knodin 0.8.7 → 0.10.0

package/dist/bin/cli.js

@@ -14,12 +14,12 @@
 import { spawn, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import readline from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { canUseSessionContextCache, parseClaudeHookPayload, readSessionContextCache, recordClaudeLifecycleEvent, renderSessionContext, SESSION_CONTEXT_BUDGET_LINE, sessionStartHookOutput, writeSessionContextCache, } from "../src/agent-events.js";
 import { inspectClaudeAgentHooks, installClaudeAgentHooks, uninstallClaudeAgentHooks, } from "../src/agent-hooks.js";
 import { detectSupportedAgents, parseInitScope, } from "../src/agent-integration.js";
 import { refreshExternalGraphArtifacts, writeArtifactRefreshRecord, } from "../src/artifact-refresh.js";
+import { formatBackupHuman, installBackupRetention, listBackups, maybeRunOpportunisticRetention, pruneBackups, removeBackupRetention, retentionDoctor, retentionStatus, runInstalledRetention, } from "../src/backup-retention.js";
 import { checkIndexed, extractPositionals, extractRepoFlag, parseReviewArgs, planIndex, resolveCliRuntimeCommand, resolveRepo, } from "../src/cli-args.js";
 import { helpCommandPath, parseCliInvocation, renderCliHelp } from "../src/cli-model.js";
 import { buildKnodinContext } from "../src/context.js";
@@ -27,20 +27,24 @@ import { exportContext, grepPackedArtifact, readPackedArtifact } from "../src/co
 import { clearDiagnostics, collectDiagnostics, diagnosticsStatus, disableDiagnostics, enableDiagnostics, inspectDiagnosticsBundle, persistDiagnosticsPreview, recordDiagnosticFailure, } from "../src/diagnostics.js";
 import { getDocSection, listDocTopics } from "../src/docs-sections.js";
 import { diagnoseInstallation } from "../src/doctor.js";
-import { createEngine, REPO_WIDE_QUERY_PATTERNS, } from "../src/engine/index.js";
+import { createEngine, KNODIN_SCHEMA_VERSION, REPO_WIDE_QUERY_PATTERNS, } from "../src/engine/index.js";
+import { runSeal } from "../src/engine/seal-command.js";
+import { runSealedQuery } from "../src/engine/sealed-query.js";
 import { resolveDbPath } from "../src/engine/state-paths.js";
 import { diagnoseFailure, } from "../src/failure-diagnosis.js";
 import { gitExecutable } from "../src/git-executable.js";
 import { decorateGraphQueryResult, inspectGraphQueryHealth } from "../src/graph-query-health.js";
 import { createIndexActivityReporter } from "../src/index-activity.js";
-import { detectTrackedTeamIntegration, InitializationHealthError, initializeRepository, inspectRepositoryIntegrationStatus, readRepositoryIntegrationConfig, refreshFromGitEvent, } from "../src/init.js";
+import { InitializationHealthError, initializeRepository, inspectRepositoryIntegrationStatus, readRepositoryIntegrationConfig, refreshFromGitEvent, } from "../src/init.js";
 import { createInitProgressRenderer } from "../src/init-progress.js";
 import { attachLifecycleHealth, attachRepairLifecycle } from "../src/lifecycle-health.js";
+import { acknowledgeUpdateFailure, queryOwnerAvailability, readManagerUpdateState, readUpdateJournal, resolveManagerOwnership, setManualPin, unpinUpdate, updateAttention, writeManagerUpdateState, } from "../src/manager-update.js";
 import { addMirror, listMirrors, refreshMirror, removeMirror } from "../src/mirror.js";
 import { compressOutput, compressOutputFile, deleteOutputArtifact, readOutputArtifact, } from "../src/output-compression.js";
 import { clearTelemetry, exportTelemetry, readTelemetryRecords, telemetryStatus, writeTelemetryReport, } from "../src/output-telemetry.js";
 import { auditPullRequests } from "../src/pr-triage.js";
 import { deliverProgressiveEvidence, } from "../src/progressive-evidence.js";
+import { acquireRepairLease } from "../src/repair-lease.js";
 import { createRepairPlan, createRepairProgressRenderer, parseRepairCliArgs, resolveRepairProgressMode, serializeRepairJsonlRecord, } from "../src/repair-progress.js";
 import { runRepositoryInitializationProcess } from "../src/repository-init-process.js";
 import { detectRepositorySignals, discoverRepositories, formatRepositoryHuman, initializeRepositories, inventoryRepository, parseFleetInitArgs, parseRepositoryCommandArgs, repositorySignalInspectionLimit, searchRepositories, withRepositorySignals, } from "../src/repository-management.js";
@@ -49,11 +53,14 @@ import { appendSessionEvent, clearSessionTelemetry, disableSessionTelemetry, ena
