@merittdev/horus 0.15.1 → 0.16.0

package/dist/index.cjs

@@ -8167,27 +8167,27 @@ var require_bson = __commonJS({
         return new _Long(lowBits, highBits, unsigned);
       }
       static fromInt(value, unsigned) {
-        let obj, cachedObj, cache;
+        let obj, cachedObj, cache2;
         if (unsigned) {
           value >>>= 0;
-          if (cache = 0 <= value && value < 256) {
+          if (cache2 = 0 <= value && value < 256) {
             cachedObj = UINT_CACHE[value];
             if (cachedObj)
               return cachedObj;
           }
           obj = _Long.fromBits(value, (value | 0) < 0 ? -1 : 0, true);
-          if (cache)
+          if (cache2)
             UINT_CACHE[value] = obj;
           return obj;
         } else {
           value |= 0;
-          if (cache = -128 <= value && value < 128) {
+          if (cache2 = -128 <= value && value < 128) {
             cachedObj = INT_CACHE[value];
             if (cachedObj)
               return cachedObj;
           }
           obj = _Long.fromBits(value, value < 0 ? -1 : 0, false);
-          if (cache)
+          if (cache2)
             INT_CACHE[value] = obj;
           return obj;
         }
@@ -14538,10 +14538,10 @@ var require_utils = __commonJS({
     function squashError(_error) {
       return;
     }
-    var randomBytes = (size2) => {
+    var randomBytes2 = (size2) => {
       return Promise.resolve(crypto.getRandomValues(new Uint8Array(size2)));
     };
-    exports2.randomBytes = randomBytes;
+    exports2.randomBytes = randomBytes2;
     async function once(ee3, name2, options) {
       options?.signal?.throwIfAborted();
       const { promise, resolve: resolve13, reject } = promiseWithResolvers();
@@ -23435,9 +23435,9 @@ var require_client_metadata = __commonJS({
         throw new error_1.MongoInvalidArgumentError("Unable to include driverInfo name and version, metadata cannot exceed 512 bytes");
       }
       let runtimeInfo = getRuntimeInfo();
-      for (const { platform: platform2 = "" } of driverInfoList) {
-        if (platform2.length > 0) {
-          runtimeInfo = `${runtimeInfo}|${platform2}`;
+      for (const { platform: platform3 = "" } of driverInfoList) {
+        if (platform3.length > 0) {
+          runtimeInfo = `${runtimeInfo}|${platform3}`;
         }
       }
       if (!metadataDocument.ifItFitsItSits("platform", runtimeInfo)) {
@@ -34620,8 +34620,8 @@ var require_callback_workflow = __commonJS({
       /**
        * Instantiate the callback workflow.
        */
-      constructor(cache, callback) {
-        this.cache = cache;
+      constructor(cache2, callback) {
+        this.cache = cache2;
         this.callback = this.withLock(callback);
         this.lastExecutionTime = Date.now() - THROTTLE_MS;
       }
@@ -34731,8 +34731,8 @@ var require_automated_callback_workflow = __commonJS({
       /**
        * Instantiate the human callback workflow.
        */
-      constructor(cache, callback) {
-        super(cache, callback);
+      constructor(cache2, callback) {
+        super(cache2, callback);
       }
       /**
        * Execute the OIDC callback workflow.
@@ -35068,8 +35068,8 @@ var require_human_callback_workflow = __commonJS({
       /**
        * Instantiate the human callback workflow.
        */
-      constructor(cache, callback) {
-        super(cache, callback);
+      constructor(cache2, callback) {
+        super(cache2, callback);
       }
       /**
        * Execute the OIDC human callback workflow.
@@ -40701,7 +40701,7 @@ var require_utils4 = __commonJS({
     var nodeCrypto = require("crypto");
     module2.exports = {
       postgresMd5PasswordHash,
-      randomBytes,
+      randomBytes: randomBytes2,
       deriveKey,
       sha256: sha2562,
       hashByName,
@@ -40711,7 +40711,7 @@ var require_utils4 = __commonJS({
     var webCrypto = nodeCrypto.webcrypto || globalThis.crypto;
     var subtleCrypto = webCrypto.subtle;
     var textEncoder = new TextEncoder();
-    function randomBytes(length) {
+    function randomBytes2(length) {
       return webCrypto.getRandomValues(Buffer.alloc(length));
     }
     async function md52(string3) {
@@ -65880,7 +65880,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.15.1" : "dev";
+var HORUS_VERSION = true ? "0.16.0" : "dev";
 var PINNED_SOURCE_VERSION = "2.0.2";
 
 // ../../packages/core/src/evidence.ts
@@ -69976,47 +69976,375 @@ function createJiti(id, opts = {}) {
 }
 
 // ../../packages/core/src/config.ts
-var import_node_path2 = require("path");
-var import_node_fs2 = require("fs");
+var import_node_path3 = require("path");
+var import_node_fs3 = require("fs");
 var import_node_url = require("url");
 
 // ../../packages/core/src/discovery.ts
 init_cjs_shims();
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var import_node_os2 = require("os");
+
+// ../../packages/core/src/secrets.ts
+init_cjs_shims();
+var import_node_crypto = require("crypto");
+var import_node_child_process = require("child_process");
 var import_node_fs = require("fs");
-var import_node_path = require("path");
 var import_node_os = require("os");
+var import_node_path = require("path");
+var MasterKeyUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MasterKeyUnavailableError";
+  }
+};
+function isEncryptedSecret(v4) {
+  if (typeof v4 !== "object" || v4 === null) return false;
+  const o5 = v4;
+  return o5["v"] === 1 && o5["alg"] === "aes-256-gcm" && typeof o5["kid"] === "string" && typeof o5["iv"] === "string" && typeof o5["ct"] === "string" && typeof o5["tag"] === "string";
+}
+var ENV_VAR = "HORUS_SECRET_KEY";
+var KEY_SERVICE = "horus";
+var KEY_ACCOUNT = "master-key";
+var KEY_LABEL = "Horus connector-secret master key";
+var KDF_SALT = Buffer.from("horus.secret.kdf.v1");
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var CMD_TIMEOUT_MS = 4e3;
+var cachedKey = null;
+var cachedSource = null;
+function fingerprint(key) {
+  return (0, import_node_crypto.createHash)("sha256").update(key).digest("hex").slice(0, 16);
+}
+function keyFromEnvValue(value) {
+  const trimmed = value.trim();
+  try {
+    const decoded = Buffer.from(trimmed, "base64");
+    if (decoded.length === KEY_BYTES && decoded.toString("base64") === trimmed) {
+      return decoded;
+    }
+  } catch {
+  }
+  return (0, import_node_crypto.scryptSync)(trimmed, KDF_SALT, KEY_BYTES);
+}
+function keyringDir() {
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".horus", "keyring");
+}
+function keyFilePath() {
+  return (0, import_node_path.join)(keyringDir(), "master.key");
+}
+function dpapiBlobPath() {
+  return (0, import_node_path.join)(keyringDir(), "master.key.dpapi");
+}
+function macKeychainGet() {
+  try {
+    const out2 = (0, import_node_child_process.execFileSync)(
+      "security",
+      ["find-generic-password", "-s", KEY_SERVICE, "-a", KEY_ACCOUNT, "-w"],
+      { stdio: ["ignore", "pipe", "ignore"], timeout: CMD_TIMEOUT_MS }
+    );
+    const v4 = out2.toString("utf8").trim();
+    return v4.length > 0 ? v4 : null;
+  } catch {
+    return null;
+  }
+}
+function macKeychainSet(b64) {
+  try {
+    (0, import_node_child_process.execFileSync)(
+      "security",
+      [
+        "add-generic-password",
+        "-U",
+        // update if it already exists
+        "-s",
+        KEY_SERVICE,
+        "-a",
+        KEY_ACCOUNT,
+        "-l",
+        KEY_LABEL,
+        "-w",
+        b64
+      ],
+      { stdio: "ignore", timeout: CMD_TIMEOUT_MS }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxKeychainGet() {
+  try {
+    const out2 = (0, import_node_child_process.execFileSync)(
+      "secret-tool",
+      ["lookup", "service", KEY_SERVICE, "account", KEY_ACCOUNT],
+      { stdio: ["ignore", "pipe", "ignore"], timeout: CMD_TIMEOUT_MS }
+    );
+    const v4 = out2.toString("utf8").trim();
+    return v4.length > 0 ? v4 : null;
+  } catch {
+    return null;
+  }
+}
+function linuxKeychainSet(b64) {
+  try {
+    (0, import_node_child_process.execFileSync)(
+      "secret-tool",
+      ["store", "--label", KEY_LABEL, "service", KEY_SERVICE, "account", KEY_ACCOUNT],
+      { input: b64, stdio: ["pipe", "ignore", "ignore"], timeout: CMD_TIMEOUT_MS }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function powershellBin() {
+  for (const bin of ["powershell", "pwsh"]) {
+    try {
+      (0, import_node_child_process.execFileSync)(bin, ["-NoProfile", "-Command", "$PSVersionTable.PSVersion.Major"], {
+        stdio: "ignore",
+        timeout: CMD_TIMEOUT_MS
+      });
+      return bin;
+    } catch {
+    }
+  }
+  return null;
+}
+function winKeychainGet() {
+  const ps = powershellBin();
+  const blob = dpapiBlobPath();
+  if (!ps || !(0, import_node_fs.existsSync)(blob)) return null;
+  const script = `
+$enc = Get-Content -Path $env:HORUS_DPAPI_BLOB -Raw
+$sec = ConvertTo-SecureString $enc
+$ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec)
+try { [Console]::Out.Write([Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)) }
+finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr) }`;
+  try {
+    const out2 = (0, import_node_child_process.execFileSync)(ps, ["-NoProfile", "-NonInteractive", "-Command", script], {
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: CMD_TIMEOUT_MS,
+      env: { ...process.env, HORUS_DPAPI_BLOB: blob }
+    });
+    const v4 = out2.toString("utf8").trim();
+    return v4.length > 0 ? v4 : null;
+  } catch {
+    return null;
+  }
+}
+function winKeychainSet(b64) {
+  const ps = powershellBin();
+  if (!ps) return false;
+  (0, import_node_fs.mkdirSync)(keyringDir(), { recursive: true });
+  const blob = dpapiBlobPath();
+  const script = `
+$sec = ConvertTo-SecureString $env:HORUS_DPAPI_KEY -AsPlainText -Force
+$enc = ConvertFrom-SecureString $sec
+Set-Content -Path $env:HORUS_DPAPI_BLOB -Value $enc -NoNewline`;
+  try {
+    (0, import_node_child_process.execFileSync)(ps, ["-NoProfile", "-NonInteractive", "-Command", script], {
+      stdio: "ignore",
+      timeout: CMD_TIMEOUT_MS,
+      env: { ...process.env, HORUS_DPAPI_KEY: b64, HORUS_DPAPI_BLOB: blob }
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function osKeychainGet() {
+  switch ((0, import_node_os.platform)()) {
+    case "darwin":
+      return macKeychainGet();
+    case "linux":
+      return linuxKeychainGet();
+    case "win32":
+      return winKeychainGet();
+    default:
+      return null;
+  }
+}
+function osKeychainSet(b64) {
+  switch ((0, import_node_os.platform)()) {
+    case "darwin":
+      return macKeychainSet(b64);
+    case "linux":
+      return linuxKeychainSet(b64);
+    case "win32":
+      return winKeychainSet(b64);
+    default:
+      return false;
+  }
+}
+function keyFileGet() {
+  const p5 = keyFilePath();
+  if (!(0, import_node_fs.existsSync)(p5)) return null;
+  try {
+    const v4 = (0, import_node_fs.readFileSync)(p5, "utf8").trim();
+    return v4.length > 0 ? v4 : null;
+  } catch {
+    return null;
+  }
+}
+function keyFileSet(b64) {
+  try {
+    (0, import_node_fs.mkdirSync)(keyringDir(), { recursive: true });
+    const p5 = keyFilePath();
+    (0, import_node_fs.writeFileSync)(p5, b64 + "\n", { mode: 384 });
+    (0, import_node_fs.chmodSync)(p5, 384);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cache(key, source) {
+  cachedKey = key;
+  cachedSource = source;
+  return { key, source };
+}
+function resolveExistingKey() {
+  if (cachedKey && cachedSource) return { key: cachedKey, source: cachedSource };
+  const envVal = process.env[ENV_VAR];
+  if (envVal && envVal.trim().length > 0) {
+    return cache(keyFromEnvValue(envVal), "env");
+  }
+  const fromKeychain = osKeychainGet();
+  if (fromKeychain) {
+    const key = Buffer.from(fromKeychain, "base64");
+    if (key.length === KEY_BYTES) return cache(key, "keychain");
+  }
+  const fromFile = keyFileGet();
+  if (fromFile) {
+    const key = Buffer.from(fromFile, "base64");
+    if (key.length === KEY_BYTES) return cache(key, "file");
+  }
+  return null;
+}
+function getMasterKeyForRead() {
+  return resolveExistingKey()?.key ?? null;
+}
+function ensureMasterKey() {
+  const existing = resolveExistingKey();
+  if (existing) return { key: existing.key, source: existing.source };
+  const key = (0, import_node_crypto.randomBytes)(KEY_BYTES);
+  const b64 = key.toString("base64");
+  if (osKeychainSet(b64)) {
+    cache(key, "generated-keychain");
+    return { key, source: "generated-keychain" };
+  }
+  if (keyFileSet(b64)) {
+    cache(key, "generated-file");
+    return {
+      key,
+      source: "generated-file",
+      warning: `No OS keychain available \u2014 stored the master key at ${keyFilePath()} (mode 0600).
+It is in your home directory (never the repo), but is protected only by file permissions.
+For stronger isolation set ${ENV_VAR} to a passphrase, or run on a host with a keyring.`
+    };
+  }
+  throw new MasterKeyUnavailableError(
+    `Could not persist a master key (no keychain and ${keyFilePath()} is not writable). Set ${ENV_VAR} to a passphrase and retry.`
+  );
+}
+function masterKeyStatus() {
+  const existing = resolveExistingKey();
+  if (!existing) {
+    return {
+      available: false,
+      detail: `no master key yet \u2014 one is created on first \`horus connect\` (keychain, or ${ENV_VAR}).`
+    };
+  }
+  const detail = {
+    env: `${ENV_VAR} environment variable`,
+    keychain: osKeychainLabel(),
+    file: `key file ${keyFilePath()} (0600 fallback)`,
+    "generated-keychain": osKeychainLabel(),
+    "generated-file": `key file ${keyFilePath()} (0600 fallback)`
+  };
+  return { available: true, source: existing.source, detail: detail[existing.source] };
+}
+function osKeychainLabel() {
+  switch ((0, import_node_os.platform)()) {
+    case "darwin":
+      return "macOS Keychain";
+    case "linux":
+      return "libsecret keyring (secret-tool)";
+    case "win32":
+      return "Windows DPAPI (user-scoped)";
+    default:
+      return "OS keychain";
+  }
+}
+function encryptSecret(plaintext, key) {
+  const k3 = key ?? ensureMasterKey().key;
+  const iv = (0, import_node_crypto.randomBytes)(IV_BYTES);
+  const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", k3, iv);
+  const ct2 = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    v: 1,
+    alg: "aes-256-gcm",
+    kid: fingerprint(k3),
+    iv: iv.toString("base64"),
+    ct: ct2.toString("base64"),
+    tag: tag.toString("base64")
+  };
+}
+function decryptSecret(blob, key) {
+  const k3 = key ?? getMasterKeyForRead();
+  if (!k3) {
+    throw new MasterKeyUnavailableError(
+      `Cannot decrypt: master key not found (set ${ENV_VAR} or restore the OS keychain entry).`
+    );
+  }
+  if (blob.kid !== fingerprint(k3)) {
+    throw new Error(
+      `Encrypted secret was sealed with a different master key (key fingerprint mismatch). Re-run \`horus connect\` to re-encrypt, or restore the original key.`
+    );
+  }
+  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", k3, Buffer.from(blob.iv, "base64"));
+  decipher.setAuthTag(Buffer.from(blob.tag, "base64"));
+  return Buffer.concat([
+    decipher.update(Buffer.from(blob.ct, "base64")),
+    decipher.final()
+  ]).toString("utf8");
+}
+
+// ../../packages/core/src/discovery.ts
 var HORUS_DIR = ".horus";
 var LOCAL_CONFIG_FILE = "config.json";
 function localConfigPath(root) {
-  return (0, import_node_path.join)(root, HORUS_DIR, LOCAL_CONFIG_FILE);
+  return (0, import_node_path2.join)(root, HORUS_DIR, LOCAL_CONFIG_FILE);
 }
 function discoverLocalConfig(start2) {
-  let dir = (0, import_node_path.resolve)(start2);
+  let dir = (0, import_node_path2.resolve)(start2);
   for (; ; ) {
     const candidate = localConfigPath(dir);
-    if ((0, import_node_fs.existsSync)(candidate)) return candidate;
-    const parent = (0, import_node_path.dirname)(dir);
+    if ((0, import_node_fs2.existsSync)(candidate)) return candidate;
+    const parent = (0, import_node_path2.dirname)(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function findRepoRoot(start2) {
-  let dir = (0, import_node_path.resolve)(start2);
+  let dir = (0, import_node_path2.resolve)(start2);
   for (; ; ) {
-    if ((0, import_node_fs.existsSync)((0, import_node_path.join)(dir, ".git"))) return dir;
-    const parent = (0, import_node_path.dirname)(dir);
+    if ((0, import_node_fs2.existsSync)((0, import_node_path2.join)(dir, ".git"))) return dir;
+    const parent = (0, import_node_path2.dirname)(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function registryPath() {
-  return (0, import_node_path.join)((0, import_node_os.homedir)(), HORUS_DIR, "registry.json");
+  return (0, import_node_path2.join)((0, import_node_os2.homedir)(), HORUS_DIR, "registry.json");
 }
 function readRegistry() {
   const p5 = registryPath();
-  if (!(0, import_node_fs.existsSync)(p5)) return { projects: {} };
+  if (!(0, import_node_fs2.existsSync)(p5)) return { projects: {} };
   try {
-    const parsed = JSON.parse((0, import_node_fs.readFileSync)(p5, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs2.readFileSync)(p5, "utf8"));
     return { projects: parsed.projects ?? {} };
   } catch {
     return { projects: {} };
@@ -70024,8 +70352,8 @@ function readRegistry() {
 }
 function writeRegistry(reg) {
   const p5 = registryPath();
-  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(p5), { recursive: true });
-  (0, import_node_fs.writeFileSync)(p5, JSON.stringify(reg, null, 2) + "\n");
+  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(p5), { recursive: true });
+  (0, import_node_fs2.writeFileSync)(p5, JSON.stringify(reg, null, 2) + "\n");
 }
 function registerProject(name2, root, configPath) {
   const reg = readRegistry();
@@ -70036,72 +70364,97 @@ function lookupProject(name2) {
   return readRegistry().projects[name2] ?? null;
 }
 function writeLocalConfig(root, file) {
-  const dir = (0, import_node_path.join)(root, HORUS_DIR);
-  (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-  const p5 = (0, import_node_path.join)(dir, LOCAL_CONFIG_FILE);
-  (0, import_node_fs.writeFileSync)(p5, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
-  (0, import_node_fs.chmodSync)(p5, 384);
+  const dir = (0, import_node_path2.join)(root, HORUS_DIR);
+  (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  const p5 = (0, import_node_path2.join)(dir, LOCAL_CONFIG_FILE);
+  (0, import_node_fs2.writeFileSync)(p5, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  (0, import_node_fs2.chmodSync)(p5, 384);
   return p5;
 }
-function ensureCredentialGitignore(root) {
-  const dir = (0, import_node_path.join)(root, HORUS_DIR);
-  (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-  const gitignorePath = (0, import_node_path.join)(dir, ".gitignore");
-  const entry2 = "config.json";
-  if ((0, import_node_fs.existsSync)(gitignorePath)) {
-    const existing = (0, import_node_fs.readFileSync)(gitignorePath, "utf8");
-    if (existing.split("\n").some((l2) => l2.trim() === entry2)) return;
-    (0, import_node_fs.writeFileSync)(gitignorePath, existing.trimEnd() + "\n" + entry2 + "\n");
-  } else {
-    (0, import_node_fs.writeFileSync)(gitignorePath, entry2 + "\n");
-  }
-}
 function readLocalConfig(path) {
-  return JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
 }
 var LOCAL_SECRETS_FILE = "secrets.local.json";
 function localSecretsPath(root) {
-  return (0, import_node_path.join)(root, HORUS_DIR, LOCAL_SECRETS_FILE);
+  return (0, import_node_path2.join)(root, HORUS_DIR, LOCAL_SECRETS_FILE);
 }
 function readLocalSecrets(root) {
   const p5 = localSecretsPath(root);
-  if (!(0, import_node_fs.existsSync)(p5)) return {};
+  if (!(0, import_node_fs2.existsSync)(p5)) return {};
   try {
-    return JSON.parse((0, import_node_fs.readFileSync)(p5, "utf8"));
+    return JSON.parse((0, import_node_fs2.readFileSync)(p5, "utf8"));
   } catch {
     return {};
   }
 }
 function writeLocalSecrets(root, secrets) {
-  const dir = (0, import_node_path.join)(root, HORUS_DIR);
-  (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_node_path2.join)(root, HORUS_DIR);
+  (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
   const p5 = localSecretsPath(root);
-  (0, import_node_fs.writeFileSync)(p5, JSON.stringify(secrets, null, 2) + "\n", { mode: 384 });
-  (0, import_node_fs.chmodSync)(p5, 384);
-  const gitignorePath = (0, import_node_path.join)(dir, ".gitignore");
+  (0, import_node_fs2.writeFileSync)(p5, JSON.stringify(secrets, null, 2) + "\n", { mode: 384 });
+  (0, import_node_fs2.chmodSync)(p5, 384);
+  const gitignorePath = (0, import_node_path2.join)(dir, ".gitignore");
   const entry2 = LOCAL_SECRETS_FILE;
-  if ((0, import_node_fs.existsSync)(gitignorePath)) {
-    const existing = (0, import_node_fs.readFileSync)(gitignorePath, "utf8");
+  if ((0, import_node_fs2.existsSync)(gitignorePath)) {
+    const existing = (0, import_node_fs2.readFileSync)(gitignorePath, "utf8");
     if (!existing.split("\n").some((l2) => l2.trim() === entry2)) {
-      (0, import_node_fs.writeFileSync)(gitignorePath, existing.trimEnd() + "\n" + entry2 + "\n");
+      (0, import_node_fs2.writeFileSync)(gitignorePath, existing.trimEnd() + "\n" + entry2 + "\n");
     }
   } else {
-    (0, import_node_fs.writeFileSync)(gitignorePath, entry2 + "\n");
+    (0, import_node_fs2.writeFileSync)(gitignorePath, entry2 + "\n");
   }
   return p5;
 }
+function writeConnectorSecret(root, envName, connector, field, plaintext, key) {
+  const secrets = readLocalSecrets(root);
+  const blob = encryptSecret(plaintext, key);
+  const byEnv = secrets.connectors ??= {};
+  const byConnector = byEnv[envName] ??= {};
+  const byField = byConnector[connector] ??= {};
+  byField[field] = blob;
+  writeLocalSecrets(root, secrets);
+  ensureProjectGitignore(root);
+}
+function decryptConnectorSecrets(root) {
+  const out2 = { values: {}, warnings: [] };
+  const stored = readLocalSecrets(root).connectors;
+  if (!stored) return out2;
+  for (const [env, byConnector] of Object.entries(stored)) {
+    for (const [connector, byField] of Object.entries(byConnector)) {
+      for (const [field, blob] of Object.entries(byField)) {
+        if (!isEncryptedSecret(blob)) continue;
+        try {
+          const plain = decryptSecret(blob);
+          const e = out2.values[env] ??= {};
+          const c4 = e[connector] ??= {};
+          c4[field] = plain;
+        } catch (err2) {
+          const reason = err2 instanceof MasterKeyUnavailableError ? "no master key" : err2.message;
+          out2.warnings.push(`${env}/${connector}.${field}: ${reason}`);
+        }
+      }
+    }
+  }
+  return out2;
+}
+function isHorusGitignored(root) {
+  if (!(0, import_node_fs2.existsSync)((0, import_node_path2.join)(root, ".git"))) return true;
+  const gitignorePath = (0, import_node_path2.join)(root, ".gitignore");
+  if (!(0, import_node_fs2.existsSync)(gitignorePath)) return false;
+  return (0, import_node_fs2.readFileSync)(gitignorePath, "utf8").split("\n").map((l2) => l2.trim()).some((l2) => l2 === ".horus" || l2 === ".horus/" || l2 === "/.horus" || l2 === "/.horus/");
+}
 function ensureProjectGitignore(root) {
-  if (!(0, import_node_fs.existsSync)((0, import_node_path.join)(root, ".git"))) return;
-  const gitignorePath = (0, import_node_path.join)(root, ".gitignore");
+  if (!(0, import_node_fs2.existsSync)((0, import_node_path2.join)(root, ".git"))) return;
+  const gitignorePath = (0, import_node_path2.join)(root, ".gitignore");
   const entry2 = ".horus/";
-  if (!(0, import_node_fs.existsSync)(gitignorePath)) {
-    (0, import_node_fs.writeFileSync)(gitignorePath, entry2 + "\n");
+  if (!(0, import_node_fs2.existsSync)(gitignorePath)) {
+    (0, import_node_fs2.writeFileSync)(gitignorePath, entry2 + "\n");
     return;
   }
-  const existing = (0, import_node_fs.readFileSync)(gitignorePath, "utf8");
+  const existing = (0, import_node_fs2.readFileSync)(gitignorePath, "utf8");
   const alreadyIgnored = existing.split("\n").map((l2) => l2.trim()).some((l2) => l2 === ".horus" || l2 === ".horus/" || l2 === "/.horus" || l2 === "/.horus/");
   if (alreadyIgnored) return;
-  (0, import_node_fs.writeFileSync)(gitignorePath, existing.trimEnd() + "\n" + entry2 + "\n");
+  (0, import_node_fs2.writeFileSync)(gitignorePath, existing.trimEnd() + "\n" + entry2 + "\n");
 }
 function patchLocalConnector(configPath, connectorType, patch, envName) {
   const file = readLocalConfig(configPath);
@@ -70366,6 +70719,35 @@ function resolveAiSettings(config2) {
   if (ai?.anthropic?.model !== void 0) out2.model = ai.anthropic.model;
   return out2;
 }
+var CONNECTOR_SECRET_FIELDS = {
+  elasticsearch: ["username", "password"],
+  mongodb: ["url"],
+  postgres: ["url"],
+  sentry: ["authToken"],
+  axiom: ["token"],
+  grafana: ["username", "password"],
+  redis: ["url"]
+};
+function findPlaintextConnectorSecrets(project) {
+  const out2 = [];
+  const envs = project?.environments;
+  if (!Array.isArray(envs)) return out2;
+  for (const env of envs) {
+    const envName = env["name"] ?? "(unnamed)";
+    const connectors = env["connectors"];
+    if (!connectors || typeof connectors !== "object") continue;
+    for (const [connector, cfg] of Object.entries(connectors)) {
+      if (!cfg || typeof cfg !== "object") continue;
+      for (const field of CONNECTOR_SECRET_FIELDS[connector] ?? []) {
+        const val = cfg[field];
+        if (typeof val === "string" && val.length > 0) {
+          out2.push(`${envName}/${connector}.${field}`);
+        }
+      }
+    }
+  }
+  return out2;
+}
 function listEnvironments(config2) {
   const out2 = [];
   for (const p5 of config2.projects) {
@@ -70392,9 +70774,9 @@ function resolveEnvironment(config2, opts) {
     project = p5;
   } else {
     const cwd = opts?.cwd ?? process.cwd();
-    const root = findRepoRoot(cwd) ?? (0, import_node_path2.resolve)(cwd);
+    const root = findRepoRoot(cwd) ?? (0, import_node_path3.resolve)(cwd);
     const matches = config2.projects.filter(
-      (p5) => p5.repositories.some((r) => (0, import_node_path2.resolve)(r.path) === root)
+      (p5) => p5.repositories.some((r) => (0, import_node_path3.resolve)(r.path) === root)
     );
     const inferred = matches[0];
     if (matches.length === 1 && inferred !== void 0) {
@@ -70572,15 +70954,41 @@ ${details}`);
   }
   return parsed.data;
 }
+function hydrateConnectorSecrets(project, root) {
+  const decrypted = decryptConnectorSecrets(root);
+  for (const w4 of decrypted.warnings) {
+    process.stderr.write(`horus: skipped encrypted connector secret (${w4})
+`);
+  }
+  if (Object.keys(decrypted.values).length === 0) return;
+  const envs = project?.environments;
+  if (!Array.isArray(envs)) return;
+  for (const env of envs) {
+    const envName = env["name"];
+    if (!envName) continue;
+    const byConnector = decrypted.values[envName];
+    if (!byConnector) continue;
+    const connectors = env["connectors"];
+    if (!connectors || typeof connectors !== "object") continue;
+    for (const [connector, fields] of Object.entries(byConnector)) {
+      const target = connectors[connector];
+      if (!target || typeof target !== "object") continue;
+      for (const [field, value] of Object.entries(fields)) {
+        target[field] = value;
+      }
+    }
+  }
+}
 async function loadConfigFile(target) {
   if (target.endsWith(".json")) {
     const file = readLocalConfig(target);
-    const root = (0, import_node_path2.dirname)((0, import_node_path2.dirname)(target));
+    const root = (0, import_node_path3.dirname)((0, import_node_path3.dirname)(target));
     const secrets = readLocalSecrets(root);
     let ai = file.ai;
     if (secrets.anthropic?.apiKey) {
       ai = { ...ai ?? {}, anthropic: { ...ai?.anthropic ?? {}, apiKey: secrets.anthropic.apiKey } };
     }
+    hydrateConnectorSecrets(file.project, root);
     const raw = {
       projects: file.project ? [file.project] : [],
       database: file.database ?? {
@@ -70622,7 +71030,7 @@ async function loadConfig(configPath, opts) {
   const cwd = opts?.cwd ?? process.cwd();
   let target;
   if (configPath) {
-    target = (0, import_node_path2.resolve)(configPath);
+    target = (0, import_node_path3.resolve)(configPath);
   } else if (opts?.name) {
     const entry2 = lookupProject(opts.name);
     if (entry2 === null) {
@@ -70636,16 +71044,16 @@ async function loadConfig(configPath, opts) {
     if (discovered) {
       target = discovered;
     } else if (process.env["HORUS_CONFIG"]) {
-      target = (0, import_node_path2.resolve)(process.env["HORUS_CONFIG"]);
+      target = (0, import_node_path3.resolve)(process.env["HORUS_CONFIG"]);
     } else {
-      const jsPath = (0, import_node_path2.resolve)(cwd, "config/horus.config.js");
-      const tsPath = (0, import_node_path2.resolve)(cwd, "config/horus.config.ts");
-      if (!(0, import_node_fs2.existsSync)(jsPath) && !(0, import_node_fs2.existsSync)(tsPath)) {
+      const jsPath = (0, import_node_path3.resolve)(cwd, "config/horus.config.js");
+      const tsPath = (0, import_node_path3.resolve)(cwd, "config/horus.config.ts");
+      if (!(0, import_node_fs3.existsSync)(jsPath) && !(0, import_node_fs3.existsSync)(tsPath)) {
         throw new Error(
           `No Horus config found for ${cwd}. Run \`horus index\` in this repo to set it up, or pass --config <path> / --name <project>.`
         );
       }
-      target = (0, import_node_fs2.existsSync)(jsPath) ? jsPath : tsPath;
+      target = (0, import_node_fs3.existsSync)(jsPath) ? jsPath : tsPath;
     }
   }
   return loadConfigFile(target);
@@ -70653,11 +71061,11 @@ async function loadConfig(configPath, opts) {
 
