@merittdev/horus 0.1.18 → 0.1.20

package/dist/index.cjs

@@ -50314,7 +50314,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.1.18" : "dev";
+var HORUS_VERSION = true ? "0.1.20" : "dev";
 var PINNED_AXON_VERSION = "1.0.7";
 var PINNED_SOURCE_VERSION = PINNED_AXON_VERSION;
 
@@ -55776,6 +55776,16 @@ function buildLevelFilter(m, minLevel) {
   );
   return { terms: { [m.levelField]: stringLevels } };
 }
+function buildTextMust(q, mapping = MERITT_FIELD_MAPPING) {
+  if (q.text === void 0) return [{ match_all: {} }];
+  if (q.broadText === true) {
+    const fields = [mapping.messageField];
+    if (mapping.messageFallbackField !== void 0) fields.push(mapping.messageFallbackField);
+    fields.push("detail", "context.*");
+    return [{ multi_match: { query: q.text, fields, type: "phrase", lenient: true } }];
+  }
+  return [{ match: { [mapping.messageField]: q.text } }];
+}
 function buildSearchBody(q, mapping = MERITT_FIELD_MAPPING) {
   const filters = [];
   if (q.level !== void 0) {
@@ -55790,7 +55800,7 @@ function buildSearchBody(q, mapping = MERITT_FIELD_MAPPING) {
   if (q.service !== void 0) {
     filters.push({ term: { [serviceTermField(mapping)]: q.service } });
   }
-  const mustClause = q.text !== void 0 ? [{ match: { [mapping.messageField]: q.text } }] : [{ match_all: {} }];
+  const mustClause = buildTextMust(q, mapping);
   return {
     query: {
       bool: {
@@ -55815,12 +55825,16 @@ function buildErrorAggBody(q, field, mapping = MERITT_FIELD_MAPPING) {
   if (q.service !== void 0) {
     filters.push({ term: { [serviceTermField(mapping)]: q.service } });
   }
+  if (q.eventCode !== void 0) {
+    filters.push({ term: { [signatureTermField(mapping)]: q.eventCode } });
+  }
   const aggField = field === mapping.eventCodeField ? signatureTermField(mapping) : `${field}.keyword`;
   return {
     size: 0,
     query: {
       bool: {
-        filter: filters
+        filter: filters,
+        must: buildTextMust(q, mapping)
       }
     },
     aggs: {
@@ -55886,10 +55900,10 @@ function normalizeHit(hit, mapping = MERITT_FIELD_MAPPING) {
     if (typeof raw === "string") traceId = raw;
   }
   if (traceId === void 0) {
-    const ctxRaw = src["context"];
-    if (typeof ctxRaw === "string") {
+    const ctxRaw2 = src["context"];
+    if (typeof ctxRaw2 === "string") {
       try {
-        const parsed = JSON.parse(ctxRaw);
+        const parsed = JSON.parse(ctxRaw2);
         const tid = parsed["traceId"] ?? parsed["trace_id"];
         if (typeof tid === "string") traceId = tid;
       } catch {
@@ -55902,6 +55916,21 @@ function normalizeHit(hit, mapping = MERITT_FIELD_MAPPING) {
     if (typeof raw === "string") requestId = raw;
   }
   const host = typeof src["hostname"] === "string" ? src["hostname"] : typeof src["host_name"] === "string" ? src["host_name"] : void 0;
+  let context;
+  const ctxRaw = src["context"];
+  if (ctxRaw !== null && typeof ctxRaw === "object" && !Array.isArray(ctxRaw)) {
+    context = ctxRaw;
+  } else if (typeof ctxRaw === "string") {
+    try {
+      const parsed = JSON.parse(ctxRaw);
+      if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+        context = parsed;
+      }
+    } catch {
+    }
+  }
+  const detailRaw = getField(src, "detail");
+  const detail = typeof detailRaw === "string" ? detailRaw : detailRaw !== null && typeof detailRaw === "object" ? safeStringify(detailRaw) : void 0;
   const index2 = typeof h["_index"] === "string" ? h["_index"] : "";
   return {
     timestamp: timestamp2,
@@ -55914,10 +55943,45 @@ function normalizeHit(hit, mapping = MERITT_FIELD_MAPPING) {
     traceId,
     requestId,
     host,
+    ...context !== void 0 ? { context } : {},
+    ...detail !== void 0 ? { detail } : {},
     index: index2,
     raw: src
   };
 }
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function displayValue(v) {
+  if (v === null || v === void 0) return void 0;
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean") return String(v);
+  return safeStringify(v);
+}
+function extractContextFields(record, limit = 16) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (key, raw) => {
+    if (out.length >= limit || seen.has(key)) return;
+    const value = displayValue(raw);
+    if (value === void 0 || value.trim() === "") return;
+    seen.add(key);
+    out.push({ key, value });
+  };
+  if (record.eventCode !== void 0) push("code", record.eventCode);
+  if (record.context !== void 0) {
+    for (const [k, v] of Object.entries(record.context)) {
+      if (k === "traceId" || k === "trace_id") continue;
+      push(k, v);
+    }
+  }
+  if (record.detail !== void 0) push("detail", record.detail);
+  return out;
+}
 function hitsToRecords(searchResponse, mapping = MERITT_FIELD_MAPPING) {
   const res = searchResponse;
   const hits = res["hits"];
@@ -55989,7 +56053,7 @@ function buildErrorAnalysisBody(q, field = "event_code", mapping = MERITT_FIELD_
   if (q.service !== void 0) {
     filters.push({ term: { [serviceTermField(mapping)]: q.service } });
   }
-  const mustClause = q.text !== void 0 ? [{ match: { [mapping.messageField]: q.text } }] : [{ match_all: {} }];
+  const mustClause = buildTextMust(q, mapping);
   const svcTerm = serviceTermField(mapping);
   const sigTerm = field === mapping.eventCodeField ? signatureTermField(mapping) : `${field}.keyword`;
   return {
@@ -56006,7 +56070,7 @@ function buildErrorAnalysisBody(q, field = "event_code", mapping = MERITT_FIELD_
           sample: {
             top_hits: {
               size: 1,
-              _source: [mapping.messageField, "component", "log_logger"],
+              _source: [mapping.messageField, "component", "log_logger", "context", "detail"],
               sort: [{ [mapping.timestampField]: { order: "desc" } }]
             }
           }
@@ -56035,6 +56099,8 @@ function parseErrorAnalysis(resp, window2, messageField = "message") {
     const sampleSrc = sampleArr[0]?.["_source"] ?? {};
     const rawMsg = getField(sampleSrc, messageField);
     const sampleMessage = typeof rawMsg === "string" ? rawMsg : typeof sampleSrc["message"] === "string" ? sampleSrc["message"] : void 0;
+    const ctx = sampleSrc["context"];
+    const sampleContext = ctx !== null && typeof ctx === "object" && !Array.isArray(ctx) ? ctx : void 0;
     return {
       key: String(b2["key"] ?? "") || "(none)",
       count: typeof b2["doc_count"] === "number" ? b2["doc_count"] : 0,
@@ -56042,7 +56108,8 @@ function parseErrorAnalysis(resp, window2, messageField = "message") {
       lastSeen: typeof last === "string" ? last : "",
       services,
       sampleMessage,
-      sampleComponent: typeof sampleSrc["component"] === "string" ? sampleSrc["component"] : typeof sampleSrc["log_logger"] === "string" ? sampleSrc["log_logger"] : void 0
+      sampleComponent: typeof sampleSrc["component"] === "string" ? sampleSrc["component"] : typeof sampleSrc["log_logger"] === "string" ? sampleSrc["log_logger"] : void 0,
+      ...sampleContext !== void 0 ? { sampleContext } : {}
     };
   });
   const affectedServices = bucketsOf(aggs["affected_services"]).map(
@@ -57299,6 +57366,10 @@ var STARVATION_MIN = 10;
 var OLD_JOB_WARN_MS = 5 * 6e4;
 var OLD_JOB_HIGH_MS = 60 * 6e4;
 var BREAKDOWN_PCT_THRESHOLD = 30;
+var STALE_FAILED_MS = 60 * 6e4;
+function isStaleFailure(ageMs) {
+  return ageMs !== void 0 && ageMs > STALE_FAILED_MS;
+}
 function fmtMs(ms) {
   if (ms >= 864e5) return `${Math.floor(ms / 864e5)}d`;
   if (ms >= 36e5) return `${Math.floor(ms / 36e5)}h`;
@@ -57344,12 +57415,20 @@ function analyzeQueueSignals(q) {
   }
   if (q.failed > FAILED_WARN) {
     const severe = q.failed > 100;
+    const stale = isStaleFailure(q.newestFailedAgeMs);
+    const ageStr = q.newestFailedAgeMs !== void 0 ? ` (most recent ${fmtMs(q.newestFailedAgeMs)} ago${stale ? ", STALE" : ""})` : "";
     signals.push({
       queueName: q.queueName,
       kind: "failed-spike",
-      title: `${q.queueName}: ${q.failed} failed jobs${severe ? " (severe)" : ""}`,
-      relevance: severe ? 0.85 : 0.75,
-      payload: { queueName: q.queueName, failed: q.failed }
+      title: `${q.queueName}: ${q.failed} failed jobs${severe ? " (severe)" : ""}${ageStr}`,
+      // A purely stale failure pile is less likely to be the live incident — hedge.
+      relevance: stale ? 0.5 : severe ? 0.85 : 0.75,
+      payload: {
+        queueName: q.queueName,
+        failed: q.failed,
+        newestFailedAgeMs: q.newestFailedAgeMs ?? null,
+        stale
+      }
     });
   }
   if (q.delayed > DELAYED_WARN) {
@@ -57366,17 +57445,22 @@ function analyzeQueueSignals(q) {
     const sampleTotal = q.failedBreakdown.reduce((sum, b2) => sum + b2.count, 0);
     const pct = Math.round(top.count / Math.max(sampleTotal, 1) * 100);
     if (pct >= BREAKDOWN_PCT_THRESHOLD) {
+      const stale = isStaleFailure(top.lastFailedAgeMs);
+      const ageStr = top.lastFailedAgeMs !== void 0 ? `, last failed ${fmtMs(top.lastFailedAgeMs)} ago${stale ? " [STALE]" : ""}` : "";
       signals.push({
         queueName: q.queueName,
         kind: "failed-breakdown",
-        title: `${q.queueName}: ${pct}% of recently sampled failures (${top.count}/${sampleTotal} sampled) are "${top.reason}"`,
-        relevance: 0.82,
+        title: `${q.queueName}: ${pct}% of recently sampled failures (${top.count}/${sampleTotal} sampled) are "${top.reason}"${ageStr}`,
+        // Demote a stale-only breakdown so a days-old error isn't read as live (HOR-217).
+        relevance: stale ? 0.5 : 0.82,
         payload: {
           queueName: q.queueName,
           topReason: top.reason,
           topCount: top.count,
           topPct: pct,
           totalFailed: q.failed,
+          topLastFailedAgeMs: top.lastFailedAgeMs ?? null,
+          topStale: stale,
           breakdown: q.failedBreakdown.slice(0, 3)
         }
       });
@@ -57482,14 +57566,34 @@ var BullMQRuntimeProvider = class {
         this.client.queueKey(name, "failed"),
         FAILED_SAMPLE
       );
-      const reasons = await this.client.pipelineHget(name, failedJobIds, "failedReason");
+      const [reasons, finished] = await Promise.all([
+        this.client.pipelineHget(name, failedJobIds, "failedReason"),
+        this.client.pipelineHget(name, failedJobIds, "finishedOn")
+      ]);
+      const now = Date.now();
       const byReason = /* @__PURE__ */ new Map();
-      for (const r of reasons) {
-        if (r === null || r === "") continue;
+      let newestFinishedOverall = 0;
+      for (let i = 0; i < failedJobIds.length; i++) {
+        const r = reasons[i];
+        if (r === null || r === void 0 || r === "") continue;
         const key = r.split("\n")[0].trim().slice(0, 120);
-        byReason.set(key, (byReason.get(key) ?? 0) + 1);
+        const finRaw = finished[i];
+        const fin = finRaw !== null && finRaw !== void 0 ? Number(finRaw) : NaN;
+        const hasFin = Number.isFinite(fin) && fin > 0;
+        const entry2 = byReason.get(key) ?? { count: 0, newestFinished: 0 };
+        entry2.count += 1;
+        if (hasFin && fin > entry2.newestFinished) entry2.newestFinished = fin;
+        byReason.set(key, entry2);
+        if (hasFin && fin > newestFinishedOverall) newestFinishedOverall = fin;
+      }
+      counts.failedBreakdown = [...byReason.entries()].map(([reason, v]) => ({
+        reason,
+        count: v.count,
+        ...v.newestFinished > 0 ? { lastFailedAgeMs: Math.max(0, now - v.newestFinished) } : {}
+      })).sort((a, b2) => b2.count - a.count);
+      if (newestFinishedOverall > 0) {
+        counts.newestFailedAgeMs = Math.max(0, now - newestFinishedOverall);
       }
-      counts.failedBreakdown = [...byReason.entries()].map(([reason, count]) => ({ reason, count })).sort((a, b2) => b2.count - a.count);
     }
     return counts;
   }
@@ -59087,7 +59191,7 @@ function sql(strings, ...params) {
     return new SQL([new StringChunk(str)]);
   }
   sql2.raw = raw;
-  function join7(chunks, separator) {
+  function join8(chunks, separator) {
     const result = [];
     for (const [i, chunk] of chunks.entries()) {
       if (i > 0 && separator !== void 0) {
@@ -59097,7 +59201,7 @@ function sql(strings, ...params) {
     }
     return new SQL(result);
   }
-  sql2.join = join7;
+  sql2.join = join8;
   function identifier(value) {
     return new Name(value);
   }
@@ -62688,7 +62792,7 @@ var PgSelectQueryBuilderBase = class extends TypedQueryBuilder {
     return (table, on) => {
       const baseTableName = this.tableName;
       const tableName = getTableLikeName(table);
-      if (typeof tableName === "string" && this.config.joins?.some((join7) => join7.alias === tableName)) {
+      if (typeof tableName === "string" && this.config.joins?.some((join8) => join8.alias === tableName)) {
         throw new Error(`Alias "${tableName}" is already used in this query`);
       }
       if (!this.isPartialSelect) {
@@ -63700,7 +63804,7 @@ var PgUpdateBase = class extends QueryPromise {
   createJoin(joinType) {
     return (table, on) => {
       const tableName = getTableLikeName(table);
-      if (typeof tableName === "string" && this.config.joins.some((join7) => join7.alias === tableName)) {
+      if (typeof tableName === "string" && this.config.joins.some((join8) => join8.alias === tableName)) {
         throw new Error(`Alias "${tableName}" is already used in this query`);
       }
       if (typeof on === "function") {
@@ -63796,10 +63900,10 @@ var PgUpdateBase = class extends QueryPromise {
           const fromFields = this.getTableLikeFields(this.config.from);
           fields[tableName] = fromFields;
         }
-        for (const join7 of this.config.joins) {
-          const tableName2 = getTableLikeName(join7.table);
-          if (typeof tableName2 === "string" && !is(join7.table, SQL)) {
-            const fromFields = this.getTableLikeFields(join7.table);
+        for (const join8 of this.config.joins) {
+          const tableName2 = getTableLikeName(join8.table);
+          if (typeof tableName2 === "string" && !is(join8.table, SQL)) {
+            const fromFields = this.getTableLikeFields(join8.table);
             fields[tableName2] = fromFields;
           }
         }
@@ -69850,6 +69954,53 @@ function classifyLogRelevance(sigKey, sigServices, seedTerms, inputService) {
     relevanceReason: "no structural link to seed \u2014 ambient runtime noise"
   };
 }
+function detectEntityFields(context, limit = 2) {
+  if (context === void 0) return [];
+  const out = [];
+  for (const [k, v] of Object.entries(context)) {
+    if (v === null || typeof v !== "string" && typeof v !== "number") continue;
+    const looksLikeId = /(^|_)ids?$/i.test(k) || /id$/.test(k) || /^(brand|order|user|customer|account|tenant|shop|merchant|product|seller)/i.test(k);
+    if (looksLikeId) {
+      out.push(k);
+      if (out.length >= limit) break;
+    }
+  }
+  return out;
+}
+async function reseedFromLogs(hint, input, deps) {
+  if (!deps.logs || typeof deps.logs.searchLogs !== "function") return null;
+  try {
+    const from = logWindowFrom(input.since);
+    const records = await deps.logs.searchLogs({
+      text: hint,
+      broadText: true,
+      from,
+      limit: 5,
+      service: input.service
+    });
+    if (records.length === 0) return null;
+    const candidates = [...new Set(records.map((r) => r.component).filter((c) => !!c))];
+    for (const name of candidates) {
+      const syms = await deps.code.searchSymbols(name, 5);
+      if (syms.length > 0) {
+        const rankedSeeds = rankSeeds(syms, [...new Set(tokenize(name))]);
+        const first = records[0];
+        const componentLabel = first?.component ?? "log entry";
+        const codeLabel = first?.eventCode ? ` (${first.eventCode})` : "";
+        const seedName = rankedSeeds[0]?.symbol.name ?? name;
+        return {
+          seeds: rankedSeeds.map((r) => r.symbol),
+          note: `Hint matched no symbol; resolved via logs: ${componentLabel}${codeLabel} \u2192 ${seedName}`,
+          ...first?.component !== void 0 ? { component: first.component } : {},
+          ...first?.eventCode !== void 0 ? { eventCode: first.eventCode } : {}
+        };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 function queueFindingConfidence(opts) {
   const { starvedCount, backloggedCount, failingCount } = opts;
   return starvedCount > 0 && backloggedCount === 0 && failingCount === 0 ? 0.65 : 0.85;
@@ -69884,8 +70035,16 @@ async function investigate(input, deps) {
   const rawSeeds = await code.searchSymbols(hint, 5);
   const hintTokens = [...new Set(tokenize(hint))];
   const ranked = rankSeeds(rawSeeds, hintTokens);
-  const seeds = ranked.map((r) => r.symbol);
-  const top = seeds[0];
+  let seeds = ranked.map((r) => r.symbol);
+  let top = seeds[0];
+  let logReseed = null;
+  if (!top) {
+    logReseed = await reseedFromLogs(hint, input, deps);
+    if (logReseed !== null) {
+      seeds = logReseed.seeds;
+      top = seeds[0];
+    }
+  }
   if (!top) {
     const report2 = {
       id: globalThis.crypto.randomUUID(),
@@ -69903,7 +70062,7 @@ async function investigate(input, deps) {
       graph: { nodes: [], edges: [] },
       confidence: 0,
       nextActions: [
-        `No symbols matched "${hint}". Try a more specific hint \u2014 an exact function, class, or file name.`
+        deps.logs != null ? `No symbols matched "${hint}", and no recent error log matched it either. Try a more specific hint \u2014 an exact function, class, or file name \u2014 or widen --since.` : `No symbols matched "${hint}". Try a more specific hint \u2014 an exact function, class, or file name.`
       ]
     };
     const persistedId2 = await persist(db, input, report2);
@@ -70013,6 +70172,8 @@ async function investigate(input, deps) {
   const logEvIds = [];
   const directLogEvIds = [];
   const ambientLogEvIds = [];
+  const entityEvIds = [];
+  const entitySummaries = [];
   let logsCollected = false;
   let logsCompatibilityError;
   if (deps.logs) {
@@ -70078,6 +70239,49 @@ async function investigate(input, deps) {
           if (relevanceClass === "direct") directLogEvIds.push(ev.id);
           else ambientLogEvIds.push(ev.id);
         }
+        if (typeof deps.logs.aggregateErrors === "function") {
+          const sigForEntities = analysis.signatures.find(
+            (s) => detectEntityFields(s.sampleContext).length > 0
+          );
+          if (sigForEntities !== void 0) {
+            for (const f of detectEntityFields(sigForEntities.sampleContext)) {
+              try {
+                const buckets = await deps.logs.aggregateErrors(
+                  {
+                    service: input.service,
+                    from,
+                    eventCode: sigForEntities.key !== "(none)" ? sigForEntities.key : void 0
+                  },
+                  `context.${f}`
+                );
+                if (buckets.length > 0) {
+                  const top3 = buckets.slice(0, 3).map((b2) => `${b2.key} (${b2.count}x)`).join(", ");
+                  const plus = buckets.length >= 20 ? "+" : "";
+                  const ev = mkEv(
+                    "log",
+                    `Distinct context.${f} for ${sigForEntities.key}: ${buckets.length}${plus} value(s) (top: ${top3})`.slice(
+                      0,
+                      180
+                    ),
+                    {
+                      field: `context.${f}`,
+                      signature: sigForEntities.key,
+                      distinctShown: buckets.length,
+                      capped: buckets.length >= 20,
+                      top: buckets.slice(0, 10)
+                    },
+                    {},
+                    void 0,
+                    0.6
+                  );
+                  entityEvIds.push(ev.id);
+                  entitySummaries.push(`${buckets.length}${plus} ${f}`);
+                }
+              } catch {
+              }
+            }
+          }
+        }
       }
     } catch {
       analysis = null;
@@ -70273,6 +70477,15 @@ async function investigate(input, deps) {
     confidence: 1,
     evidenceIds: [seedEv.id]
   });
+  if (logReseed !== null) {
+    findings2.push({
+      kind: "observation",
+      title: logReseed.note,
+      detail: "Seed was resolved by matching the hint against recent logs, not source search.",
+      confidence: 0.6,
+      evidenceIds: [seedEv.id]
+    });
+  }
   if (ranked.length > 1) {
     const candidates = ranked.slice(0, 4).map((r) => `${r.symbol.name} [${r.role}]`).join(", ");
     findings2.push({
@@ -70359,6 +70572,14 @@ async function investigate(input, deps) {
       });
     }
   }
+  if (entityEvIds.length > 0) {
+    findings2.push({
+      kind: "observation",
+      title: `Distinct failing entities: ${entitySummaries.join(" \xD7 ")}`,
+      confidence: 0.6,
+      evidenceIds: entityEvIds
+    });
+  }
   if (stateAnalysis !== null && stateEvIds.length > 0) {
     findings2.push({
       kind: "anomaly",
@@ -72938,22 +73159,22 @@ function extractQueueGraph(input) {
     }
   }
   const producers = [];
-  for (const pc37 of input.producerClasses) {
-    for (const m of pc37.content.matchAll(INJECT_QUEUE_RE)) {
+  for (const pc41 of input.producerClasses) {
+    for (const m of pc41.content.matchAll(INJECT_QUEUE_RE)) {
       const queue = m[1] ?? "";
-      if (queue) producers.push({ queue, symbol: pc37.name, file: pc37.filePath });
+      if (queue) producers.push({ queue, symbol: pc41.name, file: pc41.filePath });
     }
-    for (const m of pc37.content.matchAll(NEW_BULL_RE)) {
+    for (const m of pc41.content.matchAll(NEW_BULL_RE)) {
       if (m[2] !== "Queue") continue;
       const queue = resolveArg(m[3] ?? "", constMap);
       if (queue) {
-        producers.push({ queue, symbol: (m[1] ?? pc37.name) || baseName(pc37.filePath), file: pc37.filePath });
+        producers.push({ queue, symbol: (m[1] ?? pc41.name) || baseName(pc41.filePath), file: pc41.filePath });
       }
     }
-    for (const m of pc37.content.matchAll(QUEUE_NAME_CONST_RE)) {
+    for (const m of pc41.content.matchAll(QUEUE_NAME_CONST_RE)) {
       const ident = m[1] ?? "";
       const queue = m[2] ?? "";
-      if (queue) producers.push({ queue, symbol: ident || baseName(pc37.filePath), file: pc37.filePath });
+      if (queue) producers.push({ queue, symbol: ident || baseName(pc41.filePath), file: pc41.filePath });
     }
   }
   const workers = [];
@@ -74120,9 +74341,19 @@ function printLiveTable(queues, staticNames = /* @__PURE__ */ new Set()) {
       const age = formatAge(q.oldestWaitingMs);
       console.log(import_picocolors4.default.dim(`    oldest waiting: ${age}`));
     }
+    if (q.newestFailedAgeMs !== void 0) {
+      const stale = q.newestFailedAgeMs > 36e5;
+      const ageLine = `    most recent failure: ${formatAge(q.newestFailedAgeMs)} ago`;
+      console.log(stale ? import_picocolors4.default.yellow(`${ageLine} [STALE]`) : import_picocolors4.default.dim(ageLine));
+    }
     if (q.failedBreakdown && q.failedBreakdown.length > 0) {
-      for (const { reason, count } of q.failedBreakdown.slice(0, 3)) {
-        console.log(import_picocolors4.default.red(`    \u2717 [${count}x] ${reason}`));
+      for (const fb of q.failedBreakdown.slice(0, 3)) {
+        let suffix = "";
+        if (fb.lastFailedAgeMs !== void 0) {
+          const stale = fb.lastFailedAgeMs > 36e5;
+          suffix = import_picocolors4.default.dim(` (last ${formatAge(fb.lastFailedAgeMs)} ago)`) + (stale ? import_picocolors4.default.yellow(" [STALE]") : "");
+        }
+        console.log(import_picocolors4.default.red(`    \u2717 [${fb.count}x] ${fb.reason}`) + suffix);
       }
     }
   }
@@ -74137,7 +74368,480 @@ function formatAge(ms) {
 
