@merittdev/horus 0.2.3 → 0.3.0

package/dist/index.cjs

@@ -23435,9 +23435,9 @@ var require_client_metadata = __commonJS({
         throw new error_1.MongoInvalidArgumentError("Unable to include driverInfo name and version, metadata cannot exceed 512 bytes");
       }
       let runtimeInfo = getRuntimeInfo();
-      for (const { platform = "" } of driverInfoList) {
-        if (platform.length > 0) {
-          runtimeInfo = `${runtimeInfo}|${platform}`;
+      for (const { platform: platform2 = "" } of driverInfoList) {
+        if (platform2.length > 0) {
+          runtimeInfo = `${runtimeInfo}|${platform2}`;
         }
       }
       if (!metadataDocument.ifItFitsItSits("platform", runtimeInfo)) {
@@ -43447,7 +43447,7 @@ var require_common3 = __commonJS({
     function setup(env) {
       createDebug.debug = createDebug;
       createDebug.default = createDebug;
-      createDebug.coerce = coerce2;
+      createDebug.coerce = coerce3;
       createDebug.disable = disable;
       createDebug.enable = enable;
       createDebug.enabled = enabled;
@@ -43602,7 +43602,7 @@ var require_common3 = __commonJS({
         }
         return false;
       }
-      function coerce2(val) {
+      function coerce3(val) {
         if (val instanceof Error) {
           return val.stack || val.message;
         }
@@ -57239,9 +57239,8 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.2.3" : "dev";
-var PINNED_AXON_VERSION = "1.0.7";
-var PINNED_SOURCE_VERSION = PINNED_AXON_VERSION;
+var HORUS_VERSION = true ? "0.3.0" : "dev";
+var PINNED_SOURCE_VERSION = "1.1.1";
 
 // ../../packages/core/src/evidence.ts
 init_cjs_shims();
@@ -61672,7 +61671,7 @@ var horusConfigSchema = external_exports.object({
   projects: external_exports.array(projectSchema).default([]),
   axon: external_exports.object({
     /** Fail fast if the running Axon is not this version. */
-    pinnedVersion: external_exports.string().default("1.0.7")
+    pinnedVersion: external_exports.string().default("1.1.1")
   }).default({}),
   database: databaseSchema,
   models: modelsSchema.default({}),
@@ -62052,6 +62051,73 @@ packages/core/src/git.ts  @horus/core-team @horus/devex-team
 `.trim();
 var FIXTURE_CODEOWNERS_RULES = parseCodeowners(FIXTURE_CODEOWNERS);
 
+// ../../packages/core/src/redact.ts
+init_cjs_shims();
+var BASE_PATTERNS = [
+  [/(authorization\s*[=:]\s*)(bearer\s+)[^\s,"')]+/gi, "$1$2[REDACTED]"],
+  [/(authorization\s*[=:]\s*)(basic\s+)[^\s,"')]+/gi, "$1$2[REDACTED]"],
+  [
+    /("?(?:password|passwd|secret|token|api[_-]key|apikey|x-api-key)"?\s*[=:]\s*)"?[^"',\s)>]+/gi,
+    "$1[REDACTED]"
+  ],
+  [/((?:cookie|set-cookie)\s*[=:]\s*)[^\s"',;>]{4,}/gi, "$1[REDACTED]"],
+  [
+    /((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis(?:s)?):\/\/)[^:@/\s]+:[^@\s]+@/gi,
+    "$1[REDACTED]@"
+  ],
+  [/\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/g, "[REDACTED-CARD]"]
+];
+var EXTENDED_PATTERNS = [
+  // PEM private key blocks (run first — multi-line, highest risk).
+  [
+    /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z ]+ )?PRIVATE KEY-----/g,
+    "[REDACTED-PRIVATE-KEY]"
+  ],
+  // JSON Web Tokens (three base64url segments starting with the `{"` header).
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED-JWT]"],
+  // AWS access key ids.
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[REDACTED-AWS-KEY]"],
+  // Google API keys.
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED-GCP-KEY]"],
+  // Slack tokens.
+  [/\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g, "[REDACTED-SLACK-TOKEN]"],
+  // GitHub tokens.
+  [/\bgh[pousr]_[0-9A-Za-z]{36,}\b/g, "[REDACTED-GH-TOKEN]"],
+  // Emails.
+  [/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, "[REDACTED-EMAIL]"],
+  // IPv4 addresses.
+  [/\b(?:\d{1,3}\.){3}\d{1,3}\b/g, "[REDACTED-IP]"]
+];
+var RESIDUAL_HIGH_RISK = [
+  /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/,
+  /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/,
+  /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/
+];
+function apply(patterns, input) {
+  let out = input;
+  for (const [pattern, replacement] of patterns) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+function redactSecrets(input) {
+  return apply(BASE_PATTERNS, input);
+}
+function redactContent(input) {
+  return apply(EXTENDED_PATTERNS, apply(BASE_PATTERNS, input));
+}
+function redactOrDrop(input) {
+  try {
+    const value = redactContent(input);
+    if (RESIDUAL_HIGH_RISK.some((p) => p.test(value))) {
+      return { value: null, dropped: true };
+    }
+    return { value, dropped: false };
+  } catch {
+    return { value: null, dropped: true };
+  }
+}
+
 // ../../packages/cli/src/commands/status.ts
 init_cjs_shims();
 var import_picocolors = __toESM(require_picocolors(), 1);
@@ -63135,25 +63201,8 @@ function annotateAgainstBaseline(current, baseline) {
   current.newSignatures = newSignatures;
   return current;
 }
-var REDACTION_PATTERNS = [
-  // Authorization headers (Bearer / Basic / API-key tokens)
-  [/(authorization\s*[=:]\s*)(bearer\s+)[^\s,"')]+/gi, "$1$2[REDACTED]"],
-  [/(authorization\s*[=:]\s*)(basic\s+)[^\s,"')]+/gi, "$1$2[REDACTED]"],
-  // Standalone password/token/secret keys in KV strings, query params, JSON
-  [/("?(?:password|passwd|secret|token|api[_-]key|apikey|x-api-key)"?\s*[=:]\s*)"?[^"',\s)>]+/gi, "$1[REDACTED]"],
-  // Cookie / set-cookie header values
-  [/((?:cookie|set-cookie)\s*[=:]\s*)[^\s"',;>]{4,}/gi, "$1[REDACTED]"],
-  // Database / service connection strings with embedded credentials
-  [/((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis(?:s)?):\/\/)[^:@/\s]+:[^@\s]+@/gi, "$1[REDACTED]@"],
-  // 16-digit card-number-like sequences (PCIDSS)
-  [/\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/g, "[REDACTED-CARD]"]
-];
 function redactSensitiveString(s) {
-  let out = s;
-  for (const [pattern, replacement] of REDACTION_PATTERNS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
+  return redactSecrets(s);
 }
 function redactErrorSignature(sig) {
   if (sig.sampleMessage === void 0) return sig;
@@ -66196,7 +66245,7 @@ function sql(strings, ...params) {
     return new SQL([new StringChunk(str3)]);
   }
   sql2.raw = raw;
-  function join11(chunks, separator) {
+  function join13(chunks, separator) {
     const result = [];
     for (const [i, chunk] of chunks.entries()) {
       if (i > 0 && separator !== void 0) {
@@ -66206,7 +66255,7 @@ function sql(strings, ...params) {
     }
     return new SQL(result);
   }
-  sql2.join = join11;
+  sql2.join = join13;
   function identifier(value) {
     return new Name(value);
   }
@@ -69797,7 +69846,7 @@ var PgSelectQueryBuilderBase = class extends TypedQueryBuilder {
     return (table, on) => {
       const baseTableName = this.tableName;
       const tableName = getTableLikeName(table);
-      if (typeof tableName === "string" && this.config.joins?.some((join11) => join11.alias === tableName)) {
+      if (typeof tableName === "string" && this.config.joins?.some((join13) => join13.alias === tableName)) {
         throw new Error(`Alias "${tableName}" is already used in this query`);
       }
       if (!this.isPartialSelect) {
@@ -70809,7 +70858,7 @@ var PgUpdateBase = class extends QueryPromise {
   createJoin(joinType) {
     return (table, on) => {
       const tableName = getTableLikeName(table);
-      if (typeof tableName === "string" && this.config.joins.some((join11) => join11.alias === tableName)) {
+      if (typeof tableName === "string" && this.config.joins.some((join13) => join13.alias === tableName)) {
         throw new Error(`Alias "${tableName}" is already used in this query`);
       }
       if (typeof on === "function") {
@@ -70905,10 +70954,10 @@ var PgUpdateBase = class extends QueryPromise {
           const fromFields = this.getTableLikeFields(this.config.from);
           fields[tableName] = fromFields;
         }
-        for (const join11 of this.config.joins) {
-          const tableName2 = getTableLikeName(join11.table);
-          if (typeof tableName2 === "string" && !is(join11.table, SQL)) {
-            const fromFields = this.getTableLikeFields(join11.table);
+        for (const join13 of this.config.joins) {
+          const tableName2 = getTableLikeName(join13.table);
+          if (typeof tableName2 === "string" && !is(join13.table, SQL)) {
+            const fromFields = this.getTableLikeFields(join13.table);
             fields[tableName2] = fromFields;
           }
         }
@@ -77143,7 +77192,12 @@ async function investigate(input, deps) {
       code.impact(top.id, 2),
       code.flowsFor(top.id)
     ]);
-    const edges = await listQueueEdges(db, { project: input.repo });
+    let edges = [];
+    try {
+      edges = await listQueueEdges(db, { project: input.repo });
+    } catch {
+      edges = [];
+    }
     const symbolNames = /* @__PURE__ */ new Set([
       top.name,
       ...ctx.callers.map((s) => s.name),
@@ -77826,9 +77880,9 @@ async function investigate(input, deps) {
   const confidence = clamp015(0.5 * evidenceConfidence + 0.5 * seedResolved);
   const area = ctx?.community?.name ?? top?.filePath ?? (input.service ?? "runtime evidence");
   const topCause = rankedCauses[0];
-  const banner = degradedNoSource ? "Runtime-only (source intelligence unavailable). " : "";
+  const banner2 = degradedNoSource ? "Runtime-only (source intelligence unavailable). " : "";
   const scope = top ? `resolved to ${label} (${area})` : `over runtime evidence (${area})`;
-  const summary = topCause ? `${banner}Investigation of "${hint}" ${scope}. Top suspected cause: ${topCause.title}.` : `${banner}Investigation of "${hint}" ${scope}. No dominant suspected cause emerged from the available ${degradedNoSource ? "runtime" : "structural"} evidence.`;
+  const summary = topCause ? `${banner2}Investigation of "${hint}" ${scope}. Top suspected cause: ${topCause.title}.` : `${banner2}Investigation of "${hint}" ${scope}. No dominant suspected cause emerged from the available ${degradedNoSource ? "runtime" : "structural"} evidence.`;
   const nextActions = buildNextActions(top, ctx, impact, queueHits, changes, input);
   if (degradedNoSource) {
     nextActions.unshift(
@@ -77889,6 +77943,7 @@ async function investigate(input, deps) {
   report.sourceStatus = buildRuntimeSourceStatus(evidence2, connectorFlags);
   const persistedId = await persist(db, input, report);
   if (persistedId) report.id = persistedId;
+  report.persisted = persistedId !== null;
   if (persistedId !== null) {
     const tags = deriveTags(report);
     report.similarIncidents = await recallSimilar(db, tags, persistedId, input.repo ?? null);
@@ -80983,22 +81038,22 @@ function extractQueueGraph(input) {
     }
   }
   const producers = [];
-  for (const pc43 of input.producerClasses) {
-    for (const m of pc43.content.matchAll(INJECT_QUEUE_RE)) {
+  for (const pc47 of input.producerClasses) {
+    for (const m of pc47.content.matchAll(INJECT_QUEUE_RE)) {
       const queue = m[1] ?? "";
-      if (queue) producers.push({ queue, symbol: pc43.name, file: pc43.filePath });
+      if (queue) producers.push({ queue, symbol: pc47.name, file: pc47.filePath });
     }
-    for (const m of pc43.content.matchAll(NEW_BULL_RE)) {
+    for (const m of pc47.content.matchAll(NEW_BULL_RE)) {
       if (m[2] !== "Queue") continue;
       const queue = resolveArg(m[3] ?? "", constMap);
       if (queue) {
-        producers.push({ queue, symbol: (m[1] ?? pc43.name) || baseName(pc43.filePath), file: pc43.filePath });
+        producers.push({ queue, symbol: (m[1] ?? pc47.name) || baseName(pc47.filePath), file: pc47.filePath });
       }
     }
-    for (const m of pc43.content.matchAll(QUEUE_NAME_CONST_RE)) {
+    for (const m of pc47.content.matchAll(QUEUE_NAME_CONST_RE)) {
       const ident = m[1] ?? "";
       const queue = m[2] ?? "";
-      if (queue) producers.push({ queue, symbol: ident || baseName(pc43.filePath), file: pc43.filePath });
+      if (queue) producers.push({ queue, symbol: ident || baseName(pc47.filePath), file: pc47.filePath });
     }
   }
   const workers = [];
@@ -90068,21 +90123,21 @@ var Protocol = class {
    * the error appropriately (e.g., by failing the task, logging, etc.). The Protocol layer
    * simply propagates the error.
    */
-  async _enqueueTaskMessage(taskId, message, sessionId) {
+  async _enqueueTaskMessage(taskId, message, sessionId2) {
     if (!this._taskStore || !this._taskMessageQueue) {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId2, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
    * @param taskId The task ID whose queue should be cleared
    * @param sessionId Optional session ID for binding the operation to a specific session
    */
-  async _clearTaskQueue(taskId, sessionId) {
+  async _clearTaskQueue(taskId, sessionId2) {
     if (this._taskMessageQueue) {
-      const messages2 = await this._taskMessageQueue.dequeueAll(taskId, sessionId);
+      const messages2 = await this._taskMessageQueue.dequeueAll(taskId, sessionId2);
       for (const message of messages2) {
         if (message.type === "request" && isJSONRPCRequest(message.message)) {
           const requestId = message.message.id;
@@ -90125,7 +90180,7 @@ var Protocol = class {
       }, { once: true });
     });
   }
-  requestTaskStore(request, sessionId) {
+  requestTaskStore(request, sessionId2) {
     const taskStore = this._taskStore;
     if (!taskStore) {
       throw new Error("No task store configured");
@@ -90138,18 +90193,18 @@ var Protocol = class {
         return await taskStore.createTask(taskParams, request.id, {
           method: request.method,
           params: request.params
-        }, sessionId);
+        }, sessionId2);
       },
       getTask: async (taskId) => {
-        const task = await taskStore.getTask(taskId, sessionId);
+        const task = await taskStore.getTask(taskId, sessionId2);
         if (!task) {
           throw new McpError(ErrorCode.InvalidParams, "Failed to retrieve task: Task not found");
         }
         return task;
       },
       storeTaskResult: async (taskId, status, result) => {
-        await taskStore.storeTaskResult(taskId, status, result, sessionId);
-        const task = await taskStore.getTask(taskId, sessionId);
+        await taskStore.storeTaskResult(taskId, status, result, sessionId2);
+        const task = await taskStore.getTask(taskId, sessionId2);
         if (task) {
           const notification = TaskStatusNotificationSchema.parse({
             method: "notifications/tasks/status",
@@ -90162,18 +90217,18 @@ var Protocol = class {
         }
       },
       getTaskResult: (taskId) => {
-        return taskStore.getTaskResult(taskId, sessionId);
+        return taskStore.getTaskResult(taskId, sessionId2);
       },
       updateTaskStatus: async (taskId, status, statusMessage) => {
-        const task = await taskStore.getTask(taskId, sessionId);
+        const task = await taskStore.getTask(taskId, sessionId2);
         if (!task) {
           throw new McpError(ErrorCode.InvalidParams, `Task "${taskId}" not found - it may have been cleaned up`);
         }
         if (isTerminal(task.status)) {
           throw new McpError(ErrorCode.InvalidParams, `Cannot update task "${taskId}" from terminal status "${task.status}" to "${status}". Terminal states (completed, failed, cancelled) cannot transition to other states.`);
         }
-        await taskStore.updateTaskStatus(taskId, status, statusMessage, sessionId);
-        const updatedTask = await taskStore.getTask(taskId, sessionId);
+        await taskStore.updateTaskStatus(taskId, status, statusMessage, sessionId2);
+        const updatedTask = await taskStore.getTask(taskId, sessionId2);
         if (updatedTask) {
           const notification = TaskStatusNotificationSchema.parse({
             method: "notifications/tasks/status",
@@ -90186,7 +90241,7 @@ var Protocol = class {
         }
       },
       listTasks: (cursor) => {
-        return taskStore.listTasks(cursor, sessionId);
+        return taskStore.listTasks(cursor, sessionId2);
       }
     };
   }
@@ -90540,8 +90595,8 @@ var Server = class extends Protocol {
     this._serverInfo = _serverInfo;
     this._loggingLevels = /* @__PURE__ */ new Map();
     this.LOG_LEVEL_SEVERITY = new Map(LoggingLevelSchema.options.map((level, index2) => [level, index2]));
-    this.isMessageIgnored = (level, sessionId) => {
-      const currentLevel = this._loggingLevels.get(sessionId);
+    this.isMessageIgnored = (level, sessionId2) => {
+      const currentLevel = this._loggingLevels.get(sessionId2);
       return currentLevel ? this.LOG_LEVEL_SEVERITY.get(level) < this.LOG_LEVEL_SEVERITY.get(currentLevel) : false;
     };
     this._capabilities = options?.capabilities ?? {};
@@ -90884,9 +90939,9 @@ var Server = class extends Protocol {
    * @param params
    * @param sessionId optional for stateless and backward compatibility
    */
-  async sendLoggingMessage(params, sessionId) {
+  async sendLoggingMessage(params, sessionId2) {
     if (this._capabilities.logging) {
-      if (!this.isMessageIgnored(params.level, sessionId)) {
+      if (!this.isMessageIgnored(params.level, sessionId2)) {
         return this.notification({ method: "notifications/message", params });
       }
     }
@@ -91691,8 +91746,8 @@ var McpServer = class {
    * @param params
    * @param sessionId optional for stateless and backward compatibility
    */
-  async sendLoggingMessage(params, sessionId) {
-    return this.server.sendLoggingMessage(params, sessionId);
+  async sendLoggingMessage(params, sessionId2) {
+    return this.server.sendLoggingMessage(params, sessionId2);
   }
   /**
    * Sends a resource list changed event to the client, if connected.
@@ -93743,7 +93798,7 @@ function formatAge(ms) {
 
 // ../../packages/cli/src/commands/investigate.ts
 init_cjs_shims();
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/cloud/investigation-sync.ts
 init_cjs_shims();
@@ -93820,6 +93875,345 @@ async function listCloudInvestigations(client, cfg) {
   return result.investigations;
 }
 