 // ../../packages/core/src/git.ts
 init_cjs_shims();
-var import_node_child_process = require("child_process");
+var import_node_child_process2 = require("child_process");
 function collectLocalChanges(opts) {
   const cwd = opts?.cwd ?? process.cwd();
   const baseRef = opts?.baseRef ?? "HEAD~1";
-  const gitCheck = (0, import_node_child_process.spawnSync)("git", ["rev-parse", "--git-dir"], {
+  const gitCheck = (0, import_node_child_process2.spawnSync)("git", ["rev-parse", "--git-dir"], {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -70666,14 +71074,14 @@ function collectLocalChanges(opts) {
     return { kind: "no-git-repo", cwd };
   }
   const changedFiles = parseDiff(
-    (0, import_node_child_process.spawnSync)("git", ["diff", "--name-status", `${baseRef}..HEAD`], {
+    (0, import_node_child_process2.spawnSync)("git", ["diff", "--name-status", `${baseRef}..HEAD`], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).stdout ?? ""
   );
   const commits = parseLog(
-    (0, import_node_child_process.spawnSync)("git", ["log", "--oneline", `${baseRef}..HEAD`], {
+    (0, import_node_child_process2.spawnSync)("git", ["log", "--oneline", `${baseRef}..HEAD`], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -70682,7 +71090,7 @@ function collectLocalChanges(opts) {
   return { kind: "local-changes", baseRef, changedFiles, commits };
 }
 function runGit(args2, cwd) {
-  const res = (0, import_node_child_process.spawnSync)("git", args2, {
+  const res = (0, import_node_child_process2.spawnSync)("git", args2, {
     cwd: cwd ?? process.cwd(),
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -70698,7 +71106,7 @@ function getCurrentBranch(cwd) {
   return runGit(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
 }
 function isWorkingTreeDirty(cwd) {
-  const res = (0, import_node_child_process.spawnSync)("git", ["status", "--porcelain"], {
+  const res = (0, import_node_child_process2.spawnSync)("git", ["status", "--porcelain"], {
     cwd: cwd ?? process.cwd(),
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -70833,18 +71241,18 @@ function redactOrDrop(input) {
 
 // ../../packages/cli/src/lib/update-notifier.ts
 init_cjs_shims();
-var import_node_fs5 = require("fs");
-var import_node_path5 = require("path");
-var import_node_os3 = require("os");
+var import_node_fs6 = require("fs");
+var import_node_path6 = require("path");
+var import_node_os4 = require("os");
 var import_picocolors2 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/commands/update.ts
 init_cjs_shims();
-var import_node_fs4 = require("fs");
-var import_node_path4 = require("path");
-var import_node_os2 = require("os");
-var import_node_crypto = require("crypto");
-var import_node_child_process4 = require("child_process");
+var import_node_fs5 = require("fs");
+var import_node_path5 = require("path");
+var import_node_os3 = require("os");
+var import_node_crypto2 = require("crypto");
+var import_node_child_process5 = require("child_process");
 var import_node_util3 = require("util");
 var import_picocolors = __toESM(require_picocolors(), 1);
 
@@ -71082,12 +71490,12 @@ var SourceHttpClient = class {
 
 // ../../packages/connectors/src/source/lifecycle.ts
 init_cjs_shims();
-var import_node_child_process2 = require("child_process");
+var import_node_child_process3 = require("child_process");
 var import_node_util = require("util");
-var import_node_fs3 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs4 = require("fs");
+var import_node_path4 = require("path");
 var import_node_net = require("net");
-var exec = (0, import_node_util.promisify)(import_node_child_process2.execFile);
+var exec = (0, import_node_util.promisify)(import_node_child_process3.execFile);
 var SOURCE_BINARY = "horus-source";
 async function resolveSourceBin() {
   try {
@@ -71129,12 +71537,12 @@ async function assertSourceVersionPinned() {
   }
 }
 function isAnalyzed(root) {
-  return (0, import_node_fs3.existsSync)((0, import_node_path3.join)(root, ".horus", "source"));
+  return (0, import_node_fs4.existsSync)((0, import_node_path4.join)(root, ".horus", "source"));
 }
 var CURRENT_STORE_BACKEND = (process.env["HORUS_SOURCE_STORAGE_BACKEND"] ?? "sqlite").trim().toLowerCase();
 function readSourceMeta(root) {
   try {
-    const raw = (0, import_node_fs3.readFileSync)((0, import_node_path3.join)(root, ".horus", "source", "meta.json"), "utf8");
+    const raw = (0, import_node_fs4.readFileSync)((0, import_node_path4.join)(root, ".horus", "source", "meta.json"), "utf8");
     const j3 = JSON.parse(raw);
     const stats = j3["stats"] ?? void 0;
     return {
@@ -71154,7 +71562,7 @@ function metaHasEmbeddings(meta) {
 }
 function indexNeedsReanalyze(root) {
   if (!isAnalyzed(root)) return null;
-  if (CURRENT_STORE_BACKEND !== "kuzu" && (0, import_node_fs3.existsSync)((0, import_node_path3.join)(root, ".horus", "source", "kuzu"))) {
+  if (CURRENT_STORE_BACKEND !== "kuzu" && (0, import_node_fs4.existsSync)((0, import_node_path4.join)(root, ".horus", "source", "kuzu"))) {
     return "legacy K\xF9zuDB store present";
   }
   const meta = readSourceMeta(root);
@@ -71188,20 +71596,20 @@ async function analyzeRepo(root) {
   }
 }
 function readSourceHostUrl(root) {
-  const p5 = (0, import_node_path3.join)(root, ".horus", "source", "host.json");
-  if (!(0, import_node_fs3.existsSync)(p5)) return null;
+  const p5 = (0, import_node_path4.join)(root, ".horus", "source", "host.json");
+  if (!(0, import_node_fs4.existsSync)(p5)) return null;
   try {
-    const j3 = JSON.parse((0, import_node_fs3.readFileSync)(p5, "utf8"));
+    const j3 = JSON.parse((0, import_node_fs4.readFileSync)(p5, "utf8"));
     return typeof j3.host_url === "string" ? j3.host_url : null;
   } catch {
     return null;
   }
 }
 function readSourceHostPid(root) {
-  const p5 = (0, import_node_path3.join)(root, ".horus", "source", "host.json");
-  if (!(0, import_node_fs3.existsSync)(p5)) return null;
+  const p5 = (0, import_node_path4.join)(root, ".horus", "source", "host.json");
+  if (!(0, import_node_fs4.existsSync)(p5)) return null;
   try {
-    const j3 = JSON.parse((0, import_node_fs3.readFileSync)(p5, "utf8"));
+    const j3 = JSON.parse((0, import_node_fs4.readFileSync)(p5, "utf8"));
     if (typeof j3.pid !== "number" || !Number.isInteger(j3.pid) || j3.pid <= 0) return null;
     return {
       pid: j3.pid,
@@ -71250,19 +71658,19 @@ async function findFreePort(start2 = 8420, end = 8520) {
 }
 var SPAWNED_HOST_FILE = "spawned-host.json";
 function readSpawnedHost(root) {
-  const p5 = (0, import_node_path3.join)(root, ".horus", SPAWNED_HOST_FILE);
-  if (!(0, import_node_fs3.existsSync)(p5)) return null;
+  const p5 = (0, import_node_path4.join)(root, ".horus", SPAWNED_HOST_FILE);
+  if (!(0, import_node_fs4.existsSync)(p5)) return null;
   try {
-    return JSON.parse((0, import_node_fs3.readFileSync)(p5, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(p5, "utf8"));
   } catch {
     return null;
   }
 }
 function startHost(root, port) {
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.join)(root, ".horus"), { recursive: true });
-  const logPath = (0, import_node_path3.join)(root, ".horus", "source-host.log");
-  const fd = (0, import_node_fs3.openSync)(logPath, "a");
-  const child = (0, import_node_child_process2.spawn)(SOURCE_BINARY, ["host", "--port", String(port)], {
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.join)(root, ".horus"), { recursive: true });
+  const logPath = (0, import_node_path4.join)(root, ".horus", "source-host.log");
+  const fd = (0, import_node_fs4.openSync)(logPath, "a");
+  const child = (0, import_node_child_process3.spawn)(SOURCE_BINARY, ["host", "--port", String(port)], {
     cwd: root,
     detached: true,
     stdio: ["ignore", fd, fd]
@@ -71281,14 +71689,14 @@ function startHost(root, port) {
       root,
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    (0, import_node_fs3.writeFileSync)((0, import_node_path3.join)(root, ".horus", SPAWNED_HOST_FILE), JSON.stringify(record2, null, 2) + "\n");
+    (0, import_node_fs4.writeFileSync)((0, import_node_path4.join)(root, ".horus", SPAWNED_HOST_FILE), JSON.stringify(record2, null, 2) + "\n");
   }
   child.unref();
 }
 function removeSpawnedHostRecord(root) {
-  const p5 = (0, import_node_path3.join)(root, ".horus", SPAWNED_HOST_FILE);
+  const p5 = (0, import_node_path4.join)(root, ".horus", SPAWNED_HOST_FILE);
   try {
-    (0, import_node_fs3.unlinkSync)(p5);
+    (0, import_node_fs4.unlinkSync)(p5);
   } catch {
   }
 }
@@ -71329,8 +71737,8 @@ function reconcileSpawnedHost(root, actualPort) {
     const port = backend && Number.isFinite(backend.port) && backend.port > 0 ? backend.port : actualPort;
     if (spawned.pid === pid && spawned.port === port) return;
     const updated = { ...spawned, pid, port };
-    (0, import_node_fs3.writeFileSync)(
-      (0, import_node_path3.join)(root, ".horus", SPAWNED_HOST_FILE),
+    (0, import_node_fs4.writeFileSync)(
+      (0, import_node_path4.join)(root, ".horus", SPAWNED_HOST_FILE),
       JSON.stringify(updated, null, 2) + "\n"
     );
   } catch {
@@ -71340,7 +71748,7 @@ async function waitForOwnHost(root, requestedUrl, timeoutMs = 45e3) {
   const deadline = Date.now() + timeoutMs;
   const servesThisRepo = async (url) => {
     const served = await fetchHostRepoPath(url);
-    return served === null || (0, import_node_path3.resolve)(served) === (0, import_node_path3.resolve)(root);
+    return served === null || (0, import_node_path4.resolve)(served) === (0, import_node_path4.resolve)(root);
   };
   while (Date.now() < deadline) {
     const candidates = [];
@@ -75160,9 +75568,9 @@ init_cjs_shims();
 
 // ../../packages/connectors/src/git/provider.ts
 init_cjs_shims();
-var import_node_child_process3 = require("child_process");
+var import_node_child_process4 = require("child_process");
 var import_node_util2 = require("util");
-var exec2 = (0, import_node_util2.promisify)(import_node_child_process3.execFile);
+var exec2 = (0, import_node_util2.promisify)(import_node_child_process4.execFile);
 function parseGitLog(stdout) {
   const commits = [];
   if (!stdout.trim()) return commits;
@@ -75420,7 +75828,7 @@ async function redisServerStatus(renv) {
 }
 
 // ../../packages/cli/src/commands/update.ts
-var execFileAsync = (0, import_node_util3.promisify)(import_node_child_process4.execFile);
+var execFileAsync = (0, import_node_util3.promisify)(import_node_child_process5.execFile);
 async function ensureBackendPinned(write) {
   let installed = null;
   try {
@@ -75479,13 +75887,13 @@ async function fetchLatestRelease(_fetch = fetch) {
   return res.json();
 }
 function sha256hex(buf) {
-  return (0, import_node_crypto.createHash)("sha256").update(buf).digest("hex");
+  return (0, import_node_crypto2.createHash)("sha256").update(buf).digest("hex");
 }
 function resolveBinaryPath() {
   const raw = process.argv[1];
   if (!raw) throw new Error("Cannot determine binary path from process.argv[1]");
   try {
-    return (0, import_node_fs4.realpathSync)(raw);
+    return (0, import_node_fs5.realpathSync)(raw);
   } catch {
     return raw;
   }
@@ -75571,37 +75979,37 @@ ${import_picocolors.default.bold("Horus update")}
     write(`  ${import_picocolors.default.red("\u2717")} ${e.message}`);
     return 1;
   }
-  if (!(0, import_node_fs4.existsSync)(binaryPath)) {
+  if (!(0, import_node_fs5.existsSync)(binaryPath)) {
     write(`  ${import_picocolors.default.red("\u2717")} Binary not found at ${binaryPath}`);
     return 1;
   }
-  const tmpPath = (0, import_node_path4.join)((0, import_node_os2.tmpdir)(), `horus-update-${tag}-${process.pid}`);
+  const tmpPath = (0, import_node_path5.join)((0, import_node_os3.tmpdir)(), `horus-update-${tag}-${process.pid}`);
   const backupPath = `${binaryPath}.bak`;
   try {
-    (0, import_node_fs4.writeFileSync)(tmpPath, binBuf, { mode: 493 });
+    (0, import_node_fs5.writeFileSync)(tmpPath, binBuf, { mode: 493 });
   } catch (e) {
     write(`  ${import_picocolors.default.red("\u2717")} Could not write to temp dir: ${e.message}`);
     return 1;
   }
   try {
-    (0, import_node_fs4.renameSync)(binaryPath, backupPath);
+    (0, import_node_fs5.renameSync)(binaryPath, backupPath);
     try {
-      (0, import_node_fs4.renameSync)(tmpPath, binaryPath);
-      (0, import_node_fs4.chmodSync)(binaryPath, 493);
+      (0, import_node_fs5.renameSync)(tmpPath, binaryPath);
+      (0, import_node_fs5.chmodSync)(binaryPath, 493);
     } catch (e) {
       try {
-        (0, import_node_fs4.renameSync)(backupPath, binaryPath);
+        (0, import_node_fs5.renameSync)(backupPath, binaryPath);
       } catch {
       }
       throw e;
     }
     try {
-      (0, import_node_fs4.unlinkSync)(backupPath);
+      (0, import_node_fs5.unlinkSync)(backupPath);
     } catch {
     }
   } catch (e) {
     try {
-      (0, import_node_fs4.unlinkSync)(tmpPath);
+      (0, import_node_fs5.unlinkSync)(tmpPath);
     } catch {
     }
     const msg = e.message ?? String(e);
@@ -75623,7 +76031,7 @@ ${import_picocolors.default.bold("Horus update")}
 }
 
 // ../../packages/cli/src/lib/update-notifier.ts
-var CACHE_PATH = (0, import_node_path5.join)((0, import_node_os3.homedir)(), ".horus", "update-check.json");
+var CACHE_PATH = (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".horus", "update-check.json");
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var RELEASES_API2 = "https://api.github.com/repos/meritt-dev/horus/releases/latest";
 var FETCH_TIMEOUT_MS = 2500;
@@ -75639,7 +76047,7 @@ function formatHint(latest, current) {
 }
 function readCache(path) {
   try {
-    const j3 = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
+    const j3 = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
     if (typeof j3["latest"] === "string" && typeof j3["lastCheckMs"] === "number") {
       return { latest: j3["latest"], lastCheckMs: j3["lastCheckMs"] };
     }
@@ -75647,22 +76055,22 @@ function readCache(path) {
   }
   return null;
 }
-function writeCache(path, cache) {
+function writeCache(path, cache2) {
   try {
-    (0, import_node_fs5.mkdirSync)((0, import_node_path5.dirname)(path), { recursive: true });
-    (0, import_node_fs5.writeFileSync)(path, JSON.stringify(cache) + "\n", "utf8");
+    (0, import_node_fs6.mkdirSync)((0, import_node_path6.dirname)(path), { recursive: true });
+    (0, import_node_fs6.writeFileSync)(path, JSON.stringify(cache2) + "\n", "utf8");
   } catch {
   }
 }
-function decideNotification(cache, current, nowMs) {
+function decideNotification(cache2, current, nowMs) {
   let hint = null;
-  if (cache && cache.latest) {
+  if (cache2 && cache2.latest) {
     try {
-      if (isNewer(cache.latest, current)) hint = formatHint(cache.latest, current);
+      if (isNewer(cache2.latest, current)) hint = formatHint(cache2.latest, current);
     } catch {
     }
   }
-  const refreshDue = cache === null || nowMs - cache.lastCheckMs > CHECK_INTERVAL_MS;
+  const refreshDue = cache2 === null || nowMs - cache2.lastCheckMs > CHECK_INTERVAL_MS;
   return { hint, refreshDue };
 }
 async function refresh(path, nowMs) {
@@ -75688,8 +76096,8 @@ function maybeNotifyUpdate() {
   try {
     if (isSuppressed()) return;
     const nowMs = Date.now();
-    const cache = readCache(CACHE_PATH);
-    const { hint, refreshDue } = decideNotification(cache, HORUS_VERSION, nowMs);
+    const cache2 = readCache(CACHE_PATH);
+    const { hint, refreshDue } = decideNotification(cache2, HORUS_VERSION, nowMs);
     if (hint) process.stderr.write(hint);
     if (refreshDue) void refresh(CACHE_PATH, nowMs);
   } catch {
@@ -75698,9 +76106,9 @@ function maybeNotifyUpdate() {
 
 // ../../packages/cli/src/lib/feedback-nudge.ts
 init_cjs_shims();
-var import_node_fs10 = require("fs");
-var import_node_path11 = require("path");
-var import_node_os7 = require("os");
+var import_node_fs11 = require("fs");
+var import_node_path12 = require("path");
+var import_node_os8 = require("os");
 var import_picocolors5 = __toESM(require_picocolors(), 1);
 
 // ../../packages/db/src/index.ts
@@ -76751,7 +77159,7 @@ function sql(strings, ...params) {
     return new SQL([new StringChunk(str3)]);
   }
   sql2.raw = raw;
-  function join20(chunks, separator) {
+  function join21(chunks, separator) {
     const result = [];
     for (const [i3, chunk] of chunks.entries()) {
       if (i3 > 0 && separator !== void 0) {
@@ -76761,7 +77169,7 @@ function sql(strings, ...params) {
     }
     return new SQL(result);
   }
-  sql2.join = join20;
+  sql2.join = join21;
   function identifier(value) {
     return new Name(value);
   }
@@ -80352,7 +80760,7 @@ var PgSelectQueryBuilderBase = class extends TypedQueryBuilder {
     return (table, on2) => {
       const baseTableName = this.tableName;
       const tableName = getTableLikeName(table);
-      if (typeof tableName === "string" && this.config.joins?.some((join20) => join20.alias === tableName)) {
+      if (typeof tableName === "string" && this.config.joins?.some((join21) => join21.alias === tableName)) {
         throw new Error(`Alias "${tableName}" is already used in this query`);
       }
       if (!this.isPartialSelect) {
@@ -81364,7 +81772,7 @@ var PgUpdateBase = class extends QueryPromise {
   createJoin(joinType) {
     return (table, on2) => {
       const tableName = getTableLikeName(table);
-      if (typeof tableName === "string" && this.config.joins.some((join20) => join20.alias === tableName)) {
+      if (typeof tableName === "string" && this.config.joins.some((join21) => join21.alias === tableName)) {
         throw new Error(`Alias "${tableName}" is already used in this query`);
       }
       if (typeof on2 === "function") {
@@ -81460,10 +81868,10 @@ var PgUpdateBase = class extends QueryPromise {
           const fromFields = this.getTableLikeFields(this.config.from);
           fields[tableName] = fromFields;
         }
-        for (const join20 of this.config.joins) {
-          const tableName2 = getTableLikeName(join20.table);
-          if (typeof tableName2 === "string" && !is(join20.table, SQL)) {
-            const fromFields = this.getTableLikeFields(join20.table);
+        for (const join21 of this.config.joins) {
+          const tableName2 = getTableLikeName(join21.table);
+          if (typeof tableName2 === "string" && !is(join21.table, SQL)) {
+            const fromFields = this.getTableLikeFields(join21.table);
             fields[tableName2] = fromFields;
           }
         }
@@ -90456,9 +90864,9 @@ function drizzle2(...params) {
 })(drizzle2 || (drizzle2 = {}));
 
