@legioncodeinc/honeycomb 0.1.8 → 0.1.9

package/daemon/index.js

@@ -7369,7 +7369,7 @@ var require_dist = __commonJS({
 // dist/src/shared/constants.js
 var DAEMON_PORT = 3850;
 var DAEMON_HOST = "127.0.0.1";
-var HONEYCOMB_VERSION = true ? "0.1.8" : "0.0.0-dev";
+var HONEYCOMB_VERSION = true ? "0.1.9" : "0.0.0-dev";
 
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -22440,7 +22440,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve6) => setTimeout(resolve6));
+            await new Promise((resolve7) => setTimeout(resolve7));
             maxReadCount = 3;
             continue;
           }
@@ -22593,7 +22593,7 @@ async function startDaemon(daemon) {
   let server;
   let boundPort = daemon.config.port;
   try {
-    server = await new Promise((resolve6, reject) => {
+    server = await new Promise((resolve7, reject) => {
       let handle;
       try {
         handle = serve({
@@ -22602,7 +22602,7 @@ async function startDaemon(daemon) {
           port: daemon.config.port
         }, (info) => {
           boundPort = info.port;
-          resolve6(handle);
+          resolve7(handle);
         });
         handle.on?.("error", (err) => reject(err));
       } catch (err) {
@@ -22617,13 +22617,13 @@ async function startDaemon(daemon) {
   return {
     address: { host: daemon.config.host, port: boundPort },
     async close() {
-      await new Promise((resolve6, reject) => {
+      await new Promise((resolve7, reject) => {
         server.close((err) => {
           if (err) {
             reject(err instanceof Error ? err : new Error(String(err)));
             return;
           }
-          resolve6();
+          resolve7();
         });
       });
       await daemon.stopServices();
@@ -27827,8 +27827,9 @@ function createEmbedSupervisor(deps = {}) {
   const cfg = resolveConfig2(deps.config);
   const spawnChild = deps.spawnChild ?? defaultSpawnChild(env);
   const probeHealth = deps.probeHealth ?? defaultProbeHealth(env);
-  const disabled = !resolveEmbedClientOptions(env).enabled;
+  let enabled = deps.enabled ?? resolveEmbedClientOptions(env).enabled;
   let started = false;
+  let lifecycleStarted = false;
   let stopping = false;
   let child = null;
   let live = false;
@@ -27899,7 +27900,7 @@ function createEmbedSupervisor(deps = {}) {
       return;
     await spawnAndWatch();
   }
-  return {
+  const api = {
     get live() {
       return live;
     },
@@ -27907,16 +27908,17 @@ function createEmbedSupervisor(deps = {}) {
       return warm;
     },
     get disabled() {
-      return disabled;
+      return !enabled;
     },
     get restarts() {
       return restarts;
     },
     async start() {
+      lifecycleStarted = true;
       if (started)
         return;
       started = true;
-      if (disabled) {
+      if (!enabled) {
         logger.event("embed.disabled");
         return;
       }
@@ -27958,12 +27960,29 @@ function createEmbedSupervisor(deps = {}) {
       live = false;
       warm = false;
       restarts = 0;
-      if (disabled || stopping)
+      if (!enabled || stopping)
         return;
       logger.event("embed.manual_restart");
       await spawnAndWatch();
+    },
+    async setEnabled(want) {
+      enabled = want;
+      if (want) {
+        logger.event("embed.enabled");
+        if (!lifecycleStarted)
+          return;
+        if (child === null) {
+          started = false;
+          await api.start();
+        }
+      } else {
+        logger.event("embed.disabled_live");
+        if (child !== null)
+          await api.stop();
+      }
     }
   };
+  return api;
 }
 var noopEmbedSupervisor = {
   live: false,
@@ -27975,6 +27994,8 @@ var noopEmbedSupervisor = {
   stop() {
   },
   async restart() {
+  },
+  async setEnabled() {
   }
 };
 
@@ -27983,7 +28004,9 @@ function buildHealthDetail(inputs) {
   const reasons = {
     storage: inputs.status === "ok" ? "reachable" : "unreachable",
     embeddings: inputs.embeddingsEnabled ? "on" : "off",
-    schema: inputs.schemaMissingTable === true ? "missing_table" : "ok"
+    schema: inputs.schemaMissingTable === true ? "missing_table" : "ok",
+    // PRD-063b / b-AC-7: read the supplied Portkey state verbatim (no probe). Omitted → `off`.
+    portkey: inputs.portkey ?? "off"
   };
   return { status: inputs.status, reasons };
 }
@@ -28018,6 +28041,10 @@ var ROUTE_GROUPS = Object.freeze([
   { path: "/api/org", protect: true, session: false },
   { path: "/api/workspace", protect: true, session: false },
   { path: "/api/diagnostics", protect: true, session: false },
+  // The dashboard imperative-actions surface (logout / embeddings / restart / uninstall). Protected
+  // (inherits auth/RBAC) AND additionally local-mode + origin/CSRF gated inside the handlers
+  // (`dashboard/actions-api.ts`), since these are credential/process/lifecycle actions.
+  { path: "/api/actions", protect: true, session: false },
   { path: "/api/pipeline", protect: true, session: false },
   { path: "/api/repair", protect: true, session: false },
   { path: "/api/inference", protect: true, session: false },
@@ -28155,7 +28182,7 @@ function coarsePipelineStatus(storage) {
 }
 
 // dist/src/daemon/runtime/assemble.js
-import { mkdirSync as mkdirSync20, readFileSync as readFileSync22, rmSync as rmSync9, writeFileSync as writeFileSync17 } from "node:fs";
+import { mkdirSync as mkdirSync20, mkdtempSync, readFileSync as readFileSync22, rmSync as rmSync10, writeFileSync as writeFileSync17 } from "node:fs";
 import { homedir as homedir25 } from "node:os";
 import { join as join32 } from "node:path";
 
@@ -28583,7 +28610,7 @@ function buildAllowedProperties(input) {
 }
 var systemTelemetryClock = () => (/* @__PURE__ */ new Date()).toISOString();
 var DEFAULT_EMIT_TIMEOUT_MS = 2e3;
-var HONEYCOMB_VERSION2 = true ? "0.1.8" : "0.0.0-dev";
+var HONEYCOMB_VERSION2 = true ? "0.1.9" : "0.0.0-dev";
 async function emitTelemetry(event, opts, deps = {}) {
   const env = deps.env ?? process.env;
   const key = deps.posthogKey ?? POSTHOG_KEY;
@@ -28653,7 +28680,7 @@ async function postCapture(event, properties, distinctId, key, deps) {
 }
 
 // dist/src/daemon/runtime/auth/deeplake-issuer.js
-var realSleeper = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var realSleeper = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var DEEPLAKE_CLIENT_HEADER = "X-Deeplake-Client";
 var DEEPLAKE_ORG_HEADER = "X-Activeloop-Org-Id";
 var DEEPLAKE_CLIENT_VALUE = "honeycomb";
@@ -29181,7 +29208,7 @@ function resolveRequestScope(input) {
 
 // dist/src/daemon/runtime/auth/device-flow.js
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-var realSleeper2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var realSleeper2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var DEFAULT_MAX_POLLS2 = 900;
 function reporterOf(deps) {
   return deps.reporter ?? { prompt: (line) => console.log(line) };
@@ -29963,7 +29990,7 @@ function recursEnough(pairs) {
 }
 var systemGateSpawner = {
   run(spec, prompt, timeoutMs) {
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       const child = spawn2(spec.command, [...spec.args], { shell: false, windowsHide: true });
       let stdout = "";
       let settled = false;
@@ -29987,7 +30014,7 @@ var systemGateSpawner = {
       child.on("error", (err) => finish(() => reject(err)));
       child.on("close", (code) => {
         if (code === 0)
-          finish(() => resolve6(stdout));
+          finish(() => resolve7(stdout));
         else
           finish(() => reject(new Error(`skillify gate CLI exited with code ${code ?? "null"}`)));
       });
@@ -30091,7 +30118,7 @@ function uniqueSessionIds(pairs) {
   return out;
 }
 function withTimeout(promise2, timeoutMs, message) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let settled = false;
     const timer = setTimeout(() => {
       if (settled)
@@ -30104,7 +30131,7 @@ function withTimeout(promise2, timeoutMs, message) {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve6(v);
+      resolve7(v);
     }, (e) => {
       if (settled)
         return;
@@ -30479,7 +30506,7 @@ function buildSummaryPrompt(session, events) {
 }
 var systemSummarySpawner = {
   run(spec, prompt, timeoutMs) {
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       const child = spawn3(spec.command, [...spec.args], {
         shell: false,
         windowsHide: true,
@@ -30515,7 +30542,7 @@ var systemSummarySpawner = {
       child.on("error", (err) => finish(() => reject(err)));
       child.on("close", (code) => {
         if (code === 0)
-          finish(() => resolve6(stdout));
+          finish(() => resolve7(stdout));
         else
           finish(() => reject(new Error(`summary gate CLI exited with code ${code ?? "null"}`)));
       });
@@ -30536,7 +30563,7 @@ function createHostSummaryGenCli(spec, spawner = systemSummarySpawner, timeoutMs
 }
 var systemSleeper = {
   sleep(ms) {
-    return new Promise((resolve6) => setTimeout(resolve6, ms));
+    return new Promise((resolve7) => setTimeout(resolve7, ms));
   }
 };
 async function runSummaryWorker(trigger, session, deps) {
@@ -33779,6 +33806,11 @@ async function runGraphBuild(identity, scope, options) {
     push: push.kind
   };
 }
+async function buildCodebaseGraphSnapshot(scope, options) {
+  const workspaceDir = options.workspaceDir ?? process.cwd();
+  const identity = options.identity ?? resolveSnapshotIdentity(workspaceDir, scope);
+  return runGraphBuild(identity, scope, options);
+}
 function mountGraphApi(daemon, options) {
   const group = daemon.group(GRAPH_GROUP);
   if (group === void 0)
@@ -35696,7 +35728,7 @@ function modeledMemoryInjectionSavings(sessions, rate = resolveRate(void 0, void
 }
 
