@useorgx/wizard 0.1.38 → 0.1.39

package/dist/cli.js

@@ -3,9 +3,9 @@
 // src/cli.ts
 import * as clack from "@clack/prompts";
 import { spawnSync as spawnSync3 } from "child_process";
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { hostname } from "os";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 import { Command } from "commander";
 import pc3 from "picocolors";
 
@@ -795,7 +795,7 @@ function parsePairingPollResult(value) {
   };
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function startBrowserPairing(options, fetchImpl) {
   const data = await fetchJson({
@@ -908,12 +908,12 @@ h1{font-size:1.5rem;color:#b91c1c}p{color:#555;margin-top:.5rem}</style>
 <p>Return to your terminal and try again.</p>
 </div></body></html>`;
 function tryListen(port, hostname2) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const server = createServer();
     server.once("error", reject);
     server.listen(port, hostname2, () => {
       server.removeListener("error", reject);
-      resolve2(server);
+      resolve3(server);
     });
   });
 }
@@ -942,7 +942,7 @@ async function startLocalAuthServer(options) {
   const successHtml = options.successHtml ?? DEFAULT_SUCCESS_HTML;
   const errorHtml = options.errorHtml ?? DEFAULT_ERROR_HTML;
   const { server, port } = await bindServer(options.preferredPort, hostname2);
-  const result = new Promise((resolve2, reject) => {
+  const result = new Promise((resolve3, reject) => {
     const timer = setTimeout(() => {
       server.close();
       reject(new Error("Timed out waiting for browser authorization."));
@@ -985,7 +985,7 @@ async function startLocalAuthServer(options) {
       res.writeHead(200, { "Content-Type": "text/html" }).end(successHtml);
       clearTimeout(timer);
       server.close();
-      resolve2({ code, state });
+      resolve3({ code, state });
     });
   });
   return { port, result };
@@ -3215,8 +3215,8 @@ function encodeRepoPath2(value) {
   return value.split("/").filter((segment) => segment.length > 0).map((segment) => encodeURIComponent(segment)).join("/");
 }
 function isLikelyRepoFilePath(path) {
-  const basename3 = path.split("/").pop() ?? path;
-  return basename3.includes(".") && !/^\.[^./]+$/.test(basename3);
+  const basename4 = path.split("/").pop() ?? path;
+  return basename4.includes(".") && !/^\.[^./]+$/.test(basename4);
 }
 function buildContentsUrl2(spec, path) {
   const encodedPath = encodeRepoPath2(path);
@@ -3550,7 +3550,7 @@ function formatCommandFailure(command, args, result) {
   return `${command} ${args.join(" ")} failed${result.exitCode >= 0 ? ` with exit code ${result.exitCode}` : ""}${detail ? `: ${detail}` : "."}`;
 }
 async function defaultCommandRunner(command, args) {
-  return await new Promise((resolve2) => {
+  return await new Promise((resolve3) => {
     const child = spawn(command, [...args], {
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
@@ -3565,7 +3565,7 @@ async function defaultCommandRunner(command, args) {
     });
     child.on("error", (error) => {
       const errorCode = typeof error === "object" && error && "code" in error ? String(error.code) : void 0;
-      resolve2({
+      resolve3({
         exitCode: -1,
         stdout,
         stderr,
@@ -3573,7 +3573,7 @@ async function defaultCommandRunner(command, args) {
       });
     });
     child.on("close", (code) => {
-      resolve2({
+      resolve3({
         exitCode: code ?? -1,
         stdout,
         stderr
@@ -6500,8 +6500,634 @@ function loadAiSessionImports(options) {
   };
 }
 
-// src/lib/self-audit.ts
+// src/lib/work-graph-source-adapters.ts
 import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { basename as basename3, join as join5, resolve } from "path";
+var CLIENT_SOURCES = ["claude_code", "codex", "opencode", "goose", "cursor"];
+var DEFAULT_LIMIT_PER_SOURCE2 = 8;
+var DEFAULT_SINCE_DAYS2 = 45;
+var DEFAULT_MAX_BYTES_PER_FILE2 = 2e6;
+var WORK_SIGNAL_PATTERN = /\b(decision|decided|tradeoff|artifact|implemented|created|changed|edited|shipped|verified|test|proof|commit|blocked|blocker|failed|fails|error|timeout|permission|owner|handoff|mcp__|orgx_|tool call|schema|zod|next action|follow[- ]?up|initiative|agent|skill|recipe|workflow|customer|business|launch|deploy)\b/i;
+function parseInvestigationSourceList(value) {
+  if (!value?.trim() || value.trim().toLowerCase() === "manual") return [];
+  const requested = value.split(",").map((item) => item.trim().toLowerCase().replace(/-/g, "_")).filter(Boolean);
+  const expanded = requested.includes("all") ? [...CLIENT_SOURCES] : requested.map((source) => source === "claude" ? "claude_code" : source);
+  const deduped = [...new Set(expanded)];
+  const invalid = deduped.filter((source) => !CLIENT_SOURCES.includes(source));
+  if (invalid.length > 0) {
+    throw new Error(
+      `Unsupported investigation source: ${invalid.join(", ")}. Use claude, codex, opencode, goose, cursor, or all.`
+    );
+  }
+  return deduped;
+}
+function hash(value, length = 24) {
+  return createHash3("sha256").update(JSON.stringify(value)).digest("hex").slice(0, length);
+}
+function expandPath(path, env) {
+  return path.replace(/^~(?=\/|$)/, env.home).replace(/\$CWD/g, env.cwd).replace(/\$HOME/g, env.home);
+}
+function safeStat(path) {
+  try {
+    return statSync4(path);
+  } catch {
+    return null;
+  }
+}
+function walkFiles(root, predicate, maxFiles = 500) {
+  if (!existsSync6(root)) return [];
+  const files = [];
+  const stack = [root];
+  const ignored = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", "dist", "build", ".turbo"]);
+  while (stack.length > 0 && files.length < maxFiles) {
+    const current = stack.pop();
+    if (!current) continue;
+    let entries;
+    try {
+      entries = readdirSync4(current);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (ignored.has(entry)) continue;
+      const path = join5(current, entry);
+      const stats = safeStat(path);
+      if (!stats) continue;
+      if (stats.isDirectory()) {
+        stack.push(path);
+      } else if (stats.isFile() && predicate(path)) {
+        files.push(path);
+      }
+    }
+  }
+  return files;
+}
+function providerForClient(client) {
+  if (client === "claude_code") return "anthropic";
+  if (client === "codex") return "openai";
+  return "unknown";
+}
+function workGraphSourceClient(client) {
+  if (client === "claude_code") return "claude-code";
+  return client;
+}
+function clientLabel(client) {
+  switch (client) {
+    case "claude_code":
+      return "Claude Code sessions";
+    case "codex":
+      return "Codex sessions";
+    case "opencode":
+      return "OpenCode sessions";
+    case "goose":
+      return "goose sessions";
+    case "cursor":
+      return "Cursor workspace evidence";
+  }
+}
+function redactedText(value, limit = 900) {
+  return value.replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[redacted-email]").replace(/\b(?:sk|oxk|ghp|gho|xox[baprs])_[A-Za-z0-9_-]{12,}\b/g, "[redacted-token]").replace(/\s+/g, " ").trim().slice(0, limit);
+}
+function nowWindow(timestamp, now) {
+  const occurred = Date.parse(timestamp);
+  if (!Number.isFinite(occurred)) return "older";
+  const delta = now.getTime() - occurred;
+  if (delta < 5 * 60 * 1e3) return "live";
+  if (delta <= 24 * 60 * 60 * 1e3) return "recent_24h";
+  if (delta <= 7 * 24 * 60 * 60 * 1e3) return "recent_7d";
+  if (delta <= 30 * 24 * 60 * 60 * 1e3) return "recent_30d";
+  return "older";
+}
+function makeRawEvent(input) {
+  const contentHash = hash(input.payload, 64);
+  const uri = `${input.client}:${input.sessionId}:${input.uriSuffix}`;
+  return {
+    event_id: `evt_${hash([uri, contentHash], 24)}`,
+    source_ref: {
+      source_id: input.client,
+      uri,
+      cite_url: null,
+      resolves: true
+    },
+    source_id: input.client,
+    provider: providerForClient(input.client),
+    session_id: input.sessionId,
+    project_id: null,
+    timestamp: input.timestamp,
+    occurred_in_window: nowWindow(input.timestamp, input.now),
+    kind: input.kind,
+    role: input.role,
+    payload: input.payload,
+    raw_byte_offset: input.rawByteOffset ?? null,
+    raw_row_id: input.rawRowId ?? null,
+    content_hash: contentHash,
+    redaction_applied: true
+  };
+}
+function parseJsonLine2(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    return null;
+  }
+}
+function asText2(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    return value.map((item) => {
+      if (typeof item === "string") return item;
+      if (!isRecord(item)) return "";
+      if (typeof item.text === "string") return item.text;
+      if (typeof item.content === "string") return item.content;
+      return "";
+    }).filter(Boolean).join("\n");
+  }
+  if (isRecord(value)) {
+    if (typeof value.text === "string") return value.text;
+    if (typeof value.content === "string") return value.content;
+  }
+  return "";
+}
+function stringField(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return null;
+}
+function timestampFor(record, statsMtime) {
+  if (isRecord(record)) {
+    const timestamp = stringField(record, "timestamp", "created_at", "createdAt", "created", "time");
+    if (timestamp && Number.isFinite(Date.parse(timestamp))) return new Date(timestamp).toISOString();
+    const numeric = record.timestamp ?? record.created_at ?? record.created;
+    if (typeof numeric === "number" && Number.isFinite(numeric)) {
+      return new Date(numeric > 1e10 ? numeric : numeric * 1e3).toISOString();
+    }
+  }
+  return new Date(statsMtime).toISOString();
+}
+function mapCodexRecord(record, fallbackTimestamp) {
+  if (!isRecord(record)) return [];
+  const timestamp = timestampFor(record, Date.parse(fallbackTimestamp));
+  if (record.type === "response_item" && isRecord(record.payload)) {
+    const payload = record.payload;
+    if (payload.type === "message" && (payload.role === "user" || payload.role === "assistant")) {
+      return [{
+        kind: payload.role === "user" ? "user_prompt" : "assistant_text",
+        role: payload.role,
+        text: asText2(payload.content),
+        timestamp
+      }];
+    }
+    if (payload.type === "function_call") {
+      const toolName = stringField(payload, "name", "tool_name") ?? "unknown_tool";
+      return [{
+        kind: toolName.startsWith("mcp__") ? "mcp_tool_call" : "tool_call_start",
+        role: "tool",
+        text: redactedText(JSON.stringify(payload.arguments ?? payload)),
+        toolName,
+        timestamp
+      }];
+    }
+    if (payload.type === "function_call_output") {
+      const text2 = asText2(payload.output) || redactedText(JSON.stringify(payload.output ?? payload));
+      return [{
+        kind: /\berror|failed|exception\b/i.test(text2) ? "tool_call_error" : "tool_call_result",
+        role: "tool",
+        text: text2,
+        timestamp
+      }];
+    }
+    if (payload.type === "reasoning") {
+      return [{ kind: "assistant_reasoning", role: "assistant", text: asText2(payload.content), timestamp }];
+    }
+  }
+  if (record.type === "event_msg" && isRecord(record.payload) && typeof record.payload.message === "string") {
+    return [{ kind: "assistant_text", role: "meta", text: record.payload.message, timestamp }];
+  }
+  return [];
+}
+function mapClaudeRecord(record, fallbackTimestamp) {
+  if (!isRecord(record)) return [];
+  const timestamp = timestampFor(record, Date.parse(fallbackTimestamp));
+  const message = isRecord(record.message) ? record.message : record;
+  const role = message.role === "user" || message.role === "assistant" ? message.role : "meta";
+  const content = message.content;
+  const out = [];
+  if (Array.isArray(content)) {
+    for (const [index, part] of content.entries()) {
+      if (!isRecord(part)) continue;
+      if (part.type === "text" || typeof part.text === "string") {
+        out.push({ kind: role === "user" ? "user_prompt" : "assistant_text", role, text: asText2(part), timestamp });
+      } else if (part.type === "thinking") {
+        out.push({ kind: "assistant_reasoning", role: "assistant", text: asText2(part), timestamp });
+      } else if (part.type === "tool_use") {
+        const toolName = stringField(part, "name") ?? `tool_${index}`;
+        out.push({
+          kind: toolName.startsWith("mcp__") ? "mcp_tool_call" : "tool_call_start",
+          role: "tool",
+          text: redactedText(JSON.stringify(part.input ?? part)),
+          toolName,
+          timestamp
+        });
+      } else if (part.type === "tool_result") {
+        const text3 = asText2(part.content) || redactedText(JSON.stringify(part.content ?? part));
+        out.push({ kind: part.is_error === true ? "tool_call_error" : "tool_call_result", role: "tool", text: text3, timestamp });
+      }
+    }
+    return out;
+  }
+  const text2 = asText2(content);
+  if (text2) out.push({ kind: role === "user" ? "user_prompt" : "assistant_text", role, text: text2, timestamp });
+  return out;
+}
+function readJsonlCandidate(candidate, options) {
+  const stats = safeStat(candidate.path);
+  if (!stats || stats.size > options.maxBytesPerFile) {
+    return {
+      events: [],
+      filesRead: 0,
+      filesSkipped: [{ path: candidate.path, reason: stats ? "schema_version_unsupported" : "permission_denied" }],
+      notes: [],
+      searchedSessions: 0
+    };
+  }
+  const lines = readFileSync4(candidate.path, "utf8").split(/\r?\n/);
+  const fallbackTimestamp = new Date(stats.mtimeMs).toISOString();
+  const sessionId = basename3(candidate.path).replace(/\.[^.]+$/, "");
+  const events = [];
+  for (const [index, line] of lines.entries()) {
+    if (!line.trim()) continue;
+    const record = parseJsonLine2(line);
+    const mapped = candidate.source === "codex" ? mapCodexRecord(record, fallbackTimestamp) : candidate.source === "claude_code" ? mapClaudeRecord(record, fallbackTimestamp) : mapGenericJsonRecord(record, fallbackTimestamp);
+    for (const [partIndex, item] of mapped.entries()) {
+      if (!item.text && !item.toolName) continue;
+      events.push(makeRawEvent({
+        client: candidate.source,
+        kind: item.kind,
+        now: options.now,
+        path: candidate.path,
+        payload: {
+          extraction_mode: candidate.extractionMode,
+          relative_source_path: candidate.path,
+          text_summary: redactedText(item.text),
+          tool_name: item.toolName
+        },
+        rawByteOffset: index,
+        role: item.role,
+        sessionId,
+        timestamp: item.timestamp,
+        uriSuffix: `line:${index}:part:${partIndex}`
+      }));
+    }
+  }
+  return {
+    events,
+    filesRead: 1,
+    filesSkipped: [],
+    notes: [],
+    searchedSessions: 1
+  };
+}
+function mapGenericJsonRecord(record, fallbackTimestamp) {
+  if (!isRecord(record)) return [];
+  const timestamp = timestampFor(record, Date.parse(fallbackTimestamp));
+  const roleValue = record.role === "user" || record.role === "assistant" ? record.role : "meta";
+  const toolName = stringField(record, "tool_name", "toolName", "name");
+  if (toolName) {
+    const text3 = asText2(record.response) || asText2(record.output) || redactedText(JSON.stringify(record));
+    return [{
+      kind: toolName.startsWith("mcp__") ? "mcp_tool_call" : record.success === false ? "tool_call_error" : "tool_call_start",
+      role: "tool",
+      text: text3,
+      toolName,
+      timestamp
+    }];
+  }
+  const text2 = asText2(record.content) || asText2(record.message) || asText2(record.text);
+  if (!text2) return [];
+  return [{
+    kind: roleValue === "user" ? "user_prompt" : "assistant_text",
