@usepowerplant/cli 0.4.6 → 0.4.8

package/dist/cli.js

@@ -55485,20 +55485,210 @@ function workspaceClaimsAnyRepo(policy) {
   return policy.repos !== null ? policy.repos.length > 0 : policy.owners.length > 0;
 }
 
+// ../core/src/encodedImages.ts
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function isEncodedImage(data, mediaType) {
+  if (data.length < 16 || data.length % 4 !== 0) return false;
+  const padding = data.endsWith("==") ? 2 : data.endsWith("=") ? 1 : 0;
+  const body = data.slice(0, data.length - padding);
+  if (/[^A-Za-z0-9+/]/.test(body)) return false;
+  const last = BASE64_ALPHABET.indexOf(body.at(-1));
+  if (padding === 2 && (last & 15) !== 0 || padding === 1 && (last & 3) !== 0) return false;
+  switch (mediaType) {
+    case "image/png":
+      return isPng(atob(data));
+    case "image/jpeg":
+      return isJpeg(atob(data));
+    case "image/gif":
+      return isGif(atob(data));
+    case "image/webp":
+      return isWebp(atob(data));
+    default:
+      return false;
+  }
+}
+function u16(data, offset) {
+  return data.charCodeAt(offset) << 8 | data.charCodeAt(offset + 1);
+}
+function u32(data, offset) {
+  return u16(data, offset) * 65536 + u16(data, offset + 2) >>> 0;
+}
+function little32(data, offset) {
+  return (data.charCodeAt(offset) | data.charCodeAt(offset + 1) << 8 | data.charCodeAt(offset + 2) << 16 | data.charCodeAt(offset + 3) << 24) >>> 0;
+}
+var CRC_TABLE = Array.from({ length: 256 }, (_, value) => {
+  for (let bit = 0; bit < 8; bit++) value = value & 1 ? 3988292384 ^ value >>> 1 : value >>> 1;
+  return value >>> 0;
+});
+function crc32(data, start, end) {
+  let crc = 4294967295;
+  for (let i = start; i < end; i++)
+    crc = CRC_TABLE[(crc ^ data.charCodeAt(i)) & 255] ^ crc >>> 8;
+  return (crc ^ 4294967295) >>> 0;
+}
+function isPng(data) {
+  if (!data.startsWith("\x89PNG\r\n\n")) return false;
+  let offset = 8;
+  let imageData = false;
+  let dataEnded = false;
+  let palette = false;
+  let indexed = false;
+  while (offset + 12 <= data.length) {
+    const size = u32(data, offset);
+    const type = data.slice(offset + 4, offset + 8);
+    const end = offset + 8 + size;
+    if (size > 2147483647 || end + 4 > data.length || !/^[A-Za-z]{2}[A-Z][A-Za-z]$/.test(type))
+      return false;
+    if (u32(data, end) !== crc32(data, offset + 4, end)) return false;
+    if (offset === 8) {
+      if (type !== "IHDR" || size !== 13 || !u32(data, offset + 8) || !u32(data, offset + 12))
+        return false;
+      const depth = data.charCodeAt(offset + 16);
+      const color = data.charCodeAt(offset + 17);
+      const validDepth = color === 0 ? [1, 2, 4, 8, 16] : color === 3 ? [1, 2, 4, 8] : [8, 16];
+      if (![0, 2, 3, 4, 6].includes(color) || !validDepth.includes(depth)) return false;
+      if (data.charCodeAt(offset + 18) !== 0 || data.charCodeAt(offset + 19) !== 0 || data.charCodeAt(offset + 20) > 1)
+        return false;
+      indexed = color === 3;
+    } else if (type === "IHDR") return false;
+    else if (type === "PLTE") {
+      if (imageData || palette || size === 0 || size > 768 || size % 3 !== 0) return false;
+      palette = true;
+    } else if (type === "IDAT") {
+      if (dataEnded || indexed && !palette) return false;
+      imageData = imageData || size > 0;
+    } else if (type === "IEND") return imageData && size === 0 && end + 4 === data.length;
+    else if (type[0] === type[0].toUpperCase()) return false;
+    if (imageData && type !== "IDAT") dataEnded = true;
+    offset = end + 4;
+  }
+  return false;
+}
+function isJpeg(data) {
+  if (!data.startsWith("\xFF\xD8")) return false;
+  let offset = 2;
+  let frame = false;
+  let scan = false;
+  while (offset < data.length) {
+    if (data.charCodeAt(offset++) !== 255) return false;
+    while (data.charCodeAt(offset) === 255) offset++;
+    const marker = data.charCodeAt(offset++);
+    if (marker === 217) return frame && scan && offset === data.length;
+    if (marker === 0 || marker === 216 || marker >= 208 && marker <= 215) return false;
+    if (marker === 1) continue;
+    if (offset + 2 > data.length) return false;
+    const size = u16(data, offset);
+    if (size < 2 || offset + size > data.length) return false;
+    if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+      if (size < 11 || size !== 8 + 3 * data.charCodeAt(offset + 7) || !u16(data, offset + 3) || !u16(data, offset + 5))
+        return false;
+      frame = true;
+    }
+    if (marker !== 218) {
+      offset += size;
+      continue;
+    }
+    if (!frame || size < 8 || size !== 6 + 2 * data.charCodeAt(offset + 2)) return false;
+    offset += size;
+    const start = offset;
+    for (; ; ) {
+      const next = data.indexOf("\xFF", offset);
+      if (next < 0 || next + 1 >= data.length) return false;
+      const following = data.charCodeAt(next + 1);
+      if (following === 0 || following >= 208 && following <= 215) offset = next + 2;
+      else if (following === 255) offset = next + 1;
+      else {
+        offset = next;
+        break;
+      }
+    }
+    if (offset <= start) return false;
+    scan = true;
+  }
+  return false;
+}
+function skipGifBlocks(data, offset) {
+  while (offset < data.length) {
+    const size = data.charCodeAt(offset++);
+    if (size === 0) return offset;
+    offset += size;
+  }
+  return -1;
+}
+function isGif(data) {
+  if (!data.startsWith("GIF87a") && !data.startsWith("GIF89a") || data.length < 13) return false;
+  if (!(data.charCodeAt(6) | data.charCodeAt(7)) || !(data.charCodeAt(8) | data.charCodeAt(9)))
+    return false;
+  const packed = data.charCodeAt(10);
+  let offset = 13 + (packed & 128 ? 3 * (2 << (packed & 7)) : 0);
+  let image = false;
+  while (offset < data.length) {
+    const marker = data.charCodeAt(offset++);
+    if (marker === 59) return image && offset === data.length;
+    if (marker === 33) offset = skipGifBlocks(data, offset + 1);
+    else if (marker === 44) {
+      if (offset + 9 > data.length || !(data.charCodeAt(offset + 4) | data.charCodeAt(offset + 5)) || !(data.charCodeAt(offset + 6) | data.charCodeAt(offset + 7)))
+        return false;
+      const local = data.charCodeAt(offset + 8);
+      offset += 9 + (local & 128 ? 3 * (2 << (local & 7)) : 0);
+      const codeSize = data.charCodeAt(offset++);
+      if (codeSize < 2 || codeSize > 8 || offset >= data.length || data.charCodeAt(offset) === 0)
+        return false;
+      offset = skipGifBlocks(data, offset);
+      image = true;
+    } else return false;
+    if (offset < 0) return false;
+  }
+  return false;
+}
+function isWebp(data) {
+  return data.startsWith("RIFF") && data.slice(8, 12) === "WEBP" && little32(data, 4) + 8 === data.length && webpChunks(data, 12, data.length, true);
+}
+function webpChunks(data, start, end, allowFrames) {
+  let image = false;
+  let offset = start;
+  while (offset + 8 <= end) {
+    const type = data.slice(offset, offset + 4);
+    const size = little32(data, offset + 4);
+    const body = offset + 8;
+    const next = body + size + size % 2;
+    if (next > end) return false;
+    if (type === "VP8 ") {
+      if (size < 11 || data.charCodeAt(body) & 1 || data.slice(body + 3, body + 6) !== "\x9D
*")
+        return false;
+      if (!((data.charCodeAt(body + 6) | data.charCodeAt(body + 7) << 8) & 16383) || !((data.charCodeAt(body + 8) | data.charCodeAt(body + 9) << 8) & 16383))
+        return false;
+      image = true;
+    } else if (type === "VP8L") {
+      if (size < 6 || data.charCodeAt(body) !== 47 || data.charCodeAt(body + 4) & 224)
+        return false;
+      image = true;
+    } else if (type === "VP8X") {
+      if (size !== 10 || !allowFrames) return false;
+    } else if (type === "ANMF") {
+      if (!allowFrames || size < 16 || !webpChunks(data, body + 16, body + size, false))
+        return false;
+      image = true;
+    }
+    offset = next;
+  }
+  return image && offset === end;
+}
+
 // ../core/src/transcriptImages.ts
 var IMAGE_DATA_URI_RE = /^data:(image\/[\w.+-]+);base64,([A-Za-z0-9+/=_-]*)$/;
 function isImageDataUri(value) {
-  return value.startsWith("data:image/") && IMAGE_DATA_URI_RE.test(value);
+  if (!value.startsWith("data:image/")) return false;
+  const match = IMAGE_DATA_URI_RE.exec(value);
+  return match !== null && isEncodedImage(match[2], match[1]);
 }
 function isImageBase64Payload(record2, key) {
-  if (typeof record2[key] !== "string") return false;
-  if (key === "data") return record2.type === "base64" && isImageMediaType(record2.media_type);
-  if (key === "base64") return isImageMediaType(record2.type);
+  const data = record2[key];
+  if (typeof data !== "string") return false;
+  if (key === "data" && record2.type === "base64") return isEncodedImage(data, record2.media_type);
+  if (key === "base64") return isEncodedImage(data, record2.type);
   return false;
 }
-function isImageMediaType(value) {
-  return typeof value === "string" && value.startsWith("image/");
-}
 function describeImageBlock(block2) {
   if (block2.type !== "image") return null;
   const source = asRecord(block2.source);
@@ -55700,10 +55890,21 @@ function createDigestTurnParser(options = {}) {
   const turns = [];
   let pendingTools = [];
   let pendingUsage = null;
+  let pendingAt = null;
   let currentId = null;
   let currentCarrier = null;
   let currentBase = null;
   let currentCounted = false;
+  const envelopes = [];
+  let pendingEnvelopes = [];
+  let currentEnvelope = null;
+  const landPending = (turn) => {
+    for (const envelope of pendingEnvelopes) {
+      envelope.turn = turn;
+      envelopes.push(envelope);
+    }
+    pendingEnvelopes = [];
+  };
   return {
     pushLine(line) {
       const trimmed = line.trim();
@@ -55717,14 +55918,16 @@ function createDigestTurnParser(options = {}) {
         return;
       }
       if (record2.isMeta === true) return;
+      const at = recordTime(record2);
       if (record2.type === "user") {
         const text = userText(record2);
-        if (text) turns.push({ kind: "human_prompt", text, toolCalls: [], usage: null });
+        if (text) turns.push({ kind: "human_prompt", text, toolCalls: [], usage: null, at });
         return;
       }
       if (record2.type !== "assistant") return;
       const message2 = record2.message;
       if (!message2 || message2.model === "<synthetic>" || !Array.isArray(message2.content)) return;
+      pendingAt ??= at;
       const id = messageIdOf(record2, message2);
       if (id === null || id !== currentId) {
         currentId = id;
@@ -55738,12 +55941,17 @@ function createDigestTurnParser(options = {}) {
           const updated = mergeUsage(currentBase, parsedUsage);
           if (currentCarrier) currentCarrier.usage = updated;
           else pendingUsage = updated;
+          if (currentEnvelope) currentEnvelope.usage = parsedUsage;
         } else if (currentCarrier) {
           currentCarrier.usage = mergeUsage(currentCarrier.usage, parsedUsage);
           currentCounted = true;
+          currentEnvelope = { turn: turns.indexOf(currentCarrier), at, usage: parsedUsage };
+          envelopes.push(currentEnvelope);
         } else {
           pendingUsage = mergeUsage(pendingUsage, parsedUsage);
           currentCounted = true;
+          currentEnvelope = { turn: -1, at, usage: parsedUsage };
+          pendingEnvelopes.push(currentEnvelope);
         }
       }
       const model = typeof message2.model === "string" ? message2.model : null;
@@ -55758,32 +55966,50 @@ function createDigestTurnParser(options = {}) {
         }
         if (part.type === "text" && typeof part.text === "string" && part.text.trim() !== "") {
           if (currentCarrier === null) {
-            const turn = { kind: "agent_text", text: part.text, toolCalls: pendingTools, usage: pendingUsage };
+            const turn = {
+              kind: "agent_text",
+              text: part.text,
+              toolCalls: pendingTools,
+              usage: pendingUsage,
+              at: pendingAt
+            };
             turns.push(turn);
             currentCarrier = turn;
             pendingUsage = null;
+            landPending(turns.length - 1);
           } else {
             turns.push({
               kind: "agent_text",
               text: part.text,
               toolCalls: pendingTools,
-              usage: currentCounted ? zeroUsage(model) : null
+              usage: currentCounted ? zeroUsage(model) : null,
+              // A sibling block of the same record began when the record did.
+              at: pendingAt ?? at
             });
           }
           pendingTools = [];
+          pendingAt = null;
         }
       }
     },
     finish() {
       if (pendingTools.length > 0 || pendingUsage !== null) {
-        turns.push({ kind: "agent_text", text: "", toolCalls: pendingTools, usage: pendingUsage });
+        turns.push({ kind: "agent_text", text: "", toolCalls: pendingTools, usage: pendingUsage, at: pendingAt });
+        landPending(turns.length - 1);
         pendingTools = [];
         pendingUsage = null;
+        pendingAt = null;
       }
       return turns;
+    },
+    usageEnvelopes() {
+      return envelopes;
     }
   };
 }
+function recordTime(record2) {
+  return typeof record2.timestamp === "string" && record2.timestamp !== "" ? record2.timestamp : null;
+}
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -55920,10 +56146,12 @@ function promptText(content) {
 function createCodexTurnParser(options = {}) {
   const turns = [];
   let pendingTools = [];
+  let pendingAt = null;
   const flushPendingTools = () => {
     if (pendingTools.length === 0) return;
-    turns.push({ kind: "agent_text", text: "", toolCalls: pendingTools, usage: null });
+    turns.push({ kind: "agent_text", text: "", toolCalls: pendingTools, usage: null, at: pendingAt });
     pendingTools = [];
+    pendingAt = null;
   };
   return {
     pushLine(line) {
@@ -55938,6 +56166,7 @@ function createCodexTurnParser(options = {}) {
         return;
       }
       if (record2.type !== "response_item") return;
+      const at = typeof record2.timestamp === "string" && record2.timestamp !== "" ? record2.timestamp : null;
       const item = record2.payload;
       if (item === null || typeof item !== "object" || Array.isArray(item)) return;
       const responseItem = item;
@@ -55949,6 +56178,7 @@ function createCodexTurnParser(options = {}) {
           if (args !== null) call.input = boundedToolInput(args);
         }
         pendingTools.push(call);
+        pendingAt ??= at;
         return;
       }
       if (responseItem.type !== "message") return;
@@ -55956,15 +56186,16 @@ function createCodexTurnParser(options = {}) {
         const text2 = promptText(responseItem.content);
         if (text2 !== null) {
           flushPendingTools();
-          turns.push({ kind: "human_prompt", text: text2, toolCalls: [], usage: null });
+          turns.push({ kind: "human_prompt", text: text2, toolCalls: [], usage: null, at });
         }
         return;
       }
       if (responseItem.role !== "assistant") return;
       const text = outputTextBlocks(responseItem.content).join("\n");
       if (text.trim() === "") return;
-      turns.push({ kind: "agent_text", text, toolCalls: pendingTools, usage: null });
+      turns.push({ kind: "agent_text", text, toolCalls: pendingTools, usage: null, at: pendingAt ?? at });
       pendingTools = [];
+      pendingAt = null;
     },
     finish() {
       flushPendingTools();
@@ -55977,10 +56208,12 @@ function createCodexTurnParser(options = {}) {
 function createCursorTurnParser(options = {}) {
   const turns = [];
   let pendingTools = [];
+  let pendingAt = null;
   const flushPendingTools = () => {
     if (pendingTools.length === 0) return;
-    turns.push({ kind: "agent_text", text: "", toolCalls: pendingTools, usage: null });
+    turns.push({ kind: "agent_text", text: "", toolCalls: pendingTools, usage: null, at: pendingAt });
     pendingTools = [];
+    pendingAt = null;
   };
   return {
     pushLine(line) {
@@ -55994,9 +56227,10 @@ function createCursorTurnParser(options = {}) {
       } catch {
         return;
       }
+      const at = typeof record2.createdAt === "string" && record2.createdAt !== "" ? record2.createdAt : null;
       if (record2.type === "user" && typeof record2.text === "string" && record2.text.trim() !== "") {
         flushPendingTools();
-        turns.push({ kind: "human_prompt", text: record2.text, toolCalls: [], usage: null });
+        turns.push({ kind: "human_prompt", text: record2.text, toolCalls: [], usage: null, at });
         return;
       }
       if (record2.type === "tool" && typeof record2.name === "string") {
@@ -56006,11 +56240,13 @@ function createCursorTurnParser(options = {}) {
           call.input = boundedToolInput(record2.args);
         }
         pendingTools.push(call);
+        pendingAt ??= at;
         return;
       }
       if (record2.type === "agent" && typeof record2.text === "string" && record2.text.trim() !== "") {
-        turns.push({ kind: "agent_text", text: record2.text, toolCalls: pendingTools, usage: null });
+        turns.push({ kind: "agent_text", text: record2.text, toolCalls: pendingTools, usage: null, at: pendingAt ?? at });
         pendingTools = [];
+        pendingAt = null;
       }
     },
     finish() {
@@ -56076,7 +56312,7 @@ function parseCursorRunEventsDetailed(runs, options = {}) {
   let text = "";
   const flush2 = () => {
     if (text !== "" || pendingTools.length > 0 || pendingTokens > 0) {
-      turns.push({ kind: "agent_text", text, toolCalls: pendingTools, usage: null });
+      turns.push({ kind: "agent_text", text, toolCalls: pendingTools, usage: null, at: null });
       turnTokens.push(pendingTokens);
     }
     text = "";
@@ -56126,7 +56362,7 @@ function parseCursorRunEventsDetailed(runs, options = {}) {
         const prompt = stringField(asRecord3(data?.userMessage), "text");
         if (!prompt) continue;
         if (text !== "") flush2();
-        turns.push({ kind: "human_prompt", text: prompt, toolCalls: [], usage: null });
+        turns.push({ kind: "human_prompt", text: prompt, toolCalls: [], usage: null, at: null });
         turnTokens.push(0);
         continue;
       }
@@ -56183,10 +56419,16 @@ function normalizeUrl(raw) {
 