 // dist/src/daemon/runtime/dashboard/roi-billing.js
-var realSleeper3 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var realSleeper3 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var systemBillingClock = {
   now() {
     return Date.now();
@@ -36178,30 +36210,35 @@ async function selectRows2(storage, sql, scope) {
   return isOk(result) ? result.rows : [];
 }
 var CHARS_PER_TOKEN2 = 4;
-async function fetchKpisView(storage, scope) {
+async function fetchKpiCounts(storage, scope, projectId) {
   const memTbl = sqlIdent("memories");
   const sessTbl = sqlIdent("sessions");
-  const [memRows, sessRows, savingsRows, teamSkillRows] = await Promise.all([
-    selectRows2(storage, `SELECT COUNT(*) AS n FROM "${memTbl}"`, scope),
-    selectRows2(storage, `SELECT COUNT(*) AS n FROM "${sessTbl}"`, scope),
-    selectRows2(storage, buildEstimatedSavingsSql(), scope),
+  const projClause = projectWhereClause(projectId);
+  const [memRows, sessRows, teamSkillRows] = await Promise.all([
+    selectRows2(storage, `SELECT COUNT(*) AS n FROM "${memTbl}"${projClause}`, scope),
+    selectRows2(storage, `SELECT COUNT(*) AS n FROM "${sessTbl}"${projClause}`, scope),
     selectRows2(storage, buildTeamSkillCountSql(), scope)
   ]);
   const sessionCount = toNum2(sessRows[0]?.n);
-  const estimatedSavings = Math.floor(toNum2(savingsRows[0]?.chars) / CHARS_PER_TOKEN2);
   return {
     memoryCount: toNum2(memRows[0]?.n),
     // 035a: same value, two names — `sessionCount` kept (additive), `turnCount` is what the UI reads.
     sessionCount,
     turnCount: sessionCount,
-    estimatedSavings,
     teamSkillCount: toNum2(teamSkillRows[0]?.n)
   };
 }
-function buildEstimatedSavingsSql() {
+async function fetchEstimatedSavings(storage, scope, projectId) {
+  const savingsRows = await selectRows2(storage, buildEstimatedSavingsSql(projectId), scope);
+  return Math.floor(toNum2(savingsRows[0]?.chars) / CHARS_PER_TOKEN2);
+}
+function buildEstimatedSavingsSql(projectId) {
   const tbl = sqlIdent("memories");
   const col = sqlIdent("content");
-  return `SELECT SUM(LENGTH(${col})) AS chars FROM "${tbl}"`;
+  return `SELECT SUM(LENGTH(${col})) AS chars FROM "${tbl}"${projectWhereClause(projectId)}`;
+}
+function projectWhereClause(projectId) {
+  return projectId !== void 0 && projectId !== "" ? ` WHERE ${sqlIdent("project_id")} = ${sLiteral(projectId)}` : "";
 }
 function buildTeamSkillCountSql() {
   const tbl = sqlIdent(SYNCED_ASSETS_TABLE);
@@ -36375,7 +36412,7 @@ async function readCapturedTurns(storage, scope, projectId) {
   const tbl = sqlIdent("sessions");
   const dateCol = sqlIdent("creation_date");
   const idCol = sqlIdent("id");
-  const projClause = projectId !== void 0 && projectId !== "" ? ` WHERE ${sqlIdent("project_id")} = ${sLiteral(projectId)}` : "";
+  const projClause = projectWhereClause(projectId);
   const sql = `SELECT ${sqlIdent("input_tokens")}, ${sqlIdent("output_tokens")}, ${sqlIdent("cache_read_input_tokens")}, ${sqlIdent("cache_creation_input_tokens")}, ${sqlIdent("source_tool")} FROM "${tbl}"${projClause} ORDER BY ${dateCol} DESC, ${idCol} DESC LIMIT ${ROI_SESSIONS_LIMIT}`;
   const rows = await selectRows2(storage, sql, scope);
   return rows.map(rowToCapturedTurn);
@@ -36524,22 +36561,34 @@ function mountDashboardApi(daemon, options) {
   const resolveScope5 = (c) => resolveScopeOrLocalDefault(c, daemon.config.mode, options.defaultScope);
   const kpis = daemon.group(DASHBOARD_GROUPS.kpis);
   if (kpis !== void 0) {
+    const countsCache = createTtlViewCache(DIAG_TTL_MS);
+    const savingsCache = createTtlViewCache(SAVINGS_TTL_MS);
     kpis.get("/kpis", async (c) => {
       const scope = resolveScope5(c);
       if (scope === null)
         return c.json(NO_ORG_BODY4, 400);
-      return c.json(await fetchKpisView(storage, scope));
+      const project = resolveRequestProject(c, scope);
+      const projectId = project.degraded ? void 0 : project.projectId;
+      const key = scopeCacheKey(scope, projectId);
+      const [counts, estimatedSavings] = await Promise.all([
+        countsCache(key, () => fetchKpiCounts(storage, scope, projectId)),
+        savingsCache(key, () => fetchEstimatedSavings(storage, scope, projectId))
+      ]);
+      return c.json({ ...counts, estimatedSavings });
     });
   }
   const sessions = daemon.group(DASHBOARD_GROUPS.sessions);
   if (sessions !== void 0) {
+    const sessionsCache = createTtlViewCache(DIAG_TTL_MS);
     sessions.get("/sessions", async (c) => {
       const scope = resolveScope5(c);
       if (scope === null)
         return c.json(NO_ORG_BODY4, 400);
+      const cursorRaw = c.req.query("cursor");
       const limit = resolveSessionsLimit(c.req.query("limit"));
-      const before = decodeSessionsCursor(c.req.query("cursor"));
-      return c.json(await fetchSessionsView(storage, scope, before !== void 0 ? { limit, before } : { limit }));
+      const before = decodeSessionsCursor(cursorRaw);
+      const key = scopeCacheKey(scope, String(limit), cursorRaw);
+      return c.json(await sessionsCache(key, () => fetchSessionsView(storage, scope, before !== void 0 ? { limit, before } : { limit })));
     });
   }
   const settings = daemon.group(DASHBOARD_GROUPS.settings);
@@ -36562,20 +36611,22 @@ function mountDashboardApi(daemon, options) {
   }
   const rules = daemon.group(DASHBOARD_GROUPS.rules);
   if (rules !== void 0) {
+    const rulesCache = createTtlViewCache(DIAG_TTL_MS);
     rules.get("/rules", async (c) => {
       const scope = resolveScope5(c);
       if (scope === null)
         return c.json(NO_ORG_BODY4, 400);
-      return c.json(await fetchRulesView(storage, scope));
+      return c.json(await rulesCache(scopeCacheKey(scope), () => fetchRulesView(storage, scope)));
     });
   }
   const skills = daemon.group(DASHBOARD_GROUPS.skills);
   if (skills !== void 0) {
+    const skillsCache = createTtlViewCache(DIAG_TTL_MS);
     skills.get("/skills", async (c) => {
       const scope = resolveScope5(c);
       if (scope === null)
         return c.json(NO_ORG_BODY4, 400);
-      return c.json(await fetchSkillSyncView(storage, scope));
+      return c.json(await skillsCache(scopeCacheKey(scope), () => fetchSkillSyncView(storage, scope)));
     });
   }
   const installedAssets = daemon.group(DASHBOARD_GROUPS.installedAssets);
@@ -36626,6 +36677,535 @@ function createInventoryCache() {
     return value;
   };
 }
+var DIAG_TTL_MS = 1e4;
+var SAVINGS_TTL_MS = 6e4;
+var CACHE_MAX_KEYS = 64;
+function scopeCacheKey(scope, ...extra) {
+  return [scope.org, scope.workspace ?? "", ...extra.map((e) => e ?? "")].join("\0");
+}
+function createTtlViewCache(ttlMs) {
+  const cache = /* @__PURE__ */ new Map();
+  return async (key, compute) => {
+    const now = Date.now();
+    const hit = cache.get(key);
+    if (hit !== void 0 && now - hit.at < ttlMs)
+      return hit.value;
+    const value = await compute();
+    if (cache.size >= CACHE_MAX_KEYS && !cache.has(key))
+      cache.clear();
+    cache.set(key, { value, at: now });
+    return value;
+  };
+}
+
+// dist/src/daemon/runtime/dashboard/actions-api.js
+import { spawn as spawn4 } from "node:child_process";
+import { rmSync as rmSync5 } from "node:fs";
+import { dirname as dirname12, resolve as resolve5 } from "node:path";
+
+// dist/src/daemon/runtime/secrets/api.js
+function localDefaultScopeResolver(mode, defaultScope) {
+  return {
+    resolve(c) {
+      const fromHeader = headerScopeResolver.resolve(c);
+      if (fromHeader !== null)
+        return fromHeader;
+      if (mode === "local" && defaultScope !== void 0) {
+        return { org: defaultScope.org, workspace: defaultScope.workspace ?? "default" };
+      }
+      return null;
+    }
+  };
+}
+var headerScopeResolver = {
+  resolve(c) {
+    const org = c.req.header("x-honeycomb-org");
+    if (org === void 0 || org.length === 0)
+      return null;
+    const workspace = c.req.header("x-honeycomb-workspace");
+    const agentId = c.req.header("x-honeycomb-agent");
+    const ws = workspace !== void 0 && workspace.length > 0 ? workspace : "default";
+    return agentId !== void 0 && agentId.length > 0 ? { org, workspace: ws, agentId } : { org, workspace: ws };
+  }
+};
+function mountSecretsApi(group, deps) {
+  const scope = deps.scope ?? headerScopeResolver;
+  const store = deps.store;
+  const runner = deps.execRunner;
+  if (runner !== void 0) {
+    group.post("/exec", async (c) => {
+      const sc = scope.resolve(c);
+      if (sc === null)
+        return badTenancy(c);
+      const request = await readExecRequest(c, sc);
+      if (request === null) {
+        return c.json({ error: "bad_request", reason: "exec body must carry a command" }, 400);
+      }
+      const res = runner.submit(request);
+      if (!res.ok) {
+        if (res.reason === "queue_full") {
+          return c.json({ error: "queue_full", reason: "exec pool and queue are at capacity" }, 429);
+        }
+        return c.json({ error: "bad_request", reason: "invalid exec request" }, 400);
+      }
+      return c.json({ ok: true, jobId: res.jobId, status: "queued" }, 202);
+    });
+    group.get("/exec/:jobId", (c) => {
+      const sc = scope.resolve(c);
+      if (sc === null)
+        return badTenancy(c);
+      const jobId = c.req.param("jobId");
+      const view = runner.getStatus(jobId, sc);
+      if (view === null) {
+        return c.json({ error: "not_found", reason: "no such exec job" }, 404);
+      }
+      return c.json(view);
+    });
+    group.all("/bitwarden/*", (c) => c.json({ error: "use_exec", reason: "reference a Bitwarden item via exec vaultRefs; values are never returned" }, 400));
+    group.all("/1password/*", (c) => c.json({ error: "use_exec", reason: "reference a 1Password item via exec vaultRefs; values are never returned" }, 400));
+  } else {
+    group.post("/exec", (c) => notImplementedRoute(c, "POST /api/secrets/exec (secret_exec)"));
+    group.get("/exec/:jobId", (c) => notImplementedRoute(c, "GET /api/secrets/exec/:jobId (exec status)"));
+    group.all("/bitwarden/*", (c) => notImplementedRoute(c, "Bitwarden vault provider"));
+    group.all("/1password/*", (c) => notImplementedRoute(c, "1Password vault provider"));
+  }
+  group.get("/", (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy(c);
+    const names = store.listSecretNames(sc);
+    return c.json({ names });
+  });
+  group.post("/:name", async (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy(c);
+    const name = c.req.param("name");
+    const value = await readValue(c);
+    if (value === null) {
+      return c.json({ error: "bad_request", reason: "request body must carry a string value" }, 400);
+    }
+    const res = await store.setSecret(name, value, sc);
+    if (!res.ok) {
+      if (res.reason === "invalid_name") {
+        return c.json({ error: "bad_request", reason: "invalid secret name" }, 400);
+      }
+      return c.json({ error: "store_failed", reason: "could not store the secret" }, 502);
+    }
+    return c.json({ ok: true, name }, 201);
+  });
+  group.delete("/:name", (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy(c);
+    const name = c.req.param("name");
+    const res = store.deleteSecret(name, sc);
+    if (!res.ok) {
+      if (res.reason === "invalid_name") {
+        return c.json({ error: "bad_request", reason: "invalid secret name" }, 400);
+      }
+      if (res.reason === "not_found") {
+        return c.json({ error: "not_found", reason: "no such secret" }, 404);
+      }
+      return c.json({ error: "delete_failed", reason: "could not delete the secret" }, 502);
+    }
+    return c.json({ ok: true, name });
+  });
+}
+function badTenancy(c) {
+  return c.json({ error: "bad_request", reason: "x-honeycomb-org header is required" }, 400);
+}
+async function readValue(c) {
+  const contentType = c.req.header("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    try {
+      const body = await c.req.json();
+      if (typeof body === "object" && body !== null) {
+        const v = body.value;
+        if (typeof v === "string" && v.length > 0)
+          return v;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  const text = await c.req.text();
+  return text.length > 0 ? text : null;
+}
+function notImplementedRoute(c, what) {
+  return c.json({ error: "not_implemented", reason: `${what} is implemented in PRD-012b` }, 501);
+}
+async function readExecRequest(c, scope) {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return null;
+  }
+  if (typeof body !== "object" || body === null)
+    return null;
+  const b = body;
+  const command = b.command;
+  if (typeof command !== "string" || command.length === 0)
+    return null;
+  const args = Array.isArray(b.args) ? b.args.filter((a) => typeof a === "string") : [];
+  const secretNames = Array.isArray(b.secretNames) ? b.secretNames.filter((n) => typeof n === "string") : [];
+  const vaultRefs = {};
+  if (typeof b.vaultRefs === "object" && b.vaultRefs !== null) {
+    for (const [k, v] of Object.entries(b.vaultRefs)) {
+      if (typeof v === "string")
+        vaultRefs[k] = v;
+    }
+  }
+  const timeoutMs = typeof b.timeoutMs === "number" ? b.timeoutMs : void 0;
+  return { command, args, secretNames, vaultRefs, scope, timeoutMs };
+}
+
+// dist/src/daemon/runtime/vault/catalog.js
+var PROVIDER_CATALOG = Object.freeze([
+  Object.freeze({
+    id: "anthropic",
+    label: "Anthropic",
+    models: Object.freeze(["claude-sonnet-4-6", "claude-opus-4-8"]),
+    openEnded: false
+  }),
+  Object.freeze({
+    id: "openai",
+    label: "OpenAI",
+    models: Object.freeze(["gpt-4o", "gpt-4o-mini", "gpt-4.1"]),
+    openEnded: false
+  }),
+  Object.freeze({
+    id: "openrouter",
+    label: "OpenRouter",
+    // Suggestions only — OpenRouter accepts a free-form `vendor/model` id (passthrough).
+    models: Object.freeze(["anthropic/claude-sonnet-4.6", "openai/gpt-4o"]),
+    openEnded: true
+  }),
+  Object.freeze({
+    // PRD-063a: Portkey is a GATEWAY, not a model vendor — its `portkey.config` id is
+    // free-form (a config or virtual-key id copied from the Portkey dashboard), so it is
+    // `openEnded: true` like OpenRouter and carries NO curated model list of its own.
+    id: "portkey",
+    label: "Portkey",
+    models: Object.freeze([]),
+    openEnded: true
+  })
+]);
+function providerEntry(provider) {
+  return PROVIDER_CATALOG.find((p) => p.id === provider);
+}
+function isValidProviderModel(provider, model) {
+  const entry = providerEntry(provider);
+  if (entry === void 0)
+    return false;
+  if (typeof model !== "string" || model.length === 0)
+    return false;
+  if (entry.openEnded)
+    return true;
+  return entry.models.includes(model);
+}
+function catalogView() {
+  return PROVIDER_CATALOG;
+}
+
+// dist/src/daemon/runtime/secrets/contracts.js
+import { homedir as homedir12, hostname as hostname3, userInfo } from "node:os";
+var SECRET_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+var MAX_SECRET_NAME_LENGTH = 128;
+function isValidSecretName(value) {
+  if (typeof value !== "string")
+    return false;
+  if (value.length === 0 || value.length > MAX_SECRET_NAME_LENGTH)
+    return false;
+  if (value === "." || value === "..")
+    return false;
+  if (value.includes("/") || value.includes("\\") || value.includes("\0"))
+    return false;
+  return SECRET_NAME_PATTERN.test(value);
+}
+function asSecretName(value) {
+  return isValidSecretName(value) ? value : null;
+}
+function isSecretRecord(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const r = value;
+  if (typeof r.nonce !== "string" || typeof r.ciphertext !== "string" || typeof r.createdAt !== "string") {
+    return false;
+  }
+  const scope = r.scope;
+  if (typeof scope !== "object" || scope === null)
+    return false;
+  const s = scope;
+  if (typeof s.org !== "string" || typeof s.workspace !== "string")
+    return false;
+  if (s.agentId !== void 0 && typeof s.agentId !== "string")
+    return false;
+  return true;
+}
+var MACHINE_KEY_DIR_NAME = ".honeycomb";
+var MACHINE_KEY_FILE_NAME = ".machine-key";
+function hostnameUserFallbackId() {
+  let user = "";
+  try {
+    user = userInfo().username;
+  } catch {
+    user = "";
+  }
+  return `host:${hostname3()}|user:${user}|home:${homedir12()}`;
+}
+
+// dist/src/daemon/runtime/vault/contracts.js
+function asRecordClass(value) {
+  return isValidSecretName(value) ? value : null;
+}
+
+// dist/src/daemon/runtime/vault/registry.js
+var SECRET_CLASS = "secret";
+var SETTING_CLASS = "setting";
+var SecretValueSchema = external_exports.string().min(1);
+var SettingValueSchema = external_exports.union([external_exports.string(), external_exports.number().finite(), external_exports.boolean()]);
+var SECRET_DESCRIPTOR = Object.freeze({
+  id: SECRET_CLASS,
+  posture: "internal-only",
+  schema: SecretValueSchema
+});
+var SETTING_DESCRIPTOR = Object.freeze({
+  id: SETTING_CLASS,
+  posture: "daemon-readable",
+  schema: SettingValueSchema
+});
+var VaultRegistry = class {
+  table;
+  constructor(descriptors) {
+    this.table = /* @__PURE__ */ new Map();
+    for (const d of descriptors)
+      this.table.set(d.id, d);
+  }
+  /**
+   * Register a new record class (D-7). Validates the id is traversal-proof (a class is an
+   * on-disk segment) and that the posture is one the store understands, then adds the
+   * descriptor. Re-registering an existing id REPLACES it (so a test can swap a throwaway
+   * class); registering the built-in `secret`/`setting` ids is allowed but discouraged —
+   * their posture must not be loosened. Returns the registry for chaining.
+   *
+   * Throws on an invalid (traversal-unsafe) class id — that is a programming error, not a
+   * runtime input, so it fails loud rather than silently dropping the class.
+   */
+  registerClass(descriptor) {
+    const safe = asRecordClass(descriptor.id);
+    if (safe === null) {
+      throw new Error(`vault.registerClass: invalid (traversal-unsafe) class id`);
+    }
+    this.table.set(descriptor.id, descriptor);
+    return this;
+  }
+  /** Whether a class id is registered. */
+  has(klass) {
+    return this.table.has(klass);
+  }
+  /** The registered class ids (sorted), for diagnostics — never values. */
+  classIds() {
+    return [...this.table.keys()].sort();
+  }
+  /**
+   * Resolve a class's descriptor for a WRITE, validating the value against the class
+   * schema (zod-at-boundary). Returns `unknown_class` for an unregistered class or
+   * `invalid_value` when the value fails the schema — both fail-closed (nothing is
+   * written). On success the descriptor (with the validated value available via the
+   * caller's re-parse) is returned.
+   */
+  resolveForWrite(klass, value) {
+    const descriptor = this.table.get(klass);
+    if (descriptor === void 0)
+      return { ok: false, reason: "unknown_class" };
+    const parsed = descriptor.schema.safeParse(value);
+    if (!parsed.success)
+      return { ok: false, reason: "invalid_value" };
+    return { ok: true, descriptor };
+  }
+  /**
+   * The POSTURE GATE (a-AC-2). Resolve a class's descriptor for a READ that intends to
+   * RETURN the value to a surface (the `getSetting` path). REJECTS a class whose posture
+   * is `internal-only` with `not_readable` — so a `secret` can NEVER be read back through
+   * the daemon-readable accessor. An unknown class is `unknown_class`. This is the single
+   * point where the secret-vs-setting security boundary is enforced, as data.
+   */
+  assertReadable(klass) {
+    const descriptor = this.table.get(klass);
+    if (descriptor === void 0)
+      return { ok: false, reason: "unknown_class" };
+    if (descriptor.posture !== "daemon-readable")
+      return { ok: false, reason: "not_readable" };
+    return { ok: true, descriptor };
+  }
+  /** Resolve a descriptor with no value/posture check (internal callers that already gate). */
+  descriptorOf(klass) {
+    return this.table.get(klass);
+  }
+};
+function createVaultRegistry(extra = []) {
+  return new VaultRegistry([SECRET_DESCRIPTOR, SETTING_DESCRIPTOR, ...extra]);
+}
+
+// dist/src/daemon/runtime/vault/api.js
+var SETTINGS_GROUP = "/api/settings";
+var EMBEDDINGS_ENABLED_KEY = "embeddings.enabled";
+var KNOWN_SETTING_KEYS = [
+  "activeProvider",
+  "activeModel",
+  "pollinating.enabled",
+  EMBEDDINGS_ENABLED_KEY,
+  "recallMode",
+  "portkey.enabled",
+  "portkey.config",
+  "portkey.fallbackToProvider"
+];
+var RECALL_MODES = ["keyword", "semantic", "hybrid"];
+function isValidRecallMode(value) {
+  return RECALL_MODES.includes(value);
+}
+var DASHBOARD_PREF_PREFIX = "dashboard.";
+function isKnownSettingKey(key) {
+  if (KNOWN_SETTING_KEYS.includes(key))
+    return true;
+  return key.startsWith(DASHBOARD_PREF_PREFIX) && key.length > DASHBOARD_PREF_PREFIX.length;
+}
+function mountSettingsGroup(group, deps) {
+  const scope = deps.scope ?? headerScopeResolver;
+  const store = deps.store;
+  group.get("/", async (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy2(c);
+    const keys = store.listSettingKeys(sc);
+    const settings = {};
+    for (const key of keys) {
+      const res = await store.getSetting(key, sc);
+      if (res.ok)
+        settings[key] = res.value;
+    }
+    return c.json({ settings, catalog: catalogView() });
+  });
+  group.get("/:key", async (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy2(c);
+    const key = c.req.param("key");
+    if (!isKnownSettingKey(key)) {
+      return c.json({ error: "not_found", reason: "no such setting" }, 404);
+    }
+    const res = await store.getSetting(key, sc);
+    if (!res.ok) {
+      if (res.reason === "not_found")
+        return c.json({ error: "not_found", reason: "no such setting" }, 404);
+      if (res.reason === "not_readable")
+        return c.json({ error: "not_found", reason: "no such setting" }, 404);
+      return c.json({ error: "read_failed", reason: "could not read the setting" }, 502);
+    }
+    return c.json({ key, value: res.value });
+  });
+  group.post("/:key", async (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy2(c);
+    const key = c.req.param("key");
+    if (!isKnownSettingKey(key)) {
+      return c.json({ error: "bad_request", reason: "unknown setting key" }, 400);
+    }
+    const value = await readSettingValue(c);
+    if (value === null) {
+      return c.json({ error: "bad_request", reason: "request body must carry a scalar value" }, 400);
+    }
+    const semanticError = await validateSettingSemantics(store, sc, key, value);
+    if (semanticError !== null) {
+      return c.json({ error: "bad_request", reason: semanticError }, 400);
+    }
+    const res = await store.setSetting(key, value, sc);
+    if (!res.ok) {
+      if (res.reason === "invalid_value") {
+        return c.json({ error: "bad_request", reason: "invalid setting value" }, 400);
+      }
+      if (res.reason === "not_readable" || res.reason === "unknown_class") {
+        return c.json({ error: "bad_request", reason: "setting class is not writable" }, 400);
+      }
+      return c.json({ error: "store_failed", reason: "could not store the setting" }, 502);
+    }
+    return c.json({ ok: true, key, value }, 201);
+  });
+}
+function mountSettingsApi(daemon, deps) {
+  const group = daemon.group(SETTINGS_GROUP);
+  if (group === void 0)
+    return;
+  mountSettingsGroup(group, deps);
+}
+function badTenancy2(c) {
+  return c.json({ error: "bad_request", reason: "x-honeycomb-org header is required" }, 400);
+}
+async function readSettingValue(c) {
+  const contentType = c.req.header("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    try {
+      const body = await c.req.json();
+      if (typeof body === "object" && body !== null) {
+        const v = body.value;
+        const parsed = SettingValueSchema.safeParse(v);
+        return parsed.success ? parsed.data : null;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  const text = await c.req.text();
+  return text.length > 0 ? text : null;
+}
+async function validateSettingSemantics(store, scope, key, value) {
+  if (key === "activeProvider") {
+    if (providerEntry(String(value)) === void 0)
+      return "unknown provider";
+    return null;
+  }
+  if (key === "activeModel") {
+    const provRes = await store.getSetting("activeProvider", scope);
+    const provider = provRes.ok ? String(provRes.value) : "";
+    if (provider.length === 0)
+      return "set activeProvider before activeModel";
+    if (!isValidProviderModel(provider, String(value)))
+      return "model not in provider catalog";
+    return null;
+  }
+  if (key === "recallMode") {
+    if (!isValidRecallMode(String(value)))
+      return "recallMode must be keyword, semantic, or hybrid";
+    return null;
+  }
+  if (key === "portkey.enabled" || key === "portkey.fallbackToProvider") {
+    if (typeof value !== "boolean")
+      return `${key} must be a boolean`;
+    return null;
+  }
+  if (key === "portkey.config") {
+    if (typeof value !== "string")
+      return "portkey.config must be a string";
+    if (/[\u0000-\u001F\u007F]/.test(value))
+      return "portkey.config must not contain control characters";
+    const enabledRes = await store.getSetting("portkey.enabled", scope);
+    const enabled = enabledRes.ok && enabledRes.value === true;
+    if (enabled && value.length === 0)
+      return "portkey.config must be non-empty when portkey.enabled is true";
+    return null;
+  }
+  return null;
+}
+
+// dist/src/daemon/runtime/dashboard/harness-detect.js
+import { existsSync as existsSync12 } from "node:fs";
+import { homedir as homedir16 } from "node:os";
+import { join as join20 } from "node:path";
 