+// ../../packages/cli/src/lib/telemetry/client.ts
+init_cjs_shims();
+var import_node_crypto6 = require("crypto");
+var import_node_os3 = require("os");
+
+// ../../packages/cli/src/lib/telemetry/consent.ts
+init_cjs_shims();
+
+// ../../packages/cli/src/lib/telemetry/store.ts
+init_cjs_shims();
+var import_node_fs13 = require("fs");
+var import_node_crypto5 = require("crypto");
+
+// ../../packages/cli/src/lib/telemetry/paths.ts
+init_cjs_shims();
+var import_node_path14 = require("path");
+var TELEMETRY_FILE = "telemetry.json";
+var TELEMETRY_QUEUE_DIR = "telemetry-queue";
+function telemetryPath() {
+  return (0, import_node_path14.join)(horusHome(), TELEMETRY_FILE);
+}
+function telemetryQueueDir() {
+  return (0, import_node_path14.join)(horusHome(), TELEMETRY_QUEUE_DIR);
+}
+
+// ../../packages/cli/src/lib/telemetry/store.ts
+var TELEMETRY_SCHEMA_VERSION = 1;
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function defaultTelemetryState(installId = (0, import_node_crypto5.randomUUID)()) {
+  const now = nowIso();
+  return {
+    schemaVersion: TELEMETRY_SCHEMA_VERSION,
+    installId,
+    tierA: { enabled: true, noticeShownAt: null },
+    tierB: { enabled: false, enabledAt: null },
+    createdAt: now,
+    updatedAt: now
+  };
+}
+function coerce2(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const r = raw;
+  if (typeof r.installId !== "string" || r.installId.length === 0) return null;
+  const tierA = r.tierA ?? {};
+  const tierB = r.tierB ?? {};
+  return {
+    schemaVersion: typeof r.schemaVersion === "number" ? r.schemaVersion : TELEMETRY_SCHEMA_VERSION,
+    installId: r.installId,
+    tierA: {
+      enabled: typeof tierA.enabled === "boolean" ? tierA.enabled : true,
+      noticeShownAt: typeof tierA.noticeShownAt === "string" ? tierA.noticeShownAt : null
+    },
+    tierB: {
+      enabled: typeof tierB.enabled === "boolean" ? tierB.enabled : false,
+      enabledAt: typeof tierB.enabledAt === "string" ? tierB.enabledAt : null
+    },
+    createdAt: typeof r.createdAt === "string" ? r.createdAt : nowIso(),
+    updatedAt: typeof r.updatedAt === "string" ? r.updatedAt : nowIso()
+  };
+}
+function readTelemetryState() {
+  const p = telemetryPath();
+  if (!(0, import_node_fs13.existsSync)(p)) return null;
+  try {
+    return coerce2(JSON.parse((0, import_node_fs13.readFileSync)(p, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function writeTelemetryState(state) {
+  (0, import_node_fs13.mkdirSync)(horusHome(), { recursive: true });
+  const p = telemetryPath();
+  const tmp = `${p}.${process.pid}.tmp`;
+  (0, import_node_fs13.writeFileSync)(tmp, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
+  try {
+    (0, import_node_fs13.renameSync)(tmp, p);
+  } catch (err) {
+    try {
+      (0, import_node_fs13.rmSync)(tmp);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    (0, import_node_fs13.chmodSync)(p, 384);
+  } catch {
+  }
+}
+function loadOrInitTelemetryState() {
+  const existing = readTelemetryState();
+  if (existing) return existing;
+  const created = defaultTelemetryState();
+  writeTelemetryState(created);
+  return created;
+}
+function updateTelemetryState(mutate) {
+  const state = loadOrInitTelemetryState();
+  mutate(state);
+  state.updatedAt = nowIso();
+  writeTelemetryState(state);
+  return state;
+}
+function deleteTelemetryState() {
+  const p = telemetryPath();
+  if ((0, import_node_fs13.existsSync)(p)) (0, import_node_fs13.rmSync)(p);
+}
+
+// ../../packages/cli/src/lib/telemetry/consent.ts
+var OFF_VALUES = /* @__PURE__ */ new Set(["0", "false", "off", "no", "disable", "disabled"]);
+var ON_VALUES = /* @__PURE__ */ new Set(["1", "true", "on", "yes", "enable", "enabled", "all"]);
+var CI_ENV_VARS = [
+  "CI",
+  "CONTINUOUS_INTEGRATION",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "BUILDKITE",
+  "CIRCLECI",
+  "TRAVIS",
+  "JENKINS_URL",
+  "TEAMCITY_VERSION"
+];
+function doNotTrack(env) {
+  const v = env.DO_NOT_TRACK;
+  if (v == null || v === "") return false;
+  return !OFF_VALUES.has(v.trim().toLowerCase());
+}
+function parseEnvFlag(value) {
+  if (value == null || value === "") return void 0;
+  const v = value.trim().toLowerCase();
+  if (OFF_VALUES.has(v)) return "off";
+  if (ON_VALUES.has(v)) return "on";
+  return void 0;
+}
+function isCI(env = process.env) {
+  return CI_ENV_VARS.some((key) => {
+    const v = env[key];
+    return v != null && v !== "" && !OFF_VALUES.has(v.trim().toLowerCase());
+  });
+}
+function off(source, reason) {
+  return { tierA: false, tierB: false, forcedOff: source === "env", source, reason };
+}
+function resolveConsent(opts = {}) {
+  const env = opts.env ?? process.env;
+  if (doNotTrack(env)) return off("env", "DO_NOT_TRACK is set");
+  const envFlag = parseEnvFlag(env.HORUS_TELEMETRY);
+  if (envFlag === "off") return off("env", "HORUS_TELEMETRY disables telemetry");
+  const state = opts.state !== void 0 ? opts.state : readTelemetryState();
+  const storedTierA = state?.tierA.enabled ?? true;
+  const storedTierB = state?.tierB.enabled ?? false;
+  if (isCI(env) && envFlag !== "on") {
+    return {
+      tierA: false,
+      tierB: false,
+      forcedOff: false,
+      source: "ci",
+      reason: "CI environment detected \u2014 telemetry off by default"
+    };
+  }
+  if (envFlag === "on") {
+    return {
+      tierA: true,
+      tierB: storedTierB,
+      forcedOff: false,
+      source: "env",
+      reason: "HORUS_TELEMETRY enables usage metadata"
+    };
+  }
+  return {
+    tierA: storedTierA,
+    tierB: storedTierB,
+    forcedOff: false,
+    source: state ? "state" : "default",
+    reason: state ? "from ~/.horus/telemetry.json" : "default settings (no saved preference)"
+  };
+}
+function isContentSharingEnabled(env = process.env) {
+  return resolveConsent({ env }).tierB;
+}
+
+// ../../packages/cli/src/lib/telemetry/spool.ts
+init_cjs_shims();
+var import_node_fs14 = require("fs");
+var import_node_path15 = require("path");
+var SPOOL_FILE = "events.jsonl";
+var MAX_SPOOL_BYTES = 256 * 1024;
+function spoolFilePath() {
+  return (0, import_node_path15.join)(telemetryQueueDir(), SPOOL_FILE);
+}
+function spoolEvent(event) {
+  try {
+    (0, import_node_fs14.mkdirSync)(telemetryQueueDir(), { recursive: true });
+    const file = spoolFilePath();
+    let size2 = 0;
+    try {
+      size2 = (0, import_node_fs14.statSync)(file).size;
+    } catch {
+    }
+    if (size2 >= MAX_SPOOL_BYTES) return;
+    (0, import_node_fs14.appendFileSync)(file, JSON.stringify(event) + "\n", { mode: 384 });
+  } catch {
+  }
+}
+function readSpooledEvents() {
+  try {
+    const file = spoolFilePath();
+    if (!(0, import_node_fs14.existsSync)(file)) return [];
+    return (0, import_node_fs14.readFileSync)(file, "utf8").split("\n").filter((line2) => line2.trim().length > 0).map((line2) => {
+      try {
+        return JSON.parse(line2);
+      } catch {
+        return null;
+      }
+    }).filter((e) => e !== null);
+  } catch {
+    return [];
+  }
+}
+function clearSpool() {
+  try {
+    const file = spoolFilePath();
+    if ((0, import_node_fs14.existsSync)(file)) (0, import_node_fs14.rmSync)(file);
+  } catch {
+  }
+}
+
+// ../../packages/cli/src/lib/telemetry/events.ts
+init_cjs_shims();
+var TELEMETRY_EVENT_SCHEMA_VERSION = 1;
+var TIER_B_EVENT_TYPES = /* @__PURE__ */ new Set(["investigation.content"]);
+function tierForEventType(type) {
+  return TIER_B_EVENT_TYPES.has(type) ? "B" : "A";
+}
+function extractFlagNames(argv) {
+  const names = /* @__PURE__ */ new Set();
+  for (const token of argv.slice(2)) {
+    if (token.startsWith("--") && token.length > 2) {
+      const name = token.slice(2).split("=")[0];
+      if (name) names.add(name);
+    }
+  }
+  return [...names];
+}
+
+// ../../packages/cli/src/lib/telemetry/client.ts
+var sessionId = null;
+function getSessionId() {
+  if (!sessionId) sessionId = (0, import_node_crypto6.randomUUID)();
+  return sessionId;
+}
+function track(input) {
+  try {
+    const state = readTelemetryState();
+    if (!state) return;
+    const tier = tierForEventType(input.type);
+    const decision = resolveConsent({ state });
+    if (tier === "A" ? !decision.tierA : !decision.tierB) return;
+    const event = {
+      schemaVersion: TELEMETRY_EVENT_SCHEMA_VERSION,
+      tier,
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      installId: state.installId,
+      sessionId: getSessionId(),
+      cliVersion: HORUS_VERSION,
+      os: (0, import_node_os3.platform)(),
+      arch: (0, import_node_os3.arch)(),
+      ...input
+    };
+    spoolEvent(event);
+  } catch {
+  }
+}
+
+// ../../packages/cli/src/lib/telemetry/feedback.ts
+init_cjs_shims();
+var import_promises = require("readline/promises");
+var import_picocolors8 = __toESM(require_picocolors(), 1);
+var MANUAL_MINUTES = {
+  "1": 5,
+  // < 5 min
+  "2": 30,
+  // ~30 min
+  "3": 120,
+  // ~2 h
+  "4": 480,
+  // half-day+
+  "5": null
+  // unsure
+};
+function parseResolved(raw) {
+  const v = raw.trim().toLowerCase();
+  if (v.startsWith("y")) return "yes";
+  if (v.startsWith("p")) return "partly";
+  if (v.startsWith("n")) return "no";
+  return null;
+}
+function parseManualEstimate(raw) {
+  return MANUAL_MINUTES[raw.trim()] ?? null;
+}
+function submitFeedback(input) {
+  track({ type: "feedback.submitted", ...input });
+}
+async function runFeedbackPrompt(investigationId, horusSeconds) {
+  const rl = (0, import_promises.createInterface)({ input: process.stdin, output: process.stdout });
+  try {
+    console.log(import_picocolors8.default.dim("\nQuick feedback to improve Horus (press Enter to skip):"));
+    const a1 = await rl.question(
+      import_picocolors8.default.bold("  Did this point you at the cause? ") + import_picocolors8.default.dim("[y / partly / n] ")
+    );
+    if (a1.trim() === "") return false;
+    const a2 = await rl.question(
+      import_picocolors8.default.bold("  Manually, finding this would have taken? ") + import_picocolors8.default.dim("[1:<5m  2:~30m  3:~2h  4:half-day+  5:unsure] ")
+    );
+    submitFeedback({
+      investigationId,
+      resolved: parseResolved(a1),
+      manualEstimateMinutes: parseManualEstimate(a2),
+      horusSeconds
+    });
+    console.log(import_picocolors8.default.dim("  Thanks \u2014 recorded."));
+    return true;
+  } finally {
+    rl.close();
+  }
+}
+async function maybePromptFeedback(opts) {
+  try {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) return;
+    if (!resolveConsent().tierA) return;
+    const rate = opts.sampleRate ?? 0.25;
+    const rand = (opts.random ?? Math.random)();
+    if (rand > rate) return;
+    await runFeedbackPrompt(opts.investigationId, opts.horusSeconds ?? null);
+  } catch {
+  }
+}
+
 // ../../packages/cli/src/lib/ensure-host.ts
 init_cjs_shims();
 function parseHostPort(hostUrl) {
@@ -93912,37 +94306,37 @@ function renderStoredAIJudgment(judgment, write = (l) => console.log(l)) {
   const sep = "\u2500".repeat(60);
   write(`
 ${sep}`);
-  write(import_picocolors8.default.bold("AI Judgment") + import_picocolors8.default.dim(` (confidence: ${(judgment.confidence * 100).toFixed(0)}%, provider: ${judgment.provider})`));
+  write(import_picocolors9.default.bold("AI Judgment") + import_picocolors9.default.dim(` (confidence: ${(judgment.confidence * 100).toFixed(0)}%, provider: ${judgment.provider})`));
   write(sep);
   if (judgment.hypothesisJudgments && judgment.hypothesisJudgments.length > 0) {
-    write(import_picocolors8.default.bold("Hypothesis verdicts:"));
+    write(import_picocolors9.default.bold("Hypothesis verdicts:"));
     for (const j of judgment.hypothesisJudgments) {
-      const verdictColor = j.verdict === "supported" ? import_picocolors8.default.green : j.verdict === "weakened" ? import_picocolors8.default.yellow : j.verdict === "eliminated" ? import_picocolors8.default.red : import_picocolors8.default.dim;
-      write(`  ${verdictColor(`[${j.verdict}]`)} ${j.category}` + import_picocolors8.default.dim(` (${(j.confidence * 100).toFixed(0)}%)`));
-      write(import_picocolors8.default.dim(`    ${j.rationale}`));
+      const verdictColor = j.verdict === "supported" ? import_picocolors9.default.green : j.verdict === "weakened" ? import_picocolors9.default.yellow : j.verdict === "eliminated" ? import_picocolors9.default.red : import_picocolors9.default.dim;
+      write(`  ${verdictColor(`[${j.verdict}]`)} ${j.category}` + import_picocolors9.default.dim(` (${(j.confidence * 100).toFixed(0)}%)`));
+      write(import_picocolors9.default.dim(`    ${j.rationale}`));
     }
     write("");
   }
   if (judgment.rootCauseAssessment) {
     const rca = judgment.rootCauseAssessment;
-    const uncertaintyColor = rca.uncertainty === "low" ? import_picocolors8.default.green : rca.uncertainty === "medium" ? import_picocolors8.default.yellow : import_picocolors8.default.red;
-    write(import_picocolors8.default.bold("Root cause assessment:") + import_picocolors8.default.dim(` uncertainty: ${uncertaintyColor(rca.uncertainty)}`));
+    const uncertaintyColor = rca.uncertainty === "low" ? import_picocolors9.default.green : rca.uncertainty === "medium" ? import_picocolors9.default.yellow : import_picocolors9.default.red;
+    write(import_picocolors9.default.bold("Root cause assessment:") + import_picocolors9.default.dim(` uncertainty: ${uncertaintyColor(rca.uncertainty)}`));
     write(rca.summary);
     if (rca.citedEvidenceIds.length > 0) {
-      write(import_picocolors8.default.dim(`  Cited: ${rca.citedEvidenceIds.join(", ")}`));
+      write(import_picocolors9.default.dim(`  Cited: ${rca.citedEvidenceIds.join(", ")}`));
     }
     write("");
   }
-  write(import_picocolors8.default.bold("What:") + " " + judgment.what);
-  write(import_picocolors8.default.bold("Why:") + " " + judgment.why);
+  write(import_picocolors9.default.bold("What:") + " " + judgment.what);
+  write(import_picocolors9.default.bold("Why:") + " " + judgment.why);
   if (judgment.whereNext.length > 0) {
-    write(import_picocolors8.default.bold("Next steps:"));
+    write(import_picocolors9.default.bold("Next steps:"));
     for (const step of judgment.whereNext) {
       write(`  \u2022 ${step}`);
     }
   }
   if (judgment.citations.length > 0) {
-    write(import_picocolors8.default.dim(`
+    write(import_picocolors9.default.dim(`
 Cited evidence: ${judgment.citations.map((c) => c.evidenceId).join(", ")}`));
   }
 }
@@ -93960,6 +94354,7 @@ function classifyAIFailure(firstError) {
   return firstError;
 }
 async function runInvestigate(hint, opts) {
+  const startedAtMs = Date.now();
   try {
     const config2 = await loadConfig(opts.config, { name: opts.name });
     const projectName = opts.project ?? opts.repo;
@@ -93967,7 +94362,7 @@ async function runInvestigate(hint, opts) {
     try {
       renv = resolveEnvironment(config2, { project: projectName, env: opts.env });
     } catch (err) {
-      console.error(import_picocolors8.default.red(err.message));
+      console.error(import_picocolors9.default.red(err.message));
       return 1;
     }
     const repoRoot = repoRootOrCwd(renv.path);
@@ -93976,16 +94371,15 @@ async function runInvestigate(hint, opts) {
     const cloudSession = cloudActive ? authedClient() : null;
     if (cloudActive && !cloudSession) {
       console.error(
-        import_picocolors8.default.red(
-          `This repo is linked to Horus Cloud but you are not logged in. Run ${import_picocolors8.default.bold("horus login")} first.`
+        import_picocolors9.default.yellow(
+          `This repo is linked to Horus Cloud but you are not logged in \u2014 running locally only. Run ${import_picocolors9.default.bold("horus login")} to also sync results to the cloud.`
         )
       );
-      return 1;
     }
     const code = codeForEnv(renv);
     if (!code) {
       console.error(
-        import_picocolors8.default.red(
+        import_picocolors9.default.red(
           `No source-intelligence connector configured for project "${renv.project}" / env "${renv.env}".`
         )
       );
@@ -93995,21 +94389,21 @@ async function runInvestigate(hint, opts) {
     let health = await code.health();
     if (!health.ok && sourceUrl) {
       console.error(
-        import_picocolors8.default.yellow(`Source-intelligence host unreachable (${sourceUrl}) \u2014 attempting to start it\u2026`)
+        import_picocolors9.default.yellow(`Source-intelligence host unreachable (${sourceUrl}) \u2014 attempting to start it\u2026`)
       );
       const healed = await ensureSourceHost(renv.path, sourceUrl);
       if (healed.ok) {
-        console.error(import_picocolors8.default.green(`Source-intelligence host is up at ${healed.hostUrl}.`));
+        console.error(import_picocolors9.default.green(`Source-intelligence host is up at ${healed.hostUrl}.`));
         health = await code.health();
       } else {
-        console.error(import_picocolors8.default.dim(`  ${ensureHostReasonHint(healed.reason)}`));
+        console.error(import_picocolors9.default.dim(`  ${ensureHostReasonHint(healed.reason)}`));
       }
     }
     const runtimeOnly = !health.ok;
     if (runtimeOnly) {
       console.error(
-        import_picocolors8.default.yellow(
-          `Proceeding in runtime-only mode \u2014 no source intelligence. Run ${import_picocolors8.default.bold("horus index")} for a full (code-aware) investigation.`
+        import_picocolors9.default.yellow(
+          `Proceeding in runtime-only mode \u2014 no source intelligence. Run ${import_picocolors9.default.bold("horus index")} for a full (code-aware) investigation.`
         )
       );
     }
@@ -94054,7 +94448,7 @@ async function runInvestigate(hint, opts) {
           model,
           ...ai.anthropicApiKey !== void 0 ? { apiKey: ai.anthropicApiKey } : {}
         });
-        console.log(import_picocolors8.default.dim(`[ai] model: ${model}`));
+        console.log(import_picocolors9.default.dim(`[ai] model: ${model}`));
         const narrativeInput = buildNarrativeInput(report);
         const { output, fromProvider, degraded, validationErrors } = await renderNarrative(
           narrativeInput,
@@ -94070,37 +94464,78 @@ async function runInvestigate(hint, opts) {
           renderStoredAIJudgment(stored);
         } else if (degraded) {
           if (validationErrors && validationErrors.length > 0) {
-            console.error(import_picocolors8.default.yellow(`[ai] structured validation incomplete \u2014 showing raw AI narrative`));
+            console.error(import_picocolors9.default.yellow(`[ai] structured validation incomplete \u2014 showing raw AI narrative`));
           }
           console.log("");
-          console.log(import_picocolors8.default.dim("\u2500".repeat(60)));
-          console.log(import_picocolors8.default.bold("AI narrative ") + import_picocolors8.default.yellow("(unstructured \u2014 not validated)"));
+          console.log(import_picocolors9.default.dim("\u2500".repeat(60)));
+          console.log(import_picocolors9.default.bold("AI narrative ") + import_picocolors9.default.yellow("(unstructured \u2014 not validated)"));
           if (output.what?.trim()) {
-            console.log(import_picocolors8.default.bold("\nWhat:"), output.what.trim());
+            console.log(import_picocolors9.default.bold("\nWhat:"), output.what.trim());
           }
           if (output.why?.trim()) {
-            console.log(import_picocolors8.default.bold("\nWhy:"), output.why.trim());
+            console.log(import_picocolors9.default.bold("\nWhy:"), output.why.trim());
           }
           if (output.whereNext.length > 0) {
-            console.log(import_picocolors8.default.bold("\nNext:"));
+            console.log(import_picocolors9.default.bold("\nNext:"));
             for (const a of output.whereNext) console.log(`  - ${a}`);
           }
         } else {
           const reason = classifyAIFailure(validationErrors?.[0]);
-          console.error(import_picocolors8.default.yellow(`[ai] fallback to deterministic \u2014 ${reason}`));
+          console.error(import_picocolors9.default.yellow(`[ai] fallback to deterministic \u2014 ${reason}`));
+        }
+      }
+      track({
+        type: "investigation.completed",
+        investigationId: report.id,
+        confidence: typeof report.confidence === "number" ? report.confidence : null,
+        evidenceCount: report.evidence?.length ?? 0,
+        findingCount: report.findings?.length ?? 0,
+        suspectedCauseCount: report.suspectedCauses?.length ?? 0,
+        degraded: Boolean(report.degraded),
+        gapCount: report.gapAnalysis?.gaps?.length ?? 0,
+        hasAi: Boolean(report.aiJudgment)
+      });
+      if (isContentSharingEnabled()) {
+        const hint2 = redactOrDrop(report.input.hint ?? "");
+        if (!hint2.dropped) {
+          track({
+            type: "investigation.content",
+            investigationId: report.id,
+            hint: hint2.value ?? "",
+            summary: redactContent(report.summary ?? ""),
+            findingTitles: (report.findings ?? []).slice(0, 20).map((f) => redactContent(f.title ?? "")),
+            suspectedCauseTitles: (report.suspectedCauses ?? []).slice(0, 20).map((c) => redactContent(c.title ?? "")),
+            confidence: typeof report.confidence === "number" ? report.confidence : null
+          });
         }
       }
       if (cloudActive && cloudSession && cloudCfg) {
         try {
           const refs = await uploadInvestigationToCloud(cloudSession.client, cloudCfg, report);
-          console.log(import_picocolors8.default.dim(`[cloud] investigation saved: ${refs.investigationId}`));
+          console.log(import_picocolors9.default.dim(`[cloud] investigation saved: ${refs.investigationId}`));
         } catch (err) {
           return reportCloudError(err);
         }
       }
       if (format !== "json") {
-        console.log(import_picocolors8.default.dim(`
+        if (report.persisted === false) {
+          console.error(
+            import_picocolors9.default.yellow(`
+\u26A0 Results were not saved \u2014 the investigation database was unreachable.`)
+          );
+          console.error(
+            import_picocolors9.default.dim(
+              `  This report is display-only; \`horus ask\` won't find it. Start the database and re-run to persist.`
+            )
+          );
+        } else {
+          console.log(import_picocolors9.default.dim(`
 Ask a follow-up:  horus ask ${report.id} "<question>"`));
+        }
+        await maybePromptFeedback({
+          investigationId: report.id,
+          horusSeconds: (Date.now() - startedAtMs) / 1e3
+        });
       }
     } finally {
       await sql2.end();
@@ -94109,14 +94544,16 @@ Ask a follow-up:  horus ask ${report.id} "<question>"`));
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors8.default.red(err.message));
+    const msg = err?.message || String(err);
+    console.error(import_picocolors9.default.red(msg.trim() ? msg : "Investigation failed (unknown error)."));
+    if (process.env.HORUS_DEBUG) console.error(import_picocolors9.default.dim(err?.stack ?? String(err)));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/changes.ts
 init_cjs_shims();
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 var CHANGES_AI_CONTRACT = `Provide a clearly separated AI change-impact review with:
 
 Highest-risk changes
@@ -94141,7 +94578,7 @@ async function runChanges(base2, compare, opts) {
     const health = await code.health();
     if (!health.ok) {
       console.error(
-        import_picocolors9.default.red("Source-intelligence host unreachable \u2014 run: horus index")
+        import_picocolors10.default.red("Source-intelligence host unreachable \u2014 run: horus index")
       );
       return 1;
     }
@@ -94163,20 +94600,20 @@ async function runChanges(base2, compare, opts) {
         });
         console.log("\n" + renderInterpretation(result));
         if (!result.ok) {
-          console.error(import_picocolors9.default.yellow(`[ai] ${result.warning}`));
+          console.error(import_picocolors10.default.yellow(`[ai] ${result.warning}`));
         }
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors9.default.red(err.message));
+    console.error(import_picocolors10.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/timeline.ts
 init_cjs_shims();
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 var DEFAULT_SINCE = "7 days ago";
 function resolveTimelineWindow(opts) {
   const usingDefault = !opts.all && opts.since === void 0;
@@ -94206,7 +94643,7 @@ async function runTimeline(service, opts) {
     try {
       renv = resolveEnvironment(config2, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors10.default.red(err.message));
+      console.error(import_picocolors11.default.red(err.message));
       return 1;
     }
     const { code } = createConnectors(config2);
@@ -94221,9 +94658,9 @@ async function runTimeline(service, opts) {
       console.log(renderChangeTimeline(t));
       if (usingDefaultWindow) {
         console.log(
-          import_picocolors10.default.dim(
+          import_picocolors11.default.dim(
             `
-  Showing the last 7 days (default). Widen with ${import_picocolors10.default.bold('--since "30 days ago"')}, pin a range with ${import_picocolors10.default.bold("--since <when> --until <when>")}, or see everything with ${import_picocolors10.default.bold("--all")}.`
+  Showing the last 7 days (default). Widen with ${import_picocolors11.default.bold('--since "30 days ago"')}, pin a range with ${import_picocolors11.default.bold("--since <when> --until <when>")}, or see everything with ${import_picocolors11.default.bold("--all")}.`
           )
         );
       }
@@ -94240,20 +94677,20 @@ async function runTimeline(service, opts) {
         });
         console.log("\n" + renderInterpretation(result));
         if (!result.ok) {
-          console.error(import_picocolors10.default.yellow(`[ai] ${result.warning}`));
+          console.error(import_picocolors11.default.yellow(`[ai] ${result.warning}`));
         }
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors10.default.red(err.message));
+    console.error(import_picocolors11.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/what-changed.ts
 init_cjs_shims();
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 var DEFAULT_SINCE2 = "7 days ago";
 var WHAT_CHANGED_AI_CONTRACT = `Provide a clearly separated AI interpretation section with:
 
@@ -94277,7 +94714,7 @@ async function runWhatChanged(service, opts) {
     try {
       renv = resolveEnvironment(config2, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors11.default.red(err.message));
+      console.error(import_picocolors12.default.red(err.message));
       return 1;
     }
     const { code } = createConnectors(config2);
@@ -94300,19 +94737,19 @@ async function runWhatChanged(service, opts) {
       });
       console.log("\n" + renderInterpretation(result));
       if (!result.ok) {
-        console.error(import_picocolors11.default.yellow(`[ai] ${result.warning}`));
+        console.error(import_picocolors12.default.yellow(`[ai] ${result.warning}`));
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors11.default.red(err.message));
+    console.error(import_picocolors12.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/architecture.ts
 init_cjs_shims();
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 var ARCHITECTURE_AI_CONTRACT = `Provide a clearly separated AI interpretation section with:
 
 System summary
@@ -94341,7 +94778,7 @@ async function runArchitecture(opts) {
     const health = await code.health();
     if (!health.ok) {
       console.error(
-        import_picocolors12.default.red("Source-intelligence host unreachable \u2014 run: horus index")
+        import_picocolors13.default.red("Source-intelligence host unreachable \u2014 run: horus index")
       );
       return 1;
     }
@@ -94369,7 +94806,7 @@ async function runArchitecture(opts) {
           });
           console.log("\n" + renderInterpretation(result));
           if (!result.ok) {
-            console.error(import_picocolors12.default.yellow(`[ai] ${result.warning}`));
+            console.error(import_picocolors13.default.yellow(`[ai] ${result.warning}`));
           }
         }
       }
@@ -94378,14 +94815,14 @@ async function runArchitecture(opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors12.default.red(err.message));
+    console.error(import_picocolors13.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/blast-radius.ts
 init_cjs_shims();
-var import_picocolors13 = __toESM(require_picocolors(), 1);
+var import_picocolors14 = __toESM(require_picocolors(), 1);
 var BLAST_RADIUS_AI_CONTRACT = `Provide a clearly separated AI interpretation section with:
 