 // ../core/src/sessionTurns.ts
 function parseSessionTurns(source, transcript, options = {}) {
-  if (source === "cursor-cloud") return parseCursorRunEvents(envelopeRuns(transcript), options);
+  return parseSessionTurnsDetailed(source, transcript, options).turns;
+}
+function parseSessionTurnsDetailed(source, transcript, options = {}) {
+  if (source === "cursor-cloud") {
+    return { turns: parseCursorRunEvents(envelopeRuns(transcript), options), envelopes: [] };
+  }
   const parser = createSessionTurnParser(source, options);
   for (const line of transcript.split("\n")) parser.pushLine(line);
-  return parser.finish();
+  const turns = parser.finish();
+  return { turns, envelopes: parser.usageEnvelopes?.() ?? [] };
 }
 function createSessionTurnParser(source, options = {}) {
   if (source === "codex") return createCodexTurnParser(options);
@@ -56336,6 +56578,38 @@ function scrubBreadcrumb(breadcrumb) {
   return breadcrumb;
 }
 
+// ../core/src/freshness.ts
+function describeDataAge(generatedAt, now) {
+  const ageMs = now.getTime() - generatedAt.getTime();
+  if (ageMs < 0) return "just now";
+  const minutes = Math.floor(ageMs / 6e4);
+  if (minutes < 1) return "just now";
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  return `${days}d ago`;
+}
+
+// ../core/src/onboarding.ts
+var SAME_HOUR_MS = 60 * 60 * 1e3;
+function describeSyncSignals(member, now, noUpload = "no sessions uploaded yet") {
+  const session = member.lastSessionActivityAt;
+  const poll = member.lastCheckedInAt;
+  const error62 = member.lastSyncErrorAt;
+  const paused = member.syncPaused === true;
+  if (session === null && poll === null && error62 === null) return null;
+  const age = (at) => describeDataAge(new Date(at), now);
+  const apart = (a, b2) => b2 === null || Math.abs(Date.parse(a) - Date.parse(b2)) > SAME_HOUR_MS;
+  const parts = [session === null ? noUpload : `last uploaded session ${age(session)}`];
+  if (error62 !== null) parts.push(`reported sync error ${age(error62)}`);
+  if (paused) parts.push("syncing paused");
+  const pollSays = error62 !== null ? apart(poll ?? error62, error62) : paused || apart(poll ?? "", session);
+  if (poll !== null && pollSays) parts.push(`last poll ${age(poll)}`);
+  const line = parts.join(", ");
+  return `${line.charAt(0).toUpperCase()}${line.slice(1)}.`;
+}
+
 // ../core/src/sessionIngest.ts
 var SESSION_SOURCES = [
   "claude-code",
@@ -83283,9 +83557,20 @@ var storedCredentialsSchema = external_exports.object({
    * (`powerplant folders add`). */
   scopePaths: external_exports.array(external_exports.string()).optional(),
   /** macOS privacy roots the member explicitly allowed Powerplant to inspect
-   * for Git metadata. This does not widen capture: org policy still decides
-   * which discovered repositories upload. */
+   * for Git metadata, and that macOS let it read. This does not widen
+   * capture: org policy still decides which discovered repositories upload. */
   repoDiscoveryRoots: external_exports.array(external_exports.string()).optional(),
+  /** When the member answered yes to Git metadata scans of macOS-protected
+   * session folders (ISO 8601). One answer for this enrollment: later init
+   * runs scan a newly seen root after an explanation, without asking again.
+   * Absent = never asked, or never answered yes. */
+  repoDiscoveryConsentedAt: external_exports.string().optional(),
+  /** Protected roots the member allowed but macOS refused to let Powerplant
+   * read (a declined Files and Folders dialog). macOS remembers that refusal
+   * and shows no second dialog, so init re-reads these roots on every run
+   * without a question and moves a root to repoDiscoveryRoots once the
+   * member enables it in System Settings. */
+  repoDiscoveryBlockedRoots: external_exports.array(external_exports.string()).optional(),
   /** When this enrollment's deep first sync completed; absent = still owed,
    * so the next sync sweeps DEEP_FIRST_SYNC_DAYS instead of the rolling window. */
   deepSyncedAt: external_exports.string().optional()
@@ -83371,7 +83656,7 @@ import os6 from "node:os";
 // ../../apps/collector/src/http.ts
 var import_undici = __toESM(require_undici(), 1);
 var CLI_VERSION_HEADER = "x-powerplant-cli-version";
-var cliVersion = true ? "0.4.6" : "0.0.0-checkout";
+var cliVersion = true ? "0.4.8" : "0.0.0-checkout";
 function cliVersionHeaders() {
   return { [CLI_VERSION_HEADER]: cliVersion, "user-agent": `powerplant-cli/${cliVersion}` };
 }
@@ -83556,8 +83841,8 @@ function unconsentedProtectedRoot(candidate, environment = {}) {
   );
   return consented ? null : protectedRoot;
 }
-var DENIED = { kind: "denied" };
 var NONE = { kind: "none" };
+var deniedAt = (p) => ({ kind: "denied", path: p });
 function consentGate(candidate, environment) {
   const root = unconsentedProtectedRoot(candidate, environment);
   return root === null ? null : { kind: "unconsented", root, path: path2.resolve(candidate) };
@@ -83566,7 +83851,7 @@ function readProbe(p) {
   try {
     return { kind: "found", value: readFileSync3(p, "utf8") };
   } catch (cause) {
-    return isPermissionError(cause) ? DENIED : NONE;
+    return isPermissionError(cause) ? deniedAt(p) : NONE;
   }
 }
 function gitDirReferenceProbe(cwd, environment) {
@@ -83576,7 +83861,7 @@ function gitDirReferenceProbe(cwd, environment) {
   for (; ; ) {
     const gitPath = path2.join(dir, ".git");
     const kind = statKind(gitPath);
-    if (kind === "denied") return DENIED;
+    if (kind === "denied") return deniedAt(gitPath);
     if (kind === "dir") return { kind: "found", value: gitPath };
     if (kind === "file") {
       const pointer = readProbe(gitPath);
@@ -83600,7 +83885,7 @@ function gitDirsProbe(cwd, environment) {
   const gitDirGate = consentGate(gitDir, environment);
   if (gitDirGate) return gitDirGate;
   const commondir = readProbe(path2.join(gitDir, "commondir"));
-  if (commondir.kind === "denied") return DENIED;
+  if (commondir.kind === "denied") return commondir;
   const pointer = commondir.kind === "found" ? commondir.value.trim() : "";
   const commonDir = pointer ? path2.resolve(gitDir, pointer) : gitDir;
   const commonDirGate = consentGate(commonDir, environment);
@@ -83835,10 +84120,15 @@ function tokenRejected(route) {
     `${route} rejected this machine's token (revoked or unknown). Re-enroll this machine (powerplant enroll, or pnpm collector enroll from the checkout).`
   );
 }
-async function fetchCapturePolicy(apiUrl, machineToken) {
+function capturePolicyUrl(apiUrl, request2) {
+  const url2 = new URL(`${apiUrl}/api/collector/capture-policy`);
+  if (request2.paused !== void 0) url2.searchParams.set("paused", String(request2.paused));
+  return url2.toString();
+}
+async function fetchCapturePolicy(apiUrl, machineToken, request2 = {}) {
   const response = await fetchWithRetry(
     "fetching the org's capture policy",
-    `${apiUrl}/api/collector/capture-policy`,
+    capturePolicyUrl(apiUrl, request2),
     { headers: { authorization: `Bearer ${machineToken}` } }
   );
   if (response.status === 401) {
@@ -83869,6 +84159,19 @@ async function fetchCapturePolicy(apiUrl, machineToken) {
   );
   return result.data;
 }
+var CHECK_IN_INTERVAL_MS = 30 * 6e4;
+async function reportCheckIn(apiUrl, machineToken, paused, fetcher = fetch) {
+  try {
+    const response = await fetcher(capturePolicyUrl(apiUrl, { paused }), {
+      headers: { ...cliVersionHeaders(), authorization: `Bearer ${machineToken}` },
+      signal: AbortSignal.timeout(3e3)
+    });
+    await response.body?.cancel();
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
 async function uploadSessions(apiUrl, machineToken, items) {
   let upserted = 0;
   let unchanged = 0;
@@ -84409,7 +84712,6 @@ function removeFolder(config2, rawPath, enrollCommand, log3, deps = defaultDeps)
 
