codemem 0.47.0-beta.2 → 0.47.0-beta.4

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { ACCOUNT_CONNECTION_MIGRATION_STATEMENTS, ACCOUNT_UNLINK_MIGRATION_STATEMENTS, AUTH_LINK_AUTHORITY_CUTOVER_SQL, ContextOnlyReplayError, CoordinatorAccountLinkError, DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, DeviceIdentityError, EXTRACTION_BENCHMARK_QUALITY_WEIGHTS, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, ObserverOutputError, ObserverOutputTransportError, OwnerProfileEnrollmentError, PROMPT_TRANSPORT_PROTOCOL_RANGE, REF_BACKFILL_JOB, RawEventIngestValidationError, RawEventSweeper, RefBackfillRunner, RemoteCoordinatorRequestError, SCOPE_BACKFILL_JOB, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, ScopeBackfillRunner, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, TRUSTED_HOOK_MAPPER_OPTIONS, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, applyDistillRule, arePromptTransportProtocolRangesCompatible, atomicReplaceConfigFile, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildTieredObserverSelection, buildViewerIdentityTarget, classifyPromptTransportFailure, clonePromptPackAttempt, collectOperationalStatus, compareMemoryRoleReports, connect, connectReadOnly, coordinatorAuthControllerReviewAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorGrantIdentityGroupAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorQualifyOwnerAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewInviteAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeDeviceAction, coordinatorRevokeScopeMembershipAction, coordinatorUpdateScopeAction, createBetterSqliteCoordinatorApp, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, describePiObserverStatus, detectInstallKind, draftDistillRule, enrollOwnerProfile, ensureDeviceIdentity, ensureSchemaBootstrapped, estimateExtractionModelCost, expandUserPath, exportMemories, extractApplyPatchPaths, extractionReplayObserverIdentity, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, formatHostPort, getAttributionDiagnostics, getCodememConfigPath, getExtractionBenchmarkProfile, getExtractionModelPricing, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryArtifactReport, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getUpdateStatus, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingScopeBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, importPiSessions, ingestRawEvents, initDatabase, isAutomaticRecallMeasurement, isCoordinatorControllerAttestationReference, isEmbeddingDisabled, isExplicitUpdateInstallEligible, isReleaseVersionForChannel, judgeDistillReport, linkCoordinatorAccount, listMaintenanceJobs, listPerPeerScopeSyncState, listRetentionScopeIds, loadObserverConfig, loadPublicKey, loadRuntimeSigningPublicKey, loadSqliteVec, mdnsEnabled, mutateCodememConfigFile, normalizeCoordinatorAccountLinkOrigin, normalizePromptTransportProtocolRange, observerBaseUrlForProviderOverride, planReplicationOpsAgePrune, probeCodememViewerLiveness, probeCodememViewerLiveness as probeCodememViewerLiveness$1, probeRequiredNativeRuntime, projectMatchesFilter, promptPackArtifactFingerprint, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readAccountLinkDevice, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorAccountLinkStatus, readCoordinatorOwnerReviewLocalEvidence, readCoordinatorSyncConfig, readImportPayload, recordAutomaticRecall, recordPromptPackArtifacts, recordPromptPackTerminal, recordRetrievalSurface, renderUnifiedDiff, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveComparablePath, resolveDbPath, resolveHookProject, resolveKeyPaths, resolvePiAgentDir, resolvePiObserverConfig, resolveProject, resolveProjectRoot, resolveRetrievalSession, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, scoreExtractionBenchmarkOutput, searchPiSessions, setPeerProjectFilter, syncPassPreflight, tryUpdateRetrievalDelivery, updatePeerAddresses, upgradeCoordinatorAccountSchemaFile, upgradeCoordinatorAuthSchemaFile, vacuumDatabase, viewerUrl, writeCodememConfigFile } from "@codemem/core";
+import { ACCOUNT_CONNECTION_MIGRATION_STATEMENTS, ACCOUNT_UNLINK_MIGRATION_STATEMENTS, AUTH_LINK_AUTHORITY_CUTOVER_SQL, ContextOnlyReplayError, CoordinatorAccountLinkError, DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, DeviceIdentityError, EXTRACTION_BENCHMARK_QUALITY_WEIGHTS, FILE_CONTEXT_TRANSPORT_MAX_BYTES, FILE_CONTEXT_TRANSPORT_PROFILE, LEGACY_OWNER_RESOLUTION_SCHEMA_STATEMENTS, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, ObserverOutputError, ObserverOutputTransportError, OwnerProfileEnrollmentError, PROMPT_TRANSPORT_PROTOCOL_RANGE, REF_BACKFILL_JOB, RawEventIngestValidationError, RawEventSweeper, RefBackfillRunner, RemoteCoordinatorRequestError, SCOPE_BACKFILL_JOB, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, ScopeBackfillRunner, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, TRUSTED_HOOK_MAPPER_OPTIONS, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, applyDistillRule, arePromptTransportProtocolRangesCompatible, atomicReplaceConfigFile, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildTieredObserverSelection, buildViewerIdentityTarget, classifyPromptTransportFailure, clonePromptPackAttempt, collectOperationalStatus, compareMemoryRoleReports, connect, connectReadOnly, coordinatorAuthControllerReviewAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorGrantIdentityGroupAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorQualifyOwnerAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewInviteAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeDeviceAction, coordinatorRevokeScopeMembershipAction, coordinatorUpdateScopeAction, createBetterSqliteCoordinatorApp, createFileContextRunner, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, describePiObserverStatus, detectInstallKind, dispatchFileContextTransport, draftDistillRule, enrollOwnerProfile, ensureDeviceIdentity, ensureSchemaBootstrapped, estimateExtractionModelCost, expandUserPath, exportMemories, extractApplyPatchPaths, extractionReplayObserverIdentity, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, formatHostPort, getAttributionDiagnostics, getCodememConfigPath, getExtractionBenchmarkProfile, getExtractionModelPricing, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryArtifactReport, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getUpdateStatus, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingScopeBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, importPiSessions, ingestRawEvents, initDatabase, isAutomaticRecallMeasurement, isCoordinatorControllerAttestationReference, isEmbeddingDisabled, isExplicitUpdateInstallEligible, isReleaseVersionForChannel, judgeDistillReport, linkCoordinatorAccount, listMaintenanceJobs, listPerPeerScopeSyncState, listRetentionScopeIds, loadObserverConfig, loadPublicKey, loadRuntimeSigningPublicKey, loadSqliteVec, mdnsEnabled, mutateCodememConfigFile, normalizeCoordinatorAccountLinkOrigin, normalizePromptTransportProtocolRange, observerBaseUrlForProviderOverride, parseControllerHistoryEvidence, parseFileContextTransportRequest, planReplicationOpsAgePrune, probeCodememViewerLiveness, probeCodememViewerLiveness