@massa-ai/mcp-client 1.36.0 → 1.38.0

package/dist/index.js

@@ -26159,7 +26159,8 @@ var init_config = __esm(() => {
     },
     logging: {
       level: process.env.LOG_LEVEL || fileConfig.logging?.level || "info",
-      enableMetrics: process.env.ENABLE_METRICS === "true" || process.env.ENABLE_METRICS === undefined && !!fileConfig.logging?.enableMetrics
+      enableMetrics: process.env.ENABLE_METRICS === "true" || process.env.ENABLE_METRICS === undefined && !!fileConfig.logging?.enableMetrics,
+      file: process.env.MASSA_AI_LOG_FILE || fileConfig.logging?.file || undefined
     },
     synapse: {
       enabled: process.env.SYNAPSE_ENABLED !== "false",
@@ -26313,20 +26314,25 @@ var init_types2 = __esm(() => {
 var init_interfaces = () => {};
 
 // ../../packages/shared/dist/utils/logger.js
+import fs2 from "fs";
+
 class Logger {
   _level;
   _enableMetrics;
+  _logFilePath;
   _initialized = false;
   constructor() {}
   ensureInitialized() {
     if (!this._initialized) {
       try {
-        const configLevel = config2.get("logging").level;
-        this._level = this.parseLogLevel(configLevel);
-        this._enableMetrics = config2.get("logging").enableMetrics;
+        const loggingConfig = config2.get("logging");
+        this._level = this.parseLogLevel(loggingConfig.level);
+        this._enableMetrics = loggingConfig.enableMetrics;
+        this._logFilePath = loggingConfig.file;
       } catch {
         this._level = LogLevel.INFO;
         this._enableMetrics = false;
+        this._logFilePath = undefined;
       }
       this._initialized = true;
     }
@@ -26339,6 +26345,10 @@ class Logger {
     this.ensureInitialized();
     return this._enableMetrics;
   }
+  get logFilePath() {
+    this.ensureInitialized();
+    return this._logFilePath;
+  }
   parseLogLevel(level) {
     const levels = {
       debug: LogLevel.DEBUG,
@@ -26358,6 +26368,13 @@ class Logger {
   }
   write(message, _level) {
     console.error(message);
+    const filePath = this.logFilePath;
+    if (filePath) {
+      try {
+        fs2.appendFileSync(filePath, message + `
+`);
+      } catch {}
+    }
   }
   debug(message, meta3) {
     if (this.shouldLog(LogLevel.DEBUG)) {
@@ -26767,7 +26784,7 @@ var init_hosts = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/state.js
-import fs2 from "fs";
+import fs3 from "fs";
 import path6 from "path";
 function namedError(name, message) {
   const err = new InstallStateError(message);
@@ -26794,7 +26811,7 @@ function validateShape(raw2, filePath) {
 function readInstallState(filePath) {
   let text;
   try {
-    text = fs2.readFileSync(filePath, "utf-8");
+    text = fs3.readFileSync(filePath, "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT")
@@ -26814,8 +26831,8 @@ function writeInstallState(filePath, state) {
   const text = `${JSON.stringify(validated, null, 2)}
 `;
   try {
-    fs2.mkdirSync(path6.dirname(filePath), { recursive: true });
-    fs2.writeFileSync(filePath, text);
+    fs3.mkdirSync(path6.dirname(filePath), { recursive: true });
+    fs3.writeFileSync(filePath, text);
   } catch (err) {
     throw UnwritableInstallStateError(filePath, err.message);
   }
@@ -26842,7 +26859,7 @@ var init_state = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/lock.js
-import fs3 from "fs";
+import fs4 from "fs";
 import path7 from "path";
 import os4 from "os";
 import crypto3 from "crypto";
@@ -26855,7 +26872,7 @@ function namedError2(name, message) {
 function readOwner(ownerPath) {
   let raw2;
   try {
-    raw2 = JSON.parse(fs3.readFileSync(ownerPath, "utf-8"));
+    raw2 = JSON.parse(fs4.readFileSync(ownerPath, "utf-8"));
   } catch {
     return null;
   }
@@ -26871,7 +26888,7 @@ function releaseIfOwned(lockDir, ownerPath, token) {
   const owner = readOwner(ownerPath);
   if (owner === null || owner.token !== token)
     return;
-  fs3.rmSync(lockDir, { recursive: true, force: true });
+  fs4.rmSync(lockDir, { recursive: true, force: true });
 }
 function acquireLock(stateFilePath, options = {}) {
   const lockDir = `${stateFilePath}.switch.lock`;
@@ -26880,11 +26897,11 @@ function acquireLock(stateFilePath, options = {}) {
   const identity = options.identity ?? DEFAULT_IDENTITY;
   const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
   const createFresh = () => {
-    fs3.mkdirSync(lockDir);
+    fs4.mkdirSync(lockDir);
     const pid = identity.pid();
     const startedAt = identity.processStart(pid);
     if (startedAt == null) {
-      fs3.rmSync(lockDir, { recursive: true, force: true });
+      fs4.rmSync(lockDir, { recursive: true, force: true });
       throw LockAcquireError(lockDir, "could not determine this process's start-time identity");
     }
     const token = crypto3.randomUUID();
@@ -26895,8 +26912,8 @@ function acquireLock(stateFilePath, options = {}) {
       token,
       timestamp: clock.now()
     };
-    fs3.mkdirSync(path7.dirname(ownerPath), { recursive: true });
-    fs3.writeFileSync(ownerPath, JSON.stringify(record3));
+    fs4.mkdirSync(path7.dirname(ownerPath), { recursive: true });
+    fs4.writeFileSync(ownerPath, JSON.stringify(record3));
     return { lockDir, release: () => releaseIfOwned(lockDir, ownerPath, token) };
   };
   try {
@@ -26911,11 +26928,11 @@ function acquireLock(stateFilePath, options = {}) {
     throw LockHeldError(lockDir);
   const reclaimDir = `${lockDir}.reclaim.${owner.token}`;
   try {
-    fs3.renameSync(lockDir, reclaimDir);
+    fs4.renameSync(lockDir, reclaimDir);
   } catch {
     throw LockHeldError(lockDir);
   }
-  fs3.rmSync(reclaimDir, { recursive: true, force: true });
+  fs4.rmSync(reclaimDir, { recursive: true, force: true });
   try {
     return createFresh();
   } catch {
@@ -26949,7 +26966,7 @@ var init_lock = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/engine.js
-import fs4 from "fs";
+import fs5 from "fs";
 import path8 from "path";
 import os5 from "os";
 import crypto4 from "crypto";
@@ -26983,7 +27000,7 @@ function listProfiles(opts = {}) {
         availableProfiles: []
       };
     }
-    const installed = fs4.existsSync(layout.activeDir);
+    const installed = fs5.existsSync(layout.activeDir);
     const availableProfiles = listVariantProfiles(layout);
     const platform = state.platforms[host];
     return {
@@ -26999,9 +27016,9 @@ function listProfiles(opts = {}) {
   return { hosts };
 }
 function listVariantProfiles(layout) {
-  if (!fs4.existsSync(layout.variantsRoot))
+  if (!fs5.existsSync(layout.variantsRoot))
     return [];
-  return fs4.readdirSync(layout.variantsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  return fs5.readdirSync(layout.variantsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
 }
 function matchesGlob(filename, glob) {
   const starIdx = glob.indexOf("*");
@@ -27014,32 +27031,32 @@ function matchesGlob(filename, glob) {
 function assertStateWritable(stateFilePath) {
   const dir = path8.dirname(stateFilePath);
   try {
-    fs4.mkdirSync(dir, { recursive: true });
+    fs5.mkdirSync(dir, { recursive: true });
   } catch (err) {
     throw UnwritableInstallStateError(stateFilePath, err.message);
   }
