@lore-co/cli 0.1.17 → 0.1.19

package/dist/cli.js

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
-import { access, chmod, copyFile, mkdir, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { access, chmod, copyFile, mkdir, open, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { constants as fsConstants, realpathSync } from "node:fs";
-import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
 import { delimiter, dirname, resolve } from "node:path";
-import { homedir, platform } from "node:os";
+import { homedir, hostname, platform } from "node:os";
+import { setTimeout as delay } from "node:timers/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { NATIVE_CODING_AGENT_NAMES, WorkspaceIdentityResponseSchema, isNativeCodingAgent, } from "@lore-co/core";
+import { CLAUDE_RELIABILITY_INTEGRATION, CODEX_RELIABILITY_INTEGRATION, COPILOT_CLI_RELIABILITY_INTEGRATION, COPILOT_CLOUD_MCP_RELIABILITY_INTEGRATION, COPILOT_VSCODE_PREVIEW_RELIABILITY_INTEGRATION, CreateDeviceAuthorizationResponseSchema, CURSOR_RELIABILITY_INTEGRATION, NATIVE_CODING_AGENT_NAMES, OPENCODE_RELIABILITY_INTEGRATION, OperationalMetricsResponseSchema, PollDeviceAuthorizationResponseSchema, POLYTOKEN_RELIABILITY_INTEGRATION, RELIABILITY_INTEGRATION_CONTRACT_VERSION, ReliabilityInvocationRecordSchema, WorkspaceIdentityResponseSchema, canonicalJson, deriveReliabilityInvocationHealth, isNativeCodingAgent, } from "@lore-co/core";
 import { runHook, } from "./runtime.js";
+import { readInvocationHealthWriteInput, runInvocationHealthWrite, } from "./invocation-health-writer.js";
 import { runAskCommand } from "./ask.js";
 import { runGuardCommand } from "./guard.js";
 import { runContinueCommand, runResumeCommand } from "./handoff.js";
@@ -18,6 +21,7 @@ import { runHostCommand } from "./host.js";
 import { runDemoCommand } from "./demo.js";
 import { updateCommand } from "./update.js";
 import { runSelfHostCommand } from "./self-host.js";
+import { ReliabilityStore, ReliabilityStoreError, integrationInvocationStateKey, } from "./reliability-store.js";
 import { IS_STANDALONE_BINARY, LORE_VERSION } from "./version.js";
 const LORE_OWNER_ARGUMENT = "--owner lore";
 export const LORE_OPENCODE_PLUGIN = "@lore-co/opencode";
@@ -42,6 +46,30 @@ const POLYTOKEN_HOOK_EVENTS = [
     "pre_user_prompt",
     "post_model_turn",
 ];
+const COPILOT_CLI_HOOK_EVENTS = [
+    "userPromptTransformed",
+    "preToolUse",
+    "agentStop",
+    "sessionEnd",
+];
+const EXTERNAL_SURFACES = [
+    {
+        surface: "copilot-cloud-mcp",
+        integrationId: COPILOT_CLOUD_MCP_RELIABILITY_INTEGRATION.integrationId,
+        installation: "repository_template",
+        locallyInspectable: false,
+        capabilities: COPILOT_CLOUD_MCP_RELIABILITY_INTEGRATION.capabilities,
+    },
+];
+const AGENT_MANIFESTS = {
+    claude: CLAUDE_RELIABILITY_INTEGRATION,
+    codex: CODEX_RELIABILITY_INTEGRATION,
+    "copilot-cli": COPILOT_CLI_RELIABILITY_INTEGRATION,
+    "copilot-vscode": COPILOT_VSCODE_PREVIEW_RELIABILITY_INTEGRATION,
+    cursor: CURSOR_RELIABILITY_INTEGRATION,
+    opencode: OPENCODE_RELIABILITY_INTEGRATION,
+    polytoken: POLYTOKEN_RELIABILITY_INTEGRATION,
+};
 const ROOT_HELP = `lore
 Connect local coding agents to Lore shared engineering memory.
 
@@ -93,27 +121,32 @@ Examples:
   lore devin --help
 `;
 const CONNECT_HELP = `lore connect
-Store a workspace credential and idempotently install agent integrations.
+Authorize this device and idempotently install agent integrations.
 
 Usage:
+  lore connect --login [options]
   lore connect --token <token> [options]
 
 Options:
   --url <url>           Lore API base URL (default: https://api.uselore.co)
   --dashboard-url <url> Lore dashboard URL (default: https://uselore.co for hosted Lore)
+  --login               Approve access securely in the Lore dashboard
+  --no-open             Print the approval URL without opening a browser
   --token <token>       Workspace bearer token (or LORE_WORKSPACE_TOKEN/LORE_TOKEN)
-  --agent <name>        claude, codex, cursor, opencode, polytoken, or t3code; repeat to override auto-detection
+  --agent <name>        claude, codex, copilot, copilot-cli, copilot-vscode, cowork, cursor, opencode, polytoken, or t3code
   --timeout-ms <ms>     Hook request timeout, 250-10000 (default: 2500)
   --json                Print machine-readable output
   --help                Show this command's help
 
 Examples:
+  lore connect --login --agent claude
+  lore connect --login --agent cowork
   lore connect --token "$LORE_WORKSPACE_TOKEN" --agent claude
   lore connect --url http://localhost:3004 --token dev-token --agent codex
   lore connect --token "$LORE_WORKSPACE_TOKEN" --agent cursor
 `;
 const STATUS_HELP = `lore status
-Show whether Lore is configured and each native integration is installed.
+Show exact installation, declared capabilities, and last invocation health.
 
 Usage:
   lore status [--json]
@@ -123,7 +156,7 @@ Examples:
   lore status --json
 `;
 const DOCTOR_HELP = `lore doctor
-Check local security, runtime, agent integrations, binaries, and Lore health.
+Check local security, exact wiring, invocation health, binaries, and Lore health.
 
 Usage:
   lore doctor [--json]
@@ -133,8 +166,9 @@ Examples:
   lore doctor --json
 `;
 const DISCONNECT_HELP = `lore disconnect
-Remove only Lore-owned hooks/plugin, credentials, runtime, state, and retry queue.
-Unrelated agent settings, plugins, and Lore-created backups are retained.
+Remove Lore-owned hooks/plugin, credentials, runtime, and transient state.
+Durable captures, dead letters, verified snapshots, unrelated agent settings,
+plugins, and Lore-created backups are retained.
 
 Usage:
   lore disconnect [--json]
@@ -157,16 +191,26 @@ export function getLorePaths(home, environment = process.env) {
         ? resolve(resolvedHome, ".config")
         : resolve(environment.XDG_CONFIG_HOME);
     const t3Home = resolve(environment.T3CODE_HOME?.trim() || resolve(resolvedHome, ".t3"));
+    const copilotHome = resolve(environment.COPILOT_HOME?.trim() || resolve(resolvedHome, ".copilot"));
     return {
         home: resolvedHome,
         loreDirectory,
         config: resolve(loreDirectory, "config.json"),
         runtime: resolve(loreDirectory, "bin", "lore-hook.mjs"),
         runtimeRepository: resolve(loreDirectory, "bin", "repository.js"),
+        runtimeReliabilityStore: resolve(loreDirectory, "bin", "reliability-store.js"),
+        runtimeSignedSnapshot: resolve(loreDirectory, "bin", "signed-snapshot.js"),
+        runtimeCanonicalJson: resolve(loreDirectory, "bin", "canonical-json.js"),
+        runtimeContextFallback: resolve(loreDirectory, "bin", "context-fallback.js"),
+        runtimeInvocationHealthWriter: resolve(loreDirectory, "bin", "invocation-health-writer.js"),
+        runtimeVersion: resolve(loreDirectory, "bin", "runtime-version.js"),
         runtimePackage: resolve(loreDirectory, "bin", "package.json"),
         state: resolve(loreDirectory, "state"),
         queue: resolve(loreDirectory, "queue"),
         codexHooks: resolve(resolvedHome, ".codex", "hooks.json"),
+        copilotCliHooks: resolve(copilotHome, "hooks", "lore.json"),
+        copilotVscodeHooks: resolve(environment.LORE_COPILOT_VSCODE_HOOKS?.trim() ||
+            resolve(process.cwd(), ".github", "hooks", "lore-vscode.json")),
         claudeSettings: resolve(resolvedHome, ".claude", "settings.json"),
         cursorHooks: resolve(resolvedHome, ".cursor", "hooks.json"),
         cursorUserData: platform() === "darwin"
@@ -184,14 +228,18 @@ function isConfiguredAgent(value) {
     return typeof value === "string" && isNativeCodingAgent(value);
 }
 function isConnectAgent(value) {
-    return isConfiguredAgent(value) || value === "t3code";
+    return (isConfiguredAgent(value) ||
+        value === "copilot" ||
+        value === "cowork" ||
+        value === "t3code");
 }
-function hookCommand(agent, paths) {
+function hookCommand(agent, paths, event) {
     const loreHome = `LORE_HOME=${shellQuote(paths.home)}`;
+    const hookEvent = event === undefined ? "" : ` LORE_HOOK_EVENT=${shellQuote(event)}`;
     if (IS_STANDALONE_BINARY) {
-        return `env -u BUN_OPTIONS -u BUN_BE_BUN ${loreHome} ${shellQuote(process.execPath)} hook --agent ${agent} ${LORE_OWNER_ARGUMENT}`;
+        return `env -u BUN_OPTIONS -u BUN_BE_BUN ${loreHome}${hookEvent} ${shellQuote(process.execPath)} hook --agent ${agent} ${LORE_OWNER_ARGUMENT}`;
     }
-    return `env ${loreHome} ${shellQuote(process.execPath)} ${shellQuote(paths.runtime)} --agent ${agent} ${LORE_OWNER_ARGUMENT}`;
+    return `env ${loreHome}${hookEvent} ${shellQuote(process.execPath)} ${shellQuote(paths.runtime)} --agent ${agent} ${LORE_OWNER_ARGUMENT}`;
 }
 function isLoreHook(value) {
     if (!isObject(value) || value.type !== "command") {
@@ -380,6 +428,169 @@ export function countLoreCursorHooks(input) {
         return count + hooks[event].filter(isLoreHook).length;
     }, 0);
 }
+function copilotCliEventHandler(event, paths) {
+    return {
+        type: "command",
+        bash: hookCommand("copilot-cli", paths, event),
+        timeoutSec: event === "sessionEnd"
+            ? 2
+            : event === "agentStop"
+                ? 3
+                : event === "preToolUse"
+                    ? 10
+                    : 25,
+    };
+}
+function isLoreCopilotHook(value) {
+    if (!isObject(value) || value.type !== "command") {
+        return false;
+    }
+    const command = typeof value.bash === "string"
+        ? value.bash
+        : typeof value.command === "string"
+            ? value.command
+            : "";
+    return (/(?:^|\s)--owner(?:=|\s+)lore(?:\s|$)/u.test(command) ||
+        command.includes("/.lore/bin/lore-hook.mjs"));
+}
+function stripLoreFromCopilotEvent(value) {
+    return Array.isArray(value)
+        ? value.filter((hook) => !isLoreCopilotHook(hook))
+        : [];
+}
+export function mergeLoreCopilotCliHooks(input, paths) {
+    const result = cloneObject(input);
+    if (result.version !== undefined && result.version !== 1) {
+        throw new Error('Copilot hook configuration field "version" must be 1');
+    }
+    if (result.hooks !== undefined && !isObject(result.hooks)) {
+        throw new Error('Copilot hook configuration field "hooks" must be an object');
+    }
+    const hooks = isObject(result.hooks) ? { ...result.hooks } : {};
+    for (const event of COPILOT_CLI_HOOK_EVENTS) {
+        if (hooks[event] !== undefined && !Array.isArray(hooks[event])) {
+            throw new Error(`Copilot hook event "${event}" must be an array`);
+        }
+        hooks[event] = [
+            ...stripLoreFromCopilotEvent(hooks[event]),
+            copilotCliEventHandler(event, paths),
+        ];
+    }
+    result.version = 1;
+    result.hooks = hooks;
+    return result;
+}
+export function removeLoreCopilotCliHooks(input) {
+    const result = cloneObject(input);
+    if (!isObject(result.hooks)) {
+        return result;
+    }
+    const hooks = { ...result.hooks };
+    for (const event of COPILOT_CLI_HOOK_EVENTS) {
+        if (!Array.isArray(hooks[event])) {
+            continue;
+        }
+        const remaining = stripLoreFromCopilotEvent(hooks[event]);
+        if (remaining.length === 0) {
+            delete hooks[event];
+        }
+        else {
+            hooks[event] = remaining;
+        }
+    }
+    if (Object.keys(hooks).length === 0) {
+        delete result.hooks;
+    }
+    else {
+        result.hooks = hooks;
+    }
+    return result;
+}
+export function countLoreCopilotCliHooks(input) {
+    if (!isObject(input.hooks)) {
+        return 0;
+    }
+    return COPILOT_CLI_HOOK_EVENTS.reduce((count, event) => {
+        const hooks = input.hooks;
+        if (!isObject(hooks) || !Array.isArray(hooks[event])) {
+            return count;
+        }
+        return count + hooks[event].filter(isLoreCopilotHook).length;
+    }, 0);
+}
+function copilotVscodeEventHandler(event, paths) {
+    return {
+        type: "command",
+        command: hookCommand("copilot-vscode", paths, event),
+        timeout: event === "SessionEnd"
+            ? 2
+            : event === "Stop"
+                ? 3
+                : event === "PreToolUse"
+                    ? 10
+                    : 25,
+    };
+}
+export function mergeLoreCopilotVscodeHooks(input, paths) {
+    const result = cloneObject(input);
+    if (result.version !== undefined && result.version !== 1) {
+        throw new Error('VS Code Copilot hook field "version" must be 1');
+    }
+    if (result.hooks !== undefined && !isObject(result.hooks)) {
+        throw new Error('VS Code Copilot hook field "hooks" must be an object');
+    }
+    const hooks = isObject(result.hooks) ? { ...result.hooks } : {};
+    for (const event of HOOK_EVENTS) {
+        if (hooks[event] !== undefined && !Array.isArray(hooks[event])) {
+            throw new Error(`VS Code Copilot hook event "${event}" must be an array`);
+        }
+        hooks[event] = [
+            ...stripLoreFromCursorEvent(hooks[event]),
+            copilotVscodeEventHandler(event, paths),
+        ];
+    }
+    result.version = 1;
+    result.hooks = hooks;
+    return result;
+}
+export function removeLoreCopilotVscodeHooks(input) {
+    const result = cloneObject(input);
+    if (!isObject(result.hooks)) {
+        return result;
+    }
+    const hooks = { ...result.hooks };
+    for (const event of HOOK_EVENTS) {
+        if (!Array.isArray(hooks[event])) {
+            continue;
+        }
+        const remaining = stripLoreFromCursorEvent(hooks[event]);
+        if (remaining.length === 0) {
+            delete hooks[event];
+        }
+        else {
+            hooks[event] = remaining;
+        }
+    }
+    if (Object.keys(hooks).length === 0) {
+        delete result.hooks;
+    }
+    else {
+        result.hooks = hooks;
+    }
+    return result;
+}
+export function countLoreCopilotVscodeHooks(input) {
+    if (!isObject(input.hooks)) {
+        return 0;
+    }
+    return HOOK_EVENTS.reduce((count, event) => {
+        const hooks = input.hooks;
+        if (!isObject(hooks) || !Array.isArray(hooks[event])) {
+            return count;
+        }
+        return count + hooks[event].filter(isLoreHook).length;
+    }, 0);
+}
 function polytokenEventHandler(event, paths) {
     return {
         name: `lore-${event.replaceAll("_", "-")}`,
@@ -452,6 +663,172 @@ export function countLoreOpenCodePlugins(input) {
         ? input.plugin.filter(isLoreOpenCodePlugin).length
         : 0;
 }
+function installationUnitId(event, index, total) {
+    return total === 1 ? event : `installation-${index + 1}/${event}`;
+}
+function installationUnitState(ownedCount, exactCount) {
+    if (ownedCount === 0) {
+        return "missing";
+    }
+    if (ownedCount > 1 || exactCount > 1) {
+        return "duplicate";
+    }
+    return exactCount === 1 ? "exact" : "drifted";
+}
+function exactConfiguration(left, right) {
+    return canonicalJson(left) === canonicalJson(right);
+}
+function commandHookInstallationUnits(input, agent, paths, index, total) {
+    const configuration = objectConfiguration(input, agent);
+    if (configuration.hooks !== undefined && !isObject(configuration.hooks)) {
+        throw new Error(`${agent} configuration field "hooks" must be an object`);
+    }
+    const hooks = isObject(configuration.hooks) ? configuration.hooks : {};
+    return HOOK_EVENTS.map((event) => {
+        const groups = hooks[event];
+        if (groups !== undefined && !Array.isArray(groups)) {
+            throw new Error(`${agent} hook event "${event}" must be an array`);
+        }
+        const candidates = Array.isArray(groups) ? groups : [];
+        const expected = {
+            ...(event === "PreToolUse" ? { matcher: GUARD_TOOL_MATCHER } : {}),
+            hooks: [eventHandler(agent, event, paths)],
+        };
+        const ownedCount = candidates.reduce((count, candidate) => {
+            if (!isObject(candidate) || !Array.isArray(candidate.hooks)) {
+                return count;
+            }
+            return count + candidate.hooks.filter(isLoreHook).length;
+        }, 0);
+        const exactCount = candidates.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(ownedCount, exactCount),
+        };
+    });
+}
+function cursorInstallationUnits(input, paths, index, total) {
+    const configuration = objectConfiguration(input, "cursor");
+    if (configuration.version !== undefined && configuration.version !== 1) {
+        throw new Error('Cursor configuration field "version" must be 1');
+    }
+    if (configuration.hooks !== undefined && !isObject(configuration.hooks)) {
+        throw new Error('Cursor configuration field "hooks" must be an object');
+    }
+    const hooks = isObject(configuration.hooks) ? configuration.hooks : {};
+    return CURSOR_HOOK_EVENTS.map((event) => {
+        const values = hooks[event];
+        if (values !== undefined && !Array.isArray(values)) {
+            throw new Error(`Cursor hook event "${event}" must be an array`);
+        }
+        const candidates = Array.isArray(values) ? values : [];
+        const expected = cursorEventHandler(event, paths);
+        const ownedCount = candidates.filter(isLoreHook).length;
+        const exactCount = candidates.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(ownedCount, exactCount),
+        };
+    });
+}
+function copilotCliInstallationUnits(input, paths, index, total) {
+    const configuration = objectConfiguration(input, "copilot-cli");
+    if (configuration.version !== undefined && configuration.version !== 1) {
+        throw new Error('Copilot hook configuration field "version" must be 1');
+    }
+    if (configuration.hooks !== undefined && !isObject(configuration.hooks)) {
+        throw new Error('Copilot hook configuration field "hooks" must be an object');
+    }
+    const hooks = isObject(configuration.hooks) ? configuration.hooks : {};
+    return COPILOT_CLI_HOOK_EVENTS.map((event) => {
+        const values = hooks[event];
+        if (values !== undefined && !Array.isArray(values)) {
+            throw new Error(`Copilot hook event "${event}" must be an array`);
+        }
+        const candidates = Array.isArray(values) ? values : [];
+        const expected = copilotCliEventHandler(event, paths);
+        const ownedCount = candidates.filter(isLoreCopilotHook).length;
+        const exactCount = candidates.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(ownedCount, exactCount),
+        };
+    });
+}
+function copilotVscodeInstallationUnits(input, paths, index, total) {
+    const configuration = objectConfiguration(input, "copilot-vscode");
+    if (configuration.version !== undefined && configuration.version !== 1) {
+        throw new Error('VS Code Copilot hook field "version" must be 1');
+    }
+    if (configuration.hooks !== undefined && !isObject(configuration.hooks)) {
+        throw new Error('VS Code Copilot hook field "hooks" must be an object');
+    }
+    const hooks = isObject(configuration.hooks) ? configuration.hooks : {};
+    return HOOK_EVENTS.map((event) => {
+        const values = hooks[event];
+        if (values !== undefined && !Array.isArray(values)) {
+            throw new Error(`VS Code Copilot hook event "${event}" must be an array`);
+        }
+        const candidates = Array.isArray(values) ? values : [];
+        const expected = copilotVscodeEventHandler(event, paths);
+        const ownedCount = candidates.filter(isLoreHook).length;
+        const exactCount = candidates.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(ownedCount, exactCount),
+        };
+    });
+}
+function polytokenInstallationUnits(input, paths, index, total) {
+    if (!Array.isArray(input)) {
+        throw new Error("Polytoken hooks must contain a JSON array");
+    }
+    return POLYTOKEN_HOOK_EVENTS.map((event) => {
+        const expected = polytokenEventHandler(event, paths);
+        const owned = input.filter((candidate) => isLorePolytokenHook(candidate) &&
+            (!isObject(candidate) || candidate.event === event));
+        const exactCount = owned.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(owned.length, exactCount),
+        };
+    });
+}
+function openCodeInstallationUnits(input, index, total) {
+    const configuration = objectConfiguration(input, "opencode");
+    if (configuration.plugin !== undefined &&
+        !Array.isArray(configuration.plugin)) {
+        throw new Error('OpenCode configuration field "plugin" must be an array');
+    }
+    const plugins = Array.isArray(configuration.plugin)
+        ? configuration.plugin
+        : [];
+    const owned = plugins.filter(isLoreOpenCodePlugin);
+    const exactCount = owned.filter((candidate) => candidate === LORE_OPENCODE_PLUGIN).length;
+    return [
+        {
+            id: installationUnitId("plugin", index, total),
+            state: installationUnitState(owned.length, exactCount),
+        },
+    ];
+}
+function inspectInstallationUnits(input, agent, paths, index, total) {
+    switch (agent) {
+        case "claude":
+        case "codex":
+            return commandHookInstallationUnits(input, agent, paths, index, total);
+        case "copilot-cli":
+            return copilotCliInstallationUnits(input, paths, index, total);
+        case "copilot-vscode":
+            return copilotVscodeInstallationUnits(input, paths, index, total);
+        case "cursor":
+            return cursorInstallationUnits(input, paths, index, total);
+        case "polytoken":
+            return polytokenInstallationUnits(input, paths, index, total);
+        case "opencode":
+            return openCodeInstallationUnits(input, index, total);
+    }
+}
 async function readJsonDocument(path) {
     try {
         const [raw, metadata] = await Promise.all([
@@ -511,7 +888,7 @@ async function writeMergedJson(path, document, value, now) {
 }
 function parseConnectorConfig(value) {
     if (!isObject(value) ||
-        value.version !== 1 ||
+        (value.version !== 1 && value.version !== 2) ||
         typeof value.apiUrl !== "string" ||
         typeof value.token !== "string" ||
         !Array.isArray(value.agents) ||
@@ -547,10 +924,15 @@ function parseConnectorConfig(value) {
     const dashboardUrl = typeof value.dashboardUrl === "string"
         ? normalizeApiUrl(value.dashboardUrl)
         : undefined;
+    const parsedWorkspaceId = WorkspaceIdentityResponseSchema.shape.workspaceId.safeParse(value.workspaceId);
+    const workspaceId = parsedWorkspaceId.success
+        ? parsedWorkspaceId.data
+        : undefined;
     return {
-        version: 1,
+        version: 2,
         apiUrl: value.apiUrl,
         ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+        ...(workspaceId === undefined ? {} : { workspaceId }),
         token: value.token,
         agents,
         ...(agentConfigPaths === undefined ||
@@ -748,6 +1130,30 @@ const AGENT_TARGETS = {
         remove: (input) => removeLoreHooks(objectConfiguration(input, "codex")),
         count: (input) => countLoreHooks(objectConfiguration(input, "codex")),
     },
+    "copilot-cli": {
+        integration: "hooks",
+        expected: COPILOT_CLI_HOOK_EVENTS.length,
+        runtimeRequired: true,
+        emptyValue: () => ({}),
+        configPath: (paths) => paths.copilotCliHooks,
+        detect: async (paths) => (await commandExists("copilot")) || pathExists(paths.copilotCliHooks),
+        executable: async () => commandExists("copilot"),
+        merge: (input, paths) => mergeLoreCopilotCliHooks(objectConfiguration(input, "copilot-cli"), paths),
+        remove: (input) => removeLoreCopilotCliHooks(objectConfiguration(input, "copilot-cli")),
+        count: (input) => countLoreCopilotCliHooks(objectConfiguration(input, "copilot-cli")),
+    },
+    "copilot-vscode": {
+        integration: "hooks",
+        expected: HOOK_EVENTS.length,
+        runtimeRequired: true,
+        emptyValue: () => ({}),
+        configPath: (paths) => paths.copilotVscodeHooks,
+        detect: async (paths) => pathExists(paths.copilotVscodeHooks),
+        executable: async () => commandExists("code"),
+        merge: (input, paths) => mergeLoreCopilotVscodeHooks(objectConfiguration(input, "copilot-vscode"), paths),
+        remove: (input) => removeLoreCopilotVscodeHooks(objectConfiguration(input, "copilot-vscode")),
+        count: (input) => countLoreCopilotVscodeHooks(objectConfiguration(input, "copilot-vscode")),
+    },
     cursor: {
         integration: "hooks",
         expected: CURSOR_HOOK_EVENTS.length,
@@ -793,7 +1199,10 @@ async function detectAgents(paths) {
         agent,
         detected: await targetFor(agent).detect(paths),
     })));
-    return detected.flatMap(({ agent, detected: present }) => present ? [agent] : []);
+    const agents = detected.flatMap(({ agent, detected: present }) => present ? [agent] : []);
+    return agents.includes("copilot-cli")
+        ? agents.filter((agent) => agent !== "copilot-vscode")
+        : agents;
 }
 function installationKey(installation) {
     return `${installation.agent}\0${resolve(installation.configPath)}`;
@@ -953,7 +1362,14 @@ async function readT3CodeProviderInstallations(paths) {
     }
 }
 async function expandConnectInstallations(requested, paths) {
-    const direct = requested.flatMap((agent) => agent === "t3code" ? [] : [defaultInstallation(agent, paths)]);
+    const direct = requested.flatMap((agent) => {
+        if (agent === "cowork" || agent === "t3code") {
+            return [];
+        }
+        return [
+            defaultInstallation(agent === "copilot" ? "copilot-cli" : agent, paths),
+        ];
+    });
     if (!requested.includes("t3code")) {
         return { installations: direct, warnings: [] };
     }
@@ -979,20 +1395,65 @@ async function installRuntime(paths) {
         await Promise.all([
             rm(paths.runtime, { force: true }),
             rm(paths.runtimeRepository, { force: true }),
+            rm(paths.runtimeReliabilityStore, { force: true }),
+            rm(paths.runtimeSignedSnapshot, { force: true }),
+            rm(paths.runtimeCanonicalJson, { force: true }),
+            rm(paths.runtimeContextFallback, { force: true }),
+            rm(paths.runtimeInvocationHealthWriter, { force: true }),
+            rm(paths.runtimeVersion, { force: true }),
             rm(paths.runtimePackage, { force: true }),
         ]);
         return;
     }
     const sourceDirectory = dirname(fileURLToPath(import.meta.url));
-    const [runtime, repository] = await Promise.all([
+    const canonicalJsonModule = fileURLToPath(import.meta.resolve("@lore-co/core/canonical-json"));
+    const [runtime, repository, reliabilityStore, signedSnapshot, canonicalJson, contextFallback, invocationHealthWriter,] = await Promise.all([
         readFile(resolve(sourceDirectory, "runtime.js"), "utf8"),
         readFile(resolve(sourceDirectory, "repository.js"), "utf8"),
+        readFile(resolve(sourceDirectory, "reliability-store.js"), "utf8"),
+        readFile(resolve(sourceDirectory, "signed-snapshot.js"), "utf8"),
+        readFile(canonicalJsonModule, "utf8"),
+        readFile(resolve(sourceDirectory, "context-fallback.js"), "utf8"),
+        readFile(resolve(sourceDirectory, "invocation-health-writer.js"), "utf8"),
     ]);
+    const standaloneSignedSnapshot = signedSnapshot.replaceAll("@lore-co/core/canonical-json", "./canonical-json.js");
+    if (standaloneSignedSnapshot === signedSnapshot) {
+        throw new Error("Signed snapshot runtime dependency could not be localized");
+    }
+    const runtimeVersion = `export const RUNTIME_VERSION = ${JSON.stringify(LORE_VERSION)};\n`;
+    const runtimeFiles = {
+        "lore-hook.mjs": runtime,
+        "repository.js": repository,
+        "reliability-store.js": reliabilityStore,
+        "signed-snapshot.js": standaloneSignedSnapshot,
+        "canonical-json.js": canonicalJson,
+        "context-fallback.js": contextFallback,
+        "invocation-health-writer.js": invocationHealthWriter,
+        "runtime-version.js": runtimeVersion,
+    };
+    const runtimeManifest = {
+        type: "module",
+        loreRuntime: {
+            version: LORE_VERSION,
+            files: Object.fromEntries(Object.entries(runtimeFiles).map(([name, contents]) => [
+                name,
+                createHash("sha256").update(contents).digest("hex"),
+            ])),
+        },
+    };
     await Promise.all([
-        atomicWrite(paths.runtime, runtime, 0o700),
         atomicWrite(paths.runtimeRepository, repository, 0o600),
-        atomicWrite(paths.runtimePackage, '{"type":"module"}\n', 0o600),
+        atomicWrite(paths.runtimeReliabilityStore, reliabilityStore, 0o600),
+        atomicWrite(paths.runtimeSignedSnapshot, standaloneSignedSnapshot, 0o600),
+        atomicWrite(paths.runtimeCanonicalJson, canonicalJson, 0o600),
+        atomicWrite(paths.runtimeContextFallback, contextFallback, 0o600),
+        atomicWrite(paths.runtimeInvocationHealthWriter, invocationHealthWriter, 0o600),
+        atomicWrite(paths.runtimeVersion, runtimeVersion, 0o600),
+        atomicWrite(paths.runtimePackage, `${JSON.stringify(runtimeManifest, null, 2)}\n`, 0o600),
     ]);
+    // The hook entrypoint is the generation activation marker. Updating it last
+    // prevents a new runtime from loading before all of its local modules exist.
+    await atomicWrite(paths.runtime, runtime, 0o700);
 }
 function agentConfigPath(agent, paths) {
     return targetFor(agent).configPath(paths);
@@ -1023,7 +1484,12 @@ function valueAfter(args, index, flag) {
     return [value, index + 1];
 }
 function parseConnectArguments(args) {
-    const parsed = { agents: [], json: false };
+    const parsed = {
+        agents: [],
+        json: false,
+        login: false,
+        openBrowser: true,
+    };
     for (let index = 0; index < args.length; index += 1) {
         const argument = args[index];
         if (argument === "--help" || argument === "-h") {
@@ -1034,6 +1500,14 @@ function parseConnectArguments(args) {
             parsed.json = true;
             continue;
         }
+        if (argument === "--login") {
+            parsed.login = true;
+            continue;
+        }
+        if (argument === "--no-open") {
+            parsed.openBrowser = false;
+            continue;
+        }
         if (argument !== "--url" &&
             argument !== "--dashboard-url" &&
             argument !== "--token" &&
@@ -1063,9 +1537,17 @@ function parseConnectArguments(args) {
             parsed.agents.push(value);
         }
         else {
-            throw new Error("--agent must be claude, codex, cursor, opencode, polytoken, or t3code");
+            throw new Error("--agent must be claude, codex, copilot, copilot-cli, copilot-vscode, cowork, cursor, opencode, polytoken, or t3code");
         }
     }
+    if (parsed.login && parsed.token !== undefined) {
+        throw new Error("--login and --token cannot be used together");
+    }
+    if ((parsed.agents.includes("copilot-cli") ||
+        parsed.agents.includes("copilot")) &&
+        parsed.agents.includes("copilot-vscode")) {
+        throw new Error("Install either copilot-cli or copilot-vscode in one connection. Both hosts load repository hooks and would invoke Lore twice.");
+    }
     return parsed;
 }
 function parseOutputArguments(args, help, command) {
@@ -1086,38 +1568,26 @@ function parseOutputArguments(args, help, command) {
 function writeResult(value, json, text) {
     process.stdout.write(json ? `${JSON.stringify(value, null, 2)}\n` : text);
 }
-async function connectCommand(args) {
-    const parsed = parseConnectArguments(args);
-    if (parsed === null) {
-        return;
-    }
+export async function connectWithCredential(options) {
     if (platform() !== "darwin" && platform() !== "linux") {
         throw new Error("Lore agent integrations currently support macOS and Linux");
     }
     const paths = getLorePaths();
     const existing = await readConnectorConfig(paths);
-    const hasProvidedToken = parsed.token !== undefined ||
-        (process.env.LORE_WORKSPACE_TOKEN?.trim() ?? "") !== "" ||
-        (process.env.LORE_TOKEN?.trim() ?? "") !== "";
-    const { apiUrl, dashboardUrl } = resolveConnectEndpoints({
-        ...(parsed.apiUrl === undefined ? {} : { apiUrl: parsed.apiUrl }),
-        ...(parsed.dashboardUrl === undefined
-            ? {}
-            : { dashboardUrl: parsed.dashboardUrl }),
-        environment: process.env,
-        existing,
-        preferHostedDefault: hasProvidedToken,
-    });
-    const token = configuredToken(parsed.token, existing);
-    if (token === undefined || token.trim() === "") {
-        throw new Error("Workspace token is required. Use --token <token>, LORE_WORKSPACE_TOKEN, or LORE_TOKEN.");
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const dashboardUrl = options.dashboardUrl === undefined
+        ? undefined
+        : normalizeApiUrl(options.dashboardUrl);
+    const token = options.token.trim();
+    if (token === "") {
+        throw new Error("Workspace token cannot be empty");
     }
-    const timeoutMs = parsed.timeoutMs ?? existing?.timeoutMs ?? 2_500;
+    const timeoutMs = options.timeoutMs ?? existing?.timeoutMs ?? 2_500;
     const identity = await authenticatedIdentity(apiUrl, token.trim(), timeoutMs);
-    const requestedExpansion = parsed.agents.length === 0
+    const requestedExpansion = options.agents.length === 0
         ? { installations: [], warnings: [] }
-        : await expandConnectInstallations(parsed.agents, paths);
-    const detectedAgents = parsed.agents.length === 0 ? await detectAgents(paths) : [];
+        : await expandConnectInstallations(options.agents, paths);
+    const detectedAgents = options.agents.length === 0 ? await detectAgents(paths) : [];
     const installations = uniqueInstallations([
         ...configuredInstallations(existing, paths),
         ...requestedExpansion.installations,
@@ -1126,8 +1596,9 @@ async function connectCommand(args) {
     const agents = [
         ...new Set(installations.map((installation) => installation.agent)),
     ].sort();
-    if (agents.length === 0) {
-        throw new Error("No Claude, Codex, Cursor, OpenCode, or Polytoken installation detected. Use --agent <name>; T3 Code users can use --agent t3code.");
+    const credentialOnlyCowork = options.agents.includes("cowork");
+    if (agents.length === 0 && !credentialOnlyCowork) {
+        throw new Error("No Claude, Codex, Copilot CLI, Cursor, OpenCode, or Polytoken installation detected. Use --agent <name>; T3 Code users can use --agent t3code.");
     }
     const now = new Date();
     const documents = new Map();
@@ -1165,27 +1636,178 @@ async function connectCommand(args) {
             .map((installation) => installation.configPath);
     }
     const config = {
-        version: 1,
+        version: 2,
         apiUrl,
         ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+        workspaceId: identity.workspaceId,
         token: token.trim(),
         agents,
         agentConfigPaths,
         connectedAt: existing?.connectedAt ?? now.toISOString(),
         timeoutMs,
     };
+    const reliabilityStore = new ReliabilityStore(identity.workspaceId, {
+        home: paths.home,
+    });
+    await reliabilityStore.initialize();
+    await reliabilityStore.migrateLegacyQueue(paths.queue);
     await atomicWrite(paths.config, `${JSON.stringify(config, null, 2)}\n`, 0o600);
-    const result = {
+    if (existing !== null &&
+        existing.workspaceId === undefined &&
+        existing.apiUrl === apiUrl &&
+        existing.token === token.trim()) {
+        const credentialStore = new ReliabilityStore(credentialReliabilityWorkspaceKey(apiUrl, token.trim()), { home: paths.home });
+        await credentialStore.transferPendingTo(reliabilityStore);
+    }
+    await reliabilityStore.releaseAuthBlocked(now);
+    return {
         connected: true,
         apiUrl: config.apiUrl,
         identity,
-        agents,
+        agents: credentialOnlyCowork ? [...agents, "cowork"] : agents,
         config: paths.config,
         changedHookFiles,
         backups,
         warnings: requestedExpansion.warnings,
     };
-    writeResult(result, parsed.json, `connected: ${agents.join(", ")}\napi_url: ${config.apiUrl}\nconfig: ${paths.config}\n${requestedExpansion.warnings.map((warning) => `warning: ${warning}\n`).join("")}`);
+}
+async function requestDeviceAuthorization(input) {
+    let response;
+    try {
+        response = await fetch(`${input.apiUrl}/v1/device-authorizations`, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                clientName: `Lore CLI on ${hostname()}`,
+                agents: input.agents,
+                expiresInDays: 90,
+            }),
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        throw new Error("Lore device authorization is unreachable. Verify --url and retry.");
+    }
+    if (!response.ok) {
+        throw new Error(response.status === 404
+            ? "This Lore server does not support browser approval. Upgrade the server or use --token."
+            : "Lore could not start browser approval. Retry in a moment.");
+    }
+    const authorization = CreateDeviceAuthorizationResponseSchema.safeParse(await response.json().catch(() => null));
+    if (!authorization.success) {
+        throw new Error("Lore returned an incompatible device authorization response.");
+    }
+    const serverApprovalUrl = new URL(authorization.data.verificationUriComplete);
+    const approvalUrl = input.dashboardUrl === undefined
+        ? serverApprovalUrl.toString()
+        : new URL(`${serverApprovalUrl.pathname}${serverApprovalUrl.search}`, `${input.dashboardUrl}/`).toString();
+    process.stderr.write(`Approve Lore access with code ${authorization.data.userCode}:\n${approvalUrl}\n`);
+    if (input.openBrowser) {
+        const command = platform() === "darwin" ? "open" : "xdg-open";
+        const child = spawn(command, [approvalUrl], {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.once("error", () => {
+            // The printed URL remains the safe fallback.
+        });
+        child.unref();
+    }
+    const expiresAt = Date.parse(authorization.data.expiresAt);
+    const intervalMs = authorization.data.intervalSeconds * 1_000;
+    while (Date.now() < expiresAt) {
+        await delay(intervalMs);
+        let pollResponse;
+        try {
+            pollResponse = await fetch(`${input.apiUrl}/v1/device-authorizations/poll`, {
+                method: "POST",
+                headers: {
+                    accept: "application/json",
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    deviceCode: authorization.data.deviceCode,
+                }),
+                signal: AbortSignal.timeout(10_000),
+            });
+        }
+        catch {
+            continue;
+        }
+        if (pollResponse.status === 429) {
+            const retryAfter = Number(pollResponse.headers.get("retry-after"));
+            if (Number.isFinite(retryAfter) && retryAfter > 0) {
+                await delay(retryAfter * 1_000);
+            }
+            continue;
+        }
+        if (!pollResponse.ok) {
+            throw new Error("Lore browser approval failed. Run connect --login again.");
+        }
+        const result = PollDeviceAuthorizationResponseSchema.safeParse(await pollResponse.json().catch(() => null));
+        if (!result.success) {
+            throw new Error("Lore returned an incompatible device authorization response.");
+        }
+        if (result.data.status === "pending") {
+            continue;
+        }
+        if (result.data.status === "approved") {
+            return result.data.token;
+        }
+        if (result.data.status === "denied") {
+            throw new Error("Lore access was denied in the dashboard.");
+        }
+        throw new Error("Lore browser approval expired. Run connect --login again.");
+    }
+    throw new Error("Lore browser approval expired. Run connect --login again.");
+}
+async function connectCommand(args) {
+    const parsed = parseConnectArguments(args);
+    if (parsed === null) {
+        return;
+    }
+    const paths = getLorePaths();
+    const existing = await readConnectorConfig(paths);
+    const hasProvidedToken = parsed.token !== undefined ||
+        (process.env.LORE_WORKSPACE_TOKEN?.trim() ?? "") !== "" ||
+        (process.env.LORE_TOKEN?.trim() ?? "") !== "";
+    const { apiUrl, dashboardUrl } = resolveConnectEndpoints({
+        ...(parsed.apiUrl === undefined ? {} : { apiUrl: parsed.apiUrl }),
+        ...(parsed.dashboardUrl === undefined
+            ? {}
+            : { dashboardUrl: parsed.dashboardUrl }),
+        environment: process.env,
+        existing,
+        preferHostedDefault: parsed.login || hasProvidedToken,
+    });
+    const configured = parsed.login
+        ? undefined
+        : configuredToken(parsed.token, existing);
+    if (parsed.login && hasProvidedToken) {
+        throw new Error("--login cannot be combined with an explicit or environment workspace token. Unset it or use the token directly.");
+    }
+    const token = parsed.login
+        ? await requestDeviceAuthorization({
+            apiUrl,
+            ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+            agents: parsed.agents,
+            openBrowser: parsed.openBrowser,
+        })
+        : configured;
+    if (token === undefined || token.trim() === "") {
+        throw new Error("Workspace token is required. Use --login, --token <token>, LORE_WORKSPACE_TOKEN, or LORE_TOKEN.");
+    }
+    const result = await connectWithCredential({
+        apiUrl,
+        ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+        token,
+        agents: parsed.agents,
+        ...(parsed.timeoutMs === undefined ? {} : { timeoutMs: parsed.timeoutMs }),
+    });
+    writeResult(result, parsed.json, `connected: ${result.agents.join(", ")}\napi_url: ${result.apiUrl}\nconfig: ${result.config}\n${result.warnings.map((warning) => `warning: ${warning}\n`).join("")}`);
 }
 async function queueCount(paths) {
     try {
@@ -1195,34 +1817,250 @@ async function queueCount(paths) {
         return 0;
     }
 }
-async function getAgentStatus(agent, config, paths) {
+function reliabilityWorkspaceKey(config) {
+    return (config.workspaceId ??
+        credentialReliabilityWorkspaceKey(config.apiUrl, config.token));
+}
+function credentialReliabilityWorkspaceKey(apiUrl, token) {
+    return `credential-${createHash("sha256")
+        .update(`${apiUrl}\0${token}`)
+        .digest("hex")
+        .slice(0, 32)}`;
+}
+async function inspectReliabilityStore(config, paths) {
+    if (config === null) {
+        return { inspection: null, error: null };
+    }
+    try {
+        const store = new ReliabilityStore(reliabilityWorkspaceKey(config), {
+            home: paths.home,
+        });
+        return { inspection: await store.inspectExisting(), error: null };
+    }
+    catch (error) {
+        return {
+            inspection: null,
+            error: error instanceof Error
+                ? error.message
+                : "Local reliability store is unavailable",
+        };
+    }
+}
+const MAX_RUNTIME_MODULE_BYTES = 2 * 1024 * 1024;
+const MAX_RUNTIME_MANIFEST_BYTES = 64 * 1024;
+async function readRuntimeFile(path, maxBytes, executable = false) {
+    const handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() ||
+            metadata.size > maxBytes ||
+            (executable && (metadata.mode & 0o111) === 0)) {
+            throw new Error("Runtime file is unsafe or exceeds its size limit");
+        }
+        const buffer = Buffer.allocUnsafe(maxBytes + 1);
+        let bytes = 0;
+        while (bytes < buffer.length) {
+            const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+            if (result.bytesRead === 0) {
+                break;
+            }
+            bytes += result.bytesRead;
+        }
+        if (bytes > maxBytes) {
+            throw new Error("Runtime file exceeds its size limit");
+        }
+        return buffer.subarray(0, bytes).toString("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function inspectRuntimeInstallation(required, paths) {
+    if (!required) {
+        return { state: "not_required", version: null };
+    }
+    if (IS_STANDALONE_BINARY) {
+        try {
+            await access(process.execPath, fsConstants.R_OK | fsConstants.X_OK);
+            return { state: "installed", version: LORE_VERSION };
+        }
+        catch {
+            return { state: "missing", version: null };
+        }
+    }
+    const runtimeFiles = {
+        "lore-hook.mjs": paths.runtime,
+        "repository.js": paths.runtimeRepository,
+        "reliability-store.js": paths.runtimeReliabilityStore,
+        "signed-snapshot.js": paths.runtimeSignedSnapshot,
+        "canonical-json.js": paths.runtimeCanonicalJson,
+        "context-fallback.js": paths.runtimeContextFallback,
+        "invocation-health-writer.js": paths.runtimeInvocationHealthWriter,
+        "runtime-version.js": paths.runtimeVersion,
+    };
+    let contents;
+    let runtimePackage;
+    try {
+        [contents, runtimePackage] = await Promise.all([
+            Promise.all(Object.entries(runtimeFiles).map(async ([name, path]) => {
+                return [
+                    name,
+                    await readRuntimeFile(path, MAX_RUNTIME_MODULE_BYTES, name === "lore-hook.mjs"),
+                ];
+            })),
+            readRuntimeFile(paths.runtimePackage, MAX_RUNTIME_MANIFEST_BYTES),
+        ]);
+    }
+    catch (error) {
+        const missing = typeof error === "object" &&
+            error !== null &&
+            "code" in error &&
+            error.code === "ENOENT";
+        return { state: missing ? "missing" : "stale", version: null };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(runtimePackage);
+    }
+    catch {
+        return { state: "stale", version: null };
+    }
+    const loreRuntime = isObject(parsed) && isObject(parsed.loreRuntime)
+        ? parsed.loreRuntime
+        : null;
+    const hashes = loreRuntime !== null && isObject(loreRuntime.files)
+        ? loreRuntime.files
+        : null;
+    const version = loreRuntime !== null && typeof loreRuntime.version === "string"
+        ? loreRuntime.version
+        : null;
+    const hashEntries = hashes === null ? [] : Object.keys(hashes).sort();
+    const expectedEntries = Object.keys(runtimeFiles).sort();
+    const hashesValid = hashes !== null &&
+        canonicalJson(hashEntries) === canonicalJson(expectedEntries) &&
+        contents.every(([name, content]) => hashes[name] ===
+            createHash("sha256").update(content).digest("hex"));
+    return version === LORE_VERSION && hashesValid
+        ? { state: "installed", version }
+        : { state: "stale", version };
+}
+async function invocationHealth(config, paths, manifest) {
+    if (config === null) {
+        return {
+            health: deriveReliabilityInvocationHealth(null, manifest.integrationId),
+            error: null,
+        };
+    }
+    try {
+        const store = new ReliabilityStore(reliabilityWorkspaceKey(config), {
+            home: paths.home,
+        });
+        const record = await store.readStateExisting(integrationInvocationStateKey(manifest.integrationId));
+        const parsed = ReliabilityInvocationRecordSchema.safeParse(record);
+        if (record !== null &&
+            (!parsed.success ||
+                parsed.data.integrationId !== manifest.integrationId)) {
+            return {
+                health: deriveReliabilityInvocationHealth(undefined, manifest.integrationId),
+                error: "corrupt_record",
+            };
+        }
+        const health = deriveReliabilityInvocationHealth(record, manifest.integrationId);
+        return {
+            health,
+            error: manifest.integrationId === "plugin/opencode" &&
+                health.runtimeVersion !== null &&
+                health.runtimeVersion !== LORE_VERSION
+                ? "runtime_version_mismatch"
+                : null,
+        };
+    }
+    catch (error) {
+        return {
+            health: deriveReliabilityInvocationHealth(undefined, manifest.integrationId),
+            error: error instanceof ReliabilityStoreError
+                ? error.code.toLowerCase()
+                : "unavailable",
+        };
+    }
+}
+async function getAgentStatus(agent, config, paths, runtime) {
     const target = targetFor(agent);
+    const manifest = AGENT_MANIFESTS[agent];
     const configuredPaths = config?.agentConfigPaths?.[agent];
     const configPaths = config?.agents.includes(agent) === true && configuredPaths !== undefined
         ? configuredPaths
         : [agentConfigPath(agent, paths)];
     let installed = 0;
     let existing = 0;
-    for (const path of configPaths) {
+    let invalidConfiguration = false;
+    const units = [];
+    for (const [index, path] of configPaths.entries()) {
         try {
             const document = await readJsonDocument(path);
             installed += countAgentIntegrations(document.value, agent);
             existing += document.exists ? 1 : 0;
+            units.push(...inspectInstallationUnits(document.value === undefined
+                ? target.emptyValue()
+                : document.value, agent, paths, index, configPaths.length));
         }
         catch {
-            // A malformed target config is reported as missing integration state.
+            invalidConfiguration = true;
         }
     }
+    const invocation = await invocationHealth(config, paths, manifest);
+    const stalePluginRuntime = agent === "opencode" &&
+        invocation.error === "runtime_version_mismatch";
+    const agentRuntime = target.runtimeRequired
+        ? runtime
+        : stalePluginRuntime
+            ? {
+                state: "stale",
+                version: invocation.health.runtimeVersion,
+            }
+            : {
+                state: "not_required",
+                version: null,
+            };
+    const expected = target.expected * configPaths.length;
+    const exactUnits = units.filter((unit) => unit.state === "exact").length;
+    const installationState = invalidConfiguration
+        ? "invalid"
+        : installed === 0
+            ? "missing"
+            : agentRuntime.state === "stale"
+                ? "stale"
+                : exactUnits === expected &&
+                    agentRuntime.state !== "missing"
+                    ? "complete"
+                    : "partial";
+    const executable = await target.executable(paths);
     return {
         agent,
+        integrationId: manifest.integrationId,
         configured: config?.agents.includes(agent) ?? false,
-        executable: await target.executable(paths),
+        executable,
         configExists: existing === configPaths.length,
         configFile: configPaths[0] ?? agentConfigPath(agent, paths),
         ...(configPaths.length > 1 ? { configFiles: configPaths } : {}),
         integration: target.integration,
         installed,
-        expected: target.expected * configPaths.length,
+        expected,
+        capabilities: manifest.capabilities,
+        installation: {
+            state: installationState,
+            configured: config?.agents.includes(agent) ?? false,
+            executable,
+            installedUnits: exactUnits,
+            expectedUnits: expected,
+            units,
+            runtime: agentRuntime.state,
+            runtimeVersion: agentRuntime.version,
+            expectedRuntimeVersion: target.runtimeRequired || stalePluginRuntime ? LORE_VERSION : null,
+            issue: invalidConfiguration ? "invalid_configuration" : null,
+        },
+        invocation: invocation.health,
+        invocationError: invocation.error,
     };
 }
 async function statusData(paths) {
@@ -1235,29 +2073,27 @@ async function statusData(paths) {
         // Missing configuration is represented as disconnected.
     }
     const runtimeRequired = config?.agents.some((agent) => targetFor(agent).runtimeRequired) ?? false;
-    const runtimeInstalledCheck = runtimeRequired
-        ? Promise.all(IS_STANDALONE_BINARY
-            ? [access(process.execPath, fsConstants.R_OK | fsConstants.X_OK)]
-            : [
-                access(paths.runtime, fsConstants.R_OK | fsConstants.X_OK),
-                access(paths.runtimeRepository, fsConstants.R_OK),
-                access(paths.runtimePackage, fsConstants.R_OK),
-            ]).then(() => true, () => false)
-        : Promise.resolve(false);
-    const [runtimeInstalled, queuedTurns, agents] = await Promise.all([
-        runtimeInstalledCheck,
+    const runtime = await inspectRuntimeInstallation(runtimeRequired, paths);
+    const [legacyQueuedTurns, reliability, agents] = await Promise.all([
         queueCount(paths),
-        Promise.all(CONFIGURED_AGENT_NAMES.map(async (agent) => getAgentStatus(agent, config, paths))),
+        inspectReliabilityStore(config, paths),
+        Promise.all(CONFIGURED_AGENT_NAMES.map(async (agent) => getAgentStatus(agent, config, paths, runtime))),
     ]);
     return {
+        schemaVersion: "lore-cli-status-v1",
+        integrationContractVersion: RELIABILITY_INTEGRATION_CONTRACT_VERSION,
         connected: config !== null,
         apiUrl: config?.apiUrl ?? null,
         config: paths.config,
         configMode,
         runtimeRequired,
-        runtimeInstalled,
-        queuedTurns,
+        runtimeInstalled: runtime.state === "installed",
+        runtimeVersion: runtime.version,
+        queuedTurns: legacyQueuedTurns + (reliability.inspection?.outbox.total ?? 0),
+        reliability: reliability.inspection,
+        reliabilityError: reliability.error,
         agents,
+        externalSurfaces: EXTERNAL_SURFACES,
     };
 }
 async function statusCommand(args) {
@@ -1267,9 +2103,15 @@ async function statusCommand(args) {
     }
     const data = await statusData(getLorePaths());
     const agentLines = data.agents
-        .map((agent) => `${agent.agent}: ${agent.configured ? "configured" : "not configured"}, ${agent.integration} ${agent.installed}/${agent.expected}, executable ${agent.executable ? "yes" : "no"}, config ${agent.configExists ? "yes" : "no"}`)
+        .map((agent) => `${agent.agent}: ${agent.configured ? "configured" : "not configured"}, installation ${agent.installation.state}, invocation ${agent.invocation.state}${agent.invocationError === null ? "" : ` (${agent.invocationError})`}, capture ${agent.capabilities.captureDurability}, guard ${agent.capabilities.guardBoundaryCoverage}/${agent.capabilities.enforcement}`)
         .join("\n");
-    writeResult(data, parsed.json, `connected: ${data.connected ? "yes" : "no"}\napi_url: ${data.apiUrl ?? "-"}\nconfig_mode: ${data.configMode ?? "-"}\nruntime: ${data.runtimeRequired ? (data.runtimeInstalled ? "installed" : "missing") : "not required"}\nqueued_turns: ${data.queuedTurns}\n${agentLines}\n`);
+    const externalSurfaceLines = data.externalSurfaces
+        .map((surface) => `${surface.surface}: repository template, locally inspectable no, capture ${surface.capabilities.captureDurability}, guard ${surface.capabilities.guardBoundaryCoverage}/${surface.capabilities.enforcement}`)
+        .join("\n");
+    const metricRate = (value) => value === null || value === undefined
+        ? "-"
+        : `${(value * 100).toFixed(1)}%`;
+    writeResult(data, parsed.json, `connected: ${data.connected ? "yes" : "no"}\napi_url: ${data.apiUrl ?? "-"}\nconfig_mode: ${data.configMode ?? "-"}\nruntime: ${data.runtimeRequired ? (data.runtimeInstalled ? `installed (${data.runtimeVersion})` : data.runtimeVersion === null ? "missing" : `stale (${data.runtimeVersion})`) : "not required"}\ndurable_outbox: ${data.reliability?.outbox.total ?? 0} ready=${data.reliability?.outbox.ready ?? 0} auth_blocked=${data.reliability?.outbox.authBlocked ?? 0} dead=${data.reliability?.outbox.dead ?? 0}\noldest_capture: ${data.reliability?.outbox.oldestEnqueuedAt ?? "-"}\ncontext_snapshots: ${data.reliability?.cache.context ?? 0}\noldest_context_snapshot: ${data.reliability?.cache.oldestContextWrittenAt ?? "-"}\npolicy_snapshots: ${data.reliability?.cache.policy ?? 0}\nlocal_context_fallback_rate: ${metricRate(data.reliability?.operational.retrieval.fallbackRate)}\nlocal_guard_coverage: ${metricRate(data.reliability?.operational.guard.coverageRate)}\nlocal_guard_failures: ${data.reliability?.operational.guard.failures ?? 0}\nlocal_retrieval_failures: ${data.reliability?.operational.retrieval.failed ?? 0}\n${data.reliabilityError === null ? "" : `reliability_error: ${data.reliabilityError}\n`}${agentLines}\n${externalSurfaceLines}\n`);
 }
 async function disconnectCommand(args) {
     const parsed = parseOutputArguments(args, DISCONNECT_HELP, "disconnect");
@@ -1303,6 +2145,12 @@ async function disconnectCommand(args) {
         rm(paths.config, { force: true }),
         rm(paths.runtime, { force: true }),
         rm(paths.runtimeRepository, { force: true }),
+        rm(paths.runtimeReliabilityStore, { force: true }),
+        rm(paths.runtimeSignedSnapshot, { force: true }),
+        rm(paths.runtimeCanonicalJson, { force: true }),
+        rm(paths.runtimeContextFallback, { force: true }),
+        rm(paths.runtimeInvocationHealthWriter, { force: true }),
+        rm(paths.runtimeVersion, { force: true }),
         rm(paths.runtimePackage, { force: true }),
         rm(paths.state, { recursive: true, force: true }),
         rm(paths.queue, { recursive: true, force: true }),
@@ -1363,8 +2211,61 @@ async function apiChecks(config) {
                 : detail,
         });
     }
+    try {
+        const response = await fetch(`${config.apiUrl}/v1/reliability/metrics`, {
+            headers: {
+                authorization: `Bearer ${config.token}`,
+                "user-agent": `lore-cli/${LORE_VERSION}`,
+            },
+            signal: AbortSignal.timeout(3_000),
+        });
+        if (!response.ok) {
+            throw new Error("Operational metrics request failed");
+        }
+        const metrics = OperationalMetricsResponseSchema.parse(await response.json());
+        const captureBacklog = metrics.captureReplay.captureExtraction.pending +
+            metrics.captureReplay.captureExtraction.running;
+        const embeddingBacklog = metrics.captureReplay.memoryEmbedding.pending +
+            metrics.captureReplay.memoryEmbedding.running;
+        const deadLetters = metrics.captureReplay.captureExtraction.dead +
+            metrics.captureReplay.memoryEmbedding.dead;
+        const detectedFailures = metrics.silentFailures.count +
+            metrics.guard.failures +
+            deadLetters;
+        checks.push({
+            name: "server-operational-metrics",
+            status: metrics.silentFailures.count > 0 || deadLetters > 0
+                ? "error"
+                : metrics.guard.failures > 0 ||
+                    captureBacklog > 0 ||
+                    embeddingBacklog > 0
+                    ? "warning"
+                    : "ok",
+            detail: `${detectedFailures} detected failure(s), ${captureBacklog} capture and ${embeddingBacklog} embedding job(s) in backlog; ${metrics.guard.latency.samples} Guard latency sample(s)`,
+        });
+    }
+    catch {
+        checks.push({
+            name: "server-operational-metrics",
+            status: "warning",
+            detail: "authenticated operational metrics are unavailable",
+        });
+    }
     return checks;
 }
+async function verifyConnectedInstallation() {
+    const paths = getLorePaths();
+    const config = await readConnectorConfig(paths);
+    if (config === null) {
+        return false;
+    }
+    const status = await statusData(paths);
+    if (status.configMode !== "600" ||
+        status.agents.some((agent) => agent.configured && agent.installation.state !== "complete")) {
+        return false;
+    }
+    return (await apiChecks(config)).every((check) => check.status !== "error");
+}
 async function doctorCommand(args) {
     const parsed = parseOutputArguments(args, DOCTOR_HELP, "doctor");
     if (parsed === null) {
@@ -1415,14 +2316,87 @@ async function doctorCommand(args) {
         });
         checks.push({
             name: `${agent.agent}-${agent.integration}`,
-            status: agent.installed === agent.expected ? "ok" : "error",
-            detail: `${agent.installed}/${agent.expected} Lore ${agent.integration} in ${agent.configFile}`,
+            status: agent.installation.state === "complete" ? "ok" : "error",
+            detail: `${agent.installation.state}: ${agent.installation.installedUnits}/${agent.installation.expectedUnits} exact Lore ${agent.integration} units`,
+        });
+        checks.push({
+            name: `${agent.agent}-invocation`,
+            status: agent.invocationError !== null
+                ? "error"
+                : agent.invocation.state === "successful"
+                    ? "ok"
+                    : agent.invocation.state === "failed" ||
+                        agent.invocation.state === "incomplete"
+                        ? "error"
+                        : "warning",
+            detail: agent.invocationError !== null
+                ? agent.invocationError === "runtime_version_mismatch"
+                    ? `observed Lore ${agent.invocation.runtimeVersion}; expected ${LORE_VERSION}`
+                    : `health record unavailable (${agent.invocationError})`
+                : agent.invocation.state === "successful"
+                    ? `last completed ${agent.invocation.lastSuccessfulAt}`
+                    : agent.invocation.state === "failed"
+                        ? `last invocation failed (${agent.invocation.failureCode})`
+                        : agent.invocation.state === "incomplete"
+                            ? `last invocation did not complete (${agent.invocation.lastAttemptedAt})`
+                            : agent.invocation.state === "never_observed"
+                                ? "installed, but no invocation has been observed yet"
+                                : "invocation health is unavailable",
+        });
+    }
+    for (const surface of status.externalSurfaces) {
+        checks.push({
+            name: `${surface.surface}-capability`,
+            status: "ok",
+            detail: "surface-specific repository configuration; local installation is not claimed",
         });
     }
     checks.push({
-        name: "retry-queue",
-        status: status.queuedTurns === 0 ? "ok" : "warning",
-        detail: `${status.queuedTurns} queued turn(s)`,
+        name: "reliability-store",
+        status: status.reliabilityError !== null
+            ? "error"
+            : status.reliability === null
+                ? "warning"
+                : "ok",
+        detail: status.reliabilityError ??
+            status.reliability?.directory ??
+            "not initialized",
+    });
+    if (status.reliability !== null) {
+        checks.push({
+            name: "durable-capture-outbox",
+            status: status.reliability.outbox.authBlocked > 0 ||
+                status.reliability.outbox.dead > 0
+                ? "error"
+                : status.reliability.outbox.ready > 0 ||
+                    status.reliability.outbox.inFlight > 0
+                    ? "warning"
+                    : "ok",
+            detail: `${status.reliability.outbox.total} total; ${status.reliability.outbox.ready} ready, ${status.reliability.outbox.authBlocked} authentication-blocked, ${status.reliability.outbox.dead} dead-letter`,
+        });
+        checks.push({
+            name: "verified-snapshot-cache",
+            status: status.reliability.trustKeys > 0 ? "ok" : "warning",
+            detail: `${status.reliability.cache.context} context, ${status.reliability.cache.policy} policy, ${status.reliability.trustKeys} pinned key(s)`,
+        });
+        const operational = status.reliability.operational;
+        const detectedFailures = operational.guard.failures + operational.retrieval.failed;
+        checks.push({
+            name: "local-operational-metrics",
+            status: detectedFailures > 0 ? "warning" : "ok",
+            detail: `${detectedFailures} detected failure(s); Guard coverage ${operational.guard.coverageRate === null ? "not yet sampled" : `${(operational.guard.coverageRate * 100).toFixed(1)}%`}, context fallback ${operational.retrieval.fallbackRate === null ? "not yet sampled" : `${(operational.retrieval.fallbackRate * 100).toFixed(1)}%`}`,
+        });
+    }
+    const incompleteInvocations = status.agents.filter((agent) => agent.configured && agent.invocation.state === "incomplete").length;
+    const failedInvocations = status.agents.filter((agent) => agent.configured && agent.invocation.state === "failed").length;
+    checks.push({
+        name: "integration-invocation-completion",
+        status: incompleteInvocations > 0
+            ? "error"
+            : failedInvocations > 0
+                ? "warning"
+                : "ok",
+        detail: `${incompleteInvocations} incomplete and ${failedInvocations} explicitly failed latest invocation(s); target 0`,
     });
     if (config !== null) {
         checks.push(...(await apiChecks(config)));
@@ -1494,7 +2468,19 @@ export async function runCli(args = process.argv.slice(2)) {
             await doctorCommand(commandArgs);
             return;
         case "self-host":
-            await runSelfHostCommand(commandArgs);
+            await runSelfHostCommand(commandArgs, process.env, {
+                connect: async (request) => {
+                    const connected = await connectWithCredential({
+                        apiUrl: request.apiUrl,
+                        token: request.token,
+                        agents: request.agents,
+                    });
+                    return {
+                        agents: connected.agents,
+                        verified: await verifyConnectedInstallation(),
+                    };
+                },
+            });
             return;
         case "demo":
             await runDemoCommand(commandArgs, await readConnectorConfig(getLorePaths()));
@@ -1508,6 +2494,11 @@ export async function runCli(args = process.argv.slice(2)) {
         case "hook":
             await runHook(commandArgs);
             return;
+        case "internal-health-write": {
+            const encoded = commandArgs[0] ?? (await readInvocationHealthWriteInput());
+            await runInvocationHealthWrite(encoded);
+            return;
+        }
         default:
             throw new Error(`Unknown command: ${command}\nTry: lore --help`);
     }