as probeCodememViewerLiveness$1, probeRequiredNativeRuntime, projectMatchesFilter, promptPackArtifactFingerprint, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readAccountLinkDevice, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorAccountLinkStatus, readCoordinatorOwnerReviewLocalEvidence, readCoordinatorSyncConfig, readImportPayload, recordAutomaticRecall, recordPromptPackArtifacts, recordPromptPackTerminal, renderUnifiedDiff, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveComparablePath, resolveDbPath, resolveHookProject, resolveKeyPaths, resolvePiAgentDir, resolvePiObserverConfig, resolveProject, resolveProjectRoot, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, scoreExtractionBenchmarkOutput, searchPiSessions, setPeerProjectFilter, syncPassPreflight, tryUpdateRetrievalDelivery, updatePeerAddresses, upgradeCoordinatorAccountSchemaFile, upgradeCoordinatorAuthSchemaFile, upgradeCoordinatorOwnerResolutionSchemaFile, vacuumDatabase, viewerUrl, writeCodememConfigFile } from "@codemem/core";
 import { Command, Option } from "commander";
 import omelette from "omelette";
-import { randomInt, randomUUID } from "node:crypto";
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, networkInterfaces } from "node:os";
 import { dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
-import { styleText } from "node:util";
+import { isDeepStrictEqual, styleText } from "node:util";
+import { randomInt, randomUUID } from "node:crypto";
 import * as p from "@clack/prompts";
 import { serve } from "@hono/node-server";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
@@ -79,6 +79,54 @@ function emitJsonError(errorCode, message, exitCode = 1) {
 	process.exitCode = exitCode;
 }
 //#endregion
+//#region src/commands/claude-hook-file-context-transport.ts
+/** Internal packaged-hook transport. Normal CLI invocation keeps its original guards/output. */
+function runClaudeFileContextTransport(payload, opts) {
+	const parsed = parseFileContextTransportRequest(payload);
+	if (!parsed.success) throw new Error("invalid file-context transport request");
+	let request = parsed.data;
+	if ([
+		"1",
+		"true",
+		"yes",
+		"on"
+	].includes(String(process.env.CODEMEM_PLUGIN_IGNORE ?? "").trim().toLowerCase())) return {
+		ok: true,
+		attempt_id: request.attempt_id,
+		request_id: request.request_id,
+		result: { continue: true },
+		delivery_pending: false
+	};
+	const disabled = (value) => [
+		"0",
+		"false",
+		"off"
+	].includes(String(value ?? "").trim().toLowerCase());
+	if (disabled(process.env.CODEMEM_RETRIEVAL_LEDGER)) request = {
+		...request,
+		ledger_enabled: false
+	};
+	if (request.action === "lookup" && disabled(process.env.CODEMEM_FILE_CONTEXT)) {
+		const { relative_path: _path, project: _project, file_mtime_ms: _mtime, ...base } = request;
+		request = {
+			...base,
+			action: "skip",
+			reason: "file_context_disabled"
+		};
+	}
+	const dbPath = resolveDbPath(resolveDbOpt(opts));
+	if (resolve(dbPath) !== resolve(request.db_path) || !isDeepStrictEqual(buildViewerIdentityTarget(), request.identity_target)) throw new Error("file-context target mismatch");
+	const store = new MemoryStore(dbPath);
+	try {
+		if (!store.hasCurrentIdentity()) throw new Error("file-context identity changed");
+		return dispatchFileContextTransport(store, request);
+	} finally {
+		try {
+			store.close();
+		} catch {}
+	}
+}
+//#endregion
 //#region src/commands/claude-hook-plugin-log.ts
 /**
 * Append-only plugin event log used by `claude-hook-inject` and
@@ -130,24 +178,12 @@ function logHookEvent(message) {
 //#endregion
 //#region src/commands/claude-hook-file-context.ts
 var FILE_GATE_MIN_BYTES = 1500;
-var FETCH_LIMIT = 40;
-var DISPLAY_LIMIT = 15;
-var MTIME_FRESH_TOLERANCE_MS = 3e5;
 var SMALL_FILE_BYPASS_PATTERNS = [
 	/\.(json|jsonc|toml|ya?ml)$/i,
 	/\.env(\.|$)/i,
 	/(^|\/)dockerfile(\.|$)/i,
 	/\.config\.(js|ts|mjs|cjs|json)$/i
 ];
-var KIND_ICONS = {
-	decision: "⚖️",
-	bugfix: "🔴",
-	feature: "🟢",
-	refactor: "🔄",
-	discovery: "🔵",
-	change: "✅",
-	exploration: "🔬"
-};
 function emitJson$2(value) {
 	console.log(JSON.stringify(value));
 }
@@ -187,105 +223,6 @@ function statFile(absPath) {
 		return null;
 	}
 }
-function parseJsonArray(value) {
-	if (!value) return [];
-	try {
-		const parsed = JSON.parse(value);
-		if (!Array.isArray(parsed)) return [];
-		return parsed.filter((item) => typeof item === "string");
-	} catch {
-		return [];
-	}
-}
-function normalizePathForCompare(path) {
-	return path.replace(/\\/g, "/");
-}
-function scoreRow(row, normalizedTarget, idx) {
-	const filesModified = parseJsonArray(row.files_modified);
-	const inModified = filesModified.some((f) => normalizePathForCompare(f) === normalizedTarget);
-	let score = 0;
-	if (inModified) score += 2;
-	if (filesModified.length <= 1) score += 2;
-	else if (filesModified.length <= 3) score += 1;
-	return {
-		row,
-		score,
-		idx
-	};
-}
-function scoreAndDedupe(rows, targetPath, limit) {
-	const normalizedTarget = normalizePathForCompare(targetPath);
-	const scored = rows.map((row, idx) => scoreRow(row, normalizedTarget, idx));
-	const bestPerSession = /* @__PURE__ */ new Map();
-	for (const item of scored) {
-		const existing = bestPerSession.get(item.row.session_id);
-		if (!existing || item.score > existing.score || item.score === existing.score && item.idx < existing.idx) bestPerSession.set(item.row.session_id, item);
-	}
-	const deduped = Array.from(bestPerSession.values());
-	deduped.sort((a, b) => b.score - a.score || a.idx - b.idx);
-	return deduped.slice(0, limit).map((s) => s.row);
-}
-function compactTime(timeStr) {
-	return timeStr.toLowerCase().replace(" am", "a").replace(" pm", "p");
-}
-function formatTime(epochMs) {
-	return new Date(epochMs).toLocaleString("en-US", {
-		hour: "numeric",
-		minute: "2-digit",
-		hour12: true
-	});
-}