 Evidence used
@@ -94412,7 +94849,7 @@ async function runBlastRadius(query, opts) {
     const { code } = createConnectors(config2);
     const health = await code.health();
     if (!health.ok) {
-      console.error(import_picocolors13.default.red("Source-intelligence host unreachable \u2014 run: horus index"));
+      console.error(import_picocolors14.default.red("Source-intelligence host unreachable \u2014 run: horus index"));
       return 1;
     }
     let project;
@@ -94425,12 +94862,12 @@ async function runBlastRadius(query, opts) {
       const r = await analyzeBlastRadius(query, { code, db, project }, opts.depth ?? 3);
       if (!r) {
         console.log(`No symbol found for: ${query}`);
-        console.log(import_picocolors13.default.dim(`  Tip: use an exact class or function name, e.g. "MyService"`));
+        console.log(import_picocolors14.default.dim(`  Tip: use an exact class or function name, e.g. "MyService"`));
         return 1;
       }
       if (r.seed.name.toLowerCase() !== query.toLowerCase()) {
         console.log(
-          import_picocolors13.default.yellow(`  No exact match for "${query}"`) + import_picocolors13.default.dim(` \u2014 showing closest: "${r.seed.name}" (fuzzy match)`)
+          import_picocolors14.default.yellow(`  No exact match for "${query}"`) + import_picocolors14.default.dim(` \u2014 showing closest: "${r.seed.name}" (fuzzy match)`)
         );
       }
       if (opts.json) {
@@ -94450,7 +94887,7 @@ async function runBlastRadius(query, opts) {
           });
           console.log("\n" + renderInterpretation(result));
           if (!result.ok) {
-            console.error(import_picocolors13.default.yellow(`[ai] ${result.warning}`));
+            console.error(import_picocolors14.default.yellow(`[ai] ${result.warning}`));
           }
         }
       }
@@ -94459,28 +94896,28 @@ async function runBlastRadius(query, opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors13.default.red(err.message));
+    console.error(import_picocolors14.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/repos.ts
 init_cjs_shims();
-var import_picocolors14 = __toESM(require_picocolors(), 1);
+var import_picocolors15 = __toESM(require_picocolors(), 1);
 async function runRepos(opts) {
   const config2 = await loadConfig(opts.config);
   const providers = repoProviders(config2);
   if (providers.length === 0) {
-    console.log(import_picocolors14.default.dim("No repositories configured."));
+    console.log(import_picocolors15.default.dim("No repositories configured."));
     return 0;
   }
   const health = await reposHealth(providers);
   for (const h of health) {
-    const dot = h.reachable ? import_picocolors14.default.green("\u25CF") : import_picocolors14.default.red("\u25CF");
-    const name = import_picocolors14.default.bold(h.repo.padEnd(20));
-    const hostUrl = import_picocolors14.default.cyan(h.hostUrl.padEnd(30));
-    const path = import_picocolors14.default.dim(h.path);
-    const detail = h.detail ? import_picocolors14.default.dim(`(${h.detail})`) : "";
+    const dot = h.reachable ? import_picocolors15.default.green("\u25CF") : import_picocolors15.default.red("\u25CF");
+    const name = import_picocolors15.default.bold(h.repo.padEnd(20));
+    const hostUrl = import_picocolors15.default.cyan(h.hostUrl.padEnd(30));
+    const path = import_picocolors15.default.dim(h.path);
+    const detail = h.detail ? import_picocolors15.default.dim(`(${h.detail})`) : "";
     console.log(`  ${dot}  ${name}  ${hostUrl}  ${path}  ${detail}`);
   }
   return 0;
@@ -94488,7 +94925,7 @@ async function runRepos(opts) {
 
 // ../../packages/cli/src/commands/search.ts
 init_cjs_shims();
-var import_picocolors15 = __toESM(require_picocolors(), 1);
+var import_picocolors16 = __toESM(require_picocolors(), 1);
 async function runSearch(query, opts) {
   const config2 = await loadConfig(opts.config);
   const providers = repoProviders(config2);
@@ -94499,16 +94936,16 @@ async function runSearch(query, opts) {
   }
   let totalMatches = 0;
   for (const result of results) {
-    const statusDot = result.reachable ? import_picocolors15.default.green("\u25CF") : import_picocolors15.default.red("\u25CF");
+    const statusDot = result.reachable ? import_picocolors16.default.green("\u25CF") : import_picocolors16.default.red("\u25CF");
     console.log("");
-    console.log(`${statusDot}  ${import_picocolors15.default.bold("## " + result.repo)}  ${import_picocolors15.default.dim(result.hostUrl)}`);
+    console.log(`${statusDot}  ${import_picocolors16.default.bold("## " + result.repo)}  ${import_picocolors16.default.dim(result.hostUrl)}`);
     if (!result.reachable) {
-      console.log(import_picocolors15.default.dim("  (unreachable)"));
+      console.log(import_picocolors16.default.dim("  (unreachable)"));
     } else if (result.symbols.length === 0) {
-      console.log(import_picocolors15.default.dim("  (no matches)"));
+      console.log(import_picocolors16.default.dim("  (no matches)"));
     } else {
       for (const sym of result.symbols) {
-        console.log(`  - ${import_picocolors15.default.bold(sym.name)}  ${import_picocolors15.default.dim(sym.filePath)}`);
+        console.log(`  - ${import_picocolors16.default.bold(sym.name)}  ${import_picocolors16.default.dim(sym.filePath)}`);
       }
       totalMatches += result.symbols.length;
     }
@@ -94516,7 +94953,7 @@ async function runSearch(query, opts) {
   console.log("");
   const reachableCount = results.filter((r) => r.reachable).length;
   console.log(
-    import_picocolors15.default.dim(
+    import_picocolors16.default.dim(
       `${totalMatches} match(es) across ${reachableCount}/${results.length} reachable repo(s) for query: "${query}"`
     )
   );
@@ -94525,7 +94962,7 @@ async function runSearch(query, opts) {
 
 // ../../packages/cli/src/commands/investigations.ts
 init_cjs_shims();
-var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/format.ts
 init_cjs_shims();
@@ -94568,8 +95005,8 @@ async function runInvestigations(opts) {
     const session = authedClient();
     if (!session) {
       console.error(
-        import_picocolors16.default.red(
-          `This repo is linked to Horus Cloud but you are not logged in. Run ${import_picocolors16.default.bold("horus login")} first.`
+        import_picocolors17.default.red(
+          `This repo is linked to Horus Cloud but you are not logged in. Run ${import_picocolors17.default.bold("horus login")} first.`
         )
       );
       return 1;
@@ -94610,18 +95047,18 @@ async function runInvestigations(opts) {
 
 // ../../packages/cli/src/commands/replay.ts
 init_cjs_shims();
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 async function runReplay(id, opts) {
   const { db, sql: sql2 } = createDb(await resolveDbUrl(opts.config));
   try {
     const row = await getInvestigation(db, id);
     if (!row) {
-      console.error(import_picocolors17.default.red("No investigation found: " + id));
+      console.error(import_picocolors18.default.red("No investigation found: " + id));
       return 1;
     }
     if (!row.report) {
       console.error(
-        import_picocolors17.default.red(
+        import_picocolors18.default.red(
           "Investigation " + id + " has no stored report (run a newer investigation)."
         )
       );
@@ -94634,7 +95071,7 @@ async function runReplay(id, opts) {
     if (opts.ai && fmt !== "json") {
       if (report.aiJudgment && !opts.refreshAi) {
         renderStoredAIJudgment(report.aiJudgment);
-        console.log(import_picocolors17.default.dim("[ai] Stored judgment replayed. Use --refresh-ai to regenerate."));
+        console.log(import_picocolors18.default.dim("[ai] Stored judgment replayed. Use --refresh-ai to regenerate."));
       } else {
         const narrativeInput = buildNarrativeInput(report);
         const { provider } = await buildNarrativeProvider({
@@ -94647,17 +95084,17 @@ async function runReplay(id, opts) {
         );
         if (!fromProvider && degraded) {
           if (validationErrors?.length) {
-            console.error(import_picocolors17.default.yellow("[ai] structured validation incomplete \u2014 showing raw AI narrative"));
+            console.error(import_picocolors18.default.yellow("[ai] structured validation incomplete \u2014 showing raw AI narrative"));
           }
           console.log("");
-          console.log(import_picocolors17.default.dim("\u2500".repeat(60)));
-          console.log(import_picocolors17.default.bold("AI narrative ") + import_picocolors17.default.yellow("(unstructured \u2014 not validated)"));
-          if (output.what?.trim()) console.log(import_picocolors17.default.bold("\nWhat:"), output.what.trim());
-          if (output.why?.trim()) console.log(import_picocolors17.default.bold("\nWhy:"), output.why.trim());
+          console.log(import_picocolors18.default.dim("\u2500".repeat(60)));
+          console.log(import_picocolors18.default.bold("AI narrative ") + import_picocolors18.default.yellow("(unstructured \u2014 not validated)"));
+          if (output.what?.trim()) console.log(import_picocolors18.default.bold("\nWhat:"), output.what.trim());
+          if (output.why?.trim()) console.log(import_picocolors18.default.bold("\nWhy:"), output.why.trim());
         } else if (!fromProvider) {
-          console.error(import_picocolors17.default.yellow("[ai] Provider unavailable \u2014 deterministic output shown above."));
+          console.error(import_picocolors18.default.yellow("[ai] Provider unavailable \u2014 deterministic output shown above."));
           if (validationErrors?.length) {
-            console.error(import_picocolors17.default.dim(`    ${validationErrors[0]}`));
+            console.error(import_picocolors18.default.dim(`    ${validationErrors[0]}`));
           }
         } else {
           const stored = narrativeOutputToStoredJudgment(output, "anthropic");
@@ -94678,7 +95115,7 @@ async function runReplay(id, opts) {
 
 // ../../packages/cli/src/commands/owner.ts
 init_cjs_shims();
-var import_picocolors18 = __toESM(require_picocolors(), 1);
+var import_picocolors19 = __toESM(require_picocolors(), 1);
 async function runOwner(query, opts) {
   try {
     const config2 = await loadConfig(opts.config);
@@ -94686,7 +95123,7 @@ async function runOwner(query, opts) {
     try {
       renv = resolveEnvironment(config2, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors18.default.red(err.message));
+      console.error(import_picocolors19.default.red(err.message));
       return 1;
     }
     const code = codeForRepo(config2, renv.project);
@@ -94694,16 +95131,16 @@ async function runOwner(query, opts) {
     console.log(opts.json ? ownershipToJSON(o) : renderOwnership(o));
     return 0;
   } catch (err) {
-    console.error(import_picocolors18.default.red(err.message));
+    console.error(import_picocolors19.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/postmortem.ts
 init_cjs_shims();
-var import_node_fs13 = require("fs");
-var import_node_path14 = require("path");
-var import_picocolors19 = __toESM(require_picocolors(), 1);
+var import_node_fs15 = require("fs");
+var import_node_path16 = require("path");
+var import_picocolors20 = __toESM(require_picocolors(), 1);
 async function runPostmortem(id, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   let sql2;
@@ -94717,11 +95154,11 @@ async function runPostmortem(id, opts) {
       const { db } = conn;
       const row = await getInvestigation(db, id);
       if (!row) {
-        log(import_picocolors19.default.red("No investigation found: " + id));
+        log(import_picocolors20.default.red("No investigation found: " + id));
         return 1;
       }
       if (!row.report) {
-        log(import_picocolors19.default.red("Investigation " + id + " has no stored report."));
+        log(import_picocolors20.default.red("Investigation " + id + " has no stored report."));
         return 1;
       }
       report = migrateReport(row.report);
@@ -94813,25 +95250,25 @@ _AI summary unavailable: ${validationErrors?.[0] ?? "provider error"}_
       }
     }
     if (opts.output) {
-      const outputPath = (0, import_node_path14.resolve)(opts.output);
-      if ((0, import_node_fs13.existsSync)(outputPath) && !opts.force) {
-        log(import_picocolors19.default.red("\u2717") + " " + outputPath + " already exists");
-        log(import_picocolors19.default.dim("  pass --force to overwrite"));
+      const outputPath = (0, import_node_path16.resolve)(opts.output);
+      if ((0, import_node_fs15.existsSync)(outputPath) && !opts.force) {
+        log(import_picocolors20.default.red("\u2717") + " " + outputPath + " already exists");
+        log(import_picocolors20.default.dim("  pass --force to overwrite"));
         return 1;
       }
       try {
-        (0, import_node_fs13.writeFileSync)(outputPath, content, "utf8");
+        (0, import_node_fs15.writeFileSync)(outputPath, content, "utf8");
       } catch (err) {
-        log(import_picocolors19.default.red("\u2717 Could not write " + outputPath + ": ") + err.message);
+        log(import_picocolors20.default.red("\u2717 Could not write " + outputPath + ": ") + err.message);
         return 1;
       }
-      log(import_picocolors19.default.green("\u2713") + " Saved postmortem to " + outputPath);
+      log(import_picocolors20.default.green("\u2713") + " Saved postmortem to " + outputPath);
     } else {
       log(content);
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log(import_picocolors19.default.red("postmortem failed: " + message));
+    log(import_picocolors20.default.red("postmortem failed: " + message));
     return 1;
   } finally {
     if (sql2) {
@@ -94843,7 +95280,7 @@ _AI summary unavailable: ${validationErrors?.[0] ?? "provider error"}_
 
 // ../../packages/cli/src/commands/score.ts
 init_cjs_shims();
-var import_picocolors20 = __toESM(require_picocolors(), 1);
+var import_picocolors21 = __toESM(require_picocolors(), 1);
 var SCORE_AI_CONTRACT = `Provide a clearly separated AI score explanation with:
 
 Why this scored this way
@@ -94862,11 +95299,11 @@ async function runScore(id, opts) {
   try {
     const row = await getInvestigation(db, id);
     if (!row) {
-      console.error(import_picocolors20.default.red("No investigation found: " + id));
+      console.error(import_picocolors21.default.red("No investigation found: " + id));
       return 1;
     }
     if (!row.report) {
-      console.error(import_picocolors20.default.red("Investigation " + id + " has no stored report."));
+      console.error(import_picocolors21.default.red("Investigation " + id + " has no stored report."));
       return 1;
     }
     const s = scoreInvestigation(migrateReport(row.report));
@@ -94887,7 +95324,7 @@ async function runScore(id, opts) {
         });
         console.log("\n" + renderInterpretation(result));
         if (!result.ok) {
-          console.error(import_picocolors20.default.yellow(`[ai] ${result.warning}`));
+          console.error(import_picocolors21.default.yellow(`[ai] ${result.warning}`));
         }
       }
     }
@@ -94927,7 +95364,7 @@ async function runScores(opts) {
 
 // ../../packages/cli/src/commands/ask.ts
 init_cjs_shims();
-var import_picocolors21 = __toESM(require_picocolors(), 1);
+var import_picocolors22 = __toESM(require_picocolors(), 1);
 function renderAnswer(report, directive, opts) {
   const answer = answerQuestion(report, directive);
   if (answer) {
@@ -94939,13 +95376,13 @@ function renderAnswer(report, directive, opts) {
   if (!opts.json && report.aiJudgment) {
     const j = report.aiJudgment;
     console.log("");
-    console.log(import_picocolors21.default.dim("\u2500".repeat(60)));
-    console.log(import_picocolors21.default.dim(`Stored AI judgment (${j.provider}, ${j.generatedAt}):`));
+    console.log(import_picocolors22.default.dim("\u2500".repeat(60)));
+    console.log(import_picocolors22.default.dim(`Stored AI judgment (${j.provider}, ${j.generatedAt}):`));
     if (j.rootCauseAssessment) {
-      console.log(import_picocolors21.default.bold("Root cause (AI):"), j.rootCauseAssessment.summary);
-      console.log(import_picocolors21.default.dim(`Uncertainty: ${j.rootCauseAssessment.uncertainty}`));
+      console.log(import_picocolors22.default.bold("Root cause (AI):"), j.rootCauseAssessment.summary);
+      console.log(import_picocolors22.default.dim(`Uncertainty: ${j.rootCauseAssessment.uncertainty}`));
     } else {
-      console.log(import_picocolors21.default.bold("AI Why:"), j.why);
+      console.log(import_picocolors22.default.bold("AI Why:"), j.why);
     }
   }
   return 0;
@@ -94974,8 +95411,8 @@ async function runAsk(id, directive, opts) {
     const session = authedClient();
     if (!session) {
       console.error(
-        import_picocolors21.default.red(
-          `This repo is linked to Horus Cloud but you are not logged in. Run ${import_picocolors21.default.bold("horus login")} first.`
+        import_picocolors22.default.red(
+          `This repo is linked to Horus Cloud but you are not logged in. Run ${import_picocolors22.default.bold("horus login")} first.`
         )
       );
       return 1;
@@ -94984,15 +95421,15 @@ async function runAsk(id, directive, opts) {
       const report = await fetchInvestigationReportFromCloud(session.client, cloudCfg, id);
       if (report) return renderAnswer(report, directive, opts);
       console.error(
-        import_picocolors21.default.red(
-          `Investigation ${id} has no saved report locally or in Horus Cloud. Run ${import_picocolors21.default.bold("horus investigate")} first.`
+        import_picocolors22.default.red(
+          `Investigation ${id} has no saved report locally or in Horus Cloud. Run ${import_picocolors22.default.bold("horus investigate")} first.`
         )
       );
       return 1;
     } catch (err) {
       if (err instanceof CloudError && err.status === 404) {
         console.error(
-          import_picocolors21.default.red(
+          import_picocolors22.default.red(
             `No investigation found for "${id}" locally or in Horus Cloud. Use the id printed at the top of \`horus investigate\` output.`
           )
         );
@@ -95006,21 +95443,21 @@ async function runAsk(id, directive, opts) {
     case "found":
       return renderAnswer(local.report, directive, opts);
     case "no-report":
-      console.error(import_picocolors21.default.red("Investigation " + id + " has no stored report."));
+      console.error(import_picocolors22.default.red("Investigation " + id + " has no stored report."));
       return 1;
     case "error":
-      console.error(import_picocolors21.default.red(local.message));
+      console.error(import_picocolors22.default.red(local.message));
       return 1;
     case "not-found":
     default:
-      console.error(import_picocolors21.default.red("No investigation found: " + id));
+      console.error(import_picocolors22.default.red("No investigation found: " + id));
       return 1;
   }
 }
 
 // ../../packages/cli/src/commands/onboard.ts
 init_cjs_shims();
-var import_picocolors22 = __toESM(require_picocolors(), 1);
+var import_picocolors23 = __toESM(require_picocolors(), 1);
 var ONBOARD_AI_CONTRACT = `Provide a clearly separated AI onboarding guide with:
 
 Start here
@@ -95048,7 +95485,7 @@ async function runOnboard(area, opts) {
     try {
       renv = resolveEnvironment(config2, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors22.default.red(err.message));
+      console.error(import_picocolors23.default.red(err.message));
       return 1;
     }
     const repo = { name: renv.project, path: renv.path };
@@ -95056,7 +95493,7 @@ async function runOnboard(area, opts) {
     const health = await code.health();
     if (!health.ok) {
       console.error(
-        import_picocolors22.default.red("Source-intelligence host unreachable \u2014 run: horus index")
+        import_picocolors23.default.red("Source-intelligence host unreachable \u2014 run: horus index")
       );
       return 1;
     }
@@ -95083,7 +95520,7 @@ async function runOnboard(area, opts) {
           });
           console.log("\n" + renderInterpretation(result));
           if (!result.ok) {
-            console.error(import_picocolors22.default.yellow(`[ai] ${result.warning}`));
+            console.error(import_picocolors23.default.yellow(`[ai] ${result.warning}`));
           }
         }
       }
@@ -95092,14 +95529,14 @@ async function runOnboard(area, opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors22.default.red(err.message));
+    console.error(import_picocolors23.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/simulate.ts
 init_cjs_shims();
-var import_picocolors23 = __toESM(require_picocolors(), 1);
+var import_picocolors24 = __toESM(require_picocolors(), 1);
 async function runSimulate(scenarioId, opts) {
   try {
     if (scenarioId === void 0) {
@@ -95109,7 +95546,7 @@ async function runSimulate(scenarioId, opts) {
     const scenario = getScenario(scenarioId);
     if (scenario === null) {
       console.error(
-        import_picocolors23.default.red(
+        import_picocolors24.default.red(
           `Unknown scenario: "${scenarioId}". Run horus simulate to list available scenarios.`
         )
       );
@@ -95120,14 +95557,14 @@ async function runSimulate(scenarioId, opts) {
     try {
       renv = resolveEnvironment(config2, { project: opts.repo });
     } catch (err) {
-      console.error(import_picocolors23.default.red(err.message));
+      console.error(import_picocolors24.default.red(err.message));
       return 1;
     }
     const code = codeForRepo(config2, renv.project);
     const health = await code.health();
     if (!health.ok) {
       console.error(
-        import_picocolors23.default.red("Source-intelligence host unreachable \u2014 run: horus index")
+        import_picocolors24.default.red("Source-intelligence host unreachable \u2014 run: horus index")
       );
       return 1;
     }
@@ -95144,14 +95581,14 @@ async function runSimulate(scenarioId, opts) {
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors23.default.red(err.message));
+    console.error(import_picocolors24.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/logs.ts
 init_cjs_shims();
-var import_picocolors24 = __toESM(require_picocolors(), 1);
+var import_picocolors25 = __toESM(require_picocolors(), 1);
 var LOGS_AI_CONTRACT = `Provide a clearly separated AI evidence narration with:
 
