modelstat 0.0.50 → 0.0.52

package/dist/cli.mjs

@@ -77,6 +77,17 @@ var init_git = __esm({
   }
 });
 
+// ../../packages/core/src/billing.ts
+var MILLION, FREE_INCLUDED_TOKENS, TEAM_INCLUDED_PER_SEAT;
+var init_billing = __esm({
+  "../../packages/core/src/billing.ts"() {
+    "use strict";
+    MILLION = 1000000n;
+    FREE_INCLUDED_TOKENS = 100n * MILLION;
+    TEAM_INCLUDED_PER_SEAT = 250n * MILLION;
+  }
+});
+
 // ../../packages/core/src/enums.ts
 var AGENTS, PROVIDERS, IDENTITY_OWNER_SCOPES, INSTALL_METHODS, OS_FAMILIES, EVENT_KINDS, TOOL_CALL_STATUSES, COMPANION_PHASES, CLASSIFICATION_CONFIDENCE;
 var init_enums = __esm({
@@ -195,6 +206,72 @@ var init_enums = __esm({
   }
 });
 
+// ../../packages/core/src/ids.ts
+function ulid(seedTime) {
+  const t = seedTime ?? Date.now();
+  let timeStr = "";
+  let ts = t;
+  for (let i = 9; i >= 0; i--) {
+    timeStr = ULID_ALPHABET[ts % 32] + timeStr;
+    ts = Math.floor(ts / 32);
+  }
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  let randStr = "";
+  for (let i = 0; i < 16; i++) {
+    randStr += ULID_ALPHABET[bytes[i] % 32];
+  }
+  return timeStr + randStr;
+}
+function sourceEventId(deviceId, sourceOrFilePath, byteOffsetMaybe) {
+  let key;
+  if (typeof sourceOrFilePath === "string") {
+    const byteOffset = byteOffsetMaybe ?? 0;
+    key = `fs::${sourceOrFilePath}::${byteOffset}`;
+  } else if ("file" in sourceOrFilePath) {
+    key = `fs::${sourceOrFilePath.file}::${sourceOrFilePath.byteOffset}`;
+  } else if ("lineUuid" in sourceOrFilePath) {
+    key = `uuid::${sourceOrFilePath.lineUuid}`;
+  } else {
+    key = `web::${sourceOrFilePath.host}::${sourceOrFilePath.conversationId}::${sourceOrFilePath.messageId}`;
+  }
+  const s = `${deviceId}::${key}`;
+  let h = 5381n;
+  for (let i = 0; i < s.length; i++) {
+    h = h * 33n ^ BigInt(s.charCodeAt(i));
+    h &= 0xffffffffffffffffn;
+  }
+  return `evt_${h.toString(36)}`;
+}
+function segmentId(sessionId, startedAtMs, endedAtMs, sourceEventIds) {
+  const sorted = [...sourceEventIds].sort().join(",");
+  const s = `${sessionId}|${startedAtMs}|${endedAtMs}|${sorted}`;
+  let h = 5381n;
+  for (let i = 0; i < s.length; i++) {
+    h = h * 33n ^ BigInt(s.charCodeAt(i));
+    h &= 0xffffffffffffffffn;
+  }
+  return `seg_${h.toString(36)}`;
+}
+function paramShape(args) {
+  const MASK = "\xA7";
+  return args.split(/[ \t\n\r\f]+/).filter((t) => t.length > 0).map((t) => {
+    if (t.startsWith("-")) {
+      const eq = t.indexOf("=");
+      return eq === -1 ? t : `${t.slice(0, eq + 1)}${MASK}`;
+    }
+    return MASK;
+  }).join(" ");
+}
+var ULID_ALPHABET, batchId;
+var init_ids = __esm({
+  "../../packages/core/src/ids.ts"() {
+    "use strict";
+    ULID_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+    batchId = () => ulid();
+  }
+});
+
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType;
 var init_util = __esm({
@@ -942,9 +1019,9 @@ var init_types2 = __esm({
         return this._cachedPath;
       }
     };
-    handleResult = (ctx, result) => {
-      if (isValid(result)) {
-        return { success: true, data: result.value };
+    handleResult = (ctx, result2) => {
+      if (isValid(result2)) {
+        return { success: true, data: result2.value };
       } else {
         if (!ctx.common.issues.length) {
           throw new Error("Validation failed but no issues detected.");
@@ -992,21 +1069,21 @@ var init_types2 = __esm({
         };
       }
       _parseSync(input) {
-        const result = this._parse(input);
-        if (isAsync(result)) {
+        const result2 = this._parse(input);
+        if (isAsync(result2)) {
           throw new Error("Synchronous parse encountered promise.");
         }
-        return result;
+        return result2;
       }
       _parseAsync(input) {
-        const result = this._parse(input);
-        return Promise.resolve(result);
+        const result2 = this._parse(input);
+        return Promise.resolve(result2);
       }
       parse(data, params) {
-        const result = this.safeParse(data, params);
-        if (result.success)
-          return result.data;
-        throw result.error;
+        const result2 = this.safeParse(data, params);
+        if (result2.success)
+          return result2.data;
+        throw result2.error;
       }
       safeParse(data, params) {
         const ctx = {
@@ -1021,8 +1098,8 @@ var init_types2 = __esm({
           data,
           parsedType: getParsedType(data)
         };
-        const result = this._parseSync({ data, path: ctx.path, parent: ctx });
-        return handleResult(ctx, result);
+        const result2 = this._parseSync({ data, path: ctx.path, parent: ctx });
+        return handleResult(ctx, result2);
       }
       "~validate"(data) {
         const ctx = {
@@ -1038,9 +1115,9 @@ var init_types2 = __esm({
         };
         if (!this["~standard"].async) {
           try {
-            const result = this._parseSync({ data, path: [], parent: ctx });
-            return isValid(result) ? {
-              value: result.value
+            const result2 = this._parseSync({ data, path: [], parent: ctx });
+            return isValid(result2) ? {
+              value: result2.value
             } : {
               issues: ctx.common.issues
             };
@@ -1054,17 +1131,17 @@ var init_types2 = __esm({
             };
           }
         }
-        return this._parseAsync({ data, path: [], parent: ctx }).then((result) => isValid(result) ? {
-          value: result.value
+        return this._parseAsync({ data, path: [], parent: ctx }).then((result2) => isValid(result2) ? {
+          value: result2.value
         } : {
           issues: ctx.common.issues
         });
       }
       async parseAsync(data, params) {
-        const result = await this.safeParseAsync(data, params);
-        if (result.success)
-          return result.data;
-        throw result.error;
+        const result2 = await this.safeParseAsync(data, params);
+        if (result2.success)
+          return result2.data;
+        throw result2.error;
       }
       async safeParseAsync(data, params) {
         const ctx = {
@@ -1080,8 +1157,8 @@ var init_types2 = __esm({
           parsedType: getParsedType(data)
         };
         const maybeAsyncResult = this._parse({ data, path: ctx.path, parent: ctx });
-        const result = await (isAsync(maybeAsyncResult) ? maybeAsyncResult : Promise.resolve(maybeAsyncResult));
-        return handleResult(ctx, result);
+        const result2 = await (isAsync(maybeAsyncResult) ? maybeAsyncResult : Promise.resolve(maybeAsyncResult));
+        return handleResult(ctx, result2);
       }
       refine(check, message) {
         const getIssueProperties = (val) => {
@@ -1094,13 +1171,13 @@ var init_types2 = __esm({
           }
         };
         return this._refinement((val, ctx) => {
-          const result = check(val);
+          const result2 = check(val);