+    role: roleValue,
+    text: text2,
+    timestamp
+  }];
+}
+function readJsonCandidate(candidate, options) {
+  const stats = safeStat(candidate.path);
+  if (!stats || stats.size > options.maxBytesPerFile) {
+    return {
+      events: [],
+      filesRead: 0,
+      filesSkipped: [{ path: candidate.path, reason: stats ? "schema_version_unsupported" : "permission_denied" }],
+      notes: [],
+      searchedSessions: 0
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(candidate.path, "utf8"));
+  } catch {
+    return {
+      events: [],
+      filesRead: 0,
+      filesSkipped: [{ path: candidate.path, reason: "binary_or_corrupt" }],
+      notes: [],
+      searchedSessions: 0
+    };
+  }
+  const records = flattenPotentialMessages(parsed).slice(0, 800);
+  const fallbackTimestamp = new Date(stats.mtimeMs).toISOString();
+  const sessionId = basename3(candidate.path).replace(/\.[^.]+$/, "");
+  const events = records.flatMap(
+    (record, index) => mapGenericJsonRecord(record, fallbackTimestamp).map(
+      (item, partIndex) => makeRawEvent({
+        client: candidate.source,
+        kind: item.kind,
+        now: options.now,
+        path: candidate.path,
+        payload: {
+          extraction_mode: candidate.extractionMode,
+          relative_source_path: candidate.path,
+          text_summary: redactedText(item.text),
+          tool_name: item.toolName
+        },
+        rawRowId: String(index),
+        role: item.role,
+        sessionId,
+        timestamp: item.timestamp,
+        uriSuffix: `json:${index}:part:${partIndex}`
+      })
+    )
+  );
+  return {
+    events,
+    filesRead: 1,
+    filesSkipped: [],
+    notes: [],
+    searchedSessions: 1
+  };
+}
+function flattenPotentialMessages(value) {
+  const out = [];
+  const visit = (item, depth) => {
+    if (depth > 8 || out.length >= 1e3) return;
+    if (Array.isArray(item)) {
+      for (const child of item) visit(child, depth + 1);
+      return;
+    }
+    if (!isRecord(item)) return;
+    if (typeof item.role === "string" || typeof item.content === "string" || typeof item.text === "string" || typeof item.tool_name === "string" || typeof item.toolName === "string") {
+      out.push(item);
+    }
+    for (const value2 of Object.values(item)) {
+      if (Array.isArray(value2) || isRecord(value2)) visit(value2, depth + 1);
+    }
+  };
+  visit(value, 0);
+  return out;
+}
+function readMarkdownCandidate(candidate, options) {
+  const stats = safeStat(candidate.path);
+  if (!stats || stats.size > options.maxBytesPerFile) {
+    return {
+      events: [],
+      filesRead: 0,
+      filesSkipped: [{ path: candidate.path, reason: stats ? "schema_version_unsupported" : "permission_denied" }],
+      notes: [],
+      searchedSessions: 0
+    };
+  }
+  const text2 = readFileSync4(candidate.path, "utf8");
+  const sessionId = basename3(candidate.path).replace(/\.[^.]+$/, "");
+  const timestamp = new Date(stats.mtimeMs).toISOString();
+  const event = makeRawEvent({
+    client: candidate.source,
+    kind: candidate.path.includes(".cursor/rules") || candidate.path.endsWith(".cursorrules") ? "session_start" : "assistant_text",
+    now: options.now,
+    path: candidate.path,
+    payload: {
+      extraction_mode: candidate.extractionMode,
+      relative_source_path: candidate.path,
+      text_summary: redactedText(text2, 1200),
+      tool_usage_state: candidate.path.includes("mcp.json") ? "configured" : void 0
+    },
+    role: "meta",
+    sessionId,
+    timestamp,
+    uriSuffix: "markdown:0"
+  });
+  return {
+    events: [event],
+    filesRead: 1,
+    filesSkipped: [],
+    notes: candidate.extractionMode === "specstory" ? ["SpecStory evidence is repo-grounded and version-stable."] : [],
+    searchedSessions: 1
+  };
+}
+function discoverCandidates(source, env, sinceMs) {
+  const candidates = [];
+  const addFiles = (paths, extractionMode, predicate) => {
+    for (const rootPattern of paths) {
+      const expanded = expandPath(rootPattern, env);
+      const root = expanded.includes("*") ? expanded.slice(0, expanded.indexOf("*")).replace(/\/$/, "") : expanded;
+      const exactStats = safeStat(expanded);
+      const found = exactStats?.isFile() ? [expanded] : walkFiles(root, predicate);
+      for (const path of found) {
+        const stats = safeStat(path);
+        if (!stats || stats.mtimeMs < sinceMs) continue;
+        candidates.push({ extractionMode, mtimeMs: stats.mtimeMs, path, source });
+      }
+    }
+  };
+  if (source === "codex") {
+    addFiles([CODEX_SESSIONS_DIR], "jsonl", (path) => path.endsWith(".jsonl"));
+  } else if (source === "claude_code") {
+    addFiles([CLAUDE_PROJECTS_DIR], "jsonl", (path) => path.endsWith(".jsonl"));
+  } else if (source === "opencode") {
+    addFiles([
+      "~/.local/share/opencode/storage/session",
+      "~/Library/Application Support/opencode/storage/session"
+    ], "json", (path) => path.endsWith(".json"));
+    addFiles([
+      "~/.local/share/opencode/storage/db.sqlite",
+      "~/Library/Application Support/opencode/storage/db.sqlite"
+    ], "sqlite", (path) => path.endsWith(".sqlite") || path.endsWith(".db"));
+  } else if (source === "goose") {
+    addFiles(["~/.local/share/goose/sessions"], "jsonl", (path) => path.endsWith(".jsonl"));
+    addFiles([
+      "~/.local/share/goose/logs",
+      "~/.local/share/goose/data/sessions/sessions.db"
+    ], "sqlite", (path) => path.endsWith(".db") || /llm_request\.\d+\.jsonl$/.test(path));
+  } else if (source === "cursor") {
+    addFiles(
+      [
+        "$CWD/.specstory/history",
+        "$CWD/.cursor/rules",
+        "$CWD/.cursorrules",
+        "$CWD/.cursor/mcp.json"
+      ],
+      "specstory",
+      (path) => path.endsWith(".md") || path.endsWith(".mdc") || path.endsWith(".json") || path.endsWith(".cursorrules")
+    );
+    addFiles([
+      "~/Library/Application Support/Cursor/User/workspaceStorage",
+      "~/.config/Cursor/User/workspaceStorage"
+    ], "sqlite", (path) => path.endsWith("state.vscdb"));
+  }
+  return candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+function discoverOverrideCandidates(source, root, sinceMs) {
+  const extractionMode = root.endsWith(".json") ? "json" : "jsonl";
+  const files = walkFiles(root, (path) => path.endsWith(".jsonl") || path.endsWith(".json"));
+  const candidates = [];
+  for (const path of files) {
+    const stats = safeStat(path);
+    if (!stats || stats.mtimeMs < sinceMs) continue;
+    candidates.push({ extractionMode, mtimeMs: stats.mtimeMs, path, source });
+  }
+  return candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+function findingTypeFromEvent(event) {
+  const text2 = `${event.payload.text_summary ?? ""}
+${event.payload.tool_name ?? ""}`;
+  if (!WORK_SIGNAL_PATTERN.test(text2)) return null;
+  if (/\b(decision|decided|tradeoff|architecture|approval)\b/i.test(text2)) return "decision";
+  if (/\b(blocked|blocker|failed|fails|error|timeout|permission|schema|zod|invalid)\b/i.test(text2)) return "blocker";
+  if (/\b(artifact|implemented|created|changed|edited|commit|pr|file|shipped|deploy)\b/i.test(text2)) return "artifact";
+  if (/\b(test|verified|proof|outcome|result)\b/i.test(text2)) return "outcome";
+  if (/\b(customer|business|revenue|deal|buyer)\b/i.test(text2)) return "business";
+  if (/\b(agent|skill|recipe|tool|mcp__|orgx_)\b/i.test(text2)) return "missed_orchestration_opportunity";
+  return "action";
+}
+function titleFromEvent(event) {
+  const text2 = redactedText(String(event.payload.text_summary ?? event.payload.tool_name ?? "AI-client work signal"), 240);
+  const first = text2.replace(/^(decision|artifact|blocker|proof|next action|outcome)\s*:\s*/i, "").split(/[.!?]\s/)[0]?.trim();
+  return (first || `${event.source_id} work signal`).slice(0, 110);
+}
+function extractionFromEvents(input) {
+  const findings = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const event of input.events) {
+    const type = findingTypeFromEvent(event);
+    if (!type) continue;
+    const dedupe = `${type}:${titleFromEvent(event).toLowerCase()}`;
+    if (seen.has(dedupe)) continue;
+    seen.add(dedupe);
+    findings.push({
+      type,
+      title: titleFromEvent(event),
+      summary: type === "missed_orchestration_opportunity" && Number(event.payload.tool_name ? 1 : 0) === 0 ? "The client evidence mentions agent/tool workflow but does not prove an invocation event." : redactedText(String(event.payload.text_summary ?? "Client work signal"), 260),
+      source_client: workGraphSourceClient(input.client),
+      source_id: event.session_id,
+      source_label: clientLabel(input.client),
+      evidence_ref: event.source_ref.uri,
+      confidence: event.kind === "mcp_tool_call" || event.kind === "tool_call_start" ? 0.82 : 0.68,
+      occurred_at: event.timestamp,
+      redacted_verbatim: redactedText(String(event.payload.text_summary ?? ""), 360),
+      privacy_state: "redacted",
+      metadata: {
+        event_id: event.event_id,
+        event_kind: event.kind,
+        extraction_mode: event.payload.extraction_mode,
+        provider: event.provider,
+        tool_name: event.payload.tool_name
+      }
+    });
+    if (findings.length >= 50) break;
+  }
+  return {
+    schema_version: "2.0.0.investigation",
+    extraction_id: `${input.client}:investigation:${hash([input.client, input.events.map((event) => event.event_id)], 12)}`,
+    source_client: workGraphSourceClient(input.client),
+    source_label: clientLabel(input.client),
+    searched_sources: [...new Set(input.events.map((event) => String(event.payload.relative_source_path ?? event.session_id)))].slice(0, 30),
+    search_queries: [
+      {
+        id: "full_session_inventory",
+        lens: "Full-session deterministic inventory",
+        query: "Read messages, tool calls, commands, configs, and repo-grounded session artifacts before deriving loop candidates.",
+        result_count: input.events.length
+      }
+    ],
+    extraction_quality: {
+      confidence: findings.length > 0 ? 0.74 : input.filesRead > 0 ? 0.32 : 0.18,
+      searched_session_count: Math.max(input.filesRead, new Set(input.events.map((event) => event.session_id)).size),
+      skipped_session_count: input.filesSkipped.length,
+      notes: [
+        ...input.notes,
+        `${input.events.length} normalized raw events; ${findings.length} public-safe loop candidates.`,
+        ...input.filesSkipped.map((file) => `Skipped ${file.path}: ${file.reason}`)
+      ]
+    },
+    findings
+  };
+}
+function loadWorkGraphInvestigationSourceData(options) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const env = {
+    cwd: options.cwd ? resolve(options.cwd) : process.cwd(),
+    home: options.home ?? homedir2()
+  };
+  const sinceMs = now.getTime() - (options.sinceDays ?? DEFAULT_SINCE_DAYS2) * 24 * 60 * 60 * 1e3;
+  const limit = Math.max(1, options.limitPerSource ?? DEFAULT_LIMIT_PER_SOURCE2);
+  const maxBytesPerFile = Math.max(1, options.maxBytesPerFile ?? DEFAULT_MAX_BYTES_PER_FILE2);
+  const rawEvents = [];
+  const clientExtractions = [];
+  const connectedSources = [];
+  const missingSources = [];
+  const sourceOverrides = /* @__PURE__ */ new Map();
+  if (options.codexSessionsDir) sourceOverrides.set("codex", resolve(options.codexSessionsDir));
+  if (options.claudeProjectsDir) sourceOverrides.set("claude_code", resolve(options.claudeProjectsDir));
+  for (const source of options.sources) {
+    const overrideRoot = sourceOverrides.get(source);
+    const candidates = (overrideRoot ? discoverOverrideCandidates(source, overrideRoot, sinceMs) : discoverCandidates(source, env, sinceMs)).slice(0, limit);
+    if (candidates.length === 0) {
+      missingSources.push(`${clientLabel(source)} store`);
+      continue;
+    }
+    const sourceEvents = [];
+    const filesSkipped = [];
+    let filesRead = 0;
+    const notes = [];
+    for (const candidate of candidates) {
+      if (candidate.extractionMode === "sqlite") {
+        filesSkipped.push({ path: candidate.path, reason: "schema_version_unsupported" });
+        notes.push(`${candidate.path} detected; SQLite extraction is reserved for the cloud/runtime adapter reader.`);
+        continue;
+      }
+      const result = candidate.path.endsWith(".jsonl") ? readJsonlCandidate(candidate, { maxBytesPerFile, now }) : candidate.path.endsWith(".json") && !candidate.path.endsWith("mcp.json") ? readJsonCandidate(candidate, { maxBytesPerFile, now }) : readMarkdownCandidate(candidate, { maxBytesPerFile, now });
+      sourceEvents.push(...result.events);
+      filesRead += result.filesRead;
+      filesSkipped.push(...result.filesSkipped);
+      notes.push(...result.notes);
+    }
+    rawEvents.push(...sourceEvents);
+    clientExtractions.push(extractionFromEvents({
+      client: source,
+      events: sourceEvents,
+      filesRead,
+      filesSkipped,
+      notes
+    }));
+    if (sourceEvents.length > 0 || filesRead > 0) {
+      connectedSources.push(clientLabel(source));
+    } else {
+      missingSources.push(`${clientLabel(source)} readable events`);
+    }
+  }
+  return {
+    clientExtractions,
+    connectedSources: [...new Set(connectedSources)],
+    missingSources: [...new Set(missingSources)],
+    rawEvents
+  };
+}
+
+// src/lib/self-audit.ts
+import { createHash as createHash4 } from "crypto";
 var SELF_AUDIT_SCHEMA_VERSION = "2026-04-27";
 var AUDIT_DIMENSIONS = [
   "queryability",
@@ -6668,7 +7294,7 @@ function buildSelfCritique(scores) {
   });
 }
 function hashPlanPayload(payload) {
-  return createHash3("sha256").update(JSON.stringify(payload)).digest("hex");
+  return createHash4("sha256").update(JSON.stringify(payload)).digest("hex");
 }
 function buildSelfAuditPlan(input) {
   if (input.imports.length === 0) {
@@ -6998,10 +7624,1086 @@ Rollback: ${plan.recommended_follow_up.rollback}`,
 }
 
 // src/lib/work-graph.ts
-import { createHash as createHash4 } from "crypto";
-var WORK_GRAPH_SCHEMA_VERSION = "2026-05-07";
+import { createHash as createHash6 } from "crypto";
+
+// src/lib/work-graph-investigation.ts
+import { createHash as createHash5 } from "crypto";
+var WORK_GRAPH_INVESTIGATION_SCHEMA_VERSION = "2.0.0";
+var WORK_GRAPH_INVESTIGATION_CLIENTS = [
+  "claude_code",
+  "codex",
+  "opencode",
+  "goose",
+  "cursor",
+  "github",
+  "slack",
+  "orgx_runtime_hook"
+];
+var BRANDS = {
+  claude_code: {
+    name: "Claude Code",
+    simple_icons: "anthropic",
+    color: "#D97757",
+    logo_kind: "wordmark+symbol"
+  },
+  codex: {
+    name: "Codex",
+    simple_icons: "openai",
+    color: "#10A37F",
+    logo_kind: "wordmark+symbol"
+  },
+  opencode: {
+    name: "OpenCode",
+    simple_icons: null,
+    color: "#1A1A1A",
+    logo_kind: "wordmark",
+    asset_path: "/brands/opencode.svg"
+  },
+  goose: {
+    name: "goose",
+    simple_icons: null,
+    color: "#FCBF49",
+    logo_kind: "wordmark+symbol",
+    asset_path: "/brands/goose.svg"
+  },
+  cursor: {
+    name: "Cursor",
+    simple_icons: null,
+    color: "#FFFFFF",
+    logo_kind: "wordmark+symbol",
+    asset_path: "/brands/cursor.svg"
+  },
+  github: {
+    name: "GitHub",
+    simple_icons: "github",
+    color: "#181717",
+    logo_kind: "symbol"
+  },
+  slack: {
+    name: "Slack",
+    simple_icons: "slack",
+    color: "#4A154B",
+    logo_kind: "wordmark+symbol"
+  },
+  orgx_runtime_hook: {
+    name: "OrgX Runtime",
+    simple_icons: null,
+    color: "#00C9A7",
+    logo_kind: "wordmark+symbol",
+    asset_path: "/brands/orgx.svg"
+  }
+};
+var CAPABILITY_CEILINGS = {
+  claude_code: {
+    chronology: "high",
