crosscheck-mcp 0.2.14 → 0.2.16

package/dist/node-stdio.cjs

@@ -958,8 +958,8 @@ __export(node_stdio_exports, {
 });
 module.exports = __toCommonJS(node_stdio_exports);
 init_cjs_shims();
-var import_node_fs18 = require("fs");
-var import_node_path17 = __toESM(require("path"), 1);
+var import_node_fs19 = require("fs");
+var import_node_path18 = __toESM(require("path"), 1);
 var import_node_url2 = require("url");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 
@@ -976,10 +976,10 @@ var StderrEmitter = class {
   }
 };
 var FileEmitter = class {
-  constructor(path14) {
-    this.path = path14;
+  constructor(path15) {
+    this.path = path15;
     try {
-      (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path14), { recursive: true });
+      (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path15), { recursive: true });
     } catch {
     }
   }
@@ -1012,13 +1012,13 @@ var NullEmitter = class {
 function buildDefaultEmitter(env) {
   const mode = (env["CROSSCHECK_EVENTS"] ?? "stderr").toLowerCase();
   if (mode === "off") return new NullEmitter();
-  const path14 = env["CROSSCHECK_EVENTS_PATH"];
+  const path15 = env["CROSSCHECK_EVENTS_PATH"];
   if (mode === "file") {
-    return path14 ? new FileEmitter(path14) : new NullEmitter();
+    return path15 ? new FileEmitter(path15) : new NullEmitter();
   }
   if (mode === "both") {
     const ems = [new StderrEmitter()];
-    if (path14) ems.push(new FileEmitter(path14));
+    if (path15) ems.push(new FileEmitter(path15));
     return new TeeEmitter(ems);
   }
   return new StderrEmitter();
@@ -1067,10 +1067,10 @@ function envelopeBytes(v) {
 // src/core/pricing.ts
 init_cjs_shims();
 var import_node_fs2 = require("fs");
-function loadPricing(path14) {
+function loadPricing(path15) {
   let raw;
   try {
-    raw = (0, import_node_fs2.readFileSync)(path14, "utf8");
+    raw = (0, import_node_fs2.readFileSync)(path15, "utf8");
   } catch {
     return {};
   }
@@ -1242,11 +1242,18 @@ var ProviderError = class extends Error {
   status;
   transient;
   retryAfterS;
+  /** True specifically for "the key is fine but this model isn't
+   *  available to this account/project" (see http-errors.ts's
+   *  isModelAccessFailure) — the one failure a model fallback chain can
+   *  actually fix. Distinct from `transient`: this is never worth
+   *  retrying the SAME model, but IS worth trying a different one. */
+  modelAccessFailure;
   constructor(kind, message, opts) {
     super(message);
     this.kind = kind;
     this.status = opts?.status;
     this.transient = opts?.transient ?? defaultTransient(kind);
+    this.modelAccessFailure = opts?.modelAccessFailure ?? false;
     if (opts?.retryAfterS !== void 0) {
       this.retryAfterS = opts.retryAfterS;
     }
@@ -1278,7 +1285,7 @@ function httpFailureToProviderError(provider, status, bodyText, retryAfterS, mod
     return new ProviderError(
       "client",
       `${provider}: your account/project doesn't have access to ${modelRef} (HTTP ${status}). This is a model-access problem, not a key problem \u2014 your ${provider} API key is fine, ${modelRef} just isn't enabled for this account/project. Fix: run \`crosscheck models set ${provider} <a-model-you-have-access-to>\` (or set ${provider.toUpperCase()}_MODEL in your .env until that's available). Detail: ${detail}`,
-      { status }
+      { status, modelAccessFailure: true }
     );
   }
   if (isCreditsFailure(status, bodyText)) {
@@ -1319,8 +1326,8 @@ function httpFailureToProviderError(provider, status, bodyText, retryAfterS, mod
 // src/providers/retry.ts
 init_cjs_shims();
 var override = null;
-function setRetryConfig(cfg) {
-  override = cfg;
+function setRetryConfig(cfg2) {
+  override = cfg2;
 }
 function resolveRetryConfig() {
   const envInt = (k, d) => {
@@ -1382,21 +1389,21 @@ function defaultSleep(ms, signal) {
     signal?.addEventListener?.("abort", onAbort);
   });
 }
-async function sendWithRetry(attemptOnce, cfg, signal, deps) {
+async function sendWithRetry(attemptOnce, cfg2, signal, deps) {
   const sleep = deps?.sleepImpl ?? ((ms) => defaultSleep(ms, signal));
   const rand = deps?.random ?? Math.random;
   let lastErr;
-  for (let attempt = 1; attempt <= cfg.maxAttempts; attempt += 1) {
+  for (let attempt = 1; attempt <= cfg2.maxAttempts; attempt += 1) {
     try {
       const result = await attemptOnce();
       return { ...result, attempts: attempt };
     } catch (e) {
       lastErr = e;
       const pe = e instanceof ProviderError ? e : null;
-      if (pe?.transient !== true || attempt >= cfg.maxAttempts) throw e;
-      let backoffMs = pe.retryAfterS !== void 0 ? pe.retryAfterS * 1e3 : cfg.backoffBaseMs * 2 ** (attempt - 1);
-      backoffMs += rand() * cfg.backoffBaseMs;
-      backoffMs = Math.min(backoffMs, cfg.maxBackoffMs);
+      if (pe?.transient !== true || attempt >= cfg2.maxAttempts) throw e;
+      let backoffMs = pe.retryAfterS !== void 0 ? pe.retryAfterS * 1e3 : cfg2.backoffBaseMs * 2 ** (attempt - 1);
+      backoffMs += rand() * cfg2.backoffBaseMs;
+      backoffMs = Math.min(backoffMs, cfg2.maxBackoffMs);
       await sleep(backoffMs);
     }
   }
@@ -1408,8 +1415,8 @@ init_cjs_shims();
 var DEFAULT_SPEC = { capacity: 5, refillPerSec: 5 };
 var MAX_WAIT_SLICE_MS = 250;
 var override2 = null;
-function setRateLimitConfig(cfg) {
-  override2 = cfg;
+function setRateLimitConfig(cfg2) {
+  override2 = cfg2;
   buckets.clear();
 }
 function disabled() {
@@ -1494,6 +1501,14 @@ function buildAnthropicRequest(opts) {
   if (system !== void 0) {
     body.system = system;
   }
+  if (isReasoningModel("anthropic", opts.model)) {
+    if (opts.model.toLowerCase().startsWith("claude-fable-5")) {
+      body.thinking = { type: "adaptive" };
+      body.output_config = { effort: "low" };
+    } else {
+      body.thinking = { type: "disabled" };
+    }
+  }
   if (opts.jsonSchema) {
     body.tools = [{
       name: ANTHROPIC_STRUCTURED_TOOL_NAME,
@@ -1561,7 +1576,12 @@ function parseAnthropicResponse(opts) {
     purpose: opts.purpose
   };
   usage.total_tokens = usage.prompt_tokens + usage.completion_tokens;
-  return { text, usage };
+  const stopReasonRaw = r["stop_reason"];
+  const stopReason = typeof stopReasonRaw === "string" ? stopReasonRaw : void 0;
+  return { text, usage, ...stopReason !== void 0 ? { stopReason } : {} };
+}
+function isEmptyDueToMaxTokens(text, stopReason) {
+  return text.trim() === "" && stopReason === "max_tokens";
 }
 function applyPricing(usage, pricing) {
   const { cost_usd, estimated } = calculateCost(
@@ -1579,49 +1599,64 @@ function applyPricing(usage, pricing) {
     estimated: usage.estimated || estimated
   };
 }
+var MAX_TOKENS_ESCALATIONS = 2;
+var ESCALATION_MULTIPLIER = 2;
 async function sendAnthropic(args) {
-  const { url, headers, body } = buildAnthropicRequest({
-    model: args.model,
-    apiKey: args.apiKey,
-    messages: args.messages,
-    maxTokens: args.maxTokens,
-    temperature: args.temperature,
-    ...args.jsonSchema ? { jsonSchema: args.jsonSchema } : {}
-  });
   const doFetch = args.fetchImpl ?? globalThis.fetch;
-  const init = {
-    method: "POST",
-    headers,
-    body: JSON.stringify(body)
-  };
-  if (args.signal) init.signal = args.signal;
-  const attemptOnce = async () => {
-    let respLike;
-    try {
-      respLike = await doFetch(url, init);
-    } catch (e) {
-      throw new ProviderError("network", `anthropic: fetch failed: ${e.message}`);
-    }
-    const status = respLike.status;
-    if (status >= 200 && status < 300) {
-      let parsed;
+  let maxTokens = args.maxTokens;
+  let result = null;
+  let totalAttempts = 0;
+  for (let escalation = 0; escalation <= MAX_TOKENS_ESCALATIONS; escalation += 1) {
+    const { url, headers, body } = buildAnthropicRequest({
+      model: args.model,
+      apiKey: args.apiKey,
+      messages: args.messages,
+      maxTokens,
+      temperature: args.temperature,
+      ...args.jsonSchema ? { jsonSchema: args.jsonSchema } : {}
+    });
+    const init = {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    };
+    if (args.signal) init.signal = args.signal;
+    let stopReason;
+    const attemptOnce = async () => {
+      let respLike;
       try {
-        parsed = await respLike.json();
+        respLike = await doFetch(url, init);
       } catch (e) {
-        throw new ProviderError("parse", `anthropic: response body not JSON: ${e.message}`);
+        throw new ProviderError("network", `anthropic: fetch failed: ${e.message}`);
       }
-      const { text, usage } = parseAnthropicResponse({
-        resp: parsed,
-        model: args.model,
-        purpose: args.purpose ?? "worker"
-      });
-      return { text, attempts: 1, usage: applyPricing(usage, args.pricing) };
+      const status = respLike.status;
+      if (status >= 200 && status < 300) {
+        let parsed;
+        try {
+          parsed = await respLike.json();
+        } catch (e) {
+          throw new ProviderError("parse", `anthropic: response body not JSON: ${e.message}`);
+        }
+        const { text, usage, stopReason: sr } = parseAnthropicResponse({
+          resp: parsed,
+          model: args.model,
+          purpose: args.purpose ?? "worker"
+        });
+        stopReason = sr;
+        return { text, attempts: 1, usage: applyPricing(usage, args.pricing) };
+      }
+      const bodyText = await respLike.text().catch(() => "");
+      throw httpFailureToProviderError("anthropic", status, bodyText, parseRetryAfter(respLike), args.model);
+    };
+    await acquireRateLimit("anthropic", args.signal ? { signal: args.signal } : void 0);
+    result = await sendWithRetry(attemptOnce, resolveRetryConfig(), args.signal);
+    totalAttempts += result.attempts;
+    if (escalation >= MAX_TOKENS_ESCALATIONS || !isEmptyDueToMaxTokens(result.text, stopReason)) {
+      break;
     }
-    const bodyText = await respLike.text().catch(() => "");
-    throw httpFailureToProviderError("anthropic", status, bodyText, parseRetryAfter(respLike), args.model);
-  };
-  await acquireRateLimit("anthropic", args.signal ? { signal: args.signal } : void 0);
-  return sendWithRetry(attemptOnce, resolveRetryConfig(), args.signal);
+    maxTokens *= ESCALATION_MULTIPLIER;
+  }
+  return { ...result, attempts: totalAttempts };
 }
 