           const setError = () => ctx.addIssue({
             code: ZodIssueCode.custom,
             ...getIssueProperties(val)
           });
-          if (typeof Promise !== "undefined" && result instanceof Promise) {
-            return result.then((data) => {
+          if (typeof Promise !== "undefined" && result2 instanceof Promise) {
+            return result2.then((data) => {
               if (!data) {
                 setError();
                 return false;
@@ -1109,7 +1186,7 @@ var init_types2 = __esm({
               }
             });
           }
-          if (!result) {
+          if (!result2) {
             setError();
             return false;
           } else {
@@ -2533,14 +2610,14 @@ var init_types2 = __esm({
         if (ctx.common.async) {
           return Promise.all([...ctx.data].map((item, i) => {
             return def.type._parseAsync(new ParseInputLazyPath(ctx, item, ctx.path, i));
-          })).then((result2) => {
-            return ParseStatus.mergeArray(status2, result2);
+          })).then((result3) => {
+            return ParseStatus.mergeArray(status2, result3);
           });
         }
-        const result = [...ctx.data].map((item, i) => {
+        const result2 = [...ctx.data].map((item, i) => {
           return def.type._parseSync(new ParseInputLazyPath(ctx, item, ctx.path, i));
         });
-        return ParseStatus.mergeArray(status2, result);
+        return ParseStatus.mergeArray(status2, result2);
       }
       get element() {
         return this._def.type;
@@ -2920,18 +2997,18 @@ var init_types2 = __esm({
         const { ctx } = this._processInputParams(input);
         const options = this._def.options;
         function handleResults(results) {
-          for (const result of results) {
-            if (result.result.status === "valid") {
-              return result.result;
+          for (const result2 of results) {
+            if (result2.result.status === "valid") {
+              return result2.result;
             }
           }
-          for (const result of results) {
-            if (result.result.status === "dirty") {
-              ctx.common.issues.push(...result.ctx.common.issues);
-              return result.result;
+          for (const result2 of results) {
+            if (result2.result.status === "dirty") {
+              ctx.common.issues.push(...result2.ctx.common.issues);
+              return result2.result;
             }
           }
-          const unionErrors = results.map((result) => new ZodError(result.ctx.common.issues));
+          const unionErrors = results.map((result2) => new ZodError(result2.ctx.common.issues));
           addIssueToContext(ctx, {
             code: ZodIssueCode.invalid_union,
             unionErrors
@@ -2969,15 +3046,15 @@ var init_types2 = __esm({
               },
               parent: null
             };
-            const result = option._parseSync({
+            const result2 = option._parseSync({
               data: ctx.data,
               path: ctx.path,
               parent: childCtx
             });
-            if (result.status === "valid") {
-              return result;
-            } else if (result.status === "dirty" && !dirty) {
-              dirty = { result, ctx: childCtx };
+            if (result2.status === "valid") {
+              return result2;
+            } else if (result2.status === "dirty" && !dirty) {
+              dirty = { result: result2, ctx: childCtx };
             }
             if (childCtx.common.issues.length) {
               issues.push(childCtx.common.issues);
@@ -3484,9 +3561,9 @@ var init_types2 = __esm({
               error.addIssue(makeArgsIssue(args, e));
               throw error;
             });
-            const result = await Reflect.apply(fn, this, parsedArgs);
-            const parsedReturns = await me._def.returns._def.type.parseAsync(result, params).catch((e) => {
-              error.addIssue(makeReturnsIssue(result, e));
+            const result2 = await Reflect.apply(fn, this, parsedArgs);
+            const parsedReturns = await me._def.returns._def.type.parseAsync(result2, params).catch((e) => {
+              error.addIssue(makeReturnsIssue(result2, e));
               throw error;
             });
             return parsedReturns;
@@ -3498,10 +3575,10 @@ var init_types2 = __esm({
             if (!parsedArgs.success) {
               throw new ZodError([makeArgsIssue(args, parsedArgs.error)]);
             }
-            const result = Reflect.apply(fn, this, parsedArgs.data);
-            const parsedReturns = me._def.returns.safeParse(result, params);
+            const result2 = Reflect.apply(fn, this, parsedArgs.data);
+            const parsedReturns = me._def.returns.safeParse(result2, params);
             if (!parsedReturns.success) {
-              throw new ZodError([makeReturnsIssue(result, parsedReturns.error)]);
+              throw new ZodError([makeReturnsIssue(result2, parsedReturns.error)]);
             }
             return parsedReturns.data;
           });
@@ -3746,43 +3823,43 @@ var init_types2 = __esm({
             return Promise.resolve(processed).then(async (processed2) => {
               if (status2.value === "aborted")
                 return INVALID;
-              const result = await this._def.schema._parseAsync({
+              const result2 = await this._def.schema._parseAsync({
                 data: processed2,
                 path: ctx.path,
                 parent: ctx
               });
-              if (result.status === "aborted")
+              if (result2.status === "aborted")
                 return INVALID;
-              if (result.status === "dirty")
-                return DIRTY(result.value);
+              if (result2.status === "dirty")
+                return DIRTY(result2.value);
               if (status2.value === "dirty")
-                return DIRTY(result.value);
-              return result;
+                return DIRTY(result2.value);
+              return result2;
             });
           } else {
             if (status2.value === "aborted")
               return INVALID;
-            const result = this._def.schema._parseSync({
+            const result2 = this._def.schema._parseSync({
               data: processed,
               path: ctx.path,
               parent: ctx
             });
-            if (result.status === "aborted")
+            if (result2.status === "aborted")
               return INVALID;
-            if (result.status === "dirty")
-              return DIRTY(result.value);
+            if (result2.status === "dirty")
+              return DIRTY(result2.value);
             if (status2.value === "dirty")
-              return DIRTY(result.value);
-            return result;
+              return DIRTY(result2.value);
+            return result2;
           }
         }
         if (effect.type === "refinement") {