-  const checkPath = fs4.existsSync(stateFilePath) ? stateFilePath : dir;
+  const checkPath = fs5.existsSync(stateFilePath) ? stateFilePath : dir;
   try {
-    fs4.accessSync(checkPath, fs4.constants.W_OK);
+    fs5.accessSync(checkPath, fs5.constants.W_OK);
   } catch (err) {
     throw UnwritableInstallStateError(stateFilePath, err.message);
   }
 }
 function copyFileRouteVariant(layout, variantDir) {
-  fs4.mkdirSync(layout.activeDir, { recursive: true });
+  fs5.mkdirSync(layout.activeDir, { recursive: true });
   let changed = 0;
-  for (const entry of fs4.readdirSync(variantDir, { withFileTypes: true })) {
+  for (const entry of fs5.readdirSync(variantDir, { withFileTypes: true })) {
     if (!entry.isFile() || !matchesGlob(entry.name, layout.activeGlob))
       continue;
-    fs4.copyFileSync(path8.join(variantDir, entry.name), path8.join(layout.activeDir, entry.name));
+    fs5.copyFileSync(path8.join(variantDir, entry.name), path8.join(layout.activeDir, entry.name));
     changed++;
   }
   return changed;
 }
 function repointOpencodeVariant(layout, variantDir) {
-  fs4.mkdirSync(layout.activeDir, { recursive: true });
+  fs5.mkdirSync(layout.activeDir, { recursive: true });
   let changed = 0;
-  for (const entry of fs4.readdirSync(variantDir, { withFileTypes: true })) {
+  for (const entry of fs5.readdirSync(variantDir, { withFileTypes: true })) {
     if (!entry.isFile() || !matchesGlob(entry.name, layout.activeGlob))
       continue;
     const dest = path8.join(layout.activeDir, entry.name);
@@ -27047,15 +27064,15 @@ function repointOpencodeVariant(layout, variantDir) {
     let destExists = true;
     let destIsSymlink = false;
     try {
-      destIsSymlink = fs4.lstatSync(dest).isSymbolicLink();
+      destIsSymlink = fs5.lstatSync(dest).isSymbolicLink();
     } catch {
       destExists = false;
     }
     if (destExists && !destIsSymlink)
       continue;
     const tmp = `${dest}.massa-ai-switch.${crypto4.randomUUID()}`;
-    fs4.symlinkSync(target, tmp);
-    fs4.renameSync(tmp, dest);
+    fs5.symlinkSync(target, tmp);
+    fs5.renameSync(tmp, dest);
     changed++;
   }
   return changed;
@@ -27077,13 +27094,13 @@ function switchProfile(opts) {
   if (fileHosts.length === 0) {
     return { profile: opts.profile, dryRun, hosts: orderRows(universe, skipRows), restartRequired: false };
   }
-  const installedFileHosts = fileHosts.filter((h) => fs4.existsSync(h.layout.activeDir));
+  const installedFileHosts = fileHosts.filter((h) => fs5.existsSync(h.layout.activeDir));
   if (installedFileHosts.length === 0)
     throw NoHostsDetectedError();
   const withAvailability = fileHosts.map((h) => {
-    const variantsRootExists = fs4.existsSync(h.layout.variantsRoot);
+    const variantsRootExists = fs5.existsSync(h.layout.variantsRoot);
     const variantDir = h.layout.variantDir(opts.profile);
-    const available = variantsRootExists && fs4.existsSync(variantDir) && fs4.statSync(variantDir).isDirectory();
+    const available = variantsRootExists && fs5.existsSync(variantDir) && fs5.statSync(variantDir).isDirectory();
     return { ...h, variantsRootExists, variantDir, available };
   });
   if (!withAvailability.some((h) => h.available)) {
@@ -31297,8 +31314,8 @@ var init_esm4 = __esm(() => {
     #children;
     nocase;
     #fs;
-    constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs5 = defaultFS } = {}) {
-      this.#fs = fsFromOption(fs5);
+    constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs6 = defaultFS } = {}) {
+      this.#fs = fsFromOption(fs6);
       if (cwd instanceof URL || cwd.startsWith("file://")) {
         cwd = fileURLToPath(cwd);
       }
@@ -31773,8 +31790,8 @@ var init_esm4 = __esm(() => {
     parseRootPath(dir) {
       return win32.parse(dir).root.toUpperCase();
     }
-    newRoot(fs5) {
-      return new PathWin32(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs5 });
+    newRoot(fs6) {
+      return new PathWin32(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs6 });
     }
     isAbsolute(p) {
       return p.startsWith("/") || p.startsWith("\\") || /^[a-z]:(\/|\\)/i.test(p);
@@ -31790,8 +31807,8 @@ var init_esm4 = __esm(() => {
     parseRootPath(_dir) {
       return "/";
     }
-    newRoot(fs5) {
-      return new PathPosix(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs5 });
+    newRoot(fs6) {
+      return new PathPosix(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs6 });
     }
     isAbsolute(p) {
       return p.startsWith("/");
@@ -33197,7 +33214,7 @@ var init_capture_policy = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/ignore-patterns.js
-import fs5 from "fs/promises";
+import fs6 from "fs/promises";
 import path10 from "path";
 function buildExtensionGlob(extensions) {
   return extensions.map((ext2) => `**/*${ext2}`);
@@ -33222,7 +33239,7 @@ async function loadProjectIgnore(projectPath) {
   ig.add(DEFAULT_IGNORES);
   try {
     const gitignorePath = path10.join(projectPath, ".gitignore");
-    const gitignoreContent = await fs5.readFile(gitignorePath, "utf8");
+    const gitignoreContent = await fs6.readFile(gitignorePath, "utf8");
     const rules = gitignoreContent.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
     ig.add(rules);
@@ -34818,15 +34835,15 @@ var require_pg_connection_string = __commonJS((exports, module) => {
     if (config3.sslnegotiation === "direct" && config3.ssl === undefined) {
       config3.ssl = true;
     }
-    const fs6 = config3.sslcert || config3.sslkey || config3.sslrootcert ? __require("fs") : null;
+    const fs7 = config3.sslcert || config3.sslkey || config3.sslrootcert ? __require("fs") : null;
     if (config3.sslcert) {
-      config3.ssl.cert = fs6.readFileSync(config3.sslcert).toString();
+      config3.ssl.cert = fs7.readFileSync(config3.sslcert).toString();
     }
     if (config3.sslkey) {
-      config3.ssl.key = fs6.readFileSync(config3.sslkey).toString();
+      config3.ssl.key = fs7.readFileSync(config3.sslkey).toString();
     }
     if (config3.sslrootcert) {
-      config3.ssl.ca = fs6.readFileSync(config3.sslrootcert).toString();
+      config3.ssl.ca = fs7.readFileSync(config3.sslrootcert).toString();
     }
     if (options.useLibpqCompat && config3.uselibpqcompat) {
       throw new Error("Both useLibpqCompat and uselibpqcompat are set. Please use only one of them.");
@@ -36705,15 +36722,15 @@ var require_helper = __commonJS((exports, module) => {
 // ../../node_modules/pgpass/lib/index.js
 var require_lib = __commonJS((exports, module) => {
   var path11 = __require("path");
-  var fs6 = __require("fs");
+  var fs7 = __require("fs");
   var helper = require_helper();
   module.exports = function(connInfo, cb) {
     var file2 = helper.getFileName();
-    fs6.stat(file2, function(err, stat) {
+    fs7.stat(file2, function(err, stat) {
       if (err || !helper.usePgPass(stat, file2)) {
         return cb(undefined);
       }
-      var st = fs6.createReadStream(file2);
+      var st = fs7.createReadStream(file2);
       helper.getPassword(connInfo, st, cb);
     });
   };
@@ -38243,6 +38260,89 @@ var init_db_connection = __esm(() => {
   init_config();
 });
 