 import { inspectKnodinSkills, installKnodinSkills, KNODIN_SKILLS, removeKnodinSkills, } from "../src/skill-management.js";
 import { configuredRepositoryInitMemoryLimitBytes, enrichSystemRelationships, incorporateSystemQueryEvidence, indexModeForPath, loadSystemConfiguration, queryConfiguredSystem, systemMembershipsForPath, validateSystemHealth, } from "../src/system-config.js";
 import { applySystemPlan, planSystemImport, planSystemLink, planSystemRelate, planSystemUnlink, planSystemUnrelate, } from "../src/system-management.js";
+import { coordinationStatus } from "../src/update-coordination.js";
+import { certifyAutomaticUpdates, executeManagerUpdate, recoverInterruptedUpdate, } from "../src/update-executor.js";
 import { applyTrustedUpdate, checkTrustedUpdate, claimScheduledUpdateCheck, detectUpdateInstallMethod, explainTrustedUpdate, releaseScheduledUpdateCheck, rollbackTrustedUpdate, trustedUpdateStatus, } from "../src/update-policy.js";
 import { KNODIN_VERSION } from "../src/version.js";
 import { writeVisualization, } from "../src/visualization.js";
 import { waitForFresh } from "../src/wait-for-fresh.js";
 import { inspectWorktrees, reconcileWorktrees, removeManagedWorktree, } from "../src/worktree-lifecycle.js";
+import { indexOrSeed } from "../src/worktree-seed.js";
 function explicitScope(args) {
     const index = args.indexOf("--scope");
     if (index >= 0) {
@@ -65,44 +72,6 @@ function explicitScope(args) {
     const equals = args.find((argument) => argument.startsWith("--scope="));
     return equals ? parseInitScope(equals.slice("--scope=".length)) : null;
 }
-async function chooseInitScope(args, repo) {
-    const selected = explicitScope(args);
-    if (selected)
-        return selected;
-    if (detectTrackedTeamIntegration(repo)) {
-        process.stderr.write("[init:scope] Detected tracked knodin team integration; preserving team scope\n");
-        return "team";
-    }
-    if (!process.stdin.isTTY || !process.stderr.isTTY)
-        return "personal";
-    const prompt = readline.createInterface({
-        input: process.stdin,
-        output: process.stderr,
-    });
-    try {
-        const answer = await prompt.question([
-            "How should knodin integrate with coding agents?",
-            "  1. Personal (recommended) — all detected agents; Git stays clean",
-            "  2. Team — create commit-ready shared configuration",
-            "  3. CLI-only — agents will not discover or invoke knodin automatically",
-            "Select [1]: ",
-        ].join("\n"));
-        if (!answer.trim() || answer.trim() === "1")
-            return "personal";
-        if (answer.trim() === "2")
-            return "team";
-        if (answer.trim() === "3") {
-            const confirmation = await prompt.question("CLI-only requires manual knodin commands. Continue? [y/N] ");
-            if (!/^y(?:es)?$/i.test(confirmation.trim()))
-                throw new Error("knodin init: CLI-only selection cancelled");
-            return "cli-only";
-        }
-        return parseInitScope(answer.trim());
-    }
-    finally {
-        prompt.close();
-    }
-}
 function integrationAgents(repo) {
     const previous = readRepositoryIntegrationConfig(repo)?.agents ?? [];
     const repositoryDetected = inspectRepositoryIntegrationStatus(repo)?.agents ?? [];
@@ -151,7 +120,7 @@ function formatConfigureHuman(result) {
     const externalOutcomeLines = result.paths.externalConfigurationOutcomes
         .map(({ system, state }) => `\nExternal configuration outcome: ${system} ${state} (external mutation not locally observable)`)
         .join("");
-    return `${result.message}\nAgent integration: ${result.paths.scope} — ${configured}${failures}${filesystemMutationLines}${externalOutcomeLines}\nGraph initialization: unchanged\nLifecycle refresh: ${refresh}\nNext: ${result.nextAction}\n`;
+    return `${result.message}\nAgent integration: ${result.paths.scope} — ${configured}${failures}${filesystemMutationLines}${externalOutcomeLines}\nGraph initialization: refreshed and verified\nLifecycle refresh: ${refresh}\nNext: ${result.nextAction}\n`;
 }
 function formatRepairHuman(result) {
     const coverage = result.after.coverage;
@@ -652,7 +621,7 @@ async function main() {
                 depth: 0,
                 include: [repository],
                 command: resolveCliRuntimeCommand(process),
-                index: (target) => engine.index(target),
