@workscribe/cli 1.12.0 → 1.13.0

package/dist/index.js

@@ -27,15 +27,33 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var import_commander = require("commander");
 
 // src/utils/node-version.ts
+function detectVersionManager() {
+  if (process.env.NVM_DIR) return "nvm";
+  if (process.env.VOLTA_HOME) return "volta";
+  if (process.env.FNM_DIR) return "fnm";
+  if (process.env.MISE_DATA_DIR || process.env.MISE_SHELL) return "mise";
+  if (process.env.ASDF_DIR || process.env.ASDF_DATA_DIR) return "asdf";
+  if (process.env.NODENV_ROOT) return "nodenv";
+  return null;
+}
+var UPGRADE_COMMANDS = {
+  nvm: "nvm install 22 && nvm use 22",
+  volta: "volta install node@22",
+  fnm: "fnm install 22 && fnm use 22",
+  mise: "mise use --global node@22",
+  asdf: "asdf install nodejs 22 && asdf global nodejs 22",
+  nodenv: "nodenv install 22 && nodenv global 22"
+};
 function assertNodeVersion(nodeVersion) {
   const major = Number(nodeVersion.split(".")[0]);
   if (major < 22) {
-    process.stderr.write(
-      `workscribe requires Node.js 22 or later (you have v${nodeVersion}).
-Upgrade at https://nodejs.org or via your version manager:
-  nvm install 22 && nvm use 22
-`
-    );
+    const manager = detectVersionManager();
+    const upgradeHint = manager ? `Upgrade with ${manager}:
+  ${UPGRADE_COMMANDS[manager]}` : "Download the latest version from https://nodejs.org";
+    process.stderr.write(`workscribe requires Node.js 22 or later (you have v${nodeVersion}).
+
+${upgradeHint}
+`);
     process.exit(1);
   }
 }
@@ -56,7 +74,7 @@ var USE_XDG = !import_fs.default.existsSync(LEGACY_DIR);
 var xdgDataDir = USE_XDG ? import_path.default.join(process.env.XDG_DATA_HOME ?? import_path.default.join(import_os.default.homedir(), ".local", "share"), "workscribe") : LEGACY_DIR;
 var xdgConfigDir = USE_XDG ? import_path.default.join(process.env.XDG_CONFIG_HOME ?? import_path.default.join(import_os.default.homedir(), ".config"), "workscribe") : LEGACY_DIR;
 var xdgStateDir = USE_XDG ? import_path.default.join(process.env.XDG_STATE_HOME ?? import_path.default.join(import_os.default.homedir(), ".local", "state"), "workscribe") : LEGACY_DIR;
-var REQUIRED_DIRS = [.../* @__PURE__ */ new Set([xdgDataDir, xdgConfigDir, xdgStateDir])];
+var REQUIRED_DIRS = [.../* @__PURE__ */ new Set([xdgDataDir, xdgConfigDir, xdgStateDir, LEGACY_DIR])];
 var WORKSCRIBE_DIR = xdgDataDir;
 var DB_PATH = import_path.default.join(xdgDataDir, "workscribe.db");
 var CONFIG_PATH = import_path.default.join(xdgConfigDir, "config.json");
@@ -66,6 +84,7 @@ var EXPORTS_DIR = import_path.default.join(xdgDataDir, "exports");
 var PAUSE_FLAG_PATH = import_path.default.join(xdgStateDir, "paused");
 var WEEKLY_CACHE_DIR = import_path.default.join(xdgDataDir, "weekly-cache");
 var PROFILES_DIR = import_path.default.join(xdgDataDir, "profiles");
+var ALERTS_PENDING_PATH = import_path.default.join(LEGACY_DIR, "alerts.pending");
 
 // src/db/migrations/001_initial_schema.ts
 var initial_schema_default = {
@@ -127,8 +146,38 @@ var migration = {
 };
 var semantic_categories_default = migration;
 
+// src/db/migrations/003_alerts.ts
+var migration2 = {
+  version: 3,
+  description: "Add alerts table for AI session secret detection",
+  sql: `
+    CREATE TABLE IF NOT EXISTS alerts (
+      id         INTEGER PRIMARY KEY AUTOINCREMENT,
+      created_at INTEGER NOT NULL,
+      tool       TEXT    NOT NULL,
+      session_id TEXT,
+      context    TEXT    NOT NULL,
+      cleared    INTEGER NOT NULL DEFAULT 0
+    );
+    CREATE INDEX IF NOT EXISTS alerts_cleared ON alerts (cleared);
+  `
+};
+var alerts_default = migration2;
+
+// src/db/migrations/004_ide_columns.ts
+var migration3 = {
+  version: 4,
+  description: "Add source and file_path columns to events for IDE integration",
+  sql: `
+    ALTER TABLE events ADD COLUMN source TEXT;
+    ALTER TABLE events ADD COLUMN file_path TEXT;
+    CREATE INDEX IF NOT EXISTS idx_events_file_path ON events (file_path, cwd);
+  `
+};
+var ide_columns_default = migration3;
+
 // src/db/migrations/index.ts
-var MIGRATIONS = [initial_schema_default, semantic_categories_default];
+var MIGRATIONS = [initial_schema_default, semantic_categories_default, alerts_default, ide_columns_default];
 