-function formatDate(epochMs) {
-	return new Date(epochMs).toLocaleString("en-US", {
-		month: "short",
-		day: "numeric",
-		year: "numeric"
-	});
-}
-function formatTimeline(rows, filePath, staleness) {
-	const safePath = filePath.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
-	const enriched = rows.map((row) => ({
-		row,
-		epochMs: Date.parse(row.created_at)
-	})).filter((item) => Number.isFinite(item.epochMs) && item.epochMs > 0);
-	const byDay = /* @__PURE__ */ new Map();
-	for (const item of enriched) {
-		const day = formatDate(item.epochMs);
-		const bucket = byDay.get(day);
-		if (bucket) bucket.push(item);
-		else byDay.set(day, [item]);
-	}
-	const sortedDays = Array.from(byDay.entries()).sort((a, b) => {
-		return Math.min(...a[1].map((i) => i.epochMs)) - Math.min(...b[1].map((i) => i.epochMs));
-	});
-	const ids = rows.map((r) => r.id);
-	const lines = [`This file (${safePath}) has prior codemem observations. The Read result below is unchanged.`, `- Fetch full bodies on demand: memory.get_observations([${ids.join(", ")}]).`];
-	if (staleness) {
-		const driftMinutes = Math.max(1, Math.round((staleness.fileMtimeMs - staleness.newestObservationMs) / 6e4));
-		lines.unshift(`Heads up: this file was modified ~${driftMinutes} min after the most recent observation below. Past entries may be partially stale — verify against the Read result before relying on them.`);
-	}
-	for (const [day, dayItems] of sortedDays) {
-		const chronological = [...dayItems].sort((a, b) => a.epochMs - b.epochMs);
-		lines.push(`### ${day}`);
-		for (const { row, epochMs } of chronological) {
-			const title = (row.title || "Untitled").replace(/[\r\n\t]+/g, " ").replace(/\s+/g, " ").trim().slice(0, 160);
-			const icon = KIND_ICONS[row.kind] ?? "❔";
-			const time = compactTime(formatTime(epochMs));
-			lines.push(`${row.id} ${time} ${icon} (${row.kind}) ${title}`);
-		}
-	}
-	return lines.join("\n");
-}
-function queryByFile(dbPath, relativePath, project, limit) {
-	const store = new MemoryStore(dbPath);
-	try {
-		const opts = { limit };
-		if (project) opts.project = project;
-		return store.findByFile(relativePath, opts);
-	} finally {
-		store.close();
-	}
-}
 function resolveProject$1(payload) {
 	const cwd = typeof payload.cwd === "string" ? payload.cwd : null;
 	return resolveHookProject(cwd, payload.project);
@@ -294,73 +231,45 @@ function sourceSessionId(payload) {
 	const value = payload.session_id;
 	return typeof value === "string" && value.trim() ? value.trim() : null;
 }
-async function buildClaudeFileContext(payload, opts, deps = {}) {
-	if (envTruthy$4(process.env.CODEMEM_PLUGIN_IGNORE)) return continueResult$2();
-	const filePath = extractFilePath(payload);
-	if (!filePath) return continueResult$2();
-	const startedAt = (deps.now ?? (() => /* @__PURE__ */ new Date()))();
-	const attemptId = (deps.createAttemptId ?? randomUUID)();
-	const resolveDb = deps.resolveDb ?? resolveDbPath;
+function fileContextStore(opts, deps) {
 	let resolvedDbPath = null;
 	let activeStore = null;
-	const getStore = () => {
-		resolvedDbPath ??= resolveDb(resolveDbOpt(opts));
-		activeStore ??= (deps.createStore ?? ((dbPath) => new MemoryStore(dbPath)))(resolvedDbPath);
-		return activeStore;
+	const dbPath = () => {
+		resolvedDbPath ??= (deps.resolveDb ?? resolveDbPath)(resolveDbOpt(opts));
+		return resolvedDbPath;
 	};
-	const finish = (result) => {
-		try {
-			activeStore?.close();
-		} catch {}
-		activeStore = null;
-		return result;
-	};
-	const record = (attemptInput) => {
-		if (!envNotDisabled$3(process.env.CODEMEM_RETRIEVAL_LEDGER || "1")) return;
-		try {
-			resolvedDbPath ??= resolveDb(resolveDbOpt(opts));
-			const completedAt = (deps.now ?? (() => /* @__PURE__ */ new Date()))();
-			const ledgerInput = {
-				...attemptInput,
-				attemptId,
-				surface: "file_context",
-				trigger: "automatic",
-				startedAt: startedAt.toISOString(),
-				completedAt: completedAt.toISOString(),
-				latencyMs: Math.max(0, completedAt.getTime() - startedAt.getTime()),
-				recorderVersion: "claude-file-context-v1",
-				source: "claude",
-				streamId: sourceSessionId(payload),
-				sourceSessionId: sourceSessionId(payload),
-				mode: "claude_pre_tool_use_read"
-			};
-			if (deps.recordAttempt) deps.recordAttempt(resolvedDbPath, ledgerInput);
-			else {
-				const store = getStore();
-				recordRetrievalSurface(store.db, {
-					...ledgerInput,
-					sessionId: resolveRetrievalSession(store.db, "claude", ledgerInput.sourceSessionId)
-				});
-			}
-		} catch {}
-	};
-	const updateDelivery = (status) => {
-		if (!envNotDisabled$3(process.env.CODEMEM_RETRIEVAL_LEDGER || "1")) return;
-		try {
-			resolvedDbPath ??= resolveDb(resolveDbOpt(opts));
-			if (deps.updateDelivery) deps.updateDelivery(resolvedDbPath, attemptId, status);
-			else tryUpdateRetrievalDelivery(getStore().db, attemptId, status);
-		} catch {}
-	};
-	if (!envNotDisabled$3(process.env.CODEMEM_FILE_CONTEXT || "1")) {
-		record({
-			retrievalStatus: "skipped",
-			deliveryStatus: "not_attempted",
-			failureCode: "file_context_disabled",
-			failureStage: "configuration"
-		});
-		return finish(continueResult$2());
-	}
+	return {
+		dbPath,
+		getStore: () => {
+			activeStore ??= (deps.createStore ?? ((path) => new MemoryStore(path)))(dbPath());
+			return activeStore;
+		},
+		finish: (result) => {
+			try {
+				activeStore?.close();
+			} catch {}
+			activeStore = null;
+			return result;
+		}
+	};
+}
+function fileContextRunner(payload, store, deps) {
+	const findByFile = deps.queryByFile;
+	const recordAttempt = deps.recordAttempt;
+	const updateDelivery = deps.updateDelivery;
+	return createFileContextRunner({
+		getStore: store.getStore,
+		sourceSessionId: sourceSessionId(payload),
+		ledgerEnabled: () => envNotDisabled$3(process.env.CODEMEM_RETRIEVAL_LEDGER || "1"),
+		now: deps.now,
+		createAttemptId: deps.createAttemptId,
+		log: logHookEvent,
+		...findByFile ? { findByFile: (path, options) => findByFile(store.dbPath(), path, options.project ?? null, options.limit) } : {},
+		...recordAttempt ? { recordAttempt: (input) => recordAttempt(store.dbPath(), input) } : {},
+		...updateDelivery ? { updateDelivery: (attemptId, status) => updateDelivery(store.dbPath(), attemptId, status) } : {}
+	});
+}
+function fileContextPath(filePath, payload) {
 	const cwd = typeof payload.cwd === "string" && payload.cwd.trim() ? payload.cwd : process.cwd();
 	const expandedPath = expandHome$2(filePath);
