flatbread-cli 0.1.0 → 0.2.0

package/dist/flatbread.mjs

@@ -6,10 +6,10 @@ var __export = (target, all) => {
 };
 
 // src/index.ts
-import { spawn as spawn2 } from "node:child_process";
-import fs19 from "node:fs";
+import { spawn as spawn3 } from "node:child_process";
+import fs21 from "node:fs";
 import os7 from "node:os";
-import path18 from "node:path";
+import path20 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../../node_modules/zod/v3/external.js
@@ -490,8 +490,8 @@ function getErrorMap() {
 
 // ../../node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path19, errorMaps, issueData } = params;
-  const fullPath = [...path19, ...issueData.path || []];
+  const { data, path: path21, errorMaps, issueData } = params;
+  const fullPath = [...path21, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -607,11 +607,11 @@ var errorUtil;
 
 // ../../node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path19, key) {
+  constructor(parent, value, path21, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path19;
+    this._path = path21;
     this._key = key;
   }
   get path() {
@@ -4340,6 +4340,15 @@ var VERDICT_WORDS = {
   "not-rerun": { short: "not re-run", phrase: "no test after the last edit" },
   "no-edits": { short: "no edits", phrase: null }
 };
+function treeWords(lineage) {
+  if (lineage?.dirtyFiles === void 0) return null;
+  const total = lineage.dirtyFiles.length + (lineage.dirtyFilesOmitted ?? 0);
+  if (lineage.commitNamed === true) {
+    if (total === 0) return "clean at that commit";
+    return total === 1 ? "1 file differs from that commit" : `${total} files differ from that commit`;
+  }
+  return total === 0 ? "clean tree" : `${total} uncommitted file${total === 1 ? "" : "s"}`;
+}
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -4375,8 +4384,8 @@ function firstLine(text2) {
 function labelOf(step, cwd) {
   const tool = step.tool;
   if (tool === void 0) return step.type;
-  const path19 = firstString(tool.input, FILE_PATH_KEYS);
-  if (path19 !== void 0) return `${tool.name} ${repoRelative(path19, cwd)}`;
+  const path21 = firstString(tool.input, FILE_PATH_KEYS);
+  if (path21 !== void 0) return `${tool.name} ${repoRelative(path21, cwd)}`;
   const other = firstString(tool.input, TARGET_KEYS);
   if (other !== void 0) return cut(`${tool.name}: ${repoRelative(firstLine(other), cwd)}`, BRIEF_LIMITS.quote);
   return tool.name;
@@ -4624,9 +4633,9 @@ function runDiagnostics(trace) {
       searches.set(key, found);
     }
   }
-  for (const [path19, entries] of reads) {
+  for (const [path21, entries] of reads) {
     const hit = densest(entries, WASTE_RULES.repeatedRead.times, WASTE_RULES.repeatedRead.windowMinutes * 6e4);
-    if (hit) waste.push({ kind: "repeated-read", path: path19, steps: hit, windowMinutes: WASTE_RULES.repeatedRead.windowMinutes });
+    if (hit) waste.push({ kind: "repeated-read", path: path21, steps: hit, windowMinutes: WASTE_RULES.repeatedRead.windowMinutes });
   }
   for (const { label, entries } of searches.values()) {
     const hit = densest(entries, WASTE_RULES.repeatedSearch.times, WASTE_RULES.repeatedSearch.windowMinutes * 6e4);
@@ -4704,19 +4713,19 @@ function filesOf(steps, cwd) {
   const patches = [];
   steps.forEach((step, index) => {
     if (!isSuccessfulEdit(step) || step.tool === void 0) return;
-    const path19 = repoRelative(firstString(step.tool.input, FILE_PATH_KEYS), cwd);
-    const file = files.get(path19) ?? { path: path19 };
+    const path21 = repoRelative(firstString(step.tool.input, FILE_PATH_KEYS), cwd);
+    const file = files.get(path21) ?? { path: path21 };
     if (step.diff !== void 0) {
       const counted = countPatch(step.diff.patch);
       file.added = (file.added ?? 0) + counted.added;
       file.removed = (file.removed ?? 0) + counted.removed;
-      patches.push({ path: path19, patch: repoRelative(step.diff.patch, cwd), step: step.stepNumber });
+      patches.push({ path: path21, patch: repoRelative(step.diff.patch, cwd), step: step.stepNumber });
     }
     const result = resultOf(steps, index);
     if (step.tool.name.toLowerCase() === "write" && result !== void 0 && /^File created successfully\b/.test(result.trim())) {
       file.created = true;
     }
-    files.set(path19, file);
+    files.set(path21, file);
   });
   return { files: [...files.values()], patches };
 }
@@ -4748,7 +4757,8 @@ function buildExecutionBrief(trace) {
     ...source.dirtyFiles !== void 0 ? { dirtyFiles: source.dirtyFiles } : {},
     ...source.dirtyFilesOmitted !== void 0 ? { dirtyFilesOmitted: source.dirtyFilesOmitted } : {},
     ...source.gitCapturedAt !== void 0 ? { capturedAt: source.gitCapturedAt } : {},
-    ...source.prUrl !== void 0 ? { prUrl: source.prUrl } : {}
+    ...source.prUrl !== void 0 ? { prUrl: source.prUrl } : {},
+    ...source.commitNamed === true ? { commitNamed: true } : {}
   };
   return {
     intent: {
@@ -4879,14 +4889,14 @@ var WHEN = {
   "no-edits": "in a run with no recorded edit"
 };
 function verificationLine(brief) {
-  const runs = brief.outcome.verification;
+  const runs2 = brief.outcome.verification;
   const verdict = brief.outcome.afterLastEdit;
-  if (runs.length === 0) {
+  if (runs2.length === 0) {
     return verdict === "no-edits" ? null : "Verification: no test run was recorded.";
   }
   const shown = [];
   for (const when of ["before-first-edit", "between-edits", "after-last-edit", "no-edits"]) {
-    const group = runs.filter((run) => run.when === when);
+    const group = runs2.filter((run) => run.when === when);
     const last = group[group.length - 1];
     if (last !== void 0) shown.push(last);
   }
@@ -4894,7 +4904,7 @@ function verificationLine(brief) {
     const result = run.result === "unknown" ? "ran (result not recorded)" : run.result;
     return `${run.command} ${result} ${WHEN[run.when]}${run.counts ? ` (${run.counts})` : ""}.`;
   });
-  const omitted = runs.length - shown.length;
+  const omitted = runs2.length - shown.length;
   if (omitted > 0) parts.push(`${omitted} earlier test run${omitted === 1 ? "" : "s"} not listed.`);
   if (verdict === "not-rerun") parts.push("Not re-run after the last edit.");
   return `Verification: ${parts.join(" ")}`;
@@ -4922,11 +4932,11 @@ function lineageLine(brief) {
   if (lineage === void 0) return null;
   const parts = [];
   if (lineage.branch !== void 0) parts.push(`branch ${lineage.branch}`);
-  if (lineage.commit !== void 0) parts.push(`commit ${lineage.commit.slice(0, 12)}`);
-  if (lineage.dirtyFiles !== void 0) {
-    const total = lineage.dirtyFiles.length + (lineage.dirtyFilesOmitted ?? 0);
-    parts.push(total === 0 ? "clean tree" : `${total} uncommitted file${total === 1 ? "" : "s"}`);
+  if (lineage.commit !== void 0) {
+    parts.push(`commit ${lineage.commit.slice(0, 12)}${lineage.commitNamed === true ? " (named with --commit)" : ""}`);
   }
+  const tree = treeWords(lineage);
+  if (tree !== null) parts.push(tree);
   if (lineage.prUrl !== void 0) parts.push(`PR ${lineage.prUrl}`);
   return parts.length === 0 ? null : `Git: ${parts.join(" \xB7 ")}`;
 }
@@ -5086,13 +5096,13 @@ function categorizeTrace(trace) {
     };
   }
   if (paths.length > 0) {
-    if (paths.every((path19) => matchesAny(path19, DOC_PATTERNS))) {
+    if (paths.every((path21) => matchesAny(path21, DOC_PATTERNS))) {
       return { category: "docs", evidence: [`all ${paths.length} touched path(s) are documentation`, ...paths.slice(0, 3)] };
     }
-    if (paths.every((path19) => matchesAny(path19, TEST_PATTERNS))) {
+    if (paths.every((path21) => matchesAny(path21, TEST_PATTERNS))) {
       return { category: "tests", evidence: [`all ${paths.length} touched path(s) are tests`, ...paths.slice(0, 3)] };
     }
-    if (paths.every((path19) => matchesAny(path19, INFRA_PATTERNS))) {
+    if (paths.every((path21) => matchesAny(path21, INFRA_PATTERNS))) {
       return { category: "infra", evidence: [`all ${paths.length} touched path(s) are build/CI/deploy config`, ...paths.slice(0, 3)] };
     }
   }
@@ -5259,9 +5269,39 @@ function searchTerms(q) {
 function rowSearchText(row) {
   return normalizeSearch(`${row.title} ${row.slug} ${row.harness} ${HARNESS_INFO[row.harness].label}`);
 }
+var VOWEL = /[aeiouy]/;
+var UNDOUBLED = /([b-df-hj-km-np-rtv-xz])\1$/;
+function stem(word) {
+  if (word.length < 4 || !/^[a-z]+$/.test(word)) return word;
+  const keep = (base) => base.length >= 3 && VOWEL.test(base) ? base : word;
+  const undouble = (base) => base.length >= 4 && UNDOUBLED.test(base) && !/(ll|ss|zz)$/.test(base) ? base.slice(0, -1) : base;
+  if (/[^aeiou]ies$/.test(word) || /[^aeiou]ied$/.test(word)) return keep(word.slice(0, -3) + "y");
+  if (word.endsWith("ing")) {
+    const base = word.slice(0, -3);
+    return base.length >= 3 && VOWEL.test(base) ? undouble(base) : word;
+  }
+  if (word.endsWith("ed") && !word.endsWith("eed")) {
+    const base = word.slice(0, -2);
+    return base.length >= 3 && VOWEL.test(base) ? undouble(base) : word;
+  }
+  if (/(?:ss|x|z|ch|sh)es$/.test(word)) return keep(word.slice(0, -2));
+  if (word.endsWith("s") && !/(?:ss|us|is)$/.test(word)) return keep(word.slice(0, -1));
+  return word;
+}
+function stemText(text2) {
+  return text2.split(/[^\p{L}\p{N}]+/u).filter((word) => word.length > 0).map(stem).join(" ");
+}
 function matchesSearch(row, q) {
-  const haystack = rowSearchText(row);
-  return searchTerms(q).every((term) => haystack.includes(term));
+  return matchesText(rowSearchText(row), q);
+}
+function matchesText(text2, q) {
+  const haystack = normalizeSearch(text2);
+  const stems = ` ${stemText(haystack)} `;
+  return searchTerms(q).every((term) => {
+    if (haystack.includes(term)) return true;
+    const stemmed = stemText(term);
+    return stemmed.length > 0 && stems.includes(stemmed);
+  });
 }
 
 // ../schema/src/index.ts
@@ -5362,6 +5402,12 @@ var TraceSourceSchema = external_exports.object({
   /** How many more dirty paths there were than `dirtyFiles` holds. Absent = none were left out. */
   dirtyFilesOmitted: external_exports.number().int().positive().optional(),
   gitCapturedAt: external_exports.string().optional(),
+  /**
+   * `flatbread share --commit [sha]` (P7.2): the person sharing NAMED `headCommitSha`, and
+   * `dirtyFiles` was measured against it - so an empty list means a clean tree AT THAT COMMIT.