 // src/providers/gemini.ts
@@ -2007,19 +2042,27 @@ function detectStalePins(env) {
   const out = [];
   for (const [provider, envVar] of Object.entries(MODEL_ENV_VARS)) {
     const pinned = env[envVar];
-    const current = DEFAULT_MODELS[provider];
-    if (pinned && current && pinned !== current) {
-      out.push({ provider, envVar, pinned, current });
+    const current2 = DEFAULT_MODELS[provider];
+    if (pinned && current2 && pinned !== current2) {
+      out.push({ provider, envVar, pinned, current: current2 });
     }
   }
   return out;
 }
+function parseFallbackModels(raw) {
+  if (!raw) return [];
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function fallbackModelsFor(env, provider) {
+  const envVar = MODEL_ENV_VARS[provider];
+  return envVar ? parseFallbackModels(env[`${envVar}_FALLBACKS`]) : [];
+}
 function buildProviders(opts) {
   const out = {};
   const anthropicKey = opts.env["ANTHROPIC_API_KEY"];
   if (anthropicKey) {
     const model = opts.env["ANTHROPIC_MODEL"] ?? DEFAULT_MODELS.anthropic;
-    out["anthropic"] = makeAnthropicProvider(model, anthropicKey, opts);
+    out["anthropic"] = makeAnthropicProvider(model, anthropicKey, opts, fallbackModelsFor(opts.env, "anthropic"));
   }
   const openAiCompatSpec = [
     { name: "openai", keyEnv: "OPENAI_API_KEY", modelEnv: "OPENAI_MODEL", defaultModel: DEFAULT_MODELS["openai"] },
@@ -2034,19 +2077,20 @@ function buildProviders(opts) {
     const apiKey = opts.env[s.keyEnv];
     if (!apiKey) continue;
     const model = opts.env[s.modelEnv] ?? s.defaultModel;
-    out[s.name] = makeOpenAICompatibleProvider(s.name, model, apiKey, opts);
+    out[s.name] = makeOpenAICompatibleProvider(s.name, model, apiKey, opts, fallbackModelsFor(opts.env, s.name));
   }
   const geminiKey = opts.env["GEMINI_API_KEY"];
   if (geminiKey) {
     const model = opts.env["GEMINI_MODEL"] ?? DEFAULT_MODELS.gemini;
-    out["gemini"] = makeGeminiProvider(model, geminiKey, opts);
+    out["gemini"] = makeGeminiProvider(model, geminiKey, opts, fallbackModelsFor(opts.env, "gemini"));
   }
   return out;
 }
-function makeAnthropicProvider(model, apiKey, opts) {
+function makeAnthropicProvider(model, apiKey, opts, fallbackModels = []) {
   return {
     name: "anthropic",
     model,
+    fallbackModels,
     send: async (args) => {
       const sendOpts = {
         ...args,
@@ -2059,11 +2103,12 @@ function makeAnthropicProvider(model, apiKey, opts) {
     }
   };
 }
-function makeOpenAICompatibleProvider(name, model, apiKey, opts) {
+function makeOpenAICompatibleProvider(name, model, apiKey, opts, fallbackModels = []) {
   const url = OPENAI_COMPAT_DEFAULT_URLS[name];
   return {
     name,
     model,
+    fallbackModels,
     send: async (args) => {
       const sendOpts = {
         ...args,
@@ -2078,10 +2123,11 @@ function makeOpenAICompatibleProvider(name, model, apiKey, opts) {
     }
   };
 }
-function makeGeminiProvider(model, apiKey, opts) {
+function makeGeminiProvider(model, apiKey, opts, fallbackModels = []) {
   return {
     name: "gemini",
     model,
+    fallbackModels,
     send: async (args) => {
       const sendOpts = {
         ...args,
@@ -2098,7 +2144,7 @@ function makeGeminiProvider(model, apiKey, opts) {
 // src/server.ts
 init_cjs_shims();
 var import_server = require("@modelcontextprotocol/sdk/server/index.js");
-var import_types8 = require("@modelcontextprotocol/sdk/types.js");
+var import_types9 = require("@modelcontextprotocol/sdk/types.js");
 
 // src/bridge/index.ts
 init_cjs_shims();
@@ -2229,7 +2275,7 @@ var import_zod = require("zod");
 // src/server-meta.ts
 init_cjs_shims();
 var SERVER_NAME = "crosscheck-agent";
-var SERVER_VERSION = true ? "0.2.14" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.2.16" : "0.0.0-dev";
 
 // src/tools/audit.ts
 init_cjs_shims();
@@ -2296,27 +2342,27 @@ function extractJson(text) {
 