           const executeRefinement = (acc) => {
-            const result = effect.refinement(acc, checkCtx);
+            const result2 = effect.refinement(acc, checkCtx);
             if (ctx.common.async) {
-              return Promise.resolve(result);
+              return Promise.resolve(result2);
             }
-            if (result instanceof Promise) {
+            if (result2 instanceof Promise) {
               throw new Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");
             }
             return acc;
@@ -3820,18 +3897,18 @@ var init_types2 = __esm({
             });
             if (!isValid(base))
               return INVALID;
-            const result = effect.transform(base.value, checkCtx);
-            if (result instanceof Promise) {
+            const result2 = effect.transform(base.value, checkCtx);
+            if (result2 instanceof Promise) {
               throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
             }
-            return { status: status2.value, value: result };
+            return { status: status2.value, value: result2 };
           } else {
             return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base) => {
               if (!isValid(base))
                 return INVALID;
-              return Promise.resolve(effect.transform(base.value, checkCtx)).then((result) => ({
+              return Promise.resolve(effect.transform(base.value, checkCtx)).then((result2) => ({
                 status: status2.value,
-                value: result
+                value: result2
               }));
             });
           }
@@ -3928,18 +4005,18 @@ var init_types2 = __esm({
             issues: []
           }
         };
-        const result = this._def.innerType._parse({
+        const result2 = this._def.innerType._parse({
           data: newCtx.data,
           path: newCtx.path,
           parent: {
             ...newCtx
           }
         });
-        if (isAsync(result)) {
-          return result.then((result2) => {
+        if (isAsync(result2)) {
+          return result2.then((result3) => {
             return {
               status: "valid",
-              value: result2.status === "valid" ? result2.value : this._def.catchValue({
+              value: result3.status === "valid" ? result3.value : this._def.catchValue({
                 get error() {
                   return new ZodError(newCtx.common.issues);
                 },
@@ -3950,7 +4027,7 @@ var init_types2 = __esm({
         } else {
           return {
             status: "valid",
-            value: result.status === "valid" ? result.value : this._def.catchValue({
+            value: result2.status === "valid" ? result2.value : this._def.catchValue({
               get error() {
                 return new ZodError(newCtx.common.issues);
               },
@@ -4064,14 +4141,14 @@ var init_types2 = __esm({
     };
     ZodReadonly = class extends ZodType {
       _parse(input) {
-        const result = this._def.innerType._parse(input);
+        const result2 = this._def.innerType._parse(input);
         const freeze = (data) => {
           if (isValid(data)) {
             data.value = Object.freeze(data.value);
           }
           return data;
         };
-        return isAsync(result) ? result.then((data) => freeze(data)) : freeze(result);
+        return isAsync(result2) ? result2.then((data) => freeze(data)) : freeze(result2);
       }
       unwrap() {
         return this._def.innerType;
@@ -4311,8 +4388,223 @@ var init_zod = __esm({
   }
 });
 
+// ../../packages/core/src/policies.ts
+function compilePolicyPatterns(bundle) {
+  const out = [];
+  for (const p of bundle.patterns) {
+    const flags = `g${p.flags ?? ""}`;
+    try {
+      out.push({ name: p.name, pattern: new RegExp(p.regex, flags) });
+    } catch {
+    }
+  }
+  return out;
+}
+var RedactionPattern, RedactionPolicyBundle, POLICIES_BUNDLED_FALLBACK, POLICIES_CONFIG_KIND;
+var init_policies = __esm({
+  "../../packages/core/src/policies.ts"() {
+    "use strict";
+    init_zod();
+    RedactionPattern = external_exports.object({
+      /** Stable label for the `[REDACTED:name]` placeholder. */
+      name: external_exports.string().min(1).max(64).regex(/^[a-z0-9_]+$/, "name must be lowercase a-z0-9_"),
+      /** JS regex source. Compiled with the `g` flag on the client. */
+      regex: external_exports.string().min(1).max(1e3),
+      /** Optional extra flags; `g` is always added. Limited to `i m s u`. */
+      flags: external_exports.string().max(8).regex(/^[imsu]*$/, "only i m s u flags allowed").optional()
+    });
+    RedactionPolicyBundle = external_exports.object({
+      version: external_exports.number().int().nonnegative(),
+      /** Additive patterns unioned ON TOP of the bundled floor. There is, by
+       * design, no way to express removal — only addition. */
+      patterns: external_exports.array(RedactionPattern).max(256)
+    });
+    POLICIES_BUNDLED_FALLBACK = { version: 0, patterns: [] };
+    POLICIES_CONFIG_KIND = {
+      kind: "policies",
+      schema: RedactionPolicyBundle,
+      bundledFallback: POLICIES_BUNDLED_FALLBACK
+    };
+  }
+});
+
+// ../../packages/core/src/redact-floor.ts
+var SECRET_FLOOR;
+var init_redact_floor = __esm({
+  "../../packages/core/src/redact-floor.ts"() {
+    "use strict";
+    SECRET_FLOOR = [
+      {
+        name: "anthropic_key",
+        pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g,
+        replacement: "<REDACTED:anthropic_key>"
+      },
+      {
+        name: "openai_key",
+        pattern: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/g,
+        replacement: "<REDACTED:openai_key>"
+      },
+      {
+        name: "google_api_key",
+        pattern: /AIza[0-9A-Za-z_-]{35}/g,
+        replacement: "<REDACTED:google_api_key>"
+      },
+      {
+        name: "aws_access_key",
+        pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+        replacement: "<REDACTED:aws_access_key>"
+      },
+      { name: "github_pat", pattern: /ghp_[A-Za-z0-9]{36,}/g, replacement: "<REDACTED:github_pat>" },
+      {
+        name: "github_oauth",
+        pattern: /gho_[A-Za-z0-9]{36,}/g,
+        replacement: "<REDACTED:github_oauth>"
+      },
+      {
+        name: "github_app",
+        pattern: /gh[sur]_[A-Za-z0-9]{36,}/g,
+        replacement: "<REDACTED:github_app>"
+      },
+      {
+        name: "slack_token",
+        pattern: /xox[aboprs]-[A-Za-z0-9-]{10,}/g,
+        replacement: "<REDACTED:slack_token>"
+      },
+      {
+        name: "stripe_live_key",
+        pattern: /(?:sk|pk|rk)_live_[A-Za-z0-9]{24,}/g,
+        replacement: "<REDACTED:stripe_live_key>"
+      },
+      {
+        name: "stripe_test_key",
+        pattern: /(?:sk|pk|rk)_test_[A-Za-z0-9]{24,}/g,
+        replacement: "<REDACTED:stripe_test_key>"
+      },
+      // Discord bot token (was agent-sdk-only — the canonical drift example).