 Evidence used
@@ -95184,9 +95621,9 @@ function resolveRawLevel(opts) {
   return opts.level ?? "error";
 }
 function levelColor(level, text2) {
-  if (level === "error" || level === "fatal") return import_picocolors24.default.red(text2);
-  if (level === "warn") return import_picocolors24.default.yellow(text2);
-  return import_picocolors24.default.dim(text2);
+  if (level === "error" || level === "fatal") return import_picocolors25.default.red(text2);
+  if (level === "warn") return import_picocolors25.default.yellow(text2);
+  return import_picocolors25.default.dim(text2);
 }
 function matchServiceLabel(requested, candidates) {
   if (candidates.includes(requested)) return { kind: "unique", matched: requested };
@@ -95203,13 +95640,13 @@ async function runLogs(service, opts) {
     try {
       renv = resolveEnvironment(config2, { project: opts.project, env: opts.env });
     } catch (err) {
-      console.error(import_picocolors24.default.red(err.message));
+      console.error(import_picocolors25.default.red(err.message));
       return 1;
     }
     const logs = logsForEnv(renv);
     if (logs === null) {
       console.error(
-        import_picocolors24.default.red(
+        import_picocolors25.default.red(
           `No Elasticsearch connector configured for ${renv.project}/${renv.env} (set ES_URL / ES_USERNAME / ES_PASSWORD)`
         )
       );
@@ -95217,7 +95654,7 @@ async function runLogs(service, opts) {
     }
     const health = await logs.health();
     if (!health.ok) {
-      console.error(import_picocolors24.default.red(`Elasticsearch unreachable: ${health.detail}`));
+      console.error(import_picocolors25.default.red(`Elasticsearch unreachable: ${health.detail}`));
       return 1;
     }
     const resolvedService = service ?? renv.connectors.elasticsearch?.serviceName;
@@ -95230,21 +95667,21 @@ async function runLogs(service, opts) {
         requiresEventCode: aggregatesEventCode
       });
       for (const w of compat.issues.filter((i) => i.severity === "warning")) {
-        console.warn(import_picocolors24.default.yellow(`[warn] ${w.field}: ${w.message}`));
+        console.warn(import_picocolors25.default.yellow(`[warn] ${w.field}: ${w.message}`));
       }
       const errors2 = compat.issues.filter((i) => i.severity === "error");
       if (errors2.length > 0) {
-        console.error(import_picocolors24.default.red("Elasticsearch field mapping is incompatible with the index:"));
+        console.error(import_picocolors25.default.red("Elasticsearch field mapping is incompatible with the index:"));
         for (const e of errors2) {
-          console.error(import_picocolors24.default.red(`  ${e.field}: ${e.message}`));
+          console.error(import_picocolors25.default.red(`  ${e.field}: ${e.message}`));
         }
         console.error(
-          import_picocolors24.default.dim("Fix fields.* overrides in your connector config or choose the correct preset.")
+          import_picocolors25.default.dim("Fix fields.* overrides in your connector config or choose the correct preset.")
         );
         return 1;
       }
     } catch {
-      console.warn(import_picocolors24.default.dim("[warn] Elasticsearch compatibility check unavailable \u2014 proceeding."));
+      console.warn(import_picocolors25.default.dim("[warn] Elasticsearch compatibility check unavailable \u2014 proceeding."));
     }
     const from = sinceToIso(opts.since) ?? new Date(Date.now() - 7 * 864e5).toISOString();
     const fromDisplay = from.slice(0, 16).replace("T", " ");
@@ -95295,7 +95732,7 @@ async function runLogs(service, opts) {
         return 0;
       }
       if (records.length === 0) {
-        console.log(import_picocolors24.default.dim("No logs matched."));
+        console.log(import_picocolors25.default.dim("No logs matched."));
         return 0;
       }
       for (const r of records) {
@@ -95305,7 +95742,7 @@ async function runLogs(service, opts) {
         const line2 = `${ts}  ${lvl}  ${comp}  ${r.message.slice(0, 120)}`;
         console.log(levelColor(r.level, line2));
         for (const { key, value } of extractContextFields(r)) {
-          console.log(import_picocolors24.default.dim(`    ${key}: ${value.slice(0, 200)}`));
+          console.log(import_picocolors25.default.dim(`    ${key}: ${value.slice(0, 200)}`));
         }
       }
       return 0;
@@ -95344,22 +95781,22 @@ async function runLogs(service, opts) {
         return 0;
       }
       console.log(
-        import_picocolors24.default.bold(`Top ${field}`) + import_picocolors24.default.dim(
+        import_picocolors25.default.bold(`Top ${field}`) + import_picocolors25.default.dim(
           ` \u2014 ${renv.project}/${renv.env}` + (resolvedService ? ` \xB7 service ${resolvedService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "")
         )
       );
-      console.log(import_picocolors24.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
+      console.log(import_picocolors25.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
       console.log("");
       if (buckets.length === 0) {
-        console.log(import_picocolors24.default.dim(`  No error logs with field "${field}" in the window.`));
-        console.log(import_picocolors24.default.dim(`  Tip: ensure "${field}" is an aggregatable (keyword) field.`));
+        console.log(import_picocolors25.default.dim(`  No error logs with field "${field}" in the window.`));
+        console.log(import_picocolors25.default.dim(`  Tip: ensure "${field}" is an aggregatable (keyword) field.`));
         return 0;
       }
       for (const b2 of buckets) {
-        console.log(`  ${import_picocolors24.default.red(String(b2.count).padStart(6))}  ${b2.key}`);
+        console.log(`  ${import_picocolors25.default.red(String(b2.count).padStart(6))}  ${b2.key}`);
       }
       console.log("");
-      console.log(import_picocolors24.default.dim(`  ${buckets.length} distinct ${field} value(s) shown (top by error count).`));
+      console.log(import_picocolors25.default.dim(`  ${buckets.length} distinct ${field} value(s) shown (top by error count).`));
       return 0;
     }
     let analysis = await logs.analyzeErrors({
@@ -95426,46 +95863,46 @@ async function runLogs(service, opts) {
       return 0;
     }
     console.log(
-      import_picocolors24.default.bold(`Error analysis`) + import_picocolors24.default.dim(
+      import_picocolors25.default.bold(`Error analysis`) + import_picocolors25.default.dim(
         ` \u2014 ${renv.project}/${renv.env}` + (scopeService ? ` \xB7 service ${scopeService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "")
       )
     );
-    console.log(import_picocolors24.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
+    console.log(import_picocolors25.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
     if (broadeningNote) {
-      console.log(import_picocolors24.default.yellow(`  ${broadeningNote}`));
+      console.log(import_picocolors25.default.yellow(`  ${broadeningNote}`));
     }
     console.log(
-      `  ${analysis.totalErrors} error(s) \xB7 ${analysis.signatures.length} signature(s) \xB7 ${import_picocolors24.default.yellow(String(analysis.newSignatures.length))} new`
+      `  ${analysis.totalErrors} error(s) \xB7 ${analysis.signatures.length} signature(s) \xB7 ${import_picocolors25.default.yellow(String(analysis.newSignatures.length))} new`
     );
     console.log("");
     if (analysis.signatures.length === 0) {
-      console.log(import_picocolors24.default.dim("  No error-level logs in the window."));
+      console.log(import_picocolors25.default.dim("  No error-level logs in the window."));
       console.log(
-        import_picocolors24.default.dim(
+        import_picocolors25.default.dim(
           `  Searched: ${scopeService ? `service "${scopeService}"` : "all services"} \xB7 index: ${indexPattern} \xB7 from: ${fromDisplay} UTC`
         )
       );
-      console.log(import_picocolors24.default.dim(`  Tip: use --since to widen the window (e.g. --since 30d).`));
+      console.log(import_picocolors25.default.dim(`  Tip: use --since to widen the window (e.g. --since 30d).`));
       return 0;
     }
     for (const s of analysis.signatures) {
       const tags = [];
-      if (s.isNew) tags.push(import_picocolors24.default.red("NEW"));
+      if (s.isNew) tags.push(import_picocolors25.default.red("NEW"));
       else if (s.ratio !== void 0 && Number.isFinite(s.ratio) && s.ratio >= 1.5) {
-        tags.push(import_picocolors24.default.yellow(`spike x${s.ratio.toFixed(1)}`));
+        tags.push(import_picocolors25.default.yellow(`spike x${s.ratio.toFixed(1)}`));
       }
-      const svc = s.services.length > 0 ? import_picocolors24.default.dim(` \xB7 ${s.services.slice(0, 3).join(", ")}`) : "";
+      const svc = s.services.length > 0 ? import_picocolors25.default.dim(` \xB7 ${s.services.slice(0, 3).join(", ")}`) : "";
       const tagStr = tags.length > 0 ? `  [${tags.join(", ")}]` : "";
       console.log(
-        `  ${import_picocolors24.default.red(String(s.count).padStart(6))}  ${import_picocolors24.default.bold(s.key.padEnd(14).slice(0, 14))}  ` + import_picocolors24.default.dim(`first ${shortTs(s.firstSeen)} \xB7 last ${shortTs(s.lastSeen)}`) + svc + tagStr
+        `  ${import_picocolors25.default.red(String(s.count).padStart(6))}  ${import_picocolors25.default.bold(s.key.padEnd(14).slice(0, 14))}  ` + import_picocolors25.default.dim(`first ${shortTs(s.firstSeen)} \xB7 last ${shortTs(s.lastSeen)}`) + svc + tagStr
       );
     }
     if (analysis.affectedServices.length > 0) {
       console.log("");
-      console.log(`  ${import_picocolors24.default.bold("Affected services:")} ${analysis.affectedServices.join(", ")}`);
+      console.log(`  ${import_picocolors25.default.bold("Affected services:")} ${analysis.affectedServices.join(", ")}`);
     }
     console.log("");
-    console.log(import_picocolors24.default.dim("  (use --raw to see individual log lines)"));
+    console.log(import_picocolors25.default.dim("  (use --raw to see individual log lines)"));
     if (opts.ai) {
       const result = await renderAiInterpretation({
         command: "logs",
@@ -95484,19 +95921,19 @@ async function runLogs(service, opts) {
       });
       console.log("\n" + renderInterpretation(result));
       if (!result.ok) {
-        console.error(import_picocolors24.default.yellow(`[ai] ${result.warning}`));
+        console.error(import_picocolors25.default.yellow(`[ai] ${result.warning}`));
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors24.default.red(err.message));
+    console.error(import_picocolors25.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/metrics.ts
 init_cjs_shims();
-var import_picocolors25 = __toESM(require_picocolors(), 1);
+var import_picocolors26 = __toESM(require_picocolors(), 1);
 var METRICS_AI_CONTRACT = `Provide a clearly separated AI evidence narration with:
 
 Evidence used
@@ -95541,10 +95978,10 @@ function anomalyColor(anomaly) {
     case "latency-spike":
     case "error-rate-change":
     case "throughput-drop":
-      return import_picocolors25.default.red;
+      return import_picocolors26.default.red;
     case "queue-growth":
     case "change":
-      return import_picocolors25.default.yellow;
+      return import_picocolors26.default.yellow;
     default:
       return (s) => s;
   }
@@ -95571,7 +96008,7 @@ async function runMetrics(hint, opts) {
     const metrics = metricsProviderFromConfig(config2);
     if (metrics === null) {
       console.error(
-        import_picocolors25.default.red(
+        import_picocolors26.default.red(
           "Grafana not configured \u2014 set GRAFANA_URL + GRAFANA_USER + GRAFANA_PASSWORD"
         )
       );
@@ -95579,7 +96016,7 @@ async function runMetrics(hint, opts) {
     }
     const health = await metrics.health();
     if (!health.ok) {
-      console.error(import_picocolors25.default.red(`Grafana unreachable: ${health.detail}`));
+      console.error(import_picocolors26.default.red(`Grafana unreachable: ${health.detail}`));
       return 1;
     }
     const stepNum = opts.step !== void 0 ? Number(opts.step) : void 0;
@@ -95608,14 +96045,14 @@ async function runMetrics(hint, opts) {
         return 0;
       }
       if (series.length === 0) {
-        console.log(import_picocolors25.default.dim("No series returned."));
+        console.log(import_picocolors26.default.dim("No series returned."));
         return 0;
       }
       for (const s of series) {
         const summary = summarize(s);
         const label = labelStr(s.labels);
         console.log(
-          `  ${import_picocolors25.default.cyan(label || "(no labels)")}  last=${import_picocolors25.default.bold(fmtNum(summary.last))}  avg=${fmtNum(summary.avg)}`
+          `  ${import_picocolors26.default.cyan(label || "(no labels)")}  last=${import_picocolors26.default.bold(fmtNum(summary.last))}  avg=${fmtNum(summary.avg)}`
         );
       }
       return 0;
@@ -95630,36 +96067,36 @@ async function runMetrics(hint, opts) {
     if (findings2.length === 0) {
       if (hint !== void 0) {
         const tokens = extractHintTokens(hint);
-        console.log(import_picocolors25.default.dim(`No panels matched hint "${hint}".`));
+        console.log(import_picocolors26.default.dim(`No panels matched hint "${hint}".`));
         if (tokens.length > 0) {
-          console.log(import_picocolors25.default.dim(`  Searched for panels containing: ${tokens.join(", ")}`));
+          console.log(import_picocolors26.default.dim(`  Searched for panels containing: ${tokens.join(", ")}`));
         }
         console.log(
-          import_picocolors25.default.dim(
-            `  Tip: run ${import_picocolors25.default.bold("horus metrics")} (no hint) to see all available panels, then use a panel title or keyword directly.`
+          import_picocolors26.default.dim(
+            `  Tip: run ${import_picocolors26.default.bold("horus metrics")} (no hint) to see all available panels, then use a panel title or keyword directly.`
           )
         );
       } else {
-        console.log(import_picocolors25.default.dim("No panels found in configured Grafana dashboards."));
+        console.log(import_picocolors26.default.dim("No panels found in configured Grafana dashboards."));
       }
       return 0;
     }
     const hintSuffix = hint !== void 0 ? ` (hint: "${hint}")` : "";
     const matchSources = hint !== void 0 ? [...new Set(findings2.map((f) => f.matchSource).filter(Boolean))] : [];
-    const matchSuffix = matchSources.length > 0 ? import_picocolors25.default.dim(` [matched via ${matchSources.join(", ")}]`) : "";
+    const matchSuffix = matchSources.length > 0 ? import_picocolors26.default.dim(` [matched via ${matchSources.join(", ")}]`) : "";
     console.log(
-      import_picocolors25.default.bold(
+      import_picocolors26.default.bold(
         `Grafana metrics${hintSuffix} \u2014 ${findings2.length} series across panels`
       ) + matchSuffix
     );
     console.log(
-      import_picocolors25.default.dim(
+      import_picocolors26.default.dim(
         `  window: ${new Date(from * 1e3).toISOString()} \u2013 ${new Date(to * 1e3).toISOString()}`
       )
     );
     console.log("");
     if (flagged.length === 0) {
-      console.log(import_picocolors25.default.green("  No anomalies detected."));
+      console.log(import_picocolors26.default.green("  No anomalies detected."));
     } else {
       for (const f of flagged) {
         const color = anomalyColor(f.anomaly);
@@ -95668,14 +96105,14 @@ async function runMetrics(hint, opts) {
         const lblStr = labelStr(f.labels);
         console.log(
           color(
-            `  ${label.padEnd(22)}  ${f.panelTitle.padEnd(40).slice(0, 40)}  ${fmtNum(f.baselineAvg)} -> ${fmtNum(f.currentAvg)} (${ratioStr})` + (lblStr !== "" ? `  ${import_picocolors25.default.dim(lblStr)}` : "")
+            `  ${label.padEnd(22)}  ${f.panelTitle.padEnd(40).slice(0, 40)}  ${fmtNum(f.baselineAvg)} -> ${fmtNum(f.currentAvg)} (${ratioStr})` + (lblStr !== "" ? `  ${import_picocolors26.default.dim(lblStr)}` : "")
           )
         );
       }
     }
     if (ok.length > 0) {
       console.log("");
-      console.log(import_picocolors25.default.dim(`  ${ok.length} panel series with no anomaly.`));
+      console.log(import_picocolors26.default.dim(`  ${ok.length} panel series with no anomaly.`));
     }
     if (opts.ai) {
       const result = await renderAiInterpretation({
@@ -95690,19 +96127,19 @@ async function runMetrics(hint, opts) {
       });
       console.log("\n" + renderInterpretation(result));
       if (!result.ok) {
-        console.error(import_picocolors25.default.yellow(`[ai] ${result.warning}`));
+        console.error(import_picocolors26.default.yellow(`[ai] ${result.warning}`));
       }
     }
     return 0;
   } catch (err) {
-    console.error(import_picocolors25.default.red(err.message));
+    console.error(import_picocolors26.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/state.ts
 init_cjs_shims();
-var import_picocolors26 = __toESM(require_picocolors(), 1);
+var import_picocolors27 = __toESM(require_picocolors(), 1);
 var STATE_AI_CONTRACT = `Provide a clearly separated AI evidence narration with:
 
 Evidence used
@@ -95728,13 +96165,13 @@ async function runState(opts) {
     try {
       renv = resolveEnvironment(config2, { project: opts.project, env: opts.env });
     } catch (err) {
-      console.error(import_picocolors26.default.red(err.message));
+      console.error(import_picocolors27.default.red(err.message));
       return 1;
     }
     const mongo = mongoForEnv(renv);
     if (mongo === null) {
       console.error(
-        import_picocolors26.default.red(
+        import_picocolors27.default.red(
           `No MongoDB connector configured for ${renv.project}/${renv.env} (set the project's Mongo URL env var).`
         )
       );
@@ -95742,7 +96179,7 @@ async function runState(opts) {
     }
     const health = await mongo.health();
     if (!health.ok) {
-      console.error(import_picocolors26.default.red(`MongoDB unreachable: ${health.detail}`));
+      console.error(import_picocolors27.default.red(`MongoDB unreachable: ${health.detail}`));
       await mongo.close();
       return 1;
     }
@@ -95768,38 +96205,38 @@ async function runState(opts) {
         );
         return 0;
       }
-      const discoveryNote = analysis.autoDiscovered ? import_picocolors26.default.dim(` (${analysis.collections.length} collections, auto-discovered)`) : "";
+      const discoveryNote = analysis.autoDiscovered ? import_picocolors27.default.dim(` (${analysis.collections.length} collections, auto-discovered)`) : "";
       console.log(
-        import_picocolors26.default.bold("State analysis") + import_picocolors26.default.dim(` \u2014 ${renv.project}/${renv.env} \xB7 db ${analysis.database}`) + discoveryNote
+        import_picocolors27.default.bold("State analysis") + import_picocolors27.default.dim(` \u2014 ${renv.project}/${renv.env} \xB7 db ${analysis.database}`) + discoveryNote
       );
       console.log("");
       let signals = 0;
       for (const c of analysis.collections) {
         const flags = [];
         if (c.isStale === true) {
-          flags.push(import_picocolors26.default.yellow(`stale (last ${c.dateField}, ~${Math.round(c.ageHours ?? 0)}h)`));
+          flags.push(import_picocolors27.default.yellow(`stale (last ${c.dateField}, ~${Math.round(c.ageHours ?? 0)}h)`));
         }
         for (const a of c.anomalies) {
-          flags.push(import_picocolors26.default.red(`${a.count}\xD7 "${a.value}"`));
+          flags.push(import_picocolors27.default.red(`${a.count}\xD7 "${a.value}"`));
           signals += 1;
         }
         if (c.isStale === true) signals += 1;
-        const head = `  ${import_picocolors26.default.bold(c.collection.padEnd(18).slice(0, 18))} ${import_picocolors26.default.dim(String(c.count).padStart(8) + " docs")}`;
-        console.log(flags.length > 0 ? `${head}   ${flags.join("  ")}` : import_picocolors26.default.dim(head));
+        const head = `  ${import_picocolors27.default.bold(c.collection.padEnd(18).slice(0, 18))} ${import_picocolors27.default.dim(String(c.count).padStart(8) + " docs")}`;
+        console.log(flags.length > 0 ? `${head}   ${flags.join("  ")}` : import_picocolors27.default.dim(head));
       }
       console.log("");
       if (analysis.collections.length === 0) {
         console.log(
-          import_picocolors26.default.yellow("  No collections discovered in this database.") + import_picocolors26.default.dim(" Verify the database name in your MongoDB connector config.")
+          import_picocolors27.default.yellow("  No collections discovered in this database.") + import_picocolors27.default.dim(" Verify the database name in your MongoDB connector config.")
         );
       } else {
         const scope = analysis.autoDiscovered ? "collection(s)" : "allowlisted collection(s)";
         console.log(
-          signals > 0 ? `  ${import_picocolors26.default.bold(String(signals))} state signal(s) across ${analysis.collections.length} ${scope}` : import_picocolors26.default.dim(`  No state anomalies across ${analysis.collections.length} ${scope}.`)
+          signals > 0 ? `  ${import_picocolors27.default.bold(String(signals))} state signal(s) across ${analysis.collections.length} ${scope}` : import_picocolors27.default.dim(`  No state anomalies across ${analysis.collections.length} ${scope}.`)
         );
         if (analysis.autoDiscovered) {
           console.log(
-            import_picocolors26.default.dim(
+            import_picocolors27.default.dim(
               `  Tip: add a "collections" list to your MongoDB connector config to restrict analysis.`
             )
           );
@@ -95817,7 +96254,7 @@ async function runState(opts) {
         });
         console.log("\n" + renderInterpretation(result));
         if (!result.ok) {
-          console.error(import_picocolors26.default.yellow(`[ai] ${result.warning}`));
+          console.error(import_picocolors27.default.yellow(`[ai] ${result.warning}`));
         }
       }
       return 0;
@@ -95825,20 +96262,20 @@ async function runState(opts) {
       await mongo.close();
     }
   } catch (err) {
-    console.error(import_picocolors26.default.red(err.message));
+    console.error(import_picocolors27.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/init.ts
 init_cjs_shims();
-var import_picocolors27 = __toESM(require_picocolors(), 1);
-var import_node_path15 = require("path");
+var import_picocolors28 = __toESM(require_picocolors(), 1);
+var import_node_path17 = require("path");
 async function runInit(opts) {
   try {
     const cwd = process.cwd();
-    const root = opts.path ? (0, import_node_path15.resolve)(opts.path) : findRepoRoot(cwd) ?? cwd;
-    const name = opts.name ?? (0, import_node_path15.basename)(root);
+    const root = opts.path ? (0, import_node_path17.resolve)(opts.path) : findRepoRoot(cwd) ?? cwd;
+    const name = opts.name ?? (0, import_node_path17.basename)(root);
     const envName = opts.env ?? "production";
     const repo = { name, path: root };
     if (opts.source) repo["source"] = { hostUrl: opts.source };
@@ -95853,65 +96290,65 @@ async function runInit(opts) {
     const configPath = writeLocalConfig(root, file);
     registerProject(name, root, configPath);
     ensureProjectGitignore(root);
-    console.log(`${import_picocolors27.default.green("\u2713")} Initialized Horus project ${import_picocolors27.default.bold(name)}`);
-    console.log(import_picocolors27.default.dim(`  config:     ${configPath}`));
-    console.log(import_picocolors27.default.dim(`  registered: horus investigate --name ${name} "<hint>"`));
+    console.log(`${import_picocolors28.default.green("\u2713")} Initialized Horus project ${import_picocolors28.default.bold(name)}`);
+    console.log(import_picocolors28.default.dim(`  config:     ${configPath}`));
+    console.log(import_picocolors28.default.dim(`  registered: horus investigate --name ${name} "<hint>"`));
     if (!opts.source) {
       console.log(
-        import_picocolors27.default.dim("  no source-intelligence host set \u2014 run `horus index` to analyze + host, or pass --source <url>")
+        import_picocolors28.default.dim("  no source-intelligence host set \u2014 run `horus index` to analyze + host, or pass --source <url>")
       );
     }
     console.log(
-      import_picocolors27.default.dim("  add runtime connectors (elasticsearch/mongodb/grafana) to .horus/config.json")
+      import_picocolors28.default.dim("  add runtime connectors (elasticsearch/mongodb/grafana) to .horus/config.json")
     );
     console.log(
-      import_picocolors27.default.dim("  .horus/ is gitignored \u2014 local config and runtime state stay out of version control")
+      import_picocolors28.default.dim("  .horus/ is gitignored \u2014 local config and runtime state stay out of version control")
     );
     return 0;
   } catch (err) {
-    console.error(import_picocolors27.default.red(err.message));
+    console.error(import_picocolors28.default.red(err.message));
     return 1;
   }
 }
 
 // ../../packages/cli/src/commands/projects.ts
 init_cjs_shims();
-var import_picocolors28 = __toESM(require_picocolors(), 1);
+var import_picocolors29 = __toESM(require_picocolors(), 1);
 async function runProjects() {
   const reg = readRegistry();
   const names = Object.keys(reg.projects).sort();
   if (names.length === 0) {
     console.log(
-      import_picocolors28.default.dim("No registered projects. Run `horus index` (or `horus init`) inside a repo.")
+      import_picocolors29.default.dim("No registered projects. Run `horus index` (or `horus init`) inside a repo.")
     );
     return 0;
   }
-  console.log(import_picocolors28.default.bold("Registered Horus projects"));
+  console.log(import_picocolors29.default.bold("Registered Horus projects"));
   console.log("");
   for (const name of names) {
     const entry2 = reg.projects[name];
     if (entry2 === void 0) continue;
-    console.log(`  ${import_picocolors28.default.bold(name.padEnd(22))} ${import_picocolors28.default.dim(entry2.root)}`);
+    console.log(`  ${import_picocolors29.default.bold(name.padEnd(22))} ${import_picocolors29.default.dim(entry2.root)}`);
   }
   console.log("");
-  console.log(import_picocolors28.default.dim('  horus investigate --name <name> "<hint>"'));
+  console.log(import_picocolors29.default.dim('  horus investigate --name <name> "<hint>"'));
   return 0;
 }
 
 // ../../packages/cli/src/commands/setup.ts
 init_cjs_shims();
-var import_picocolors29 = __toESM(require_picocolors(), 1);
+var import_picocolors30 = __toESM(require_picocolors(), 1);
 var DEFAULT_DB_URL3 = "postgresql://horus:horus@localhost:5433/horus";
 async function runSetup(opts) {
   const write = opts.write ?? ((line2) => console.log(line2));
   let ok = true;
-  write(import_picocolors29.default.bold("\nHorus setup\n"));
+  write(import_picocolors30.default.bold("\nHorus setup\n"));
   const backendVersion = await getSourceVersion();
   if (backendVersion === null) {
     ok = false;
-    write(`  ${import_picocolors29.default.red("\u25CF")} Horus source-intelligence backend not found`);
+    write(`  ${import_picocolors30.default.red("\u25CF")} Horus source-intelligence backend not found`);
     write(
-      import_picocolors29.default.dim(
+      import_picocolors30.default.dim(
         `      install it (Python 3.11+ required):
         pip install horus-source
       ensure ~/.local/bin is on your PATH`
@@ -95920,17 +96357,17 @@ async function runSetup(opts) {
   } else if (backendVersion !== PINNED_SOURCE_VERSION) {
     ok = false;
     write(
-      `  ${import_picocolors29.default.yellow("\u25CF")} Horus source-intelligence backend version mismatch` + import_picocolors29.default.dim(` (installed: ${backendVersion}, required: ${PINNED_SOURCE_VERSION})`)
+      `  ${import_picocolors30.default.yellow("\u25CF")} Horus source-intelligence backend version mismatch` + import_picocolors30.default.dim(` (installed: ${backendVersion}, required: ${PINNED_SOURCE_VERSION})`)
     );
     write(
-      import_picocolors29.default.dim(
+      import_picocolors30.default.dim(
         `      update it:
         pip install --upgrade horus-source`
       )
     );
   } else {
     write(
-      `  ${import_picocolors29.default.green("\u25CF")} Horus source-intelligence backend ` + import_picocolors29.default.dim(`(${backendVersion})`)
+      `  ${import_picocolors30.default.green("\u25CF")} Horus source-intelligence backend ` + import_picocolors30.default.dim(`(${backendVersion})`)
     );
   }
   let dbUrl = process.env["DATABASE_URL"] ?? DEFAULT_DB_URL3;
@@ -95942,11 +96379,11 @@ async function runSetup(opts) {
   }
   const db = await checkDatabase(dbUrl);
   if (db.reachable) {
-    write(`  ${import_picocolors29.default.green("\u25CF")} Postgres reachable ${import_picocolors29.default.dim(`(${db.schemaDetail})`)}`);
+    write(`  ${import_picocolors30.default.green("\u25CF")} Postgres reachable ${import_picocolors30.default.dim(`(${db.schemaDetail})`)}`);
     if (!db.schemaReady) {
       ok = false;
       write(
-        import_picocolors29.default.dim(
+        import_picocolors30.default.dim(
           `      schema not applied \u2014 run migrations:
         from the Horus repo: pnpm db migrate
         or apply the schema directly: https://github.com/meritt-dev/horus/tree/master/packages/db/drizzle`
@@ -95955,9 +96392,9 @@ async function runSetup(opts) {
     }
   } else {
     ok = false;
-    write(`  ${import_picocolors29.default.red("\u25CF")} Postgres unreachable`);
+    write(`  ${import_picocolors30.default.red("\u25CF")} Postgres unreachable`);
     write(
-      import_picocolors29.default.dim(
+      import_picocolors30.default.dim(
         `      start a local instance:
         docker run -d --name horus-db \\
           -e POSTGRES_USER=horus -e POSTGRES_PASSWORD=horus -e POSTGRES_DB=horus \\
@@ -95982,10 +96419,10 @@ async function runSetup(opts) {
         if (!health.ok) {
           ok = false;
           write(
-            `  ${import_picocolors29.default.red("\u25CF")} Source intelligence host unreachable for ${import_picocolors29.default.bold(repo.name)} ` + import_picocolors29.default.dim(`(${repoHostUrl})`)
+            `  ${import_picocolors30.default.red("\u25CF")} Source intelligence host unreachable for ${import_picocolors30.default.bold(repo.name)} ` + import_picocolors30.default.dim(`(${repoHostUrl})`)
           );
           write(
-            import_picocolors29.default.dim(
+            import_picocolors30.default.dim(
               `      start the source intelligence host:
         cd ${repo.path}
         horus index`
@@ -95996,10 +96433,10 @@ async function runSetup(opts) {
           if (count === 0) {
             ok = false;
             write(
-              `  ${import_picocolors29.default.yellow("\u25CF")} Source intelligence host running but ${import_picocolors29.default.bold(repo.name)} is not indexed`
+              `  ${import_picocolors30.default.yellow("\u25CF")} Source intelligence host running but ${import_picocolors30.default.bold(repo.name)} is not indexed`
             );
             write(
-              import_picocolors29.default.dim(
+              import_picocolors30.default.dim(
                 `      index the repo:
         cd ${repo.path}
         horus index`
@@ -96007,7 +96444,7 @@ async function runSetup(opts) {
             );
           } else {
             write(
-              `  ${import_picocolors29.default.green("\u25CF")} ${import_picocolors29.default.bold(repo.name)} \u2014 ${count} nodes indexed ` + import_picocolors29.default.dim(`(${repoHostUrl})`)
+              `  ${import_picocolors30.default.green("\u25CF")} ${import_picocolors30.default.bold(repo.name)} \u2014 ${count} nodes indexed ` + import_picocolors30.default.dim(`(${repoHostUrl})`)
             );
           }
         }
@@ -96017,10 +96454,10 @@ async function runSetup(opts) {
   write("");
   if (ok) {
     write(
-      import_picocolors29.default.green("Ready.") + ' Next: `cd` into a repo and run `horus index`, then `horus investigate "<hint>"`.'
+      import_picocolors30.default.green("Ready.") + ' Next: `cd` into a repo and run `horus index`, then `horus investigate "<hint>"`.'
     );
   } else {
-    write(import_picocolors29.default.yellow("Resolve the items above, then re-run `horus setup`."));
+    write(import_picocolors30.default.yellow("Resolve the items above, then re-run `horus setup`."));
   }
   return ok ? 0 : 1;
 }
@@ -96029,12 +96466,12 @@ async function runSetup(opts) {
 init_cjs_shims();
 var import_node_readline = require("readline");
 var import_node_child_process6 = require("child_process");
-var import_picocolors32 = __toESM(require_picocolors(), 1);
+var import_picocolors33 = __toESM(require_picocolors(), 1);
 