+   * Absent = HEAD, read automatically.
+   */
+  commitNamed: external_exports.literal(true).optional(),
   /** `flatbread share --pr <url>`: the pull request this run belongs to, as the person sharing it said. */
   prUrl: external_exports.string().url().max(GIT_LIMITS.prUrl).regex(/^https:\/\//, "a PR link must be https").optional(),
   /** Absent on records written before Pass 6, which were all claude-code. */
@@ -5554,6 +5600,13 @@ var TraceRecordSchema = external_exports.object({
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["slug"], message: `slug "${record.slug}" is reserved` });
   }
 });
+function normalizeTitle(input) {
+  if (typeof input !== "string") return null;
+  const flat = input.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim();
+  if (flat.length === 0) return null;
+  if (flat.length > LIMITS.title) return null;
+  return flat;
+}
 var RecordSummarySchema = external_exports.object({
   slug: SlugSchema,
   title: external_exports.string(),
@@ -5656,6 +5709,9 @@ function claudeSettingsPath(env = process.env) {
   if (configDir) return path.join(configDir, "settings.json");
   return path.join(os.homedir(), ".claude", "settings.json");
 }
+function encodeCwd(cwd) {
+  return cwd.replace(/[^a-zA-Z0-9]/g, "-");
+}
 function isSubagentSessionFile(filePath) {
   const segments = filePath.split(/[\\/]/).filter((segment2) => segment2.length > 0);
   const base = segments[segments.length - 1] ?? "";
@@ -7347,8 +7403,8 @@ function isInsideDir(child, parent) {
 }
 function targetIndicatesDb(target, env) {
   if (isDbTarget(target)) return true;
-  const stem = path8.basename(target, ".json");
-  if (/^ses_[0-9a-zA-Z]+$/.test(stem)) return true;
+  const stem2 = path8.basename(target, ".json");
+  if (/^ses_[0-9a-zA-Z]+$/.test(stem2)) return true;
   const resolved = path8.resolve(target);
   for (const dir of [dataDir(env), storageDir(env)]) {
     if (resolved === path8.resolve(dir) || isInsideDir(resolved, dir)) return true;
@@ -7394,8 +7450,8 @@ async function resolveSource(target, env = process.env) {
   const wantsDb = isDbTarget(target) || dbExists(data) && targetIndicatesDb(target, env);
   if (wantsDb) {
     const explicit = isDbTarget(target) ? splitDbTarget(target) : { dbPath: dbPathFor(data), sessionId: void 0 };
-    const stem = path8.basename(target, ".json");
-    const sessionId = explicit.sessionId ?? (/^ses_[0-9a-zA-Z]+$/.test(stem) ? stem : void 0);
+    const stem2 = path8.basename(target, ".json");
+    const sessionId = explicit.sessionId ?? (/^ses_[0-9a-zA-Z]+$/.test(stem2) ? stem2 : void 0);
     const result = await readDbSession(path8.dirname(explicit.dbPath), sessionId);
     if (!("unavailable" in result)) {
       if (result.messages.length === 0) {
@@ -8459,8 +8515,8 @@ function safeSlug(slug) {
   if (slug.includes("..") || slug.length > 72) return null;
   return slug;
 }
-function isRecordStem(stem) {
-  return safeSlug(stem) !== null && SlugSchema.safeParse(stem).success;
+function isRecordStem(stem2) {
+  return safeSlug(stem2) !== null && SlugSchema.safeParse(stem2).success;
 }
 function readStoreRecords(dir) {
   if (!fs12.existsSync(dir)) return { records: [], unreadable: 0 };
@@ -8520,9 +8576,9 @@ function createFileStore(options) {
     async get(slug, getOptions = {}) {
       const filePath = fileFor(slug);
       if (filePath === null || !fs12.existsSync(filePath)) return { ok: false, reason: "not-found" };
-      const read = readRecord(filePath);
-      if (!read.ok) return { ok: false, reason: "unreadable", problem: read.problem };
-      const record = read.record;
+      const read2 = readRecord(filePath);
+      if (!read2.ok) return { ok: false, reason: "unreadable", problem: read2.problem };
+      const record = read2.record;
       const hasManageToken = manageTokenMatches(getOptions.manageToken, record.manageTokenHash);
       const viewer = { ...getOptions.viewer, hasManageToken };
       const allowed = canRead(record, viewer);
@@ -8534,10 +8590,10 @@ function createFileStore(options) {
       const summaries = [];
       for (const entry of fs12.readdirSync(dir, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-        const read = readRecord(path12.join(dir, entry.name));
-        if (!read.ok) continue;
-        if (!canList(read.record)) continue;
-        summaries.push(summarize(read.record));
+        const read2 = readRecord(path12.join(dir, entry.name));
+        if (!read2.ok) continue;
+        if (!canList(read2.record)) continue;
+        summaries.push(summarize(read2.record));
       }
       summaries.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0);
       return summaries;
@@ -8641,6 +8697,31 @@ function readGitLineage(cwd, options = {}) {
     gitCapturedAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
   };
 }
+function zList(output) {
+  return output === null ? null : output.split("\0").filter((entry) => entry.length > 0);
+}
+function bindCommit(cwd, rev, options = {}) {
+  const base = readGitLineage(cwd, options);
+  if (base === null || cwd === void 0) {
+    return { problem: `the session's directory (${cwd ?? "not recorded"}) is not a git work tree on this machine` };
+  }
+  const sha = git(cwd, ["rev-parse", "--verify", "-q", `${rev}^{commit}`], options)?.trim();
+  if (sha === void 0 || !/^[0-9a-f]{7,64}$/.test(sha)) return { problem: `"${rev}" is not a commit in ${cwd}` };
+  if (sha === base.headCommitSha) return { ...base, commitNamed: true };
+  const tracked = zList(git(cwd, ["diff", "--name-only", "-z", sha, "--"], options));
+  const untracked = zList(git(cwd, ["ls-files", "--others", "--exclude-standard", "-z"], options));
+  if (tracked === null || untracked === null) return { problem: `git could not compare the working tree with ${sha}` };
+  const dirty = [.../* @__PURE__ */ new Set([...tracked, ...untracked])];
+  const kept = dirty.slice(0, GIT_LIMITS.dirtyFiles);
+  const { dirtyFilesOmitted: _omitted, ...rest } = base;
+  return {
+    ...rest,
+    headCommitSha: sha,
+    dirtyFiles: kept,
+    ...dirty.length > kept.length ? { dirtyFilesOmitted: dirty.length - kept.length } : {},
+    commitNamed: true
+  };
+}
 function checkPrUrl(value) {
   let parsed;
   try {
@@ -8656,12 +8737,14 @@ function checkPrUrl(value) {
 function withLineage(trace, lineage, prUrl) {
   if (lineage === null && prUrl === void 0) return trace;
   const source = { ...trace.source };
-  const elsewhere = lineage !== null && source.gitBranch !== void 0 && lineage.gitBranch !== source.gitBranch;
+  const elsewhere = lineage !== null && lineage.commitNamed !== true && source.gitBranch !== void 0 && lineage.gitBranch !== source.gitBranch;
   if (lineage !== null && !elsewhere) {
     if (source.gitBranch === void 0 && lineage.gitBranch !== void 0) source.gitBranch = lineage.gitBranch;
     if (lineage.headCommitSha !== void 0) source.headCommitSha = lineage.headCommitSha;
     source.dirtyFiles = lineage.dirtyFiles;
     if (lineage.dirtyFilesOmitted !== void 0) source.dirtyFilesOmitted = lineage.dirtyFilesOmitted;
+    else delete source.dirtyFilesOmitted;
+    if (lineage.commitNamed === true) source.commitNamed = true;
     source.gitCapturedAt = lineage.gitCapturedAt;
   }
   if (prUrl !== void 0) source.prUrl = prUrl;
@@ -9549,6 +9632,8 @@ aside .note{color:var(--dim);font-size:12px;margin:0 0 12px}
 .keys b{color:var(--fg);font-weight:600}
 .row .path{color:#5c6474;font-size:10px;word-break:break-all}
 fieldset{border:1px solid var(--line);border-radius:6px;margin:0 0 12px;padding:8px 10px}
+input.title{box-sizing:border-box;width:100%;font:inherit;padding:6px 8px;margin:4px 0 6px;border:1px solid var(--line);border-radius:5px;background:var(--bg);color:var(--fg)}
+input.title:focus{outline:none;border-color:var(--acc)}
 legend{color:var(--dim);font-size:11px;text-transform:uppercase;letter-spacing:.06em}
 label.vis{display:block;padding:3px 0}
 .warn{color:var(--warn);font-size:11px;margin:4px 0 0}
@@ -9594,6 +9679,9 @@ var SCRIPT = `
     if (e.metaKey || e.ctrlKey || e.altKey) return;
     var tag = e.target && e.target.tagName;
     var key = e.key;
+    // TYPING IS NOT TRIAGE: j, k and space in the title field are letters. Enter submits the form
+    // the way any text field does, through the first submit button - Confirm.