 // ../../packages/cli/src/commands/investigate.ts
 init_cjs_shims();
+var import_picocolors6 = __toESM(require_picocolors(), 1);
+
+// ../../packages/cli/src/lib/cloud/context-store.ts
+init_cjs_shims();
+var import_node_fs6 = require("fs");
+var import_node_path8 = require("path");
+
+// ../../packages/cli/src/lib/cloud/paths.ts
+init_cjs_shims();
+var import_node_path7 = require("path");
+var import_node_os2 = require("os");
+var CLOUD_CONFIG_FILE = "cloud.json";
+var AUTH_FILE = "auth.json";
+function cloudConfigPath(root) {
+  return (0, import_node_path7.join)(root, HORUS_DIR, CLOUD_CONFIG_FILE);
+}
+function horusHome() {
+  return process.env.HORUS_HOME ?? (0, import_node_path7.join)((0, import_node_os2.homedir)(), HORUS_DIR);
+}
+function authPath() {
+  return (0, import_node_path7.join)(horusHome(), AUTH_FILE);
+}
+
+// ../../packages/cli/src/lib/cloud/context-store.ts
+function readCloudConfig(root) {
+  const p = cloudConfigPath(root);
+  if (!(0, import_node_fs6.existsSync)(p)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(p, "utf8"));
+    if (parsed.context !== "local" && parsed.context !== "cloud") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeCloudConfig(root, cfg) {
+  const p = cloudConfigPath(root);
+  (0, import_node_fs6.mkdirSync)((0, import_node_path8.dirname)(p), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(p, JSON.stringify(cfg, null, 2) + "\n");
+}
+function clearCloudConfig(root) {
+  const p = cloudConfigPath(root);
+  if ((0, import_node_fs6.existsSync)(p)) (0, import_node_fs6.rmSync)(p);
+}
+function isCloudActive(cfg) {
+  return !!cfg && cfg.context === "cloud" && !!cfg.project;
+}
+
+// ../../packages/cli/src/lib/cloud/session.ts
+init_cjs_shims();
+
+// ../../packages/cli/src/lib/cloud/api.ts
+init_cjs_shims();
+var DEFAULT_API_BASE_URL = "https://api.horus.dev";
+var CloudError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "CloudError";
+  }
+  status;
+  code;
+};
+var CloudOfflineError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CloudOfflineError";
+  }
+};
+var CloudClient = class {
+  constructor(baseUrl, token) {
+    this.baseUrl = baseUrl;
+    this.token = token;
+  }
+  baseUrl;
+  token;
+  async request(method, path, body) {
+    const headers = {};
+    if (this.token) headers.authorization = `Bearer ${this.token}`;
+    if (body !== void 0) headers["content-type"] = "application/json";
+    let res;
+    try {
+      res = await fetch(`${this.baseUrl.replace(/\/$/, "")}${path}`, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body) : void 0
+      });
+    } catch (err) {
+      throw new CloudOfflineError(
+        `Cannot reach Horus Cloud at ${this.baseUrl} (${err.message}).`
+      );
+    }
+    if (res.status === 204) return void 0;
+    const text2 = await res.text();
+    const json2 = text2 ? JSON.parse(text2) : void 0;
+    if (!res.ok) {
+      const envelope = json2;
+      throw new CloudError(
+        res.status,
+        envelope?.error?.code ?? "http_error",
+        envelope?.error?.message ?? `Request failed (${res.status}).`
+      );
+    }
+    return json2;
+  }
+  me() {
+    return this.request("GET", "/v1/me");
+  }
+  context() {
+    return this.request("GET", "/v1/context");
+  }
+  listTokens() {
+    return this.request("GET", "/v1/cli/tokens");
+  }
+  revokeToken(id) {
+    return this.request("DELETE", `/v1/cli/tokens/${id}`);
+  }
+  createInvestigation(projectId, body) {
+    return this.request("POST", `/v1/projects/${projectId}/investigations`, body);
+  }
+  listInvestigations(projectId) {
+    return this.request(
+      "GET",
+      `/v1/projects/${projectId}/investigations`
+    );
+  }
+  getInvestigation(projectId, investigationId) {
+    return this.request(
+      "GET",
+      `/v1/projects/${projectId}/investigations/${investigationId}`
+    );
+  }
+  updateInvestigation(projectId, investigationId, body) {
+    return this.request(
+      "PATCH",
+      `/v1/projects/${projectId}/investigations/${investigationId}`,
+      body
+    );
+  }
+  addInvestigationRepositories(projectId, investigationId, repositoryIds) {
+    return this.request(
+      "POST",
+      `/v1/projects/${projectId}/investigations/${investigationId}/repositories`,
+      { repositoryIds }
+    );
+  }
+  createEvidence(projectId, investigationId, body) {
+    return this.request(
+      "POST",
+      `/v1/projects/${projectId}/investigations/${investigationId}/evidence`,
+      body
+    );
+  }
+  listEvidence(projectId, investigationId) {
+    return this.request(
+      "GET",
+      `/v1/projects/${projectId}/investigations/${investigationId}/evidence`
+    );
+  }
+  createAgentRun(projectId, investigationId, body) {
+    return this.request(
+      "POST",
+      `/v1/projects/${projectId}/investigations/${investigationId}/agent-runs`,
+      body
+    );
+  }
+};
+
+// ../../packages/cli/src/lib/cloud/auth-store.ts
+init_cjs_shims();
+var import_node_fs7 = require("fs");
+function readAuth() {
+  const p = authPath();
+  if (!(0, import_node_fs7.existsSync)(p)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(p, "utf8"));
+    if (!parsed.token || !parsed.apiBaseUrl || !parsed.account) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeAuth(state) {
+  (0, import_node_fs7.mkdirSync)(horusHome(), { recursive: true });
+  const p = authPath();
+  (0, import_node_fs7.writeFileSync)(p, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
+  try {
+    (0, import_node_fs7.chmodSync)(p, 384);
+  } catch {
+  }
+}
+function clearAuth() {
+  const p = authPath();
+  if ((0, import_node_fs7.existsSync)(p)) (0, import_node_fs7.rmSync)(p);
+}
+
+// ../../packages/cli/src/lib/cloud/session.ts
+function resolveApiBaseUrl(explicit) {
+  return explicit ?? process.env.HORUS_CLOUD_API_URL ?? readAuth()?.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+}
+function repoRootOrCwd(cwd = process.cwd()) {
+  return findRepoRoot(cwd) ?? cwd;
+}
+function authedClient() {
+  const auth = readAuth();
+  if (!auth) return null;
+  return { client: new CloudClient(auth.apiBaseUrl, auth.token), auth };
+}
+
+// ../../packages/cli/src/lib/cloud/investigation-sync.ts
+init_cjs_shims();
+var REPORT_EVIDENCE_TYPE = "note";
+var REPORT_EVIDENCE_SOURCE = "cli";
+var REPORT_EVIDENCE_TITLE = "Investigation report snapshot";
+var REPORT_EVIDENCE_KIND = "horus:report";
+var REPORT_CONTENT_FORMAT = "application/json";
+function idempotencyKey(reportId, suffix) {
+  return `${reportId}:${suffix}`;
+}
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+async function uploadInvestigationToCloud(client, cfg, report) {
+  if (!cfg.project) {
+    throw new Error("Cloud config is missing a linked project.");
+  }
+  const projectId = cfg.project.id;
+  const repositoryIds = cfg.repository?.id ? [cfg.repository.id] : void 0;
+  const investigation = await client.createInvestigation(projectId, {
+    title: report.input.hint.slice(0, 500) || "Untitled investigation",
+    hint: report.input.hint,
+    repositoryIds,
+    idempotencyKey: idempotencyKey(report.id, "investigation")
+  });
+  await client.createEvidence(projectId, investigation.id, {
+    type: REPORT_EVIDENCE_TYPE,
+    source: REPORT_EVIDENCE_SOURCE,
+    title: REPORT_EVIDENCE_TITLE,
+    content: JSON.stringify(report),
+    contentFormat: REPORT_CONTENT_FORMAT,
+    payload: { kind: REPORT_EVIDENCE_KIND, report: clone(report) },
+    idempotencyKey: idempotencyKey(report.id, "report")
+  });
+  await client.createAgentRun(projectId, investigation.id, {
+    repositoryId: cfg.repository?.id,
+    status: "completed",
+    cliVersion: process.env.npm_package_version ?? "0.0.0",
+    summary: report.summary,
+    idempotencyKey: idempotencyKey(report.id, "run")
+  });
+  await client.updateInvestigation(projectId, investigation.id, { status: "completed" });
+  return { projectId, investigationId: investigation.id };
+}
+function findReportEvidence(evidence2) {
+  const record = evidence2.find((e) => {
+    const payload2 = e.payload;
+    return e.source === REPORT_EVIDENCE_SOURCE && payload2?.kind === REPORT_EVIDENCE_KIND;
+  });
+  if (!record) return null;
+  const payload = record.payload;
+  if (payload?.report) return clone(payload.report);
+  try {
+    return JSON.parse(record.content);
+  } catch {
+    return null;
+  }
+}
+async function fetchInvestigationReportFromCloud(client, cfg, investigationId) {
+  if (!cfg.project) {
+    throw new Error("Cloud config is missing a linked project.");
+  }
+  const projectId = cfg.project.id;
+  await client.getInvestigation(projectId, investigationId);
+  const evidence2 = await client.listEvidence(projectId, investigationId);
+  return findReportEvidence(evidence2);
+}
+async function listCloudInvestigations(client, cfg) {
+  if (!cfg.project) {
+    throw new Error("Cloud config is missing a linked project.");
+  }
+  const result = await client.listInvestigations(cfg.project.id);
+  return result.investigations;
+}
+
+// ../../packages/cli/src/commands/context.ts
+init_cjs_shims();
 var import_picocolors5 = __toESM(require_picocolors(), 1);
+function resolveTriple(ctx, target) {
+  const parts = target.split("/");
+  if (parts.length !== 3) return null;
+  const [orgSlug, wsSlug, projSlug] = parts;
+  const organization = ctx.organizations.find((o) => o.slug === orgSlug);
+  if (!organization) return null;
+  const workspace = ctx.workspaces.find(
+    (w) => w.slug === wsSlug && w.organizationId === organization.id
+  );
+  if (!workspace) return null;
+  const project = ctx.projects.find(
+    (p) => p.slug === projSlug && p.workspaceId === workspace.id
+  );
+  if (!project) return null;
+  return {
+    organization: { id: organization.id, slug: organization.slug },
+    workspace: { id: workspace.id, slug: workspace.slug },
+    project: { id: project.id, slug: project.slug }
+  };
+}
+function tripleLabel(ctx, projectId) {
+  const project = ctx.projects.find((p) => p.id === projectId);
+  if (!project) return null;
+  const ws = ctx.workspaces.find((w) => w.id === project.workspaceId);
+  const org = ctx.organizations.find((o) => o.id === project.organizationId);
+  if (!ws || !org) return null;
+  return `${org.slug}/${ws.slug}/${project.slug}`;
+}
+async function runContextList(opts = {}) {
+  const root = repoRootOrCwd(opts.cwd);
+  const cfg = readCloudConfig(root);
+  const session = authedClient();
+  const activeCloud = isCloudActive(cfg);
+  console.log(`  ${import_picocolors5.default.bold("CONTEXT".padEnd(44))} STORAGE`);
+  const mark4 = (active) => active ? import_picocolors5.default.green("*") : " ";
+  console.log(`${mark4(!activeCloud)} ${"local".padEnd(44)} ${import_picocolors5.default.dim("~/.horus local Postgres")}`);
+  if (!session) {
+    console.log("");
+    console.log(import_picocolors5.default.dim(`Run ${import_picocolors5.default.bold("horus login")} to see cloud contexts you can use.`));
+    return 0;
+  }
+  try {
+    const ctx = await session.client.context();
+    for (const project of ctx.projects) {
+      const label = tripleLabel(ctx, project.id);
+      if (!label) continue;
+      const active = activeCloud && cfg?.project?.id === project.id;
+      console.log(`${mark4(active)} ${label.padEnd(44)} ${import_picocolors5.default.dim("Horus Cloud")}`);
+    }
+    console.log("");
+    console.log(import_picocolors5.default.dim("(* = active for this repo)"));
+    return 0;
+  } catch (err) {
+    return reportCloudError(err);
+  }
+}
+async function runContextUse(target, opts = {}) {
+  const root = repoRootOrCwd(opts.cwd);
+  if (target === "local") {
+    const cfg = readCloudConfig(root) ?? { context: "local" };
+    writeCloudConfig(root, { ...cfg, context: "local" });
+    console.log(
+      `${import_picocolors5.default.green("\u2713")} Context for this repo is now ${import_picocolors5.default.bold("local")}. ` + import_picocolors5.default.dim("(local data preserved)")
+    );
+    return 0;
+  }
+  const session = authedClient();
+  if (!session) {
+    console.error(import_picocolors5.default.red(`Not logged in. Run ${import_picocolors5.default.bold("horus login")} first.`));
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = await session.client.context();
+  } catch (err) {
+    return reportCloudError(err);
+  }
+  const resolved = resolveTriple(ctx, target);
+  if (!resolved) {
+    console.error(
+      import_picocolors5.default.red(`You don't have access to ${import_picocolors5.default.bold(target)}.`) + `
+  Ask an org admin for an invite, or run ${import_picocolors5.default.bold("horus context list")} to see available projects.`
+    );
+    return 1;
+  }
+  writeCloudConfig(root, {
+    context: "cloud",
+    organization: resolved.organization,
+    workspace: resolved.workspace,
+    project: resolved.project
+  });
+  console.log(
+    `${import_picocolors5.default.green("\u2713")} Context for this repo is now ${import_picocolors5.default.bold(target)} ${import_picocolors5.default.dim("(cloud)")}.`
+  );
+  return 0;
+}
+function formatRelativeTime(iso) {
+  if (!iso) return null;
+  const then = new Date(iso).getTime();
+  if (Number.isNaN(then)) return null;
+  const secs = Math.max(0, Math.round((Date.now() - then) / 1e3));
+  if (secs < 60) return "just now";
+  const mins = Math.round(secs / 60);
+  if (mins < 60) return `${mins}m ago`;
+  const hours = Math.round(mins / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.round(hours / 24);
+  return `${days}d ago`;
+}
+function syncMetaLines(project) {
+  const lines = [];
+  if (project.provider && project.provider !== "other") {
+    lines.push(`${import_picocolors5.default.bold("Provider:")}    ${project.provider}`);
+  }
+  if (project.remoteUrl) lines.push(`${import_picocolors5.default.bold("Remote:")}      ${project.remoteUrl}`);
+  if (project.defaultBranch) lines.push(`${import_picocolors5.default.bold("Branch:")}      ${project.defaultBranch}`);
+  const synced = formatRelativeTime(project.lastSyncedAt);
+  lines.push(`${import_picocolors5.default.bold("Last sync:")}   ${synced ?? import_picocolors5.default.dim("never")}`);
+  return lines;
+}
+async function runContextShow(opts = {}) {
+  const root = repoRootOrCwd(opts.cwd);
+  const cfg = readCloudConfig(root);
+  if (!isCloudActive(cfg) || !cfg.project) {
+    console.log(`${import_picocolors5.default.bold("Context:")}    local`);
+    console.log(`${import_picocolors5.default.bold("Storage:")}    local Postgres ${import_picocolors5.default.dim("(~/.horus)")}`);
+    console.log(
+      import_picocolors5.default.dim(`Tip:        ${import_picocolors5.default.bold("horus login")} then ${import_picocolors5.default.bold("horus context use <org>/<workspace>/<project>")} to use a cloud project.`)
+    );
+    return 0;
+  }
+  const triple = `${cfg.organization?.slug}/${cfg.workspace?.slug}/${cfg.project.slug}`;
+  console.log(`${import_picocolors5.default.bold("Context:")}    ${triple}   ${import_picocolors5.default.dim("(cloud)")}`);
+  const session = authedClient();
+  if (!session) {
+    console.log(`${import_picocolors5.default.bold("Account:")}    ${import_picocolors5.default.dim("not logged in")}`);
+    console.log(import_picocolors5.default.dim(`Showing cached context. Run ${import_picocolors5.default.bold("horus login")} for live project + sync details.`));
+    return 0;
+  }
+  let ctx;
+  try {
+    ctx = await session.client.context();
+  } catch (err) {
+    console.log(`${import_picocolors5.default.bold("Account:")}    ${session.auth.account.email}`);
+    if (err instanceof CloudOfflineError) {
+      console.log(import_picocolors5.default.dim("Offline \u2014 showing cached context; sync details unavailable."));
+      return 0;
+    }
+    return reportCloudError(err);
+  }
+  const project = ctx.projects.find((p) => p.id === cfg.project?.id);
+  if (!project) {
+    console.log(`${import_picocolors5.default.bold("Account:")}    ${session.auth.account.email}`);
+    console.error(
+      import_picocolors5.default.yellow(`This repo's stored project is no longer in your accessible context.`) + `
+  Your access may have changed or the project was removed.
+  Run ${import_picocolors5.default.bold("horus context list")} to see available projects, then ${import_picocolors5.default.bold("horus context use <org>/<workspace>/<project>")}.`
+    );
+    return 1;
+  }
+  const ws = ctx.workspaces.find((w) => w.id === project.workspaceId);
+  const org = ctx.organizations.find((o) => o.id === project.organizationId);
+  console.log(
+    `${import_picocolors5.default.bold("Project:")}    ${project.name}` + (ws && org ? `  \xB7  workspace ${ws.name}  \xB7  org ${org.name}` : "")
+  );
+  for (const line2 of syncMetaLines(project)) console.log(line2);
+  console.log(`${import_picocolors5.default.bold("Account:")}    ${session.auth.account.email}`);
+  console.log(`${import_picocolors5.default.bold("Sync to:")}    ${triple} ${import_picocolors5.default.dim("(horus cloud sync)")}`);
+  return 0;
+}
+function reportCloudError(err) {
+  if (err instanceof CloudOfflineError) {
+    console.error(import_picocolors5.default.red(err.message));
+    return 1;
+  }
+  if (err instanceof CloudError && err.status === 401) {
+    console.error(
+      import_picocolors5.default.red("Your session expired.") + ` Run ${import_picocolors5.default.bold("horus login")} to continue. ` + import_picocolors5.default.dim("(local mode still works)")
+    );
+    return 1;
+  }
+  console.error(import_picocolors5.default.red(`Cloud request failed: ${err.message}`));
+  return 1;
+}
+
+// ../../packages/cli/src/commands/investigate.ts
 function extractEvidenceExcerpt(e) {
   if (!e.payload || typeof e.payload !== "object") return void 0;
   const p = e.payload;
@@ -74195,37 +74899,37 @@ function renderStoredAIJudgment(judgment, write = (l) => console.log(l)) {
   const sep = "\u2500".repeat(60);
   write(`
 ${sep}`);
-  write(import_picocolors5.default.bold("AI Judgment") + import_picocolors5.default.dim(` (confidence: ${(judgment.confidence * 100).toFixed(0)}%, provider: ${judgment.provider})`));
+  write(import_picocolors6.default.bold("AI Judgment") + import_picocolors6.default.dim(` (confidence: ${(judgment.confidence * 100).toFixed(0)}%, provider: ${judgment.provider})`));
   write(sep);
   if (judgment.hypothesisJudgments && judgment.hypothesisJudgments.length > 0) {
-    write(import_picocolors5.default.bold("Hypothesis verdicts:"));
+    write(import_picocolors6.default.bold("Hypothesis verdicts:"));
     for (const j of judgment.hypothesisJudgments) {
-      const verdictColor = j.verdict === "supported" ? import_picocolors5.default.green : j.verdict === "weakened" ? import_picocolors5.default.yellow : j.verdict === "eliminated" ? import_picocolors5.default.red : import_picocolors5.default.dim;
-      write(`  ${verdictColor(`[${j.verdict}]`)} ${j.category}` + import_picocolors5.default.dim(` (${(j.confidence * 100).toFixed(0)}%)`));
-      write(import_picocolors5.default.dim(`    ${j.rationale}`));
+      const verdictColor = j.verdict === "supported" ? import_picocolors6.default.green : j.verdict === "weakened" ? import_picocolors6.default.yellow : j.verdict === "eliminated" ? import_picocolors6.default.red : import_picocolors6.default.dim;
+      write(`  ${verdictColor(`[${j.verdict}]`)} ${j.category}` + import_picocolors6.default.dim(` (${(j.confidence * 100).toFixed(0)}%)`));
+      write(import_picocolors6.default.dim(`    ${j.rationale}`));
     }
     write("");
   }
   if (judgment.rootCauseAssessment) {
     const rca = judgment.rootCauseAssessment;
-    const uncertaintyColor = rca.uncertainty === "low" ? import_picocolors5.default.green : rca.uncertainty === "medium" ? import_picocolors5.default.yellow : import_picocolors5.default.red;
-    write(import_picocolors5.default.bold("Root cause assessment:") + import_picocolors5.default.dim(` uncertainty: ${uncertaintyColor(rca.uncertainty)}`));
+    const uncertaintyColor = rca.uncertainty === "low" ? import_picocolors6.default.green : rca.uncertainty === "medium" ? import_picocolors6.default.yellow : import_picocolors6.default.red;
+    write(import_picocolors6.default.bold("Root cause assessment:") + import_picocolors6.default.dim(` uncertainty: ${uncertaintyColor(rca.uncertainty)}`));
     write(rca.summary);
     if (rca.citedEvidenceIds.length > 0) {
-      write(import_picocolors5.default.dim(`  Cited: ${rca.citedEvidenceIds.join(", ")}`));
+      write(import_picocolors6.default.dim(`  Cited: ${rca.citedEvidenceIds.join(", ")}`));
     }
     write("");
   }
-  write(import_picocolors5.default.bold("What:") + " " + judgment.what);
-  write(import_picocolors5.default.bold("Why:") + " " + judgment.why);
+  write(import_picocolors6.default.bold("What:") + " " + judgment.what);
+  write(import_picocolors6.default.bold("Why:") + " " + judgment.why);
   if (judgment.whereNext.length > 0) {
-    write(import_picocolors5.default.bold("Next steps:"));
+    write(import_picocolors6.default.bold("Next steps:"));
     for (const step of judgment.whereNext) {
       write(`  \u2022 ${step}`);
     }
   }
   if (judgment.citations.length > 0) {
-    write(import_picocolors5.default.dim(`
+    write(import_picocolors6.default.dim(`
 Cited evidence: ${judgment.citations.map((c) => c.evidenceId).join(", ")}`));
   }
 }
@@ -74250,13 +74954,25 @@ async function runInvestigate(hint, opts) {
     try {
       renv = resolveEnvironment(config, { project: projectName, env: opts.env });
     } catch (err) {
-      console.error(import_picocolors5.default.red(err.message));
+      console.error(import_picocolors6.default.red(err.message));
+      return 1;
+    }
+    const repoRoot = repoRootOrCwd(renv.path);
+    const cloudCfg = readCloudConfig(repoRoot);
+    const cloudActive = isCloudActive(cloudCfg);
+    const cloudSession = cloudActive ? authedClient() : null;
+    if (cloudActive && !cloudSession) {
+      console.error(
+        import_picocolors6.default.red(
+          `This repo is linked to Horus Cloud but you are not logged in. Run ${import_picocolors6.default.bold("horus login")} first.`
+        )
+      );
       return 1;
     }
     const code = codeForEnv(renv);
     if (!code) {
       console.error(
-        import_picocolors5.default.red(
+        import_picocolors6.default.red(
           `No source-intelligence connector configured for project "${renv.project}" / env "${renv.env}".`
         )
       );
@@ -74266,7 +74982,7 @@ async function runInvestigate(hint, opts) {
     if (!health.ok) {
       const sourceUrl = renv.repositories[0]?.sourceHostUrl ?? renv.repositories[0]?.axonHostUrl;
       console.error(
-        import_picocolors5.default.red(
+        import_picocolors6.default.red(
           `Source-intelligence host unreachable for ${renv.project}/${renv.env}` + (sourceUrl ? ` (${sourceUrl}) \u2014 run: horus index` : " \u2014 run: horus index")
         )
       );
@@ -74311,7 +75027,7 @@ async function runInvestigate(hint, opts) {
           model,
           ...ai.anthropicApiKey !== void 0 ? { apiKey: ai.anthropicApiKey } : {}
         });
-        console.log(import_picocolors5.default.dim(`[ai] model: ${model}`));
+        console.log(import_picocolors6.default.dim(`[ai] model: ${model}`));
         const narrativeInput = buildNarrativeInput(report);
         const { output, fromProvider, degraded, validationErrors } = await renderNarrative(
           narrativeInput,
@@ -74327,24 +75043,32 @@ async function runInvestigate(hint, opts) {
           renderStoredAIJudgment(stored);
         } else if (degraded) {
           if (validationErrors && validationErrors.length > 0) {
-            console.error(import_picocolors5.default.yellow(`[ai] structured validation incomplete \u2014 showing raw AI narrative`));
+            console.error(import_picocolors6.default.yellow(`[ai] structured validation incomplete \u2014 showing raw AI narrative`));
           }
           console.log("");
-          console.log(import_picocolors5.default.dim("\u2500".repeat(60)));
-          console.log(import_picocolors5.default.bold("AI narrative ") + import_picocolors5.default.yellow("(unstructured \u2014 not validated)"));
+          console.log(import_picocolors6.default.dim("\u2500".repeat(60)));
+          console.log(import_picocolors6.default.bold("AI narrative ") + import_picocolors6.default.yellow("(unstructured \u2014 not validated)"));
           if (output.what?.trim()) {
-            console.log(import_picocolors5.default.bold("\nWhat:"), output.what.trim());
+            console.log(import_picocolors6.default.bold("\nWhat:"), output.what.trim());
           }
           if (output.why?.trim()) {
-            console.log(import_picocolors5.default.bold("\nWhy:"), output.why.trim());
+            console.log(import_picocolors6.default.bold("\nWhy:"), output.why.trim());
           }
           if (output.whereNext.length > 0) {
-            console.log(import_picocolors5.default.bold("\nNext:"));
+            console.log(import_picocolors6.default.bold("\nNext:"));
             for (const a of output.whereNext) console.log(`  - ${a}`);
           }
         } else {
           const reason = classifyAIFailure(validationErrors?.[0]);
-          console.error(import_picocolors5.default.yellow(`[ai] fallback to deterministic \u2014 ${reason}`));
+          console.error(import_picocolors6.default.yellow(`[ai] fallback to deterministic \u2014 ${reason}`));
+        }
+      }
+      if (cloudActive && cloudSession && cloudCfg) {
+        try {
+          const refs = await uploadInvestigationToCloud(cloudSession.client, cloudCfg, report);
+          console.log(import_picocolors6.default.dim(`[cloud] investigation saved: ${refs.investigationId}`));
+        } catch (err) {
+          return reportCloudError(err);
         }
       }
     } finally {
@@ -74354,14 +75078,14 @@ async function runInvestigate(hint, opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors5.default.red(err.message));
+    console.error(import_picocolors6.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/changes.ts
 init_cjs_shims();
-var import_picocolors6 = __toESM(require_picocolors(), 1);
+var import_picocolors7 = __toESM(require_picocolors(), 1);
 var CHANGES_AI_CONTRACT = `Provide a clearly separated AI change-impact review with:
 