 // src/core/json-schema.ts
 init_cjs_shims();
-function validateSchema(value, schema, path14 = "") {
+function validateSchema(value, schema, path15 = "") {
   const errs = [];
   if ("anyOf" in schema) {
     const subs = schema["anyOf"].map(
-      (s) => validateSchema(value, s, path14)
+      (s) => validateSchema(value, s, path15)
     );
     if (!subs.some((e) => e.length === 0)) {
-      errs.push(`${path14 || "<root>"}: did not match anyOf`);
+      errs.push(`${path15 || "<root>"}: did not match anyOf`);
     }
     return errs;
   }
   if ("oneOf" in schema) {
-    const passed = schema["oneOf"].filter((s) => validateSchema(value, s, path14).length === 0).length;
+    const passed = schema["oneOf"].filter((s) => validateSchema(value, s, path15).length === 0).length;
     if (passed !== 1) {
-      errs.push(`${path14 || "<root>"}: matched ${passed} of oneOf, expected 1`);
+      errs.push(`${path15 || "<root>"}: matched ${passed} of oneOf, expected 1`);
     }
     return errs;
   }
   if ("const" in schema && !deepEqual(value, schema["const"])) {
     errs.push(
-      `${path14 || "<root>"}: expected const ${pyRepr(schema["const"])}, got ${pyRepr(value)}`
+      `${path15 || "<root>"}: expected const ${pyRepr(schema["const"])}, got ${pyRepr(value)}`
     );
     return errs;
   }
@@ -2326,7 +2372,7 @@ function validateSchema(value, schema, path14 = "") {
     const ok = types.some((tt) => matchesType(value, String(tt)));
     if (!ok) {
       errs.push(
-        `${path14 || "<root>"}: expected type ${pyReprType(t)}, got ${pyTypeName(value)}`
+        `${path15 || "<root>"}: expected type ${pyReprType(t)}, got ${pyTypeName(value)}`
       );
       return errs;
     }
@@ -2335,29 +2381,29 @@ function validateSchema(value, schema, path14 = "") {
     if ("enum" in schema) {
       const en = schema["enum"];
       if (!en.some((x) => deepEqual(x, value))) {
-        errs.push(`${path14 || "<root>"}: value ${pyRepr(value)} not in enum`);
+        errs.push(`${path15 || "<root>"}: value ${pyRepr(value)} not in enum`);
       }
     }
     if ("minLength" in schema && value.length < schema["minLength"]) {
-      errs.push(`${path14 || "<root>"}: shorter than minLength ${schema["minLength"]}`);
+      errs.push(`${path15 || "<root>"}: shorter than minLength ${schema["minLength"]}`);
     }
   }
   if (typeof value === "number" && !Number.isNaN(value)) {
     if ("minimum" in schema && value < schema["minimum"]) {
-      errs.push(`${path14 || "<root>"}: ${value} < minimum ${schema["minimum"]}`);
+      errs.push(`${path15 || "<root>"}: ${value} < minimum ${schema["minimum"]}`);
     }
     if ("maximum" in schema && value > schema["maximum"]) {
-      errs.push(`${path14 || "<root>"}: ${value} > maximum ${schema["maximum"]}`);
+      errs.push(`${path15 || "<root>"}: ${value} > maximum ${schema["maximum"]}`);
     }
   }
   if (Array.isArray(value)) {
     if ("minItems" in schema && value.length < schema["minItems"]) {
-      errs.push(`${path14 || "<root>"}: fewer items than minItems ${schema["minItems"]}`);
+      errs.push(`${path15 || "<root>"}: fewer items than minItems ${schema["minItems"]}`);
     }
     const itemSchema = schema["items"];
     if (isObj(itemSchema)) {
       for (let i = 0; i < value.length; i++) {
-        errs.push(...validateSchema(value[i], itemSchema, `${path14}[${i}]`));
+        errs.push(...validateSchema(value[i], itemSchema, `${path15}[${i}]`));
       }
     }
   }
@@ -2366,19 +2412,19 @@ function validateSchema(value, schema, path14 = "") {
     const required = schema["required"] ?? [];
     for (const r of required) {
       if (!(r in value)) {
-        errs.push(`${path14 || "<root>"}: missing required key ${pyRepr(r)}`);
+        errs.push(`${path15 || "<root>"}: missing required key ${pyRepr(r)}`);
       }
     }
     if (schema["additionalProperties"] === false) {
       for (const k of Object.keys(value)) {
         if (!(k in props)) {
-          errs.push(`${path14 || "<root>"}: unknown key ${pyRepr(k)}`);
+          errs.push(`${path15 || "<root>"}: unknown key ${pyRepr(k)}`);
         }
       }
     }
     for (const [k, v] of Object.entries(value)) {
       const ps = props[k];
-      if (ps) errs.push(...validateSchema(v, ps, path14 ? `${path14}.${k}` : k));
+      if (ps) errs.push(...validateSchema(v, ps, path15 ? `${path15}.${k}` : k));
     }
   }
   return errs;
@@ -2879,8 +2925,8 @@ async function recordSessionCall(storage, sessionId, answers, wallMs, cpuMs, now
 // src/core/budgets.ts
 init_cjs_shims();
 var operatorBudgets = null;
-function setOperatorBudgets(cfg) {
-  operatorBudgets = cfg;
+function setOperatorBudgets(cfg2) {
+  operatorBudgets = cfg2;
 }
 function operatorCeiling(purpose, provider) {
   const direct = operatorBudgets?.token_budgets?.[purpose];
@@ -2891,6 +2937,55 @@ function operatorCeiling(purpose, provider) {
   return null;
 }
 
+// src/core/model-fallback.ts
+init_cjs_shims();
+
+// src/core/retarget.ts
+init_cjs_shims();
+function retargetProvider(p, newModel) {
+  if (p.model === newModel) return p;
+  return {
+    name: p.name,
+    model: newModel,
+    send: (args) => p.send({ ...args, modelOverride: newModel })
+  };
+}
+async function loadProviderWeights(storage, names) {
+  const out = {};
+  for (const raw of names) {
+    const name = raw.toLowerCase();
+    if (name in out) continue;
+    const row = await storage.getProviderStats(name);
+    if (!row) {
+      out[name] = 0.5;
+      continue;
+    }
+    const total = row.wins + row.losses + row.abstains;
+    out[name] = total <= 0 ? 0.5 : (row.wins + 0.5 * row.abstains) / total;
+  }
+  return out;
+}
+
+// src/core/model-fallback.ts
+async function sendWithModelFallback(provider, args) {
+  const chain = [provider.model, ...provider.fallbackModels ?? []];
+  let lastErr;
+  for (let i = 0; i < chain.length; i += 1) {
+    const candidate = chain[i];
+    const p = i === 0 ? provider : retargetProvider(provider, candidate);
+    try {
+      const result = await p.send(args);
+      return { result, modelUsed: candidate };
+    } catch (e) {
+      lastErr = e;
+      const isModelAccessFailure2 = e instanceof ProviderError && e.modelAccessFailure;
+      const hasMoreCandidates = i < chain.length - 1;
+      if (!isModelAccessFailure2 || !hasMoreCandidates) throw e;
+    }
+  }
+  throw lastErr;
+}
+
 // src/core/structured.ts
 async function requestStructured(provider, baseMessages, schema, opts) {
   const maxRetries = opts.maxRetries ?? 1;
@@ -2969,7 +3064,7 @@ async function askOne(provider, messages, opts) {
   const ceiling = operatorCeiling(opts.purpose, provider.name);
   if (ceiling !== null && ceiling < maxTokens) maxTokens = ceiling;
   try {
-    const r = await provider.send({
+    const { result: r, modelUsed } = await sendWithModelFallback(provider, {
       messages,
       maxTokens,
       temperature: opts.temperature,
@@ -2982,7 +3077,10 @@ async function askOne(provider, messages, opts) {
     const cpuMs = Math.trunc((cpu.user + cpu.system) / 1e3);
     return {
       provider: provider.name,
-      model: provider.model,
+      // modelUsed reflects whichever model actually answered — the
+      // primary, or a fallback if one was needed. Equivalent to the old
+      // `provider.model` whenever no fallback occurred.
+      model: modelUsed,
       response: r.text,
       attempts: r.attempts,
       usage: r.usage,
@@ -3029,8 +3127,8 @@ function isPersonaId(s) {
   return PERSONA_IDS.includes(s);
 }
 var personaConfig = null;
-function setPersonaConfig(cfg) {
-  personaConfig = cfg;
+function setPersonaConfig(cfg2) {
+  personaConfig = cfg2;
 }
 var processFirstCallConsumed = false;
 var sessionsSeen = /* @__PURE__ */ new Set();
@@ -3097,8 +3195,8 @@ function routePersona(prompt, toolName) {
   return { id: "engineering", scores };
 }
 function resolvePersona(opts) {
-  const cfg = opts.config ?? personaConfig;
-  if (cfg?.enabled === false) return { id: null, source: "disabled", bypassed: true };
+  const cfg2 = opts.config ?? personaConfig;
+  if (cfg2?.enabled === false) return { id: null, source: "disabled", bypassed: true };
   const explicit = opts.explicit?.trim().toLowerCase();
   if (explicit === "none" || explicit === "off") {
     return { id: null, source: "none", bypassed: true };
@@ -3144,12 +3242,12 @@ function readIfExists(p) {
   }
 }
 function loadPersonaBody(id, opts) {
-  const cfg = opts?.config ?? personaConfig;
-  const cacheKey = `${id}|${opts?.repoRoot ?? ""}|${cfg?.dir ?? ""}`;
+  const cfg2 = opts?.config ?? personaConfig;
+  const cacheKey = `${id}|${opts?.repoRoot ?? ""}|${cfg2?.dir ?? ""}`;
   const cached = bodyCache.get(cacheKey);
   if (cached !== void 0) return cached;
   const candidates = [];
-  if (cfg?.dir) candidates.push(import_node_path2.default.join(cfg.dir, `${id}.md`));
+  if (cfg2?.dir) candidates.push(import_node_path2.default.join(cfg2.dir, `${id}.md`));
   if (opts?.repoRoot) candidates.push(import_node_path2.default.join(opts.repoRoot, ".crosscheck", "personas", `${id}.md`));
   if (id === "engineering" && opts?.repoRoot) candidates.push(import_node_path2.default.join(opts.repoRoot, "CLAUDE.md"));
   const bundled = bundledPersonasDir();
@@ -3199,9 +3297,9 @@ function buildPersonaInjection(opts) {
 
