@inerrata-corporation/errata 2.0.6-dev.2506 → 2.0.6-dev.2533

package/README.txt

@@ -25,6 +25,28 @@ USE
 
 Dashboard: http://127.0.0.1:7891
 
+CODEX
+
+    errata install-hooks codex       # explicit install or upgrade for this workspace
+
+Init detects .codex in the project or CODEX_HOME (default ~/.codex). Successful
+errata link flows also refresh detected Codex hooks; --skip-hooks opts out of
+either automatic install. The installer preserves other config and writes its
+Node relay into .codex/hooks/errata-relay.mjs. No curl or Bash dependency.
+
+Restart/resume Codex after installing, and review/trust the hooks with /hooks.
+If your Codex build gates hooks, enable [features] codex_hooks = true. Update
+older Codex builds if UserPromptSubmit or tool hooks are unsupported.
+
+SessionStart injects .errata/context.md, including startup/resume/compaction.
+UserPromptSubmit and PostToolUse inject it again only when it changes. Tool
+recall and capture remain enabled. Refresh happens at a tool boundary, not
+during model generation. The daemon must be running; unavailable hooks fail
+open. AGENTS.md's file-read instruction remains a useful fallback.
+
+The cloud MCP/plugin installer alone does not install this local daemon.
+Install errata and run init in each workspace to enable daemon context.
+
 UPDATE
 
     errata update                    # pull the newest build on your channel (npm i -g)

package/consolidate-worker.mjs

@@ -15322,6 +15322,9 @@ var init_symbol_intent = __esm({
 });
 
 // ../../packages/shared/src/wire.ts
+function isAnchorLabelKind(kind) {
+  return typeof kind === "string" && ANCHOR_LABEL_KINDS.includes(kind);
+}
 function anchorVersionAttrs(attrs) {
   if (!attrs) return {};
   const commit = attrs["observedAtCommit"];
@@ -15331,7 +15334,24 @@ function anchorVersionAttrs(attrs) {
     ...typeof hash2 === "string" && ANCHOR_BODY_HASH_RE.test(hash2) ? { symbolContentHash: hash2 } : {}
   };
 }
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+function anchorLabelAttrs(attrs) {
+  if (!attrs) return {};
+  const relPath = attrs["labelRelPath"];
+  const qname = attrs["labelQname"];
+  const kind = attrs["labelKind"];
+  const line = attrs["labelLine"];
+  if (typeof relPath !== "string" || !ANCHOR_LABEL_PATH_RE.test(relPath)) return {};
+  if (!isAnchorLabelKind(kind)) return {};
+  const qnameOk = typeof qname === "string" && ANCHOR_LABEL_QNAME_RE.test(qname);
+  if (kind !== "File" && !qnameOk) return {};
+  return {
+    labelRelPath: relPath,
+    labelKind: kind,
+    ...kind !== "File" && qnameOk ? { labelQname: qname } : {},
+    ...typeof line === "number" && Number.isInteger(line) && line >= 1 && line <= 1e7 ? { labelLine: line } : {}
+  };
+}
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, ANCHOR_SYMBOL_KINDS, ANCHOR_LABEL_KINDS, FILE_ANCHOR_QNAME, ANCHOR_LABEL_PATH_RE, ANCHOR_LABEL_QNAME_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15434,6 +15454,22 @@ var init_wire = __esm({
     });
     ANCHOR_COMMIT_SHA_RE = /^[0-9a-f]{7,40}$/;
     ANCHOR_BODY_HASH_RE = /^[0-9a-f]{8,64}$/;
+    ANCHOR_SYMBOL_KINDS = [
+      "Function",
+      "Class",
+      "Method",
+      "Module",
+      "Interface",
+      "Const",
+      "Enum",
+      "TypeAlias",
+      "Namespace",
+      "Property"
+    ];
+    ANCHOR_LABEL_KINDS = [...ANCHOR_SYMBOL_KINDS, "File"];
+    FILE_ANCHOR_QNAME = "";
+    ANCHOR_LABEL_PATH_RE = /^(?![/])(?![A-Za-z]:)(?!(?:.*\/)?\.\.(?:\/|$))[^\x00-\x1f\x7f\\`]{1,512}$/;
+    ANCHOR_LABEL_QNAME_RE = /^[^\x00-\x1f\x7f`]{1,256}$/;
     CastaliaIngestEdgeSchema = external_exports.object({
       fromCanonicalId: external_exports.string().min(6).max(160),
       toCanonicalId: external_exports.string().min(6).max(160),
@@ -15453,7 +15489,17 @@ var init_wire = __esm({
          *  classify the anchor current / pre-change; absent ⇒ the pre-versioning
          *  contract, unverified. Only meaningful on `ANCHORED_AT`. */
         observedAtCommit: external_exports.string().regex(ANCHOR_COMMIT_SHA_RE).optional(),
-        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional()
+        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional(),
+        /** PJ-anchor-labels: the READABLE identity of the anchor's target —
+         *  repo-relative path, qualified name (absent for a File), kind and line.
+         *  Sent only for a project whose owner opted in; the door strips them again
+         *  for any project that has not (the daemon's flag is not trusted alone).
+         *  Prefixed `label*` so no local edge attr (`anchorLine` lives there
+         *  natively) can ride out under a shared key. */
+        labelRelPath: external_exports.string().regex(ANCHOR_LABEL_PATH_RE).optional(),
+        labelQname: external_exports.string().regex(ANCHOR_LABEL_QNAME_RE).optional(),
+        labelKind: external_exports.enum(ANCHOR_LABEL_KINDS).optional(),
+        labelLine: external_exports.number().int().min(1).max(1e7).optional()
       }).optional()
     });
     SymbolSummarySidecarSchema = external_exports.record(
@@ -19153,19 +19199,39 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       for (const e of store.outEdges(sourceId, ["ANCHORED_AT"])) {
         const target = store.getNode(e.to);
         if (!target) continue;
+        if (!isAnchorLabelKind(target.label)) continue;
+        const isFile = target.label === "File";
+        if (isFile && !project.anchorLabels) continue;
         const relPath = target.attrs["relPath"];
-        const qname = target.attrs["qname"];
+        const qname = isFile ? FILE_ANCHOR_QNAME : target.attrs["qname"];
         if (typeof relPath !== "string" || typeof qname !== "string") continue;
-        if (ignored(relPath) || ignored(qname)) continue;
-        planned.push({ e, target, symId: projectSymbolId(project.salt, project.projectId, relPath, qname, target.label) });
+        if (ignored(relPath) || qname !== "" && ignored(qname)) continue;
+        const line = e.attrs?.["anchorLine"];
+        const wireAttrs = {
+          ...anchorVersionAttrs(e.attrs),
+          // PJ-anchor-labels: only for an opted-in project, and only through the
+          // shared projection (invalid path/kind ⇒ no label, never half of one).