 // ../../packages/db/src/client.ts
-var import_node_os4 = require("os");
-var import_node_path6 = require("path");
-var import_node_fs6 = require("fs");
+var import_node_os5 = require("os");
+var import_node_path7 = require("path");
+var import_node_fs7 = require("fs");
 var import_node_url2 = require("url");
 
 // ../../packages/db/src/guard.ts
@@ -90659,8 +91067,8 @@ function createDb(url, opts) {
   return { db, sql: sql2 };
 }
 function localDbPath() {
-  const dir = process.env["HORUS_DB_DIR"] || (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".horus");
-  return (0, import_node_path6.join)(dir, "horus.db");
+  const dir = process.env["HORUS_DB_DIR"] || (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".horus");
+  return (0, import_node_path7.join)(dir, "horus.db");
 }
 var DEFAULT_LOCAL_PG_URL = "postgresql://horus:horus@localhost:5433/horus";
 function shouldUseEmbeddedDb(url) {
@@ -90719,7 +91127,7 @@ async function applyEmbeddedMigrations(client) {
 async function createLocalDb(opts) {
   const dataDir = opts?.path ?? localDbPath();
   try {
-    (0, import_node_fs6.mkdirSync)(dataDir.replace(/[^/]+$/, ""), { recursive: true });
+    (0, import_node_fs7.mkdirSync)(dataDir.replace(/[^/]+$/, ""), { recursive: true });
   } catch {
   }
   assertEmbeddedAssetsPresent();
@@ -90752,20 +91160,20 @@ async function acquireDbLock(dataDir) {
   };
   for (; ; ) {
     try {
-      const fd = (0, import_node_fs6.openSync)(lockPath, "wx");
-      (0, import_node_fs6.writeSync)(fd, `${process.pid} ${Date.now()}`);
-      (0, import_node_fs6.closeSync)(fd);
+      const fd = (0, import_node_fs7.openSync)(lockPath, "wx");
+      (0, import_node_fs7.writeSync)(fd, `${process.pid} ${Date.now()}`);
+      (0, import_node_fs7.closeSync)(fd);
       return () => {
         try {
-          (0, import_node_fs6.unlinkSync)(lockPath);
+          (0, import_node_fs7.unlinkSync)(lockPath);
         } catch {
         }
       };
     } catch (e) {
       if (e.code !== "EEXIST") return noop3;
       try {
-        if (Date.now() - (0, import_node_fs6.statSync)(lockPath).mtimeMs > STALE_MS) {
-          (0, import_node_fs6.unlinkSync)(lockPath);
+        if (Date.now() - (0, import_node_fs7.statSync)(lockPath).mtimeMs > STALE_MS) {
+          (0, import_node_fs7.unlinkSync)(lockPath);
           continue;
         }
       } catch {
@@ -90779,9 +91187,9 @@ async function acquireDbLock(dataDir) {
 var EMBEDDED_PGLITE_ASSETS = ["pglite.wasm", "pglite.data", "initdb.wasm"];
 function assertEmbeddedAssetsPresent() {
   if (false) return;
-  const selfDir = (0, import_node_path6.dirname)((0, import_node_url2.fileURLToPath)(importMetaUrl));
+  const selfDir = (0, import_node_path7.dirname)((0, import_node_url2.fileURLToPath)(importMetaUrl));
   for (const asset of EMBEDDED_PGLITE_ASSETS) {
-    if (!(0, import_node_fs6.existsSync)((0, import_node_path6.join)(selfDir, asset))) {
+    if (!(0, import_node_fs7.existsSync)((0, import_node_path7.join)(selfDir, asset))) {
       throw new Error(
         `HORUS_DB_UNAVAILABLE: embedded database asset missing (${asset}). This build does not ship local persistence \u2014 install via npm or Homebrew, or set DATABASE_URL.`
       );
@@ -90931,21 +91339,21 @@ init_cjs_shims();
 
 // ../../node_modules/.pnpm/drizzle-orm@0.38.4_@electric-sql+pglite@0.5.3_@types+pg@8.20.0_pg@8.22.0_postgres@3.4.9/node_modules/drizzle-orm/migrator.js
 init_cjs_shims();
-var import_node_crypto2 = __toESM(require("crypto"), 1);
-var import_node_fs7 = __toESM(require("fs"), 1);
+var import_node_crypto3 = __toESM(require("crypto"), 1);
+var import_node_fs8 = __toESM(require("fs"), 1);
 function readMigrationFiles(config2) {
   const migrationFolderTo = config2.migrationsFolder;
   const migrationQueries = [];
   const journalPath = `${migrationFolderTo}/meta/_journal.json`;
-  if (!import_node_fs7.default.existsSync(journalPath)) {
+  if (!import_node_fs8.default.existsSync(journalPath)) {
     throw new Error(`Can't find meta/_journal.json file`);
   }
-  const journalAsString = import_node_fs7.default.readFileSync(`${migrationFolderTo}/meta/_journal.json`).toString();
+  const journalAsString = import_node_fs8.default.readFileSync(`${migrationFolderTo}/meta/_journal.json`).toString();
   const journal = JSON.parse(journalAsString);
   for (const journalEntry of journal.entries) {
     const migrationPath = `${migrationFolderTo}/${journalEntry.tag}.sql`;
     try {
-      const query = import_node_fs7.default.readFileSync(`${migrationFolderTo}/${journalEntry.tag}.sql`).toString();
+      const query = import_node_fs8.default.readFileSync(`${migrationFolderTo}/${journalEntry.tag}.sql`).toString();
       const result = query.split("--> statement-breakpoint").map((it2) => {
         return it2;
       });
@@ -90953,7 +91361,7 @@ function readMigrationFiles(config2) {
         sql: result,
         bps: journalEntry.breakpoints,
         folderMillis: journalEntry.when,
-        hash: import_node_crypto2.default.createHash("sha256").update(query).digest("hex")
+        hash: import_node_crypto3.default.createHash("sha256").update(query).digest("hex")
       });
     } catch {
       throw new Error(`No file ${migrationPath} found in ${migrationFolderTo} folder`);
@@ -90970,8 +91378,8 @@ async function migrate(db, config2) {
 
 // ../../packages/db/src/migrate.ts
 var import_node_url3 = require("url");
-var import_node_path7 = require("path");
-var migrationsFolder = (0, import_node_path7.resolve)((0, import_node_path7.dirname)((0, import_node_url3.fileURLToPath)(importMetaUrl)), "../drizzle");
+var import_node_path8 = require("path");
+var migrationsFolder = (0, import_node_path8.resolve)((0, import_node_path8.dirname)((0, import_node_url3.fileURLToPath)(importMetaUrl)), "../drizzle");
 async function runMigrations(url) {
   assertLocalDatabaseUrl(url);
   const sql2 = src_default(url, { max: 1, onnotice: () => {
@@ -90983,7 +91391,7 @@ async function runMigrations(url) {
   }
 }
 var entry = process.argv[1];
-var invokedDirectly = entry !== void 0 && (0, import_node_url3.fileURLToPath)(importMetaUrl) === (0, import_node_path7.resolve)(entry) && (0, import_node_path7.basename)(entry).replace(/\.[cm]?[jt]s$/, "") === "migrate";
+var invokedDirectly = entry !== void 0 && (0, import_node_url3.fileURLToPath)(importMetaUrl) === (0, import_node_path8.resolve)(entry) && (0, import_node_path8.basename)(entry).replace(/\.[cm]?[jt]s$/, "") === "migrate";
 if (invokedDirectly) {
   const url = process.env.DATABASE_URL ?? "postgresql://horus:horus@localhost:5433/horus";
   runMigrations(url).then(() => {
@@ -91053,43 +91461,43 @@ var import_picocolors3 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/telemetry/client.ts
 init_cjs_shims();
-var import_node_crypto4 = require("crypto");
-var import_node_os6 = require("os");
+var import_node_crypto5 = require("crypto");
+var import_node_os7 = require("os");
 
 // ../../packages/cli/src/lib/telemetry/consent.ts
 init_cjs_shims();
 
 // ../../packages/cli/src/lib/telemetry/store.ts
 init_cjs_shims();
-var import_node_fs8 = require("fs");
-var import_node_crypto3 = require("crypto");
+var import_node_fs9 = require("fs");
+var import_node_crypto4 = require("crypto");
 
 // ../../packages/cli/src/lib/cloud/paths.ts
 init_cjs_shims();
-var import_node_path8 = require("path");
-var import_node_os5 = require("os");
+var import_node_path9 = require("path");
+var import_node_os6 = require("os");
 var CLOUD_CONFIG_FILE = "cloud.json";
 var AUTH_FILE = "auth.json";
 function cloudConfigPath(root) {
-  return (0, import_node_path8.join)(root, HORUS_DIR, CLOUD_CONFIG_FILE);
+  return (0, import_node_path9.join)(root, HORUS_DIR, CLOUD_CONFIG_FILE);
 }
 function horusHome() {
-  return process.env.HORUS_HOME ?? (0, import_node_path8.join)((0, import_node_os5.homedir)(), HORUS_DIR);
+  return process.env.HORUS_HOME ?? (0, import_node_path9.join)((0, import_node_os6.homedir)(), HORUS_DIR);
 }
 function authPath() {
-  return (0, import_node_path8.join)(horusHome(), AUTH_FILE);
+  return (0, import_node_path9.join)(horusHome(), AUTH_FILE);
 }
 
 // ../../packages/cli/src/lib/telemetry/paths.ts
 init_cjs_shims();
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var TELEMETRY_FILE = "telemetry.json";
 var TELEMETRY_QUEUE_DIR = "telemetry-queue";
 function telemetryPath() {
-  return (0, import_node_path9.join)(horusHome(), TELEMETRY_FILE);
+  return (0, import_node_path10.join)(horusHome(), TELEMETRY_FILE);
 }
 function telemetryQueueDir() {
-  return (0, import_node_path9.join)(horusHome(), TELEMETRY_QUEUE_DIR);
+  return (0, import_node_path10.join)(horusHome(), TELEMETRY_QUEUE_DIR);
 }
 
 // ../../packages/cli/src/lib/telemetry/store.ts
@@ -91097,7 +91505,7 @@ var TELEMETRY_SCHEMA_VERSION = 1;
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
-function defaultTelemetryState(installId = (0, import_node_crypto3.randomUUID)()) {
+function defaultTelemetryState(installId = (0, import_node_crypto4.randomUUID)()) {
   const now = nowIso();
   return {
     schemaVersion: TELEMETRY_SCHEMA_VERSION,
@@ -91131,29 +91539,29 @@ function coerce2(raw) {
 }
 function readTelemetryState() {
   const p5 = telemetryPath();
-  if (!(0, import_node_fs8.existsSync)(p5)) return null;
+  if (!(0, import_node_fs9.existsSync)(p5)) return null;
   try {
-    return coerce2(JSON.parse((0, import_node_fs8.readFileSync)(p5, "utf8")));
+    return coerce2(JSON.parse((0, import_node_fs9.readFileSync)(p5, "utf8")));
   } catch {
     return null;
   }
 }
 function writeTelemetryState(state) {
-  (0, import_node_fs8.mkdirSync)(horusHome(), { recursive: true });
+  (0, import_node_fs9.mkdirSync)(horusHome(), { recursive: true });
   const p5 = telemetryPath();
   const tmp = `${p5}.${process.pid}.tmp`;
-  (0, import_node_fs8.writeFileSync)(tmp, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
+  (0, import_node_fs9.writeFileSync)(tmp, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
   try {
-    (0, import_node_fs8.renameSync)(tmp, p5);
+    (0, import_node_fs9.renameSync)(tmp, p5);
   } catch (err2) {
     try {
-      (0, import_node_fs8.rmSync)(tmp);
+      (0, import_node_fs9.rmSync)(tmp);
     } catch {
     }
     throw err2;
   }
   try {
-    (0, import_node_fs8.chmodSync)(p5, 384);
+    (0, import_node_fs9.chmodSync)(p5, 384);
   } catch {
   }
 }
@@ -91173,7 +91581,7 @@ function updateTelemetryState(mutate) {
 }
 function deleteTelemetryState() {
   const p5 = telemetryPath();
-  if ((0, import_node_fs8.existsSync)(p5)) (0, import_node_fs8.rmSync)(p5);
+  if ((0, import_node_fs9.existsSync)(p5)) (0, import_node_fs9.rmSync)(p5);
 }
 
 // ../../packages/cli/src/lib/telemetry/consent.ts
@@ -91251,32 +91659,32 @@ function isContentSharingEnabled(env = process.env) {
 
 // ../../packages/cli/src/lib/telemetry/spool.ts
 init_cjs_shims();
-var import_node_fs9 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path11 = require("path");
 var SPOOL_FILE = "events.jsonl";
 var MAX_SPOOL_BYTES = 256 * 1024;
 function spoolFilePath() {
-  return (0, import_node_path10.join)(telemetryQueueDir(), SPOOL_FILE);
+  return (0, import_node_path11.join)(telemetryQueueDir(), SPOOL_FILE);
 }
 function spoolEvent(event) {
   try {
-    (0, import_node_fs9.mkdirSync)(telemetryQueueDir(), { recursive: true });
+    (0, import_node_fs10.mkdirSync)(telemetryQueueDir(), { recursive: true });
     const file = spoolFilePath();
     let size2 = 0;
     try {
-      size2 = (0, import_node_fs9.statSync)(file).size;
+      size2 = (0, import_node_fs10.statSync)(file).size;
     } catch {
     }
     if (size2 >= MAX_SPOOL_BYTES) return;
-    (0, import_node_fs9.appendFileSync)(file, JSON.stringify(event) + "\n", { mode: 384 });
+    (0, import_node_fs10.appendFileSync)(file, JSON.stringify(event) + "\n", { mode: 384 });
   } catch {
   }
 }
 function readSpooledEvents() {
   try {
     const file = spoolFilePath();
-    if (!(0, import_node_fs9.existsSync)(file)) return [];
-    return (0, import_node_fs9.readFileSync)(file, "utf8").split("\n").filter((line2) => line2.trim().length > 0).map((line2) => {
+    if (!(0, import_node_fs10.existsSync)(file)) return [];
+    return (0, import_node_fs10.readFileSync)(file, "utf8").split("\n").filter((line2) => line2.trim().length > 0).map((line2) => {
       try {
         return JSON.parse(line2);
       } catch {
@@ -91290,7 +91698,7 @@ function readSpooledEvents() {
 function clearSpool() {
   try {
     const file = spoolFilePath();
-    if ((0, import_node_fs9.existsSync)(file)) (0, import_node_fs9.rmSync)(file);
+    if ((0, import_node_fs10.existsSync)(file)) (0, import_node_fs10.rmSync)(file);
   } catch {
   }
 }
@@ -91316,7 +91724,7 @@ function extractFlagNames(argv) {
 // ../../packages/cli/src/lib/telemetry/client.ts
 var sessionId = null;
 function getSessionId() {
-  if (!sessionId) sessionId = (0, import_node_crypto4.randomUUID)();
+  if (!sessionId) sessionId = (0, import_node_crypto5.randomUUID)();
   return sessionId;
 }
 function track(input) {
@@ -91333,8 +91741,8 @@ function track(input) {
       installId: state.installId,
       sessionId: getSessionId(),
       cliVersion: HORUS_VERSION,
-      os: (0, import_node_os6.platform)(),
-      arch: (0, import_node_os6.arch)(),
+      os: (0, import_node_os7.platform)(),
+      arch: (0, import_node_os7.arch)(),
       ...input
     };
     spoolEvent(event);
@@ -91484,7 +91892,7 @@ async function runFeedback(investigationId, opts = {}) {
 }
 
 // ../../packages/cli/src/lib/feedback-nudge.ts
-var STATE_PATH = (0, import_node_path11.join)((0, import_node_os7.homedir)(), ".horus", "feedback-nudge.json");
+var STATE_PATH = (0, import_node_path12.join)((0, import_node_os8.homedir)(), ".horus", "feedback-nudge.json");
 var MIN_AGE_MS = 2 * 60 * 60 * 1e3;
 var RATE_LIMIT_MS = 20 * 60 * 60 * 1e3;
 var MAX_REMEMBERED = 50;
@@ -91500,7 +91908,7 @@ function isSuppressed2(env = process.env, isTTY = Boolean(process.stdin.isTTY &&
 }
 function readState(path = STATE_PATH) {
   try {
-    const j3 = JSON.parse((0, import_node_fs10.readFileSync)(path, "utf8"));
+    const j3 = JSON.parse((0, import_node_fs11.readFileSync)(path, "utf8"));
     const lastPromptMs = typeof j3["lastPromptMs"] === "number" ? j3["lastPromptMs"] : 0;
     const promptedIds = Array.isArray(j3["promptedIds"]) ? j3["promptedIds"].filter((x4) => typeof x4 === "string") : [];
     return { lastPromptMs, promptedIds };
@@ -91510,12 +91918,12 @@ function readState(path = STATE_PATH) {
 }
 function writeState(state, path = STATE_PATH) {
   try {
-    (0, import_node_fs10.mkdirSync)((0, import_node_path11.dirname)(path), { recursive: true });
+    (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(path), { recursive: true });
     const trimmed = {
       lastPromptMs: state.lastPromptMs,
       promptedIds: state.promptedIds.slice(-MAX_REMEMBERED)
     };
-    (0, import_node_fs10.writeFileSync)(path, JSON.stringify(trimmed) + "\n", "utf8");
+    (0, import_node_fs11.writeFileSync)(path, JSON.stringify(trimmed) + "\n", "utf8");
   } catch {
   }
 }
@@ -93610,6 +94018,19 @@ function detectFixedCadence(body2, name2) {
   }
   return null;
 }
+function detectExactMatchQuery(body2, name2) {
+  const sql2 = /\bWHERE\b[^;]*?["'`]?\b\w+\b["'`]?\s*=\s*[$?:]\w*/i.exec(body2);
+  if (sql2 && !/\b(?:LIKE|ILIKE|LOWER|UPPER|TRIM|SIMILAR|REGEXP)\b/i.test(grp(sql2, 0))) {
+    const frag = grp(sql2, 0).trim().slice(0, 48);
+    return { pattern: "exact-match-query", matched: frag, baseScore: 0.2, title: hedged(name2, `matches on an exact-equality query (\`${frag}\`) with no normalization, so a value differing only in formatting (case, whitespace, leading zeros) returns no rows`) };
+  }
+  const orm = /\.(?:find|findOne|findFirst|findUnique)\s*\(\s*\{\s*\w+\s*:/.exec(body2);
+  if (orm) {
+    const frag = grp(orm, 0).trim().slice(0, 40);
+    return { pattern: "exact-match-query", matched: frag, baseScore: 0.2, title: hedged(name2, `looks up by an exact field match (\`${frag}\`) with no normalization, so a value differing only in formatting returns no match`) };
+  }
+  return null;
+}
 function detectInPlaceMutation(body2, ctx) {
   const hay = `${ctx.symbol.name} ${ctx.symbol.filePath ?? ""} ${ctx.symbol.signature ?? ""}`;
   const contextual = /reduc|\bslice\b|store|mutat|\bstate\b/i.test(hay) || ctx.imports.some((i3) => /redux|zustand|immer|valtio|mobx/i.test(i3));
@@ -93665,7 +94086,14 @@ function detectDataFlowCause(ctx) {
   if (raw.length < 40) return null;
   const body2 = stripComments(raw);
   const nm = ctx.symbol.name;
-  return detectFixedCadence(body2, nm) ?? detectInPlaceMutation(body2, ctx) ?? detectUnawaitedWrite(body2, ctx) ?? detectHardcodedBound(body2, nm);
+  return detectFixedCadence(body2, nm) ?? detectExactMatchQuery(body2, nm) ?? detectInPlaceMutation(body2, ctx) ?? detectUnawaitedWrite(body2, ctx) ?? detectHardcodedBound(body2, nm);
+}
+function detectDataFlowCauseAcross(contexts) {
+  for (const c4 of contexts) {
+    const f5 = detectDataFlowCause(c4);
+    if (f5) return f5;
+  }
+  return null;
 }
 
 // ../../packages/engine/src/hypotheses.ts
@@ -94376,7 +94804,7 @@ init_cjs_shims();
 
 // ../../packages/engine/src/memory-detect.ts
 init_cjs_shims();
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 
 // ../../packages/engine/src/memory-store.ts
 init_cjs_shims();
@@ -94462,7 +94890,7 @@ function sharedNonGenericTags(a2, b5) {
 }
 function recurrenceEdgeId(idA, idB) {
   const [lo, hi] = idA <= idB ? [idA, idB] : [idB, idA];
-  const h3 = (0, import_node_crypto5.createHash)("sha256").update(`recurs-with\0${lo}\0${hi}`).digest("hex");
+  const h3 = (0, import_node_crypto6.createHash)("sha256").update(`recurs-with\0${lo}\0${hi}`).digest("hex");
   return `lnk_recurs_${h3.slice(0, 32)}`;
 }
 function normalizeCause(s5) {
@@ -95498,9 +95926,9 @@ function computeWeightedEvidenceConfidence(evidence2, ambientEvidenceIds) {
 
 // ../../packages/engine/src/git-collector.ts
 init_cjs_shims();
-var import_node_child_process5 = require("child_process");
+var import_node_child_process6 = require("child_process");
 var import_node_util4 = require("util");
-var exec3 = (0, import_node_util4.promisify)(import_node_child_process5.execFile);
+var exec3 = (0, import_node_util4.promisify)(import_node_child_process6.execFile);
 var DEFAULT_MAX_COMMITS = 50;
 var DEFAULT_MAX_FILES = 100;
 var DEFAULT_MAX_BYTES = 5e4;
@@ -96378,6 +96806,13 @@ function isNoiseCommit(commit) {
     return true;
   }
   if (/pre-commit.*autoupdate/i.test(subject) || /\[pre-commit\.ci\]/i.test(subject)) return true;
+  if (/^(docs|style|test|ci)(\([^)]*\))?[:!]/i.test(subject)) return true;
+  if (/\b(reformat|whitespace|prettier|eslint)\b/i.test(subject)) return true;
+  if (/\bcode\s*(style|formatting)\b/i.test(subject)) return true;
+  if (/\bclean\s*up\b[^.]*\bformat/i.test(subject)) return true;
+  if (/\b(documentation|docs|readme)\b/i.test(subject) && !/\b(endpoint|api|service|handler|controller|component|module|feature|migration|schema|query|cache|queue|webhook|sdk|cli|route)\b/i.test(subject)) {
+    return true;
+  }
   return false;
 }
 function seedTouchedByRelevantChange(recentChanges, seedFile) {
@@ -96389,6 +96824,26 @@ function seedTouchedByRelevantChange(recentChanges, seedFile) {
     (c4) => !isNoiseCommit(c4) && c4.files.some(matchesSeed)
   );
 }
+function seedTouchingCommitFocus(recentChanges, seedFile) {
+  if (recentChanges === void 0 || seedFile === void 0) return null;
+  if (recentChanges.degenerate) return null;
+  const matchesSeed = (f5) => f5 === seedFile || seedFile.endsWith(f5) || f5.endsWith(seedFile);
+  let min = null;
+  for (const c4 of recentChanges.commits) {
+    if (isNoiseCommit(c4)) continue;
+    if (!c4.files.some(matchesSeed)) continue;
+    const n4 = c4.files.length;
+    if (min === null || n4 < min) min = n4;
+  }
+  return min;
+}
+function regressionSeedTouchedScore(focus) {
+  if (focus === null) return 0.18;
+  if (focus <= 4) return 0.45;
+  if (focus <= 8) return 0.38;
+  if (focus <= 14) return 0.3;
+  return 0.2;
+}
 function formatRegressionCitation(recentChanges, changes, seedFile) {
   const matchesSeed = (f5) => seedFile === void 0 || f5 === seedFile || seedFile.endsWith(f5) || f5.endsWith(seedFile);
   const all = (recentChanges?.commits ?? []).filter((c4) => !isNoiseCommit(c4));
@@ -97727,7 +98182,11 @@ async function investigate(input, deps) {
       category: "deployment-regression",
       sourceEvidenceIds: [changeEvId, ...seedEv ? [seedEv.id] : []],
       // A regression NOT backed by a seed-touching commit must not score like one that is.
-      baseScore: clamp015((seedInChanges ? 0.45 : 0.18) + (queueHits.length > 0 ? 0.05 : 0)),
+      // HOR-451: scale the seed-touched prior by commit focus — a broad/diffuse commit that merely
+      // touched the seed no longer outranks an evidence-backed runtime cause.
+      baseScore: clamp015(
+        (seedInChanges ? regressionSeedTouchedScore(seedTouchingCommitFocus(recentChanges, top?.filePath)) : 0.18) + (queueHits.length > 0 ? 0.05 : 0)
+      ),
       metadata: { blastRadius }
     });
   }
@@ -97766,36 +98225,39 @@ async function investigate(input, deps) {
       const raiser = bySeed ? top.name : lead.raiserName || top.name;
       const depClause = bySeed ? "" : `, a dependency of ${top.name}`;
       const calleePenalty = bySeed ? 0 : 0.18;
-      let title;
-      let baseScore;
-      if (tier === SEV_ERROR) {
-        title = bySeed ? `Runtime error ${lead.code} (${lead.count}x in Elasticsearch) is raised by ${raiser} \u2014 the likely failure${msgClause}` : `Runtime error ${lead.code} (${lead.count}x in Elasticsearch) surfaces on ${raiser}${depClause}${msgClause}`;
-        baseScore = clamp015(0.6 + volumeBoost - calleePenalty);
-      } else if (tier === SEV_WARN) {
-        title = `Warning ${lead.code} (${lead.count}x in Elasticsearch) ${bySeed ? "is raised by" : "surfaces on"} ${raiser}${depClause}${msgClause}`;
-        baseScore = clamp015(0.42 + volumeBoost - calleePenalty);
-      } else {
-        title = `Diagnostic signal ${lead.code} (${lead.count}x in Elasticsearch) is logged by ${raiser}${depClause} \u2014 informational, not an error${msgClause}`;
-        baseScore = clamp015(0.3 + volumeBoost - calleePenalty);
-      }
-      causeInputs.push({
-        id: "cause:seed-emitted-error",
-        title: title.slice(0, 220),
-        category: "error-correlation",
-        sourceEvidenceIds,
-        baseScore,
-        metadata: {
-          blastRadius,
-          seedEmitted: true,
-          code: lead.code,
-          count: lead.count,
-          severity: tier === SEV_ERROR ? "error" : tier === SEV_WARN ? "warn" : "info"
+      if (tier === SEV_ERROR || tier === SEV_WARN) {
+        let title;
+        let baseScore;
+        if (tier === SEV_ERROR) {
+          title = bySeed ? `Runtime error ${lead.code} (${lead.count}x in Elasticsearch) is raised by ${raiser} \u2014 the likely failure${msgClause}` : `Runtime error ${lead.code} (${lead.count}x in Elasticsearch) surfaces on ${raiser}${depClause}${msgClause}`;
+          baseScore = clamp015(0.6 + volumeBoost - calleePenalty);
+        } else {
+          title = `Warning ${lead.code} (${lead.count}x in Elasticsearch) ${bySeed ? "is raised by" : "surfaces on"} ${raiser}${depClause}${msgClause}`;
+          baseScore = clamp015(0.42 + volumeBoost - calleePenalty);
         }
-      });
+        causeInputs.push({
+          id: "cause:seed-emitted-error",
+          title: title.slice(0, 220),
+          category: "error-correlation",
+          sourceEvidenceIds,
+          baseScore,
+          metadata: {
+            blastRadius,
+            seedEmitted: true,
+            code: lead.code,
+            count: lead.count,
+            severity: tier === SEV_ERROR ? "error" : "warn"
+          }
+        });
+      }
     }
   }
-  if (top && seedEv && ctx && !sourceImpactHint) {
-    const dataFlow = detectDataFlowCause(ctx);
+  if (top && seedEv && ctx && code && !sourceImpactHint) {
+    const scanIds = [
+      .../* @__PURE__ */ new Set([...seeds.slice(1, 4).map((s5) => s5.id), ...(ctx.callees ?? []).slice(0, 4).map((c4) => c4.id)])
+    ].filter((id) => id !== top.id);
+    const extraCtxs = (await Promise.all(scanIds.map((id) => code.context(id).catch(() => null)))).filter((c4) => c4 !== null);
+    const dataFlow = detectDataFlowCauseAcross([ctx, ...extraCtxs]);
     if (dataFlow) {
       causeInputs.push({
         id: "cause:seed-data-flow",
@@ -98914,7 +99376,7 @@ function blastRadiusToJSON(r) {
 