+// ../../packages/core/dist/kernel/sanitize/credential-scrub.js
+function markerFor(id) {
+  return `[REDACTED:${id}]`;
+}
+function fullMatchRule(id, pattern) {
+  const marker = markerFor(id);
+  return {
+    id,
+    replace(text) {
+      let count = 0;
+      const replaced = text.replace(pattern, () => {
+        count++;
+        return marker;
+      });
+      return { text: replaced, count };
+    }
+  };
+}
+function scrubCredentials(payloadJson) {
+  const redactions = {};
+  for (const id of RULE_IDS)
+    redactions[id] = 0;
+  let text = payloadJson;
+  for (const rule of RULES) {
+    const { text: next, count } = rule.replace(text);
+    text = next;
+    redactions[rule.id] += count;
+  }
+  const total = Object.values(redactions).reduce((sum, n) => sum + n, 0);
+  return {
+    sanitized: text,
+    redactions,
+    total
+  };
+}
+var PEM_PATTERN, JWT_PATTERN, AWS_KEY_PATTERN, SK_KEY_PATTERN, GITHUB_TOKEN_PATTERN, SLACK_TOKEN_PATTERN, BEARER_PATTERN, RULES, RULE_IDS;
+var init_credential_scrub = __esm(() => {
+  PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
+  JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+  AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
+  SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
+  GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
+  SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
+  BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
+  RULES = [
+    fullMatchRule("pem", PEM_PATTERN),
+    fullMatchRule("jwt", JWT_PATTERN),
+    fullMatchRule("aws-key", AWS_KEY_PATTERN),
+    fullMatchRule("sk-key", SK_KEY_PATTERN),
+    fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
+    fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
+    {
+      id: "bearer",
+      replace(text) {
+        let count = 0;
+        const replaced = text.replace(BEARER_PATTERN, (_m, prefix) => {
+          count++;
+          return `${prefix}${markerFor("bearer")}`;
+        });
+        return { text: replaced, count };
+      }
+    }
+  ];
+  RULE_IDS = RULES.map((r) => r.id);
+});
+
+// ../../packages/core/dist/kernel/sanitize/safe-error-summary.js
+function safeErrorSummary(error51) {
+  if (error51 instanceof Error) {
+    return {
+      name: error51.name,
+      message: scrubCredentials(error51.message).sanitized
+    };
+  }
+  return {
+    name: "UnknownError",
+    message: scrubCredentials(String(error51)).sanitized
+  };
+}
+var init_safe_error_summary = __esm(() => {
+  init_credential_scrub();
+});
+
 // ../../packages/core/dist/kernel/alias-resolver.js
 class ProjectIdentityAliasResolver {
   ttlMs;
@@ -38268,9 +38368,7 @@ class ProjectIdentityAliasResolver {
       this.cache.set(projectId, { canonical, expiresAt: this.now() + this.ttlMs });
       return canonical;
     } catch (error51) {
-      logger.warn("[project-identity] alias resolution failed; using original id (sanitized)", {
-        name: error51 instanceof Error ? error51.name : "unknown"
-      });
+      logger.warn("[project-identity] alias resolution failed; using original id", safeErrorSummary(error51));
       return projectId;
     }
   }
@@ -38327,10 +38425,11 @@ var DEFAULT_TTL_MS = 30000, DEFAULT_RESOLVE_TIMEOUT_MS = 250, sharedResolver = n
 var init_alias_resolver = __esm(() => {
   init_dist();
   init_db_connection();
+  init_safe_error_summary();
 });
 
 // ../../packages/core/dist/services/search/index-manager.js
-import fs6 from "fs";
+import fs7 from "fs";
 import path11 from "path";
 