 // ../../apps/collector/src/diagnostics.ts
 import { createHmac } from "node:crypto";
-var DIAGNOSTIC_INTERVAL_MS = 30 * 6e4;
 function observeFileDiagnostic(observer, file2) {
   try {
     observer?.(file2);
@@ -84527,8 +84829,7 @@ function createDiagnosticsReporter(credentials, send = createDiagnosticSender())
   let pending = Promise.resolve();
   let enrollment = null;
   let lastIssue = null;
-  let paused = false;
-  const report2 = (detailed) => {
+  const report2 = () => {
     try {
       const current = credentials();
       if (!current) return;
@@ -84537,29 +84838,20 @@ function createDiagnosticsReporter(credentials, send = createDiagnosticSender())
         lastIssue = null;
       }
       const matching = pass !== null && passEnrollments.get(pass) === current.token ? pass : null;
-      if (detailed) {
-        if (matching === null) return;
-        const issue2 = issueSignature(matching);
-        if (issue2 === lastIssue) return;
-        lastIssue = issue2;
-      }
-      const body = collectorDiagnosticSchema.parse({
-        state: matching?.outcome === "running" ? "syncing" : paused ? "paused" : "idle",
-        pass: detailed ? matching : null
-      });
+      if (matching === null) return;
+      const issue2 = issueSignature(matching);
+      if (issue2 === lastIssue) return;
+      lastIssue = issue2;
+      const body = collectorDiagnosticSchema.parse({ state: "idle", pass: matching });
       pending = send(current, body).catch(() => void 0);
     } catch {
     }
   };
   return {
-    heartbeat: (isPaused = false) => {
-      paused = isPaused;
-      report2(false);
-    },
     flush: () => pending,
     onDiagnostics: (diagnostic) => {
       pass = diagnostic;
-      if (diagnostic.outcome !== "running") report2(true);
+      if (diagnostic.outcome !== "running") report2();
     }
   };
 }
@@ -85071,6 +85363,7 @@ function readCodexTranscriptHints(home, roots) {
 }
 