 Highest-risk changes
@@ -74386,7 +75110,7 @@ async function runChanges(base2, compare, opts) {
     const health = await code.health();
     if (!health.ok) {
       console.error(
-        import_picocolors6.default.red("Source-intelligence host unreachable \u2014 run: horus index")
+        import_picocolors7.default.red("Source-intelligence host unreachable \u2014 run: horus index")
       );
       return 1;
     }
@@ -74408,20 +75132,20 @@ async function runChanges(base2, compare, opts) {
         });
         console.log("\n" + renderInterpretation(result));
         if (!result.ok) {
-          console.error(import_picocolors6.default.yellow(`[ai] ${result.warning}`));
+          console.error(import_picocolors7.default.yellow(`[ai] ${result.warning}`));
         }
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors6.default.red(err.message));
+    console.error(import_picocolors7.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/timeline.ts
 init_cjs_shims();
-var import_picocolors7 = __toESM(require_picocolors(), 1);
+var import_picocolors8 = __toESM(require_picocolors(), 1);
 var DEFAULT_SINCE = "7 days ago";
 function resolveTimelineWindow(opts) {
   const usingDefault = !opts.all && opts.since === void 0;
@@ -74451,7 +75175,7 @@ async function runTimeline(service, opts) {
     try {
       renv = resolveEnvironment(config, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors7.default.red(err.message));
+      console.error(import_picocolors8.default.red(err.message));
       return 1;
     }
     const { code } = createConnectors(config);
@@ -74466,9 +75190,9 @@ async function runTimeline(service, opts) {
       console.log(renderChangeTimeline(t));
       if (usingDefaultWindow) {
         console.log(
-          import_picocolors7.default.dim(
+          import_picocolors8.default.dim(
             `
-  Showing the last 7 days (default). Widen with ${import_picocolors7.default.bold('--since "30 days ago"')}, pin a range with ${import_picocolors7.default.bold("--since <when> --until <when>")}, or see everything with ${import_picocolors7.default.bold("--all")}.`
+  Showing the last 7 days (default). Widen with ${import_picocolors8.default.bold('--since "30 days ago"')}, pin a range with ${import_picocolors8.default.bold("--since <when> --until <when>")}, or see everything with ${import_picocolors8.default.bold("--all")}.`
           )
         );
       }
@@ -74485,20 +75209,20 @@ async function runTimeline(service, opts) {
         });
         console.log("\n" + renderInterpretation(result));
         if (!result.ok) {
-          console.error(import_picocolors7.default.yellow(`[ai] ${result.warning}`));
+          console.error(import_picocolors8.default.yellow(`[ai] ${result.warning}`));
         }
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors7.default.red(err.message));
+    console.error(import_picocolors8.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/what-changed.ts
 init_cjs_shims();
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 var DEFAULT_SINCE2 = "7 days ago";
 var WHAT_CHANGED_AI_CONTRACT = `Provide a clearly separated AI interpretation section with:
 
@@ -74522,7 +75246,7 @@ async function runWhatChanged(service, opts) {
     try {
       renv = resolveEnvironment(config, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors8.default.red(err.message));
+      console.error(import_picocolors9.default.red(err.message));
       return 1;
     }
     const { code } = createConnectors(config);
@@ -74545,19 +75269,19 @@ async function runWhatChanged(service, opts) {
       });
       console.log("\n" + renderInterpretation(result));
       if (!result.ok) {
-        console.error(import_picocolors8.default.yellow(`[ai] ${result.warning}`));
+        console.error(import_picocolors9.default.yellow(`[ai] ${result.warning}`));
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors8.default.red(err.message));
+    console.error(import_picocolors9.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/architecture.ts
 init_cjs_shims();
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 var ARCHITECTURE_AI_CONTRACT = `Provide a clearly separated AI interpretation section with:
 
 System summary
@@ -74586,7 +75310,7 @@ async function runArchitecture(opts) {
     const health = await code.health();
     if (!health.ok) {
       console.error(
-        import_picocolors9.default.red("Source-intelligence host unreachable \u2014 run: horus index")
+        import_picocolors10.default.red("Source-intelligence host unreachable \u2014 run: horus index")
       );
       return 1;
     }
@@ -74614,7 +75338,7 @@ async function runArchitecture(opts) {
           });
           console.log("\n" + renderInterpretation(result));
           if (!result.ok) {
-            console.error(import_picocolors9.default.yellow(`[ai] ${result.warning}`));
+            console.error(import_picocolors10.default.yellow(`[ai] ${result.warning}`));
           }
         }
       }
@@ -74623,14 +75347,14 @@ async function runArchitecture(opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors9.default.red(err.message));
+    console.error(import_picocolors10.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/blast-radius.ts
 init_cjs_shims();
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 var BLAST_RADIUS_AI_CONTRACT = `Provide a clearly separated AI interpretation section with:
 
 Evidence used
@@ -74657,7 +75381,7 @@ async function runBlastRadius(query, opts) {
     const { code } = createConnectors(config);
     const health = await code.health();
     if (!health.ok) {
-      console.error(import_picocolors10.default.red("Source-intelligence host unreachable \u2014 run: horus index"));
+      console.error(import_picocolors11.default.red("Source-intelligence host unreachable \u2014 run: horus index"));
       return 1;
     }
     let project;
@@ -74670,12 +75394,12 @@ async function runBlastRadius(query, opts) {
       const r = await analyzeBlastRadius(query, { code, db, project }, opts.depth ?? 3);
       if (!r) {
         console.log(`No symbol found for: ${query}`);
-        console.log(import_picocolors10.default.dim(`  Tip: use an exact class or function name, e.g. "MyService"`));
+        console.log(import_picocolors11.default.dim(`  Tip: use an exact class or function name, e.g. "MyService"`));
         return 1;
       }
       if (r.seed.name.toLowerCase() !== query.toLowerCase()) {
         console.log(
-          import_picocolors10.default.yellow(`  No exact match for "${query}"`) + import_picocolors10.default.dim(` \u2014 showing closest: "${r.seed.name}" (fuzzy match)`)
+          import_picocolors11.default.yellow(`  No exact match for "${query}"`) + import_picocolors11.default.dim(` \u2014 showing closest: "${r.seed.name}" (fuzzy match)`)
         );
       }
       if (opts.json) {
@@ -74695,7 +75419,7 @@ async function runBlastRadius(query, opts) {
           });
           console.log("\n" + renderInterpretation(result));
           if (!result.ok) {
-            console.error(import_picocolors10.default.yellow(`[ai] ${result.warning}`));
+            console.error(import_picocolors11.default.yellow(`[ai] ${result.warning}`));
           }
         }
       }
@@ -74704,28 +75428,28 @@ async function runBlastRadius(query, opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors10.default.red(err.message));
+    console.error(import_picocolors11.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/repos.ts
 init_cjs_shims();
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 async function runRepos(opts) {
   const config = await loadConfig(opts.config);
   const providers = repoProviders(config);
   if (providers.length === 0) {
-    console.log(import_picocolors11.default.dim("No repositories configured."));
+    console.log(import_picocolors12.default.dim("No repositories configured."));
     return 0;
   }
   const health = await reposHealth(providers);
   for (const h of health) {
-    const dot = h.reachable ? import_picocolors11.default.green("\u25CF") : import_picocolors11.default.red("\u25CF");
-    const name = import_picocolors11.default.bold(h.repo.padEnd(20));
-    const hostUrl = import_picocolors11.default.cyan(h.hostUrl.padEnd(30));
-    const path = import_picocolors11.default.dim(h.path);
-    const detail = h.detail ? import_picocolors11.default.dim(`(${h.detail})`) : "";
+    const dot = h.reachable ? import_picocolors12.default.green("\u25CF") : import_picocolors12.default.red("\u25CF");
+    const name = import_picocolors12.default.bold(h.repo.padEnd(20));
+    const hostUrl = import_picocolors12.default.cyan(h.hostUrl.padEnd(30));
+    const path = import_picocolors12.default.dim(h.path);
+    const detail = h.detail ? import_picocolors12.default.dim(`(${h.detail})`) : "";
     console.log(`  ${dot}  ${name}  ${hostUrl}  ${path}  ${detail}`);
   }
   return 0;
@@ -74733,7 +75457,7 @@ async function runRepos(opts) {
 
 // ../../packages/cli/src/commands/search.ts
 init_cjs_shims();
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 async function runSearch(query, opts) {
   const config = await loadConfig(opts.config);
   const providers = repoProviders(config);
@@ -74744,16 +75468,16 @@ async function runSearch(query, opts) {
   }
   let totalMatches = 0;
   for (const result of results) {
-    const statusDot = result.reachable ? import_picocolors12.default.green("\u25CF") : import_picocolors12.default.red("\u25CF");
+    const statusDot = result.reachable ? import_picocolors13.default.green("\u25CF") : import_picocolors13.default.red("\u25CF");
     console.log("");
-    console.log(`${statusDot}  ${import_picocolors12.default.bold("## " + result.repo)}  ${import_picocolors12.default.dim(result.hostUrl)}`);
+    console.log(`${statusDot}  ${import_picocolors13.default.bold("## " + result.repo)}  ${import_picocolors13.default.dim(result.hostUrl)}`);
     if (!result.reachable) {
-      console.log(import_picocolors12.default.dim("  (unreachable)"));
+      console.log(import_picocolors13.default.dim("  (unreachable)"));
     } else if (result.symbols.length === 0) {
-      console.log(import_picocolors12.default.dim("  (no matches)"));
+      console.log(import_picocolors13.default.dim("  (no matches)"));
     } else {
       for (const sym of result.symbols) {
-        console.log(`  - ${import_picocolors12.default.bold(sym.name)}  ${import_picocolors12.default.dim(sym.filePath)}`);
+        console.log(`  - ${import_picocolors13.default.bold(sym.name)}  ${import_picocolors13.default.dim(sym.filePath)}`);
       }
       totalMatches += result.symbols.length;
     }
@@ -74761,7 +75485,7 @@ async function runSearch(query, opts) {
   console.log("");
   const reachableCount = results.filter((r) => r.reachable).length;
   console.log(
-    import_picocolors12.default.dim(
+    import_picocolors13.default.dim(
       `${totalMatches} match(es) across ${reachableCount}/${results.length} reachable repo(s) for query: "${query}"`
     )
   );
@@ -74770,6 +75494,7 @@ async function runSearch(query, opts) {
 
 // ../../packages/cli/src/commands/investigations.ts
 init_cjs_shims();
+var import_picocolors14 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/format.ts
 init_cjs_shims();
@@ -74803,6 +75528,34 @@ async function resolveDbUrl(configPath) {
 
 // ../../packages/cli/src/commands/investigations.ts
 async function runInvestigations(opts) {
+  const repoRoot = repoRootOrCwd();
+  const cloudCfg = readCloudConfig(repoRoot);
+  if (isCloudActive(cloudCfg)) {
+    const session = authedClient();
+    if (!session) {
+      console.error(
+        import_picocolors14.default.red(
+          `This repo is linked to Horus Cloud but you are not logged in. Run ${import_picocolors14.default.bold("horus login")} first.`
+        )
+      );
+      return 1;
+    }
+    try {
+      const rows = await listCloudInvestigations(session.client, cloudCfg);
+      if (rows.length === 0) {
+        console.log('No investigations yet. Run: horus investigate "<hint>"');
+      } else {
+        for (const row of rows) {
+          const ts = formatDateTime(new Date(row.createdAt));
+          const title = (row.title ?? "").length > 60 ? (row.title ?? "").slice(0, 57) + "..." : row.title ?? "";
+          console.log(`${row.id}  ${ts}  ${title}`);
+        }
+      }
+    } catch (err) {
+      return reportCloudError(err);
+    }
+    return 0;
+  }
   const { db, sql: sql2 } = createDb(await resolveDbUrl(opts.config));
   try {
     const rows = await listInvestigations(db, opts.limit ?? 20);
@@ -74823,18 +75576,18 @@ async function runInvestigations(opts) {
 
 // ../../packages/cli/src/commands/replay.ts
 init_cjs_shims();
-var import_picocolors13 = __toESM(require_picocolors(), 1);
+var import_picocolors15 = __toESM(require_picocolors(), 1);
 async function runReplay(id, opts) {
   const { db, sql: sql2 } = createDb(await resolveDbUrl(opts.config));
   try {
     const row = await getInvestigation(db, id);
     if (!row) {
-      console.error(import_picocolors13.default.red("No investigation found: " + id));
+      console.error(import_picocolors15.default.red("No investigation found: " + id));
       return 1;
     }
     if (!row.report) {
       console.error(
-        import_picocolors13.default.red(
+        import_picocolors15.default.red(
           "Investigation " + id + " has no stored report (run a newer investigation)."
         )
       );
@@ -74847,7 +75600,7 @@ async function runReplay(id, opts) {
     if (opts.ai && fmt !== "json") {
       if (report.aiJudgment && !opts.refreshAi) {
         renderStoredAIJudgment(report.aiJudgment);
-        console.log(import_picocolors13.default.dim("[ai] Stored judgment replayed. Use --refresh-ai to regenerate."));
+        console.log(import_picocolors15.default.dim("[ai] Stored judgment replayed. Use --refresh-ai to regenerate."));
       } else {
         const narrativeInput = buildNarrativeInput(report);
         const { provider } = await buildNarrativeProvider({
@@ -74860,17 +75613,17 @@ async function runReplay(id, opts) {
         );
         if (!fromProvider && degraded) {
           if (validationErrors?.length) {
-            console.error(import_picocolors13.default.yellow("[ai] structured validation incomplete \u2014 showing raw AI narrative"));
+            console.error(import_picocolors15.default.yellow("[ai] structured validation incomplete \u2014 showing raw AI narrative"));
           }
           console.log("");
-          console.log(import_picocolors13.default.dim("\u2500".repeat(60)));
-          console.log(import_picocolors13.default.bold("AI narrative ") + import_picocolors13.default.yellow("(unstructured \u2014 not validated)"));
-          if (output.what?.trim()) console.log(import_picocolors13.default.bold("\nWhat:"), output.what.trim());
-          if (output.why?.trim()) console.log(import_picocolors13.default.bold("\nWhy:"), output.why.trim());
+          console.log(import_picocolors15.default.dim("\u2500".repeat(60)));
+          console.log(import_picocolors15.default.bold("AI narrative ") + import_picocolors15.default.yellow("(unstructured \u2014 not validated)"));
+          if (output.what?.trim()) console.log(import_picocolors15.default.bold("\nWhat:"), output.what.trim());
+          if (output.why?.trim()) console.log(import_picocolors15.default.bold("\nWhy:"), output.why.trim());
         } else if (!fromProvider) {
-          console.error(import_picocolors13.default.yellow("[ai] Provider unavailable \u2014 deterministic output shown above."));
+          console.error(import_picocolors15.default.yellow("[ai] Provider unavailable \u2014 deterministic output shown above."));
           if (validationErrors?.length) {
-            console.error(import_picocolors13.default.dim(`    ${validationErrors[0]}`));
+            console.error(import_picocolors15.default.dim(`    ${validationErrors[0]}`));
           }
         } else {
           const stored = narrativeOutputToStoredJudgment(output, "anthropic");
@@ -74891,7 +75644,7 @@ async function runReplay(id, opts) {
 
 // ../../packages/cli/src/commands/owner.ts
 init_cjs_shims();
-var import_picocolors14 = __toESM(require_picocolors(), 1);
+var import_picocolors16 = __toESM(require_picocolors(), 1);
 async function runOwner(query, opts) {
   try {
     const config = await loadConfig(opts.config);
@@ -74899,7 +75652,7 @@ async function runOwner(query, opts) {
     try {
       renv = resolveEnvironment(config, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors14.default.red(err.message));
+      console.error(import_picocolors16.default.red(err.message));
       return 1;
     }
     const code = codeForRepo(config, renv.project);
@@ -74907,16 +75660,16 @@ async function runOwner(query, opts) {
     console.log(opts.json ? ownershipToJSON(o) : renderOwnership(o));
     return 0;
   } catch (err) {
-    console.error(import_picocolors14.default.red(err.message));
+    console.error(import_picocolors16.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/postmortem.ts
 init_cjs_shims();
-var import_node_fs6 = require("fs");
-var import_node_path7 = require("path");
-var import_picocolors15 = __toESM(require_picocolors(), 1);
+var import_node_fs8 = require("fs");
+var import_node_path9 = require("path");
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 async function runPostmortem(id, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   let sql2;
@@ -74930,11 +75683,11 @@ async function runPostmortem(id, opts) {
       const { db } = conn;
       const row = await getInvestigation(db, id);
       if (!row) {
-        log(import_picocolors15.default.red("No investigation found: " + id));
+        log(import_picocolors17.default.red("No investigation found: " + id));
         return 1;
       }
       if (!row.report) {
-        log(import_picocolors15.default.red("Investigation " + id + " has no stored report."));
+        log(import_picocolors17.default.red("Investigation " + id + " has no stored report."));
         return 1;
       }
       report = migrateReport(row.report);
@@ -75026,25 +75779,25 @@ _AI summary unavailable: ${validationErrors?.[0] ?? "provider error"}_
       }
     }
     if (opts.output) {
-      const outputPath = (0, import_node_path7.resolve)(opts.output);
-      if ((0, import_node_fs6.existsSync)(outputPath) && !opts.force) {
-        log(import_picocolors15.default.red("\u2717") + " " + outputPath + " already exists");
-        log(import_picocolors15.default.dim("  pass --force to overwrite"));
+      const outputPath = (0, import_node_path9.resolve)(opts.output);
+      if ((0, import_node_fs8.existsSync)(outputPath) && !opts.force) {
+        log(import_picocolors17.default.red("\u2717") + " " + outputPath + " already exists");
+        log(import_picocolors17.default.dim("  pass --force to overwrite"));
         return 1;
       }
       try {
-        (0, import_node_fs6.writeFileSync)(outputPath, content, "utf8");
+        (0, import_node_fs8.writeFileSync)(outputPath, content, "utf8");
       } catch (err) {
-        log(import_picocolors15.default.red("\u2717 Could not write " + outputPath + ": ") + err.message);
+        log(import_picocolors17.default.red("\u2717 Could not write " + outputPath + ": ") + err.message);
         return 1;
       }
-      log(import_picocolors15.default.green("\u2713") + " Saved postmortem to " + outputPath);
+      log(import_picocolors17.default.green("\u2713") + " Saved postmortem to " + outputPath);
     } else {
       log(content);
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log(import_picocolors15.default.red("postmortem failed: " + message));
+    log(import_picocolors17.default.red("postmortem failed: " + message));
     return 1;
   } finally {
     if (sql2) {
@@ -75056,7 +75809,7 @@ _AI summary unavailable: ${validationErrors?.[0] ?? "provider error"}_
 
 // ../../packages/cli/src/commands/score.ts
 init_cjs_shims();
-var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 var SCORE_AI_CONTRACT = `Provide a clearly separated AI score explanation with:
 
 Why this scored this way
@@ -75075,11 +75828,11 @@ async function runScore(id, opts) {
   try {
     const row = await getInvestigation(db, id);
     if (!row) {
-      console.error(import_picocolors16.default.red("No investigation found: " + id));
+      console.error(import_picocolors18.default.red("No investigation found: " + id));
       return 1;
     }
     if (!row.report) {
-      console.error(import_picocolors16.default.red("Investigation " + id + " has no stored report."));
+      console.error(import_picocolors18.default.red("Investigation " + id + " has no stored report."));
       return 1;
     }
     const s = scoreInvestigation(migrateReport(row.report));
@@ -75100,7 +75853,7 @@ async function runScore(id, opts) {
         });
         console.log("\n" + renderInterpretation(result));
         if (!result.ok) {
-          console.error(import_picocolors16.default.yellow(`[ai] ${result.warning}`));
+          console.error(import_picocolors18.default.yellow(`[ai] ${result.warning}`));
         }
       }
     }
@@ -75140,56 +75893,90 @@ async function runScores(opts) {
 
 // ../../packages/cli/src/commands/ask.ts
 init_cjs_shims();
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors19 = __toESM(require_picocolors(), 1);
+function renderAnswer(report, directive, opts) {
+  const answer = answerQuestion(report, directive);
+  if (answer) {
+    console.log(opts.json ? qaToJSON(answer) : renderQAAnswer(answer));
+    return 0;
+  }
+  const v = refineInvestigation(report, directive);
+  console.log(opts.json ? refinedToJSON(report, v) : renderRefined(report, v));
+  if (!opts.json && report.aiJudgment) {
+    const j = report.aiJudgment;
+    console.log("");
+    console.log(import_picocolors19.default.dim("\u2500".repeat(60)));
+    console.log(import_picocolors19.default.dim(`Stored AI judgment (${j.provider}, ${j.generatedAt}):`));
+    if (j.rootCauseAssessment) {
+      console.log(import_picocolors19.default.bold("Root cause (AI):"), j.rootCauseAssessment.summary);
+      console.log(import_picocolors19.default.dim(`Uncertainty: ${j.rootCauseAssessment.uncertainty}`));
+    } else {
+      console.log(import_picocolors19.default.bold("AI Why:"), j.why);
+    }
+  }
+  return 0;
+}
 async function runAsk(id, directive, opts) {
+  const repoRoot = repoRootOrCwd();
+  const cloudCfg = readCloudConfig(repoRoot);
+  if (isCloudActive(cloudCfg)) {
+    const session = authedClient();
+    if (!session) {
+      console.error(
+        import_picocolors19.default.red(
+          `This repo is linked to Horus Cloud but you are not logged in. Run ${import_picocolors19.default.bold("horus login")} first.`
+        )
+      );
+      return 1;
+    }
+    try {
+      const report = await fetchInvestigationReportFromCloud(
+        session.client,
+        cloudCfg,
+        id
+      );
+      if (!report) {
+        console.error(
+          import_picocolors19.default.red(
+            `Cloud investigation ${id} has no saved report. Run this investigation with ${import_picocolors19.default.bold("horus investigate")} first.`
+          )
+        );
+        return 1;
+      }
+      return renderAnswer(report, directive, opts);
+    } catch (err) {
+      return reportCloudError(err);
+    }
+  }
   const { db, sql: sql2 } = createDb(await resolveDbUrl(opts.config));
   try {
     const row = await getInvestigation(db, id);
     if (!row) {
-      console.error(import_picocolors17.default.red("No investigation found: " + id));
+      console.error(import_picocolors19.default.red("No investigation found: " + id));
       return 1;
     }
     if (!row.report) {
-      console.error(import_picocolors17.default.red("Investigation " + id + " has no stored report."));
+      console.error(import_picocolors19.default.red("Investigation " + id + " has no stored report."));
       return 1;
     }
     const report = migrateReport(row.report);
-    const answer = answerQuestion(report, directive);
-    if (answer) {
-      console.log(opts.json ? qaToJSON(answer) : renderQAAnswer(answer));
-      return 0;
-    }
-    const v = refineInvestigation(report, directive);
-    console.log(opts.json ? refinedToJSON(report, v) : renderRefined(report, v));
-    if (!opts.json && report.aiJudgment) {
-      const j = report.aiJudgment;
-      console.log("");
-      console.log(import_picocolors17.default.dim("\u2500".repeat(60)));
-      console.log(import_picocolors17.default.dim(`Stored AI judgment (${j.provider}, ${j.generatedAt}):`));
-      if (j.rootCauseAssessment) {
-        console.log(import_picocolors17.default.bold("Root cause (AI):"), j.rootCauseAssessment.summary);
-        console.log(import_picocolors17.default.dim(`Uncertainty: ${j.rootCauseAssessment.uncertainty}`));
-      } else {
-        console.log(import_picocolors17.default.bold("AI Why:"), j.why);
-      }
-    }
+    return renderAnswer(report, directive, opts);
   } catch (err) {
     const code = typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
     if (code === "22P02") {
-      console.error(import_picocolors17.default.red("No investigation found: " + id));
+      console.error(import_picocolors19.default.red("No investigation found: " + id));
       return 1;
     }
-    console.error(import_picocolors17.default.red(err instanceof Error ? err.message : String(err)));
+    console.error(import_picocolors19.default.red(err instanceof Error ? err.message : String(err)));
     return 1;
   } finally {
     await sql2.end();
   }
-  return 0;
 }
 