+    if (tag === 'INPUT' && e.target.type === 'text') return;
     if (key === 'j' || key === 'ArrowDown') { e.preventDefault(); focusRow(cursor + 1); return; }
     if (key === 'k' || key === 'ArrowUp') { e.preventDefault(); focusRow(cursor - 1); return; }
     if (key === ' ' && cursor >= 0 && tag !== 'BUTTON') {
@@ -9724,6 +9812,11 @@ function renderReviewPage(input) {
     Every match is redacted by default. Tick a row to KEEP the original text instead.</p>
     <div class="tools"><button id="keep-none" type="button">redact all</button><button id="keep-all" type="button">keep all</button></div>
     <p class="keys"><b>j</b>/<b>k</b> move &middot; <b>space</b> keep or redact &middot; <b>enter</b> confirm</p>
+    ${input.titleDraft === void 0 ? "" : `<fieldset>
+      <legend><label for="title">Title</label></legend>
+      <input class="title" id="title" name="title" type="text" required maxlength="${LIMITS.title}" value="${escapeHtml(input.titleDraft)}">
+      <p class="note">Change it here, or leave it. A secret typed into it is redacted.</p>
+    </fieldset>`}
     <fieldset>
       <legend>Visibility</legend>
       <label class="vis"><input type="radio" name="visibility" value="private" checked> private</label>
@@ -9777,7 +9870,9 @@ async function readBody(req, limitBytes = 2 * 1024 * 1024) {
 function parseDecisionBody(body) {
   const form = new URLSearchParams(body);
   const parsedVisibility = VisibilitySchema.safeParse(form.get("visibility"));
+  const title = form.get("title");
   return {
+    ...title !== null ? { title: normalizeTitle(title) } : {},
     visibility: parsedVisibility.success ? parsedVisibility.data : "private",
     // ONE CHECKBOX MAY DECIDE MANY MATCHES. A grouped row carries every id it governs,
     // space-separated, so the browser sends one value and the caller still gets the flat
@@ -9852,8 +9947,24 @@ async function startReviewServer(options) {
       void (async () => {
         try {
           const body = await readBody(req);
-          const { visibility, keepIds } = parseDecisionBody(body);
-          const confirmed = { action: "confirm", visibility, keepIds };
+          const { visibility, keepIds, title } = parseDecisionBody(body);
+          if (title === null) {
+            send(
+              400,
+              page(
+                "Flatbread - title refused",
+                `<div class="done"><h1>That title cannot be used</h1><p class="meta">A title is 1-${LIMITS.title} characters. Go back, change it, and confirm again. Nothing was written.</p></div>`
+              )
+            );
+            return;
+          }
+          const changed = title !== void 0 && options.titleDraft !== void 0 && title !== normalizeTitle(options.titleDraft);
+          const confirmed = {
+            action: "confirm",
+            visibility,
+            keepIds,
+            ...changed ? { title } : {}
+          };
           const message = options.onConfirm ? await options.onConfirm(confirmed) : "";
           send(200, renderDonePage("Share draft written", message, options.publishTo));
           finish(confirmed);
@@ -9890,6 +10001,16 @@ async function startReviewServer(options) {
 }
 
 // src/share.ts
+var spanKey = (match) => `${match.fieldPath}\0${match.start}\0${match.end}\0${match.original}`;
+function applyReview(trace, matches, keepIds, title) {
+  if (title === void 0 || title === trace.title) return applyRedactions(trace, matches, { keepIds });
+  const retitled = { ...trace, title };
+  const kept = new Set(keepIds);
+  const keptSpans = new Set(matches.filter((m) => kept.has(m.id) && m.fieldPath !== "title").map(spanKey));
+  const rescanned = scanTrace(retitled).matches;
+  const keep = rescanned.filter((m) => m.fieldPath !== "title" && keptSpans.has(spanKey(m))).map((m) => m.id);
+  return applyRedactions(retitled, rescanned, { keepIds: keep });
+}
 function openInBrowser(url) {
   try {
     if (process.platform === "win32") {
@@ -10064,17 +10185,22 @@ async function runShare(options) {
     if (parsed.humanTest) console.error(`  next step HUMAN-TESTS.md section ${parsed.humanTest}`);
     return { exitCode: 1, status: "not-found" };
   }
-  const trace = withLineage(
-    parsed.trace,
-    (options.readLineage ?? ((cwd) => readGitLineage(cwd)))(parsed.trace.source.cwd),
-    options.prUrl
-  );
-  for (const note of parsed.notes) log(`note: ${note}`);
-  if (options.parseOutputPath) {
-    FlatbreadTraceSchema.parse(trace);
-    fs16.mkdirSync(path15.dirname(options.parseOutputPath), { recursive: true });
-    fs16.writeFileSync(options.parseOutputPath, JSON.stringify(trace, null, 2) + "\n", "utf8");
+  const cwd = parsed.trace.source.cwd;
+  let lineage;
+  if (options.commit !== void 0) {
+    const bound = (options.bindCommit ?? ((dir, rev) => bindCommit(dir, rev)))(cwd, options.commit);
+    if ("problem" in bound) {
+      console.error(`--commit ${options.commit}: ${bound.problem}`);
+      console.error("Nothing was written. Run it from the session's repository, or leave --commit off.");
+      return { exitCode: 1, status: "bad-commit" };
+    }
+    lineage = bound;
+  } else {
+    lineage = (options.readLineage ?? ((dir) => readGitLineage(dir)))(cwd);
   }
+  const lined = withLineage(parsed.trace, lineage, options.prUrl);
+  const trace = options.title !== void 0 ? FlatbreadTraceSchema.parse({ ...lined, title: options.title }) : lined;
+  for (const note of parsed.notes) log(`note: ${note}`);
   const scan = scanTrace(trace);
   const byRule = /* @__PURE__ */ new Map();
   for (const match of scan.matches) byRule.set(match.rule, (byRule.get(match.rule) ?? 0) + 1);
@@ -10101,11 +10227,12 @@ async function runShare(options) {
       slots: scan.slots,
       sessionPath: target,
       draftPath: options.outputPath,
+      titleDraft: previewTitle,
       ...isPublisher(reviewPublisher) ? { publishTo: reviewPublisher.description } : {},
       ...options.ports ? { ports: options.ports } : {},
       ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
       onConfirm: (decision2) => {
-        const applied2 = applyRedactions(trace, scan.matches, { keepIds: decision2.keepIds });
+        const applied2 = applyReview(trace, scan.matches, decision2.keepIds, decision2.title);
         const draft2 = buildDraft(applied2.trace, applied2.report, decision2.visibility);
         writeDraft(options.outputPath, draft2);
         written = draft2;
@@ -10385,11 +10512,160 @@ function describeReadFailure(failure, what) {
 
 // src/mcp.ts
 import readline3 from "node:readline";
+
+// src/bucket.ts
+import { createHash as createHash2 } from "node:crypto";
+import fs18 from "node:fs";
+import path17 from "node:path";
+var BUCKET_INDEX_VERSION = 1;
+var BUCKET_INDEX_FILE = "index.json";
+var CAPTURE_LOG_FILE = "capture.log";
+var COMMIT_SESSION_WINDOW_MS = 2 * 60 * 60 * 1e3;
+function bucketDir(env = process.env) {
+  return path17.join(flatbreadHome(env), "bucket");
+}
+function bucketSlug(harness, sessionKey) {
+  return `local-${createHash2("sha256").update(`${harness}\0${sessionKey}`, "utf8").digest("hex").slice(0, 12)}`;
+}
+function rowOf(record) {
+  const sha = record.trace.source.headCommitSha;
+  return {
+    summary: summarize(record),
+    sessionPath: record.trace.source.sourcePath,
+    capturedAt: record.updatedAt,
+    ...record.trace.source.commitNamed === true && sha !== void 0 ? { commit: sha } : {}
+  };
+}
+function recordStems(dir) {
+  return fs18.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).filter((stem2) => SlugSchema.safeParse(stem2).success).sort();
+}
+function writeAtomic(file, body) {
+  fs18.mkdirSync(path17.dirname(file), { recursive: true });
+  const temp = `${file}.${process.pid}.tmp`;
+  fs18.writeFileSync(temp, body, "utf8");
+  fs18.renameSync(temp, file);
+}
+var newestFirst = (rows) => [...rows].sort((a, b) => a.capturedAt < b.capturedAt ? 1 : a.capturedAt > b.capturedAt ? -1 : a.summary.slug < b.summary.slug ? -1 : 1);
+function readIndex(dir) {
+  try {
+    const parsed = JSON.parse(fs18.readFileSync(path17.join(dir, BUCKET_INDEX_FILE), "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const { version, rows } = parsed;
+    if (version !== BUCKET_INDEX_VERSION || !Array.isArray(rows)) return null;
+    const out = [];
+    for (const row of rows) {
+      if (typeof row !== "object" || row === null) return null;
+      const { summary, sessionPath, capturedAt, commit } = row;
+      const parsedSummary = RecordSummarySchema.safeParse(summary);
+      if (!parsedSummary.success || typeof sessionPath !== "string" || typeof capturedAt !== "string") return null;
+      if (commit !== void 0 && typeof commit !== "string") return null;
+      out.push({ summary: parsedSummary.data, sessionPath, capturedAt, ...commit !== void 0 ? { commit } : {} });
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+function writeIndex(dir, rows) {
+  writeAtomic(path17.join(dir, BUCKET_INDEX_FILE), JSON.stringify({ version: BUCKET_INDEX_VERSION, rows: newestFirst(rows) }, null, 2) + "\n");
+}
+function readBucket(dir) {
+  if (!fs18.existsSync(dir)) return { rows: [], rebuilt: false, unreadable: 0 };
+  const stems = recordStems(dir);
+  const indexed = readIndex(dir);
+  if (indexed !== null && JSON.stringify(indexed.map((row) => row.summary.slug).sort()) === JSON.stringify(stems)) {
+    return { rows: newestFirst(indexed), rebuilt: false, unreadable: 0 };
+  }
+  const { records, unreadable } = readStoreRecords(dir);
+  const rows = newestFirst(records.map(rowOf));
+  try {
+    writeIndex(dir, rows);
+  } catch {
+  }
+  return { rows, rebuilt: true, unreadable };
+}
+function readBucketRecord(dir, slug) {
+  if (!SlugSchema.safeParse(slug).success) return null;
+  try {
+    const parsed = TraceRecordSchema.safeParse(JSON.parse(fs18.readFileSync(path17.join(dir, `${slug}.json`), "utf8")));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+function matchesQuery(summary, query) {
+  if (query.harness !== void 0 && summary.harness !== query.harness) return false;
+  if (query.category !== void 0 && summary.category !== query.category) return false;
+  if (query.onlyWithRecoveries === true && summary.failuresRecovered === 0) return false;
+  return matchesSearch(summary, query.query ?? "");
+}
+async function captureToBucket(options) {
+  const dir = options.dir ?? bucketDir(options.env);
+  const now = options.now ?? (/* @__PURE__ */ new Date()).toISOString();
+  const parsed = await parseWithHarness({ filePath: options.file, ...options.harness !== void 0 ? { harness: options.harness } : {} });
+  if (!parsed.ok) return { status: "refused", reason: `could not parse ${options.file}: ${parsed.reason}` };
+  const cwd = parsed.trace.source.cwd;
+  let lineage;
+  if (options.commit !== void 0) {
+    const bound = (options.bindCommit ?? ((at, rev) => bindCommit(at, rev)))(cwd, options.commit);
+    if ("problem" in bound) return { status: "refused", reason: `--commit ${options.commit}: ${bound.problem}` };
+    lineage = bound;
+  } else {
+    lineage = (options.readLineage ?? ((at) => readGitLineage(at)))(cwd);
+  }
+  const trace = withLineage(parsed.trace, lineage);
+  const scan = scanTrace(trace);
+  const applied = applyRedactions(trace, scan.matches, { keepIds: [] });