 // ../../apps/collector/src/codexCli.ts
+import { closeSync as closeSync3, mkdirSync as mkdirSync2, openSync as openSync3, renameSync, rmSync, utimesSync, writeSync } from "node:fs";
 import os8 from "node:os";
 import path7 from "node:path";
 import { setImmediate as yieldToEventLoop2 } from "node:timers/promises";
@@ -85145,19 +85438,96 @@ function parseCodexRollout(text) {
     ...typeof git?.repository_url === "string" && repoFullNameFrom(git.repository_url)
   };
 }
-function parseRolloutFile(rolloutPath) {
-  const text = readIfExists(rolloutPath);
-  return text === null ? null : parseCodexRollout(text);
-}
+function foldRolloutPages(pages) {
+  const first = (key) => pages.find((page) => page[key] !== void 0)?.[key];
+  const last = (key) => [...pages].reverse().find((page) => page[key] !== void 0)?.[key];
+  const sum2 = (measured2) => measured2.length === 0 ? null : measured2.reduce((total, page) => addCodexTotals(total, page));
+  const measured = pages.map((page) => page.totals).filter((totals) => totals !== null);
+  const measuredFast = pages.filter((page) => page.totals !== null).map((page) => page.fastTotals);
+  const sessionId = first("sessionId");
+  const startedAt = first("startedAt");
+  const endedAt = last("endedAt");
+  const model = last("model");
+  const speedMode = last("speedMode");
+  const cwd = first("cwd");
+  const gitBranch = first("gitBranch");
+  const repoName = first("repoName");
+  const repoFullName = first("repoFullName");
+  return {
+    kind: pages[0].kind,
+    ...sessionId !== void 0 && { sessionId },
+    ...startedAt !== void 0 && { startedAt },
+    ...endedAt !== void 0 && { endedAt },
+    ...model !== void 0 && { model },
+    totals: sum2(measured),
+    fastTotals: measuredFast.every((fast) => fast !== null) ? sum2(measuredFast) : null,
+    ...speedMode !== void 0 && { speedMode },
+    ...cwd !== void 0 && { cwd },
+    ...gitBranch !== void 0 && { gitBranch },
+    ...repoName !== void 0 && { repoName },
+    ...repoFullName !== void 0 && { repoFullName }
+  };
+}
+function rolloutIdentity(rolloutPath) {
+  const name = path7.basename(rolloutPath, ".jsonl");
+  const [head, pageId, ...rest] = name.split("_");
+  const threadId2 = head.slice(-36);
+  const conventional = rest.length === 0 && head.startsWith("rollout-") && head.at(-37) === "-" && SESSION_UUID.test(threadId2) && (pageId === void 0 || SESSION_UUID.test(pageId));
+  if (!conventional) return { threadId: name, page: false };
+  return { threadId: threadId2.toLowerCase(), page: pageId !== void 0 };
+}
+function codexSpoolDir(home) {
+  return path7.join(home, ".config", "powerplant", "codex");
+}
+function mergedSpoolIsFresh(spoolPath, mtimeMs) {
+  const existing = statIfExists(spoolPath);
+  return existing !== null && Math.abs(existing.mtimeMs - mtimeMs) < 1;
+}
+var MergedSpoolWriter = class {
+  constructor(spoolPath) {
+    this.spoolPath = spoolPath;
+    mkdirSync2(path7.dirname(spoolPath), { recursive: true, mode: 448 });
+    this.tmpPath = `${spoolPath}.${process.pid}.tmp`;
+    this.fd = openSync3(this.tmpPath, "w", 384);
+  }
+  spoolPath;
+  tmpPath;
+  fd;
+  bytes = 0;
+  append(pageText) {
+    if (this.fd === void 0) throw new Error("merged transcript already closed");
+    const text = pageText.endsWith("\n") ? pageText : `${pageText}
+`;
+    this.bytes += writeSync(this.fd, text);
+  }
+  /** Stamps the newest page's mtime and publishes the file; returns its size. */
+  finish(mtimeMs) {
+    this.close();
+    utimesSync(this.tmpPath, mtimeMs / 1e3, mtimeMs / 1e3);
+    renameSync(this.tmpPath, this.spoolPath);
+    return this.bytes;
+  }
+  abandon() {
+    this.close();
+    rmSync(this.tmpPath, { force: true });
+  }
+  close() {
+    if (this.fd === void 0) return;
+    closeSync3(this.fd);
+    this.fd = void 0;
+  }
+};
 function rolloutLocation(rolloutPath) {
   const record2 = readFirstRecord(rolloutPath, (candidate) => candidate.type === "session_meta");
   const meta3 = record2?.payload;
   if (!meta3 || typeof meta3 !== "object" || Array.isArray(meta3)) return { kind: "session", totals: null, fastTotals: null };
   const { cwd, id, session_id: fallbackId } = meta3;
   const sessionId = id ?? fallbackId;
+  const startedAt = record2?.timestamp;
   return {
     kind: isSidecarThread(meta3) ? "subagent" : "session",
     ...typeof sessionId === "string" && { sessionId },
+    ...typeof startedAt === "string" && { startedAt },
     totals: null,
     fastTotals: null,
     ...typeof cwd === "string" && cwd !== "" && { cwd }
@@ -85212,89 +85582,128 @@ async function collectCodexSessions(options = {}) {
   const now = options.now ?? Date.now();
   const capture = options.capture ?? captureEverythingUnresolved;
   const maxBytes = options.maxTranscriptBytes ?? MAX_TRANSCRIPT_FILE_BYTES;
+  const spoolDir = options.spoolDir ?? codexSpoolDir(options.homeDir ?? os8.homedir());
   const items = [];
   const candidates = [];
   const unreadable = [];
   const skips = { skippedOutOfScope: 0, skippedNoRepo: 0 };
   let skippedSubagentThreads = 0;
   let skippedTooLarge = 0;
+  let mergedThreads = 0;
+  let largestMergedBytes = 0;
   const externalIdOf = (rolloutPath) => path7.basename(rolloutPath, ".jsonl");
-  const seen = /* @__PURE__ */ new Set();
-  const admitFrom = async (files, archived, sessionId) => {
-    for (const rolloutPath of files) {
-      if (seen.has(rolloutPath)) continue;
+  const files = /* @__PURE__ */ new Map();
+  const observe = async (paths, archived, hintSessionId) => {
+    for (const rolloutPath of paths) {
+      const known = files.get(rolloutPath);
+      if (known !== void 0) {
+        if (hintSessionId === void 0) delete known.hintSessionIds;
+        else known.hintSessionIds?.push(hintSessionId);
+        continue;
+      }
       await yieldToEventLoop2();
       const stat = statIfExists(rolloutPath);
       if (!stat) continue;
-      seen.add(rolloutPath);
-      if (options.sinceMs !== void 0 && Math.max(stat.mtimeMs, stat.ctimeMs) < options.sinceMs)
-        continue;
-      if (stat.size > maxBytes) {
+      files.set(rolloutPath, {
+        rolloutPath,
+        archived,
+        identity: rolloutIdentity(rolloutPath),
+        mtimeMs: stat.mtimeMs,
+        changedMs: Math.max(stat.mtimeMs, stat.ctimeMs),
+        sizeBytes: stat.size,
+        ...hintSessionId !== void 0 && { hintSessionIds: [hintSessionId] }
+      });
+    }
+  };
+  const archiveDir = codexArchivedSessionsDir(sessionsDir);
+  const hintHome = options.homeDir ?? (options.codexDir === void 0 ? os8.homedir() : void 0);
+  if (hintHome !== void 0) {
+    for (const hint of readCodexTranscriptHints(hintHome, [sessionsDir, archiveDir])) {
+      await observe([hint.rolloutPath], hint.archived, hint.sessionId);
+    }
+  }
+  await observe(rolloutFiles(sessionsDir), false);
+  await observe(rolloutFiles(archiveDir), true);
+  const byThread = /* @__PURE__ */ new Map();
+  for (const file2 of files.values()) {
+    const thread = byThread.get(file2.identity.threadId);
+    if (thread === void 0) byThread.set(file2.identity.threadId, [file2]);
+    else thread.push(file2);
+  }
+  for (const [threadId2, observed] of byThread) {
+    const stored = dedupeStoreCopies(observed);
+    let externalId = externalIdOf((stored.find((file2) => !file2.identity.page) ?? stored[0]).rolloutPath);
+    try {
+      const spoolPath = stored.length > 1 ? path7.join(spoolDir, `${threadId2}.jsonl`) : void 0;
+      const changedMs = Math.max(...stored.map((file2) => file2.changedMs));
+      if (options.sinceMs !== void 0 && changedMs < options.sinceMs) {
+        const neverMerged = spoolPath !== void 0 && !options.locationsOnly && statIfExists(spoolPath) === null;
+        if (!neverMerged) continue;
+      }
+      await yieldToEventLoop2();
+      const named = stored.filter((file2) => {
+        if (file2.hintSessionIds === void 0) return true;
+        const { sessionId } = rolloutLocation(file2.rolloutPath);
+        return sessionId !== void 0 && file2.hintSessionIds.includes(sessionId);
+      });
+      if (named.length === 0) continue;
+      const threadFiles = named.length > 1 ? orderPages(named) : named;
+      const base = threadFiles[0];
+      externalId = externalIdOf(base.rolloutPath);
+      const mtimeMs = Math.max(...threadFiles.map((file2) => file2.mtimeMs));
+      const sizeBytes = threadFiles.reduce((sum2, file2) => sum2 + file2.sizeBytes, 0);
+      if (sizeBytes > maxBytes) {
         skippedTooLarge += 1;
         observeFileDiagnostic(options.onFileDiagnostic, {
-          path: rolloutPath,
+          path: base.rolloutPath,
           reason: "too_large",
-          sizeBytes: stat.size
+          sizeBytes
         });
         continue;
       }
-      try {
-        const location = rolloutLocation(rolloutPath);
-        if (sessionId !== void 0 && location.sessionId !== sessionId) {
-          seen.delete(rolloutPath);
-          continue;
-        }
-        if (location.kind === "subagent") {
-          skippedSubagentThreads += 1;
-          continue;
-        }
-        const decision = captureDecision(location.cwd, capture);
-        if (!decision.capture) {
-          countCaptureSkip(skips, decision.reason);
-          continue;
-        }
-        if (options.locationsOnly) {
-          items.push({
-            mtimeMs: stat.mtimeMs,
-            transcriptPath: rolloutPath,
-            ...location.cwd && { cwd: location.cwd },
-            item: {
-              source: "codex",
-              externalId: externalIdOf(rolloutPath),
-              status: now - stat.mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive",
-              archived,
-              capturedVia: decision.via
-            }
-          });
-          continue;
-        }
-        candidates.push({
-          rolloutPath,
-          archived,
-          mtimeMs: stat.mtimeMs,
+      const location = rolloutLocation(base.rolloutPath);
+      if (location.kind === "subagent") {
+        skippedSubagentThreads += 1;
+        continue;
+      }
+      const decision = captureDecision(location.cwd, capture);
+      if (!decision.capture) {
+        countCaptureSkip(skips, decision.reason);
+        continue;
+      }
+      const thread = {
+        externalId,
+        files: threadFiles,
+        ...threadFiles.length > 1 && spoolPath !== void 0 && { spoolPath },
+        mtimeMs,
+        archived: threadFiles.every((file2) => file2.archived)
+      };
+      if (options.locationsOnly) {
+        items.push({
+          mtimeMs,
+          transcriptPath: base.rolloutPath,
           ...location.cwd && { cwd: location.cwd },
-          decision
-        });
-      } catch (error62) {
-        unreadable.push(`${externalIdOf(rolloutPath)}: ${describeReadError(error62)}`);
-        observeFileDiagnostic(options.onFileDiagnostic, {
-          path: rolloutPath,
-          reason: "unreadable",
-          sizeBytes: null,
-          errorCode: diagnosticErrorCode(error62)
+          item: {
+            source: "codex",
+            externalId,
+            status: now - mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive",
+            archived: thread.archived,
+            capturedVia: decision.via
+          }
         });
+        continue;
       }
-    }
-  };
-  const archiveDir = codexArchivedSessionsDir(sessionsDir);
-  const hintHome = options.homeDir ?? (options.codexDir === void 0 ? os8.homedir() : void 0);
-  if (hintHome !== void 0) {
-    for (const hint of readCodexTranscriptHints(hintHome, [sessionsDir, archiveDir])) {
-      await admitFrom([hint.rolloutPath], hint.archived, hint.sessionId);
+      candidates.push({ thread, ...location.cwd && { cwd: location.cwd }, decision });
+    } catch (error62) {
+      unreadable.push(`${externalId}: ${describeReadError(error62)}`);
+      observeFileDiagnostic(options.onFileDiagnostic, {
+        path: stored[0].rolloutPath,
+        reason: "unreadable",
+        sizeBytes: null,
+        errorCode: diagnosticErrorCode(error62)
+      });
     }
   }
-  await admitFrom(rolloutFiles(sessionsDir), false);
-  await admitFrom(rolloutFiles(archiveDir), true);
   if (options.locationsOnly) {
     return {
       sessions: items.sort((a, b2) => b2.mtimeMs - a.mtimeMs),
@@ -85302,30 +85711,59 @@ async function collectCodexSessions(options = {}) {
       skippedSubagentThreads,
       skippedTooLarge,
       unreadable,
-      heldBack: 0
+      heldBack: 0,
+      mergedThreads: 0,
+      largestMergedBytes: 0
     };
   }
-  candidates.sort((a, b2) => b2.mtimeMs - a.mtimeMs);
+  candidates.sort((a, b2) => b2.thread.mtimeMs - a.thread.mtimeMs);
   const chosen = options.maxSessions === void 0 ? candidates : candidates.slice(0, options.maxSessions);
   const threadNames = chosen.length > 0 ? loadThreadNames(sessionsDir) : /* @__PURE__ */ new Map();
   for (const candidate of chosen) {
     await yieldToEventLoop2();
-    const { rolloutPath, archived, mtimeMs, cwd, decision } = candidate;
+    const { thread, cwd, decision } = candidate;
+    let writer;
     try {
-      const summary = parseRolloutFile(rolloutPath);
-      if (!summary) continue;
+      const rewrite = thread.spoolPath !== void 0 && !mergedSpoolIsFresh(thread.spoolPath, thread.mtimeMs);
+      if (thread.spoolPath !== void 0 && rewrite) writer = new MergedSpoolWriter(thread.spoolPath);
+      const pages = [];
+      let vanished = false;
+      for (const file2 of thread.files) {
+        const text = readIfExists(file2.rolloutPath);
+        if (text === null) {
+          vanished = true;
+          break;
+        }
+        const page = parseCodexRollout(text);
+        if (page === null) continue;
+        pages.push(page);
+        writer?.append(text);
+      }
+      if (vanished || pages.length === 0) {
+        writer?.abandon();
+        continue;
+      }
+      const summary = foldRolloutPages(pages);
+      let transcriptPath = thread.files[0].rolloutPath;
+      if (thread.spoolPath !== void 0) {
+        const mergedBytes = writer ? writer.finish(thread.mtimeMs) : statIfExists(thread.spoolPath)?.size ?? 0;
+        writer = void 0;
+        transcriptPath = thread.spoolPath;
+        mergedThreads += 1;
+        largestMergedBytes = Math.max(largestMergedBytes, mergedBytes);
+      }
       const repoDir = summary.repoName ?? (cwd ? path7.basename(cwd) : void 0);
       const repoFullName = decision.repoFullName ?? summary.repoFullName;
       const title = summary.sessionId ? threadNames.get(summary.sessionId) : void 0;
       items.push({
-        mtimeMs,
-        transcriptPath: rolloutPath,
+        mtimeMs: thread.mtimeMs,
+        transcriptPath,
         ...cwd && { cwd },
         item: {
           source: "codex",
-          externalId: externalIdOf(rolloutPath),
-          status: now - mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive",
-          archived,
+          externalId: thread.externalId,
+          status: now - thread.mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive",
+          archived: thread.archived,
           ...summary.startedAt && { startedAt: summary.startedAt },
           ...summary.endedAt && { endedAt: summary.endedAt },
           ...summary.model && { model: summary.model },
@@ -85350,9 +85788,10 @@ async function collectCodexSessions(options = {}) {
         }
       });
     } catch (error62) {
-      unreadable.push(`${externalIdOf(rolloutPath)}: ${describeReadError(error62)}`);
+      writer?.abandon();
+      unreadable.push(`${thread.externalId}: ${describeReadError(error62)}`);
       observeFileDiagnostic(options.onFileDiagnostic, {
-        path: rolloutPath,
+        path: thread.files[0].rolloutPath,
         reason: "unreadable",
         sizeBytes: null,
         errorCode: diagnosticErrorCode(error62)
@@ -85365,15 +85804,32 @@ async function collectCodexSessions(options = {}) {
     skippedSubagentThreads,
     skippedTooLarge,
     unreadable,
-    heldBack: candidates.length - chosen.length
+    heldBack: candidates.length - chosen.length,
+    mergedThreads,
+    largestMergedBytes
   };
 }
+function dedupeStoreCopies(threadFiles) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const file2 of threadFiles) {
+    const name = path7.basename(file2.rolloutPath);
+    const known = byName.get(name);
+    if (known === void 0 || file2.archived) byName.set(name, file2);
+  }
+  return [...byName.values()];
+}
+function orderPages(threadFiles) {
+  const orderOf = (file2) => rolloutLocation(file2.rolloutPath).startedAt ?? "";
+  return threadFiles.map((file2) => ({ file: file2, order: orderOf(file2) })).sort(
+    (a, b2) => Number(a.file.identity.page) - Number(b2.file.identity.page) || a.order.localeCompare(b2.order) || a.file.rolloutPath.localeCompare(b2.file.rolloutPath)
+  ).map((entry) => entry.file);
+}
 function codexThreadCwd(threadId2, sessionsDir = path7.join(os8.homedir(), ".codex", "sessions")) {
   if (!SESSION_UUID.test(threadId2)) return void 0;
-  const suffix = `-${threadId2.toLowerCase()}.jsonl`;
+  const wanted = threadId2.toLowerCase();
   for (const root of [sessionsDir, codexArchivedSessionsDir(sessionsDir)]) {
     for (const rolloutPath of rolloutFiles(root)) {
-      if (!path7.basename(rolloutPath).toLowerCase().endsWith(suffix)) continue;
+      if (rolloutIdentity(rolloutPath).threadId !== wanted) continue;
       const cwd = rolloutLocation(rolloutPath).cwd;
       if (cwd !== void 0) return cwd;
     }
@@ -85387,7 +85843,7 @@ import path10 from "node:path";
 