 // ../../packages/cli/src/commands/onboard.ts
 init_cjs_shims();
-var import_picocolors18 = __toESM(require_picocolors(), 1);
+var import_picocolors20 = __toESM(require_picocolors(), 1);
 var ONBOARD_AI_CONTRACT = `Provide a clearly separated AI onboarding guide with:
 
 Start here
@@ -75217,7 +76004,7 @@ async function runOnboard(area, opts) {
     try {
       renv = resolveEnvironment(config, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors18.default.red(err.message));
+      console.error(import_picocolors20.default.red(err.message));
       return 1;
     }
     const repo = { name: renv.project, path: renv.path };
@@ -75225,7 +76012,7 @@ async function runOnboard(area, opts) {
     const health = await code.health();
     if (!health.ok) {
       console.error(
-        import_picocolors18.default.red("Source-intelligence host unreachable \u2014 run: horus index")
+        import_picocolors20.default.red("Source-intelligence host unreachable \u2014 run: horus index")
       );
       return 1;
     }
@@ -75252,7 +76039,7 @@ async function runOnboard(area, opts) {
           });
           console.log("\n" + renderInterpretation(result));
           if (!result.ok) {
-            console.error(import_picocolors18.default.yellow(`[ai] ${result.warning}`));
+            console.error(import_picocolors20.default.yellow(`[ai] ${result.warning}`));
           }
         }
       }
@@ -75261,14 +76048,14 @@ async function runOnboard(area, opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors18.default.red(err.message));
+    console.error(import_picocolors20.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/simulate.ts
 init_cjs_shims();
-var import_picocolors19 = __toESM(require_picocolors(), 1);
+var import_picocolors21 = __toESM(require_picocolors(), 1);
 async function runSimulate(scenarioId, opts) {
   try {
     if (scenarioId === void 0) {
@@ -75278,7 +76065,7 @@ async function runSimulate(scenarioId, opts) {
     const scenario = getScenario(scenarioId);
     if (scenario === null) {
       console.error(
-        import_picocolors19.default.red(
+        import_picocolors21.default.red(
           `Unknown scenario: "${scenarioId}". Run horus simulate to list available scenarios.`
         )
       );
@@ -75289,14 +76076,14 @@ async function runSimulate(scenarioId, opts) {
     try {
       renv = resolveEnvironment(config, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors19.default.red(err.message));
+      console.error(import_picocolors21.default.red(err.message));
       return 1;
     }
     const code = codeForRepo(config, renv.project);
     const health = await code.health();
     if (!health.ok) {
       console.error(
-        import_picocolors19.default.red("Source-intelligence host unreachable \u2014 run: horus index")
+        import_picocolors21.default.red("Source-intelligence host unreachable \u2014 run: horus index")
       );
       return 1;
     }
@@ -75313,14 +76100,14 @@ async function runSimulate(scenarioId, opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors19.default.red(err.message));
+    console.error(import_picocolors21.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/logs.ts
 init_cjs_shims();
-var import_picocolors20 = __toESM(require_picocolors(), 1);
+var import_picocolors22 = __toESM(require_picocolors(), 1);
 var LOGS_AI_CONTRACT = `Provide a clearly separated AI evidence narration with:
 
 Evidence used
@@ -75353,9 +76140,9 @@ function resolveRawLevel(opts) {
   return opts.level ?? "error";
 }
 function levelColor(level, text2) {
-  if (level === "error" || level === "fatal") return import_picocolors20.default.red(text2);
-  if (level === "warn") return import_picocolors20.default.yellow(text2);
-  return import_picocolors20.default.dim(text2);
+  if (level === "error" || level === "fatal") return import_picocolors22.default.red(text2);
+  if (level === "warn") return import_picocolors22.default.yellow(text2);
+  return import_picocolors22.default.dim(text2);
 }
 async function runLogs(service, opts) {
   try {
@@ -75364,13 +76151,13 @@ async function runLogs(service, opts) {
     try {
       renv = resolveEnvironment(config, { project: opts.project, env: opts.env });
     } catch (err) {
-      console.error(import_picocolors20.default.red(err.message));
+      console.error(import_picocolors22.default.red(err.message));
       return 1;
     }
     const logs = logsForEnv(renv);
     if (logs === null) {
       console.error(
-        import_picocolors20.default.red(
+        import_picocolors22.default.red(
           `No Elasticsearch connector configured for ${renv.project}/${renv.env} (set ES_URL / ES_USERNAME / ES_PASSWORD)`
         )
       );
@@ -75378,35 +76165,34 @@ async function runLogs(service, opts) {
     }
     const health = await logs.health();
     if (!health.ok) {
-      console.error(import_picocolors20.default.red(`Elasticsearch unreachable: ${health.detail}`));
+      console.error(import_picocolors22.default.red(`Elasticsearch unreachable: ${health.detail}`));
       return 1;
     }
     const resolvedService = service ?? renv.connectors.elasticsearch?.serviceName;
     const indexPattern = renv.connectors.elasticsearch?.indexPattern ?? "*";
     try {
+      const aggregatesEventCode = opts.raw !== true && opts.groupBy === void 0;
       const compat = await logs.checkCompatibility({
         requiresService: resolvedService !== void 0,
-        // raw mode dumps log lines (searchLogs); only the default path calls
-        // analyzeErrors() which requires aggregatable event-code and service fields.
-        requiresServiceAggregation: opts.raw !== true,
-        requiresEventCode: opts.raw !== true
+        requiresServiceAggregation: aggregatesEventCode,
+        requiresEventCode: aggregatesEventCode
       });
       for (const w of compat.issues.filter((i) => i.severity === "warning")) {
-        console.warn(import_picocolors20.default.yellow(`[warn] ${w.field}: ${w.message}`));
+        console.warn(import_picocolors22.default.yellow(`[warn] ${w.field}: ${w.message}`));
       }
       const errors2 = compat.issues.filter((i) => i.severity === "error");
       if (errors2.length > 0) {
-        console.error(import_picocolors20.default.red("Elasticsearch field mapping is incompatible with the index:"));
+        console.error(import_picocolors22.default.red("Elasticsearch field mapping is incompatible with the index:"));
         for (const e of errors2) {
-          console.error(import_picocolors20.default.red(`  ${e.field}: ${e.message}`));
+          console.error(import_picocolors22.default.red(`  ${e.field}: ${e.message}`));
         }
         console.error(
-          import_picocolors20.default.dim("Fix fields.* overrides in your connector config or choose the correct preset.")
+          import_picocolors22.default.dim("Fix fields.* overrides in your connector config or choose the correct preset.")
         );
         return 1;
       }
     } catch {
-      console.warn(import_picocolors20.default.dim("[warn] Elasticsearch compatibility check unavailable \u2014 proceeding."));
+      console.warn(import_picocolors22.default.dim("[warn] Elasticsearch compatibility check unavailable \u2014 proceeding."));
     }
     const from = sinceToIso(opts.since) ?? new Date(Date.now() - 7 * 864e5).toISOString();
     const fromDisplay = from.slice(0, 16).replace("T", " ");
@@ -75418,6 +76204,9 @@ async function runLogs(service, opts) {
         from,
         level: rawLevel,
         text: opts.grep,
+        // grep searches message + detail + context.* so error strings buried
+        // outside the message field are still found (HOR-216).
+        broadText: opts.grep !== void 0,
         limit
       });
       if (opts.json) {
@@ -75440,6 +76229,9 @@ async function runLogs(service, opts) {
                 component: r.component ?? null,
                 eventCode: r.eventCode ?? null,
                 message: r.message,
+                // Structured fields restored to raw output (HOR-215/216).
+                context: r.context ?? null,
+                detail: r.detail ?? null,
                 traceId: r.traceId ?? null,
                 requestId: r.requestId ?? null
               }))
@@ -75451,7 +76243,7 @@ async function runLogs(service, opts) {
         return 0;
       }
       if (records.length === 0) {
-        console.log(import_picocolors20.default.dim("No logs matched."));
+        console.log(import_picocolors22.default.dim("No logs matched."));
         return 0;
       }
       for (const r of records) {
@@ -75460,18 +76252,74 @@ async function runLogs(service, opts) {
         const comp = (r.component ?? r.service ?? "").padEnd(30).slice(0, 30);
         const line2 = `${ts}  ${lvl}  ${comp}  ${r.message.slice(0, 120)}`;
         console.log(levelColor(r.level, line2));
+        for (const { key, value } of extractContextFields(r)) {
+          console.log(import_picocolors22.default.dim(`    ${key}: ${value.slice(0, 200)}`));
+        }
+      }
+      return 0;
+    }
+    if (opts.groupBy !== void 0) {
+      const field = opts.groupBy;
+      const buckets = await logs.aggregateErrors(
+        {
+          service: resolvedService,
+          from,
+          text: opts.grep,
+          broadText: opts.grep !== void 0
+        },
+        field
+      );
+      if (opts.json) {
+        console.log(
+          JSON.stringify(
+            {
+              scope: {
+                project: renv.project,
+                env: renv.env,
+                service: resolvedService ?? null,
+                index: indexPattern,
+                from,
+                severity: "error+",
+                grep: opts.grep ?? null,
+                groupBy: field
+              },
+              buckets
+            },
+            null,
+            2
+          )
+        );
+        return 0;
+      }
+      console.log(
+        import_picocolors22.default.bold(`Top ${field}`) + import_picocolors22.default.dim(
+          ` \u2014 ${renv.project}/${renv.env}` + (resolvedService ? ` \xB7 service ${resolvedService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "")
+        )
+      );
+      console.log(import_picocolors22.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
+      console.log("");
+      if (buckets.length === 0) {
+        console.log(import_picocolors22.default.dim(`  No error logs with field "${field}" in the window.`));
+        console.log(import_picocolors22.default.dim(`  Tip: ensure "${field}" is an aggregatable (keyword) field.`));
+        return 0;
+      }
+      for (const b2 of buckets) {
+        console.log(`  ${import_picocolors22.default.red(String(b2.count).padStart(6))}  ${b2.key}`);
       }
+      console.log("");
+      console.log(import_picocolors22.default.dim(`  ${buckets.length} distinct ${field} value(s) shown (top by error count).`));
       return 0;
     }
     let analysis = await logs.analyzeErrors({
       service: resolvedService,
       from,
-      text: opts.grep
+      text: opts.grep,
+      broadText: opts.grep !== void 0
     });
     let scopeService = resolvedService;
     let broadeningNote;
     if (analysis.signatures.length === 0 && resolvedService !== void 0) {
-      const broader = await logs.analyzeErrors({ from, text: opts.grep });
+      const broader = await logs.analyzeErrors({ from, text: opts.grep, broadText: opts.grep !== void 0 });
       if (broader.signatures.length > 0) {
         analysis = broader;
         broadeningNote = `No errors found for service "${resolvedService}" \u2014 showing all services`;
@@ -75503,46 +76351,46 @@ async function runLogs(service, opts) {
       return 0;
     }
     console.log(
-      import_picocolors20.default.bold(`Error analysis`) + import_picocolors20.default.dim(
+      import_picocolors22.default.bold(`Error analysis`) + import_picocolors22.default.dim(
         ` \u2014 ${renv.project}/${renv.env}` + (scopeService ? ` \xB7 service ${scopeService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "")
       )
     );
-    console.log(import_picocolors20.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
+    console.log(import_picocolors22.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
     if (broadeningNote) {
-      console.log(import_picocolors20.default.yellow(`  ${broadeningNote}`));
+      console.log(import_picocolors22.default.yellow(`  ${broadeningNote}`));
     }
     console.log(
-      `  ${analysis.totalErrors} error(s) \xB7 ${analysis.signatures.length} signature(s) \xB7 ${import_picocolors20.default.yellow(String(analysis.newSignatures.length))} new`
+      `  ${analysis.totalErrors} error(s) \xB7 ${analysis.signatures.length} signature(s) \xB7 ${import_picocolors22.default.yellow(String(analysis.newSignatures.length))} new`
     );
     console.log("");
     if (analysis.signatures.length === 0) {
-      console.log(import_picocolors20.default.dim("  No error-level logs in the window."));
+      console.log(import_picocolors22.default.dim("  No error-level logs in the window."));
       console.log(
-        import_picocolors20.default.dim(
+        import_picocolors22.default.dim(
           `  Searched: ${scopeService ? `service "${scopeService}"` : "all services"} \xB7 index: ${indexPattern} \xB7 from: ${fromDisplay} UTC`
         )
       );
-      console.log(import_picocolors20.default.dim(`  Tip: use --since to widen the window (e.g. --since 30d).`));
+      console.log(import_picocolors22.default.dim(`  Tip: use --since to widen the window (e.g. --since 30d).`));
       return 0;
     }
     for (const s of analysis.signatures) {
       const tags = [];
-      if (s.isNew) tags.push(import_picocolors20.default.red("NEW"));
+      if (s.isNew) tags.push(import_picocolors22.default.red("NEW"));
       else if (s.ratio !== void 0 && Number.isFinite(s.ratio) && s.ratio >= 1.5) {
-        tags.push(import_picocolors20.default.yellow(`spike x${s.ratio.toFixed(1)}`));
+        tags.push(import_picocolors22.default.yellow(`spike x${s.ratio.toFixed(1)}`));
       }
-      const svc = s.services.length > 0 ? import_picocolors20.default.dim(` \xB7 ${s.services.slice(0, 3).join(", ")}`) : "";
+      const svc = s.services.length > 0 ? import_picocolors22.default.dim(` \xB7 ${s.services.slice(0, 3).join(", ")}`) : "";
       const tagStr = tags.length > 0 ? `  [${tags.join(", ")}]` : "";
       console.log(
-        `  ${import_picocolors20.default.red(String(s.count).padStart(6))}  ${import_picocolors20.default.bold(s.key.padEnd(14).slice(0, 14))}  ` + import_picocolors20.default.dim(`first ${shortTs(s.firstSeen)} \xB7 last ${shortTs(s.lastSeen)}`) + svc + tagStr
+        `  ${import_picocolors22.default.red(String(s.count).padStart(6))}  ${import_picocolors22.default.bold(s.key.padEnd(14).slice(0, 14))}  ` + import_picocolors22.default.dim(`first ${shortTs(s.firstSeen)} \xB7 last ${shortTs(s.lastSeen)}`) + svc + tagStr
       );
     }
     if (analysis.affectedServices.length > 0) {
       console.log("");
-      console.log(`  ${import_picocolors20.default.bold("Affected services:")} ${analysis.affectedServices.join(", ")}`);
+      console.log(`  ${import_picocolors22.default.bold("Affected services:")} ${analysis.affectedServices.join(", ")}`);
     }
     console.log("");
-    console.log(import_picocolors20.default.dim("  (use --raw to see individual log lines)"));
+    console.log(import_picocolors22.default.dim("  (use --raw to see individual log lines)"));
     if (opts.ai) {
       const result = await renderAiInterpretation({
         command: "logs",
@@ -75561,19 +76409,19 @@ async function runLogs(service, opts) {
       });
       console.log("\n" + renderInterpretation(result));
       if (!result.ok) {
-        console.error(import_picocolors20.default.yellow(`[ai] ${result.warning}`));
+        console.error(import_picocolors22.default.yellow(`[ai] ${result.warning}`));
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors20.default.red(err.message));
+    console.error(import_picocolors22.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/metrics.ts
 init_cjs_shims();
-var import_picocolors21 = __toESM(require_picocolors(), 1);
+var import_picocolors23 = __toESM(require_picocolors(), 1);
 var METRICS_AI_CONTRACT = `Provide a clearly separated AI evidence narration with:
 
 Evidence used
@@ -75618,10 +76466,10 @@ function anomalyColor(anomaly) {
     case "latency-spike":
     case "error-rate-change":
     case "throughput-drop":
-      return import_picocolors21.default.red;
+      return import_picocolors23.default.red;
     case "queue-growth":
     case "change":
-      return import_picocolors21.default.yellow;
+      return import_picocolors23.default.yellow;
     default:
       return (s) => s;
   }
@@ -75648,7 +76496,7 @@ async function runMetrics(hint, opts) {
     const metrics = metricsProviderFromConfig(config);
     if (metrics === null) {
       console.error(
-        import_picocolors21.default.red(
+        import_picocolors23.default.red(
           "Grafana not configured \u2014 set GRAFANA_URL + GRAFANA_USER + GRAFANA_PASSWORD"
         )
       );
@@ -75656,7 +76504,7 @@ async function runMetrics(hint, opts) {
     }
     const health = await metrics.health();
     if (!health.ok) {
-      console.error(import_picocolors21.default.red(`Grafana unreachable: ${health.detail}`));
+      console.error(import_picocolors23.default.red(`Grafana unreachable: ${health.detail}`));
       return 1;
     }
     const stepNum = opts.step !== void 0 ? Number(opts.step) : void 0;
@@ -75685,14 +76533,14 @@ async function runMetrics(hint, opts) {
         return 0;
       }
       if (series.length === 0) {
-        console.log(import_picocolors21.default.dim("No series returned."));
+        console.log(import_picocolors23.default.dim("No series returned."));
         return 0;
       }
       for (const s of series) {
         const summary = summarize(s);
         const label = labelStr(s.labels);
         console.log(
-          `  ${import_picocolors21.default.cyan(label || "(no labels)")}  last=${import_picocolors21.default.bold(fmtNum(summary.last))}  avg=${fmtNum(summary.avg)}`
+          `  ${import_picocolors23.default.cyan(label || "(no labels)")}  last=${import_picocolors23.default.bold(fmtNum(summary.last))}  avg=${fmtNum(summary.avg)}`
         );
       }
       return 0;
@@ -75707,36 +76555,36 @@ async function runMetrics(hint, opts) {
     if (findings2.length === 0) {
       if (hint !== void 0) {
         const tokens = extractHintTokens(hint);
-        console.log(import_picocolors21.default.dim(`No panels matched hint "${hint}".`));
+        console.log(import_picocolors23.default.dim(`No panels matched hint "${hint}".`));
         if (tokens.length > 0) {
-          console.log(import_picocolors21.default.dim(`  Searched for panels containing: ${tokens.join(", ")}`));
+          console.log(import_picocolors23.default.dim(`  Searched for panels containing: ${tokens.join(", ")}`));
         }
         console.log(
-          import_picocolors21.default.dim(
-            `  Tip: run ${import_picocolors21.default.bold("horus metrics")} (no hint) to see all available panels, then use a panel title or keyword directly.`
+          import_picocolors23.default.dim(
+            `  Tip: run ${import_picocolors23.default.bold("horus metrics")} (no hint) to see all available panels, then use a panel title or keyword directly.`
           )
         );
       } else {
-        console.log(import_picocolors21.default.dim("No panels found in configured Grafana dashboards."));
+        console.log(import_picocolors23.default.dim("No panels found in configured Grafana dashboards."));
       }
       return 0;
     }
     const hintSuffix = hint !== void 0 ? ` (hint: "${hint}")` : "";
     const matchSources = hint !== void 0 ? [...new Set(findings2.map((f) => f.matchSource).filter(Boolean))] : [];
-    const matchSuffix = matchSources.length > 0 ? import_picocolors21.default.dim(` [matched via ${matchSources.join(", ")}]`) : "";
+    const matchSuffix = matchSources.length > 0 ? import_picocolors23.default.dim(` [matched via ${matchSources.join(", ")}]`) : "";
     console.log(
-      import_picocolors21.default.bold(
+      import_picocolors23.default.bold(
         `Grafana metrics${hintSuffix} \u2014 ${findings2.length} series across panels`
       ) + matchSuffix
     );
     console.log(
-      import_picocolors21.default.dim(
+      import_picocolors23.default.dim(
         `  window: ${new Date(from * 1e3).toISOString()} \u2013 ${new Date(to * 1e3).toISOString()}`
       )
     );
     console.log("");
     if (flagged.length === 0) {
-      console.log(import_picocolors21.default.green("  No anomalies detected."));
+      console.log(import_picocolors23.default.green("  No anomalies detected."));
     } else {
       for (const f of flagged) {
         const color = anomalyColor(f.anomaly);
@@ -75745,14 +76593,14 @@ async function runMetrics(hint, opts) {
         const lblStr = labelStr(f.labels);
         console.log(
           color(
-            `  ${label.padEnd(22)}  ${f.panelTitle.padEnd(40).slice(0, 40)}  ${fmtNum(f.baselineAvg)} -> ${fmtNum(f.currentAvg)} (${ratioStr})` + (lblStr !== "" ? `  ${import_picocolors21.default.dim(lblStr)}` : "")
+            `  ${label.padEnd(22)}  ${f.panelTitle.padEnd(40).slice(0, 40)}  ${fmtNum(f.baselineAvg)} -> ${fmtNum(f.currentAvg)} (${ratioStr})` + (lblStr !== "" ? `  ${import_picocolors23.default.dim(lblStr)}` : "")
           )
         );
       }
     }
     if (ok.length > 0) {
       console.log("");
-      console.log(import_picocolors21.default.dim(`  ${ok.length} panel series with no anomaly.`));
+      console.log(import_picocolors23.default.dim(`  ${ok.length} panel series with no anomaly.`));
     }
     if (opts.ai) {
       const result = await renderAiInterpretation({
@@ -75767,19 +76615,19 @@ async function runMetrics(hint, opts) {
       });
       console.log("\n" + renderInterpretation(result));
       if (!result.ok) {
-        console.error(import_picocolors21.default.yellow(`[ai] ${result.warning}`));
+        console.error(import_picocolors23.default.yellow(`[ai] ${result.warning}`));
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors21.default.red(err.message));
+    console.error(import_picocolors23.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/state.ts
 init_cjs_shims();
-var import_picocolors22 = __toESM(require_picocolors(), 1);
+var import_picocolors24 = __toESM(require_picocolors(), 1);
 var STATE_AI_CONTRACT = `Provide a clearly separated AI evidence narration with:
 
