  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`
@@ -100283,7 +100457,7 @@ function spawnDaemonDetached(options = {}) {
   try {
     const logPath = daemonLogPath();
     try {
-      if (statSync13(logPath).size > 5 * 1024 * 1024) renameSync9(logPath, `${logPath}.1`);
+      if (statSync15(logPath).size > 5 * 1024 * 1024) renameSync9(logPath, `${logPath}.1`);
     } catch {
     }
     out2 = openSync3(logPath, "a");
@@ -100352,24 +100526,24 @@ async function cmdInstallHooks(args2) {
   }
 }
 async function installOpencodePlugin(port) {
-  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync45, writeFileSync: writeFileSync33 } = await import("node:fs");
-  const { join: join52 } = await import("node:path");
-  const dir = join52(ROOT, ".opencode", "plugin");
+  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync46, writeFileSync: writeFileSync33 } = await import("node:fs");
+  const { join: join54 } = await import("node:path");
+  const dir = join54(ROOT, ".opencode", "plugin");
   if (!existsSync41(dir)) mkdirSync13(dir, { recursive: true });
-  const file2 = join52(dir, "inerrata.js");
+  const file2 = join54(dir, "inerrata.js");
   if (existsSync41(file2)) {
-    const head2 = readFileSync45(file2, "utf8").split("\n")[0] ?? "";
+    const head2 = readFileSync46(file2, "utf8").split("\n")[0] ?? "";
     if (head2.trim() !== OPENCODE_PLUGIN_MARKER) {
       console.error(`refusing to overwrite ${file2}: not an errata-managed plugin (line 1 lacks the marker)`);
       process.exit(2);
     }
   }
   writeFileSync33(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
-  const cfgFile = join52(ROOT, "opencode.json");
+  const cfgFile = join54(ROOT, "opencode.json");
   let cfg = { $schema: "https://opencode.ai/config.json" };
   if (existsSync41(cfgFile)) {
     try {
-      cfg = JSON.parse(readFileSync45(cfgFile, "utf8"));
+      cfg = JSON.parse(readFileSync46(cfgFile, "utf8"));
     } catch {
       console.error(`refusing to touch invalid JSON at ${cfgFile} \u2014 fix it and re-run`);
       process.exit(2);
@@ -100415,15 +100589,15 @@ function installClaudeMods() {
   }
 }
 async function installClaudeHooks(port) {
-  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync45, writeFileSync: writeFileSync33 } = await import("node:fs");
-  const { join: join52 } = await import("node:path");
-  const dir = join52(ROOT, ".claude");
+  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync46, writeFileSync: writeFileSync33 } = await import("node:fs");
+  const { join: join54 } = await import("node:path");
+  const dir = join54(ROOT, ".claude");
   if (!existsSync41(dir)) mkdirSync13(dir, { recursive: true });
-  const file2 = join52(dir, "settings.json");
+  const file2 = join54(dir, "settings.json");
   let settings = {};
   if (existsSync41(file2)) {
     try {
-      settings = JSON.parse(readFileSync45(file2, "utf8"));
+      settings = JSON.parse(readFileSync46(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -100477,7 +100651,7 @@ async function installClaudeHooks(port) {
   console.log(`  ${ensureStatusLine(port)}`);
   console.log(`  ${installClaudeMods().line}`);
   await installClaudeMcpConfig();
-  const claudeMd = join52(ROOT, "CLAUDE.md");
+  const claudeMd = join54(ROOT, "CLAUDE.md");
   const recall = writeManagedBlock(claudeMd, { body: RECALL_FIRST_BLOCK });
   if (recall.kind === "collision") {
     console.warn(
@@ -100489,15 +100663,15 @@ async function installClaudeHooks(port) {
   console.log(`  endpoint: http://127.0.0.1:${port}/api/hook`);
 }
 async function installClaudeMcpConfig() {
-  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync45, writeFileSync: writeFileSync33 } = await import("node:fs");
-  const { join: join52, dirname: dirname19 } = await import("node:path");
-  const file2 = join52(ROOT, ".mcp.json");
+  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync46, writeFileSync: writeFileSync33 } = await import("node:fs");
+  const { join: join54, dirname: dirname19 } = await import("node:path");
+  const file2 = join54(ROOT, ".mcp.json");
   const dir = dirname19(file2);
   if (!existsSync41(dir)) mkdirSync13(dir, { recursive: true });
   let cfg = {};
   if (existsSync41(file2)) {
     try {
-      cfg = JSON.parse(readFileSync45(file2, "utf8"));
+      cfg = JSON.parse(readFileSync46(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -100511,15 +100685,15 @@ async function installClaudeMcpConfig() {
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses / show / similar`);
 }
 async function installCursorMcpConfig() {
-  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync45, writeFileSync: writeFileSync33 } = await import("node:fs");
-  const { join: join52 } = await import("node:path");
-  const dir = join52(ROOT, ".cursor");
+  const { mkdirSync: mkdirSync13, existsSync: existsSync41, readFileSync: readFileSync46, writeFileSync: writeFileSync33 } = await import("node:fs");
+  const { join: join54 } = await import("node:path");
+  const dir = join54(ROOT, ".cursor");
   if (!existsSync41(dir)) mkdirSync13(dir, { recursive: true });
-  const file2 = join52(dir, "mcp.json");
+  const file2 = join54(dir, "mcp.json");
   let cfg = {};
   if (existsSync41(file2)) {
     try {
-      cfg = JSON.parse(readFileSync45(file2, "utf8"));
+      cfg = JSON.parse(readFileSync46(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -100538,7 +100712,7 @@ async function installCodexHooks(port) {
   const gitRoot = nearestGitRoot(process.cwd());
   const hookRoot = gitRoot && mainCheckoutOfWorktree(gitRoot) ? gitRoot : ROOT;
   const file2 = writeCodexHooks(hookRoot, port);
-  const instructions = writeManagedBlock(join51(hookRoot, "AGENTS.md"), {
+  const instructions = writeManagedBlock(join53(hookRoot, "AGENTS.md"), {
     body: AGENTS_POINTER_BODY,
     stable: true
   });
@@ -100984,9 +101158,9 @@ async function cmdDash(args2) {
       await yieldToLoop2();
       try {
         const items = selectDurableMemory(handle2.sharedStore, r.engine.profile, {
-          atCommit: readGitRefState(join51(r.root, ".git")).sha ?? void 0
+          atCommit: readGitRefState(join53(r.root, ".git")).sha ?? void 0
         });
-        const res = bleedRules(join51(r.root, ".claude", "rules"), items);
+        const res = bleedRules(join53(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(
             `[rules:${r.entry.name}] ${res.written} collective principle(s) \u2192 .claude/rules` + (res.pruned ? `, ${res.pruned} pruned` : "")