 class IndexManager {
@@ -38426,7 +38525,7 @@ class IndexManager {
       for (const filePath of indexedFiles) {
         const fullPath = path11.join(projectPath, filePath);
         try {
-          const stat = await fs6.promises.stat(fullPath);
+          const stat = await fs7.promises.stat(fullPath);
           fileMetadata[filePath] = {
             path: filePath,
             mtime: stat.mtimeMs,
@@ -38479,7 +38578,7 @@ class IndexManager {
         }
         const fullPath = path11.join(projectPath, match2);
         try {
-          const stat = await fs6.promises.stat(fullPath);
+          const stat = await fs7.promises.stat(fullPath);
           files.set(match2, {
             path: match2,
             mtime: stat.mtimeMs,
@@ -41732,7 +41831,7 @@ var require_auth_config = __commonJS((exports, module) => {
     writeAuthConfig: () => writeAuthConfig
   });
   module.exports = __toCommonJS2(auth_config_exports);
-  var fs7 = __toESM2(__require("fs"));
+  var fs8 = __toESM2(__require("fs"));
   var path12 = __toESM2(__require("path"));
   var import_token_util = require_token_util();
   function getAuthConfigPath() {
@@ -41745,10 +41844,10 @@ var require_auth_config = __commonJS((exports, module) => {
   function readAuthConfig() {
     try {
       const authPath = getAuthConfigPath();
-      if (!fs7.existsSync(authPath)) {
+      if (!fs8.existsSync(authPath)) {
         return null;
       }
-      const content = fs7.readFileSync(authPath, "utf8");
+      const content = fs8.readFileSync(authPath, "utf8");
       if (!content) {
         return null;
       }
@@ -41760,10 +41859,10 @@ var require_auth_config = __commonJS((exports, module) => {
   function writeAuthConfig(config3) {
     const authPath = getAuthConfigPath();
     const authDir = path12.dirname(authPath);
-    if (!fs7.existsSync(authDir)) {
-      fs7.mkdirSync(authDir, { mode: 504, recursive: true });
+    if (!fs8.existsSync(authDir)) {
+      fs8.mkdirSync(authDir, { mode: 504, recursive: true });
     }
-    fs7.writeFileSync(authPath, JSON.stringify(config3, null, 2), { mode: 384 });
+    fs8.writeFileSync(authPath, JSON.stringify(config3, null, 2), { mode: 384 });
   }
   function isValidAccessToken(authConfig, expirationBufferMs = 0) {
     if (!authConfig.token)
@@ -41939,7 +42038,7 @@ var require_token_util = __commonJS((exports, module) => {
   });
   module.exports = __toCommonJS2(token_util_exports);
   var path12 = __toESM2(__require("path"));
-  var fs7 = __toESM2(__require("fs"));
+  var fs8 = __toESM2(__require("fs"));
   var import_token_error = require_token_error();
   var import_token_io = require_token_io();
   var import_auth_config = require_auth_config();
@@ -42020,10 +42119,10 @@ var require_token_util = __commonJS((exports, module) => {
       throw new import_token_error.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");
     }
     const prjPath = path12.join(dir, ".vercel", "project.json");
-    if (!fs7.existsSync(prjPath)) {
+    if (!fs8.existsSync(prjPath)) {
       throw new import_token_error.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");
     }
-    const prj = JSON.parse(fs7.readFileSync(prjPath, "utf8"));
+    const prj = JSON.parse(fs8.readFileSync(prjPath, "utf8"));
     if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
       throw new TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");
     }
@@ -42036,9 +42135,9 @@ var require_token_util = __commonJS((exports, module) => {
     }
     const tokenPath = path12.join(dir, "com.vercel.token", `${projectId}.json`);
     const tokenJson = JSON.stringify(token);
-    fs7.mkdirSync(path12.dirname(tokenPath), { mode: 504, recursive: true });
-    fs7.writeFileSync(tokenPath, tokenJson);
-    fs7.chmodSync(tokenPath, 432);
+    fs8.mkdirSync(path12.dirname(tokenPath), { mode: 504, recursive: true });
+    fs8.writeFileSync(tokenPath, tokenJson);
+    fs8.chmodSync(tokenPath, 432);
     return;
   }
   function loadToken(projectId) {
@@ -42047,10 +42146,10 @@ var require_token_util = __commonJS((exports, module) => {
       throw new import_token_error.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");
     }
     const tokenPath = path12.join(dir, "com.vercel.token", `${projectId}.json`);
-    if (!fs7.existsSync(tokenPath)) {
+    if (!fs8.existsSync(tokenPath)) {
       return null;
     }
-    const token = JSON.parse(fs7.readFileSync(tokenPath, "utf8"));
+    const token = JSON.parse(fs8.readFileSync(tokenPath, "utf8"));
     assertVercelOidcTokenResponse(token);
     return token;
   }
@@ -69480,26 +69579,26 @@ var require_process = __commonJS((exports, module) => {
 
 // ../../node_modules/detect-libc/lib/filesystem.js
 var require_filesystem = __commonJS((exports, module) => {
-  var fs7 = __require("fs");
+  var fs8 = __require("fs");
   var LDD_PATH = "/usr/bin/ldd";
   var SELF_PATH = "/proc/self/exe";
   var MAX_LENGTH = 2048;
   var readFileSync2 = (path12) => {
-    const fd = fs7.openSync(path12, "r");
+    const fd = fs8.openSync(path12, "r");
     const buffer = Buffer.alloc(MAX_LENGTH);
-    const bytesRead = fs7.readSync(fd, buffer, 0, MAX_LENGTH, 0);
-    fs7.close(fd, () => {});
+    const bytesRead = fs8.readSync(fd, buffer, 0, MAX_LENGTH, 0);
+    fs8.close(fd, () => {});
     return buffer.subarray(0, bytesRead);
   };
   var readFile = (path12) => new Promise((resolve4, reject) => {
-    fs7.open(path12, "r", (err, fd) => {
+    fs8.open(path12, "r", (err, fd) => {
       if (err) {
         reject(err);
       } else {
         const buffer = Buffer.alloc(MAX_LENGTH);
-        fs7.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
+        fs8.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
           resolve4(buffer.subarray(0, bytesRead));
-          fs7.close(fd, () => {});
+          fs8.close(fd, () => {});
         });
       }
     });
@@ -106162,10 +106261,10 @@ Note that ${s.bold("include")} statements only accept relation fields.`, a;
       super(t, "P2023", r);
     }
   };
-  var fs7 = new WeakMap;
+  var fs8 = new WeakMap;
   function Ep(e) {
-    let t = fs7.get(e);
-    return t || (t = Object.entries(e), fs7.set(e, t)), t;
+    let t = fs8.get(e);
+    return t || (t = Object.entries(e), fs8.set(e, t)), t;
   }
   function hs(e, t, r) {
     switch (t.type) {
@@ -114691,6 +114790,7 @@ var init_registry = __esm(() => {
     search_analytics: { storeId: "search_analytics", identityColumn: "project_id", mutable: true },
     search_events: { storeId: "search_events", identityColumn: "project_id", mutable: true },
     synapse_sessions: { storeId: "synapse_sessions", identityColumn: "workspace_id", mutable: true },
+    managed_runs: { storeId: "managed_runs", identityColumn: "project_id", mutable: true },
     operation_log: { storeId: "operation_log", identityColumn: "project_id", mutable: false },
     project_identity_operations: {
       storeId: "project_identity_operations",
@@ -120974,6 +121074,89 @@ var init_reranker = __esm(() => {
   });
 });
 