 Evidence used
@@ -75805,13 +76653,13 @@ async function runState(opts) {
     try {
       renv = resolveEnvironment(config, { project: opts.project, env: opts.env });
     } catch (err) {
-      console.error(import_picocolors22.default.red(err.message));
+      console.error(import_picocolors24.default.red(err.message));
       return 1;
     }
     const mongo = mongoForEnv(renv);
     if (mongo === null) {
       console.error(
-        import_picocolors22.default.red(
+        import_picocolors24.default.red(
           `No MongoDB connector configured for ${renv.project}/${renv.env} (set the project's Mongo URL env var).`
         )
       );
@@ -75819,7 +76667,7 @@ async function runState(opts) {
     }
     const health = await mongo.health();
     if (!health.ok) {
-      console.error(import_picocolors22.default.red(`MongoDB unreachable: ${health.detail}`));
+      console.error(import_picocolors24.default.red(`MongoDB unreachable: ${health.detail}`));
       await mongo.close();
       return 1;
     }
@@ -75845,38 +76693,38 @@ async function runState(opts) {
         );
         return 0;
       }
-      const discoveryNote = analysis.autoDiscovered ? import_picocolors22.default.dim(` (${analysis.collections.length} collections, auto-discovered)`) : "";
+      const discoveryNote = analysis.autoDiscovered ? import_picocolors24.default.dim(` (${analysis.collections.length} collections, auto-discovered)`) : "";
       console.log(
-        import_picocolors22.default.bold("State analysis") + import_picocolors22.default.dim(` \u2014 ${renv.project}/${renv.env} \xB7 db ${analysis.database}`) + discoveryNote
+        import_picocolors24.default.bold("State analysis") + import_picocolors24.default.dim(` \u2014 ${renv.project}/${renv.env} \xB7 db ${analysis.database}`) + discoveryNote
       );
       console.log("");
       let signals = 0;
       for (const c of analysis.collections) {
         const flags = [];
         if (c.isStale === true) {
-          flags.push(import_picocolors22.default.yellow(`stale (last ${c.dateField}, ~${Math.round(c.ageHours ?? 0)}h)`));
+          flags.push(import_picocolors24.default.yellow(`stale (last ${c.dateField}, ~${Math.round(c.ageHours ?? 0)}h)`));
         }
         for (const a of c.anomalies) {
-          flags.push(import_picocolors22.default.red(`${a.count}\xD7 "${a.value}"`));
+          flags.push(import_picocolors24.default.red(`${a.count}\xD7 "${a.value}"`));
           signals += 1;
         }
         if (c.isStale === true) signals += 1;
-        const head = `  ${import_picocolors22.default.bold(c.collection.padEnd(18).slice(0, 18))} ${import_picocolors22.default.dim(String(c.count).padStart(8) + " docs")}`;
-        console.log(flags.length > 0 ? `${head}   ${flags.join("  ")}` : import_picocolors22.default.dim(head));
+        const head = `  ${import_picocolors24.default.bold(c.collection.padEnd(18).slice(0, 18))} ${import_picocolors24.default.dim(String(c.count).padStart(8) + " docs")}`;
+        console.log(flags.length > 0 ? `${head}   ${flags.join("  ")}` : import_picocolors24.default.dim(head));
       }
       console.log("");
       if (analysis.collections.length === 0) {
         console.log(
-          import_picocolors22.default.yellow("  No collections discovered in this database.") + import_picocolors22.default.dim(" Verify the database name in your MongoDB connector config.")
+          import_picocolors24.default.yellow("  No collections discovered in this database.") + import_picocolors24.default.dim(" Verify the database name in your MongoDB connector config.")
         );
       } else {
         const scope = analysis.autoDiscovered ? "collection(s)" : "allowlisted collection(s)";
         console.log(
-          signals > 0 ? `  ${import_picocolors22.default.bold(String(signals))} state signal(s) across ${analysis.collections.length} ${scope}` : import_picocolors22.default.dim(`  No state anomalies across ${analysis.collections.length} ${scope}.`)
+          signals > 0 ? `  ${import_picocolors24.default.bold(String(signals))} state signal(s) across ${analysis.collections.length} ${scope}` : import_picocolors24.default.dim(`  No state anomalies across ${analysis.collections.length} ${scope}.`)
         );
         if (analysis.autoDiscovered) {
           console.log(
-            import_picocolors22.default.dim(
+            import_picocolors24.default.dim(
               `  Tip: add a "collections" list to your MongoDB connector config to restrict analysis.`
             )
           );
@@ -75894,7 +76742,7 @@ async function runState(opts) {
         });
         console.log("\n" + renderInterpretation(result));
         if (!result.ok) {
-          console.error(import_picocolors22.default.yellow(`[ai] ${result.warning}`));
+          console.error(import_picocolors24.default.yellow(`[ai] ${result.warning}`));
         }
       }
       return 0;
@@ -75902,20 +76750,20 @@ async function runState(opts) {
       await mongo.close();
     }
   } catch (err) {
-    console.error(import_picocolors22.default.red(err.message));
+    console.error(import_picocolors24.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/init.ts
 init_cjs_shims();
-var import_picocolors23 = __toESM(require_picocolors(), 1);
-var import_node_path8 = require("path");
+var import_picocolors25 = __toESM(require_picocolors(), 1);
+var import_node_path10 = require("path");
 async function runInit(opts) {
   try {
     const cwd = process.cwd();
-    const root = opts.path ? (0, import_node_path8.resolve)(opts.path) : findRepoRoot(cwd) ?? cwd;
-    const name = opts.name ?? (0, import_node_path8.basename)(root);
+    const root = opts.path ? (0, import_node_path10.resolve)(opts.path) : findRepoRoot(cwd) ?? cwd;
+    const name = opts.name ?? (0, import_node_path10.basename)(root);
     const envName = opts.env ?? "production";
     const repo = { name, path: root };
     if (opts.source) repo["source"] = { hostUrl: opts.source };
@@ -75930,65 +76778,65 @@ async function runInit(opts) {
     const configPath = writeLocalConfig(root, file);
     registerProject(name, root, configPath);
     ensureProjectGitignore(root);
-    console.log(`${import_picocolors23.default.green("\u2713")} Initialized Horus project ${import_picocolors23.default.bold(name)}`);
-    console.log(import_picocolors23.default.dim(`  config:     ${configPath}`));
-    console.log(import_picocolors23.default.dim(`  registered: horus investigate --name ${name} "<hint>"`));
+    console.log(`${import_picocolors25.default.green("\u2713")} Initialized Horus project ${import_picocolors25.default.bold(name)}`);
+    console.log(import_picocolors25.default.dim(`  config:     ${configPath}`));
+    console.log(import_picocolors25.default.dim(`  registered: horus investigate --name ${name} "<hint>"`));
     if (!opts.source) {
       console.log(
-        import_picocolors23.default.dim("  no source-intelligence host set \u2014 run `horus index` to analyze + host, or pass --source <url>")
+        import_picocolors25.default.dim("  no source-intelligence host set \u2014 run `horus index` to analyze + host, or pass --source <url>")
       );
     }
     console.log(
-      import_picocolors23.default.dim("  add runtime connectors (elasticsearch/mongodb/grafana) to .horus/config.json")
+      import_picocolors25.default.dim("  add runtime connectors (elasticsearch/mongodb/grafana) to .horus/config.json")
     );
     console.log(
-      import_picocolors23.default.dim("  .horus/ is gitignored \u2014 local config and runtime state stay out of version control")
+      import_picocolors25.default.dim("  .horus/ is gitignored \u2014 local config and runtime state stay out of version control")
     );
     return 0;
   } catch (err) {
-    console.error(import_picocolors23.default.red(err.message));
+    console.error(import_picocolors25.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/projects.ts
 init_cjs_shims();
-var import_picocolors24 = __toESM(require_picocolors(), 1);
+var import_picocolors26 = __toESM(require_picocolors(), 1);
 async function runProjects() {
   const reg = readRegistry();
   const names = Object.keys(reg.projects).sort();
   if (names.length === 0) {
     console.log(
-      import_picocolors24.default.dim("No registered projects. Run `horus index` (or `horus init`) inside a repo.")
+      import_picocolors26.default.dim("No registered projects. Run `horus index` (or `horus init`) inside a repo.")
     );
     return 0;
   }
-  console.log(import_picocolors24.default.bold("Registered Horus projects"));
+  console.log(import_picocolors26.default.bold("Registered Horus projects"));
   console.log("");
   for (const name of names) {
     const entry2 = reg.projects[name];
     if (entry2 === void 0) continue;
-    console.log(`  ${import_picocolors24.default.bold(name.padEnd(22))} ${import_picocolors24.default.dim(entry2.root)}`);
+    console.log(`  ${import_picocolors26.default.bold(name.padEnd(22))} ${import_picocolors26.default.dim(entry2.root)}`);
   }
   console.log("");
-  console.log(import_picocolors24.default.dim('  horus investigate --name <name> "<hint>"'));
+  console.log(import_picocolors26.default.dim('  horus investigate --name <name> "<hint>"'));
   return 0;
 }
 
 // ../../packages/cli/src/commands/setup.ts
 init_cjs_shims();
-var import_picocolors25 = __toESM(require_picocolors(), 1);
+var import_picocolors27 = __toESM(require_picocolors(), 1);
 var DEFAULT_DB_URL3 = "postgresql://horus:horus@localhost:5433/horus";
 async function runSetup(opts) {
   const write = opts.write ?? ((line2) => console.log(line2));
   let ok = true;
-  write(import_picocolors25.default.bold("\nHorus setup\n"));
+  write(import_picocolors27.default.bold("\nHorus setup\n"));
   const backendVersion = await getSourceVersion();
   if (backendVersion === null) {
     ok = false;
-    write(`  ${import_picocolors25.default.red("\u25CF")} Horus source-intelligence backend not found`);
+    write(`  ${import_picocolors27.default.red("\u25CF")} Horus source-intelligence backend not found`);
     write(
-      import_picocolors25.default.dim(
+      import_picocolors27.default.dim(
         `      install it (Python 3.11+ required):
         pip install horus-source
       ensure ~/.local/bin is on your PATH`
@@ -75997,17 +76845,17 @@ async function runSetup(opts) {
   } else if (backendVersion !== PINNED_SOURCE_VERSION) {
     ok = false;
     write(
-      `  ${import_picocolors25.default.yellow("\u25CF")} Horus source-intelligence backend version mismatch` + import_picocolors25.default.dim(` (installed: ${backendVersion}, required: ${PINNED_SOURCE_VERSION})`)
+      `  ${import_picocolors27.default.yellow("\u25CF")} Horus source-intelligence backend version mismatch` + import_picocolors27.default.dim(` (installed: ${backendVersion}, required: ${PINNED_SOURCE_VERSION})`)
     );
     write(
-      import_picocolors25.default.dim(
+      import_picocolors27.default.dim(
         `      update it:
         pip install --upgrade horus-source`
       )
     );
   } else {
     write(
-      `  ${import_picocolors25.default.green("\u25CF")} Horus source-intelligence backend ` + import_picocolors25.default.dim(`(${backendVersion})`)
+      `  ${import_picocolors27.default.green("\u25CF")} Horus source-intelligence backend ` + import_picocolors27.default.dim(`(${backendVersion})`)
     );
   }
   let dbUrl = process.env["DATABASE_URL"] ?? DEFAULT_DB_URL3;
@@ -76019,11 +76867,11 @@ async function runSetup(opts) {
   }
   const db = await checkDatabase(dbUrl);
   if (db.reachable) {
-    write(`  ${import_picocolors25.default.green("\u25CF")} Postgres reachable ${import_picocolors25.default.dim(`(${db.schemaDetail})`)}`);
+    write(`  ${import_picocolors27.default.green("\u25CF")} Postgres reachable ${import_picocolors27.default.dim(`(${db.schemaDetail})`)}`);
     if (!db.schemaReady) {
       ok = false;
       write(
-        import_picocolors25.default.dim(
+        import_picocolors27.default.dim(
           `      schema not applied \u2014 run migrations:
         from the Horus repo: pnpm db migrate
         or apply the schema directly: https://github.com/meritt-dev/horus/tree/master/packages/db/drizzle`
@@ -76032,9 +76880,9 @@ async function runSetup(opts) {
     }
   } else {
     ok = false;
-    write(`  ${import_picocolors25.default.red("\u25CF")} Postgres unreachable`);
+    write(`  ${import_picocolors27.default.red("\u25CF")} Postgres unreachable`);
     write(
-      import_picocolors25.default.dim(
+      import_picocolors27.default.dim(
         `      start a local instance:
         docker run -d --name horus-db \\
           -e POSTGRES_USER=horus -e POSTGRES_PASSWORD=horus -e POSTGRES_DB=horus \\
@@ -76059,10 +76907,10 @@ async function runSetup(opts) {
         if (!health.ok) {
           ok = false;
           write(
-            `  ${import_picocolors25.default.red("\u25CF")} Source intelligence host unreachable for ${import_picocolors25.default.bold(repo.name)} ` + import_picocolors25.default.dim(`(${repoHostUrl})`)
+            `  ${import_picocolors27.default.red("\u25CF")} Source intelligence host unreachable for ${import_picocolors27.default.bold(repo.name)} ` + import_picocolors27.default.dim(`(${repoHostUrl})`)
           );
           write(
-            import_picocolors25.default.dim(
+            import_picocolors27.default.dim(
               `      start the source intelligence host:
         cd ${repo.path}
         horus index`
@@ -76073,10 +76921,10 @@ async function runSetup(opts) {
           if (count === 0) {
             ok = false;
             write(
-              `  ${import_picocolors25.default.yellow("\u25CF")} Source intelligence host running but ${import_picocolors25.default.bold(repo.name)} is not indexed`
+              `  ${import_picocolors27.default.yellow("\u25CF")} Source intelligence host running but ${import_picocolors27.default.bold(repo.name)} is not indexed`
             );
             write(
-              import_picocolors25.default.dim(
+              import_picocolors27.default.dim(
                 `      index the repo:
         cd ${repo.path}
         horus index`
@@ -76084,7 +76932,7 @@ async function runSetup(opts) {
             );
           } else {
             write(
-              `  ${import_picocolors25.default.green("\u25CF")} ${import_picocolors25.default.bold(repo.name)} \u2014 ${count} nodes indexed ` + import_picocolors25.default.dim(`(${repoHostUrl})`)
+              `  ${import_picocolors27.default.green("\u25CF")} ${import_picocolors27.default.bold(repo.name)} \u2014 ${count} nodes indexed ` + import_picocolors27.default.dim(`(${repoHostUrl})`)
             );
           }
         }
@@ -76094,10 +76942,10 @@ async function runSetup(opts) {
   write("");
   if (ok) {
     write(
-      import_picocolors25.default.green("Ready.") + ' Next: `cd` into a repo and run `horus index`, then `horus investigate "<hint>"`.'
+      import_picocolors27.default.green("Ready.") + ' Next: `cd` into a repo and run `horus index`, then `horus investigate "<hint>"`.'
     );
   } else {
-    write(import_picocolors25.default.yellow("Resolve the items above, then re-run `horus setup`."));
+    write(import_picocolors27.default.yellow("Resolve the items above, then re-run `horus setup`."));
   }
   return ok ? 0 : 1;
 }
@@ -76106,12 +76954,12 @@ async function runSetup(opts) {
 init_cjs_shims();
 var import_node_readline = require("readline");
 var import_node_child_process6 = require("child_process");
-var import_picocolors28 = __toESM(require_picocolors(), 1);
+var import_picocolors30 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/tty-selector.ts
 init_cjs_shims();
 var import_node_tty = require("tty");
-var import_picocolors26 = __toESM(require_picocolors(), 1);
+var import_picocolors28 = __toESM(require_picocolors(), 1);
 var ExitPromptError = class extends Error {
   constructor(message = "Prompt was cancelled") {
     super(message);
@@ -76167,7 +77015,7 @@ async function checkboxSearch(opts) {
       clear();
       const lines = [];
       lines.push(
-        `? ${import_picocolors26.default.bold(message)} ${import_picocolors26.default.dim("(\u2191\u2193 navigate \u2022 space toggle \u2022 enter confirm \u2022 type filter)")}`
+        `? ${import_picocolors28.default.bold(message)} ${import_picocolors28.default.dim("(\u2191\u2193 navigate \u2022 space toggle \u2022 enter confirm \u2022 type filter)")}`
       );
       const visible = filtered.slice(visibleOffset, visibleOffset + pageSize);
       for (let i = 0; i < visible.length; i++) {
@@ -76175,29 +77023,29 @@ async function checkboxSearch(opts) {
         const choice = visible[i];
         const isCursor = idx === cursor;
         const isSelected = selected.has(choice);
-        const marker = isSelected ? import_picocolors26.default.green("\u25CF") : " ";
+        const marker = isSelected ? import_picocolors28.default.green("\u25CF") : " ";
         const prefix = `[${marker}]`;
-        const label = isCursor ? import_picocolors26.default.cyan(choice) : choice;
-        const pointer = isCursor ? import_picocolors26.default.cyan("\u276F") : " ";
+        const label = isCursor ? import_picocolors28.default.cyan(choice) : choice;
+        const pointer = isCursor ? import_picocolors28.default.cyan("\u276F") : " ";
         lines.push(`  ${pointer} ${prefix} ${label}`);
       }
       if (filtered.length === 0) {
-        lines.push(import_picocolors26.default.dim("  No matches"));
+        lines.push(import_picocolors28.default.dim("  No matches"));
       }
       const statusParts = [
         `${selected.size} selected`,
         `${filtered.length}/${choices.length} matches`
       ];
       if (filter) statusParts.push(`filter: ${filter}`);
-      lines.push(import_picocolors26.default.dim(`  ${statusParts.join(" \xB7 ")}`));
+      lines.push(import_picocolors28.default.dim(`  ${statusParts.join(" \xB7 ")}`));
       output.write(lines.join("\n"));
       lastRenderLines = lines.length;
     }
     function finish(values2) {
       cleanup();
-      const summary = values2.length > 0 ? values2.join(", ") : import_picocolors26.default.dim("none");
+      const summary = values2.length > 0 ? values2.join(", ") : import_picocolors28.default.dim("none");
       output.write(`
-? ${import_picocolors26.default.bold(message)} ${summary}
+? ${import_picocolors28.default.bold(message)} ${summary}
 `);
       resolve8(values2);
     }
@@ -76289,7 +77137,7 @@ async function checkboxSearch(opts) {
 // ../../packages/cli/src/commands/connect-ai.ts
 init_cjs_shims();
 var import_node_child_process5 = require("child_process");
-var import_picocolors27 = __toESM(require_picocolors(), 1);
+var import_picocolors29 = __toESM(require_picocolors(), 1);
 function cliInstalled(id) {
   const r = (0, import_node_child_process5.spawnSync)(id, ["--version"], { stdio: "ignore", timeout: 2e3 });
   return !r.error;
@@ -76317,13 +77165,13 @@ async function runConnectAi(opts) {
     const root = findRepoRoot(cwd) ?? cwd;
     const configPath = discoverLocalConfig(cwd) ?? localConfigPath(root);
     const installed = LOCAL_PROVIDER_IDS.filter((id) => cliInstalled(id));
-    console.log(import_picocolors27.default.bold("\nAI providers"));
+    console.log(import_picocolors29.default.bold("\nAI providers"));
     console.log(
-      import_picocolors27.default.dim(
+      import_picocolors29.default.dim(
         `  Local CLIs on PATH: ${installed.length > 0 ? installed.join(", ") : "none detected"}`
       )
     );
-    console.log(import_picocolors27.default.dim("  Cloud: anthropic (Anthropic Claude API \u2014 used by `investigate --ai`)\n"));
+    console.log(import_picocolors29.default.dim("  Cloud: anthropic (Anthropic Claude API \u2014 used by `investigate --ai`)\n"));
     let provider = opts.provider;
     if (provider === void 0) {
       if (isInteractive()) {
@@ -76334,7 +77182,7 @@ async function runConnectAi(opts) {
       }
     }
     if (!AI_PROVIDERS.includes(provider)) {
-      console.error(import_picocolors27.default.red(`Unknown AI provider: ${provider}`) + import_picocolors27.default.dim(`
+      console.error(import_picocolors29.default.red(`Unknown AI provider: ${provider}`) + import_picocolors29.default.dim(`
   supported: ${AI_PROVIDERS.join(", ")}`));
       return 1;
     }
@@ -76347,7 +77195,7 @@ async function runConnectAi(opts) {
       }
       if (!apiKey) {
         console.error(
-          import_picocolors27.default.red("No API key provided.") + import_picocolors27.default.dim("\n  Pass --api-key sk-ant-\u2026 or set ANTHROPIC_API_KEY and re-run.")
+          import_picocolors29.default.red("No API key provided.") + import_picocolors29.default.dim("\n  Pass --api-key sk-ant-\u2026 or set ANTHROPIC_API_KEY and re-run.")
         );
         return 1;
       }
@@ -76355,28 +77203,28 @@ async function runConnectAi(opts) {
         const probe2 = await probeAnthropic(apiKey);
         if (!probe2.ok) {
           console.error(`
-${import_picocolors27.default.red("\u2717 Anthropic key check failed:")} ${probe2.detail}`);
-          console.error(import_picocolors27.default.dim("  Fix the key and retry, or pass --no-test to skip."));
+${import_picocolors29.default.red("\u2717 Anthropic key check failed:")} ${probe2.detail}`);
+          console.error(import_picocolors29.default.dim("  Fix the key and retry, or pass --no-test to skip."));
           return 1;
         }
         console.log(`
-${import_picocolors27.default.green("\u2713")} anthropic ${import_picocolors27.default.dim(`(${probe2.detail})`)}`);
+${import_picocolors29.default.green("\u2713")} anthropic ${import_picocolors29.default.dim(`(${probe2.detail})`)}`);
       }
       if (opts.model) aiBlock["anthropic"] = { model: opts.model };
       storedKey = apiKey;
     } else {
       if (!installed.includes(provider)) {
         console.error(
-          import_picocolors27.default.red(`${provider} CLI not found on PATH.`) + import_picocolors27.default.dim(`
+          import_picocolors29.default.red(`${provider} CLI not found on PATH.`) + import_picocolors29.default.dim(`
   Install it first, or choose anthropic.`)
         );
         return 1;
       }
       const desc2 = DEFAULT_LOCAL_PROVIDER_REGISTRY.get(provider);
       console.log(`
-${import_picocolors27.default.green("\u2713")} ${desc2?.displayName ?? provider} ${import_picocolors27.default.dim("detected on PATH")}`);
+${import_picocolors29.default.green("\u2713")} ${desc2?.displayName ?? provider} ${import_picocolors29.default.dim("detected on PATH")}`);
       console.log(
-        import_picocolors27.default.dim(
+        import_picocolors29.default.dim(
           "  Note: `investigate --ai` currently uses the Anthropic API for narrative.\n  Local-CLI narrative generation is recorded as your preference for future use."
         )
       );
@@ -76394,15 +77242,15 @@ ${import_picocolors27.default.green("\u2713")} ${desc2?.displayName ?? provider}
       });
     }
     console.log(`
-${import_picocolors27.default.green("\u2713")} ${import_picocolors27.default.bold("ai")} provider saved \u2192 ${import_picocolors27.default.dim(configPath)}`);
-    console.log(import_picocolors27.default.dim(`  provider: ${provider}`));
+${import_picocolors29.default.green("\u2713")} ${import_picocolors29.default.bold("ai")} provider saved \u2192 ${import_picocolors29.default.dim(configPath)}`);
+    console.log(import_picocolors29.default.dim(`  provider: ${provider}`));
     if (storedKey && secretsPathStr) {
-      console.log(import_picocolors27.default.dim(`  anthropic key: ${redactKey(storedKey)} \u2192 ${secretsPathStr} (gitignored)`));
+      console.log(import_picocolors29.default.dim(`  anthropic key: ${redactKey(storedKey)} \u2192 ${secretsPathStr} (gitignored)`));
     }
-    console.log(import_picocolors27.default.dim('  run: horus investigate "<hint>" --ai'));
+    console.log(import_picocolors29.default.dim('  run: horus investigate "<hint>" --ai'));
     return 0;
   } catch (err) {
-    console.error(import_picocolors27.default.red(err instanceof Error ? err.message : String(err)));
+    console.error(import_picocolors29.default.red(err instanceof Error ? err.message : String(err)));
     return 1;
   }
 }
@@ -76434,7 +77282,7 @@ async function runConnect(type, opts) {
   }
   if (!SUPPORTED.includes(type)) {
     console.error(
-      import_picocolors28.default.red(`Unknown connector type: ${type}`) + import_picocolors28.default.dim(`
+      import_picocolors30.default.red(`Unknown connector type: ${type}`) + import_picocolors30.default.dim(`
   supported: ${SUPPORTED.join(", ")}, ai`)
     );
     return 1;
@@ -76465,20 +77313,20 @@ async function runConnect(type, opts) {
       if (!probeResult.ok) {
         console.error(
           `
-${import_picocolors28.default.red(`\u2717 Could not reach ${connectorType}:`)} ${probeResult.detail}` + import_picocolors28.default.dim("\n  Fix the connection and retry, or pass --no-test to skip.")
+${import_picocolors30.default.red(`\u2717 Could not reach ${connectorType}:`)} ${probeResult.detail}` + import_picocolors30.default.dim("\n  Fix the connection and retry, or pass --no-test to skip.")
         );
         return 1;
       }
       console.log(
         `
-${import_picocolors28.default.green("\u2713")} ${connectorType} reachable ${import_picocolors28.default.dim(`(${probeResult.detail})`)}`
+${import_picocolors30.default.green("\u2713")} ${connectorType} reachable ${import_picocolors30.default.dim(`(${probeResult.detail})`)}`
       );
     }
     const hasLiteralCredentials = filled.url !== void 0 || filled.password !== void 0 || filled.username !== void 0;
     if (hasLiteralCredentials) {
       if (isGitTracked(configPath, root)) {
         console.error(
-          import_picocolors28.default.red(".horus/config.json is already tracked by Git.") + "\nStoring credentials here would expose them in the repository.\n" + import_picocolors28.default.dim(
+          import_picocolors30.default.red(".horus/config.json is already tracked by Git.") + "\nStoring credentials here would expose them in the repository.\n" + import_picocolors30.default.dim(
             "  Option A \u2014 remove from Git index then re-run:\n    git rm --cached .horus/config.json\n    horus connect " + type + " ...\n\n  Option B \u2014 keep credentials in the environment and reference them:\n    export ES_URL=https://...\n    export ES_USERNAME=...\n    export ES_PASSWORD=...\n  Then edit .horus/config.json manually to use urlEnv/usernameEnv/passwordEnv."
           )
         );
@@ -76488,18 +77336,18 @@ ${import_picocolors28.default.green("\u2713")} ${connectorType} reachable ${impo
     }
     patchLocalConnector(configPath, connectorType, patch, filled.env);
     console.log(
-      `${import_picocolors28.default.green("\u2713")} ${import_picocolors28.default.bold(connectorType)} connector saved \u2192 ${import_picocolors28.default.dim(configPath)}`
+      `${import_picocolors30.default.green("\u2713")} ${import_picocolors30.default.bold(connectorType)} connector saved \u2192 ${import_picocolors30.default.dim(configPath)}`
     );
     printSummary(connectorType, filled);
-    console.log(import_picocolors28.default.dim(`
+    console.log(import_picocolors30.default.dim(`
   run: horus investigate "<hint>"`));
     return 0;
   } catch (err) {
     if (err instanceof ExitPromptError) {
-      console.error(import_picocolors28.default.red("Cancelled."));
+      console.error(import_picocolors30.default.red("Cancelled."));
       return 1;
     }
-    console.error(import_picocolors28.default.red(err.message));
+    console.error(import_picocolors30.default.red(err.message));
     return 1;
   }
 }
@@ -76508,7 +77356,7 @@ async function fillInteractive(type, opts) {
   if (!needsInteraction) return opts;
   console.log(
     `
-${import_picocolors28.default.bold(`Connect ${type}`)} ${import_picocolors28.default.dim("(press Enter to skip optional fields)")}
+${import_picocolors30.default.bold(`Connect ${type}`)} ${import_picocolors30.default.dim("(press Enter to skip optional fields)")}
 `
   );
   const filled = { ...opts };
@@ -76563,7 +77411,7 @@ ${import_picocolors28.default.bold(`Connect ${type}`)} ${import_picocolors28.def
       break;
     case "redis": {
       console.log(
-        import_picocolors28.default.dim(
+        import_picocolors30.default.dim(
           "  Tip: embed credentials directly in the URL \u2014 redis://:password@host:6379\n       or enter the URL and password separately below."
         )
       );
@@ -76601,8 +77449,8 @@ function missingRequired(type, opts) {
 }
 function ask(label, placeholder = "", required = true) {
   return new Promise((resolve8) => {
-    const hint = placeholder ? import_picocolors28.default.dim(` (${placeholder})`) : "";
-    const suffix = required ? "" : import_picocolors28.default.dim(" [optional]");
+    const hint = placeholder ? import_picocolors30.default.dim(` (${placeholder})`) : "";
+    const suffix = required ? "" : import_picocolors30.default.dim(" [optional]");
     process.stdout.write(`  ${label}${suffix}${hint}: `);
     const rl = (0, import_node_readline.createInterface)({
       input: process.stdin,
@@ -76619,7 +77467,7 @@ function askPassword(label) {
   return new Promise((resolve8) => {
     const stdin = process.stdin;
     if (typeof stdin.setRawMode === "function") {
-      process.stdout.write(`  ${label}${import_picocolors28.default.dim(" [optional]")}: `);
+      process.stdout.write(`  ${label}${import_picocolors30.default.dim(" [optional]")}: `);
       stdin.setRawMode(true);
       stdin.resume();
       let value = "";
@@ -76719,15 +77567,15 @@ function describeProbe(p) {
   return `${p.keyCount} keys \xB7 ${p.suggestedRoles.join("/")}${examples ? ` \xB7 ${examples}` : ""}`;
 }
 async function discoverAndSelectDbs(url, bullmqPrefix) {
-  console.log(import_picocolors28.default.dim("\n  Scanning DBs 0-15 (read-only, sampled)\u2026"));
+  console.log(import_picocolors30.default.dim("\n  Scanning DBs 0-15 (read-only, sampled)\u2026"));
   const probes = await probeRedisDatabases(url, { bullmqPrefix });
   const nonEmpty = probes.filter((p) => p.reachable && p.keyCount > 0);
   if (nonEmpty.length === 0) {
-    console.log(import_picocolors28.default.dim("  No populated DBs found."));
+    console.log(import_picocolors30.default.dim("  No populated DBs found."));
     return [];
   }
   for (const p of nonEmpty) {
-    console.log(`  ${import_picocolors28.default.bold(`DB ${p.db}`)} ${import_picocolors28.default.dim("\xB7 " + describeProbe(p))}`);
+    console.log(`  ${import_picocolors30.default.bold(`DB ${p.db}`)} ${import_picocolors30.default.dim("\xB7 " + describeProbe(p))}`);
   }
   const byLabel = /* @__PURE__ */ new Map();
   const choices = nonEmpty.map((p) => {
@@ -76838,7 +77686,7 @@ function printSummary(type, opts) {
   } else if (opts.dashboard) {
     lines.push(`  dashboard:      ${opts.dashboard}`);
   }
-  if (lines.length > 0) console.log(import_picocolors28.default.dim(lines.join("\n")));
+  if (lines.length > 0) console.log(import_picocolors30.default.dim(lines.join("\n")));
 }
 function isGitTracked(filePath, cwd) {
   try {
@@ -76877,11 +77725,11 @@ async function askIndexSelection(indices) {
   const shown = indices.slice(0, MAX_DISPLAY);
   console.log("\n  Available Elasticsearch indexes/data streams:");
   shown.forEach((name, i) => {
-    console.log(`  ${import_picocolors28.default.dim(`[${i + 1}]`)} ${name}`);
+    console.log(`  ${import_picocolors30.default.dim(`[${i + 1}]`)} ${name}`);
   });
   if (indices.length > MAX_DISPLAY) {
     console.log(
-      import_picocolors28.default.dim(
+      import_picocolors30.default.dim(
         `  \u2026 and ${indices.length - MAX_DISPLAY} more (type a pattern manually to match all)`
       )
     );
@@ -76925,11 +77773,11 @@ async function askDashboardSelection(dashboards) {
   const shown = dashboards.slice(0, MAX_DISPLAY);
   console.log("\n  Available Grafana dashboards:");
   shown.forEach((d, i) => {
-    const folder = d.folderTitle ? import_picocolors28.default.dim(` (${d.folderTitle})`) : "";
-    console.log(`  ${import_picocolors28.default.dim(`[${i + 1}]`)} ${d.title}${folder}`);
+    const folder = d.folderTitle ? import_picocolors30.default.dim(` (${d.folderTitle})`) : "";
+    console.log(`  ${import_picocolors30.default.dim(`[${i + 1}]`)} ${d.title}${folder}`);
   });
   if (dashboards.length > MAX_DISPLAY) {
-    console.log(import_picocolors28.default.dim(`  \u2026 and ${dashboards.length - MAX_DISPLAY} more`));
+    console.log(import_picocolors30.default.dim(`  \u2026 and ${dashboards.length - MAX_DISPLAY} more`));
   }
   const input = (await ask(
     `  Select dashboards to use (e.g. 1,2 or Enter to type uid manually)`,
@@ -76980,12 +77828,12 @@ function redactUrl(raw) {
 // ../../packages/cli/src/commands/stop.ts
 init_cjs_shims();
 var import_node_child_process7 = require("child_process");
-var import_node_fs7 = require("fs");
+var import_node_fs9 = require("fs");
 var import_node_util4 = require("util");
-var import_node_path9 = require("path");
-var import_picocolors29 = __toESM(require_picocolors(), 1);
+var import_node_path11 = require("path");
+var import_picocolors31 = __toESM(require_picocolors(), 1);
 var execFileAsync = (0, import_node_util4.promisify)(import_node_child_process7.execFile);
-var unlinkAsync = (0, import_node_util4.promisify)(import_node_fs7.unlink);
+var unlinkAsync = (0, import_node_util4.promisify)(import_node_fs9.unlink);
 var SPAWNED_HOST_FILE2 = "spawned-host.json";
 var START_TIME_TOLERANCE_S = 60;
 var STOP_WAIT_MS = 5e3;
@@ -77000,30 +77848,30 @@ async function runStop(opts) {
     const root = findRepoRoot(cwd) ?? cwd;
     const hostUrl = readSourceHostUrl(root);
     if (!hostUrl) {
-      console.log(import_picocolors29.default.dim("No source-intelligence host found for this repo (.horus/source/host.json absent)."));
+      console.log(import_picocolors31.default.dim("No source-intelligence host found for this repo (.horus/source/host.json absent)."));
       return 0;
     }
     return await stopHost(root, hostUrl);
   } catch (err) {
-    console.error(import_picocolors29.default.red(err.message));
+    console.error(import_picocolors31.default.red(err.message));
     return 1;
   }
 }
 async function stopHost(root, hostUrl) {
   const alive = await isHostHealthy(hostUrl);
   if (!alive) {
-    console.log(import_picocolors29.default.dim(`Host ${hostUrl} is already stopped.`));
+    console.log(import_picocolors31.default.dim(`Host ${hostUrl} is already stopped.`));
     return 0;
   }
   const port = extractPort(hostUrl);
   if (port === null) {
-    console.error(import_picocolors29.default.red(`Cannot determine port from host URL: ${hostUrl}`));
+    console.error(import_picocolors31.default.red(`Cannot determine port from host URL: ${hostUrl}`));
     return 1;
   }
   const spawned = readSpawnedHost(root);
   if (spawned === null) {
     console.error(
-      import_picocolors29.default.red(
+      import_picocolors31.default.red(
         `No ownership record found (.horus/${SPAWNED_HOST_FILE2} absent). Horus will not stop a host it did not spawn.`
       )
     );
@@ -77031,12 +77879,12 @@ async function stopHost(root, hostUrl) {
   }
   const recordError = validateSpawnedRecord(spawned);
   if (recordError !== null) {
-    console.error(import_picocolors29.default.red(`Ownership record is malformed: ${recordError}. Aborting for safety.`));
+    console.error(import_picocolors31.default.red(`Ownership record is malformed: ${recordError}. Aborting for safety.`));
     return 1;
   }
   if (spawned.port !== port) {
     console.error(
-      import_picocolors29.default.red(
+      import_picocolors31.default.red(
         `Ownership record port (${spawned.port}) does not match host URL port (${port}). Record may be stale.`
       )
     );
@@ -77044,7 +77892,7 @@ async function stopHost(root, hostUrl) {
   }
   if (spawned.root !== root) {
     console.error(
-      import_picocolors29.default.red(
+      import_picocolors31.default.red(
         `Ownership record root (${spawned.root}) does not match resolved root (${root}). Record may be stale.`
       )
     );
@@ -77052,9 +77900,9 @@ async function stopHost(root, hostUrl) {
   }
   const info = await getProcessInfo(spawned.pid);
   if (info === null) {
-    console.log(import_picocolors29.default.dim(`Process pid ${spawned.pid} is no longer running \u2014 already stopped.`));
+    console.log(import_picocolors31.default.dim(`Process pid ${spawned.pid} is no longer running \u2014 already stopped.`));
     try {
-      await unlinkAsync((0, import_node_path9.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
+      await unlinkAsync((0, import_node_path11.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
     } catch {
     }
     return 0;
@@ -77065,7 +77913,7 @@ async function stopHost(root, hostUrl) {
   );
   if (!hostPortRe.test(info.args)) {
     console.error(
-      import_picocolors29.default.red(
+      import_picocolors31.default.red(
         `Pid ${spawned.pid} args do not match "horus-source host --port ${portStr}". Got: "${info.args.slice(0, 120)}". Aborting for safety.`
       )
     );
@@ -77074,12 +77922,12 @@ async function stopHost(root, hostUrl) {
   const startTs = new Date(spawned.startedAt).getTime();
   const recordedAgeS = Math.round((Date.now() - startTs) / 1e3);
   if (!Number.isFinite(info.etimeSeconds)) {
-    console.error(import_picocolors29.default.red(`Could not read elapsed time for pid ${spawned.pid}. Aborting for safety.`));
+    console.error(import_picocolors31.default.red(`Could not read elapsed time for pid ${spawned.pid}. Aborting for safety.`));
     return 1;
   }
   if (Math.abs(info.etimeSeconds - recordedAgeS) > START_TIME_TOLERANCE_S) {
     console.error(
-      import_picocolors29.default.red(
+      import_picocolors31.default.red(
         `Pid ${spawned.pid} age mismatch: record says ~${recordedAgeS}s, process reports ${info.etimeSeconds}s elapsed. Possible PID reuse \u2014 aborting for safety.`
       )
     );
@@ -77091,9 +77939,9 @@ async function stopHost(root, hostUrl) {
     signaled = true;
   } catch (err) {
     if (err.code === "ESRCH") {
-      console.log(import_picocolors29.default.dim(`Process pid ${spawned.pid} exited before signal \u2014 already stopped.`));
+      console.log(import_picocolors31.default.dim(`Process pid ${spawned.pid} exited before signal \u2014 already stopped.`));
     } else {
-      console.error(import_picocolors29.default.red(`Failed to signal pid ${spawned.pid}: ${err.message}`));
+      console.error(import_picocolors31.default.red(`Failed to signal pid ${spawned.pid}: ${err.message}`));
       return 1;
     }
   }
@@ -77109,18 +77957,18 @@ async function stopHost(root, hostUrl) {
     }
     if (!exited) {
       console.error(
-        import_picocolors29.default.red(
+        import_picocolors31.default.red(
           `Host pid ${spawned.pid} did not exit within ${STOP_WAIT_MS / 1e3}s after SIGTERM.`
         )
       );
       return 1;
     }
     console.log(
-      `${import_picocolors29.default.green("\u2713")} Stopped source-intelligence host ` + import_picocolors29.default.dim(`(pid ${spawned.pid}, port ${port})`) + ` for ${root}`
+      `${import_picocolors31.default.green("\u2713")} Stopped source-intelligence host ` + import_picocolors31.default.dim(`(pid ${spawned.pid}, port ${port})`) + ` for ${root}`
     );
   }
   try {
-    await unlinkAsync((0, import_node_path9.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
+    await unlinkAsync((0, import_node_path11.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
   } catch {
   }
   return 0;
@@ -77129,7 +77977,7 @@ async function stopAll() {
   const registry = readRegistry();
   const projects2 = Object.entries(registry.projects);
   if (projects2.length === 0) {
-    console.log(import_picocolors29.default.dim("No registered projects."));
+    console.log(import_picocolors31.default.dim("No registered projects."));
     return 0;
   }
   let stopped = 0;
@@ -77139,17 +77987,17 @@ async function stopAll() {
     if (!hostUrl) continue;
     const alive = await isHostHealthy(hostUrl);
     if (!alive) continue;
-    console.log(`  Stopping ${import_picocolors29.default.bold(name)} ${import_picocolors29.default.dim(`(${hostUrl})`)}`);
+    console.log(`  Stopping ${import_picocolors31.default.bold(name)} ${import_picocolors31.default.dim(`(${hostUrl})`)}`);
     const code = await stopHost(entry2.root, hostUrl);
     if (code === 0) stopped++;
     else failed++;
   }
   if (stopped === 0 && failed === 0) {
-    console.log(import_picocolors29.default.dim("No running source-intelligence hosts found."));
+    console.log(import_picocolors31.default.dim("No running source-intelligence hosts found."));
   } else {
     console.log(
       `
-Stopped ${stopped} host(s)${failed > 0 ? import_picocolors29.default.red(`, ${failed} failed`) : ""}.`
+Stopped ${stopped} host(s)${failed > 0 ? import_picocolors31.default.red(`, ${failed} failed`) : ""}.`
     );
   }
   return failed > 0 ? 1 : 0;
@@ -77201,12 +78049,12 @@ function extractPort(hostUrl) {
 