 // src/core/utils.ts
 init_cjs_shims();
-function checkSessionBreakers(session, cfg) {
+function checkSessionBreakers(session, cfg2) {
   if (!session || typeof session !== "object") return null;
-  const c = cfg ?? {};
+  const c = cfg2 ?? {};
   const costCap = Number(c.max_session_cost_usd ?? 0);
   if (costCap > 0 && Number(session.total_cost_usd ?? 0) >= costCap) {
     return {
@@ -3225,10 +3323,10 @@ function checkSessionBreakers(session, cfg) {
   }
   return null;
 }
-function checkDagBreakers(dag, cfg) {
+function checkDagBreakers(dag, cfg2) {
   if (!dag || typeof dag !== "object") return null;
   const nodes = Array.isArray(dag.nodes) ? dag.nodes : [];
-  const c = cfg ?? {};
+  const c = cfg2 ?? {};
   const maxNodes = Math.trunc(Number(c.max_dag_nodes ?? 0));
   if (maxNodes > 0 && nodes.length > maxNodes) {
     return {
@@ -3313,8 +3411,8 @@ function breakerEnvelope(toolName, trip, sessionId) {
     transient: false
   };
 }
-async function maybeBreakerEnvelope(storage, sessionId, toolName, cfg, extras) {
-  if (!sessionId || !storage || !cfg) return null;
+async function maybeBreakerEnvelope(storage, sessionId, toolName, cfg2, extras) {
+  if (!sessionId || !storage || !cfg2) return null;
   let session;
   try {
     session = await storage.getSession(sessionId) ?? null;
@@ -3322,13 +3420,13 @@ async function maybeBreakerEnvelope(storage, sessionId, toolName, cfg, extras) {
     return null;
   }
   const target = extras && extras.length > 0 ? projectSessionWithAnswers(session, extras) : session;
-  const trip = checkSessionBreakers(target, cfg);
+  const trip = checkSessionBreakers(target, cfg2);
   if (!trip) return null;
   return breakerEnvelope(toolName, trip, sessionId);
 }
-function maybeDagBreakerEnvelope(dag, toolName, cfg, sessionId) {
-  if (!cfg) return null;
-  const trip = checkDagBreakers(dag ?? null, cfg);
+function maybeDagBreakerEnvelope(dag, toolName, cfg2, sessionId) {
+  if (!cfg2) return null;
+  const trip = checkDagBreakers(dag ?? null, cfg2);
   if (!trip) return null;
   return breakerEnvelope(toolName, trip, sessionId);
 }
@@ -3351,9 +3449,9 @@ function builtinRedactionRules() {
     { pattern: /\b(?:\d{4}[ -]?){3}\d{4}\b/g, label: "CARD", prefix_group: false }
   ];
 }
-function compileRules(cfg) {
+function compileRules(cfg2) {
   const rules = builtinRedactionRules();
-  const extras = cfg?.patterns_extra ?? [];
+  const extras = cfg2?.patterns_extra ?? [];
   for (const src of extras) {
     try {
       rules.push({ pattern: new RegExp(src, "g"), label: "EXTRA", prefix_group: false });
@@ -3362,25 +3460,25 @@ function compileRules(cfg) {
   }
   return { rules };
 }
-function hmacSuffix(cfg, label, value) {
-  const secret = cfg.hmac_secret ?? Buffer.alloc(0);
-  const sid = cfg.session_id ?? "";
+function hmacSuffix(cfg2, label, value) {
+  const secret = cfg2.hmac_secret ?? Buffer.alloc(0);
+  const sid = cfg2.session_id ?? "";
   const sidBytes = Buffer.from(sid, "utf8");
   const key = Buffer.concat([Buffer.from(secret), sidBytes]);
   const digest = (0, import_node_crypto2.createHmac)("sha256", key).update(`${label}:${value}`, "utf8").digest("hex");
   return digest.slice(0, 8);
 }
-function redactText(s, cfg) {
+function redactText(s, cfg2) {
   if (typeof s !== "string" || s.length === 0) return s;
-  if (cfg && cfg.enabled === false) return s;
-  const { rules } = compileRules(cfg);
-  const hmacMode = Boolean(cfg?.hmac_tokens);
+  if (cfg2 && cfg2.enabled === false) return s;
+  const { rules } = compileRules(cfg2);
+  const hmacMode = Boolean(cfg2?.hmac_tokens);
   let out = s;
   for (const { pattern, label, prefix_group } of rules) {
     pattern.lastIndex = 0;
     if (hmacMode) {
       out = out.replace(pattern, (match, ...args) => {
-        const suffix = hmacSuffix(cfg ?? {}, label, match);
+        const suffix = hmacSuffix(cfg2 ?? {}, label, match);
         const token = `[REDACTED_${label}:${suffix}]`;
         if (prefix_group) {
           const g1 = args[0];
@@ -3400,23 +3498,23 @@ function redactText(s, cfg) {
   }
   return out;
 }
-function redactObj(obj, cfg) {
-  if (typeof obj === "string") return redactText(obj, cfg);
+function redactObj(obj, cfg2) {
+  if (typeof obj === "string") return redactText(obj, cfg2);
   if (Array.isArray(obj)) {
-    return obj.map((v) => redactObj(v, cfg));
+    return obj.map((v) => redactObj(v, cfg2));
   }
   if (obj && typeof obj === "object") {
     const out = {};
     for (const [k, v] of Object.entries(obj)) {
-      out[k] = redactObj(v, cfg);
+      out[k] = redactObj(v, cfg2);
     }
     return out;
   }
   return obj;
 }
 var globalRedaction = null;
-function setRedactionConfig(cfg) {
-  globalRedaction = cfg;
+function setRedactionConfig(cfg2) {
+  globalRedaction = cfg2;
 }
 function getRedactionConfig() {
   return globalRedaction ?? void 0;
@@ -3703,32 +3801,6 @@ function numberOrNull(v) {
 // src/tools/audit.ts
 var import_node_perf_hooks = require("perf_hooks");
 
-// src/core/retarget.ts
-init_cjs_shims();
-function retargetProvider(p, newModel) {
-  if (p.model === newModel) return p;
-  return {
-    name: p.name,
-    model: newModel,
-    send: (args) => p.send({ ...args, modelOverride: newModel })
-  };
-}
-async function loadProviderWeights(storage, names) {
-  const out = {};
-  for (const raw of names) {
-    const name = raw.toLowerCase();
-    if (name in out) continue;
-    const row = await storage.getProviderStats(name);
-    if (!row) {
-      out[name] = 0.5;
-      continue;
-    }
-    const total = row.wins + row.losses + row.abstains;
-    out[name] = total <= 0 ? 0.5 : (row.wins + 0.5 * row.abstains) / total;
-  }
-  return out;
-}
-
 // src/core/co-reason.ts
 init_cjs_shims();
 var CO_REASON_MODEL = "gpt-5.6";
@@ -4692,8 +4764,8 @@ function neutralizeInjection(s) {
 
 // src/core/worker.ts
 var WORKER_TOOL_COST_CAP_MODES = ["warn", "enforce", "off"];
-function workerToolCostCapDefaults(callerCapUsd, callerMode, cfg) {
-  const cfgObj = cfg ?? {};
+function workerToolCostCapDefaults(callerCapUsd, callerMode, cfg2) {
+  const cfgObj = cfg2 ?? {};
   let capRaw = callerCapUsd !== void 0 && callerCapUsd !== null ? callerCapUsd : cfgObj.cost_cap_usd;
   let cap;
   if (capRaw === void 0 || capRaw === null) {
@@ -6304,7 +6376,7 @@ function tryKill(child, signal, isUnix) {
 init_cjs_shims();
 function shlexSplit(s) {
   const out = [];
-  let current = "";
+  let current2 = "";
   let hasCurrent = false;
   let mode = "normal";
   for (let i = 0; i < s.length; i++) {
@@ -6322,7 +6394,7 @@ function shlexSplit(s) {
       }
       if (ch === "\\") {
         if (i + 1 < s.length) {
-          current += s[i + 1];
+          current2 += s[i + 1];
           i++;
           hasCurrent = true;
         }
@@ -6330,13 +6402,13 @@ function shlexSplit(s) {
       }
       if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") {
         if (hasCurrent) {
-          out.push(current);
-          current = "";
+          out.push(current2);
+          current2 = "";
           hasCurrent = false;
         }
         continue;
       }
-      current += ch;
+      current2 += ch;
       hasCurrent = true;
       continue;
     }
@@ -6345,7 +6417,7 @@ function shlexSplit(s) {
         mode = "normal";
         continue;
       }
-      current += ch;
+      current2 += ch;
       continue;
     }
     if (mode === "double") {
@@ -6356,21 +6428,21 @@ function shlexSplit(s) {
       if (ch === "\\") {
         const nxt = s[i + 1];
         if (nxt === "$" || nxt === "`" || nxt === '"' || nxt === "\\" || nxt === "\n") {
-          current += nxt;
+          current2 += nxt;
           i++;
           continue;
         }
-        current += "\\";
+        current2 += "\\";
         continue;
       }
-      current += ch;
+      current2 += ch;
       continue;
     }
   }
   if (mode !== "normal") {
     throw new Error("unmatched quote");
   }
-  if (hasCurrent) out.push(current);
+  if (hasCurrent) out.push(current2);
   return out;
 }
 