 // ../../apps/collector/src/cursorLocal.ts
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, utimesSync as utimesSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync4, utimesSync as utimesSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import os10 from "node:os";
 import path9 from "node:path";
 import { fileURLToPath } from "node:url";
@@ -85395,15 +85851,15 @@ import { fileURLToPath } from "node:url";
 // ../../apps/collector/src/cursorTranscriptFile.ts
 import { createHash as createHash3 } from "node:crypto";
 import {
-  closeSync as closeSync3,
+  closeSync as closeSync4,
   existsSync,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync2,
-  openSync as openSync3,
+  mkdirSync as mkdirSync3,
+  openSync as openSync4,
   readSync as readSync3,
   readdirSync as readdirSync3,
   realpathSync as realpathSync2,
-  utimesSync,
+  utimesSync as utimesSync2,
   writeFileSync as writeFileSync2
 } from "node:fs";
 import os9 from "node:os";
@@ -85472,7 +85928,7 @@ var hintSchema2 = external_exports.object({
   model: external_exports.string().max(256).optional()
 });
 function readBounded(file2, maxBytes) {
-  const fd = openSync3(file2, "r");
+  const fd = openSync4(file2, "r");
   try {
     const chunks = [];
     let bytes = 0;
@@ -85485,7 +85941,7 @@ function readBounded(file2, maxBytes) {
     }
     return null;
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 function collectCursorTranscriptFiles(options, isDatabaseSession, result, databaseSpoolDir, spoolName) {
@@ -85589,9 +86045,9 @@ function collectCursorTranscriptFiles(options, isDatabaseSession, result, databa
           result.skippedTooLarge++;
           continue;
         }
-        mkdirSync2(spoolDir, { recursive: true, mode: 448 });
+        mkdirSync3(spoolDir, { recursive: true, mode: 448 });
         writeFileSync2(spool, body, { mode: 384 });
-        utimesSync(spool, stat.atime, stat.mtime);
+        utimesSync2(spool, stat.atime, stat.mtime);
       }
       result.sessions.push({
         cwd,
@@ -85942,13 +86398,13 @@ function collectFromStore(db, userDir, options, result, knownIds) {
           ...transcript.bubblesOmitted > 0 && { bubblesOmitted: transcript.bubblesOmitted }
         };
         if (!spoolDirReady) {
-          mkdirSync3(spoolDir, { recursive: true });
+          mkdirSync4(spoolDir, { recursive: true });
           spoolDirReady = true;
         }
         const body = [meta3, ...transcript.lines].map((line) => JSON.stringify(line)).join("\n");
         writeFileSync3(spoolPath, `${body}
 `, "utf8");
-        utimesSync2(spoolPath, new Date(lastUpdatedAt), new Date(lastUpdatedAt));
+        utimesSync3(spoolPath, new Date(lastUpdatedAt), new Date(lastUpdatedAt));
       }
       const repoSourceDir = facts.repoPath ?? cwd;
       const startBranch = facts.branches[0];
@@ -86080,25 +86536,33 @@ function groupProtectedSessions(sessions, environment = {}) {
     if (!session.cwd) continue;
     const cwd = path10.resolve(session.cwd);
     const directRoot = macPrivacyProtectedRoot(cwd, environment);
-    const gitDir = directRoot === null ? resolveGitDirReference(cwd, environment) : null;
-    const root = directRoot ?? (gitDir ? macPrivacyProtectedRoot(gitDir, environment) : null);
-    if (root === null) continue;
-    const folder = directRoot !== null || gitDir === null ? cwd : checkoutOfGitDir(gitDir);
-    tally.add(root, folder, cwd);
+    if (directRoot !== null) tally.add(directRoot, cwd, cwd);
+    const gitDir = resolveGitDirReference(cwd, environment);
+    const checkoutRoot = gitDir ? macPrivacyProtectedRoot(gitDir, environment) : null;
+    if (checkoutRoot !== null && checkoutRoot !== directRoot) {
+      tally.add(checkoutRoot, checkoutOfGitDir(gitDir), cwd);
+    }
   }
   return tally.entries();
 }
 var defaultAllowDeps = {
   load: loadCredentials,
   persist: saveCredentials,
-  probeRepo: repoProber
+  probeRepo: repoProber,
+  now: Date.now
 };
+function protectedRootReview(credentials, root) {
+  const resolved = path10.resolve(root);
+  if ((credentials.repoDiscoveryRoots ?? []).includes(resolved)) return "allowed";
+  if ((credentials.repoDiscoveryBlockedRoots ?? []).includes(resolved)) return "blocked";
+  return "unreviewed";
+}
 function allowProtectedRepoDiscovery(config2, found, environment = {}, deps = defaultAllowDeps) {
   const enrollment = deps.load(config2.appEnv);
   if (enrollment === null) {
     throw new ExpectedCliError("This machine must be enrolled before protected folders can be reviewed.");
   }
-  const candidateRoots = found.map((entry) => path10.resolve(entry.root));
+  const candidateRoots = rootsOf(found);
   const invalid = candidateRoots.find(
     (root) => macPrivacyProtectedRoot(root, environment) !== root
   );
@@ -86119,53 +86583,92 @@ function allowProtectedRepoDiscovery(config2, found, environment = {}, deps = de
     needsReview: []
   };
   const needsReview = new ProtectedRootTally(environment);
+  const refusedElsewhere = new ProtectedRootTally(environment);
   for (const entry of found) {
+    const root = path10.resolve(entry.root);
     const probes = entry.folders.flatMap(
       (folder) => folder.cwds.map((cwd) => ({ cwd, probe: probeOf(cwd), folder }))
     );
+    let deniedHere = false;
     let unconsented = 0;
     const countedFolderTargets = /* @__PURE__ */ new Set();
+    const countOnce = (target, sessionCount) => {
+      const counted = countedFolderTargets.has(target);
+      countedFolderTargets.add(target);
+      return counted ? 0 : sessionCount;
+    };
     for (const { cwd, probe, folder } of probes) {
+      if (probe.kind === "denied") {
+        const refusedRoot = macPrivacyProtectedRoot(probe.path, environment);
+        if (refusedRoot === root) deniedHere = true;
+        else if (refusedRoot !== null) {
+          const checkout2 = checkoutOfGitDir(probe.path);
+          const target2 = [folder.path, refusedRoot, checkout2].join("\0");
+          refusedElsewhere.add(refusedRoot, checkout2, cwd, countOnce(target2, folder.sessionCount));
+        }
+        continue;
+      }
       if (probe.kind !== "unconsented") continue;
       unconsented += 1;
       const checkout = checkoutOfGitDir(probe.path);
       const target = [folder.path, probe.root, checkout].join("\0");
-      needsReview.add(
-        probe.root,
-        checkout,
-        cwd,
-        countedFolderTargets.has(target) ? 0 : folder.sessionCount
-      );
-      countedFolderTargets.add(target);
+      needsReview.add(probe.root, checkout, cwd, countOnce(target, folder.sessionCount));
     }
     if (probes.some(({ probe }) => probe.kind === "found")) outcome.enabled.push(entry);
-    else if (probes.some(({ probe }) => probe.kind === "denied")) outcome.blocked.push(entry);
+    else if (deniedHere) outcome.blocked.push(entry);
     else if (unconsented > 0) outcome.unreviewed.push(entry);
     else outcome.unmatched.push(entry);
   }
+  const blockedRoots = new Set(rootsOf(outcome.blocked));
+  outcome.blocked.push(
+    ...refusedElsewhere.entries().filter((entry) => !blockedRoots.has(entry.root))
+  );
   outcome.needsReview = needsReview.entries();
-  const consented = [...outcome.enabled, ...outcome.unmatched];
-  if (consented.length === 0) return outcome;
   const credentials = deps.load(config2.appEnv);
   if (credentials === null || credentials.token !== enrollment.token || credentials.enrolledAt !== enrollment.enrolledAt) {
     throw new ExpectedCliError(
-      "This machine's enrollment changed while the folders were being reviewed, so the approval was not saved, run `powerplant init` again to review them."
+      "This machine's enrollment changed while the folders were being reviewed, so nothing was saved, run `powerplant init` again to review them."
     );
   }
-  const allowedProtectedRoots = [
+  const next = credentialsAfterRepoDiscovery(credentials, outcome, deps.now);
+  if (next !== null) deps.persist(config2.appEnv, next);
+  return outcome;
+}
+function rootsOf(entries) {
+  return entries.map((entry) => path10.resolve(entry.root));
+}
+function credentialsAfterRepoDiscovery(credentials, outcome, now) {
+  const readable = rootsOf([...outcome.enabled, ...outcome.unmatched]);
+  const denied = rootsOf(outcome.blocked).filter((root) => !readable.includes(root));
+  const allowedRoots = [
     .../* @__PURE__ */ new Set([
-      ...credentials.repoDiscoveryRoots ?? [],
-      ...consented.map((entry) => path10.resolve(entry.root))
+      ...(credentials.repoDiscoveryRoots ?? []).filter((root) => !denied.includes(root)),
+      ...readable
     ])
   ];
-  if (allowedProtectedRoots.length !== (credentials.repoDiscoveryRoots ?? []).length) {
-    deps.persist(config2.appEnv, { ...credentials, repoDiscoveryRoots: allowedProtectedRoots });
-  }
-  return outcome;
+  const blockedRoots = [
+    .../* @__PURE__ */ new Set([
+      ...(credentials.repoDiscoveryBlockedRoots ?? []).filter((root) => !readable.includes(root)),
+      ...denied
+    ])
+  ];
+  const unchanged = credentials.repoDiscoveryConsentedAt !== void 0 && sameList(allowedRoots, credentials.repoDiscoveryRoots ?? []) && sameList(blockedRoots, credentials.repoDiscoveryBlockedRoots ?? []);
+  if (unchanged) return null;
+  return {
+    ...credentials,
+    repoDiscoveryConsentedAt: credentials.repoDiscoveryConsentedAt ?? new Date(now()).toISOString(),
+    // Both lists clear on empty: keeping a stale allowed list would read a
+    // root as consent after macOS refused it.
+    repoDiscoveryRoots: allowedRoots.length > 0 ? allowedRoots : void 0,
+    repoDiscoveryBlockedRoots: blockedRoots.length > 0 ? blockedRoots : void 0
+  };
+}
+function sameList(a, b2) {
+  return a.length === b2.length && a.every((root, index) => root === b2[index]);
 }
 
 // ../../apps/collector/src/hookInstall.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import os12 from "node:os";
 import path11 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -86233,7 +86736,7 @@ function hookSourcePath(script) {
 }
 function installCollectorHooks(homeDir = os12.homedir()) {
   const hookDir = path11.join(homeDir, ".config", "powerplant", "hooks");
-  mkdirSync4(hookDir, { recursive: true });
+  mkdirSync5(hookDir, { recursive: true });
   for (const script of HOOK_SCRIPTS) {
     writeFileSync4(path11.join(hookDir, script), readFileSync6(hookSourcePath(script), "utf8"), {
       mode: 493
@@ -86249,12 +86752,12 @@ function installCollectorHooks(homeDir = os12.homedir()) {
   }
   const merged = mergeCollectorHooks(settingsText, (script) => `node "${path11.join(hookDir, script)}"`);
   if (merged.action === "write") {
-    mkdirSync4(settingsDir, { recursive: true });
+    mkdirSync5(settingsDir, { recursive: true });
     writeFileSync4(settingsPath, merged.text);
   }
   if (merged.action !== "skip") {
     for (const retired of RETIRED_HOOK_WIRINGS) {
-      rmSync(path11.join(hookDir, retired.script), { force: true });
+      rmSync2(path11.join(hookDir, retired.script), { force: true });
     }
   }
   return {
@@ -86266,7 +86769,7 @@ function installCollectorHooks(homeDir = os12.homedir()) {
 
 // ../../apps/collector/src/service.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import os13 from "node:os";
 import path12 from "node:path";
 var RESTART_THROTTLE_SECONDS = 60;
@@ -86346,11 +86849,11 @@ function installService(config2, command) {
     );
   }
   const launcher = launcherPath(config2.appEnv);
-  mkdirSync5(path12.dirname(launcher), { recursive: true });
+  mkdirSync6(path12.dirname(launcher), { recursive: true });
   writeFileSync5(launcher, buildLauncherScript(command));
   chmodSync2(launcher, 493);
   const file2 = plistPath(config2.appEnv);
-  mkdirSync5(path12.dirname(file2), { recursive: true });
+  mkdirSync6(path12.dirname(file2), { recursive: true });
   writeFileSync5(file2, buildLaunchdPlist(config2.appEnv, installerPathValue()));
   runLaunchctl(["bootstrap", `gui/${uid()}`, file2]);
   return `${file2} (watching for session changes; log: ${logPath(config2.appEnv)})`;
@@ -86388,7 +86891,7 @@ function serviceUpToDate(config2, command) {
 function uninstallService(config2) {
   requireMacos();
   const existed = bootout(config2.appEnv);
-  rmSync2(launcherPath(config2.appEnv), { force: true });
+  rmSync3(launcherPath(config2.appEnv), { force: true });
   if (existsSync4(plistPath(config2.appEnv))) {
     unlinkSync2(plistPath(config2.appEnv));
     return true;
@@ -86458,7 +86961,7 @@ function xmlEscape(value) {
 }
 