 // ../../packages/cli/src/commands/hosts.ts
 init_cjs_shims();
-var import_picocolors30 = __toESM(require_picocolors(), 1);
+var import_picocolors32 = __toESM(require_picocolors(), 1);
 async function runHosts() {
   const registry = readRegistry();
   const projects2 = Object.entries(registry.projects);
   if (projects2.length === 0) {
-    console.log(import_picocolors30.default.dim("No registered projects. Run `horus index` in a repo first."));
+    console.log(import_picocolors32.default.dim("No registered projects. Run `horus index` in a repo first."));
     return 0;
   }
   const rows = [];
@@ -77223,29 +78071,29 @@ async function runHosts() {
   });
   const anyHost = rows.some((r) => r.hostUrl !== null);
   if (!anyHost) {
-    console.log(import_picocolors30.default.dim("No source-intelligence hosts found. Run `horus index` to start one."));
+    console.log(import_picocolors32.default.dim("No source-intelligence hosts found. Run `horus index` to start one."));
     return 0;
   }
   console.log("");
   for (const row of rows) {
     if (row.hostUrl === null) continue;
-    const status = row.healthy ? import_picocolors30.default.green("\u25CF running") : import_picocolors30.default.red("\u25CF stopped");
+    const status = row.healthy ? import_picocolors32.default.green("\u25CF running") : import_picocolors32.default.red("\u25CF stopped");
     const port = extractPort2(row.hostUrl) ?? "?";
     console.log(
-      `  ${status}  ${import_picocolors30.default.bold(row.name.padEnd(24))} port ${String(port).padEnd(6)} ${import_picocolors30.default.dim(row.root)}`
+      `  ${status}  ${import_picocolors32.default.bold(row.name.padEnd(24))} port ${String(port).padEnd(6)} ${import_picocolors32.default.dim(row.root)}`
     );
   }
   console.log("");
   const noHost = rows.filter((r) => r.hostUrl === null);
   if (noHost.length > 0) {
     for (const row of noHost) {
-      console.log(`  ${import_picocolors30.default.dim("\u25CB no host")}   ${import_picocolors30.default.dim(row.name)}`);
+      console.log(`  ${import_picocolors32.default.dim("\u25CB no host")}   ${import_picocolors32.default.dim(row.name)}`);
     }
     console.log("");
   }
   const running = rows.filter((r) => r.healthy).length;
   console.log(
-    import_picocolors30.default.dim(
+    import_picocolors32.default.dim(
       `${running} running \xB7 horus stop to reap \xB7 horus stop --all to stop everything`
     )
   );
@@ -77262,12 +78110,12 @@ function extractPort2(hostUrl) {
 
 // ../../packages/cli/src/commands/doctor.ts
 init_cjs_shims();
-var import_picocolors31 = __toESM(require_picocolors(), 1);
+var import_picocolors33 = __toESM(require_picocolors(), 1);
 var DEFAULT_DB_URL4 = "postgresql://horus:horus@localhost:5433/horus";
 function mark2(status) {
-  if (status === "pass") return import_picocolors31.default.green("\u2713");
-  if (status === "warn") return import_picocolors31.default.yellow("~");
-  return import_picocolors31.default.red("\u2717");
+  if (status === "pass") return import_picocolors33.default.green("\u2713");
+  if (status === "warn") return import_picocolors33.default.yellow("~");
+  return import_picocolors33.default.red("\u2717");
 }
 async function runDoctor(opts) {
   const cwd = opts?.cwd ?? process.cwd();
@@ -77494,11 +78342,11 @@ async function runDoctor(opts) {
     write(JSON.stringify(output, null, 2));
     return hasFailure ? 1 : 0;
   }
-  write(import_picocolors31.default.bold("\nHorus readiness check\n"));
+  write(import_picocolors33.default.bold("\nHorus readiness check\n"));
   for (const check of checks) {
-    write(`  ${mark2(check.status)} ${import_picocolors31.default.bold(check.label.padEnd(26))}  ${import_picocolors31.default.dim(check.detail)}`);
+    write(`  ${mark2(check.status)} ${import_picocolors33.default.bold(check.label.padEnd(26))}  ${import_picocolors33.default.dim(check.detail)}`);
     if (check.next) {
-      write(`    ${import_picocolors31.default.dim("\u2192 " + check.next)}`);
+      write(`    ${import_picocolors33.default.dim("\u2192 " + check.next)}`);
     }
   }
   write("");
@@ -77508,16 +78356,16 @@ async function runDoctor(opts) {
 // ../../packages/cli/src/commands/providers-doctor.ts
 init_cjs_shims();
 var import_node_child_process8 = require("child_process");
-var import_picocolors32 = __toESM(require_picocolors(), 1);
+var import_picocolors34 = __toESM(require_picocolors(), 1);
 function statusMark(status) {
-  if (status === "ready") return import_picocolors32.default.green("\u2713");
-  if (status === "installed") return import_picocolors32.default.yellow("~");
-  return import_picocolors32.default.red("\u2717");
+  if (status === "ready") return import_picocolors34.default.green("\u2713");
+  if (status === "installed") return import_picocolors34.default.yellow("~");
+  return import_picocolors34.default.red("\u2717");
 }
 function statusLabel(status) {
-  if (status === "ready") return import_picocolors32.default.green("ready");
-  if (status === "installed") return import_picocolors32.default.yellow("installed (not configured)");
-  return import_picocolors32.default.dim("not found on PATH");
+  if (status === "ready") return import_picocolors34.default.green("ready");
+  if (status === "installed") return import_picocolors34.default.yellow("installed (not configured)");
+  return import_picocolors34.default.dim("not found on PATH");
 }
 function detectBinary(id) {
   const result = (0, import_node_child_process8.spawnSync)(id, ["--version"], { stdio: "pipe", timeout: 2e3 });
@@ -77534,7 +78382,7 @@ async function runProvidersDoctorCommand(opts) {
   const registry = opts?.registry ?? DEFAULT_LOCAL_PROVIDER_REGISTRY;
   const write = opts?.write ?? ((line2) => console.log(line2));
   const results = buildProviderResults(registry, opts?._detect);
-  write(import_picocolors32.default.bold("\nLocal AI providers\n"));
+  write(import_picocolors34.default.bold("\nLocal AI providers\n"));
   for (const result of results) {
     const descriptor = registry.get(result.id);
     const name = descriptor?.displayName ?? result.id;
@@ -77542,11 +78390,11 @@ async function runProvidersDoctorCommand(opts) {
       `  ${statusMark(result.status)} ${result.id.padEnd(8)}  ${name.padEnd(22)}  ${statusLabel(result.status)}`
     );
     if (result.status !== "ready" && result.detail) {
-      write(`    ${import_picocolors32.default.dim("\u2192 " + result.detail)}`);
+      write(`    ${import_picocolors34.default.dim("\u2192 " + result.detail)}`);
     }
   }
   write("");
-  write(import_picocolors32.default.bold("Cloud AI providers\n"));
+  write(import_picocolors34.default.bold("Cloud AI providers\n"));
   let source = null;
   if (opts?._anthropicKey !== void 0) {
     source = opts._anthropicKey ? "env" : null;
@@ -77561,18 +78409,18 @@ async function runProvidersDoctorCommand(opts) {
   }
   if (source === "config") {
     write(
-      `  ${import_picocolors32.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors32.default.green("configured (local .horus config)")}`
+      `  ${import_picocolors34.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors34.default.green("configured (local .horus config)")}`
     );
   } else if (source === "env") {
     write(
-      `  ${import_picocolors32.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors32.default.green("configured (ANTHROPIC_API_KEY env)")}`
+      `  ${import_picocolors34.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors34.default.green("configured (ANTHROPIC_API_KEY env)")}`
     );
   } else {
     write(
-      `  ${import_picocolors32.default.red("\u2717")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors32.default.dim("not configured")}`
+      `  ${import_picocolors34.default.red("\u2717")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors34.default.dim("not configured")}`
     );
     write(
-      `    ${import_picocolors32.default.dim("\u2192 run `horus connect ai` (or set ANTHROPIC_API_KEY) to enable `horus investigate --ai`")}`
+      `    ${import_picocolors34.default.dim("\u2192 run `horus connect ai` (or set ANTHROPIC_API_KEY) to enable `horus investigate --ai`")}`
     );
   }
   write("");
@@ -77581,9 +78429,9 @@ async function runProvidersDoctorCommand(opts) {
 
 // ../../packages/cli/src/commands/generate-config.ts
 init_cjs_shims();
-var import_node_fs8 = require("fs");
-var import_node_path10 = require("path");
-var import_picocolors33 = __toESM(require_picocolors(), 1);
+var import_node_fs10 = require("fs");
+var import_node_path12 = require("path");
+var import_picocolors35 = __toESM(require_picocolors(), 1);
 function configTemplate(name, repoPath) {
   return `export default {
   database: {
@@ -77631,39 +78479,39 @@ async function runGenerateConfig(opts) {
   const defaults = localConfigPath2 != null ? projectDefaults(localConfigPath2) : null;
   const hasLocalConfig = defaults != null;
   const defaultOut = hasLocalConfig ? "horus.config.example.js" : "horus.config.js";
-  const outPath = (0, import_node_path10.resolve)(cwd, opts.out ?? defaultOut);
+  const outPath = (0, import_node_path12.resolve)(cwd, opts.out ?? defaultOut);
   const name = opts.name ?? defaults?.name ?? "my-project";
   const repoPath = opts.repo ?? defaults?.repoPath ?? `/path/to/${name}`;
-  if ((0, import_node_fs8.existsSync)(outPath) && !opts.force) {
-    log(`${import_picocolors33.default.red("\u2717")} ${outPath} already exists`);
-    log(import_picocolors33.default.dim("  pass --force to overwrite"));
+  if ((0, import_node_fs10.existsSync)(outPath) && !opts.force) {
+    log(`${import_picocolors35.default.red("\u2717")} ${outPath} already exists`);
+    log(import_picocolors35.default.dim("  pass --force to overwrite"));
     return 1;
   }
   try {
-    (0, import_node_fs8.mkdirSync)((0, import_node_path10.dirname)(outPath), { recursive: true });
-    (0, import_node_fs8.writeFileSync)(outPath, configTemplate(name, repoPath), "utf8");
+    (0, import_node_fs10.mkdirSync)((0, import_node_path12.dirname)(outPath), { recursive: true });
+    (0, import_node_fs10.writeFileSync)(outPath, configTemplate(name, repoPath), "utf8");
   } catch (err) {
-    log(`${import_picocolors33.default.red("\u2717")} Could not write ${outPath}: ${err.message}`);
+    log(`${import_picocolors35.default.red("\u2717")} Could not write ${outPath}: ${err.message}`);
     return 1;
   }
-  log(`${import_picocolors33.default.green("\u2713")} Created ${outPath}`);
-  log(import_picocolors33.default.dim(`  project: ${name}`));
-  log(import_picocolors33.default.dim(`  repo:    ${repoPath}`));
+  log(`${import_picocolors35.default.green("\u2713")} Created ${outPath}`);
+  log(import_picocolors35.default.dim(`  project: ${name}`));
+  log(import_picocolors35.default.dim(`  repo:    ${repoPath}`));
   if (hasLocalConfig && localConfigPath2 != null) {
     log("");
-    log(import_picocolors33.default.yellow("Note:") + ` an initialized Horus project config exists at ${localConfigPath2}`);
+    log(import_picocolors35.default.yellow("Note:") + ` an initialized Horus project config exists at ${localConfigPath2}`);
     log("  \u2022 .horus/config.json  \u2014 project config used by `horus investigate` from this repo");
     log("  \u2022 horus.config.js     \u2014 standalone/global config used with `horus doctor --config <path>`");
-    log(import_picocolors33.default.dim(`  next:  review ${outPath} and copy/adapt it as needed`));
+    log(import_picocolors35.default.dim(`  next:  review ${outPath} and copy/adapt it as needed`));
   } else {
-    log(import_picocolors33.default.dim(`  next:    horus doctor --config ${outPath}`));
+    log(import_picocolors35.default.dim(`  next:    horus doctor --config ${outPath}`));
   }
   return 0;
 }
 
 // ../../packages/cli/src/commands/readiness.ts
 init_cjs_shims();
-var import_picocolors34 = __toESM(require_picocolors(), 1);
+var import_picocolors36 = __toESM(require_picocolors(), 1);
 var READINESS_AI_CONTRACT = `Provide a clearly separated AI readiness summary with:
 
 Overall assessment
@@ -77686,9 +78534,9 @@ Confidence / gaps
 - Which checks Horus could verify vs. which require manual confirmation`;
 var DEFAULT_DB_URL5 = "postgresql://horus:horus@localhost:5433/horus";
 function mark3(status) {
-  if (status === "pass") return import_picocolors34.default.green("\u2713");
-  if (status === "warn") return import_picocolors34.default.yellow("~");
-  return import_picocolors34.default.red("\u2717");
+  if (status === "pass") return import_picocolors36.default.green("\u2713");
+  if (status === "warn") return import_picocolors36.default.yellow("~");
+  return import_picocolors36.default.red("\u2717");
 }
 async function runReadiness(opts) {
   const cwd = opts?.cwd ?? process.cwd();
@@ -77843,20 +78691,20 @@ async function runReadiness(opts) {
   }
   const blockingChecks = checks.filter((c) => c.blocking);
   const optionalChecks = checks.filter((c) => !c.blocking);
-  write(import_picocolors34.default.bold("\nHorus release readiness\n"));
-  write(import_picocolors34.default.bold("  Blocking"));
+  write(import_picocolors36.default.bold("\nHorus release readiness\n"));
+  write(import_picocolors36.default.bold("  Blocking"));
   for (const check of blockingChecks) {
-    write(`    ${mark3(check.status)} ${import_picocolors34.default.bold(check.label.padEnd(22))}  ${import_picocolors34.default.dim(check.detail)}`);
+    write(`    ${mark3(check.status)} ${import_picocolors36.default.bold(check.label.padEnd(22))}  ${import_picocolors36.default.dim(check.detail)}`);
     if (check.next) {
-      write(`      ${import_picocolors34.default.dim("\u2192 " + check.next)}`);
+      write(`      ${import_picocolors36.default.dim("\u2192 " + check.next)}`);
     }
   }
   write("");
-  write(import_picocolors34.default.bold("  Optional"));
+  write(import_picocolors36.default.bold("  Optional"));
   for (const check of optionalChecks) {
-    write(`    ${mark3(check.status)} ${import_picocolors34.default.bold(check.label.padEnd(22))}  ${import_picocolors34.default.dim(check.detail)}`);
+    write(`    ${mark3(check.status)} ${import_picocolors36.default.bold(check.label.padEnd(22))}  ${import_picocolors36.default.dim(check.detail)}`);
     if (check.next) {
-      write(`      ${import_picocolors34.default.dim("\u2192 " + check.next)}`);
+      write(`      ${import_picocolors36.default.dim("\u2192 " + check.next)}`);
     }
   }
   write("");
@@ -77864,21 +78712,21 @@ async function runReadiness(opts) {
   const optionalWarns = optionalChecks.filter((c) => c.status === "warn").length;
   if (blockingFails.length === 0) {
     if (optionalWarns === 0) {
-      write(import_picocolors34.default.green("  Ready for demo/release."));
+      write(import_picocolors36.default.green("  Ready for demo/release."));
     } else {
       write(
-        import_picocolors34.default.yellow(
+        import_picocolors36.default.yellow(
           `  Ready for a basic demo. ${optionalWarns} optional item(s) not configured \u2014 investigation evidence will be limited.`
         )
       );
     }
   } else {
     write(
-      import_picocolors34.default.red(
+      import_picocolors36.default.red(
         `  Not ready. ${blockingFails.length} blocking item(s) must be resolved before demo/release.`
       )
     );
-    write(import_picocolors34.default.dim("  Re-run `horus readiness` after resolving the items above."));
+    write(import_picocolors36.default.dim("  Re-run `horus readiness` after resolving the items above."));
   }
   write("");
   if (opts?.ai) {
@@ -77893,7 +78741,7 @@ async function runReadiness(opts) {
     });
     console.log("\n" + renderInterpretation(result));
     if (!result.ok) {
-      console.error(import_picocolors34.default.yellow(`[ai] ${result.warning}`));
+      console.error(import_picocolors36.default.yellow(`[ai] ${result.warning}`));
     }
   }
   return blockingFails.length > 0 ? 1 : 0;
@@ -77901,46 +78749,79 @@ async function runReadiness(opts) {
 
 // ../../packages/cli/src/commands/skill.ts
 init_cjs_shims();
-var import_node_fs9 = require("fs");
-var import_node_path11 = require("path");
-var import_node_os2 = require("os");
-var import_picocolors35 = __toESM(require_picocolors(), 1);
+var import_node_fs11 = require("fs");
+var import_node_path13 = require("path");
+var import_node_os3 = require("os");
+var import_promises = require("readline/promises");
+var import_picocolors37 = __toESM(require_picocolors(), 1);
 var SUPPORTED_TARGETS = ["claude", "codex", "gemini", "cursor", "generic"];
 function isValidTarget(target) {
   return SUPPORTED_TARGETS.includes(target);
 }
+function getLegacyClaudeSkillPath(opts) {
+  const base2 = opts.global ? (0, import_node_os3.homedir)() : opts.cwd ?? process.cwd();
+  return (0, import_node_path13.join)(base2, ".claude", "skills", "horus.md");
+}
 function getSkillInstallPath(target, opts) {
-  const base2 = opts.global ? (0, import_node_os2.homedir)() : opts.cwd ?? process.cwd();
-  if (target === "claude") {
-    return (0, import_node_path11.join)(base2, ".claude", "skills", "horus.md");
+  const base2 = opts.global ? (0, import_node_os3.homedir)() : opts.cwd ?? process.cwd();
+  switch (target) {
+    case "claude":
+      return (0, import_node_path13.join)(base2, ".claude", "skills", "horus", "SKILL.md");
+    case "gemini":
+      return opts.global ? (0, import_node_path13.join)(base2, ".gemini", "GEMINI.md") : (0, import_node_path13.join)(base2, "GEMINI.md");
+    case "cursor":
+      return opts.global ? (0, import_node_path13.join)(base2, ".cursorrules") : (0, import_node_path13.join)(base2, ".cursor", "rules", "horus.mdc");
+    case "codex":
+      return opts.global ? (0, import_node_path13.join)(base2, ".codex", "AGENTS.md") : (0, import_node_path13.join)(base2, "AGENTS.md");
+    case "generic":
+    default:
+      return (0, import_node_path13.join)(base2, ".horus", "skills", `horus-${target}.md`);
   }
-  return (0, import_node_path11.join)(base2, ".horus", "skills", `horus-${target}.md`);
 }
-var BASE_SKILL = `# Horus Incident Investigation Skill
+var BASE_SKILL = `# Horus Grounded Investigation Skill
+
+When working in a repo with Horus configured, use Horus before guessing about production behavior, runtime state, ownership, recent changes, or codebase logic.
 
-When investigating a production issue in a repo with Horus configured, use Horus before guessing.
+Horus is a read-only evidence layer. It helps collect and connect source, runtime, metrics, queue, log, ownership, and change evidence. It does not mutate production systems.
 
 ## When to use Horus
 
 Use Horus when the user asks:
-- why something is broken, slow, or failing
-- about a production incident or outage
-- what changed recently
-- who owns a component or service
-- about blast radius or impact of a change
-- about queues, workers, Redis/BullMQ, logs, metrics, MongoDB state, or source paths
-- to verify a fix or check for regressions after a change
 
-## Getting started
+* why something is broken, slow, failing, flaky, or inconsistent
+* about a production incident, outage, regression, or degraded service
+* what changed recently
+* what caused a behavior change
+* who owns a component, service, queue, worker, route, or module
+* about blast radius or impact of a change
+* about queues, workers, Redis, BullMQ, NATS, logs, metrics, MongoDB state, or source paths
+* to verify a fix or check for regressions after a change
+* whether a feature behaves a certain way
+* where business logic lives
+* whether a condition, flag, enum, status, or branch is handled
+* whether code paths are connected or only coincidentally similar
+
+## Default first steps
+
+Start small. Do not shotgun every command.
 
 \`\`\`bash
 horus status
-horus explain <symbol-or-hint>
-horus investigate "<incident hint>"
+horus investigate "<incident, behavior, or debugging hint>"
+\`\`\`
+
+If Horus returns a saved investigation ID, use that ID for follow-up reasoning:
+
+\`\`\`bash
+horus ask <id> "what evidence is missing?"
+horus ask <id> "what evidence contradicts the likely root cause?"
+horus score <id>
 \`\`\`
 
 ## Runtime evidence
 
+Use runtime commands when the question depends on live or recent runtime behavior:
+
 \`\`\`bash
 horus logs [service]
 horus state
@@ -77948,9 +78829,21 @@ horus metrics "<hint>"
 horus queues --live
 \`\`\`
 
+Examples:
+
+\`\`\`bash
+horus logs api
+horus metrics "checkout latency"
+horus queues --live
+horus state
+\`\`\`
+
 ## Source reasoning
 
+Use source commands when the question depends on code behavior, ownership, blast radius, or recent code changes:
+
 \`\`\`bash
+horus explain <symbol-or-hint>
 horus blast-radius <symbol>
 horus owner <symbol>
 horus changes <base> [compare]
@@ -77958,9 +78851,61 @@ horus timeline
 horus what-changed
 \`\`\`
 
+Examples:
+
+\`\`\`bash
+horus explain "brandType MANUAL product auto draft"
+horus blast-radius ProductDraftService
+horus owner ProductDraftService
+horus what-changed
+\`\`\`
+
+## Logic and behavior questions
+
+For questions like:
+
+* "Do we auto draft products for brands where brandType===MANUAL?"
+* "Where is this status handled?"
+* "Does this worker retry failed jobs?"
+* "What happens when this integration sync fails?"
+* "Is this queue idempotent?"
+* "Does this change affect Shopify imports?"
+
+Prefer:
+
+\`\`\`bash
+horus explain "<symbol-or-behavior-hint>"
+horus investigate "<behavior question>"
+\`\`\`
+
+Then ask follow-ups against the saved investigation:
+
+\`\`\`bash
+horus ask <id> "what source evidence proves this behavior?"
+horus ask <id> "what source evidence disproves this behavior?"
+horus ask <id> "what evidence is missing?"
+\`\`\`
+
+Correct \`horus ask\` usage:
+
+\`\`\`bash
+horus ask <id> "do we auto draft products for brands where brandType===MANUAL?"
+\`\`\`
+
+Incorrect usage:
+
+\`\`\`bash
+horus ask "do we auto draft products for brands where brandType===MANUAL?"
+\`\`\`
+
+\`horus ask\` requires an investigation ID and a directive.
+
 ## Saved investigations
 
+Use saved investigations to continue from existing evidence instead of restarting randomly:
+
 \`\`\`bash
+horus investigations
 horus replay <id>
 horus ask <id> "what evidence is missing?"
 horus ask <id> "what evidence contradicts <hypothesis>?"
@@ -77968,67 +78913,224 @@ horus postmortem <id>
 horus score <id>
 \`\`\`
 
+## New codebase orientation
+
+When entering an unfamiliar area of the repo:
+
+\`\`\`bash
+horus doctor
+horus onboard [area]
+horus explain <symbol-or-hint>
+horus owner <symbol-or-hint>
+\`\`\`
+
+## Change and fix workflow
+
+For write or fix tasks:
+
+1. Use Horus before editing to understand evidence, ownership, and blast radius.
+2. Make code changes using normal filesystem tools.
+3. Use Horus after editing to validate blast radius and relevant runtime/source assumptions.
+4. Run normal project tests, typechecks, linters, or smoke checks as appropriate.
+
+Example:
+
+\`\`\`bash
+horus investigate "<bug or behavior>"
+horus blast-radius <symbol>
+# edit files normally
+horus blast-radius <changed-symbol>
+horus ask <id> "does the proposed fix address the collected evidence?"
+\`\`\`
+
+## Reporting format
+
+When answering after using Horus, report:
+
+* Conclusion
+* Horus evidence
+* Source locations
+* Missing, weak, stale, or ambient evidence
+* Conflicts between Horus evidence and filesystem/source inspection
+* Blast radius or risk
+* Recommended next action
+
 ## Rules
 
-- Treat Horus evidence as grounded but not infallible.
-- Mention when Horus evidence is missing, stale, ambient, or not structurally linked.
-- Do not invent runtime evidence Horus did not collect.
-- Prefer exact source locations from Horus over guesses.
-- If Horus output conflicts with filesystem or source inspection, report the discrepancy.
-- For write or fix tasks, use Horus to validate blast radius and rerun relevant checks after changes.
-- Horus is read-only evidence collection \u2014 never use Horus to mutate production systems.
-- Do not hallucinate evidence. If Horus returns nothing, say so explicitly.
+* Treat Horus evidence as grounded but not infallible.
+* Mention when Horus evidence is missing, stale, ambient, incomplete, or not structurally linked.
+* Do not invent runtime evidence Horus did not collect.
+* Prefer exact source locations from Horus over guesses.
+* If Horus output conflicts with filesystem or source inspection, report the discrepancy.
+* For write or fix tasks, use Horus to validate blast radius and rerun relevant checks after changes.
+* Horus is read-only evidence collection. Never use Horus to mutate production systems.
+* Do not hallucinate evidence. If Horus returns nothing, say so explicitly.
+* Do not use Horus as a substitute for tests, typechecks, or direct source inspection.
+* Do not overuse Horus for trivial syntax edits, formatting-only changes, or obvious local refactors unless blast radius matters.
 `;
-var CLAUDE_SUFFIX = `## Claude Code notes
+function skillFrontmatter(target) {
+  const description = "Use Horus as the grounded evidence layer for production incident investigation.";
+  switch (target) {
+    case "claude":
+      return `---
+name: horus
+description: ${description}
+---
 
-This skill is loaded automatically when present at \`.claude/skills/horus.md\`.
+`;
+    case "cursor":
+      return `---
+description: ${description}
+globs: *
+alwaysApply: true
+---
 
-Useful starting points:
-- \`horus investigations\` \u2014 list saved investigation IDs
-- \`horus doctor\` \u2014 check system health
-- \`horus onboard [area]\` \u2014 get oriented in a new codebase area
 `;
+    default:
+      return "";
+  }
+}
+var PROVIDER_NOTES = {
+  claude: `## Claude Code notes
+
+This skill is loaded automatically when present at:
+
+\`\`\`bash
+.claude/skills/horus/SKILL.md
+\`\`\`
+
+Useful starting points:
+
+\`\`\`bash
+horus investigations
+horus doctor
+horus onboard [area]
+horus status
+\`\`\`
+`,
+  gemini: `## Gemini CLI notes
+
+This context file is loaded automatically by Gemini CLI when present at:
+
+\`\`\`bash
+GEMINI.md
+\`\`\`
+
+Useful starting points:
+
+\`\`\`bash
+horus investigations
+horus doctor
+horus onboard [area]
+horus status
+\`\`\`
+`,
+  cursor: `## Cursor notes
+
+This rule is loaded automatically when present at \`.cursor/rules/horus.mdc\`.
+
+Useful starting points:
+
+\`\`\`bash
+horus investigations
+horus doctor
+horus onboard [area]
+horus status
+\`\`\`
+`,
+  codex: `## Codex notes
+
+This file is loaded automatically by Codex CLI as project instructions when present at \`AGENTS.md\`.
+
+Useful starting points:
+
+\`\`\`bash
+horus investigations
+horus doctor
+horus onboard [area]
+horus status
+\`\`\`
+`,
+  generic: ""
+};
 function generateSkillContent(target) {
-  if (target === "claude") {
-    return BASE_SKILL + "\n" + CLAUDE_SUFFIX;
+  return skillFrontmatter(target) + BASE_SKILL + "\n" + PROVIDER_NOTES[target];
+}
+async function confirm(message) {
+  if (!process.stdin.isTTY) {
+    return false;
+  }
+  const rl = (0, import_promises.createInterface)({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question(`${message} [y/N] `);
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
   }
-  return BASE_SKILL;
 }
 async function runSkillInstall(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors35.default.red("\u2717")} Unknown target: ${import_picocolors35.default.bold(target)}`);
-    log(import_picocolors35.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors37.default.red("\u2717")} Unknown target: ${import_picocolors37.default.bold(target)}`);
+    log(import_picocolors37.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   const outPath = getSkillInstallPath(target, { global: opts.global, cwd: opts.cwd });
   const content = generateSkillContent(target);
-  if ((0, import_node_fs9.existsSync)(outPath) && !opts.force) {
-    log(`${import_picocolors35.default.red("\u2717")} ${outPath} already exists`);
-    log(import_picocolors35.default.dim("  pass --force to overwrite"));
+  if (target === "claude") {
+    const legacyPath = getLegacyClaudeSkillPath({ global: opts.global, cwd: opts.cwd });
+    if ((0, import_node_fs11.existsSync)(legacyPath)) {
+      if (!opts.force) {
+        const confirmed = await (opts.confirm ?? confirm)(
+          `Found old flat skill file at ${legacyPath}. Replace it with the new directory layout?`
+        );
+        if (!confirmed) {
+          log(`${import_picocolors37.default.yellow("!")} Migration cancelled; existing skill left untouched.`);
+          log(import_picocolors37.default.dim("  Pass --force to replace without prompting."));
+          return 1;
+        }
+      }
+      try {
+        (0, import_node_fs11.rmSync)(legacyPath);
+        log(`${import_picocolors37.default.yellow("!")} Replaced old flat skill file: ${legacyPath}`);
+      } catch (err) {
+        log(`${import_picocolors37.default.red("\u2717")} Could not remove legacy skill file ${legacyPath}: ${err.message}`);
+        return 1;
+      }
+    }
+  }
+  if ((0, import_node_fs11.existsSync)(outPath) && !opts.force) {
+    log(`${import_picocolors37.default.red("\u2717")} ${outPath} already exists`);
+    log(import_picocolors37.default.dim("  pass --force to overwrite"));
     return 1;
   }
   try {
-    (0, import_node_fs9.mkdirSync)((0, import_node_path11.dirname)(outPath), { recursive: true });
-    (0, import_node_fs9.writeFileSync)(outPath, content, "utf8");
+    (0, import_node_fs11.mkdirSync)((0, import_node_path13.dirname)(outPath), { recursive: true });
+    (0, import_node_fs11.writeFileSync)(outPath, content, "utf8");
   } catch (err) {
-    log(`${import_picocolors35.default.red("\u2717")} Could not write ${outPath}: ${err.message}`);
+    log(`${import_picocolors37.default.red("\u2717")} Could not write ${outPath}: ${err.message}`);
     return 1;
   }
-  log(`${import_picocolors35.default.green("\u2713")} Horus skill installed \u2192 ${outPath}`);
+  log(`${import_picocolors37.default.green("\u2713")} Horus skill installed \u2192 ${outPath}`);
   if (target === "claude") {
-    log(import_picocolors35.default.dim("  Claude Code will load this skill automatically."));
-    log(import_picocolors35.default.dim("  Invoke it with: /horus"));
+    log(import_picocolors37.default.dim("  Claude Code will load this skill automatically."));
+    log(import_picocolors37.default.dim("  Invoke it with: /horus"));
+  } else if (target === "gemini") {
+    log(import_picocolors37.default.dim("  Gemini CLI will load this context file automatically."));
+  } else if (target === "cursor") {
+    log(import_picocolors37.default.dim("  Cursor will load this rule automatically."));
+  } else if (target === "codex") {
+    log(import_picocolors37.default.dim("  Codex CLI will load this file automatically."));
   } else {
-    log(import_picocolors35.default.dim(`  Copy or reference this file in your ${target} agent instructions.`));
+    log(import_picocolors37.default.dim(`  Copy or reference this file in your ${target} agent instructions.`));
   }
   return 0;
 }
 async function runSkillPrint(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors35.default.red("\u2717")} Unknown target: ${import_picocolors35.default.bold(target)}`);
-    log(import_picocolors35.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors37.default.red("\u2717")} Unknown target: ${import_picocolors37.default.bold(target)}`);
+    log(import_picocolors37.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   process.stdout.write(generateSkillContent(target));
@@ -78037,8 +79139,8 @@ async function runSkillPrint(target, opts) {
 async function runSkillPath(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors35.default.red("\u2717")} Unknown target: ${import_picocolors35.default.bold(target)}`);
-    log(import_picocolors35.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors37.default.red("\u2717")} Unknown target: ${import_picocolors37.default.bold(target)}`);
+    log(import_picocolors37.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   const outPath = getSkillInstallPath(target, { global: opts.global, cwd: opts.cwd });
@@ -78048,11 +79150,11 @@ async function runSkillPath(target, opts) {
 