+                index: indexOrSeed(engine, KNODIN_SCHEMA_VERSION),
                 status: (target) => engine.status(target),
                 agents: detectSupportedAgents(),
                 indexMode: (target) => indexModeForPath(loadSystemConfiguration(target), target),
@@ -705,6 +674,26 @@ async function main() {
     // `--json` is a shared output flag. Repair owns its richer --json/--jsonl
     // parser; all other commands receive their original arguments minus it.
     const rest = cmd === "repair" ? rawRest : rawRest.filter((argument) => argument !== "--json");
+    let recoveryJournal = readUpdateJournal();
+    const recoverySafeStates = new Set(["planned", "candidate-verified", "rollback-verified"]);
+    if (recoveryJournal && !recoverySafeStates.has(recoveryJournal.state) && cmd !== "doctor") {
+        const recovery = await recoverInterruptedUpdate({ runtimeCommand, env: process.env });
+        recoveryJournal = readUpdateJournal();
+        if (recovery?.status === "terminal-unhealthy" && cmd !== "update") {
+            throw new Error(`knodin update recovery is terminal-unhealthy: ${recovery.reason ?? "candidate and rollback verification failed"}`);
+        }
+    }
+    if (recoveryJournal &&
+        !recoverySafeStates.has(recoveryJournal.state) &&
+        cmd !== "update" &&
+        cmd !== "doctor") {
+        throw new Error(`knodin is in unverified update state ${recoveryJournal.state}; run \`knodin update status\` for recovery guidance`);
+    }
+    if (!jsonOutput && cmd !== "update") {
+        const attention = updateAttention(readManagerUpdateState());
+        if (attention)
+            process.stderr.write(`${attention}\n`);
+    }
     const selector = {
         identity: selectorValue("--identity"),
         file: selectorValue("--file"),
@@ -776,7 +765,7 @@ async function main() {
             depth: plan.depth,
             dryRun: plan.dryRun,
             worktrees: plan.worktrees,
-            index: (target) => engine.index(target),
+            index: indexOrSeed(engine, KNODIN_SCHEMA_VERSION),
             status: (target) => engine.status(target),
             agents: detectSupportedAgents(),
             indexMode: (target) => indexModeForPath(systemConfig, target),
@@ -826,7 +815,11 @@ async function main() {
                 repositories,
             };
             const boundedOutput = plan.signals
-                ? applyResponseBudget(output, "repositories:discover", { bytes: plan.byteBudget, tokens: plan.tokenBudget, items: plan.itemBudget }, { bytes: 65_536, tokens: 16_384, items: 100 })
+                ? applyResponseBudget(output, "repositories:discover", {
+                    bytes: plan.byteBudget,
+                    tokens: plan.tokenBudget,
+                    items: plan.itemBudget,
+                }, { bytes: 65_536, tokens: 16_384, items: 100 })
                 : output;
             process.stdout.write(`${JSON.stringify(boundedOutput, null, plan.json ? 0 : 2)}\n`);
             process.exitCode = discovery.issues.length > 0 ? 1 : 0;
@@ -880,7 +873,7 @@ async function main() {
                 manifestPath: plan.manifestPath,
                 include: plan.include,
                 exclude: plan.exclude,
-                index: (target) => engine.index(target),
+                index: indexOrSeed(engine, KNODIN_SCHEMA_VERSION),
                 status: (target) => engine.status(target),
                 agents: detectSupportedAgents(),
                 indexMode: (target) => indexModeForPath(systemConfig, target),
@@ -903,7 +896,12 @@ async function main() {
                 }));
             }
             await engine.close();
-            const output = { schemaVersion: 1, command: "init", ...summary, repositories };
+            const output = {
+                schemaVersion: 1,
+                command: "init",
+                ...summary,
+                repositories,
+            };
             process.stdout.write(plan.json ? `${JSON.stringify(output)}\n` : formatRepositoryHuman(summary));
             process.exitCode = summary.exitCode;
             return;
@@ -1010,13 +1008,15 @@ async function main() {
     if (cmd === "update") {
         if (repoFlag !== undefined)
             throw new Error("knodin update does not accept --repo");
-        const [action, ...unsupported] = rest;
-        if (!action || !["status", "check", "explain", "apply", "rollback"].includes(action)) {