 // ../../packages/cli/src/lib/tty-selector.ts
 init_cjs_shims();
 var import_node_tty = require("tty");
-var import_picocolors30 = __toESM(require_picocolors(), 1);
+var import_picocolors31 = __toESM(require_picocolors(), 1);
 var ExitPromptError = class extends Error {
   constructor(message = "Prompt was cancelled") {
     super(message);
@@ -96090,7 +96527,7 @@ async function checkboxSearch(opts) {
       clear();
       const lines = [];
       lines.push(
-        `? ${import_picocolors30.default.bold(message)} ${import_picocolors30.default.dim("(\u2191\u2193 navigate \u2022 space toggle \u2022 enter confirm \u2022 type filter)")}`
+        `? ${import_picocolors31.default.bold(message)} ${import_picocolors31.default.dim("(\u2191\u2193 navigate \u2022 space toggle \u2022 enter confirm \u2022 type filter)")}`
       );
       const visible = filtered.slice(visibleOffset, visibleOffset + pageSize);
       for (let i = 0; i < visible.length; i++) {
@@ -96098,29 +96535,29 @@ async function checkboxSearch(opts) {
         const choice = visible[i];
         const isCursor = idx === cursor;
         const isSelected = selected.has(choice);
-        const marker = isSelected ? import_picocolors30.default.green("\u25CF") : " ";
+        const marker = isSelected ? import_picocolors31.default.green("\u25CF") : " ";
         const prefix = `[${marker}]`;
-        const label = isCursor ? import_picocolors30.default.cyan(choice) : choice;
-        const pointer = isCursor ? import_picocolors30.default.cyan("\u276F") : " ";
+        const label = isCursor ? import_picocolors31.default.cyan(choice) : choice;
+        const pointer = isCursor ? import_picocolors31.default.cyan("\u276F") : " ";
         lines.push(`  ${pointer} ${prefix} ${label}`);
       }
       if (filtered.length === 0) {
-        lines.push(import_picocolors30.default.dim("  No matches"));
+        lines.push(import_picocolors31.default.dim("  No matches"));
       }
       const statusParts = [
         `${selected.size} selected`,
         `${filtered.length}/${choices.length} matches`
       ];
       if (filter) statusParts.push(`filter: ${filter}`);
-      lines.push(import_picocolors30.default.dim(`  ${statusParts.join(" \xB7 ")}`));
+      lines.push(import_picocolors31.default.dim(`  ${statusParts.join(" \xB7 ")}`));
       output.write(lines.join("\n"));
       lastRenderLines = lines.length;
     }
     function finish(values2) {
       cleanup();
-      const summary = values2.length > 0 ? values2.join(", ") : import_picocolors30.default.dim("none");
+      const summary = values2.length > 0 ? values2.join(", ") : import_picocolors31.default.dim("none");
       output.write(`
-? ${import_picocolors30.default.bold(message)} ${summary}
+? ${import_picocolors31.default.bold(message)} ${summary}
 `);
       resolve8(values2);
     }
@@ -96212,7 +96649,7 @@ async function checkboxSearch(opts) {
 // ../../packages/cli/src/commands/connect-ai.ts
 init_cjs_shims();
 var import_node_child_process5 = require("child_process");
-var import_picocolors31 = __toESM(require_picocolors(), 1);
+var import_picocolors32 = __toESM(require_picocolors(), 1);
 function cliInstalled(id) {
   const r = (0, import_node_child_process5.spawnSync)(id, ["--version"], { stdio: "ignore", timeout: 2e3 });
   return !r.error;
@@ -96240,13 +96677,13 @@ async function runConnectAi(opts) {
     const root = findRepoRoot(cwd) ?? cwd;
     const configPath = discoverLocalConfig(cwd) ?? localConfigPath(root);
     const installed = LOCAL_PROVIDER_IDS.filter((id) => cliInstalled(id));
-    console.log(import_picocolors31.default.bold("\nAI providers"));
+    console.log(import_picocolors32.default.bold("\nAI providers"));
     console.log(
-      import_picocolors31.default.dim(
+      import_picocolors32.default.dim(
         `  Local CLIs on PATH: ${installed.length > 0 ? installed.join(", ") : "none detected"}`
       )
     );
-    console.log(import_picocolors31.default.dim("  Cloud: anthropic (Anthropic Claude API \u2014 used by `investigate --ai`)\n"));
+    console.log(import_picocolors32.default.dim("  Cloud: anthropic (Anthropic Claude API \u2014 used by `investigate --ai`)\n"));
     let provider = opts.provider;
     if (provider === void 0) {
       if (isInteractive()) {
@@ -96257,7 +96694,7 @@ async function runConnectAi(opts) {
       }
     }
     if (!AI_PROVIDERS.includes(provider)) {
-      console.error(import_picocolors31.default.red(`Unknown AI provider: ${provider}`) + import_picocolors31.default.dim(`
+      console.error(import_picocolors32.default.red(`Unknown AI provider: ${provider}`) + import_picocolors32.default.dim(`
   supported: ${AI_PROVIDERS.join(", ")}`));
       return 1;
     }
@@ -96270,7 +96707,7 @@ async function runConnectAi(opts) {
       }
       if (!apiKey) {
         console.error(
-          import_picocolors31.default.red("No API key provided.") + import_picocolors31.default.dim("\n  Pass --api-key sk-ant-\u2026 or set ANTHROPIC_API_KEY and re-run.")
+          import_picocolors32.default.red("No API key provided.") + import_picocolors32.default.dim("\n  Pass --api-key sk-ant-\u2026 or set ANTHROPIC_API_KEY and re-run.")
         );
         return 1;
       }
@@ -96278,28 +96715,28 @@ async function runConnectAi(opts) {
         const probe2 = await probeAnthropic(apiKey);
         if (!probe2.ok) {
           console.error(`
-${import_picocolors31.default.red("\u2717 Anthropic key check failed:")} ${probe2.detail}`);
-          console.error(import_picocolors31.default.dim("  Fix the key and retry, or pass --no-test to skip."));
+${import_picocolors32.default.red("\u2717 Anthropic key check failed:")} ${probe2.detail}`);
+          console.error(import_picocolors32.default.dim("  Fix the key and retry, or pass --no-test to skip."));
           return 1;
         }
         console.log(`
-${import_picocolors31.default.green("\u2713")} anthropic ${import_picocolors31.default.dim(`(${probe2.detail})`)}`);
+${import_picocolors32.default.green("\u2713")} anthropic ${import_picocolors32.default.dim(`(${probe2.detail})`)}`);
       }
       if (opts.model) aiBlock["anthropic"] = { model: opts.model };
       storedKey = apiKey;
     } else {
       if (!installed.includes(provider)) {
         console.error(
-          import_picocolors31.default.red(`${provider} CLI not found on PATH.`) + import_picocolors31.default.dim(`
+          import_picocolors32.default.red(`${provider} CLI not found on PATH.`) + import_picocolors32.default.dim(`
   Install it first, or choose anthropic.`)
         );
         return 1;
       }
       const desc2 = DEFAULT_LOCAL_PROVIDER_REGISTRY.get(provider);
       console.log(`
-${import_picocolors31.default.green("\u2713")} ${desc2?.displayName ?? provider} ${import_picocolors31.default.dim("detected on PATH")}`);
+${import_picocolors32.default.green("\u2713")} ${desc2?.displayName ?? provider} ${import_picocolors32.default.dim("detected on PATH")}`);
       console.log(
-        import_picocolors31.default.dim(
+        import_picocolors32.default.dim(
           "  Note: `investigate --ai` currently uses the Anthropic API for narrative.\n  Local-CLI narrative generation is recorded as your preference for future use."
         )
       );
@@ -96317,15 +96754,15 @@ ${import_picocolors31.default.green("\u2713")} ${desc2?.displayName ?? provider}
       });
     }
     console.log(`
-${import_picocolors31.default.green("\u2713")} ${import_picocolors31.default.bold("ai")} provider saved \u2192 ${import_picocolors31.default.dim(configPath)}`);
-    console.log(import_picocolors31.default.dim(`  provider: ${provider}`));
+${import_picocolors32.default.green("\u2713")} ${import_picocolors32.default.bold("ai")} provider saved \u2192 ${import_picocolors32.default.dim(configPath)}`);
+    console.log(import_picocolors32.default.dim(`  provider: ${provider}`));
     if (storedKey && secretsPathStr) {
-      console.log(import_picocolors31.default.dim(`  anthropic key: ${redactKey(storedKey)} \u2192 ${secretsPathStr} (gitignored)`));
+      console.log(import_picocolors32.default.dim(`  anthropic key: ${redactKey(storedKey)} \u2192 ${secretsPathStr} (gitignored)`));
     }
-    console.log(import_picocolors31.default.dim('  run: horus investigate "<hint>" --ai'));
+    console.log(import_picocolors32.default.dim('  run: horus investigate "<hint>" --ai'));
     return 0;
   } catch (err) {
-    console.error(import_picocolors31.default.red(err instanceof Error ? err.message : String(err)));
+    console.error(import_picocolors32.default.red(err instanceof Error ? err.message : String(err)));
     return 1;
   }
 }
@@ -96357,7 +96794,7 @@ async function runConnect(type, opts) {
   }
   if (!SUPPORTED.includes(type)) {
     console.error(
-      import_picocolors32.default.red(`Unknown connector type: ${type}`) + import_picocolors32.default.dim(`
+      import_picocolors33.default.red(`Unknown connector type: ${type}`) + import_picocolors33.default.dim(`
   supported: ${SUPPORTED.join(", ")}, ai`)
     );
     return 1;
@@ -96388,20 +96825,20 @@ async function runConnect(type, opts) {
       if (!probeResult.ok) {
         console.error(
           `
-${import_picocolors32.default.red(`\u2717 Could not reach ${connectorType}:`)} ${probeResult.detail}` + import_picocolors32.default.dim("\n  Fix the connection and retry, or pass --no-test to skip.")
+${import_picocolors33.default.red(`\u2717 Could not reach ${connectorType}:`)} ${probeResult.detail}` + import_picocolors33.default.dim("\n  Fix the connection and retry, or pass --no-test to skip.")
         );
         return 1;
       }
       console.log(
         `
-${import_picocolors32.default.green("\u2713")} ${connectorType} reachable ${import_picocolors32.default.dim(`(${probeResult.detail})`)}`
+${import_picocolors33.default.green("\u2713")} ${connectorType} reachable ${import_picocolors33.default.dim(`(${probeResult.detail})`)}`
       );
     }
     const hasLiteralCredentials = filled.url !== void 0 || filled.password !== void 0 || filled.username !== void 0;
     if (hasLiteralCredentials) {
       if (isGitTracked(configPath, root)) {
         console.error(
-          import_picocolors32.default.red(".horus/config.json is already tracked by Git.") + "\nStoring credentials here would expose them in the repository.\n" + import_picocolors32.default.dim(
+          import_picocolors33.default.red(".horus/config.json is already tracked by Git.") + "\nStoring credentials here would expose them in the repository.\n" + import_picocolors33.default.dim(
             "  Option A \u2014 remove from Git index then re-run:\n    git rm --cached .horus/config.json\n    horus connect " + type + " ...\n\n  Option B \u2014 keep credentials in the environment and reference them:\n    export ES_URL=https://...\n    export ES_USERNAME=...\n    export ES_PASSWORD=...\n  Then edit .horus/config.json manually to use urlEnv/usernameEnv/passwordEnv."
           )
         );
@@ -96411,18 +96848,18 @@ ${import_picocolors32.default.green("\u2713")} ${connectorType} reachable ${impo
     }
     patchLocalConnector(configPath, connectorType, patch, filled.env);
     console.log(
-      `${import_picocolors32.default.green("\u2713")} ${import_picocolors32.default.bold(connectorType)} connector saved \u2192 ${import_picocolors32.default.dim(configPath)}`
+      `${import_picocolors33.default.green("\u2713")} ${import_picocolors33.default.bold(connectorType)} connector saved \u2192 ${import_picocolors33.default.dim(configPath)}`
     );
     printSummary(connectorType, filled);
-    console.log(import_picocolors32.default.dim(`
+    console.log(import_picocolors33.default.dim(`
   run: horus investigate "<hint>"`));
     return 0;
   } catch (err) {
     if (err instanceof ExitPromptError) {
-      console.error(import_picocolors32.default.red("Cancelled."));
+      console.error(import_picocolors33.default.red("Cancelled."));
       return 1;
     }
-    console.error(import_picocolors32.default.red(err.message));
+    console.error(import_picocolors33.default.red(err.message));
     return 1;
   }
 }
@@ -96431,7 +96868,7 @@ async function fillInteractive(type, opts) {
   if (!needsInteraction) return opts;
   console.log(
     `
-${import_picocolors32.default.bold(`Connect ${type}`)} ${import_picocolors32.default.dim("(press Enter to skip optional fields)")}
+${import_picocolors33.default.bold(`Connect ${type}`)} ${import_picocolors33.default.dim("(press Enter to skip optional fields)")}
 `
   );
   const filled = { ...opts };
@@ -96486,7 +96923,7 @@ ${import_picocolors32.default.bold(`Connect ${type}`)} ${import_picocolors32.def
       break;
     case "redis": {
       console.log(
-        import_picocolors32.default.dim(
+        import_picocolors33.default.dim(
           "  Tip: embed credentials directly in the URL \u2014 redis://:password@host:6379\n       or enter the URL and password separately below."
         )
       );
@@ -96524,8 +96961,8 @@ function missingRequired(type, opts) {
 }
 function ask(label, placeholder = "", required2 = true) {
   return new Promise((resolve8) => {
-    const hint = placeholder ? import_picocolors32.default.dim(` (${placeholder})`) : "";
-    const suffix = required2 ? "" : import_picocolors32.default.dim(" [optional]");
+    const hint = placeholder ? import_picocolors33.default.dim(` (${placeholder})`) : "";
+    const suffix = required2 ? "" : import_picocolors33.default.dim(" [optional]");
     process.stdout.write(`  ${label}${suffix}${hint}: `);
     const rl = (0, import_node_readline.createInterface)({
       input: process.stdin,
@@ -96542,7 +96979,7 @@ function askPassword(label) {
   return new Promise((resolve8) => {
     const stdin = process.stdin;
     if (typeof stdin.setRawMode === "function") {
-      process.stdout.write(`  ${label}${import_picocolors32.default.dim(" [optional]")}: `);
+      process.stdout.write(`  ${label}${import_picocolors33.default.dim(" [optional]")}: `);
       stdin.setRawMode(true);
       stdin.resume();
       let value = "";
@@ -96642,15 +97079,15 @@ function describeProbe(p) {
   return `${p.keyCount} keys \xB7 ${p.suggestedRoles.join("/")}${examples ? ` \xB7 ${examples}` : ""}`;
 }
 async function discoverAndSelectDbs(url, bullmqPrefix) {
-  console.log(import_picocolors32.default.dim("\n  Scanning DBs 0-15 (read-only, sampled)\u2026"));
+  console.log(import_picocolors33.default.dim("\n  Scanning DBs 0-15 (read-only, sampled)\u2026"));
   const probes = await probeRedisDatabases(url, { bullmqPrefix });
   const nonEmpty = probes.filter((p) => p.reachable && p.keyCount > 0);
   if (nonEmpty.length === 0) {
-    console.log(import_picocolors32.default.dim("  No populated DBs found."));
+    console.log(import_picocolors33.default.dim("  No populated DBs found."));
     return [];
   }
   for (const p of nonEmpty) {
-    console.log(`  ${import_picocolors32.default.bold(`DB ${p.db}`)} ${import_picocolors32.default.dim("\xB7 " + describeProbe(p))}`);
+    console.log(`  ${import_picocolors33.default.bold(`DB ${p.db}`)} ${import_picocolors33.default.dim("\xB7 " + describeProbe(p))}`);
   }
   const byLabel = /* @__PURE__ */ new Map();
   const choices = nonEmpty.map((p) => {
@@ -96761,7 +97198,7 @@ function printSummary(type, opts) {
   } else if (opts.dashboard) {
     lines.push(`  dashboard:      ${opts.dashboard}`);
   }
-  if (lines.length > 0) console.log(import_picocolors32.default.dim(lines.join("\n")));
+  if (lines.length > 0) console.log(import_picocolors33.default.dim(lines.join("\n")));
 }
 function isGitTracked(filePath, cwd) {
   try {
@@ -96800,11 +97237,11 @@ async function askIndexSelection(indices) {
   const shown = indices.slice(0, MAX_DISPLAY);
   console.log("\n  Available Elasticsearch indexes/data streams:");
   shown.forEach((name, i) => {
-    console.log(`  ${import_picocolors32.default.dim(`[${i + 1}]`)} ${name}`);
+    console.log(`  ${import_picocolors33.default.dim(`[${i + 1}]`)} ${name}`);
   });
   if (indices.length > MAX_DISPLAY) {
     console.log(
-      import_picocolors32.default.dim(
+      import_picocolors33.default.dim(
         `  \u2026 and ${indices.length - MAX_DISPLAY} more (type a pattern manually to match all)`
       )
     );
@@ -96848,11 +97285,11 @@ async function askDashboardSelection(dashboards) {
   const shown = dashboards.slice(0, MAX_DISPLAY);
   console.log("\n  Available Grafana dashboards:");
   shown.forEach((d, i) => {
-    const folder = d.folderTitle ? import_picocolors32.default.dim(` (${d.folderTitle})`) : "";
-    console.log(`  ${import_picocolors32.default.dim(`[${i + 1}]`)} ${d.title}${folder}`);
+    const folder = d.folderTitle ? import_picocolors33.default.dim(` (${d.folderTitle})`) : "";
+    console.log(`  ${import_picocolors33.default.dim(`[${i + 1}]`)} ${d.title}${folder}`);
   });
   if (dashboards.length > MAX_DISPLAY) {
-    console.log(import_picocolors32.default.dim(`  \u2026 and ${dashboards.length - MAX_DISPLAY} more`));
+    console.log(import_picocolors33.default.dim(`  \u2026 and ${dashboards.length - MAX_DISPLAY} more`));
   }
   const input = (await ask(
     `  Select dashboards to use (e.g. 1,2 or Enter to type uid manually)`,
@@ -96903,12 +97340,12 @@ function redactUrl(raw) {
 // ../../packages/cli/src/commands/stop.ts
 init_cjs_shims();
 var import_node_child_process7 = require("child_process");
-var import_node_fs14 = require("fs");
+var import_node_fs16 = require("fs");
 var import_node_util4 = require("util");
-var import_node_path16 = require("path");
-var import_picocolors33 = __toESM(require_picocolors(), 1);
+var import_node_path18 = require("path");
+var import_picocolors34 = __toESM(require_picocolors(), 1);
 var execFileAsync = (0, import_node_util4.promisify)(import_node_child_process7.execFile);
-var unlinkAsync = (0, import_node_util4.promisify)(import_node_fs14.unlink);
+var unlinkAsync = (0, import_node_util4.promisify)(import_node_fs16.unlink);
 var SPAWNED_HOST_FILE2 = "spawned-host.json";
 var START_TIME_TOLERANCE_S = 60;
 var STOP_WAIT_MS = 5e3;
@@ -96923,30 +97360,30 @@ async function runStop(opts) {
     const root = findRepoRoot(cwd) ?? cwd;
     const hostUrl = readSourceHostUrl(root);
     if (!hostUrl) {
-      console.log(import_picocolors33.default.dim("No source-intelligence host found for this repo (.horus/source/host.json absent)."));
+      console.log(import_picocolors34.default.dim("No source-intelligence host found for this repo (.horus/source/host.json absent)."));
       return 0;
     }
     return await stopHost(root, hostUrl);
   } catch (err) {
-    console.error(import_picocolors33.default.red(err.message));
+    console.error(import_picocolors34.default.red(err.message));
     return 1;
   }
 }
 async function stopHost(root, hostUrl) {
   const alive = await isHostHealthy(hostUrl);
   if (!alive) {
-    console.log(import_picocolors33.default.dim(`Host ${hostUrl} is already stopped.`));
+    console.log(import_picocolors34.default.dim(`Host ${hostUrl} is already stopped.`));
     return 0;
   }
   const port = extractPort(hostUrl);
   if (port === null) {
-    console.error(import_picocolors33.default.red(`Cannot determine port from host URL: ${hostUrl}`));
+    console.error(import_picocolors34.default.red(`Cannot determine port from host URL: ${hostUrl}`));
     return 1;
   }
   const spawned = readSpawnedHost(root);
   if (spawned === null) {
     console.error(
-      import_picocolors33.default.red(
+      import_picocolors34.default.red(
         `No ownership record found (.horus/${SPAWNED_HOST_FILE2} absent). Horus will not stop a host it did not spawn.`
       )
     );
@@ -96954,12 +97391,12 @@ async function stopHost(root, hostUrl) {
   }
   const recordError = validateSpawnedRecord(spawned);
   if (recordError !== null) {
-    console.error(import_picocolors33.default.red(`Ownership record is malformed: ${recordError}. Aborting for safety.`));
+    console.error(import_picocolors34.default.red(`Ownership record is malformed: ${recordError}. Aborting for safety.`));
     return 1;
   }
   if (spawned.port !== port) {
     console.error(
-      import_picocolors33.default.red(
+      import_picocolors34.default.red(
         `Ownership record port (${spawned.port}) does not match host URL port (${port}). Record may be stale.`
       )
     );
@@ -96967,7 +97404,7 @@ async function stopHost(root, hostUrl) {
   }
   if (spawned.root !== root) {
     console.error(
-      import_picocolors33.default.red(
+      import_picocolors34.default.red(
         `Ownership record root (${spawned.root}) does not match resolved root (${root}). Record may be stale.`
       )
     );
@@ -96975,9 +97412,9 @@ async function stopHost(root, hostUrl) {
   }
   const info = await getProcessInfo(spawned.pid);
   if (info === null) {
-    console.log(import_picocolors33.default.dim(`Process pid ${spawned.pid} is no longer running \u2014 already stopped.`));
+    console.log(import_picocolors34.default.dim(`Process pid ${spawned.pid} is no longer running \u2014 already stopped.`));
     try {
-      await unlinkAsync((0, import_node_path16.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
+      await unlinkAsync((0, import_node_path18.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
     } catch {
     }
     return 0;
@@ -96988,7 +97425,7 @@ async function stopHost(root, hostUrl) {
   );
   if (!hostPortRe.test(info.args)) {
     console.error(
-      import_picocolors33.default.red(
+      import_picocolors34.default.red(
         `Pid ${spawned.pid} args do not match "horus-source host --port ${portStr}". Got: "${info.args.slice(0, 120)}". Aborting for safety.`
       )
     );
@@ -96997,12 +97434,12 @@ async function stopHost(root, hostUrl) {
   const startTs = new Date(spawned.startedAt).getTime();
   const recordedAgeS = Math.round((Date.now() - startTs) / 1e3);
   if (!Number.isFinite(info.etimeSeconds)) {
-    console.error(import_picocolors33.default.red(`Could not read elapsed time for pid ${spawned.pid}. Aborting for safety.`));
+    console.error(import_picocolors34.default.red(`Could not read elapsed time for pid ${spawned.pid}. Aborting for safety.`));
     return 1;
   }
   if (Math.abs(info.etimeSeconds - recordedAgeS) > START_TIME_TOLERANCE_S) {
     console.error(
-      import_picocolors33.default.red(
+      import_picocolors34.default.red(
         `Pid ${spawned.pid} age mismatch: record says ~${recordedAgeS}s, process reports ${info.etimeSeconds}s elapsed. Possible PID reuse \u2014 aborting for safety.`
       )
     );
@@ -97014,9 +97451,9 @@ async function stopHost(root, hostUrl) {
     signaled = true;
   } catch (err) {
     if (err.code === "ESRCH") {
-      console.log(import_picocolors33.default.dim(`Process pid ${spawned.pid} exited before signal \u2014 already stopped.`));
+      console.log(import_picocolors34.default.dim(`Process pid ${spawned.pid} exited before signal \u2014 already stopped.`));
     } else {
-      console.error(import_picocolors33.default.red(`Failed to signal pid ${spawned.pid}: ${err.message}`));
+      console.error(import_picocolors34.default.red(`Failed to signal pid ${spawned.pid}: ${err.message}`));
       return 1;
     }
   }
@@ -97032,18 +97469,18 @@ async function stopHost(root, hostUrl) {
     }
     if (!exited) {
       console.error(
-        import_picocolors33.default.red(
+        import_picocolors34.default.red(
           `Host pid ${spawned.pid} did not exit within ${STOP_WAIT_MS / 1e3}s after SIGTERM.`
         )
       );
       return 1;
     }
     console.log(
-      `${import_picocolors33.default.green("\u2713")} Stopped source-intelligence host ` + import_picocolors33.default.dim(`(pid ${spawned.pid}, port ${port})`) + ` for ${root}`
+      `${import_picocolors34.default.green("\u2713")} Stopped source-intelligence host ` + import_picocolors34.default.dim(`(pid ${spawned.pid}, port ${port})`) + ` for ${root}`
     );
   }
   try {
-    await unlinkAsync((0, import_node_path16.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
+    await unlinkAsync((0, import_node_path18.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
   } catch {
   }
   return 0;
@@ -97052,7 +97489,7 @@ async function stopAll() {
   const registry2 = readRegistry();
   const projects2 = Object.entries(registry2.projects);
   if (projects2.length === 0) {
-    console.log(import_picocolors33.default.dim("No registered projects."));
+    console.log(import_picocolors34.default.dim("No registered projects."));
     return 0;
   }
   let stopped = 0;
@@ -97062,17 +97499,17 @@ async function stopAll() {
     if (!hostUrl) continue;
     const alive = await isHostHealthy(hostUrl);
     if (!alive) continue;
-    console.log(`  Stopping ${import_picocolors33.default.bold(name)} ${import_picocolors33.default.dim(`(${hostUrl})`)}`);
+    console.log(`  Stopping ${import_picocolors34.default.bold(name)} ${import_picocolors34.default.dim(`(${hostUrl})`)}`);
     const code = await stopHost(entry2.root, hostUrl);
     if (code === 0) stopped++;
     else failed++;
   }
   if (stopped === 0 && failed === 0) {
-    console.log(import_picocolors33.default.dim("No running source-intelligence hosts found."));
+    console.log(import_picocolors34.default.dim("No running source-intelligence hosts found."));
   } else {
     console.log(
       `
-Stopped ${stopped} host(s)${failed > 0 ? import_picocolors33.default.red(`, ${failed} failed`) : ""}.`
+Stopped ${stopped} host(s)${failed > 0 ? import_picocolors34.default.red(`, ${failed} failed`) : ""}.`
     );
   }
   return failed > 0 ? 1 : 0;
@@ -97124,12 +97561,12 @@ function extractPort(hostUrl) {
 
 // ../../packages/cli/src/commands/hosts.ts
 init_cjs_shims();
-var import_picocolors34 = __toESM(require_picocolors(), 1);
+var import_picocolors35 = __toESM(require_picocolors(), 1);
 async function runHosts() {
   const registry2 = readRegistry();
   const projects2 = Object.entries(registry2.projects);
   if (projects2.length === 0) {
-    console.log(import_picocolors34.default.dim("No registered projects. Run `horus index` in a repo first."));
+    console.log(import_picocolors35.default.dim("No registered projects. Run `horus index` in a repo first."));
     return 0;
   }
   const rows = [];
@@ -97146,29 +97583,29 @@ async function runHosts() {
   });
   const anyHost = rows.some((r) => r.hostUrl !== null);
   if (!anyHost) {
-    console.log(import_picocolors34.default.dim("No source-intelligence hosts found. Run `horus index` to start one."));
+    console.log(import_picocolors35.default.dim("No source-intelligence hosts found. Run `horus index` to start one."));
     return 0;
   }
   console.log("");
   for (const row of rows) {
     if (row.hostUrl === null) continue;
-    const status = row.healthy ? import_picocolors34.default.green("\u25CF running") : import_picocolors34.default.red("\u25CF stopped");
+    const status = row.healthy ? import_picocolors35.default.green("\u25CF running") : import_picocolors35.default.red("\u25CF stopped");
     const port = extractPort2(row.hostUrl) ?? "?";
     console.log(
-      `  ${status}  ${import_picocolors34.default.bold(row.name.padEnd(24))} port ${String(port).padEnd(6)} ${import_picocolors34.default.dim(row.root)}`
+      `  ${status}  ${import_picocolors35.default.bold(row.name.padEnd(24))} port ${String(port).padEnd(6)} ${import_picocolors35.default.dim(row.root)}`
     );
   }
   console.log("");
   const noHost = rows.filter((r) => r.hostUrl === null);
   if (noHost.length > 0) {
     for (const row of noHost) {
-      console.log(`  ${import_picocolors34.default.dim("\u25CB no host")}   ${import_picocolors34.default.dim(row.name)}`);
+      console.log(`  ${import_picocolors35.default.dim("\u25CB no host")}   ${import_picocolors35.default.dim(row.name)}`);
     }
     console.log("");
   }
   const running = rows.filter((r) => r.healthy).length;
   console.log(
-    import_picocolors34.default.dim(
+    import_picocolors35.default.dim(
       `${running} running \xB7 horus stop to reap \xB7 horus stop --all to stop everything`
     )
   );
@@ -97185,12 +97622,12 @@ function extractPort2(hostUrl) {
 
 // ../../packages/cli/src/commands/doctor.ts
 init_cjs_shims();
-var import_picocolors35 = __toESM(require_picocolors(), 1);
+var import_picocolors36 = __toESM(require_picocolors(), 1);
 var DEFAULT_DB_URL4 = "postgresql://horus:horus@localhost:5433/horus";
 function mark2(status) {
-  if (status === "pass") return import_picocolors35.default.green("\u2713");
-  if (status === "warn") return import_picocolors35.default.yellow("~");
-  return import_picocolors35.default.red("\u2717");
+  if (status === "pass") return import_picocolors36.default.green("\u2713");
+  if (status === "warn") return import_picocolors36.default.yellow("~");
+  return import_picocolors36.default.red("\u2717");
 }
 async function runDoctor(opts) {
   const cwd = opts?.cwd ?? process.cwd();
@@ -97417,11 +97854,11 @@ async function runDoctor(opts) {
     write(JSON.stringify(output, null, 2));
     return hasFailure ? 1 : 0;
   }
-  write(import_picocolors35.default.bold("\nHorus readiness check\n"));
+  write(import_picocolors36.default.bold("\nHorus readiness check\n"));
   for (const check2 of checks) {
-    write(`  ${mark2(check2.status)} ${import_picocolors35.default.bold(check2.label.padEnd(26))}  ${import_picocolors35.default.dim(check2.detail)}`);
+    write(`  ${mark2(check2.status)} ${import_picocolors36.default.bold(check2.label.padEnd(26))}  ${import_picocolors36.default.dim(check2.detail)}`);
     if (check2.next) {
-      write(`    ${import_picocolors35.default.dim("\u2192 " + check2.next)}`);
+      write(`    ${import_picocolors36.default.dim("\u2192 " + check2.next)}`);
     }
   }
   write("");
@@ -97431,16 +97868,16 @@ async function runDoctor(opts) {
 // ../../packages/cli/src/commands/providers-doctor.ts
 init_cjs_shims();
 var import_node_child_process8 = require("child_process");
-var import_picocolors36 = __toESM(require_picocolors(), 1);
+var import_picocolors37 = __toESM(require_picocolors(), 1);
 function statusMark(status) {
-  if (status === "ready") return import_picocolors36.default.green("\u2713");
-  if (status === "installed") return import_picocolors36.default.yellow("~");
-  return import_picocolors36.default.red("\u2717");
+  if (status === "ready") return import_picocolors37.default.green("\u2713");
+  if (status === "installed") return import_picocolors37.default.yellow("~");
+  return import_picocolors37.default.red("\u2717");
 }
 function statusLabel(status) {
-  if (status === "ready") return import_picocolors36.default.green("ready");
-  if (status === "installed") return import_picocolors36.default.yellow("installed (not configured)");
-  return import_picocolors36.default.dim("not found on PATH");
+  if (status === "ready") return import_picocolors37.default.green("ready");
+  if (status === "installed") return import_picocolors37.default.yellow("installed (not configured)");
+  return import_picocolors37.default.dim("not found on PATH");
 }
 function detectBinary(id) {
   const result = (0, import_node_child_process8.spawnSync)(id, ["--version"], { stdio: "pipe", timeout: 2e3 });
@@ -97457,7 +97894,7 @@ async function runProvidersDoctorCommand(opts) {
   const registry2 = opts?.registry ?? DEFAULT_LOCAL_PROVIDER_REGISTRY;
   const write = opts?.write ?? ((line2) => console.log(line2));
   const results = buildProviderResults(registry2, opts?._detect);
-  write(import_picocolors36.default.bold("\nLocal AI providers\n"));
+  write(import_picocolors37.default.bold("\nLocal AI providers\n"));
   for (const result of results) {
     const descriptor = registry2.get(result.id);
     const name = descriptor?.displayName ?? result.id;
@@ -97465,11 +97902,11 @@ async function runProvidersDoctorCommand(opts) {
       `  ${statusMark(result.status)} ${result.id.padEnd(8)}  ${name.padEnd(22)}  ${statusLabel(result.status)}`
     );
     if (result.status !== "ready" && result.detail) {
-      write(`    ${import_picocolors36.default.dim("\u2192 " + result.detail)}`);
+      write(`    ${import_picocolors37.default.dim("\u2192 " + result.detail)}`);
     }
   }
   write("");
-  write(import_picocolors36.default.bold("Cloud AI providers\n"));
+  write(import_picocolors37.default.bold("Cloud AI providers\n"));
   let source = null;
   if (opts?._anthropicKey !== void 0) {
     source = opts._anthropicKey ? "env" : null;
@@ -97484,18 +97921,18 @@ async function runProvidersDoctorCommand(opts) {
   }
   if (source === "config") {
     write(
-      `  ${import_picocolors36.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors36.default.green("configured (local .horus config)")}`
+      `  ${import_picocolors37.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors37.default.green("configured (local .horus config)")}`
     );
   } else if (source === "env") {
     write(
-      `  ${import_picocolors36.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors36.default.green("configured (ANTHROPIC_API_KEY env)")}`
+      `  ${import_picocolors37.default.green("\u2713")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors37.default.green("configured (ANTHROPIC_API_KEY env)")}`
     );
   } else {
     write(
-      `  ${import_picocolors36.default.red("\u2717")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors36.default.dim("not configured")}`
+      `  ${import_picocolors37.default.red("\u2717")} ${"anthropic".padEnd(8)}  ${"Anthropic Claude API".padEnd(22)}  ${import_picocolors37.default.dim("not configured")}`
     );
     write(
-      `    ${import_picocolors36.default.dim("\u2192 run `horus connect ai` (or set ANTHROPIC_API_KEY) to enable `horus investigate --ai`")}`
+      `    ${import_picocolors37.default.dim("\u2192 run `horus connect ai` (or set ANTHROPIC_API_KEY) to enable `horus investigate --ai`")}`
     );
   }
   write("");
@@ -97504,9 +97941,9 @@ async function runProvidersDoctorCommand(opts) {
 
 // ../../packages/cli/src/commands/generate-config.ts
 init_cjs_shims();
-var import_node_fs15 = require("fs");
-var import_node_path17 = require("path");
-var import_picocolors37 = __toESM(require_picocolors(), 1);
+var import_node_fs17 = require("fs");
+var import_node_path19 = require("path");
+var import_picocolors38 = __toESM(require_picocolors(), 1);
 function configTemplate(name, repoPath) {
   return `export default {
   database: {
@@ -97554,39 +97991,39 @@ async function runGenerateConfig(opts) {
   const defaults = localConfigPath2 != null ? projectDefaults(localConfigPath2) : null;
   const hasLocalConfig = defaults != null;
   const defaultOut = hasLocalConfig ? "horus.config.example.js" : "horus.config.js";
-  const outPath = (0, import_node_path17.resolve)(cwd, opts.out ?? defaultOut);
+  const outPath = (0, import_node_path19.resolve)(cwd, opts.out ?? defaultOut);
   const name = opts.name ?? defaults?.name ?? "my-project";
   const repoPath = opts.repo ?? defaults?.repoPath ?? `/path/to/${name}`;
-  if ((0, import_node_fs15.existsSync)(outPath) && !opts.force) {
-    log(`${import_picocolors37.default.red("\u2717")} ${outPath} already exists`);
-    log(import_picocolors37.default.dim("  pass --force to overwrite"));
+  if ((0, import_node_fs17.existsSync)(outPath) && !opts.force) {
+    log(`${import_picocolors38.default.red("\u2717")} ${outPath} already exists`);
+    log(import_picocolors38.default.dim("  pass --force to overwrite"));
     return 1;
   }
   try {
-    (0, import_node_fs15.mkdirSync)((0, import_node_path17.dirname)(outPath), { recursive: true });
-    (0, import_node_fs15.writeFileSync)(outPath, configTemplate(name, repoPath), "utf8");
+    (0, import_node_fs17.mkdirSync)((0, import_node_path19.dirname)(outPath), { recursive: true });
+    (0, import_node_fs17.writeFileSync)(outPath, configTemplate(name, repoPath), "utf8");
   } catch (err) {
-    log(`${import_picocolors37.default.red("\u2717")} Could not write ${outPath}: ${err.message}`);
+    log(`${import_picocolors38.default.red("\u2717")} Could not write ${outPath}: ${err.message}`);
     return 1;
   }
-  log(`${import_picocolors37.default.green("\u2713")} Created ${outPath}`);
-  log(import_picocolors37.default.dim(`  project: ${name}`));
-  log(import_picocolors37.default.dim(`  repo:    ${repoPath}`));
+  log(`${import_picocolors38.default.green("\u2713")} Created ${outPath}`);
+  log(import_picocolors38.default.dim(`  project: ${name}`));
+  log(import_picocolors38.default.dim(`  repo:    ${repoPath}`));
   if (hasLocalConfig && localConfigPath2 != null) {
     log("");
-    log(import_picocolors37.default.yellow("Note:") + ` an initialized Horus project config exists at ${localConfigPath2}`);
+    log(import_picocolors38.default.yellow("Note:") + ` an initialized Horus project config exists at ${localConfigPath2}`);
     log("  \u2022 .horus/config.json  \u2014 project config used by `horus investigate` from this repo");
     log("  \u2022 horus.config.js     \u2014 standalone/global config used with `horus doctor --config <path>`");
-    log(import_picocolors37.default.dim(`  next:  review ${outPath} and copy/adapt it as needed`));
+    log(import_picocolors38.default.dim(`  next:  review ${outPath} and copy/adapt it as needed`));
   } else {
-    log(import_picocolors37.default.dim(`  next:    horus doctor --config ${outPath}`));
+    log(import_picocolors38.default.dim(`  next:    horus doctor --config ${outPath}`));
   }
   return 0;
 }
 
 // ../../packages/cli/src/commands/readiness.ts
 init_cjs_shims();
-var import_picocolors38 = __toESM(require_picocolors(), 1);
+var import_picocolors39 = __toESM(require_picocolors(), 1);
 var READINESS_AI_CONTRACT = `Provide a clearly separated AI readiness summary with:
 
 Overall assessment
@@ -97609,9 +98046,9 @@ Confidence / gaps
 - Which checks Horus could verify vs. which require manual confirmation`;
 var DEFAULT_DB_URL5 = "postgresql://horus:horus@localhost:5433/horus";
 function mark3(status) {
-  if (status === "pass") return import_picocolors38.default.green("\u2713");
-  if (status === "warn") return import_picocolors38.default.yellow("~");
-  return import_picocolors38.default.red("\u2717");
+  if (status === "pass") return import_picocolors39.default.green("\u2713");
+  if (status === "warn") return import_picocolors39.default.yellow("~");
+  return import_picocolors39.default.red("\u2717");
 }
 async function runReadiness(opts) {
   const cwd = opts?.cwd ?? process.cwd();
@@ -97766,20 +98203,20 @@ async function runReadiness(opts) {
   }
   const blockingChecks = checks.filter((c) => c.blocking);
   const optionalChecks = checks.filter((c) => !c.blocking);
-  write(import_picocolors38.default.bold("\nHorus release readiness\n"));
-  write(import_picocolors38.default.bold("  Blocking"));
+  write(import_picocolors39.default.bold("\nHorus release readiness\n"));
+  write(import_picocolors39.default.bold("  Blocking"));
   for (const check2 of blockingChecks) {
-    write(`    ${mark3(check2.status)} ${import_picocolors38.default.bold(check2.label.padEnd(22))}  ${import_picocolors38.default.dim(check2.detail)}`);
+    write(`    ${mark3(check2.status)} ${import_picocolors39.default.bold(check2.label.padEnd(22))}  ${import_picocolors39.default.dim(check2.detail)}`);
     if (check2.next) {
-      write(`      ${import_picocolors38.default.dim("\u2192 " + check2.next)}`);
+      write(`      ${import_picocolors39.default.dim("\u2192 " + check2.next)}`);
     }
   }
   write("");
-  write(import_picocolors38.default.bold("  Optional"));
+  write(import_picocolors39.default.bold("  Optional"));
   for (const check2 of optionalChecks) {
-    write(`    ${mark3(check2.status)} ${import_picocolors38.default.bold(check2.label.padEnd(22))}  ${import_picocolors38.default.dim(check2.detail)}`);
+    write(`    ${mark3(check2.status)} ${import_picocolors39.default.bold(check2.label.padEnd(22))}  ${import_picocolors39.default.dim(check2.detail)}`);
     if (check2.next) {
-      write(`      ${import_picocolors38.default.dim("\u2192 " + check2.next)}`);
+      write(`      ${import_picocolors39.default.dim("\u2192 " + check2.next)}`);
     }
   }
   write("");
@@ -97787,21 +98224,21 @@ async function runReadiness(opts) {
   const optionalWarns = optionalChecks.filter((c) => c.status === "warn").length;
   if (blockingFails.length === 0) {
     if (optionalWarns === 0) {
-      write(import_picocolors38.default.green("  Ready for demo/release."));
+      write(import_picocolors39.default.green("  Ready for demo/release."));
     } else {
       write(
-        import_picocolors38.default.yellow(
+        import_picocolors39.default.yellow(
           `  Ready for a basic demo. ${optionalWarns} optional item(s) not configured \u2014 investigation evidence will be limited.`
         )
       );
     }
   } else {
     write(
-      import_picocolors38.default.red(
+      import_picocolors39.default.red(
         `  Not ready. ${blockingFails.length} blocking item(s) must be resolved before demo/release.`
       )
     );
-    write(import_picocolors38.default.dim("  Re-run `horus readiness` after resolving the items above."));
+    write(import_picocolors39.default.dim("  Re-run `horus readiness` after resolving the items above."));
   }
   write("");
   if (opts?.ai) {
@@ -97816,7 +98253,7 @@ async function runReadiness(opts) {
     });
     console.log("\n" + renderInterpretation(result));
     if (!result.ok) {
-      console.error(import_picocolors38.default.yellow(`[ai] ${result.warning}`));
+      console.error(import_picocolors39.default.yellow(`[ai] ${result.warning}`));
     }
   }
   return blockingFails.length > 0 ? 1 : 0;
@@ -97824,33 +98261,33 @@ async function runReadiness(opts) {
 