 // dist/src/hooks/shared/contracts.js
 var LOGICAL_EVENTS = [
@@ -36730,7 +37310,7 @@ var HEALTH_DIMENSION_WIRABLE = Object.freeze({
 
 // dist/src/notifications/state.js
 import { closeSync as closeSync3, existsSync as existsSync10, mkdirSync as mkdirSync11, openSync as openSync3, readFileSync as readFileSync13, renameSync as renameSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir13 } from "node:os";
 import { join as join17 } from "node:path";
 
 // dist/src/daemon/runtime/assets/contracts.js
@@ -36754,7 +37334,7 @@ var audienceMatches = (asset, ctx) => {
 
 // dist/src/daemon-client/assets/install.js
 import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync14, renameSync as renameSync7, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
+import { homedir as homedir14 } from "node:os";
 import { dirname as dirname10, join as join18, resolve as resolve4 } from "node:path";
 var HARNESS_SKILL_DIRS = Object.freeze({
   claude_code: join18(".claude", "skills"),
@@ -36774,38 +37354,52 @@ var HARNESS_AGENT_DIRS = Object.freeze({
 });
 
 // dist/src/commands/contracts.js
+var VERB_GROUPS = Object.freeze([
+  { key: "memory", label: "Memory & recall" },
+  { key: "knowledge", label: "Knowledge & skills" },
+  { key: "agents", label: "Agents, routing & config" },
+  { key: "account", label: "Account & workspaces" },
+  { key: "system", label: "Setup & system" }
+]);
 var VERB_TABLE = Object.freeze([
-  { verb: "setup", cls: "local", summary: "detect assistants, wire hooks, bring up the daemon" },
-  { verb: "install", cls: "local", summary: "bring up the daemon (health-gated) + open the dashboard (PRD-050a)" },
-  { verb: "status", cls: "local", summary: "daemon connectivity + login + D1\u2013D5 environment health" },
-  { verb: "daemon", cls: "local", summary: "start | stop | status the loopback daemon (3850)" },
-  { verb: "dashboard", cls: "local", summary: "launch the daemon-served dashboard (020b)" },
-  { verb: "telemetry", cls: "local", summary: "show exactly what adoption telemetry has been / would be sent (--show, PRD-050e)" },
-  { verb: "pollinate", cls: "storage", summary: "trigger a pollinating consolidation pass on the daemon (009/026)" },
-  { verb: "maintenance", cls: "storage", summary: "run version-history compaction over version-bumped tables (030)" },
-  { verb: "remember", cls: "storage", summary: "write a memory through the daemon (--type fact|convention|preference|decision|gotcha|reference)" },
-  { verb: "recall", cls: "storage", summary: "recall memories through the daemon" },
-  { verb: "memory", cls: "storage", summary: "lifecycle: conflicts (list/resolve), stale-refs (list), inspect <id> --lifecycle (058d)" },
-  { verb: "agent", cls: "storage", summary: "run an agent turn through the daemon" },
-  { verb: "ontology", cls: "storage", summary: "inspect/propose ontology changes through the daemon" },
-  { verb: "secret", cls: "storage", summary: "manage named secrets through the daemon" },
-  { verb: "settings", cls: "storage", summary: "get/set/list vault settings + provider\u2192model selector through the daemon" },
-  { verb: "asset", cls: "storage", summary: "register/promote/demote/style skills+agents through the tier\xD7style lattice (033)" },
-  { verb: "skill", cls: "storage", summary: "skillify scope/pull/unpull/force/promote through the daemon (promote = cross-project, 049c)" },
-  { verb: "skillify", cls: "storage", summary: "pull team skills from the daemon (016c)" },
-  { verb: "hook", cls: "local", summary: "inspect/wire harness hooks" },
-  { verb: "route", cls: "storage", summary: "manage inference routes through the daemon" },
-  { verb: "sources", cls: "storage", summary: "connect/index/purge sources through the daemon" },
-  { verb: "graph", cls: "storage", summary: "build/query the codebase graph through the daemon" },
-  { verb: "goal", cls: "storage", summary: "manage goals/KPIs through the daemon" },
-  { verb: "whoami", cls: "auth", summary: "show the authenticated user, org, and workspace (GET /me)" },
-  { verb: "org", cls: "auth", summary: "list/switch org (passthrough to the auth dispatcher)" },
-  { verb: "workspace", cls: "auth", summary: "list/switch/use workspace (passthrough to the auth dispatcher)" },
-  { verb: "workspaces", cls: "auth", summary: "list workspaces in the active org (alias of `workspace list`)" },
-  { verb: "project", cls: "auth", summary: "list/bind/use projects + show the resolved per-folder scope (049d)" },
-  { verb: "sessions", cls: "storage", summary: "list/prune captured sessions through the daemon" },
-  { verb: "uninstall", cls: "local", summary: "reverse only Honeycomb's changes" },
-  { verb: "update", cls: "local", summary: "self-update the CLI, daemon, and bundles" }
+  // Memory & recall — the product's core write/read/lifecycle surface.
+  { verb: "remember", cls: "storage", group: "memory", summary: "write a memory through the daemon (--type fact|convention|preference|decision|gotcha|reference)" },
+  { verb: "recall", cls: "storage", group: "memory", summary: "recall memories through the daemon" },
+  { verb: "memory", cls: "storage", group: "memory", summary: "lifecycle: conflicts (list/resolve), stale-refs (list), inspect <id> --lifecycle (058d)" },
+  { verb: "sessions", cls: "storage", group: "memory", summary: "list/prune captured sessions through the daemon" },
+  { verb: "pollinate", cls: "storage", group: "memory", summary: "trigger a pollinating consolidation pass on the daemon (009/026)" },
+  { verb: "maintenance", cls: "storage", group: "memory", summary: "run version-history compaction over version-bumped tables (030)" },
+  // Knowledge & skills — skills, assets, ontology, the codebase graph, and goals.
+  { verb: "skill", cls: "storage", group: "knowledge", summary: "skillify scope/pull/unpull/force/promote through the daemon (promote = cross-project, 049c)" },
+  { verb: "skillify", cls: "storage", group: "knowledge", summary: "pull team skills from the daemon (016c)" },
+  { verb: "asset", cls: "storage", group: "knowledge", summary: "register/promote/demote/style skills+agents through the tier\xD7style lattice (033)" },
+  { verb: "ontology", cls: "storage", group: "knowledge", summary: "inspect/propose ontology changes through the daemon" },
+  { verb: "graph", cls: "storage", group: "knowledge", summary: "build/query the codebase graph through the daemon" },
+  { verb: "sources", cls: "storage", group: "knowledge", summary: "connect/index/purge sources through the daemon" },
+  { verb: "goal", cls: "storage", group: "knowledge", summary: "manage goals/KPIs through the daemon" },
+  // Agents, routing & config — agent turns, inference routes, secrets, and vault settings.
+  { verb: "agent", cls: "storage", group: "agents", summary: "run an agent turn through the daemon" },
+  { verb: "route", cls: "storage", group: "agents", summary: "manage inference routes through the daemon" },
+  { verb: "secret", cls: "storage", group: "agents", summary: "manage named secrets through the daemon" },
+  { verb: "settings", cls: "storage", group: "agents", summary: "get/set/list vault settings + provider\u2192model selector through the daemon" },
+  // Account & workspaces — auth, identity, and the org/workspace/project scope surface.
+  { verb: "login", cls: "auth", group: "account", summary: "authenticate via device flow, or --token <key> for headless (023)" },
+  { verb: "logout", cls: "auth", group: "account", summary: "remove the shared credentials and sign out (023)" },
+  { verb: "whoami", cls: "auth", group: "account", summary: "show the authenticated user, org, and workspace (GET /me)" },
+  { verb: "org", cls: "auth", group: "account", summary: "list/switch org (passthrough to the auth dispatcher)" },
+  { verb: "workspace", cls: "auth", group: "account", summary: "list/switch/use workspace (passthrough to the auth dispatcher)" },
+  { verb: "workspaces", cls: "auth", group: "account", summary: "list workspaces in the active org (alias of `workspace list`)" },
+  { verb: "project", cls: "auth", group: "account", summary: "list/bind/use projects + show the resolved per-folder scope (049d)" },
+  // Setup & system — install/onboard, daemon lifecycle, dashboard, hooks, telemetry, update.
+  { verb: "setup", cls: "local", group: "system", summary: "detect assistants, wire hooks, bring up the daemon" },
+  { verb: "install", cls: "local", group: "system", summary: "bring up the daemon (health-gated) + open the dashboard (PRD-050a)" },
+  { verb: "status", cls: "local", group: "system", summary: "daemon connectivity + login + D1\u2013D5 environment health" },
+  { verb: "daemon", cls: "local", group: "system", summary: "start | stop | status the loopback daemon (3850)" },
+  { verb: "dashboard", cls: "local", group: "system", summary: "launch the daemon-served dashboard (020b)" },
+  { verb: "hook", cls: "local", group: "system", summary: "inspect/wire harness hooks" },
+  { verb: "telemetry", cls: "local", group: "system", summary: "show exactly what adoption telemetry has been / would be sent (--show, PRD-050e)" },
+  { verb: "update", cls: "local", group: "system", summary: "self-update the CLI, daemon, and bundles" },
+  { verb: "uninstall", cls: "local", group: "system", summary: "reverse only Honeycomb's changes" }
 ]);
 var DEFAULT_GLOBAL_FLAGS = Object.freeze({
   help: false,
@@ -36817,7 +37411,7 @@ var DEFAULT_GLOBAL_FLAGS = Object.freeze({
 // dist/src/daemon/runtime/assets/device.js
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync11 } from "node:fs";
-import { homedir as homedir14, hostname as hostname3 } from "node:os";
+import { homedir as homedir15, hostname as hostname4 } from "node:os";
 import { dirname as dirname11, join as join19 } from "node:path";
 
 // dist/src/hooks/normalize.js
@@ -37342,6 +37936,200 @@ function capabilitiesFor(name) {
   return HARNESS_CAPABILITIES[name];
 }
 
+// dist/src/daemon/runtime/dashboard/harness-detect.js
+var HARNESS_MARKERS = [
+  {
+    name: "claude-code",
+    // src/connectors/claude-code.ts: configPath() = ~/.claude/settings.json; pluginRoot = ~/.claude/plugins/honeycomb.
+    paths: (h) => [join20(h, ".claude", "settings.json"), join20(h, ".claude", "plugins", "honeycomb")]
+  },
+  {
+    name: "cursor",
+    // src/connectors/cursor.ts: configPath() = ~/.cursor/hooks.json; pluginRoot = ~/.cursor/honeycomb.
+    paths: (h) => [join20(h, ".cursor", "hooks.json"), join20(h, ".cursor", "honeycomb")]
+  },
+  {
+    name: "codex",
+    // hivemind-v1/src/cli/install-codex.ts: HOOKS_PATH = ~/.codex/hooks.json; PLUGIN_DIR = ~/.codex/hivemind.
+    paths: (h) => [join20(h, ".codex", "hooks.json"), join20(h, ".codex", "hivemind")]
+  },
+  {
+    name: "hermes",
+    // hivemind-v1/src/cli/install-hermes.ts: CONFIG_PATH = ~/.hermes/config.yaml; HIVEMIND_DIR = ~/.hermes/hivemind.
+    paths: (h) => [join20(h, ".hermes", "config.yaml"), join20(h, ".hermes", "hivemind")]
+  },
+  {
+    name: "pi",
+    // hivemind-v1/src/cli/install-pi.ts: AGENTS_MD = ~/.pi/agent/AGENTS.md; EXTENSION_PATH = ~/.pi/agent/extensions/hivemind.ts.
+    paths: (h) => [
+      join20(h, ".pi", "agent", "extensions", "hivemind.ts"),
+      join20(h, ".pi", "agent", "AGENTS.md")
+    ]
+  },
+  {
+    name: "openclaw",
+    // hivemind-v1/src/cli/install-openclaw.ts: PLUGIN_DIR = ~/.openclaw/extensions/hivemind.
+    paths: (h) => [join20(h, ".openclaw", "extensions", "hivemind")]
+  }
+];
+function markerExists(path4) {
+  try {
+    return existsSync12(path4);
+  } catch {
+    return false;
+  }
+}
+function detectInstalledHarnesses(homeDir = homedir16(), _cwd = process.cwd()) {
+  const canonical = new Set(CANONICAL_HARNESS_IDS);
+  const installed = /* @__PURE__ */ new Set();
+  for (const marker of HARNESS_MARKERS) {
+    if (!canonical.has(marker.name))
+      continue;
+    if (marker.paths(homeDir).some(markerExists))
+      installed.add(marker.name);
+  }
+  return installed;
+}
+
+// dist/src/daemon/runtime/dashboard/actions-api.js
+var ACTIONS_GROUP = "/api/actions";
+var RESTART_SHUTDOWN_DELAY_MS = 100;
+function isLoopbackOrigin(origin) {
+  try {
+    const host = new URL(origin).hostname;
+    return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function actionGuard(c, mode) {
+  if (mode !== "local") {
+    return c.json({ error: "forbidden", reason: "actions are available in local mode only" }, 403);
+  }
+  const site = c.req.header("sec-fetch-site");
+  if (site === "cross-site" || site === "same-site") {
+    return c.json({ error: "forbidden", reason: "cross-origin request rejected" }, 403);
+  }
+  const origin = c.req.header("origin");
+  if (origin !== void 0 && origin !== "" && !isLoopbackOrigin(origin)) {
+    return c.json({ error: "forbidden", reason: "untrusted origin" }, 403);
+  }
+  const session = c.req.header("x-honeycomb-session");
+  if (session === void 0 || session.trim() === "") {
+    return c.json({ error: "forbidden", reason: "missing dashboard session header" }, 403);
+  }
+  return null;
+}
+async function readEnabled(c) {
+  try {
+    const body = await c.req.json();
+    if (typeof body === "object" && body !== null) {
+      const v = body.enabled;
+      if (typeof v === "boolean")
+        return v;
+      if (v === "true" || v === 1)
+        return true;
+      if (v === "false" || v === 0)
+        return false;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function defaultRemoveCredentials() {
+  for (const path4 of [credentialsPath(), legacyCredentialsPath()]) {
+    try {
+      rmSync5(path4, { force: true });
+    } catch {
+    }
+  }
+}
+function defaultShutdown() {
+  try {
+    process.kill(process.pid, "SIGTERM");
+  } catch {
+  }
+}
+function defaultSpawnRestart() {
+  const entry = process.argv[1];
+  if (entry === void 0 || entry === "")
+    return;
+  const helper = resolve5(dirname12(entry), "restart-helper.js");
+  const child = spawn4(process.execPath, [helper], {
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env, HONEYCOMB_RESTART_ENTRY: entry, HONEYCOMB_RESTART_PORT: String(DAEMON_PORT) }
+  });
+  child.unref();
+}
+function defaultUninstall() {
+  const harnesses = [...detectInstalledHarnesses()];
+  return {
+    ok: true,
+    harnesses,
+    removed: false,
+    command: "honeycomb uninstall",
+    note: "Run `honeycomb uninstall` in your terminal to remove Honeycomb's hooks from your coding assistants. It reverses only Honeycomb's changes; your DeepLake login is left intact (use Log out for that)."
+  };
+}
+function mountActionsGroup(group, mode, options) {
+  const embed = options.embed;
+  const store = options.store;
+  const removeCredentials = options.removeCredentials ?? defaultRemoveCredentials;
+  const shutdown = options.shutdown ?? defaultShutdown;
+  const spawnRestart = options.spawnRestart ?? defaultSpawnRestart;
+  const uninstall = options.uninstall ?? defaultUninstall;
+  const settingsScope = localDefaultScopeResolver(mode, options.defaultScope);
+  group.post("/logout", (c) => {
+    const denied = actionGuard(c, mode);
+    if (denied)
+      return denied;
+    removeCredentials();
+    return c.json({ ok: true });
+  });
+  group.post("/embeddings", async (c) => {
+    const denied = actionGuard(c, mode);
+    if (denied)
+      return denied;
+    const enabled = await readEnabled(c);
+    if (enabled === null) {
+      return c.json({ error: "bad_request", reason: "body must carry { enabled: boolean }" }, 400);
+    }
+    if (store !== void 0) {
+      const sc = settingsScope.resolve(c);
+      if (sc !== null) {
+        try {
+          await store.setSetting(EMBEDDINGS_ENABLED_KEY, enabled, sc);
+        } catch {
+        }
+      }
+    }
+    await embed.setEnabled(enabled);
+    return c.json({ ok: true, enabled });
+  });
+  group.post("/restart", (c) => {
+    const denied = actionGuard(c, mode);
+    if (denied)
+      return denied;
+    spawnRestart();
+    setTimeout(() => shutdown(), RESTART_SHUTDOWN_DELAY_MS);
+    return c.json({ ok: true, restarting: true });
+  });
+  group.post("/uninstall", (c) => {
+    const denied = actionGuard(c, mode);
+    if (denied)
+      return denied;
+    return c.json(uninstall());
+  });
+}
+function mountActionsApi(daemon, options) {
+  const group = daemon.group(ACTIONS_GROUP);
+  if (group === void 0)
+    return;
+  mountActionsGroup(group, daemon.config.mode, options);
+}
+
 // dist/src/daemon/runtime/dashboard/harness-api.js
 var HARNESS_GROUP = "/api/diagnostics";
 var HARNESS_PATH = "/harnesses";
@@ -37871,25 +38659,25 @@ async function tableAbsent(probe, table) {
 }
 