+  const sessionKey = trace.source.sessionId.length > 0 ? trace.source.sessionId : path17.resolve(options.file);
+  const slug = bucketSlug(parsed.harness, sessionKey);
+  const recordPath = path17.join(dir, `${slug}.json`);
+  const previous = readBucketRecord(dir, slug);
+  const commit = applied.trace.source.commitNamed === true ? applied.trace.source.headCommitSha : void 0;
+  const draft = ShareDraftSchema.parse({
+    schemaVersion: 1,
+    createdAt: previous?.createdAt ?? now,
+    trace: { ...applied.trace, visibility: "private" },
+    redaction: applied.report,
+    uploaded: false
+  });
+  const done = { slug, path: recordPath, steps: draft.trace.steps.length, redacted: draft.redaction.redactedCount, ...commit !== void 0 ? { commit } : {} };
+  if (previous !== null && previous.trace.steps.length === draft.trace.steps.length && previous.trace.source.headCommitSha === draft.trace.source.headCommitSha && previous.trace.source.commitNamed === draft.trace.source.commitNamed) {
+    return { status: "unchanged", ...done };
+  }
+  const record = buildRecord(draft, { slug, manageTokenHash: hashManageToken(mintManageToken()), now, origin: "local", visibility: "private" });
+  writeAtomic(recordPath, JSON.stringify(record, null, 2) + "\n");
+  const rows = readBucket(dir).rows.filter((row) => row.summary.slug !== slug);
+  writeIndex(dir, [...rows, rowOf(record)]);
+  return { status: "captured", ...done };
+}
+function sessionForRepo(repo, options = {}) {
+  const projects = getProjectsDir(options.env ?? process.env);
+  const folder = path17.join(projects, encodeCwd(path17.resolve(repo)));
+  const newest = listSessionFiles(folder)[0];
+  if (newest === void 0) return { problem: `no Claude Code session recorded for ${repo}` };
+  const age = (options.nowMs ?? Date.now()) - newest.mtimeMs;
+  const window = options.windowMs ?? COMMIT_SESSION_WINDOW_MS;
+  if (age > window) {
+    return { problem: `the newest session for ${repo} last moved ${Math.round(age / 6e4)} min ago, outside the ${Math.round(window / 6e4)} min window` };
+  }
+  return { file: newest.filePath };
+}
+function logCapture(dir, line, now = (/* @__PURE__ */ new Date()).toISOString()) {
+  try {
+    fs18.mkdirSync(dir, { recursive: true });
+    fs18.appendFileSync(path17.join(dir, CAPTURE_LOG_FILE), `${now} ${line.replace(/[\r\n]+/g, " ")}
+`, "utf8");
+  } catch {
+  }
+}
+
+// src/mcp.ts
 var MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
-var MCP_SERVER_VERSION = "0.1.0";
-function defaultMcpDeps(storeDir2) {
+var MCP_SERVER_VERSION = "0.2.0";
+function defaultMcpDeps(storeDir2, bucketDir2) {
   return {
     storeDir: storeDir2,
+    bucketDir: bucketDir2,
     search: (query) => searchRemote(query, { client: "mcp" }),
     capsule: (ref) => fetchCapsule(ref, { client: "mcp" })
   };
@@ -10434,12 +10710,6 @@ function hitLine(hit) {
   if (hit.visibility !== "public") parts.push(hit.visibility);
   return `- ${parts.join(" \xB7 ")}`;
 }
-function matchesLocal(summary, query) {
-  if (query.harness !== void 0 && summary.harness !== query.harness) return false;
-  if (query.category !== void 0 && summary.category !== query.category) return false;
-  if (query.onlyWithRecoveries === true && summary.failuresRecovered === 0) return false;
-  return matchesSearch(summary, query.query ?? "");
-}
 function readQuery(args) {
   const query = {};
   if (args["query"] !== void 0) {
@@ -10467,29 +10737,52 @@ function readQuery(args) {
 function localRecords(deps) {
   return deps.storeDir === null ? { records: [], unreadable: 0 } : readStoreRecords(deps.storeDir);
 }
-async function searchTool(args, deps) {
-  const query = readQuery(args);
-  if (typeof query === "string") return text(query, true);
+var runs = (count) => `${count} matching run${count === 1 ? "" : "s"}`;
+function capturedLine(row) {
+  return `${hitLine(row.summary)} \xB7 captured ${row.capturedAt.slice(0, 10)}${row.commit !== void 0 ? ` at ${row.commit.slice(0, 12)}` : ""}`;
+}
+async function searchEverywhere(query, deps, options = {}) {
   const out = [];
   const local = localRecords(deps);
-  const localHits = local.records.map((record) => summarize(record)).filter((summary) => matchesLocal(summary, query));
+  const localHits = local.records.map((record) => summarize(record)).filter((summary) => matchesQuery(summary, query));
   if (deps.storeDir !== null) {
-    out.push(`This machine (${localHits.length} matching run${localHits.length === 1 ? "" : "s"}):`);
+    out.push(`This machine (${runs(localHits.length)}):`);
     for (const hit of localHits) out.push(hitLine(hit));
     if (local.unreadable > 0) out.push(`(${local.unreadable} local record file${local.unreadable === 1 ? "" : "s"} could not be read)`);
   }
+  const seen = new Set(localHits.map((hit) => hit.slug));
+  if (deps.bucketDir !== null) {
+    const bucket = readBucket(deps.bucketDir);
+    const captured = bucket.rows.filter((row) => !seen.has(row.summary.slug) && matchesQuery(row.summary, query));
+    if (out.length > 0) out.push("");
+    out.push(`Captured on this machine, not shared (${runs(captured.length)}):`);
+    for (const row of captured) {
+      out.push(capturedLine(row));
+      seen.add(row.summary.slug);
+    }
+    if (bucket.unreadable > 0) out.push(`(${bucket.unreadable} captured run file${bucket.unreadable === 1 ? "" : "s"} could not be read)`);
+  }
+  if (options.remote === false) {
+    if (out.length > 0) out.push("");
+    out.push("The site was not searched: --local");
+    return { lines: out, siteSearched: false };
+  }
   const remote = await deps.search(query);
   if (out.length > 0) out.push("");
   if (remote.ok) {
-    const seen = new Set(localHits.map((hit) => hit.slug));
     const fresh = remote.results.filter((hit) => !seen.has(hit.slug));
-    out.push(`${remote.site} (${fresh.length} matching run${fresh.length === 1 ? "" : "s"}):`);
+    out.push(`${remote.site} (${runs(fresh.length)}):`);
     for (const hit of fresh) out.push(hitLine(hit));
   } else {
     out.push(`The site was not searched: ${describeReadFailure(remote, "search")}`);
   }
-  out.push("", "Pass a run ID to flatbread_get_capsule for what that run learned.");
-  return text(out.join("\n"));
+  return { lines: out, siteSearched: remote.ok };
+}
+async function searchTool(args, deps) {
+  const query = readQuery(args);
+  if (typeof query === "string") return text(query, true);
+  const { lines: lines2 } = await searchEverywhere(query, deps);
+  return text([...lines2, "", "Pass a run ID to flatbread_get_capsule for what that run learned."].join("\n"));
 }
 async function capsuleTool(args, deps) {
   const raw = args["slug"];
@@ -10497,8 +10790,8 @@ async function capsuleTool(args, deps) {
   const ref = parseRunRef(raw);
   if (ref === null) return text(`"${raw}" is not a run ID or a /r/<id> link`, true);
   if (ref.site === void 0) {
-    const local = localRecords(deps).records.find((record) => record.slug === ref.slug);
-    if (local !== void 0) return text(buildCapsule(local.trace));
+    const local = localRecords(deps).records.find((record) => record.slug === ref.slug) ?? (deps.bucketDir !== null ? readBucketRecord(deps.bucketDir, ref.slug) : null);
+    if (local !== null && local !== void 0) return text(buildCapsule(local.trace));
   }
   const remote = await deps.capsule(ref);
   if (remote.ok) return text(remote.capsule);
@@ -10577,10 +10870,126 @@ async function runMcpServer(deps, io) {
   return 0;
 }
 
+// src/git-hook.ts
+import fs19 from "node:fs";
+import path18 from "node:path";
+var POST_COMMIT_MARKER = "# flatbread post-commit hook - remove with: flatbread setup --uninstall";
+var CHAINED_HOOK = "post-commit.pre-flatbread";
+var sq = (value) => `'${value.replace(/\\/g, "/").replace(/'/g, "'\\''")}'`;
+function captureLine(execPath, entryPath) {
+  return `${sq(execPath)} ${sq(entryPath)} capture --commit "$(git rev-parse HEAD)" --repo "$(git rev-parse --show-toplevel)" --quiet >/dev/null 2>&1 &`;
+}
+function postCommitScript(execPath, entryPath) {
+  return [
+    "#!/bin/sh",
+    POST_COMMIT_MARKER,
+    "# Runs the hook that was here before, then records this commit against the newest agent session",
+    "# in this repository, on this machine only. It never changes the commit; it exits with the",
+    "# earlier hook's status. Off switch: FLATBREAD_HOOK_DISABLED=1",
+    "status=0",
+    `prior="$(dirname "$0")/${CHAINED_HOOK}"`,
+    'if [ -x "$prior" ]; then',
+    '  "$prior" "$@"',
+    "  status=$?",
+    "fi",
+    'if [ -z "$FLATBREAD_HOOK_DISABLED" ]; then',
+    `  ( ${captureLine(execPath, entryPath)} )`,
+    "fi",
+    'exit "$status"',
+    ""
+  ].join("\n");
+}
+var isOurs = (body) => body.includes(POST_COMMIT_MARKER);
+function hooksDirFor(cwd, options = {}) {
+  const top = git(cwd, ["rev-parse", "--show-toplevel"], options)?.trim();
+  if (top === void 0 || top.length === 0) return { ok: false, reason: "not-a-repo", detail: `${cwd} is not inside a git repository` };
+  const managed = git(top, ["config", "--show-scope", "--get", "core.hooksPath"], options)?.trim();
+  let machineHooksPath;
+  if (managed !== void 0 && managed.length > 0) {
+    const tab = managed.indexOf("	");
+    const scope = tab > 0 ? managed.slice(0, tab) : "local";
+    const value = tab > 0 ? managed.slice(tab + 1) : managed;
+    if (scope !== "system" && scope !== "global") {
+      return { ok: false, reason: "hooks-path", detail: `core.hooksPath is set to ${value} in this repository, so another tool owns its hooks` };
+    }
+    machineHooksPath = { scope, path: value };
+  }
+  const common = git(top, ["rev-parse", "--git-common-dir"], options)?.trim();
+  if (common === void 0 || common.length === 0) return { ok: false, reason: "unreadable", detail: `git could not name the git directory of ${top}` };
+  return { ok: true, repo: path18.resolve(top), dir: path18.resolve(top, common, "hooks"), ...machineHooksPath !== void 0 ? { machineHooksPath } : {} };
+}
+var read = (file) => {
+  try {
+    return fs19.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+};
+function installGitHook(dir, script, options = {}) {
+  const hook = path18.join(dir, "post-commit");
+  const chained = path18.join(dir, CHAINED_HOOK);
+  const current = read(hook);
+  const write = (lines2) => {
+    if (options.dryRun === true) return { code: 0, lines: [...lines2, "--dry-run: nothing was written"] };
+    fs19.mkdirSync(dir, { recursive: true });
+    if (current !== null && !isOurs(current)) fs19.renameSync(hook, chained);
+    fs19.writeFileSync(hook, script, { encoding: "utf8", mode: 493 });
+    fs19.chmodSync(hook, 493);
+    return { code: 0, lines: lines2 };
+  };
+  if (current === null) return write([`post-commit  ${hook} (new)`]);
+  if (isOurs(current)) {
+    if (current === script) return { code: 0, lines: [`post-commit  ${hook}`, "already installed, unchanged"] };
+    return write([`post-commit  ${hook}`, "updated the flatbread hook"]);
+  }
+  if (fs19.existsSync(chained)) {
+    return {
+      code: 1,
+      lines: [
+        `refused      ${hook}`,
+        `${chained} already exists, and post-commit is not ours. Neither file was touched.`,
+        "Move one of them yourself, then run setup again."