-            throw new Error("knodin update requires status, check, explain, apply, or rollback");
-        }
-        if (unsupported.length > 0)
-            throw new Error(`knodin update ${action}: unknown argument ${unsupported[0]}`);
+        const [action, ...actionArguments] = rest;
+        if (!action)
+            throw new Error("knodin update requires an action");
         const method = detectUpdateInstallMethod(runtimeCommand);
+        const owner = resolveManagerOwnership({
+            runtimeCommand,
+            executablePath: runtimeCommand.at(-1),
+            env: process.env,
+        });
         const runManager = async (argv) => {
             const [executable, ...arguments_] = argv;
             if (!executable)
@@ -1052,8 +1052,16 @@ async function main() {
             healthCheck,
         };
         let output;
-        if (action === "status")
-            output = trustedUpdateStatus(options);
+        if (action === "status") {
+            output = {
+                ...trustedUpdateStatus(options),
+                owner,
+                managerState: readManagerUpdateState(),
+                journal: readUpdateJournal(),
+                coordination: coordinationStatus(),
+                attention: updateAttention(readManagerUpdateState()),
+            };
+        }
         else if (action === "check") {
             try {
                 output = await checkTrustedUpdate(options);
@@ -1067,11 +1075,178 @@ async function main() {
             output = explainTrustedUpdate(options);
         else if (action === "apply")
             output = await applyTrustedUpdate(options);
-        else
+        else if (action === "rollback")
             output = await rollbackTrustedUpdate(options);
+        else if (action === "available") {
+            output = await queryOwnerAvailability({ installedVersion: KNODIN_VERSION, owner });
+            const availability = output;
+            const state = readManagerUpdateState();
+            if (availability.latestVersion &&
+                state.pin?.kind === "automatic-rollback" &&
+                state.pin.acknowledgedFailedVersion === state.pin.failedVersion &&
+                availability.latestVersion !== state.pin.failedVersion) {
+                writeManagerUpdateState({
+                    ...state,
+                    lastAvailableVersion: availability.latestVersion,
+                    pin: { ...state.pin, newerAvailableVersion: availability.latestVersion },
+                });
+            }
+        }
+        else if (action === "upgrade") {
+            const apply = actionArguments.includes("--apply");
+            const explicitVersion = actionArguments.find((argument) => argument !== "--apply");
+            let targetVersion = explicitVersion;
+            if (!targetVersion) {
+                const availability = await queryOwnerAvailability({
+                    installedVersion: KNODIN_VERSION,
+                    owner,
+                });
+                if (!availability.latestVersion)
+                    output = availability;
+                else
+                    targetVersion = availability.latestVersion;
+            }
+            if (targetVersion)
+                output = await executeManagerUpdate({
+                    currentVersion: KNODIN_VERSION,
+                    targetVersion,
+                    runtimeCommand,
+                    env: process.env,
+                    apply,
+                });
+        }
+        else if (action === "pin") {
+            const apply = actionArguments.includes("--apply");
+            const version = actionArguments.find((argument) => argument !== "--apply");
+            if (!version)
+                throw new Error("knodin update pin requires a version");
+            output = apply
+                ? await executeManagerUpdate({
+                    currentVersion: KNODIN_VERSION,
+                    targetVersion: version,
+                    runtimeCommand,
+                    env: process.env,
+                    apply: true,
+                    pinKind: "manual",
+                })
+                : setManualPin(version);
+        }
+        else if (action === "unpin")
+            output = unpinUpdate();
+        else if (action === "acknowledge")
+            output = acknowledgeUpdateFailure();
+        else if (action === "auto") {