+    ownership: "none",
+    verification: "low",
+    handoff: "medium",
+    customer_context: "none",
+    decision_lineage: "medium"
+  },
+  codex: {
+    chronology: "high",
+    ownership: "none",
+    verification: "low",
+    handoff: "medium",
+    customer_context: "none",
+    decision_lineage: "medium"
+  },
+  opencode: {
+    chronology: "high",
+    ownership: "none",
+    verification: "medium",
+    handoff: "medium",
+    customer_context: "none",
+    decision_lineage: "high"
+  },
+  goose: {
+    chronology: "high",
+    ownership: "low",
+    verification: "medium",
+    handoff: "low",
+    customer_context: "low",
+    decision_lineage: "high"
+  },
+  cursor: {
+    chronology: "medium",
+    ownership: "none",
+    verification: "low",
+    handoff: "low",
+    customer_context: "none",
+    decision_lineage: "medium"
+  },
+  github: {
+    chronology: "high",
+    ownership: "high",
+    verification: "high",
+    handoff: "none",
+    customer_context: "low",
+    decision_lineage: "medium"
+  },
+  slack: {
+    chronology: "medium",
+    ownership: "high",
+    verification: "none",
+    handoff: "high",
+    customer_context: "high",
+    decision_lineage: "low"
+  },
+  orgx_runtime_hook: {
+    chronology: "high",
+    ownership: "medium",
+    verification: "high",
+    handoff: "high",
+    customer_context: "none",
+    decision_lineage: "high"
+  }
+};
+function hash2(value, length = 16) {
+  return createHash5("sha256").update(JSON.stringify(value)).digest("hex").slice(0, length);
+}
+function clamp(value, min = 0, max = 1) {
+  return Math.max(min, Math.min(max, value));
+}
+function countBy(values) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const value of values) counts.set(value, (counts.get(value) ?? 0) + 1);
+  return [...counts.entries()].map(([key, count]) => ({ key, count }));
+}
+function normalizeClient(value) {
+  const lower = value.toLowerCase().replace(/-/g, "_");
+  if (lower.includes("claude")) return "claude_code";
+  if (lower.includes("codex") || lower.includes("openai")) return "codex";
+  if (lower.includes("cursor")) return "cursor";
+  if (lower.includes("opencode")) return "opencode";
+  if (lower.includes("goose")) return "goose";
+  if (lower.includes("github") || lower === "git") return "github";
+  if (lower.includes("slack")) return "slack";
+  if (lower.includes("hook") || lower.includes("runtime") || lower.includes("mcp")) return "orgx_runtime_hook";
+  return "codex";
+}
+function providerForClient2(client) {
+  if (client === "claude_code") return "anthropic";
+  if (client === "codex") return "openai";
+  return "unknown";
+}
+function eventKindForFinding(finding) {
+  if (finding.type === "decision") return "assistant_reasoning";
+  if (finding.type === "artifact") return "file_edit";
+  if (finding.type === "blocker") return "tool_call_error";
+  if (finding.type === "outcome") return "test_run";
+  if (finding.type === "missed_orchestration_opportunity") return "mcp_tool_call";
+  return "assistant_text";
+}
+function windowFor(timestamp, now) {
+  const occurred = Date.parse(timestamp);
+  const current = Date.parse(now);
+  if (!Number.isFinite(occurred) || !Number.isFinite(current)) return "older";
+  const delta = current - occurred;
+  if (delta < 5 * 60 * 1e3) return "live";
+  if (delta <= 24 * 60 * 60 * 1e3) return "recent_24h";
+  if (delta <= 7 * 24 * 60 * 60 * 1e3) return "recent_7d";
+  if (delta <= 30 * 24 * 60 * 60 * 1e3) return "recent_30d";
+  return "older";
+}
+function rawEventFromFinding(finding, index, generatedAt) {
+  const sourceClient = normalizeClient(finding.source_client);
+  const timestamp = typeof finding.metadata.occurred_at === "string" ? finding.metadata.occurred_at : generatedAt;
+  const eventId = `evt_${hash2([finding.evidence_ref, finding.title, index], 24)}`;
+  const payload = {
+    title: finding.title,
+    summary: finding.summary,
+    finding_type: finding.type,
+    source_id: finding.source_id,
+    confidence: finding.confidence,
+    redacted_verbatim: typeof finding.metadata.redacted_verbatim === "string" ? finding.metadata.redacted_verbatim : finding.summary.slice(0, 420)
+  };
+  return {
+    event_id: eventId,
+    source_ref: {
+      source_id: sourceClient,
+      uri: finding.evidence_ref,
+      cite_url: null,
+      resolves: true
+    },
+    source_id: sourceClient,
+    provider: providerForClient2(sourceClient),
+    session_id: finding.source_id,
+    project_id: null,
+    timestamp,
+    occurred_in_window: windowFor(timestamp, generatedAt),
+    kind: eventKindForFinding(finding),
+    role: finding.type === "blocker" ? "tool" : "meta",
+    payload,
+    raw_byte_offset: null,
+    raw_row_id: null,
+    content_hash: hash2(payload, 64),
+    redaction_applied: true
+  };
+}
+function rawEventFromSourceEvent(event, index, generatedAt) {
+  const sourceClient = normalizeClient(event.source_client);
+  const payload = {
+    source_label: event.source_label,
+    event_type: event.event_type,
+    text_summary: event.text.slice(0, 420)
+  };
+  return {
+    event_id: `evt_${hash2([event.evidence_ref, index], 24)}`,
+    source_ref: {
+      source_id: sourceClient,
+      uri: event.evidence_ref,
+      cite_url: null,
+      resolves: true
+    },
+    source_id: sourceClient,
+    provider: providerForClient2(sourceClient),
+    session_id: event.source_id,
+    project_id: null,
+    timestamp: generatedAt,
+    occurred_in_window: "live",
+    kind: event.event_type === "tool_signal" ? "tool_call_start" : "assistant_text",
+    role: "meta",
+    payload,
+    raw_byte_offset: null,
+    raw_row_id: null,
+    content_hash: hash2(payload, 64),
+    redaction_applied: true
+  };
+}
+function buildRawEvents(input) {
+  const sourceEvents = input.events.map(
+    (event, index) => rawEventFromSourceEvent(event, index, input.generatedAt)
+  );
+  const findingEvents = input.findings.map(
+    (finding, index) => rawEventFromFinding(finding, index, input.generatedAt)
+  );
+  const byUri = /* @__PURE__ */ new Map();
+  for (const event of [...input.rawEvents ?? [], ...sourceEvents, ...findingEvents]) {
+    byUri.set(event.event_id || `${event.source_ref.uri}:${event.kind}`, event);
+  }
+  return [...byUri.values()].sort(
+    (left, right) => left.timestamp.localeCompare(right.timestamp)
+  );
+}
+function eventsForRefs(events, refs) {
+  const refSet = new Set(refs);
+  return events.filter((event) => refSet.has(event.source_ref.uri));
+}
+function intentClassForFinding(finding) {
+  const text2 = `${finding.title}
+${finding.summary}`;
+  if (finding.type === "decision") return "architecture_decision";
+  if (finding.type === "artifact" || /\b(implemented|built|created|shipped)\b/i.test(text2)) {
+    return "feature_implementation";
+  }
+  if (/\b(test|qa|verified|proof)\b/i.test(text2)) return "verification_or_testing";
+  if (/\b(auth|config|mcp|source|connect|integration|hook)\b/i.test(text2)) {
+    return "integration_or_connection";
+  }
+  if (/\b(refactor|cleanup|rename|remove)\b/i.test(text2)) return "cleanup_or_refactor";
+  if (/\b(doc|readme|methodology|runbook)\b/i.test(text2)) return "documentation";
+  if (finding.type === "blocker" && /\bbug|error|fail|zod|schema\b/i.test(text2)) return "bug_fix";
+  if (finding.type === "blocker") return "investigation";
+  return "unclear";
+}
+function bottleneckClassForText(text2) {
+  if (/\bzod\b|schema|validation|expected .* received/i.test(text2)) return "schema_validation";
+  if (/permission|approval|denied|unauthorized|401|403/i.test(text2)) return "permission_denied";
+  if (/missing arg|wrong type|tool.*misconfigured|invalid/i.test(text2)) return "tool_misconfigured";
+  if (/context overflow|compaction|too large/i.test(text2)) return "context_overflow";
+  if (/auth|billing|quota|402|api key|token/i.test(text2)) return "auth_or_billing";
+  if (/dispatch|race|not dispatched|ready stream/i.test(text2)) return "race_or_dispatch";
+  if (/cross.repo|repo boundary|vendored|mirror/i.test(text2)) return "cross_repo_dependency";
+  if (/external|api failed|timeout|timed out/i.test(text2)) return "external_api_failure";
+  if (/owner|handoff|dri|approval/i.test(text2)) return "human_handoff_missing";
+  return null;
+}
+function terminalForTrail(trail) {
+  if (trail.state === "verified" || trail.valence === "healthy") {
+    return {
+      state: "shipped",
+      proof: trail.evidence_refs[0] ? { kind: "inferred_only", ref: trail.evidence_refs[0] } : { kind: "inferred_only" },
+      classified_by: "deterministic",
+      classification_basis: ["verified_or_healthy_trail_state"]
+    };
+  }
+  if (trail.state === "blocked" || trail.valence === "risk" || trail.valence === "escalating") {
+    return {
+      state: "blocked",
+      proof: { kind: "absent", expected_kind: "owner_visible_resolution" },
+      classified_by: "deterministic",
+      classification_basis: ["blocked_or_escalating_trail_state"]
+    };
+  }
+  if (trail.state === "stale" || trail.state === "decaying") {
+    return {
+      state: "abandoned",
+      proof: { kind: "absent", expected_kind: "later_resolution_event" },
+      classified_by: "deterministic",
+      classification_basis: ["stale_or_decaying_trail_state"]
+    };
+  }
+  return {
+    state: "ongoing",
+    proof: trail.evidence_refs[0] ? { kind: "inferred_only", ref: trail.evidence_refs[0] } : { kind: "inferred_only" },
+    classified_by: "hybrid",
+    classification_basis: ["no_deterministic_terminal_event"]
+  };
+}
+function buildWorkLoops(input) {
+  const findingsByRef = new Map(input.findings.map((finding) => [finding.evidence_ref, finding]));
+  return input.trails.map((trail, index) => {
+    const matchedEvents = eventsForRefs(input.events, trail.evidence_refs);
+    const matchedFindings = trail.evidence_refs.map((ref) => findingsByRef.get(ref)).filter((finding) => Boolean(finding));
+    const firstFinding = matchedFindings[0];
+    const eventIds = matchedEvents.map((event) => event.event_id);
+    const text2 = [
+      trail.title,
+      trail.summary,
+      ...matchedFindings.map((finding) => finding.summary)
+    ].join("\n");
+    const bottleneck = bottleneckClassForText(text2);
+    const terminal = terminalForTrail(trail);
+    const confidence = clamp(
+      trail.confidence || matchedFindings.reduce((total, finding) => total + finding.confidence, 0) / Math.max(1, matchedFindings.length)
+    );
+    return {
+      loop_id: `loop_${hash2([trail.id, index], 18)}`,
+      cites: eventIds,
+      origin: {
+        event_id: eventIds[0] ?? `evt_missing_${index}`,
+        timestamp: matchedEvents[0]?.timestamp ?? trail.created_at,
+        intent: trail.title.slice(0, 160),
+        intent_class: firstFinding ? intentClassForFinding(firstFinding) : "unclear"
+      },
+      path: {
+        event_ids: eventIds,
+        actions_taken: matchedEvents.map((event) => ({
+          kind: event.kind,
+          label: String(event.payload.title ?? event.kind).slice(0, 120),
+          event_id: event.event_id
+        })),
+        sessions_spanned: [...new Set(matchedEvents.map((event) => event.session_id))],
+        tools_used: matchedEvents.filter((event) => event.kind === "tool_call_start" || event.kind === "mcp_tool_call").map((event) => String(event.payload.tool_name ?? event.payload.title ?? "unknown_tool")),
+        span_minutes: Math.max(1, matchedEvents.length * 12)
+      },
+      terminal,
+      bottleneck: {
+        class: bottleneck,
+        evidence_event_ids: bottleneck ? eventIds : []
+      },
+      recurrence: {
+        family_id: null,
+        appearances_in_family: 1,
+        is_first_appearance: true,
+        decay_half_life_days: terminal.state === "blocked" ? 3 : null
+      },
+      confidence,
+      survived_critic: confidence >= 0.6 && eventIds.length > 0,
+      public_surface: confidence >= 0.6 && eventIds.length > 0
+    };
+  });
+}
+function loopFamilyKey(loop) {
+  return [
+    loop.origin.intent_class,
+    loop.terminal.state,
+    loop.bottleneck.class ?? "none"
+  ].join(":");
+}
+function shapeForFamily(loops) {
+  if (loops.length <= 1) return "single_signal";
+  if (loops.some((loop) => loop.terminal.state === "shipped")) return "decaying_resolved";
+  if (loops.some((loop) => loop.bottleneck.class)) return loops.length >= 3 ? "accelerating" : "dense_recent_cluster";
+  return loops.length >= 4 ? "chronic_evenly_spaced" : "dense_recent_cluster";
+}
+function repairForFamily(familyLoops, impact) {
+  const top = familyLoops[0];
+  const title = top?.origin.intent ?? "Investigate work loop";
+  const bottleneck = top?.bottleneck.class;
+  const capability = bottleneck === "human_handoff_missing" ? "mcp__orgx__assign_owner" : bottleneck ? "mcp__orgx__create_blocker" : top?.origin.intent_class === "architecture_decision" ? "mcp__orgx__create_decision" : "mcp__orgx__scaffold_initiative";
+  return {
+    named_orgx_capability: capability,
+    expected_tool_call_args: {
+      title,
+      source: "work_graph_investigation",
+      evidence_event_ids: familyLoops.flatMap((loop) => loop.cites).slice(0, 12),
+      terminal_state: top?.terminal.state ?? "ongoing",
+      bottleneck_class: bottleneck ?? null
+    },
+    expected_outcome: "OrgX would create an owner-visible record tied to the source evidence, then suppress duplicate rediscovery until it is reopened.",
+    expected_score_lift: [
+      { dimension: "chronology_depth", delta: Math.min(18, familyLoops.length * 3) },
+      { dimension: "repair_actionability", delta: capability.includes("scaffold") ? 12 : 16 }
+    ],
+    expected_hours_recovered: Number(Math.min(impact.time_saved_hours_per_week, familyLoops.length * 0.75).toFixed(1)),
+    expected_dollars_recovered: Math.round(Math.min(impact.estimated_monthly_value_usd, familyLoops.length * 0.75 * 4.33 * 200)),
+    preconditions: ["claim_profile", "confirm_or_correct_evidence"]
+  };
+}
+function buildLoopFamilies(loops, events, impact) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const loop of loops) {
+    const key = loopFamilyKey(loop);
+    grouped.set(key, [...grouped.get(key) ?? [], loop]);
+  }
+  const families = [...grouped.entries()].map(([key, group]) => {
+    const sourceIds = new Set(
+      group.flatMap(
+        (loop) => loop.cites.map((cite) => events.find((event) => event.event_id === cite)?.source_id).filter(Boolean)
+      )
+    );
+    const familyId = `family_${hash2(key, 16)}`;
+    const timestamps = group.map((loop) => Date.parse(loop.origin.timestamp)).filter(Number.isFinite);
+    const spanDays = timestamps.length > 1 ? Math.max(1, Math.ceil((Math.max(...timestamps) - Math.min(...timestamps)) / 864e5)) : 0;
+    const divergenceScore = group.length >= 3 ? 0.32 : 0.5;
+    return {
+      family_id: familyId,
+      shared_intent_class: group[0]?.origin.intent_class ?? "unclear",
+      shared_terminal_state: group[0]?.terminal.state ?? "ongoing",
+      shared_bottleneck_class: group[0]?.bottleneck.class ?? null,
+      loop_ids: group.map((loop) => loop.loop_id),
+      appearances: group.length,
+      span_days: spanDays,
+      shape: shapeForFamily(group),
+      semantic_centroid: group[0]?.origin.intent ?? "Work loop family",
+      divergence_score: divergenceScore,
+      cross_source_confluence: sourceIds.size >= 2,
+      orgx_repair: repairForFamily(group, impact),
+      alternative_explanations_considered: [
+        "The loops may be related only by vocabulary.",
+        "The apparent recurrence may be a planned multi-step implementation rather than unresolved work."