 // src/db/index.ts
 var _db = null;
@@ -165,13 +214,13 @@ function applyMigrations(db) {
   const applied = new Set(
     db.prepare("SELECT version FROM schema_migrations").all().map((row) => row.version)
   );
-  for (const migration2 of MIGRATIONS) {
-    if (applied.has(migration2.version)) continue;
+  for (const migration4 of MIGRATIONS) {
+    if (applied.has(migration4.version)) continue;
     db.exec("BEGIN");
     try {
-      db.exec(migration2.sql);
+      db.exec(migration4.sql);
       db.prepare("INSERT INTO schema_migrations (version, applied_at) VALUES ($version, datetime('now'))").run({
-        version: migration2.version
+        version: migration4.version
       });
       db.exec("COMMIT");
     } catch (err) {
@@ -179,18 +228,48 @@ function applyMigrations(db) {
         db.exec("ROLLBACK");
       } catch {
       }
-      throw new Error(`Migration ${migration2.version} (${migration2.description}) failed: ${err.message}`);
+      throw new Error(`Migration ${migration4.version} (${migration4.description}) failed: ${err.message}`);
     }
   }
 }
 function insertEvent(params) {
   const db = getDb();
   const stmt = db.prepare(`
-    INSERT INTO events (captured_at, command, cwd, exit_code, duration_ms, repo_name, branch, category, metadata)
-    VALUES ($captured_at, $command, $cwd, $exit_code, $duration_ms, $repo_name, $branch, $category, $metadata)
+    INSERT INTO events (captured_at, command, cwd, exit_code, duration_ms, repo_name, branch, category, metadata, source, file_path)
+    VALUES ($captured_at, $command, $cwd, $exit_code, $duration_ms, $repo_name, $branch, $category, $metadata, $source, $file_path)
   `);
   stmt.run(params);
 }
+function getRecentSessionsByRepo(repoName, limit) {
+  const db = getDb();
+  return db.prepare("SELECT * FROM sessions WHERE repo_name = $repo_name ORDER BY started_at DESC LIMIT $limit").all({ repo_name: repoName, limit });
+}
+function getLastSessionTouchingFile(filePath) {
+  const db = getDb();
+  return db.prepare(
+    `SELECT s.* FROM sessions s
+       INNER JOIN session_events se ON se.session_id = s.id
+       INNER JOIN events e ON e.id = se.event_id
+       WHERE e.file_path = $file_path
+       ORDER BY s.started_at DESC
+       LIMIT 1`
+  ).get({ file_path: filePath });
+}
+function getSessionBranch(sessionId) {
+  const db = getDb();
+  const row = db.prepare(
+    `SELECT e.branch FROM events e
+       INNER JOIN session_events se ON se.event_id = e.id
+       WHERE se.session_id = $session_id AND e.branch IS NOT NULL
+       ORDER BY e.captured_at DESC
+       LIMIT 1`
+  ).get({ session_id: sessionId });
+  return row?.branch ?? null;
+}
+function getLastEventForFile(filePath, cwd) {
+  const db = getDb();
+  return db.prepare("SELECT * FROM events WHERE file_path = $file_path AND cwd = $cwd ORDER BY id DESC LIMIT 1").get({ file_path: filePath, cwd });
+}
 function getLastEvent() {
   const db = getDb();
   const stmt = db.prepare("SELECT * FROM events ORDER BY id DESC LIMIT 1");
@@ -332,7 +411,10 @@ var BUILTIN_PATTERNS = [
   /(?<=export\s+(?:[A-Z_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASS|AUTH|CREDENTIAL)[A-Z_]*)=)\S+/gi,
   // Inline assignment: VAR_WITH_SENSITIVE_KEYWORD=value cmd  (e.g. API_KEY=secret npm start)
   // Lookbehind matches only the variable-name= prefix, so only the value is replaced
-  /(?<=[A-Z_][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASS|AUTH|CREDENTIAL)[A-Z0-9_]*=)\S+/gi
+  /(?<=[A-Z_][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASS|AUTH|CREDENTIAL)[A-Z0-9_]*=)\S+/gi,
+  // Credentials embedded in connection string URLs (e.g. DATABASE_URL=postgres://user:pass@host/db)
+  // Matches the password segment between :// user : password @ — preserves scheme and host
+  /(?<=[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^:@\s/]+:)[^@\s]+(?=@)/g
 ];
 function redact(command, extraPatterns = []) {
   let result = command;
@@ -421,7 +503,7 @@ function readLastAiderPrompt(cwd) {
   try {
     const histPath = import_path3.default.join(cwd, HISTORY_FILE);
     const content = import_fs4.default.readFileSync(histPath, "utf-8");
-    const matches = [...content.matchAll(/^> (.+)$/gm)];
+    const matches = [...content.matchAll(/^#### (.+)$/gm)];
     if (!matches.length) return null;
     return matches[matches.length - 1][1].trim().slice(0, PROMPT_MAX_LENGTH);
   } catch {
@@ -441,56 +523,108 @@ var ai_tools_default = [
     displayName: "Claude Code",
     pattern: "^claude\\b",
     hook: "claude-code",
-    contextSource: "hook"
+    contextSource: "hook",
+    historyFormat: null,
+    securityWarning: null
   },
   {
     tool: "aider",
     displayName: "Aider",
     pattern: "^aider\\b",
     hook: null,
-    contextSource: "history-file"
+    contextSource: "history-file",
+    historyFormat: "markdown",
+    securityWarning: null
+  },
+  {
+    tool: "codex",
+    displayName: "Codex CLI",
+    pattern: "^codex\\b",
+    hook: null,
+    contextSource: "history-file",
+    historyFormat: "jsonl",
+    securityWarning: null
   },
   {
     tool: "gemini",
-    displayName: "Gemini",
+    displayName: "Gemini CLI",
     pattern: "^gemini\\b",
     hook: null,
-    contextSource: null
+    contextSource: "history-file",
+    historyFormat: "json",
+    securityWarning: null
   },
   {
     tool: "gh copilot",
     displayName: "GitHub Copilot",
     pattern: "^gh\\s+copilot\\b",
     hook: null,
-    contextSource: null
-  },
-  {
-    tool: "cody",
-    displayName: "Cody",
-    pattern: "^cody\\b",
-    hook: null,
-    contextSource: null
+    contextSource: "history-file",
+    historyFormat: "jsonl",
+    securityWarning: null
   },
   {
     tool: "amazon-q",
     displayName: "Amazon Q",
     pattern: "^q\\s+(chat|dev)\\b",
     hook: null,
-    contextSource: null
+    contextSource: "history-file",
+    historyFormat: "json",
+    securityWarning: null
+  },
+  {
+    tool: "opencode",
+    displayName: "OpenCode",
+    pattern: "^opencode\\b",
+    hook: null,
+    contextSource: "sqlite",
+    historyFormat: "sqlite",
+    securityWarning: null
+  },
+  {
+    tool: "kilo",
+    displayName: "Kilo Code",
+    pattern: "^kilo\\b",
+    hook: null,
+    contextSource: null,
+    historyFormat: null,
+    securityWarning: null
+  },
+  {
+    tool: "grok",
+    displayName: "Grok Build",
+    pattern: "^grok\\b",
+    hook: null,
+    contextSource: null,
+    historyFormat: null,
+    securityWarning: "Grok Build was found to silently upload entire local git repositories \u2014 including .env files and untracked secrets \u2014 to Google Cloud Storage without user disclosure (July 2026 incident). Workscribe does not read Grok Build session files. Consider whether this tool is appropriate for use in repositories containing sensitive credentials."
   },
   {
     tool: "continue",
     displayName: "Continue",
     pattern: "^continue\\b",
     hook: null,
-    contextSource: null
+    contextSource: null,
+    historyFormat: null,
+    securityWarning: null
+  },
+  {
+    tool: "cody",
+    displayName: "Cody",
+    pattern: "^cody\\b",
+    hook: null,
+    contextSource: null,
+    historyFormat: null,
+    securityWarning: null
   },
   {
     tool: "cursor",
     displayName: "Cursor",
     pattern: "^cursor\\b",
     hook: null,
-    contextSource: null
+    contextSource: null,
+    historyFormat: null,
+    securityWarning: null
   }
 ];
 
@@ -529,7 +663,9 @@ function loadAIToolRegistry() {
           displayName: entry.displayName ?? entry.tool,
           pattern: entry.pattern,
           hook: entry.hook ?? null,
-          contextSource: entry.contextSource ?? null
+          contextSource: entry.contextSource ?? null,
+          historyFormat: entry.historyFormat ?? null,
+          securityWarning: entry.securityWarning ?? null
         }));
       }
     }
@@ -1074,11 +1210,41 @@ function isDuplicate(command, cwd, lastEvent, dedupWindowMs = 5e3, now = Date.no
   return lastEvent.command === normalizeForFilter(command) && lastEvent.cwd === cwd && now - lastTime < dedupWindowMs;
 }
 
+// src/capture/ide.ts
+var IDE_DEDUP_WINDOW_MS = 3e4;
+
 // src/capture/index.ts
 function captureCommand(opts) {
   if (import_fs10.default.existsSync(PAUSE_FLAG_PATH)) return;
   const config = readConfig();
-  const { command, cwd, exitCode, durationMs } = opts;
+  const { cwd, exitCode, durationMs } = opts;
+  if (opts.type) {
+    if (opts.type === "code_edit" && opts.file) {
+      const lastForFile = getLastEventForFile(opts.file, cwd);
+      if (lastForFile) {
+        const lastTime = new Date(lastForFile.captured_at).getTime();
+        if (Date.now() - lastTime < IDE_DEDUP_WINDOW_MS) return;
+      }
+    }
+    const command2 = opts.command ?? opts.file ?? opts.type;
+    const nameOverride2 = config.projects?.[cwd] ?? null;
+    const { repoName: repoName2, branch: branch2 } = getGitContext(cwd, nameOverride2);
+    insertEvent({
+      captured_at: (/* @__PURE__ */ new Date()).toISOString(),
+      command: command2,
+      cwd,
+      exit_code: exitCode,
+      duration_ms: durationMs,
+      repo_name: repoName2,
+      branch: branch2,
+      category: opts.type,
+      metadata: null,
+      source: opts.source ?? null,
+      file_path: opts.file ?? null
+    });
+    return;
+  }
+  const command = opts.command;
   if (shouldFilter(command, config.capture.ignore)) return;
   const last = getLastEvent();
   if (isDuplicate(command, cwd, last ?? void 0)) return;
@@ -1092,7 +1258,6 @@ function captureCommand(opts) {
     if (firstToken) metadata.tool = firstToken;
     metadata.hint = safeCommand.trim().slice(0, 120);
   }
-  if (opts.source) metadata.source = opts.source;
   if (category === "ai_session") {
     if (opts.gitBefore) {
       const commits = getCommitsSince(opts.gitBefore, cwd);
@@ -1115,24 +1280,30 @@ function captureCommand(opts) {
     repo_name: repoName,
     branch,
     category,
-    metadata: Object.keys(metadata).length > 0 ? JSON.stringify(metadata) : null
+    metadata: Object.keys(metadata).length > 0 ? JSON.stringify(metadata) : null,
+    source: opts.source ?? null,
+    file_path: null
   });
 }
 
 // src/cli/capture.ts
 var CAPTURE_HANG_TIMEOUT_MS = 5e3;
 function registerCapture(program2) {
-  program2.command("_capture").description("Internal: capture a shell command event (called by shell hook)").option("--cmd <command>", "command that was executed").option("--cwd <path>", "working directory").option("--exit <code>", "exit code", parseInt).option("--duration <ms>", "duration in milliseconds", parseInt).option("--git-before <sha>", "git HEAD SHA before this command ran").action((opts) => {
+  program2.command("_capture").description("Internal: capture a shell command or IDE event (called by shell hook or IDE plugin)").option("--cmd <command>", "command that was executed (shell events)").option("--cwd <path>", "working directory").option("--exit <code>", "exit code", parseInt).option("--duration <ms>", "duration in milliseconds", parseInt).option("--git-before <sha>", "git HEAD SHA before this command ran").option("--type <type>", "event type override \u2014 skips normalization (IDE integrations)").option("--source <source>", "event source identifier (e.g. vscode, neovim, jupyter)").option("--file <path>", "file path for code_edit events").action((opts) => {
     const hangGuard = setTimeout(() => process.exit(0), CAPTURE_HANG_TIMEOUT_MS);
     hangGuard.unref();
     try {
-      if (!opts.cmd || !opts.cwd) return;
+      if (!opts.cwd) return;
+      if (!opts.cmd && !opts.type) return;
       captureCommand({
         command: opts.cmd,
         cwd: opts.cwd,
         exitCode: opts.exit ?? null,
         durationMs: opts.duration ?? null,
-        gitBefore: opts.gitBefore ?? void 0
+        gitBefore: opts.gitBefore ?? void 0,
+        source: opts.source ?? void 0,
+        type: opts.type ?? void 0,
+        file: opts.file ?? void 0
       });
     } catch (err) {
       debugLog("_capture", err);
@@ -1140,6 +1311,38 @@ function registerCapture(program2) {
   });
 }
 