 	const absolutePath = isAbsolute(expandedPath) ? expandedPath : resolve(cwd, expandedPath);
@@ -368,133 +277,78 @@ async function buildClaudeFileContext(payload, opts, deps = {}) {
 	const escapesCwd = relativePath === ".." || relativePath.startsWith("../") || isAbsolute(relativePath);
 	if (!relativePath || escapesCwd) {
 		logHookEvent(`file_context.skip reason=outside_cwd path=${JSON.stringify(filePath)} cwd=${JSON.stringify(cwd)}`);
-		record({
-			retrievalStatus: "skipped",
-			deliveryStatus: "not_attempted",
-			failureCode: "outside_cwd",
-			failureStage: "path_validation"
-		});
-		return finish(continueResult$2());
+		return null;
 	}
+	return {
+		absolutePath,
+		relativePath
+	};
+}
+async function buildClaudeFileContext(payload, opts, deps = {}) {
+	if (envTruthy$4(process.env.CODEMEM_PLUGIN_IGNORE)) return continueResult$2();
+	const filePath = extractFilePath(payload);
+	if (!filePath) return continueResult$2();
+	const store = fileContextStore(opts, deps);
+	const runner = fileContextRunner(payload, store, deps);
+	if (!envNotDisabled$3(process.env.CODEMEM_FILE_CONTEXT || "1")) return store.finish(runner.skip({ reason: "file_context_disabled" }));
+	const path = fileContextPath(filePath, payload);
+	if (!path) return store.finish(runner.skip({ reason: "outside_cwd" }));
+	const { absolutePath, relativePath } = path;
 	const minBytes = Number.parseInt(process.env.CODEMEM_FILE_CONTEXT_MIN_BYTES ?? `${FILE_GATE_MIN_BYTES}`, 10);
 	const minBytesEffective = Number.isFinite(minBytes) && minBytes >= 0 ? minBytes : FILE_GATE_MIN_BYTES;
 	const stat = (deps.statFile ?? statFile)(absolutePath);
 	if (!stat) {
 		logHookEvent(`file_context.skip reason=stat_failed path=${JSON.stringify(relativePath)}`);
-		record({
-			retrievalStatus: "skipped",
-			deliveryStatus: "not_attempted",
-			failureCode: "stat_failed",
-			failureStage: "file_access",
+		return store.finish(runner.skip({
+			reason: "stat_failed",
 			repositoryPaths: [relativePath]
-		});
-		return finish(continueResult$2());
+		}));
 	}
 	const bypassSizeGate = SMALL_FILE_BYPASS_PATTERNS.some((p) => p.test(relativePath));
 	if (stat.sizeBytes < minBytesEffective && !bypassSizeGate) {
 		logHookEvent(`file_context.skip reason=below_size_gate path=${JSON.stringify(relativePath)} size=${stat.sizeBytes} gate=${minBytesEffective}`);
-		record({
-			retrievalStatus: "skipped",
-			deliveryStatus: "not_attempted",
-			failureCode: "below_size_gate",
-			failureStage: "size_gate",
-			repositoryPaths: [relativePath]
-		});
-		return finish(continueResult$2());
-	}
-	const project = resolveProject$1(payload);
-	const queryFn = deps.queryByFile ?? queryByFile;
-	let rows = [];
-	try {
-		resolvedDbPath ??= resolveDb(resolveDbOpt(opts));
-		rows = deps.queryByFile ? queryFn(resolvedDbPath, relativePath, project, FETCH_LIMIT) : getStore().findByFile(relativePath, {
-			limit: FETCH_LIMIT,
-			...project ? { project } : {}
-		});
-	} catch (err) {
-		logHookEvent(`codemem claude-hook-file-context query failed: ${err instanceof Error ? err.message : String(err)}`);
-		record({
-			retrievalStatus: "failed",
-			deliveryStatus: "not_attempted",
-			failureCode: "query_failed",
-			failureStage: "retrieval",
-			project,
-			filters: project ? { project } : void 0,
+		return store.finish(runner.skip({
+			reason: "below_size_gate",
 			repositoryPaths: [relativePath]
-		});
-		return finish(continueResult$2());
-	}
-	if (rows.length === 0) {
-		logHookEvent(`file_context.skip reason=no_observations path=${JSON.stringify(relativePath)} project=${JSON.stringify(project ?? "")}`);
-		record({
-			retrievalStatus: "no_results",
-			deliveryStatus: "not_attempted",
-			project,
-			filters: project ? { project } : void 0,
-			repositoryPaths: [relativePath]
-		});
-		return finish(continueResult$2());
-	}
-	const top = scoreAndDedupe(rows, relativePath, DISPLAY_LIMIT);
-	if (top.length === 0) {
-		logHookEvent(`file_context.skip reason=no_top_after_dedupe path=${JSON.stringify(relativePath)} candidates=${rows.length}`);
-		record({
-			retrievalStatus: "succeeded",
-			deliveryStatus: "not_attempted",
-			candidateIds: rows.map((row) => row.id),
-			candidateCount: rows.length,
-			selectedIds: [],
-			failureCode: "no_top_after_dedupe",
-			failureStage: "selection",
-			project,
-			filters: project ? { project } : void 0,
-			repositoryPaths: [relativePath]
-		});
-		return finish(continueResult$2());
-	}
-	let staleness = null;
-	if (stat.mtimeMs > 0) {
-		const newestObservationMs = top.reduce((max, row) => {
-			const epoch = Date.parse(row.created_at);
-			return Number.isFinite(epoch) && epoch > max ? epoch : max;
-		}, 0);
-		if (newestObservationMs > 0 && stat.mtimeMs > newestObservationMs + MTIME_FRESH_TOLERANCE_MS) staleness = {
-			fileMtimeMs: stat.mtimeMs,
-			newestObservationMs
-		};
-	}
-	record({
-		retrievalStatus: "succeeded",
-		deliveryStatus: "not_attempted",
-		candidateIds: rows.map((row) => row.id),
-		candidateCount: rows.length,
-		selectedIds: top.map((row) => row.id),
-		project,
-		filters: project ? { project } : void 0,
-		repositoryPaths: [relativePath]
-	});
-	let timeline;
-	try {
-		timeline = formatTimeline(top, relativePath, staleness);
-	} catch {
-		updateDelivery("failed");
-		return finish(continueResult$2());
+		}));
 	}
-	logHookEvent(`file_context.ok path=${JSON.stringify(relativePath)} candidates=${rows.length} surfaced=${top.length} project=${JSON.stringify(project ?? "")} stale=${staleness ? "true" : "false"}`);
-	updateDelivery("handed_off");
-	return finish({ hookSpecificOutput: {
-		hookEventName: "PreToolUse",
-		permissionDecision: "allow",
-		additionalContext: timeline
-	} });
+	return store.finish(runner.run({
+		relativePath,
+		project: resolveProject$1(payload),
+		fileMtimeMs: stat.mtimeMs
+	}));
 }
 var claudeHookFileContextCmd = new Command("claude-hook-file-context").configureHelp(helpStyle).description("Return Claude PreToolUse:Read additionalContext from per-file observation timeline");
 addDbOption(claudeHookFileContextCmd);
+claudeHookFileContextCmd.addOption(new Option("--transport-profile").hideHelp());
+claudeHookFileContextCmd.addOption(new Option("--transport").hideHelp());
 var claudeHookFileContextCommand = claudeHookFileContextCmd.action(async (opts) => {
+	if (opts.transportProfile) {
+		process.stdout.write(`${JSON.stringify(FILE_CONTEXT_TRANSPORT_PROFILE)}\n`);
+		return;
+	}
 	let raw = "";
-	for await (const chunk of process.stdin) raw += String(chunk);
+	for await (const chunk of process.stdin) {