 // ../../packages/cli/src/commands/skill.ts
 init_cjs_shims();
-var import_node_fs16 = require("fs");
-var import_node_path18 = require("path");
-var import_node_os3 = require("os");
-var import_promises = require("readline/promises");
-var import_picocolors39 = __toESM(require_picocolors(), 1);
+var import_node_fs18 = require("fs");
+var import_node_path20 = require("path");
+var import_node_os4 = require("os");
+var import_promises2 = require("readline/promises");
+var import_picocolors40 = __toESM(require_picocolors(), 1);
 var SUPPORTED_TARGETS = ["claude", "codex", "gemini", "cursor", "generic"];
 function isValidTarget(target) {
   return SUPPORTED_TARGETS.includes(target);
 }
 function getLegacyClaudeSkillPath(opts) {
-  const base2 = opts.global ? (0, import_node_os3.homedir)() : opts.cwd ?? process.cwd();
-  return (0, import_node_path18.join)(base2, ".claude", "skills", "horus.md");
+  const base2 = opts.global ? (0, import_node_os4.homedir)() : opts.cwd ?? process.cwd();
+  return (0, import_node_path20.join)(base2, ".claude", "skills", "horus.md");
 }
 function getSkillInstallPath(target, opts) {
-  const base2 = opts.global ? (0, import_node_os3.homedir)() : opts.cwd ?? process.cwd();
+  const base2 = opts.global ? (0, import_node_os4.homedir)() : opts.cwd ?? process.cwd();
   switch (target) {
     case "claude":
-      return (0, import_node_path18.join)(base2, ".claude", "skills", "horus", "SKILL.md");
+      return (0, import_node_path20.join)(base2, ".claude", "skills", "horus", "SKILL.md");
     case "gemini":
-      return opts.global ? (0, import_node_path18.join)(base2, ".gemini", "GEMINI.md") : (0, import_node_path18.join)(base2, "GEMINI.md");
+      return opts.global ? (0, import_node_path20.join)(base2, ".gemini", "GEMINI.md") : (0, import_node_path20.join)(base2, "GEMINI.md");
     case "cursor":
-      return opts.global ? (0, import_node_path18.join)(base2, ".cursorrules") : (0, import_node_path18.join)(base2, ".cursor", "rules", "horus.mdc");
+      return opts.global ? (0, import_node_path20.join)(base2, ".cursorrules") : (0, import_node_path20.join)(base2, ".cursor", "rules", "horus.mdc");
     case "codex":
-      return opts.global ? (0, import_node_path18.join)(base2, ".codex", "AGENTS.md") : (0, import_node_path18.join)(base2, "AGENTS.md");
+      return opts.global ? (0, import_node_path20.join)(base2, ".codex", "AGENTS.md") : (0, import_node_path20.join)(base2, "AGENTS.md");
     case "generic":
     default:
-      return (0, import_node_path18.join)(base2, ".horus", "skills", `horus-${target}.md`);
+      return (0, import_node_path20.join)(base2, ".horus", "skills", `horus-${target}.md`);
   }
 }
 var BASE_SKILL = `# Horus Grounded Investigation Skill
@@ -98135,7 +98572,7 @@ async function confirm(message) {
   if (!process.stdin.isTTY) {
     return false;
   }
-  const rl = (0, import_promises.createInterface)({ input: process.stdin, output: process.stdout });
+  const rl = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
   try {
     const answer = await rl.question(`${message} [y/N] `);
     return /^y(es)?$/i.test(answer.trim());
@@ -98146,66 +98583,66 @@ async function confirm(message) {
 async function runSkillInstall(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors39.default.red("\u2717")} Unknown target: ${import_picocolors39.default.bold(target)}`);
-    log(import_picocolors39.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors40.default.red("\u2717")} Unknown target: ${import_picocolors40.default.bold(target)}`);
+    log(import_picocolors40.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   const outPath = getSkillInstallPath(target, { global: opts.global, cwd: opts.cwd });
   const content = generateSkillContent(target);
   if (target === "claude") {
     const legacyPath = getLegacyClaudeSkillPath({ global: opts.global, cwd: opts.cwd });
-    if ((0, import_node_fs16.existsSync)(legacyPath)) {
+    if ((0, import_node_fs18.existsSync)(legacyPath)) {
       if (!opts.force) {
         const confirmed = await (opts.confirm ?? confirm)(
           `Found old flat skill file at ${legacyPath}. Replace it with the new directory layout?`
         );
         if (!confirmed) {
-          log(`${import_picocolors39.default.yellow("!")} Migration cancelled; existing skill left untouched.`);
-          log(import_picocolors39.default.dim("  Pass --force to replace without prompting."));
+          log(`${import_picocolors40.default.yellow("!")} Migration cancelled; existing skill left untouched.`);
+          log(import_picocolors40.default.dim("  Pass --force to replace without prompting."));
           return 1;
         }
       }
       try {
-        (0, import_node_fs16.rmSync)(legacyPath);
-        log(`${import_picocolors39.default.yellow("!")} Replaced old flat skill file: ${legacyPath}`);
+        (0, import_node_fs18.rmSync)(legacyPath);
+        log(`${import_picocolors40.default.yellow("!")} Replaced old flat skill file: ${legacyPath}`);
       } catch (err) {
-        log(`${import_picocolors39.default.red("\u2717")} Could not remove legacy skill file ${legacyPath}: ${err.message}`);
+        log(`${import_picocolors40.default.red("\u2717")} Could not remove legacy skill file ${legacyPath}: ${err.message}`);
         return 1;
       }
     }
   }
-  if ((0, import_node_fs16.existsSync)(outPath) && !opts.force) {
-    log(`${import_picocolors39.default.red("\u2717")} ${outPath} already exists`);
-    log(import_picocolors39.default.dim("  pass --force to overwrite"));
+  if ((0, import_node_fs18.existsSync)(outPath) && !opts.force) {
+    log(`${import_picocolors40.default.red("\u2717")} ${outPath} already exists`);
+    log(import_picocolors40.default.dim("  pass --force to overwrite"));
     return 1;
   }
   try {
-    (0, import_node_fs16.mkdirSync)((0, import_node_path18.dirname)(outPath), { recursive: true });
-    (0, import_node_fs16.writeFileSync)(outPath, content, "utf8");
+    (0, import_node_fs18.mkdirSync)((0, import_node_path20.dirname)(outPath), { recursive: true });
+    (0, import_node_fs18.writeFileSync)(outPath, content, "utf8");
   } catch (err) {
-    log(`${import_picocolors39.default.red("\u2717")} Could not write ${outPath}: ${err.message}`);
+    log(`${import_picocolors40.default.red("\u2717")} Could not write ${outPath}: ${err.message}`);
     return 1;
   }
-  log(`${import_picocolors39.default.green("\u2713")} Horus skill installed \u2192 ${outPath}`);
+  log(`${import_picocolors40.default.green("\u2713")} Horus skill installed \u2192 ${outPath}`);
   if (target === "claude") {
-    log(import_picocolors39.default.dim("  Claude Code will load this skill automatically."));
-    log(import_picocolors39.default.dim("  Invoke it with: /horus"));
+    log(import_picocolors40.default.dim("  Claude Code will load this skill automatically."));
+    log(import_picocolors40.default.dim("  Invoke it with: /horus"));
   } else if (target === "gemini") {
-    log(import_picocolors39.default.dim("  Gemini CLI will load this context file automatically."));
+    log(import_picocolors40.default.dim("  Gemini CLI will load this context file automatically."));
   } else if (target === "cursor") {
-    log(import_picocolors39.default.dim("  Cursor will load this rule automatically."));
+    log(import_picocolors40.default.dim("  Cursor will load this rule automatically."));
   } else if (target === "codex") {
-    log(import_picocolors39.default.dim("  Codex CLI will load this file automatically."));
+    log(import_picocolors40.default.dim("  Codex CLI will load this file automatically."));
   } else {
-    log(import_picocolors39.default.dim(`  Copy or reference this file in your ${target} agent instructions.`));
+    log(import_picocolors40.default.dim(`  Copy or reference this file in your ${target} agent instructions.`));
   }
   return 0;
 }
 async function runSkillPrint(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors39.default.red("\u2717")} Unknown target: ${import_picocolors39.default.bold(target)}`);
-    log(import_picocolors39.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors40.default.red("\u2717")} Unknown target: ${import_picocolors40.default.bold(target)}`);
+    log(import_picocolors40.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   process.stdout.write(generateSkillContent(target));
@@ -98214,8 +98651,8 @@ async function runSkillPrint(target, opts) {
 async function runSkillPath(target, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
   if (!isValidTarget(target)) {
-    log(`${import_picocolors39.default.red("\u2717")} Unknown target: ${import_picocolors39.default.bold(target)}`);
-    log(import_picocolors39.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
+    log(`${import_picocolors40.default.red("\u2717")} Unknown target: ${import_picocolors40.default.bold(target)}`);
+    log(import_picocolors40.default.dim(`  Supported targets: ${SUPPORTED_TARGETS.join(", ")}`));
     return 1;
   }
   const outPath = getSkillInstallPath(target, { global: opts.global, cwd: opts.cwd });
@@ -98225,11 +98662,11 @@ async function runSkillPath(target, opts) {
 
 // ../../packages/cli/src/commands/update.ts
 init_cjs_shims();
-var import_node_fs17 = require("fs");
-var import_node_path19 = require("path");
-var import_node_os4 = require("os");
-var import_node_crypto5 = require("crypto");
-var import_picocolors40 = __toESM(require_picocolors(), 1);
+var import_node_fs19 = require("fs");
+var import_node_path21 = require("path");
+var import_node_os5 = require("os");
+var import_node_crypto7 = require("crypto");
+var import_picocolors41 = __toESM(require_picocolors(), 1);
 var RELEASES_API = "https://api.github.com/repos/meritt-dev/horus/releases/latest";
 function parseVersion(v) {
   const m = v.replace(/^v/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -98254,13 +98691,13 @@ async function fetchLatestRelease(_fetch = fetch) {
   return res.json();
 }
 function sha256hex(buf) {
-  return (0, import_node_crypto5.createHash)("sha256").update(buf).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(buf).digest("hex");
 }
 function resolveBinaryPath() {
   const raw = process.argv[1];
   if (!raw) throw new Error("Cannot determine binary path from process.argv[1]");
   try {
-    return (0, import_node_fs17.realpathSync)(raw);
+    return (0, import_node_fs19.realpathSync)(raw);
   } catch {
     return raw;
   }
@@ -98270,33 +98707,33 @@ async function runUpdate(opts) {
   const _fetch = opts._fetch ?? fetch;
   const currentVersion = opts._currentVersion ?? HORUS_VERSION;
   write(`
-${import_picocolors40.default.bold("Horus update")}
+${import_picocolors41.default.bold("Horus update")}
 `);
-  write(`  Current version: ${import_picocolors40.default.cyan(currentVersion)}`);
+  write(`  Current version: ${import_picocolors41.default.cyan(currentVersion)}`);
   let release;
   try {
     release = await fetchLatestRelease(_fetch);
   } catch (e) {
-    write(`  ${import_picocolors40.default.red("\u2717")} Could not reach GitHub: ${e.message}`);
+    write(`  ${import_picocolors41.default.red("\u2717")} Could not reach GitHub: ${e.message}`);
     return 1;
   }
   const latest = release.tag_name.replace(/^v/, "");
-  write(`  Latest version:  ${import_picocolors40.default.cyan(latest)}`);
+  write(`  Latest version:  ${import_picocolors41.default.cyan(latest)}`);
   const newer = isNewer(latest, currentVersion);
   if (opts.check) {
     if (newer) {
       write(`
-  ${import_picocolors40.default.yellow("\u2192")} ${import_picocolors40.default.bold(latest)} is available.`);
-      write(`    Run ${import_picocolors40.default.bold("horus update")} to upgrade.`);
+  ${import_picocolors41.default.yellow("\u2192")} ${import_picocolors41.default.bold(latest)} is available.`);
+      write(`    Run ${import_picocolors41.default.bold("horus update")} to upgrade.`);
     } else {
       write(`
-  ${import_picocolors40.default.green("\u2713")} Already on the latest version.`);
+  ${import_picocolors41.default.green("\u2713")} Already on the latest version.`);
     }
     return 0;
   }
   if (!newer && !opts.force) {
     write(`
-  ${import_picocolors40.default.green("\u2713")} Already on the latest version.`);
+  ${import_picocolors41.default.green("\u2713")} Already on the latest version.`);
     return 0;
   }
   const tag = release.tag_name;
@@ -98305,8 +98742,8 @@ ${import_picocolors40.default.bold("Horus update")}
   const binaryAsset = release.assets.find((a) => a.name === assetName);
   const checksumAsset = release.assets.find((a) => a.name === checksumName);
   if (!binaryAsset) {
-    write(`  ${import_picocolors40.default.red("\u2717")} Release ${tag} has no binary asset named '${assetName}'.`);
-    write(`    Fallback: ${import_picocolors40.default.dim("curl -fsSL https://horus.sh/install.sh | bash")}`);
+    write(`  ${import_picocolors41.default.red("\u2717")} Release ${tag} has no binary asset named '${assetName}'.`);
+    write(`    Fallback: ${import_picocolors41.default.dim("curl -fsSL https://horus.sh/install.sh | bash")}`);
     return 1;
   }
   write(`
@@ -98316,7 +98753,7 @@ ${import_picocolors40.default.bold("Horus update")}
     redirect: "follow"
   });
   if (!binRes.ok || !binRes.body) {
-    write(`  ${import_picocolors40.default.red("\u2717")} Download failed: ${binRes.status}`);
+    write(`  ${import_picocolors41.default.red("\u2717")} Download failed: ${binRes.status}`);
     return 1;
   }
   const binBuf = Buffer.from(await binRes.arrayBuffer());
@@ -98330,75 +98767,75 @@ ${import_picocolors40.default.bold("Horus update")}
       const expectedHash = csText.trim().split(/\s+/)[0];
       const actualHash = sha256hex(binBuf);
       if (expectedHash !== actualHash) {
-        write(`  ${import_picocolors40.default.red("\u2717")} Checksum mismatch \u2014 download may be corrupt.`);
+        write(`  ${import_picocolors41.default.red("\u2717")} Checksum mismatch \u2014 download may be corrupt.`);
         write(`    Expected: ${expectedHash}`);
         write(`    Got:      ${actualHash}`);
         return 1;
       }
-      write(`  ${import_picocolors40.default.green("\u2713")} Checksum verified.`);
+      write(`  ${import_picocolors41.default.green("\u2713")} Checksum verified.`);
     }
   }
   let binaryPath;
   try {
     binaryPath = resolveBinaryPath();
   } catch (e) {
-    write(`  ${import_picocolors40.default.red("\u2717")} ${e.message}`);
+    write(`  ${import_picocolors41.default.red("\u2717")} ${e.message}`);
     return 1;
   }
-  if (!(0, import_node_fs17.existsSync)(binaryPath)) {
-    write(`  ${import_picocolors40.default.red("\u2717")} Binary not found at ${binaryPath}`);
+  if (!(0, import_node_fs19.existsSync)(binaryPath)) {
+    write(`  ${import_picocolors41.default.red("\u2717")} Binary not found at ${binaryPath}`);
     return 1;
   }
-  const tmpPath = (0, import_node_path19.join)((0, import_node_os4.tmpdir)(), `horus-update-${tag}-${process.pid}`);
+  const tmpPath = (0, import_node_path21.join)((0, import_node_os5.tmpdir)(), `horus-update-${tag}-${process.pid}`);
   const backupPath = `${binaryPath}.bak`;
   try {
-    (0, import_node_fs17.writeFileSync)(tmpPath, binBuf, { mode: 493 });
+    (0, import_node_fs19.writeFileSync)(tmpPath, binBuf, { mode: 493 });
   } catch (e) {
-    write(`  ${import_picocolors40.default.red("\u2717")} Could not write to temp dir: ${e.message}`);
+    write(`  ${import_picocolors41.default.red("\u2717")} Could not write to temp dir: ${e.message}`);
     return 1;
   }
   try {
-    (0, import_node_fs17.renameSync)(binaryPath, backupPath);
+    (0, import_node_fs19.renameSync)(binaryPath, backupPath);
     try {
-      (0, import_node_fs17.renameSync)(tmpPath, binaryPath);
-      (0, import_node_fs17.chmodSync)(binaryPath, 493);
+      (0, import_node_fs19.renameSync)(tmpPath, binaryPath);
+      (0, import_node_fs19.chmodSync)(binaryPath, 493);
     } catch (e) {
       try {
-        (0, import_node_fs17.renameSync)(backupPath, binaryPath);
+        (0, import_node_fs19.renameSync)(backupPath, binaryPath);
       } catch {
       }
       throw e;
     }
     try {
-      (0, import_node_fs17.unlinkSync)(backupPath);
+      (0, import_node_fs19.unlinkSync)(backupPath);
     } catch {
     }
   } catch (e) {
     try {
-      (0, import_node_fs17.unlinkSync)(tmpPath);
+      (0, import_node_fs19.unlinkSync)(tmpPath);
     } catch {
     }
     const msg = e.message ?? String(e);
     const needsSudo = e.code === "EACCES" || e.code === "EPERM";
-    write(`  ${import_picocolors40.default.red("\u2717")} Could not replace binary at ${binaryPath}: ${msg}`);
+    write(`  ${import_picocolors41.default.red("\u2717")} Could not replace binary at ${binaryPath}: ${msg}`);
     if (needsSudo) {
       write(`
   Try with sudo:`);
       write(
-        `    ${import_picocolors40.default.dim(`sudo curl -fsSL https://github.com/meritt-dev/horus/releases/download/${tag}/${assetName} -o ${binaryPath} && sudo chmod +x ${binaryPath}`)}`
+        `    ${import_picocolors41.default.dim(`sudo curl -fsSL https://github.com/meritt-dev/horus/releases/download/${tag}/${assetName} -o ${binaryPath} && sudo chmod +x ${binaryPath}`)}`
       );
     }
     return 1;
   }
-  write(`  ${import_picocolors40.default.green("\u2713")} Updated: ${import_picocolors40.default.bold(currentVersion)} \u2192 ${import_picocolors40.default.bold(latest)}`);
-  write(`  ${import_picocolors40.default.dim(binaryPath)}`);
+  write(`  ${import_picocolors41.default.green("\u2713")} Updated: ${import_picocolors41.default.bold(currentVersion)} \u2192 ${import_picocolors41.default.bold(latest)}`);
+  write(`  ${import_picocolors41.default.dim(binaryPath)}`);
   return 0;
 }
 
 // ../../packages/cli/src/commands/login.ts
 init_cjs_shims();
 var import_node_child_process9 = require("child_process");
-var import_picocolors41 = __toESM(require_picocolors(), 1);
+var import_picocolors42 = __toESM(require_picocolors(), 1);
 var sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
@@ -98423,19 +98860,19 @@ async function loginWithToken(apiBaseUrl, token) {
       }
     });
     console.log(
-      `${import_picocolors41.default.green("\u2713")} Logged in as ${import_picocolors41.default.bold(me.user.primaryEmail)}. Run ${import_picocolors41.default.bold("horus cloud link")} to connect this repo.`
+      `${import_picocolors42.default.green("\u2713")} Logged in as ${import_picocolors42.default.bold(me.user.primaryEmail)}. Run ${import_picocolors42.default.bold("horus cloud link")} to connect this repo.`
     );
     return 0;
   } catch (err) {
     if (err instanceof CloudOfflineError) {
-      console.error(import_picocolors41.default.red(err.message));
+      console.error(import_picocolors42.default.red(err.message));
       return 1;
     }
     if (err instanceof CloudError && err.status === 401) {
-      console.error(import_picocolors41.default.red("That token is not valid. Create a fresh one in the dashboard and try again."));
+      console.error(import_picocolors42.default.red("That token is not valid. Create a fresh one in the dashboard and try again."));
       return 1;
     }
-    console.error(import_picocolors41.default.red(`Login failed: ${err.message}`));
+    console.error(import_picocolors42.default.red(`Login failed: ${err.message}`));
     return 1;
   }
 }
@@ -98446,19 +98883,19 @@ async function loginWithBrowser(apiBaseUrl) {
     session = await client.startCliSession();
   } catch (err) {
     if (err instanceof CloudOfflineError) {
-      console.error(import_picocolors41.default.red(err.message));
+      console.error(import_picocolors42.default.red(err.message));
       return 1;
     }
-    console.error(import_picocolors41.default.red(`Could not start login: ${err.message}`));
+    console.error(import_picocolors42.default.red(`Could not start login: ${err.message}`));
     return 1;
   }
   console.log("");
   console.log(`  To sign in, open this URL in your browser:`);
-  console.log(`    ${import_picocolors41.default.cyan(import_picocolors41.default.bold(session.verificationUri))}`);
+  console.log(`    ${import_picocolors42.default.cyan(import_picocolors42.default.bold(session.verificationUri))}`);
   console.log("");
-  console.log(`  and enter the code:  ${import_picocolors41.default.bold(session.userCode)}`);
+  console.log(`  and enter the code:  ${import_picocolors42.default.bold(session.userCode)}`);
   console.log("");
-  console.log(import_picocolors41.default.dim(`  Waiting for approval\u2026  (press Ctrl+C to cancel)`));
+  console.log(import_picocolors42.default.dim(`  Waiting for approval\u2026  (press Ctrl+C to cancel)`));
   openBrowser(session.verificationUriComplete);
   const deadline = Date.now() + session.expiresIn * 1e3;
   let intervalMs = Math.max(session.interval, 1) * 1e3;
@@ -98469,7 +98906,7 @@ async function loginWithBrowser(apiBaseUrl) {
       poll = await client.pollCliSession(session.deviceCode);
     } catch (err) {
       if (err instanceof CloudOfflineError) {
-        console.error(import_picocolors41.default.red(`
+        console.error(import_picocolors42.default.red(`
 ${err.message}`));
         return 1;
       }
@@ -98482,14 +98919,14 @@ ${err.message}`));
         intervalMs += 2e3;
         break;
       case "denied":
-        console.error(import_picocolors41.default.red("\nLogin was denied in the browser."));
+        console.error(import_picocolors42.default.red("\nLogin was denied in the browser."));
         return 1;
       case "expired":
-        console.error(import_picocolors41.default.red("\nThis login request expired. Run `horus login` again."));
+        console.error(import_picocolors42.default.red("\nThis login request expired. Run `horus login` again."));
         return 1;
       case "approved":
         if (!poll.token || !poll.account) {
-          console.error(import_picocolors41.default.red("\nLogin approved but no token was returned. Try again."));
+          console.error(import_picocolors42.default.red("\nLogin approved but no token was returned. Try again."));
           return 1;
         }
         writeAuth({
@@ -98499,12 +98936,12 @@ ${err.message}`));
         });
         console.log(
           `
-${import_picocolors41.default.green("\u2713")} Logged in as ${import_picocolors41.default.bold(poll.account.email)}. Run ${import_picocolors41.default.bold("horus cloud link")} to connect this repo.`
+${import_picocolors42.default.green("\u2713")} Logged in as ${import_picocolors42.default.bold(poll.account.email)}. Run ${import_picocolors42.default.bold("horus cloud link")} to connect this repo.`
         );
         return 0;
     }
   }
-  console.error(import_picocolors41.default.red("\nTimed out waiting for approval. Run `horus login` again."));
+  console.error(import_picocolors42.default.red("\nTimed out waiting for approval. Run `horus login` again."));
   return 1;
 }
 async function runLogin(opts = {}) {
@@ -98518,7 +98955,7 @@ async function runLogin(opts = {}) {
 async function runLogout() {
   const auth = readAuth();
   if (!auth) {
-    console.log(import_picocolors41.default.dim("Not logged in."));
+    console.log(import_picocolors42.default.dim("Not logged in."));
     return 0;
   }
   const session = authedClient();
@@ -98532,14 +98969,14 @@ async function runLogout() {
     }
   }
   clearAuth();
-  console.log(`${import_picocolors41.default.green("\u2713")} Logged out. Local mode still works.`);
+  console.log(`${import_picocolors42.default.green("\u2713")} Logged out. Local mode still works.`);
   return 0;
 }
 
 // ../../packages/cli/src/commands/cloud.ts
 init_cjs_shims();
-var import_picocolors42 = __toESM(require_picocolors(), 1);
-var import_promises2 = require("readline/promises");
+var import_picocolors43 = __toESM(require_picocolors(), 1);
+var import_promises3 = require("readline/promises");
 