+      {
+        name: "discord_token",
+        pattern: /[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}/g,
+        replacement: "<REDACTED:discord_token>"
+      },
+      {
+        name: "jwt",
+        pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+        replacement: "<REDACTED:jwt>"
+      },
+      // Full PEM block (was header-only in the wire floor — this redacts the body too).
+      {
+        name: "private_key_header",
+        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
+        replacement: "<REDACTED:private_key>"
+      },
+      // modelstat's own device bearer — agents must never ship their credential.
+      {
+        name: "modelstat_device_secret",
+        pattern: /ds_live_[A-Za-z0-9_-]{32,}/g,
+        replacement: "<REDACTED:modelstat_device_secret>"
+      },
+      // Generic env-style KEY=VALUE where KEY names a secret. Keeps the var name.
+      {
+        name: "env_secret",
+        pattern: /\b([A-Z][A-Z0-9_]*(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|API)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]{12,})['"]?/g,
+        replacement: "$1=<REDACTED:env_secret>"
+      },
+      {
+        name: "bearer_header",
+        pattern: /Bearer\s+[A-Za-z0-9._~+/-]{20,}=*/g,
+        replacement: "Bearer <REDACTED:bearer>"
+      },
+      {
+        name: "db_url_with_password",
+        pattern: /\b(postgres|mysql|mongodb|redis|amqp)(?:\+[a-z]+)?:\/\/[^:\s]+:([^@\s]+)@/gi,
+        replacement: "$1://<user>:<REDACTED:db_password>@"
+      },
+      // Generic 40-char base64-ish blob (e.g. an AWS secret access key on its own).
+      // Most generic ⇒ last, so specific patterns claim their matches first.
+      {
+        name: "aws_secret_key",
+        pattern: /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/g,
+        replacement: "<REDACTED:aws_secret_key>"
+      }
+    ];
+  }
+});
+
+// ../../packages/core/src/redact.ts
+function setRemoteRedactionPatterns(patterns) {
+  remotePatterns = patterns;
+}
+function entropy(s) {
+  const freq = /* @__PURE__ */ new Map();
+  for (const c of s) freq.set(c, (freq.get(c) ?? 0) + 1);
+  let h = 0;
+  for (const n of freq.values()) {
+    const p = n / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+function redact(text, repoRootAbs) {
+  let out = text;
+  const counts = {
+    secrets_found: 0,
+    emails_redacted: 0,
+    paths_redacted_absolute: 0
+  };
+  for (const { name, pattern } of SECRET_FLOOR) {
+    out = out.replace(pattern, () => {
+      counts.secrets_found += 1;
+      return `[REDACTED:${name}]`;
+    });
+  }
+  for (const { name, pattern } of remotePatterns) {
+    out = out.replace(pattern, () => {
+      counts.secrets_found += 1;
+      return `[REDACTED:${name}]`;
+    });
+  }
+  out = out.replace(TOKEN_CANDIDATE, (match) => {
+    if (/^[a-f0-9]+$/i.test(match)) return match;
+    if (/^[A-Z]+$/.test(match)) return match;
+    const hasLetter = /[A-Za-z]/.test(match);
+    const hasDigit = /\d/.test(match);
+    const hasUpper = /[A-Z]/.test(match);
+    const hasLower = /[a-z]/.test(match);
+    if (!(hasLetter && hasDigit && hasUpper && hasLower)) return match;
+    if (entropy(match) < 3.6) return match;
+    counts.secrets_found += 1;
+    return `[REDACTED:hi-entropy]`;
+  });
+  out = out.replace(EMAIL_PATTERN, () => {
+    counts.emails_redacted += 1;
+    return "[REDACTED:email]";
+  });
+  const pathReplacer = (match) => {
+    if (repoRootAbs && match.startsWith(repoRootAbs)) {
+      return match.slice(repoRootAbs.length).replace(/^\/+/, "./");
+    }
+    counts.paths_redacted_absolute += 1;
+    return "[REDACTED:abs-path]";
+  };
+  out = out.replace(ABSOLUTE_PATH_MACOS, pathReplacer);
+  out = out.replace(ABSOLUTE_PATH_LINUX, pathReplacer);
+  return { text: out, counts };
+}
+var remotePatterns, EMAIL_PATTERN, ABSOLUTE_PATH_MACOS, ABSOLUTE_PATH_LINUX, TOKEN_CANDIDATE;
+var init_redact = __esm({
+  "../../packages/core/src/redact.ts"() {
+    "use strict";
+    init_redact_floor();
+    remotePatterns = [];
+    EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+    ABSOLUTE_PATH_MACOS = /\/Users\/[^\s"'`)]+/g;
+    ABSOLUTE_PATH_LINUX = /\/home\/[^\s"'`)]+/g;
+    TOKEN_CANDIDATE = /[A-Za-z0-9/+=_-]{32,}/g;
+  }
+});
+
 // ../../packages/core/src/schemas.ts
-var TokenUsage, GitContext, RawEvent, RedactionReport, TaxonomyHintRooted, Segment, ToolCallWire, IngestBatch, HeartbeatPayload, DeviceEnrollment, DeviceSelfRegister, DeviceClaimRequest, ProcessingMetadata, RedactionPolicy, DetectedInstallation, DetectedIdentity, DiscoveryReport, ClassificationConfidenceEnum;
+var TokenUsage, GitContext, RawEvent, RedactionReport, TaxonomyHintRooted, Segment, ToolAction, ToolCallWire, IngestBatch, HeartbeatPayload, DeviceEnrollment, DeviceSelfRegister, DeviceClaimRequest, ProcessingMetadata, RedactionPolicy, DetectedInstallation, DetectedIdentity, DiscoveryReport, ClassificationConfidenceEnum;
 var init_schemas = __esm({
   "../../packages/core/src/schemas.ts"() {
     "use strict";
@@ -4405,18 +4697,51 @@ var init_schemas = __esm({
       abstract: external_exports.string().max(512),
       /** Tokens spent inside this segment only. */
       tokens: TokenUsage,
-      /** Tags with strongly-typed root keys. Server merges with its own
-       * classifier output and files any novel names as taxonomy proposals. */
+      /** Tags with strongly-typed root keys. The server may merge these with
+       * its own classifier output. */
       tags: external_exports.array(TaxonomyHintRooted).max(40).default([]),
       /** Counts of what was stripped. */
       redaction: RedactionReport,
       /** `source_event_id`s covered by this segment. Used for dedupe + replay. */
       source_event_ids: external_exports.array(external_exports.string()).max(2e3),
       /** Optional embedding of the abstract (BGE-small-en-v1.5, 384 dims).