+            const subaction = actionArguments[0];
+            if (!subaction || !["status", "enable", "disable", "run"].includes(subaction))
+                throw new Error("knodin update auto requires status, enable, disable, or run");
+            const state = readManagerUpdateState();
+            if (subaction === "status")
+                output = state;
+            else if (subaction === "disable") {
+                output = { ...state, autoEnabled: false };
+                writeManagerUpdateState(output);
+            }
+            else if (subaction === "enable") {
+                if (state.platformAutoEligible) {
+                    output = { ...state, autoEnabled: true };
+                    writeManagerUpdateState(output);
+                }
+                else
+                    output = await certifyAutomaticUpdates({
+                        currentVersion: KNODIN_VERSION,
+                        runtimeCommand,
+                        env: process.env,
+                    });
+            }
+            else if (!state.autoEnabled || !state.platformAutoEligible) {
+                output = { ...state, status: "disabled" };
+            }
+            else {
+                const availability = await queryOwnerAvailability({
+                    installedVersion: KNODIN_VERSION,
+                    owner,
+                });
+                output =
+                    availability.status === "available" &&
+                        availability.autoEligible &&
+                        availability.latestVersion
+                        ? await executeManagerUpdate({
+                            currentVersion: KNODIN_VERSION,
+                            targetVersion: availability.latestVersion,
+                            runtimeCommand,
+                            env: process.env,
+                            apply: true,
+                        })
+                        : availability;
+            }
+        }
+        else
+            throw new Error(`knodin update: unknown action ${action}`);
         process.stdout.write(jsonOutput ? `${JSON.stringify(output)}\n` : formatGenericHuman("update", output));
         return;
     }
+    if (cmd === "backups") {
+        const action = invocation.commandPath[1];
+        const retentionAction = invocation.commandPath[2];
+        const roots = invocation.positionals;
+        const defaultRoots = () => {
+            if (roots.length > 0)
+                return roots;
+            const target = resolveRepo(repoFlag, process.cwd());
+            if (!target.ok)
+                throw new Error(target.error);
+            return [target.repo];
+        };
+        const depth = invocation.options.depth;
+        const retentionDays = invocation.options.retentionDays;
+        const keepNewest = invocation.options.keepNewest;
+        let output;
+        if (action === "list")
+            output = listBackups(defaultRoots(), { depth });
+        else if (action === "prune") {
+            output = pruneBackups(defaultRoots(), {
+                depth,
+                retentionDays,
+                keepNewest,
+                apply: invocation.options.apply === true,
+            });
+        }
+        else if (action === "retention" && retentionAction === "install") {
+            output = installBackupRetention(roots, {
+                depth,
+                retentionDays,
+                keepNewest,
+                schedule: invocation.options.schedule,
+                dryRun: invocation.options.dryRun === true,
+                launcher: runtimeCommand,
+            });
+        }
+        else if (action === "retention" && retentionAction === "status") {
+            output = retentionStatus();
+        }
+        else if (action === "retention" && retentionAction === "doctor") {
+            output = retentionDoctor();
+        }
+        else if (action === "retention" && retentionAction === "remove") {
+            output = removeBackupRetention();
+        }
+        else if (action === "retention" && retentionAction === "run") {
+            output = runInstalledRetention();
+        }
+        else {
+            throw new Error("knodin backups requires list, prune, or retention install|status|doctor|remove");
+        }
+        if (invocation.options.jsonl === true) {
+            const records = output.backups ??