 // ../../apps/collector/src/status.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync8, renameSync as renameSync2, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import os14 from "node:os";
 import path13 from "node:path";
 var HEARTBEAT_INTERVAL_MS = 6e4;
@@ -86493,6 +86996,9 @@ var collectorStatusSchema = external_exports.object({
   /** Last pass that completed without error — everything eligible had been
    * uploaded as of this time. */
   lastSyncAt: external_exports.string().optional(),
+  /** Last pass that upserted at least one session; missing = no session
+   * has uploaded in this daemon's lifetime, not "never". */
+  lastUploadAt: external_exports.string().optional(),
   consecutiveFailures: external_exports.number().int().nonnegative()
 });
 var controlSchema = external_exports.object({
@@ -86509,7 +87015,8 @@ var controlSchema = external_exports.object({
 function interpretControlChange(previous, current) {
   const transitioned = previous.paused !== current.paused;
   const nudge = !current.paused && (transitioned || current.resumedAt !== previous.resumedAt);
-  return { transitioned, nudge };
+  const updateOptIn = current.autoUpdate === true && previous.autoUpdate !== true;
+  return { transitioned, nudge, updateOptIn };
 }
 function collectorStateDir(homeDir = os14.homedir()) {
   return path13.join(homeDir, ".config", "powerplant", "state");
@@ -86524,14 +87031,18 @@ function controlFilePath(appEnv, homeDir) {
   return path13.join(collectorStateDir(homeDir), `collector-control-${appEnv}.json`);
 }
 function writeAtomically(file2, payload) {
-  mkdirSync6(path13.dirname(file2), { recursive: true });
+  mkdirSync7(path13.dirname(file2), { recursive: true });
   const tmp = `${file2}.${process.pid}.tmp`;
   writeFileSync6(tmp, payload);
-  renameSync(tmp, file2);
+  renameSync2(tmp, file2);
 }
 function writeCollectorStatus(appEnv, status, homeDir) {
   writeAtomically(statusFilePath(appEnv, homeDir), JSON.stringify(status, null, 2));
 }
+function carriedUploadClock(previous, machineId) {
+  if (previous.file !== "ok" || machineId === void 0) return void 0;
+  return previous.status.machineId === machineId ? previous.status.lastUploadAt : void 0;
+}
 function readCollectorStatus(appEnv, homeDir) {
   let raw;
   try {
@@ -86568,10 +87079,10 @@ function writeCollectorControl(appEnv, control, homeDir) {
   writeAtomically(controlFilePath(appEnv, homeDir), JSON.stringify(control, null, 2));
 }
 function clearCollectorControl(appEnv, homeDir) {
-  rmSync3(controlFilePath(appEnv, homeDir), { force: true });
+  rmSync4(controlFilePath(appEnv, homeDir), { force: true });
 }
 function clearCollectorStatus(appEnv, homeDir) {
-  rmSync3(statusFilePath(appEnv, homeDir), { force: true });
+  rmSync4(statusFilePath(appEnv, homeDir), { force: true });
 }
 function describeDaemonState(read, probes = {}) {
   if (read.file === "invalid") return { state: "unreadable" };
@@ -86944,7 +87455,10 @@ async function runSyncPassInternal(config2, options, diagnostic) {
   const active = items.filter((s) => s.status === "active").length;
   const tooLarge = (count2, what) => count2 > 0 ? ` \xB7 ${count2} ${what} skipped (over ${MAX_TRANSCRIPT_FILE_BYTES / (1024 * 1024)}MB, too large to read)` : "";
   log3(
-    `Found ${inWindow.length} local session(s) (${claude.sessions.length} claude, ${codex.sessions.length} codex, ${cursor.sessions.length} cursor) ` + describeScanReach(window2, options.narrowSinceMs) + (active > 0 ? ` (${active} still active)` : "") + (skippedOutOfScope > 0 ? ` \xB7 ${skippedOutOfScope} ${describeSkipReason(capture)}` : "") + (skippedNoRepo > 0 ? ` \xB7 ${skippedNoRepo} ${describeNoRepoSkipReason(capture)}` : "") + (codex.skippedSubagentThreads > 0 ? ` \xB7 ${codex.skippedSubagentThreads} codex subagent thread(s) skipped (spend unmeasured)` : "") + (cursor.skippedSubagentComposers > 0 ? ` \xB7 ${cursor.skippedSubagentComposers} cursor subagent thread(s) skipped` : "") + (cursor.skippedNonLocalComposers > 0 ? ` \xB7 ${cursor.skippedNonLocalComposers} cursor session(s) skipped (not local to this machine)` : "") + (cursor.skippedUnreadable > 0 ? ` \xB7 ${cursor.skippedUnreadable} cursor session(s) unreadable, skipped` : "") + tooLarge(claude.skippedTooLarge, "claude transcript(s)") + (claude.unreadable.length > 0 ? ` \xB7 ${claude.unreadable.length} claude transcript(s) unreadable, skipped` : "") + tooLarge(codex.skippedTooLarge, "codex rollout(s)") + (codex.unreadable.length > 0 ? ` \xB7 ${codex.unreadable.length} codex rollout(s) unreadable, skipped` : "") + tooLarge(cursor.skippedTooLarge, "cursor transcript(s)") + (cursor.truncatedTranscripts > 0 ? ` \xB7 ${cursor.truncatedTranscripts} cursor transcript(s) cut at ${MAX_TRANSCRIPT_FILE_BYTES / (1024 * 1024)}MB (the rest of the conversation stays local)` : "") + (heldBack > 0 ? ` \xB7 ${heldBack} older session(s) held back, the first sync backfills the ${DEEP_FIRST_SYNC_MAX_SESSIONS} most recently active` : "") + "."
+    `Found ${inWindow.length} local session(s) (${claude.sessions.length} claude, ${codex.sessions.length} codex, ${cursor.sessions.length} cursor) ` + describeScanReach(window2, options.narrowSinceMs) + (active > 0 ? ` (${active} still active)` : "") + (skippedOutOfScope > 0 ? ` \xB7 ${skippedOutOfScope} ${describeSkipReason(capture)}` : "") + (skippedNoRepo > 0 ? ` \xB7 ${skippedNoRepo} ${describeNoRepoSkipReason(capture)}` : "") + (codex.skippedSubagentThreads > 0 ? ` \xB7 ${codex.skippedSubagentThreads} codex subagent thread(s) skipped (spend unmeasured)` : "") + (cursor.skippedSubagentComposers > 0 ? ` \xB7 ${cursor.skippedSubagentComposers} cursor subagent thread(s) skipped` : "") + (cursor.skippedNonLocalComposers > 0 ? ` \xB7 ${cursor.skippedNonLocalComposers} cursor session(s) skipped (not local to this machine)` : "") + (cursor.skippedUnreadable > 0 ? ` \xB7 ${cursor.skippedUnreadable} cursor session(s) unreadable, skipped` : "") + tooLarge(claude.skippedTooLarge, "claude transcript(s)") + (claude.unreadable.length > 0 ? ` \xB7 ${claude.unreadable.length} claude transcript(s) unreadable, skipped` : "") + tooLarge(codex.skippedTooLarge, "codex rollout(s)") + (codex.unreadable.length > 0 ? ` \xB7 ${codex.unreadable.length} codex rollout(s) unreadable, skipped` : "") + // The measure for POW-79's follow-up: a merged thread re-uploads whole
+    // on every change, so once the largest nears the cap, per-page upload
+    // is due.
+    (codex.mergedThreads > 0 ? ` \xB7 ${codex.mergedThreads} codex thread(s) merged from split rollouts (largest ${(codex.largestMergedBytes / (1024 * 1024)).toFixed(1)}MB of the ${MAX_TRANSCRIPT_FILE_BYTES / (1024 * 1024)}MB cap)` : "") + tooLarge(cursor.skippedTooLarge, "cursor transcript(s)") + (cursor.truncatedTranscripts > 0 ? ` \xB7 ${cursor.truncatedTranscripts} cursor transcript(s) cut at ${MAX_TRANSCRIPT_FILE_BYTES / (1024 * 1024)}MB (the rest of the conversation stays local)` : "") + (heldBack > 0 ? ` \xB7 ${heldBack} older session(s) held back, the first sync backfills the ${DEEP_FIRST_SYNC_MAX_SESSIONS} most recently active` : "") + "."
   );
   for (const failure of claude.unreadable) log3(`  claude transcript skipped, ${failure}`);
   for (const failure of codex.unreadable) log3(`  codex rollout skipped, ${failure}`);
@@ -87191,10 +87705,10 @@ import path16 from "node:path";
 import {
   existsSync as existsSync5,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   readFileSync as readFileSync10,
-  renameSync as renameSync2,
-  rmSync as rmSync4,
+  renameSync as renameSync3,
+  rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "node:fs";
 import path15 from "node:path";
@@ -87275,7 +87789,7 @@ function installProviderHook(provider, home) {
     `${shellQuote2(process.execPath)} ${shellQuote2(scriptPath)}`
   );
   if (merged.action === "skip") return { provider, settings: "skip", detail: merged.reason };
-  mkdirSync7(hookDir, { recursive: true });
+  mkdirSync8(hookDir, { recursive: true });
   writeAtomic(scriptPath, readFileSync10(hookSourcePath(script), "utf8"), 448);
   if (merged.action === "write") {
     const current = existsSync5(configPath) ? readFileSync10(configPath, "utf8") : null;
@@ -87293,9 +87807,9 @@ function writeAtomic(file2, text, mode) {
   const temporary = `${file2}.${randomUUID()}.tmp`;
   try {
     writeFileSync7(temporary, text, { mode, flag: "wx" });
-    renameSync2(temporary, file2);
+    renameSync3(temporary, file2);
   } finally {
-    rmSync4(temporary, { force: true });
+    rmSync5(temporary, { force: true });
   }
 }
 function installProviderHooks(home) {
@@ -87637,6 +88151,10 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
   const presentRoots = storeRoots.filter(({ dir }) => existsSync6(dir)).map(({ dir }) => dir);
   const initialControl = readCollectorControl(config2.appEnv, home);
   const pausedAtMs = initialControl.paused ? Date.parse(initialControl.pausedAt ?? "") : Number.NaN;
+  const lastUploadAt = carriedUploadClock(
+    readCollectorStatus(config2.appEnv, home),
+    credentials?.machineId
+  );
   let status = {
     pid: process.pid,
     version: runtime.version,
@@ -87652,6 +88170,7 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
     },
     watchedRoots: presentRoots,
     paused: initialControl.paused,
+    ...lastUploadAt !== void 0 && { lastUploadAt },
     consecutiveFailures: 0
   };
   let statusWriteFailed = false;
@@ -87670,9 +88189,19 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
   };
   writeStatus({});
   const diagnostics = createDiagnosticsReporter(() => loadCredentials(config2.appEnv));
-  diagnostics.heartbeat(initialControl.paused);
-  const diagnosticHeartbeat = setInterval(() => diagnostics.heartbeat(status.paused), DIAGNOSTIC_INTERVAL_MS);
-  diagnosticHeartbeat.unref?.();
+  const checkIn = () => {
+    let current;
+    try {
+      current = loadCredentials(config2.appEnv);
+    } catch {
+      return;
+    }
+    if (current === null) return;
+    void reportCheckIn(current.apiUrl, current.token, status.paused);
+  };
+  checkIn();
+  const checkInTimer = setInterval(checkIn, CHECK_IN_INTERVAL_MS);
+  checkInTimer.unref?.();
   const heartbeat = setInterval(() => writeStatus({}), HEARTBEAT_INTERVAL_MS);
   heartbeat.unref?.();
   const noticeIfUnsupported = async () => {
@@ -87770,6 +88299,7 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
         ...result.diagnostic && { diagnostic: result.diagnostic }
       },
       ...result.ok && { lastSyncAt: new Date(result.at).toISOString() },
+      ...result.ok && result.upserted > 0 && { lastUploadAt: new Date(result.at).toISOString() },
       consecutiveFailures: result.ok ? 0 : status.consecutiveFailures + 1
     }),
     reportError: reportCollectorError,
@@ -87801,16 +88331,21 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
   let lastControl = initialControl;
   const controlPoll = setInterval(() => {
     const control = readCollectorControl(config2.appEnv, home);
-    const { transitioned, nudge } = interpretControlChange(lastControl, control);
+    const { transitioned, nudge, updateOptIn } = interpretControlChange(lastControl, control);
     lastControl = control;
     if (transitioned) {
       log3(control.paused ? "syncing paused via control file" : "syncing resumed");
       writeStatus({ paused: control.paused });
+      checkIn();
     }
     if (nudge) {
       log3("running a catch-up pass to cover the pause");
       loop.nudge();
     }
+    if (updateOptIn) {
+      log3("automatic updates turned on, checking for a release now");
+      void checkForUpdate();
+    }
   }, CONTROL_POLL_MS);
   controlPoll.unref?.();
   if (runtime.entryPath) {
@@ -87844,7 +88379,7 @@ import os16 from "node:os";
 import path18 from "node:path";
 