@@ -7078,16 +7150,16 @@ function computeDrift(opts) {
   const absPath = resolvePinPath(opts);
   const doc = loadDoc(absPath);
   const pinned = doc && typeof doc === "object" && doc["pins"] && typeof doc["pins"] === "object" ? doc["pins"] : {};
-  const current = computeCurrent(opts);
+  const current2 = computeCurrent(opts);
   const drift = [];
   for (const [p, h] of Object.entries(pinned)) {
-    if (current[p] && current[p] !== h) drift.push(p);
+    if (current2[p] && current2[p] !== h) drift.push(p);
   }
-  const missingFromPin = Object.keys(current).filter((p) => !(p in pinned));
-  const missingFiles = Object.keys(pinned).filter((p) => !(p in current));
+  const missingFromPin = Object.keys(current2).filter((p) => !(p in pinned));
+  const missingFiles = Object.keys(pinned).filter((p) => !(p in current2));
   return {
     pinned,
-    current,
+    current: current2,
     drift: drift.sort(),
     missing_from_pin: missingFromPin.sort(),
     missing_files: missingFiles.sort(),
@@ -7372,19 +7444,19 @@ function sortKeyJsonifyTopLevel(json) {
   for (const k of Object.keys(obj).sort()) sorted[k] = obj[k];
   return JSON.stringify(sorted);
 }
-function resolveCacheDir(cfg, repoRoot) {
-  const raw = cfg.dir ?? ".crosscheck/node_cache";
+function resolveCacheDir(cfg2, repoRoot) {
+  const raw = cfg2.dir ?? ".crosscheck/node_cache";
   if ((0, import_node_path8.isAbsolute)(raw)) return raw;
   return (0, import_node_path8.resolve)(repoRoot ?? process.cwd(), raw);
 }
-function cachePath(cfg, repoRoot, key) {
-  return (0, import_node_path8.join)(resolveCacheDir(cfg, repoRoot), key.slice(0, 2), `${key}.json`);
+function cachePath(cfg2, repoRoot, key) {
+  return (0, import_node_path8.join)(resolveCacheDir(cfg2, repoRoot), key.slice(0, 2), `${key}.json`);
 }
-function getNodeCache(cfg, repoRoot, key, nowMs) {
-  if (!cfg || cfg.enabled === false) return null;
-  const p = cachePath(cfg, repoRoot, key);
+function getNodeCache(cfg2, repoRoot, key, nowMs) {
+  if (!cfg2 || cfg2.enabled === false) return null;
+  const p = cachePath(cfg2, repoRoot, key);
   if (!(0, import_node_fs8.existsSync)(p)) return null;
-  const ttlS = cfg.ttl_seconds ?? 604800;
+  const ttlS = cfg2.ttl_seconds ?? 604800;
   try {
     const st = (0, import_node_fs8.statSync)(p);
     if (ttlS > 0) {
@@ -7402,21 +7474,21 @@ function getNodeCache(cfg, repoRoot, key, nowMs) {
     return null;
   }
 }
-function atomicWriteJson(path14, payload) {
-  (0, import_node_fs8.mkdirSync)((0, import_node_path8.dirname)(path14), { recursive: true });
-  const tmp = `${path14}.${process.pid}.${Date.now()}.tmp`;
+function atomicWriteJson(path15, payload) {
+  (0, import_node_fs8.mkdirSync)((0, import_node_path8.dirname)(path15), { recursive: true });
+  const tmp = `${path15}.${process.pid}.${Date.now()}.tmp`;
   (0, import_node_fs8.writeFileSync)(tmp, JSON.stringify(payload), "utf8");
-  (0, import_node_fs8.renameSync)(tmp, path14);
+  (0, import_node_fs8.renameSync)(tmp, path15);
 }
-function putNodeCache(cfg, repoRoot, key, value) {
-  if (!cfg || cfg.enabled === false) return;
+function putNodeCache(cfg2, repoRoot, key, value) {
+  if (!cfg2 || cfg2.enabled === false) return;
   try {
-    const p = cachePath(cfg, repoRoot, key);
+    const p = cachePath(cfg2, repoRoot, key);
     atomicWriteJson(p, value);
-    const maxEntries = cfg.max_entries ?? 2e3;
-    const maxBytes = cfg.max_cache_bytes ?? 100 * 1024 * 1024;
+    const maxEntries = cfg2.max_entries ?? 2e3;
+    const maxBytes = cfg2.max_cache_bytes ?? 100 * 1024 * 1024;
     if (maxEntries <= 0 && maxBytes <= 0) return;
-    const base = resolveCacheDir(cfg, repoRoot);
+    const base = resolveCacheDir(cfg2, repoRoot);
     if (!(0, import_node_fs8.existsSync)(base)) return;
     const entries = [];
     let totalBytes = 0;
@@ -8534,31 +8606,31 @@ async function runFetch(args, opts) {
   const url = String(args["url"] ?? "");
   const force = Boolean(args["force_refresh"]);
   const sessionId = typeof args["session_id"] === "string" ? args["session_id"] : null;
-  const cfg = { ...DEFAULT_CONFIG, ...opts.config ?? {} };
+  const cfg2 = { ...DEFAULT_CONFIG, ...opts.config ?? {} };
   const base = { tool: "fetch", url };
-  if (!cfg.enabled) {
+  if (!cfg2.enabled) {
     return { ...base, accepted: false, reason: "fetch is disabled" };
   }
   if (!(url.startsWith("https://") || url.startsWith("http://"))) {
     return { ...base, accepted: false, reason: "only http/https schemes are supported" };
   }
-  if (cfg.url_allowlist.length === 0) {
+  if (cfg2.url_allowlist.length === 0) {
     return {
       ...base,
       accepted: false,
       reason: "fetch.url_allowlist is empty; no URLs may be fetched"
     };
   }
-  if (!isUrlAllowed(url, cfg.url_allowlist)) {
+  if (!isUrlAllowed(url, cfg2.url_allowlist)) {
     return {
       ...base,
       accepted: false,
       reason: "url is not covered by fetch.url_allowlist",
-      allowlist: cfg.url_allowlist
+      allowlist: cfg2.url_allowlist
     };
   }
-  const maxBytesSession = Math.max(0, cfg.max_bytes_per_session);
-  const maxUniqueHosts = Math.max(0, cfg.max_unique_hosts_per_session);
+  const maxBytesSession = Math.max(0, cfg2.max_bytes_per_session);
+  const maxUniqueHosts = Math.max(0, cfg2.max_unique_hosts_per_session);
   const host = extractHost(url);
   if (sessionId && opts.storage && (maxBytesSession > 0 || maxUniqueHosts > 0)) {
     const { total_bytes, unique_hosts } = await opts.storage.getFetchEgressTotals(sessionId);
@@ -8598,7 +8670,7 @@ async function runFetch(args, opts) {
       }
     }
   }
-  const evDir = resolveEvidenceDir(cfg.evidence_dir, opts.repoRoot);
+  const evDir = resolveEvidenceDir(cfg2.evidence_dir, opts.repoRoot);
   const urlHash16 = sha256Hex2(url).slice(0, 16);
   const metaPath = import_node_path9.default.join(evDir, `by-url-${urlHash16}.json`);
   if ((0, import_node_fs9.existsSync)(metaPath) && !force) {
@@ -8620,7 +8692,7 @@ async function runFetch(args, opts) {
   try {
     response = await withTimeout(
       fetchFn(url, { headers: { "User-Agent": "crosscheck-agent/0.1" } }),
-      cfg.timeout_s * 1e3
+      cfg2.timeout_s * 1e3
     );
   } catch (e) {
     return {
@@ -8646,8 +8718,8 @@ async function runFetch(args, opts) {
     const reader = response.body?.getReader?.();
     if (!reader) {
       const buf = await response.arrayBuffer();
-      if (buf.byteLength > cfg.max_bytes) {
-        return { ...base, accepted: false, reason: `response exceeds max_bytes=${cfg.max_bytes}` };
+      if (buf.byteLength > cfg2.max_bytes) {
+        return { ...base, accepted: false, reason: `response exceeds max_bytes=${cfg2.max_bytes}` };
       }
       data = new Uint8Array(buf);
     } else {
@@ -8659,7 +8731,7 @@ async function runFetch(args, opts) {
         if (done) break;
         if (value) {
           total += value.byteLength;
-          if (total > cfg.max_bytes) {
+          if (total > cfg2.max_bytes) {
             exceeded = true;
             await reader.cancel().catch(() => {
             });
@@ -8669,7 +8741,7 @@ async function runFetch(args, opts) {
         }
       }
       if (exceeded) {
-        return { ...base, accepted: false, reason: `response exceeds max_bytes=${cfg.max_bytes}` };
+        return { ...base, accepted: false, reason: `response exceeds max_bytes=${cfg2.max_bytes}` };
       }
       data = new Uint8Array(total);
       let offset = 0;
@@ -12523,15 +12595,15 @@ var CHECK_INTERVAL_SECONDS = 3 * 24 * 60 * 60;
 var DEFAULT_PACKAGE = "crosscheck-cli";
 var FETCH_TIMEOUT_MS = 3e3;
 function engineVersion() {
-  return true ? "0.2.14" : "0.0.0-dev";
+  return true ? "0.2.16" : "0.0.0-dev";
 }
 function defaultUpdateCachePath() {
   const base = process.env["CROSSCHECK_DATA_DIR"] || import_node_path13.default.join(import_node_os2.default.homedir() || import_node_os2.default.tmpdir(), ".crosscheck");
   return import_node_path13.default.join(base, "update_check.json");
 }
-function isNewer(latest, current) {
+function isNewer(latest, current2) {
   const a = parseTriple(latest);
-  const b = parseTriple(current);
+  const b = parseTriple(current2);
   for (let i = 0; i < 3; i += 1) {
     if (a[i] !== b[i]) return a[i] > b[i];
   }
@@ -12541,13 +12613,13 @@ function parseTriple(v) {
   const parts = (v.split("-")[0] ?? "").split(".").map((n) => Number.parseInt(n, 10) || 0);
   return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
 }
-function buildNotice(pkg, current, latest) {
+function buildNotice(pkg, current2, latest) {
   return {
     update_available: true,
     package: pkg,
-    current_version: current,
+    current_version: current2,
     latest_version: latest,
-    message: `crosscheck ${latest} is available \u2014 you're on ${current}. To upgrade, run:
+    message: `crosscheck ${latest} is available \u2014 you're on ${current2}. To upgrade, run:
 