+                output.candidates ?? [output];
+            for (const record of records)
+                process.stdout.write(`${JSON.stringify(record)}\n`);
+        }
+        else {
+            process.stdout.write(jsonOutput ? `${JSON.stringify(output)}\n` : formatBackupHuman("backups", output));
+        }
+        return;
+    }
     if (process.stdout.isTTY &&
         claimScheduledUpdateCheck({
             currentVersion: KNODIN_VERSION,
@@ -1123,6 +1298,14 @@ async function main() {
         process.exit(1);
     }
     const repo = resolved.repo;
+    if (cmd !== "doctor") {
+        try {
+            maybeRunOpportunisticRetention(repo);
+        }
+        catch {
+            // Best-effort cleanup must never make an ordinary command fail.
+        }
+    }
     if (cmd === "agent-event" && !fs.existsSync(resolveDbPath(repo)))
         return;
     if (cmd === "doctor") {
@@ -1246,7 +1429,10 @@ async function main() {
             const input = positionals[0] === "create" ? (positionals[1] ?? "-") : (positionals[0] ?? "-");
             compressionResult =
                 input === "-"
-                    ? compressOutput(repo, { ...request, text: await readBoundedStdin(maxInputBytes) })
+                    ? compressOutput(repo, {
+                        ...request,
+                        text: await readBoundedStdin(maxInputBytes),
+                    })
                     : compressOutputFile(repo, input, request);
         }
         if (action === "diagnose" &&
@@ -1325,7 +1511,10 @@ async function main() {
                     if (existing.state !== "configured")
                         throw new Error("knodin shared configure --disable requires a valid existing configuration");
                     writeSharedIndexConfig(repo, { ...existing.config, enabled: false });
-                    result = { state: "configured", config: { ...existing.config, enabled: false } };
+                    result = {
+                        state: "configured",
+                        config: { ...existing.config, enabled: false },
+                    };
                     break;
                 }
                 const required = (name) => {
@@ -1360,7 +1549,11 @@ async function main() {
                     },
                 };
                 const target = writeSharedIndexConfig(repo, config);
-                result = { state: "configured", path: target, config: loadSharedIndexConfig(repo) };
+                result = {
+                    state: "configured",
+                    path: target,
+                    config: loadSharedIndexConfig(repo),
+                };
                 break;
             }
             if (action === "publisher-metadata") {
@@ -1394,7 +1587,10 @@ async function main() {
                 if (!bundlePath)
                     throw new Error("knodin shared publisher-finalize requires <bundle>");
                 const bundle = JSON.parse(fs.readFileSync(path.resolve(process.cwd(), bundlePath), "utf8"));
-                const pointer = finalizeSharedPublisherBundle({ config: configuration.config, bundle });
+                const pointer = finalizeSharedPublisherBundle({
+                    config: configuration.config,
+                    bundle,
+                });
                 result = { bundle, pointer: JSON.parse(pointer.toString("utf8")) };
                 break;
             }
@@ -1421,12 +1617,19 @@ async function main() {
                 let credentialProbe = "not-requested";
                 if (invocation.options.probe === true) {
                     if (configuration.state !== "configured" || !configuration.config.enabled) {
-                        credentialProbe = { state: "unavailable", category: "configuration" };
+                        credentialProbe = {
+                            state: "unavailable",
+                            category: "configuration",
+                        };
                     }
                     else {
                         const store = createSharedObjectStore(configuration.config);
                         try {
-                            const current = spawnSync(gitExecutable(), ["symbolic-ref", "--quiet", "--short", "HEAD"], { cwd: repo, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).stdout.trim();
+                            const current = spawnSync(gitExecutable(), ["symbolic-ref", "--quiet", "--short", "HEAD"], {
+                                cwd: repo,
+                                encoding: "utf8",
+                                stdio: ["ignore", "pipe", "ignore"],
+                            }).stdout.trim();
                             const branch = configuredBranchCandidates(configuration.config, current || undefined)[0];
                             if (!store || !branch)
                                 throw new SharedIndexError("configuration", "shared-index probe has no configured local branch candidate");
@@ -1667,7 +1870,7 @@ async function main() {
                             continue;
                         await initializeRepository(checkout, {
                             command: runtimeCommand,
-                            index: (target, indexOptions) => engine.index(target, undefined, false, indexOptions),
+                            index: indexOrSeed(engine, KNODIN_SCHEMA_VERSION),
                             scope: "personal",
                             agents: [],
                         });
@@ -1703,7 +1906,11 @@ async function main() {
                 const [systemId, ...repositories] = invocation.positionals;
                 if (!systemId)
                     throw new Error("knodin system unlink requires <system-id>");
-                const plan = planSystemUnlink({ systemId, repositories, repoPath: repo });
+                const plan = planSystemUnlink({
+                    systemId,
+                    repositories,
+                    repoPath: repo,
+                });
                 result = invocation.options.dryRun === true ? plan : applySystemPlan(plan);
                 break;
             }
@@ -1822,32 +2029,39 @@ async function main() {
             break;
         }
         case "hook-refresh": {
-            const [kind, first, second] = rest;
-            let event;
-            if (kind === "commit")
-                event = { kind };
-            else if (kind === "checkout" && first && second) {
-                event = { kind, before: first, after: second };
-            }
-            else if (kind === "merge" && first && second) {
-                event = { kind, before: first, after: second };
-            }
-            else if (kind === "rewrite" && first) {
-                event = { kind, inputPath: first };
+            const lifecycleLease = acquireRepairLease(repo, "lifecycle-hook");
+            try {
+                const [kind, first, second] = rest;
+                let event;
+                if (kind === "commit")
+                    event = { kind };
+                else if (kind === "checkout" && first && second) {
+                    event = { kind, before: first, after: second };
+                }
+                else if (kind === "merge" && first && second) {
+                    event = { kind, before: first, after: second };
+                }
+                else if (kind === "rewrite" && first) {
+                    event = { kind, inputPath: first };
+                }
+                else {
+                    throw new Error("knodin hook-refresh: invalid lifecycle event");
+                }
+                const shared = await opportunisticSharedRestore();
+                const indexed = shared?.restored
+                    ? []
+                    : await refreshFromGitEvent(repo, event, (target, files) => engine.index(target, files));
+                result = { indexed, ...(shared ? { sharedRestore: shared } : {}) };
             }
-            else {
-                throw new Error("knodin hook-refresh: invalid lifecycle event");
+            finally {
+                lifecycleLease.release();
             }
-            const shared = await opportunisticSharedRestore();
-            const indexed = shared?.restored
-                ? []
-                : await refreshFromGitEvent(repo, event, (target, files) => engine.index(target, files));
-            result = { indexed, ...(shared ? { sharedRestore: shared } : {}) };
             break;
         }
         case "init": {
-            const scope = await chooseInitScope(rawRest, repo);
-            const agents = scope === "team" ? [] : integrationAgents(repo);
+            const requestedScope = explicitScope(rawRest);
+            const scope = requestedScope ?? readRepositoryIntegrationConfig(repo)?.scope ?? "cli-only";
+            const agents = requestedScope && scope !== "team" ? integrationAgents(repo) : [];
             const renderer = createInitRenderer();
             const activity = createIndexActivityReporter(repo);
             activity.start();
@@ -1862,9 +2076,10 @@ async function main() {
                     }
                     paths = await initializeRepository(repo, {
                         command: runtimeCommand,
-                        index: (target, options) => engine.index(target, undefined, false, options),