-       * Present when the companion has an Embedder adapter configured.
-       * Reserved for server-side similarity / clustering. */
+       * Present when the companion has an Embedder adapter configured. */
       abstract_embedding: external_exports.array(external_exports.number()).length(384).optional()
     });
+    ToolAction = external_exports.object({
+      /** Where it ran: `shell`, `mcp`, `builtin`, `browser`. (tier 0) */
+      surface: external_exports.string().max(40),
+      /** Concrete program/operation, or a generic bucket token. (tier 0 | bucket) */
+      executable: external_exports.string().max(80).nullable().default(null),
+      /** Verb/intent (`restart`, `read`, …). (tier 0) */
+      action: external_exports.string().max(40).nullable().default(null),
+      /** What it acts on (`deployment`, `file`, …). (tier 0) */
+      object: external_exports.string().max(60).nullable().default(null),
+      /** Governed safe flags (`destructive`, `remote`, …). (tier 0) */
+      qualifiers: external_exports.array(external_exports.string().max(40)).max(8).default([]),
+      /** Value-masked argument skeleton (every value → `§`). (tier 1) */
+      param_shape: external_exports.string().max(200).nullable().default(null),
+      /** Relevant non-sensitive keywords (e.g. ["rollout","restart","prod"]),
+       * OpenAI-redacted on-device. (tier 0) */
+      keywords: external_exports.array(external_exports.string().max(40)).max(12).default([]),
+      /** Human-readable command summary (e.g. "redeploying service payments-api"),
+       * OpenAI-redacted on-device. (tier 0) */
+      abstract: external_exports.string().max(200).nullable().default(null),
+      /** The compliance-redacted command text — PII/secrets stripped on-device
+       * (SOC2/GDPR), org-internal infra intact; the server derives semantics from
+       * it. Un-redacted raw never ships. (tier 0, post-redaction) */
+      command_redacted: external_exports.string().max(1e3).nullable().default(null),
+      /** Per-script content abstracts for any script/bash FILES the command runs
+       * — summarized on-device by the local model, then redacted. Ordered by
+       * appearance; `token` is the script's token exactly as it appears in
+       * `command_redacted`, so the backend deterministically zips each `summary`
+       * to its place when ingesting the command + its scripts. (tier 0) */
+      scripts: external_exports.array(external_exports.object({ token: external_exports.string().max(200), summary: external_exports.string().max(200) })).max(8).default([]),
+      /** Extractor confidence in [0, 1]. */
+      confidence: external_exports.number().min(0).max(1).default(0),
+      /** Provenance of the extraction, e.g. `shell.v2`. */
+      extractor: external_exports.string().max(40)
+    }).strict();
     ToolCallWire = external_exports.object({
       /** tool_use block `id` / codex `call_id`; parsers fall back to a
        * deterministic `tc_<djb2-base36>` of `${source_event_id}|${call_index}`
@@ -4456,9 +4781,9 @@ var init_schemas = __esm({
       /** Model of the assistant message that issued the call. `<synthetic>`
        * kept verbatim per the PR #12 attribution rules. */
       model: external_exports.string().max(120).nullable(),
-      /** ONLY for shell-ish tools: command verbs from the fixed allowlist
-       * (@modelstat/parsers/shell-families). Never raw command text. */
-      command_families: external_exports.array(external_exports.string().max(40)).max(3).default([])
+      /** On-device action decomposition — nested + additive, `null` when nothing
+       * was extracted. Replaces `command_families`. */
+      action: ToolAction.nullable().default(null)
     });
     IngestBatch = external_exports.object({
       batch_id: external_exports.string(),
@@ -4469,7 +4794,7 @@ var init_schemas = __esm({
       segments: external_exports.array(Segment).max(2e3).default([]),
       /** Per-call tool invocations (additive — old agents omit it, old
        * servers ignore it). See ToolCallWire for the privacy contract:
-       * hashes / byte sizes / allowlisted verbs only, never payloads. */
+       * hashes / byte sizes / governed action tokens only, never payloads. */
       tool_calls: external_exports.array(ToolCallWire).max(2e4).default([]),
       /** Optional per-session metadata hint: which installation produced them, etc. */
       session_installs: external_exports.record(
@@ -4481,11 +4806,10 @@ var init_schemas = __esm({
       ).optional(),
       /** Optional per-session titles — session_id → short redacted title
        * (≤120 chars) produced by the companion's local titler from the
-       * session's segment abstracts. Server-side this is last-write-wins
-       * per session; companions recompute it from the full session view on
-       * every upload, so the latest batch always carries the freshest
-       * title. Absent for runtimes without a titler (older agents, no-op
-       * browser summariser) — the server keeps whatever it has. */
+       * session's segment abstracts. Companions recompute it from the full
+       * session view on every upload, so the latest batch always carries the
+       * freshest title. Absent for runtimes without a titler (older agents,
+       * no-op browser summariser). */
       session_titles: external_exports.record(external_exports.string(), external_exports.string().max(120)).optional()
     });
     HeartbeatPayload = external_exports.object({