     npm install -g crosscheck-cli@latest
 
@@ -14234,13 +14306,214 @@ function attachUpdateNotice(result, toolName, opts) {
 
 // src/core/telemetry.ts
 init_cjs_shims();
+var import_node_crypto10 = __toESM(require("crypto"), 1);
+
+// src/core/segments.ts
+init_cjs_shims();
+var import_node_crypto9 = __toESM(require("crypto"), 1);
+var import_node_fs17 = require("fs");
+var import_node_path16 = __toESM(require("path"), 1);
+
+// src/core/git-context.ts
+init_cjs_shims();
+var import_node_child_process3 = require("child_process");
 var import_node_crypto8 = __toESM(require("crypto"), 1);
+var TRUNK_BRANCHES = /* @__PURE__ */ new Set([
+  "main",
+  "master",
+  "dev",
+  "develop",
+  "trunk"
+]);
+function git(args, cwd) {
+  try {
+    return (0, import_node_child_process3.execFileSync)("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function repoIdentity(cwd) {
+  const root = git(["rev-list", "--max-parents=0", "HEAD"], cwd);
+  if (root) return `root:${root.split("\n").pop().trim()}`;
+  const remote = git(["config", "--get", "remote.origin.url"], cwd);
+  if (remote) return `remote:${remote}`;
+  const top = git(["rev-parse", "--show-toplevel"], cwd);
+  return top ? `path:${top}` : null;
+}
+function fingerprintOf(seatKey, parts) {
+  return import_node_crypto8.default.createHmac("sha256", seatKey).update(parts.join("\0")).digest("hex");
+}
+function readGitContext(seatKey, cwd) {
+  try {
+    const inside = git(["rev-parse", "--is-inside-work-tree"], cwd);
+    if (inside !== "true") return { signal: "no_repo" };
+    const repo = repoIdentity(cwd);
+    if (!repo) return { signal: "no_repo" };
+    const branch = git(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
+    if (!branch || branch === "HEAD") {
+      const wt = git(["rev-parse", "--show-toplevel"], cwd) ?? cwd;
+      return {
+        fingerprint: fingerprintOf(seatKey, [repo, "worktree", wt]),
+        signal: "worktree",
+        localLabel: `worktree:${wt}`
+      };
+    }
+    if (TRUNK_BRANCHES.has(branch)) {
+      return {
+        fingerprint: fingerprintOf(seatKey, [repo, "trunk"]),
+        signal: "trunk",
+        localLabel: `${branch} (maintenance)`
+      };
+    }
+    return {
+      fingerprint: fingerprintOf(seatKey, [repo, "branch", branch]),
+      signal: "branch",
+      localLabel: branch
+    };
+  } catch {
+    return { signal: "no_repo" };
+  }
+}
+function sameContext(a, b) {
+  return a.fingerprint === b.fingerprint && a.signal === b.signal;
+}
+
+// src/core/segments.ts
+var POST_TIMEOUT_MS = 5e3;
+function canonicalSegmentBody(s) {
+  return [
+    s.segmentId,
+    s.seatId,
+    s.orgId,
+    s.sessionId,
+    String(s.seq),
+    s.fingerprint ?? "",
+    s.signal,
+    s.startedAt,
+    s.endedAt ?? ""
+  ].join("|");
+}
+function signSegment(seatKey, s) {
+  return import_node_crypto9.default.createHmac("sha256", seatKey).update(canonicalSegmentBody(s)).digest("hex");
+}
+var cfgResolved = false;
+var cfg = null;
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function getConfig() {
+  if (cfgResolved) return cfg;
+  cfgResolved = true;
+  if (process.env["CROSSCHECK_TELEMETRY"] === "off") return cfg = null;
+  const base = process.env["CROSSCHECK_TELEMETRY_URL"];
+  const seatId = process.env["CROSSCHECK_SEAT_ID"];
+  const orgId = process.env["CROSSCHECK_ORG_ID"];
+  const seatKey = process.env["CROSSCHECK_SEAT_HMAC_KEY"];
+  if (!base || !seatId || !orgId || !seatKey) return cfg = null;
+  if (!UUID_RE.test(seatId) || !UUID_RE.test(orgId)) return cfg = null;
+  const sessionId = process.env["CLAUDE_SESSION_ID"] || process.env["CLAUDE_CODE_SESSION_ID"] || `engine-${import_node_crypto9.default.randomUUID()}`;
+  cfg = {
+    url: base.replace(/\/telemetry\/?$/, "/segments"),
+    seatId,
+    orgId,
+    seatKey,
+    sessionId
+  };
+  return cfg;
+}
+var current = null;
+var nextSeq = 0;
+function currentFingerprint() {
+  return current?.context.fingerprint;
+}
+function rememberLabel(context) {
+  if (!context.fingerprint || !context.localLabel) return;
+  try {
+    const dir = process.env["CROSSCHECK_DATA_DIR"] || import_node_path16.default.join(process.env["HOME"] ?? process.env["USERPROFILE"] ?? ".", ".crosscheck");
+    const file = import_node_path16.default.join(dir, "features.json");
+    let map = {};
+    if ((0, import_node_fs17.existsSync)(file)) {
+      try {
+        const parsed = JSON.parse((0, import_node_fs17.readFileSync)(file, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) map = parsed;
+      } catch {
+      }
+    }
+    map[context.fingerprint] = {
+      label: context.localLabel,
+      lastSeen: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    (0, import_node_fs17.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs17.writeFileSync)(file, `${JSON.stringify(map, null, 2)}
+`, "utf8");
+  } catch {
+  }
+}
+async function post(url, segments) {
+  try {
+    await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ segments }),
+      signal: AbortSignal.timeout(POST_TIMEOUT_MS)
+    });
+  } catch {
+  }
+}
+function emit(c, seg, endedAt) {
+  const payload = {
+    segmentId: seg.segmentId,
+    seatId: c.seatId,
+    orgId: c.orgId,
+    sessionId: c.sessionId,
+    seq: seg.seq,
+    ...seg.context.fingerprint ? { fingerprint: seg.context.fingerprint } : {},
+    signal: seg.context.signal,
+    startedAt: seg.startedAt,
+    ...endedAt ? { endedAt } : {}
+  };
+  const signatureHmac = signSegment(c.seatKey, payload);
+  void post(c.url, [{ ...payload, signatureHmac }]);
+}
+function syncSegment(cwd) {
+  try {
+    const c = getConfig();
+    if (!c) return;
+    const context = readGitContext(c.seatKey, cwd ?? process.cwd());
+    if (current && sameContext(current.context, context)) return;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (current) emit(c, current, now);
+    current = {
+      segmentId: import_node_crypto9.default.randomUUID(),
+      seq: nextSeq++,
+      context,
+      startedAt: now
+    };
+    rememberLabel(context);
+    emit(c, current);
+  } catch {
+  }
+}
+function closeSegment() {
+  try {
+    const c = getConfig();
+    if (!c || !current) return;
+    emit(c, current, (/* @__PURE__ */ new Date()).toISOString());
+    current = null;
+  } catch {
+  }
+}
+
+// src/core/telemetry.ts
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var BATCH_MAX = 100;
 var FLUSH_BATCH_AT = 25;
 var FLUSH_INTERVAL_MS = 15e3;
 var MAX_QUEUE = 500;
-var POST_TIMEOUT_MS = 5e3;
+var POST_TIMEOUT_MS2 = 5e3;
 var PROVIDER_TO_SCHEMA = {
   anthropic: "anthropic",
   openai: "openai",
@@ -14270,7 +14543,7 @@ function toolToPattern(toolName) {
   return TOOL_TO_PATTERN[String(toolName).toLowerCase()] ?? "other";
 }
 function canonicalEventBody(e) {