+// src/capture/detect-secrets.ts
+function containsSecrets(text) {
+  return redact(text) !== text;
+}
+
+// src/db/alerts.ts
+var import_fs11 = __toESM(require("fs"));
+var import_path7 = __toESM(require("path"));
+function insertAlert(tool, sessionId, context) {
+  getDb().prepare(
+    `INSERT INTO alerts (created_at, tool, session_id, context)
+       VALUES ($created_at, $tool, $session_id, $context)`
+  ).run({ created_at: Date.now(), tool, session_id: sessionId ?? null, context });
+  import_fs11.default.mkdirSync(import_path7.default.dirname(ALERTS_PENDING_PATH), { recursive: true });
+  import_fs11.default.writeFileSync(ALERTS_PENDING_PATH, "", { flag: "w" });
+}
+function getPendingAlerts() {
+  return getDb().prepare("SELECT * FROM alerts WHERE cleared = 0 ORDER BY created_at DESC").all();
+}
+function hasPendingAlerts() {
+  const row = getDb().prepare("SELECT COUNT(*) as count FROM alerts WHERE cleared = 0").get();
+  return Number(row.count) > 0;
+}
+function clearAlerts() {
+  const result = getDb().prepare("UPDATE alerts SET cleared = 1 WHERE cleared = 0").run();
+  try {
+    import_fs11.default.unlinkSync(ALERTS_PENDING_PATH);
+  } catch {
+  }
+  return Number(result.changes);
+}
+
 // src/cli/hook.ts
 function parseHookPayload(raw) {
   if (!raw.trim()) return null;
@@ -1150,8 +1353,17 @@ function parseHookPayload(raw) {
   if (!command || !cwd) return null;
   return { command, cwd };
 }
+function parseUserPromptPayload(raw) {
+  if (!raw.trim()) return null;
+  const payload = JSON.parse(raw);
+  const prompt = typeof payload.prompt === "string" ? payload.prompt : null;
+  const sessionId = typeof payload.session_id === "string" ? payload.session_id : "";
+  const cwd = typeof payload.cwd === "string" ? payload.cwd : "";
+  if (!prompt) return null;
+  return { session_id: sessionId, prompt, cwd };
+}
 function registerHook(program2) {
-  program2.command("_hook").description("Internal: capture events from AI tool hooks (stdin JSON payload)").option("--source <source>", "hook source identifier (e.g. claude-code)").action((opts) => {
+  program2.command("_hook").description("Internal: capture events from AI tool hooks (stdin JSON payload)").option("--source <source>", "hook source identifier (e.g. claude-code)").option("--event <event>", "hook event type (PostToolUse or UserPromptSubmit)", "PostToolUse").action((opts) => {
     let raw = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
@@ -1159,6 +1371,23 @@ function registerHook(program2) {
     });
     process.stdin.on("end", () => {
       try {
+        if (opts.event === "UserPromptSubmit") {
+          const parsed2 = parseUserPromptPayload(raw);
+          if (!parsed2) return;
+          if (containsSecrets(parsed2.prompt)) {
+            insertAlert(
+              opts.source ?? "unknown",
+              parsed2.session_id || null,
+              "Possible credential detected in prompt submitted to AI tool"
+            );
+            process.stdout.write(
+              JSON.stringify({
+                systemMessage: "Workscribe detected a possible credential in your prompt. Run `workscribe alerts` for details."
+              })
+            );
+          }
+          return;
+        }
         if (readConfig().capture.aiTools === false) return;
         const parsed = parseHookPayload(raw);
         if (!parsed) return;
@@ -1177,8 +1406,8 @@ function registerHook(program2) {
 }
 
 // src/cli/init.ts
-var import_fs13 = __toESM(require("fs"));
-var import_path9 = __toESM(require("path"));
+var import_fs14 = __toESM(require("fs"));
+var import_path10 = __toESM(require("path"));
 var import_os5 = __toESM(require("os"));
 var import_prompts = __toESM(require("prompts"));
 var import_chalk2 = __toESM(require("chalk"));
@@ -1224,6 +1453,17 @@ function eachDayOfRange(start, end) {
   }
   return days;
 }
+function timeAgo(isoString, now = Date.now()) {
+  const elapsedMs = now - new Date(isoString).getTime();
+  const minutes = Math.floor(elapsedMs / 6e4);
+  if (minutes < 2) return "just now";
+  if (minutes < 60) return `${minutes} minutes ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return hours === 1 ? "1 hour ago" : `${hours} hours ago`;
+  const days = Math.floor(hours / 24);
+  if (days === 1) return "yesterday";
+  return `${days} days ago`;
+}
 function isoWeekKey(dateStr) {
   const d = /* @__PURE__ */ new Date(dateStr + "T00:00:00");
   const jan4 = new Date(d.getFullYear(), 0, 4);
@@ -1272,6 +1512,8 @@ RULES \u2014 follow these exactly:
 
 7. Stick to what the events show. Do not infer subject matter from the branch name. Do not add details not derivable from the events.
 
+8. For code_edit events: these represent file saves from an IDE integration. Describe what was being built based on repository context (branch name, commit messages). Never list individual filenames.
+
 Maximum 5 bullets. Output ONLY the bullet points, nothing else.`;
 function getSystemPrompt() {
   const contexts = getActiveProfileAiContexts();
@@ -1313,7 +1555,9 @@ function buildUserMessage(payload, includeCategories = []) {
       if (excluded.has(event.category)) continue;
       const failed = event.exitCode !== null && event.exitCode !== 0 ? " [failed]" : "";
       let key;
-      if (event.hint) {
+      if (event.category === "code_edit") {
+        key = `code_edit${failed}`;
+      } else if (event.hint) {
         key = `other  [${event.hint}]${failed}`;
       } else {
         const meta = Object.keys(event.metadata).length > 0 ? ` ${JSON.stringify(event.metadata)}` : "";
@@ -1381,7 +1625,9 @@ function buildWeeklyMessage(payload) {
         if (excluded.has(event.category)) continue;
         const failed = event.exitCode !== null && event.exitCode !== 0 ? " [failed]" : "";
         let key;
-        if (event.hint) {
+        if (event.category === "code_edit") {
+          key = `code_edit${failed}`;
+        } else if (event.hint) {
           key = `other  [${event.hint}]${failed}`;
         } else {
           const meta = Object.keys(event.metadata).length > 0 ? ` ${JSON.stringify(event.metadata)}` : "";
@@ -1412,7 +1658,7 @@ var GenericProvider = class {
   baseUrl;
   includeCategories;
   async call(system, userMsg, maxTokens) {
-    const response = await fetchWithTimeout(this.config.chatUrl(this.baseUrl), {
+    const response = await fetchWithTimeout(this.config.chatUrl(this.baseUrl, this.apiKey, this.model), {
       method: "POST",
       headers: this.config.headers(this.apiKey),
       body: JSON.stringify(this.config.buildChatBody(this.model, system, userMsg, maxTokens))
@@ -1430,7 +1676,7 @@ var GenericProvider = class {
   }
   async validate() {
     const isPost = this.config.validateMethod === "POST";
-    const response = await fetchWithTimeout(this.config.validateUrl(this.baseUrl), {
+    const response = await fetchWithTimeout(this.config.validateUrl(this.baseUrl, this.apiKey, this.model), {
       method: this.config.validateMethod,
       headers: isPost ? this.config.headers(this.apiKey) : void 0,
       body: isPost && this.config.buildValidateBody ? JSON.stringify(this.config.buildValidateBody(this.model)) : void 0
@@ -1529,6 +1775,59 @@ var PROVIDER_CONFIGS = {
     },
     chatError: (status, body) => `Ollama error ${status}: ${body}. Is Ollama running? Try: ollama serve`,
     validateError: (_status, _body, baseUrl) => `Ollama is not reachable at ${baseUrl}. Is it running? Try: ollama serve`
+  },
+  gemini: {
+    defaultModel: "gemini-2.0-flash-lite",
+    defaultBaseUrl: "https://generativelanguage.googleapis.com/v1beta",
+    dailyTokens: 1024,
+    weeklyTokens: 1024,
+    // API key and model are embedded in the URL — not in headers
+    chatUrl: (baseUrl, apiKey, model) => `${baseUrl}/models/${model}:generateContent?key=${apiKey}`,
+    validateUrl: (baseUrl, apiKey, model) => `${baseUrl}/models/${model}:generateContent?key=${apiKey}`,
+    validateMethod: "POST",
+    headers: () => ({ "Content-Type": "application/json" }),
+    buildChatBody: (_model, system, userMsg, maxTokens) => ({
+      system_instruction: { parts: [{ text: system }] },
+      contents: [{ role: "user", parts: [{ text: userMsg }] }],
+      generationConfig: { maxOutputTokens: maxTokens, temperature: 0.3 }
+    }),
+    buildValidateBody: () => ({
+      contents: [{ role: "user", parts: [{ text: "." }] }],
+      generationConfig: { maxOutputTokens: 1 }
+    }),
+    parseText: (json) => {
+      const data = json;
+      return data.candidates?.[0]?.content?.parts?.[0]?.text ?? "";
+    },
+    chatError: (status, body) => `Gemini API error ${status}: ${body}`,
+    validateError: (status, body) => `Gemini API error ${status}: ${body}`
+  },
+  groq: {
+    defaultModel: "llama-3.1-8b-instant",
+    defaultBaseUrl: "https://api.groq.com/openai/v1",
+    dailyTokens: 1024,
+    weeklyTokens: 1024,
+    chatUrl: (baseUrl) => `${baseUrl}/chat/completions`,
+    validateUrl: (baseUrl) => `${baseUrl}/models`,
+    validateMethod: "GET",
+    headers: (apiKey) => ({
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`
+    }),
+    buildChatBody: (model, system, userMsg, maxTokens) => ({
+      model,
+      messages: [
+        { role: "system", content: system },
+        { role: "user", content: userMsg }
+      ],
+      max_tokens: maxTokens
+    }),
+    parseText: (json) => {
+      const data = json;
+      return data.choices?.[0]?.message?.content ?? "";
+    },
+    chatError: (status, body) => `Groq API error ${status}: ${body}`,
+    validateError: (status, body) => `Groq API error ${status}: ${body}`
   }
 };
 