+      ]
+    };
+  }
+  return write([
+    `post-commit  ${hook}`,
+    `your post-commit was kept as ${CHAINED_HOOK} and runs first, unchanged, with its exit status`
+  ]);
+}
+function uninstallGitHook(dir, options = {}) {
+  const hook = path18.join(dir, "post-commit");
+  const chained = path18.join(dir, CHAINED_HOOK);
+  const current = read(hook);
+  const hasChained = fs19.existsSync(chained);
+  const done = (lines2, act) => {
+    if (options.dryRun === true) return { code: 0, lines: [...lines2, "--dry-run: nothing was written"] };
+    act();
+    return { code: 0, lines: lines2 };
+  };
+  if (current !== null && !isOurs(current)) {
+    return {
+      code: 0,
+      lines: [
+        `post-commit  ${hook} is not ours, left alone`,
+        ...hasChained ? [`${chained} is still there; it is yours to keep or delete`] : []
+      ]
+    };
+  }
+  if (current === null && !hasChained) return { code: 0, lines: [`no flatbread post-commit in ${dir}`] };
+  if (hasChained) {
+    return done([`post-commit  ${hook}`, `restored your post-commit from ${CHAINED_HOOK}`], () => {
+      if (current !== null) fs19.rmSync(hook);
+      fs19.renameSync(chained, hook);
+    });
+  }
+  return done([`post-commit  ${hook}`, "removed the flatbread hook"], () => fs19.rmSync(hook));
+}
+
 // src/hook.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import fs18 from "node:fs";
-import path17 from "node:path";
+import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
+import fs20 from "node:fs";
+import path19 from "node:path";
 var HOOK_EVENTS = ["Stop", "SessionEnd"];
 var OFFER_AFTER_STOPS = 2;
 var MAX_TRACKED_SESSIONS = 50;
@@ -10590,14 +10999,14 @@ function emptyHookState() {
   return { version: HOOK_STATE_VERSION, sessions: {} };
 }
 function hookStatePath(env = process.env) {
-  return path17.join(flatbreadHome(env), "hook-state.json");
+  return path19.join(flatbreadHome(env), "hook-state.json");
 }
 function readHookState(env = process.env) {
   const file = hookStatePath(env);
-  if (!fs18.existsSync(file)) return { ok: true, state: emptyHookState(), present: false };
+  if (!fs20.existsSync(file)) return { ok: true, state: emptyHookState(), present: false };
   let raw;
   try {
-    raw = fs18.readFileSync(file, "utf8");
+    raw = fs20.readFileSync(file, "utf8");
   } catch (error) {
     return { ok: false, reason: "unreadable", detail: error.message };
   }
@@ -10640,9 +11049,9 @@ function pruneHookState(state, keep = MAX_TRACKED_SESSIONS) {
 }
 function writeHookState(state, env = process.env) {
   const dir = flatbreadHome(env);
-  fs18.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs20.mkdirSync(dir, { recursive: true, mode: 448 });
   const file = hookStatePath(env);
-  fs18.writeFileSync(file, JSON.stringify(pruneHookState(state), null, 2) + "\n", {
+  fs20.writeFileSync(file, JSON.stringify(pruneHookState(state), null, 2) + "\n", {
     encoding: "utf8",
     mode: 384
   });
@@ -10777,12 +11186,18 @@ function offerAfterFrom(env) {
   }
   return { value: parsed };
 }
+function spawnDetachedDefault(command, args) {
+  const child = spawn2(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+  child.on("error", () => {
+  });
+  child.unref();
+}
 async function runHookNotify(io) {
   const env = io.env ?? process.env;
   const stdout = io.stdout ?? ((line) => process.stdout.write(line + "\n"));
   const stderr = io.stderr ?? ((line) => process.stderr.write(line + "\n"));
   const now = io.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const exists = io.exists ?? ((filePath) => fs18.existsSync(filePath));
+  const exists = io.exists ?? ((filePath) => fs20.existsSync(filePath));
   const execPath = io.execPath ?? process.execPath;
   const entryPath = io.entryPath ?? process.argv[1] ?? "";
   try {
@@ -10796,14 +11211,14 @@ async function runHookNotify(io) {
       stderr(`flatbread hook: NOT RETRIEVED (${parsed.detail})`);
       return 0;
     }
-    const read = readHookState(env);
-    if (!read.ok) {
-      stderr(`flatbread hook: NOT RETRIEVED (${read.reason}: ${read.detail}) at ${hookStatePath(env)}`);
+    const read2 = readHookState(env);
+    if (!read2.ok) {
+      stderr(`flatbread hook: NOT RETRIEVED (${read2.reason}: ${read2.detail}) at ${hookStatePath(env)}`);
       return 0;
     }
     const offerAfter = offerAfterFrom(env);
     if (offerAfter.ignored) stderr(`flatbread hook: ${offerAfter.ignored}, using ${OFFER_AFTER_STOPS}`);
-    const decision = decideHook(parsed.event, read.state, {
+    const decision = decideHook(parsed.event, read2.state, {
       now: now(),
       exists,
       offerAfter: offerAfter.value,
@@ -10811,7 +11226,7 @@ async function runHookNotify(io) {
       entryPath
     });
     let recorded = true;
-    if (decision.nextState !== read.state) {
+    if (decision.nextState !== read2.state) {
       try {
         writeHookState(decision.nextState, env);
       } catch (error) {
@@ -10819,6 +11234,11 @@ async function runHookNotify(io) {
         stderr(`flatbread hook: could not record state (${error.message})`);
       }
     }
+    const transcript = parsed.event.transcript_path;
+    if (io.capture === true && parsed.event.hook_event_name === "SessionEnd" && transcript !== void 0 && exists(transcript)) {
+      (io.spawnDetached ?? spawnDetachedDefault)(execPath, [entryPath, "capture", "--file", transcript, "--quiet"]);
+      stderr("flatbread hook: capturing this session into the local bucket, in the background");
+    }
     if (decision.speak && recorded) {
       stdout(JSON.stringify({ systemMessage: decision.systemMessage }));
       stderr(`flatbread hook: ${decision.why}`);
@@ -10839,7 +11259,7 @@ function hookHandlerFor(options) {
   const handler = {
     type: "command",
     command: options.execPath,
-    args: [options.entryPath, "hook", "notify"]
+    args: [options.entryPath, "hook", "notify", ...options.capture === true && options.event === "SessionEnd" ? ["--capture"] : []]
   };
   if (options.event === "Stop") handler.timeout = STOP_TIMEOUT_SECONDS;
   return handler;
@@ -10934,10 +11354,10 @@ function removeHookConfig(settings) {
   return { settings: root, removed };
 }
 function readSettingsFile(file) {
-  if (!fs18.existsSync(file)) return { present: false, file };
+  if (!fs20.existsSync(file)) return { present: false, file };
   let raw;
   try {
-    raw = fs18.readFileSync(file, "utf8");
+    raw = fs20.readFileSync(file, "utf8");
   } catch (error) {
     return { present: true, file, unreadable: error.message };
   }
@@ -10949,19 +11369,19 @@ function readSettingsFile(file) {
   }
 }
 function writeSettingsFile(file, settings) {
-  fs18.mkdirSync(path17.dirname(file), { recursive: true });
+  fs20.mkdirSync(path19.dirname(file), { recursive: true });
   const temp = `${file}.flatbread-${process.pid}.tmp`;
-  fs18.writeFileSync(temp, JSON.stringify(settings, null, 2) + "\n", "utf8");
-  fs18.renameSync(temp, file);
+  fs20.writeFileSync(temp, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  fs20.renameSync(temp, file);
 }
-function handlersFor(execPath, entryPath) {
+function handlersFor(execPath, entryPath, capture = false) {
   return {
     Stop: hookHandlerFor({ execPath, entryPath, event: "Stop" }),
-    SessionEnd: hookHandlerFor({ execPath, entryPath, event: "SessionEnd" })
+    SessionEnd: hookHandlerFor({ execPath, entryPath, event: "SessionEnd", capture })
   };
 }
-function handlerBlockFor(execPath, entryPath) {
-  const handlers = handlersFor(execPath, entryPath);
+function handlerBlockFor(execPath, entryPath, capture = false) {
+  const handlers = handlersFor(execPath, entryPath, capture);
   const hooks = {};
   for (const event of HOOK_EVENTS) hooks[event] = [{ hooks: [handlers[event]] }];
   return JSON.stringify({ hooks }, null, 2);
@@ -10972,21 +11392,22 @@ function runHookInstall(options = {}) {
   const execPath = options.execPath ?? process.execPath;
   const entryPath = options.entryPath ?? process.argv[1] ?? "";
   const file = options.settingsPath ?? claudeSettingsPath(env);
-  const read = readSettingsFile(file);
-  if (read.present && "unreadable" in read) {
+  const capture = options.capture === true;
+  const read2 = readSettingsFile(file);
+  if (read2.present && "unreadable" in read2) {
     log("");
     log(`  refused      ${file}`);
-    log(`  ${read.unreadable}`);
+    log(`  ${read2.unreadable}`);
     log("  a settings file we cannot read is not one we will rewrite. Add this by hand:");
     log("");
-    for (const line of handlerBlockFor(execPath, entryPath).split("\n")) log(`  ${line}`);
+    for (const line of handlerBlockFor(execPath, entryPath, capture).split("\n")) log(`  ${line}`);
     log("");
     return 1;
   }
-  const current = read.present ? read.parsed : {};
+  const current = read2.present ? read2.parsed : {};
   let merged;
   try {
-    merged = mergeHookConfig(current, handlersFor(execPath, entryPath));
+    merged = mergeHookConfig(current, handlersFor(execPath, entryPath, capture));
   } catch (error) {
     log("");
     log(`  refused      ${file}`);
@@ -10995,7 +11416,7 @@ function runHookInstall(options = {}) {
     return 1;
   }
   log("");
-  log(`  settings     ${file}${read.present ? "" : " (new)"}`);
+  log(`  settings     ${file}${read2.present ? "" : " (new)"}`);
   log(`  command      "${execPath}" "${entryPath}" hook notify`);
   if (merged.changes.length === 0) {
     log("  already installed, unchanged");
@@ -11019,7 +11440,7 @@ function runHookInstall(options = {}) {
       log("  refused: nothing was written, because this command line does not work here.");
       log("  fix the command (or pass --no-probe if you know better), then install again:");
       log("");
-      for (const line of handlerBlockFor(execPath, entryPath).split("\n")) log(`  ${line}`);
+      for (const line of handlerBlockFor(execPath, entryPath, capture).split("\n")) log(`  ${line}`);
       log("");
       return 1;
     }
@@ -11048,7 +11469,9 @@ function runHookInstall(options = {}) {
     log("");
     return 1;
   }
-  log("  wrote it. Stop offers the share once per session; SessionEnd only records the end.");
+  log(
+    capture ? "  wrote it. Stop offers the share once per session; SessionEnd captures the run into the local bucket." : "  wrote it. Stop offers the share once per session; SessionEnd only records the end."