-  return [
+  const base = [
     e.eventId,
     e.seatId,
     e.orgId,
@@ -14285,13 +14558,22 @@ function canonicalEventBody(e) {
     e.status,
     e.errorClass ?? ""
   ].join("|");
+  if (e.runId === void 0 && e.purpose === void 0 && e.fingerprint === void 0) {
+    return base;
+  }
+  return [base, e.runId ?? "", e.purpose ?? "", e.fingerprint ?? ""].join("|");
+}
+function normalizePurpose(v) {
+  if (typeof v !== "string") return void 0;
+  const slug = v.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "-").slice(0, 32);
+  return /^[a-z0-9][a-z0-9_-]*$/.test(slug) ? slug : void 0;
 }
 function signEvent(seatSigningKey, e) {
-  return import_node_crypto8.default.createHmac("sha256", seatSigningKey).update(canonicalEventBody(e)).digest("hex");
+  return import_node_crypto10.default.createHmac("sha256", seatSigningKey).update(canonicalEventBody(e)).digest("hex");
 }
 var configResolved = false;
 var config = null;
-function getConfig() {
+function getConfig2() {
   if (configResolved) return config;
   configResolved = true;
   if (process.env["CROSSCHECK_TELEMETRY"] === "off") return config = null;
@@ -14300,7 +14582,7 @@ function getConfig() {
   const orgId = process.env["CROSSCHECK_ORG_ID"];
   const seatKey = process.env["CROSSCHECK_SEAT_HMAC_KEY"];
   if (!url || !seatId || !orgId || !seatKey) return config = null;
-  if (!UUID_RE.test(seatId) || !UUID_RE.test(orgId)) return config = null;
+  if (!UUID_RE2.test(seatId) || !UUID_RE2.test(orgId)) return config = null;
   config = { url, seatId, orgId, seatKey };
   return config;
 }
@@ -14335,7 +14617,10 @@ function usageEventsFromEnvelope(out, toolName) {
       completionTokens: intNonNeg(u.completion_tokens),
       costUsdEstimate: cost,
       latencyMs,
-      status: "ok"
+      status: "ok",
+      // Envelopes have carried `purpose` per call all along (debate /
+      // debate-coreason / synth / worker); it just was never forwarded.
+      purpose: normalizePurpose(u.purpose)
     });
   }
   return events;
@@ -14350,11 +14635,11 @@ function scheduleFlush() {
   }, FLUSH_INTERVAL_MS);
   if (typeof flushTimer.unref === "function") flushTimer.unref();
 }
-function enqueue(cfg, input) {
+function enqueue(cfg2, input, runId, fingerprint) {
   const base = {
-    eventId: import_node_crypto8.default.randomUUID(),
-    seatId: cfg.seatId,
-    orgId: cfg.orgId,
+    eventId: import_node_crypto10.default.randomUUID(),
+    seatId: cfg2.seatId,
+    orgId: cfg2.orgId,
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     provider: input.provider,
     model: input.model,
@@ -14363,9 +14648,17 @@ function enqueue(cfg, input) {
     completionTokens: input.completionTokens,
     costUsdEstimate: input.costUsdEstimate,
     latencyMs: input.latencyMs,
-    status: input.status
-  };
-  const signatureHmac = signEvent(cfg.seatKey, base);
+    status: input.status,
+    runId,
+    // Omit entirely (not "") when unknown, so the canonical body stays
+    // consistent with what the server reconstructs from the JSON.
+    ...input.purpose === void 0 ? {} : { purpose: input.purpose },
+    // Panel attribution is EXACT: we know the active git segment at emit
+    // time, so there is no time-join and no ambiguity window — unlike host
+    // tokens, which can only be matched by session and timestamp.
+    ...fingerprint === void 0 ? {} : { fingerprint }
+  };
+  const signatureHmac = signEvent(cfg2.seatKey, base);
   queue.push({ ...base, signatureHmac });
   if (queue.length > MAX_QUEUE) queue.splice(0, queue.length - MAX_QUEUE);
   if (queue.length >= FLUSH_BATCH_AT) void flush();
@@ -14373,10 +14666,14 @@ function enqueue(cfg, input) {
 }
 function recordUsage(out, toolName) {
   try {
-    const cfg = getConfig();
-    if (!cfg) return;
+    const cfg2 = getConfig2();
+    if (!cfg2) return;
     if (toolName === "update_crosscheck") return;
-    for (const ev of usageEventsFromEnvelope(out, toolName)) enqueue(cfg, ev);
+    const runId = import_node_crypto10.default.randomUUID();
+    const fingerprint = currentFingerprint();
+    for (const ev of usageEventsFromEnvelope(out, toolName)) {
+      enqueue(cfg2, ev, runId, fingerprint);
+    }
   } catch {
   }
 }
@@ -14387,7 +14684,7 @@ async function postBatch(url, batch) {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ events: batch }),
-      signal: AbortSignal.timeout(POST_TIMEOUT_MS)
+      signal: AbortSignal.timeout(POST_TIMEOUT_MS2)
     });
   } catch {
     queue.unshift(...batch);
@@ -14409,15 +14706,15 @@ async function postBatch(url, batch) {
   if (queue.length > MAX_QUEUE) queue.splice(0, queue.length - MAX_QUEUE);
 }
 async function flush() {
-  const cfg = getConfig();
-  if (!cfg) return;
+  const cfg2 = getConfig2();
+  if (!cfg2) return;
   if (flushTimer) {
     clearTimeout(flushTimer);
     flushTimer = null;
   }
   while (queue.length > 0) {
     const batch = queue.splice(0, BATCH_MAX);
-    await postBatch(cfg.url, batch);
+    await postBatch(cfg2.url, batch);
     if (queue.length > 0 && queue[0] === batch[0]) break;
   }
 }
@@ -14457,14 +14754,14 @@ function createServer(opts = {}) {
     });
   };
   const tools = buildToolRegistry(opts);
-  server.setRequestHandler(import_types8.ListToolsRequestSchema, async () => ({
+  server.setRequestHandler(import_types9.ListToolsRequestSchema, async () => ({
     tools: Array.from(tools.values()).map((t) => ({
       name: t.name,
       description: t.description,
       inputSchema: t.inputSchema
     }))
   }));
-  server.setRequestHandler(import_types8.CallToolRequestSchema, async (req) => {
+  server.setRequestHandler(import_types9.CallToolRequestSchema, async (req) => {
     const name = req.params.name;
     const tool = tools.get(name);
     if (!tool) {
@@ -14485,6 +14782,7 @@ function createServer(opts = {}) {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const startedHr = process.hrtime.bigint();
     const id = nextEventId();
+    syncSegment(opts.repoRoot);
     const gateBlock = configPinGate(name, {
       ...opts.repoRoot ? { repoRoot: opts.repoRoot } : {},
       ...opts.configPinning ? { config: opts.configPinning } : {},
@@ -14566,6 +14864,13 @@ function createServer(opts = {}) {
 async function connectAndServe(transport, opts = {}) {
   const server = createServer(opts);
   await server.connect(transport);
+  for (const sig of ["SIGINT", "SIGTERM"]) {
+    process.once(sig, () => {
+      closeSegment();
+      process.exit(0);
+    });
+  }
+  process.once("beforeExit", () => closeSegment());
   const cliVersion = process.env["CROSSCHECK_CLI_VERSION"];
   void maybeCheckForUpdate({
     currentVersion: cliVersion ?? SERVER_VERSION,
@@ -14603,9 +14908,9 @@ function buildToolRegistry(opts) {
 