@@ -1537,7 +1836,7 @@ function getProvider(config) {
   const { provider, apiKey = "", model, baseUrl } = config.ai;
   if (!provider) {
     throw new Error(
-      "No AI provider configured.\nRun: workscribe config set ai.provider <anthropic|openai|ollama|openai-compatible>"
+      "No AI provider configured.\nRun: workscribe config set ai.provider <anthropic|openai|gemini|groq|ollama|openai-compatible>"
     );
   }
   const configKey = provider === "openai-compatible" ? "openai" : provider;
@@ -1545,7 +1844,7 @@ function getProvider(config) {
   if (!providerConfig) {
     throw new Error(
       `Unknown provider: "${provider}"
-Supported providers: anthropic, openai, ollama, openai-compatible`
+Supported providers: anthropic, openai, gemini, groq, ollama, openai-compatible`
     );
   }
   if (provider !== "ollama" && !apiKey) {
@@ -1565,9 +1864,10 @@ Run: workscribe config set ai.apiKey <your-key>`);
 }
 
 // src/capture/shell-hook.ts
-var import_fs11 = __toESM(require("fs"));
-var import_path7 = __toESM(require("path"));
+var import_fs12 = __toESM(require("fs"));
+var import_path8 = __toESM(require("path"));
 var import_os3 = __toESM(require("os"));
+var import_child_process3 = require("child_process");
 
 // src/utils/completion-scripts.ts
 function bashCompletion(commands) {
@@ -1624,13 +1924,13 @@ function fishCompletion(commands) {
 }
 
 // src/capture/shell-hook.ts
-var FISH_COMPLETIONS_DIR = import_path7.default.join(import_os3.default.homedir(), ".config", "fish", "completions");
+var FISH_COMPLETIONS_DIR = import_path8.default.join(import_os3.default.homedir(), ".config", "fish", "completions");
 var HOOK_START = "# workscribe:hook:start";
 var HOOK_END = "# workscribe:hook:end";
 var HOOK_PREAMBLE = "# Workscribe \u2014 developer work journal";
 function getInstalledHookBlock(rcFile) {
-  if (!import_fs11.default.existsSync(rcFile)) return null;
-  const content = import_fs11.default.readFileSync(rcFile, "utf-8");
+  if (!import_fs12.default.existsSync(rcFile)) return null;
+  const content = import_fs12.default.readFileSync(rcFile, "utf-8");
   const startIdx = content.indexOf(HOOK_START);
   const endIdx = content.indexOf(HOOK_END);
   if (startIdx === -1 || endIdx === -1) return null;
@@ -1646,54 +1946,66 @@ function isHookOutdated(rcFile, hookContent) {
 }
 function installHook(rcFile, hookContent) {
   const backup = `${rcFile}.workscribe-backup-${Date.now()}`;
-  import_fs11.default.copyFileSync(rcFile, backup);
-  log.info(`Backed up ${rcFile} \u2192 ${import_path7.default.basename(backup)}`);
-  import_fs11.default.appendFileSync(rcFile, `
+  import_fs12.default.copyFileSync(rcFile, backup);
+  log.info(`Backed up ${rcFile} \u2192 ${import_path8.default.basename(backup)}`);
+  import_fs12.default.appendFileSync(rcFile, `
 ${hookContent}
 `);
 }
 function updateHook(rcFile, hookContent) {
   const backup = `${rcFile}.workscribe-backup-${Date.now()}`;
-  import_fs11.default.copyFileSync(rcFile, backup);
-  log.info(`Backed up ${rcFile} \u2192 ${import_path7.default.basename(backup)}`);
-  const content = import_fs11.default.readFileSync(rcFile, "utf-8");
+  import_fs12.default.copyFileSync(rcFile, backup);
+  log.info(`Backed up ${rcFile} \u2192 ${import_path8.default.basename(backup)}`);
+  const content = import_fs12.default.readFileSync(rcFile, "utf-8");
   const startIdx = content.indexOf(HOOK_START);
   const endIdx = content.indexOf(HOOK_END) + HOOK_END.length;
-  import_fs11.default.writeFileSync(rcFile, content.slice(0, startIdx) + hookContent + content.slice(endIdx));
+  import_fs12.default.writeFileSync(rcFile, content.slice(0, startIdx) + hookContent + content.slice(endIdx));
 }
 function removeHook(rcFile) {
   const backup = `${rcFile}.workscribe-backup-${Date.now()}`;
-  import_fs11.default.copyFileSync(rcFile, backup);
-  log.info(`Backed up ${rcFile} \u2192 ${import_path7.default.basename(backup)}`);
-  const content = import_fs11.default.readFileSync(rcFile, "utf-8");
+  import_fs12.default.copyFileSync(rcFile, backup);
+  log.info(`Backed up ${rcFile} \u2192 ${import_path8.default.basename(backup)}`);
+  const content = import_fs12.default.readFileSync(rcFile, "utf-8");
   const startIdx = content.indexOf(HOOK_START);
   const endIdx = content.indexOf(HOOK_END) + HOOK_END.length;
   const preambleIdx = content.lastIndexOf(HOOK_PREAMBLE, startIdx);
   const blockStart = preambleIdx !== -1 ? preambleIdx : startIdx;
   const before = content.slice(0, blockStart).replace(/\n+$/, "\n");
   const after = content.slice(endIdx).replace(/^\n/, "");
-  import_fs11.default.writeFileSync(rcFile, before + after);
+  import_fs12.default.writeFileSync(rcFile, before + after);
+}
+function resolveWorkscribeBinary() {
+  try {
+    const resolved = (0, import_child_process3.execFileSync)("which", ["workscribe"], { encoding: "utf-8" }).trim();
+    return resolved || null;
+  } catch {
+    return null;
+  }
+}
+function injectBinaryPath(hookContent, binaryPath) {
+  return hookContent.replace("command -v workscribe > /dev/null 2>&1 || return 0", `[[ -x "${binaryPath}" ]] || return 0`).replace("command -v workscribe &>/dev/null || return 0", `[[ -x "${binaryPath}" ]] || return 0`).replace("type -q workscribe\n    or return 0", `test -x "${binaryPath}"
+    or return 0`).replaceAll("command workscribe _capture", `"${binaryPath}" _capture`).replaceAll("command workscribe alerts", `"${binaryPath}" alerts`);
 }
 function isCompletionsInstalled(shell) {
   if (shell.name === "fish") {
-    return import_fs11.default.existsSync(import_path7.default.join(FISH_COMPLETIONS_DIR, "workscribe.fish"));
+    return import_fs12.default.existsSync(import_path8.default.join(FISH_COMPLETIONS_DIR, "workscribe.fish"));
   }
   try {
-    return import_fs11.default.readFileSync(shell.rcFile, "utf-8").includes("workscribe completions");
+    return import_fs12.default.readFileSync(shell.rcFile, "utf-8").includes("workscribe completions");
   } catch {
     return false;
   }
 }
 function installCompletions(shell, commands) {
   if (shell.name === "fish") {
-    if (!import_fs11.default.existsSync(FISH_COMPLETIONS_DIR)) {
-      import_fs11.default.mkdirSync(FISH_COMPLETIONS_DIR, { recursive: true });
+    if (!import_fs12.default.existsSync(FISH_COMPLETIONS_DIR)) {
+      import_fs12.default.mkdirSync(FISH_COMPLETIONS_DIR, { recursive: true });
     }
-    import_fs11.default.writeFileSync(import_path7.default.join(FISH_COMPLETIONS_DIR, "workscribe.fish"), fishCompletion(commands), { mode: 420 });
+    import_fs12.default.writeFileSync(import_path8.default.join(FISH_COMPLETIONS_DIR, "workscribe.fish"), fishCompletion(commands), { mode: 420 });
   } else {
     const script = shell.name === "zsh" ? zshCompletion(commands) : bashCompletion(commands);
-    const cacheFile = import_path7.default.join(WORKSCRIBE_DIR, `completion.${shell.name}`);
-    import_fs11.default.writeFileSync(cacheFile, script, { mode: 420 });
+    const cacheFile = import_path8.default.join(WORKSCRIBE_DIR, `completion.${shell.name}`);
+    import_fs12.default.writeFileSync(cacheFile, script, { mode: 420 });
     const sourceLine = shell.name === "zsh" ? `
 # Workscribe completions
 autoload -Uz compinit && compinit
@@ -1702,20 +2014,20 @@ source "${cacheFile}"
 # Workscribe completions
 source "${cacheFile}"
 `;
-    import_fs11.default.appendFileSync(shell.rcFile, sourceLine);
+    import_fs12.default.appendFileSync(shell.rcFile, sourceLine);
   }
 }
 
 // src/capture/hooks/claude-code.ts
-var import_fs12 = __toESM(require("fs"));
-var import_path8 = __toESM(require("path"));
+var import_fs13 = __toESM(require("fs"));
+var import_path9 = __toESM(require("path"));
 var import_os4 = __toESM(require("os"));
 
 // src/capture/hooks/utils.ts
-var import_child_process3 = require("child_process");
+var import_child_process4 = require("child_process");
 function isCommandInstalled(cmd) {
   try {
-    (0, import_child_process3.execSync)(`which ${cmd}`, { stdio: "ignore" });
+    (0, import_child_process4.execSync)(`which ${cmd}`, { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -1723,11 +2035,11 @@ function isCommandInstalled(cmd) {
 }
 
 // src/capture/hooks/claude-code.ts
-var CLAUDE_SETTINGS_PATH = import_path8.default.join(import_os4.default.homedir(), ".claude", "settings.json");
+var CLAUDE_SETTINGS_PATH = import_path9.default.join(import_os4.default.homedir(), ".claude", "settings.json");
 function readSettings() {
-  if (!import_fs12.default.existsSync(CLAUDE_SETTINGS_PATH)) return {};
+  if (!import_fs13.default.existsSync(CLAUDE_SETTINGS_PATH)) return {};
   try {
-    return JSON.parse(import_fs12.default.readFileSync(CLAUDE_SETTINGS_PATH, "utf-8"));
+    return JSON.parse(import_fs13.default.readFileSync(CLAUDE_SETTINGS_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -1739,19 +2051,30 @@ var claudeCodeIntegration = {
   },
   isHookInstalled() {
     const settings = readSettings();
-    const postToolUse = settings.hooks?.PostToolUse ?? [];
-    return postToolUse.some((entry) => {
-      const hooks = entry.hooks ?? [];
-      return hooks.some((hookItem) => {
+    const hooks = settings.hooks ?? {};
+    const postToolUse = hooks.PostToolUse ?? [];
+    const hasPostToolUse = postToolUse.some((entry) => {
+      const entryHooks = entry.hooks ?? [];
+      return entryHooks.some((hookItem) => {
+        const hook = hookItem;
+        return typeof hook.command === "string" && hook.command.includes("workscribe _hook");
+      });
+    });
+    const userPromptSubmit = hooks.UserPromptSubmit ?? [];
+    const hasUserPromptSubmit = userPromptSubmit.some((entry) => {
+      const entryHooks = entry.hooks ?? [];
+      return entryHooks.some((hookItem) => {
         const hook = hookItem;
         return typeof hook.command === "string" && hook.command.includes("workscribe _hook");
       });
     });
+    return hasPostToolUse && hasUserPromptSubmit;
   },
   install() {
     const settings = readSettings();
     const existingHooks = settings.hooks ?? {};
     const existingPostToolUse = existingHooks.PostToolUse ?? [];
+    const existingUserPromptSubmit = existingHooks.UserPromptSubmit ?? [];
     settings.hooks = {
       ...existingHooks,
       PostToolUse: [
@@ -1760,10 +2083,21 @@ var claudeCodeIntegration = {
           matcher: "Bash",
           hooks: [{ type: "command", command: "workscribe _hook --source claude-code", async: true }]
         }
+      ],
+      UserPromptSubmit: [
+        ...existingUserPromptSubmit,
+        {
+          hooks: [
+            {
+              type: "command",
+              command: "workscribe _hook --source claude-code --event UserPromptSubmit"
+            }
+          ]
+        }
       ]
     };
-    import_fs12.default.mkdirSync(import_path8.default.dirname(CLAUDE_SETTINGS_PATH), { recursive: true });
-    import_fs12.default.writeFileSync(CLAUDE_SETTINGS_PATH, JSON.stringify(settings, null, 2));
+    import_fs13.default.mkdirSync(import_path9.default.dirname(CLAUDE_SETTINGS_PATH), { recursive: true });
+    import_fs13.default.writeFileSync(CLAUDE_SETTINGS_PATH, JSON.stringify(settings, null, 2));
   }
 };
 
@@ -1794,11 +2128,11 @@ function registerCompletions(program2) {
 // src/cli/init.ts
 function detectShell() {
   const shell = process.env.SHELL ?? "";
-  if (shell.includes("zsh")) return { name: "zsh", rcFile: import_path9.default.join(import_os5.default.homedir(), ".zshrc") };
-  if (shell.includes("bash")) return { name: "bash", rcFile: import_path9.default.join(import_os5.default.homedir(), ".bashrc") };
+  if (shell.includes("zsh")) return { name: "zsh", rcFile: import_path10.default.join(import_os5.default.homedir(), ".zshrc") };
+  if (shell.includes("bash")) return { name: "bash", rcFile: import_path10.default.join(import_os5.default.homedir(), ".bashrc") };
   if (shell.includes("fish")) {
-    const confDir = import_path9.default.join(import_os5.default.homedir(), ".config", "fish", "conf.d");
-    return { name: "fish", rcFile: import_path9.default.join(confDir, "workscribe.fish") };
+    const confDir = import_path10.default.join(import_os5.default.homedir(), ".config", "fish", "conf.d");
+    return { name: "fish", rcFile: import_path10.default.join(confDir, "workscribe.fish") };
   }
   return null;
 }
@@ -1812,19 +2146,19 @@ function registerInit(program2) {
     log.plain(import_chalk2.default.bold("\n  Workscribe \u2014 Developer Work Journal\n"));
     step(1, TOTAL_STEPS, "Creating data directories");
     for (const dir of REQUIRED_DIRS) {
-      if (!import_fs13.default.existsSync(dir)) {
-        import_fs13.default.mkdirSync(dir, { recursive: true, mode: 448 });
+      if (!import_fs14.default.existsSync(dir)) {
+        import_fs14.default.mkdirSync(dir, { recursive: true, mode: 448 });
         log.success(`Created ${dir}`);
       } else {
         try {
-          import_fs13.default.chmodSync(dir, 448);
+          import_fs14.default.chmodSync(dir, 448);
         } catch {
         }
         log.info(`${dir} already exists`);
       }
     }
-    if (!import_fs13.default.existsSync(PROFILES_DIR)) {
-      import_fs13.default.mkdirSync(PROFILES_DIR, { recursive: true, mode: 448 });
+    if (!import_fs14.default.existsSync(PROFILES_DIR)) {
+      import_fs14.default.mkdirSync(PROFILES_DIR, { recursive: true, mode: 448 });
     }
     step(2, TOTAL_STEPS, "Initialising database");
     getDb();
@@ -1837,16 +2171,18 @@ function registerInit(program2) {
         `  Manually add the hook from: ${import_chalk2.default.cyan("shell/hook.zsh")}, ${import_chalk2.default.cyan("shell/hook.bash")}, or ${import_chalk2.default.cyan("shell/hook.fish")}`
       );
     } else {
-      const hookFile = import_path9.default.join(__dirname, "..", "shell", `hook.${shell.name}`);
-      if (!import_fs13.default.existsSync(hookFile)) {
+      const hookFile = import_path10.default.join(__dirname, "..", "shell", `hook.${shell.name}`);
+      if (!import_fs14.default.existsSync(hookFile)) {
         log.warn(`Hook template not found at ${hookFile}`);
       } else {
-        const hookContent = import_fs13.default.readFileSync(hookFile, "utf-8");
+        const hookContent = import_fs14.default.readFileSync(hookFile, "utf-8");
+        const binaryPath = resolveWorkscribeBinary();
+        const hookWithPath = binaryPath ? injectBinaryPath(hookContent, binaryPath) : hookContent;
         if (shell.name === "fish") {
-          const confDir = import_path9.default.dirname(shell.rcFile);
-          if (!import_fs13.default.existsSync(confDir)) import_fs13.default.mkdirSync(confDir, { recursive: true });
+          const confDir = import_path10.default.dirname(shell.rcFile);
+          if (!import_fs14.default.existsSync(confDir)) import_fs14.default.mkdirSync(confDir, { recursive: true });
         }
-        if (!import_fs13.default.existsSync(shell.rcFile)) import_fs13.default.writeFileSync(shell.rcFile, "");
+        if (!import_fs14.default.existsSync(shell.rcFile)) import_fs14.default.writeFileSync(shell.rcFile, "");
         if (!isHookInstalled(shell.rcFile)) {
           log.plain("");
           log.plain(import_chalk2.default.dim("  Workscribe adds a lightweight hook to your shell that captures each"));
@@ -1854,9 +2190,9 @@ function registerInit(program2) {
           log.plain(import_chalk2.default.dim("  It runs in the background and adds no latency to your terminal."));
           log.plain(import_chalk2.default.dim("  Credentials and secrets are redacted before anything is stored."));
           log.plain("");
-          installHook(shell.rcFile, hookContent);
+          installHook(shell.rcFile, hookWithPath);
           log.success(`Shell hook installed in ${shell.rcFile}`);
-        } else if (isHookOutdated(shell.rcFile, hookContent)) {
+        } else if (isHookOutdated(shell.rcFile, hookWithPath)) {
           const { update } = await (0, import_prompts.default)({
             type: "confirm",
             name: "update",
@@ -1864,7 +2200,7 @@ function registerInit(program2) {
             initial: true
           });
           if (update) {
-            updateHook(shell.rcFile, hookContent);
+            updateHook(shell.rcFile, hookWithPath);
             log.success(`Shell hook updated in ${shell.rcFile}`);
           } else {
             log.info("Shell hook update skipped");
@@ -2020,7 +2356,7 @@ function registerInit(program2) {
         }
       }
     }
-    if (!import_fs13.default.existsSync(CONFIG_PATH)) {
+    if (!import_fs14.default.existsSync(CONFIG_PATH)) {
       writeConfig(config);
     }
     log.plain("");
@@ -2056,7 +2392,7 @@ function registerInit(program2) {
 }
 