 // ../../apps/collector/src/codexReviewFacts.ts
-import { closeSync as closeSync4, lstatSync as lstatSync4, openSync as openSync4, readSync as readSync4, realpathSync as realpathSync3 } from "node:fs";
+import { closeSync as closeSync5, lstatSync as lstatSync4, openSync as openSync5, readSync as readSync4, realpathSync as realpathSync3 } from "node:fs";
 import path17 from "node:path";
 var pointerSchema = external_exports.object({
   source: external_exports.unknown().optional(),
@@ -87882,7 +88417,7 @@ function readCodexReviewFacts(row, id, home) {
   }
 }
 function readPrefix(file2) {
-  const fd = openSync4(file2, "r");
+  const fd = openSync5(file2, "r");
   const buffer = Buffer.alloc(MAX_PREFIX_BYTES);
   let used = 0;
   let first = -1;
@@ -87903,7 +88438,7 @@ function readPrefix(file2) {
       used = end;
     }
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
   if (first < 0 || second < 0) return null;
   try {
@@ -88283,7 +88818,7 @@ async function probeClaudeDesktopSessions(wanted, installed, reportFault, root =
 
 // src/cli.ts
 import { spawn as spawn2, spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync11, openSync as openSync6, realpathSync as realpathSync5, rmSync as rmSync6 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync12, openSync as openSync7, realpathSync as realpathSync5, rmSync as rmSync7 } from "node:fs";
 import path28 from "node:path";
 import { parseArgs } from "node:util";
 
@@ -88291,7 +88826,7 @@ import { parseArgs } from "node:util";
 import { execFileSync as execFileSync5, spawnSync } from "node:child_process";
 import {
   existsSync as existsSync9,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   mkdtempSync,
   readdirSync as readdirSync5,
   readFileSync as readFileSync11,
@@ -89330,7 +89865,7 @@ function realReadTextFileStrict(filePath) {
   }
 }
 function realWriteTextFile(filePath, content) {
-  mkdirSync8(path21.dirname(filePath), { recursive: true });
+  mkdirSync9(path21.dirname(filePath), { recursive: true });
   writeFileSync8(filePath, content);
 }
 function codexConfigPath(homeDir = os19.homedir()) {
@@ -89395,7 +89930,7 @@ function realRunInteractive(bin, args, env) {
 
 // src/connections.ts
 import { execFileSync as execFileSync6, spawnSync as spawnSync2 } from "node:child_process";
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "node:fs";
 import path22 from "node:path";
 function probeConnections(clients, deps) {
   const reports = [];
@@ -89524,7 +90059,7 @@ function detectedClientsPath(homeDir) {
 function saveDetectedClients(clients, pathValue, homeDir) {
   try {
     const file2 = detectedClientsPath(homeDir);
-    mkdirSync9(path22.dirname(file2), { recursive: true });
+    mkdirSync10(path22.dirname(file2), { recursive: true });
     const record2 = {
       detectedAt: (/* @__PURE__ */ new Date()).toISOString(),
       path: pathValue,
@@ -89608,7 +90143,7 @@ function whichAllWith(pathValue) {
 }
 
 // src/doctor.ts
-import { closeSync as closeSync5, fstatSync, openSync as openSync5, readSync as readSync5 } from "node:fs";
+import { closeSync as closeSync6, fstatSync, openSync as openSync6, readSync as readSync5 } from "node:fs";
 
 // src/update.ts
 import path24 from "node:path";
@@ -89633,7 +90168,7 @@ import { accessSync, constants as constants2 } from "node:fs";
 import path23 from "node:path";
 
 // src/version.ts
-var CLI_VERSION = true ? "0.4.6" : "0.0.0-checkout";
+var CLI_VERSION = true ? "0.4.8" : "0.0.0-checkout";
 var CLI_RELEASE_BUILD = true ? true : false;
 var CLI_PACKAGE_NAME = "@usepowerplant/cli";
 
@@ -89937,7 +90472,7 @@ function redactedLogTail(raw) {
 function readDoctorLogTail(path29) {
   let fd;
   try {
-    fd = openSync5(path29, "r");
+    fd = openSync6(path29, "r");
   } catch (error62) {
     if (error62.code === "ENOENT") return { path: path29, lines: null };
     return { path: path29, lines: null, readError: error62 instanceof Error ? error62.message : String(error62) };
@@ -89953,7 +90488,7 @@ function readDoctorLogTail(path29) {
   } catch (error62) {
     return { path: path29, lines: null, readError: error62 instanceof Error ? error62.message : String(error62) };
   } finally {
-    closeSync5(fd);
+    closeSync6(fd);
   }
 }
 function renderDoctorReport(i) {
@@ -90205,6 +90740,9 @@ async function confirmResume(deps, log3, indent) {
   }
 }
 
+// src/protectedFolders.ts
+var MACOS_BLOCKED_FOLDER_REMEDY = "To allow it, open System Settings > Privacy & Security > Files and Folders, enable the folder for node, then run `powerplant init`.";
+
 // src/init.ts
 function syncNote(credentials) {
   const org = credentials.orgName ?? "your organization";
@@ -90249,7 +90787,7 @@ async function runInit(deps) {
   }
   log3("");
   const orgName = credentials.orgName;
-  let repoDiscoveryEnabled = false;
+  let repoDiscoveryDidWork = false;
   let protectedFoldersNeedAttention = false;
   let installed = false;
   let menubarDidWork = false;
@@ -90262,56 +90800,68 @@ async function runInit(deps) {
       "Checking recent session locations\u2026",
       deps.findProtectedSessions
     );
-    const alreadyAllowed = new Set(credentials.repoDiscoveryRoots ?? []);
-    const needsReview = protectedSessions.filter((entry) => !alreadyAllowed.has(entry.root));
-    if (needsReview.length > 0) {
-      protectedFoldersNeedAttention = true;
-      log3("     Coding agents recorded recent sessions in folders macOS is currently hiding from Powerplant:");
-      logProtectedFolders(log3, needsReview);
-      log3("     Powerplant will scan only Git metadata in those recorded session folders.");
-      if (deps.promptAllowed) {
-        const allowed = await confirmProtectedRepoDiscovery(deps);
-        if (allowed) {
-          log3(
-            '     macOS may label Powerplant as "node" because Powerplant runs on Node.js.'
-          );
+    const reviewOf = (entry) => protectedRootReview(credentials, entry.root);
+    const blocked = protectedSessions.filter((entry) => reviewOf(entry) === "blocked");
+    const fresh = protectedSessions.filter((entry) => reviewOf(entry) === "unreviewed");
+    if (blocked.length > 0 || fresh.length > 0) {
+      const org = orgName ?? "your organization";
+      const consented = credentials.repoDiscoveryConsentedAt !== void 0;
+      const toProbe = [];
+      let needsAttention = false;
+      if (fresh.length > 0) {
+        log3("     Coding agents recorded recent sessions in folders macOS is currently hiding from Powerplant:");
+        logProtectedFolders(log3, fresh);
+        if (!deps.promptAllowed) {
+          needsAttention = true;
+          logProtectedSessionsStayLocal(log3, fresh);
+          log3(`       Run \`powerplant init\` in a terminal to ${consented ? "scan" : "review"} them.`);
+        } else {
           log3(
-            `     If permission is added, Powerplant will only read Git metadata in these folders to check for ${orgName ?? "your organization's"} sessions.`
+            consented ? `     You already allowed Git metadata scans. Checking those folders for ${org}'s work repositories.` : `     If you allow it, Powerplant reads only Git metadata there, to find ${org}'s work repositories.`
           );
-          const result = await deps.activity(
+          if (consented || await confirmProtectedRepoDiscovery(deps)) toProbe.push(...fresh);
+          else {
+            needsAttention = true;
+            logProtectedSessionsStayLocal(log3, fresh);
+          }
+        }
+      }
+      if (blocked.length > 0) {
+        if (deps.promptAllowed) {
+          log3(`     Checking whether macOS still blocks ${displayRoots(blocked)}.`);
+          toProbe.push(...blocked);
+        } else {
+          needsAttention = true;
+          logBlockedByMacOS(log3, blocked);
+        }
+      }
+      if (toProbe.length > 0) {
+        log3('     macOS may label Powerplant as "node" because Powerplant runs on Node.js.');
+        const probe = async (roots) => {
+          const result2 = await deps.activity(
             "Scanning recorded session folders for Git repositories\u2026",
-            () => deps.allowProtectedRepoDiscovery(needsReview)
+            () => deps.allowProtectedRepoDiscovery(roots)
           );
-          let needsAttention = reportProtectedRepoDiscovery(log3, result);
-          if (result.enabled.length > 0) repoDiscoveryEnabled = true;
-          if (result.needsReview.length > 0) {
-            log3("     Some of those sessions use Git checkouts in other folders macOS is hiding from Powerplant:");
-            logProtectedFolders(log3, result.needsReview);
-            const again = await confirmProtectedRepoDiscovery(deps);
-            if (again) {
-              const second = await deps.activity(
-                "Scanning recorded session folders for Git repositories\u2026",
-                () => deps.allowProtectedRepoDiscovery([...result.unreviewed, ...result.needsReview])
-              );
-              needsAttention = reportProtectedRepoDiscovery(log3, second) || needsAttention;
-              if (second.enabled.length > 0) repoDiscoveryEnabled = true;
-              if (second.unreviewed.length > 0) {
-                logProtectedSessionsStayLocal(log3, second.unreviewed);
-                needsAttention = true;
-              }
-            } else {
-              logProtectedSessionsStayLocal(log3, result.needsReview);
-              needsAttention = true;
-            }
+          needsAttention = reportProtectedRepoDiscovery(log3, result2) || needsAttention;
+          const unblocked = result2.unmatched.filter((entry) => reviewOf(entry) === "blocked");
+          if (unblocked.length > 0) {
+            log3(`     \u2713 macOS now lets Powerplant read ${displayRoots(unblocked)}. No work repositories were found there.`);
+          }
+          if (result2.enabled.length > 0 || unblocked.length > 0) repoDiscoveryDidWork = true;
+          return result2;
+        };
+        const result = await probe(toProbe);
+        if (result.needsReview.length > 0) {
+          log3("     Some of those sessions use Git checkouts in other folders macOS is hiding from Powerplant:");
+          logProtectedFolders(log3, result.needsReview);
+          const second = await probe([...result.unreviewed, ...result.needsReview]);
+          if (second.unreviewed.length > 0) {
+            logProtectedSessionsStayLocal(log3, second.unreviewed);
+            needsAttention = true;
           }
-          protectedFoldersNeedAttention = needsAttention;
-        } else {
-          logProtectedSessionsStayLocal(log3, needsReview);
         }
-      } else {
-        logProtectedSessionsStayLocal(log3, needsReview);
-        log3("       Run `powerplant init` in a terminal to review them.");
       }
+      protectedFoldersNeedAttention = needsAttention;
     }
   }
   if (deps.platform !== "darwin") {
@@ -90351,7 +90901,7 @@ async function runInit(deps) {
   log3("");
   const connectDidWork = outcome !== null && outcome.connected + outcome.configured > outcome.unchanged;
   const connectSettled = outcome !== null && outcome.found > 0 && outcome.pending === 0 && outcome.failed === 0 && outcome.skipped === 0 && outcome.unchanged === outcome.found && !connectDidWork;
-  if (!enrolled && !installed && !menubarDidWork && !repoDiscoveryEnabled && !protectedFoldersNeedAttention && pauseOffer === "not-paused" && connectSettled) {
+  if (!enrolled && !installed && !menubarDidWork && !repoDiscoveryDidWork && !protectedFoldersNeedAttention && pauseOffer === "not-paused" && connectSettled) {
     log3("Everything is already set up.");
     return;
   }
@@ -90428,24 +90978,22 @@ function logProtectedFolders(log3, roots) {
 }
 function reportProtectedRepoDiscovery(log3, result) {
   if (result.enabled.length > 0) {
-    log3(
-      `     \u2713 Repository scanning enabled for ${result.enabled.map((entry) => entry.displayRoot).join(", ")}`
-    );
-  }
-  if (result.blocked.length > 0) {
-    log3(
-      `     ! macOS blocked Powerplant from reading ${result.blocked.map((entry) => entry.displayRoot).join(", ")}.`
-    );
-    log3(
-      "       Sessions there will stay local. To allow it, open System Settings > Privacy & Security > Files and Folders, enable the folder for node, then rerun `powerplant init`."
-    );
+    log3(`     \u2713 Repository scanning enabled for ${displayRoots(result.enabled)}`);
   }
+  if (result.blocked.length > 0) logBlockedByMacOS(log3, result.blocked);
   return result.blocked.length > 0;
 }
+function logBlockedByMacOS(log3, roots) {
+  log3(`     ! macOS blocked Powerplant from reading ${displayRoots(roots)}.`);
+  log3(`       Sessions there will stay local. ${MACOS_BLOCKED_FOLDER_REMEDY}`);
+}
+function displayRoots(roots) {
+  return roots.map((entry) => entry.displayRoot).join(", ");
+}
 function logProtectedSessionsStayLocal(log3, found) {
   const total = found.reduce((sum2, entry) => sum2 + entry.sessionCount, 0);
   log3(
-    `     ! Repository matching for ${total} recent session${total === 1 ? "" : "s"} under ${found.map((entry) => entry.displayRoot).join(", ")} was not enabled.`
+    `     ! Repository matching for ${total} recent session${total === 1 ? "" : "s"} under ${displayRoots(found)} was not enabled.`
   );
   log3("       Sessions outside folders you explicitly added will stay local.");
 }
@@ -90489,6 +91037,8 @@ function renderMenu(i) {
   }
   if (items.length > 0) items.push({ type: "separator" });
   const progress = updateProgressView(i.update.progress, i.cliVersion, i.now);
+  let updateStart;
+  let updateCount = 0;
   const unsupported = isUnsupportedVersion(i.cliVersion, i.oldestSupportedVersion);
   if (unsupported) {
     items.push(
@@ -90497,7 +91047,9 @@ function renderMenu(i) {
         `You have ${i.cliVersion}; the oldest supported is ${i.oldestSupportedVersion}. Update now.`
       )
     );
+    updateStart ??= items.length;
     items.push(...updateItems(i, progress, envArgs, problem));
+    updateCount = items.length - updateStart;
     items.push({ type: "separator" });
   }
   if (i.credentialsError !== void 0) {
@@ -90530,6 +91082,7 @@ function renderMenu(i) {
   }
   if (!unsupported && (isUpdateAvailable(i.cliVersion, i.latestVersion) || progress.kind !== "none")) {
     items.push({ type: "separator" });
+    updateStart = items.length;
     if (progress.kind === "none") {
       items.push({
         type: "status",
@@ -90539,6 +91092,7 @@ function renderMenu(i) {
       });
     }
     items.push(...updateItems(i, progress, envArgs, problem));
+    updateCount = items.length - updateStart;
   }
   items.push({ type: "separator" });
   items.push({ type: "action", title: "Open Powerplant", url: i.config.webUrl });
@@ -90548,6 +91102,17 @@ function renderMenu(i) {
   const icon = attention ? "attention" : i.control.paused ? "paused" : "running";
   return {
     contract: MENU_CONTRACT,
+    ...i.update.inPlace && updateStart !== void 0 && {
+      cliUpdate: {
+        startIndex: updateStart,
+        itemCount: updateCount,
+        state: progress.kind === "none" ? "available" : progress.kind,
+        target: progress.kind === "none" ? i.latestVersion : progress.target,
+        ...progress.kind === "failed" && { detail: progress.detail },
+        run: ["update", "--background", ...envArgs],
+        logPath: updateLogPath()
+      }
+    },
     ...i.desktopDiagnostic && { desktopDiagnostic: i.desktopDiagnostic },
     appEnv: i.config.appEnv,
     cliVersion: i.cliVersion,
@@ -91077,8 +91642,9 @@ function renderStatus(i) {
     );
     lines.push(`Syncing: ${describeStoredCapture(i.credentials)}.`);
     for (const entry of i.protectedSessions ?? []) {
+      const sessions = `${entry.sessionCount} recent agent session${entry.sessionCount === 1 ? "" : "s"}`;
       lines.push(
-        `\u26A0 Repository matching is not enabled for ${entry.sessionCount} recent agent session${entry.sessionCount === 1 ? "" : "s"} under ${entry.displayRoot}. Sessions outside folders you explicitly added are staying local, run \`powerplant init\` to review Git repository scanning.`
+        protectedRootReview(i.credentials, entry.root) === "blocked" ? `\u26A0 macOS is blocking Powerplant from reading ${entry.displayRoot} (${sessions}). Those sessions are staying local. ${MACOS_BLOCKED_FOLDER_REMEDY}` : `\u26A0 Repository matching is not enabled for ${sessions} under ${entry.displayRoot}. Sessions outside folders you explicitly added are staying local, run \`powerplant init\` to review Git repository scanning.`
       );
     }
   }
@@ -91130,9 +91696,17 @@ function renderDaemon(i) {
       `  The daemon is on ${status.version}, this CLI is ${i.cliVersion}, it restarts onto the installed version within minutes, or now via: powerplant restart`
     );
   }
-  lines.push(
-    status.lastSyncAt !== void 0 ? `  Last successful sync: ${ago(i.now - Date.parse(status.lastSyncAt))}.` : "  No successful sync yet in this run."
+  const signals = describeSyncSignals(
+    {
+      lastSessionActivityAt: status.lastUploadAt ?? null,
+      lastCheckedInAt: status.lastPass?.at ?? null,
+      syncPaused: null,
+      lastSyncErrorAt: status.lastPass && !status.lastPass.ok ? status.lastPass.at : null
+    },
+    new Date(i.now),
+    "last upload unmeasured"
   );
+  lines.push(signals === null ? "  No pass has run yet in this run." : `  ${signals}`);
   if (status.lastPass && !status.lastPass.ok) {
     lines.push(
       `  \u26A0 Last pass failed: ${status.lastPass.error ?? "unknown error"} (${status.consecutiveFailures} consecutive failure${status.consecutiveFailures === 1 ? "" : "s"}).`
@@ -91159,7 +91733,10 @@ function statusJson(i) {
     },
     protectedRepoDiscoveryNeeded: (i.protectedSessions ?? []).map((entry) => ({
       displayRoot: entry.displayRoot,
-      sessionCount: entry.sessionCount
+      sessionCount: entry.sessionCount,
+      // The member said yes and macOS refused: System Settings, not init,
+      // is the fix, so a tool rendering this must not say "review".
+      blockedByMacOS: i.credentials !== null && protectedRootReview(i.credentials, entry.root) === "blocked"
     })),
     ...i.credentialsError !== void 0 && { credentialsError: i.credentialsError },
     service: i.service,
@@ -91315,7 +91892,7 @@ function createTerminalOutput(options) {
 }
 