+          ...project.anchorLabels ? anchorLabelAttrs({
+            labelRelPath: normalizeSymbolPath(relPath),
+            labelKind: target.label,
+            ...isFile ? {} : { labelQname: qname },
+            ...typeof line === "number" ? { labelLine: line } : {}
+          }) : {}
+        };
+        planned.push({
+          e,
+          target,
+          symId: projectSymbolId(project.salt, project.projectId, relPath, qname, target.label),
+          wireAttrs
+        });
       }
       if (planned.length === 0) continue;
       const dg = digest(
-        planned.map(({ e, symId }) => `ANCHORED_AT>${symId}>${JSON.stringify(anchorVersionAttrs(e.attrs))}`).sort()
+        planned.map(({ symId, wireAttrs }) => `ANCHORED_AT>${symId}>${JSON.stringify(wireAttrs)}`).sort()
       );
       if (source.attrs["projectAnchorsContributedDigest"] === dg) continue;
       projectAnchorDigests[sourceId] = dg;
-      for (const { e, target, symId } of planned) {
+      for (const { e, target, symId, wireAttrs } of planned) {
         if (!contextSeen.has(symId)) {
           contextSeen.add(symId);
           contextNodes.push({
@@ -19192,7 +19258,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
             stability: "unstable"
           });
         }
-        anchorEdges.push({ ...e, from: wireFrom, to: symId, attrs: anchorVersionAttrs(e.attrs) });
+        anchorEdges.push({ ...e, from: wireFrom, to: symId, attrs: wireAttrs });
       }
     }
   }

package/errata.mjs

@@ -15729,6 +15729,9 @@ function provenanceBand(source) {
 function isSeedProvenance(source) {
   return provenanceBand(source) === "seed";
 }
+function isAnchorLabelKind(kind) {
+  return typeof kind === "string" && ANCHOR_LABEL_KINDS.includes(kind);
+}
 function anchorVersionAttrs(attrs) {
   if (!attrs) return {};
   const commit = attrs["observedAtCommit"];
@@ -15738,6 +15741,28 @@ function anchorVersionAttrs(attrs) {
     ...typeof hash2 === "string" && ANCHOR_BODY_HASH_RE.test(hash2) ? { symbolContentHash: hash2 } : {}
   };
 }
+function anchorLabelAttrs(attrs) {
+  if (!attrs) return {};
+  const relPath = attrs["labelRelPath"];
+  const qname = attrs["labelQname"];
+  const kind = attrs["labelKind"];
+  const line = attrs["labelLine"];
+  if (typeof relPath !== "string" || !ANCHOR_LABEL_PATH_RE.test(relPath)) return {};
+  if (!isAnchorLabelKind(kind)) return {};
+  const qnameOk = typeof qname === "string" && ANCHOR_LABEL_QNAME_RE.test(qname);
+  if (kind !== "File" && !qnameOk) return {};
+  return {
+    labelRelPath: relPath,
+    labelKind: kind,
+    ...kind !== "File" && qnameOk ? { labelQname: qname } : {},
+    ...typeof line === "number" && Number.isInteger(line) && line >= 1 && line <= 1e7 ? { labelLine: line } : {}
+  };
+}
+function stripAnchorLabels(attrs) {
+  const out2 = { ...attrs };
+  for (const k of ANCHOR_LABEL_KEYS) delete out2[k];
+  return out2;
+}
 function validateCastaliaPayload(p) {
   const errors = [];
   const labelByCid = /* @__PURE__ */ new Map();
@@ -15767,7 +15792,7 @@ function summarizeIngestResult(r) {
     ...r.patternReconciliation ? { patternReconciliation: r.patternReconciliation } : {}
   };
 }
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, QUARANTINE_EXTRACTION_SOURCE_PREFIX, MAX_NODES_PER_PAYLOAD, MAX_EDGES_PER_PAYLOAD, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, QUARANTINE_EXTRACTION_SOURCE_PREFIX, MAX_NODES_PER_PAYLOAD, MAX_EDGES_PER_PAYLOAD, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, ANCHOR_SYMBOL_KINDS, ANCHOR_LABEL_KINDS, FILE_ANCHOR_QNAME, ANCHOR_LABEL_PATH_RE, ANCHOR_LABEL_QNAME_RE, ANCHOR_LABEL_KEYS, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15873,6 +15898,23 @@ var init_wire = __esm({
     });
     ANCHOR_COMMIT_SHA_RE = /^[0-9a-f]{7,40}$/;
     ANCHOR_BODY_HASH_RE = /^[0-9a-f]{8,64}$/;
+    ANCHOR_SYMBOL_KINDS = [
+      "Function",
+      "Class",
+      "Method",
+      "Module",
+      "Interface",
+      "Const",
+      "Enum",
+      "TypeAlias",
+      "Namespace",
+      "Property"
+    ];
+    ANCHOR_LABEL_KINDS = [...ANCHOR_SYMBOL_KINDS, "File"];
+    FILE_ANCHOR_QNAME = "";
+    ANCHOR_LABEL_PATH_RE = /^(?![/])(?![A-Za-z]:)(?!(?:.*\/)?\.\.(?:\/|$))[^\x00-\x1f\x7f\\`]{1,512}$/;
+    ANCHOR_LABEL_QNAME_RE = /^[^\x00-\x1f\x7f`]{1,256}$/;
+    ANCHOR_LABEL_KEYS = ["labelRelPath", "labelQname", "labelKind", "labelLine"];
     CastaliaIngestEdgeSchema = external_exports.object({
       fromCanonicalId: external_exports.string().min(6).max(160),
       toCanonicalId: external_exports.string().min(6).max(160),
@@ -15892,7 +15934,17 @@ var init_wire = __esm({
          *  classify the anchor current / pre-change; absent ⇒ the pre-versioning
          *  contract, unverified. Only meaningful on `ANCHORED_AT`. */
         observedAtCommit: external_exports.string().regex(ANCHOR_COMMIT_SHA_RE).optional(),
-        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional()
+        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional(),
+        /** PJ-anchor-labels: the READABLE identity of the anchor's target —
+         *  repo-relative path, qualified name (absent for a File), kind and line.
+         *  Sent only for a project whose owner opted in; the door strips them again
+         *  for any project that has not (the daemon's flag is not trusted alone).