+// ../../packages/core/dist/kernel/search-diagnostics.js
+function searchBackendUnavailable(component, cause) {
+  return cause instanceof SearchServiceError ? cause : new SearchServiceError("SEARCH_BACKEND_UNAVAILABLE", component, { cause });
+}
+function storeCorruption(component, cause) {
+  return cause instanceof SearchServiceError ? cause : new SearchServiceError("STORE_CORRUPTION", component, {
+    cause,
+    statusCode: 500
+  });
+}
+function projectNotIndexed(projectId, message) {
+  return new SearchServiceError("PROJECT_NOT_INDEXED", projectId, {
+    message,
+    statusCode: 404
+  });
+}
+function recordSearchDegradation(code, component, projectId) {
+  const degradation = {
+    code,
+    component,
+    message: DEGRADATION_MESSAGES[code]
+  };
+  diagnostics.push({
+    kind: "degradation",
+    ...degradation,
+    projectId,
+    timestamp: new Date().toISOString()
+  });
+  if (diagnostics.length > MAX_DIAGNOSTICS) {
+    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
+  }
+  return degradation;
+}
+function recordSearchFailure(error51, projectId) {
+  if (recordedFailures.has(error51))
+    return;
+  recordedFailures.add(error51);
+  diagnostics.push({
+    kind: "failure",
+    code: error51.code,
+    component: error51.component,
+    message: error51.message,
+    projectId,
+    timestamp: new Date().toISOString()
+  });
+  if (diagnostics.length > MAX_DIAGNOSTICS) {
+    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
+  }
+}
+function getSearchDiagnostics() {
+  return diagnostics.map((diagnostic) => ({ ...diagnostic }));
+}
+function resetSearchDiagnosticsForTests() {
+  diagnostics.length = 0;
+}
+var MAX_DIAGNOSTICS = 100, diagnostics, recordedFailures, DEGRADATION_MESSAGES, SearchServiceError;
+var init_search_diagnostics = __esm(() => {
+  diagnostics = [];
+  recordedFailures = new WeakSet;
+  DEGRADATION_MESSAGES = {
+    QUERY_UNDERSTANDING_UNAVAILABLE: "Query understanding was unavailable; original query used",
+    TRIGRAM_UNAVAILABLE: "Trigram enrichment was unavailable",
+    FUZZY_SEARCH_UNAVAILABLE: "Fuzzy enrichment was unavailable",
+    PROXIMITY_RERANK_UNAVAILABLE: "Proximity reranking was unavailable; fused order preserved",
+    GRAPH_AUGMENTATION_UNAVAILABLE: "Graph augmentation was unavailable",
+    SYNAPSE_UNAVAILABLE: "Synapse enrichment was unavailable; stateless results used",
+    SEARCH_AUDIT_UNAVAILABLE: "Search event auditing was unavailable",
+    SEARCH_ANALYTICS_UNAVAILABLE: "Search analytics were unavailable"
+  };
+  SearchServiceError = class SearchServiceError extends Error {
+    code;
+    component;
+    statusCode;
+    constructor(code, component, options) {
+      super(options?.message ?? (code === "STORE_CORRUPTION" ? "Stored data is invalid" : "A required search backend is unavailable"), options?.cause === undefined ? undefined : { cause: options.cause });
+      this.code = code;
+      this.component = component;
+      this.name = "SearchServiceError";
+      this.statusCode = options?.statusCode ?? 503;
+    }
+  };
+});
+
 // ../../packages/core/dist/kernel/enum-validation.js
 function validateEnum(paramName, value, validValues) {
   if (typeof value !== "string" || !validValues.includes(value)) {
@@ -121082,7 +121265,7 @@ class SearchController {
     });
     const admission = await this.contextualSearch.checkSearchAdmission(projectId, projectPath);
     if (!admission.admitted) {
-      throw new Error(admission.error ?? `Project '${projectId}' is not indexed`);
+      throw projectNotIndexed(projectId, admission.error ?? `Project '${projectId}' is not indexed`);
     }
     const staleWarning = admission.stale ?? null;
     let reindexInfo = null;
@@ -121306,6 +121489,7 @@ var init_search_controller = __esm(() => {
   init_contextual_search_rlm();
   init_event_bus();
   init_reranker();
+  init_search_diagnostics();
   init_esm();
   init_filter_validation();
 });
@@ -121791,83 +121975,6 @@ var init_session_bias = __esm(() => {
   init_synapse();
 });
 
-// ../../packages/core/dist/kernel/search-diagnostics.js
-function searchBackendUnavailable(component, cause) {
-  return cause instanceof SearchServiceError ? cause : new SearchServiceError("SEARCH_BACKEND_UNAVAILABLE", component, { cause });
-}
-function storeCorruption(component, cause) {
-  return cause instanceof SearchServiceError ? cause : new SearchServiceError("STORE_CORRUPTION", component, {
-    cause,
-    statusCode: 500
-  });
-}
-function recordSearchDegradation(code, component, projectId) {
-  const degradation = {
-    code,
-    component,
-    message: DEGRADATION_MESSAGES[code]
-  };
-  diagnostics.push({
-    kind: "degradation",
-    ...degradation,
-    projectId,
-    timestamp: new Date().toISOString()
-  });
-  if (diagnostics.length > MAX_DIAGNOSTICS) {
-    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
-  }
-  return degradation;
-}
-function recordSearchFailure(error51, projectId) {
-  if (recordedFailures.has(error51))
-    return;
-  recordedFailures.add(error51);
-  diagnostics.push({
-    kind: "failure",
-    code: error51.code,
-    component: error51.component,
-    message: error51.message,
-    projectId,
-    timestamp: new Date().toISOString()
-  });
-  if (diagnostics.length > MAX_DIAGNOSTICS) {
-    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
-  }
-}
-function getSearchDiagnostics() {
-  return diagnostics.map((diagnostic) => ({ ...diagnostic }));
-}
-function resetSearchDiagnosticsForTests() {
-  diagnostics.length = 0;
-}
-var MAX_DIAGNOSTICS = 100, diagnostics, recordedFailures, DEGRADATION_MESSAGES, SearchServiceError;
-var init_search_diagnostics = __esm(() => {
-  diagnostics = [];
-  recordedFailures = new WeakSet;
-  DEGRADATION_MESSAGES = {
-    QUERY_UNDERSTANDING_UNAVAILABLE: "Query understanding was unavailable; original query used",
-    TRIGRAM_UNAVAILABLE: "Trigram enrichment was unavailable",
-    FUZZY_SEARCH_UNAVAILABLE: "Fuzzy enrichment was unavailable",
-    PROXIMITY_RERANK_UNAVAILABLE: "Proximity reranking was unavailable; fused order preserved",
-    GRAPH_AUGMENTATION_UNAVAILABLE: "Graph augmentation was unavailable",
-    SYNAPSE_UNAVAILABLE: "Synapse enrichment was unavailable; stateless results used",
-    SEARCH_AUDIT_UNAVAILABLE: "Search event auditing was unavailable",
-    SEARCH_ANALYTICS_UNAVAILABLE: "Search analytics were unavailable"
-  };
-  SearchServiceError = class SearchServiceError extends Error {
-    code;
-    component;
-    statusCode;
-    constructor(code, component, options) {
-      super(code === "STORE_CORRUPTION" ? "Stored data is invalid" : "A required search backend is unavailable", options?.cause === undefined ? undefined : { cause: options.cause });
-      this.code = code;
-      this.component = component;
-      this.name = "SearchServiceError";
-      this.statusCode = options?.statusCode ?? 503;
-    }
-  };
-});
-
 // ../../packages/core/dist/services/search/hybrid-search.js
 async function search(deps, query, projectId, options = {}) {
   const maxResults = options.maxResults ?? 10;
@@ -123224,7 +123331,7 @@ var init_managed_run_repository_pg = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/project-indexer.js
-import fs7 from "fs/promises";
+import fs8 from "fs/promises";
 import path13 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function runWithIndexLock(lockMap, projectId, work) {
@@ -123484,7 +123591,7 @@ async function checkSearchAdmission(deps, projectId, projectPath) {
 }
 async function indexFile(deps, filePath, projectId, projectRoot, centralityMap) {
   projectId = await getProjectIdentityAliasResolver().resolve(projectId);
-  const content = await fs7.readFile(filePath, "utf-8");
+  const content = await fs8.readFile(filePath, "utf-8");
   const relativePath = path13.relative(projectRoot, filePath);
   const maxFileSize = config2.get("security").maxFileSize || 1024 * 1024;
   if (content.length > maxFileSize) {
@@ -124350,7 +124457,7 @@ function stripNul(content) {
 }
 
 // ../../packages/core/dist/services/etl/stages/discover.js
-import fs8 from "fs/promises";
+import fs9 from "fs/promises";
 import path14 from "path";
 import { createHash as createHash5 } from "crypto";
 