 // dist/src/daemon/runtime/dashboard/asset-install-target.js
-import { existsSync as existsSync12, mkdirSync as mkdirSync14, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { homedir as homedir15 } from "node:os";
-import { join as join20 } from "node:path";
-var SKILLS_SUBDIR = join20(".claude", "skills");
-var AGENTS_SUBDIR = join20(".claude", "agents");
+import { existsSync as existsSync13, mkdirSync as mkdirSync14, readFileSync as readFileSync16, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "node:fs";
+import { homedir as homedir17 } from "node:os";
+import { join as join21 } from "node:path";
+var SKILLS_SUBDIR = join21(".claude", "skills");
+var AGENTS_SUBDIR = join21(".claude", "agents");
 var SKILL_FILE3 = "SKILL.md";
 function createFsAssetInstallTarget(dirs = {}) {
   const projectDir = dirs.projectDir ?? process.cwd();
-  const globalDir = dirs.globalDir ?? homedir15();
+  const globalDir = dirs.globalDir ?? homedir17();
   const rootFor = (install) => install === "global" ? globalDir : projectDir;
   const pathFor = (assetType, install, name) => {
     const root = rootFor(install);
     const segment = sanitizeSegment3(name);
     if (assetType === "agent") {
-      const dir2 = join20(root, AGENTS_SUBDIR);
-      return { dir: dir2, file: join20(dir2, `${segment}.md`) };
+      const dir2 = join21(root, AGENTS_SUBDIR);
+      return { dir: dir2, file: join21(dir2, `${segment}.md`) };
     }
-    const dir = join20(root, SKILLS_SUBDIR, segment);
-    return { dir, file: join20(dir, SKILL_FILE3) };
+    const dir = join21(root, SKILLS_SUBDIR, segment);
+    return { dir, file: join21(dir, SKILL_FILE3) };
   };
   return {
     async write(assetType, install, name, body) {
@@ -37905,7 +38693,7 @@ function createFsAssetInstallTarget(dirs = {}) {
     async read(assetType, install, name) {
       try {
         const { file: file2 } = pathFor(assetType, install, name);
-        if (!existsSync12(file2))
+        if (!existsSync13(file2))
           return null;
         return readFileSync16(file2, "utf-8");
       } catch {
@@ -37916,14 +38704,14 @@ function createFsAssetInstallTarget(dirs = {}) {
       try {
         const { dir, file: file2 } = pathFor(assetType, install, name);
         if (assetType === "agent") {
-          if (!existsSync12(file2))
+          if (!existsSync13(file2))
             return false;
-          rmSync5(file2, { force: true });
+          rmSync6(file2, { force: true });
           return true;
         }
-        if (!existsSync12(dir))
+        if (!existsSync13(dir))
           return false;
-        rmSync5(dir, { recursive: true, force: true });
+        rmSync6(dir, { recursive: true, force: true });
         return true;
       } catch {
         return false;
@@ -37931,7 +38719,7 @@ function createFsAssetInstallTarget(dirs = {}) {
     },
     exists(assetType, install, name) {
       try {
-        return existsSync12(pathFor(assetType, install, name).file);
+        return existsSync13(pathFor(assetType, install, name).file);
       } catch {
         return false;
       }
@@ -38309,67 +39097,9 @@ function pickAssetType(value) {
   return typeof value === "string" && SYNCED_ASSET_TYPES.includes(value) ? value : null;
 }
 
-// dist/src/daemon/runtime/dashboard/harness-detect.js
-import { existsSync as existsSync13 } from "node:fs";
-import { homedir as homedir16 } from "node:os";
-import { join as join21 } from "node:path";
-var HARNESS_MARKERS = [
-  {
-    name: "claude-code",
-    // src/connectors/claude-code.ts: configPath() = ~/.claude/settings.json; pluginRoot = ~/.claude/plugins/honeycomb.
-    paths: (h) => [join21(h, ".claude", "settings.json"), join21(h, ".claude", "plugins", "honeycomb")]
-  },
-  {
-    name: "cursor",
-    // src/connectors/cursor.ts: configPath() = ~/.cursor/hooks.json; pluginRoot = ~/.cursor/honeycomb.
-    paths: (h) => [join21(h, ".cursor", "hooks.json"), join21(h, ".cursor", "honeycomb")]
-  },
-  {
-    name: "codex",
-    // hivemind-v1/src/cli/install-codex.ts: HOOKS_PATH = ~/.codex/hooks.json; PLUGIN_DIR = ~/.codex/hivemind.
-    paths: (h) => [join21(h, ".codex", "hooks.json"), join21(h, ".codex", "hivemind")]
-  },
-  {
-    name: "hermes",
-    // hivemind-v1/src/cli/install-hermes.ts: CONFIG_PATH = ~/.hermes/config.yaml; HIVEMIND_DIR = ~/.hermes/hivemind.
-    paths: (h) => [join21(h, ".hermes", "config.yaml"), join21(h, ".hermes", "hivemind")]
-  },
-  {
-    name: "pi",
-    // hivemind-v1/src/cli/install-pi.ts: AGENTS_MD = ~/.pi/agent/AGENTS.md; EXTENSION_PATH = ~/.pi/agent/extensions/hivemind.ts.
-    paths: (h) => [
-      join21(h, ".pi", "agent", "extensions", "hivemind.ts"),
-      join21(h, ".pi", "agent", "AGENTS.md")
-    ]
-  },
-  {
-    name: "openclaw",
-    // hivemind-v1/src/cli/install-openclaw.ts: PLUGIN_DIR = ~/.openclaw/extensions/hivemind.
-    paths: (h) => [join21(h, ".openclaw", "extensions", "hivemind")]
-  }
-];
-function markerExists(path4) {
-  try {
-    return existsSync13(path4);
-  } catch {
-    return false;
-  }
-}
-function detectInstalledHarnesses(homeDir = homedir16(), _cwd = process.cwd()) {
-  const canonical = new Set(CANONICAL_HARNESS_IDS);
-  const installed = /* @__PURE__ */ new Set();
-  for (const marker of HARNESS_MARKERS) {
-    if (!canonical.has(marker.name))
-      continue;
-    if (marker.paths(homeDir).some(markerExists))
-      installed.add(marker.name);
-  }
-  return installed;
-}
-
 // dist/src/daemon/runtime/dashboard/web-assets.js
 import { existsSync as existsSync14, readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname12, join as join22 } from "node:path";
+import { dirname as dirname13, join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var CSS_FILES = ["tokens/fonts.css", "tokens/colors.css", "tokens/typography.css", "tokens/spacing.css", "tokens/base.css"];
 var LOGO_FILE = "logos/honeycomb-memory-cluster.svg";
@@ -38394,7 +39124,7 @@ var DASHBOARD_APP_BUNDLE = "dashboard-app.js";
 function resolveAssetsDir(startUrl = import.meta.url) {
   let dir;
   try {
-    dir = dirname12(fileURLToPath2(startUrl));
+    dir = dirname13(fileURLToPath2(startUrl));
   } catch {
     return null;
   }
@@ -38402,7 +39132,7 @@ function resolveAssetsDir(startUrl = import.meta.url) {
     const candidate = join22(dir, "assets");
     if (existsSync14(join22(candidate, "styles.css")))
       return candidate;
-    const parent = dirname12(dir);
+    const parent = dirname13(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -38411,7 +39141,7 @@ function resolveAssetsDir(startUrl = import.meta.url) {
 }
 function resolveBundleDir(startUrl = import.meta.url) {
   try {
-    return dirname12(fileURLToPath2(startUrl));
+    return dirname13(fileURLToPath2(startUrl));
   } catch {
     return null;
   }
@@ -38523,24 +39253,27 @@ function mountDashboardHost(daemon, options = {}) {
   if (root === void 0)
     return;
   const assets = options.assets ?? createWebAssets();
-  root.get(DASHBOARD_HOST_PATH, (c) => c.html(renderShell()));
+  root.get(DASHBOARD_HOST_PATH, (c) => {
+    c.header("cache-control", "no-cache");
+    return c.html(renderShell());
+  });
   root.get(DASHBOARD_APP_PATH, (c) => {
     const asset = assets.appJs();
     if (asset === null)
       return c.text("dashboard bundle not built", 404);
-    return c.body(asset.body, 200, { "content-type": asset.contentType });
+    return c.body(asset.body, 200, { "content-type": asset.contentType, "cache-control": "no-cache" });
   });
   root.get(DASHBOARD_CSS_PATH, (c) => {
     const asset = assets.css();
     if (asset === null)
       return c.text("dashboard styles unavailable", 404);
-    return c.body(asset.body, 200, { "content-type": asset.contentType });
+    return c.body(asset.body, 200, { "content-type": asset.contentType, "cache-control": "no-cache" });
   });
   root.get(DASHBOARD_LOGO_PATH, (c) => {
     const asset = assets.logo();
     if (asset === null)
       return c.text("dashboard logo unavailable", 404);
-    return c.body(asset.body, 200, { "content-type": asset.contentType });
+    return c.body(asset.body, 200, { "content-type": asset.contentType, "cache-control": "no-cache" });
   });
   root.get(DASHBOARD_FONT_PATH, (c) => {
     const asset = assets.font(c.req.param("name"));
@@ -38589,8 +39322,8 @@ function mountSetupLogin(daemon, options = {}) {
     };
     let rejectGrant = () => {
     };
-    const grantReady = new Promise((resolve6, reject) => {
-      resolveGrant = resolve6;
+    const grantReady = new Promise((resolve7, reject) => {
+      resolveGrant = resolve7;
       rejectGrant = reject;
     });
     const deps = {
@@ -38621,7 +39354,7 @@ function mountSetupLogin(daemon, options = {}) {
 
 // dist/src/daemon/runtime/dashboard/setup-state.js
 import { existsSync as existsSync15 } from "node:fs";
-import { homedir as homedir17 } from "node:os";
+import { homedir as homedir18 } from "node:os";
 import { join as join23 } from "node:path";
 var SETUP_STATE_PATH = "/setup/state";
 var SETUP_STATE_GROUP = "/";
@@ -38644,7 +39377,7 @@ function derivePriorTool(recorded, hivemindDirPresent) {
   return hivemindDirPresent ? { hivemind: "present" } : recorded;
 }
 function resolveSetupState(deps = {}) {
-  const home = deps.homeDir ?? homedir17();
+  const home = deps.homeDir ?? homedir18();
   const env = deps.env ?? process.env;
   const onboarding = loadOnboarding(deps.onboardingDir);
   const legacyCredentialsDir = deps.legacyCredentialsDir ?? join23(home, LEGACY_CREDENTIALS_DIR_NAME);
@@ -38679,8 +39412,8 @@ function mountSetupStateApi(daemon, deps = {}) {
 
 // dist/src/daemon/runtime/onboarding/hivemind-uninstall.js
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { cpSync, existsSync as existsSync16, rmSync as rmSync6 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
+import { cpSync, existsSync as existsSync16, rmSync as rmSync7 } from "node:fs";
+import { homedir as homedir19 } from "node:os";
 import { join as join24 } from "node:path";
 var HIVEMIND_DIR_NAME2 = ".hivemind";
 var HIVEMIND_NPM_PACKAGE = "@deeplake/hivemind";
@@ -38702,7 +39435,7 @@ function hivemindBackupPath(home, iso) {
   return join24(home, `${HIVEMIND_BACKUP_PREFIX}${safe}`);
 }
 function backupAndUninstallHivemind(deps = {}) {
-  const home = deps.homeDir ?? homedir18();
+  const home = deps.homeDir ?? homedir19();
   const npmRemove = deps.npmRemove ?? defaultNpmGlobalRemover;
   const dir = hivemindDirPath(home);
   let npmRemoved = false;
@@ -38718,7 +39451,7 @@ function backupAndUninstallHivemind(deps = {}) {
   const backupPath = hivemindBackupPath(home, iso);
   cpSync(dir, backupPath, { recursive: true });
   try {
-    rmSync6(dir, { recursive: true, force: true });
+    rmSync7(dir, { recursive: true, force: true });
     return { removed: true, backupPath, npmRemoved };
   } catch {
     return { removed: false, backupPath, npmRemoved };
@@ -38727,9 +39460,9 @@ function backupAndUninstallHivemind(deps = {}) {
 function restoreHivemindBackup(backupPath, deps = {}) {
   if (backupPath.length === 0 || !existsSync16(backupPath))
     return false;
-  const home = deps.homeDir ?? homedir18();
+  const home = deps.homeDir ?? homedir19();
   const dir = hivemindDirPath(home);
-  rmSync6(dir, { recursive: true, force: true });
+  rmSync7(dir, { recursive: true, force: true });
   cpSync(backupPath, dir, { recursive: true });
   return true;
 }
@@ -39549,8 +40282,8 @@ function resolveProjectsScope(c, defaultScope) {
 