 // src/cli/status.ts
-var import_fs14 = __toESM(require("fs"));
+var import_fs15 = __toESM(require("fs"));
 var import_chalk3 = __toESM(require("chalk"));
 function registerStatus(program2) {
   program2.command("status").description("Show capture status and event counts").action(() => {
@@ -2064,7 +2400,7 @@ function registerStatus(program2) {
     const total = getEventCount();
     const todayEvents = getEventsForDate(todayDate());
     const last = getLastEvent();
-    const isPaused = import_fs14.default.existsSync(PAUSE_FLAG_PATH);
+    const isPaused = import_fs15.default.existsSync(PAUSE_FLAG_PATH);
     log.plain("");
     log.plain(import_chalk3.default.bold("  Workscribe Status"));
     log.plain("");
@@ -2087,6 +2423,13 @@ function registerStatus(program2) {
     log.plain(
       `  Profiles     ${activeProfiles.length > 0 ? import_chalk3.default.cyan(activeProfiles.join(", ")) : import_chalk3.default.dim("none")}`
     );
+    const pendingAlerts = getPendingAlerts();
+    if (pendingAlerts.length > 0) {
+      log.plain("");
+      log.plain(
+        `  ${import_chalk3.default.yellow("!")}  ${import_chalk3.default.yellow(String(pendingAlerts.length))} pending security alert${pendingAlerts.length === 1 ? "" : "s"}` + import_chalk3.default.dim("  (run: workscribe alerts)")
+      );
+    }
     const { total: weekTotal, otherCount } = getRecentOtherRate(7);
     if (weekTotal > 0) {
       const otherPct = Math.round(otherCount / weekTotal * 100);
@@ -2180,13 +2523,16 @@ function registerEvents(program2) {
 var import_chalk5 = __toESM(require("chalk"));
 
 // src/sessions/grouper.ts
+var LONG_RUNNING_THRESHOLD_MS = 5 * 60 * 1e3;
 function splitByIdleGap(events, idleMs) {
   if (events.length === 0) return [];
   const groups = [[events[0]]];
   for (let i = 1; i < events.length; i++) {
     const prev = new Date(events[i - 1].captured_at).getTime();
-    const curr = new Date(events[i].captured_at).getTime();
-    if (curr - prev >= idleMs) {
+    const currCompleted = new Date(events[i].captured_at).getTime();
+    const currDuration = events[i].duration_ms ?? 0;
+    const currEffective = currDuration >= LONG_RUNNING_THRESHOLD_MS ? currCompleted - currDuration : currCompleted;
+    if (currEffective - prev >= idleMs) {
       groups.push([events[i]]);
     } else {
       groups[groups.length - 1].push(events[i]);
@@ -2194,13 +2540,17 @@ function splitByIdleGap(events, idleMs) {
   }
   return groups;
 }
-function splitByRepo(events) {
+var REPO_SWITCH_GAP_MS = 10 * 60 * 1e3;
+function splitByRepo(events, gapMs = 0) {
   if (events.length === 0) return [];
   const groups = [[events[0]]];
   for (let i = 1; i < events.length; i++) {
     const prevRepo = events[i - 1].repo_name;
     const currRepo = events[i].repo_name;
-    if (currRepo !== prevRepo) {
+    const prevTime = new Date(events[i - 1].captured_at).getTime();
+    const currTime = new Date(events[i].captured_at).getTime();
+    const gap = currTime - prevTime;
+    if (currRepo !== prevRepo && gap >= gapMs) {
       groups.push([events[i]]);
     } else {
       groups[groups.length - 1].push(events[i]);
@@ -2245,7 +2595,7 @@ function buildSessions(date, events, savedSummaries = /* @__PURE__ */ new Map())
   const timeGroups = splitByIdleGap(events, idleMs);
   for (const group of timeGroups) {
     if (group.length === 0) continue;
-    const repoGroups = splitByRepo(group);
+    const repoGroups = splitByRepo(group, REPO_SWITCH_GAP_MS);
     for (const repoGroup of repoGroups) {
       if (repoGroup.length === 0) continue;
       const first = repoGroup[0];
@@ -2324,9 +2674,9 @@ function registerSessions(program2) {
 
 // src/cli/summary.ts
 var import_chalk6 = __toESM(require("chalk"));
-var import_fs15 = __toESM(require("fs"));
+var import_fs16 = __toESM(require("fs"));
 var import_os6 = __toESM(require("os"));
-var import_path10 = __toESM(require("path"));
+var import_path11 = __toESM(require("path"));
 
 // src/integrations/webhook.ts
 async function postToWebhook(url, text) {
@@ -2431,9 +2781,9 @@ function registerSummary(program2) {
         return;
       }
       const cacheKey = isoWeekKey(today);
-      const cacheFile = import_path10.default.join(WEEKLY_CACHE_DIR, `${cacheKey}.md`);
-      if (!opts.fresh && import_fs15.default.existsSync(cacheFile)) {
-        const cached = import_fs15.default.readFileSync(cacheFile, "utf-8");
+      const cacheFile = import_path11.default.join(WEEKLY_CACHE_DIR, `${cacheKey}.md`);
+      if (!opts.fresh && import_fs16.default.existsSync(cacheFile)) {
+        const cached = import_fs16.default.readFileSync(cacheFile, "utf-8");
         log.plain("");
         log.plain(cached);
         log.plain("");
@@ -2449,8 +2799,8 @@ function registerSummary(program2) {
         log.plain("");
         log.plain(summary);
         log.plain("");
-        import_fs15.default.mkdirSync(WEEKLY_CACHE_DIR, { recursive: true });
-        import_fs15.default.writeFileSync(cacheFile, summary, { encoding: "utf-8", mode: 384 });
+        import_fs16.default.mkdirSync(WEEKLY_CACHE_DIR, { recursive: true });
+        import_fs16.default.writeFileSync(cacheFile, summary, { encoding: "utf-8", mode: 384 });
         await handleWebhook(opts, config, summary);
       } catch (error) {
         log.error(`Weekly summary failed [${config.ai.provider}]: ${error.message}`);
@@ -2568,8 +2918,8 @@ ${bullets.trim()}`;
 }
 
 // src/cli/export.ts
-var import_fs16 = __toESM(require("fs"));
-var import_path11 = __toESM(require("path"));
+var import_fs17 = __toESM(require("fs"));
+var import_path12 = __toESM(require("path"));
 function eventRowToPayload2(row) {
   let metadata = {};
   try {
@@ -2625,9 +2975,9 @@ function registerExport(program2) {
     const payload = { date, sessions: sessionPayloads };
     log.info(`Generating summary via ${config.ai.provider}\u2026`);
     const summary = await provider.summarize(payload);
-    const outputPath = opts.output ?? import_path11.default.join(EXPORTS_DIR, `workscribe-${date}.md`);
-    if (!import_fs16.default.existsSync(EXPORTS_DIR)) import_fs16.default.mkdirSync(EXPORTS_DIR, { recursive: true, mode: 448 });
-    import_fs16.default.writeFileSync(outputPath, `# Work Summary \u2014 ${date}
+    const outputPath = opts.output ?? import_path12.default.join(EXPORTS_DIR, `workscribe-${date}.md`);
+    if (!import_fs17.default.existsSync(EXPORTS_DIR)) import_fs17.default.mkdirSync(EXPORTS_DIR, { recursive: true, mode: 448 });
+    import_fs17.default.writeFileSync(outputPath, `# Work Summary \u2014 ${date}
 
 ${summary}
 `, { encoding: "utf-8", mode: 384 });
@@ -2699,22 +3049,22 @@ function printConfig(obj, indent) {
 }
 