@@ -4583,304 +4907,136 @@ var init_schemas = __esm({
   }
 });
 
-// ../../packages/core/src/ids.ts
-function ulid(seedTime) {
-  const t = seedTime ?? Date.now();
-  let timeStr = "";
-  let ts = t;
-  for (let i = 9; i >= 0; i--) {
-    timeStr = ULID_ALPHABET[ts % 32] + timeStr;
-    ts = Math.floor(ts / 32);
-  }
-  const bytes = new Uint8Array(16);
-  globalThis.crypto.getRandomValues(bytes);
-  let randStr = "";
-  for (let i = 0; i < 16; i++) {
-    randStr += ULID_ALPHABET[bytes[i] % 32];
-  }
-  return timeStr + randStr;
-}
-function sourceEventId(deviceId, sourceOrFilePath, byteOffsetMaybe) {
-  let key;
-  if (typeof sourceOrFilePath === "string") {
-    const byteOffset = byteOffsetMaybe ?? 0;
-    key = `fs::${sourceOrFilePath}::${byteOffset}`;
-  } else if ("file" in sourceOrFilePath) {
-    key = `fs::${sourceOrFilePath.file}::${sourceOrFilePath.byteOffset}`;
-  } else if ("lineUuid" in sourceOrFilePath) {
-    key = `uuid::${sourceOrFilePath.lineUuid}`;
-  } else {
-    key = `web::${sourceOrFilePath.host}::${sourceOrFilePath.conversationId}::${sourceOrFilePath.messageId}`;
-  }
-  const s = `${deviceId}::${key}`;
-  let h = 5381n;
-  for (let i = 0; i < s.length; i++) {
-    h = h * 33n ^ BigInt(s.charCodeAt(i));
-    h &= 0xffffffffffffffffn;
-  }
-  return `evt_${h.toString(36)}`;
-}
-function segmentId(sessionId, startedAtMs, endedAtMs, sourceEventIds) {
-  const sorted = [...sourceEventIds].sort().join(",");
-  const s = `${sessionId}|${startedAtMs}|${endedAtMs}|${sorted}`;
-  let h = 5381n;
-  for (let i = 0; i < s.length; i++) {
-    h = h * 33n ^ BigInt(s.charCodeAt(i));
-    h &= 0xffffffffffffffffn;
-  }
-  return `seg_${h.toString(36)}`;
-}
-var ULID_ALPHABET, batchId;
-var init_ids = __esm({
-  "../../packages/core/src/ids.ts"() {
+// ../../packages/core/src/index.ts
+var init_src = __esm({
+  "../../packages/core/src/index.ts"() {
     "use strict";
-    ULID_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-    batchId = () => ulid();
+    init_billing();
+    init_enums();
+    init_ids();
+    init_policies();
+    init_redact();
+    init_redact_floor();
+    init_schemas();
   }
 });
 
-// ../../packages/core/src/redact.ts
-function entropy(s) {
-  const freq = /* @__PURE__ */ new Map();
-  for (const c of s) freq.set(c, (freq.get(c) ?? 0) + 1);
-  let h = 0;
-  for (const n of freq.values()) {
-    const p = n / s.length;
-    h -= p * Math.log2(p);
+// ../../packages/parsers/src/tool-action/scripts.ts
+function detectScriptRefs(command) {
+  const refs = [];
+  for (const segment of command.split(SEGMENT_SEP)) {
+    const tokens = segment.trim().split(/\s+/).filter(Boolean);
+    tokens.forEach((tok, i) => {
+      const t = stripQuotes(tok);
+      if (!t || t.startsWith("-") || t.includes("://")) return;
+      const looksLikeScript = SCRIPT_EXT.test(t) || // ends in a script extension
+      t.startsWith("./") || t.startsWith("../") || // an explicit relative executable
+      i === 0 && t.includes("/");
+      if (looksLikeScript) refs.push(t);
+    });
   }
-  return h;
+  return refs;
 }
-function redact(text, repoRootAbs) {
-  let out = text;
-  const counts = {
-    secrets_found: 0,
-    emails_redacted: 0,
-    paths_redacted_absolute: 0
+function scriptCandidates(ref, roots) {
+  const out = [];
+  const push = (p) => {
+    if (p && !out.includes(p)) out.push(p);
   };
-  for (const { name, pattern } of SECRET_PATTERNS) {
-    out = out.replace(pattern, () => {
-      counts.secrets_found += 1;
-      return `[REDACTED:${name}]`;
-    });
+  if (isAbsolute(ref)) push(ref);
+  for (const root of roots) {
+    if (root) push(joinPath(root, ref));
   }
-  out = out.replace(TOKEN_CANDIDATE, (match) => {
-    if (/^[a-f0-9]+$/i.test(match)) return match;
-    if (/^[A-Z]+$/.test(match)) return match;
-    const hasLetter = /[A-Za-z]/.test(match);
-    const hasDigit = /\d/.test(match);
-    const hasUpper = /[A-Z]/.test(match);
-    const hasLower = /[a-z]/.test(match);
-    if (!(hasLetter && hasDigit && hasUpper && hasLower)) return match;
-    if (entropy(match) < 3.6) return match;
-    counts.secrets_found += 1;
-    return `[REDACTED:hi-entropy]`;
-  });
-  out = out.replace(EMAIL_PATTERN, () => {
-    counts.emails_redacted += 1;
-    return "[REDACTED:email]";
-  });
-  const pathReplacer = (match) => {
-    if (repoRootAbs && match.startsWith(repoRootAbs)) {
-      return match.slice(repoRootAbs.length).replace(/^\/+/, "./");
-    }
-    counts.paths_redacted_absolute += 1;
-    return "[REDACTED:abs-path]";
-  };
-  out = out.replace(ABSOLUTE_PATH_MACOS, pathReplacer);
-  out = out.replace(ABSOLUTE_PATH_LINUX, pathReplacer);
-  return { text: out, counts };
+  push(ref);
+  return out.sort(
+    (a, b) => Number(isAbsolute(b)) - Number(isAbsolute(a)) || b.length - a.length
+  );
 }
-var SECRET_PATTERNS, EMAIL_PATTERN, ABSOLUTE_PATH_MACOS, ABSOLUTE_PATH_LINUX, TOKEN_CANDIDATE;
-var init_redact = __esm({
-  "../../packages/core/src/redact.ts"() {
-    "use strict";
-    SECRET_PATTERNS = [
-      { name: "anthropic_key", pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-      { name: "openai_key", pattern: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/g },
-      { name: "google_api_key", pattern: /AIza[0-9A-Za-z_-]{35}/g },
-      { name: "aws_access_key", pattern: /AKIA[0-9A-Z]{16}/g },
-      { name: "aws_secret_key", pattern: /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/g },
-      { name: "github_pat", pattern: /ghp_[A-Za-z0-9]{36}/g },