 // dist/src/daemon/runtime/projects/onboarding-api.js
 import { existsSync as existsSync17, readdirSync as readdirSync3, realpathSync, statSync as statSync2 } from "node:fs";
-import { homedir as homedir19 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join25, resolve as resolve5, sep as sep3 } from "node:path";
+import { homedir as homedir20 } from "node:os";
+import { isAbsolute as isAbsolute2, join as join25, resolve as resolve6, sep as sep3 } from "node:path";
 var ONBOARDING_GROUP = "/api/diagnostics";
 var FS_BROWSE_PATH = "/fs/browse";
 var PROJECTS_BIND_PATH = "/projects/bind";
@@ -39578,19 +40311,19 @@ function suggestProjectId(absPath, readRemote) {
         return repo;
     }
   }
-  const segs = resolve5(absPath).split(sep3).filter((s) => s.length > 0);
+  const segs = resolve6(absPath).split(sep3).filter((s) => s.length > 0);
   const base = segs[segs.length - 1];
   return base ?? "";
 }
 function canonicalize(absPath) {
-  let head = resolve5(absPath);
+  let head = resolve6(absPath);
   const tail = [];
   for (; ; ) {
     try {
       const real = realpathSync(head);
       return stripTrailingSep(tail.length > 0 ? join25(real, ...tail.reverse()) : real);
     } catch {
-      const parent = resolve5(head, "..");
+      const parent = resolve6(head, "..");
       if (parent === head)
         return stripTrailingSep(head);
       const segmentStart = parent.endsWith(sep3) ? parent.length : parent.length + sep3.length;
@@ -39617,7 +40350,7 @@ function parentWithinRoot(dir, root) {
   const normalizedRoot = root;
   if (dir === normalizedRoot)
     return null;
-  const parent = canonicalize(resolve5(dir, ".."));
+  const parent = canonicalize(resolve6(dir, ".."));
   return parent === normalizedRoot || parent.startsWith(normalizedRoot + sep3) ? parent : normalizedRoot;
 }
 function listChildDirs(dir) {
@@ -39655,7 +40388,7 @@ function mountOnboardingApi(daemon, options) {
   if (group === void 0)
     return;
   const mode = daemon.config.mode;
-  const root = canonicalize(options.browseRoot ?? homedir19());
+  const root = canonicalize(options.browseRoot ?? homedir20());
   const readRemote = options.readRemote ?? defaultGitRemoteReader;
   const notLocal = () => mode !== "local";
   group.get(FS_BROWSE_PATH, (c) => {
@@ -39747,7 +40480,7 @@ function resolveBindPath(path4) {
   const trimmed = path4.trim();
   if (trimmed.length === 0 || !isAbsolute2(trimmed))
     return null;
-  return resolve5(trimmed);
+  return resolve6(trimmed);
 }
 function rejectBind(path4, reason) {
   return { bound: false, path: path4, projectId: "", error: reason };
@@ -39776,9 +40509,9 @@ function remoteFor(absPath, readRemote) {
   return raw2 !== null ? canonicalizeRemote(raw2) : "";
 }
 function removeBinding(absPath, options) {
-  const normalized = stripTrailingSep(resolve5(absPath));
+  const normalized = stripTrailingSep(resolve6(absPath));
   const loaded = loadProjectsCache(options.projectsDir);
-  const kept = loaded.bindings.filter((b) => stripTrailingSep(resolve5(b.path)) !== normalized);
+  const kept = loaded.bindings.filter((b) => stripTrailingSep(resolve6(b.path)) !== normalized);
   if (kept.length === loaded.bindings.length) {
     return { unbound: false, path: normalized };
   }
@@ -41384,7 +42117,7 @@ function recordKey(record2) {
 // dist/src/daemon/runtime/notifications/api.js
 var NOTIFICATIONS_GROUP = "/api/diagnostics";
 var NOTIFICATIONS_PATH = "/notifications";
-var headerScopeResolver = {
+var headerScopeResolver2 = {
   resolve(c) {
     const org = c.req.header("x-honeycomb-org");
     if (org === void 0 || org.length === 0)
@@ -41428,7 +42161,7 @@ function mountNotificationsApi(daemon, options) {
   if (group === void 0)
     return;
   const table = options.table ?? "notifications";
-  const scopeResolver = options.scope ?? headerScopeResolver;
+  const scopeResolver = options.scope ?? headerScopeResolver2;
   group.get(NOTIFICATIONS_PATH, async (c) => {
     const scope = scopeResolver.resolve(c);
     if (scope === null) {
@@ -41614,6 +42347,8 @@ var DEFAULT_TRAVERSAL_MIN_EDGE_WEIGHT = 0.3;
 var DEFAULT_TRAVERSAL_TIMEOUT_MS = 500;
 var DEFAULT_RERANKER = "none";
 var DEFAULT_RERANKER_TIMEOUT_MS = 300;
+var DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS = 1e3;
+var DEFAULT_RERANKER_COHERE_MODEL = "rerank-v3.5";
 var DEFAULT_RERANKER_WINDOW = 50;
 var DEFAULT_DEDUP_ENABLED = true;
 var DEFAULT_DEDUP_SIMILARITY_THRESHOLD = 0.9;
@@ -41632,7 +42367,7 @@ var DEFAULT_RESOLUTION_BOOST = 1.25;
 var DEFAULT_REHEARSAL_BOOST = 1.1;
 var DEFAULT_REHEARSAL_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
 var DEFAULT_MIN_INJECTION_SCORE = 0.6;
-var RERANKER_STRATEGIES = Object.freeze(["embedding-cosine", "llm", "none"]);
+var RERANKER_STRATEGIES = Object.freeze(["embedding-cosine", "llm", "cohere", "none"]);
 var BoolFlag3 = external_exports.preprocess((raw2) => {
   if (typeof raw2 === "boolean")
     return raw2;
@@ -41687,12 +42422,26 @@ var TraversalConfigSchema = external_exports.object({
   timeoutMs: ClampedInt4(DEFAULT_TRAVERSAL_TIMEOUT_MS, 1).default(DEFAULT_TRAVERSAL_TIMEOUT_MS)
 });
 var RerankerConfigSchema = external_exports.object({
-  /** The reranker strategy (D-4). */
+  /** The reranker strategy (D-4 + PRD-063c). */
   strategy: external_exports.enum(RERANKER_STRATEGIES).default(DEFAULT_RERANKER),
-  /** Reranker timeout in ms; on timeout keep the original order (d-AC-2 / b-AC-2). */
+  /** Reranker timeout in ms; on timeout keep the original order (d-AC-2 / b-AC-2). LOCAL-cosine budget. */
   timeoutMs: ClampedInt4(DEFAULT_RERANKER_TIMEOUT_MS, 1).default(DEFAULT_RERANKER_TIMEOUT_MS),
+  /**
+   * The PROVIDER-rerank timeout in ms (PRD-063c / c-AC-3): the budget for the `cohere` outbound
+   * Portkey round-trip, larger than the local-cosine {@link timeoutMs} because it crosses the
+   * network. A `cohere` call that exceeds it FAILS SOFT to the RRF order. Defaults to
+   * {@link DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS} (1000ms); the local-cosine path never reads it.
+   */
+  providerTimeoutMs: ClampedInt4(DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS, 1).default(DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS),
   /** Rerank window N: how many fused top-N candidates to re-score (PRD-047b). */
-  window: ClampedInt4(DEFAULT_RERANKER_WINDOW, 1).default(DEFAULT_RERANKER_WINDOW)
+  window: ClampedInt4(DEFAULT_RERANKER_WINDOW, 1).default(DEFAULT_RERANKER_WINDOW),
+  /**
+   * The Cohere rerank `model` id sent to Portkey when the strategy is `cohere` (PRD-063c / c-D-1).
+   * Defaults to {@link DEFAULT_RERANKER_COHERE_MODEL}; the operator may override it (or configure
+   * the model inside Portkey). A non-string env value falls back to the default. Only the `cohere`
+   * strategy reads it.
+   */
+  cohereModel: external_exports.string().min(1).catch(DEFAULT_RERANKER_COHERE_MODEL).default(DEFAULT_RERANKER_COHERE_MODEL)
 });
 var DedupConfigSchema = external_exports.object({
   /** Whether semantic near-duplicate dedup runs; ON by default (PRD-047c / c-AC-3). */
@@ -41792,7 +42541,9 @@ function envRecallConfigProvider(env = process.env) {
         reranker: {
           strategy: env.HONEYCOMB_RECALL_RERANKER,
           timeoutMs: env.HONEYCOMB_RECALL_RERANKER_TIMEOUT_MS,
-          window: env.HONEYCOMB_RECALL_RERANKER_WINDOW
+          providerTimeoutMs: env.HONEYCOMB_RECALL_RERANKER_PROVIDER_TIMEOUT_MS,
+          window: env.HONEYCOMB_RECALL_RERANKER_WINDOW,
+          cohereModel: env.HONEYCOMB_RECALL_RERANKER_COHERE_MODEL
         },
         dampening: {
           gravity: env.HONEYCOMB_RECALL_DAMPENING_GRAVITY,
@@ -41861,10 +42612,10 @@ var Semaphore = class {
       this.held += 1;
       return Promise.resolve();
     }
-    return new Promise((resolve6) => {
+    return new Promise((resolve7) => {
       this.waiters.push(() => {
         this.held += 1;
-        resolve6();
+        resolve7();
       });
     });
   }
@@ -42367,9 +43118,16 @@ async function fetchCandidateEmbeddings(candidates, request, deps) {
 }
 async function rerankHits(hits, queryVector, config2, request, deps) {
   const rrfOrder = [...hits];
+  if (hits.length === 0)
+    return rrfOrder;
+  if (config2.strategy === "cohere") {
+    if (deps.cohereRerank === void 0)
+      return rrfOrder;
+    return rerankWithCohere(rrfOrder, config2, request, deps, deps.cohereRerank);
+  }
   if (config2.strategy !== "embedding-cosine")
     return rrfOrder;
-  if (hits.length === 0)
+  if (queryVector === null)
     return rrfOrder;
   const now = deps.now ?? Date.now;
   const start = now();
@@ -42400,6 +43158,56 @@ async function rerankHits(hits, queryVector, config2, request, deps) {
     return rrfOrder;
   }
 }
+async function rerankWithCohere(rrfOrder, config2, request, deps, seam) {
+  const baseOrder = [...rrfOrder];
+  const now = deps.now ?? Date.now;
+  const start = now();
+  const window = Math.max(1, Math.trunc(config2.window));
+  const head = baseOrder.slice(0, window);
+  const tail = baseOrder.slice(window);
+  const documents = head.map((h) => h.text);
+  try {
+    const timeoutMs = Math.max(1, Math.trunc(config2.providerTimeoutMs));
+    const TIMED_OUT = /* @__PURE__ */ Symbol("rerank-timeout");
+    let timer;
+    const timeout = new Promise((resolve7) => {
+      timer = setTimeout(() => resolve7(TIMED_OUT), timeoutMs);
+    });
+    let outcome;
+    try {
+      outcome = await Promise.race([seam.rerank(request.query, documents, head.length), timeout]);
+    } finally {
+      if (timer !== void 0)
+        clearTimeout(timer);
+    }
+    if (outcome === TIMED_OUT || outcome.ok === false)
+      return baseOrder;
+    const scoreByIndex = /* @__PURE__ */ new Map();
+    for (const r of outcome.results) {
+      if (r.index >= 0 && r.index < head.length && !scoreByIndex.has(r.index)) {
+        scoreByIndex.set(r.index, r.relevanceScore);
+      }
+    }
+    const scoredSlots = [];
+    for (let i = 0; i < head.length; i++) {
+      if (scoreByIndex.has(i))
+        scoredSlots.push(i);
+    }
+    const orderedByScore = scoredSlots.map((index) => ({ index, score: scoreByIndex.get(index) })).sort((a, b) => {
+      if (b.score !== a.score)
+        return b.score - a.score;
+      return a.index - b.index;
+    });
+    const reorderedHead = head.slice();
+    scoredSlots.forEach((slot, i) => {
+      reorderedHead[slot] = head[orderedByScore[i].index];
+    });
+    void start;
+    return [...reorderedHead, ...tail];
+  } catch {
+    return baseOrder;
+  }
+}
 function provenanceRank(source) {
   if (source === "memories")
     return 0;
@@ -42739,11 +43547,15 @@ async function recallMemories(request, deps) {
     rowsToRankedArm(sessionsRows)
   ];
   const { hits, sources } = fuseHits(arms, limit);
-  const rerankerConfig = deps.reranker ?? { strategy: DEFAULT_RERANKER, timeoutMs: DEFAULT_RERANKER_TIMEOUT_MS, window: DEFAULT_RERANKER_WINDOW };
-  const ranked = semanticRun === null || rerankerConfig.strategy === "none" ? (
-    // No query vector to rerank against, or RRF-only requested → keep the fused order.
-    hits
-  ) : await rerankHits(hits, semanticRun.queryVector, rerankerConfig, request, deps);
+  const rerankerConfig = deps.reranker ?? {
+    strategy: DEFAULT_RERANKER,
+    timeoutMs: DEFAULT_RERANKER_TIMEOUT_MS,
+    providerTimeoutMs: DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS,
+    window: DEFAULT_RERANKER_WINDOW,
+    cohereModel: DEFAULT_RERANKER_COHERE_MODEL
+  };
+  const skipRerank = rerankerConfig.strategy === "none" || rerankerConfig.strategy !== "cohere" && semanticRun === null;
+  const ranked = skipRerank ? hits : await rerankHits(hits, semanticRun?.queryVector ?? null, rerankerConfig, request, deps);
   const dedupConfig = deps.dedup ?? { enabled: DEFAULT_DEDUP_ENABLED, similarityThreshold: DEFAULT_DEDUP_SIMILARITY_THRESHOLD };
   const deduped = await dedupHits(ranked, dedupConfig, request, deps);
   const dedupedSources = deduped.length === ranked.length ? sources : [...new Set(deduped.map((h) => h.source))];
@@ -42772,470 +43584,6 @@ async function recallMemories(request, deps) {
   }
 }
 