 // src/cli/pause.ts
-var import_fs17 = __toESM(require("fs"));
+var import_fs18 = __toESM(require("fs"));
 function registerPause(program2) {
   program2.command("pause").description("Pause capture temporarily").action(() => {
-    if (import_fs17.default.existsSync(PAUSE_FLAG_PATH)) {
+    if (import_fs18.default.existsSync(PAUSE_FLAG_PATH)) {
       log.info("Capture is already paused. Run workscribe resume to restart.");
       return;
     }
-    import_fs17.default.writeFileSync(PAUSE_FLAG_PATH, "", { mode: 384 });
+    import_fs18.default.writeFileSync(PAUSE_FLAG_PATH, "", { mode: 384 });
     log.success("Capture paused. Run workscribe resume to restart.");
   });
   program2.command("resume").description("Resume capture after a pause").action(() => {
-    if (!import_fs17.default.existsSync(PAUSE_FLAG_PATH)) {
+    if (!import_fs18.default.existsSync(PAUSE_FLAG_PATH)) {
       log.info("Capture is not paused.");
       return;
     }
-    import_fs17.default.rmSync(PAUSE_FLAG_PATH);
+    import_fs18.default.rmSync(PAUSE_FLAG_PATH);
     log.success("Capture resumed.");
   });
 }
@@ -2799,19 +3149,19 @@ function registerClear(program2) {
 }
 
 // src/cli/uninstall.ts
-var import_fs18 = __toESM(require("fs"));
-var import_path12 = __toESM(require("path"));
+var import_fs19 = __toESM(require("fs"));
+var import_path13 = __toESM(require("path"));
 var import_os7 = __toESM(require("os"));
 var import_prompts3 = __toESM(require("prompts"));
 var import_chalk9 = __toESM(require("chalk"));
 function detectShellRcFiles() {
   const candidates = [
-    { name: "zsh", rcFile: import_path12.default.join(import_os7.default.homedir(), ".zshrc") },
-    { name: "bash", rcFile: import_path12.default.join(import_os7.default.homedir(), ".bashrc") },
-    { name: "bash", rcFile: import_path12.default.join(import_os7.default.homedir(), ".bash_profile") },
-    { name: "fish", rcFile: import_path12.default.join(import_os7.default.homedir(), ".config", "fish", "conf.d", "workscribe.fish") }
+    { name: "zsh", rcFile: import_path13.default.join(import_os7.default.homedir(), ".zshrc") },
+    { name: "bash", rcFile: import_path13.default.join(import_os7.default.homedir(), ".bashrc") },
+    { name: "bash", rcFile: import_path13.default.join(import_os7.default.homedir(), ".bash_profile") },
+    { name: "fish", rcFile: import_path13.default.join(import_os7.default.homedir(), ".config", "fish", "conf.d", "workscribe.fish") }
   ];
-  return candidates.filter((candidate) => import_fs18.default.existsSync(candidate.rcFile) && isHookInstalled(candidate.rcFile));
+  return candidates.filter((candidate) => import_fs19.default.existsSync(candidate.rcFile) && isHookInstalled(candidate.rcFile));
 }
 function registerUninstall(program2) {
   program2.command("uninstall").description("Remove shell hooks and optionally delete all Workscribe data").option("--hooks-only", "remove shell hooks only, skip data deletion prompt (used by npm preuninstall)").action(async (opts) => {
@@ -2822,7 +3172,7 @@ function registerUninstall(program2) {
     } else {
       for (const { name, rcFile } of hooked) {
         if (name === "fish") {
-          import_fs18.default.unlinkSync(rcFile);
+          import_fs19.default.unlinkSync(rcFile);
           log.success(`Shell hook removed: ${rcFile}`);
           log.plain(`  ${import_chalk9.default.dim("Restart your terminal to take effect")}`);
         } else {
@@ -2836,7 +3186,7 @@ function registerUninstall(program2) {
       }
     }
     if (opts.hooksOnly) return;
-    const existingDirs = [...new Set(REQUIRED_DIRS)].filter((dir) => import_fs18.default.existsSync(dir));
+    const existingDirs = [...new Set(REQUIRED_DIRS)].filter((dir) => import_fs19.default.existsSync(dir));
     if (existingDirs.length > 0) {
       log.plain("");
       const { deleteData } = await (0, import_prompts3.default)({
@@ -2847,7 +3197,7 @@ function registerUninstall(program2) {
       });
       if (deleteData) {
         for (const dir of existingDirs) {
-          import_fs18.default.rmSync(dir, { recursive: true, force: true });
+          import_fs19.default.rmSync(dir, { recursive: true, force: true });
           log.success(`Deleted ${dir}`);
         }
       } else {
@@ -2861,8 +3211,8 @@ function registerUninstall(program2) {
 }
 
 // src/cli/profile.ts
-var import_fs19 = __toESM(require("fs"));
-var import_path13 = __toESM(require("path"));
+var import_fs20 = __toESM(require("fs"));
+var import_path14 = __toESM(require("path"));
 var import_chalk10 = __toESM(require("chalk"));
 var MIN_SUGGEST_COUNT = 5;
 function registerProfile(program2) {
@@ -2908,7 +3258,7 @@ function registerProfile(program2) {
       log.plain(import_chalk10.default.dim("  " + "\u2500".repeat(60)));
       for (const entry of entries) {
         const badge = activeNames.has(entry.name) ? import_chalk10.default.green(" [active]") : "";
-        const installed = import_fs19.default.existsSync(import_path13.default.join(PROFILES_DIR, `${entry.name}.json`)) ? import_chalk10.default.dim(" installed") : "";
+        const installed = import_fs20.default.existsSync(import_path14.default.join(PROFILES_DIR, `${entry.name}.json`)) ? import_chalk10.default.dim(" installed") : "";
         log.plain(`  ${import_chalk10.default.cyan(entry.name.padEnd(18))} ${entry.displayName.padEnd(28)}${badge}${installed}`);
         if (entry.description) log.plain(`  ${import_chalk10.default.dim(" ".repeat(18) + entry.description)}`);
       }
@@ -2944,8 +3294,8 @@ function registerProfile(program2) {
         continue;
       }
       activeNames.delete(name);
-      const cachePath = import_path13.default.join(PROFILES_DIR, `${name}.json`);
-      if (import_fs19.default.existsSync(cachePath)) import_fs19.default.unlinkSync(cachePath);
+      const cachePath = import_path14.default.join(PROFILES_DIR, `${name}.json`);
+      if (import_fs20.default.existsSync(cachePath)) import_fs20.default.unlinkSync(cachePath);
       log.success(`Profile "${name}" removed`);
     }
     config.capture.profiles = [...activeNames];
@@ -3086,7 +3436,9 @@ function registerNote(program2) {
       repo_name: repoName,
       branch,
       category: "note",
-      metadata: JSON.stringify({ text })
+      metadata: JSON.stringify({ text }),
+      source: null,
+      file_path: null
     });
     log.success(`Note saved${repoName ? ` to ${repoName}` : ""}`);
   });
@@ -3094,8 +3446,8 @@ function registerNote(program2) {
 
 // src/cli/week.ts
 var import_chalk11 = __toESM(require("chalk"));
-var import_fs20 = __toESM(require("fs"));
-var import_path14 = __toESM(require("path"));
+var import_fs21 = __toESM(require("fs"));
+var import_path15 = __toESM(require("path"));
 var import_os8 = __toESM(require("os"));
 function eventRowToPayload3(row) {
   let metadata = {};
@@ -3168,9 +3520,9 @@ function registerWeek(program2) {
       return;
     }
     const cacheKey = isoWeekKey(today);
-    const cacheFile = import_path14.default.join(WEEKLY_CACHE_DIR, `${cacheKey}.md`);
-    if (!opts.fresh && import_fs20.default.existsSync(cacheFile)) {
-      const cached = import_fs20.default.readFileSync(cacheFile, "utf-8");
+    const cacheFile = import_path15.default.join(WEEKLY_CACHE_DIR, `${cacheKey}.md`);
+    if (!opts.fresh && import_fs21.default.existsSync(cacheFile)) {
+      const cached = import_fs21.default.readFileSync(cacheFile, "utf-8");
       log.plain("");
       log.plain(cached);
       log.plain("");
@@ -3186,8 +3538,8 @@ function registerWeek(program2) {
       log.plain("");
       log.plain(summary);
       log.plain("");
-      import_fs20.default.mkdirSync(WEEKLY_CACHE_DIR, { recursive: true });
-      import_fs20.default.writeFileSync(cacheFile, summary, { encoding: "utf-8", mode: 384 });
+      import_fs21.default.mkdirSync(WEEKLY_CACHE_DIR, { recursive: true });
+      import_fs21.default.writeFileSync(cacheFile, summary, { encoding: "utf-8", mode: 384 });
       await postSummary(opts, config, summary);
     } catch (error) {
       log.error(`Weekly digest failed [${config.ai.provider}]: ${error.message}`);
@@ -3197,15 +3549,15 @@ function registerWeek(program2) {
 }
 