@@ -124438,8 +124545,8 @@ class DiscoverStage {
   async processFile(ctx, relativePath, forceReindex) {
     const absolutePath = path14.join(ctx.projectPath, relativePath);
     try {
-      const stat = await fs8.stat(absolutePath);
-      const content = stripNul(await fs8.readFile(absolutePath, "utf-8"));
+      const stat = await fs9.stat(absolutePath);
+      const content = stripNul(await fs9.readFile(absolutePath, "utf-8"));
       const contentHash = createHash5("sha256").update(content).digest("hex");
       let needsReparse = forceReindex;
       if (!forceReindex) {
@@ -124483,7 +124590,7 @@ class DiscoverStage {
     }
     try {
       const gitignorePath = path14.join(projectPath, ".gitignore");
-      const gitignoreContent = await fs8.readFile(gitignorePath, "utf8");
+      const gitignoreContent = await fs9.readFile(gitignorePath, "utf8");
       const rules = gitignoreContent.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
       ig.add(rules);
@@ -126812,7 +126919,7 @@ var init_structural_runtime = __esm(() => {
 
 // ../../packages/core/dist/services/etl/stages/parse.js
 import path15 from "path";
-import fs9 from "fs/promises";
+import fs10 from "fs/promises";
 function resolveChunkerMaxChars() {
   const global2 = Number(process.env.EMBEDDING_MAX_CHARS);
   if (Number.isFinite(global2) && global2 > 0)
@@ -126904,7 +127011,7 @@ class ParseStage {
     if (!file2.needsReparse) {
       const extension = path15.extname(file2.relativePath).toLowerCase();
       if ([".c", ".cpp", ".hpp"].includes(extension)) {
-        const content = file2.snapshotContent ?? await fs9.readFile(file2.absolutePath, "utf8");
+        const content = file2.snapshotContent ?? await fs10.readFile(file2.absolutePath, "utf8");
         const outcome = await this.runtime.parse({ extension, source: Buffer.from(content) });
         if (outcome.status === "failed")
           throw new StructuralEtlParseError(file2.relativePath, outcome.failureKind, `Structural evidence parse failed (${outcome.failureKind})`, outcome.diagnosticCount, outcome.diagnostics.slice(0, 10));
@@ -126916,7 +127023,7 @@ class ParseStage {
       return { file: file2, chunks: [], symbols: [], rawImports: [], rawEdges: [] };
     }
     try {
-      const content = file2.snapshotContent ?? await fs9.readFile(file2.absolutePath, "utf-8");
+      const content = file2.snapshotContent ?? await fs10.readFile(file2.absolutePath, "utf-8");
       const ext2 = path15.extname(file2.relativePath).toLowerCase();
       const chunkerMaxChars = resolveChunkerMaxChars();
       const chunks = smartChunk(content, file2.relativePath, chunkerMaxChars ? { maxChunkChars: chunkerMaxChars } : {});
@@ -127957,7 +128064,7 @@ var init_data_document2 = __esm(() => {
 
 // ../../packages/core/dist/services/etl/stages/resolve.js
 import path18 from "path";
-import fs10 from "fs";
+import fs11 from "fs";
 
 class ResolveStage {
   symbolRepository;
@@ -128274,7 +128381,7 @@ class ResolveStage {
     const aliases = [];
     const tsconfigPath = path18.join(projectPath, "tsconfig.json");
     try {
-      const raw2 = fs10.readFileSync(tsconfigPath, "utf-8");
+      const raw2 = fs11.readFileSync(tsconfigPath, "utf-8");
       const stripped = raw2.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
       const tsconfig = JSON.parse(stripped);
       const paths = tsconfig?.compilerOptions?.paths ?? {};
@@ -130697,7 +130804,7 @@ __export(exports_symbol_graph_service, {
   SymbolGraphService: () => SymbolGraphService
 });
 import path22 from "path";
-import fs11 from "fs/promises";
+import fs12 from "fs/promises";
 
 class SymbolGraphService {
   identityLookup;
@@ -131025,7 +131132,7 @@ class SymbolGraphService {
   async readSnippet(relativePath, lineStart, lineEnd, projectId) {
     try {
       const absolutePath = await this.resolveToAbsolute(relativePath, projectId);
-      const content = await fs11.readFile(absolutePath, "utf-8");
+      const content = await fs12.readFile(absolutePath, "utf-8");
       const lines = content.split(`
 `);
       return lines.slice(Math.max(0, lineStart - 1), Math.min(lines.length, lineEnd)).join(`
@@ -131037,7 +131144,7 @@ class SymbolGraphService {
   async readContext(relativePath, lineNumber, contextLines, projectId) {
     try {
       const absolutePath = await this.resolveToAbsolute(relativePath, projectId);
-      const content = await fs11.readFile(absolutePath, "utf-8");
+      const content = await fs12.readFile(absolutePath, "utf-8");
       const lines = content.split(`
 `);
       const start = Math.max(0, lineNumber - contextLines - 1);
@@ -135754,6 +135861,10 @@ var init_checkpoint_store_pg = __esm(() => {
 });
 
 // ../../packages/core/dist/services/checkpoint/checkpoint-manager.js
+var exports_checkpoint_manager = {};
+__export(exports_checkpoint_manager, {
+  CheckpointManager: () => CheckpointManager
+});
 var CheckpointManager;
 var init_checkpoint_manager = __esm(() => {
   init_config();
@@ -136882,7 +136993,7 @@ var init_session_pin_store = __esm(() => {
 });
 
 // ../../packages/core/dist/services/hooks/attribution-resolver.js
-import fs12 from "fs";
+import fs13 from "fs";
 import os6 from "os";
 import path24 from "path";
 
@@ -136909,9 +137020,7 @@ class PgWorkspaceRootProvider {
       this.cache = { roots, expiresAt: this.now() + PROVIDER_TTL_MS };
       return roots;
     } catch (error51) {
-      logger.warn("[hook-attribution] workspace roots lookup failed; containment disabled (sanitized)", {
-        name: error51 instanceof Error ? error51.name : "unknown"
-      });
+      logger.warn("[hook-attribution] workspace roots lookup failed; containment disabled", safeErrorSummary(error51));
       return [];
     } finally {
       if (timer)
@@ -137020,7 +137129,7 @@ class AttributionResolver {
 }
 function defaultCanonicalize(cwd) {
   try {
-    return fs12.realpathSync(cwd);
+    return fs13.realpathSync(cwd);
   } catch {
     try {
       return path24.resolve(cwd);
@@ -137039,75 +137148,10 @@ var init_attribution_resolver = __esm(() => {
   init_dist();
   init_db_connection();
   init_alias_resolver();
+  init_safe_error_summary();
   init_session_pin_store();
 });
 