+  );
   log("  off switch: FLATBREAD_HOOK_DISABLED=1, or flatbread hook uninstall");
   log("");
   return 0;
@@ -11057,23 +11480,23 @@ function runHookUninstall(options = {}) {
   const env = options.env ?? process.env;
   const log = options.log ?? ((line) => console.log(line));
   const file = options.settingsPath ?? claudeSettingsPath(env);
-  const read = readSettingsFile(file);
+  const read2 = readSettingsFile(file);
   log("");
-  if (!read.present) {
+  if (!read2.present) {
     log(`  nothing to remove: ${file} does not exist`);
     log("");
     return 0;
   }
-  if ("unreadable" in read) {
+  if ("unreadable" in read2) {
     log(`  refused      ${file}`);
-    log(`  ${read.unreadable}`);
+    log(`  ${read2.unreadable}`);
     log("  remove the flatbread entries by hand rather than let us rewrite a file we cannot read");
     log("");
     return 1;
   }
   let result;
   try {
-    result = removeHookConfig(read.parsed);
+    result = removeHookConfig(read2.parsed);
   } catch (error) {
     log(`  refused      ${error instanceof Error ? error.message : String(error)}`);
     log("");
@@ -11084,6 +11507,13 @@ function runHookUninstall(options = {}) {
     log("");
     return 0;
   }
+  if (options.dryRun === true) {
+    log(`  settings     ${file}`);
+    for (const line of result.removed) log(`  ${line}`);
+    log("  --dry-run: nothing was written");
+    log("");
+    return 0;
+  }
   try {
     writeSettingsFile(file, result.settings);
   } catch (error) {
@@ -11100,8 +11530,8 @@ function runHookUninstall(options = {}) {
 function settingsCandidates(env, cwd) {
   return [
     { label: "user", file: claudeSettingsPath(env) },
-    { label: "project", file: path17.join(cwd, ".claude", "settings.json") },
-    { label: "local", file: path17.join(cwd, ".claude", "settings.local.json") }
+    { label: "project", file: path19.join(cwd, ".claude", "settings.json") },
+    { label: "local", file: path19.join(cwd, ".claude", "settings.local.json") }
   ];
 }
 function installedEventsIn(parsed, exists) {
@@ -11131,23 +11561,23 @@ function runHookStatus(options = {}) {
   const env = options.env ?? process.env;
   const log = options.log ?? ((line) => console.log(line));
   const cwd = options.cwd ?? process.cwd();
-  const exists = options.exists ?? ((filePath) => fs18.existsSync(filePath));
+  const exists = options.exists ?? ((filePath) => fs20.existsSync(filePath));
   const candidates = options.settingsPath === void 0 ? settingsCandidates(env, cwd) : [{ label: "settings", file: options.settingsPath }];
   log("");
   log("flatbread hook");
   log("");
   let installed = 0;
   for (const candidate of candidates) {
-    const read2 = readSettingsFile(candidate.file);
-    if (!read2.present) {
+    const read3 = readSettingsFile(candidate.file);
+    if (!read3.present) {
       log(`  ${candidate.label.padEnd(8)} ${candidate.file} (absent)`);
       continue;
     }
-    if ("unreadable" in read2) {
-      log(`  ${candidate.label.padEnd(8)} ${candidate.file} NOT RETRIEVED (${read2.unreadable})`);
+    if ("unreadable" in read3) {
+      log(`  ${candidate.label.padEnd(8)} ${candidate.file} NOT RETRIEVED (${read3.unreadable})`);
       continue;
     }
-    const found = installedEventsIn(read2.parsed, exists);
+    const found = installedEventsIn(read3.parsed, exists);
     installed += found.events.length;
     const summary = found.events.length === 0 ? "(no flatbread handler)" : found.events.join(", ");
     log(`  ${candidate.label.padEnd(8)} ${candidate.file} ${summary}`);
@@ -11171,15 +11601,15 @@ function runHookStatus(options = {}) {
     }
   }
   log("");
-  const read = readHookState(env);
-  if (!read.ok) {
-    log(`  state        NOT RETRIEVED (${read.reason}: ${read.detail})`);
+  const read2 = readHookState(env);
+  if (!read2.ok) {
+    log(`  state        NOT RETRIEVED (${read2.reason}: ${read2.detail})`);
     log(`               ${hookStatePath(env)}`);
     log("");
     return 1;
   }
-  const sessions = Object.entries(read.state.sessions);
-  log(`  state        ${hookStatePath(env)}${read.present ? "" : " (none yet)"}`);
+  const sessions = Object.entries(read2.state.sessions);
+  log(`  state        ${hookStatePath(env)}${read2.present ? "" : " (none yet)"}`);
   log(`  sessions     ${sessions.length}`);
   log(`  offered      ${sessions.filter(([, session]) => session.offeredAt !== void 0).length}`);
   const recent = [...sessions].sort((a, b) => b[1].lastSeenAt > a[1].lastSeenAt ? 1 : -1).slice(0, 5);
@@ -11251,6 +11681,74 @@ function probeHandler(handler, run = spawnSync2) {
   return { ok: true, detail: "ran, exited 0, printed nothing" };
 }
 
+// src/setup.ts
+function runSetup(options = {}) {
+  const env = options.env ?? process.env;
+  const log = options.log ?? ((line) => console.log(line));
+  const execPath = options.execPath ?? process.execPath;
+  const entryPath = options.entryPath ?? process.argv[1] ?? "";
+  const dryRun = options.dryRun === true;
+  const settings = options.settingsPath !== void 0 ? { settingsPath: options.settingsPath } : {};
+  if (options.uninstall !== true && /[\\/]_npx[\\/]/.test(entryPath)) {
+    log("");
+    log(`  refused: this flatbread runs from npx's cache (${entryPath}),`);
+    log("  which npm may clear - and a hook that names a missing file fails silently. Install it, then run setup:");
+    log("    npm install -g flatbread-cli");
+    log("    flatbread setup");
+    log("");
+    return 1;
+  }
+  log("");
+  log("Claude Code");
+  const claude = options.uninstall === true ? runHookUninstall({ env, log, dryRun, ...settings }) : runHookInstall({
+    env,
+    log,
+    execPath,
+    entryPath,
+    dryRun,
+    capture: true,
+    ...options.noProbe === true ? { noProbe: true } : {},
+    ...options.spawn !== void 0 ? { spawn: options.spawn } : {},
+    ...settings
+  });
+  let git2 = 0;
+  log("git");
+  if (options.noGit === true) {
+    log("  --no-git: the post-commit hook was not touched");
+  } else {
+    const where = hooksDirFor(options.repo ?? process.cwd(), options.git !== void 0 ? { git: options.git } : {});
+    if (!where.ok) {
+      log(`  skipped      ${where.detail}`);
+      if (where.reason === "hooks-path" && options.uninstall !== true) {
+        log("  add this line to that post-commit yourself to capture commits:");
+        log(`    ${captureLine(execPath, entryPath)}`);
+      } else if (where.reason === "not-a-repo" && options.uninstall !== true) {
+        log("  run setup inside a repository to bind its commits to your sessions");
+      }
+      if (where.reason === "unreadable") git2 = 1;
+    } else {
+      const outcome = options.uninstall === true ? uninstallGitHook(where.dir, { dryRun }) : installGitHook(where.dir, postCommitScript(execPath, entryPath), { dryRun });
+      for (const line of outcome.lines) log(`  ${line}`);
+      if (where.machineHooksPath !== void 0 && options.uninstall !== true && outcome.code === 0) {
+        log(`  note         git runs ${where.machineHooksPath.path} first (core.hooksPath, ${where.machineHooksPath.scope} config).`);
+        log("               This hook fires only if that one runs the repository's own post-commit.");
+        log(`               After your next commit, ${bucketDir(env)}/capture.log says whether it did.`);
+      }
+      git2 = outcome.code;
+    }
+  }
+  log("");
+  if (options.uninstall === true) {
+    log(`  the bucket is left alone: ${bucketDir(env)}`);
+  } else {
+    log(`  captures go to ${bucketDir(env)}: redacted, private, never uploaded`);
+    log("  find them with: flatbread search <words>");
+    log("  share one with: flatbread share --file <its session>, which opens the review");
+  }
+  log("");
+  return claude !== 0 || git2 !== 0 ? 1 : 0;
+}
+
 // src/login-server.ts
 import crypto2 from "node:crypto";
 import http2 from "node:http";
@@ -11461,18 +11959,18 @@ async function bindFirst(server, ports) {
 }
 
 // src/index.ts
-var PACKAGE_ROOT = path18.resolve(path18.dirname(fileURLToPath(import.meta.url)), "..");
-var SOURCE_CHECKOUT = fs19.existsSync(path18.join(PACKAGE_ROOT, "src", "index.ts"));
-var TMP_DIR = process.env["FLATBREAD_TMP_DIR"]?.trim() || (SOURCE_CHECKOUT ? path18.join(PACKAGE_ROOT, ".tmp") : path18.join(os7.homedir(), ".flatbread"));
-var OUTPUT_PATH = path18.join(TMP_DIR, "last-parse.json");
-var SHARE_OUTPUT_PATH = path18.join(TMP_DIR, "last-share.json");
+var PACKAGE_ROOT = path20.resolve(path20.dirname(fileURLToPath(import.meta.url)), "..");
+var SOURCE_CHECKOUT = fs21.existsSync(path20.join(PACKAGE_ROOT, "src", "index.ts"));
+var TMP_DIR = process.env["FLATBREAD_TMP_DIR"]?.trim() || (SOURCE_CHECKOUT ? path20.join(PACKAGE_ROOT, ".tmp") : path20.join(os7.homedir(), ".flatbread"));
+var OUTPUT_PATH = path20.join(TMP_DIR, "last-parse.json");
+var SHARE_OUTPUT_PATH = path20.join(TMP_DIR, "last-share.json");
 function storeDir() {
-  return resolveStoreDir() ?? (SOURCE_CHECKOUT ? null : path18.join(TMP_DIR, DEFAULT_STORE_DIRNAME));
+  return resolveStoreDir() ?? (SOURCE_CHECKOUT ? null : path20.join(TMP_DIR, DEFAULT_STORE_DIRNAME));
 }
 var USAGE = `flatbread - registry of AI agent runs
 
 Usage:
-  flatbread parse --file <path>         Parse a session log (harness auto-detected)
+  flatbread parse --file <path>         Parse a session log and print its brief. Writes nothing
   flatbread parse --latest              Parse the newest session for a harness
   flatbread share                       Review + sanitize the newest session
   flatbread share --file <path>          Review + sanitize a specific session
@@ -11481,6 +11979,13 @@ Usage:
   flatbread pull <id|url> --out <file>  Write it to a file instead
   flatbread mcp                         MCP server on stdio: flatbread_search_traces and
                                         flatbread_get_capsule, for your coding agent
+  flatbread search <words>              Find runs: this machine's shared and captured ones, then
+                                        the site (the same answer the MCP server gives)
+  flatbread setup                       Auto-capture: the Claude Code hook, plus a chained git
+                                        post-commit in this repository. Captures stay local
+  flatbread setup --uninstall           Remove exactly what setup added
+  flatbread capture --file <path>       Capture one session into the local bucket (setup's hooks
+                                        run this; redacted, private, never uploaded)
   flatbread adapters                    List harness adapters and their confidence
   flatbread login                       Sign in through the website, the way npm does
   flatbread login --email <addr>        Sign in by email instead (see the note below)
@@ -11496,15 +12001,40 @@ Usage:
 Options for parse:
   --harness <id>                        Skip detection and name the harness.