 // ../../packages/engine/src/memory-recall.ts
 init_cjs_shims();
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var FRESHNESS_HALF_LIFE_DAYS = 30;
 var NO_ANCHOR_DECAY = 0.5;
 var STALE_RANK_FACTOR = 0.5;
@@ -98934,7 +99396,7 @@ function recallCodeProviderFromCodeProvider(code) {
   };
 }
 function hashNodeContent(content) {
-  return "sha256:" + (0, import_node_crypto6.createHash)("sha256").update(content, "utf8").digest("hex");
+  return "sha256:" + (0, import_node_crypto7.createHash)("sha256").update(content, "utf8").digest("hex");
 }
 function clamp016(n4) {
   if (!Number.isFinite(n4)) return 0;
@@ -101537,7 +101999,7 @@ function renderReport2(top, ctx, impact, flows, siblings) {
 
 // ../../packages/cli/src/commands/index-repo.ts
 init_cjs_shims();
-var import_node_path17 = require("path");
+var import_node_path18 = require("path");
 var import_picocolors9 = __toESM(require_picocolors(), 1);
 
 // ../../packages/knowledge/src/index.ts
@@ -101746,7 +102208,7 @@ var KnowledgeManifestSchema = external_exports.object({
 
 // ../../packages/knowledge/src/layout.ts
 init_cjs_shims();
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 var HORUS_DIR2 = ".horus";
 var KNOWLEDGE_DIR = "index";
 var KNOWLEDGE_FILES = {
@@ -101761,37 +102223,37 @@ var KNOWLEDGE_FILES = {
   db: "index.db"
 };
 function knowledgeDir(root) {
-  return (0, import_node_path12.join)(root, HORUS_DIR2, KNOWLEDGE_DIR);
+  return (0, import_node_path13.join)(root, HORUS_DIR2, KNOWLEDGE_DIR);
 }
 function knowledgePath(root, file) {
-  return (0, import_node_path12.join)(knowledgeDir(root), KNOWLEDGE_FILES[file]);
+  return (0, import_node_path13.join)(knowledgeDir(root), KNOWLEDGE_FILES[file]);
 }
 
 // ../../packages/knowledge/src/store.ts
 init_cjs_shims();
-var import_node_crypto7 = require("crypto");
-var import_node_fs11 = require("fs");
-var import_node_path13 = require("path");
+var import_node_crypto8 = require("crypto");
+var import_node_fs12 = require("fs");
+var import_node_path14 = require("path");
 function readJson(path) {
-  return JSON.parse((0, import_node_fs11.readFileSync)(path, "utf8"));
+  return JSON.parse((0, import_node_fs12.readFileSync)(path, "utf8"));
 }
 function writeJson(path, value) {
-  (0, import_node_fs11.mkdirSync)((0, import_node_path13.dirname)(path), { recursive: true });
-  (0, import_node_fs11.writeFileSync)(path, JSON.stringify(value, null, 2) + "\n");
+  (0, import_node_fs12.mkdirSync)((0, import_node_path14.dirname)(path), { recursive: true });
+  (0, import_node_fs12.writeFileSync)(path, JSON.stringify(value, null, 2) + "\n");
 }
 function createJsonKnowledgeStore(root) {
   const manifestPath = knowledgePath(root, "manifest");
   const basePath = knowledgePath(root, "knowledgeBase");
   return {
     exists() {
-      return (0, import_node_fs11.existsSync)(basePath);
+      return (0, import_node_fs12.existsSync)(basePath);
     },
     readManifest() {
-      if (!(0, import_node_fs11.existsSync)(manifestPath)) return null;
+      if (!(0, import_node_fs12.existsSync)(manifestPath)) return null;
       return KnowledgeManifestSchema.parse(readJson(manifestPath));
     },
     readSnapshot() {
-      if (!(0, import_node_fs11.existsSync)(basePath)) return null;
+      if (!(0, import_node_fs12.existsSync)(basePath)) return null;
       return KnowledgeSnapshotSchema.parse(readJson(basePath));
     },
     write(snapshot, opts = {}) {
@@ -101799,9 +102261,9 @@ function createJsonKnowledgeStore(root) {
       const counts = {};
       for (const cat of KNOWLEDGE_CATEGORIES) counts[cat] = parsed[cat].length;
       const snapshotJson = JSON.stringify(parsed, null, 2) + "\n";
-      const contentHash = (0, import_node_crypto7.createHash)("sha256").update(snapshotJson).digest("hex");
-      (0, import_node_fs11.mkdirSync)((0, import_node_path13.dirname)(basePath), { recursive: true });
-      (0, import_node_fs11.writeFileSync)(basePath, snapshotJson);
+      const contentHash = (0, import_node_crypto8.createHash)("sha256").update(snapshotJson).digest("hex");
+      (0, import_node_fs12.mkdirSync)((0, import_node_path14.dirname)(basePath), { recursive: true });
+      (0, import_node_fs12.writeFileSync)(basePath, snapshotJson);
       writeJson(knowledgePath(root, "contracts"), {
         operations: parsed.operations,
         types: parsed.types,
@@ -101887,9 +102349,9 @@ function searchSnapshot(snapshot, query, opts = {}) {
 
 // ../../packages/knowledge/src/import/index.ts
 init_cjs_shims();
-var import_node_crypto8 = require("crypto");
-var import_node_fs12 = require("fs");
-var import_node_path14 = require("path");
+var import_node_crypto9 = require("crypto");
+var import_node_fs13 = require("fs");
+var import_node_path15 = require("path");
 
 // ../../packages/knowledge/src/import/maison-safqa.ts
 init_cjs_shims();
@@ -102127,8 +102589,8 @@ function importMaisonSafqaKnowledgeBase(raw, opts = {}) {
 // ../../packages/knowledge/src/import/index.ts
 function importKnowledgeBaseFile(filePath, opts = {}) {
   const source = opts.source ?? MAISON_SAFQA_SOURCE;
-  const content = (0, import_node_fs12.readFileSync)(filePath, "utf8");
-  const contentHash = (0, import_node_crypto8.createHash)("sha256").update(content).digest("hex");
+  const content = (0, import_node_fs13.readFileSync)(filePath, "utf8");
+  const contentHash = (0, import_node_crypto9.createHash)("sha256").update(content).digest("hex");
   let raw;
   try {
     raw = JSON.parse(content);
@@ -102147,7 +102609,7 @@ function importKnowledgeBaseFile(filePath, opts = {}) {
       generator: { tool: source, version: result.kbVersion ?? void 0 },
       sourceIntelligence: { tool: source },
       extraFiles: [
-        { name: `${source}:${(0, import_node_path14.basename)(filePath)}`, category: "import-source", contentHash }
+        { name: `${source}:${(0, import_node_path15.basename)(filePath)}`, category: "import-source", contentHash }
       ]
     });
   }
@@ -102156,8 +102618,8 @@ function importKnowledgeBaseFile(filePath, opts = {}) {
 
 // ../../packages/knowledge/src/build/project-landscape.ts
 init_cjs_shims();
-var import_node_fs13 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path16 = require("path");
 
 // ../../packages/knowledge/src/build/source-graph.ts
 init_cjs_shims();
@@ -102357,14 +102819,14 @@ function deriveExternalIntegrations(profiles) {
 // ../../packages/knowledge/src/build/project-landscape.ts
 function readPackageJson(repoPath) {
   try {
-    return JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path15.join)(repoPath, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs14.readFileSync)((0, import_node_path16.join)(repoPath, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }
 function readText(repoPath, file) {
   try {
-    return (0, import_node_fs13.readFileSync)((0, import_node_path15.join)(repoPath, file), "utf8");
+    return (0, import_node_fs14.readFileSync)((0, import_node_path16.join)(repoPath, file), "utf8");
   } catch {
     return null;
   }
@@ -102917,27 +103379,27 @@ function extractQueueGraph(input) {
     }
   }
   const producers = [];
-  for (const pc59 of input.producerClasses) {
-    const loopVarEnums = loopVarEnumsFor(pc59.content);
-    for (const m5 of pc59.content.matchAll(INJECT_QUEUE_RE)) {
+  for (const pc60 of input.producerClasses) {
+    const loopVarEnums = loopVarEnumsFor(pc60.content);
+    for (const m5 of pc60.content.matchAll(INJECT_QUEUE_RE)) {
       const queue = m5[1] ?? "";
-      if (queue) producers.push({ queue, symbol: pc59.name, file: pc59.filePath });
+      if (queue) producers.push({ queue, symbol: pc60.name, file: pc60.filePath });
     }
-    for (const m5 of pc59.content.matchAll(NEW_BULL_RE)) {
+    for (const m5 of pc60.content.matchAll(NEW_BULL_RE)) {
       if (m5[2] !== "Queue") continue;
       const queues2 = resolveArg(m5[3] ?? "", constMap, enums, loopVarEnums);
       for (const queue of queues2) {
         producers.push({
           queue,
-          symbol: (m5[1] ?? pc59.name) || baseName(pc59.filePath),
-          file: pc59.filePath
+          symbol: (m5[1] ?? pc60.name) || baseName(pc60.filePath),
+          file: pc60.filePath
         });
       }
     }
-    for (const m5 of pc59.content.matchAll(QUEUE_NAME_CONST_RE)) {
+    for (const m5 of pc60.content.matchAll(QUEUE_NAME_CONST_RE)) {
       const ident = m5[1] ?? "";
       const queue = m5[2] ?? "";
-      if (queue) producers.push({ queue, symbol: ident || baseName(pc59.filePath), file: pc59.filePath });
+      if (queue) producers.push({ queue, symbol: ident || baseName(pc60.filePath), file: pc60.filePath });
     }
   }
   const workers = [];
@@ -103237,7 +103699,7 @@ async function stitch(client, db, opts = {}) {
 
 // ../../packages/cli/src/lib/ensure-host.ts
 init_cjs_shims();
-var import_node_path16 = require("path");
+var import_node_path17 = require("path");
 var import_picocolors8 = __toESM(require_picocolors(), 1);
 function parseHostPort(hostUrl) {
   try {
@@ -103266,7 +103728,7 @@ function ensureHostReasonHint(reason) {
 async function verifyHostServesRepo(hostUrl, root) {
   const served = await fetchHostRepoPath(hostUrl);
   if (served === null) return "unknown";
-  return (0, import_node_path16.resolve)(served) === (0, import_node_path16.resolve)(root) ? "match" : "foreign";
+  return (0, import_node_path17.resolve)(served) === (0, import_node_path17.resolve)(root) ? "match" : "foreign";
 }
 async function ensureOwnSourceHost(root, opts = {}) {
   const ownUrl = readSourceHostUrl(root);
@@ -103376,16 +103838,16 @@ async function stitchQueueMap(hostUrl, dbUrl, label) {
 async function hostServesRepo(hostUrl, root) {
   try {
     const info2 = await new SourceHttpClient({ baseUrl: hostUrl }).hostInfo();
-    return (0, import_node_path17.resolve)(info2.repoPath) === (0, import_node_path17.resolve)(root);
+    return (0, import_node_path18.resolve)(info2.repoPath) === (0, import_node_path18.resolve)(root);
   } catch {
     return true;
   }
 }
 function findConfiguredRepo(config2, root) {
-  const target = (0, import_node_path17.resolve)(root);
+  const target = (0, import_node_path18.resolve)(root);
   for (const p5 of config2.projects) {
     for (const r of p5.repositories) {
-      if ((0, import_node_path17.resolve)(r.path) === target) {
+      if ((0, import_node_path18.resolve)(r.path) === target) {
         const hostUrl = r.source?.hostUrl;
         return { project: p5.name, ...hostUrl ? { hostUrl } : {} };
       }
@@ -103447,7 +103909,7 @@ async function buildKnowledgeIndex(root, config2, label, configuredProject, opts
     const gitSha = getHeadSha(root) ?? void 0;
     const branch = getCurrentBranch(root) ?? void 0;
     if (opts.importKb) {
-      const res = importKnowledgeBaseFile((0, import_node_path17.resolve)(opts.importKb), { root, project: label });
+      const res = importKnowledgeBaseFile((0, import_node_path18.resolve)(opts.importKb), { root, project: label });
       const total = res.manifest ? Object.values(res.manifest.counts).reduce((a2, b5) => a2 + b5, 0) : 0;
       console.log(import_picocolors9.default.dim(`  project knowledge: imported ${total} item(s) from ${opts.importKb}`));
       if (res.warnings.length) console.log(import_picocolors9.default.dim(`  (${res.warnings.length} import warning(s))`));
@@ -103462,12 +103924,12 @@ async function buildKnowledgeIndex(root, config2, label, configuredProject, opts
     const repos = [];
     if (config2 && configuredProject) {
       const proj = config2.projects.find((p5) => p5.name === configuredProject);
-      for (const r of proj?.repositories ?? []) repos.push({ name: r.name, path: (0, import_node_path17.resolve)(r.path) });
+      for (const r of proj?.repositories ?? []) repos.push({ name: r.name, path: (0, import_node_path18.resolve)(r.path) });
     }
     if (repos.length === 0) repos.push({ name: label, path: root });
     let sourceGraph;
     if (hostUrl) {
-      const graphRepo = repos.find((r) => (0, import_node_path17.resolve)(r.path) === (0, import_node_path17.resolve)(root))?.name ?? label;
+      const graphRepo = repos.find((r) => (0, import_node_path18.resolve)(r.path) === (0, import_node_path18.resolve)(root))?.name ?? label;
       try {
         const extract = await extractSourceGraph(hostUrl, graphRepo);
         if (extract) sourceGraph = extract;
@@ -103527,7 +103989,7 @@ async function runIndex(opts) {
       }
     }
     const isConfigured = configuredProject !== null;
-    const name2 = opts.name ?? configuredProject ?? (0, import_node_path17.basename)(root);
+    const name2 = opts.name ?? configuredProject ?? (0, import_node_path18.basename)(root);
     const label = configuredProject ?? name2;
     let hostUrl;
     let spawned = false;
@@ -103674,8 +104136,8 @@ async function runIndex(opts) {
 
 // ../../packages/cli/src/commands/knowledge.ts
 init_cjs_shims();
-var import_node_fs14 = require("fs");
-var import_node_crypto9 = require("crypto");
+var import_node_fs15 = require("fs");
+var import_node_crypto10 = require("crypto");
 var import_picocolors10 = __toESM(require_picocolors(), 1);
 function resolveRoot(opts) {
   if (opts.root) return opts.root;
@@ -103943,7 +104405,7 @@ function runKnowledgeValidate(opts = {}) {
   if (manifest && snapshot) {
     const recorded = manifest.files.find((f5) => f5.name === "knowledge-base.json")?.contentHash;
     if (recorded) {
-      const actual = (0, import_node_crypto9.createHash)("sha256").update((0, import_node_fs14.readFileSync)(knowledgePath(root, "knowledgeBase"), "utf8")).digest("hex");
+      const actual = (0, import_node_crypto10.createHash)("sha256").update((0, import_node_fs15.readFileSync)(knowledgePath(root, "knowledgeBase"), "utf8")).digest("hex");
       if (actual !== recorded) {
         issues.push("knowledge-base.json content hash does not match the manifest (file modified after write)");
       }
@@ -114277,12 +114739,12 @@ var import_picocolors11 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/open-url.ts
 init_cjs_shims();
-var import_node_child_process6 = require("child_process");
+var import_node_child_process7 = require("child_process");
 function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
   const args2 = process.platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    (0, import_node_child_process6.execFile)(cmd, args2, () => {
+    (0, import_node_child_process7.execFile)(cmd, args2, () => {
     });
   } catch {
   }
@@ -114670,8 +115132,8 @@ async function runMcpServer(opts = {}) {
 
 // ../../packages/cli/src/commands/knowledge-cloud.ts
 init_cjs_shims();
-var import_node_fs17 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs18 = require("fs");
+var import_node_path20 = require("path");
 var import_picocolors13 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/cloud/session.ts
@@ -114895,12 +115357,12 @@ var CloudClient = class {
 
 // ../../packages/cli/src/lib/cloud/auth-store.ts
 init_cjs_shims();
-var import_node_fs15 = require("fs");
+var import_node_fs16 = require("fs");
 function readAuth() {
   const p5 = authPath();
-  if (!(0, import_node_fs15.existsSync)(p5)) return null;
+  if (!(0, import_node_fs16.existsSync)(p5)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs15.readFileSync)(p5, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs16.readFileSync)(p5, "utf8"));
     if (!parsed.token || !parsed.apiBaseUrl || !parsed.account) return null;
     return parsed;
   } catch {
@@ -114908,17 +115370,17 @@ function readAuth() {
   }
 }
 function writeAuth(state) {
-  (0, import_node_fs15.mkdirSync)(horusHome(), { recursive: true });
+  (0, import_node_fs16.mkdirSync)(horusHome(), { recursive: true });
   const p5 = authPath();
-  (0, import_node_fs15.writeFileSync)(p5, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
+  (0, import_node_fs16.writeFileSync)(p5, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
   try {
-    (0, import_node_fs15.chmodSync)(p5, 384);
+    (0, import_node_fs16.chmodSync)(p5, 384);
   } catch {
   }
 }
 function clearAuth() {
   const p5 = authPath();
-  if ((0, import_node_fs15.existsSync)(p5)) (0, import_node_fs15.rmSync)(p5);
+  if ((0, import_node_fs16.existsSync)(p5)) (0, import_node_fs16.rmSync)(p5);
 }
 
 // ../../packages/cli/src/lib/cloud/session.ts
@@ -114936,13 +115398,13 @@ function authedClient() {
 
 // ../../packages/cli/src/lib/cloud/context-store.ts
 init_cjs_shims();
-var import_node_fs16 = require("fs");
-var import_node_path18 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path19 = require("path");
 function readCloudConfig(root) {
   const p5 = cloudConfigPath(root);
-  if (!(0, import_node_fs16.existsSync)(p5)) return null;
+  if (!(0, import_node_fs17.existsSync)(p5)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs16.readFileSync)(p5, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(p5, "utf8"));
     if (parsed.context !== "local" && parsed.context !== "cloud") return null;
     return parsed;
   } catch {
@@ -114951,12 +115413,12 @@ function readCloudConfig(root) {
 }
 function writeCloudConfig(root, cfg) {
   const p5 = cloudConfigPath(root);
-  (0, import_node_fs16.mkdirSync)((0, import_node_path18.dirname)(p5), { recursive: true });
-  (0, import_node_fs16.writeFileSync)(p5, JSON.stringify(cfg, null, 2) + "\n");
+  (0, import_node_fs17.mkdirSync)((0, import_node_path19.dirname)(p5), { recursive: true });
+  (0, import_node_fs17.writeFileSync)(p5, JSON.stringify(cfg, null, 2) + "\n");
 }
 function clearCloudConfig(root) {
   const p5 = cloudConfigPath(root);
-  if ((0, import_node_fs16.existsSync)(p5)) (0, import_node_fs16.rmSync)(p5);
+  if ((0, import_node_fs17.existsSync)(p5)) (0, import_node_fs17.rmSync)(p5);
 }
 function isCloudActive(cfg) {
   return !!cfg && cfg.context === "cloud" && !!cfg.project;
@@ -115152,10 +115614,10 @@ function reportCloudError(err2) {
 
 // ../../packages/cli/src/commands/knowledge-cloud.ts
 function readKnowledgeRedactConfig(root) {
-  const configPath = (0, import_node_path19.join)(root, ".horus", "config.json");
-  if (!(0, import_node_fs17.existsSync)(configPath)) return {};
+  const configPath = (0, import_node_path20.join)(root, ".horus", "config.json");
+  if (!(0, import_node_fs18.existsSync)(configPath)) return {};
   try {
-    const raw = JSON.parse((0, import_node_fs17.readFileSync)(configPath, "utf8"));
+    const raw = JSON.parse((0, import_node_fs18.readFileSync)(configPath, "utf8"));
     const redact = raw["knowledge"]?.["redact"];
     return { dropProvenancePaths: !!redact?.dropProvenancePaths, summariesOnly: !!redact?.summariesOnly };
   } catch {
@@ -116576,12 +117038,12 @@ async function listCloudInvestigations(client, cfg) {
 
 // ../../packages/cli/src/lib/freshness.ts
 init_cjs_shims();
-var import_node_child_process7 = require("child_process");
-var import_node_fs18 = require("fs");
-var import_node_path20 = require("path");
+var import_node_child_process8 = require("child_process");
+var import_node_fs19 = require("fs");
+var import_node_path21 = require("path");
 var import_node_util5 = require("util");
 var import_picocolors15 = __toESM(require_picocolors(), 1);
-var execFileAsync2 = (0, import_node_util5.promisify)(import_node_child_process7.execFile);
+var execFileAsync2 = (0, import_node_util5.promisify)(import_node_child_process8.execFile);
 async function commitsSince(repoRoot, sinceIso) {
   try {
     const { stdout } = await execFileAsync2(
@@ -116599,7 +117061,7 @@ var RUNTIME_SOURCES = /* @__PURE__ */ new Set(["logs", "metrics", "state", "queu
 var STALE_INDEX_MS = 7 * 24 * 60 * 60 * 1e3;
 function readIndexMeta(repoRoot) {
   try {
-    const raw = (0, import_node_fs18.readFileSync)((0, import_node_path20.join)(repoRoot, ".horus", "source", "meta.json"), "utf8");
+    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path21.join)(repoRoot, ".horus", "source", "meta.json"), "utf8");
     const j3 = JSON.parse(raw);
     return {
       lastIndexedAt: typeof j3.last_indexed_at === "string" ? j3.last_indexed_at : void 0,
@@ -116686,9 +117148,9 @@ function renderFreshness(f5) {
 // ../../packages/cli/src/lib/investigation-runner.ts
 init_cjs_shims();
 var import_picocolors16 = __toESM(require_picocolors(), 1);
-var import_node_fs19 = require("fs");
-var import_node_path21 = require("path");
-var import_node_os8 = require("os");
+var import_node_fs20 = require("fs");
+var import_node_path22 = require("path");
+var import_node_os9 = require("os");
 
 // ../../packages/eval/src/index.ts
 init_cjs_shims();
@@ -117221,7 +117683,7 @@ function loadReranker() {
   const flag = process.env.HORUS_RERANK;
   if (!flag || flag === "0" || flag.toLowerCase() === "false") return void 0;
   try {
-    const blob = JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path21.join)((0, import_node_os8.homedir)(), ".horus", "reranker.json"), "utf8"));
+    const blob = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path22.join)((0, import_node_os9.homedir)(), ".horus", "reranker.json"), "utf8"));
     if (!isRerankerModel(blob)) return void 0;
     if ((blob.holdout?.delta ?? 0) <= 0) return void 0;
     return (causes) => applyReranker(blob, causes);
@@ -118602,8 +119064,8 @@ async function runOwner(query, opts) {
 
 // ../../packages/cli/src/commands/postmortem.ts
 init_cjs_shims();
-var import_node_fs20 = require("fs");
-var import_node_path22 = require("path");
+var import_node_fs21 = require("fs");
+var import_node_path23 = require("path");
 var import_picocolors30 = __toESM(require_picocolors(), 1);
 async function runPostmortem(id, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
@@ -118714,14 +119176,14 @@ _AI summary unavailable: ${validationErrors?.[0] ?? "provider error"}_
       }
     }
     if (opts.output) {
-      const outputPath = (0, import_node_path22.resolve)(opts.output);
-      if ((0, import_node_fs20.existsSync)(outputPath) && !opts.force) {
+      const outputPath = (0, import_node_path23.resolve)(opts.output);
+      if ((0, import_node_fs21.existsSync)(outputPath) && !opts.force) {
         log(import_picocolors30.default.red("\u2717") + " " + outputPath + " already exists");
         log(import_picocolors30.default.dim("  pass --force to overwrite"));
         return 1;
       }
       try {
-        (0, import_node_fs20.writeFileSync)(outputPath, content, "utf8");
+        (0, import_node_fs21.writeFileSync)(outputPath, content, "utf8");
       } catch (err2) {
         log(import_picocolors30.default.red("\u2717 Could not write " + outputPath + ": ") + err2.message);
         return 1;
@@ -121119,12 +121581,12 @@ async function runState(opts) {
 // ../../packages/cli/src/commands/init.ts
 init_cjs_shims();
 var import_picocolors39 = __toESM(require_picocolors(), 1);
-var import_node_path23 = require("path");
+var import_node_path24 = require("path");
 async function runInit(opts) {
   try {
     const cwd = process.cwd();
-    const root = opts.path ? (0, import_node_path23.resolve)(opts.path) : findRepoRoot(cwd) ?? cwd;
-    const name2 = opts.name ?? (0, import_node_path23.basename)(root);
+    const root = opts.path ? (0, import_node_path24.resolve)(opts.path) : findRepoRoot(cwd) ?? cwd;
+    const name2 = opts.name ?? (0, import_node_path24.basename)(root);
     const envName = opts.env ?? "production";
     const repo = { name: name2, path: root };
     if (opts.source) repo["source"] = { hostUrl: opts.source };
@@ -121314,7 +121776,6 @@ async function runSetup(opts) {
 // ../../packages/cli/src/commands/connect.ts
 init_cjs_shims();
 var import_node_readline = require("readline");
-var import_node_child_process9 = require("child_process");
 var import_picocolors44 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/tty-selector.ts
@@ -121639,10 +122100,10 @@ async function selectSearch(opts) {
 
 // ../../packages/cli/src/commands/connect-ai.ts
 init_cjs_shims();
-var import_node_child_process8 = require("child_process");
+var import_node_child_process9 = require("child_process");
 var import_picocolors43 = __toESM(require_picocolors(), 1);
 function cliInstalled(id) {
-  const r = (0, import_node_child_process8.spawnSync)(id, ["--version"], { stdio: "ignore", timeout: 2e3 });
+  const r = (0, import_node_child_process9.spawnSync)(id, ["--version"], { stdio: "ignore", timeout: 2e3 });
   return !r.error;
 }
 async function probeAnthropic(apiKey) {
@@ -121792,7 +122253,7 @@ async function runConnect(type, opts) {
   }
   const connectorType = type;
   try {
-    const cwd = process.cwd();
+    const cwd = opts.cwd ?? process.cwd();
     const root = findRepoRoot(cwd) ?? cwd;
     const configPath = discoverLocalConfig(cwd) ?? localConfigPath(root);
     const filled = await fillInteractive(connectorType, opts);
@@ -121834,22 +122295,45 @@ ${import_picocolors44.default.red(`\u2717 Could not reach ${connectorType}:`)} $
 ${import_picocolors44.default.green("\u2713")} ${connectorType} reachable ${import_picocolors44.default.dim(`(${probeResult.detail})`)}`
       );
     }
-    const hasLiteralCredentials = filled.url !== void 0 || filled.password !== void 0 || filled.username !== void 0 || filled.authToken !== void 0 || filled.token !== void 0;
-    if (hasLiteralCredentials) {
-      if (isGitTracked(configPath, root)) {
-        console.error(
-          import_picocolors44.default.red(".horus/config.json is already tracked by Git.") + "\nStoring credentials here would expose them in the repository.\n" + import_picocolors44.default.dim(
-            "  Option A \u2014 remove from Git index then re-run:\n    git rm --cached .horus/config.json\n    horus connect " + type + " ...\n\n  Option B \u2014 keep credentials in the environment and reference them:\n    export ES_URL=https://...\n    export ES_USERNAME=...\n    export ES_PASSWORD=...\n  Then edit .horus/config.json manually to use urlEnv/usernameEnv/passwordEnv."
-          )
-        );
+    const envName = resolveEnvName(configPath, filled.env);
+    const secretFields = CONNECTOR_SECRET_FIELDS[connectorType] ?? [];
+    const nonSecretPatch = {};
+    const secretPatch = [];
+    for (const [k3, v4] of Object.entries(patch)) {
+      if (secretFields.includes(k3) && typeof v4 === "string" && v4.length > 0) {
+        secretPatch.push([k3, v4]);
+      } else {
+        nonSecretPatch[k3] = v4;
+      }
+    }
+    ensureProjectGitignore(root);
+    if (secretPatch.length > 0) {
+      let keyResult;
+      try {
+        keyResult = ensureMasterKey();
+      } catch (err2) {
+        console.error(import_picocolors44.default.red(err2.message));
         return 1;
       }
-      ensureCredentialGitignore(root);
+      for (const [field, value] of secretPatch) {
+        writeConnectorSecret(root, envName, connectorType, field, value, keyResult.key);
+      }
+      if (keyResult.warning) console.warn(import_picocolors44.default.yellow(`
+\u26A0 ${keyResult.warning}`));
     }
-    patchLocalConnector(configPath, connectorType, patch, filled.env);
+    patchLocalConnector(configPath, connectorType, nonSecretPatch, envName);
     console.log(
       `${import_picocolors44.default.green("\u2713")} ${import_picocolors44.default.bold(connectorType)} connector saved \u2192 ${import_picocolors44.default.dim(configPath)}`
     );
+    if (secretPatch.length > 0) {
+      const n4 = secretPatch.length;
+      console.log(
+        import_picocolors44.default.dim(
+          `  ${n4} secret${n4 > 1 ? "s" : ""} encrypted \u2192 ${localSecretsPath(root)}
+  master key: ${masterKeyStatus().detail}`
+        )
+      );
+    }
     printSummary(connectorType, filled);
     console.log(import_picocolors44.default.dim(`
   run: horus investigate "<hint>"`));
@@ -122313,16 +122797,19 @@ function printSummary(type, opts) {
   }
   if (lines.length > 0) console.log(import_picocolors44.default.dim(lines.join("\n")));
 }
-function isGitTracked(filePath, cwd) {
-  try {
-    (0, import_node_child_process9.execFileSync)("git", ["ls-files", "--error-unmatch", filePath], {
-      cwd,
-      stdio: "pipe"
-    });
-    return true;
-  } catch {
-    return false;
+function resolveEnvName(configPath, requested) {
+  const file = readLocalConfig(configPath);
+  const project = file.project;
+  const envs = project?.environments ?? [];
+  if (requested) {
+    if (!envs.some((e) => e.name === requested)) {
+      throw new Error(`Environment "${requested}" not found in config.`);
+    }
+    return requested;
   }
+  const first = envs[0]?.name;
+  if (!first) throw new Error("No environments found in config.");
+  return first;
 }
 async function discoverEsIndices(url, username, password) {
   if (!url) return [];
@@ -122507,15 +122994,157 @@ function redactUrl(raw) {
   }
 }
 
+// ../../packages/cli/src/commands/secrets.ts
+init_cjs_shims();
+var import_node_fs22 = require("fs");
+var import_picocolors45 = __toESM(require_picocolors(), 1);
+function locate(cwd = process.cwd()) {
+  const root = findRepoRoot(cwd) ?? cwd;
+  const configPath = discoverLocalConfig(cwd) ?? localConfigPath(root);
+  return { root, configPath, exists: (0, import_node_fs22.existsSync)(configPath) };
+}
+function countStoredSecrets(root) {
+  const stored = readLocalSecrets(root).connectors;
+  if (!stored) return 0;
+  let n4 = 0;
+  for (const byConnector of Object.values(stored)) {
+    for (const byField of Object.values(byConnector)) {
+      n4 += Object.keys(byField).length;
+    }
+  }
+  return n4;
+}
+function runSecretsStatus(opts = {}) {
+  const { root, configPath, exists: exists2 } = locate(opts.cwd);
+  const key = masterKeyStatus();
+  console.log(import_picocolors45.default.bold("\nMaster key"));
+  console.log(
+    key.available ? `  ${import_picocolors45.default.green("\u25CF")} ${key.detail}` : `  ${import_picocolors45.default.dim("\u25CB")} ${key.detail}`
+  );
+  const stored = countStoredSecrets(root);
+  console.log(import_picocolors45.default.bold("\nEncrypted secrets"));
+  console.log(`  ${stored} stored \u2192 ${import_picocolors45.default.dim(localSecretsPath(root))}`);
+  if (stored > 0) {
+    const { warnings } = decryptConnectorSecrets(root);
+    if (warnings.length > 0) {
+      console.log(import_picocolors45.default.yellow(`  \u26A0 ${warnings.length} cannot be decrypted with the current key:`));
+      for (const w4 of warnings) console.log(import_picocolors45.default.dim(`    - ${w4}`));
+    } else {
+      console.log(import_picocolors45.default.dim("  all decrypt cleanly with the current key"));
+    }
+  }
+  console.log(import_picocolors45.default.bold("\nPlaintext in config.json"));
+  if (!exists2) {
+    console.log(import_picocolors45.default.dim("  no .horus/config.json found"));
+  } else {
+    const plaintext = findPlaintextConnectorSecrets(readLocalConfig(configPath).project);
+    if (plaintext.length === 0) {
+      console.log(`  ${import_picocolors45.default.green("\u2713")} none \u2014 config carries no credentials`);
+    } else {
+      console.log(import_picocolors45.default.yellow(`  \u26A0 ${plaintext.length} plaintext secret(s) \u2014 run \`horus secrets migrate\`:`));
+      for (const p5 of plaintext) console.log(import_picocolors45.default.dim(`    - ${p5}`));
+    }
+  }
+  console.log(import_picocolors45.default.bold("\nGitignore"));
+  console.log(
+    isHorusGitignored(root) ? `  ${import_picocolors45.default.green("\u2713")} .horus/ is gitignored` : import_picocolors45.default.yellow("  \u26A0 .horus/ is NOT gitignored \u2014 run `horus secrets migrate` or add `.horus/` to .gitignore")
+  );
+  console.log("");
+  return 0;
+}
+function runSecretsMigrate(opts = {}) {
+  const { root, configPath, exists: exists2 } = locate(opts.cwd);
+  if (!exists2) {
+    console.error(import_picocolors45.default.red(`No .horus/config.json found at ${configPath}.`));
+    console.error(import_picocolors45.default.dim("  Run `horus index` in this repo first."));
+    return 1;
+  }
+  const file = readLocalConfig(configPath);
+  const plaintext = findPlaintextConnectorSecrets(file.project);
+  ensureProjectGitignore(root);
+  if (plaintext.length === 0) {
+    console.log(`${import_picocolors45.default.green("\u2713")} No plaintext connector secrets in config.json \u2014 nothing to migrate.`);
+    if (!isHorusGitignored(root)) {
+      console.log(import_picocolors45.default.dim("  Ensured `.horus/` is gitignored."));
+    }
+    return 0;
+  }
+  if (opts.dryRun) {
+    console.log(import_picocolors45.default.bold(`Would migrate ${plaintext.length} plaintext secret(s) \u2192 encrypted store:`));
+    for (const p5 of plaintext) console.log(import_picocolors45.default.dim(`  - ${p5}`));
+    console.log(import_picocolors45.default.dim("\n  Re-run without --dry-run to apply."));
+    return 0;
+  }
+  let keyResult;
+  try {
+    keyResult = ensureMasterKey();
+  } catch (err2) {
+    console.error(import_picocolors45.default.red(err2.message));
+    return 1;
+  }
+  const project = file.project;
+  let migrated = 0;
+  for (const env of project?.environments ?? []) {
+    const envName = env["name"];
+    const connectors = env["connectors"];
+    if (!envName || !connectors) continue;
+    for (const [connector, cfg] of Object.entries(connectors)) {
+      if (!cfg || typeof cfg !== "object") continue;
+      for (const field of CONNECTOR_SECRET_FIELDS[connector] ?? []) {
+        const val = cfg[field];
+        if (typeof val === "string" && val.length > 0) {
+          writeConnectorSecret(root, envName, connector, field, val, keyResult.key);
+          delete cfg[field];
+          migrated++;
+        }
+      }
+    }
+  }
+  writeLocalConfig(root, file);
+  console.log(`${import_picocolors45.default.green("\u2713")} Migrated ${migrated} secret(s) \u2192 ${import_picocolors45.default.dim(localSecretsPath(root))}`);
+  console.log(import_picocolors45.default.dim(`  master key: ${masterKeyStatus().detail}`));
+  console.log(import_picocolors45.default.dim("  config.json now carries no credentials."));
+  if (keyResult.warning) console.warn(import_picocolors45.default.yellow(`
+\u26A0 ${keyResult.warning}`));
+  console.log(
+    import_picocolors45.default.dim(
+      "\n  If config.json was ever committed, scrub the old secret from history:\n    git rm --cached .horus/config.json   # if tracked\n    # then rotate the exposed credential at its provider."
+    )
+  );
+  return 0;
+}
+function runSecretsKey(opts = {}) {
+  const status = masterKeyStatus();
+  if (!status.available) {
+    console.log(import_picocolors45.default.dim("No master key yet \u2014 created on first `horus connect` or `horus secrets migrate`."));
+    return 0;
+  }
+  console.log(`Master key source: ${status.detail}`);
+  if (!opts.show) {
+    console.log(import_picocolors45.default.dim("  Pass --show to print the key (base64) for CI use (HORUS_SECRET_KEY)."));
+    return 0;
+  }
+  const key = getMasterKeyForRead();
+  if (!key) {
+    console.error(import_picocolors45.default.red("Could not read the master key."));
+    return 1;
+  }
+  console.warn(import_picocolors45.default.yellow("\u26A0 Treat this as a credential. Anyone with it can decrypt your connector secrets."));
+  console.log(`
+export HORUS_SECRET_KEY=${key.toString("base64")}
+`);
+  return 0;
+}
+
 // ../../packages/cli/src/commands/stop.ts
 init_cjs_shims();
 var import_node_child_process10 = require("child_process");
-var import_node_fs21 = require("fs");
+var import_node_fs23 = require("fs");
 var import_node_util6 = require("util");
-var import_node_path24 = require("path");
-var import_picocolors45 = __toESM(require_picocolors(), 1);
+var import_node_path25 = require("path");
+var import_picocolors46 = __toESM(require_picocolors(), 1);
 var execFileAsync3 = (0, import_node_util6.promisify)(import_node_child_process10.execFile);
-var unlinkAsync = (0, import_node_util6.promisify)(import_node_fs21.unlink);
+var unlinkAsync = (0, import_node_util6.promisify)(import_node_fs23.unlink);
 var SPAWNED_HOST_FILE2 = "spawned-host.json";
 var START_TIME_TOLERANCE_S = 60;
 var STOP_WAIT_MS = 5e3;
@@ -122531,19 +123160,19 @@ async function runStop(opts) {
     const root = findRepoRoot(cwd) ?? cwd;
     const hostUrl = readSourceHostUrl(root);
     if (!hostUrl) {
-      console.log(import_picocolors45.default.dim("No source-intelligence host found for this repo (.horus/source/host.json absent)."));
+      console.log(import_picocolors46.default.dim("No source-intelligence host found for this repo (.horus/source/host.json absent)."));
       return 0;
     }
     return await stopHost(root, hostUrl);
   } catch (err2) {
-    console.error(import_picocolors45.default.red(err2.message));
+    console.error(import_picocolors46.default.red(err2.message));
     return 1;
   }
 }
 async function stopHost(root, hostUrl) {
   const port = extractPort(hostUrl);
   if (port === null) {
-    console.error(import_picocolors45.default.red(`Cannot determine port from host URL: ${hostUrl}`));
+    console.error(import_picocolors46.default.red(`Cannot determine port from host URL: ${hostUrl}`));
     return 1;
   }
   const healthy = await isHostHealthy(hostUrl);
@@ -122553,12 +123182,12 @@ async function stopHost(root, hostUrl) {
     if (!wrapperAlive) {
       const res = await stopBackendServerPid(root, port);
       if (res === "failed") return 1;
-      if (res !== "stopped") console.log(import_picocolors45.default.dim(`Host ${hostUrl} is already stopped.`));
+      if (res !== "stopped") console.log(import_picocolors46.default.dim(`Host ${hostUrl} is already stopped.`));
       await cleanupSpawnedRecord(root);
       return 0;
     }
     console.log(
-      import_picocolors45.default.dim(
+      import_picocolors46.default.dim(
         `Host ${hostUrl} is unreachable but pid ${owned.pid} is still running \u2014 terminating a stuck host.`
       )
     );
@@ -122566,7 +123195,7 @@ async function stopHost(root, hostUrl) {
   const spawned = readSpawnedHost(root);
   if (spawned === null) {
     console.error(
-      import_picocolors45.default.red(
+      import_picocolors46.default.red(
         `No ownership record found (.horus/${SPAWNED_HOST_FILE2} absent). Horus will not stop a host it did not spawn.`
       )
     );
@@ -122574,12 +123203,12 @@ async function stopHost(root, hostUrl) {
   }
   const recordError = validateSpawnedRecord(spawned);
   if (recordError !== null) {
-    console.error(import_picocolors45.default.red(`Ownership record is malformed: ${recordError}. Aborting for safety.`));
+    console.error(import_picocolors46.default.red(`Ownership record is malformed: ${recordError}. Aborting for safety.`));
     return 1;
   }
   if (spawned.port !== port) {
     console.error(
-      import_picocolors45.default.red(
+      import_picocolors46.default.red(
         `Ownership record port (${spawned.port}) does not match host URL port (${port}). Record may be stale.`
       )
     );
@@ -122587,7 +123216,7 @@ async function stopHost(root, hostUrl) {
   }
   if (spawned.root !== root) {
     console.error(
-      import_picocolors45.default.red(
+      import_picocolors46.default.red(
         `Ownership record root (${spawned.root}) does not match resolved root (${root}). Record may be stale.`
       )
     );
@@ -122598,14 +123227,14 @@ async function stopHost(root, hostUrl) {
     const res = await stopBackendServerPid(root, port);
     if (res === "failed") return 1;
     if (res !== "stopped") {
-      console.log(import_picocolors45.default.dim(`Process pid ${spawned.pid} is no longer running \u2014 already stopped.`));
+      console.log(import_picocolors46.default.dim(`Process pid ${spawned.pid} is no longer running \u2014 already stopped.`));
     }
     await cleanupSpawnedRecord(root);
     return 0;
   }
   if (!isOwnHostProcess(spawned.pid, port, root, info2.args)) {
     console.error(
-      import_picocolors45.default.red(
+      import_picocolors46.default.red(
         `Pid ${spawned.pid} args do not match "horus-source host --port ${port}". Got: "${info2.args.slice(0, 120)}". Aborting for safety.`
       )
     );
@@ -122614,12 +123243,12 @@ async function stopHost(root, hostUrl) {
   const startTs = new Date(spawned.startedAt).getTime();
   const recordedAgeS = Math.round((Date.now() - startTs) / 1e3);
   if (!Number.isFinite(info2.etimeSeconds)) {
-    console.error(import_picocolors45.default.red(`Could not read elapsed time for pid ${spawned.pid}. Aborting for safety.`));
+    console.error(import_picocolors46.default.red(`Could not read elapsed time for pid ${spawned.pid}. Aborting for safety.`));
     return 1;
   }
   if (Math.abs(info2.etimeSeconds - recordedAgeS) > START_TIME_TOLERANCE_S) {
     console.error(
-      import_picocolors45.default.red(
+      import_picocolors46.default.red(
         `Pid ${spawned.pid} age mismatch: record says ~${recordedAgeS}s, process reports ${info2.etimeSeconds}s elapsed. Possible PID reuse \u2014 aborting for safety.`
       )
     );
@@ -122629,17 +123258,17 @@ async function stopHost(root, hostUrl) {
   try {
     terminated = await terminatePid(spawned.pid);
   } catch (err2) {
-    console.error(import_picocolors45.default.red(`Failed to signal pid ${spawned.pid}: ${err2.message}`));
+    console.error(import_picocolors46.default.red(`Failed to signal pid ${spawned.pid}: ${err2.message}`));
     return 1;
   }
   if (!terminated) {
     console.error(
-      import_picocolors45.default.red(`Host pid ${spawned.pid} did not exit even after SIGKILL \u2014 could not reclaim the port.`)
+      import_picocolors46.default.red(`Host pid ${spawned.pid} did not exit even after SIGKILL \u2014 could not reclaim the port.`)
     );
     return 1;
   }
   console.log(
-    `${import_picocolors45.default.green("\u2713")} Stopped source-intelligence host ` + import_picocolors45.default.dim(`(pid ${spawned.pid}, port ${port})`) + ` for ${root}`
+    `${import_picocolors46.default.green("\u2713")} Stopped source-intelligence host ` + import_picocolors46.default.dim(`(pid ${spawned.pid}, port ${port})`) + ` for ${root}`
   );
   if (await stopBackendServerPid(root, port) === "failed") return 1;
   await cleanupSpawnedRecord(root);
@@ -122657,11 +123286,11 @@ function isOwnHostProcess(pid, port, root, args2) {
   if (hostArgvRegex(port).test(args2)) return true;
   if (!hostArgvAnyPortRegex().test(args2)) return false;
   const rec = readSourceHostPid(root);
-  return rec !== null && rec.pid === pid && Number.isFinite(rec.port) && rec.port === port && !!rec.repoPath && (0, import_node_path24.resolve)(rec.repoPath) === (0, import_node_path24.resolve)(root);
+  return rec !== null && rec.pid === pid && Number.isFinite(rec.port) && rec.port === port && !!rec.repoPath && (0, import_node_path25.resolve)(rec.repoPath) === (0, import_node_path25.resolve)(root);
 }
 async function cleanupSpawnedRecord(root) {
   try {
-    await unlinkAsync((0, import_node_path24.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
+    await unlinkAsync((0, import_node_path25.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
   } catch {
   }
 }
@@ -122674,7 +123303,7 @@ async function stopBackendServerPid(root, port) {
   if (info2 === null) return "none";
   if (!isOwnHostProcess(rec.pid, port, root, info2.args)) {
     console.log(
-      import_picocolors45.default.dim(
+      import_picocolors46.default.dim(
         `Host pid ${rec.pid} is now an unrelated process (stale source/host.json / PID reuse) \u2014 host already gone.`
       )
     );
@@ -122684,17 +123313,17 @@ async function stopBackendServerPid(root, port) {
   try {
     terminated = await terminatePid(rec.pid);
   } catch (err2) {
-    console.error(import_picocolors45.default.red(`Failed to signal pid ${rec.pid}: ${err2.message}`));
+    console.error(import_picocolors46.default.red(`Failed to signal pid ${rec.pid}: ${err2.message}`));
     return "failed";
   }
   if (!terminated) {
     console.error(
-      import_picocolors45.default.red(`Host pid ${rec.pid} did not exit even after SIGKILL \u2014 could not reclaim the port.`)
+      import_picocolors46.default.red(`Host pid ${rec.pid} did not exit even after SIGKILL \u2014 could not reclaim the port.`)
     );
     return "failed";
   }
   console.log(
-    `${import_picocolors45.default.green("\u2713")} Stopped source-intelligence host ` + import_picocolors45.default.dim(`(pid ${rec.pid}, port ${port})`) + ` for ${root}`
+    `${import_picocolors46.default.green("\u2713")} Stopped source-intelligence host ` + import_picocolors46.default.dim(`(pid ${rec.pid}, port ${port})`) + ` for ${root}`
   );
   return "stopped";
 }
@@ -122702,7 +123331,7 @@ async function stopAll() {
   const registry2 = readRegistry();
   const projects2 = Object.entries(registry2.projects);
   if (projects2.length === 0) {
-    console.log(import_picocolors45.default.dim("No registered projects."));
+    console.log(import_picocolors46.default.dim("No registered projects."));
     return 0;
   }
   let stopped = 0;
@@ -122714,17 +123343,17 @@ async function stopAll() {
     if (!healthy && readSpawnedHost(entry2.root) === null && readSourceHostPid(entry2.root) === null) {
       continue;
     }
-    console.log(`  Stopping ${import_picocolors45.default.bold(name2)} ${import_picocolors45.default.dim(`(${hostUrl})`)}`);
+    console.log(`  Stopping ${import_picocolors46.default.bold(name2)} ${import_picocolors46.default.dim(`(${hostUrl})`)}`);
     const code = await stopHost(entry2.root, hostUrl);
     if (code === 0) stopped++;
     else failed++;
   }
   if (stopped === 0 && failed === 0) {
-    console.log(import_picocolors45.default.dim("No running source-intelligence hosts found."));
+    console.log(import_picocolors46.default.dim("No running source-intelligence hosts found."));
   } else {
     console.log(
       `
-Stopped ${stopped} host(s)${failed > 0 ? import_picocolors45.default.red(`, ${failed} failed`) : ""}.`
+Stopped ${stopped} host(s)${failed > 0 ? import_picocolors46.default.red(`, ${failed} failed`) : ""}.`
     );
   }
   return failed > 0 ? 1 : 0;
@@ -122812,7 +123441,7 @@ function extractPort(hostUrl) {
 