 // src/menubarApp.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, renameSync as renameSync3, rmSync as rmSync5 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync11, renameSync as renameSync4, rmSync as rmSync6 } from "node:fs";
 import os21 from "node:os";
 import path27 from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -91383,11 +91960,11 @@ function realMenubarAppOps(input2) {
     },
     replace: (zip, appPath) => {
       const parent = path27.dirname(appPath);
-      mkdirSync10(parent, { recursive: true });
+      mkdirSync11(parent, { recursive: true });
       const staging = path27.join(parent, `.${MENUBAR_APP_NAME}.swap-${process.pid}`);
       const retired = path27.join(parent, `.${MENUBAR_APP_NAME}.old-${process.pid}`);
-      rmSync5(staging, { recursive: true, force: true });
-      rmSync5(retired, { recursive: true, force: true });
+      rmSync6(staging, { recursive: true, force: true });
+      rmSync6(retired, { recursive: true, force: true });
       try {
         const extract = spawnSync4("ditto", ["-xk", zip, staging]);
         if (extract.status !== 0) {
@@ -91400,16 +91977,16 @@ function realMenubarAppOps(input2) {
           throw new Error(`${zip} does not contain ${MENUBAR_APP_NAME}`);
         }
         const hadOld = existsSync11(appPath);
-        if (hadOld) renameSync3(appPath, retired);
+        if (hadOld) renameSync4(appPath, retired);
         try {
-          renameSync3(extracted, appPath);
+          renameSync4(extracted, appPath);
         } catch (error62) {
-          if (hadOld) renameSync3(retired, appPath);
+          if (hadOld) renameSync4(retired, appPath);
           throw error62;
         }
       } finally {
-        rmSync5(staging, { recursive: true, force: true });
-        rmSync5(retired, { recursive: true, force: true });
+        rmSync6(staging, { recursive: true, force: true });
+        rmSync6(retired, { recursive: true, force: true });
       }
     },
     launch: (appPath) => {
@@ -91754,7 +92331,11 @@ ${USAGE}`);
         // Enrollment's own narration (org, token location, capture boundary)
         // indents under stage 1.
         enroll: () => enroll2((line) => terminal.log(`     ${line}`)),
-        findProtectedSessions: () => findRecentProtectedSessions(),
+        // Discovery may read a worktree pointer under a root the store
+        // already allows, so a revoked checkout root still surfaces.
+        findProtectedSessions: () => findRecentProtectedSessions({
+          environment: { allowedProtectedRoots: loadCredentials(config2.appEnv)?.repoDiscoveryRoots ?? [] }
+        }),
         promptAllowed: pickerOn,
         promptLine: realPromptLine,
         allowProtectedRepoDiscovery: (found) => allowProtectedRepoDiscovery(config2, found),
@@ -91828,12 +92409,14 @@ The access you granted these agents stays on your Powerplant account until you r
     }
     case "status": {
       const stored = loadCredentialsSafely(config2);
-      const allowedProtectedRoots = new Set(stored.credentials?.repoDiscoveryRoots ?? []);
+      const credentials = stored.credentials;
       const [latestVersion, oldestSupportedVersion, protectedSessions] = await Promise.all([
-        fetchAvailableVersion(config2, stored.credentials),
-        oldestSupportedFor(stored.credentials),
-        process.platform === "darwin" && stored.credentials ? findRecentProtectedSessions().then(
-          (found) => found.filter((entry) => !allowedProtectedRoots.has(entry.root))
+        fetchAvailableVersion(config2, credentials),
+        oldestSupportedFor(credentials),
+        process.platform === "darwin" && credentials ? findRecentProtectedSessions({
+          environment: { allowedProtectedRoots: credentials.repoDiscoveryRoots ?? [] }
+        }).then(
+          (found) => found.filter((entry) => protectedRootReview(credentials, entry.root) !== "allowed")
         ) : []
       ]);
       const inputs = {
@@ -91976,7 +92559,7 @@ The access you granted these agents stays on your Powerplant account until you r
         const on = parseAutomaticFlag(values.automatic);
         setAutomaticUpdates(config2.appEnv, on);
         console.log(
-          on ? "Automatic updates on: the background sync installs each new release within an hour of publication." : "Automatic updates off: powerplant status and the menu bar still say when a release is available."
+          on ? "Automatic updates on: the background sync checks for a release now and installs each new one within an hour of publication." : "Automatic updates off: powerplant status and the menu bar still say when a release is available."
         );
         return;
       }
@@ -92139,8 +92722,8 @@ function startBackgroundUpdate(config2, target) {
     readProgress: updateProgress.read,
     writeProgress: updateProgress.write,
     spawnChild: () => {
-      mkdirSync11(path28.dirname(updateLogPath()), { recursive: true });
-      const log3 = openSync6(updateLogPath(), "a");
+      mkdirSync12(path28.dirname(updateLogPath()), { recursive: true });
+      const log3 = openSync7(updateLogPath(), "a");
       const child = spawn2(process.execPath, [entryPath(), "update", ...envArgsFor(config2)], {
         detached: true,
         stdio: ["ignore", log3, log3],
@@ -92202,7 +92785,7 @@ function restartSyncOnNewCode(config2) {
 var updateProgress = {
   read: () => readUpdateProgress(realReadTextFile),
   write: (record2) => realWriteTextFile(updateProgressPath(), JSON.stringify(record2, null, 2)),
-  clear: () => rmSync6(updateProgressPath(), { force: true })
+  clear: () => rmSync7(updateProgressPath(), { force: true })
 };
 function envArgsFor(config2) {
   return config2.appEnv === "production" ? [] : ["--env", config2.appEnv];