+                        index: indexOrSeed(engine, KNODIN_SCHEMA_VERSION),
                         scope,
                         agents,
+                        configureIntegration: requestedScope !== null,
                         onProgress: (event) => {
                             activity.update(event);
                             renderer.onProgress(event);
@@ -1909,16 +2124,17 @@ async function main() {
             const agents = scope === "team" ? [] : integrationAgents(repo);
             const paths = await initializeRepository(repo, {
                 command: runtimeCommand,
-                index: async () => undefined,
+                index: indexOrSeed(engine, KNODIN_SCHEMA_VERSION),
                 scope,
                 agents,
                 allowTrackedTransition: true,
                 auditConfigurationChanges: true,
+                configureIntegration: true,
             });
             result = {
                 status: "success",
                 message: `knodin agent integration changed to ${scope}.`,
-                graphInitialization: "unchanged",
+                graphInitialization: "refreshed",
                 nextAction: "run `knodin status` and reload the configured client",
                 paths,
             };
@@ -2068,7 +2284,9 @@ async function main() {
             }
             const progressMode = resolveRepairProgressMode(options, process.env, process.stderr.isTTY);
             const renderer = progressMode === "tty"
-                ? createProgressWorkerRenderer("repair-progress-worker", { type: "start" })
+                ? createProgressWorkerRenderer("repair-progress-worker", {
+                    type: "start",
+                })
                 : (() => {
                     const direct = createRepairProgressRenderer({
                         mode: progressMode,
@@ -2211,6 +2429,29 @@ async function main() {
             }));
             break;
         }
+        case "seal": {
+            const output = selectorValue("--output");
+            if (!output)
+                throw new Error("knodin seal requires --output <path.sqlite>");
+            result = await runSeal({
+                repoPath: repo,
+                outputPath: output,
+                // Embeddings dominate artifact size and code lookup is served
+                // lexically plus by graph traversal, so they are stripped unless
+                // asked for.
+                stripEmbeddings: !rest.includes("--keep-embeddings"),
+                includeExcluded: rest.includes("--include-excluded"),
+            });
+            break;
+        }
+        case "sealed": {
+            if (!rest[0])
+                throw new Error("knodin sealed requires an artifact path");
+            result = await runSealedQuery(rest[0], rest[1], {
+                strictCompat: rest.includes("--strict-compat"),
+            });
+            break;
+        }
         case "pack": {
             const action = rest[0];
             const diffScope = selectorValue("--diff-scope");
@@ -2509,7 +2750,10 @@ async function main() {
             else if (action === "export")
                 result = exportTelemetry(repo, readTelemetryRecords(repo, input, retentionDays), selectorValue("--output"), readSessionEvents(repo, retentionDays));
             else if (action === "clear")
-                result = { ...clearTelemetry(repo, input), session: clearSessionTelemetry(repo) };
+                result = {
+                    ...clearTelemetry(repo, input),
+                    session: clearSessionTelemetry(repo),
+                };
             else
                 throw new Error("knodin telemetry requires enable, disable, status, report, export, or clear");
             break;
@@ -2581,7 +2825,11 @@ async function main() {
                 result =
                     action === "preview"
                         ? persistDiagnosticsPreview(repo, options)
-                        : collectDiagnostics(repo, { ...options, outputPath: outputOption, previewId });
+                        : collectDiagnostics(repo, {
+                            ...options,
+                            outputPath: outputOption,
+                            previewId,
+                        });
             }
             else {
                 throw new Error("knodin diagnostics requires enable, status, preview, archive, inspect, clear, or disable");
@@ -2717,6 +2965,8 @@ catch (err) {
             "wiki",
             "visualize",
             "pack",
+            "seal",
+            "sealed",
             "compress",
             "prs",
             "worktrees",