                                         ${HARNESS_IDS.join(", ")}
+  --save                                Also write the raw (unredacted) trace where view and the
+                                        local viewer read it
+  --out <file>                          Write the raw trace to <file> instead
 
 Options for share:
   --harness <id>                        Skip detection and name the harness
   --publish                             Upload the run to your account (needs flatbread login)
   --pr <url>                            Link the pull request this run belongs to (https)
+  --title <text>                        The run's title (1-${LIMITS.title} characters). The review page
+                                        opens with it and can still change it
+  --commit [sha]                        Bind the run to a commit (bare --commit = HEAD) and record
+                                        whether the working tree was clean against it
   --no-review                           Redact every match, skip the browser (non-interactive)
   --no-open                             Start the review server but do not launch a browser
   -h, --help                            Show this message
 
+Options for search:
+  --harness <id>  --category <kind>     Only runs from that harness, or of that kind of job
+  --recovered                           Only runs where the agent recovered from a failure
+  --local                               This machine only; the site is not asked
+
+Options for setup:
+  --dry-run                             Say what would be written, write nothing
+  --uninstall                           Remove the handlers and the post-commit; restore a
+                                        post-commit hook setup had chained
+  --no-git                              Leave the repository's hooks alone
+  --settings <path>  --no-probe         As for hook install
+
+Options for capture:
+  --commit [sha]                        Bind the capture to a commit (bare = HEAD)
+  --repo <dir>                          Without --file: the newest session of that repository,
+                                        if it moved in the last ${Math.round(COMMIT_SESSION_WINDOW_MS / 6e4)} minutes
+  --quiet                               Log to the bucket's capture.log and always exit 0 (hooks)
+
 Options for hook install and hook uninstall:
   --settings <path>                     Settings file to edit. Default: the user settings file
                                         (~/.claude/settings.json, or CLAUDE_CONFIG_DIR)
@@ -11519,8 +12049,8 @@ Options for adapters:
 Notes:
   parse and share record the git branch, HEAD commit and uncommitted file names when the
   session ran inside a git repository. Nothing else from git is read.
-  Parsed traces are written to ${path18.relative(process.cwd(), OUTPUT_PATH) || OUTPUT_PATH}
-  Share drafts are written to ${path18.relative(process.cwd(), SHARE_OUTPUT_PATH) || SHARE_OUTPUT_PATH}
+  parse --save writes ${path20.relative(process.cwd(), OUTPUT_PATH) || OUTPUT_PATH}
+  Share drafts are written to ${path20.relative(process.cwd(), SHARE_OUTPUT_PATH) || SHARE_OUTPUT_PATH}
   Every parsed run defaults to visibility "private".
   Nothing is uploaded unless you pass --publish, or set FLATBREAD_API_URL and
   FLATBREAD_API_TOKEN yourself. pull and mcp only read: public runs, your own when you
@@ -11528,6 +12058,8 @@ Notes:
   127.0.0.1 only. Add the MCP server to Claude Code with:
     claude mcp add flatbread -- npx -y flatbread-cli mcp
   The viewer is a separate dev server: npm run dev -w @flatbread/web
+  Captured runs live in ~/.flatbread/bucket (FLATBREAD_HOOK_DISABLED=1 stops every capture).
+  A capture is not a share: to publish one, run share --file on its session.
   The hook offers ONE LINE at the end of a turn and never uploads anything itself. Turn it
   off with FLATBREAD_HOOK_DISABLED=1, or change when it speaks with
   FLATBREAD_HOOK_OFFER_AFTER=<turns>. It records what it has seen in ~/.flatbread.
@@ -11548,6 +12080,15 @@ function parseArgv(argv) {
     const arg = argv[i];
     if (arg === "--latest") {
       args.latest = true;
+    } else if (arg === "--save") {
+      args.out = OUTPUT_PATH;
+    } else if (arg === "--out") {
+      const value = argv[i + 1];
+      if (value === void 0 || value.startsWith("--")) throw new Error("--out needs a file path");
+      args.out = path20.resolve(value);
+      i += 1;
+    } else if (arg !== void 0 && arg.startsWith("--out=")) {
+      args.out = path20.resolve(arg.slice("--out=".length));
     } else if (arg === "--harness") {
       const value = argv[i + 1];
       if (value === void 0 || value.startsWith("--")) {
@@ -11643,7 +12184,9 @@ function report(result, outputPath) {
   lines2.push("");
   lines2.push(...briefLines(trace));
   lines2.push("");
-  lines2.push(`  wrote ${outputPath}`);
+  lines2.push(
+    outputPath === void 0 ? `  wrote nothing. --save writes ${OUTPUT_PATH} for the viewer` : `  wrote ${outputPath}`
+  );
   lines2.push("");
   console.log(lines2.join("\n"));
 }
@@ -11666,12 +12209,12 @@ async function runParse(args) {
     target = found[0];
     console.log(`latest ${harness} session: ${target}`);
   } else if (args.file) {
-    target = path18.resolve(args.file);
-    if (!fs19.existsSync(target)) {
+    target = path20.resolve(args.file);
+    if (!fs21.existsSync(target)) {
       console.error(`file not found: ${target}`);
       return 1;
     }
-    if (!fs19.statSync(target).isFile()) {
+    if (!fs21.statSync(target).isFile()) {
       console.error(`not a file: ${target}`);
       return 1;
     }
@@ -11701,9 +12244,11 @@ async function runParse(args) {
   }
   const trace = withLineage(result.trace, readGitLineage(result.trace.source.cwd));
   FlatbreadTraceSchema.parse(trace);
-  fs19.mkdirSync(path18.dirname(OUTPUT_PATH), { recursive: true });
-  fs19.writeFileSync(OUTPUT_PATH, JSON.stringify(trace, null, 2) + "\n", "utf8");
-  report({ ...result, trace }, OUTPUT_PATH);
+  if (args.out !== void 0) {
+    fs21.mkdirSync(path20.dirname(args.out), { recursive: true });
+    fs21.writeFileSync(args.out, JSON.stringify(trace, null, 2) + "\n", "utf8");
+  }
+  report({ ...result, trace }, args.out);
   return 0;
 }
 function parseAdaptersArgv(argv) {
@@ -11765,8 +12310,8 @@ async function runAdapters(args) {
   }
   let input = null;
   if (args.file !== void 0) {
-    const resolved = path18.resolve(args.file);
-    if (!fs19.existsSync(resolved)) {
+    const resolved = path20.resolve(args.file);
+    if (!fs21.existsSync(resolved)) {
       console.error(`file not found: ${resolved}`);
       return 1;
     }
@@ -11780,6 +12325,16 @@ async function runAdapters(args) {
   console.log("");
   return 0;
 }
+var COMMIT_REV = /^[A-Za-z0-9][A-Za-z0-9._/~^@{}-]{0,199}$/;
+function checkCommitRev(value) {
+  if (!COMMIT_REV.test(value)) throw new Error(`--commit needs a commit SHA or ref, e.g. --commit HEAD (got "${value}")`);
+  return value;
+}
+function checkTitle(value) {
+  const title = normalizeTitle(value);
+  if (title === null) throw new Error(`--title must be 1-${LIMITS.title} characters`);
+  return title;
+}
 function parseShareArgv(argv) {
   const args = { noReview: false, open: true, publish: false };
   for (let i = 0; i < argv.length; i += 1) {
@@ -11807,6 +12362,23 @@ function parseShareArgv(argv) {
       i += 1;
     } else if (arg !== void 0 && arg.startsWith("--pr=")) {
       args.prUrl = checkPrUrl(arg.slice("--pr=".length));
+    } else if (arg === "--title") {
+      const value = argv[i + 1];
+      if (value === void 0 || value.startsWith("--")) throw new Error("--title needs the run's title, in quotes");
+      args.title = checkTitle(value);
+      i += 1;
+    } else if (arg !== void 0 && arg.startsWith("--title=")) {
+      args.title = checkTitle(arg.slice("--title=".length));
+    } else if (arg === "--commit") {
+      const value = argv[i + 1];
+      if (value === void 0 || value.startsWith("--")) {
+        args.commit = "HEAD";
+      } else {
+        args.commit = checkCommitRev(value);
+        i += 1;
+      }
+    } else if (arg !== void 0 && arg.startsWith("--commit=")) {
+      args.commit = checkCommitRev(arg.slice("--commit=".length));
     } else if (arg === "--file") {
       const value = argv[i + 1];
       if (value === void 0 || value.startsWith("--")) {
@@ -11960,7 +12532,7 @@ function tryOpenBrowser(url) {
     const windows = process.platform === "win32";
     const command = windows ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
     const args = windows ? ["/c", "start", "", url] : [url];
-    const child = spawn2(command, args, { stdio: "ignore", detached: true, windowsHide: true });
+    const child = spawn3(command, args, { stdio: "ignore", detached: true, windowsHide: true });
     child.on("error", () => {
     });
     child.unref();
@@ -12075,7 +12647,7 @@ function parseHookArgv(argv) {
   if (known === void 0) {
     throw new Error(`unknown hook subcommand "${sub}". Known: ${HOOK_SUBCOMMANDS.join(", ")}`);
   }
-  const args = { sub: known, dryRun: false, noProbe: false };
+  const args = { sub: known, dryRun: false, noProbe: false, capture: false };
   for (let i = 0; i < rest.length; i += 1) {
     const flag = rest[i];
     if (flag === "--settings") {
@@ -12093,13 +12665,17 @@ function parseHookArgv(argv) {
       args.noProbe = true;
       continue;
     }
+    if (flag === "--capture" && known === "notify") {
+      args.capture = true;