+         *  Prefixed `label*` so no local edge attr (`anchorLine` lives there
+         *  natively) can ride out under a shared key. */
+        labelRelPath: external_exports.string().regex(ANCHOR_LABEL_PATH_RE).optional(),
+        labelQname: external_exports.string().regex(ANCHOR_LABEL_QNAME_RE).optional(),
+        labelKind: external_exports.enum(ANCHOR_LABEL_KINDS).optional(),
+        labelLine: external_exports.number().int().min(1).max(1e7).optional()
       }).optional()
     });
     SymbolSummarySidecarSchema = external_exports.record(
@@ -16716,7 +16768,12 @@ __export(src_exports, {
   AMBIGUOUS_ALIASES: () => AMBIGUOUS_ALIASES,
   ANCHOR_BODY_HASH_RE: () => ANCHOR_BODY_HASH_RE,
   ANCHOR_COMMIT_SHA_RE: () => ANCHOR_COMMIT_SHA_RE,
+  ANCHOR_LABEL_KEYS: () => ANCHOR_LABEL_KEYS,
+  ANCHOR_LABEL_KINDS: () => ANCHOR_LABEL_KINDS,
+  ANCHOR_LABEL_PATH_RE: () => ANCHOR_LABEL_PATH_RE,
+  ANCHOR_LABEL_QNAME_RE: () => ANCHOR_LABEL_QNAME_RE,
   ANCHOR_REFUSAL_REASONS: () => ANCHOR_REFUSAL_REASONS,
+  ANCHOR_SYMBOL_KINDS: () => ANCHOR_SYMBOL_KINDS,
   BELIEF_EDGES: () => BELIEF_EDGES,
   BRIDGE_EDGES: () => BRIDGE_EDGES,
   CAUSAL_EDGES: () => CAUSAL_EDGES,
@@ -16739,6 +16796,7 @@ __export(src_exports, {
   EDGE_RULES: () => EDGE_RULES,
   EDGE_WEIGHT: () => EDGE_WEIGHT,
   EVIDENCE_EDGES: () => EVIDENCE_EDGES,
+  FILE_ANCHOR_QNAME: () => FILE_ANCHOR_QNAME,
   GIT_EDGES: () => GIT_EDGES,
   GRAPH_EVENT_VOCABULARIES: () => GRAPH_EVENT_VOCABULARIES,
   IDENTITY_EDGES: () => IDENTITY_EDGES,
@@ -16775,6 +16833,7 @@ __export(src_exports, {
   VALIDATION_SOURCES: () => VALIDATION_SOURCES,
   aliasesLongestFirst: () => aliasesLongestFirst,
   allEntities: () => allEntities,
+  anchorLabelAttrs: () => anchorLabelAttrs,
   anchorVersionAttrs: () => anchorVersionAttrs,
   assertGraphEventVocabulary: () => assertGraphEventVocabulary,
   buildSpine: () => buildSpine,
@@ -16796,6 +16855,7 @@ __export(src_exports, {
   extractIdentifierTokens: () => extractIdentifierTokens,
   genericCanonicalId: () => genericCanonicalId,
   identityId: () => identityId,
+  isAnchorLabelKind: () => isAnchorLabelKind,
   isCausalProtected: () => isCausalProtected,
   isCloudWritableNodeLabel: () => isCloudWritableNodeLabel,
   isCodeLabel: () => isCodeLabel,
@@ -16844,6 +16904,7 @@ __export(src_exports, {
   sidecarDropBucket: () => sidecarDropBucket,
   spineDeps: () => spineDeps,
   splitPnpmKey: () => splitPnpmKey,
+  stripAnchorLabels: () => stripAnchorLabels,
   substituteSymbolSummaries: () => substituteSymbolSummaries,
   summarizeIngestResult: () => summarizeIngestResult,
   summaryRejectionReason: () => summaryRejectionReason,
@@ -24956,7 +25017,10 @@ function toWirePayload(batch, runId) {
         ...typeof e.confidence === "number" ? { confidence: clamp012(e.confidence) } : {},
         ...perContext ? { perContext } : {},
         // PJ-anchor-version: the two opaque version stamps ride on anchors only.
-        ...e.type === "ANCHORED_AT" ? anchorVersionAttrs(e.attrs) : {}
+        ...e.type === "ANCHORED_AT" ? anchorVersionAttrs(e.attrs) : {},
+        // PJ-anchor-labels: readable labels ride only when the producer set the
+        // `label*` keys, which the daemon does only for an opted-in project.
+        ...e.type === "ANCHORED_AT" ? anchorLabelAttrs(e.attrs) : {}
       }
     };
   });
@@ -51034,15 +51098,14 @@ function recallForTool(store, command, ctx) {
 ${lines.join("\n")}`;
 }
 function decideContextInject(args2) {
-  const { event, source, sessionId, block, lastInjectedHash } = args2;
+  const { event, sessionId, block, lastInjectedHash } = args2;
   if (!block) return null;
   if (event === "SessionStart") {
-    lastInjectedHash.set(sessionId, block.hash);
-    if (source === "startup") return null;
-  } else if (lastInjectedHash.get(sessionId) === block.hash) {
+    if (sessionId) lastInjectedHash.set(sessionId, block.hash);
+  } else if (sessionId && lastInjectedHash.get(sessionId) === block.hash) {
     return null;
   } else {
-    lastInjectedHash.set(sessionId, block.hash);
+    if (sessionId) lastInjectedHash.set(sessionId, block.hash);
   }
   const additionalContext = "The errata daemon has updated your live workspace context. The block below REPLACES any earlier errata context block in this conversation \u2014 treat it as the current source of truth:\n\n" + block.body;
   return { hookEventName: event, additionalContext };
@@ -70832,8 +70895,8 @@ var init_report_render = __esm({
 
 // src/cli.ts
 init_src6();
-import { closeSync as closeSync2, existsSync as existsSync33, openSync as openSync2, readFileSync as readFileSync32, renameSync as renameSync4, statSync as statSync8 } from "node:fs";
-import { join as join37, resolve as pathResolve2 } from "node:path";
+import { closeSync as closeSync2, existsSync as existsSync34, openSync as openSync2, readFileSync as readFileSync33, renameSync as renameSync4, statSync as statSync8 } from "node:fs";
+import { join as join38, resolve as pathResolve2 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/daemon.ts
@@ -78143,7 +78206,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.6-dev.2506" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.6-dev.2533" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -81172,19 +81235,39 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       for (const e of store.outEdges(sourceId, ["ANCHORED_AT"])) {
         const target = store.getNode(e.to);
         if (!target) continue;
+        if (!isAnchorLabelKind(target.label)) continue;
+        const isFile = target.label === "File";
+        if (isFile && !project.anchorLabels) continue;
         const relPath = target.attrs["relPath"];
-        const qname = target.attrs["qname"];
+        const qname = isFile ? FILE_ANCHOR_QNAME : target.attrs["qname"];
         if (typeof relPath !== "string" || typeof qname !== "string") continue;
-        if (ignored(relPath) || ignored(qname)) continue;
-        planned.push({ e, target, symId: projectSymbolId(project.salt, project.projectId, relPath, qname, target.label) });
+        if (ignored(relPath) || qname !== "" && ignored(qname)) continue;
+        const line = e.attrs?.["anchorLine"];
+        const wireAttrs = {
+          ...anchorVersionAttrs(e.attrs),
+          // PJ-anchor-labels: only for an opted-in project, and only through the
+          // shared projection (invalid path/kind ⇒ no label, never half of one).