 // src/core/config-file.ts
 init_cjs_shims();
-var import_node_fs17 = require("fs");
-var import_node_path16 = __toESM(require("path"), 1);
-var import_node_crypto9 = require("crypto");
+var import_node_fs18 = require("fs");
+var import_node_path17 = __toESM(require("path"), 1);
+var import_node_crypto11 = require("crypto");
 function asObj(v) {
   return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 }
@@ -14632,18 +14937,18 @@ function pickNums(src, keys) {
 }
 function findConfigFile(opts) {
   const direct = opts.explicitPath ?? process.env["CROSSCHECK_CONFIG_PATH"];
-  if (direct) return (0, import_node_fs17.existsSync)(direct) ? direct : void 0;
+  if (direct) return (0, import_node_fs18.existsSync)(direct) ? direct : void 0;
   const candidates = [];
   let dir = opts.startDir;
   for (let i = 0; dir && i < 8; i += 1) {
-    candidates.push(import_node_path16.default.join(dir, "crosscheck.config.json"));
-    const parent = import_node_path16.default.dirname(dir);
+    candidates.push(import_node_path17.default.join(dir, "crosscheck.config.json"));
+    const parent = import_node_path17.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  if (opts.repoRoot) candidates.push(import_node_path16.default.join(opts.repoRoot, "crosscheck.config.json"));
-  if (opts.dataDir) candidates.push(import_node_path16.default.join(opts.dataDir, "crosscheck.config.json"));
-  return candidates.find((p) => (0, import_node_fs17.existsSync)(p));
+  if (opts.repoRoot) candidates.push(import_node_path17.default.join(opts.repoRoot, "crosscheck.config.json"));
+  if (opts.dataDir) candidates.push(import_node_path17.default.join(opts.dataDir, "crosscheck.config.json"));
+  return candidates.find((p) => (0, import_node_fs18.existsSync)(p));
 }
 function mapConfig(raw, sourcePath) {
   const result = { sourcePath };
@@ -14660,16 +14965,16 @@ function mapConfig(raw, sourcePath) {
   }
   const nc = asObj(raw["node_cache"]);
   if (nc) {
-    const cfg = {
+    const cfg2 = {
       ...pickNums(nc, ["ttl_seconds", "max_entries", "max_cache_bytes"])
     };
-    if (bool(nc["enabled"]) !== void 0) cfg.enabled = bool(nc["enabled"]);
-    if (str(nc["dir"]) !== void 0) cfg.dir = str(nc["dir"]);
-    result.nodeCache = cfg;
+    if (bool(nc["enabled"]) !== void 0) cfg2.enabled = bool(nc["enabled"]);
+    if (str(nc["dir"]) !== void 0) cfg2.dir = str(nc["dir"]);
+    result.nodeCache = cfg2;
   }
   const f = asObj(raw["fetch"]);
   if (f) {
-    const cfg = {
+    const cfg2 = {
       ...pickNums(f, [
         "max_bytes",
         "max_bytes_per_session",
@@ -14677,10 +14982,10 @@ function mapConfig(raw, sourcePath) {
         "timeout_s"
       ])
     };
-    if (bool(f["enabled"]) !== void 0) cfg.enabled = bool(f["enabled"]);
-    if (strArr(f["url_allowlist"]) !== void 0) cfg.url_allowlist = strArr(f["url_allowlist"]);
-    if (str(f["evidence_dir"]) !== void 0) cfg.evidence_dir = str(f["evidence_dir"]);
-    result.fetchConfig = cfg;
+    if (bool(f["enabled"]) !== void 0) cfg2.enabled = bool(f["enabled"]);
+    if (strArr(f["url_allowlist"]) !== void 0) cfg2.url_allowlist = strArr(f["url_allowlist"]);
+    if (str(f["evidence_dir"]) !== void 0) cfg2.evidence_dir = str(f["evidence_dir"]);
+    result.fetchConfig = cfg2;
   }
   if ("provider_allowlist" in raw) {
     const pa = raw["provider_allowlist"];
@@ -14704,10 +15009,10 @@ function mapConfig(raw, sourcePath) {
   if (retries) {
     const maxAttempts = num(retries["max_attempts"]);
     const baseS = num(retries["backoff_base_s"]);
-    const cfg = {};
-    if (maxAttempts !== void 0) cfg.maxAttempts = Math.max(1, Math.trunc(maxAttempts));
-    if (baseS !== void 0) cfg.backoffBaseMs = Math.round(baseS * 1e3);
-    if (Object.keys(cfg).length > 0) setRetryConfig(cfg);
+    const cfg2 = {};
+    if (maxAttempts !== void 0) cfg2.maxAttempts = Math.max(1, Math.trunc(maxAttempts));
+    if (baseS !== void 0) cfg2.backoffBaseMs = Math.round(baseS * 1e3);
+    if (Object.keys(cfg2).length > 0) setRetryConfig(cfg2);
   }
   const rl = asObj(raw["rate_limits"]);
   if (rl) {
@@ -14733,22 +15038,22 @@ function mapConfig(raw, sourcePath) {
   }
   const red = asObj(raw["redaction"]);
   if (red) {
-    const cfg = {};
-    if (bool(red["enabled"]) !== void 0) cfg.enabled = bool(red["enabled"]);
+    const cfg2 = {};
+    if (bool(red["enabled"]) !== void 0) cfg2.enabled = bool(red["enabled"]);
     const extras = strArr(red["patterns_extra"]);
-    if (extras && extras.length > 0) cfg.patterns_extra = extras;
+    if (extras && extras.length > 0) cfg2.patterns_extra = extras;
     if (bool(red["hmac_tokens"]) === true) {
-      cfg.hmac_tokens = true;
-      cfg.hmac_secret = (0, import_node_crypto9.randomBytes)(32);
+      cfg2.hmac_tokens = true;
+      cfg2.hmac_secret = (0, import_node_crypto11.randomBytes)(32);
     }
-    if (Object.keys(cfg).length > 0) setRedactionConfig(cfg);
+    if (Object.keys(cfg2).length > 0) setRedactionConfig(cfg2);
   }
   const personas = asObj(raw["personas"]);
   if (personas) {
-    const cfg = {};
-    if (bool(personas["enabled"]) !== void 0) cfg.enabled = bool(personas["enabled"]);
-    if (str(personas["dir"]) !== void 0) cfg.dir = str(personas["dir"]);
-    if (Object.keys(cfg).length > 0) setPersonaConfig(cfg);
+    const cfg2 = {};
+    if (bool(personas["enabled"]) !== void 0) cfg2.enabled = bool(personas["enabled"]);
+    if (str(personas["dir"]) !== void 0) cfg2.dir = str(personas["dir"]);
+    if (Object.keys(cfg2).length > 0) setPersonaConfig(cfg2);
   }
   return result;
 }
@@ -14757,7 +15062,7 @@ function loadConfigFile(opts) {
   if (!file) return null;
   let raw;
   try {
-    raw = JSON.parse((0, import_node_fs17.readFileSync)(file, "utf8"));
+    raw = JSON.parse((0, import_node_fs18.readFileSync)(file, "utf8"));
   } catch (e) {
     try {
       process.stderr.write(
@@ -14777,7 +15082,7 @@ function loadConfigFile(opts) {
 var SHUTDOWN_TIMEOUT_MS = 2e3;
 async function main() {
   enforceLicenseOrExit();
-  const cfgDataDir = process.env["CROSSCHECK_DATA_DIR"] || import_node_path17.default.join(process.env["HOME"] ?? process.env["USERPROFILE"] ?? "", ".crosscheck");
+  const cfgDataDir = process.env["CROSSCHECK_DATA_DIR"] || import_node_path18.default.join(process.env["HOME"] ?? process.env["USERPROFILE"] ?? "", ".crosscheck");
   const configFile = loadConfigFile({
     startDir: process.cwd(),
     repoRoot: findGitRoot(__dirname),
@@ -14802,7 +15107,7 @@ async function main() {
   installShutdownHandlers();
   const bundledPricing = (() => {
     try {
-      return import_node_path17.default.join(import_node_path17.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl)), "pricing.json");
+      return import_node_path18.default.join(import_node_path18.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl)), "pricing.json");
     } catch {
       return void 0;
     }
@@ -14811,7 +15116,7 @@ async function main() {
     process.env["CROSSCHECK_PRICING_PATH"],
     resolveRepoFile("config/pricing.json"),
     bundledPricing
-  ].find((p) => p && (0, import_node_fs18.existsSync)(p));
+  ].find((p) => p && (0, import_node_fs19.existsSync)(p));
   const pricing = pricingPath ? loadPricing(pricingPath) : {};
   const providers = buildProviders({ env: process.env, pricing });
   if (Object.keys(providers).length > 0) {
@@ -14829,10 +15134,10 @@ async function main() {
   }
   let storage;
   if (process.env["CROSSCHECK_DB_DISABLED"] !== "1") {
-    const dbPath = process.env["CROSSCHECK_DB_PATH"] ?? resolveRepoFile(".crosscheck/db.sqlite") ?? import_node_path17.default.join(cfgDataDir, "db.sqlite");
+    const dbPath = process.env["CROSSCHECK_DB_PATH"] ?? resolveRepoFile(".crosscheck/db.sqlite") ?? import_node_path18.default.join(cfgDataDir, "db.sqlite");
     if (dbPath) {
       try {
-        (0, import_node_fs18.mkdirSync)(import_node_path17.default.dirname(dbPath), { recursive: true });
+        (0, import_node_fs19.mkdirSync)(import_node_path18.default.dirname(dbPath), { recursive: true });
         const { openBetterSqliteStorage: openBetterSqliteStorage2 } = await Promise.resolve().then(() => (init_better_sqlite3(), better_sqlite3_exports));
         storage = openBetterSqliteStorage2({ path: dbPath });
         await storage.migrate();
@@ -14900,9 +15205,9 @@ function installShutdownHandlers() {
 function resolveRepoFile(rel) {
   let dir = __dirname;
   for (let i = 0; i < 8; i++) {
-    const candidate = import_node_path17.default.join(dir, rel);
-    if ((0, import_node_fs18.existsSync)(candidate)) return candidate;
-    const parent = import_node_path17.default.dirname(dir);
+    const candidate = import_node_path18.default.join(dir, rel);
+    if ((0, import_node_fs19.existsSync)(candidate)) return candidate;
+    const parent = import_node_path18.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -14911,8 +15216,8 @@ function resolveRepoFile(rel) {
 function findGitRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 12; i++) {
-    if ((0, import_node_fs18.existsSync)(import_node_path17.default.join(dir, ".git"))) return dir;
-    const parent = import_node_path17.default.dirname(dir);
+    if ((0, import_node_fs19.existsSync)(import_node_path18.default.join(dir, ".git"))) return dir;
+    const parent = import_node_path18.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }