@inerrata-corporation/errata 2.0.6-dev.2563 → 2.0.6-dev.2568

package/errata.mjs

@@ -28996,6 +28996,186 @@ var init_review2 = __esm({
   }
 });
 
+// src/consent.ts
+function effectiveConsent(config2, profile) {
+  const c = profile?.consoleConsents;
+  if (c) return { sync: c.sync, telemetry: c.telemetry, contributePackages: c.contributePackages };
+  return {
+    sync: config2.consent.sync,
+    telemetry: config2.consent.telemetry,
+    contributePackages: config2.consent.contributePackages
+  };
+}
+var init_consent = __esm({
+  "src/consent.ts"() {
+    "use strict";
+  }
+});
+
+// src/git-remote.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6, statSync } from "node:fs";
+import { isAbsolute, join as join6, resolve } from "node:path";
+function resolveGitDir(root) {
+  const dotGit = join6(root, ".git");
+  try {
+    const st = statSync(dotGit);
+    if (st.isDirectory()) return dotGit;
+    const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync6(dotGit, "utf8"));
+    if (!m) return null;
+    const dir = m[1];
+    return isAbsolute(dir) ? dir : resolve(root, dir);
+  } catch {
+    return null;
+  }
+}
+function gitConfigPath(gitDir) {
+  const commondirFile = join6(gitDir, "commondir");
+  if (existsSync8(commondirFile)) {
+    const common = readFileSync6(commondirFile, "utf8").trim();
+    const commonDir = isAbsolute(common) ? common : resolve(gitDir, common);
+    return join6(commonDir, "config");
+  }
+  return join6(gitDir, "config");
+}
+function readRemotes(root) {
+  const gitDir = resolveGitDir(root);
+  if (!gitDir) return [];
+  const cfgPath = gitConfigPath(gitDir);
+  if (!existsSync8(cfgPath)) return [];
+  let txt;
+  try {
+    txt = readFileSync6(cfgPath, "utf8");
+  } catch {
+    return [];
+  }
+  const out2 = [];
+  const sectionRe = /^\s*\[remote "([^"]+)"\]\s*$([\s\S]*?)(?=^\s*\[|\s*$(?![\s\S]))/gm;
+  for (const m of txt.matchAll(sectionRe)) {
+    const url2 = /^\s*url\s*=\s*(.+?)\s*$/m.exec(m[2])?.[1];
+    if (url2) out2.push({ name: m[1], url: url2 });
+  }
+  return out2;
+}
+function detectRepoLocator(root, remote) {
+  const remotes = readRemotes(root);
+  if (remotes.length === 0) return null;
+  const pick2 = remote ? remotes.find((r) => r.name === remote) ?? null : remotes.find((r) => r.name === "origin") ?? (remotes.length === 1 ? remotes[0] : null);
+  return pick2 ? normalizeRepoLocator(pick2.url) : null;
+}
+var init_git_remote = __esm({
+  "src/git-remote.ts"() {
+    "use strict";
+    init_src();
+  }
+});
+
+// src/profile.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { join as join7 } from "node:path";
+function workspaceId(root) {
+  return "wp_" + createHash3("sha256").update(root).digest("hex").slice(0, 12);
+}
+function sessionOriginKey(sessionId) {
+  if (!sessionId) return void 0;
+  return "ws_" + createHash3("sha256").update(sessionId).digest("hex").slice(0, 12);
+}
+function refreshRepoLocator(root, profile) {
+  const detected = detectRepoLocator(root, profile.repoRemote);
+  if (!detected || detected === profile.repoLocator) return false;
+  if (profile.repoLocator) {
+    const aliases = new Set(profile.repoLocatorAliases ?? []);
+    aliases.add(profile.repoLocator);
+    aliases.delete(detected);
+    profile.repoLocatorAliases = [...aliases];
+  }
+  profile.repoLocator = detected;
+  saveProfile(root, profile);
+  return true;
+}
+function loadProfile(root) {
+  const p = workspacePaths(root);
+  if (!existsSync9(p.workspaceJson)) return null;
+  return JSON.parse(readFileSync7(p.workspaceJson, "utf8"));
+}
+function saveProfile(root, profile) {
+  const p = workspacePaths(root);
+  ensureDir(p.configDir);
+  writeFileSync7(p.workspaceJson, JSON.stringify(profile, null, 2), "utf8");
+}
+function autodetectProfile(root) {
+  const id = workspaceId(root);
+  const name2 = root.split(/[\\/]/).filter(Boolean).pop() ?? "workspace";
+  const p = emptyProfile(id, name2);
+  const locator = detectRepoLocator(root);
+  if (locator) p.repoLocator = locator;
+  const pkgPath = join7(root, "package.json");
+  if (existsSync9(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
+      const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+      p.languages.push("javascript");
+      if (existsSync9(join7(root, "tsconfig.json")) || deps["typescript"]) {
+        p.languages.push("typescript");
+      }
+      const nodeVer = pkg.engines?.node?.trim();
+      p.stack.push(nodeVer ? `node@${nodeVer}` : "node");
+      const interesting = [
+        "next",
+        "react",
+        "vue",
+        "svelte",
+        "express",
+        "hono",
+        "fastify",
+        "@modelcontextprotocol/sdk"
+      ];
+      for (const k of interesting) {
+        if (deps[k]) p.stack.push(k);
+      }
+    } catch {
+    }
+  }
+  const pyproject = join7(root, "pyproject.toml");
+  if (existsSync9(pyproject)) {
+    try {
+      const txt = readFileSync7(pyproject, "utf8");
+      const py = /python\s*=\s*"([^"]+)"/.exec(txt)?.[1];
+      p.languages.push("python");
+      p.stack.push(`python@${py ?? "3"}`);
+      const candidates = ["fastapi", "django", "flask", "mcp", "pytest"];
+      for (const k of candidates) {
+        if (new RegExp(`\\b${k}\\b`, "i").test(txt)) p.stack.push(k);
+      }
+    } catch {
+    }
+  }
+  const reqs = join7(root, "requirements.txt");
+  if (existsSync9(reqs)) {
+    if (!p.languages.includes("python")) p.languages.push("python");
+    if (!p.stack.includes("python@3")) p.stack.push("python@3");
+  }
+  if (existsSync9(join7(root, "go.mod"))) {
+    p.languages.push("go");
+    p.stack.push("go");
+  }
+  if (existsSync9(join7(root, "Cargo.toml"))) {
+    p.languages.push("rust");
+    p.stack.push("rust");
+  }
+  p.languages = [...new Set(p.languages)];
+  p.stack = [...new Set(p.stack)];
+  return p;
+}
+var init_profile2 = __esm({
+  "src/profile.ts"() {
+    "use strict";
+    init_src2();
+    init_paths();
+    init_git_remote();
+  }
+});
+
 // src/identity.ts
 function resolveWorkspaceIdentity(cfg, entry, env2 = process.env) {
   if (env2["ERRATA_CONFIG_PATH"]) {
@@ -29071,70 +29251,13 @@ var init_identity2 = __esm({
   }
 });
 
-// src/git-remote.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, statSync } from "node:fs";
-import { isAbsolute, join as join6, resolve } from "node:path";
-function resolveGitDir(root) {
-  const dotGit = join6(root, ".git");
-  try {
-    const st = statSync(dotGit);
-    if (st.isDirectory()) return dotGit;
-    const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync6(dotGit, "utf8"));
-    if (!m) return null;
-    const dir = m[1];
-    return isAbsolute(dir) ? dir : resolve(root, dir);
-  } catch {
-    return null;
-  }
-}
-function gitConfigPath(gitDir) {
-  const commondirFile = join6(gitDir, "commondir");
-  if (existsSync8(commondirFile)) {
-    const common = readFileSync6(commondirFile, "utf8").trim();
-    const commonDir = isAbsolute(common) ? common : resolve(gitDir, common);
-    return join6(commonDir, "config");
-  }
-  return join6(gitDir, "config");
-}
-function readRemotes(root) {
-  const gitDir = resolveGitDir(root);
-  if (!gitDir) return [];
-  const cfgPath = gitConfigPath(gitDir);
-  if (!existsSync8(cfgPath)) return [];
-  let txt;
-  try {
-    txt = readFileSync6(cfgPath, "utf8");
-  } catch {
-    return [];
-  }
-  const out2 = [];
-  const sectionRe = /^\s*\[remote "([^"]+)"\]\s*$([\s\S]*?)(?=^\s*\[|\s*$(?![\s\S]))/gm;
-  for (const m of txt.matchAll(sectionRe)) {
-    const url2 = /^\s*url\s*=\s*(.+?)\s*$/m.exec(m[2])?.[1];
-    if (url2) out2.push({ name: m[1], url: url2 });
-  }
-  return out2;
-}
-function detectRepoLocator(root, remote) {
-  const remotes = readRemotes(root);
-  if (remotes.length === 0) return null;
-  const pick2 = remote ? remotes.find((r) => r.name === remote) ?? null : remotes.find((r) => r.name === "origin") ?? (remotes.length === 1 ? remotes[0] : null);
-  return pick2 ? normalizeRepoLocator(pick2.url) : null;
-}
-var init_git_remote = __esm({
-  "src/git-remote.ts"() {
-    "use strict";
-    init_src();
-  }
-});
-
 // src/checkout-root.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join7, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
+import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join8, resolve as resolve2 } from "node:path";
 function nearestGitRoot(dir) {
   let cur = resolve2(dir);
   for (; ; ) {
-    if (existsSync9(join7(cur, ".git"))) return cur;
+    if (existsSync10(join8(cur, ".git"))) return cur;
     const parent = dirname6(cur);
     if (parent === cur) return null;
     cur = parent;
@@ -29142,19 +29265,19 @@ function nearestGitRoot(dir) {
 }
 function mainCheckoutOfWorktree(root) {
   const gitDir = resolveGitDir(root);
-  if (!gitDir || gitDir === join7(root, ".git")) return null;
-  const commondirFile = join7(gitDir, "commondir");
-  if (!existsSync9(commondirFile)) return null;
+  if (!gitDir || gitDir === join8(root, ".git")) return null;
+  const commondirFile = join8(gitDir, "commondir");
+  if (!existsSync10(commondirFile)) return null;
   let common;
   try {
-    common = readFileSync7(commondirFile, "utf8").trim();
+    common = readFileSync8(commondirFile, "utf8").trim();
   } catch {
     return null;
   }
   const commonDir = resolve2(isAbsolute2(common) ? common : resolve2(gitDir, common));
   if (basename2(commonDir) !== ".git") return null;
   const main2 = dirname6(commonDir);
-  return existsSync9(join7(main2, ".git")) ? main2 : null;
+  return existsSync10(join8(main2, ".git")) ? main2 : null;
 }
 function checkoutRootOf(cwd) {
   const root = nearestGitRoot(cwd);
@@ -29172,16 +29295,16 @@ var init_checkout_root = __esm({
 });
 
 // src/registry.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join9 } from "node:path";
 function registryPath() {
-  return process.env["ERRATA_REGISTRY_PATH"] ?? join8(globalDir(), "workspaces.json");
+  return process.env["ERRATA_REGISTRY_PATH"] ?? join9(globalDir(), "workspaces.json");
 }
 function read() {
   const p = registryPath();
-  if (!existsSync10(p)) return { version: 1, workspaces: {} };
+  if (!existsSync11(p)) return { version: 1, workspaces: {} };
   try {
-    const parsed = JSON.parse(readFileSync8(p, "utf8"));
+    const parsed = JSON.parse(readFileSync9(p, "utf8"));
     return { version: 1, workspaces: parsed.workspaces ?? {} };
   } catch {
     return { version: 1, workspaces: {} };
@@ -29189,9 +29312,9 @@ function read() {
 }
 function registryCorrupt() {
   const p = registryPath();
-  if (!existsSync10(p)) return false;
+  if (!existsSync11(p)) return false;
   try {
-    JSON.parse(readFileSync8(p, "utf8"));
+    JSON.parse(readFileSync9(p, "utf8"));
     return false;
   } catch {
     return true;
@@ -29199,7 +29322,7 @@ function registryCorrupt() {
 }
 function write(reg) {
   ensureDir(globalDir());
-  writeFileSync7(registryPath(), JSON.stringify(reg, null, 2), "utf8");
+  writeFileSync8(registryPath(), JSON.stringify(reg, null, 2), "utf8");
 }
 function registerWorkspace(profile, root, now = Date.now()) {
   if (isLinkedWorktree(root)) return;
@@ -29234,6 +29357,9 @@ function workspaceEntryForPath(absPath) {
   }
   return best;
 }
+function liveWorkspaceEntry(entry) {
+  return read().workspaces[entry.id] ?? entry;
+}
 function boundWorkspaceEntries() {
   return Object.values(read().workspaces).filter((e) => e.installationProfile);
 }
@@ -29241,7 +29367,7 @@ function pruneMissingWorkspaces() {
   const reg = read();
   const removed = [];
   for (const [id, entry] of Object.entries(reg.workspaces)) {
-    if (!existsSync10(entry.path)) {
+    if (!existsSync11(entry.path)) {
       removed.push(entry);
       delete reg.workspaces[id];
     }
@@ -29250,13 +29376,13 @@ function pruneMissingWorkspaces() {
   return removed;
 }
 function workspaceStatus(entry) {
-  const missing = !existsSync10(entry.path);
+  const missing = !existsSync11(entry.path);
   const lockPath = workspacePaths(entry.path).daemonLock;
   let running = false;
   let webUiUrl = null;
-  if (existsSync10(lockPath)) {
+  if (existsSync11(lockPath)) {
     try {
-      const lock = JSON.parse(readFileSync8(lockPath, "utf8"));
+      const lock = JSON.parse(readFileSync9(lockPath, "utf8"));
       if (lock.pid && lock.webUiUrl && pidAlive(lock.pid)) {
         running = true;
         webUiUrl = lock.webUiUrl;
@@ -30710,7 +30836,7 @@ var init_diagnostic_matcher = __esm({
 });
 
 // ../../packages/generalizer/src/generalizer.ts
-import { isAbsolute as isAbsolute3, join as join9, relative } from "node:path";
+import { isAbsolute as isAbsolute3, join as join10, relative } from "node:path";
 async function runGeneralizer(opts) {
   const report = {
     eventsProcessed: 0,
@@ -30818,7 +30944,7 @@ function extractDiagnostics(ev) {
 function diagRelPath(file2, cwd, workspaceRoot) {
   const norm = (p) => p.replace(/\\/g, "/");
   if (!workspaceRoot) return norm(file2);
-  const abs = isAbsolute3(file2) ? file2 : join9(cwd ?? workspaceRoot, file2);
+  const abs = isAbsolute3(file2) ? file2 : join10(cwd ?? workspaceRoot, file2);
   return norm(relative(workspaceRoot, abs));
 }
 function extractErrorSignature(ev) {
@@ -32460,23 +32586,23 @@ var init_src10 = __esm({
 });
 
 // ../../packages/indexer/src/parse-cache.ts
-import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync9, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync8 } from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync10, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function parseCacheDir() {
-  return process.env["ERRATA_PARSE_CACHE"] ?? join10(homedir3(), ".errata", "parse-cache");
+  return process.env["ERRATA_PARSE_CACHE"] ?? join11(homedir3(), ".errata", "parse-cache");
 }
 function parseCacheKey(source, providerId) {
-  return createHash3("sha256").update(`${PARSE_CACHE_VERSION}:${providerId}:${source}`).digest("hex");
+  return createHash4("sha256").update(`${PARSE_CACHE_VERSION}:${providerId}:${source}`).digest("hex");
 }
 function entryPath(dir, key) {
-  return join10(dir, key.slice(0, 2), `${key.slice(2)}.json`);
+  return join11(dir, key.slice(0, 2), `${key.slice(2)}.json`);
 }
 function readParseCache(dir, key) {
   const file2 = entryPath(dir, key);
   try {
-    const raw2 = readFileSync9(file2, "utf8");
+    const raw2 = readFileSync10(file2, "utf8");
     const parsed = JSON.parse(raw2);
     if (parsed.v !== PARSE_CACHE_VERSION || !Array.isArray(parsed.symbols)) return null;
     return { symbols: parsed.symbols, reExports: parsed.reExports ?? [] };
@@ -32495,8 +32621,8 @@ function writeParseCache(dir, key, providerId, value) {
     const body2 = JSON.stringify(envelope);
     if (body2.length > MAX_ENTRY_BYTES) return;
     const file2 = entryPath(dir, key);
-    mkdirSync6(join10(dir, key.slice(0, 2)), { recursive: true });
-    writeFileSync8(file2, body2);
+    mkdirSync6(join11(dir, key.slice(0, 2)), { recursive: true });
+    writeFileSync9(file2, body2);
   } catch {
   }
 }
@@ -32505,9 +32631,9 @@ function sweepParseCacheOnce(dir, now = Date.now()) {
   sweptThisProcess = true;
   let removed = 0;
   try {
-    if (!existsSync11(dir)) return 0;
+    if (!existsSync12(dir)) return 0;
     for (const bucket of readdirSync2(dir)) {
-      const bucketDir = join10(dir, bucket);
+      const bucketDir = join11(dir, bucket);
       let names;
       try {
         names = readdirSync2(bucketDir);
@@ -32515,7 +32641,7 @@ function sweepParseCacheOnce(dir, now = Date.now()) {
         continue;
       }
       for (const name2 of names) {
-        const file2 = join10(bucketDir, name2);
+        const file2 = join11(bucketDir, name2);
         try {
           if (now - statSync2(file2).mtimeMs > ENTRY_TTL_MS) {
             rmSync2(file2, { force: true });
@@ -32763,10 +32889,10 @@ var init_identity3 = __esm({
 });
 
 // ../../packages/indexer/src/pipeline.ts
-import { appendFileSync, readFileSync as readFileSync10, statSync as statSync3 } from "node:fs";
+import { appendFileSync, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
 import { readdir } from "node:fs/promises";
-import { extname, join as join11, relative as relative2, sep } from "node:path";
-import { createHash as createHash4 } from "node:crypto";
+import { extname, join as join12, relative as relative2, sep } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
 import { execFileSync } from "node:child_process";
 function nowTs() {
   return indexNow ?? Date.now();
@@ -32775,7 +32901,7 @@ function fingerprintOf(signature, bodyHash) {
   return `${signature ?? ""}|${bodyHash ?? ""}`;
 }
 function sha(s) {
-  return createHash4("sha256").update(s).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(s).digest("hex").slice(0, 16);
 }
 function fileNodeId(workspaceId2, relPath) {
   return `file_${sha(workspaceId2 + ":" + relPath.replace(/\\/g, "/"))}`;
@@ -32903,7 +33029,7 @@ async function incrementalReindex(store, rootPath, workspaceId2, changedAbsPaths
   for (const rel of [...changedRelPaths]) {
     let h;
     try {
-      h = createHash4("sha256").update(readFileSync10(join11(rootPath, rel))).digest("hex");
+      h = createHash5("sha256").update(readFileSync11(join12(rootPath, rel))).digest("hex");
     } catch {
       continue;
     }
@@ -32952,13 +33078,13 @@ async function incrementalReindex(store, rootPath, workspaceId2, changedAbsPaths
   let parsedFiles = 0;
   for (const rel of changedRelPaths) {
     if (parsedFiles++ > 0) await new Promise((r2) => setImmediate(r2));
-    const abs = join11(rootPath, ...rel.split("/"));
+    const abs = join12(rootPath, ...rel.split("/"));
     const ext = extname(abs).toLowerCase();
     const provider = providers.find((p) => p.fileExtensions.includes(ext));
     if (!provider) continue;
     let symbols;
     try {
-      symbols = provider.extractSymbols(readFileSync10(abs, "utf8"), abs);
+      symbols = provider.extractSymbols(readFileSync11(abs, "utf8"), abs);
     } catch {
       continue;
     }
@@ -33278,7 +33404,7 @@ async function runIndexer(store, opts) {
         report.filesSkipped++;
         continue;
       }
-      source = readFileSync10(f.absPath, "utf8");
+      source = readFileSync11(f.absPath, "utf8");
     } catch {
       report.filesSkipped++;
       continue;
@@ -33350,7 +33476,7 @@ async function runIndexer(store, opts) {
     const depth = fileNode.relPath.split("/").length;
     if (depth !== 3) continue;
     try {
-      const pkg = JSON.parse(readFileSync10(fileNode.absPath, "utf8"));
+      const pkg = JSON.parse(readFileSync11(fileNode.absPath, "utf8"));
       if (!pkg.name) continue;
       const pkgDir = fileNode.relPath.replace(/\/package\.json$/, "");
       const candidates = [
@@ -33738,7 +33864,7 @@ async function scan(root, current, ignores, providers, out2) {
   for (const ent of entries) {
     if (ignores.has(ent.name)) continue;
     if (ent.name.startsWith(".") && ent.name !== ".") continue;
-    const abs = join11(current, ent.name);
+    const abs = join12(current, ent.name);
     if (ent.isDirectory()) {
       await scan(root, abs, ignores, providers, out2);
     } else if (ent.isFile()) {
@@ -33793,7 +33919,7 @@ function gitListFiles(root, ignores, providers) {
   if (rels === null) return null;
   const out2 = [];
   for (const rel of rels) {
-    const abs = join11(root, rel);
+    const abs = join12(root, rel);
     let size;
     try {
       size = statSync3(abs).size;
@@ -33816,7 +33942,7 @@ function upsertFile(store, id, f, workspaceId2, skip) {
   const now = nowTs();
   let contentHash;
   try {
-    contentHash = createHash4("sha256").update(readFileSync10(f.absPath)).digest("hex");
+    contentHash = createHash5("sha256").update(readFileSync11(f.absPath)).digest("hex");
   } catch {
   }
   const carried = { ...store.getNode(id)?.attrs ?? {} };
@@ -38189,8 +38315,8 @@ ${JSON.stringify(symbolNames, null, 2)}`);
 
 // ../../packages/indexer/src/languages/tree-sitter-loader.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname7, join as join12 } from "node:path";
-import { existsSync as existsSync12, readdirSync as readdirSync3 } from "node:fs";
+import { dirname as dirname7, join as join13 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync3 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 function entryDir() {
   try {
@@ -38204,27 +38330,27 @@ function entryDir() {
 }
 function findWasmDir() {
   const here = entryDir();
-  const seaWasm = join12(here, "resources", "wasm");
-  if (existsSync12(join12(seaWasm, "tree-sitter-typescript.wasm"))) return seaWasm;
+  const seaWasm = join13(here, "resources", "wasm");
+  if (existsSync13(join13(seaWasm, "tree-sitter-typescript.wasm"))) return seaWasm;
   let dir = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const flat = join12(
+    const flat = join13(
       dir,
       "node_modules",
       "@vscode",
       "tree-sitter-wasm",
       "wasm"
     );
-    if (existsSync12(join12(flat, "tree-sitter-typescript.wasm"))) return flat;
+    if (existsSync13(join13(flat, "tree-sitter-typescript.wasm"))) return flat;
     dir = dirname7(dir);
   }
   let root = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const pnpmDir = join12(root, "node_modules", ".pnpm");
-    if (existsSync12(pnpmDir)) {
+    const pnpmDir = join13(root, "node_modules", ".pnpm");
+    if (existsSync13(pnpmDir)) {
       for (const entry of readdirSync3(pnpmDir)) {
         if (entry.startsWith("@vscode+tree-sitter-wasm@")) {
-          const candidate = join12(
+          const candidate = join13(
             pnpmDir,
             entry,
             "node_modules",
@@ -38232,7 +38358,7 @@ function findWasmDir() {
             "tree-sitter-wasm",
             "wasm"
           );
-          if (existsSync12(join12(candidate, "tree-sitter-typescript.wasm"))) {
+          if (existsSync13(join13(candidate, "tree-sitter-typescript.wasm"))) {
             return candidate;
           }
         }
@@ -38246,27 +38372,27 @@ function findWasmDir() {
 }
 function findRuntimeDir() {
   const here = entryDir();
-  const seaRuntime = join12(here, "resources", "wasm");
-  if (existsSync12(join12(seaRuntime, "web-tree-sitter.wasm"))) return seaRuntime;
+  const seaRuntime = join13(here, "resources", "wasm");
+  if (existsSync13(join13(seaRuntime, "web-tree-sitter.wasm"))) return seaRuntime;
   let dir = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const flat = join12(dir, "node_modules", "web-tree-sitter");
-    if (existsSync12(join12(flat, "web-tree-sitter.wasm"))) return flat;
+    const flat = join13(dir, "node_modules", "web-tree-sitter");
+    if (existsSync13(join13(flat, "web-tree-sitter.wasm"))) return flat;
     dir = dirname7(dir);
   }
   let root = here;
   for (let i2 = 0; i2 < 6; i2++) {
-    const pnpmDir = join12(root, "node_modules", ".pnpm");
-    if (existsSync12(pnpmDir)) {
+    const pnpmDir = join13(root, "node_modules", ".pnpm");
+    if (existsSync13(pnpmDir)) {
       for (const entry of readdirSync3(pnpmDir)) {
         if (entry.startsWith("web-tree-sitter@")) {
-          const candidate = join12(
+          const candidate = join13(
             pnpmDir,
             entry,
             "node_modules",
             "web-tree-sitter"
           );
-          if (existsSync12(join12(candidate, "web-tree-sitter.wasm"))) {
+          if (existsSync13(join13(candidate, "web-tree-sitter.wasm"))) {
             return candidate;
           }
         }
@@ -38283,7 +38409,7 @@ async function loadWebTreeSitter() {
     void err2;
   }
   const here = entryDir();
-  const seaResourceBase = join12(here, "resources", "_resolve.js");
+  const seaResourceBase = join13(here, "resources", "_resolve.js");
   const resourceRequire = createRequire2(seaResourceBase);
   return resourceRequire("web-tree-sitter");
 }
@@ -38298,9 +38424,9 @@ async function ensureTreeSitterReady() {
     await Parser2.init({
       locateFile: (name2) => {
         if (name2 === "tree-sitter.wasm" || name2 === "web-tree-sitter.wasm") {
-          return join12(runtime, name2);
+          return join13(runtime, name2);
         }
-        return join12(grammars, name2);
+        return join13(grammars, name2);
       }
     });
   })();
@@ -38312,7 +38438,7 @@ async function loadGrammar(name2) {
   if (cached2) return cached2;
   if (!languageClass) throw new Error("tree-sitter not initialized");
   const grammars = findWasmDir();
-  const lang = await languageClass.load(join12(grammars, `${name2}.wasm`));
+  const lang = await languageClass.load(join13(grammars, `${name2}.wasm`));
   grammarCache.set(name2, lang);
   return lang;
 }
@@ -38335,7 +38461,7 @@ var init_tree_sitter_loader = __esm({
 });
 
 // ../../packages/indexer/src/languages/typescript-treesitter.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 function extractNode(node2, source, containerQname, containerKind) {
   switch (node2.type) {
     case "function_declaration":
@@ -38548,7 +38674,7 @@ function scopeRecord(kind, name2, qname, node2, body2, source) {
       const sig = header.replace(/\s+/g, " ").trim();
       if (sig) rec.signature = sig;
       const bodyText = source.slice(body2.startIndex, body2.endIndex);
-      rec.bodyHash = createHash5("sha256").update(bodyText).digest("hex").slice(0, 16);
+      rec.bodyHash = createHash6("sha256").update(bodyText).digest("hex").slice(0, 16);
       rec.bodySimhash = toHex(simhash(bodyText));
     }
   }
@@ -38990,14 +39116,14 @@ var init_typescript_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/python-treesitter.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 function sigAndHash(node2, body2, source) {
   if (!body2) return {};
   const out2 = {};
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash6("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash7("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -39410,7 +39536,7 @@ var init_python_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/cpp-treesitter.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function extractNode3(node2, containerQname, containerIsClass, source) {
   switch (node2.type) {
     case "function_definition":
@@ -39594,7 +39720,7 @@ function sigAndHash2(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash7("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash8("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -39755,7 +39881,7 @@ var init_cpp_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/go-treesitter.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 function extractNode4(node2, containerQname, source) {
   switch (node2.type) {
     case "function_declaration": {
@@ -39917,7 +40043,7 @@ function sigAndHash3(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash8("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash9("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40061,7 +40187,7 @@ var init_go_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/rust-treesitter.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 function extractNode5(node2, containerQname, containerIsClass, source) {
   switch (node2.type) {
     case "function_item":
@@ -40276,7 +40402,7 @@ function sigAndHash4(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash9("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash10("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40427,7 +40553,7 @@ var init_rust_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/ruby-treesitter.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 function sigAndHash5(node2, body2, source) {
   if (!body2) {
     const sig2 = source.slice(node2.startIndex, node2.endIndex).replace(/\s+/g, " ").trim();
@@ -40437,7 +40563,7 @@ function sigAndHash5(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash10("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash11("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -40783,7 +40909,7 @@ var init_ruby_treesitter = __esm({
 });
 
 // ../../packages/indexer/src/languages/csharp-treesitter.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 function extractNode7(node2, containerQname, containerIsType, source, eof) {
   switch (node2.type) {
     case "method_declaration":
@@ -40985,7 +41111,7 @@ function sigAndHash6(node2, body2, source) {
   const sig = source.slice(node2.startIndex, body2.startIndex).replace(/\s+/g, " ").trim();
   if (sig) out2.signature = sig;
   const bodyText = source.slice(body2.startIndex, body2.endIndex);
-  out2.bodyHash = createHash11("sha256").update(bodyText).digest("hex").slice(0, 16);
+  out2.bodyHash = createHash12("sha256").update(bodyText).digest("hex").slice(0, 16);
   out2.bodySimhash = toHex(simhash(bodyText));
   return out2;
 }
@@ -41216,7 +41342,7 @@ var init_src11 = __esm({
 // src/reconcile.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { readdirSync as readdirSync4, statSync as statSync4 } from "node:fs";
-import { join as join13, relative as relative3, sep as sep2 } from "node:path";
+import { join as join14, relative as relative3, sep as sep2 } from "node:path";
 function indexerWouldScan(rel) {
   for (const seg of rel.split(/[\\/]/)) {
     if (seg.length === 0) continue;
@@ -41239,7 +41365,7 @@ function gitSourceFiles(root) {
   const out2 = [];
   for (const rel of stdout.split("\0")) {
     if (!rel || !SOURCE_RE.test(rel) || !indexerWouldScan(rel)) continue;
-    const abs = join13(root, rel);
+    const abs = join14(root, rel);
     if (IGNORED.test(abs)) continue;
     out2.push(abs);
   }
@@ -41254,7 +41380,7 @@ function* walkSource(dir) {
   }
   for (const e of entries) {
     const name2 = String(e.name);
-    const full = join13(dir, name2);
+    const full = join14(dir, name2);
     if (IGNORED.test(full)) continue;
     if (!indexerWouldScan(name2)) continue;
     if (e.isDirectory()) yield* walkSource(full);
@@ -41404,7 +41530,7 @@ __export(mcp_exports, {
   runTool: () => runTool,
   searchGraph: () => searchGraph
 });
-import { existsSync as existsSync13, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "node:fs";
 import { resolve as resolve3 } from "node:path";
 function collectEnrichmentPulls(store, opts = {}) {
   const pending = store.findNodesByLabel("Solution").filter((s) => s.attrs["enrichmentPending"] === true).filter((s) => !opts.onlyUnsurfaced || s.attrs["enrichmentSurfaced"] !== true);
@@ -41441,7 +41567,7 @@ function takeEnrichmentNudge(store) {
 ` + items;
 }
 function takeDiscriminatorNudge(path2) {
-  if (!path2 || !existsSync13(path2)) return null;
+  if (!path2 || !existsSync14(path2)) return null;
   let shared;
   try {
     shared = openGraphStore({ path: path2 });
@@ -41572,10 +41698,10 @@ function showNode(store, node2, maxLines) {
   if (!relPath) return { found: false, reason: "no file owner for node" };
   const workspaceRoot = process.cwd();
   const absPath = resolve3(workspaceRoot, relPath);
-  if (!existsSync13(absPath)) {
+  if (!existsSync14(absPath)) {
     return { found: false, reason: `file not found on disk: ${absPath}` };
   }
-  const source = readFileSync11(absPath, "utf8");
+  const source = readFileSync12(absPath, "utf8");
   const attrs = node2.attrs;
   let startByte = attrs["bodyStartByte"] ?? attrs["startByte"];
   let endByte = attrs["bodyEndByte"] ?? attrs["endByte"];
@@ -41802,6 +41928,7 @@ function buildToolContext(workspaceRoot) {
   try {
     const cfg = loadConfig();
     const entry = workspaceRoot ? workspaceEntryForPath(resolve3(workspaceRoot)) : null;
+    const syncOk = effectiveConsent(cfg, entry ? loadProfile(entry.path) : null).sync;
     const identity = resolveWorkspaceIdentity(cfg, entry);
     if (identity.invalid) {
       console.error(`[errata mcp] cloud DISABLED for this workspace: ${identity.reason}`);
@@ -41809,13 +41936,13 @@ function buildToolContext(workspaceRoot) {
     }
     if (identity.rule === "workspace-binding" && identity.profileName) {
       const profile = identity.profile;
-      if (cfg.consent.sync && (profile.accessToken || profile.apiKey)) {
+      if (syncOk && (profile.accessToken || profile.apiKey)) {
         console.error(`[errata mcp] workspace identity: profile "${identity.profileName}"`);
         return { ...base, cloud: authedCloudClientForProfile(cfg, identity.profileName) };
       }
       return base;
     }
-    if (cfg.consent.sync && hasCloudCredential(cfg) && cfg.cloudUrl) {
+    if (syncOk && hasCloudCredential(cfg) && cfg.cloudUrl) {
       return { ...base, cloud: authedCloudClient(cfg) };
     }
   } catch {
@@ -41862,6 +41989,8 @@ var init_mcp = __esm({
     "use strict";
     init_cloud_auth();
     init_config();
+    init_consent();
+    init_profile2();
     init_identity2();
     init_registry();
     init_dual_augment();
@@ -42329,7 +42458,7 @@ var init_mcp = __esm({
           const local = causalChain(store, { seedId: id, direction: "both", maxHops, limit });
           try {
             const path2 = sharedStorePath();
-            if (!existsSync13(path2)) return { found: true, ...local };
+            if (!existsSync14(path2)) return { found: true, ...local };
             const shared = openGraphStore({ path: path2 });
             try {
               if (!shared.getNode(id)) return { found: true, ...local };
@@ -42929,7 +43058,7 @@ var init_mcp = __esm({
         inputSchema: { type: "object", properties: {} },
         handler: () => {
           const path2 = sharedStorePath();
-          if (!existsSync13(path2)) return { count: 0, pending: [] };
+          if (!existsSync14(path2)) return { count: 0, pending: [] };
           const shared = openGraphStore({ path: path2 });
           try {
             const pending = pendingAbstractions(shared);
@@ -42957,7 +43086,7 @@ var init_mcp = __esm({
         },
         handler: (args2) => {
           const path2 = sharedStorePath();
-          if (!existsSync13(path2)) return { count: 0, pending: [] };
+          if (!existsSync14(path2)) return { count: 0, pending: [] };
           const shared = openGraphStore({ path: path2 });
           try {
             const pending = pendingDiscriminators(shared, {
@@ -43001,7 +43130,7 @@ var init_mcp = __esm({
         },
         handler: (args2) => {
           const path2 = sharedStorePath();
-          if (!existsSync13(path2)) return { count: 0, routes: [] };
+          if (!existsSync14(path2)) return { count: 0, routes: [] };
           const shared = openGraphStore({ path: path2 });
           try {
             const result = triageOf(shared, {
@@ -43386,8 +43515,8 @@ __export(vfile_exports, {
   resolvePath: () => resolvePath,
   segmentsOf: () => segmentsOf
 });
-import { writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join14, resolve as resolve4, sep as sep3 } from "node:path";
+import { writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15, resolve as resolve4, sep as sep3 } from "node:path";
 function segmentsOf(rawPath) {
   let p = rawPath.replace(/\\/g, "/");
   p = p.replace(/^.*\.errata\/g\//, "").replace(/^\/?g\//, "").replace(/^\/+/, "");
@@ -43461,14 +43590,14 @@ async function renderVFile(rawPath, store, ctx = {}) {
 }
 async function materializeVFile(rawPath, workspaceRoot, store, ctx = {}) {
   const segs = segmentsOf(rawPath);
-  const gRoot = join14(workspaceRoot, ".errata", "g");
+  const gRoot = join15(workspaceRoot, ".errata", "g");
   const abs = resolve4(gRoot, ...segs.length ? segs : ["index"]);
   if (abs !== gRoot && !abs.startsWith(gRoot + sep3)) {
     throw new Error(`refusing to materialize outside .errata/g: ${rawPath}`);
   }
   const text = await renderVFile(rawPath, store, ctx);
   ensureParent(abs);
-  writeFileSync9(abs, text, "utf8");
+  writeFileSync10(abs, text, "utf8");
   return abs;
 }
 async function materializeOverview(workspaceRoot, store, ctx = {}) {
@@ -50888,25 +51017,25 @@ var init_tool_index = __esm({
 
 // src/outbox.ts
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   renameSync,
   unlinkSync,
-  writeFileSync as writeFileSync10
+  writeFileSync as writeFileSync11
 } from "node:fs";
-import { join as join15 } from "node:path";
-import { createHash as createHash12 } from "node:crypto";
+import { join as join16 } from "node:path";
+import { createHash as createHash13 } from "node:crypto";
 function enqueueOutbox(paths, payload) {
   ensureDir(paths.outbox);
-  const id = createHash12("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
-  const file2 = join15(paths.outbox, `${Date.now()}-${id}.json`);
-  writeFileSync10(file2, JSON.stringify(payload, null, 2), "utf8");
+  const id = createHash13("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+  const file2 = join16(paths.outbox, `${Date.now()}-${id}.json`);
+  writeFileSync11(file2, JSON.stringify(payload, null, 2), "utf8");
   return file2;
 }
 async function flushOutbox(paths, client, store) {
   ensureDir(paths.outbox);
-  const entries = existsSync14(paths.outbox) ? readdirSync5(paths.outbox) : [];
+  const entries = existsSync15(paths.outbox) ? readdirSync5(paths.outbox) : [];
   let uploaded = 0;
   let failed = 0;
   const quarantine = (abs, reason) => {
@@ -50917,10 +51046,10 @@ async function flushOutbox(paths, client, store) {
     }
   };
   for (const f of entries.filter((e) => e.endsWith(".json")).sort()) {
-    const abs = join15(paths.outbox, f);
+    const abs = join16(paths.outbox, f);
     let payload;
     try {
-      payload = JSON.parse(readFileSync12(abs, "utf8"));
+      payload = JSON.parse(readFileSync13(abs, "utf8"));
     } catch {
       failed++;
       quarantine(abs, "unparseable JSON");
@@ -50965,7 +51094,7 @@ async function flushOutbox(paths, client, store) {
       }
     }
   }
-  const remainingFiles = existsSync14(paths.outbox) ? readdirSync5(paths.outbox).filter((e) => e.endsWith(".json")) : [];
+  const remainingFiles = existsSync15(paths.outbox) ? readdirSync5(paths.outbox).filter((e) => e.endsWith(".json")) : [];
   return { uploaded, failed, remaining: remainingFiles.length };
 }
 var init_outbox = __esm({
@@ -73444,10 +73573,10 @@ init_src10();
 init_review2();
 
 // src/turn.ts
-import { closeSync, existsSync as existsSync15, fstatSync, openSync, readdirSync as readdirSync6, readSync, realpathSync, statSync as statSync5 } from "node:fs";
-import { basename as basename5, delimiter, dirname as dirname10, join as join18, normalize as normalize3 } from "node:path";
+import { closeSync, existsSync as existsSync16, fstatSync, openSync, readdirSync as readdirSync6, readSync, realpathSync, statSync as statSync5 } from "node:fs";
+import { basename as basename5, delimiter, dirname as dirname10, join as join19, normalize as normalize3 } from "node:path";
 import { homedir as homedir4 } from "node:os";
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 function readFrom(path2, fromByte, maxBytes) {
   let fd;
   try {
@@ -73823,11 +73952,11 @@ function turnsSince(turns, mark) {
   return at >= 0 ? turns.slice(at + 1) : turns;
 }
 function claudeProjectDir(cwd, home = homedir4()) {
-  return join18(home, ".claude", "projects", cwd.replace(/[\\/:.]/g, "-"));
+  return join19(home, ".claude", "projects", cwd.replace(/[\\/:.]/g, "-"));
 }
 function recentTranscripts(cwd, opts = {}) {
   const dir = claudeProjectDir(cwd, opts.home ?? homedir4());
-  if (!existsSync15(dir)) return [];
+  if (!existsSync16(dir)) return [];
   let names;
   try {
     names = readdirSync6(dir);
@@ -73838,7 +73967,7 @@ function recentTranscripts(cwd, opts = {}) {
   const refs = [];
   for (const name2 of names) {
     if (!name2.endsWith(".jsonl")) continue;
-    const path2 = join18(dir, name2);
+    const path2 = join19(dir, name2);
     let mtimeMs;
     try {
       mtimeMs = statSync5(path2).mtimeMs;
@@ -73853,8 +73982,8 @@ function recentTranscripts(cwd, opts = {}) {
 }
 function subagentTranscripts(mainTranscriptPath, sessionId) {
   if (!mainTranscriptPath || !sessionId) return [];
-  const dir = join18(dirname10(mainTranscriptPath), sessionId, "subagents");
-  if (!existsSync15(dir)) return [];
+  const dir = join19(dirname10(mainTranscriptPath), sessionId, "subagents");
+  if (!existsSync16(dir)) return [];
   let names;
   try {
     names = readdirSync6(dir);
@@ -73864,7 +73993,7 @@ function subagentTranscripts(mainTranscriptPath, sessionId) {
   const refs = [];
   for (const name2 of names) {
     if (!name2.endsWith(".jsonl")) continue;
-    const path2 = join18(dir, name2);
+    const path2 = join19(dir, name2);
     let mtimeMs;
     try {
       mtimeMs = statSync5(path2).mtimeMs;
@@ -73883,8 +74012,8 @@ function splitPathList(value, sep5 = delimiter) {
 function codexSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_CODEX_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["CODEX_HOME"]) roots.add(join18(env2["CODEX_HOME"], "sessions"));
-  roots.add(join18(home, ".codex", "sessions"));
+  if (env2["CODEX_HOME"]) roots.add(join19(env2["CODEX_HOME"], "sessions"));
+  roots.add(join19(home, ".codex", "sessions"));
   return [...roots];
 }
 function readCodexRolloutCwd(path2) {
@@ -73929,7 +74058,7 @@ function codexRolloutsForCwd(cwd, opts = {}) {
   const limit = opts.limit ?? 25;
   const out2 = [];
   for (const root of codexSessionRoots(opts.env, opts.home)) {
-    if (!existsSync15(root)) continue;
+    if (!existsSync16(root)) continue;
     const stack = [{ dir: root, depth: 0 }];
     while (stack.length > 0) {
       const { dir, depth } = stack.pop();
@@ -73940,7 +74069,7 @@ function codexRolloutsForCwd(cwd, opts = {}) {
         continue;
       }
       for (const name2 of names) {
-        const full = join18(dir, name2);
+        const full = join19(dir, name2);
         let st;
         try {
           st = statSync5(full);
@@ -73965,12 +74094,12 @@ function codexRolloutsForCwd(cwd, opts = {}) {
 function geminiSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_GEMINI_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["GEMINI_CLI_HOME"]) roots.add(join18(env2["GEMINI_CLI_HOME"], ".gemini", "tmp"));
-  roots.add(join18(home, ".gemini", "tmp"));
+  if (env2["GEMINI_CLI_HOME"]) roots.add(join19(env2["GEMINI_CLI_HOME"], ".gemini", "tmp"));
+  roots.add(join19(home, ".gemini", "tmp"));
   return [...roots];
 }
 function geminiProjectHash(cwd) {
-  return createHash13("sha256").update(cwd).digest("hex");
+  return createHash14("sha256").update(cwd).digest("hex");
 }
 function geminiHashesFor(cwd) {
   const variants = /* @__PURE__ */ new Set([cwd, cwd.replace(/\/+$/, "")]);
@@ -74006,7 +74135,7 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
   const hashes = geminiHashesFor(cwd);
   const out2 = [];
   for (const root of geminiSessionRoots(opts.env, opts.home)) {
-    if (!existsSync15(root)) continue;
+    if (!existsSync16(root)) continue;
     let slugs;
     try {
       slugs = readdirSync6(root);
@@ -74014,7 +74143,7 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
       continue;
     }
     for (const slug2 of slugs) {
-      const chats = join18(root, slug2, "chats");
+      const chats = join19(root, slug2, "chats");
       let names;
       try {
         names = readdirSync6(chats);
@@ -74023,7 +74152,7 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
       }
       for (const name2 of names) {
         if (!name2.startsWith("session-") || !name2.endsWith(".jsonl")) continue;
-        const full = join18(chats, name2);
+        const full = join19(chats, name2);
         let st;
         try {
           st = statSync5(full);
@@ -74043,8 +74172,8 @@ function geminiTranscriptsForCwd(cwd, opts = {}) {
 function opencodeSessionRoots(env2 = process.env, home = homedir4()) {
   const roots = /* @__PURE__ */ new Set();
   for (const d of splitPathList(env2["ERRATA_OPENCODE_SESSIONS_DIRS"])) roots.add(d);
-  if (env2["XDG_DATA_HOME"]) roots.add(join18(env2["XDG_DATA_HOME"], "opencode", "errata"));
-  roots.add(join18(home, ".local", "share", "opencode", "errata"));
+  if (env2["XDG_DATA_HOME"]) roots.add(join19(env2["XDG_DATA_HOME"], "opencode", "errata"));
+  roots.add(join19(home, ".local", "share", "opencode", "errata"));
   return [...roots];
 }
 function readOpencodeTranscriptDirectory(path2) {
@@ -74077,7 +74206,7 @@ function opencodeTranscriptsForCwd(cwd, opts = {}) {
   }
   const out2 = [];
   for (const root of opencodeSessionRoots(opts.env, opts.home)) {
-    if (!existsSync15(root)) continue;
+    if (!existsSync16(root)) continue;
     let names;
     try {
       names = readdirSync6(root);
@@ -74086,7 +74215,7 @@ function opencodeTranscriptsForCwd(cwd, opts = {}) {
     }
     for (const name2 of names) {
       if (!name2.endsWith(".jsonl")) continue;
-      const full = join18(root, name2);
+      const full = join19(root, name2);
       let st;
       try {
         st = statSync5(full);
@@ -74109,7 +74238,7 @@ init_src2();
 init_agent_signals();
 init_tool_index();
 init_src5();
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync11 } from "node:fs";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync12 } from "node:fs";
 var NEG = /n['']t|\b(?:not|never|no|none|neither|nor|unrelated|irrelevant|would|might|could|if)\b/i;
 var CITE_GROUP_RE = /\(((?:[^()\n]|\([^()\n]*\)){1,200})\)/g;
 var HANDLE_RE = /\[([a-z0-9][\w-]{0,80})\]|((?:pat|sol|drc|dcause|dfix|dprob|prob|claim|err)_[0-9a-f]{6,})/gi;
@@ -74788,13 +74917,13 @@ function writePrimingHandles(path2, nodes, now = Date.now()) {
       entries.sort((a, b) => (b[1].seenAt ?? 0) - (a[1].seenAt ?? 0));
       entries.length = HANDLE_MAP_MAX;
     }
-    writeFileSync11(path2, JSON.stringify(Object.fromEntries(entries)));
+    writeFileSync12(path2, JSON.stringify(Object.fromEntries(entries)));
   } catch {
   }
 }
 function readPrimingHandles(path2) {
   try {
-    return JSON.parse(readFileSync13(path2, "utf8"));
+    return JSON.parse(readFileSync14(path2, "utf8"));
   } catch {
     return {};
   }
@@ -75269,8 +75398,8 @@ ${conversation}` }]
 // src/constraint-backfill.ts
 init_src5();
 init_src2();
-import { existsSync as existsSync16, readFileSync as readFileSync14, readdirSync as readdirSync7, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync15, readdirSync as readdirSync7, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join20 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 var BACKFILL_VERSION = 1;
 var EMPTY = {
@@ -75284,13 +75413,13 @@ var EMPTY = {
   recoverable: 0
 };
 function markerPath(configDir) {
-  return join19(configDir, "constraint-backfill.json");
+  return join20(configDir, "constraint-backfill.json");
 }
 function alreadyDone(configDir) {
   const p = markerPath(configDir);
-  if (!existsSync16(p)) return false;
+  if (!existsSync17(p)) return false;
   try {
-    const raw2 = JSON.parse(readFileSync14(p, "utf8"));
+    const raw2 = JSON.parse(readFileSync15(p, "utf8"));
     return raw2?.version === BACKFILL_VERSION;
   } catch {
     return false;
@@ -75300,7 +75429,7 @@ function replay(root) {
   const statements = /* @__PURE__ */ new Set();
   const citedByFix = /* @__PURE__ */ new Set();
   const dir = claudeProjectDir(root, homedir5());
-  if (!existsSync16(dir)) return { statements, citedByFix };
+  if (!existsSync17(dir)) return { statements, citedByFix };
   let names;
   try {
     names = readdirSync7(dir).filter((n) => n.endsWith(".jsonl"));
@@ -75310,7 +75439,7 @@ function replay(root) {
   for (const f of names) {
     let lines;
     try {
-      lines = readFileSync14(join19(dir, f), "utf8").split("\n");
+      lines = readFileSync15(join20(dir, f), "utf8").split("\n");
     } catch {
       continue;
     }
@@ -75424,7 +75553,7 @@ function backfillConstraintKind(store, opts) {
     }
   });
   try {
-    writeFileSync12(
+    writeFileSync13(
       markerPath(opts.configDir),
       JSON.stringify({ version: BACKFILL_VERSION, at: opts.now, ...report, cloudTwins: report.cloudTwins.length }, null, 2),
       "utf8"
@@ -75437,8 +75566,8 @@ function backfillConstraintKind(store, opts) {
 // src/edge-repair.ts
 init_src();
 init_src5();
-import { existsSync as existsSync17, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync16, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join21 } from "node:path";
 function citeEdgeId(from, type, to) {
   return `edge_${digest({ from, type, to })}`.slice(0, 24);
 }
@@ -75453,13 +75582,13 @@ var EMPTY2 = {
   byType: {}
 };
 function markerPath2(configDir) {
-  return join20(configDir, "edge-repair.json");
+  return join21(configDir, "edge-repair.json");
 }
 function alreadyDone2(configDir) {
   const p = markerPath2(configDir);
-  if (!existsSync17(p)) return false;
+  if (!existsSync18(p)) return false;
   try {
-    return JSON.parse(readFileSync15(p, "utf8"))?.version === EDGE_REPAIR_VERSION;
+    return JSON.parse(readFileSync16(p, "utf8"))?.version === EDGE_REPAIR_VERSION;
   } catch {
     return false;
   }
@@ -75508,7 +75637,7 @@ function repairInvalidEdges(store, opts) {
   });
   store.pruneEdgeRejections(opts.now - REJECTION_RETENTION_MS);
   try {
-    writeFileSync13(
+    writeFileSync14(
       markerPath2(opts.configDir),
       JSON.stringify({ version: EDGE_REPAIR_VERSION, at: opts.now, ...report }, null, 2),
       "utf8"
@@ -75522,8 +75651,8 @@ function repairInvalidEdges(store, opts) {
 init_reconcile();
 
 // src/pass-ledger.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync18, readFileSync as readFileSync16, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join21 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync19, readFileSync as readFileSync17, writeFileSync as writeFileSync15 } from "node:fs";
+import { join as join22 } from "node:path";
 
 // src/isolate-census.ts
 var live = 0;
@@ -75546,7 +75675,7 @@ var PER_KIND_MAX = 100;
 var TRIM_EVERY = 50;
 var appendsSinceTrim = /* @__PURE__ */ new Map();
 function passLedgerPath(configDir) {
-  return join21(configDir, "pass-ledger.jsonl");
+  return join22(configDir, "pass-ledger.jsonl");
 }
 function appendPassLedger(configDir, kind, durationMs, counts) {
   const path2 = passLedgerPath(configDir);
@@ -75575,7 +75704,7 @@ function appendPassLedger(configDir, kind, durationMs, counts) {
       return;
     }
     appendsSinceTrim.set(path2, 0);
-    const lines = readFileSync16(path2, "utf8").split("\n").filter(Boolean);
+    const lines = readFileSync17(path2, "utf8").split("\n").filter(Boolean);
     const keptByKind = /* @__PURE__ */ new Map();
     const kept = [];
     for (let i2 = lines.length - 1; i2 >= 0; i2--) {
@@ -75591,16 +75720,16 @@ function appendPassLedger(configDir, kind, durationMs, counts) {
       kept.push(lines[i2]);
     }
     if (kept.length < lines.length) {
-      writeFileSync14(path2, kept.reverse().join("\n") + "\n");
+      writeFileSync15(path2, kept.reverse().join("\n") + "\n");
     }
   } catch {
   }
 }
 function readPassLedger(configDir) {
   const path2 = passLedgerPath(configDir);
-  if (!existsSync18(path2)) return [];
+  if (!existsSync19(path2)) return [];
   try {
-    return readFileSync16(path2, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l)).filter(
+    return readFileSync17(path2, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l)).filter(
       (e) => typeof e?.ts === "number" && typeof e?.kind === "string" && typeof e?.durationMs === "number"
     ).map((e) => ({ ...e, counts: e.counts ?? {} }));
   } catch {
@@ -75968,11 +76097,11 @@ init_outbox();
 init_src9();
 init_src();
 init_src2();
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join22 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join23 } from "node:path";
 function loadClaimIgnorePatterns(workspaceRoot) {
   try {
-    return readFileSync17(join22(workspaceRoot, ".errataignore"), "utf8").split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#")).map((l) => l.toLowerCase());
+    return readFileSync18(join23(workspaceRoot, ".errataignore"), "utf8").split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#")).map((l) => l.toLowerCase());
   } catch {
     return [];
   }
@@ -76335,9 +76464,9 @@ async function pullCloudTriage(shared, cloud, profile, limit = 50) {
 // src/retrieval-stack.ts
 init_src();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync18, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync19, statSync as statSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var RETRIEVAL_STACK_CAP = 24;
 var MANIFEST_SCAN_CAP = 400;
 var RUNTIME_TOKENS = /* @__PURE__ */ new Set([
@@ -76627,51 +76756,51 @@ function mavenGroupIsSelfDisclosing(name2, selfTokens) {
 function loadRegistryPolicy(root, env2 = process.env, repoLocator) {
   const read2 = (p) => {
     try {
-      return readFileSync18(p, "utf8");
+      return readFileSync19(p, "utf8");
     } catch {
       return null;
     }
   };
   const texts = (...paths) => paths.map(read2).filter((t) => t !== null);
   const home = homedir6();
-  const npm = parseNpmrcPolicy(texts(join23(root, ".npmrc"), join23(home, ".npmrc")));
+  const npm = parseNpmrcPolicy(texts(join24(root, ".npmrc"), join24(home, ".npmrc")));
   const blocked = /* @__PURE__ */ new Set();
   if (!npm.defaultPublic) blocked.add("npm");
   if (pypiIndexIsPrivate(
     texts(
-      join23(root, "pip.conf"),
-      join23(root, "pip.ini"),
-      join23(root, "pyproject.toml"),
-      join23(root, "requirements.txt"),
-      join23(home, ".pip", "pip.conf"),
-      join23(home, ".config", "pip", "pip.conf"),
-      join23(env2["APPDATA"] ?? home, "pip", "pip.ini")
+      join24(root, "pip.conf"),
+      join24(root, "pip.ini"),
+      join24(root, "pyproject.toml"),
+      join24(root, "requirements.txt"),
+      join24(home, ".pip", "pip.conf"),
+      join24(home, ".config", "pip", "pip.conf"),
+      join24(env2["APPDATA"] ?? home, "pip", "pip.ini")
     )
   )) {
     blocked.add("pypi");
   }
   if (cargoRegistryIsPrivate(
     texts(
-      join23(root, ".cargo", "config.toml"),
-      join23(root, ".cargo", "config"),
-      join23(home, ".cargo", "config.toml"),
-      join23(home, ".cargo", "config")
+      join24(root, ".cargo", "config.toml"),
+      join24(root, ".cargo", "config"),
+      join24(home, ".cargo", "config.toml"),
+      join24(home, ".cargo", "config")
     )
   )) {
     blocked.add("cargo");
   }
   if (nugetSourcesArePrivate(
     texts(
-      join23(root, "NuGet.config"),
-      join23(root, "nuget.config"),
-      join23(root, "NuGet.Config"),
-      join23(env2["APPDATA"] ?? home, "NuGet", "NuGet.Config"),
-      join23(home, ".nuget", "NuGet", "NuGet.Config")
+      join24(root, "NuGet.config"),
+      join24(root, "nuget.config"),
+      join24(root, "NuGet.Config"),
+      join24(env2["APPDATA"] ?? home, "NuGet", "NuGet.Config"),
+      join24(home, ".nuget", "NuGet", "NuGet.Config")
     )
   )) {
     blocked.add("nuget");
   }
-  const goEnvFile = env2["GOENV"] ?? join23(env2["APPDATA"] ?? join23(home, ".config"), "go", "env");
+  const goEnvFile = env2["GOENV"] ?? join24(env2["APPDATA"] ?? join24(home, ".config"), "go", "env");
   const goEnvText = read2(goEnvFile) ?? "";
   const fromFile = ["GOPRIVATE", "GONOSUMDB", "GONOSUMCHECK"].map(
     (k) => new RegExp(`^${k}=(.*)$`, "m").exec(goEnvText)?.[1]
@@ -76682,10 +76811,10 @@ function loadRegistryPolicy(root, env2 = process.env, repoLocator) {
     env2["GONOSUMCHECK"],
     ...fromFile
   ]);
-  const gemfiles = texts(join23(root, "Gemfile"));
+  const gemfiles = texts(join24(root, "Gemfile"));
   if (gemSourceIsPrivate(gemfiles)) blocked.add("gem");
   if (mavenReposArePrivate(
-    texts(join23(root, "pom.xml"), join23(home, ".m2", "settings.xml"))
+    texts(join24(root, "pom.xml"), join24(home, ".m2", "settings.xml"))
   )) {
     blocked.add("maven");
   }
@@ -76852,8 +76981,8 @@ function readDirectDependencies(root) {
   const familiesSeen = /* @__PURE__ */ new Set();
   for (const c of LOCKFILES) {
     if (familiesSeen.has(c.family)) continue;
-    const p = join23(root, c.file);
-    if (!existsSync19(p)) continue;
+    const p = join24(root, c.file);
+    if (!existsSync20(p)) continue;
     try {
       const s = statSync6(p);
       stamps.push(`${c.file}:${s.mtimeMs}:${s.size}`);
@@ -76873,7 +77002,7 @@ function readDirectDependencies(root) {
   const direct = [];
   for (const { c, path: path2 } of found) {
     try {
-      direct.push(...c.parse(readFileSync18(path2, "utf8")).direct ?? []);
+      direct.push(...c.parse(readFileSync19(path2, "utf8")).direct ?? []);
     } catch {
     }
   }
@@ -76916,14 +77045,14 @@ function manifestPaths(root) {
     "project.godot"
   ];
   return {
-    paths: ROOT_MANIFESTS.filter((f) => existsSync19(join23(root, f))),
+    paths: ROOT_MANIFESTS.filter((f) => existsSync20(join24(root, f))),
     tracked: false,
     truncated: false
   };
 }
 var WORKSPACE_MARKERS = ["pnpm-workspace.yaml", "lerna.json", "go.work", "settings.gradle", "settings.gradle.kts"];
 function rootDeclaresWorkspace(root, texts) {
-  if (WORKSPACE_MARKERS.some((f) => existsSync19(join23(root, f)))) return true;
+  if (WORKSPACE_MARKERS.some((f) => existsSync20(join24(root, f)))) return true;
   return /"workspaces"\s*:/.test(texts.get("package.json") ?? "") || /<modules>/.test(texts.get("pom.xml") ?? "") || /^\s*\[workspace\]/m.test(texts.get("Cargo.toml") ?? "");
 }
 var EMPTY_SCAN = { deps: [], self: [], complete: true };
@@ -76937,11 +77066,11 @@ function scanManifests(root) {
   const texts = /* @__PURE__ */ new Map();
   const stamps = [];
   for (const rel of paths) {
-    const abs = join23(root, rel);
+    const abs = join24(root, rel);
     try {
       const s = statSync6(abs);
       stamps.push(`${rel}:${s.mtimeMs}:${s.size}`);
-      texts.set(rel, readFileSync18(abs, "utf8"));
+      texts.set(rel, readFileSync19(abs, "utf8"));
     } catch {
     }
   }
@@ -76970,22 +77099,22 @@ function readManifestDependencies(root) {
 }
 
 // src/git-sensor.ts
-import { existsSync as existsSync20, readFileSync as readFileSync19, watch as fsWatch } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync20, watch as fsWatch } from "node:fs";
+import { join as join25 } from "node:path";
 function readFirstLine(path2) {
   try {
-    return readFileSync19(path2, "utf8").split(/\r?\n/, 1)[0].trim();
+    return readFileSync20(path2, "utf8").split(/\r?\n/, 1)[0].trim();
   } catch {
     return null;
   }
 }
 function readGitRefState(gitDir) {
-  const head2 = readFirstLine(join24(gitDir, "HEAD"));
+  const head2 = readFirstLine(join25(gitDir, "HEAD"));
   const m = head2 ? /^ref:\s*refs\/heads\/(.+)$/.exec(head2) : null;
   const branch = m ? m[1] : null;
   let sha2 = null;
   if (branch) {
-    sha2 = readFirstLine(join24(gitDir, "refs", "heads", branch));
+    sha2 = readFirstLine(join25(gitDir, "refs", "heads", branch));
     if (!sha2) sha2 = shaFromPackedRefs(gitDir, `refs/heads/${branch}`);
   } else if (head2 && /^[0-9a-f]{7,40}$/i.test(head2)) {
     sha2 = head2;
@@ -76993,13 +77122,13 @@ function readGitRefState(gitDir) {
   return {
     branch,
     sha: sha2,
-    mergeHeadExists: existsSync20(join24(gitDir, "MERGE_HEAD")),
-    origHeadExists: existsSync20(join24(gitDir, "ORIG_HEAD"))
+    mergeHeadExists: existsSync21(join25(gitDir, "MERGE_HEAD")),
+    origHeadExists: existsSync21(join25(gitDir, "ORIG_HEAD"))
   };
 }
 function shaFromPackedRefs(gitDir, ref) {
   try {
-    for (const line of readFileSync19(join24(gitDir, "packed-refs"), "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync20(join25(gitDir, "packed-refs"), "utf8").split(/\r?\n/)) {
       const [sha2, name2] = line.split(/\s+/);
       if (name2 === ref && sha2) return sha2;
     }
@@ -77033,7 +77162,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
   const settle = () => {
     if (timer) clearTimeout(timer);
     timer = setTimeout(() => {
-      if (existsSync20(join24(gitDir, "index.lock"))) {
+      if (existsSync21(join25(gitDir, "index.lock"))) {
         settle();
         return;
       }
@@ -77044,7 +77173,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
     }, debounceMs);
   };
   for (const sub of ["HEAD", "logs/HEAD", "MERGE_HEAD", "ORIG_HEAD"]) {
-    const p = join24(gitDir, sub);
+    const p = join25(gitDir, sub);
     try {
       watchers.push(fsWatch(p, settle));
     } catch {
@@ -77269,21 +77398,21 @@ var TelemetryRecorder = class {
 
 // src/skills.ts
 import {
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync8,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync15
+  writeFileSync as writeFileSync16
 } from "node:fs";
-import { basename as basename6, join as join25 } from "node:path";
+import { basename as basename6, join as join26 } from "node:path";
 function skillFileName(id) {
   return `${id.replace(/[^A-Za-z0-9_.-]/g, "_")}.md`;
 }
 function readSkillManifest(manifestPath) {
-  if (!existsSync21(manifestPath)) return [];
+  if (!existsSync22(manifestPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync20(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync21(manifestPath, "utf8"));
     return (parsed.skills ?? []).map((s) => ({
       title: s.title ?? "",
       layer: s.layer ?? "technique",
@@ -77307,7 +77436,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
   for (const s of res.skills) {
     const fileName = skillFileName(s.id);
     keep.add(fileName);
-    writeFileSync15(join25(paths.skillsDir, fileName), s.markdown, "utf8");
+    writeFileSync16(join26(paths.skillsDir, fileName), s.markdown, "utf8");
     rows.push({
       id: s.id,
       title: s.title,
@@ -77320,7 +77449,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     const fileName = skillFileName(p.id);
     if (keep.has(fileName)) continue;
     keep.add(fileName);
-    writeFileSync15(join25(paths.skillsDir, fileName), p.markdown, "utf8");
+    writeFileSync16(join26(paths.skillsDir, fileName), p.markdown, "utf8");
     rows.push({
       id: p.id,
       title: p.title,
@@ -77334,13 +77463,13 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     if (!f.endsWith(".md")) continue;
     if (keep.has(basename6(f))) continue;
     try {
-      unlinkSync2(join25(paths.skillsDir, f));
+      unlinkSync2(join26(paths.skillsDir, f));
       pruned++;
     } catch {
     }
   }
   rows.sort((a, b) => a.id.localeCompare(b.id));
-  writeFileSync15(
+  writeFileSync16(
     paths.skillsManifest,
     JSON.stringify({ generatedAt: Date.now(), skills: rows }, null, 2),
     "utf8"
@@ -77352,22 +77481,22 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
 init_src2();
 import {
   cpSync,
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   lstatSync,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   readdirSync as readdirSync9,
   rmSync as rmSync3,
   symlinkSync,
-  writeFileSync as writeFileSync16
+  writeFileSync as writeFileSync17
 } from "node:fs";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 var SKILL_NS = "errata-";
 var HARNESS_SKILL_DIRS = [
-  { configDir: ".claude", skillsDir: join26(".claude", "skills") },
+  { configDir: ".claude", skillsDir: join27(".claude", "skills") },
   // Cursor adopted the standard; its exact project dir is still moving — kept
   // best-effort and gated on `.cursor/` presence so we never create it blind.
-  { configDir: ".cursor", skillsDir: join26(".cursor", "skills") }
+  { configDir: ".cursor", skillsDir: join27(".cursor", "skills") }
 ];
 function skillSlug(title, id) {
   const base = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || id.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
@@ -77412,12 +77541,12 @@ function skillCiteHandle(s) {
   return priorHandle({ id: s.id, description: s.title });
 }
 function reconcileNamespaced(dir, keep) {
-  if (!existsSync22(dir)) return 0;
+  if (!existsSync23(dir)) return 0;
   let pruned = 0;
   for (const name2 of readdirSync9(dir)) {
     if (!name2.startsWith(SKILL_NS) || keep.has(name2)) continue;
     try {
-      rmSync3(join26(dir, name2), { recursive: true, force: true });
+      rmSync3(join27(dir, name2), { recursive: true, force: true });
       pruned++;
     } catch {
     }
@@ -77426,7 +77555,7 @@ function reconcileNamespaced(dir, keep) {
 }
 function linkOrCopy(linkPath, target) {
   try {
-    if (existsSync22(linkPath) || safeLstat(linkPath)) rmSync3(linkPath, { recursive: true, force: true });
+    if (existsSync23(linkPath) || safeLstat(linkPath)) rmSync3(linkPath, { recursive: true, force: true });
   } catch {
   }
   try {
@@ -77447,7 +77576,7 @@ function safeLstat(p) {
   }
 }
 function emitAndProjectSkills(root, skills) {
-  const agentsSkillsDir = join26(root, ".agents", "skills");
+  const agentsSkillsDir = join27(root, ".agents", "skills");
   mkdirSync8(agentsSkillsDir, { recursive: true });
   const slugs = [];
   const keep = /* @__PURE__ */ new Set();
@@ -77455,7 +77584,7 @@ function emitAndProjectSkills(root, skills) {
   for (const s of skills) {
     let body2;
     try {
-      body2 = readFileSync21(s.bodyPath, "utf8");
+      body2 = readFileSync22(s.bodyPath, "utf8");
     } catch {
       continue;
     }
@@ -77464,9 +77593,9 @@ function emitAndProjectSkills(root, skills) {
     keep.add(slug2);
     slugs.push(slug2);
     const description = deriveDescription(s.title, s.layer, body2);
-    mkdirSync8(join26(agentsSkillsDir, slug2), { recursive: true });
-    writeFileSync16(
-      join26(agentsSkillsDir, slug2, "SKILL.md"),
+    mkdirSync8(join27(agentsSkillsDir, slug2), { recursive: true });
+    writeFileSync17(
+      join27(agentsSkillsDir, slug2, "SKILL.md"),
       renderSkillMd(slug2, description, body2, skillCiteHandle(s)),
       "utf8"
     );
@@ -77475,11 +77604,11 @@ function emitAndProjectSkills(root, skills) {
   reconcileNamespaced(agentsSkillsDir, keep);
   let projected = 0;
   for (const h of HARNESS_SKILL_DIRS) {
-    if (!existsSync22(join26(root, h.configDir))) continue;
-    const dir = join26(root, h.skillsDir);
+    if (!existsSync23(join27(root, h.configDir))) continue;
+    const dir = join27(root, h.skillsDir);
     mkdirSync8(dir, { recursive: true });
     for (const slug2 of slugs) {
-      linkOrCopy(join26(dir, slug2), join26(agentsSkillsDir, slug2));
+      linkOrCopy(join27(dir, slug2), join27(agentsSkillsDir, slug2));
       projected++;
     }
     reconcileNamespaced(dir, keep);
@@ -77488,15 +77617,15 @@ function emitAndProjectSkills(root, skills) {
   return { slugs, emitted, projected };
 }
 function emitInputsFromManifest(erretaDir, manifestPath) {
-  if (!existsSync22(manifestPath)) return [];
+  if (!existsSync23(manifestPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync21(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync22(manifestPath, "utf8"));
     return (parsed.skills ?? []).filter((s) => Boolean(s.id && s.file)).map((s) => ({
       id: s.id,
       title: s.title ?? s.id,
       layer: s.layer ?? "technique",
       confidence: s.confidence ?? 0,
-      bodyPath: join26(erretaDir, s.file)
+      bodyPath: join27(erretaDir, s.file)
     }));
   } catch {
     return [];
@@ -77510,17 +77639,17 @@ var GITIGNORE_LINES = [
   ".cursor/skills/errata-*/"
 ];
 function ensureSkillGitignore(root) {
-  const path2 = join26(root, ".gitignore");
+  const path2 = join27(root, ".gitignore");
   let current = "";
   try {
-    current = existsSync22(path2) ? readFileSync21(path2, "utf8") : "";
+    current = existsSync23(path2) ? readFileSync22(path2, "utf8") : "";
   } catch {
     return;
   }
   if (current.includes(GITIGNORE_MARK)) return;
   const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
   try {
-    writeFileSync16(path2, `${current}${prefix}
+    writeFileSync17(path2, `${current}${prefix}
 ${GITIGNORE_LINES.join("\n")}
 `, "utf8");
   } catch {
@@ -77613,108 +77742,7 @@ function createToolRunState() {
 // src/engine.ts
 init_tool_index();
 init_paths();
-
-// src/profile.ts
-init_src2();
-init_paths();
-init_git_remote();
-import { existsSync as existsSync23, readFileSync as readFileSync22, writeFileSync as writeFileSync17 } from "node:fs";
-import { createHash as createHash14 } from "node:crypto";
-import { join as join27 } from "node:path";
-function workspaceId(root) {
-  return "wp_" + createHash14("sha256").update(root).digest("hex").slice(0, 12);
-}
-function sessionOriginKey(sessionId) {
-  if (!sessionId) return void 0;
-  return "ws_" + createHash14("sha256").update(sessionId).digest("hex").slice(0, 12);
-}
-function refreshRepoLocator(root, profile) {
-  const detected = detectRepoLocator(root, profile.repoRemote);
-  if (!detected || detected === profile.repoLocator) return false;
-  if (profile.repoLocator) {
-    const aliases = new Set(profile.repoLocatorAliases ?? []);
-    aliases.add(profile.repoLocator);
-    aliases.delete(detected);
-    profile.repoLocatorAliases = [...aliases];
-  }
-  profile.repoLocator = detected;
-  saveProfile(root, profile);
-  return true;
-}
-function loadProfile(root) {
-  const p = workspacePaths(root);
-  if (!existsSync23(p.workspaceJson)) return null;
-  return JSON.parse(readFileSync22(p.workspaceJson, "utf8"));
-}
-function saveProfile(root, profile) {
-  const p = workspacePaths(root);
-  ensureDir(p.configDir);
-  writeFileSync17(p.workspaceJson, JSON.stringify(profile, null, 2), "utf8");
-}
-function autodetectProfile(root) {
-  const id = workspaceId(root);
-  const name2 = root.split(/[\\/]/).filter(Boolean).pop() ?? "workspace";
-  const p = emptyProfile(id, name2);
-  const locator = detectRepoLocator(root);
-  if (locator) p.repoLocator = locator;
-  const pkgPath = join27(root, "package.json");
-  if (existsSync23(pkgPath)) {
-    try {
-      const pkg = JSON.parse(readFileSync22(pkgPath, "utf8"));
-      const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
-      p.languages.push("javascript");
-      if (existsSync23(join27(root, "tsconfig.json")) || deps["typescript"]) {
-        p.languages.push("typescript");
-      }
-      const nodeVer = pkg.engines?.node?.trim();
-      p.stack.push(nodeVer ? `node@${nodeVer}` : "node");
-      const interesting = [
-        "next",
-        "react",
-        "vue",
-        "svelte",
-        "express",
-        "hono",
-        "fastify",
-        "@modelcontextprotocol/sdk"
-      ];
-      for (const k of interesting) {
-        if (deps[k]) p.stack.push(k);
-      }
-    } catch {
-    }
-  }
-  const pyproject = join27(root, "pyproject.toml");
-  if (existsSync23(pyproject)) {
-    try {
-      const txt = readFileSync22(pyproject, "utf8");
-      const py = /python\s*=\s*"([^"]+)"/.exec(txt)?.[1];
-      p.languages.push("python");
-      p.stack.push(`python@${py ?? "3"}`);
-      const candidates = ["fastapi", "django", "flask", "mcp", "pytest"];
-      for (const k of candidates) {
-        if (new RegExp(`\\b${k}\\b`, "i").test(txt)) p.stack.push(k);
-      }
-    } catch {
-    }
-  }
-  const reqs = join27(root, "requirements.txt");
-  if (existsSync23(reqs)) {
-    if (!p.languages.includes("python")) p.languages.push("python");
-    if (!p.stack.includes("python@3")) p.stack.push("python@3");
-  }
-  if (existsSync23(join27(root, "go.mod"))) {
-    p.languages.push("go");
-    p.stack.push("go");
-  }
-  if (existsSync23(join27(root, "Cargo.toml"))) {
-    p.languages.push("rust");
-    p.stack.push("rust");
-  }
-  p.languages = [...new Set(p.languages)];
-  p.stack = [...new Set(p.stack)];
-  return p;
-}
+init_profile2();
 
 // src/witness-queue.ts
 import { readFileSync as readFileSync23, renameSync as renameSync2, writeFileSync as writeFileSync18 } from "node:fs";
@@ -77915,7 +77943,9 @@ var CausalBuffer = class {
 };
 
 // src/engine.ts
+init_profile2();
 init_config();
+init_consent();
 init_cloud_auth();
 
 // src/notify.ts
@@ -78332,7 +78362,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.6-dev.2563" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.6-dev.2568" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -78439,6 +78469,7 @@ function createWorkspaceEngine(opts) {
   } else {
     refreshRepoLocator(opts.workspaceRoot, profile);
   }
+  const consentNow = () => effectiveConsent(loadConfig(), profile);
   const store = openGraphStore({ path: paths.castalia });
   const witnessLoad = loadWitnessQueueWithLosses(witnessQueuePath(paths.configDir));
   const witnessPrune = pruneWitnessQueueWithDispositions(witnessLoad.queue, Date.now());
@@ -78867,7 +78898,7 @@ function createWorkspaceEngine(opts) {
     // resolves each token against both the Package and Language namespaces,
     // and the profile keeps them in separate fields.
     languages: profile?.languages ?? [],
-    contributePackages: loadConfig().consent.contributePackages,
+    contributePackages: consentNow().contributePackages,
     // `repoLocator` feeds the Maven self-disclosure rule ONLY: a groupId
     // carrying this project's own owner/repo token is the project naming
     // itself, not a library it depends on.
@@ -78878,7 +78909,7 @@ function createWorkspaceEngine(opts) {
     if (opts.skipContextWriter || remoteInFlight) return;
     const now = Date.now();
     if (now - lastRemoteAt < REMOTE_REFRESH_MS) return;
-    const syncOk = opts.syncConsent ?? loadConfig().consent.sync;
+    const syncOk = opts.syncConsent ?? consentNow().sync;
     if (!syncOk) return;
     if (typeof cloud.search !== "function") return;
     remoteInFlight = true;
@@ -78918,7 +78949,7 @@ function createWorkspaceEngine(opts) {
   const maybeRefreshIntentPriors = (liveIntent) => {
     if (!liveIntent || opts.skipContextWriter || intentRemoteInFlight) return;
     if (intentRemote?.forIntent === liveIntent) return;
-    const syncOk = opts.syncConsent ?? loadConfig().consent.sync;
+    const syncOk = opts.syncConsent ?? consentNow().sync;
     if (!syncOk) return;
     if (typeof cloud.search !== "function") return;
     intentRemoteInFlight = true;
@@ -80224,7 +80255,7 @@ B: ${b}`,
     });
   }
   const pullSkills = async () => {
-    if ((opts.syncConsent ?? loadConfig().consent.sync) === true) {
+    if ((opts.syncConsent ?? consentNow().sync) === true) {
       for (const req of communityInductionRequests(store)) {
         try {
           const r = await cloud.induceSkill({ members: req.members, context: req.context });
@@ -80244,7 +80275,7 @@ B: ${b}`,
     const pins = profile?.projectId ? await cloud.getSkillPins(profile.projectId).then((r) => r.pins).catch(() => []) : [];
     const anchorMap = buildBucketTokenAnchors(
       profile.languages ?? [],
-      loadConfig().consent.contributePackages ? store.findNodesByLabel("Package").map((p) => ({
+      consentNow().contributePackages ? store.findNodesByLabel("Package").map((p) => ({
         name: String(p.attrs["name"] ?? ""),
         purl: String(p.attrs["purl"] ?? p.id)
       })) : []
@@ -80550,7 +80581,7 @@ B: ${b}`,
       };
     },
     async syncNow() {
-      const syncOk = opts.syncConsent ?? loadConfig().consent.sync;
+      const syncOk = opts.syncConsent ?? consentNow().sync;
       if (!syncOk) {
         console.log(
           "[errata] sync skipped \u2014 cloud sync consent is off (enable with `errata consent sync on`)"
@@ -80581,14 +80612,14 @@ B: ${b}`,
       }
       try {
         const freshCfg = loadConfig();
-        if (freshCfg.consent.telemetry) {
+        if (consentNow().telemetry) {
           telemetry.event("graph_snapshot", store.nodeCount(), {
             problemsLive: store.findNodesByLabel("Problem").length
           });
           telemetry.event("heartbeat");
         }
         const t = await telemetry.flush(cloud, {
-          consent: freshCfg.consent.telemetry,
+          consent: consentNow().telemetry,
           credentialPresent: Boolean(opts.apiKey) || hasCloudCredential(freshCfg)
         });
         if (t.sent > 0) {
@@ -80950,6 +80981,9 @@ function noveltyAgainst(node2, neighbors, opts = {}) {
   };
 }
 
+// src/instance-ingest.ts
+init_profile2();
+
 // src/public-symbols.ts
 import { readFileSync as readFileSync27, readdirSync as readdirSync11, existsSync as existsSync28 } from "node:fs";
 import { join as join32 } from "node:path";
@@ -81969,6 +82003,7 @@ function liveCloudClient(src) {
 init_identity2();
 
 // src/project-link.ts
+init_profile2();
 async function ensureProjectLink(root, profile, client) {
   if (profile.projectLinkDisabled) return { linked: false, reason: "disabled" };
   const locator = profile.repoLocator;
@@ -81993,10 +82028,12 @@ async function ensureProjectLink(root, profile, client) {
 
 // src/project-hydrate.ts
 init_src11();
+init_profile2();
 
 // src/project-reanchor.ts
 init_src();
 init_src11();
+init_profile2();
 var DEFAULT_LIMIT = 50;
 var ANCHOR_SYMBOL_KINDS2 = [
   "Function",
@@ -83712,6 +83749,7 @@ async function buildUnitBundle(root, unit, opts = {}) {
 }
 
 // src/project-history.ts
+init_profile2();
 var execFileAsync = promisify(execFile3);
 var HISTORY_EXTRACTOR_VERSION = "history-1";
 var LEASE_POLL_MS = 2e4;
@@ -84452,18 +84490,16 @@ fixtures/
 *.sql.gz
 `;
 function applyConsents(profile, config2, c, decidedAt, now = Date.now) {
-  const nextConfig = {
-    ...config2,
-    consent: {
-      ...config2.consent,
-      sync: c.sync !== "off",
-      telemetry: c.telemetry,
-      contributePackages: c.packages && c.sync !== "off"
-    },
-    onboardedAt: config2.onboardedAt ?? now()
+  const nextConfig = { ...config2, onboardedAt: config2.onboardedAt ?? now() };
+  const consoleConsents = {
+    sync: c.sync !== "off",
+    telemetry: c.telemetry,
+    contributePackages: c.packages && c.sync !== "off",
+    decidedAt
   };
   const nextProfile = {
     ...profile,
+    consoleConsents,
     syncConsent: c.sync === "automatic" ? "automatic" : c.sync === "ask" ? "ask-each-time" : "disabled",
     linkConsents: {
       structure: c.structure,
@@ -84473,7 +84509,8 @@ function applyConsents(profile, config2, c, decidedAt, now = Date.now) {
     }
   };
   const prev = profile.linkConsents;
-  const changed = profile.syncConsent !== nextProfile.syncConsent || config2.consent.sync !== nextConfig.consent.sync || config2.consent.telemetry !== nextConfig.consent.telemetry || config2.consent.contributePackages !== nextConfig.consent.contributePackages || !prev || prev.structure !== nextProfile.linkConsents.structure || prev.mineHistory !== nextProfile.linkConsents.mineHistory || prev.contributeHistory !== nextProfile.linkConsents.contributeHistory;
+  const prevConsole = profile.consoleConsents;
+  const changed = profile.syncConsent !== nextProfile.syncConsent || prevConsole?.sync !== consoleConsents.sync || prevConsole?.telemetry !== consoleConsents.telemetry || prevConsole?.contributePackages !== consoleConsents.contributePackages || !prev || prev.structure !== nextProfile.linkConsents.structure || prev.mineHistory !== nextProfile.linkConsents.mineHistory || prev.contributeHistory !== nextProfile.linkConsents.contributeHistory;
   return { profile: nextProfile, config: nextConfig, changed };
 }
 function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
@@ -84497,6 +84534,7 @@ function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
 }
 
 // src/multi.ts
+init_consent();
 init_registry();
 
 // src/adopt.ts
@@ -84693,6 +84731,9 @@ function codexWakeCandidates(input) {
   return out2;
 }
 
+// src/multi.ts
+init_profile2();
+
 // src/hook-route.ts
 function msysToWindowsPath(p, platform = process.platform) {
   if (platform !== "win32") return p;
@@ -85509,11 +85550,11 @@ async function startMultiDaemon(opts = {}) {
   const ANCHOR_PULL_INTERVAL_MS = 10 * 60 * 1e3;
   const anchorPullAll = async () => {
     const c = loadConfig();
-    if (!c.consent.sync || !hasCloudCredential(c)) return;
+    if (!hasCloudCredential(c)) return;
     const client = cloudNow();
     for (const r of records) {
       const projectId = r.engine.profile.projectId;
-      if (!projectId) continue;
+      if (!projectId || !effectiveConsent(c, r.engine.profile).sync) continue;
       try {
         const { salt } = await resolveProjectSymbolSalt(client, projectId);
         await pullProjectAnchors(r, client, salt);
@@ -85527,9 +85568,10 @@ async function startMultiDaemon(opts = {}) {
   }, ANCHOR_PULL_INTERVAL_MS);
   const ambientLinkAll = async () => {
     const c = loadConfig();
-    if (!c.consent.sync || !hasCloudCredential(c)) return;
+    if (!hasCloudCredential(c)) return;
     const client = cloudNow();
     for (const r of records) {
+      if (!effectiveConsent(c, r.engine.profile).sync) continue;
       const out2 = await ensureProjectLink(r.root, r.engine.profile, client);
       if (out2.linked) {
         console.log(
@@ -85596,14 +85638,14 @@ async function startMultiDaemon(opts = {}) {
             };
             void startHistoryStage(root, engine.profile, client, {
               anchors: { index: anchorIndex, salt },
-              // PS-web projects: the console's consents (Privacy tab) win over
-              // the profile's memory; applied to config and profile here, with
+              // PS-web projects: the console's consents (Privacy tab) are this
+              // project's, applied to ITS profile only (DC-consent-scope), with
               // the change printed so a flipped switch is visible in the log.
               applyConsents: (p, consents) => {
                 const cfg2 = loadConfig();
                 const applied = applyConsents(p, cfg2, consents, (/* @__PURE__ */ new Date()).toISOString());
                 if (applied.changed) {
-                  saveConfig(applied.config);
+                  if (applied.config.onboardedAt !== cfg2.onboardedAt) saveConfig(applied.config);
                   Object.assign(engine.profile, applied.profile);
                   saveProfile(root, engine.profile);
                   console.log(
@@ -85885,7 +85927,7 @@ async function startMultiDaemon(opts = {}) {
       const ignore2 = loadClaimIgnorePatterns(globalDir());
       const primaryLanguage = machineDominantLanguage();
       const languages = records.flatMap((r) => r.engine.profile.languages ?? []);
-      const packages = cfg2.consent.contributePackages ? records.flatMap(
+      const packages = cfg2.consent.contributePackages ? records.filter((r) => effectiveConsent(cfg2, r.engine.profile).contributePackages).flatMap(
         (r) => r.engine.store.findNodesByLabel("Package").map((p) => ({
           name: String(p.attrs["name"] ?? ""),
           purl: String(p.attrs["purl"] ?? p.id)
@@ -85904,7 +85946,9 @@ async function startMultiDaemon(opts = {}) {
     },
     async syncInstancesPublic() {
       const cfg2 = loadConfig();
-      if (!cfg2.consent.sync) return { uploaded: 0, skipped: "consent-off" };
+      if (!records.some((r) => effectiveConsent(cfg2, r.engine.profile).sync)) {
+        return { uploaded: 0, skipped: "consent-off" };
+      }
       if (registryCorrupt()) {
         const msg = "workspace registry unreadable \u2014 holding ALL per-workspace cloud push (bindings unprovable; fail-closed)";
         console.error(`[identity] ${msg}`);
@@ -85980,7 +86024,9 @@ async function startMultiDaemon(opts = {}) {
         }
       };
       for (const r of records) {
-        const recordIdentity = identityFor(r.entry);
+        const recordConsent = effectiveConsent(cfg2, r.engine.profile);
+        if (!recordConsent.sync) continue;
+        const recordIdentity = identityFor(liveWorkspaceEntry(r.entry));
         if (recordIdentity.invalid) {
           noteIdentityBlock(r.id, r.entry.name, recordIdentity);
           errors.push(`[${r.entry.name}] identity: ${recordIdentity.reason}`);
@@ -86015,7 +86061,7 @@ async function startMultiDaemon(opts = {}) {
           profile: r.engine.profile,
           daemonVersion: DAEMON_VERSION,
           ignorePatterns: [...ignore2],
-          includePackages: cfg2.consent.contributePackages
+          includePackages: recordConsent.contributePackages
         });
         if (context) {
           await lane("context", projectName, async () => {
@@ -86046,7 +86092,7 @@ async function startMultiDaemon(opts = {}) {
           profile: r.engine.profile,
           daemonVersion: DAEMON_VERSION,
           ignorePatterns: [...ignore2],
-          includePackages: cfg2.consent.contributePackages,
+          includePackages: recordConsent.contributePackages,
           workspaceRoot: r.root,
           ...project ? { project } : {}
         });
@@ -86362,6 +86408,8 @@ async function startMultiDaemon(opts = {}) {
 
 // src/cli.ts
 init_src5();
+init_profile2();
+init_consent();
 init_git_remote();
 init_config();
 init_src7();
@@ -87704,8 +87752,14 @@ async function cmdStatus() {
   );
   const cs = cfg.consent;
   console.log(
-    `  consent:   sync ${cs.sync ? "on" : "off"} \xB7 telemetry ${cs.telemetry ? "on" : "off"} \xB7 packages ${cs.contributePackages ? "on" : "off"}`
+    `  consent:   sync ${cs.sync ? "on" : "off"} \xB7 telemetry ${cs.telemetry ? "on" : "off"} \xB7 packages ${cs.contributePackages ? "on" : "off"} (machine default)`
   );
+  const pc = profile?.consoleConsents;
+  if (pc) {
+    console.log(
+      `             this project (console): sync ${pc.sync ? "on" : "off"} \xB7 telemetry ${pc.telemetry ? "on" : "off"} \xB7 packages ${pc.contributePackages ? "on" : "off"}`
+    );
+  }
   console.log(`  cloud:`);
   console.log(`    url:    ${cfg.cloudUrl}`);
   if (daemonCloud) {
@@ -88154,12 +88208,11 @@ async function cmdLoginOAuthDevice(cfg, input) {
   }
 }
 async function linkRegisteredWorkspaces(cfg) {
-  if (!cfg.consent.sync) return;
   const client = authedCloudClient(cfg);
   for (const w of listWorkspaces()) {
     try {
       const profile = loadProfile(w.path);
-      if (!profile) continue;
+      if (!profile || !effectiveConsent(cfg, profile).sync) continue;
       refreshRepoLocator(w.path, profile);
       const out2 = await ensureProjectLink(w.path, profile, client);
       if (out2.linked) {
@@ -88244,7 +88297,7 @@ async function cmdLink(args2) {
         `linked${d.existed ? "" : " (created)"}: ${d.locator} \u2192 project ${d.projectId} \xB7 ${where} \xB7 ${d.visibility} \xB7 grant v${d.grantVersion}`
       );
       console.log(
-        `consents: sync=${d.consents.sync} telemetry=${d.consents.telemetry ? "on" : "off"} packages=${applied.config.consent.contributePackages ? "on" : "off"} structure=${d.consents.structure ? "on" : "off"} history=${d.consents.mineHistory ? applied.profile.linkConsents?.contributeHistory ? "mine+contribute" : "mine" : "off"}`
+        `consents (this project): sync=${d.consents.sync} telemetry=${d.consents.telemetry ? "on" : "off"} packages=${applied.profile.consoleConsents?.contributePackages ? "on" : "off"} structure=${d.consents.structure ? "on" : "off"} history=${d.consents.mineHistory ? applied.profile.linkConsents?.contributeHistory ? "mine+contribute" : "mine" : "off"}`
       );
       await refreshLinkedCodexHooks(args2);
       if (applied.wroteIgnore) console.log("wrote .errataignore (starter) \u2014 edit it; it is your hard control");