+          ...project.anchorLabels ? anchorLabelAttrs({
+            labelRelPath: normalizeSymbolPath(relPath),
+            labelKind: target.label,
+            ...isFile ? {} : { labelQname: qname },
+            ...typeof line === "number" ? { labelLine: line } : {}
+          }) : {}
+        };
+        planned.push({
+          e,
+          target,
+          symId: projectSymbolId(project.salt, project.projectId, relPath, qname, target.label),
+          wireAttrs
+        });
       }
       if (planned.length === 0) continue;
       const dg = digest(
-        planned.map(({ e, symId }) => `ANCHORED_AT>${symId}>${JSON.stringify(anchorVersionAttrs(e.attrs))}`).sort()
+        planned.map(({ symId, wireAttrs }) => `ANCHORED_AT>${symId}>${JSON.stringify(wireAttrs)}`).sort()
       );
       if (source.attrs["projectAnchorsContributedDigest"] === dg) continue;
       projectAnchorDigests[sourceId] = dg;
-      for (const { e, target, symId } of planned) {
+      for (const { e, target, symId, wireAttrs } of planned) {
         if (!contextSeen.has(symId)) {
           contextSeen.add(symId);
           contextNodes.push({
@@ -81211,7 +81294,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
             stability: "unstable"
           });
         }
-        anchorEdges.push({ ...e, from: wireFrom, to: symId, attrs: anchorVersionAttrs(e.attrs) });
+        anchorEdges.push({ ...e, from: wireFrom, to: symId, attrs: wireAttrs });
       }
     }
   }
@@ -81522,13 +81605,13 @@ function isInstalledEntry(entry) {
 }
 function foreignDaemonNote(lock, selfEntry) {
   if (!lock.entry || normEntry(lock.entry) === normEntry(selfEntry)) return null;
-  const what = isInstalledEntry(lock.entry) ? "another install" : "a LOCAL BUILD";
-  return [
-    `launched from ${what}, not this one${lock.version ? ` (it is ${lock.version})` : ""}:`,
+  const runningInstalled = isInstalledEntry(lock.entry);
+  const head2 = [
+    `launched from ${runningInstalled ? "the installed package" : "a LOCAL BUILD"}, not this one${lock.version ? ` (it is ${lock.version})` : ""}:`,
     `  running: ${lock.entry}`,
-    `  this:    ${selfEntry}`,
-    "`errata update` does not replace it. To move onto this install: errata stop, then errata dash."
+    `  this:    ${selfEntry}`
   ];
+  return runningInstalled ? [...head2, "this CLI is a different bundle from the daemon it is talking to \u2014 its view may not match what the daemon runs."] : [...head2, "`errata update` does not replace it. To move onto the installed package: errata stop, then errata dash."];
 }
 function isProcessAlive(pid) {
   if (!pid || pid <= 0) return false;
@@ -81715,7 +81798,7 @@ init_src11();
 init_src();
 init_src11();
 var DEFAULT_LIMIT = 50;
-var ANCHOR_SYMBOL_KINDS = [
+var ANCHOR_SYMBOL_KINDS2 = [
   "Function",
   "Class",
   "Method",
@@ -81736,7 +81819,7 @@ function classifyAnchorVersion(cloudAttrs, localSymbol) {
 function buildReverseSymbolMap(opts) {
   const { store, salt, projectId } = opts;
   const reverse = /* @__PURE__ */ new Map();
-  for (const kind of ANCHOR_SYMBOL_KINDS) {
+  for (const kind of ANCHOR_SYMBOL_KINDS2) {
     for (const n of store.findNodeIdentitiesByLabel(kind)) {
       const { relPath, qname } = n;
       if (relPath === null || qname === null) continue;
@@ -81746,6 +81829,13 @@ function buildReverseSymbolMap(opts) {
       if (!reverse.has(twin)) reverse.set(twin, n.id);
     }
   }
+  for (const n of store.findNodeIdentitiesByLabel("File")) {
+    if (n.relPath === null) continue;
+    const sym = projectSymbolId(salt, projectId, n.relPath, FILE_ANCHOR_QNAME, "File");
+    if (!reverse.has(sym)) reverse.set(sym, n.id);
+    const twin = projectSaltedNodeId(sym, salt);
+    if (!reverse.has(twin)) reverse.set(twin, n.id);
+  }
   return reverse;
 }
 function anchorConfidence(attrs) {
@@ -84482,12 +84572,21 @@ function withLaunchOrigin(pending) {
   return LOCAL_BUILD_ENTRY ? { ...pending, localBuildEntry: LOCAL_BUILD_ENTRY } : pending;
 }
 var projectSymbolSalts = /* @__PURE__ */ new Map();
+var PROJECT_SALT_REFRESH_MS = 10 * 6e4;
 async function resolveProjectSymbolSalt(client, projectId) {
   const cached2 = projectSymbolSalts.get(projectId);
-  if (cached2) return { projectId, salt: cached2 };
-  const { salt } = await client.projectSymbolSalt(projectId);
-  projectSymbolSalts.set(projectId, salt);
-  return { projectId, salt };
+  if (cached2 && Date.now() - cached2.fetchedAt < PROJECT_SALT_REFRESH_MS) {
+    return { projectId, salt: cached2.salt, anchorLabels: cached2.anchorLabels };
+  }
+  try {
+    const res = await client.projectSymbolSalt(projectId);
+    const entry = { salt: res.salt, anchorLabels: res.anchorLabels === true, fetchedAt: Date.now() };
+    projectSymbolSalts.set(projectId, entry);
+    return { projectId, salt: entry.salt, anchorLabels: entry.anchorLabels };
+  } catch (err2) {
+    if (cached2) return { projectId, salt: cached2.salt, anchorLabels: cached2.anchorLabels };
+    throw err2;
+  }
 }
 var WATERMARK_BATCH = 250;
 async function stampBatched(items, stamp) {
@@ -86612,32 +86711,92 @@ function hookRelayCommand(port, path2) {
 }
 var CODEX_HOOKS_BEGIN = `# >>> errata hooks (errata-managed)`;
 var CODEX_HOOKS_END = `# <<< errata hooks`;
-function buildCodexHooksToml(port) {