 // src/cli/bug-report.ts
-var import_fs21 = __toESM(require("fs"));
+var import_fs22 = __toESM(require("fs"));
 var import_os9 = __toESM(require("os"));
-var import_path15 = __toESM(require("path"));
+var import_path16 = __toESM(require("path"));
 var import_chalk12 = __toESM(require("chalk"));
 var GITHUB_ISSUES_URL = "https://github.com/workscribe/workscribe/issues/new";
 var DEBUG_LOG_TAIL_LINES = 100;
 function tailFile(filePath, lines) {
-  if (!import_fs21.default.existsSync(filePath)) return "(no debug log found \u2014 set WORKSCRIBE_DEBUG=1 to enable)";
-  const content = import_fs21.default.readFileSync(filePath, "utf-8");
+  if (!import_fs22.default.existsSync(filePath)) return "(no debug log found \u2014 set WORKSCRIBE_DEBUG=1 to enable)";
+  const content = import_fs22.default.readFileSync(filePath, "utf-8");
   const allLines = content.split("\n");
   return allLines.slice(-lines).join("\n");
 }
@@ -3223,9 +3575,9 @@ function redactConfig() {
 function registerBugReport(program2) {
   program2.command("bug-report").description("Generate a diagnostic report for filing a bug").action(() => {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const reportPath = import_path15.default.join(WORKSCRIBE_DIR, `bug-report-${timestamp}.txt`);
+    const reportPath = import_path16.default.join(WORKSCRIBE_DIR, `bug-report-${timestamp}.txt`);
     const systemInfo = [
-      `Workscribe version : ${"1.12.0"}`,
+      `Workscribe version : ${"1.13.0"}`,
       `Node.js version    : ${process.version}`,
       `Platform           : ${process.platform}`,
       `Architecture       : ${process.arch}`,
@@ -3247,17 +3599,17 @@ function registerBugReport(program2) {
       tailFile(DEBUG_LOG_PATH, DEBUG_LOG_TAIL_LINES)
     ].join("\n");
     try {
-      if (!import_fs21.default.existsSync(WORKSCRIBE_DIR)) {
-        import_fs21.default.mkdirSync(WORKSCRIBE_DIR, { recursive: true, mode: 448 });
+      if (!import_fs22.default.existsSync(WORKSCRIBE_DIR)) {
+        import_fs22.default.mkdirSync(WORKSCRIBE_DIR, { recursive: true, mode: 448 });
       }
-      import_fs21.default.writeFileSync(reportPath, report, { mode: 384 });
+      import_fs22.default.writeFileSync(reportPath, report, { mode: 384 });
     } catch (error) {
       log.error(`Could not write report: ${error.message}`);
       process.exit(1);
     }
     const params = new URLSearchParams({
-      title: `Bug report \u2014 workscribe ${"1.12.0"}`,
-      body: `<!-- Attach ${import_path15.default.basename(reportPath)} or paste the relevant sections below -->
+      title: `Bug report \u2014 workscribe ${"1.13.0"}`,
+      body: `<!-- Attach ${import_path16.default.basename(reportPath)} or paste the relevant sections below -->
 
 **Describe the issue:**
 
@@ -3275,19 +3627,119 @@ function registerBugReport(program2) {
   });
 }
 
+// src/cli/alerts.ts
+var import_chalk13 = __toESM(require("chalk"));
+function formatTimestamp(ms) {
+  return new Date(ms).toLocaleString([], {
+    month: "short",
+    day: "numeric",
+    hour: "2-digit",
+    minute: "2-digit"
+  });
+}
+function registerAlerts(program2) {
+  const alertsCmd = program2.command("alerts").description("Show and manage security alerts from AI session monitoring").option("--check", "Print warning if alerts are pending (used by shell hooks)").action((opts) => {
+    if (opts.check) {
+      if (hasPendingAlerts()) {
+        log.plain(
+          import_chalk13.default.yellow("  [workscribe] Possible credentials detected in an AI session.") + import_chalk13.default.dim("  Run workscribe alerts for details.")
+        );
+      }
+      return;
+    }
+    const alerts = getPendingAlerts();
+    if (alerts.length === 0) {
+      log.plain("");
+      log.plain("  No pending security alerts.");
+      log.plain("");
+      return;
+    }
+    log.plain("");
+    log.plain(import_chalk13.default.bold("  Security Alerts") + import_chalk13.default.dim(`  (${alerts.length} pending)`));
+    log.plain("");
+    for (const alert of alerts) {
+      log.plain(`  ${import_chalk13.default.yellow("!")}  ${import_chalk13.default.dim(formatTimestamp(alert.created_at))}  ${import_chalk13.default.cyan(alert.tool)}`);
+      log.plain(`     ${alert.context}`);
+      if (alert.session_id) log.plain(`     ${import_chalk13.default.dim("Session: " + alert.session_id)}`);
+      log.plain("");
+    }
+    log.plain(import_chalk13.default.dim("  Run workscribe alerts clear  to dismiss all alerts"));
+    log.plain("");
+  });
+  alertsCmd.command("clear").description("Dismiss all pending security alerts").action(() => {
+    const count = clearAlerts();
+    if (count === 0) {
+      log.plain("  No pending alerts to clear.");
+    } else {
+      log.plain(`  ${count} alert${count === 1 ? "" : "s"} cleared.`);
+    }
+  });
+}
+
+// src/cli/context.ts
+var import_path17 = __toESM(require("path"));
+var import_chalk14 = __toESM(require("chalk"));
+function printSessionContext(session, heading) {
+  const ago = timeAgo(session.started_at);
+  const branch = getSessionBranch(session.id);
+  const durationMinutes = (new Date(session.ended_at).getTime() - new Date(session.started_at).getTime()) / 6e4;
+  log.plain("");
+  log.plain(`  ${import_chalk14.default.bold(heading)}: ${import_chalk14.default.cyan(ago)}`);
+  log.plain("");
+  log.plain(`  Date     ${session.date}`);
+  log.plain(`  Duration ${formatDuration(durationMinutes)}`);
+  if (branch) log.plain(`  Branch   ${import_chalk14.default.dim(branch)}`);
+  log.plain(`  Events   ${session.event_count}`);
+  if (session.summary) {
+    log.plain("");
+    for (const line of session.summary.split("\n")) {
+      log.plain(`  ${line}`);
+    }
+  } else {
+    log.plain("");
+    log.plain(import_chalk14.default.dim(`  No summary \u2014 run: workscribe summary ${session.date}`));
+  }
+  log.plain("");
+}
+function registerContext(program2) {
+  program2.command("context").description("Show the last session for the current repo").option("--file <path>", "narrow to last session that touched this file").action((opts) => {
+    if (opts.file) {
+      const normalizedFile = import_path17.default.normalize(opts.file);
+      const session = getLastSessionTouchingFile(normalizedFile);
+      if (!session) {
+        log.plain(`  No sessions found touching ${normalizedFile}`);
+        return;
+      }
+      printSessionContext(session, `Last session touching ${import_path17.default.basename(normalizedFile)}`);
+      return;
+    }
+    const { repoName } = getGitContext(process.cwd());
+    if (!repoName) {
+      log.plain("  Not in a git repository. Run workscribe context from a project directory.");
+      return;
+    }
+    const sessions = getRecentSessionsByRepo(repoName, 1);
+    if (sessions.length === 0) {
+      log.plain(`  No sessions found for ${repoName}`);
+      return;
+    }
+    printSessionContext(sessions[0], `Last session on ${repoName}`);
+  });
+}
+
 // src/utils/update-check.ts
-var import_fs22 = __toESM(require("fs"));
+var import_fs23 = __toESM(require("fs"));
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function readCache() {
   try {
-    return JSON.parse(import_fs22.default.readFileSync(UPDATE_CHECK_PATH, "utf-8"));
+    return JSON.parse(import_fs23.default.readFileSync(UPDATE_CHECK_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeCache(cache) {
   try {
-    import_fs22.default.writeFileSync(UPDATE_CHECK_PATH, JSON.stringify(cache), { mode: 384 });
+    import_fs23.default.writeFileSync(UPDATE_CHECK_PATH, JSON.stringify(cache), { mode: 384 });
   } catch {
   }
 }
@@ -3300,7 +3752,7 @@ function isNewer(latest, current) {
   return latestPatch > currentPatch;
 }
 function checkForUpdate() {
-  const current = "1.12.0";
+  const current = "1.13.0";
   const cache = readCache();
   if (cache && isNewer(cache.latestVersion, current)) {
     process.stderr.write(
@@ -3325,7 +3777,7 @@ function checkForUpdate() {
 assertNodeVersion(process.versions.node);
 checkForUpdate();
 var program = new import_commander.Command();
-program.name("workscribe").description("Automatic developer work journal").version("1.12.0");
+program.name("workscribe").description("Automatic developer work journal").version("1.13.0");
 registerCapture(program);
 registerHook(program);
 registerInit(program);
@@ -3344,5 +3796,7 @@ registerNote(program);
 registerWeek(program);
 registerBugReport(program);
 registerCompletions(program);
+registerAlerts(program);
+registerContext(program);
 program.parse();
 //# sourceMappingURL=index.js.map