 // ../../packages/cli/src/commands/hosts.ts
 init_cjs_shims();
-var import_picocolors46 = __toESM(require_picocolors(), 1);
+var import_picocolors47 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/host-reaper.ts
 init_cjs_shims();
@@ -122917,14 +123546,14 @@ async function runHosts(opts = {}) {
   for (const row of rows) {
     if (row.hostUrl === null) continue;
     printedAny = true;
-    const status = row.live ? import_picocolors46.default.green("\u25CF running") : import_picocolors46.default.red("\u25CF stopped");
+    const status = row.live ? import_picocolors47.default.green("\u25CF running") : import_picocolors47.default.red("\u25CF stopped");
     const port = row.port ?? "?";
     console.log(
-      `  ${status}  ${import_picocolors46.default.bold(row.name.padEnd(24))} port ${String(port).padEnd(6)} ${import_picocolors46.default.dim(row.root)}`
+      `  ${status}  ${import_picocolors47.default.bold(row.name.padEnd(24))} port ${String(port).padEnd(6)} ${import_picocolors47.default.dim(row.root)}`
     );
   }
   const noHost = rows.filter((r) => r.hostUrl === null);
-  for (const row of noHost) console.log(`  ${import_picocolors46.default.dim("\u25CB no host")}   ${import_picocolors46.default.dim(row.name)}`);
+  for (const row of noHost) console.log(`  ${import_picocolors47.default.dim("\u25CB no host")}   ${import_picocolors47.default.dim(row.name)}`);
   if (printedAny || noHost.length > 0) console.log("");
   const claimedPids = /* @__PURE__ */ new Set();
   for (const [, entry2] of projects2) {
@@ -122937,37 +123566,37 @@ async function runHosts(opts = {}) {
   let reapFailed = 0;
   if (orphans.length > 0) {
     console.log(
-      import_picocolors46.default.yellow(`  \u26A0 ${orphans.length} orphaned source host(s) \u2014 no registered repo owns them:`)
+      import_picocolors47.default.yellow(`  \u26A0 ${orphans.length} orphaned source host(s) \u2014 no registered repo owns them:`)
     );
-    for (const o5 of orphans) console.log(import_picocolors46.default.dim(`      pid ${o5.pid}  port ${o5.port}`));
+    for (const o5 of orphans) console.log(import_picocolors47.default.dim(`      pid ${o5.pid}  port ${o5.port}`));
     if (opts.reap) {
       let reaped = 0;
       for (const o5 of orphans) {
         if (await reapPid(o5.pid)) {
           reaped++;
-          console.log(`  ${import_picocolors46.default.green("\u2713")} reaped pid ${o5.pid} ${import_picocolors46.default.dim(`(port ${o5.port})`)}`);
+          console.log(`  ${import_picocolors47.default.green("\u2713")} reaped pid ${o5.pid} ${import_picocolors47.default.dim(`(port ${o5.port})`)}`);
         } else {
           reapFailed++;
-          console.log(import_picocolors46.default.red(`  \u2717 could not stop pid ${o5.pid} (port ${o5.port})`));
+          console.log(import_picocolors47.default.red(`  \u2717 could not stop pid ${o5.pid} (port ${o5.port})`));
         }
       }
-      console.log(import_picocolors46.default.dim(`  Reaped ${reaped}/${orphans.length} orphan(s).`));
+      console.log(import_picocolors47.default.dim(`  Reaped ${reaped}/${orphans.length} orphan(s).`));
     } else {
-      console.log(import_picocolors46.default.dim("  Run `horus hosts --reap` to stop them."));
+      console.log(import_picocolors47.default.dim("  Run `horus hosts --reap` to stop them."));
     }
     console.log("");
   }
   if (projects2.length === 0 && orphans.length === 0) {
-    console.log(import_picocolors46.default.dim("No registered projects. Run `horus index` in a repo first."));
+    console.log(import_picocolors47.default.dim("No registered projects. Run `horus index` in a repo first."));
     return 0;
   }
   if (!printedAny && orphans.length === 0) {
-    console.log(import_picocolors46.default.dim("No source-intelligence hosts found. Run `horus index` to start one."));
+    console.log(import_picocolors47.default.dim("No source-intelligence hosts found. Run `horus index` to start one."));
     return 0;
   }
   const running = countDistinctLiveHosts(rows);
   console.log(
-    import_picocolors46.default.dim(
+    import_picocolors47.default.dim(
       `${running} running${orphans.length ? ` \xB7 ${orphans.length} orphan(s)` : ""} \xB7 horus hosts --reap to clear orphans \xB7 horus stop --all to stop everything`
     )
   );
@@ -122984,7 +123613,7 @@ function extractPort2(hostUrl) {
 
 // ../../packages/cli/src/commands/doctor.ts
 init_cjs_shims();
-var import_picocolors47 = __toESM(require_picocolors(), 1);
+var import_picocolors48 = __toESM(require_picocolors(), 1);
 var DEFAULT_DB_URL4 = "postgresql://horus:horus@localhost:5433/horus";
 var CONNECTOR_CHECKS = {
   // Elasticsearch (runtime logs)
@@ -123101,9 +123730,9 @@ var CONNECTOR_CHECKS = {
 };
 var DOCTOR_CONNECTOR_KEYS = Object.keys(CONNECTOR_CHECKS);
 function mark2(status) {
-  if (status === "pass") return import_picocolors47.default.green("\u2713");
-  if (status === "warn") return import_picocolors47.default.yellow("~");
-  return import_picocolors47.default.red("\u2717");
+  if (status === "pass") return import_picocolors48.default.green("\u2713");
+  if (status === "warn") return import_picocolors48.default.yellow("~");
+  return import_picocolors48.default.red("\u2717");
 }
 async function runDoctor(opts) {
   const cwd = opts?.cwd ?? process.cwd();
@@ -123167,6 +123796,38 @@ async function runDoctor(opts) {
       next: "run `horus init` then `horus index` to set up source intelligence"
     });
   }
+  {
+    if (repoRoot && !isHorusGitignored(repoRoot)) {
+      checks.push({
+        label: "Secrets gitignore",
+        status: "warn",
+        detail: ".horus/ is NOT gitignored \u2014 credentials could be committed",
+        next: "run `horus secrets migrate` (also hardens .gitignore), or add `.horus/` to .gitignore"
+      });
+    } else if (repoRoot) {
+      checks.push({ label: "Secrets gitignore", status: "pass", detail: ".horus/ is gitignored" });
+    }
+    if (configPath) {
+      try {
+        const plaintext = findPlaintextConnectorSecrets(readLocalConfig(configPath).project);
+        if (plaintext.length > 0) {
+          checks.push({
+            label: "Secret storage",
+            status: "warn",
+            detail: `${plaintext.length} plaintext credential(s) in config.json: ${plaintext.join(", ")}`,
+            next: "run `horus secrets migrate` to encrypt them and strip config.json"
+          });
+        } else {
+          checks.push({
+            label: "Secret storage",
+            status: "pass",
+            detail: "no plaintext credentials in config.json"
+          });
+        }
+      } catch {
+      }
+    }
+  }
   {
     const dbChecker = opts?._dbCheck ?? checkDatabase;
     let dbUrl = process.env["DATABASE_URL"] ?? DEFAULT_DB_URL4;
@@ -123243,15 +123904,15 @@ async function runDoctor(opts) {
     write(JSON.stringify(output, null, 2));
     return hasFailure ? 1 : 0;
   }
-  write(import_picocolors47.default.bold("\nHorus readiness check\n"));
+  write(import_picocolors48.default.bold("\nHorus readiness check\n"));
   for (const check2 of checks) {
-    write(`  ${mark2(check2.status)} ${import_picocolors47.default.bold(check2.label.padEnd(26))}  ${import_picocolors47.default.dim(check2.detail)}`);
+    write(`  ${mark2(check2.status)} ${import_picocolors48.default.bold(check2.label.padEnd(26))}  ${import_picocolors48.default.dim(check2.detail)}`);
     if (check2.next) {
-      write(`    ${import_picocolors47.default.dim("\u2192 " + check2.next)}`);
+      write(`    ${import_picocolors48.default.dim("\u2192 " + check2.next)}`);
     }
   }
   write("");
-  write(import_picocolors47.default.dim("  Hit a bug or a missing capability? Report it:  horus report"));
+  write(import_picocolors48.default.dim("  Hit a bug or a missing capability? Report it:  horus report"));
   write("");
   return hasFailure ? 1 : 0;
 }
@@ -123259,16 +123920,16 @@ async function runDoctor(opts) {
 // ../../packages/cli/src/commands/providers-doctor.ts
 init_cjs_shims();
 var import_node_child_process12 = require("child_process");
-var import_picocolors48 = __toESM(require_picocolors(), 1);
+var import_picocolors49 = __toESM(require_picocolors(), 1);
 function statusMark(status) {
-  if (status === "ready") return import_picocolors48.default.green("\u2713");
-  if (status === "installed") return import_picocolors48.default.yellow("~");
-  return import_picocolors48.default.red("\u2717");
+  if (status === "ready") return import_picocolors49.default.green("\u2713");
+  if (status === "installed") return import_picocolors49.default.yellow("~");
+  return import_picocolors49.default.red("\u2717");
 }
 function statusLabel(status) {
-  if (status === "ready") return import_picocolors48.default.green("ready");
-  if (status === "installed") return import_picocolors48.default.yellow("installed (not configured)");
-  return import_picocolors48.default.dim("not found on PATH");
+  if (status === "ready") return import_picocolors49.default.green("ready");
+  if (status === "installed") return import_picocolors49.default.yellow("installed (not configured)");
+  return import_picocolors49.default.dim("not found on PATH");
 }
 function detectBinary(id) {
   const result = (0, import_node_child_process12.spawnSync)(id, ["--version"], { stdio: "pipe", timeout: 2e3 });
@@ -123285,7 +123946,7 @@ async function runProvidersDoctorCommand(opts) {
   const registry2 = opts?.registry ?? DEFAULT_LOCAL_PROVIDER_REGISTRY;
   const write = opts?.write ?? ((line2) => console.log(line2));
   const results = buildProviderResults(registry2, opts?._detect);
-  write(import_picocolors48.default.bold("\nLocal AI providers\n"));
+  write(import_picocolors49.default.bold("\nLocal AI providers\n"));
   for (const result of results) {
     const descriptor = registry2.get(result.id);
     const name2 = descriptor?.displayName ?? result.id;
@@ -123293,11 +123954,11 @@ async function runProvidersDoctorCommand(opts) {
       `  ${statusMark(result.status)} ${result.id.padEnd(8)}  ${name2.padEnd(22)}  ${statusLabel(result.status)}`
     );
     if (result.status !== "ready" && result.detail) {
-      write(`    ${import_picocolors48.default.dim("\u2192 " + result.detail)}`);
+      write(`    ${import_picocolors49.default.dim("\u2192 " + result.detail)}`);
     }
   }
   write("");
-  write(import_picocolors48.default.bold("Cloud AI providers\n"));
+  write(import_picocolors49.default.bold("Cloud AI providers\n"));
   let source = null;
   if (opts?._anthropicKey !== void 0) {
     source = opts._anthropicKey ? "env" : null;
@@ -123312,18 +123973,18 @@ async function runProvidersDoctorCommand(opts) {
   }
   if (source === "config") {
     write(
-      `  ${import_picocolors48.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors48.default.green("configured (local .horus config)")}`
+      `  ${import_picocolors49.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors49.default.green("configured (local .horus config)")}`
     );
   } else if (source === "env") {
     write(
-      `  ${import_picocolors48.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors48.default.green("configured (ANTHROPIC_API_KEY env)")}`
+      `  ${import_picocolors49.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors49.default.green("configured (ANTHROPIC_API_KEY env)")}`
     );
   } else {
     write(
-      `  ${import_picocolors48.default.red("\u2717")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors48.default.dim("not configured")}`
+      `  ${import_picocolors49.default.red("\u2717")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors49.default.dim("not configured")}`
     );
     write(
-      `    ${import_picocolors48.default.dim("\u2192 run `horus connect ai` (or set ANTHROPIC_API_KEY) to enable `horus investigate --ai`")}`
+      `    ${import_picocolors49.default.dim("\u2192 run `horus connect ai` (or set ANTHROPIC_API_KEY) to enable `horus investigate --ai`")}`
     );
   }
   write("");
@@ -123332,9 +123993,9 @@ async function runProvidersDoctorCommand(opts) {
 
 // ../../packages/cli/src/commands/generate-config.ts
 init_cjs_shims();
-var import_node_fs22 = require("fs");
-var import_node_path25 = require("path");
-var import_picocolors49 = __toESM(require_picocolors(), 1);
+var import_node_fs24 = require("fs");
+var import_node_path26 = require("path");
+var import_picocolors50 = __toESM(require_picocolors(), 1);
 function configTemplate(name2, repoPath) {
   return `export default {
   database: {
@@ -123382,39 +124043,39 @@ async function runGenerateConfig(opts) {
   const defaults2 = localConfigPath2 != null ? projectDefaults(localConfigPath2) : null;
   const hasLocalConfig = defaults2 != null;
   const defaultOut = hasLocalConfig ? "horus.config.example.js" : "horus.config.js";
-  const outPath = (0, import_node_path25.resolve)(cwd, opts.out ?? defaultOut);
+  const outPath = (0, import_node_path26.resolve)(cwd, opts.out ?? defaultOut);
   const name2 = opts.name ?? defaults2?.name ?? "my-project";
   const repoPath = opts.repo ?? defaults2?.repoPath ?? `/path/to/${name2}`;
-  if ((0, import_node_fs22.existsSync)(outPath) && !opts.force) {
-    log(`${import_picocolors49.default.red("\u2717")} ${outPath} already exists`);
-    log(import_picocolors49.default.dim("  pass --force to overwrite"));
+  if ((0, import_node_fs24.existsSync)(outPath) && !opts.force) {
+    log(`${import_picocolors50.default.red("\u2717")} ${outPath} already exists`);
+    log(import_picocolors50.default.dim("  pass --force to overwrite"));
     return 1;
   }
   try {
-    (0, import_node_fs22.mkdirSync)((0, import_node_path25.dirname)(outPath), { recursive: true });
-    (0, import_node_fs22.writeFileSync)(outPath, configTemplate(name2, repoPath), "utf8");
+    (0, import_node_fs24.mkdirSync)((0, import_node_path26.dirname)(outPath), { recursive: true });
+    (0, import_node_fs24.writeFileSync)(outPath, configTemplate(name2, repoPath), "utf8");
   } catch (err2) {
-    log(`${import_picocolors49.default.red("\u2717")} Could not write ${outPath}: ${err2.message}`);
+    log(`${import_picocolors50.default.red("\u2717")} Could not write ${outPath}: ${err2.message}`);
     return 1;
   }
-  log(`${import_picocolors49.default.green("\u2713")} Created ${outPath}`);
-  log(import_picocolors49.default.dim(`  project: ${name2}`));
-  log(import_picocolors49.default.dim(`  repo:    ${repoPath}`));
+  log(`${import_picocolors50.default.green("\u2713")} Created ${outPath}`);
+  log(import_picocolors50.default.dim(`  project: ${name2}`));
+  log(import_picocolors50.default.dim(`  repo:    ${repoPath}`));
   if (hasLocalConfig && localConfigPath2 != null) {
     log("");
-    log(import_picocolors49.default.yellow("Note:") + ` an initialized Horus project config exists at ${localConfigPath2}`);
+    log(import_picocolors50.default.yellow("Note:") + ` an initialized Horus project config exists at ${localConfigPath2}`);
     log("  \u2022 .horus/config.json  \u2014 project config used by `horus investigate` from this repo");
     log("  \u2022 horus.config.js     \u2014 standalone/global config used with `horus doctor --config <path>`");
-    log(import_picocolors49.default.dim(`  next:  review ${outPath} and copy/adapt it as needed`));
+    log(import_picocolors50.default.dim(`  next:  review ${outPath} and copy/adapt it as needed`));
   } else {
-    log(import_picocolors49.default.dim(`  next:    horus doctor --config ${outPath}`));
+    log(import_picocolors50.default.dim(`  next:    horus doctor --config ${outPath}`));
   }
   return 0;
 }
 
 // ../../packages/cli/src/commands/readiness.ts
 init_cjs_shims();
-var import_picocolors50 = __toESM(require_picocolors(), 1);
+var import_picocolors51 = __toESM(require_picocolors(), 1);
 var READINESS_AI_CONTRACT = `Provide a clearly separated AI readiness summary with:
 
 Overall assessment
@@ -123437,9 +124098,9 @@ Confidence / gaps
 - Which checks Horus could verify vs. which require manual confirmation`;
 var DEFAULT_DB_URL5 = "postgresql://horus:horus@localhost:5433/horus";
 function mark3(status) {
-  if (status === "pass") return import_picocolors50.default.green("\u2713");
-  if (status === "warn") return import_picocolors50.default.yellow("~");
-  return import_picocolors50.default.red("\u2717");
+  if (status === "pass") return import_picocolors51.default.green("\u2713");
+  if (status === "warn") return import_picocolors51.default.yellow("~");
+  return import_picocolors51.default.red("\u2717");
 }
 async function runReadiness(opts) {
   const cwd = opts?.cwd ?? process.cwd();
@@ -123644,20 +124305,20 @@ async function runReadiness(opts) {
   }
   const blockingChecks = checks.filter((c4) => c4.blocking);
   const optionalChecks = checks.filter((c4) => !c4.blocking);
-  write(import_picocolors50.default.bold("\nHorus release readiness\n"));
-  write(import_picocolors50.default.bold("  Blocking"));
+  write(import_picocolors51.default.bold("\nHorus release readiness\n"));
+  write(import_picocolors51.default.bold("  Blocking"));
   for (const check2 of blockingChecks) {
-    write(`    ${mark3(check2.status)} ${import_picocolors50.default.bold(check2.label.padEnd(22))}  ${import_picocolors50.default.dim(check2.detail)}`);
+    write(`    ${mark3(check2.status)} ${import_picocolors51.default.bold(check2.label.padEnd(22))}  ${import_picocolors51.default.dim(check2.detail)}`);
     if (check2.next) {
-      write(`      ${import_picocolors50.default.dim("\u2192 " + check2.next)}`);
+      write(`      ${import_picocolors51.default.dim("\u2192 " + check2.next)}`);
     }
   }
   write("");
-  write(import_picocolors50.default.bold("  Optional"));
+  write(import_picocolors51.default.bold("  Optional"));
   for (const check2 of optionalChecks) {
-    write(`    ${mark3(check2.status)} ${import_picocolors50.default.bold(check2.label.padEnd(22))}  ${import_picocolors50.default.dim(check2.detail)}`);
+    write(`    ${mark3(check2.status)} ${import_picocolors51.default.bold(check2.label.padEnd(22))}  ${import_picocolors51.default.dim(check2.detail)}`);
     if (check2.next) {
-      write(`      ${import_picocolors50.default.dim("\u2192 " + check2.next)}`);
+      write(`      ${import_picocolors51.default.dim("\u2192 " + check2.next)}`);
     }
   }
   write("");
@@ -123665,21 +124326,21 @@ async function runReadiness(opts) {
   const optionalWarns = optionalChecks.filter((c4) => c4.status === "warn").length;
   if (blockingFails.length === 0) {
     if (optionalWarns === 0) {
-      write(import_picocolors50.default.green("  Ready for demo/release."));
+      write(import_picocolors51.default.green("  Ready for demo/release."));
     } else {
       write(
-        import_picocolors50.default.yellow(
+        import_picocolors51.default.yellow(
           `  Ready for a basic demo. ${optionalWarns} optional item(s) not configured \u2014 investigation evidence will be limited.`
         )
       );
     }
   } else {
     write(
-      import_picocolors50.default.red(
+      import_picocolors51.default.red(
         `  Not ready. ${blockingFails.length} blocking item(s) must be resolved before demo/release.`
       )
     );
-    write(import_picocolors50.default.dim("  Re-run `horus readiness` after resolving the items above."));
+    write(import_picocolors51.default.dim("  Re-run `horus readiness` after resolving the items above."));
   }
   write("");
   if (opts?.ai) {
@@ -123694,7 +124355,7 @@ async function runReadiness(opts) {
     });
     console.log("\n" + renderInterpretation(result));
     if (!result.ok) {
-      console.error(import_picocolors50.default.yellow(`[ai] ${result.warning}`));
+      console.error(import_picocolors51.default.yellow(`[ai] ${result.warning}`));
     }
   }
   return blockingFails.length > 0 ? 1 : 0;
@@ -123702,33 +124363,33 @@ async function runReadiness(opts) {
 
 // ../../packages/cli/src/commands/skill.ts
 init_cjs_shims();
-var import_node_fs23 = require("fs");
-var import_node_path26 = require("path");
-var import_node_os9 = require("os");
+var import_node_fs25 = require("fs");
+var import_node_path27 = require("path");
+var import_node_os10 = require("os");
 var import_promises3 = require("readline/promises");
-var import_picocolors51 = __toESM(require_picocolors(), 1);
+var import_picocolors52 = __toESM(require_picocolors(), 1);
 var SUPPORTED_TARGETS = ["claude", "codex", "gemini", "cursor", "generic"];
 function isValidTarget(target) {
   return SUPPORTED_TARGETS.includes(target);
 }
 function getLegacyClaudeSkillPath(opts) {
-  const base2 = opts.global ? (0, import_node_os9.homedir)() : opts.cwd ?? process.cwd();
-  return (0, import_node_path26.join)(base2, ".claude", "skills", "horus.md");
+  const base2 = opts.global ? (0, import_node_os10.homedir)() : opts.cwd ?? process.cwd();
+  return (0, import_node_path27.join)(base2, ".claude", "skills", "horus.md");
 }
 function getSkillInstallPath(target, opts) {
-  const base2 = opts.global ? (0, import_node_os9.homedir)() : opts.cwd ?? process.cwd();
+  const base2 = opts.global ? (0, import_node_os10.homedir)() : opts.cwd ?? process.cwd();
   switch (target) {
     case "claude":
-      return (0, import_node_path26.join)(base2, ".claude", "skills", "horus", "SKILL.md");
+      return (0, import_node_path27.join)(base2, ".claude", "skills", "horus", "SKILL.md");
     case "gemini":
-      return opts.global ? (0, import_node_path26.join)(base2, ".gemini", "GEMINI.md") : (0, import_node_path26.join)(base2, "GEMINI.md");
+      return opts.global ? (0, import_node_path27.join)(base2, ".gemini", "GEMINI.md") : (0, import_node_path27.join)(base2, "GEMINI.md");
     case "cursor":
-      return opts.global ? (0, import_node_path26.join)(base2, ".cursorrules") : (0, import_node_path26.join)(base2, ".cursor", "rules", "horus.mdc");
+      return opts.global ? (0, import_node_path27.join)(base2, ".cursorrules") : (0, import_node_path27.join)(base2, ".cursor", "rules", "horus.mdc");
     case "codex":
-      return opts.global ? (0, import_node_path26.join)(base2, ".codex", "AGENTS.md") : (0, import_node_path26.join)(base2, "AGENTS.md");
+      return opts.global ? (0, import_node_path27.join)(base2, ".codex", "AGENTS.md") : (0, import_node_path27.join)(base2, "AGENTS.md");
     case "generic":
     default:
-      return (0, import_node_path26.join)(base2, ".horus", "skills", `horus-${target}.md`);
+      return (0, import_node_path27.join)(base2, ".horus", "skills", `horus-${target}.md`);
   }
 }
 var BASE_SKILL = `# Horus Grounded Investigation Skill
@@ -124045,66 +124706,66 @@ async function confirm(message) {
 async function runSkillInstall(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors51.default.red("\u2717")} Unknown target: ${import_picocolors51.default.bold(target)}`);
-    log(import_picocolors51.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors52.default.red("\u2717")} Unknown target: ${import_picocolors52.default.bold(target)}`);
+    log(import_picocolors52.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   const outPath = getSkillInstallPath(target, { global: opts.global, cwd: opts.cwd });
   const content = generateSkillContent(target);
   if (target === "claude") {
     const legacyPath = getLegacyClaudeSkillPath({ global: opts.global, cwd: opts.cwd });
-    if ((0, import_node_fs23.existsSync)(legacyPath)) {
+    if ((0, import_node_fs25.existsSync)(legacyPath)) {
       if (!opts.force) {
         const confirmed = await (opts.confirm ?? confirm)(
           `Found old flat skill file at ${legacyPath}. Replace it with the new directory layout?`
         );
         if (!confirmed) {
-          log(`${import_picocolors51.default.yellow("!")} Migration cancelled; existing skill left untouched.`);
-          log(import_picocolors51.default.dim("  Pass --force to replace without prompting."));
+          log(`${import_picocolors52.default.yellow("!")} Migration cancelled; existing skill left untouched.`);
+          log(import_picocolors52.default.dim("  Pass --force to replace without prompting."));
           return 1;
         }
       }
       try {
-        (0, import_node_fs23.rmSync)(legacyPath);
-        log(`${import_picocolors51.default.yellow("!")} Replaced old flat skill file: ${legacyPath}`);
+        (0, import_node_fs25.rmSync)(legacyPath);
+        log(`${import_picocolors52.default.yellow("!")} Replaced old flat skill file: ${legacyPath}`);
       } catch (err2) {
-        log(`${import_picocolors51.default.red("\u2717")} Could not remove legacy skill file ${legacyPath}: ${err2.message}`);
+        log(`${import_picocolors52.default.red("\u2717")} Could not remove legacy skill file ${legacyPath}: ${err2.message}`);
         return 1;
       }
     }
   }
-  if ((0, import_node_fs23.existsSync)(outPath) && !opts.force) {
-    log(`${import_picocolors51.default.red("\u2717")} ${outPath} already exists`);
-    log(import_picocolors51.default.dim("  pass --force to overwrite"));
+  if ((0, import_node_fs25.existsSync)(outPath) && !opts.force) {
+    log(`${import_picocolors52.default.red("\u2717")} ${outPath} already exists`);
+    log(import_picocolors52.default.dim("  pass --force to overwrite"));
     return 1;
   }
   try {
-    (0, import_node_fs23.mkdirSync)((0, import_node_path26.dirname)(outPath), { recursive: true });
-    (0, import_node_fs23.writeFileSync)(outPath, content, "utf8");
+    (0, import_node_fs25.mkdirSync)((0, import_node_path27.dirname)(outPath), { recursive: true });
+    (0, import_node_fs25.writeFileSync)(outPath, content, "utf8");
   } catch (err2) {
-    log(`${import_picocolors51.default.red("\u2717")} Could not write ${outPath}: ${err2.message}`);
+    log(`${import_picocolors52.default.red("\u2717")} Could not write ${outPath}: ${err2.message}`);
     return 1;
   }
-  log(`${import_picocolors51.default.green("\u2713")} Horus skill installed \u2192 ${outPath}`);
+  log(`${import_picocolors52.default.green("\u2713")} Horus skill installed \u2192 ${outPath}`);
   if (target === "claude") {
-    log(import_picocolors51.default.dim("  Claude Code will load this skill automatically."));
-    log(import_picocolors51.default.dim("  Invoke it with: /horus"));
+    log(import_picocolors52.default.dim("  Claude Code will load this skill automatically."));
+    log(import_picocolors52.default.dim("  Invoke it with: /horus"));
   } else if (target === "gemini") {
-    log(import_picocolors51.default.dim("  Gemini CLI will load this context file automatically."));
+    log(import_picocolors52.default.dim("  Gemini CLI will load this context file automatically."));
   } else if (target === "cursor") {
-    log(import_picocolors51.default.dim("  Cursor will load this rule automatically."));
+    log(import_picocolors52.default.dim("  Cursor will load this rule automatically."));
   } else if (target === "codex") {
-    log(import_picocolors51.default.dim("  Codex CLI will load this file automatically."));
+    log(import_picocolors52.default.dim("  Codex CLI will load this file automatically."));
   } else {
-    log(import_picocolors51.default.dim(`  Copy or reference this file in your ${target} agent instructions.`));
+    log(import_picocolors52.default.dim(`  Copy or reference this file in your ${target} agent instructions.`));
   }
   return 0;
 }
 async function runSkillPrint(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors51.default.red("\u2717")} Unknown target: ${import_picocolors51.default.bold(target)}`);
-    log(import_picocolors51.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors52.default.red("\u2717")} Unknown target: ${import_picocolors52.default.bold(target)}`);
+    log(import_picocolors52.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   process.stdout.write(generateSkillContent(target));
@@ -124113,8 +124774,8 @@ async function runSkillPrint(target, opts) {
 async function runSkillPath(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors51.default.red("\u2717")} Unknown target: ${import_picocolors51.default.bold(target)}`);
-    log(import_picocolors51.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors52.default.red("\u2717")} Unknown target: ${import_picocolors52.default.bold(target)}`);
+    log(import_picocolors52.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   const outPath = getSkillInstallPath(target, { global: opts.global, cwd: opts.cwd });
@@ -124124,7 +124785,7 @@ async function runSkillPath(target, opts) {
 
 // ../../packages/cli/src/commands/login.ts
 init_cjs_shims();
-var import_picocolors52 = __toESM(require_picocolors(), 1);
+var import_picocolors53 = __toESM(require_picocolors(), 1);
 var sleep2 = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
 async function loginWithToken(apiBaseUrl, token) {
   const client = new CloudClient(apiBaseUrl, token);
@@ -124140,19 +124801,19 @@ async function loginWithToken(apiBaseUrl, token) {
       }
     });
     console.log(
-      `${import_picocolors52.default.green("\u2713")} Logged in as ${import_picocolors52.default.bold(me3.user.primaryEmail)}. Run ${import_picocolors52.default.bold("horus cloud link")} to connect this repo.`
+      `${import_picocolors53.default.green("\u2713")} Logged in as ${import_picocolors53.default.bold(me3.user.primaryEmail)}. Run ${import_picocolors53.default.bold("horus cloud link")} to connect this repo.`
     );
     return 0;
   } catch (err2) {
     if (err2 instanceof CloudOfflineError) {
-      console.error(import_picocolors52.default.red(err2.message));
+      console.error(import_picocolors53.default.red(err2.message));
       return 1;
     }
     if (err2 instanceof CloudError && err2.status === 401) {
-      console.error(import_picocolors52.default.red("That token is not valid. Create a fresh one in the dashboard and try again."));
+      console.error(import_picocolors53.default.red("That token is not valid. Create a fresh one in the dashboard and try again."));
       return 1;
     }
-    console.error(import_picocolors52.default.red(`Login failed: ${err2.message}`));
+    console.error(import_picocolors53.default.red(`Login failed: ${err2.message}`));
     return 1;
   }
 }
@@ -124163,19 +124824,19 @@ async function loginWithBrowser(apiBaseUrl) {
     session = await client.startCliSession();
   } catch (err2) {
     if (err2 instanceof CloudOfflineError) {
-      console.error(import_picocolors52.default.red(err2.message));
+      console.error(import_picocolors53.default.red(err2.message));
       return 1;
     }
-    console.error(import_picocolors52.default.red(`Could not start login: ${err2.message}`));
+    console.error(import_picocolors53.default.red(`Could not start login: ${err2.message}`));
     return 1;
   }
   console.log("");
   console.log(`  To sign in, open this URL in your browser:`);
-  console.log(`    ${import_picocolors52.default.cyan(import_picocolors52.default.bold(session.verificationUri))}`);
+  console.log(`    ${import_picocolors53.default.cyan(import_picocolors53.default.bold(session.verificationUri))}`);
   console.log("");
-  console.log(`  and enter the code:  ${import_picocolors52.default.bold(session.userCode)}`);
+  console.log(`  and enter the code:  ${import_picocolors53.default.bold(session.userCode)}`);
   console.log("");
-  console.log(import_picocolors52.default.dim(`  Waiting for approval\u2026  (press Ctrl+C to cancel)`));
+  console.log(import_picocolors53.default.dim(`  Waiting for approval\u2026  (press Ctrl+C to cancel)`));
   openBrowser(session.verificationUriComplete);
   const deadline = Date.now() + session.expiresIn * 1e3;
   let intervalMs = Math.max(session.interval, 1) * 1e3;
@@ -124186,7 +124847,7 @@ async function loginWithBrowser(apiBaseUrl) {
       poll = await client.pollCliSession(session.deviceCode);
     } catch (err2) {
       if (err2 instanceof CloudOfflineError) {
-        console.error(import_picocolors52.default.red(`
+        console.error(import_picocolors53.default.red(`
 ${err2.message}`));
         return 1;
       }
@@ -124199,14 +124860,14 @@ ${err2.message}`));
         intervalMs += 2e3;
         break;
       case "denied":
-        console.error(import_picocolors52.default.red("\nLogin was denied in the browser."));
+        console.error(import_picocolors53.default.red("\nLogin was denied in the browser."));
         return 1;
       case "expired":
-        console.error(import_picocolors52.default.red("\nThis login request expired. Run `horus login` again."));
+        console.error(import_picocolors53.default.red("\nThis login request expired. Run `horus login` again."));
         return 1;
       case "approved":
         if (!poll.token || !poll.account) {
-          console.error(import_picocolors52.default.red("\nLogin approved but no token was returned. Try again."));
+          console.error(import_picocolors53.default.red("\nLogin approved but no token was returned. Try again."));
           return 1;
         }
         writeAuth({
@@ -124216,12 +124877,12 @@ ${err2.message}`));
         });
         console.log(
           `
-${import_picocolors52.default.green("\u2713")} Logged in as ${import_picocolors52.default.bold(poll.account.email)}. Run ${import_picocolors52.default.bold("horus cloud link")} to connect this repo.`
+${import_picocolors53.default.green("\u2713")} Logged in as ${import_picocolors53.default.bold(poll.account.email)}. Run ${import_picocolors53.default.bold("horus cloud link")} to connect this repo.`
         );
         return 0;
     }
   }
-  console.error(import_picocolors52.default.red("\nTimed out waiting for approval. Run `horus login` again."));
+  console.error(import_picocolors53.default.red("\nTimed out waiting for approval. Run `horus login` again."));
   return 1;
 }
 async function runLogin(opts = {}) {
@@ -124235,7 +124896,7 @@ async function runLogin(opts = {}) {
 async function runLogout() {
   const auth = readAuth();
   if (!auth) {
-    console.log(import_picocolors52.default.dim("Not logged in."));
+    console.log(import_picocolors53.default.dim("Not logged in."));
     return 0;
   }
   const session = authedClient();
@@ -124249,13 +124910,13 @@ async function runLogout() {
     }
   }
   clearAuth();
-  console.log(`${import_picocolors52.default.green("\u2713")} Logged out. Local mode still works.`);
+  console.log(`${import_picocolors53.default.green("\u2713")} Logged out. Local mode still works.`);
   return 0;
 }
 
 // ../../packages/cli/src/commands/cloud.ts
 init_cjs_shims();
-var import_picocolors53 = __toESM(require_picocolors(), 1);
+var import_picocolors54 = __toESM(require_picocolors(), 1);
 var import_promises4 = require("readline/promises");
 
 // ../../packages/cli/src/lib/cloud/git.ts
@@ -124300,7 +124961,7 @@ async function runCloudLink(opts = {}) {
   const root = repoRootOrCwd(opts.cwd);
   const session = authedClient();
   if (!session) {
-    console.error(import_picocolors53.default.red(`Not logged in. Run ${import_picocolors53.default.bold("horus login")} first.`));
+    console.error(import_picocolors54.default.red(`Not logged in. Run ${import_picocolors54.default.bold("horus login")} first.`));
     return 1;
   }
   let ctx;
@@ -124310,7 +124971,7 @@ async function runCloudLink(opts = {}) {
     return reportCloudError(err2);
   }
   const remote = detectGitRemote(root);
-  if (remote) console.log(import_picocolors53.default.dim(`Detected git remote: ${remote.remoteUrl}`));
+  if (remote) console.log(import_picocolors54.default.dim(`Detected git remote: ${remote.remoteUrl}`));
   let resolved = null;
   let target = opts.project;
   if (!target) {
@@ -124326,7 +124987,7 @@ async function runCloudLink(opts = {}) {
       const org = ctx.organizations.find((o5) => o5.id === match.organizationId);
       if (ws && org) {
         target = `${org.slug}/${ws.slug}/${match.slug}`;
-        console.log(import_picocolors53.default.dim(`Matched existing project by remote: ${import_picocolors53.default.bold(target)}`));
+        console.log(import_picocolors54.default.dim(`Matched existing project by remote: ${import_picocolors54.default.bold(target)}`));
       }
     }
   }
@@ -124335,8 +124996,8 @@ async function runCloudLink(opts = {}) {
     if (created === "aborted") return 1;
     if (!created) {
       console.error(
-        import_picocolors53.default.red("No project to link.") + `
-  Run ${import_picocolors53.default.bold("horus cloud link")} in a TTY to create one, pass ${import_picocolors53.default.bold("--project <org/workspace/project>")}, or create a project at ${import_picocolors53.default.bold("https://cloud.horus.sh")}.`
+        import_picocolors54.default.red("No project to link.") + `
+  Run ${import_picocolors54.default.bold("horus cloud link")} in a TTY to create one, pass ${import_picocolors54.default.bold("--project <org/workspace/project>")}, or create a project at ${import_picocolors54.default.bold("https://cloud.horus.sh")}.`
       );
       return 1;
     }
@@ -124346,8 +125007,8 @@ async function runCloudLink(opts = {}) {
     resolved = resolveTriple(ctx, target);
     if (!resolved) {
       console.error(
-        import_picocolors53.default.red(`You don't have access to ${import_picocolors53.default.bold(target)}.`) + `
-  Run ${import_picocolors53.default.bold("horus context list")} to see available projects.`
+        import_picocolors54.default.red(`You don't have access to ${import_picocolors54.default.bold(target)}.`) + `
+  Run ${import_picocolors54.default.bold("horus context list")} to see available projects.`
       );
       return 1;
     }
@@ -124360,10 +125021,10 @@ async function runCloudLink(opts = {}) {
     project: resolved.project
   });
   console.log(
-    `${import_picocolors53.default.green("\u2713")} Linked. Context for this repo is now ${import_picocolors53.default.bold(label)} ${import_picocolors53.default.dim("(cloud)")}.`
+    `${import_picocolors54.default.green("\u2713")} Linked. Context for this repo is now ${import_picocolors54.default.bold(label)} ${import_picocolors54.default.dim("(cloud)")}.`
   );
   console.log(
-    import_picocolors53.default.dim(`  Investigations here save to Horus Cloud. ${import_picocolors53.default.bold("horus context use local")} to switch back.`)
+    import_picocolors54.default.dim(`  Investigations here save to Horus Cloud. ${import_picocolors54.default.bold("horus context use local")} to switch back.`)
   );
   return 0;
 }
@@ -124371,11 +125032,11 @@ async function runCloudUnlink(opts = {}) {
   const root = repoRootOrCwd(opts.cwd);
   const cfg = readCloudConfig(root);
   if (!cfg || cfg.context !== "cloud") {
-    console.log(import_picocolors53.default.dim("This repo isn't linked to a cloud project."));
+    console.log(import_picocolors54.default.dim("This repo isn't linked to a cloud project."));
     return 0;
   }
   clearCloudConfig(root);
-  console.log(`${import_picocolors53.default.green("\u2713")} Unlinked. This repo is back to ${import_picocolors53.default.bold("local")} mode.`);
+  console.log(`${import_picocolors54.default.green("\u2713")} Unlinked. This repo is back to ${import_picocolors54.default.bold("local")} mode.`);
   return 0;
 }
 async function runCloudStatus(opts = {}) {
@@ -124383,18 +125044,18 @@ async function runCloudStatus(opts = {}) {
   const cfg = readCloudConfig(root);
   const session = authedClient();
   if (!isCloudActive(cfg) || !cfg?.project) {
-    console.log(`${import_picocolors53.default.bold("Context:")}  local`);
-    console.log(`${import_picocolors53.default.bold("Storage:")}  local Postgres (~/.horus)`);
+    console.log(`${import_picocolors54.default.bold("Context:")}  local`);
+    console.log(`${import_picocolors54.default.bold("Storage:")}  local Postgres (~/.horus)`);
     console.log(
-      import_picocolors53.default.dim(`Tip:      ${import_picocolors53.default.bold("horus login")} then ${import_picocolors53.default.bold("horus cloud link")} to share investigations with your team.`)
+      import_picocolors54.default.dim(`Tip:      ${import_picocolors54.default.bold("horus login")} then ${import_picocolors54.default.bold("horus cloud link")} to share investigations with your team.`)
     );
     return 0;
   }
   const triple = `${cfg.organization?.slug}/${cfg.workspace?.slug}/${cfg.project.slug}`;
-  console.log(`${import_picocolors53.default.bold("Context:")}     ${triple}   ${import_picocolors53.default.dim("(cloud)")}`);
+  console.log(`${import_picocolors54.default.bold("Context:")}     ${triple}   ${import_picocolors54.default.dim("(cloud)")}`);
   let projectLine = `${cfg.project.slug}`;
   let metaLines = [];
-  let account = import_picocolors53.default.dim("not logged in");
+  let account = import_picocolors54.default.dim("not logged in");
   if (session) {
     account = session.auth.account.email;
     try {
@@ -124409,9 +125070,9 @@ async function runCloudStatus(opts = {}) {
     } catch {
     }
   }
-  console.log(`${import_picocolors53.default.bold("Project:")}     ${projectLine}`);
+  console.log(`${import_picocolors54.default.bold("Project:")}     ${projectLine}`);
   for (const line2 of metaLines) console.log(line2);
-  console.log(`${import_picocolors53.default.bold("Account:")}     ${account}`);
+  console.log(`${import_picocolors54.default.bold("Account:")}     ${account}`);
   return 0;
 }
 async function runCloudSync(opts = {}) {
@@ -124419,13 +125080,13 @@ async function runCloudSync(opts = {}) {
   const cfg = readCloudConfig(root);
   if (!isCloudActive(cfg) || !cfg.project) {
     console.error(
-      import_picocolors53.default.red("This repo isn't linked to a cloud project.") + ` Run ${import_picocolors53.default.bold("horus cloud link")} first.`
+      import_picocolors54.default.red("This repo isn't linked to a cloud project.") + ` Run ${import_picocolors54.default.bold("horus cloud link")} first.`
     );
     return 1;
   }
   const session = authedClient();
   if (!session) {
-    console.error(import_picocolors53.default.red(`Not logged in. Run ${import_picocolors53.default.bold("horus login")} first.`));
+    console.error(import_picocolors54.default.red(`Not logged in. Run ${import_picocolors54.default.bold("horus login")} first.`));
     return 1;
   }
   const { db, sql: sql2 } = await openDb(await resolveDbUrl(opts.config));
@@ -124443,26 +125104,26 @@ async function runCloudSync(opts = {}) {
     const target = `${cfg.organization?.slug}/${cfg.workspace?.slug}/${cfg.project.slug}`;
     if (uploadable.length === 0) {
       console.log(
-        import_picocolors53.default.dim(
+        import_picocolors54.default.dim(
           `No local investigations with reports to upload.` + (skippedNoReport ? ` (${skippedNoReport} without a report skipped)` : "")
         )
       );
       return 0;
     }
-    console.log(import_picocolors53.default.bold(`Will upload ${uploadable.length} investigation(s) to ${target} ${import_picocolors53.default.dim("(cloud)")}:`));
+    console.log(import_picocolors54.default.bold(`Will upload ${uploadable.length} investigation(s) to ${target} ${import_picocolors54.default.dim("(cloud)")}:`));
     for (const c4 of uploadable.slice(0, 20)) {
-      console.log(`  ${import_picocolors53.default.dim(c4.id.slice(0, 8))}  ${(c4.title ?? "untitled").slice(0, 70)}`);
+      console.log(`  ${import_picocolors54.default.dim(c4.id.slice(0, 8))}  ${(c4.title ?? "untitled").slice(0, 70)}`);
     }
-    if (uploadable.length > 20) console.log(import_picocolors53.default.dim(`  \u2026and ${uploadable.length - 20} more`));
-    if (skippedNoReport) console.log(import_picocolors53.default.dim(`  (${skippedNoReport} local investigation(s) without a report will be skipped)`));
+    if (uploadable.length > 20) console.log(import_picocolors54.default.dim(`  \u2026and ${uploadable.length - 20} more`));
+    if (skippedNoReport) console.log(import_picocolors54.default.dim(`  (${skippedNoReport} local investigation(s) without a report will be skipped)`));
     if (opts.dryRun) {
-      console.log(import_picocolors53.default.dim("Dry run \u2014 nothing uploaded. Re-run without --dry-run to upload."));
+      console.log(import_picocolors54.default.dim("Dry run \u2014 nothing uploaded. Re-run without --dry-run to upload."));
       return 0;
     }
     if (!opts.yes) {
       if (!process.stdin.isTTY) {
         console.error(
-          import_picocolors53.default.yellow(`Re-run with ${import_picocolors53.default.bold("--yes")} to upload, or ${import_picocolors53.default.bold("--dry-run")} to preview only.`)
+          import_picocolors54.default.yellow(`Re-run with ${import_picocolors54.default.bold("--yes")} to upload, or ${import_picocolors54.default.bold("--dry-run")} to preview only.`)
         );
         return 1;
       }
@@ -124470,7 +125131,7 @@ async function runCloudSync(opts = {}) {
       try {
         const answer = (await rl.question(`Upload ${uploadable.length} investigation(s) to ${target}? (y/N) `)).trim().toLowerCase();
         if (answer !== "y" && answer !== "yes") {
-          console.log(import_picocolors53.default.dim("Aborted. Nothing uploaded."));
+          console.log(import_picocolors54.default.dim("Aborted. Nothing uploaded."));
           return 0;
         }
       } finally {
@@ -124483,18 +125144,18 @@ async function runCloudSync(opts = {}) {
       try {
         const refs = await uploadInvestigationToCloud(session.client, cfg, c4.report, { db });
         created++;
-        console.log(`${import_picocolors53.default.green("\u2713")} ${import_picocolors53.default.dim(c4.id.slice(0, 8))} \u2192 ${refs.investigationId}`);
+        console.log(`${import_picocolors54.default.green("\u2713")} ${import_picocolors54.default.dim(c4.id.slice(0, 8))} \u2192 ${refs.investigationId}`);
       } catch (err2) {
         failed++;
-        console.error(`${import_picocolors53.default.red("\u2717")} ${import_picocolors53.default.dim(c4.id.slice(0, 8))} ${err2.message}`);
+        console.error(`${import_picocolors54.default.red("\u2717")} ${import_picocolors54.default.dim(c4.id.slice(0, 8))} ${err2.message}`);
       }
     }
     console.log("");
     console.log(
-      `${import_picocolors53.default.bold("Sync complete:")} ${import_picocolors53.default.green(`${created} uploaded`)}, ${skippedNoReport} skipped, ` + (failed ? import_picocolors53.default.red(`${failed} failed`) : "0 failed") + "."
+      `${import_picocolors54.default.bold("Sync complete:")} ${import_picocolors54.default.green(`${created} uploaded`)}, ${skippedNoReport} skipped, ` + (failed ? import_picocolors54.default.red(`${failed} failed`) : "0 failed") + "."
     );
     console.log(
-      import_picocolors53.default.dim("Local data was not modified. Re-running is safe \u2014 duplicates are deduped by idempotency key.")
+      import_picocolors54.default.dim("Local data was not modified. Re-running is safe \u2014 duplicates are deduped by idempotency key.")
     );
     return failed > 0 ? 1 : 0;
   } finally {
@@ -124505,8 +125166,8 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
   if (!process.stdin.isTTY && !yes) return null;
   if (ctx.organizations.length === 0) {
     console.error(
-      import_picocolors53.default.red("You're not a member of any organization yet.") + `
-  Create one at ${import_picocolors53.default.bold("https://cloud.horus.sh")} first.`
+      import_picocolors54.default.red("You're not a member of any organization yet.") + `
+  Create one at ${import_picocolors54.default.bold("https://cloud.horus.sh")} first.`
     );
     return null;
   }
@@ -124531,9 +125192,9 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
       const wsName = await ask2("New workspace name", repoName || "default");
       const ws = await client.createWorkspace(org.id, { name: wsName });
       workspace = { id: ws.id, slug: ws.slug };
-      console.log(import_picocolors53.default.dim(`Created workspace ${import_picocolors53.default.bold(ws.slug)}.`));
+      console.log(import_picocolors54.default.dim(`Created workspace ${import_picocolors54.default.bold(ws.slug)}.`));
     } else {
-      console.log(`Workspaces in ${import_picocolors53.default.bold(org.slug)}:`);
+      console.log(`Workspaces in ${import_picocolors54.default.bold(org.slug)}:`);
       orgWorkspaces.forEach((w4, i3) => console.log(`  ${i3 + 1}) ${w4.slug}`));
       console.log(`  ${orgWorkspaces.length + 1}) + create a new workspace`);
       const pick2 = Number(await ask2("Workspace number", "1"));
@@ -124541,7 +125202,7 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
         const wsName = await ask2("New workspace name", repoName || "default");
         const ws = await client.createWorkspace(org.id, { name: wsName });
         workspace = { id: ws.id, slug: ws.slug };
-        console.log(import_picocolors53.default.dim(`Created workspace ${import_picocolors53.default.bold(ws.slug)}.`));
+        console.log(import_picocolors54.default.dim(`Created workspace ${import_picocolors54.default.bold(ws.slug)}.`));
       } else {
         const chosen = orgWorkspaces[pick2 - 1] ?? orgWorkspaces[0];
         workspace = { id: chosen.id, slug: chosen.slug };
@@ -124553,7 +125214,7 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
       remoteUrl: remote?.remoteUrl,
       provider: remote ? inferProvider(remote.remoteUrl) : void 0
     });
-    console.log(import_picocolors53.default.dim(`Created project ${import_picocolors53.default.bold(project.slug)}.`));
+    console.log(import_picocolors54.default.dim(`Created project ${import_picocolors54.default.bold(project.slug)}.`));
     return {
       organization: { id: org.id, slug: org.slug },
       workspace,
@@ -124569,8 +125230,8 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
 
 // ../../packages/cli/src/commands/telemetry.ts
 init_cjs_shims();
-var import_picocolors55 = __toESM(require_picocolors(), 1);
-var import_node_crypto10 = require("crypto");
+var import_picocolors56 = __toESM(require_picocolors(), 1);
+var import_node_crypto11 = require("crypto");
 
 // ../../packages/cli/src/lib/telemetry/transport.ts
 init_cjs_shims();
@@ -124630,7 +125291,7 @@ async function deleteRemoteTelemetry(installId, opts = {}) {
 
 // ../../packages/cli/src/lib/telemetry/notice.ts
 init_cjs_shims();
-var import_picocolors54 = __toESM(require_picocolors(), 1);
+var import_picocolors55 = __toESM(require_picocolors(), 1);
 var PRIVACY_URL = "https://horus.sh/privacy";
 var SUPPRESS_FIRST_TOKEN = /* @__PURE__ */ new Set(["telemetry", "help"]);
 var SUPPRESS_FLAGS = /* @__PURE__ */ new Set(["-V", "--version", "-h", "--help"]);
@@ -124642,11 +125303,11 @@ function shouldSuppressFor(argv) {
   return firstToken != null && SUPPRESS_FIRST_TOKEN.has(firstToken);
 }
 function banner() {
-  const b5 = import_picocolors54.default.bold;
-  const dim = import_picocolors54.default.dim;
+  const b5 = import_picocolors55.default.bold;
+  const dim = import_picocolors55.default.dim;
   return [
     "",
-    import_picocolors54.default.cyan(b5("Horus collects anonymous usage data to improve the tool.")),
+    import_picocolors55.default.cyan(b5("Horus collects anonymous usage data to improve the tool.")),
     dim("  \u2022 On by default: command names, timings, success/failure, and where the"),
     dim("    engine ran out of evidence. No file contents, queries, or secrets."),
     dim("  \u2022 Off by default: your investigation inputs/outputs (opt in to help train"),
@@ -124654,7 +125315,7 @@ function banner() {
     dim("  \u2022 If you use Horus Cloud, linked investigations sync to your workspace."),
     "",
     `  ${dim("Opt out anytime:")} ${b5("horus telemetry disable")}  ${dim("\xB7")}  ${b5("HORUS_TELEMETRY=0")}  ${dim("\xB7")}  ${b5("DO_NOT_TRACK=1")}`,
-    `  ${dim("Details:")} ${import_picocolors54.default.underline(PRIVACY_URL)}`,
+    `  ${dim("Details:")} ${import_picocolors55.default.underline(PRIVACY_URL)}`,
     ""
   ].join("\n");
 }
@@ -124677,45 +125338,45 @@ function maybeShowFirstRunNotice(argv = process.argv) {
 
 // ../../packages/cli/src/commands/telemetry.ts
 function onOff(enabled) {
-  return enabled ? import_picocolors55.default.green("on") : import_picocolors55.default.dim("off");
+  return enabled ? import_picocolors56.default.green("on") : import_picocolors56.default.dim("off");
 }
 function warnIfEnvOverrides() {
   const decision = resolveConsent();
   if (decision.forcedOff) {
     console.log(
-      import_picocolors55.default.yellow(
+      import_picocolors56.default.yellow(
         `
 Note: telemetry is currently forced off by your environment (${decision.reason}).`
       )
     );
-    console.log(import_picocolors55.default.dim("Your saved preference will apply once that override is removed."));
+    console.log(import_picocolors56.default.dim("Your saved preference will apply once that override is removed."));
   } else if (decision.source === "ci") {
     console.log(
-      import_picocolors55.default.yellow("\nNote: CI environment detected \u2014 telemetry stays off here regardless.")
+      import_picocolors56.default.yellow("\nNote: CI environment detected \u2014 telemetry stays off here regardless.")
     );
   }
 }
 async function runTelemetryStatus() {
   const state = readTelemetryState();
   const decision = resolveConsent({ state });
-  console.log(import_picocolors55.default.bold("Horus telemetry"));
+  console.log(import_picocolors56.default.bold("Horus telemetry"));
   console.log(
-    `  Usage metadata (Tier A): ${onOff(decision.tierA)}  ${import_picocolors55.default.dim(`[${decision.source}]`)}`
+    `  Usage metadata (Tier A): ${onOff(decision.tierA)}  ${import_picocolors56.default.dim(`[${decision.source}]`)}`
   );
   console.log(`  Content sharing (Tier B): ${onOff(decision.tierB)}`);
-  console.log(import_picocolors55.default.dim(`  Reason: ${decision.reason}`));
+  console.log(import_picocolors56.default.dim(`  Reason: ${decision.reason}`));
   if (state) {
-    console.log(import_picocolors55.default.dim(`  Install ID: ${state.installId}`));
+    console.log(import_picocolors56.default.dim(`  Install ID: ${state.installId}`));
     console.log(
-      import_picocolors55.default.dim(
+      import_picocolors56.default.dim(
         `  Saved: Tier A ${state.tierA.enabled ? "on" : "off"}, Tier B ${state.tierB.enabled ? "on" : "off"}`
       )
     );
   } else {
-    console.log(import_picocolors55.default.dim("  No saved preference yet (defaults apply)."));
+    console.log(import_picocolors56.default.dim("  No saved preference yet (defaults apply)."));
   }
-  console.log(import_picocolors55.default.dim(`  Config: ${telemetryPath()}`));
-  console.log(import_picocolors55.default.dim(`  Privacy: ${PRIVACY_URL}`));
+  console.log(import_picocolors56.default.dim(`  Config: ${telemetryPath()}`));
+  console.log(import_picocolors56.default.dim(`  Privacy: ${PRIVACY_URL}`));
   if (!state || decision.source === "env" || decision.source === "ci") {
     warnIfEnvOverrides();
   }
@@ -124726,7 +125387,7 @@ async function runTelemetryEnable() {
     s5.tierA.enabled = true;
     if (!s5.tierA.noticeShownAt) s5.tierA.noticeShownAt = (/* @__PURE__ */ new Date()).toISOString();
   });
-  console.log(import_picocolors55.default.green("Anonymous usage metadata (Tier A) is now ON. Thank you!"));
+  console.log(import_picocolors56.default.green("Anonymous usage metadata (Tier A) is now ON. Thank you!"));
   warnIfEnvOverrides();
   return 0;
 }
@@ -124736,7 +125397,7 @@ async function runTelemetryDisable() {
     s5.tierB.enabled = false;
     if (!s5.tierA.noticeShownAt) s5.tierA.noticeShownAt = (/* @__PURE__ */ new Date()).toISOString();
   });
-  console.log(import_picocolors55.default.yellow("All telemetry is now OFF (Tier A and Tier B)."));
+  console.log(import_picocolors56.default.yellow("All telemetry is now OFF (Tier A and Tier B)."));
   return 0;
 }
 async function runTelemetryEnableContent() {
@@ -124747,10 +125408,10 @@ async function runTelemetryEnableContent() {
     if (!s5.tierA.noticeShownAt) s5.tierA.noticeShownAt = (/* @__PURE__ */ new Date()).toISOString();
   });
   console.log(
-    import_picocolors55.default.green("Content sharing (Tier B) is now ON \u2014 redacted inputs/outputs help improve Horus.")
+    import_picocolors56.default.green("Content sharing (Tier B) is now ON \u2014 redacted inputs/outputs help improve Horus.")
   );
-  console.log(import_picocolors55.default.dim("Content is scrubbed of secrets/PII before it ever leaves your machine."));
-  console.log(import_picocolors55.default.dim(`What this means: ${PRIVACY_URL}`));
+  console.log(import_picocolors56.default.dim("Content is scrubbed of secrets/PII before it ever leaves your machine."));
+  console.log(import_picocolors56.default.dim(`What this means: ${PRIVACY_URL}`));
   warnIfEnvOverrides();
   return 0;
 }
@@ -124758,16 +125419,16 @@ async function runTelemetryDisableContent() {
   updateTelemetryState((s5) => {
     s5.tierB.enabled = false;
   });
-  console.log(import_picocolors55.default.yellow("Content sharing (Tier B) is now OFF. Usage metadata is unchanged."));
+  console.log(import_picocolors56.default.yellow("Content sharing (Tier B) is now OFF. Usage metadata is unchanged."));
   return 0;
 }
 async function runTelemetryResetId() {
-  const next = (0, import_node_crypto10.randomUUID)();
+  const next = (0, import_node_crypto11.randomUUID)();
   updateTelemetryState((s5) => {
     s5.installId = next;
   });
-  console.log(import_picocolors55.default.green("Install ID reset."));
-  console.log(import_picocolors55.default.dim(`  New install ID: ${next}`));
+  console.log(import_picocolors56.default.green("Install ID reset."));
+  console.log(import_picocolors56.default.dim(`  New install ID: ${next}`));
   return 0;
 }
 async function runTelemetryDelete() {
@@ -124775,9 +125436,9 @@ async function runTelemetryDelete() {
   if (installId) await deleteRemoteTelemetry(installId);
   deleteTelemetryState();
   clearSpool();
-  console.log(import_picocolors55.default.green("Telemetry deleted \u2014 local state cleared and a server purge requested."));
+  console.log(import_picocolors56.default.green("Telemetry deleted \u2014 local state cleared and a server purge requested."));
   console.log(
-    import_picocolors55.default.dim(
+    import_picocolors56.default.dim(
       "Next run will treat this as a fresh install and re-show the notice. If the purge could not reach the server (offline), re-run this command when back online."
     )
   );
@@ -124821,8 +125482,8 @@ function installCommandTelemetry(program2) {
 // ../../packages/cli/src/commands/eval.ts
 init_cjs_shims();
 var import_promises5 = require("fs/promises");
-var import_node_path27 = require("path");
-var import_picocolors56 = __toESM(require_picocolors(), 1);
+var import_node_path28 = require("path");
+var import_picocolors57 = __toESM(require_picocolors(), 1);
 function resolveProject2(config2, repo) {
   let project;
   try {
@@ -124830,7 +125491,7 @@ function resolveProject2(config2, repo) {
   } catch {
   }
   if (!project) {
-    console.error(import_picocolors56.default.red("Could not resolve a project \u2014 pass --repo <name> or run inside a repo."));
+    console.error(import_picocolors57.default.red("Could not resolve a project \u2014 pass --repo <name> or run inside a repo."));
     return null;
   }
   return project;
@@ -124839,7 +125500,7 @@ function readSlice(opts) {
   let source;
   if (opts.source !== void 0) {
     if (!isOutcomeSource(opts.source)) {
-      console.error(import_picocolors56.default.red(`Unknown --source "${opts.source}" (one of: feedback, confirm).`));
+      console.error(import_picocolors57.default.red(`Unknown --source "${opts.source}" (one of: feedback, confirm).`));
       return null;
     }
     source = opts.source;
@@ -124847,7 +125508,7 @@ function readSlice(opts) {
   let since;
   if (opts.days !== void 0) {
     if (!Number.isFinite(opts.days) || opts.days <= 0) {
-      console.error(import_picocolors56.default.red("--days must be a positive number."));
+      console.error(import_picocolors57.default.red("--days must be a positive number."));
       return null;
     }
     since = new Date(Date.now() - opts.days * 24 * 60 * 60 * 1e3);
@@ -124871,7 +125532,7 @@ async function runEvalBuild(opts) {
     const project = resolveProject2(config2, opts.repo);
     if (!project) return 1;
     const version3 = opts.version ?? CORPUS_VERSION;
-    const outDir = opts.out ? (0, import_node_path27.isAbsolute)(opts.out) ? opts.out : (0, import_node_path27.resolve)(process.cwd(), opts.out) : (0, import_node_path27.join)(process.cwd(), ".horus", "eval");
+    const outDir = opts.out ? (0, import_node_path28.isAbsolute)(opts.out) ? opts.out : (0, import_node_path28.resolve)(process.cwd(), opts.out) : (0, import_node_path28.join)(process.cwd(), ".horus", "eval");
     const { db, sql: sql2 } = await openDb(config2.database.url);
     try {
       const labels = await listOutcomeLabels(db, {
@@ -124887,34 +125548,34 @@ async function runEvalBuild(opts) {
       const build = buildCorpus(labels, resolveReport);
       const artifact = serializeCorpus(build, version3);
       await (0, import_promises5.mkdir)(outDir, { recursive: true });
-      const corpusPath = (0, import_node_path27.join)(outDir, artifact.filename);
-      const manifestPath = (0, import_node_path27.join)(outDir, `corpus-${version3}.manifest.json`);
+      const corpusPath = (0, import_node_path28.join)(outDir, artifact.filename);
+      const manifestPath = (0, import_node_path28.join)(outDir, `corpus-${version3}.manifest.json`);
       const manifest = { ...artifact.manifest, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), project };
       await (0, import_promises5.writeFile)(corpusPath, artifact.jsonl, "utf8");
       await (0, import_promises5.writeFile)(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
       if (opts.json) {
         console.log(JSON.stringify({ project, corpusPath, manifestPath, manifest }, null, 2));
       } else {
-        console.log(import_picocolors56.default.bold(`Eval corpus \u2014 ${project}`));
+        console.log(import_picocolors57.default.bold(`Eval corpus \u2014 ${project}`));
         console.log(
-          `  Rows: ${import_picocolors56.default.green(String(build.rows.length))} ` + import_picocolors56.default.dim(
+          `  Rows: ${import_picocolors57.default.green(String(build.rows.length))} ` + import_picocolors57.default.dim(
             `(evaluated ${build.evaluated}, quarantined ${build.quarantined.length}, unjoinable ${build.unjoinable.length})`
           )
         );
         console.log(
-          import_picocolors56.default.dim(
+          import_picocolors57.default.dim(
             `  Class balance: ${build.classBalance.yes} yes, ${build.classBalance.partly} partly, ${build.classBalance.no} no \xB7 source: ${build.bySource.feedback} feedback, ${build.bySource.confirm} confirm`
           )
         );
-        console.log(`  Corpus:   ${import_picocolors56.default.cyan(corpusPath)}`);
-        console.log(`  Manifest: ${import_picocolors56.default.cyan(manifestPath)}`);
+        console.log(`  Corpus:   ${import_picocolors57.default.cyan(corpusPath)}`);
+        console.log(`  Manifest: ${import_picocolors57.default.cyan(manifestPath)}`);
       }
       return 0;
     } finally {
       await sql2.end();
     }
   } catch (err2) {
-    console.error(import_picocolors56.default.red(err2.message));
+    console.error(import_picocolors57.default.red(err2.message));
     return 1;
   }
 }
@@ -124944,31 +125605,31 @@ async function runEvalBaseline(opts) {
         console.log(JSON.stringify({ project, baseline, separation }, null, 2));
       } else {
         const pct2 = (n4) => `${(n4 * 100).toFixed(0)}%`;
-        console.log(import_picocolors56.default.bold(`Eval baseline \u2014 ${project}`));
+        console.log(import_picocolors57.default.bold(`Eval baseline \u2014 ${project}`));
         if (baseline.n === 0) {
           console.log(
-            import_picocolors56.default.dim(
+            import_picocolors57.default.dim(
               "No outcome labels yet. Leave feedback (`horus feedback`) or confirm an investigation (`horus memory confirm`) to seed the eval set."
             )
           );
         } else {
           console.log(
-            `  Strict hit-rate: ${import_picocolors56.default.green(pct2(baseline.strictHitRate))} ` + import_picocolors56.default.dim(`(weighted ${pct2(baseline.weightedHitRate)}) over ${baseline.n} investigation(s)`)
+            `  Strict hit-rate: ${import_picocolors57.default.green(pct2(baseline.strictHitRate))} ` + import_picocolors57.default.dim(`(weighted ${pct2(baseline.weightedHitRate)}) over ${baseline.n} investigation(s)`)
           );
           console.log(
-            `  Class balance: ${import_picocolors56.default.green(`${baseline.classBalance.yes} yes`)}, ${import_picocolors56.default.yellow(`${baseline.classBalance.partly} partly`)}, ${import_picocolors56.default.red(`${baseline.classBalance.no} no`)} \xB7 ` + import_picocolors56.default.dim(`source: ${baseline.bySource.feedback} feedback, ${baseline.bySource.confirm} confirm`)
+            `  Class balance: ${import_picocolors57.default.green(`${baseline.classBalance.yes} yes`)}, ${import_picocolors57.default.yellow(`${baseline.classBalance.partly} partly`)}, ${import_picocolors57.default.red(`${baseline.classBalance.no} no`)} \xB7 ` + import_picocolors57.default.dim(`source: ${baseline.bySource.feedback} feedback, ${baseline.bySource.confirm} confirm`)
           );
           if (separation.factors.length === 0) {
             console.log(
-              import_picocolors56.default.dim(
+              import_picocolors57.default.dim(
                 `  Feature separation: no discriminative sample yet (needs feedback rows with yes AND no verdicts and a ranked cause).`
               )
             );
           } else {
-            console.log(import_picocolors56.default.dim(`  Feature separation (yes vs no, ${separation.evaluated} row(s)):`));
+            console.log(import_picocolors57.default.dim(`  Feature separation (yes vs no, ${separation.evaluated} row(s)):`));
             for (const f5 of separation.factors.slice(0, 10)) {
               console.log(
-                import_picocolors56.default.dim(
+                import_picocolors57.default.dim(
                   `    ${f5.factor}: \u0394 ${f5.separation.toFixed(3)} (yes ${f5.meanYes.toFixed(3)} vs no ${f5.meanNo.toFixed(3)}, effect ${f5.effectSize.toFixed(2)})`
                 )
               );
@@ -124981,7 +125642,7 @@ async function runEvalBaseline(opts) {
       await sql2.end();
     }
   } catch (err2) {
-    console.error(import_picocolors56.default.red(err2.message));
+    console.error(import_picocolors57.default.red(err2.message));
     return 1;
   }
 }
@@ -124989,10 +125650,10 @@ async function runEvalBaseline(opts) {
 // ../../packages/cli/src/commands/train.ts
 init_cjs_shims();
 var import_promises6 = require("fs/promises");
-var import_node_path28 = require("path");
-var import_node_os10 = require("os");
-var import_picocolors57 = __toESM(require_picocolors(), 1);
-var RERANKER_MODEL_PATH = (0, import_node_path28.join)((0, import_node_os10.homedir)(), ".horus", "reranker.json");
+var import_node_path29 = require("path");
+var import_node_os11 = require("os");
+var import_picocolors58 = __toESM(require_picocolors(), 1);
+var RERANKER_MODEL_PATH = (0, import_node_path29.join)((0, import_node_os11.homedir)(), ".horus", "reranker.json");
 function candidatesFromReport(blob) {
   if (blob === null || typeof blob !== "object") return null;
   const causes = blob.suspectedCauses;
@@ -125006,7 +125667,7 @@ async function runTrain(opts) {
   let source;
   if (opts.source !== void 0) {
     if (!isOutcomeSource(opts.source)) {
-      console.error(import_picocolors57.default.red(`Unknown --source "${opts.source}" (one of: feedback, confirm).`));
+      console.error(import_picocolors58.default.red(`Unknown --source "${opts.source}" (one of: feedback, confirm).`));
       return 1;
     }
     source = opts.source;
@@ -125014,7 +125675,7 @@ async function runTrain(opts) {
   let since;
   if (opts.days !== void 0) {
     if (!Number.isFinite(opts.days) || opts.days <= 0) {
-      console.error(import_picocolors57.default.red("--days must be a positive number."));
+      console.error(import_picocolors58.default.red("--days must be a positive number."));
       return 1;
     }
     since = new Date(Date.now() - opts.days * 24 * 60 * 60 * 1e3);
@@ -125050,7 +125711,7 @@ async function runTrain(opts) {
       await sql2.end();
     }
   } catch (err2) {
-    console.error(import_picocolors57.default.red(`Could not read the local corpus: ${err2.message}`));
+    console.error(import_picocolors58.default.red(`Could not read the local corpus: ${err2.message}`));
     return 1;
   }
   const split = holdoutSplit(investigations2);
@@ -125058,48 +125719,48 @@ async function runTrain(opts) {
   if (!result.ok) {
     if (result.reason === "insufficient-corpus") {
       console.log(
-        import_picocolors57.default.yellow(
+        import_picocolors58.default.yellow(
           `Not enough labeled investigations to train yet (have ${result.labeledInvestigations} with a known-correct cause; need \u2265${MIN_TRAIN_INVESTIGATIONS}).`
         )
       );
-      console.log(import_picocolors57.default.dim("  Keep labeling outcomes with `horus feedback` \u2014 the reranker trains once the corpus is large enough."));
+      console.log(import_picocolors58.default.dim("  Keep labeling outcomes with `horus feedback` \u2014 the reranker trains once the corpus is large enough."));
     } else {
-      console.log(import_picocolors57.default.yellow(`Cannot train a meaningful model yet: ${result.detail}.`));
+      console.log(import_picocolors58.default.yellow(`Cannot train a meaningful model yet: ${result.detail}.`));
     }
     return 0;
   }
   const { baselineHitRate, rerankedHitRate, delta, n: n4 } = result.holdout;
-  console.log(import_picocolors57.default.bold("\nReranker training (local, per-tenant)\n"));
+  console.log(import_picocolors58.default.bold("\nReranker training (local, per-tenant)\n"));
   console.log(`  Holdout investigations:  ${n4}`);
   console.log(`  Baseline top-1 hit-rate: ${pct(baselineHitRate)}`);
   console.log(`  Reranked top-1 hit-rate: ${pct(rerankedHitRate)}`);
   console.log(`  Delta:                   ${delta >= 0 ? "+" : ""}${pct(delta)}`);
   console.log("");
   if (delta <= 0) {
-    console.log(import_picocolors57.default.yellow("  The reranker did NOT beat the deterministic baseline \u2014 not saving a model."));
-    console.log(import_picocolors57.default.dim("  Horus stays on its hand-tuned ranking. Re-run as more labels accumulate."));
+    console.log(import_picocolors58.default.yellow("  The reranker did NOT beat the deterministic baseline \u2014 not saving a model."));
+    console.log(import_picocolors58.default.dim("  Horus stays on its hand-tuned ranking. Re-run as more labels accumulate."));
     return 0;
   }
   try {
-    await (0, import_promises6.mkdir)((0, import_node_path28.join)((0, import_node_os10.homedir)(), ".horus"), { recursive: true });
+    await (0, import_promises6.mkdir)((0, import_node_path29.join)((0, import_node_os11.homedir)(), ".horus"), { recursive: true });
     const { ok: _ok, ...model } = result;
     void _ok;
     await (0, import_promises6.writeFile)(RERANKER_MODEL_PATH, JSON.stringify(model, null, 2) + "\n", "utf8");
   } catch (err2) {
-    console.error(import_picocolors57.default.red(`Trained, but could not write the model: ${err2.message}`));
+    console.error(import_picocolors58.default.red(`Trained, but could not write the model: ${err2.message}`));
     return 1;
   }
-  console.log(import_picocolors57.default.green(`  \u2713 Reranker beats baseline by +${pct(delta)} \u2014 saved to ${RERANKER_MODEL_PATH}`));
-  console.log(import_picocolors57.default.dim("  It ships OFF by default. Enable it with `HORUS_RERANK=1 horus investigate \u2026`."));
+  console.log(import_picocolors58.default.green(`  \u2713 Reranker beats baseline by +${pct(delta)} \u2014 saved to ${RERANKER_MODEL_PATH}`));
+  console.log(import_picocolors58.default.dim("  It ships OFF by default. Enable it with `HORUS_RERANK=1 horus investigate \u2026`."));
   return 0;
 }
 
 // ../../packages/cli/src/lib/report-crash.ts
 init_cjs_shims();
-var import_picocolors58 = __toESM(require_picocolors(), 1);
+var import_picocolors59 = __toESM(require_picocolors(), 1);
 function reportCrash(err2, log = console.error) {
   log(err2);
-  log(import_picocolors58.default.dim("\n  Looks like a Horus bug or a missing capability? Report it:  horus report"));
+  log(import_picocolors59.default.dim("\n  Looks like a Horus bug or a missing capability? Report it:  horus report"));
 }
 
 // ../../packages/cli/src/index.ts
@@ -125187,6 +125848,16 @@ Examples:
       });
     }
   );
+  const secrets = program2.command("secrets").description("Manage encrypted connector credentials (.horus/secrets.local.json) \u2014 HOR-452");
+  secrets.command("status").description("Show the master key source, stored secrets, plaintext in config, and gitignore state").action(() => {
+    process.exitCode = runSecretsStatus();
+  });
+  secrets.command("migrate").description("Move plaintext connector secrets out of config.json into the encrypted store").option("--dry-run", "list what would be migrated without changing anything").action((opts) => {
+    process.exitCode = runSecretsMigrate({ dryRun: opts.dryRun });
+  });
+  secrets.command("key").description("Show the master key source; --show prints it (base64) for CI (HORUS_SECRET_KEY)").option("--show", "print the master key (treat as a credential)").action((opts) => {
+    process.exitCode = runSecretsKey({ show: opts.show });
+  });
   program2.command("stop").description("Stop the source-intelligence host for the current repo (or --all to stop every host)").option("--all", "stop all registered source-intelligence hosts").action(async (opts) => {
     process.exitCode = await runStop(opts);
   });