+      ],
+      alternative_rejected_because: group.length >= 3 ? ["Shared intent class, terminal state, and bottleneck class recur across multiple evidence events."] : ["Kept as a non-public single/weak family until more chronology exists."],
+      survived_critic: group.length >= 3 && divergenceScore < 0.5,
+      public_surface: group.length >= 3 && divergenceScore < 0.5
+    };
+  });
+  const familyMap = new Map(families.map((family) => [family.family_id, family]));
+  for (const family of families) {
+    for (const loopId of family.loop_ids) {
+      const loop = loops.find((candidate) => candidate.loop_id === loopId);
+      if (!loop) continue;
+      loop.recurrence.family_id = family.family_id;
+      loop.recurrence.appearances_in_family = family.appearances;
+      loop.recurrence.is_first_appearance = family.loop_ids[0] === loop.loop_id;
+    }
+  }
+  return [...familyMap.values()].sort((left, right) => right.appearances - left.appearances);
+}
+function buildUsageCatalogue(events, findings) {
+  const toolEvents = events.filter((event) => event.kind === "tool_call_start" || event.kind === "mcp_tool_call");
+  const mcpToolNames = /* @__PURE__ */ new Map();
+  for (const event of toolEvents) {
+    const text2 = `${event.payload.title ?? ""}
+${event.payload.summary ?? ""}
+${event.payload.text_summary ?? ""}`;
+    const match = text2.match(/\b(?:mcp__[\w-]+__[\w-]+|orgx_[\w-]+|complete_with_proof|ship_batch|record_outcome|scaffold_initiative)\b/i);
+    const name = match?.[0] ?? "unknown_tool";
+    mcpToolNames.set(name, [...mcpToolNames.get(name) ?? [], event]);
+  }
+  const mentionedTools = /* @__PURE__ */ new Set();
+  for (const finding of findings) {
+    const matches = `${finding.title}
+${finding.summary}`.matchAll(/\b(?:mcp__[\w-]+__[\w-]+|orgx_[\w-]+|complete_with_proof|ship_batch|record_outcome|scaffold_initiative)\b/gi);
+    for (const match of matches) mentionedTools.add(match[0]);
+  }
+  const configuredOrgxEvents = events.filter(
+    (event) => event.payload.tool_usage_state === "configured" && /\borgx\b|mcp/i.test(JSON.stringify(event.payload))
+  );
+  const shouldHaveInvoked = findings.filter(
+    (finding) => finding.type === "missed_orchestration_opportunity" || /\bshould have|available but not called|not invoked|writeback\b/i.test(`${finding.title}
+${finding.summary}`)
+  );
+  const mcp_tools = [
+    ...[...mcpToolNames.entries()].map(([name, matchingEvents]) => ({
+      name,
+      namespace: name.startsWith("mcp__") ? name.split("__")[1] ?? "unknown" : "orgx",
+      state: matchingEvents.length > 0 ? "invoked" : "mentioned",
+      invocations: matchingEvents.length,
+      success: matchingEvents.filter((event) => event.kind === "tool_call_result").length,
+      error: matchingEvents.filter((event) => event.kind === "tool_call_error").length,
+      error_classes: [],
+      by_source: countBy(matchingEvents.map((event) => event.source_id)).map(({ key, count }) => ({
+        source_id: key,
+        count
+      })),
+      event_refs: matchingEvents.map((event) => event.event_id)
+    })),
+    ...[...mentionedTools].filter((name) => !mcpToolNames.has(name)).map((name) => ({
+      name,
+      namespace: name.startsWith("mcp__") ? name.split("__")[1] ?? "unknown" : "orgx",
+      state: "mentioned",
+      invocations: 0,
+      success: 0,
+      error: 0,
+      error_classes: [],
+      by_source: [],
+      event_refs: []
+    })),
+    ...configuredOrgxEvents.length > 0 && !mcpToolNames.has("mcp__orgx__configured") ? [{
+      name: "mcp__orgx__configured",
+      namespace: "orgx",
+      state: "configured",
+      invocations: 0,
+      success: 0,
+      error: 0,
+      error_classes: [],
+      by_source: countBy(configuredOrgxEvents.map((event) => event.source_id)).map(({ key, count }) => ({
+        source_id: key,
+        count
+      })),
+      event_refs: configuredOrgxEvents.map((event) => event.event_id)
+    }] : [],
+    ...shouldHaveInvoked.length > 0 && !mcpToolNames.has("mcp__orgx__create_decision") ? [{
+      name: "mcp__orgx__create_decision",
+      namespace: "orgx",
+      state: "should_have_invoked",
+      invocations: 0,
+      success: 0,
+      error: 0,
+      error_classes: [],
+      by_source: [],
+      event_refs: []
+    }] : []
+  ];
+  const ai_clients = WORK_GRAPH_INVESTIGATION_CLIENTS.slice(0, 5).map((sourceId) => {
+    const sourceEvents = events.filter((event) => event.source_id === sourceId);
+    return {
+      source_id: sourceId,
+      sessions: new Set(sourceEvents.map((event) => event.session_id)).size,
+      turns: sourceEvents.filter((event) => event.kind === "user_prompt" || event.kind === "assistant_text").length
+    };
+  });
+  return {
+    ai_clients,
+    mcp_tools,
+    mcp_namespaces_seen: [...new Set(mcp_tools.map((tool) => tool.namespace))],
+    shell_commands: [],
+    recipes_or_skills: findings.filter((finding) => /\bskill|recipe|agent\b/i.test(`${finding.title}
+${finding.summary}`)).slice(0, 20).map((finding) => ({
+      source_id: normalizeClient(finding.source_client),
+      name: finding.title.slice(0, 80),
+      invocations: 0,
+      last_used: typeof finding.metadata.occurred_at === "string" ? finding.metadata.occurred_at : (/* @__PURE__ */ new Date()).toISOString()
+    })),
+    agents_observed: ai_clients.filter((client) => client.sessions > 0).map((client) => ({
+      source_id: client.source_id,
+      name: BRANDS[client.source_id].name,
+      spawn_count: client.sessions,
+      success_count: 0
+    })),
+    repo_paths_touched: [],
+    external_sources_called: []
+  };
+}
+function capabilityCellsFor(input) {
+  const ceilings = CAPABILITY_CEILINGS[input.sourceId];
+  const sourceEvents = input.events.filter((event) => event.source_id === input.sourceId);
+  const achievedBase = input.status === "connected" ? 0.68 : input.status === "partial" ? 0.42 : input.status === "detected_not_read" ? 0.16 : 0;
+  const hasToolState = sourceEvents.some((event) => event.kind.includes("tool"));
+  const hasVerification = sourceEvents.some((event) => event.kind === "test_run" || event.kind === "commit");
+  const hasHandoff = sourceEvents.some((event) => /handoff|owner|approval/i.test(JSON.stringify(event.payload)));
+  return Object.fromEntries(
+    Object.keys(ceilings).map((dimension) => {
+      const ceiling = ceilings[dimension];
+      const boost = dimension === "decision_lineage" && hasToolState || dimension === "verification" && hasVerification || dimension === "handoff" && hasHandoff ? 0.18 : 0;
+      const achieved = ceiling === "none" ? 0 : clamp(achievedBase + boost);
+      return [
+        dimension,
+        {
+          ceiling,
+          achieved,
+          basis: sourceEvents.length > 0 ? `${sourceEvents.length} normalized raw event${sourceEvents.length === 1 ? "" : "s"}` : input.status === "missing" ? "Source supported but not connected for this audit" : "Source detected without enough readable evidence",
+          blockers_to_full: achieved >= 0.8 ? [] : [
+            dimension === "verification" ? "connect_github_or_runtime_hook" : dimension === "ownership" || dimension === "handoff" ? "connect_slack_or_claim_profile" : "deepen_native_session_events"
+          ]
+        }
+      ];
+    })
+  );
+}
+function buildCorpusManifest(input) {
+  const manifests = WORK_GRAPH_INVESTIGATION_CLIENTS.map((sourceId) => {
+    const sourceEvents = input.events.filter((event) => event.source_id === sourceId);
+    const matchingExtraction = input.clientExtractions.find(
+      (extraction) => normalizeClient(extraction.source_client) === sourceId
+    );
+    const coverageManifest = input.coverage.manifests?.find(
+      (manifest) => normalizeClient(manifest.source_client) === sourceId
+    );
+    const status = sourceEvents.length > 0 || matchingExtraction && matchingExtraction.finding_count > 0 || coverageManifest?.status === "connected" ? "connected" : matchingExtraction ? "detected_not_read" : coverageManifest?.status === "partial" ? "partial" : input.coverage.missing.some((source) => normalizeClient(source) === sourceId) ? "missing" : "supported_not_connected";
+    const skipped = coverageManifest?.skipped_session_count ? [{ reason: "no_entity_references", count: coverageManifest.skipped_session_count }] : [];
+    const cells = capabilityCellsFor({ sourceId, status, events: input.events });
+    const sourceSessionCount = new Set(sourceEvents.map((event) => event.session_id)).size;
+    return {
+      source_id: sourceId,
+      brand: BRANDS[sourceId],
+      client: sourceId,
+      provider: providerForClient2(sourceId),
+      status,
+      extraction_mode: sourceId === "opencode" || sourceId === "goose" ? "sqlite" : sourceId === "cursor" ? "specstory" : sourceId === "orgx_runtime_hook" ? "orgx_runtime_hook" : "jsonl",
+      storage_paths_resolved: coverageManifest?.searched_sources ?? [],
+      storage_version_detected: null,
+      files_seen: coverageManifest?.searched_session_count ?? matchingExtraction?.searched_session_count ?? sourceSessionCount,
+      files_read: sourceEvents.length > 0 ? Math.max(1, sourceSessionCount) : 0,
+      files_skipped: skipped,
+      sessions: sourceSessionCount || matchingExtraction?.searched_session_count || coverageManifest?.searched_session_count || 0,
+      message_turns: sourceEvents.filter((event) => event.kind === "user_prompt" || event.kind === "assistant_text").length || (sourceId === "codex" || sourceId === "claude_code" ? input.auditMethod.searched_message_count : 0),
+      tool_calls: sourceEvents.filter((event) => event.kind === "tool_call_start").length,
+      mcp_tool_calls: sourceEvents.filter((event) => event.kind === "mcp_tool_call").length,
+      capability_cells: cells
+    };
+  });
+  const timestamps = input.events.map((event) => event.timestamp).sort();
+  const filesSeen = manifests.reduce((total, source) => total + source.files_seen, 0);
+  const filesRead = manifests.reduce((total, source) => total + source.files_read, 0);
+  const filesSkipped = manifests.reduce(
+    (total, source) => total + source.files_skipped.reduce((sum, skipped) => sum + skipped.count, 0),
+    0
+  );
+  const sessions = manifests.reduce((total, source) => total + source.sessions, 0);
+  return {
+    audit_id: input.auditId,
+    ran_at: input.generatedAt,
+    sources: manifests,
+    totals: {
+      files_seen: Math.max(filesSeen, input.auditMethod.searched_session_files),
+      files_read: Math.max(filesRead, input.auditMethod.searched_session_files - input.auditMethod.skipped_session_files),
+      files_skipped: Math.max(filesSkipped, input.auditMethod.skipped_session_files),
+      bytes_read: 0,
+      sessions: Math.max(sessions, input.auditMethod.searched_session_files),
+      sessions_skipped: input.auditMethod.skipped_session_files ? [{ reason: "no_entity_references", count: input.auditMethod.skipped_session_files }] : [],
+      message_turns: Math.max(
+        input.auditMethod.searched_message_count,
+        input.events.filter((event) => event.kind === "user_prompt" || event.kind === "assistant_text").length
+      ),
+      user_prompts: input.events.filter((event) => event.kind === "user_prompt").length,
+      assistant_turns: input.events.filter((event) => event.kind === "assistant_text").length,
+      assistant_reasoning_turns: input.events.filter((event) => event.kind === "assistant_reasoning").length,
+      tool_calls: input.events.filter((event) => event.kind === "tool_call_start").length,
+      mcp_tool_calls: input.events.filter((event) => event.kind === "mcp_tool_call").length,
+      tool_call_errors: input.events.filter((event) => event.kind === "tool_call_error").length,
+      file_edits: input.events.filter((event) => event.kind === "file_edit").length,
+      file_reads: input.events.filter((event) => event.kind === "file_read").length,
+      shell_commands: input.events.filter((event) => event.kind === "shell_command").length,
+      test_runs: input.events.filter((event) => event.kind === "test_run").length,
+      errors_emitted: input.events.filter((event) => event.kind === "error_emitted").length,
+      permission_requests: input.events.filter((event) => event.kind === "permission_request").length,
+      forks: input.events.filter((event) => event.kind === "session_fork").length,
+      compactions: input.events.filter((event) => event.kind === "compaction").length,
+      earliest_event: timestamps[0] ?? null,
+      latest_event: timestamps[timestamps.length - 1] ?? null
+    }
+  };
+}
+function buildSourceConfidence(corpusManifest) {
+  return {
+    rows: [
+      "chronology",
+      "ownership",
+      "verification",
+      "handoff",
+      "customer_context",
+      "decision_lineage"
+    ],
+    columns: corpusManifest.sources
+  };
+}
+function verifyItems(items, events) {
+  const eventIds = new Set(events.map((event) => event.event_id));
+  return items.map((item) => {
+    const failed = item.cites.filter((cite) => !eventIds.has(cite)).map((cite) => ({ event_id_ref: cite, reason: "missing_event" }));
+    return {
+      finding_id: item.id,
+      citations_total: item.cites.length,
+      citations_resolved: item.cites.length - failed.length,
+      citations_failed: failed,
+      content_hashes_match: true,
+      passed: item.cites.length > 0 && failed.length === 0
+    };
+  });
+}
+function criticForLoop(loop) {
+  const survival = clamp(loop.confidence - (loop.cites.length <= 1 ? 0.08 : 0));
+  return {
+    finding_id: loop.loop_id,
+    attack_vectors_attempted: [
+      "is_this_actually_recurring",
+      "is_this_actually_blocked",
+      "is_the_intent_actually_what_we_say",
+      "are_these_events_actually_related",
+      "is_the_dollar_estimate_defensible",
+      "would_orgx_actually_have_helped",
+      "is_the_owner_actually_ambiguous",
+      "is_the_recurrence_just_text_overlap"
+    ],
+    weakest_claim: loop.cites.length <= 1 ? "Only one resolved citation supports this loop; chronology depth is limited." : "The loop is supported, but source coverage may still miss owner or verification context.",
+    most_plausible_alternative: loop.cites.length <= 1 ? "This may be a single work signal rather than a recurring bottleneck." : "This could be normal staged execution rather than unresolved rework.",
+    survival_score: Number(survival.toFixed(2)),
+    survived: survival >= 0.6,
+    demoted_to: survival >= 0.6 ? "public" : "weak_signal"
+  };
+}
+function counterfactualForLoop(loop, family) {
+  if (!loop.survived_critic || loop.cites.length === 0) return null;
+  const repair = family?.orgx_repair ?? repairForFamily([loop], {
+    time_saved_hours_per_week: 1,
+    acceleration_percent: 10,
+    estimated_monthly_value_usd: 800,
+    confidence: loop.confidence,
+    basis: [],
+    assumptions: []
+  });
+  const realism = clamp(loop.confidence + (loop.terminal.state === "blocked" ? 0.06 : 0), 0, 0.92);
+  if (realism < 0.7) return null;
+  const entityKind = repair.named_orgx_capability.includes("decision") ? "decision" : repair.named_orgx_capability.includes("blocker") ? "task" : repair.named_orgx_capability.includes("artifact") ? "artifact" : "initiative";
+  return {
+    triggered_by_event_id: loop.origin.event_id,
+    triggered_at: loop.origin.timestamp,
+    actual_user_event_summary: `You worked on "${loop.origin.intent}" without a durable OrgX repair record tied to the source event.`,
+    actual_outcome: loop.terminal.state === "blocked" ? "The loop stayed blocked or returned as new work." : "The work stayed visible in session evidence, but not as durable operating memory.",
+    orgx_capability: {
+      tool: repair.named_orgx_capability,
+      args: repair.expected_tool_call_args,
+      args_basis: ["loop.origin.intent", "loop.cites", "loop.terminal.state", "loop.bottleneck.class"]
+    },
+    orgx_outcome: repair.expected_outcome,
+    resulting_entity: {
+      kind: entityKind,
+      inferred_id: `orgx_${entityKind}_${hash2(loop.loop_id, 12)}`,
+      would_link_to: loop.cites
+    },
+    realism_score: Number(realism.toFixed(2)),
+    realism_basis: [
+      "The triggering event resolves to the normalized corpus.",
+      "The proposed OrgX capability maps directly to the loop terminal state and bottleneck.",
+      "The output is deterministic: create or link an owner-visible entity rather than asserting improvement."
+    ],
+    could_have_failed_because: [
+      "The user may not have granted write permission.",
+      "The inferred title or owner might need human correction after claim.",
+      "The source may lack enough downstream verification until GitHub or runtime hooks are connected."
+    ],
+    generated_by_prompt_version: "orgx-investigation-counterfactual-v1",
+    survived_critic: true
+  };
+}
+function buildWhyNot100(input) {
+  const entries = [];
+  const singleSignal = input.loops.filter((loop) => loop.cites.length <= 1).length;
+  const confluenceFamilies = input.families.filter((family) => family.cross_source_confluence).length;
+  const fileEdits = input.corpus.totals.file_edits;
+  if (confluenceFamilies === 0) {
+    entries.push({
+      dimension: "cross_source_confluence",
+      current_score: 0,
+      precise_gap: `0 cross-source loop families were proven; ${input.loops.length} loops still need a second source such as GitHub, Slack, or runtime hooks.`,
+      user_action: {
+        kind: "connect_source",
+        target: "GitHub or Slack",
+        ux_route: "/integrations",
+        copy_for_button: "Connect proof source"
+      },
+      orgx_action: {
+        kind: "auto_correlate",
+        description: "OrgX will join session events to commits, approvals, and runtime writeback events.",
+        triggers_when: "on_next_audit_run"
+      },
+      expected_score_lift: 22,
+      expected_findings_unlocked: Math.max(1, Math.ceil(input.loops.length * 0.35)),
+      preview_findings: [
+        {
+          title_redacted: "Session decision linked to commit proof",
+          evidence_count_anticipated: Math.max(2, fileEdits || 2),
+          confidence_anticipated: 0.82,
+          derivation_basis: "extrapolated_from_existing"
+        }
+      ],
+      preconditions: ["connect_github_or_slack"],
+      estimated_seconds_to_complete: 90
+    });
+  }
+  if (singleSignal > 0) {
+    entries.push({
+      dimension: "chronology_depth",
+      current_score: Math.max(1, 10 - Math.min(9, singleSignal)),
+      precise_gap: `${singleSignal} work loop${singleSignal === 1 ? "" : "s"} have only one resolved event; OrgX can identify them but cannot yet prove before/after motion.`,
+      user_action: {
+        kind: "install_hook",
+        target: "OrgX runtime hooks",
+        ux_route: "/settings/integrations/orgx-runtime",
+        copy_for_button: "Install runtime hooks"
+      },
+      orgx_action: {
+        kind: "auto_writeback",
+        description: "OrgX will append session-start, tool-use, stop, and outcome events to the same loop.",
+        triggers_when: "on_user_action_completion"
+      },
+      expected_score_lift: Math.min(24, singleSignal * 3),
+      expected_findings_unlocked: singleSignal,
+      preview_findings: [
+        {
+          title_redacted: "Blocked loop gains start, retry, and resolution events",
+          evidence_count_anticipated: 3,
+          confidence_anticipated: 0.78,
+          derivation_basis: "rule_based"
+        }
+      ],
+      preconditions: ["install_runtime_hook"],
+      estimated_seconds_to_complete: 120
+    });
+  }
+  if (input.coverage.missing.length > 0) {
+    entries.push({
+      dimension: "source_coverage",
+      current_score: Math.max(0, 10 - input.coverage.missing.length * 2),
+      precise_gap: `${input.coverage.missing.length} source gap${input.coverage.missing.length === 1 ? "" : "s"} remain: ${input.coverage.missing.join(", ")}.`,
+      user_action: {
+        kind: "connect_source",
+        target: input.coverage.missing[0] ?? "missing source",
+        ux_route: "/integrations",
+        copy_for_button: "Connect missing source"
+      },
+      orgx_action: {
+        kind: "auto_classify",
+        description: "OrgX will classify ownership, handoff, and verification evidence from the newly connected source.",
+        triggers_when: "on_next_audit_run"
+      },
+      expected_score_lift: Math.min(18, input.coverage.missing.length * 4),
+      expected_findings_unlocked: Math.max(1, input.coverage.missing.length * 2),
+      preview_findings: [
+        {
+          title_redacted: "Owner-visible handoff replaces inferred blocker state",
+          evidence_count_anticipated: 2,
+          confidence_anticipated: 0.8,
+          derivation_basis: "rule_based"
+        }
+      ],
+      preconditions: ["authorize_source"],
+      estimated_seconds_to_complete: 75
+    });
+  }
+  return entries.slice(0, 6);
+}
+function buildRepairPlan(input) {
+  const firstFamily = input.families.find((family) => family.public_surface) ?? input.families[0];
+  const firstCounterfactual = input.counterfactuals[0];
+  const actions = [];
+  if (firstFamily || firstCounterfactual) {
+    const closes = firstFamily?.loop_ids ?? (firstCounterfactual ? [firstCounterfactual.triggered_by_event_id] : []);
+    actions.push({
+      id: "repair:promote-loop",
+      type: firstFamily?.orgx_repair.named_orgx_capability.includes("assign") ? "assign_owner" : "promote_decision",
+      title: "Repair the top recurring work loop",
+      closes_loop_ids: closes,
+      expected_gain: "execution continuity",
+      expected_hours_recovered: firstFamily?.orgx_repair.expected_hours_recovered ?? 0.8,
+      expected_dollars_recovered: firstFamily?.orgx_repair.expected_dollars_recovered ?? 650,
+      required_inputs: ["confirmed evidence", "owner or fallback owner"],
+      confidence: firstCounterfactual?.realism_score ?? 0.72,
+      time_to_value: "10 minutes after claim",
+      preview_tree: [
+        { kind: "workstream", title: "Repair recurring AI work loop" },
+        { kind: "milestone", title: "Promote decision or blocker to durable record" },
+        { kind: "task", title: "Attach source evidence and owner-visible next step" }
+      ]
+    });
+  }
+  const sourceGap = input.whyNot100.find((entry) => entry.dimension === "source_coverage" || entry.dimension === "cross_source_confluence");
+  if (sourceGap) {
+    actions.push({
+      id: "repair:connect-source",
+      type: "connect_source",
+      title: sourceGap.user_action?.copy_for_button ?? "Connect missing proof source",
+      closes_loop_ids: [],
+      expected_gain: "source confidence",
+      expected_hours_recovered: 0,
+      expected_dollars_recovered: 0,
+      required_inputs: [sourceGap.user_action?.target ?? "source authorization"],
+      confidence: 0.78,
+      time_to_value: `${Math.ceil(sourceGap.estimated_seconds_to_complete / 60)} minutes`,
+      preview_tree: [
+        { kind: "workstream", title: "Connect source evidence" },
+        { kind: "task", title: "Correlate session events to proof, owner, and handoff signals" }
+      ]
+    });
+  }
+  actions.push({
+    id: "repair:launch-profile",
+    type: "convert_to_initiative",
+    title: "Launch from this investigation",
+    closes_loop_ids: firstFamily?.loop_ids ?? [],
+    expected_gain: "initiative readiness",
+    expected_hours_recovered: firstFamily?.orgx_repair.expected_hours_recovered ?? 0,
+    expected_dollars_recovered: firstFamily?.orgx_repair.expected_dollars_recovered ?? 0,
+    required_inputs: ["claim profile", "approve repair plan"],
+    confidence: 0.7,
+    time_to_value: "1 click after claim",
+    preview_tree: [
+      { kind: "workstream", title: "Investigation to durable OrgX initiative" },
+      { kind: "milestone", title: "Convert loop family into assigned work" },
+      { kind: "task", title: "Close the highest-confidence counterfactual gap" }
+    ]
+  });
+  return actions.slice(0, 3);
+}
+function buildMirror(input) {
+  const topFamily = input.families.find((family) => family.public_surface) ?? input.families[0];
+  const topLoop = input.loops[0];
+  const sourceCount = input.corpus.sources.filter((source) => source.status === "connected" || source.status === "partial").length;
+  const dropped = input.loops.filter((loop) => !loop.survived_critic).length;
+  const text2 = [
+    `You have AI-assisted work spread across ${sourceCount} connected or partial source${sourceCount === 1 ? "" : "s"}, but the execution record is still incomplete.`,
+    topFamily ? `The clearest repeated loop is "${topFamily.semantic_centroid}", with ${topFamily.appearances} appearance${topFamily.appearances === 1 ? "" : "s"} and a ${topFamily.shared_terminal_state} terminal state.` : topLoop ? `The clearest work loop is "${topLoop.origin.intent}", but it still needs more chronology before OrgX should call it recurring.` : "The corpus did not produce a verified work loop yet.",
+    input.counterfactuals[0] ? `OrgX can point to the exact event where it would have called ${input.counterfactuals[0].orgx_capability.tool} and what entity it would have created.` : "Counterfactual repair is waiting on a higher-confidence loop with resolved citations.",
+    `The current estimate is ${input.impact.time_saved_hours_per_week} recoverable hours/week, grounded in ${input.impact.basis[0] ?? "resolved work-loop evidence"}.`,
+    dropped > 0 ? `${dropped} weak signal${dropped === 1 ? " was" : "s were"} kept out of the public readout because the citations or critic score did not clear the bar.` : "Every surfaced loop cleared citation verification and the critic floor."
+  ].join(" ");
+  return {
+    text: text2,
+    evidence_pills: [
+      {
+        phrase: `${input.loops.length} work loop${input.loops.length === 1 ? "" : "s"}`,
+        cites: input.loops.flatMap((loop) => loop.cites).slice(0, 12)
+      },
+      {
+        phrase: `${sourceCount} source${sourceCount === 1 ? "" : "s"}`,
+        cites: []
+      },
+      {
+        phrase: `${input.counterfactuals.length} earned counterfactual${input.counterfactuals.length === 1 ? "" : "s"}`,
+        cites: input.counterfactuals.map((item) => item.triggered_by_event_id)
+      }
+    ]
+  };
+}
+function buildWorkGraphInvestigation(input) {
+  const auditId = `wgi_${hash2([input.fingerprint, input.generatedAt], 24)}`;
+  const rawEvents = buildRawEvents(input);
+  const corpus = buildCorpusManifest({
+    auditId,
+    auditMethod: input.auditMethod,
+    clientExtractions: input.clientExtractions,
+    coverage: input.coverage,
+    events: rawEvents,
+    generatedAt: input.generatedAt
+  });
+  const loops = buildWorkLoops({ events: rawEvents, findings: input.findings, trails: input.trails });
+  const families = buildLoopFamilies(loops, rawEvents, input.impact);
+  const usage = buildUsageCatalogue(rawEvents, input.findings);
+  const sourceConfidence = buildSourceConfidence(corpus);
+  const loopCritics = loops.map(criticForLoop);
+  const familyByLoop = /* @__PURE__ */ new Map();
+  for (const family of families) {
+    for (const loopId of family.loop_ids) familyByLoop.set(loopId, family);
+  }
+  const verifiedLoops = loops.filter((loop) => {
+    const critic = loopCritics.find((entry) => entry.finding_id === loop.loop_id);
+    return loop.public_surface && critic?.survived;
+  });
+  const counterfactuals = verifiedLoops.map((loop) => counterfactualForLoop(loop, familyByLoop.get(loop.loop_id))).filter((item) => Boolean(item)).slice(0, 8);
+  const verificationItems = [
+    ...loops.map((loop) => ({ id: loop.loop_id, cites: loop.cites })),
+    ...counterfactuals.map((item) => ({
+      id: `counterfactual:${item.resulting_entity.inferred_id}`,
+      cites: [item.triggered_by_event_id]
+    }))
+  ];
+  const verification = verifyItems(verificationItems, rawEvents);
+  const whyNot100 = buildWhyNot100({
+    corpus,
+    coverage: input.coverage,
+    loops,
+    families,
+    impact: input.impact
+  });
+  const repairPlan = buildRepairPlan({ counterfactuals, families, whyNot100 });
+  const mirror = buildMirror({
+    loops,
+    families,
+    counterfactuals,
+    corpus,
+    impact: input.impact
+  });
+  const eventBySource = countBy(rawEvents.map((event) => event.source_id)).map(({ key, count }) => ({
+    source_id: key,
+    count
+  }));
+  const eventByKind = countBy(rawEvents.map((event) => event.kind)).map(({ key, count }) => ({
+    kind: key,
+    count
+  }));
+  return {
+    schema_version: WORK_GRAPH_INVESTIGATION_SCHEMA_VERSION,
+    audit_id: auditId,
+    fingerprint: input.fingerprint,
+    generated_at: input.generatedAt,
+    corpus_manifest: corpus,
+    raw_events_summary: {
+      count: rawEvents.length,
+      by_source: eventBySource,
+      by_kind: eventByKind,
+      earliest: corpus.totals.earliest_event,
+      latest: corpus.totals.latest_event
+    },
+    raw_events: rawEvents.slice(0, 500),
+    work_loops: loops,
+    loop_families: families,
+    usage_catalogue: usage,
+    source_confidence: sourceConfidence,
+    why_not_100: whyNot100,
+    counterfactuals,
+    critic_log: [
+      ...loopCritics,
+      ...families.map((family) => ({
+        finding_id: family.family_id,
+        attack_vectors_attempted: [
+          "is_this_actually_recurring",
+          "is_the_recurrence_just_text_overlap",
+          "are_these_events_actually_related"
+        ],
+        weakest_claim: family.appearances < 3 ? "The family has fewer than 3 appearances and should not be public as recurrence." : "The family still depends on source normalization and may need human correction.",
+        most_plausible_alternative: family.appearances < 3 ? "This is a single signal or thin pair, not a real recurring loop." : "The loops may be related staged work rather than repeated unresolved work.",
+        survival_score: family.survived_critic ? 0.72 : 0.52,
+        survived: family.survived_critic,
+        demoted_to: family.public_surface ? "public" : "weak_signal"
+      }))
+    ],
+    verification_log: verification,
+    mirror_paragraph: mirror,
+    repair_plan: repairPlan,
+    impact_projection: {
+      hours_recoverable_per_week: {
+        value: input.impact.time_saved_hours_per_week,
+        basis: input.impact.basis.join(" "),
+        confidence: input.impact.confidence
+      },
+      dollars_recoverable_per_month: {
+        value: input.impact.estimated_monthly_value_usd,
+        basis: "hours_recoverable_per_week * 4.33 weeks * blended operator hourly value",
+        confidence: input.impact.confidence
+      },
+      acceleration_pct: {
+        value: input.impact.acceleration_percent,
+        basis: "directional execution lift from repairable loops, source coverage, and automation potential",
+        confidence: input.impact.confidence
+      }
+    },
+    redaction_log: [
+      { kind: "raw_transcripts_excluded", count: 1 },
+      { kind: "redacted_event_payloads", count: rawEvents.length }
+    ],
+    raw_transcripts_excluded: true,
+    claimable: loops.some((loop) => loop.public_surface)
+  };
+}
+
+// src/lib/work-graph.ts
+var WORK_GRAPH_SCHEMA_VERSION = "2.0.0";
 var WORK_GRAPH_FINGERPRINT_VERSION = "wgf_v1";
-var WORK_GRAPH_EXTRACTION_SCHEMA_VERSION = "2026-05-07.ai-client-search.v1";
+var WORK_GRAPH_EXTRACTION_SCHEMA_VERSION = "2.0.0.investigation";
 var WORK_GRAPH_FINDING_TYPES = [
   "action",
   "decision",
@@ -7019,7 +8721,7 @@ function clampScore2(value) {
   return Math.max(0, Math.min(100, Math.round(value)));
 }
 function hashJson(value) {
-  return createHash4("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash6("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function normalizeFingerprintText(value) {
   return value.toLowerCase().replace(/https?:\/\/\S+/g, "url").replace(/[0-9a-f]{12,}/g, "hash").replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/g, "uuid").replace(/\s+/g, " ").trim().slice(0, 600);
@@ -7040,6 +8742,10 @@ function sourceClientForImport(source) {
   if (raw.includes("claude-code")) return "claude-code";
   if (raw.includes("claude")) return "claude";
   if (raw.includes("cursor")) return "cursor";
+  if (raw.includes("opencode")) return "opencode";
+  if (raw.includes("goose")) return "goose";
+  if (raw.includes("opencode")) return "opencode";
+  if (raw.includes("goose")) return "goose";
   if (raw.includes("openclaw")) return "openclaw";
   if (raw.includes("slack")) return "slack";
   if (raw.includes("github")) return "github";
@@ -7056,12 +8762,14 @@ function sourceClientForImport(source) {
 function normalizeSourceClient(value) {
   if (typeof value !== "string") return "unknown";
   const normalized = value.trim().toLowerCase();
-  if (normalized === "codex" || normalized === "claude" || normalized === "claude-code" || normalized === "cursor" || normalized === "openclaw" || normalized === "slack" || normalized === "mcp" || normalized === "github" || normalized === "linear" || normalized === "gmail" || normalized === "calendar" || normalized === "notion" || normalized === "docs" || normalized === "manual" || normalized === "wizard" || normalized === "api") {
+  if (normalized === "codex" || normalized === "claude" || normalized === "claude-code" || normalized === "cursor" || normalized === "opencode" || normalized === "goose" || normalized === "openclaw" || normalized === "slack" || normalized === "mcp" || normalized === "orgx_runtime_hook" || normalized === "github" || normalized === "linear" || normalized === "gmail" || normalized === "calendar" || normalized === "notion" || normalized === "docs" || normalized === "manual" || normalized === "wizard" || normalized === "api") {
     return normalized;
   }
   if (normalized.includes("claude")) return "claude";
   if (normalized.includes("codex")) return "codex";
   if (normalized.includes("cursor")) return "cursor";
+  if (normalized.includes("opencode")) return "opencode";
+  if (normalized.includes("goose")) return "goose";
   if (normalized.includes("slack")) return "slack";
   if (normalized.includes("github")) return "github";
   if (normalized.includes("linear")) return "linear";
@@ -7070,6 +8778,7 @@ function normalizeSourceClient(value) {
   if (normalized.includes("notion")) return "notion";
   if (normalized.includes("doc")) return "docs";
   if (normalized.includes("mcp")) return "mcp";
+  if (normalized.includes("runtime") || normalized.includes("hook")) return "orgx_runtime_hook";
   return "unknown";
 }
 function sourceClientFromText(value) {
@@ -7077,6 +8786,8 @@ function sourceClientFromText(value) {
   if (/\bclaude(?:[- ]code)?\b|\.claude\/projects|claude:/.test(normalized)) return "claude";
   if (/\bcodex\b|\.codex\/sessions|rollout-/.test(normalized)) return "codex";
   if (/\bcursor\b/.test(normalized)) return "cursor";
+  if (/\bopencode\b/.test(normalized)) return "opencode";
+  if (/\bgoose\b/.test(normalized)) return "goose";
   if (/\bopenclaw\b/.test(normalized)) return "openclaw";
   if (/\bslack\b/.test(normalized)) return "slack";
   if (/\bgithub\b|\bgit:|pull request|commit\b/.test(normalized)) return "github";
@@ -7219,7 +8930,7 @@ function buildWorkGraphExtractionProtocol() {
     required_output: {
       schema_version: WORK_GRAPH_EXTRACTION_SCHEMA_VERSION,
       extraction_id: "stable id for this extraction run",
-      source_client: "codex | claude | claude-code | cursor | openclaw | slack | mcp | github | linear | gmail | calendar | notion | docs | manual | api | unknown",
+      source_client: "codex | claude | claude-code | cursor | opencode | goose | openclaw | slack | mcp | github | linear | gmail | calendar | notion | docs | manual | api | unknown",
       source_label: "human-readable source label",
       searched_sources: ["session/log/source group names searched"],
       search_queries: [
@@ -7348,8 +9059,12 @@ ${extractionText}`.toLowerCase();
     ...normalizedConnectedSources,
     ...sourceClients.includes("codex") ? ["Codex sessions"] : [],
     ...sourceClients.includes("claude") || sourceClients.includes("claude-code") ? ["Claude Code sessions"] : [],
+    ...sourceClients.includes("cursor") ? ["Cursor workspace evidence"] : [],
+    ...sourceClients.includes("opencode") ? ["OpenCode sessions"] : [],
+    ...sourceClients.includes("goose") ? ["goose sessions"] : [],
     ...sourceClients.includes("github") ? ["Git/GitHub proof"] : [],
     ...sourceClients.includes("mcp") ? ["MCP tool telemetry"] : [],
+    ...sourceClients.includes("orgx_runtime_hook") ? ["OrgX runtime hook replay"] : [],
     ...sourceClients.includes("slack") ? ["Slack coordination"] : []
   ];
   const inferredMissing = [
@@ -7369,7 +9084,7 @@ ${extractionText}`.toLowerCase();
   });
   const partialCount = manifests.filter((manifest) => manifest.status === "partial").length;
   const coverageScore = clampScore2(
-    28 + Math.min(34, connected.length * 7) + Math.min(18, findings.length * 2) + (sourceClients.includes("codex") ? 6 : 0) + (sourceClients.includes("claude") || sourceClients.includes("claude-code") ? 6 : 0) - missing.length * 7 - partialCount * 3
+    28 + Math.min(34, connected.length * 7) + Math.min(18, findings.length * 2) + (sourceClients.includes("codex") ? 6 : 0) + (sourceClients.includes("claude") || sourceClients.includes("claude-code") ? 6 : 0) + (sourceClients.includes("cursor") ? 4 : 0) + (sourceClients.includes("opencode") ? 4 : 0) + (sourceClients.includes("goose") ? 4 : 0) - missing.length * 7 - partialCount * 3
   );
   return {
     connected,
@@ -7466,7 +9181,7 @@ function buildSourceCoverageManifests(input) {
   });
 }
 function canonicalSourceManifestLabel(manifest) {
-  if (manifest.source_client === "codex" || manifest.source_client === "claude" || manifest.source_client === "claude-code") {
+  if (manifest.source_client === "codex" || manifest.source_client === "claude" || manifest.source_client === "claude-code" || manifest.source_client === "cursor" || manifest.source_client === "opencode" || manifest.source_client === "goose") {
     return labelForSourceClient(manifest.source_client);
   }
   if (manifest.source_client === "github" || manifest.source_client === "slack" || manifest.source_client === "mcp") {
@@ -7481,8 +9196,16 @@ function labelForSourceClient(sourceClient) {
     case "claude":
     case "claude-code":
       return "Claude Code sessions";
+    case "cursor":
+      return "Cursor workspace evidence";
+    case "opencode":
+      return "OpenCode sessions";
+    case "goose":
+      return "goose sessions";
     case "mcp":
       return "MCP tool telemetry";
+    case "orgx_runtime_hook":
+      return "OrgX runtime hook replay";
     case "github":
       return "Git/GitHub proof";
     case "slack":
@@ -7548,7 +9271,9 @@ function numberFromImportMetadata(source, key) {
 }
 function buildAuditMethod(input) {
   const extractionSummaries = summarizeClientExtractions(input.clientExtractions);
-  const nativePacks = extractionSummaries.filter((summary) => summary.source_client === "codex" || summary.source_client === "claude" || summary.source_client === "claude-code").map((summary) => ({
+  const nativePacks = extractionSummaries.filter(
+    (summary) => summary.source_client === "codex" || summary.source_client === "claude" || summary.source_client === "claude-code" || summary.source_client === "cursor" || summary.source_client === "opencode" || summary.source_client === "goose"
+  ).map((summary) => ({
     source_client: summary.source_client,
     source_label: summary.source_label,
     searched_session_count: summary.searched_session_count,
@@ -8932,7 +10657,7 @@ function buildAgentNodes(findings) {
   );
   const sourceAgents = sortedUnique(
     findings.map(
-      (finding) => ["codex", "claude", "claude-code", "cursor", "openclaw"].includes(finding.source_client) ? finding.source_client : ""
+      (finding) => ["codex", "claude", "claude-code", "cursor", "opencode", "goose", "openclaw"].includes(finding.source_client) ? finding.source_client : ""
     ).filter(Boolean)
   );
   return [...actorIds, ...sourceAgents].slice(0, 20).map((agent) => ({
@@ -9250,6 +10975,20 @@ function buildSessionReconciliationReport(input) {
   };
   const reportHash = hashJson(reportSeed);
   const sessionId = input.sessionId ?? `work-graph-${reportHash.slice(0, 16)}`;
+  const investigation = buildWorkGraphInvestigation({
+    auditMethod,
+    clientExtractions: clientExtractionSummaries,
+    coverage,
+    events,
+    findings: allFindings,
+    fingerprint: fingerprint.fingerprint,
+    generatedAt,
+    impact: impactProjection,
+    patterns: recurringPatterns,
+    ...input.investigationRawEvents ? { rawEvents: input.investigationRawEvents } : {},
+    recommendations,
+    trails
+  });
   return {
     schema_version: WORK_GRAPH_SCHEMA_VERSION,
     report_id: reportHash.slice(0, 24),
@@ -9281,6 +11020,7 @@ function buildSessionReconciliationReport(input) {
     opportunity_score: opportunityScore,
     execution_quality: executionQuality,
     impact_projection: impactProjection,
+    investigation,
     initiative_kickoffs: initiativeKickoffs,
     redaction_level: "summary_only",
     raw_transcripts_sent: false
@@ -9328,7 +11068,7 @@ function renderWorkGraphExtractionProtocolMarkdown(protocol = buildWorkGraphExtr
 }
 function renderWorkGraphMarkdown(report) {
   const lines = [];
-  lines.push("# OrgX Work Graph Reconciliation");
+  lines.push("# OrgX Investigation Engine");
   lines.push("");
   lines.push(`Generated: ${report.generated_at}`);
   lines.push(`Workspace: ${report.workspace.name} (${report.workspace.id})`);
@@ -9359,6 +11099,44 @@ function renderWorkGraphMarkdown(report) {
     lines.push(`- ${note}`);
   }
   lines.push("");
+  lines.push("## Investigation v2");
+  lines.push("");
+  lines.push(`Schema: ${report.investigation.schema_version}`);
+  lines.push(`Audit ID: ${report.investigation.audit_id}`);
+  lines.push(`Raw events normalized: ${report.investigation.raw_events_summary.count}`);
+  lines.push(`Work loops: ${report.investigation.work_loops.length}`);
+  lines.push(`Recurring loop families: ${report.investigation.loop_families.filter((family) => family.public_surface).length}`);
+  const passedVerification = report.investigation.verification_log.filter((entry) => entry.passed).length;
+  const droppedVerification = report.investigation.verification_log.length - passedVerification;
+  lines.push(`Verification: ${passedVerification} passed, ${droppedVerification} dropped as unverifiable`);
+  lines.push(`Earned counterfactuals: ${report.investigation.counterfactuals.length}`);
+  lines.push("");
+  lines.push("Mirror:");
+  lines.push(report.investigation.mirror_paragraph.text);
+  lines.push("");
+  if (report.investigation.counterfactuals[0]) {
+    const counterfactual = report.investigation.counterfactuals[0];
+    lines.push("Top earned counterfactual:");
+    lines.push(`- Trigger: ${counterfactual.triggered_by_event_id} at ${counterfactual.triggered_at}`);
+    lines.push(`- Actual: ${counterfactual.actual_outcome}`);
+    lines.push(`- OrgX would call: ${counterfactual.orgx_capability.tool}`);
+    lines.push(`- Outcome: ${counterfactual.orgx_outcome}`);
+    lines.push("");
+  }
+  if (report.investigation.why_not_100.length > 0) {
+    lines.push("What improves it:");
+    for (const gap of report.investigation.why_not_100) {
+      lines.push(`- ${gap.precise_gap} ${gap.user_action ? `Action: ${gap.user_action.copy_for_button} (${gap.user_action.ux_route}).` : ""}`);
+    }
+    lines.push("");
+  }
+  lines.push("Source capability matrix:");
+  for (const source of report.investigation.source_confidence.columns) {
+    const chronology = source.capability_cells.chronology;
+    const verification = source.capability_cells.verification;
+    lines.push(`- ${source.brand.name}: ${source.status}, chronology ${Math.round(chronology.achieved * 100)}%/${chronology.ceiling}, verification ${Math.round(verification.achieved * 100)}%/${verification.ceiling}`);
+  }
+  lines.push("");
   lines.push("## Client Extractions");
   lines.push("");
   if (report.client_extractions.length === 0) {
@@ -9629,8 +11407,8 @@ async function publishWorkGraphEvents(fingerprint, patch, options = {}) {
 }
 
 // src/lib/work-graph-hook-events.ts
-import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { createHash as createHash7 } from "crypto";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
 var SOURCE_CLIENTS = [
   "codex",
   "claude",
@@ -9664,7 +11442,7 @@ function asStringArray(value) {
   return value.filter((item) => typeof item === "string" && item.trim().length > 0);
 }
 function stableHash(value) {
-  return createHash5("sha256").update(value).digest("hex").slice(0, 20);
+  return createHash7("sha256").update(value).digest("hex").slice(0, 20);
 }
 function normalizeSourceClient2(value) {
   const raw = asString2(value)?.toLowerCase();
@@ -9731,8 +11509,8 @@ function readHookRecord(line) {
   }
 }
 function readRuntimeHookOutbox(path, limit = 200) {
-  if (!existsSync6(path)) return { path, records: [], skipped: 0 };
-  const lines = readFileSync4(path, "utf8").split(/\r?\n/).filter((line) => line.trim().length > 0);
+  if (!existsSync7(path)) return { path, records: [], skipped: 0 };
+  const lines = readFileSync5(path, "utf8").split(/\r?\n/).filter((line) => line.trim().length > 0);
   const selected = lines.slice(Math.max(0, lines.length - Math.max(1, limit)));
   const records = [];
   let skipped = Math.max(0, lines.length - selected.length);
@@ -9868,20 +11646,20 @@ function buildWorkGraphHookReplayPatch(readResult) {
 }
 
 // src/lib/runtime-hooks.ts
-import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join6 } from "path";
 var HOOK_MARKER = "orgx-session-hook.mjs";
 var HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "PermissionRequest", "Stop"];
 var CLAUDE_HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "SubagentStop", "Stop", "SessionEnd"];
 function defaultPaths(options = {}) {
-  const hookDir = join5(ORGX_WIZARD_CONFIG_HOME, "hooks");
+  const hookDir = join6(ORGX_WIZARD_CONFIG_HOME, "hooks");
   return {
-    claudeSettingsPath: options.claudeSettingsPath ?? join5(CLAUDE_DIR, "settings.json"),
-    codexConfigPath: options.codexConfigPath ?? CODEX_CONFIG_PATH ?? join5(CODEX_DIR, "config.toml"),
-    codexHooksPath: options.codexHooksPath ?? join5(CODEX_DIR, "hooks.json"),
-    hookScriptPath: options.hookScriptPath ?? join5(hookDir, HOOK_MARKER),
-    outboxPath: options.outboxPath ?? join5(hookDir, "events.jsonl")
+    claudeSettingsPath: options.claudeSettingsPath ?? join6(CLAUDE_DIR, "settings.json"),
+    codexConfigPath: options.codexConfigPath ?? CODEX_CONFIG_PATH ?? join6(CODEX_DIR, "config.toml"),
+    codexHooksPath: options.codexHooksPath ?? join6(CODEX_DIR, "hooks.json"),
+    hookScriptPath: options.hookScriptPath ?? join6(hookDir, HOOK_MARKER),
+    outboxPath: options.outboxPath ?? join6(hookDir, "events.jsonl")
   };
 }
 function countJsonlLines(path) {
@@ -9894,7 +11672,7 @@ function backupPath(path, now) {
   return `${path}.bak.${timestamp}`;
 }
 function backupExisting(path, now) {
-  if (!existsSync7(path)) return null;
+  if (!existsSync8(path)) return null;
   const backup = backupPath(path, now);
   copyFileSync(path, backup);
   return backup;
@@ -10092,7 +11870,7 @@ function inspectRuntimeHooks(options = {}) {
     installed: {
       claudeCode: hasOrgxHook(claudeSettingsRaw),
       codex: hasOrgxHook(codexHooksRaw),
-      hookScript: existsSync7(paths.hookScriptPath)
+      hookScript: existsSync8(paths.hookScriptPath)
     },
     codex: {
       configExists: Boolean(codexConfigRaw),
@@ -10322,7 +12100,7 @@ async function runHookReplayCommand(options) {
   }
   const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
   const paths = inspectRuntimeHooks().paths;
-  const outboxPath = resolve(options.outbox?.trim() || paths.outboxPath);
+  const outboxPath = resolve2(options.outbox?.trim() || paths.outboxPath);
   const readResult = readRuntimeHookOutbox(outboxPath, parsePositiveInt(options.limit, 200));
   const replay = buildWorkGraphHookReplayPatch(readResult);
   if (replay.records === 0) {
@@ -10354,10 +12132,10 @@ async function runHookReplayCommand(options) {
 }
 function readAuditInput(options, interactive) {
   if (options.input?.trim()) {
-    return readFileSync6(resolve(options.input.trim()), "utf8");
+    return readFileSync7(resolve2(options.input.trim()), "utf8");
   }
   if (!process.stdin.isTTY) {
-    return readFileSync6(0, "utf8");
+    return readFileSync7(0, "utf8");
   }
   if (!interactive) {
     throw new Error("Audit input is required. Pass --input <file> or pipe text into wizard audit.");
@@ -10389,8 +12167,8 @@ function collectPathOption(value, previous = []) {
   ];
 }
 function parseClientExtractionFile(path) {
-  const resolvedPath = resolve(path);
-  const parsed = JSON.parse(readFileSync6(resolvedPath, "utf8"));
+  const resolvedPath = resolve2(path);
+  const parsed = JSON.parse(readFileSync7(resolvedPath, "utf8"));
   if (!isRecord(parsed)) {
     throw new Error(`AI-client extraction must be a JSON object: ${resolvedPath}`);
   }
@@ -10412,8 +12190,8 @@ async function readAuditImports(options, interactive) {
   const missingSources = [];
   if (sources.length > 0) {
     const imported = loadAiSessionImports({
-      ...options.claudeProjectsDir?.trim() ? { claudeProjectsDir: resolve(options.claudeProjectsDir.trim()) } : {},
-      ...options.codexSessionsDir?.trim() ? { codexSessionsDir: resolve(options.codexSessionsDir.trim()) } : {},
+      ...options.claudeProjectsDir?.trim() ? { claudeProjectsDir: resolve2(options.claudeProjectsDir.trim()) } : {},
+      ...options.codexSessionsDir?.trim() ? { codexSessionsDir: resolve2(options.codexSessionsDir.trim()) } : {},
       limitPerSource: parsePositiveInteger(options.sessionLimit, 3, "--session-limit"),
       sinceDays: parsePositiveInteger(options.sessionDays, 30, "--session-days"),
       sources
@@ -10441,7 +12219,7 @@ async function readAuditImports(options, interactive) {
   }
   if (imports.length === 0) {
     const sourceHint = sources.length > 0 ? ` No audit-relevant lines were found in ${sources.join(", ")} sessions.` : "";
-    throw new Error(`Audit input is required.${sourceHint} Pass --input <file>, pipe text, or use --from codex|claude|all.`);
+    throw new Error(`Audit input is required.${sourceHint} Pass --input <file>, pipe text, or use --from claude,codex,opencode,goose,cursor,all.`);
   }
   return {
     connectedSources,
@@ -10451,13 +12229,28 @@ async function readAuditImports(options, interactive) {
 }
 async function readWorkGraphInputs(options, interactive) {
   const clientExtractions = readClientExtractions(options);
+  const investigationSources = parseInvestigationSourceList(options.from);
+  const investigationSourceData = investigationSources.length > 0 ? loadWorkGraphInvestigationSourceData({
+    ...options.claudeProjectsDir?.trim() ? { claudeProjectsDir: resolve2(options.claudeProjectsDir.trim()) } : {},
+    ...options.codexSessionsDir?.trim() ? { codexSessionsDir: resolve2(options.codexSessionsDir.trim()) } : {},
+    cwd: process.cwd(),
+    limitPerSource: parsePositiveInteger(options.sessionLimit, 8, "--session-limit"),
+    sinceDays: parsePositiveInteger(options.sessionDays, 45, "--session-days"),
+    sources: investigationSources
+  }) : {
+    clientExtractions: [],
+    connectedSources: [],
+    missingSources: [],
+    rawEvents: []
+  };
   const shouldReadSessionImports = Boolean(
-    options.from?.trim() || options.input?.trim() || clientExtractions.length === 0 || !process.stdin.isTTY && clientExtractions.length === 0
+    options.from?.trim() || options.input?.trim() || clientExtractions.length === 0 && investigationSourceData.clientExtractions.length === 0 || !process.stdin.isTTY && clientExtractions.length === 0 && investigationSourceData.clientExtractions.length === 0
   );
   if (!shouldReadSessionImports) {
     return {
-      clientExtractions,
+      clientExtractions: [...clientExtractions, ...investigationSourceData.clientExtractions],
       connectedSources: [],
+      investigationRawEvents: investigationSourceData.rawEvents,
       imports: [],
       missingSources: []
     };
@@ -10466,7 +12259,7 @@ async function readWorkGraphInputs(options, interactive) {
   try {
     auditImports = await readAuditImports(options, interactive);
   } catch (error) {
-    if (clientExtractions.length === 0) throw error;
+    if (clientExtractions.length === 0 && investigationSourceData.clientExtractions.length === 0) throw error;
     const message = error instanceof Error ? error.message : String(error);
     auditImports = {
       connectedSources: [],
@@ -10475,10 +12268,11 @@ async function readWorkGraphInputs(options, interactive) {
     };
   }
   return {
-    clientExtractions,
-    connectedSources: auditImports.connectedSources,
+    clientExtractions: [...clientExtractions, ...investigationSourceData.clientExtractions],
+    connectedSources: [...auditImports.connectedSources, ...investigationSourceData.connectedSources],
+    investigationRawEvents: investigationSourceData.rawEvents,
     imports: auditImports.imports,
-    missingSources: auditImports.missingSources
+    missingSources: [...auditImports.missingSources, ...investigationSourceData.missingSources]
   };
 }
 function requireWriteApproval(options, interactive) {
@@ -10555,10 +12349,10 @@ async function runAuditCommand(options) {
     workspace
   });
   const markdown = renderSelfAuditMarkdown(plan);
-  const outputDir = resolve(options.outputDir?.trim() || ".orgx/audits");
+  const outputDir = resolve2(options.outputDir?.trim() || ".orgx/audits");
   const timestamp = plan.generated_at.replace(/[:.]/g, "-");
-  const jsonPath = resolve(outputDir, `ai-native-self-audit-${timestamp}.json`);
-  const markdownPath = resolve(outputDir, `ai-native-self-audit-${timestamp}.md`);
+  const jsonPath = resolve2(outputDir, `ai-native-self-audit-${timestamp}.json`);
+  const markdownPath = resolve2(outputDir, `ai-native-self-audit-${timestamp}.md`);
   writeJsonFile(jsonPath, plan);
   writeTextFile(markdownPath, markdown);
   if (options.json) {
@@ -10609,7 +12403,7 @@ async function runAuditCommand(options) {
 }
 function runWorkGraphExtractionSchemaCommand(options) {
   const protocol = buildWorkGraphExtractionProtocol();
-  const outputPath = options.output?.trim() ? resolve(options.output.trim()) : "";
+  const outputPath = options.output?.trim() ? resolve2(options.output.trim()) : "";
   if (outputPath) {
     if (options.json) {
       writeJsonFile(outputPath, protocol);
@@ -10648,6 +12442,7 @@ async function runWorkGraphCommand(options, defaults = {}) {
       ...workspace.id === "local-workspace" ? [] : ["OrgX workspace"]
     ],
     imports: auditInputs.imports,
+    investigationRawEvents: auditInputs.investigationRawEvents,
     missingSources: [
       ...workspace.id === "local-workspace" ? ["OrgX workspace auth"] : [],
       ...auditInputs.missingSources
@@ -10656,10 +12451,10 @@ async function runWorkGraphCommand(options, defaults = {}) {
     workspace
   });
   const markdown = renderWorkGraphMarkdown(report);
-  const outputDir = resolve(commandOptions.outputDir?.trim() || ".orgx/work-graph");
+  const outputDir = resolve2(commandOptions.outputDir?.trim() || ".orgx/work-graph");
   const timestamp = report.generated_at.replace(/[:.]/g, "-");
-  const jsonPath = resolve(outputDir, `work-graph-report-${timestamp}.json`);
-  const markdownPath = resolve(outputDir, `work-graph-report-${timestamp}.md`);
+  const jsonPath = resolve2(outputDir, `work-graph-report-${timestamp}.json`);
+  const markdownPath = resolve2(outputDir, `work-graph-report-${timestamp}.md`);
   writeJsonFile(jsonPath, report);
   writeTextFile(markdownPath, markdown);
   let published = null;
@@ -11041,14 +12836,14 @@ async function readSingleKey() {
   const stdin = process.stdin;
   if (!stdin.isTTY) return null;
   const previousRawMode = stdin.isRaw === true;
-  return await new Promise((resolve2) => {
+  return await new Promise((resolve3) => {
     const cleanup = (result) => {
       stdin.off("data", onData);
       if (stdin.isTTY) {
         stdin.setRawMode(previousRawMode);
       }
       stdin.pause();
-      resolve2(result);
+      resolve3(result);
     };
     const onData = (chunk) => {
       const text2 = chunk.toString("utf8");
@@ -11701,7 +13496,7 @@ function printDoctorReport(report, assessment) {
 async function main() {
   const program = new Command();
   program.name("orgx-wizard").description("Add OrgX MCP configs, skills/rules, and companion plugins to your local AI tools.").showHelpAfterError();
-  const pkgVersion = true ? "0.1.38" : void 0;
+  const pkgVersion = true ? "0.1.39" : void 0;
   program.version(pkgVersion ?? "unknown", "-V, --version");
   program.hook("preAction", (_thisCommand, actionCommand) => {
     if (Boolean(actionCommand.optsWithGlobals().json)) return;
@@ -12391,7 +14186,7 @@ async function main() {
       jsonOutput: Boolean(options.json)
     });
   });
-  program.command("audit").description("Run the AI-native Founder Loop self-audit from pasted or file-based AI-session context.").option("--input <path>", "AI-session transcript or summary file; stdin is used when piped").option("--from <sources>", "auto-import recent local AI sessions: codex, claude, or all").option("--session-limit <count>", "max recent sessions to import per selected source", "3").option("--session-days <days>", "lookback window for local AI-session imports", "30").option("--codex-sessions-dir <path>", "override Codex sessions directory for audit import").option("--claude-projects-dir <path>", "override Claude projects directory for audit import").option("--source-label <label>", "label for the imported AI-session source").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace when authenticated").option("--workspace-name <name>", "workspace name override for local-only audits").option("--output-dir <path>", "directory for generated audit JSON and Markdown", ".orgx/audits").option("--attach-to-initiative <id>", "attach the generated audit artifact to an existing OrgX initiative").option("--create-initiative", "create an OrgX initiative from the generated audit plan").option("--write-follow-up", "create one approval-gated OrgX follow-up task from the audit recommendation").option("--workstream-id <id>", "optional workstream id for the generated follow-up task").option("--milestone-id <id>", "optional milestone id for the generated follow-up task").option("--dry-run", "exercise OrgX write paths without sending writes").option("--yes", "approve OrgX write flags in non-interactive mode").option("--json", "emit a JSON command summary").action(async (options) => {
+  program.command("audit").description("Run the AI-native Founder Loop self-audit from pasted or file-based AI-session context.").option("--input <path>", "AI-session transcript or summary file; stdin is used when piped").option("--from <sources>", "auto-import recent local AI sessions: claude, codex, opencode, goose, cursor, or all").option("--session-limit <count>", "max recent sessions to import per selected source", "3").option("--session-days <days>", "lookback window for local AI-session imports", "30").option("--codex-sessions-dir <path>", "override Codex sessions directory for audit import").option("--claude-projects-dir <path>", "override Claude projects directory for audit import").option("--source-label <label>", "label for the imported AI-session source").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace when authenticated").option("--workspace-name <name>", "workspace name override for local-only audits").option("--output-dir <path>", "directory for generated audit JSON and Markdown", ".orgx/audits").option("--attach-to-initiative <id>", "attach the generated audit artifact to an existing OrgX initiative").option("--create-initiative", "create an OrgX initiative from the generated audit plan").option("--write-follow-up", "create one approval-gated OrgX follow-up task from the audit recommendation").option("--workstream-id <id>", "optional workstream id for the generated follow-up task").option("--milestone-id <id>", "optional milestone id for the generated follow-up task").option("--dry-run", "exercise OrgX write paths without sending writes").option("--yes", "approve OrgX write flags in non-interactive mode").option("--json", "emit a JSON command summary").action(async (options) => {
     await safeTrackWizardTelemetry("audit_started", {
       attach_to_initiative: Boolean(options.attachToInitiative),
       command: "audit",
@@ -12409,14 +14204,14 @@ async function main() {
     });
     runWorkGraphExtractionSchemaCommand(options);
   });
-  workGraph.command("preview").description("Preview the OrgX Profile evidence findings without writing to OrgX.").option("--input <path>", "source transcript or summary file; stdin is used when piped").option("--extraction <path>", "structured AI-client extraction JSON; repeat or comma-separate for multiple clients", collectPathOption, []).option("--from <sources>", "auto-import recent local AI sessions: codex, claude, or all").option("--session-limit <count>", "max recent sessions to import per selected source", "15").option("--session-days <days>", "lookback window for local AI-session imports", "60").option("--codex-sessions-dir <path>", "override Codex sessions directory for import").option("--claude-projects-dir <path>", "override Claude projects directory for import").option("--source-label <label>", "label for the imported manual source").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace when authenticated").option("--workspace-name <name>", "workspace name override for local-only previews").option("--output-dir <path>", "directory for generated Work Graph JSON and Markdown", ".orgx/work-graph").option("--json", "emit a JSON command summary").action(async (options) => {
+  workGraph.command("preview").description("Preview the OrgX Profile evidence findings without writing to OrgX.").option("--input <path>", "source transcript or summary file; stdin is used when piped").option("--extraction <path>", "structured AI-client extraction JSON; repeat or comma-separate for multiple clients", collectPathOption, []).option("--from <sources>", "auto-import recent local AI sessions: claude, codex, opencode, goose, cursor, or all").option("--session-limit <count>", "max recent sessions to import per selected source", "15").option("--session-days <days>", "lookback window for local AI-session imports", "60").option("--codex-sessions-dir <path>", "override Codex sessions directory for import").option("--claude-projects-dir <path>", "override Claude projects directory for import").option("--source-label <label>", "label for the imported manual source").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace when authenticated").option("--workspace-name <name>", "workspace name override for local-only previews").option("--output-dir <path>", "directory for generated Work Graph JSON and Markdown", ".orgx/work-graph").option("--json", "emit a JSON command summary").action(async (options) => {
     await safeTrackWizardTelemetry("work_graph_preview_started", {
       command: "work-graph preview",
       from: options.from ?? "manual"
     });
     await runWorkGraphCommand(options);
   });
-  workGraph.command("profile").description("Build a local OrgX Profile with evidence findings, domain coverage, source confidence, and repair recommendations.").option("--input <path>", "source transcript or summary file; stdin is used when piped").option("--extraction <path>", "structured AI-client extraction JSON; repeat or comma-separate for multiple clients", collectPathOption, []).option("--from <sources>", "auto-import recent local AI sessions: codex, claude, or all").option("--session-limit <count>", "max recent sessions to import per selected source", "25").option("--session-days <days>", "lookback window for local AI-session imports", "60").option("--codex-sessions-dir <path>", "override Codex sessions directory for import").option("--claude-projects-dir <path>", "override Claude projects directory for import").option("--source-label <label>", "label for the imported manual source").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace when authenticated").option("--workspace-name <name>", "workspace name override for local-only profiles").option("--output-dir <path>", "directory for generated Work Graph JSON and Markdown", ".orgx/work-graph").option("--publish", "publish the generated OrgX Profile to OrgX and return a shareable URL").option("--public-share", "create a public redacted /work-graph/<token> share when publishing").option("--attach-artifact", "attach the report as an OrgX artifact when an initiative/entity is provided").option("--attach-to-initiative <id>", "attach the report to an existing OrgX initiative").option("--entity-type <type>", "entity type for artifact attachment: project, initiative, milestone, task, decision").option("--entity-id <id>", "entity id for artifact attachment").option("--artifact-url <url>", "override the artifact URL stored in OrgX").option("--yes", "approve publish/write prompts in non-interactive mode").option("--json", "emit a JSON command summary").action(async (options) => {
+  workGraph.command("profile").description("Build a local OrgX Profile with evidence findings, domain coverage, source confidence, and repair recommendations.").option("--input <path>", "source transcript or summary file; stdin is used when piped").option("--extraction <path>", "structured AI-client extraction JSON; repeat or comma-separate for multiple clients", collectPathOption, []).option("--from <sources>", "auto-import recent local AI sessions: claude, codex, opencode, goose, cursor, or all").option("--session-limit <count>", "max recent sessions to import per selected source", "25").option("--session-days <days>", "lookback window for local AI-session imports", "60").option("--codex-sessions-dir <path>", "override Codex sessions directory for import").option("--claude-projects-dir <path>", "override Claude projects directory for import").option("--source-label <label>", "label for the imported manual source").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace when authenticated").option("--workspace-name <name>", "workspace name override for local-only profiles").option("--output-dir <path>", "directory for generated Work Graph JSON and Markdown", ".orgx/work-graph").option("--publish", "publish the generated OrgX Profile to OrgX and return a shareable URL").option("--public-share", "create a public redacted /work-graph/<token> share when publishing").option("--attach-artifact", "attach the report as an OrgX artifact when an initiative/entity is provided").option("--attach-to-initiative <id>", "attach the report to an existing OrgX initiative").option("--entity-type <type>", "entity type for artifact attachment: project, initiative, milestone, task, decision").option("--entity-id <id>", "entity id for artifact attachment").option("--artifact-url <url>", "override the artifact URL stored in OrgX").option("--yes", "approve publish/write prompts in non-interactive mode").option("--json", "emit a JSON command summary").action(async (options) => {
     await safeTrackWizardTelemetry("work_graph_profile_started", {
       command: "work-graph profile",
       from: options.from ?? "manual"
@@ -12424,7 +14219,7 @@ async function main() {
     await runWorkGraphCommand(options);
   });
   const sessions = program.command("sessions").description("Inspect and reconcile local AI sessions into OrgX-ready Work Graph reports.");
-  sessions.command("reconcile").description("Backfill recent Codex and Claude sessions into a redacted OrgX Profile report.").option("--extraction <path>", "structured AI-client extraction JSON; repeat or comma-separate for multiple clients", collectPathOption, []).option("--from <sources>", "auto-import recent local AI sessions: codex, claude, or all", "all").option("--session-limit <count>", "max recent sessions to import per selected source", "25").option("--session-days <days>", "lookback window for local AI-session imports", "30").option("--codex-sessions-dir <path>", "override Codex sessions directory for import").option("--claude-projects-dir <path>", "override Claude projects directory for import").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace when authenticated").option("--workspace-name <name>", "workspace name override for local-only reconciliation").option("--output-dir <path>", "directory for generated Work Graph JSON and Markdown", ".orgx/work-graph").option("--publish", "publish the generated OrgX Profile to OrgX and return a shareable URL").option("--public-share", "create a public redacted /work-graph/<token> share when publishing").option("--attach-artifact", "attach the report as an OrgX artifact when an initiative/entity is provided").option("--attach-to-initiative <id>", "attach the report to an existing OrgX initiative").option("--entity-type <type>", "entity type for artifact attachment: project, initiative, milestone, task, decision").option("--entity-id <id>", "entity id for artifact attachment").option("--artifact-url <url>", "override the artifact URL stored in OrgX").option("--yes", "approve publish/write prompts in non-interactive mode").option("--json", "emit a JSON command summary").action(async (options) => {
+  sessions.command("reconcile").description("Backfill recent Claude Code, Codex, OpenCode, goose, and Cursor sessions into a redacted OrgX Profile report.").option("--extraction <path>", "structured AI-client extraction JSON; repeat or comma-separate for multiple clients", collectPathOption, []).option("--from <sources>", "auto-import recent local AI sessions: claude, codex, opencode, goose, cursor, or all", "all").option("--session-limit <count>", "max recent sessions to import per selected source", "25").option("--session-days <days>", "lookback window for local AI-session imports", "30").option("--codex-sessions-dir <path>", "override Codex sessions directory for import").option("--claude-projects-dir <path>", "override Claude projects directory for import").option("--workspace-id <id>", "workspace id override; defaults to the current OrgX workspace when authenticated").option("--workspace-name <name>", "workspace name override for local-only reconciliation").option("--output-dir <path>", "directory for generated Work Graph JSON and Markdown", ".orgx/work-graph").option("--publish", "publish the generated OrgX Profile to OrgX and return a shareable URL").option("--public-share", "create a public redacted /work-graph/<token> share when publishing").option("--attach-artifact", "attach the report as an OrgX artifact when an initiative/entity is provided").option("--attach-to-initiative <id>", "attach the report to an existing OrgX initiative").option("--entity-type <type>", "entity type for artifact attachment: project, initiative, milestone, task, decision").option("--entity-id <id>", "entity id for artifact attachment").option("--artifact-url <url>", "override the artifact URL stored in OrgX").option("--yes", "approve publish/write prompts in non-interactive mode").option("--json", "emit a JSON command summary").action(async (options) => {
     await safeTrackWizardTelemetry("sessions_reconcile_started", {
       command: "sessions reconcile",
       from: options.from ?? "all"