 // ../../packages/cli/src/lib/cloud/git.ts
 init_cjs_shims();
@@ -98583,7 +99020,7 @@ async function runCloudLink(opts = {}) {
   const root = repoRootOrCwd(opts.cwd);
   const session = authedClient();
   if (!session) {
-    console.error(import_picocolors42.default.red(`Not logged in. Run ${import_picocolors42.default.bold("horus login")} first.`));
+    console.error(import_picocolors43.default.red(`Not logged in. Run ${import_picocolors43.default.bold("horus login")} first.`));
     return 1;
   }
   let ctx;
@@ -98593,7 +99030,7 @@ async function runCloudLink(opts = {}) {
     return reportCloudError(err);
   }
   const remote = detectGitRemote(root);
-  if (remote) console.log(import_picocolors42.default.dim(`Detected git remote: ${remote.remoteUrl}`));
+  if (remote) console.log(import_picocolors43.default.dim(`Detected git remote: ${remote.remoteUrl}`));
   let resolved = null;
   let target = opts.project;
   if (!target) {
@@ -98609,7 +99046,7 @@ async function runCloudLink(opts = {}) {
       const org = ctx.organizations.find((o) => o.id === match.organizationId);
       if (ws && org) {
         target = `${org.slug}/${ws.slug}/${match.slug}`;
-        console.log(import_picocolors42.default.dim(`Matched existing project by remote: ${import_picocolors42.default.bold(target)}`));
+        console.log(import_picocolors43.default.dim(`Matched existing project by remote: ${import_picocolors43.default.bold(target)}`));
       }
     }
   }
@@ -98618,8 +99055,8 @@ async function runCloudLink(opts = {}) {
     if (created === "aborted") return 1;
     if (!created) {
       console.error(
-        import_picocolors42.default.red("No project to link.") + `
-  Run ${import_picocolors42.default.bold("horus cloud link")} in a TTY to create one, pass ${import_picocolors42.default.bold("--project <org/workspace/project>")}, or create a project at ${import_picocolors42.default.bold("https://cloud.horus.sh")}.`
+        import_picocolors43.default.red("No project to link.") + `
+  Run ${import_picocolors43.default.bold("horus cloud link")} in a TTY to create one, pass ${import_picocolors43.default.bold("--project <org/workspace/project>")}, or create a project at ${import_picocolors43.default.bold("https://cloud.horus.sh")}.`
       );
       return 1;
     }
@@ -98629,8 +99066,8 @@ async function runCloudLink(opts = {}) {
     resolved = resolveTriple(ctx, target);
     if (!resolved) {
       console.error(
-        import_picocolors42.default.red(`You don't have access to ${import_picocolors42.default.bold(target)}.`) + `
-  Run ${import_picocolors42.default.bold("horus context list")} to see available projects.`
+        import_picocolors43.default.red(`You don't have access to ${import_picocolors43.default.bold(target)}.`) + `
+  Run ${import_picocolors43.default.bold("horus context list")} to see available projects.`
       );
       return 1;
     }
@@ -98643,10 +99080,10 @@ async function runCloudLink(opts = {}) {
     project: resolved.project
   });
   console.log(
-    `${import_picocolors42.default.green("\u2713")} Linked. Context for this repo is now ${import_picocolors42.default.bold(label)} ${import_picocolors42.default.dim("(cloud)")}.`
+    `${import_picocolors43.default.green("\u2713")} Linked. Context for this repo is now ${import_picocolors43.default.bold(label)} ${import_picocolors43.default.dim("(cloud)")}.`
   );
   console.log(
-    import_picocolors42.default.dim(`  Investigations here save to Horus Cloud. ${import_picocolors42.default.bold("horus context use local")} to switch back.`)
+    import_picocolors43.default.dim(`  Investigations here save to Horus Cloud. ${import_picocolors43.default.bold("horus context use local")} to switch back.`)
   );
   return 0;
 }
@@ -98654,11 +99091,11 @@ async function runCloudUnlink(opts = {}) {
   const root = repoRootOrCwd(opts.cwd);
   const cfg = readCloudConfig(root);
   if (!cfg || cfg.context !== "cloud") {
-    console.log(import_picocolors42.default.dim("This repo isn't linked to a cloud project."));
+    console.log(import_picocolors43.default.dim("This repo isn't linked to a cloud project."));
     return 0;
   }
   clearCloudConfig(root);
-  console.log(`${import_picocolors42.default.green("\u2713")} Unlinked. This repo is back to ${import_picocolors42.default.bold("local")} mode.`);
+  console.log(`${import_picocolors43.default.green("\u2713")} Unlinked. This repo is back to ${import_picocolors43.default.bold("local")} mode.`);
   return 0;
 }
 async function runCloudStatus(opts = {}) {
@@ -98666,18 +99103,18 @@ async function runCloudStatus(opts = {}) {
   const cfg = readCloudConfig(root);
   const session = authedClient();
   if (!isCloudActive(cfg) || !cfg?.project) {
-    console.log(`${import_picocolors42.default.bold("Context:")}  local`);
-    console.log(`${import_picocolors42.default.bold("Storage:")}  local Postgres (~/.horus)`);
+    console.log(`${import_picocolors43.default.bold("Context:")}  local`);
+    console.log(`${import_picocolors43.default.bold("Storage:")}  local Postgres (~/.horus)`);
     console.log(
-      import_picocolors42.default.dim(`Tip:      ${import_picocolors42.default.bold("horus login")} then ${import_picocolors42.default.bold("horus cloud link")} to share investigations with your team.`)
+      import_picocolors43.default.dim(`Tip:      ${import_picocolors43.default.bold("horus login")} then ${import_picocolors43.default.bold("horus cloud link")} to share investigations with your team.`)
     );
     return 0;
   }
   const triple = `${cfg.organization?.slug}/${cfg.workspace?.slug}/${cfg.project.slug}`;
-  console.log(`${import_picocolors42.default.bold("Context:")}     ${triple}   ${import_picocolors42.default.dim("(cloud)")}`);
+  console.log(`${import_picocolors43.default.bold("Context:")}     ${triple}   ${import_picocolors43.default.dim("(cloud)")}`);
   let projectLine = `${cfg.project.slug}`;
   let metaLines = [];
-  let account = import_picocolors42.default.dim("not logged in");
+  let account = import_picocolors43.default.dim("not logged in");
   if (session) {
     account = session.auth.account.email;
     try {
@@ -98692,9 +99129,9 @@ async function runCloudStatus(opts = {}) {
     } catch {
     }
   }
-  console.log(`${import_picocolors42.default.bold("Project:")}     ${projectLine}`);
+  console.log(`${import_picocolors43.default.bold("Project:")}     ${projectLine}`);
   for (const line2 of metaLines) console.log(line2);
-  console.log(`${import_picocolors42.default.bold("Account:")}     ${account}`);
+  console.log(`${import_picocolors43.default.bold("Account:")}     ${account}`);
   return 0;
 }
 async function runCloudSync(opts = {}) {
@@ -98702,13 +99139,13 @@ async function runCloudSync(opts = {}) {
   const cfg = readCloudConfig(root);
   if (!isCloudActive(cfg) || !cfg.project) {
     console.error(
-      import_picocolors42.default.red("This repo isn't linked to a cloud project.") + ` Run ${import_picocolors42.default.bold("horus cloud link")} first.`
+      import_picocolors43.default.red("This repo isn't linked to a cloud project.") + ` Run ${import_picocolors43.default.bold("horus cloud link")} first.`
     );
     return 1;
   }
   const session = authedClient();
   if (!session) {
-    console.error(import_picocolors42.default.red(`Not logged in. Run ${import_picocolors42.default.bold("horus login")} first.`));
+    console.error(import_picocolors43.default.red(`Not logged in. Run ${import_picocolors43.default.bold("horus login")} first.`));
     return 1;
   }
   const { db, sql: sql2 } = createDb(await resolveDbUrl(opts.config));
@@ -98729,34 +99166,34 @@ async function runCloudSync(opts = {}) {
   const target = `${cfg.organization?.slug}/${cfg.workspace?.slug}/${cfg.project.slug}`;
   if (uploadable.length === 0) {
     console.log(
-      import_picocolors42.default.dim(
+      import_picocolors43.default.dim(
         `No local investigations with reports to upload.` + (skippedNoReport ? ` (${skippedNoReport} without a report skipped)` : "")
       )
     );
     return 0;
   }
-  console.log(import_picocolors42.default.bold(`Will upload ${uploadable.length} investigation(s) to ${target} ${import_picocolors42.default.dim("(cloud)")}:`));
+  console.log(import_picocolors43.default.bold(`Will upload ${uploadable.length} investigation(s) to ${target} ${import_picocolors43.default.dim("(cloud)")}:`));
   for (const c of uploadable.slice(0, 20)) {
-    console.log(`  ${import_picocolors42.default.dim(c.id.slice(0, 8))}  ${(c.title ?? "untitled").slice(0, 70)}`);
+    console.log(`  ${import_picocolors43.default.dim(c.id.slice(0, 8))}  ${(c.title ?? "untitled").slice(0, 70)}`);
   }
-  if (uploadable.length > 20) console.log(import_picocolors42.default.dim(`  \u2026and ${uploadable.length - 20} more`));
-  if (skippedNoReport) console.log(import_picocolors42.default.dim(`  (${skippedNoReport} local investigation(s) without a report will be skipped)`));
+  if (uploadable.length > 20) console.log(import_picocolors43.default.dim(`  \u2026and ${uploadable.length - 20} more`));
+  if (skippedNoReport) console.log(import_picocolors43.default.dim(`  (${skippedNoReport} local investigation(s) without a report will be skipped)`));
   if (opts.dryRun) {
-    console.log(import_picocolors42.default.dim("Dry run \u2014 nothing uploaded. Re-run without --dry-run to upload."));
+    console.log(import_picocolors43.default.dim("Dry run \u2014 nothing uploaded. Re-run without --dry-run to upload."));
     return 0;
   }
   if (!opts.yes) {
     if (!process.stdin.isTTY) {
       console.error(
-        import_picocolors42.default.yellow(`Re-run with ${import_picocolors42.default.bold("--yes")} to upload, or ${import_picocolors42.default.bold("--dry-run")} to preview only.`)
+        import_picocolors43.default.yellow(`Re-run with ${import_picocolors43.default.bold("--yes")} to upload, or ${import_picocolors43.default.bold("--dry-run")} to preview only.`)
       );
       return 1;
     }
-    const rl = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
+    const rl = (0, import_promises3.createInterface)({ input: process.stdin, output: process.stdout });
     try {
       const answer = (await rl.question(`Upload ${uploadable.length} investigation(s) to ${target}? (y/N) `)).trim().toLowerCase();
       if (answer !== "y" && answer !== "yes") {
-        console.log(import_picocolors42.default.dim("Aborted. Nothing uploaded."));
+        console.log(import_picocolors43.default.dim("Aborted. Nothing uploaded."));
         return 0;
       }
     } finally {
@@ -98769,18 +99206,18 @@ async function runCloudSync(opts = {}) {
     try {
       const refs = await uploadInvestigationToCloud(session.client, cfg, c.report);
       created++;
-      console.log(`${import_picocolors42.default.green("\u2713")} ${import_picocolors42.default.dim(c.id.slice(0, 8))} \u2192 ${refs.investigationId}`);
+      console.log(`${import_picocolors43.default.green("\u2713")} ${import_picocolors43.default.dim(c.id.slice(0, 8))} \u2192 ${refs.investigationId}`);
     } catch (err) {
       failed++;
-      console.error(`${import_picocolors42.default.red("\u2717")} ${import_picocolors42.default.dim(c.id.slice(0, 8))} ${err.message}`);
+      console.error(`${import_picocolors43.default.red("\u2717")} ${import_picocolors43.default.dim(c.id.slice(0, 8))} ${err.message}`);
     }
   }
   console.log("");
   console.log(
-    `${import_picocolors42.default.bold("Sync complete:")} ${import_picocolors42.default.green(`${created} uploaded`)}, ${skippedNoReport} skipped, ` + (failed ? import_picocolors42.default.red(`${failed} failed`) : "0 failed") + "."
+    `${import_picocolors43.default.bold("Sync complete:")} ${import_picocolors43.default.green(`${created} uploaded`)}, ${skippedNoReport} skipped, ` + (failed ? import_picocolors43.default.red(`${failed} failed`) : "0 failed") + "."
   );
   console.log(
-    import_picocolors42.default.dim("Local data was not modified. Re-running is safe \u2014 duplicates are deduped by idempotency key.")
+    import_picocolors43.default.dim("Local data was not modified. Re-running is safe \u2014 duplicates are deduped by idempotency key.")
   );
   return failed > 0 ? 1 : 0;
 }
@@ -98788,12 +99225,12 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
   if (!process.stdin.isTTY && !yes) return null;
   if (ctx.organizations.length === 0) {
     console.error(
-      import_picocolors42.default.red("You're not a member of any organization yet.") + `
-  Create one at ${import_picocolors42.default.bold("https://cloud.horus.sh")} first.`
+      import_picocolors43.default.red("You're not a member of any organization yet.") + `
+  Create one at ${import_picocolors43.default.bold("https://cloud.horus.sh")} first.`
     );
     return null;
   }
-  const rl = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
+  const rl = (0, import_promises3.createInterface)({ input: process.stdin, output: process.stdout });
   const ask2 = async (q, def) => {
     if (yes && def !== void 0) return def;
     const a = (await rl.question(def ? `${q} (${def}): ` : `${q}: `)).trim();
@@ -98814,9 +99251,9 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
       const wsName = await ask2("New workspace name", repoName || "default");
       const ws = await client.createWorkspace(org.id, { name: wsName });
       workspace = { id: ws.id, slug: ws.slug };
-      console.log(import_picocolors42.default.dim(`Created workspace ${import_picocolors42.default.bold(ws.slug)}.`));
+      console.log(import_picocolors43.default.dim(`Created workspace ${import_picocolors43.default.bold(ws.slug)}.`));
     } else {
-      console.log(`Workspaces in ${import_picocolors42.default.bold(org.slug)}:`);
+      console.log(`Workspaces in ${import_picocolors43.default.bold(org.slug)}:`);
       orgWorkspaces.forEach((w, i) => console.log(`  ${i + 1}) ${w.slug}`));
       console.log(`  ${orgWorkspaces.length + 1}) + create a new workspace`);
       const pick2 = Number(await ask2("Workspace number", "1"));
@@ -98824,7 +99261,7 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
         const wsName = await ask2("New workspace name", repoName || "default");
         const ws = await client.createWorkspace(org.id, { name: wsName });
         workspace = { id: ws.id, slug: ws.slug };
-        console.log(import_picocolors42.default.dim(`Created workspace ${import_picocolors42.default.bold(ws.slug)}.`));
+        console.log(import_picocolors43.default.dim(`Created workspace ${import_picocolors43.default.bold(ws.slug)}.`));
       } else {
         const chosen = orgWorkspaces[pick2 - 1] ?? orgWorkspaces[0];
         workspace = { id: chosen.id, slug: chosen.slug };
@@ -98836,7 +99273,7 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
       remoteUrl: remote?.remoteUrl,
       provider: remote ? inferProvider(remote.remoteUrl) : void 0
     });
-    console.log(import_picocolors42.default.dim(`Created project ${import_picocolors42.default.bold(project.slug)}.`));
+    console.log(import_picocolors43.default.dim(`Created project ${import_picocolors43.default.bold(project.slug)}.`));
     return {
       organization: { id: org.id, slug: org.slug },
       workspace,
@@ -98850,6 +99287,274 @@ async function createProjectFromRepo(client, ctx, remote, yes) {
   }
 }
 
+// ../../packages/cli/src/commands/telemetry.ts
+init_cjs_shims();
+var import_picocolors45 = __toESM(require_picocolors(), 1);
+var import_node_crypto8 = require("crypto");
+
+// ../../packages/cli/src/lib/telemetry/transport.ts
+init_cjs_shims();
+var CHUNK = 100;
+var DEFAULT_TIMEOUT_MS = 1500;
+function telemetryBaseUrl() {
+  return process.env.HORUS_TELEMETRY_URL ?? process.env.HORUS_API_BASE_URL ?? readAuth()?.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+}
+async function postBatch(url, events, signal) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ events }),
+    signal
+  });
+  return res.ok;
+}
+async function flushTelemetry(opts = {}) {
+  try {
+    if (!resolveConsent().tierA) return;
+    const events = readSpooledEvents();
+    if (events.length === 0) return;
+    const url = `${telemetryBaseUrl().replace(/\/$/, "")}/v1/telemetry`;
+    const controller = new AbortController();
+    const timer2 = setTimeout(() => controller.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    try {
+      for (let i = 0; i < events.length; i += CHUNK) {
+        const ok = await postBatch(url, events.slice(i, i + CHUNK), controller.signal);
+        if (!ok) return;
+      }
+      clearSpool();
+    } finally {
+      clearTimeout(timer2);
+    }
+  } catch {
+  }
+}
+async function deleteRemoteTelemetry(installId, opts = {}) {
+  try {
+    if (!installId) return;
+    const url = `${telemetryBaseUrl().replace(/\/$/, "")}/v1/telemetry/delete`;
+    const controller = new AbortController();
+    const timer2 = setTimeout(() => controller.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    try {
+      await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ installId }),
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timer2);
+    }
+  } catch {
+  }
+}
+
+// ../../packages/cli/src/lib/telemetry/notice.ts
+init_cjs_shims();
+var import_picocolors44 = __toESM(require_picocolors(), 1);
+var PRIVACY_URL = "https://horus.sh/privacy";
+var SUPPRESS_FIRST_TOKEN = /* @__PURE__ */ new Set(["telemetry", "help"]);
+var SUPPRESS_FLAGS = /* @__PURE__ */ new Set(["-V", "--version", "-h", "--help"]);
+function shouldSuppressFor(argv) {
+  const args = argv.slice(2);
+  if (args.length === 0) return true;
+  if (args.some((a) => SUPPRESS_FLAGS.has(a))) return true;
+  const firstToken = args.find((a) => !a.startsWith("-"));
+  return firstToken != null && SUPPRESS_FIRST_TOKEN.has(firstToken);
+}
+function banner() {
+  const b2 = import_picocolors44.default.bold;
+  const dim = import_picocolors44.default.dim;
+  return [
+    "",
+    import_picocolors44.default.cyan(b2("Horus collects anonymous usage data to improve the tool.")),
+    dim("  \u2022 On by default: command names, timings, success/failure, and where the"),
+    dim("    engine ran out of evidence. No file contents, queries, or secrets."),
+    dim("  \u2022 Off by default: your investigation inputs/outputs (opt in to help train"),
+    `    ${dim("Horus)")}  ${dim("\u2014 run")} ${b2("horus telemetry enable-content")}`,
+    dim("  \u2022 If you use Horus Cloud, linked investigations sync to your workspace."),
+    "",
+    `  ${dim("Opt out anytime:")} ${b2("horus telemetry disable")}  ${dim("\xB7")}  ${b2("HORUS_TELEMETRY=0")}  ${dim("\xB7")}  ${b2("DO_NOT_TRACK=1")}`,
+    `  ${dim("Details:")} ${import_picocolors44.default.underline(PRIVACY_URL)}`,
+    ""
+  ].join("\n");
+}
+function maybeShowFirstRunNotice(argv = process.argv) {
+  try {
+    const env = process.env;
+    if (resolveConsent({ env }).forcedOff) return;
+    if (isCI(env)) return;
+    const state = loadOrInitTelemetryState();
+    if (state.tierA.noticeShownAt) return;
+    if (shouldSuppressFor(argv)) return;
+    if (!process.stderr.isTTY) return;
+    process.stderr.write(banner() + "\n");
+    updateTelemetryState((s) => {
+      s.tierA.noticeShownAt = (/* @__PURE__ */ new Date()).toISOString();
+    });
+  } catch {
+  }
+}
+
+// ../../packages/cli/src/commands/telemetry.ts
+function onOff(enabled) {
+  return enabled ? import_picocolors45.default.green("on") : import_picocolors45.default.dim("off");
+}
+function warnIfEnvOverrides() {
+  const decision = resolveConsent();
+  if (decision.forcedOff) {
+    console.log(
+      import_picocolors45.default.yellow(
+        `
+Note: telemetry is currently forced off by your environment (${decision.reason}).`
+      )
+    );
+    console.log(import_picocolors45.default.dim("Your saved preference will apply once that override is removed."));
+  } else if (decision.source === "ci") {
+    console.log(
+      import_picocolors45.default.yellow("\nNote: CI environment detected \u2014 telemetry stays off here regardless.")
+    );
+  }
+}
+async function runTelemetryStatus() {
+  const state = readTelemetryState();
+  const decision = resolveConsent({ state });
+  console.log(import_picocolors45.default.bold("Horus telemetry"));
+  console.log(
+    `  Usage metadata (Tier A): ${onOff(decision.tierA)}  ${import_picocolors45.default.dim(`[${decision.source}]`)}`
+  );
+  console.log(`  Content sharing (Tier B): ${onOff(decision.tierB)}`);
+  console.log(import_picocolors45.default.dim(`  Reason: ${decision.reason}`));
+  if (state) {
+    console.log(import_picocolors45.default.dim(`  Install ID: ${state.installId}`));
+    console.log(
+      import_picocolors45.default.dim(
+        `  Saved: Tier A ${state.tierA.enabled ? "on" : "off"}, Tier B ${state.tierB.enabled ? "on" : "off"}`
+      )
+    );
+  } else {
+    console.log(import_picocolors45.default.dim("  No saved preference yet (defaults apply)."));
+  }
+  console.log(import_picocolors45.default.dim(`  Config: ${telemetryPath()}`));
+  console.log(import_picocolors45.default.dim(`  Privacy: ${PRIVACY_URL}`));
+  if (!state || decision.source === "env" || decision.source === "ci") {
+    warnIfEnvOverrides();
+  }
+  return 0;
+}
+async function runTelemetryEnable() {
+  updateTelemetryState((s) => {
+    s.tierA.enabled = true;
+    if (!s.tierA.noticeShownAt) s.tierA.noticeShownAt = (/* @__PURE__ */ new Date()).toISOString();
+  });
+  console.log(import_picocolors45.default.green("Anonymous usage metadata (Tier A) is now ON. Thank you!"));
+  warnIfEnvOverrides();
+  return 0;
+}
+async function runTelemetryDisable() {
+  updateTelemetryState((s) => {
+    s.tierA.enabled = false;
+    s.tierB.enabled = false;
+    if (!s.tierA.noticeShownAt) s.tierA.noticeShownAt = (/* @__PURE__ */ new Date()).toISOString();
+  });
+  console.log(import_picocolors45.default.yellow("All telemetry is now OFF (Tier A and Tier B)."));
+  return 0;
+}
+async function runTelemetryEnableContent() {
+  updateTelemetryState((s) => {
+    s.tierA.enabled = true;
+    s.tierB.enabled = true;
+    s.tierB.enabledAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (!s.tierA.noticeShownAt) s.tierA.noticeShownAt = (/* @__PURE__ */ new Date()).toISOString();
+  });
+  console.log(
+    import_picocolors45.default.green("Content sharing (Tier B) is now ON \u2014 redacted inputs/outputs help improve Horus.")
+  );
+  console.log(import_picocolors45.default.dim("Content is scrubbed of secrets/PII before it ever leaves your machine."));
+  console.log(import_picocolors45.default.dim(`What this means: ${PRIVACY_URL}`));
+  warnIfEnvOverrides();
+  return 0;
+}
+async function runTelemetryDisableContent() {
+  updateTelemetryState((s) => {
+    s.tierB.enabled = false;
+  });
+  console.log(import_picocolors45.default.yellow("Content sharing (Tier B) is now OFF. Usage metadata is unchanged."));
+  return 0;
+}
+async function runTelemetryResetId() {
+  const next = (0, import_node_crypto8.randomUUID)();
+  updateTelemetryState((s) => {
+    s.installId = next;
+  });
+  console.log(import_picocolors45.default.green("Install ID reset."));
+  console.log(import_picocolors45.default.dim(`  New install ID: ${next}`));
+  return 0;
+}
+async function runTelemetryDelete() {
+  const installId = readTelemetryState()?.installId;
+  if (installId) await deleteRemoteTelemetry(installId);
+  deleteTelemetryState();
+  clearSpool();
+  console.log(import_picocolors45.default.green("Telemetry deleted \u2014 local state cleared and a server purge requested."));
+  console.log(
+    import_picocolors45.default.dim(
+      "Next run will treat this as a fresh install and re-show the notice. If the purge could not reach the server (offline), re-run this command when back online."
+    )
+  );
+  return 0;
+}
+
+// ../../packages/cli/src/lib/telemetry/command-hooks.ts
+init_cjs_shims();
+function commandPath(cmd) {
+  const parts = [];
+  let current = cmd;
+  while (current && current.parent) {
+    parts.unshift(current.name());
+    current = current.parent;
+  }
+  return parts.join(" ") || cmd.name();
+}
+function installCommandTelemetry(program2) {
+  let startedAt = 0;
+  program2.hook("preAction", (_thisCommand, actionCommand) => {
+    startedAt = Date.now();
+    track({
+      type: "command.invoked",
+      command: commandPath(actionCommand),
+      flags: extractFlagNames(process.argv)
+    });
+  });
+  program2.hook("postAction", (_thisCommand, actionCommand) => {
+    const exitCode = typeof process.exitCode === "number" ? process.exitCode : 0;
+    track({
+      type: "command.completed",
+      command: commandPath(actionCommand),
+      flags: extractFlagNames(process.argv),
+      durationMs: startedAt ? Date.now() - startedAt : 0,
+      exitCode,
+      ok: exitCode === 0
+    });
+  });
+}
+
+// ../../packages/cli/src/commands/feedback.ts
+init_cjs_shims();
+var import_picocolors46 = __toESM(require_picocolors(), 1);
+async function runFeedback(investigationId) {
+  if (!process.stdin.isTTY) {
+    console.error(import_picocolors46.default.yellow("horus feedback needs an interactive terminal."));
+    return 1;
+  }
+  const id = investigationId?.trim();
+  if (!id) {
+    console.error(import_picocolors46.default.red("Usage: horus feedback <investigationId>"));
+    return 1;
+  }
+  await runFeedbackPrompt(id, null);
+  return 0;
+}
+
 // ../../packages/cli/src/index.ts
 function buildProgram() {
   const program2 = new Command();
@@ -99271,11 +99976,50 @@ Examples:
   horus cloud sync --dry-run     # preview what would upload
   horus cloud sync               # confirm, then upload
   horus cloud sync --yes         # upload without prompting`);
+  program2.command("feedback [investigationId]").description("Leave quick impact feedback on an investigation (helps improve Horus)").action(async (investigationId) => {
+    process.exitCode = await runFeedback(investigationId);
+  });
+  const telemetry = program2.command("telemetry").description("Manage anonymous usage telemetry that helps improve Horus");
+  telemetry.command("status").description("Show the effective telemetry decision, saved preferences, and install ID").action(async () => {
+    process.exitCode = await runTelemetryStatus();
+  });
+  telemetry.command("enable").description("Turn on anonymous usage metadata (Tier A)").action(async () => {
+    process.exitCode = await runTelemetryEnable();
+  });
+  telemetry.command("disable").description("Turn off all telemetry (Tier A and Tier B)").action(async () => {
+    process.exitCode = await runTelemetryDisable();
+  });
+  telemetry.command("enable-content").description("Opt in to sharing redacted investigation inputs/outputs (Tier B)").action(async () => {
+    process.exitCode = await runTelemetryEnableContent();
+  });
+  telemetry.command("disable-content").description("Stop sharing inputs/outputs; keep usage metadata (Tier B off)").action(async () => {
+    process.exitCode = await runTelemetryDisableContent();
+  });
+  telemetry.command("reset-id").description("Generate a new random install ID").action(async () => {
+    process.exitCode = await runTelemetryResetId();
+  });
+  telemetry.command("delete").description("Delete local telemetry state (install ID + saved preferences)").action(async () => {
+    process.exitCode = await runTelemetryDelete();
+  });
+  telemetry.addHelpText(
+    "after",
+    `
+Defaults: usage metadata ON (with this notice), content sharing OFF.
+Hard opt-out via env: HORUS_TELEMETRY=0 or DO_NOT_TRACK=1.
+
+Examples:
+  horus telemetry status
+  horus telemetry disable
+  horus telemetry enable-content`
+  );
   return program2;
 }
 async function run(argv = process.argv) {
+  maybeShowFirstRunNotice(argv);
   const program2 = buildProgram();
+  installCommandTelemetry(program2);
   await program2.parseAsync(argv);
+  await flushTelemetry();
 }
 
 // src/index.ts