-  const cmd2 = hookCurlCommand(port).replace(/"/g, '\\"');
-  const turnCmd = hookCurlCommand(port, "/api/turn").replace(/"/g, '\\"');
-  return `${CODEX_HOOKS_BEGIN}
-[[hooks.PreToolUse]]
-matcher = ".*"
-
-[[hooks.PreToolUse.hooks]]
-type = "command"
-command = "${cmd2}"
-timeout = 10
-
-[[hooks.PostToolUse]]
-matcher = ".*"
-
-[[hooks.PostToolUse.hooks]]
-type = "command"
-command = "${cmd2}"
-timeout = 10
-
-[[hooks.PostToolUse.hooks]]
-type = "command"
-command = "${turnCmd}"
-timeout = 10
-${CODEX_HOOKS_END}
+function buildCodexHooksToml(port, options) {
+  const platform = options.platform ?? process.platform;
+  const quote = (value) => {
+    if (platform === "win32") {
+      if (/["%\r\n]/.test(value)) throw new Error("Unsupported character in Codex hook path");
+      return '"' + value + '"';
+    }
+    return "'" + value.replace(/'/g, "'\\''") + "'";
+  };
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid hook port");
+  const command = quote(options.nodePath) + " " + quote(options.relayPath) + " " + port;
+  const handlers = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].map(
+    (event) => "[[hooks." + event + "]]\n" + (event === "UserPromptSubmit" ? "" : 'matcher = ".*"\n') + "\n[[hooks." + event + '.hooks]]\ntype = "command"\ncommand = ' + JSON.stringify(command) + "\ntimeout = 10\nadditionalContextLimit = 5000\n"
+  );
+  return CODEX_HOOKS_BEGIN + "\n" + handlers.join("\n") + CODEX_HOOKS_END + "\n";
+}
+
+// src/codex-hooks.ts
+import { existsSync as existsSync33, mkdirSync as mkdirSync9, readFileSync as readFileSync32, writeFileSync as writeFileSync24 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join37 } from "node:path";
+
+// src/codex-hook-relay.ts
+var CODEX_RELAY_SOURCE = String.raw`// errata-managed: regenerated by errata install-hooks codex
+import { readFileSync } from 'node:fs';
+
+try {
+  const payload = JSON.parse(readFileSync(0, 'utf8') || '{}');
+  const port = Number(process.argv[2]);
+  const event = payload.hook_event_name;
+  if (!Number.isInteger(port) || port < 1 || port > 65535) process.exit(0);
+  const contexts = [];
+  const post = async (endpoint, relay = false) => {
+    try {
+      const response = await fetch('http://127.0.0.1:' + port + '/api/' + endpoint, {
+        method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload), signal: AbortSignal.timeout(2000),
+      });
+      if (!response.ok || !relay) return;
+      const result = await response.json();
+      const context = result.hookSpecificOutput?.additionalContext;
+      if (typeof context === 'string' && context.trim()) contexts.push(context);
+    } catch { /* An unavailable daemon must never block the agent. */ }
+  };
+  if (event === 'PreToolUse' || event === 'PostToolUse') await post('hook', true);
+  if (event === 'PostToolUse') await post('turn');
+  if (['SessionStart', 'UserPromptSubmit', 'PostToolUse'].includes(event)) {
+    // Run after capture, so changes already rendered by the daemon arrive now.
+    // Background extraction finishing later arrives at the next tool boundary.
+    await post('context-inject', true);
+  }
+  if (contexts.length) {
+    process.stdout.write(JSON.stringify({ hookSpecificOutput: {
+      hookEventName: event, additionalContext: contexts.join('\n\n'),
+    } }));
+  }
+} catch { /* Invalid input is also fail-open. */ }
 `;
+
+// src/codex-hooks.ts
+function hasCodexConfig(root, codexHome = process.env["CODEX_HOME"] || join37(homedir7(), ".codex")) {
+  return existsSync33(join37(root, ".codex")) || existsSync33(codexHome);
+}
+function replaceCodexHooks(existing, block) {
+  const begin = existing.indexOf(CODEX_HOOKS_BEGIN);
+  const end = existing.indexOf(CODEX_HOOKS_END);
+  if (begin >= 0 || end >= 0) {
+    if (begin < 0 || end < begin || existing.indexOf(CODEX_HOOKS_BEGIN, begin + CODEX_HOOKS_BEGIN.length) >= 0) {
+      throw new Error(
+        "Incomplete or duplicate errata hooks markers in .codex/config.toml; repair them before reinstalling."
+      );
+    }
+    return existing.slice(0, begin) + block.trimEnd() + existing.slice(end + CODEX_HOOKS_END.length);
+  }
+  return existing.trimEnd() + (existing.trim() ? "\n\n" : "") + block;
+}
+function writeCodexHooks(root, port, nodePath = process.execPath) {
+  const dir = join37(root, ".codex");
+  const file2 = join37(dir, "config.toml");
+  const relay = join37(dir, "hooks", "errata-relay.mjs");
+  const block = buildCodexHooksToml(port, { nodePath, relayPath: relay });
+  const final = replaceCodexHooks(existsSync33(file2) ? readFileSync32(file2, "utf8") : "", block);
+  mkdirSync9(join37(dir, "hooks"), { recursive: true });
+  writeFileSync24(relay, CODEX_RELAY_SOURCE, "utf8");
+  writeFileSync24(file2, final, "utf8");
+  return file2;
 }
 
 // src/opencode-plugin.ts
@@ -86979,6 +87138,7 @@ Commands:
                       Flags: --project <id> adopt an existing project (fork\u2192upstream);
                       --remote <name> derive the locator from a non-origin remote;
                       --name <name> mint a locator-less project; no flags = re-resolve now
+                      --skip-hooks leave existing harness configuration unchanged
   unlink              Detach from the cloud project + disable ambient re-linking
   use [<handle>]      Set the sticky session active agent the daemon acts as.
                       No arg lists the agents you can act as + the current one;
@@ -87044,21 +87204,21 @@ async function cmdInit() {
   if (!skipHooks) {
     console.log("");
     console.log("installing harness hooks...");
-    const { existsSync: existsSync34 } = await import("node:fs");
-    const { join: join38 } = await import("node:path");
+    const { existsSync: existsSync35 } = await import("node:fs");
+    const { join: join39 } = await import("node:path");
     try {
       await installClaudeHooks(port);
     } catch (err2) {
       console.warn(`  \u26A0\uFE0F  Claude hook install failed: ${err2 instanceof Error ? err2.message : err2}`);
     }
-    if (existsSync34(join38(ROOT, ".cursor"))) {
+    if (existsSync35(join39(ROOT, ".cursor"))) {
       try {
         await installCursorMcpConfig();
       } catch (err2) {
         console.warn(`  \u26A0\uFE0F  Cursor MCP config failed: ${err2 instanceof Error ? err2.message : err2}`);
       }
     }
-    if (existsSync34(join38(ROOT, ".codex"))) {
+    if (hasCodexConfig(ROOT)) {
       try {
         await installCodexHooks(port);
       } catch (err2) {
@@ -87235,9 +87395,9 @@ async function cmdStatus() {
     console.log(`    stack:     ${profile.stack.join(", ") || "(none)"}`);
     console.log(`    languages: ${profile.languages.join(", ") || "(none)"}`);
   }
-  console.log(`  graph db:  ${existsSync33(paths.castalia) ? "yes" : "no"} (${paths.castalia})`);
-  console.log(`  event log: ${existsSync33(paths.eventLog) ? "yes" : "no"} (${paths.eventLog})`);
-  if (existsSync33(paths.castalia)) {
+  console.log(`  graph db:  ${existsSync34(paths.castalia) ? "yes" : "no"} (${paths.castalia})`);
+  console.log(`  event log: ${existsSync34(paths.eventLog) ? "yes" : "no"} (${paths.eventLog})`);
+  if (existsSync34(paths.castalia)) {
     try {
       const { openGraphStore: openGraphStore2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
       const store = openGraphStore2({ path: paths.castalia });
@@ -87872,6 +88032,7 @@ async function cmdLink(args2) {
       console.log(
         `consents: sync=${d.consents.sync} telemetry=${d.consents.telemetry ? "on" : "off"} packages=${applied.config.consent.contributePackages ? "on" : "off"} structure=${d.consents.structure ? "on" : "off"} history=${d.consents.mineHistory ? applied.profile.linkConsents?.contributeHistory ? "mine+contribute" : "mine" : "off"}`
       );
+      await refreshLinkedCodexHooks(args2);
       if (applied.wroteIgnore) console.log("wrote .errataignore (starter) \u2014 edit it; it is your hard control");
       if (!hasCloudCredential(cfg)) {
         console.log("  note: run `errata login` so this daemon can sync under the link and report the history stage.");
@@ -87912,6 +88073,7 @@ async function cmdLink(args2) {
     profile.projectId = res.project.id;
     profile.projectLocator = profile.repoLocator;
     saveProfile(ROOT, profile);
+    await refreshLinkedCodexHooks(args2);
     console.log(`linked (adopted): ${profile.repoLocator} \u2192 project ${res.project.id} (${res.project.name})`);
     return;
   }
@@ -87921,6 +88083,7 @@ async function cmdLink(args2) {
     profile.projectId = res.project.id;
     delete profile.projectLocator;
     saveProfile(ROOT, profile);
+    await refreshLinkedCodexHooks(args2);
     console.log(`linked (locator-less): project ${res.project.id} (${res.project.name})`);
     return;
   }
@@ -87929,6 +88092,7 @@ async function cmdLink(args2) {
   delete profile.projectLocator;
   const out2 = await ensureProjectLink(ROOT, profile, client);
   if (out2.linked) {
+    await refreshLinkedCodexHooks(args2);
     console.log(`linked: ${profile.repoLocator} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""}`);
   } else {
     console.error(`link failed (${out2.reason})${out2.detail ? `: ${out2.detail}` : ""}`);
@@ -88135,11 +88299,11 @@ function cmdInstallationProfile(args2) {
 }
 async function cmdReview() {
   const paths = workspacePaths(ROOT);
-  if (!existsSync33(paths.reviewQueue)) {
+  if (!existsSync34(paths.reviewQueue)) {
     console.log("(review queue empty)");
     return;
   }
-  const queue = JSON.parse(readFileSync32(paths.reviewQueue, "utf8"));
+  const queue = JSON.parse(readFileSync33(paths.reviewQueue, "utf8"));
   if (queue.length === 0) {
     console.log("(review queue empty)");
     return;
@@ -88810,7 +88974,7 @@ async function gatherRepo(store, ws) {
   };
 }
 async function gatherReportData(generatedAt) {
-  const { existsSync: existsSync34 } = await import("node:fs");
+  const { existsSync: existsSync35 } = await import("node:fs");
   const { openGraphStore: openGraphStore2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
   const cfg = loadConfig();
   const outbound = cfg.consent.sync ? "auto" : "off";
@@ -88818,7 +88982,7 @@ async function gatherReportData(generatedAt) {
   for (const ws of listWorkspaces()) {
     if (ws.missing) continue;
     const dbPath = workspacePaths(ws.path).castalia;
-    if (!existsSync34(dbPath)) continue;
+    if (!existsSync35(dbPath)) continue;
     let store = null;
     try {
       store = openGraphStore2({ path: dbPath });
@@ -88849,7 +89013,7 @@ async function gatherReportData(generatedAt) {
   };
 }
 async function cmdReport(args2) {
-  const { mkdirSync: mkdirSync9, writeFileSync: writeFileSync24 } = await import("node:fs");
+  const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync25 } = await import("node:fs");
   const { renderReport: renderReport2 } = await Promise.resolve().then(() => (init_report_render(), report_render_exports));
   const includeFutureVerbs = args2.includes("--future-verbs");
   const now = /* @__PURE__ */ new Date();
@@ -88860,10 +89024,10 @@ async function cmdReport(args2) {
     process.exit(2);
   }
   const outDir = workspacePaths(ROOT).configDir;
-  mkdirSync9(outDir, { recursive: true });
+  mkdirSync10(outDir, { recursive: true });
   const files = renderReport2(data, { includeFutureVerbs });
-  for (const f of files) writeFileSync24(join37(outDir, f.name), f.html, "utf8");
-  const indexPath = join37(outDir, "report.html");
+  for (const f of files) writeFileSync25(join38(outDir, f.name), f.html, "utf8");
+  const indexPath = join38(outDir, "report.html");
   console.log(`report \u2192 ${indexPath}`);
   console.log(
     `  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`
@@ -88983,24 +89147,24 @@ async function cmdInstallHooks(args2) {
   }
 }
 async function installOpencodePlugin(port) {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join38 } = await import("node:path");
-  const dir = join38(ROOT, ".opencode", "plugin");
-  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
-  const file2 = join38(dir, "inerrata.js");
-  if (existsSync34(file2)) {
-    const head2 = readFileSync33(file2, "utf8").split("\n")[0] ?? "";
+  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync34, writeFileSync: writeFileSync25 } = await import("node:fs");
+  const { join: join39 } = await import("node:path");
+  const dir = join39(ROOT, ".opencode", "plugin");
+  if (!existsSync35(dir)) mkdirSync10(dir, { recursive: true });
+  const file2 = join39(dir, "inerrata.js");
+  if (existsSync35(file2)) {
+    const head2 = readFileSync34(file2, "utf8").split("\n")[0] ?? "";
     if (head2.trim() !== OPENCODE_PLUGIN_MARKER) {
       console.error(`refusing to overwrite ${file2}: not an errata-managed plugin (line 1 lacks the marker)`);
       process.exit(2);
     }
   }
-  writeFileSync24(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
-  const cfgFile = join38(ROOT, "opencode.json");
+  writeFileSync25(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
+  const cfgFile = join39(ROOT, "opencode.json");
   let cfg = { $schema: "https://opencode.ai/config.json" };
-  if (existsSync34(cfgFile)) {
+  if (existsSync35(cfgFile)) {
     try {
-      cfg = JSON.parse(readFileSync33(cfgFile, "utf8"));
+      cfg = JSON.parse(readFileSync34(cfgFile, "utf8"));
     } catch {
       console.error(`refusing to touch invalid JSON at ${cfgFile} \u2014 fix it and re-run`);
       process.exit(2);
@@ -89011,7 +89175,7 @@ async function installOpencodePlugin(port) {
   if (!hadErrata) {
     const inv = errataMcpInvocation();
     cfg.mcp["errata"] = { type: "local", command: [inv.command, ...inv.args] };
-    writeFileSync24(cfgFile, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+    writeFileSync25(cfgFile, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   }
   console.log(`installed OpenCode plugin \u2192 ${file2}`);
   if (hadErrata) console.log(`  mcp.errata already present in ${cfgFile} \u2014 left untouched`);
@@ -89031,15 +89195,15 @@ function errataMcpInvocation() {
   return { command: cmd2, args: args2 };
 }
 async function installClaudeHooks(port) {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join38 } = await import("node:path");
-  const dir = join38(ROOT, ".claude");
-  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
-  const file2 = join38(dir, "settings.json");
+  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync34, writeFileSync: writeFileSync25 } = await import("node:fs");
+  const { join: join39 } = await import("node:path");
+  const dir = join39(ROOT, ".claude");
+  if (!existsSync35(dir)) mkdirSync10(dir, { recursive: true });
+  const file2 = join39(dir, "settings.json");
   let settings = {};
-  if (existsSync34(file2)) {
+  if (existsSync35(file2)) {
     try {
-      settings = JSON.parse(readFileSync33(file2, "utf8"));
+      settings = JSON.parse(readFileSync34(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -89085,10 +89249,10 @@ async function installClaudeHooks(port) {
     dropErrata(list);
     list.push({ hooks: [{ type: "command", command: injectCmd }] });
   }
-  writeFileSync24(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  writeFileSync25(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code hooks \u2192 ${file2}`);
   await installClaudeMcpConfig();
-  const claudeMd = join38(ROOT, "CLAUDE.md");
+  const claudeMd = join39(ROOT, "CLAUDE.md");
   const recall = writeManagedBlock(claudeMd, { body: RECALL_FIRST_BLOCK });
   if (recall.kind === "collision") {
     console.warn(
@@ -89100,15 +89264,15 @@ async function installClaudeHooks(port) {
   console.log(`  endpoint: http://127.0.0.1:${port}/api/hook`);
 }
 async function installClaudeMcpConfig() {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join38, dirname: dirname13 } = await import("node:path");
-  const file2 = join38(ROOT, ".mcp.json");
+  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync34, writeFileSync: writeFileSync25 } = await import("node:fs");
+  const { join: join39, dirname: dirname13 } = await import("node:path");
+  const file2 = join39(ROOT, ".mcp.json");
   const dir = dirname13(file2);
-  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
+  if (!existsSync35(dir)) mkdirSync10(dir, { recursive: true });
   let cfg = {};
-  if (existsSync34(file2)) {
+  if (existsSync35(file2)) {
     try {
-      cfg = JSON.parse(readFileSync33(file2, "utf8"));
+      cfg = JSON.parse(readFileSync34(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -89116,21 +89280,21 @@ async function installClaudeMcpConfig() {
   }
   cfg.mcpServers ??= {};
   cfg.mcpServers["errata"] = errataMcpInvocation();
-  writeFileSync24(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  writeFileSync25(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code MCP server config \u2192 ${file2}`);
   console.log(`  Claude Code will spawn \`errata mcp\` on workspace open.`);
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses / show / similar`);
 }
 async function installCursorMcpConfig() {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join38 } = await import("node:path");
-  const dir = join38(ROOT, ".cursor");
-  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
-  const file2 = join38(dir, "mcp.json");
+  const { mkdirSync: mkdirSync10, existsSync: existsSync35, readFileSync: readFileSync34, writeFileSync: writeFileSync25 } = await import("node:fs");
+  const { join: join39 } = await import("node:path");
+  const dir = join39(ROOT, ".cursor");
+  if (!existsSync35(dir)) mkdirSync10(dir, { recursive: true });
+  const file2 = join39(dir, "mcp.json");
   let cfg = {};
-  if (existsSync34(file2)) {
+  if (existsSync35(file2)) {
     try {
-      cfg = JSON.parse(readFileSync33(file2, "utf8"));
+      cfg = JSON.parse(readFileSync34(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -89138,7 +89302,7 @@ async function installCursorMcpConfig() {
   }
   cfg.mcpServers ??= {};
   cfg.mcpServers["errata"] = errataMcpInvocation();
-  writeFileSync24(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+  writeFileSync25(file2, JSON.stringify(cfg, null, 2) + "\n", "utf8");
   console.log(`installed Cursor MCP server config \u2192 ${file2}`);
   console.log(`  Cursor will spawn \`errata mcp\` on workspace open.`);
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses`);
@@ -89146,39 +89310,21 @@ async function installCursorMcpConfig() {
   console.log(`  \u26A0\uFE0F  reload Cursor (Cmd/Ctrl-Shift-P \u2192 "Reload Window") to pick it up.`);
 }
 async function installCodexHooks(port) {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join38 } = await import("node:path");
-  const dir = join38(ROOT, ".codex");
-  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
-  const file2 = join38(dir, "config.toml");
-  let existing = "";
-  if (existsSync34(file2)) {
-    existing = readFileSync33(file2, "utf8");
-    const beginIdx = existing.indexOf(CODEX_HOOKS_BEGIN);
-    const endIdx = existing.indexOf(CODEX_HOOKS_END);
-    if (beginIdx >= 0 && endIdx > beginIdx) {
-      existing = existing.slice(0, beginIdx).trimEnd() + existing.slice(endIdx + CODEX_HOOKS_END.length).trimStart();
-    }
-  }
-  const block = buildCodexHooksToml(port);
-  const final = existing.length > 0 && !existing.endsWith("\n") ? `${existing}
-
-${block}` : existing + (existing.endsWith("\n\n") ? "" : "\n") + block;
-  writeFileSync24(file2, final, "utf8");
+  const file2 = writeCodexHooks(ROOT, port);
   console.log(`installed Codex hooks \u2192 ${file2}`);
-  console.log(`  endpoint: http://127.0.0.1:${port}/api/hook (+ /api/turn on PostToolUse)`);
-  console.log("");
-  console.log(`  Codex reads files via the shell, so the virtual graph surface`);
-  console.log(`  works by \`cat .errata/g/<verb>/<seed>\` (e.g. cat .errata/g/burst/foo).`);
-  console.log("");
-  console.log(`  Codex has no Stop/SessionEnd hook at this installed version, so`);
-  console.log(`  [!\u2026]/(fix:[\u2026]) tags are harvested via the PostToolUse-triggered`);
-  console.log(`  /api/turn call above instead \u2014 every turn with a tool call is`);
-  console.log(`  covered; a tool-less final turn is picked up on this workspace's`);
-  console.log(`  next daemon boot replay. Re-run this after a Codex upgrade in`);
-  console.log(`  case a newer version adds a real turn-boundary hook.`);
-  console.log(`  If [features] hooks=false in your config.toml, set it true. Hook`);
-  console.log(`  schemas evolve \u2014 if hooks stop firing after an update, re-run this.`);
+  console.log("  Context loads on SessionStart/UserPromptSubmit and refreshes after tools when changed.");
+  console.log("  Tool capture and /api/turn harvesting remain enabled.");
+  console.log("  Restart/resume Codex to reload config, then review and trust the hooks with /hooks.");
+  console.log("  If your Codex version gates hooks, enable [features] codex_hooks = true.");
+  console.log("  Older Codex versions may not support every event; update if hooks do not fire.");
+}
+async function refreshLinkedCodexHooks(args2) {
+  if (args2.includes("--skip-hooks") || !hasCodexConfig(ROOT)) return;
+  try {
+    await installCodexHooks(resolveHookPort());
+  } catch (err2) {
+    console.warn(`  Codex hook refresh failed: ${err2 instanceof Error ? err2.message : err2}`);
+  }
 }
 function printAiderInstructions() {
   console.log(`Aider doesn't expose programmatic per-tool hooks, so the`);
@@ -89508,7 +89654,7 @@ async function cmdDash(args2) {
       await yieldToLoop2();
       try {
         const items = selectDurableMemory(handle2.sharedStore, r.engine.profile);
-        const res = bleedRules(join37(r.root, ".claude", "rules"), items);
+        const res = bleedRules(join38(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(
             `[rules:${r.entry.name}] ${res.written} collective principle(s) \u2192 .claude/rules` + (res.pruned ? `, ${res.pruned} pruned` : "")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.6-dev.2506",
+  "version": "2.0.6-dev.2533",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -15140,7 +15140,7 @@ var init_symbol_intent = __esm({
 });
 
 // ../../packages/shared/src/wire.ts
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, ANCHOR_COMMIT_SHA_RE, ANCHOR_BODY_HASH_RE, ANCHOR_SYMBOL_KINDS, ANCHOR_LABEL_KINDS, ANCHOR_LABEL_PATH_RE, ANCHOR_LABEL_QNAME_RE, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15243,6 +15243,21 @@ var init_wire = __esm({
     });
     ANCHOR_COMMIT_SHA_RE = /^[0-9a-f]{7,40}$/;
     ANCHOR_BODY_HASH_RE = /^[0-9a-f]{8,64}$/;
+    ANCHOR_SYMBOL_KINDS = [
+      "Function",
+      "Class",
+      "Method",
+      "Module",
+      "Interface",
+      "Const",
+      "Enum",
+      "TypeAlias",
+      "Namespace",
+      "Property"
+    ];
+    ANCHOR_LABEL_KINDS = [...ANCHOR_SYMBOL_KINDS, "File"];
+    ANCHOR_LABEL_PATH_RE = /^(?![/])(?![A-Za-z]:)(?!(?:.*\/)?\.\.(?:\/|$))[^\x00-\x1f\x7f\\`]{1,512}$/;
+    ANCHOR_LABEL_QNAME_RE = /^[^\x00-\x1f\x7f`]{1,256}$/;
     CastaliaIngestEdgeSchema = external_exports.object({
       fromCanonicalId: external_exports.string().min(6).max(160),
       toCanonicalId: external_exports.string().min(6).max(160),
@@ -15262,7 +15277,17 @@ var init_wire = __esm({
          *  classify the anchor current / pre-change; absent ⇒ the pre-versioning
          *  contract, unverified. Only meaningful on `ANCHORED_AT`. */
         observedAtCommit: external_exports.string().regex(ANCHOR_COMMIT_SHA_RE).optional(),
-        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional()
+        symbolContentHash: external_exports.string().regex(ANCHOR_BODY_HASH_RE).optional(),
+        /** PJ-anchor-labels: the READABLE identity of the anchor's target —
+         *  repo-relative path, qualified name (absent for a File), kind and line.
+         *  Sent only for a project whose owner opted in; the door strips them again
+         *  for any project that has not (the daemon's flag is not trusted alone).
+         *  Prefixed `label*` so no local edge attr (`anchorLine` lives there
+         *  natively) can ride out under a shared key. */
+        labelRelPath: external_exports.string().regex(ANCHOR_LABEL_PATH_RE).optional(),
+        labelQname: external_exports.string().regex(ANCHOR_LABEL_QNAME_RE).optional(),
+        labelKind: external_exports.enum(ANCHOR_LABEL_KINDS).optional(),
+        labelLine: external_exports.number().int().min(1).max(1e7).optional()
       }).optional()
     });
     SymbolSummarySidecarSchema = external_exports.record(