+      continue;
+    }
     throw new Error(`unknown option for hook ${known}: ${flag}`);
   }
   if (known !== "install" && args.noProbe) {
     throw new Error("--no-probe only means anything to hook install");
   }
   if (known === "notify" && (args.settings !== void 0 || args.dryRun)) {
-    throw new Error("hook notify takes no options: Claude Code runs it with the event on stdin");
+    throw new Error("hook notify takes only --capture: Claude Code runs it with the event on stdin");
   }
   if (known === "status" && args.dryRun) {
     throw new Error("hook status writes nothing, so --dry-run means nothing here");
@@ -12111,7 +12687,7 @@ function parseHookArgv(argv) {
 }
 async function runHookCommand(args) {
   if (args.sub === "notify") {
-    return runHookNotify({ readStdin: () => readAllStdin(), entryPath: CLI_ENTRY });
+    return runHookNotify({ readStdin: () => readAllStdin(), entryPath: CLI_ENTRY, capture: args.capture });
   }
   if (args.sub === "install") {
     return runHookInstall({
@@ -12169,19 +12745,146 @@ async function runPull(args) {
     process.stdout.write(result.capsule);
     return 0;
   }
-  const target = path18.resolve(args.out);
-  fs19.mkdirSync(path18.dirname(target), { recursive: true });
-  fs19.writeFileSync(target, result.capsule, "utf8");
+  const target = path20.resolve(args.out);
+  fs21.mkdirSync(path20.dirname(target), { recursive: true });
+  fs21.writeFileSync(target, result.capsule, "utf8");
   console.error(`wrote ${target}`);
   return 0;
 }
+function parseSearchArgv(argv) {
+  const query = {};
+  const words = [];
+  let local = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    const valueOf = (flag) => {
+      if (arg.startsWith(`${flag}=`)) return arg.slice(flag.length + 1);
+      const value = argv[i + 1];
+      if (value === void 0 || value.startsWith("--")) throw new Error(`${flag} needs a value`);
+      i += 1;
+      return value;
+    };
+    if (arg === "--harness" || arg.startsWith("--harness=")) {
+      query.harness = toHarnessId(valueOf("--harness"));
+    } else if (arg === "--category" || arg.startsWith("--category=")) {
+      const value = valueOf("--category");
+      if (!TASK_CATEGORIES.includes(value)) throw new Error(`unknown --category "${value}". Known: ${TASK_CATEGORIES.join(", ")}`);
+      query.category = value;
+    } else if (arg === "--recovered") {
+      query.onlyWithRecoveries = true;
+    } else if (arg === "--local") {
+      local = true;
+    } else if (arg.startsWith("--")) {
+      throw new Error(`Unknown option for search: ${arg}`);
+    } else {
+      words.push(arg);
+    }
+  }
+  if (words.length > 0) query.query = words.join(" ");
+  return { query, local };
+}
+async function runSearch(argv, deps = defaultMcpDeps(storeDir(), bucketDir()), print = console.log) {
+  const { query, local } = parseSearchArgv(argv);
+  const { lines: lines2, siteSearched } = await searchEverywhere(query, deps, { remote: !local });
+  for (const line of lines2) print(line);
+  return local || siteSearched ? 0 : 1;
+}
+function parseCaptureArgv(argv) {
+  const args = { quiet: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    const next = argv[i + 1];
+    if (arg === "--file" || arg === "--repo" || arg === "--harness") {
+      if (next === void 0 || next.startsWith("--")) throw new Error(`${arg} needs a value`);
+      if (arg === "--file") args.file = next;
+      else if (arg === "--repo") args.repo = next;
+      else args.harness = toHarnessId(next);
+      i += 1;
+    } else if (arg === "--commit") {
+      if (next === void 0 || next.startsWith("--")) {
+        args.commit = "HEAD";
+      } else {
+        args.commit = checkCommitRev(next);
+        i += 1;
+      }
+    } else if (arg.startsWith("--commit=")) {
+      args.commit = checkCommitRev(arg.slice("--commit=".length));
+    } else if (arg === "--quiet") {
+      args.quiet = true;
+    } else {
+      throw new Error(`Unknown option for capture: ${arg}`);
+    }
+  }
+  if (args.file !== void 0 && args.repo !== void 0) throw new Error("capture takes --file or --repo, not both");
+  return args;
+}
+async function runCapture(args, env = process.env) {
+  const dir = bucketDir(env);
+  const say = (line) => args.quiet ? logCapture(dir, line) : console.log(line);
+  try {
+    if (args.quiet && (env["FLATBREAD_HOOK_DISABLED"] ?? "").trim() !== "") {
+      say("skipped FLATBREAD_HOOK_DISABLED is set");
+      return 0;
+    }
+    let file = args.file;
+    if (file === void 0) {
+      const found = sessionForRepo(args.repo ?? process.cwd(), { env });
+      if ("problem" in found) {
+        say(`skipped ${found.problem}`);
+        return 0;
+      }
+      file = found.file;
+    }
+    const result = await captureToBucket({
+      file,
+      env,
+      dir,
+      ...args.harness !== void 0 ? { harness: args.harness } : {},
+      ...args.commit !== void 0 ? { commit: args.commit } : {}
+    });
+    if (result.status === "refused") {
+      say(`refused ${result.reason}`);
+      return args.quiet ? 0 : 1;
+    }
+    say(
+      `${result.status} ${result.slug} ${result.steps} steps, ${result.redacted} redacted` + (result.commit !== void 0 ? `, at ${result.commit.slice(0, 12)}` : "") + ` -> ${result.path}`
+    );
+    return 0;
+  } catch (error) {
+    say(`failed ${error instanceof Error ? error.message : String(error)}`);
+    return args.quiet ? 0 : 1;
+  }
+}
+function parseSetupArgv(argv) {
+  const args = {
+    dryRun: false,
+    uninstall: false,
+    noGit: false,
+    noProbe: false
+  };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--dry-run") args.dryRun = true;
+    else if (arg === "--uninstall") args.uninstall = true;
+    else if (arg === "--no-git") args.noGit = true;
+    else if (arg === "--no-probe") args.noProbe = true;
+    else if (arg === "--settings") {
+      const value = argv[i + 1];
+      if (value === void 0 || value.startsWith("--")) throw new Error("--settings needs a path");
+      args.settings = value;
+      i += 1;
+    } else throw new Error(`Unknown option for setup: ${arg}`);
+  }
+  if (args.uninstall && args.noProbe) throw new Error("--no-probe only means anything when installing");
+  return args;
+}
 async function main(argv) {
   const [command, ...rest] = argv;
   if (command === void 0 || command === "--help" || command === "-h" || command === "help") {
     console.log(USAGE);
     return command === void 0 ? 1 : 0;
   }
-  if (command !== "parse" && command !== "share" && command !== "view" && command !== "adapters" && command !== "login" && command !== "logout" && command !== "whoami" && command !== "hook" && command !== "pull" && command !== "mcp") {
+  if (command !== "parse" && command !== "share" && command !== "view" && command !== "adapters" && command !== "login" && command !== "logout" && command !== "whoami" && command !== "hook" && command !== "pull" && command !== "mcp" && command !== "search" && command !== "setup" && command !== "capture") {
     console.error(`Unknown command: ${command}`);
     console.error(USAGE);
     return 1;
@@ -12200,6 +12903,24 @@ async function main(argv) {
     }
     return runHookCommand(hookArgs);
   }
+  if (command === "search" || command === "setup" || command === "capture") {
+    try {
+      if (command === "search") return await runSearch(rest);
+      if (command === "capture") return await runCapture(parseCaptureArgv(rest));
+      const setup = parseSetupArgv(rest);
+      return runSetup({
+        entryPath: CLI_ENTRY,
+        dryRun: setup.dryRun,
+        uninstall: setup.uninstall,
+        noGit: setup.noGit,
+        noProbe: setup.noProbe,
+        ...setup.settings !== void 0 ? { settingsPath: setup.settings } : {}
+      });
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      return 1;
+    }
+  }
   if (command === "login") return runLogin(rest);
   if (command === "logout") return runLogout();
   if (command === "whoami") return runWhoami();
@@ -12218,7 +12939,7 @@ async function main(argv) {
       console.error(`mcp takes no options, got: ${rest.join(" ")}`);
       return 1;
     }
-    return runMcpServer(defaultMcpDeps(storeDir()));
+    return runMcpServer(defaultMcpDeps(storeDir(), bucketDir()));
   }
   if (command === "pull") {
     let pullArgs;
@@ -12251,10 +12972,11 @@ async function main(argv) {
       noReview: shareArgs.noReview,
       publish: shareArgs.publish,
       ...shareArgs.prUrl !== void 0 ? { prUrl: shareArgs.prUrl } : {},
+      ...shareArgs.title !== void 0 ? { title: shareArgs.title } : {},
+      ...shareArgs.commit !== void 0 ? { commit: shareArgs.commit } : {},
       ...storeDir() !== null ? { storeDir: storeDir() } : {},
       openBrowser: shareArgs.open && !shareArgs.noReview,
-      outputPath: SHARE_OUTPUT_PATH,
-      parseOutputPath: OUTPUT_PATH
+      outputPath: SHARE_OUTPUT_PATH
     });
     return result.exitCode;
   }
@@ -12272,9 +12994,9 @@ var invokedDirectly = (() => {
   if (entry === void 0) return false;
   const real = (file) => {
     try {
-      return fs19.realpathSync(file);
+      return fs21.realpathSync(file);
     } catch {
-      return path18.resolve(file);
+      return path20.resolve(file);
     }
   };
   return real(entry) === real(fileURLToPath(import.meta.url));
@@ -12293,8 +13015,13 @@ export {
   TMP_DIR,
   main,
   openableUrl,
+  parseCaptureArgv,
   parsePullArgv,
+  parseSearchArgv,
+  parseSetupArgv,
+  runCapture,
   runLogin,
   runLogout,
+  runSearch,
   runWhoami
 };