-      { name: "github_oauth", pattern: /gho_[A-Za-z0-9]{36}/g },
-      { name: "github_app", pattern: /gh[sur]_[A-Za-z0-9]{36}/g },
-      { name: "slack_token", pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-      { name: "stripe_live_key", pattern: /sk_live_[A-Za-z0-9]{24,}/g },
-      { name: "stripe_test_key", pattern: /sk_test_[A-Za-z0-9]{24,}/g },
-      { name: "jwt", pattern: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
-      { name: "private_key_header", pattern: /-----BEGIN [A-Z ]+PRIVATE KEY-----/g }
-    ];
-    EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
-    ABSOLUTE_PATH_MACOS = /\/Users\/[^\s"'`)]+/g;
-    ABSOLUTE_PATH_LINUX = /\/home\/[^\s"'`)]+/g;
-    TOKEN_CANDIDATE = /[A-Za-z0-9/+=_-]{32,}/g;
+function resolveScriptPath(ref, roots, exists) {
+  for (const cand of scriptCandidates(ref, roots)) {
+    if (exists(cand)) return cand;
   }
-});
-
-// ../../packages/core/src/billing.ts
-var MILLION, FREE_INCLUDED_TOKENS, TEAM_INCLUDED_PER_SEAT;
-var init_billing = __esm({
-  "../../packages/core/src/billing.ts"() {
-    "use strict";
-    MILLION = 1000000n;
-    FREE_INCLUDED_TOKENS = 100n * MILLION;
-    TEAM_INCLUDED_PER_SEAT = 250n * MILLION;
+  return null;
+}
+function isAbsolute(p) {
+  return p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p);
+}
+function joinPath(root, rel) {
+  return `${root.replace(/\/+$/, "")}/${rel.replace(/^\.\//, "")}`;
+}
+function stripQuotes(token) {
+  if (token.length >= 2) {
+    const a = token[0];
+    const b = token[token.length - 1];
+    if (a === "'" && b === "'" || a === '"' && b === '"') return token.slice(1, -1);
   }
-});
-
-// ../../packages/core/src/index.ts
-var init_src = __esm({
-  "../../packages/core/src/index.ts"() {
+  return token;
+}
+var SEGMENT_SEP, SCRIPT_EXT;
+var init_scripts = __esm({
+  "../../packages/parsers/src/tool-action/scripts.ts"() {
     "use strict";
-    init_enums();
-    init_schemas();
-    init_ids();
-    init_redact();
-    init_billing();
+    SEGMENT_SEP = /\s*(?:&&|\|\||[;|&\n])\s*/;
+    SCRIPT_EXT = /\.(sh|bash|zsh|ksh|fish|py|rb|js|mjs|cjs|ts|tsx|pl|php|lua|ps1|bat|cmd|r|jl|groovy|kts)$/i;
   }
 });
 
-// ../../packages/parsers/src/shell-families/index.ts
-function extractCommandFamilies(command) {
-  const families = [];
-  for (const part of splitCommandParts(command)) {
-    const verb = leadingVerb(part);
-    if (!verb || !ALLOWLIST.has(verb)) continue;
-    if (!families.includes(verb)) families.push(verb);
-    if (families.length >= MAX_COMMAND_FAMILIES) break;
+// ../../packages/parsers/src/tool-action/index.ts
+function extractToolAction(call) {
+  const isMcp = call.server.startsWith("mcp:");
+  const command = isMcp ? null : shellCommandOf(call.input);
+  const surface = isMcp ? "mcp" : command != null ? "shell" : "builtin";
+  let executable = call.name || null;
+  let param_shape = null;
+  let command_redacted = null;
+  if (command != null) {
+    const [head = "", ...rest] = command.trim().split(/\s+/);
+    executable = basename(head) || null;
+    param_shape = paramShape(rest.join(" ")) || null;
+    command_redacted = redact(command, call.cwd ?? void 0).text.slice(0, MAX_COMMAND_REDACTED) || null;
   }
-  return families;
+  return {
+    surface,
+    executable,
+    action: null,
+    object: null,
+    qualifiers: [],
+    param_shape,
+    keywords: [],
+    abstract: null,
+    command_redacted,
+    scripts: [],
+    confidence: 0,
+    extractor: `${surface}.v1`
+  };
 }
-function splitCommandParts(command) {
-  const parts = [];
-  let current = "";
-  let inSingle = false;
-  let inDouble = false;
-  for (let i = 0; i < command.length; i++) {
-    const ch = command[i];
-    if (!inSingle && ch === "\\") {
-      current += ch + (command[i + 1] ?? "");
-      i++;
-      continue;
-    }
-    if (ch === "'" && !inDouble) {
-      inSingle = !inSingle;
-      current += ch;
-      continue;
-    }
-    if (ch === '"' && !inSingle) {
-      inDouble = !inDouble;
-      current += ch;
-      continue;
-    }
-    if (!inSingle && !inDouble) {
-      if (ch === ";" || ch === "|" || ch === "\n") {
-        parts.push(current);
-        current = "";
-        continue;
-      }
-      if (ch === "&" && command[i + 1] === "&") {
-        parts.push(current);
-        current = "";
-        i++;
-        continue;
-      }
-    }
-    current += ch;
-  }
-  parts.push(current);
-  return parts;
+function extractLocalToolContext(call) {
+  if (call.server.startsWith("mcp:")) return null;
+  const command = shellCommandOf(call.input);
+  if (command == null) return null;
+  return { command, cwd: call.cwd ?? null };
 }
-function leadingVerb(part) {
-  const tokens = part.trim().split(/\s+/);
-  let i = 0;
-  while (i < tokens.length) {
-    const tok = stripQuotes(tokens[i] ?? "");
-    if (tok === "") {
-      i++;
-      continue;
+function shellCommandOf(input) {
+  if (typeof input === "string") return input.trim() ? input : null;
+  if (input && typeof input === "object") {
+    const cmd = input.command ?? input.cmd;
+    if (typeof cmd === "string") return cmd.trim() ? cmd : null;
+    if (Array.isArray(cmd)) {
+      const parts = cmd.filter((p) => typeof p === "string");
+      if (parts.length) return parts.join(" ");
     }
-    if (VAR_ASSIGNMENT.test(tok)) {
-      i++;
-      continue;
-    }
-    if (WRAPPERS.has(tok)) {
-      i++;
-      while (i < tokens.length && (tokens[i] ?? "").startsWith("-")) i++;
-      continue;
-    }
-    const base = tok.split("/").pop() ?? tok;