-// dist/src/daemon/runtime/secrets/api.js
-function localDefaultScopeResolver(mode, defaultScope) {
-  return {
-    resolve(c) {
-      const fromHeader = headerScopeResolver2.resolve(c);
-      if (fromHeader !== null)
-        return fromHeader;
-      if (mode === "local" && defaultScope !== void 0) {
-        return { org: defaultScope.org, workspace: defaultScope.workspace ?? "default" };
-      }
-      return null;
-    }
-  };
-}
-var headerScopeResolver2 = {
-  resolve(c) {
-    const org = c.req.header("x-honeycomb-org");
-    if (org === void 0 || org.length === 0)
-      return null;
-    const workspace = c.req.header("x-honeycomb-workspace");
-    const agentId = c.req.header("x-honeycomb-agent");
-    const ws = workspace !== void 0 && workspace.length > 0 ? workspace : "default";
-    return agentId !== void 0 && agentId.length > 0 ? { org, workspace: ws, agentId } : { org, workspace: ws };
-  }
-};
-function mountSecretsApi(group, deps) {
-  const scope = deps.scope ?? headerScopeResolver2;
-  const store = deps.store;
-  const runner = deps.execRunner;
-  if (runner !== void 0) {
-    group.post("/exec", async (c) => {
-      const sc = scope.resolve(c);
-      if (sc === null)
-        return badTenancy(c);
-      const request = await readExecRequest(c, sc);
-      if (request === null) {
-        return c.json({ error: "bad_request", reason: "exec body must carry a command" }, 400);
-      }
-      const res = runner.submit(request);
-      if (!res.ok) {
-        if (res.reason === "queue_full") {
-          return c.json({ error: "queue_full", reason: "exec pool and queue are at capacity" }, 429);
-        }
-        return c.json({ error: "bad_request", reason: "invalid exec request" }, 400);
-      }
-      return c.json({ ok: true, jobId: res.jobId, status: "queued" }, 202);
-    });
-    group.get("/exec/:jobId", (c) => {
-      const sc = scope.resolve(c);
-      if (sc === null)
-        return badTenancy(c);
-      const jobId = c.req.param("jobId");
-      const view = runner.getStatus(jobId, sc);
-      if (view === null) {
-        return c.json({ error: "not_found", reason: "no such exec job" }, 404);
-      }
-      return c.json(view);
-    });
-    group.all("/bitwarden/*", (c) => c.json({ error: "use_exec", reason: "reference a Bitwarden item via exec vaultRefs; values are never returned" }, 400));
-    group.all("/1password/*", (c) => c.json({ error: "use_exec", reason: "reference a 1Password item via exec vaultRefs; values are never returned" }, 400));
-  } else {
-    group.post("/exec", (c) => notImplementedRoute(c, "POST /api/secrets/exec (secret_exec)"));
-    group.get("/exec/:jobId", (c) => notImplementedRoute(c, "GET /api/secrets/exec/:jobId (exec status)"));
-    group.all("/bitwarden/*", (c) => notImplementedRoute(c, "Bitwarden vault provider"));
-    group.all("/1password/*", (c) => notImplementedRoute(c, "1Password vault provider"));
-  }
-  group.get("/", (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy(c);
-    const names = store.listSecretNames(sc);
-    return c.json({ names });
-  });
-  group.post("/:name", async (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy(c);
-    const name = c.req.param("name");
-    const value = await readValue(c);
-    if (value === null) {
-      return c.json({ error: "bad_request", reason: "request body must carry a string value" }, 400);
-    }
-    const res = await store.setSecret(name, value, sc);
-    if (!res.ok) {
-      if (res.reason === "invalid_name") {
-        return c.json({ error: "bad_request", reason: "invalid secret name" }, 400);
-      }
-      return c.json({ error: "store_failed", reason: "could not store the secret" }, 502);
-    }
-    return c.json({ ok: true, name }, 201);
-  });
-  group.delete("/:name", (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy(c);
-    const name = c.req.param("name");
-    const res = store.deleteSecret(name, sc);
-    if (!res.ok) {
-      if (res.reason === "invalid_name") {
-        return c.json({ error: "bad_request", reason: "invalid secret name" }, 400);
-      }
-      if (res.reason === "not_found") {
-        return c.json({ error: "not_found", reason: "no such secret" }, 404);
-      }
-      return c.json({ error: "delete_failed", reason: "could not delete the secret" }, 502);
-    }
-    return c.json({ ok: true, name });
-  });
-}
-function badTenancy(c) {
-  return c.json({ error: "bad_request", reason: "x-honeycomb-org header is required" }, 400);
-}
-async function readValue(c) {
-  const contentType = c.req.header("content-type") ?? "";
-  if (contentType.includes("application/json")) {
-    try {
-      const body = await c.req.json();
-      if (typeof body === "object" && body !== null) {
-        const v = body.value;
-        if (typeof v === "string" && v.length > 0)
-          return v;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  }
-  const text = await c.req.text();
-  return text.length > 0 ? text : null;
-}
-function notImplementedRoute(c, what) {
-  return c.json({ error: "not_implemented", reason: `${what} is implemented in PRD-012b` }, 501);
-}
-async function readExecRequest(c, scope) {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return null;
-  }
-  if (typeof body !== "object" || body === null)
-    return null;
-  const b = body;
-  const command = b.command;
-  if (typeof command !== "string" || command.length === 0)
-    return null;
-  const args = Array.isArray(b.args) ? b.args.filter((a) => typeof a === "string") : [];
-  const secretNames = Array.isArray(b.secretNames) ? b.secretNames.filter((n) => typeof n === "string") : [];
-  const vaultRefs = {};
-  if (typeof b.vaultRefs === "object" && b.vaultRefs !== null) {
-    for (const [k, v] of Object.entries(b.vaultRefs)) {
-      if (typeof v === "string")
-        vaultRefs[k] = v;
-    }
-  }
-  const timeoutMs = typeof b.timeoutMs === "number" ? b.timeoutMs : void 0;
-  return { command, args, secretNames, vaultRefs, scope, timeoutMs };
-}
-
-// dist/src/daemon/runtime/vault/catalog.js
-var PROVIDER_CATALOG = Object.freeze([
-  Object.freeze({
-    id: "anthropic",
-    label: "Anthropic",
-    models: Object.freeze(["claude-sonnet-4-6", "claude-opus-4-8"]),
-    openEnded: false
-  }),
-  Object.freeze({
-    id: "openai",
-    label: "OpenAI",
-    models: Object.freeze(["gpt-4o", "gpt-4o-mini", "gpt-4.1"]),
-    openEnded: false
-  }),
-  Object.freeze({
-    id: "openrouter",
-    label: "OpenRouter",
-    // Suggestions only — OpenRouter accepts a free-form `vendor/model` id (passthrough).
-    models: Object.freeze(["anthropic/claude-sonnet-4.6", "openai/gpt-4o"]),
-    openEnded: true
-  })
-]);
-function providerEntry(provider) {
-  return PROVIDER_CATALOG.find((p) => p.id === provider);
-}
-function isValidProviderModel(provider, model) {
-  const entry = providerEntry(provider);
-  if (entry === void 0)
-    return false;
-  if (typeof model !== "string" || model.length === 0)
-    return false;
-  if (entry.openEnded)
-    return true;
-  return entry.models.includes(model);
-}
-function catalogView() {
-  return PROVIDER_CATALOG;
-}
-
-// dist/src/daemon/runtime/secrets/contracts.js
-import { homedir as homedir20, hostname as hostname4, userInfo } from "node:os";
-var SECRET_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
-var MAX_SECRET_NAME_LENGTH = 128;
-function isValidSecretName(value) {
-  if (typeof value !== "string")
-    return false;
-  if (value.length === 0 || value.length > MAX_SECRET_NAME_LENGTH)
-    return false;
-  if (value === "." || value === "..")
-    return false;
-  if (value.includes("/") || value.includes("\\") || value.includes("\0"))
-    return false;
-  return SECRET_NAME_PATTERN.test(value);
-}
-function asSecretName(value) {
-  return isValidSecretName(value) ? value : null;
-}
-function isSecretRecord(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const r = value;
-  if (typeof r.nonce !== "string" || typeof r.ciphertext !== "string" || typeof r.createdAt !== "string") {
-    return false;
-  }
-  const scope = r.scope;
-  if (typeof scope !== "object" || scope === null)
-    return false;
-  const s = scope;
-  if (typeof s.org !== "string" || typeof s.workspace !== "string")
-    return false;
-  if (s.agentId !== void 0 && typeof s.agentId !== "string")
-    return false;
-  return true;
-}
-var MACHINE_KEY_DIR_NAME = ".honeycomb";
-var MACHINE_KEY_FILE_NAME = ".machine-key";
-function hostnameUserFallbackId() {
-  let user = "";
-  try {
-    user = userInfo().username;
-  } catch {
-    user = "";
-  }
-  return `host:${hostname4()}|user:${user}|home:${homedir20()}`;
-}
-
-// dist/src/daemon/runtime/vault/contracts.js
-function asRecordClass(value) {
-  return isValidSecretName(value) ? value : null;
-}
-
-// dist/src/daemon/runtime/vault/registry.js
-var SECRET_CLASS = "secret";
-var SETTING_CLASS = "setting";
-var SecretValueSchema = external_exports.string().min(1);
-var SettingValueSchema = external_exports.union([external_exports.string(), external_exports.number().finite(), external_exports.boolean()]);
-var SECRET_DESCRIPTOR = Object.freeze({
-  id: SECRET_CLASS,
-  posture: "internal-only",
-  schema: SecretValueSchema
-});
-var SETTING_DESCRIPTOR = Object.freeze({
-  id: SETTING_CLASS,
-  posture: "daemon-readable",
-  schema: SettingValueSchema
-});
-var VaultRegistry = class {
-  table;
-  constructor(descriptors) {
-    this.table = /* @__PURE__ */ new Map();
-    for (const d of descriptors)
-      this.table.set(d.id, d);
-  }
-  /**
-   * Register a new record class (D-7). Validates the id is traversal-proof (a class is an
-   * on-disk segment) and that the posture is one the store understands, then adds the
-   * descriptor. Re-registering an existing id REPLACES it (so a test can swap a throwaway
-   * class); registering the built-in `secret`/`setting` ids is allowed but discouraged —
-   * their posture must not be loosened. Returns the registry for chaining.
-   *
-   * Throws on an invalid (traversal-unsafe) class id — that is a programming error, not a
-   * runtime input, so it fails loud rather than silently dropping the class.
-   */
-  registerClass(descriptor) {
-    const safe = asRecordClass(descriptor.id);
-    if (safe === null) {
-      throw new Error(`vault.registerClass: invalid (traversal-unsafe) class id`);
-    }
-    this.table.set(descriptor.id, descriptor);
-    return this;
-  }
-  /** Whether a class id is registered. */
-  has(klass) {
-    return this.table.has(klass);
-  }
-  /** The registered class ids (sorted), for diagnostics — never values. */
-  classIds() {
-    return [...this.table.keys()].sort();
-  }
-  /**
-   * Resolve a class's descriptor for a WRITE, validating the value against the class
-   * schema (zod-at-boundary). Returns `unknown_class` for an unregistered class or
-   * `invalid_value` when the value fails the schema — both fail-closed (nothing is
-   * written). On success the descriptor (with the validated value available via the
-   * caller's re-parse) is returned.
-   */
-  resolveForWrite(klass, value) {
-    const descriptor = this.table.get(klass);
-    if (descriptor === void 0)
-      return { ok: false, reason: "unknown_class" };
-    const parsed = descriptor.schema.safeParse(value);
-    if (!parsed.success)
-      return { ok: false, reason: "invalid_value" };
-    return { ok: true, descriptor };
-  }
-  /**
-   * The POSTURE GATE (a-AC-2). Resolve a class's descriptor for a READ that intends to
-   * RETURN the value to a surface (the `getSetting` path). REJECTS a class whose posture
-   * is `internal-only` with `not_readable` — so a `secret` can NEVER be read back through
-   * the daemon-readable accessor. An unknown class is `unknown_class`. This is the single
-   * point where the secret-vs-setting security boundary is enforced, as data.
-   */
-  assertReadable(klass) {
-    const descriptor = this.table.get(klass);
-    if (descriptor === void 0)
-      return { ok: false, reason: "unknown_class" };
-    if (descriptor.posture !== "daemon-readable")
-      return { ok: false, reason: "not_readable" };
-    return { ok: true, descriptor };
-  }
-  /** Resolve a descriptor with no value/posture check (internal callers that already gate). */
-  descriptorOf(klass) {
-    return this.table.get(klass);
-  }
-};
-function createVaultRegistry(extra = []) {
-  return new VaultRegistry([SECRET_DESCRIPTOR, SETTING_DESCRIPTOR, ...extra]);
-}
-
-// dist/src/daemon/runtime/vault/api.js
-var SETTINGS_GROUP = "/api/settings";
-var KNOWN_SETTING_KEYS = ["activeProvider", "activeModel", "pollinating.enabled", "recallMode"];
-var RECALL_MODES = ["keyword", "semantic", "hybrid"];
-function isValidRecallMode(value) {
-  return RECALL_MODES.includes(value);
-}
-var DASHBOARD_PREF_PREFIX = "dashboard.";
-function isKnownSettingKey(key) {
-  if (KNOWN_SETTING_KEYS.includes(key))
-    return true;
-  return key.startsWith(DASHBOARD_PREF_PREFIX) && key.length > DASHBOARD_PREF_PREFIX.length;
-}
-function mountSettingsGroup(group, deps) {
-  const scope = deps.scope ?? headerScopeResolver2;
-  const store = deps.store;
-  group.get("/", async (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy2(c);
-    const keys = store.listSettingKeys(sc);
-    const settings = {};
-    for (const key of keys) {
-      const res = await store.getSetting(key, sc);
-      if (res.ok)
-        settings[key] = res.value;
-    }
-    return c.json({ settings, catalog: catalogView() });
-  });
-  group.get("/:key", async (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy2(c);
-    const key = c.req.param("key");
-    if (!isKnownSettingKey(key)) {
-      return c.json({ error: "not_found", reason: "no such setting" }, 404);
-    }
-    const res = await store.getSetting(key, sc);
-    if (!res.ok) {
-      if (res.reason === "not_found")
-        return c.json({ error: "not_found", reason: "no such setting" }, 404);
-      if (res.reason === "not_readable")
-        return c.json({ error: "not_found", reason: "no such setting" }, 404);
-      return c.json({ error: "read_failed", reason: "could not read the setting" }, 502);
-    }
-    return c.json({ key, value: res.value });
-  });
-  group.post("/:key", async (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy2(c);
-    const key = c.req.param("key");
-    if (!isKnownSettingKey(key)) {
-      return c.json({ error: "bad_request", reason: "unknown setting key" }, 400);
-    }
-    const value = await readSettingValue(c);
-    if (value === null) {
-      return c.json({ error: "bad_request", reason: "request body must carry a scalar value" }, 400);
-    }
-    const semanticError = await validateSettingSemantics(store, sc, key, value);
-    if (semanticError !== null) {
-      return c.json({ error: "bad_request", reason: semanticError }, 400);
-    }
-    const res = await store.setSetting(key, value, sc);
-    if (!res.ok) {
-      if (res.reason === "invalid_value") {
-        return c.json({ error: "bad_request", reason: "invalid setting value" }, 400);
-      }
-      if (res.reason === "not_readable" || res.reason === "unknown_class") {
-        return c.json({ error: "bad_request", reason: "setting class is not writable" }, 400);
-      }
-      return c.json({ error: "store_failed", reason: "could not store the setting" }, 502);
-    }
-    return c.json({ ok: true, key, value }, 201);
-  });
-}
-function mountSettingsApi(daemon, deps) {
-  const group = daemon.group(SETTINGS_GROUP);
-  if (group === void 0)
-    return;
-  mountSettingsGroup(group, deps);
-}
-function badTenancy2(c) {
-  return c.json({ error: "bad_request", reason: "x-honeycomb-org header is required" }, 400);
-}
-async function readSettingValue(c) {
-  const contentType = c.req.header("content-type") ?? "";
-  if (contentType.includes("application/json")) {
-    try {
-      const body = await c.req.json();
-      if (typeof body === "object" && body !== null) {
-        const v = body.value;
-        const parsed = SettingValueSchema.safeParse(v);
-        return parsed.success ? parsed.data : null;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  }
-  const text = await c.req.text();
-  return text.length > 0 ? text : null;
-}
-async function validateSettingSemantics(store, scope, key, value) {
-  if (key === "activeProvider") {
-    if (providerEntry(String(value)) === void 0)
-      return "unknown provider";
-    return null;
-  }
-  if (key === "activeModel") {
-    const provRes = await store.getSetting("activeProvider", scope);
-    const provider = provRes.ok ? String(provRes.value) : "";
-    if (provider.length === 0)
-      return "set activeProvider before activeModel";
-    if (!isValidProviderModel(provider, String(value)))
-      return "model not in provider catalog";
-    return null;
-  }
-  if (key === "recallMode") {
-    if (!isValidRecallMode(String(value)))
-      return "recallMode must be keyword, semantic, or hybrid";
-    return null;
-  }
-  return null;
-}
-
 // dist/src/daemon/runtime/memories/calibration-store.js
 function coldStart(bins) {
   return {
@@ -44273,7 +44621,13 @@ function mountMemoriesApi(daemon, options) {
       // PRD-058a: the per-request recency override (per-class half-lives + activation exponent).
       ...recency !== void 0 ? { recency } : {},
       // PRD-058b: the κ gate's conflict-suppression seam (drops the κ = ρ open-conflict loser).
-      ...options.conflictSuppression !== void 0 ? { conflictSuppression: options.conflictSuppression } : {}
+      ...options.conflictSuppression !== void 0 ? { conflictSuppression: options.conflictSuppression } : {},
+      // PRD-063c: the operator-selected reranker config + the Cohere-via-Portkey seam. The
+      // `cohere` strategy activates ONLY when BOTH are present (the strategy is `cohere` AND the
+      // gateway-on seam is wired); otherwise the engine keeps the RRF order / runs the local
+      // cosine path — byte-identical to today (c-AC-4).
+      ...options.reranker !== void 0 ? { reranker: options.reranker } : {},
+      ...options.cohereRerank !== void 0 ? { cohereRerank: options.cohereRerank } : {}
     });
     logDegradedRecall(options.logger, result);
     logProjectScopeDegraded(options.logger, project);
@@ -45741,7 +46095,7 @@ var DISCOVERY_POLLS = 20;
 var DISCOVERY_POLL_DELAY_MS = 400;
 var DISCOVERY_STABLE_BREAK = 4;
 function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function nowIso7() {
   return (/* @__PURE__ */ new Date()).toISOString();
@@ -46979,7 +47333,7 @@ function guardedLookup(allowLoopback) {
 }
 function requestOnce(url2, timeoutMs, maxBytes, allowLoopback) {
   const requestFn = url2.protocol === "https:" ? httpsRequest : httpRequest;
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const req = requestFn(url2, {
       method: "GET",
       headers: { "user-agent": USER_AGENT, accept: "*/*" },
@@ -47006,7 +47360,7 @@ function requestOnce(url2, timeoutMs, maxBytes, allowLoopback) {
         if (aborted2)
           return;
         const location = res.headers.location;
-        resolve6({
+        resolve7({
           status: res.statusCode ?? 0,
           location: typeof location === "string" ? location : void 0,
           contentType: typeof res.headers["content-type"] === "string" ? res.headers["content-type"] : "",
@@ -48180,7 +48534,7 @@ function buildSourcesApiDeps(options) {
 // dist/src/daemon/runtime/secrets/store.js
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { appendFileSync, existsSync as existsSync18, mkdirSync as mkdirSync16, readdirSync as readdirSync4, readFileSync as readFileSync18, rmSync as rmSync7, statSync as statSync3, writeFileSync as writeFileSync13 } from "node:fs";
+import { appendFileSync, existsSync as existsSync18, mkdirSync as mkdirSync16, readdirSync as readdirSync4, readFileSync as readFileSync18, rmSync as rmSync8, statSync as statSync3, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir21 } from "node:os";
 import { join as join27 } from "node:path";
 
@@ -49052,7 +49406,7 @@ var SecretsStore = class {
       return { ok: false, reason: "not_found" };
     }
     try {
-      rmSync7(file2);
+      rmSync8(file2);
       this.audit("deleted", scope, "ok", safe);
       return { ok: true };
     } catch {
@@ -49173,7 +49527,7 @@ function stripRefWrapper(ref) {
 }
 
 // dist/src/daemon/runtime/vault/store.js
-import { appendFileSync as appendFileSync2, existsSync as existsSync19, mkdirSync as mkdirSync17, readdirSync as readdirSync5, readFileSync as readFileSync19, rmSync as rmSync8, writeFileSync as writeFileSync14 } from "node:fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync19, mkdirSync as mkdirSync17, readdirSync as readdirSync5, readFileSync as readFileSync19, rmSync as rmSync9, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join28 } from "node:path";
 var VAULT_DIR_NAME = ".vault";
 var VAULT_AUDIT_FILE_NAME = "vault-audit.ndjson";
@@ -49347,7 +49701,7 @@ var VaultStore = class {
       return { ok: false, reason: "not_found" };
     }
     try {
-      rmSync8(file2);
+      rmSync9(file2);
       this.audit(safeClass, "deleted", scope, "ok", safe);
       return { ok: true };
     } catch {
@@ -50286,94 +50640,7 @@ var noopUsageSink = {
   record() {
   }
 };
-var AnthropicContentBlockSchema = external_exports.object({
-  type: external_exports.string(),
-  text: external_exports.string().optional()
-});
-var AnthropicUsageSchema = external_exports.object({
-  input_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
-  output_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
-  cache_read_input_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
-  cache_creation_input_tokens: external_exports.number().int().nonnegative().catch(0).default(0)
-});
-var ZERO_USAGE = {
-  input_tokens: 0,
-  output_tokens: 0,
-  cache_read_input_tokens: 0,
-  cache_creation_input_tokens: 0
-};
-var AnthropicMessagesResponseSchema = external_exports.object({
-  content: external_exports.array(AnthropicContentBlockSchema).default([]),
-  // Finding (usage-failsoft): `.default(ZERO_USAGE)` only covers `usage === undefined`. A response with
-  // `usage: null` or a malformed `usage` object would FAIL the object parse and -- because this field is
-  // part of the whole-response schema -- bubble up to a 502 that DROPS an otherwise-valid completion.
-  // `.catch(ZERO_USAGE)` makes ANY invalid value (null, a string, a malformed object) fall back to
-  // zero-usage so a valid completion is NEVER dropped over its (side-channel) usage block.
-  usage: AnthropicUsageSchema.default(ZERO_USAGE).catch(ZERO_USAGE)
-});
-function toAnthropicBody(call, defaultMaxTokens) {
-  const systemParts = [];
-  const messages = [];
-  for (const m of call.request.messages) {
-    if (m.role === "system") {
-      systemParts.push(m.content);
-      continue;
-    }
-    const role = m.role === "assistant" ? "assistant" : "user";
-    messages.push({ role, content: m.content });
-  }
-  const maxTokens = call.request.maxTokens ?? defaultMaxTokens;
-  return {
-    model: call.target.model,
-    max_tokens: maxTokens,
-    ...systemParts.length > 0 ? { system: systemParts.join("\n\n") } : {},
-    messages
-  };
-}
-function joinContentText(content) {
-  return content.filter((b) => b.type === "text" && typeof b.text === "string").map((b) => b.text).join("");
-}
-function createAnthropicTransport(deps = {}) {
-  const doFetch = deps.fetch ?? globalThis.fetch;
-  const url2 = deps.baseUrl ?? ANTHROPIC_MESSAGES_URL;
-  const defaultMaxTokens = deps.defaultMaxTokens ?? DEFAULT_MAX_TOKENS;
-  const usageSink = deps.usageSink ?? noopUsageSink;
-  async function post(call) {
-    const body = toAnthropicBody(call, defaultMaxTokens);
-    let res;
-    try {
-      res = await doFetch(url2, {
-        method: "POST",
-        headers: {
-          "x-api-key": call.apiKey,
-          "anthropic-version": ANTHROPIC_VERSION,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
-    } catch (err) {
-      const detail = err instanceof Error ? err.name : "network error";
-      throw new ProviderError(503, `anthropic transport: request failed (${detail})`);
-    }
-    if (!res.ok) {
-      throw new ProviderError(res.status, `anthropic transport: provider returned status ${res.status}`);
-    }
-    const raw2 = await res.text().then((t) => safeJson2(t));
-    const parsed = AnthropicMessagesResponseSchema.safeParse(raw2);
-    if (!parsed.success) {
-      throw new ProviderError(502, "anthropic transport: malformed provider response");
-    }
-    const u = parsed.data.usage;
-    const usage = {
-      model: call.target.model,
-      workload: call.request.workload,
-      inputTokens: u.input_tokens,
-      outputTokens: u.output_tokens,
-      cacheReadInputTokens: u.cache_read_input_tokens,
-      cacheCreationInputTokens: u.cache_creation_input_tokens
-    };
-    return { output: joinContentText(parsed.data.content), usage };
-  }
+function usageReportingTransport(post, usageSink) {
   function reportUsage(usage) {
     try {
       usageSink.record(usage);
@@ -50396,15 +50663,209 @@ function createAnthropicTransport(deps = {}) {
     }
   };
 }
-function safeJson2(text) {
+function safeJsonParse(text) {
   try {
     return JSON.parse(text);
   } catch {
     return void 0;
   }
 }
+var AnthropicContentBlockSchema = external_exports.object({
+  type: external_exports.string(),
+  text: external_exports.string().optional()
+});
+var AnthropicUsageSchema = external_exports.object({
+  input_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  output_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  cache_read_input_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  cache_creation_input_tokens: external_exports.number().int().nonnegative().catch(0).default(0)
+});
+var ZERO_USAGE = {
+  input_tokens: 0,
+  output_tokens: 0,
+  cache_read_input_tokens: 0,
+  cache_creation_input_tokens: 0
+};
+var AnthropicMessagesResponseSchema = external_exports.object({
+  content: external_exports.array(AnthropicContentBlockSchema).default([]),
+  // Finding (usage-failsoft): `.default(ZERO_USAGE)` only covers `usage === undefined`. A response with
+  // `usage: null` or a malformed `usage` object would FAIL the object parse and -- because this field is
+  // part of the whole-response schema -- bubble up to a 502 that DROPS an otherwise-valid completion.
+  // `.catch(ZERO_USAGE)` makes ANY invalid value (null, a string, a malformed object) fall back to
+  // zero-usage so a valid completion is NEVER dropped over its (side-channel) usage block.
+  usage: AnthropicUsageSchema.default(ZERO_USAGE).catch(ZERO_USAGE)
+});
+function toAnthropicBody(call, defaultMaxTokens) {
+  const systemParts = [];
+  const messages = [];
+  for (const m of call.request.messages) {
+    if (m.role === "system") {
+      systemParts.push(m.content);
+      continue;
+    }
+    const role = m.role === "assistant" ? "assistant" : "user";
+    messages.push({ role, content: m.content });
+  }
+  const maxTokens = call.request.maxTokens ?? defaultMaxTokens;
+  return {
+    model: call.target.model,
+    max_tokens: maxTokens,
+    ...systemParts.length > 0 ? { system: systemParts.join("\n\n") } : {},
+    messages
+  };
+}
+function joinContentText(content) {
+  return content.filter((b) => b.type === "text" && typeof b.text === "string").map((b) => b.text).join("");
+}
+function createAnthropicTransport(deps = {}) {
+  const doFetch = deps.fetch ?? globalThis.fetch;
+  const url2 = deps.baseUrl ?? ANTHROPIC_MESSAGES_URL;
+  const defaultMaxTokens = deps.defaultMaxTokens ?? DEFAULT_MAX_TOKENS;
+  const usageSink = deps.usageSink ?? noopUsageSink;
+  async function post(call) {
+    const body = toAnthropicBody(call, defaultMaxTokens);
+    let res;
+    try {
+      res = await doFetch(url2, {
+        method: "POST",
+        headers: {
+          "x-api-key": call.apiKey,
+          "anthropic-version": ANTHROPIC_VERSION,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      const detail = err instanceof Error ? err.name : "network error";
+      throw new ProviderError(503, `anthropic transport: request failed (${detail})`);
+    }
+    if (!res.ok) {
+      throw new ProviderError(res.status, `anthropic transport: provider returned status ${res.status}`);
+    }
+    const raw2 = await res.text().then((t) => safeJsonParse(t));
+    const parsed = AnthropicMessagesResponseSchema.safeParse(raw2);
+    if (!parsed.success) {
+      throw new ProviderError(502, "anthropic transport: malformed provider response");
+    }
+    const u = parsed.data.usage;
+    const usage = {
+      model: call.target.model,
+      workload: call.request.workload,
+      inputTokens: u.input_tokens,
+      outputTokens: u.output_tokens,
+      cacheReadInputTokens: u.cache_read_input_tokens,
+      cacheCreationInputTokens: u.cache_creation_input_tokens
+    };
+    return { output: joinContentText(parsed.data.content), usage };
+  }
+  return usageReportingTransport(post, usageSink);
+}
+
+// dist/src/daemon/runtime/inference/transport-portkey.js
+var PORTKEY_BASE_URL = "https://api.portkey.ai/v1";
+var PORTKEY_CHAT_COMPLETIONS_URL = `${PORTKEY_BASE_URL}/chat/completions`;
+var PORTKEY_RERANK_URL = `${PORTKEY_BASE_URL}/rerank`;
+var PORTKEY_API_KEY_HEADER = "x-portkey-api-key";
+var PORTKEY_CONFIG_HEADER = "x-portkey-config";
+function buildPortkeyHeaders(apiKey, configId) {
+  return {
+    [PORTKEY_API_KEY_HEADER]: apiKey,
+    [PORTKEY_CONFIG_HEADER]: configId,
+    "content-type": "application/json"
+  };
+}
+var PORTKEY_DEFAULT_MAX_TOKENS = 4096;
+var PortkeyChoiceSchema = external_exports.object({
+  message: external_exports.object({ content: external_exports.string().nullable().optional() }).optional()
+});
+var PortkeyUsageSchema = external_exports.object({
+  prompt_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  completion_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  prompt_tokens_details: external_exports.object({ cached_tokens: external_exports.number().int().nonnegative().catch(0).default(0) }).partial().optional()
+});
+var ZERO_PORTKEY_USAGE = { prompt_tokens: 0, completion_tokens: 0 };
+var PortkeyChatResponseSchema = external_exports.object({
+  choices: external_exports.array(PortkeyChoiceSchema).default([]),
+  // As with the Anthropic transport's usage block: `.catch()` so ANY invalid `usage` value
+  // (null, a string, a malformed object) falls back to zero-usage and a VALID completion is
+  // never dropped over its (side-channel) usage block.
+  usage: PortkeyUsageSchema.default(ZERO_PORTKEY_USAGE).catch(ZERO_PORTKEY_USAGE)
+});
+function toPortkeyBody(call, defaultMaxTokens) {
+  return {
+    model: call.target.model,
+    max_tokens: call.request.maxTokens ?? defaultMaxTokens,
+    messages: call.request.messages.map((m) => ({ role: m.role, content: m.content }))
+  };
+}
+function joinChoiceText(choices) {
+  return choices.map((c) => c.message?.content).filter((t) => typeof t === "string").join("");
+}
+function createPortkeyTransport(deps) {
+  const doFetch = deps.fetch ?? globalThis.fetch;
+  const url2 = deps.baseUrl ?? PORTKEY_CHAT_COMPLETIONS_URL;
+  const defaultMaxTokens = deps.defaultMaxTokens ?? PORTKEY_DEFAULT_MAX_TOKENS;
+  const usageSink = deps.usageSink ?? noopUsageSink;
+  const configId = deps.config;
+  const onTransportError = deps.onTransportError;
+  function reportTransportError(statusCode) {
+    if (onTransportError === void 0)
+      return;
+    try {
+      onTransportError(statusCode);
+    } catch {
+    }
+  }
+  async function post(call) {
+    const body = toPortkeyBody(call, defaultMaxTokens);
+    let res;
+    try {
+      res = await doFetch(url2, {
+        method: "POST",
+        headers: buildPortkeyHeaders(call.apiKey, configId),
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      reportTransportError(503);
+      const detail = err instanceof Error ? err.name : "network error";
+      throw new ProviderError(503, `portkey transport: request failed (${detail})`);
+    }
+    if (!res.ok) {
+      reportTransportError(res.status);
+      throw new ProviderError(res.status, `portkey transport: gateway returned status ${res.status}`);
+    }
+    const raw2 = await res.text().then((t) => safeJsonParse(t));
+    const parsed = PortkeyChatResponseSchema.safeParse(raw2);
+    if (!parsed.success) {
+      throw new ProviderError(502, "portkey transport: malformed gateway response");
+    }
+    const u = parsed.data.usage;
+    const usage = {
+      model: call.target.model,
+      workload: call.request.workload,
+      inputTokens: u.prompt_tokens,
+      outputTokens: u.completion_tokens,
+      cacheReadInputTokens: u.prompt_tokens_details?.cached_tokens ?? 0,
+      // Portkey's OpenAI-shaped usage has no cache-WRITE field; surface 0 (never fabricate).
+      cacheCreationInputTokens: 0
+    };
+    return { output: joinChoiceText(parsed.data.choices), usage };
+  }
+  return usageReportingTransport(post, usageSink);
+}
 
 // dist/src/daemon/runtime/inference/model-client-factory.js
+var PORTKEY_API_KEY_REF = "${PORTKEY_API_KEY}";
+var PORTKEY_API_KEY_NAME = "PORTKEY_API_KEY";
+var PORTKEY_ACCOUNT_ID = "portkey-gateway";
+var PORTKEY_TARGET_ID = "portkey-target";
+var PORTKEY_POLICY_ID = "portkey-default";
+var PortkeyUnconfiguredError = class extends Error {
+  constructor() {
+    super("portkey: enabled but PORTKEY_API_KEY is not set (fail-closed; set the key or disable portkey.enabled)");
+    this.name = "PortkeyUnconfiguredError";
+  }
+};
 async function resolveConfig3(source) {
   if (typeof source === "string") {
     return loadInferenceConfigFromYaml(source);
@@ -50422,7 +50883,7 @@ function applyProviderModelOverride(config2, override) {
     workloads: config2.workloads
   };
 }
-async function buildInferenceModelClient(deps) {
+async function buildProviderPathClient(deps) {
   let config2;
   try {
     config2 = await resolveConfig3(deps.config);
@@ -50443,6 +50904,161 @@ async function buildInferenceModelClient(deps) {
   });
   return new RouterModelClient(router);
 }
+async function buildInferenceModelClient(deps) {
+  const { client } = await buildInferenceModelClientWithStatus(deps);
+  return client;
+}
+async function buildInferenceModelClientWithStatus(deps) {
+  const portkey = deps.portkey;
+  if (portkey === void 0 || !portkey.enabled) {
+    return { client: await buildProviderPathClient(deps), portkeyStatus: "off" };
+  }
+  try {
+    const client = await resolvePortkeyClient(deps, portkey);
+    return { client, portkeyStatus: "ok" };
+  } catch (err) {
+    if (err instanceof PortkeyUnconfiguredError) {
+      return { client: noopModelClient, portkeyStatus: "unconfigured" };
+    }
+    return { client: noopModelClient, portkeyStatus: "unconfigured" };
+  }
+}
+async function resolvePortkeyClient(deps, portkey) {
+  const names = deps.secretsStore.listSecretNames(deps.scope);
+  if (!names.includes(PORTKEY_API_KEY_NAME)) {
+    throw new PortkeyUnconfiguredError();
+  }
+  const secrets = createSecretResolver(deps.secretsStore, deps.scope);
+  const transport = createPortkeyTransport({
+    config: portkey.config,
+    ...deps.usageSink !== void 0 ? { usageSink: deps.usageSink } : {},
+    ...deps.onPortkeyUnreachable !== void 0 ? { onTransportError: deps.onPortkeyUnreachable } : {}
+  });
+  const router = createInferenceRouter({
+    config: buildPortkeyConfig(portkey.model),
+    transport,
+    secrets,
+    history: deps.history ?? noopRoutingHistoryStore
+  });
+  const portkeyClient = new RouterModelClient(router);
+  if (!portkey.fallbackToProvider) {
+    return portkeyClient;
+  }
+  const providerClient = await buildProviderPathClient(deps);
+  return new PortkeyFallbackModelClient(portkeyClient, providerClient);
+}
+function buildPortkeyConfig(model) {
+  return {
+    accounts: [{ id: PORTKEY_ACCOUNT_ID, provider: "portkey", apiKeyRef: PORTKEY_API_KEY_REF }],
+    targets: [
+      {
+        id: PORTKEY_TARGET_ID,
+        accountRef: PORTKEY_ACCOUNT_ID,
+        model,
+        privacyTier: "public",
+        capabilities: ["chat"],
+        contextWindow: 1e6
+      }
+    ],
+    policies: [{ id: PORTKEY_POLICY_ID, mode: "strict", chain: [PORTKEY_TARGET_ID] }],
+    workloads: [
+      { name: "memory_extraction", policyRef: PORTKEY_POLICY_ID, requiredCapabilities: ["chat"], minPrivacyTier: "public" },
+      { name: "memory_decision", policyRef: PORTKEY_POLICY_ID, requiredCapabilities: ["chat"], minPrivacyTier: "public" },
+      { name: "memory_pollinating", policyRef: PORTKEY_POLICY_ID, requiredCapabilities: ["chat"], minPrivacyTier: "public" }
+    ]
+  };
+}
+var PortkeyFallbackModelClient = class {
+  portkey;
+  provider;
+  constructor(portkey, provider) {
+    this.portkey = portkey;
+    this.provider = provider;
+  }
+  async complete(a, b) {
+    try {
+      return typeof a === "string" ? await this.portkey.complete(a, b) : await this.portkey.complete(a);
+    } catch (err) {
+      void err;
+      return typeof a === "string" ? this.provider.complete(a, b) : this.provider.complete(a);
+    }
+  }
+};
+
+// dist/src/daemon/runtime/recall/rerank-portkey.js
+var RERANK_FAILED = Object.freeze({ ok: false });
+var RerankResultSchema = external_exports.object({
+  index: external_exports.number().int().nonnegative(),
+  relevance_score: external_exports.number()
+});
+var RerankResponseSchema = external_exports.object({
+  results: external_exports.array(RerankResultSchema)
+});
+function createPortkeyRerankClient(deps) {
+  const doFetch = deps.fetch ?? globalThis.fetch;
+  const url2 = deps.baseUrl ?? PORTKEY_RERANK_URL;
+  const configId = deps.config;
+  const onTransportError = deps.onTransportError;
+  function reportTransportError(statusCode) {
+    if (onTransportError === void 0)
+      return;
+    try {
+      onTransportError(statusCode);
+    } catch {
+    }
+  }
+  return {
+    async rerank(apiKey, request) {
+      const body = {
+        model: request.model,
+        query: request.query,
+        documents: request.documents,
+        top_n: request.topN
+      };
+      let res;
+      try {
+        res = await doFetch(url2, {
+          method: "POST",
+          // SAME auth pair as the chat transport (c-D-2); the key lives only in the header (c-AC-2).
+          headers: buildPortkeyHeaders(apiKey, configId),
+          body: JSON.stringify(body)
+        });
+      } catch {
+        reportTransportError(503);
+        return RERANK_FAILED;
+      }
+      if (!res.ok) {
+        reportTransportError(res.status);
+        return RERANK_FAILED;
+      }
+      const text = await res.text().catch(() => "");
+      const parsed = RerankResponseSchema.safeParse(safeJsonParse(text));
+      if (!parsed.success) {
+        process.stderr.write("honeycomb: portkey rerank returned an unusable 2xx body; failing soft to RRF order\n");
+        return RERANK_FAILED;
+      }
+      const results = parsed.data.results.filter((r) => r.index < request.documents.length).map((r) => ({ index: r.index, relevanceScore: r.relevance_score }));
+      return { ok: true, results };
+    }
+  };
+}
+function buildCohereRerankSeam(deps) {
+  return {
+    async rerank(query, documents, topN) {
+      let apiKey;
+      try {
+        apiKey = await deps.secrets.resolve(deps.apiKeyRef);
+      } catch {
+        return { ok: false };
+      }
+      try {
+        return await deps.client.rerank(apiKey, { model: deps.model, query, documents, topN });
+      } catch {
+        return RERANK_FAILED;
+      }
+    }
+  };
+}
 
 // dist/src/daemon/runtime/services/poll-backoff.js
 var DEFAULT_POLL_BACKOFF_FLOOR_MS = 1e3;
@@ -52394,7 +53010,7 @@ function sanitizeSegment4(name) {
 // dist/src/daemon/runtime/skillify/watermark.js
 import { mkdirSync as mkdirSync19, readFileSync as readFileSync21, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir23 } from "node:os";
-import { dirname as dirname13, join as join30 } from "node:path";
+import { dirname as dirname14, join as join30 } from "node:path";
 function defaultWatermarkBaseDir() {
   return join30(homedir23(), ".honeycomb", "state", "skillify");
 }
@@ -52420,7 +53036,7 @@ function createWatermarkStore(baseDir = defaultWatermarkBaseDir()) {
       const next = current === null ? oldest : earlier(current, oldest);
       const file2 = { watermark: next, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
       const path4 = fileFor(projectKey);
-      mkdirSync19(dirname13(path4), { recursive: true });
+      mkdirSync19(dirname14(path4), { recursive: true });
       writeFileSync16(path4, JSON.stringify(file2, null, 2), "utf-8");
       return next;
     }
@@ -53181,6 +53797,7 @@ var AGENT_CONFIG_FILE_NAME = "agent.yaml";
 var LOCK_FILE_NAME = "daemon.lock";
 var PID_FILE_NAME = "daemon.pid";
 var DEFAULT_HEALTH_PROBE_INTERVAL_MS = 15e3;
+var DEFAULT_GRAPH_BUILD_INTERVAL_MS = 60 * 60 * 1e3;
 var defaultSeamFns = {
   attachHooks: attachHooksHandlers,
   mountDashboard: mountDashboardApi,
@@ -53258,7 +53875,7 @@ function readPidFile(path4) {
 function releaseSingleInstanceLock(runtimeDir) {
   for (const name of [LOCK_FILE_NAME, PID_FILE_NAME]) {
     try {
-      rmSync9(join32(runtimeDir, name), { force: true });
+      rmSync10(join32(runtimeDir, name), { force: true });
     } catch {
     }
   }
@@ -53281,7 +53898,7 @@ function authForMode(mode, storage, scope) {
   }
   return { authenticator: composeAuthenticator(storage, scope), policy: defaultDenyPolicy };
 }
-function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDetail, workspaceDir, installedHarnesses, logStore, seams = defaultSeamFns, vault) {
+function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDetail, workspaceDir, installedHarnesses, logStore, seams = defaultSeamFns, vault, rerankerDeps) {
   const captureHandler = seams.attachHooks(daemon, {
     storage,
     queue: daemon.services.queue,
@@ -53326,7 +53943,12 @@ function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDeta
     embed: embed.client,
     logger: daemon.logger,
     conflictSuppression,
-    ...vault !== void 0 ? { vault } : {}
+    ...vault !== void 0 ? { vault } : {},
+    // PRD-063c: the operator-selected reranker config + the late-bound Cohere-via-Portkey seam.
+    // The `cohere` strategy only does anything when BOTH the strategy is `cohere` (env) AND the
+    // gateway is ON (the seam's inner transport is wired in `start()`); otherwise RRF / local
+    // cosine, byte-identical to today (c-AC-4). Absent rerankerDeps (a unit mount) → engine default.
+    ...rerankerDeps !== void 0 ? { reranker: rerankerDeps.reranker, cohereRerank: rerankerDeps.cohereRerank } : {}
   });
   if (seams.mountConflicts !== void 0) {
     seams.mountConflicts(daemon, { storage, defaultScope });
@@ -53410,7 +54032,7 @@ function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDeta
   return captureHandler;
 }
 function resolveProductDataDeps(storage, defaultScope, queue, embed, mode) {
-  const baseDir = process.env.HONEYCOMB_WORKSPACE ?? process.cwd();
+  const baseDir = resolveWorkspaceBaseDir();
   const secrets = {
     store: new SecretsStore({ baseDir, machineKey: createMachineKeyProvider() }),
     // PRD-022 local-mode default: the dashboard's `GET /api/secrets` (names-only) carries no
@@ -53434,8 +54056,35 @@ function resolveProductDataDeps(storage, defaultScope, queue, embed, mode) {
     defaultScope
   };
 }
+var workspaceBaseDirMemo;
 function resolveWorkspaceBaseDir() {
-  return process.env.HONEYCOMB_WORKSPACE ?? process.cwd();
+  if (workspaceBaseDirMemo !== void 0)
+    return workspaceBaseDirMemo;
+  const fromEnv = process.env.HONEYCOMB_WORKSPACE;
+  const candidate = fromEnv !== void 0 && fromEnv.length > 0 ? fromEnv : process.cwd();
+  if (isWritableDir(candidate)) {
+    workspaceBaseDirMemo = candidate;
+    return candidate;
+  }
+  const fallback = join32(homedir25(), ".honeycomb");
+  process.stderr.write(`honeycomb: workspace "${candidate}" is not writable; using "${fallback}" for filesystem state (secrets, logs, agent.yaml)
+`);
+  try {
+    mkdirSync20(fallback, { recursive: true, mode: DIR_MODE });
+  } catch {
+  }
+  workspaceBaseDirMemo = fallback;
+  return fallback;
+}
+function isWritableDir(dir) {
+  try {
+    mkdirSync20(dir, { recursive: true });
+    const probe = mkdtempSync(join32(dir, ".honeycomb-write-test-"));
+    rmSync10(probe, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
 }
 function resolveAgentConfigPath(options) {
   return options.agentConfigPath ?? join32(resolveWorkspaceBaseDir(), AGENT_CONFIG_FILE_NAME);
@@ -53446,6 +54095,9 @@ function secretScopeFromQueryScope(scope) {
 var VAULT_PROVIDER_KEY = "activeProvider";
 var VAULT_MODEL_KEY = "activeModel";
 var VAULT_POLLINATING_ENABLED_KEY = "pollinating.enabled";
+var VAULT_PORTKEY_ENABLED_KEY = "portkey.enabled";
+var VAULT_PORTKEY_CONFIG_KEY = "portkey.config";
+var VAULT_PORTKEY_FALLBACK_KEY = "portkey.fallbackToProvider";
 function catalogTrustedTableProbe() {
   const names = CATALOG.map((t) => t.name);
   return { tables: () => Promise.resolve(names) };
@@ -53476,6 +54128,41 @@ async function readProviderModelOverride(vault, scope) {
     return void 0;
   }
 }
+async function readPortkeySelection(vault, scope) {
+  if (vault === void 0)
+    return void 0;
+  try {
+    const enabledRes = await vault.getSetting(VAULT_PORTKEY_ENABLED_KEY, scope);
+    const enabled = enabledRes.ok && coerceSettingBool(enabledRes.value);
+    if (!enabled)
+      return void 0;
+    const configRes = await vault.getSetting(VAULT_PORTKEY_CONFIG_KEY, scope);
+    const config2 = configRes.ok ? String(configRes.value) : "";
+    if (config2.length === 0)
+      return void 0;
+    const modelRes = await vault.getSetting(VAULT_MODEL_KEY, scope);
+    const model = modelRes.ok ? String(modelRes.value) : "";
+    const fallbackRes = await vault.getSetting(VAULT_PORTKEY_FALLBACK_KEY, scope);
+    const fallbackToProvider = fallbackRes.ok && coerceSettingBool(fallbackRes.value);
+    return { enabled: true, config: config2, model, fallbackToProvider };
+  } catch {
+    return void 0;
+  }
+}
+async function resolvePortkeyAssemblyStatus(selection, scope) {
+  if (selection === void 0 || !selection.enabled)
+    return "off";
+  try {
+    const secretsStore = new SecretsStore({
+      baseDir: resolveWorkspaceBaseDir(),
+      machineKey: createMachineKeyProvider()
+    });
+    const names = secretsStore.listSecretNames(secretScopeFromQueryScope(scope));
+    return names.includes(PORTKEY_API_KEY_NAME) ? "ok" : "unconfigured";
+  } catch {
+    return "unconfigured";
+  }
+}
 async function readVaultPollinatingEnabled(vault, scope) {
   if (vault === void 0)
     return { decidedByVault: false, enabled: false };
@@ -53489,6 +54176,17 @@ async function readVaultPollinatingEnabled(vault, scope) {
     return { decidedByVault: false, enabled: false };
   }
 }
+async function readBootEmbeddingsEnabled(vault, scope) {
+  if (vault !== void 0) {
+    try {
+      const res = await vault.getSetting(EMBEDDINGS_ENABLED_KEY, scope);
+      if (res.ok)
+        return coerceSettingBool(res.value);
+    } catch {
+    }
+  }
+  return resolveEmbedClientOptions().enabled;
+}
 function coerceSettingBool(value) {
   if (typeof value === "boolean")
     return value;
@@ -53498,7 +54196,7 @@ function coerceSettingBool(value) {
     return value === "true" || value === "1";
   return false;
 }
-async function buildGatedPollinatingWorker(options, storage, scope, queue, vault, backoff) {
+async function buildGatedPollinatingWorker(options, storage, scope, queue, vault, backoff, portkeyDeps) {
   let config2;
   try {
     config2 = resolvePollinatingConfig(options.pollinatingConfigProvider);
@@ -53522,7 +54220,9 @@ async function buildGatedPollinatingWorker(options, storage, scope, queue, vault
     scope: secretScopeFromQueryScope(scope),
     secretsStore,
     config: resolveAgentConfigPath(options),
-    ...providerModelOverride !== void 0 ? { providerModelOverride } : {}
+    ...providerModelOverride !== void 0 ? { providerModelOverride } : {},
+    ...portkeyDeps?.selection !== void 0 ? { portkey: portkeyDeps.selection } : {},
+    ...portkeyDeps !== void 0 ? { onPortkeyUnreachable: portkeyDeps.onUnreachable } : {}
   });
   const trigger = createPollinatingTrigger({ storage, scope, config: config2, enqueuer: queue });
   return createPollinatingWorker({ queue, storage, scope, config: config2, model, trigger, backoff });
@@ -53546,7 +54246,7 @@ function makePipelineEntryEnqueuer(queue) {
     });
   };
 }
-async function buildPipelineWorker(options, storage, scope, queue, embed, backoff) {
+async function buildPipelineWorker(options, storage, scope, queue, embed, backoff, portkeyDeps) {
   let config2;
   try {
     config2 = resolvePipelineConfig();
@@ -53562,7 +54262,9 @@ async function buildPipelineWorker(options, storage, scope, queue, embed, backof
     model = await buildInferenceModelClient({
       scope: secretScopeFromQueryScope(scope),
       secretsStore,
-      config: resolveAgentConfigPath(options)
+      config: resolveAgentConfigPath(options),
+      ...portkeyDeps?.selection !== void 0 ? { portkey: portkeyDeps.selection } : {},
+      ...portkeyDeps !== void 0 ? { onPortkeyUnreachable: portkeyDeps.onUnreachable } : {}
     });
   } catch {
     model = noopModelClient;
@@ -53597,6 +54299,7 @@ function assembleDaemon(options = {}) {
   const tenancy = resolveDaemonTenancy(provider);
   const scope = tenancy.scope;
   const daemonOrgName = tenancy.orgName;
+  const vault = options.vault ?? (options.storage === void 0 ? buildVaultStore() : void 0);
   const services = {
     queue: createJobQueueService({ storage, scope }),
     watcher: createFileWatcherService({
@@ -53612,10 +54315,34 @@ function assembleDaemon(options = {}) {
     // fake supervisor so the hermetic assembly never spawns a real process.
     embed: options.embedSupervisor ?? createEmbedSupervisor()
   };
+  const embedSupervisor = services.embed;
+  if (embedSupervisor !== void 0 && vault !== void 0) {
+    void readBootEmbeddingsEnabled(vault, secretScopeFromQueryScope(scope)).then(async (enabled) => {
+      if (enabled !== !embedSupervisor.disabled)
+        await embedSupervisor.setEnabled(enabled);
+    }).catch((err) => {
+      const reason = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`honeycomb: embeddings boot reconciliation failed (non-fatal): ${reason}
+`);
+    });
+  }
   let healthBit = "ok";
   const pipelineProbe = () => healthBit;
-  const embeddingsEnabled = options.embeddingsEnabled ?? (options.embed !== void 0 ? false : resolveEmbedClientOptions().enabled);
-  const healthDetail = () => buildHealthDetail({ status: healthBit, embeddingsEnabled });
+  const embeddingsReason = () => options.embeddingsEnabled ?? (options.embed !== void 0 ? false : embedSupervisor !== void 0 ? !embedSupervisor.disabled : resolveEmbedClientOptions().enabled);
+  let portkeyHealth = "off";
+  const recordPortkeyUnreachable = (_statusCode) => {
+    portkeyHealth = "unreachable";
+  };
+  const healthDetail = () => buildHealthDetail({ status: healthBit, embeddingsEnabled: embeddingsReason(), portkey: portkeyHealth });
+  let cohereRerankInner;
+  const cohereRerankSeam = {
+    rerank(query, documents, topN) {
+      const inner = cohereRerankInner;
+      if (inner === void 0)
+        return Promise.resolve({ ok: false });
+      return inner.rerank(query, documents, topN);
+    }
+  };
   const { authenticator, policy } = authForMode(config2.mode, storage, scope);
   const createOptions = {
     config: config2,
@@ -53630,8 +54357,16 @@ function assembleDaemon(options = {}) {
   const daemon = createDaemon(createOptions);
   const embed = options.embed ?? createEmbedAttachment({ storage });
   const installedHarnesses = options.installedHarnesses ?? (options.harnessTargets !== void 0 && options.harnessTargets.length > 0 ? new Set(options.harnessTargets.map((t) => t.name)) : options.storage === void 0 ? detectInstalledHarnesses() : /* @__PURE__ */ new Set());
-  const vault = options.vault ?? (options.storage === void 0 ? buildVaultStore() : void 0);
-  const captureHandler = assembleSeams(daemon, storage, scope, daemonOrgName, embed, healthDetail, options.workspaceDir ?? process.cwd(), installedHarnesses, logStore, options.seams ?? defaultSeamFns, vault);
+  let rerankerMountDeps;
+  try {
+    rerankerMountDeps = { reranker: resolveRecallConfig().reranker, cohereRerank: cohereRerankSeam };
+  } catch {
+    rerankerMountDeps = {
+      reranker: RecallConfigSchema.parse({}).reranker,
+      cohereRerank: cohereRerankSeam
+    };
+  }
+  const captureHandler = assembleSeams(daemon, storage, scope, daemonOrgName, embed, healthDetail, options.workspaceDir ?? process.cwd(), installedHarnesses, logStore, options.seams ?? defaultSeamFns, vault, rerankerMountDeps);
   if (vault !== void 0 && vault instanceof VaultStore) {
     try {
       mountSettingsApi(daemon, { store: vault, scope: localDefaultScopeResolver(daemon.config.mode, scope) });
@@ -53646,6 +54381,17 @@ function assembleDaemon(options = {}) {
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     process.stderr.write(`honeycomb: auth status API mount failed (non-fatal): ${reason}
+`);
+  }
+  try {
+    mountActionsApi(daemon, {
+      embed: daemon.services.embed,
+      defaultScope: scope,
+      ...vault instanceof VaultStore ? { store: vault } : {}
+    });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`honeycomb: actions API mount failed (non-fatal): ${reason}
 `);
   }
   try {
@@ -53696,6 +54442,27 @@ function assembleDaemon(options = {}) {
       healthBit = "degraded";
     }
   }
+  const autoBuildGraph = options.storage === void 0 && config2.mode === "local";
+  let graphBuildTimer = null;
+  let graphBuildInFlight = false;
+  async function rebuildCodebaseGraph() {
+    if (graphBuildInFlight)
+      return;
+    graphBuildInFlight = true;
+    try {
+      await buildCodebaseGraphSnapshot(scope, {
+        storage,
+        defaultScope: scope,
+        workspaceDir: options.workspaceDir ?? process.cwd()
+      });
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`honeycomb: codebase graph auto-build failed (non-fatal): ${reason}
+`);
+    } finally {
+      graphBuildInFlight = false;
+    }
+  }
   let started = false;
   let locked = false;
   let pollinatingWorker = null;
@@ -53720,6 +54487,15 @@ function assembleDaemon(options = {}) {
       if (typeof probeTimer.unref === "function") {
         probeTimer.unref();
       }
+      if (autoBuildGraph) {
+        void rebuildCodebaseGraph();
+        graphBuildTimer = setInterval(() => {
+          void rebuildCodebaseGraph();
+        }, DEFAULT_GRAPH_BUILD_INTERVAL_MS);
+        if (typeof graphBuildTimer.unref === "function") {
+          graphBuildTimer.unref();
+        }
+      }
       await daemon.startServices();
       let pollBackoff;
       try {
@@ -53733,6 +54509,33 @@ function assembleDaemon(options = {}) {
       } catch {
         consolidatePoll = false;
       }
+      let portkeyWorkerDeps = { onUnreachable: recordPortkeyUnreachable };
+      try {
+        const portkeySelection = await readPortkeySelection(vault, secretScopeFromQueryScope(scope));
+        portkeyHealth = await resolvePortkeyAssemblyStatus(portkeySelection, scope);
+        portkeyWorkerDeps = {
+          ...portkeySelection !== void 0 ? { selection: portkeySelection } : {},
+          onUnreachable: recordPortkeyUnreachable
+        };
+        if (portkeySelection !== void 0) {
+          const rerankSecrets = createSecretResolver(new SecretsStore({ baseDir: resolveWorkspaceBaseDir(), machineKey: createMachineKeyProvider() }), secretScopeFromQueryScope(scope));
+          const rerankClient = createPortkeyRerankClient({
+            config: portkeySelection.config,
+            onTransportError: recordPortkeyUnreachable
+          });
+          cohereRerankInner = buildCohereRerankSeam({
+            client: rerankClient,
+            secrets: rerankSecrets,
+            apiKeyRef: PORTKEY_API_KEY_REF,
+            model: rerankerMountDeps.reranker.cohereModel
+          });
+        } else {
+          cohereRerankInner = void 0;
+        }
+      } catch {
+        portkeyHealth = "off";
+        cohereRerankInner = void 0;
+      }
       try {
         summaryWorker = buildSummaryWorker(storage, scope, daemon.services.queue, embed);
         summaryWorker.start();
@@ -53743,7 +54546,7 @@ function assembleDaemon(options = {}) {
         summaryWorker = null;
       }
       try {
-        pipelineWorker = await buildPipelineWorker(options, storage, scope, daemon.services.queue, embed, pollBackoff);
+        pipelineWorker = await buildPipelineWorker(options, storage, scope, daemon.services.queue, embed, pollBackoff, portkeyWorkerDeps);
         if (!consolidatePoll)
           pipelineWorker.start();
       } catch (err) {
@@ -53775,7 +54578,7 @@ function assembleDaemon(options = {}) {
         }
       }
       try {
-        pollinatingWorker = await buildGatedPollinatingWorker(options, storage, scope, daemon.services.queue, vault, pollBackoff);
+        pollinatingWorker = await buildGatedPollinatingWorker(options, storage, scope, daemon.services.queue, vault, pollBackoff, portkeyWorkerDeps);
         const pollinatingInjected = options.pollinatingWorker !== void 0;
         if (consolidatePoll && !pollinatingInjected) {
           const participants = [pipelineWorker, pollinatingWorker].filter((p) => p !== null);
@@ -53830,6 +54633,10 @@ function assembleDaemon(options = {}) {
         clearInterval(probeTimer);
         probeTimer = null;
       }
+      if (graphBuildTimer !== null) {
+        clearInterval(graphBuildTimer);
+        graphBuildTimer = null;
+      }
       if (started) {
         await daemon.stopServices();
         started = false;