-// ../../packages/core/dist/kernel/sanitize/credential-scrub.js
-function markerFor(id) {
-  return `[REDACTED:${id}]`;
-}
-function fullMatchRule(id, pattern) {
-  const marker26 = markerFor(id);
-  return {
-    id,
-    replace(text3) {
-      let count = 0;
-      const replaced = text3.replace(pattern, () => {
-        count++;
-        return marker26;
-      });
-      return { text: replaced, count };
-    }
-  };
-}
-function scrubCredentials(payloadJson) {
-  const redactions = {};
-  for (const id of RULE_IDS)
-    redactions[id] = 0;
-  let text3 = payloadJson;
-  for (const rule of RULES) {
-    const { text: next, count } = rule.replace(text3);
-    text3 = next;
-    redactions[rule.id] += count;
-  }
-  const total = Object.values(redactions).reduce((sum, n) => sum + n, 0);
-  return {
-    sanitized: text3,
-    redactions,
-    total
-  };
-}
-var PEM_PATTERN, JWT_PATTERN, AWS_KEY_PATTERN, SK_KEY_PATTERN, GITHUB_TOKEN_PATTERN, SLACK_TOKEN_PATTERN, BEARER_PATTERN, RULES, RULE_IDS;
-var init_credential_scrub = __esm(() => {
-  PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
-  JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
-  AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
-  SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
-  GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
-  SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
-  BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
-  RULES = [
-    fullMatchRule("pem", PEM_PATTERN),
-    fullMatchRule("jwt", JWT_PATTERN),
-    fullMatchRule("aws-key", AWS_KEY_PATTERN),
-    fullMatchRule("sk-key", SK_KEY_PATTERN),
-    fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
-    fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
-    {
-      id: "bearer",
-      replace(text3) {
-        let count = 0;
-        const replaced = text3.replace(BEARER_PATTERN, (_m, prefix) => {
-          count++;
-          return `${prefix}${markerFor("bearer")}`;
-        });
-        return { text: replaced, count };
-      }
-    }
-  ];
-  RULE_IDS = RULES.map((r) => r.id);
-});
-
 // ../../packages/core/dist/tools/compact_snapshot.js
 class CompactSnapshotTool {
   name = "compact_snapshot";
@@ -138693,7 +138737,7 @@ var init_get_architecture = __esm(() => {
 });
 
 // ../../packages/core/dist/services/file-read/file-content-cache.js
-import fs13 from "fs/promises";
+import fs14 from "fs/promises";
 
 class FileContentCache {
   extractMetadata;
@@ -138726,7 +138770,7 @@ class FileContentCache {
         metadata: cached2.metadata
       };
     }
-    const content = await fs13.readFile(filePath, "utf-8");
+    const content = await fs14.readFile(filePath, "utf-8");
     const metadata = await this.extractMetadata(content, filePath, options);
     evictOldest(this.fileCache, this.FILE_CACHE_MAX_ENTRIES - 1);
     this.fileCache.set(cacheKey, {
@@ -142151,7 +142195,7 @@ var init_l1_memory_cache = __esm(() => {
 });
 
 // ../../packages/core/dist/services/health/local-health-checker.js
-import fs14 from "fs/promises";
+import fs15 from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import path27 from "path";
 
@@ -142187,10 +142231,10 @@ class LocalHealthChecker {
     const start = Date.now();
     try {
       if (!existsSync3(this.dataDir))
-        await fs14.mkdir(this.dataDir, { recursive: true });
+        await fs15.mkdir(this.dataDir, { recursive: true });
       const probe2 = path27.join(this.dataDir, ".health-check-test");
-      await fs14.writeFile(probe2, "ok");
-      await fs14.unlink(probe2);
+      await fs15.writeFile(probe2, "ok");
+      await fs15.unlink(probe2);
       return { available: true, latency: Date.now() - start, details: { path: this.dataDir, writable: true } };
     } catch (error51) {
       return { available: false, latency: Date.now() - start, error: `Data directory error: ${error51.message}` };
@@ -144054,6 +144098,11 @@ function registerDefaultJobs(scheduler) {
     const projectId = job.payload?.projectId ?? "default";
     await observationConsolidationJob2.runOnce(projectId);
   });
+  scheduler.registerHandler("checkpoint-purge", async () => {
+    const { CheckpointManager: CheckpointManager2 } = await Promise.resolve().then(() => (init_checkpoint_manager(), exports_checkpoint_manager));
+    const count = CheckpointManager2.getInstance().purgeExpired();
+    logger.info("Scheduled checkpoint purge completed", { count });
+  });
   for (const rawDef of DEFAULT_SCHEDULED_JOBS) {
     const def = applySafeDefaults(rawDef);
     const enabled2 = envBool2(def.enableEnvVar, def.defaultEnabled);
@@ -144115,6 +144164,15 @@ var init_scheduler_defaults = __esm(() => {
       defaultEnabled: false,
       enableEnvVar: "MASSA_AI_SCHEDULER_OBSERVATION_BRIDGE_ENABLED",
       intervalEnvVar: "MASSA_AI_SCHEDULER_OBSERVATION_BRIDGE_INTERVAL_MS"
+    },
+    {
+      id: "scheduled-checkpoint-purge",
+      name: "Checkpoint Purge (clock)",
+      jobKind: "checkpoint-purge",
+      schedule: { type: "interval", intervalMs: ONE_HOUR },
+      defaultEnabled: false,
+      enableEnvVar: "MASSA_AI_SCHEDULER_CHECKPOINT_PURGE_ENABLED",
+      intervalEnvVar: "MASSA_AI_SCHEDULER_CHECKPOINT_PURGE_INTERVAL_MS"
     }
   ];
 });
@@ -144129,7 +144187,7 @@ var init_scheduler2 = __esm(() => {
 });
 
 // ../../packages/core/dist/services/pricing/models-dev-client.js
-import fs15 from "fs/promises";
+import fs16 from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import path28 from "path";
 function getModelsDevClient() {
@@ -144159,7 +144217,7 @@ var init_models_dev_client = __esm(() => {
         if (!existsSync4(cachePath)) {
           return null;
         }
-        const content = await fs15.readFile(cachePath, "utf-8");
+        const content = await fs16.readFile(cachePath, "utf-8");
         const data = JSON.parse(content);
         const age = Date.now() - data.timestamp;
         if (age > ModelsDevClient.LOCAL_CACHE_TTL) {
@@ -144187,13 +144245,13 @@ var init_models_dev_client = __esm(() => {
       const cachePath = this.getLocalCachePath();
       try {
         const dir = path28.dirname(cachePath);
-        await fs15.mkdir(dir, { recursive: true });
+        await fs16.mkdir(dir, { recursive: true });
         const data = {
           timestamp: Date.now(),
           version: "1.0.0",
           models: Object.fromEntries(models)
         };
-        await fs15.writeFile(cachePath, JSON.stringify(data), "utf-8");
+        await fs16.writeFile(cachePath, JSON.stringify(data), "utf-8");
         logger.debug("Saved pricing to local cache", {
           models: models.size,
           path: cachePath
@@ -144522,7 +144580,7 @@ var init_models_dev_client = __esm(() => {
       const cachePath = this.getLocalCachePath();
       try {
         if (existsSync4(cachePath)) {
-          await fs15.unlink(cachePath);
+          await fs16.unlink(cachePath);
           logger.debug("Local pricing cache file deleted");
         }
       } catch (error51) {
@@ -162529,6 +162587,7 @@ var init_services = __esm(() => {
   init_search_analytics_pg();
   init_index_manager();
   init_search_diagnostics();
+  init_safe_error_summary();
   init_memory_controller();
   init_llm_client();
   init_search_controller();
@@ -162966,7 +163025,7 @@ var init_hook_service = __esm(() => {
 
 // ../../packages/core/dist/services/bootstrap/bootstrap-service.js
 import { randomUUID as randomUUID9 } from "crypto";
-import fs16 from "fs";
+import fs17 from "fs";
 import path29 from "path";
 import { spawn as spawn2 } from "child_process";
 function readBootstrapConfig() {
@@ -163128,8 +163187,8 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   try {
     for (const name26 of README_CANDIDATES) {
       const p = path29.join(projectRoot, name26);
-      if (fs16.existsSync(p) && fs16.statSync(p).isFile()) {
-        const buf = fs16.readFileSync(p);
+      if (fs17.existsSync(p) && fs17.statSync(p).isFile()) {
+        const buf = fs17.readFileSync(p);
         signals.readme = buf.slice(0, MAX_README_BYTES).toString("utf8");
         break;
       }
@@ -163139,11 +163198,11 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   }
   try {
     const docsDir = path29.join(projectRoot, "docs");
-    if (fs16.existsSync(docsDir) && fs16.statSync(docsDir).isDirectory()) {
+    if (fs17.existsSync(docsDir) && fs17.statSync(docsDir).isDirectory()) {
       const entries = walkMarkdown(docsDir).slice(0, MAX_DOCS);
       for (const rel of entries) {
         try {
-          const buf = fs16.readFileSync(rel);
+          const buf = fs17.readFileSync(rel);
           signals.docs.push({
             path: path29.relative(projectRoot, rel),
             snippet: buf.slice(0, MAX_DOC_BYTES).toString("utf8")
@@ -163157,9 +163216,9 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   try {
     for (const name26 of MANIFEST_FILES) {
       const p = path29.join(projectRoot, name26);
-      if (!fs16.existsSync(p) || !fs16.statSync(p).isFile())
+      if (!fs17.existsSync(p) || !fs17.statSync(p).isFile())
         continue;
-      const raw2 = fs16.readFileSync(p).slice(0, MAX_MANIFEST_BYTES).toString("utf8");
+      const raw2 = fs17.readFileSync(p).slice(0, MAX_MANIFEST_BYTES).toString("utf8");
       const kind = name26;
       if (name26 === "package.json") {
         try {
@@ -163199,7 +163258,7 @@ function walkMarkdown(dir) {
     const cur = stack.pop();
     let entries;
     try {
-      entries = fs16.readdirSync(cur, { withFileTypes: true });
+      entries = fs17.readdirSync(cur, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -163934,6 +163993,7 @@ __export(exports_dist, {
   searchSessionHook: () => searchSessionHook,
   searchBackendUnavailable: () => searchBackendUnavailable,
   scanSignals: () => scanSignals,
+  safeErrorSummary: () => safeErrorSummary,
   runPool: () => runPool,
   ruleBasedSeed: () => ruleBasedSeed,
   resolveStructuralParseLanguage: () => resolveStructuralParseLanguage,
@@ -163957,6 +164017,7 @@ __export(exports_dist, {
   recordSearchFailure: () => recordSearchFailure,
   recordSearchDegradation: () => recordSearchDegradation,
   quoteDiscoveredIdentifier: () => quoteDiscoveredIdentifier,
+  projectNotIndexed: () => projectNotIndexed,
   payloadStorePolicies: () => payloadStorePolicies,
   parseStructuralFqn: () => parseStructuralFqn,
   parseProjectIdentityPreviewRequest: () => parseProjectIdentityPreviewRequest,
@@ -166614,7 +166675,7 @@ class StdioServerTransport {
 }
 
 // src/index.ts
-import fs19 from "fs/promises";
+import fs20 from "fs/promises";
 
 // src/api-client.ts
 init_config();
@@ -166724,7 +166785,7 @@ init_dist();
 init_dist();
 init_dist15();
 init_dist();
-import fs17 from "fs/promises";
+import fs18 from "fs/promises";
 import path30 from "path";
 var _indexProjectTool = null;
 function indexProjectTool() {
@@ -167009,7 +167070,7 @@ class EmbeddedApiClient {
           end = start + 20;
         }
         const absolutePath = path30.join(workspace.project_path, file2);
-        const content = await fs17.readFile(absolutePath, "utf-8");
+        const content = await fs18.readFile(absolutePath, "utf-8");
         const lines = content.split(/\r?\n/);
         const slice = lines.slice(start - 1, Math.min(lines.length, end));
         const formatted = slice.map((text3, idx) => ({ lineNumber: start + idx, content: text3 }));
@@ -167248,8 +167309,8 @@ class EmbeddedApiClient {
     const finalProjectId = rawBase.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 128);
     const uploadRoot = process.env.MASSA_AI_UPLOAD_DIR || path30.join(getGlobalDataDir(), "uploads");
     const stagingDir = path30.resolve(uploadRoot, finalProjectId);
-    await fs17.rm(stagingDir, { recursive: true, force: true });
-    await fs17.mkdir(stagingDir, { recursive: true });
+    await fs18.rm(stagingDir, { recursive: true, force: true });
+    await fs18.mkdir(stagingDir, { recursive: true });
     const WRITE_BATCH = 20;
     for (let i = 0;i < params.files.length; i += WRITE_BATCH) {
       await Promise.all(params.files.slice(i, i + WRITE_BATCH).map(async (file2) => {
@@ -167260,8 +167321,8 @@ class EmbeddedApiClient {
         if (!dest.startsWith(stagingDir + path30.sep)) {
           throw new Error(`Path escapes staging directory: ${file2.relativePath}`);
         }
-        await fs17.mkdir(path30.dirname(dest), { recursive: true });
-        await fs17.writeFile(dest, file2.content, "utf-8");
+        await fs18.mkdir(path30.dirname(dest), { recursive: true });
+        await fs18.writeFile(dest, file2.content, "utf-8");
       }));
     }
     return await indexProjectTool().handle({
@@ -167605,7 +167666,7 @@ class EmbeddedApiClient {
 
 // src/file-collector.ts
 init_config();
-import fs18 from "fs/promises";
+import fs19 from "fs/promises";
 import path31 from "path";
 var SKIP_DIRS = new Set([
   "node_modules",
@@ -167647,7 +167708,7 @@ async function walk2(root2, dir, files, state, allowed) {
     return;
   let entries;
   try {
-    entries = await fs18.readdir(dir, { withFileTypes: true });
+    entries = await fs19.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -167664,12 +167725,12 @@ async function walk2(root2, dir, files, state, allowed) {
         continue;
       const fullPath = path31.join(dir, entry2.name);
       try {
-        const stat = await fs18.stat(fullPath);
+        const stat = await fs19.stat(fullPath);
         if (stat.size > MAX_FILE_BYTES)
           continue;
         if (state.totalBytes + stat.size > MAX_TOTAL_BYTES)
           continue;
-        const content = await fs18.readFile(fullPath, "utf-8");
+        const content = await fs19.readFile(fullPath, "utf-8");
         state.totalBytes += stat.size;
         const relativePath = path31.relative(root2, fullPath).split(path31.sep).join("/");
         files.push({ relativePath, content });
@@ -169572,7 +169633,7 @@ class McpProxyServer {
       return textContent(JSON.stringify({ success: false, error: "projectPath is required" }));
     }
     try {
-      if (!(await fs19.stat(projectPath2)).isDirectory()) {
+      if (!(await fs20.stat(projectPath2)).isDirectory()) {
         return textContent(JSON.stringify({ success: false, error: `${projectPath2} is not a directory` }));
       }
     } catch {