+		raw += String(chunk);
+		if (opts.transport && Buffer.byteLength(raw) > FILE_CONTEXT_TRANSPORT_MAX_BYTES) {
+			emitError$2({
+				error: "parse_error",
+				message: "transport payload too large"
+			});
+			process.exitCode = 1;
+			return;
+		}
+	}
 	const trimmed = raw.trim();
 	if (!trimmed) {
+		if (opts.transport) {
+			process.stdout.write(`${JSON.stringify({
+				error: "parse_error",
+				message: "transport request required"
+			})}\n`);
+			process.exitCode = 1;
+			return;
+		}
 		emitJson$2(continueResult$2());
 		return;
 	}
@@ -518,8 +372,23 @@ var claudeHookFileContextCommand = claudeHookFileContextCmd.action(async (opts)
 		process.exitCode = 1;
 		return;
 	}
-	emitJson$2(await buildClaudeFileContext(payload, opts));
+	await emitFileContext(payload, opts);
 });
+async function emitFileContext(payload, opts) {
+	try {
+		if (opts.transport) {
+			process.stdout.write(`${JSON.stringify(runClaudeFileContextTransport(payload, opts))}\n`);
+			return;
+		}
+		emitJson$2(await buildClaudeFileContext(payload, opts));
+	} catch {
+		emitError$2({
+			error: "file_context_failed",
+			message: "file context unavailable"
+		});
+		process.exitCode = 1;
+	}
+}
 //#endregion
 //#region src/commands/hook-ingest-live-spool.ts
 function spoolLiveHookPayload(dir, payload, logPrefix) {
@@ -1727,7 +1596,7 @@ async function buildLocalPack$2(context, project, dbPath, workingSetPaths = [])
 			packTokens: Number.isFinite(Number(pack.metrics?.pack_tokens)) ? Number(pack.metrics.pack_tokens) : 0
 		};
 	} finally {
-		store.close();
+		await store.closeAsync();
 	}
 }
 async function buildClaudeHookInjection(payload, opts, deps = {}) {
@@ -2368,7 +2237,7 @@ async function buildLocalPack$1(context, project, dbPath) {
 			packTokens: Number.isFinite(Number(pack.metrics?.pack_tokens)) ? Number(pack.metrics?.pack_tokens) : 0
 		};
 	} finally {
-		store.close();
+		await store.closeAsync();
 	}
 }
 async function prepareCodexHookInjection(payload, opts, deps = {}) {
@@ -2630,21 +2499,34 @@ function hasDatabaseSelection(options) {
 	return options.dbPath !== void 0 || options.db !== void 0;
 }
 function exportAccountSchema(options) {
-	const statements = options.deviceUnlink ? ACCOUNT_UNLINK_MIGRATION_STATEMENTS : ACCOUNT_CONNECTION_MIGRATION_STATEMENTS;
-	const text = `-- ${accountPrerequisites}\n-- Execute in ONE atomic D1 batch; do not split into autocommitted requests. Nothing has been applied.\n${statements.map((s) => `${s.trim().replace(/;$/u, "")};`).join("\n")}\n`;
+	let statements = options.deviceUnlink ? ACCOUNT_UNLINK_MIGRATION_STATEMENTS : ACCOUNT_CONNECTION_MIGRATION_STATEMENTS;
+	let prerequisites = accountPrerequisites;
+	if (options.ownerResolution) {
+		statements = LEGACY_OWNER_RESOLUTION_SCHEMA_STATEMENTS;
+		prerequisites += " Requires the current account-management schema first; installs inert receipt storage only, not ownership or access.";
+	}
+	const text = `-- ${prerequisites}\n-- Execute in ONE atomic D1 batch; do not split into autocommitted requests. Nothing has been applied.\n${statements.map((s) => `${s.trim().replace(/;$/u, "")};`).join("\n")}\n`;
 	process.stdout.write(options.json ? `${JSON.stringify({
 		statements,
 		applied: false
 	})}\n` : text);
 }
+function invalidAccountSelection(options, path) {
+	if (options.exportSql) return hasDatabaseSelection(options);
+	if (!path) return true;
+	return Boolean(options.ownerResolution && !hasDatabaseSelection(options));
+}
 async function upgradeAccount(options) {
+	if (options.ownerResolution && options.deviceUnlink) {
+		failure$4(options, "Use --owner-resolution without --device-unlink.", 2, "account_schema_upgrade_failed");
+		return;
+	}
 	if (options.deviceUnlink && !options.exportSql) {
 		failure$4(options, "Use --device-unlink only with --export-sql; local upgrades detect the installed schema.", 2, "account_schema_upgrade_failed");
 		return;
 	}
 	const path = resolveDbOpt(options);
-	const selected = hasDatabaseSelection(options);
-	if (options.exportSql && selected || !options.exportSql && !path) {
+	if (invalidAccountSelection(options, path)) {
 		failure$4(options, options.exportSql ? "Use --export-sql without --db-path; export opens no database." : `Select an existing coordinator database with --db-path. ${accountPrerequisites}`, 2, "account_schema_upgrade_failed");
 		return;
 	}
@@ -2655,14 +2537,23 @@ async function upgradeAccount(options) {
 		}
 		if (!path) return;
 		if (!options.json) process.stderr.write(`${accountPrerequisites}\n`);
-		await upgradeCoordinatorAccountSchemaFile(path);
-		process.stdout.write(options.json ? `${JSON.stringify({ upgraded: true })}\n` : "Coordinator account schema upgraded.\n");
+		if (options.ownerResolution) await upgradeCoordinatorOwnerResolutionSchemaFile(path);
+		else await upgradeCoordinatorAccountSchemaFile(path);
+		process.stdout.write(options.json ? `${JSON.stringify({ upgraded: true })}\n` : accountUpgradeSuccess(options));
 	} catch (error) {
-		failure$4(options, `Account schema upgrade stopped. Inspect the selected database before retrying. ${error instanceof Error ? error.message : "Coordinator account schema upgrade failed."}`, 1, "account_schema_upgrade_failed");
+		failure$4(options, `Account schema upgrade stopped. Inspect the selected database before retrying. ${accountUpgradeFailure(options, error)}`, 1, "account_schema_upgrade_failed");
 	}
 }
+function accountUpgradeSuccess(options) {
+	if (options.ownerResolution) return "Coordinator owner-resolution receipt storage ready; ownership and access unchanged.\n";
+	return "Coordinator account schema upgraded.\n";
+}
+function accountUpgradeFailure(options, error) {
+	if (options.ownerResolution) return "Owner-resolution storage requires the current account schema: first use upgrade-account-schema without --owner-resolution. Partial, unsupported or colliding receipt schemas cannot be repaired by this command. Check file access and writer locks.";
+	return error instanceof Error ? error.message : "Coordinator account schema upgrade failed.";
+}
 function buildCoordinatorAccountSchemaCommand() {
-	const command = new Command("upgrade-account-schema").configureHelp(helpStyle).description("Explicitly install optional coordinator account management on an existing V2 database").option("--device-unlink", "export only the delta for the prior account-management schema (requires --export-sql)").option("-e, --export-sql", "export statement boundaries for one atomic D1 batch without opening a database").addHelpText("after", `\n${accountPrerequisites}\nD1 export does not apply SQL or verify remote execution limits.\n`);
+	const command = new Command("upgrade-account-schema").configureHelp(helpStyle).description("Explicitly install optional coordinator account management on an existing V2 database").option("-o, --owner-resolution", "install inert owner-resolution receipt storage (requires current account schema)").option("--device-unlink", "export only the delta for the prior account-management schema (requires --export-sql)").option("-e, --export-sql", "export statement boundaries for one atomic D1 batch without opening a database").addHelpText("after", `\n${accountPrerequisites}\n--owner-resolution installs storage only; it does not resolve an owner or change access. It requires the current account schema and an explicit --db-path, or --export-sql without a database. It cannot be combined with --device-unlink.\nD1 export does not apply SQL or verify remote execution limits.\n`);
 	addDbOption(command);
 	addJsonOption(command);
 	command.action(upgradeAccount);
@@ -3195,7 +3086,8 @@ var REVIEW_REASONS = [
 	"key_mismatch",
 	"enrollment_identity_mismatch",
 	"invite_identity_mismatch",
-	"invite_evidence_invalid"
+	"invite_evidence_invalid",
+	"legacy_history_invalid"
 ];
 function validId$1(value) {
 	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
@@ -3204,6 +3096,7 @@ function isHash(value) {
 	return typeof value === "string" && value.length === 64 && /^[a-f0-9]{64}$/.test(value);
 }
 function reviewErrorMessage(error) {
+	if (error instanceof CoordinatorHistoryUnavailableError) return "Update the coordinator before reviewing this device owner: retained history evidence was missing or invalid in its response. Nothing changed.";
 	if (error instanceof RemoteCoordinatorRequestError) {
 		if (error.code === "review_stale") return "Evidence changed since the preview. Nothing changed; run the review again.";
 		if (error.code === "already_reviewed_or_needs_review") return "This device already has a reviewed owner, or needs a separate review. Nothing changed.";
@@ -3271,9 +3164,27 @@ function validInviteCount(reply, invites) {
 function validInviteRef(invite) {
 	return !!invite && validId$1(invite.invite_id) && (invite.kind === "team_member" || invite.kind === "add_device");
 }
+function previewEnrollment(enrollment) {
+	if (!enrollment) return null;
+	return {
+		device_id: enrollment.device_id,
+		fingerprint: enrollment.fingerprint,
+		display_name: null,
+		identity_label: enrollment.identity_label
+	};
+}
+var CoordinatorHistoryUnavailableError = class extends Error {};
+function parsePreviewHistory(value, coordinatorId) {
+	try {
+		return parseControllerHistoryEvidence(value, coordinatorId);
+	} catch {
+		throw new CoordinatorHistoryUnavailableError();
+	}
+}
 function parsePreview(payload, request) {
 	if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("invalid_preview");
 	const reply = payload;
+	if (!Array.isArray(reply.legacy_history)) throw new CoordinatorHistoryUnavailableError();
 	const enrollment = reply.enrollment;
 	const invites = reply.reviewed_invites;
 	if (reply.state !== "ready" && reply.state !== "needs_review" || !validId$1(reply.coordinator_id) || !Array.isArray(reply.reasons) || !reply.reasons.every((reason) => typeof reason === "string" && REVIEW_REASONS.includes(reason)) || !Array.isArray(invites) || !validInviteCount(reply, invites) || !invites.every(validInviteRef)) throw new Error("invalid_preview");
@@ -3282,14 +3193,10 @@ function parsePreview(payload, request) {
 	return {
 		state: reply.state,
 		coordinator_id: reply.coordinator_id,
+		legacy_history: parsePreviewHistory(reply.legacy_history, reply.coordinator_id),
 		reasons: reply.reasons,
 		evidence_digest: reply.state === "ready" ? reply.evidence_digest : void 0,
-		enrollment: enrollment ? {
-			device_id: enrollment.device_id,
-			fingerprint: enrollment.fingerprint,
-			display_name: null,
-			identity_label: enrollment.identity_label
-		} : null,
+		enrollment: previewEnrollment(enrollment),
 		reviewed_invites: invites.map((invite) => ({
 			invite_id: invite.invite_id,
 			kind: invite.kind
@@ -3364,6 +3271,86 @@ function emitReviewPreview(evidence, preview) {
 		...stopped
 	})}\n`);
 }
+function terminalIdentifier(value) {
+	return JSON.stringify(value).replace(/[\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}]/gu, (character) => `\\u{${character.codePointAt(0)?.toString(16)}}`);
+}
+function historyAssociation(deviceId, fingerprint, subject) {
+	if (deviceId === subject.deviceId) {
+		if (fingerprint === subject.fingerprint) return "Current device; current fingerprint";
+		return "Current device; different recorded key";
+	}
+	if (fingerprint === subject.fingerprint) return "Other device; current fingerprint";
+	return "Other recorded device/key; canonical-key equivalence is not identified in this summary";
+}
+function* controllerHistoryRows(preview, subject) {
+	for (const record of preview.legacy_history) {
+		yield {
+			text: `Historical group ${terminalIdentifier(record.group_id)}; Team ${terminalIdentifier(record.manifest.team_id)}; completed ${terminalIdentifier(record.completed_at)}\nCandidate: ${terminalIdentifier(record.candidate_ref)}; manifest version: ${record.manifest_version}; recorded: ${terminalIdentifier(record.created_at)}\nOriginal retained manifest JSON: ${terminalIdentifier(record.manifest_json)}`,
+			records: 1,
+			decisions: 0
+		};
+		for (const decision of record.manifest.device_decisions) {
+			const identity = decision.identity_id === null ? "none" : terminalIdentifier(decision.identity_id);
+			yield {
+				text: `  ${decision.decision}; Identity: ${identity}; enabled: ${decision.enabled ? "yes" : "no"}\n  Device: ${terminalIdentifier(decision.device_id)}; fingerprint: ${terminalIdentifier(decision.key_fingerprint)}\n  ${historyAssociation(decision.device_id, decision.key_fingerprint, subject)}`,
+				records: 0,
+				decisions: 1
+			};
+		}
+	}
+}
+/** A truncated summary must never authorize the terminal confirmation. */
+function formatControllerReviewHistory(preview, subject) {
+	const lines = [
+		`Proposed current owner Identity: ${terminalIdentifier(subject.identityId)}`,
+		"Retained legacy sharing assignments (not ownership changes):",
+		"Records may contain other devices. Different fingerprints may represent known key aliases; no row below is assumed to belong to this device unless labeled as an exact device/fingerprint match."