 // ../../packages/cli/src/commands/update.ts
 init_cjs_shims();
-var import_node_fs10 = require("fs");
-var import_node_path12 = require("path");
-var import_node_os3 = require("os");
+var import_node_fs12 = require("fs");
+var import_node_path14 = require("path");
+var import_node_os4 = require("os");
 var import_node_crypto2 = require("crypto");
-var import_picocolors36 = __toESM(require_picocolors(), 1);
+var import_picocolors38 = __toESM(require_picocolors(), 1);
 var RELEASES_API = "https://api.github.com/repos/meritt-dev/horus/releases/latest";
 function parseVersion(v) {
   const m = v.replace(/^v/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -78083,7 +79185,7 @@ function resolveBinaryPath() {
   const raw = process.argv[1];
   if (!raw) throw new Error("Cannot determine binary path from process.argv[1]");
   try {
-    return (0, import_node_fs10.realpathSync)(raw);
+    return (0, import_node_fs12.realpathSync)(raw);
   } catch {
     return raw;
   }
@@ -78093,33 +79195,33 @@ async function runUpdate(opts) {
   const _fetch = opts._fetch ?? fetch;
   const currentVersion = opts._currentVersion ?? HORUS_VERSION;
   write(`
-${import_picocolors36.default.bold("Horus update")}
+${import_picocolors38.default.bold("Horus update")}
 `);
-  write(`  Current version: ${import_picocolors36.default.cyan(currentVersion)}`);
+  write(`  Current version: ${import_picocolors38.default.cyan(currentVersion)}`);
   let release;
   try {
     release = await fetchLatestRelease(_fetch);
   } catch (e) {
-    write(`  ${import_picocolors36.default.red("\u2717")} Could not reach GitHub: ${e.message}`);
+    write(`  ${import_picocolors38.default.red("\u2717")} Could not reach GitHub: ${e.message}`);
     return 1;
   }
   const latest = release.tag_name.replace(/^v/, "");
-  write(`  Latest version:  ${import_picocolors36.default.cyan(latest)}`);
+  write(`  Latest version:  ${import_picocolors38.default.cyan(latest)}`);
   const newer = isNewer(latest, currentVersion);
   if (opts.check) {
     if (newer) {
       write(`
-  ${import_picocolors36.default.yellow("\u2192")} ${import_picocolors36.default.bold(latest)} is available.`);
-      write(`    Run ${import_picocolors36.default.bold("horus update")} to upgrade.`);
+  ${import_picocolors38.default.yellow("\u2192")} ${import_picocolors38.default.bold(latest)} is available.`);
+      write(`    Run ${import_picocolors38.default.bold("horus update")} to upgrade.`);
     } else {
       write(`
-  ${import_picocolors36.default.green("\u2713")} Already on the latest version.`);
+  ${import_picocolors38.default.green("\u2713")} Already on the latest version.`);
     }
     return 0;
   }
   if (!newer && !opts.force) {
     write(`
-  ${import_picocolors36.default.green("\u2713")} Already on the latest version.`);
+  ${import_picocolors38.default.green("\u2713")} Already on the latest version.`);
     return 0;
   }
   const tag = release.tag_name;
@@ -78128,8 +79230,8 @@ ${import_picocolors36.default.bold("Horus update")}
   const binaryAsset = release.assets.find((a) => a.name === assetName);
   const checksumAsset = release.assets.find((a) => a.name === checksumName);
   if (!binaryAsset) {
-    write(`  ${import_picocolors36.default.red("\u2717")} Release ${tag} has no binary asset named '${assetName}'.`);
-    write(`    Fallback: ${import_picocolors36.default.dim("curl -fsSL https://horus.sh/install.sh | bash")}`);
+    write(`  ${import_picocolors38.default.red("\u2717")} Release ${tag} has no binary asset named '${assetName}'.`);
+    write(`    Fallback: ${import_picocolors38.default.dim("curl -fsSL https://horus.sh/install.sh | bash")}`);
     return 1;
   }
   write(`
@@ -78139,7 +79241,7 @@ ${import_picocolors36.default.bold("Horus update")}
     redirect: "follow"
   });
   if (!binRes.ok || !binRes.body) {
-    write(`  ${import_picocolors36.default.red("\u2717")} Download failed: ${binRes.status}`);
+    write(`  ${import_picocolors38.default.red("\u2717")} Download failed: ${binRes.status}`);
     return 1;
   }
   const binBuf = Buffer.from(await binRes.arrayBuffer());
@@ -78153,71 +79255,380 @@ ${import_picocolors36.default.bold("Horus update")}
       const expectedHash = csText.trim().split(/\s+/)[0];
       const actualHash = sha256hex(binBuf);
       if (expectedHash !== actualHash) {
-        write(`  ${import_picocolors36.default.red("\u2717")} Checksum mismatch \u2014 download may be corrupt.`);
+        write(`  ${import_picocolors38.default.red("\u2717")} Checksum mismatch \u2014 download may be corrupt.`);
         write(`    Expected: ${expectedHash}`);
         write(`    Got:      ${actualHash}`);
         return 1;
       }
-      write(`  ${import_picocolors36.default.green("\u2713")} Checksum verified.`);
+      write(`  ${import_picocolors38.default.green("\u2713")} Checksum verified.`);
     }
   }
   let binaryPath;
   try {
     binaryPath = resolveBinaryPath();
   } catch (e) {
-    write(`  ${import_picocolors36.default.red("\u2717")} ${e.message}`);
+    write(`  ${import_picocolors38.default.red("\u2717")} ${e.message}`);
     return 1;
   }
-  if (!(0, import_node_fs10.existsSync)(binaryPath)) {
-    write(`  ${import_picocolors36.default.red("\u2717")} Binary not found at ${binaryPath}`);
+  if (!(0, import_node_fs12.existsSync)(binaryPath)) {
+    write(`  ${import_picocolors38.default.red("\u2717")} Binary not found at ${binaryPath}`);
     return 1;
   }
-  const tmpPath = (0, import_node_path12.join)((0, import_node_os3.tmpdir)(), `horus-update-${tag}-${process.pid}`);
+  const tmpPath = (0, import_node_path14.join)((0, import_node_os4.tmpdir)(), `horus-update-${tag}-${process.pid}`);
   const backupPath = `${binaryPath}.bak`;
   try {
-    (0, import_node_fs10.writeFileSync)(tmpPath, binBuf, { mode: 493 });
+    (0, import_node_fs12.writeFileSync)(tmpPath, binBuf, { mode: 493 });
   } catch (e) {
-    write(`  ${import_picocolors36.default.red("\u2717")} Could not write to temp dir: ${e.message}`);
+    write(`  ${import_picocolors38.default.red("\u2717")} Could not write to temp dir: ${e.message}`);
     return 1;
   }
   try {
-    (0, import_node_fs10.renameSync)(binaryPath, backupPath);
+    (0, import_node_fs12.renameSync)(binaryPath, backupPath);
     try {
-      (0, import_node_fs10.renameSync)(tmpPath, binaryPath);
-      (0, import_node_fs10.chmodSync)(binaryPath, 493);
+      (0, import_node_fs12.renameSync)(tmpPath, binaryPath);
+      (0, import_node_fs12.chmodSync)(binaryPath, 493);
     } catch (e) {
       try {
-        (0, import_node_fs10.renameSync)(backupPath, binaryPath);
+        (0, import_node_fs12.renameSync)(backupPath, binaryPath);
       } catch {
       }
       throw e;
     }
     try {
-      (0, import_node_fs10.unlinkSync)(backupPath);
+      (0, import_node_fs12.unlinkSync)(backupPath);
     } catch {
     }
   } catch (e) {
     try {
-      (0, import_node_fs10.unlinkSync)(tmpPath);
+      (0, import_node_fs12.unlinkSync)(tmpPath);
     } catch {
     }
     const msg = e.message ?? String(e);
     const needsSudo = e.code === "EACCES" || e.code === "EPERM";
-    write(`  ${import_picocolors36.default.red("\u2717")} Could not replace binary at ${binaryPath}: ${msg}`);
+    write(`  ${import_picocolors38.default.red("\u2717")} Could not replace binary at ${binaryPath}: ${msg}`);
     if (needsSudo) {
       write(`
   Try with sudo:`);
       write(
-        `    ${import_picocolors36.default.dim(`sudo curl -fsSL https://github.com/meritt-dev/horus/releases/download/${tag}/${assetName} -o ${binaryPath} && sudo chmod +x ${binaryPath}`)}`
+        `    ${import_picocolors38.default.dim(`sudo curl -fsSL https://github.com/meritt-dev/horus/releases/download/${tag}/${assetName} -o ${binaryPath} && sudo chmod +x ${binaryPath}`)}`
       );
     }
     return 1;
   }
-  write(`  ${import_picocolors36.default.green("\u2713")} Updated: ${import_picocolors36.default.bold(currentVersion)} \u2192 ${import_picocolors36.default.bold(latest)}`);
-  write(`  ${import_picocolors36.default.dim(binaryPath)}`);
+  write(`  ${import_picocolors38.default.green("\u2713")} Updated: ${import_picocolors38.default.bold(currentVersion)} \u2192 ${import_picocolors38.default.bold(latest)}`);
+  write(`  ${import_picocolors38.default.dim(binaryPath)}`);
+  return 0;
+}
+
+// ../../packages/cli/src/commands/login.ts
+init_cjs_shims();
+var import_promises2 = require("readline/promises");
+var import_picocolors39 = __toESM(require_picocolors(), 1);
+async function promptToken() {
+  if (!process.stdin.isTTY) return null;
+  const rl = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question("Paste your Horus Cloud token: ");
+    return answer.trim() || null;
+  } finally {
+    rl.close();
+  }
+}
+async function runLogin(opts = {}) {
+  const apiBaseUrl = resolveApiBaseUrl(opts.apiUrl);
+  const token = opts.token ?? process.env.HORUS_TOKEN ?? await promptToken();
+  if (!token) {
+    console.error(
+      import_picocolors39.default.red("No token provided.") + "\n  Create one in the Horus Cloud dashboard, then run " + import_picocolors39.default.bold("horus login --token <token>") + " (or set HORUS_TOKEN)."
+    );
+    console.error(import_picocolors39.default.dim("  Browser device-flow login is coming once the cloud device endpoints land."));
+    return 1;
+  }
+  const client = new CloudClient(apiBaseUrl, token);
+  try {
+    const me = await client.me();
+    writeAuth({
+      apiBaseUrl,
+      token,
+      account: {
+        userId: me.user.id,
+        email: me.user.primaryEmail,
+        displayName: me.user.displayName ?? void 0
+      }
+    });
+    console.log(
+      `${import_picocolors39.default.green("\u2713")} Logged in as ${import_picocolors39.default.bold(me.user.primaryEmail)}. Run ${import_picocolors39.default.bold("horus cloud link")} to connect this repo.`
+    );
+    return 0;
+  } catch (err) {
+    if (err instanceof CloudOfflineError) {
+      console.error(import_picocolors39.default.red(err.message));
+      return 1;
+    }
+    if (err instanceof CloudError && err.status === 401) {
+      console.error(import_picocolors39.default.red("That token is not valid. Create a fresh one in the dashboard and try again."));
+      return 1;
+    }
+    console.error(import_picocolors39.default.red(`Login failed: ${err.message}`));
+    return 1;
+  }
+}
+async function runLogout() {
+  const auth = readAuth();
+  if (!auth) {
+    console.log(import_picocolors39.default.dim("Not logged in."));
+    return 0;
+  }
+  const session = authedClient();
+  if (session) {
+    try {
+      const prefix = auth.token.slice(0, 12);
+      const { tokens } = await session.client.listTokens();
+      const match = tokens.find((t) => t.prefix === prefix && !t.revokedAt);
+      if (match) await session.client.revokeToken(match.id);
+    } catch {
+    }
+  }
+  clearAuth();
+  console.log(`${import_picocolors39.default.green("\u2713")} Logged out. Local mode still works.`);
   return 0;
 }
 
+// ../../packages/cli/src/commands/cloud.ts
+init_cjs_shims();
+var import_picocolors40 = __toESM(require_picocolors(), 1);
+var import_promises3 = require("readline/promises");
+
+// ../../packages/cli/src/lib/cloud/git.ts
+init_cjs_shims();
+var import_node_child_process9 = require("child_process");
+function parseRepoName(remoteUrl) {
+  const cleaned = remoteUrl.trim().replace(/\.git$/, "");
+  const lastSegment = cleaned.split(/[/:]/).filter(Boolean).pop() ?? "";
+  return lastSegment;
+}
+function detectGitRemote(root) {
+  try {
+    const remoteUrl = (0, import_node_child_process9.execFileSync)("git", ["-C", root, "remote", "get-url", "origin"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!remoteUrl) return null;
+    return { remoteUrl, repoName: parseRepoName(remoteUrl) };
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/cli/src/commands/cloud.ts
+async function runCloudLink(opts = {}) {
+  const root = repoRootOrCwd(opts.cwd);
+  const session = authedClient();
+  if (!session) {
+    console.error(import_picocolors40.default.red(`Not logged in. Run ${import_picocolors40.default.bold("horus login")} first.`));
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = await session.client.context();
+  } catch (err) {
+    return reportCloudError(err);
+  }
+  const remote = detectGitRemote(root);
+  if (remote) console.log(import_picocolors40.default.dim(`Detected git remote: ${remote.remoteUrl}`));
+  let target = opts.project;
+  if (!target) {
+    const existing = readCloudConfig(root);
+    if (isCloudActive(existing) && existing?.organization && existing?.workspace && existing?.project) {
+      target = `${existing.organization.slug}/${existing.workspace.slug}/${existing.project.slug}`;
+    }
+  }
+  if (!target) {
+    target = await pickProjectInteractively(ctx);
+  }
+  if (!target) {
+    console.error(
+      import_picocolors40.default.red("No project specified.") + `
+  Pass ${import_picocolors40.default.bold("--project <org/workspace/project>")}, or run ${import_picocolors40.default.bold("horus context list")} to see options.`
+    );
+    return 1;
+  }
+  const resolved = resolveTriple(ctx, target);
+  if (!resolved) {
+    console.error(
+      import_picocolors40.default.red(`You don't have access to ${import_picocolors40.default.bold(target)}.`) + `
+  Run ${import_picocolors40.default.bold("horus context list")} to see available projects.`
+    );
+    return 1;
+  }
+  writeCloudConfig(root, {
+    context: "cloud",
+    organization: resolved.organization,
+    workspace: resolved.workspace,
+    project: resolved.project
+  });
+  console.log(
+    `${import_picocolors40.default.green("\u2713")} Linked. Context for this repo is now ${import_picocolors40.default.bold(target)} ${import_picocolors40.default.dim("(cloud)")}.`
+  );
+  console.log(
+    import_picocolors40.default.dim(`  Investigations here save to Horus Cloud. ${import_picocolors40.default.bold("horus context use local")} to switch back.`)
+  );
+  return 0;
+}
+async function runCloudUnlink(opts = {}) {
+  const root = repoRootOrCwd(opts.cwd);
+  const cfg = readCloudConfig(root);
+  if (!cfg || cfg.context !== "cloud") {
+    console.log(import_picocolors40.default.dim("This repo isn't linked to a cloud project."));
+    return 0;
+  }
+  clearCloudConfig(root);
+  console.log(`${import_picocolors40.default.green("\u2713")} Unlinked. This repo is back to ${import_picocolors40.default.bold("local")} mode.`);
+  return 0;
+}
+async function runCloudStatus(opts = {}) {
+  const root = repoRootOrCwd(opts.cwd);
+  const cfg = readCloudConfig(root);
+  const session = authedClient();
+  if (!isCloudActive(cfg) || !cfg?.project) {
+    console.log(`${import_picocolors40.default.bold("Context:")}  local`);
+    console.log(`${import_picocolors40.default.bold("Storage:")}  local Postgres (~/.horus)`);
+    console.log(
+      import_picocolors40.default.dim(`Tip:      ${import_picocolors40.default.bold("horus login")} then ${import_picocolors40.default.bold("horus cloud link")} to share investigations with your team.`)
+    );
+    return 0;
+  }
+  const triple = `${cfg.organization?.slug}/${cfg.workspace?.slug}/${cfg.project.slug}`;
+  console.log(`${import_picocolors40.default.bold("Context:")}     ${triple}   ${import_picocolors40.default.dim("(cloud)")}`);
+  let projectLine = `${cfg.project.slug}`;
+  let metaLines = [];
+  let account = import_picocolors40.default.dim("not logged in");
+  if (session) {
+    account = session.auth.account.email;
+    try {
+      const ctx = await session.client.context();
+      const project = ctx.projects.find((p) => p.id === cfg.project?.id);
+      const ws = ctx.workspaces.find((w) => w.id === project?.workspaceId);
+      const org = ctx.organizations.find((o) => o.id === project?.organizationId);
+      if (project && ws && org) {
+        projectLine = `${project.name}  \xB7  workspace ${ws.name}  \xB7  org ${org.name}`;
+        metaLines = syncMetaLines(project);
+      }
+    } catch {
+    }
+  }
+  console.log(`${import_picocolors40.default.bold("Project:")}     ${projectLine}`);
+  for (const line2 of metaLines) console.log(line2);
+  console.log(`${import_picocolors40.default.bold("Account:")}     ${account}`);
+  return 0;
+}
+async function runCloudSync(opts = {}) {
+  const root = repoRootOrCwd(opts.cwd);
+  const cfg = readCloudConfig(root);
+  if (!isCloudActive(cfg) || !cfg.project) {
+    console.error(
+      import_picocolors40.default.red("This repo isn't linked to a cloud project.") + ` Run ${import_picocolors40.default.bold("horus cloud link")} first.`
+    );
+    return 1;
+  }
+  const session = authedClient();
+  if (!session) {
+    console.error(import_picocolors40.default.red(`Not logged in. Run ${import_picocolors40.default.bold("horus login")} first.`));
+    return 1;
+  }
+  const { db, sql: sql2 } = createDb(await resolveDbUrl(opts.config));
+  const uploadable = [];
+  let skippedNoReport = 0;
+  try {
+    const rows = await listInvestigationsWithReports(db, opts.limit ?? 1e3);
+    for (const row of rows) {
+      if (row.report && typeof row.report === "object") {
+        uploadable.push({ id: row.id, title: row.title, report: row.report });
+      } else {
+        skippedNoReport++;
+      }
+    }
+  } finally {
+    await sql2.end();
+  }
+  const target = `${cfg.organization?.slug}/${cfg.workspace?.slug}/${cfg.project.slug}`;
+  if (uploadable.length === 0) {
+    console.log(
+      import_picocolors40.default.dim(
+        `No local investigations with reports to upload.` + (skippedNoReport ? ` (${skippedNoReport} without a report skipped)` : "")
+      )
+    );
+    return 0;
+  }
+  console.log(import_picocolors40.default.bold(`Will upload ${uploadable.length} investigation(s) to ${target} ${import_picocolors40.default.dim("(cloud)")}:`));
+  for (const c of uploadable.slice(0, 20)) {
+    console.log(`  ${import_picocolors40.default.dim(c.id.slice(0, 8))}  ${(c.title ?? "untitled").slice(0, 70)}`);
+  }
+  if (uploadable.length > 20) console.log(import_picocolors40.default.dim(`  \u2026and ${uploadable.length - 20} more`));
+  if (skippedNoReport) console.log(import_picocolors40.default.dim(`  (${skippedNoReport} local investigation(s) without a report will be skipped)`));
+  if (opts.dryRun) {
+    console.log(import_picocolors40.default.dim("Dry run \u2014 nothing uploaded. Re-run without --dry-run to upload."));
+    return 0;
+  }
+  if (!opts.yes) {
+    if (!process.stdin.isTTY) {
+      console.error(
+        import_picocolors40.default.yellow(`Re-run with ${import_picocolors40.default.bold("--yes")} to upload, or ${import_picocolors40.default.bold("--dry-run")} to preview only.`)
+      );
+      return 1;
+    }
+    const rl = (0, import_promises3.createInterface)({ input: process.stdin, output: process.stdout });
+    try {
+      const answer = (await rl.question(`Upload ${uploadable.length} investigation(s) to ${target}? (y/N) `)).trim().toLowerCase();
+      if (answer !== "y" && answer !== "yes") {
+        console.log(import_picocolors40.default.dim("Aborted. Nothing uploaded."));
+        return 0;
+      }
+    } finally {
+      rl.close();
+    }
+  }
+  let created = 0;
+  let failed = 0;
+  for (const c of uploadable) {
+    try {
+      const refs = await uploadInvestigationToCloud(session.client, cfg, c.report);
+      created++;
+      console.log(`${import_picocolors40.default.green("\u2713")} ${import_picocolors40.default.dim(c.id.slice(0, 8))} \u2192 ${refs.investigationId}`);
+    } catch (err) {
+      failed++;
+      console.error(`${import_picocolors40.default.red("\u2717")} ${import_picocolors40.default.dim(c.id.slice(0, 8))} ${err.message}`);
+    }
+  }
+  console.log("");
+  console.log(
+    `${import_picocolors40.default.bold("Sync complete:")} ${import_picocolors40.default.green(`${created} uploaded`)}, ${skippedNoReport} skipped, ` + (failed ? import_picocolors40.default.red(`${failed} failed`) : "0 failed") + "."
+  );
+  console.log(
+    import_picocolors40.default.dim("Local data was not modified. Re-running is safe \u2014 duplicates are deduped by idempotency key.")
+  );
+  return failed > 0 ? 1 : 0;
+}
+async function pickProjectInteractively(ctx) {
+  if (!process.stdin.isTTY) return void 0;
+  const labels = ctx.projects.map((p) => {
+    const ws = ctx.workspaces.find((w) => w.id === p.workspaceId);
+    const org = ctx.organizations.find((o) => o.id === p.organizationId);
+    return ws && org ? `${org.slug}/${ws.slug}/${p.slug}` : null;
+  }).filter((x) => !!x);
+  if (labels.length === 0) return void 0;
+  console.log("Select a project to link:");
+  labels.forEach((label, i) => console.log(`  ${i + 1}) ${label}`));
+  const rl = (0, import_promises3.createInterface)({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question("Number: ")).trim();
+    const idx = Number(answer) - 1;
+    return labels[idx];
+  } finally {
+    rl.close();
+  }
+}
+
 // ../../packages/cli/src/index.ts
 function buildProgram() {
   const program2 = new Command();
@@ -78511,7 +79922,7 @@ Examples:
   });
   program2.command("logs [service]").description(
     "Synthesize error evidence from logs (signatures, first/last, affected services); --raw for lines"
-  ).option("-c, --config <path>", "path to horus.config.ts").option("--name <name>", "registered project name (resolves via the registry)").option("--project <name>", "project name").option("--env <name>", "environment name (e.g. production)").option("--since <when>", "time window, e.g. 24h, 7d, or an ISO date").option("--level <level>", "minimum level (with --raw): trace|debug|info|warn|error|fatal").option("--grep <text>", "match text in the message").option("--raw", "dump individual log lines instead of synthesized evidence (error+ by default)").option("--all-levels", "with --raw: show all severity levels, not just error+").option("--limit <n>", "max records (with --raw)").option("--json", "output JSON").option("--ai", "append AI narration of error signatures (default mode only, not --raw or --json)").option("--ai-model <model>", "override the AI model (default: claude-opus-4-8)").action(
+  ).option("-c, --config <path>", "path to horus.config.ts").option("--name <name>", "registered project name (resolves via the registry)").option("--project <name>", "project name").option("--env <name>", "environment name (e.g. production)").option("--since <when>", "time window, e.g. 24h, 7d, or an ISO date").option("--level <level>", "minimum level (with --raw): trace|debug|info|warn|error|fatal").option("--grep <text>", "match text in the message").option("--raw", "dump individual log lines instead of synthesized evidence (error+ by default)").option("--all-levels", "with --raw: show all severity levels, not just error+").option("--group-by <field>", "aggregate error counts by a context field, e.g. context.brand_id").option("--limit <n>", "max records (with --raw)").option("--json", "output JSON").option("--ai", "append AI narration of error signatures (default mode only, not --raw or --json)").option("--ai-model <model>", "override the AI model (default: claude-opus-4-8)").action(
     async (service, opts) => {
       process.exitCode = await runLogs(service, opts);
     }
@@ -78535,11 +79946,11 @@ Examples:
     process.exitCode = await runSkillInstall(target, { force: opts.force, global: opts.global });
   }).addHelpText("after", `
 Targets:
-  claude   \u2192 .claude/skills/horus.md  (Claude Code \u2014 loaded automatically)
-  codex    \u2192 .horus/skills/horus-codex.md
-  gemini   \u2192 .horus/skills/horus-gemini.md
-  cursor   \u2192 .horus/skills/horus-cursor.md
-  generic  \u2192 .horus/skills/horus-generic.md
+  claude   \u2192 .claude/skills/horus/SKILL.md  (Claude Code skill)
+  codex    \u2192 AGENTS.md                     (Codex CLI project instructions)
+  gemini   \u2192 GEMINI.md                     (Gemini CLI project context)
+  cursor   \u2192 .cursor/rules/horus.mdc        (Cursor project rule)
+  generic  \u2192 .horus/skills/horus-generic.md (plain Markdown)
 
 Examples:
   horus skill install claude
@@ -78568,6 +79979,47 @@ Examples:
   horus update --check      # check without installing
   horus update --force      # re-download current version
 `);
+  program2.command("login").description("Log in to Horus Cloud; stores a CLI token in ~/.horus/auth.json (never in the repo)").option("--token <token>", "CLI token (or set HORUS_TOKEN); otherwise prompts when interactive").option("--api-url <url>", "Horus Cloud API base URL (or set HORUS_CLOUD_API_URL)").action(async (opts) => {
+    process.exitCode = await runLogin({ token: opts.token, apiUrl: opts.apiUrl });
+  }).addHelpText("after", `
+Examples:
+  horus login --token <token>
+  HORUS_TOKEN=<token> horus login`);
+  program2.command("logout").description("Revoke the current CLI token and clear local credentials").action(async () => {
+    process.exitCode = await runLogout();
+  });
+  const context = program2.command("context").description("Select where this repo stores investigations (local or a cloud project)");
+  context.command("list").description("List the local context and the cloud contexts you can use").action(async () => {
+    process.exitCode = await runContextList();
+  });
+  context.command("use <target>").description('Switch context: "local" or "<org>/<workspace>/<project>"').action(async (target) => {
+    process.exitCode = await runContextUse(target);
+  });
+  context.command("show").description("Show the active context and the selected project's sync metadata").action(async () => {
+    process.exitCode = await runContextShow();
+  });
+  const cloud = program2.command("cloud").description("Link this repo to a Horus Cloud project and inspect cloud state");
+  cloud.command("link").description("Link the current repo to a cloud project (Git-aware)").option("--project <org/workspace/project>", "target project (skips the interactive picker)").option("-y, --yes", "skip confirmation prompts").action(async (opts) => {
+    process.exitCode = await runCloudLink({ project: opts.project, yes: opts.yes });
+  });
+  cloud.command("unlink").description("Remove this repo's cloud link (returns to local mode)").action(async () => {
+    process.exitCode = await runCloudUnlink();
+  });
+  cloud.command("status").description("Show the active context, linked project, sync metadata, and auth state").action(async () => {
+    process.exitCode = await runCloudStatus();
+  });
+  cloud.command("sync").description("Upload existing local investigations to the linked cloud project").option("-c, --config <path>", "path to horus config for the local database").option("--limit <n>", "max local investigations to consider", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("-y, --yes", "skip the confirmation prompt").action(async (opts) => {
+    process.exitCode = await runCloudSync({
+      config: opts.config,
+      limit: opts.limit,
+      dryRun: opts.dryRun,
+      yes: opts.yes
+    });
+  }).addHelpText("after", `
+Examples:
+  horus cloud sync --dry-run     # preview what would upload
+  horus cloud sync               # confirm, then upload
+  horus cloud sync --yes         # upload without prompting`);
   return program2;
 }
 async function run(argv = process.argv) {