+	];
+	let records = 0;
+	let decisions = 0;
+	let characters = lines.join("\n").length;
+	let complete = true;
+	for (const row of controllerHistoryRows(preview, subject)) {
+		if (records + row.records > 20 || decisions + row.decisions > 40 || characters + row.text.length + 1 > 24e3) {
+			complete = false;
+			break;
+		}
+		lines.push(row.text);
+		records += row.records;
+		decisions += row.decisions;
+		characters += row.text.length + 1;
+	}
+	if (preview.legacy_history.length === 0) lines.push("No relevant retained legacy assignments.");
+	if (!complete) {
+		const totalDecisions = preview.legacy_history.reduce((total, record) => total + record.manifest.device_decisions.length, 0);
+		lines.push(`TRUNCATED: showing ${records} of ${preview.legacy_history.length} records and ${decisions} of ${totalDecisions} device decisions. Terminal confirmation is disabled.`);
+	}
+	lines.push("Previous assignments are retained. This review records current ownership; it does not migrate sharing, move memories, merge Identities, or grant Team/Project access.", "Approval grants the existing controller authority, including account management when the coordinator permits it. Google account linking remains a separate step.");
+	return {
+		text: lines.join("\n"),
+		complete
+	};
+}
+function showCoordinatorReview(preview, request, options) {
+	p.log.info(`Coordinator: ${preview.coordinator_id}; reviewed invitations: ${preview.reviewed_invite_count}`, { output: process.stderr });
+	const history = formatControllerReviewHistory(preview, request);
+	p.log.message(history.text, { output: process.stderr });
+	if (history.complete) return true;
+	failure$1(options, "Nothing changed. Run the same command with --json to inspect all retained evidence. Ask the coordinator operator to use the administrator review API for evidence exceeding this terminal's display limit.", 2);
+	return false;
+}
+function reportReviewFailure(options, error) {
+	if (options.json && error instanceof CoordinatorHistoryUnavailableError) {
+		process.stdout.write(`${JSON.stringify({
+			error: "owner_review_unavailable",
+			message: reviewErrorMessage(error),
+			unchanged: true
+		})}\n`);
+		process.exitCode = 1;
+		return;
+	}
+	failure$1(options, reviewErrorMessage(error));
+}
 async function reviewDeviceOwner(group, options) {
 	try {
 		if (!validId$1(group)) return failure$1(options, "Use a valid coordinator group ID.", 2);
@@ -3392,10 +3379,10 @@ async function reviewDeviceOwner(group, options) {
 			return;
 		}
 		if (preview.state !== "ready") return failure$1(options, `Coordinator review stopped: ${preview.reasons.join(", ")}. Nothing changed.`);
-		p.log.info(`Coordinator: ${preview.coordinator_id}; reviewed invitations: ${preview.reviewed_invite_count}`, { output: process.stderr });
+		if (!showCoordinatorReview(preview, request, options)) return;
 		await confirmReview(group, options, evidence, request, preview);
 	} catch (error) {
-		failure$1(options, reviewErrorMessage(error));
+		reportReviewFailure(options, error);
 	}
 }
 function buildCoordinatorReviewDeviceOwnerCommand() {
@@ -6040,7 +6027,7 @@ function createInjectMemoryCommand() {
 			const pack = await store.buildMemoryPackAsync(context, limit, budget, filters);
 			console.log(pack.pack_text ?? "");
 		} finally {
-			store.close();
+			await store.closeAsync();
 		}
 	});
 	return cmd;
@@ -7207,7 +7194,7 @@ async function withStore(opts, errorCode, run) {
 		p.log.error(message);
 		process.exitCode = usageError ? 2 : 1;
 	} finally {
-		store?.close();
+		await store?.closeAsync();
 	}
 }
 function ledgerAutomaticContext(payload) {
@@ -7900,7 +7887,7 @@ async function buildLocalPack(context, project, dbPath) {
 			packTokens: Number.isFinite(Number(pack.metrics?.pack_tokens)) ? Number(pack.metrics?.pack_tokens) : 0
 		};
 	} finally {
-		store.close();
+		await store.closeAsync();
 	}
 }
 function isRecord$1(value) {
@@ -8789,6 +8776,12 @@ function readViewerPidRecord(dbPath) {
 	};
 	return null;
 }
+function removeOwnedViewerPidFile(dbPath) {
+	try {
+		if (readViewerPidRecord(dbPath)?.pid !== process.pid) return;
+		rmSync(pidFilePath(dbPath));
+	} catch {}
+}
 function normalizeViewerHost(host) {
 	const normalized = host.trim().toLowerCase();
 	if (normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]") return "loopback";
@@ -9207,6 +9200,10 @@ function createRawEventTargetState(store) {
 		stop
 	};
 }
+function createOptionalOwnerRecovery(serverModule, options) {
+	if (!("createAccountOwnerRecoveryService" in serverModule) || typeof serverModule.createAccountOwnerRecoveryService !== "function") return void 0;
+	return serverModule.createAccountOwnerRecoveryService(options);
+}
 function createViewerAccountLink(store, invocation, serverModule) {
 	const configPath = resolveCodememConfigPath(invocation.configPath ?? void 0).resolved.path;
 	const keysDir = dirname(resolveKeyPaths(process.env.CODEMEM_KEYS_DIR?.trim() || void 0)[0]);
@@ -9222,15 +9219,31 @@ function createViewerAccountLink(store, invocation, serverModule) {
 		keysDir
 	});
 	const registry = serverModule.createAccountLinkRegistry({ readContext });
+	const ownerRecovery = createOptionalOwnerRecovery(serverModule, {
+		readContext,
+		registry,
+		readAdminSecret: () => {
+			const envSecret = process.env.CODEMEM_SYNC_COORDINATOR_ADMIN_SECRET?.trim();
+			if (envSecret) return envSecret;
+			const secret = readCodememConfigFileAtPath(configPath).sync_coordinator_admin_secret;
+			return typeof secret === "string" ? secret.trim() : null;
+		}
+	});
 	let actualBoundPort = null;
 	return {
 		registry,
+		ownerRecovery,
+		close: async () => {
+			if (ownerRecovery) await ownerRecovery.close();
+			await registry.close();
+		},
 		setBoundPort: (port) => {
 			actualBoundPort = port;
 		},
 		options: {
 			readContext,
 			registry,
+			ownerRecovery,
 			getListenerAddress: () => actualBoundPort === null ? null : {
 				host: invocation.host,
 				port: actualBoundPort
@@ -9252,7 +9265,7 @@ function announceViewerStartup(options) {
 }
 async function startForegroundViewer(invocation) {
 	const serverModule = await import("@codemem/server");
-	const { createApp, createSyncApp, closeStore, createViewerRawEventInbox, getStore } = serverModule;
+	const { createApp, createSyncApp, closeStoreAsync, createViewerRawEventInbox, getStore } = serverModule;
 	const createRawEventInbox = createViewerRawEventInbox;
 	const coordinatorMaintenanceDependencies = createServeCoordinatorMaintenanceDependencies(serverModule);
 	const { serve } = await import("@hono/node-server");
@@ -9274,7 +9287,7 @@ async function startForegroundViewer(invocation) {
 		p.log.warn("sqlite-vec failed to load; retrying viewer startup with embeddings disabled");
 		for (const line of sqliteVecFailureDiagnostics(err, resolveDbPath(invocation.dbPath ?? void 0))) p.log.warn(`sqlite-vec diagnostic: ${line}`);
 		process.env.CODEMEM_EMBEDDING_DISABLED = "1";
-		closeStore();
+		await closeStoreAsync();
 		store = getStore();
 		p.log.warn("Embeddings disabled for this viewer process; raw-event ingestion remains active.");
 	}
@@ -9368,51 +9381,72 @@ async function startForegroundViewer(invocation) {
 	server.on("error", (err) => {
 		if (err.code === "EADDRINUSE") p.log.warn(`Viewer already running at http://${invocation.host}:${invocation.port}`);
 		else p.log.error(err.message);
-		process.exit(1);
+		requestShutdown(1);
 	});
-	const shutdown = async () => {
+	let shutdownPromise;
+	let shutdownExitCode = 0;
+	const shutdown = (exitCode = 0) => {
+		shutdownExitCode = Math.max(shutdownExitCode, exitCode);
+		shutdownPromise ??= finishShutdown();
+		return shutdownPromise;
+	};
+	const finishShutdown = async () => {
 		p.outro("shutting down");
 		syncAbort.abort();
-		await accountLink.registry.close();
-		await stopMaintenanceWorkerProcess(maintenanceWorker, dbPath);
-		await new Promise((resolve) => {
-			let remaining = syncServer ? 2 : 1;
-			const done = () => {
-				if (--remaining === 0) resolve();
-			};
-			syncServer?.close(done);
-			server.close(done);
-		}).catch(() => {});
-		await rawEventProcessing.stop();
 		try {
-			rmSync(pidPath);
-		} catch {}
-		closeStore();
-		process.exit(0);
-	};
-	const forceShutdown = () => {
-		setTimeout(() => {
-			if (maintenanceWorker?.pid && isProcessRunning(maintenanceWorker.pid)) try {
-				process.kill(maintenanceWorker.pid, "SIGKILL");
-			} catch {}
 			try {
-				rmSync(pidPath);
-			} catch {}
+				await accountLink.close();
+				await stopMaintenanceWorkerProcess(maintenanceWorker, dbPath);
+			} finally {
+				await closeViewerListeners(syncServer ? [syncServer, server] : [server]);
+				await rawEventProcessing.stop();
+			}
+		} catch (error) {
+			shutdownExitCode = 1;
+			logViewerShutdownError(error);
+		} finally {
+			removeOwnedViewerPidFile(dbPath);
 			try {
-				rmSync(maintenanceWorkerPidFilePath(dbPath));
-			} catch {}
-			closeStore();
-			process.exit(1);
-		}, 3e4).unref();
+				await closeStoreAsync();
+			} catch (error) {
+				shutdownExitCode = 1;
+				logViewerShutdownError(error);
+			}
+		}
+		process.exit(shutdownExitCode);
 	};
-	process.on("SIGINT", () => {
-		forceShutdown();
-		shutdown();
-	});
-	process.on("SIGTERM", () => {
-		forceShutdown();
-		shutdown();
-	});
+	const requestShutdown = (exitCode = 0) => {
+		if (!shutdownPromise) forceViewerShutdown(maintenanceWorker, dbPath);
+		shutdown(exitCode).catch((error) => {
+			logViewerShutdownError(error);
+		});
+	};
+	process.on("SIGINT", () => requestShutdown());
+	process.on("SIGTERM", () => requestShutdown());
+}
+function logViewerShutdownError(error) {
+	p.log.error(error instanceof Error ? error.message : String(error));
+}
+function closeViewerListeners(listeners) {
+	return new Promise((resolve) => {
+		let remaining = listeners.length;
+		const done = () => {
+			if (--remaining === 0) resolve();
+		};
+		for (const listener of listeners) listener.close(done);
+	}).catch(() => {});
+}
+function forceViewerShutdown(maintenanceWorker, dbPath) {
+	setTimeout(() => {
+		if (maintenanceWorker?.pid && isProcessRunning(maintenanceWorker.pid)) try {
+			process.kill(maintenanceWorker.pid, "SIGKILL");
+		} catch {}
+		removeOwnedViewerPidFile(dbPath);
+		try {
+			rmSync(maintenanceWorkerPidFilePath(dbPath));
+		} catch {}
+		process.exit(1);
+	}, 3e4).unref();
 }
 async function runServeInvocation(invocation, dependencies = {
 	nativeRuntimeAllowsServeStart,