-    return base === "" ? null : base;
   }
   return null;
 }
-function stripQuotes(token) {
-  if (token.length >= 2) {
-    const first = token[0];
-    const last = token[token.length - 1];
-    if (first === "'" && last === "'" || first === '"' && last === '"') {
-      return token.slice(1, -1);
-    }
-  }
-  return token;
+function basename(token) {
+  return token.split("/").pop() ?? token;
 }
-var SHELL_FAMILY_ALLOWLIST, MAX_COMMAND_FAMILIES, ALLOWLIST, WRAPPERS, VAR_ASSIGNMENT;
-var init_shell_families = __esm({
-  "../../packages/parsers/src/shell-families/index.ts"() {
+var MAX_COMMAND_REDACTED;
+var init_tool_action = __esm({
+  "../../packages/parsers/src/tool-action/index.ts"() {
     "use strict";
-    SHELL_FAMILY_ALLOWLIST = [
-      "git",
-      "npm",
-      "pnpm",
-      "npx",
-      "yarn",
-      "node",
-      "python",
-      "python3",
-      "pytest",
-      "pip",
-      "pip3",
-      "cargo",
-      "rustc",
-      "go",
-      "make",
-      "cmake",
-      "docker",
-      "docker-compose",
-      "kubectl",
-      "helm",
-      "terraform",
-      "gh",
-      "aws",
-      "gcloud",
-      "az",
-      "curl",
-      "wget",
-      "rg",
-      "grep",
-      "find",
-      "sed",
-      "awk",
-      "jq",
-      "psql",
-      "mysql",
-      "redis-cli",
-      "brew",
-      "apt",
-      "tsx",
-      "vitest",
-      "jest",
-      "playwright",
-      "ruby",
-      "bundle",
-      "mvn",
-      "gradle",
-      "ls",
-      "cat"
-    ];
-    MAX_COMMAND_FAMILIES = 3;
-    ALLOWLIST = new Set(SHELL_FAMILY_ALLOWLIST);
-    WRAPPERS = /* @__PURE__ */ new Set(["sudo", "env", "time", "nice"]);
-    VAR_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+    init_src();
+    init_scripts();
+    MAX_COMMAND_REDACTED = 1e3;
   }
 });
 
@@ -4977,17 +5133,16 @@ function extractExcerpt(content) {
   const truncated = cleaned.slice(0, 320);
   return truncated.length > 0 ? truncated : void 0;
 }
-function commandFamiliesFor(server, name, input) {
-  if (server !== "builtin" || !SHELL_TOOL_NAMES.has(name)) return [];
-  if (typeof input !== "object" || input === null) return [];
-  const command = input.command;
-  return typeof command === "string" ? extractCommandFamilies(command) : [];
-}
 function buildToolCallDraft(opts) {
   const { server, name } = splitObservedToolName(opts.observedName);
   const hashes = hashArgs(opts.input);
+  const external_call_id = typeof opts.rawCallId === "string" && opts.rawCallId.trim() !== "" ? opts.rawCallId.trim().slice(0, 120) : fallbackCallId(opts.sourceEventId, opts.callIndex);
+  if (opts.contexts) {
+    const local = extractLocalToolContext({ server, name, input: opts.input, cwd: opts.cwd });
+    if (local) opts.contexts.push({ external_call_id, ...local });
+  }
   return {
-    external_call_id: typeof opts.rawCallId === "string" && opts.rawCallId.trim() !== "" ? opts.rawCallId.trim().slice(0, 120) : fallbackCallId(opts.sourceEventId, opts.callIndex),
+    external_call_id,
     session_id: opts.sessionId,
     source_event_id: opts.sourceEventId,
     agent: "claude_code",
@@ -5005,12 +5160,13 @@ function buildToolCallDraft(opts) {
     args_bytes: hashes.args_bytes,
     result_bytes: 0,
     model: opts.model,
-    command_families: commandFamiliesFor(server, name, opts.input)
+    action: extractToolAction({ server, name, input: opts.input, cwd: opts.cwd })
   };
 }
 async function parseClaudeCodeJsonl(ctx) {
   const events = [];
   const toolCalls = [];
+  const scriptContexts = [];
   const pendingByCallId = /* @__PURE__ */ new Map();
   let chunk = [];
   let emitted = 0;
@@ -5133,7 +5289,9 @@ async function parseClaudeCodeJsonl(ctx) {
           startedAt: a.timestamp,
           // Model verbatim from the issuing assistant message —
           // including "<synthetic>" (same rule as the event below).
-          model: a.message?.model ?? null
+          model: a.message?.model ?? null,
+          cwd,
+          contexts: scriptContexts
         });
         const identity = toolIdentity(draft.server, draft.name);
         aggregate[identity] = (aggregate[identity] ?? 0) + 1;
@@ -5244,7 +5402,9 @@ async function parseClaudeCodeJsonl(ctx) {
         // No issuing assistant message on this line — attribute to the
         // session's last real model, same as user_message attribution
         // (lastModel never holds "<synthetic>", per the rule above).
-        model: lastModel
+        model: lastModel,
+        cwd,
+        contexts: scriptContexts
       });
       toolCalls.push(draft);
       if (typeof t.id === "string" && t.id) pendingByCallId.set(t.id, draft);
@@ -5256,6 +5416,7 @@ async function parseClaudeCodeJsonl(ctx) {
   return {
     events,
     toolCalls,
+    scriptContexts,
     stats: { rawLines, emittedEvents: emitted, skipped },
     sourceFile: ctx.sourceFile
   };
@@ -5274,22 +5435,14 @@ async function quickChecksum(path5) {
   for await (const chunk of stream) h.update(chunk);
   return { size: st.size, mtime: st.mtimeMs, tailHash: h.digest("hex").slice(0, 16) };
 }
-var SHELL_TOOL_NAMES;
 var init_claude_code = __esm({
   "../../packages/parsers/src/claude-code/index.ts"() {
     "use strict";
     init_src();
     init_git();
-    init_shell_families();
+    init_tool_action();
     init_tool_hash();
     init_types();
-    SHELL_TOOL_NAMES = /* @__PURE__ */ new Set([
-      "Bash",
-      "shell",
-      "local_shell_call",
-      "exec_command",
-      "run_terminal_cmd"
-    ]);
   }
 });
 
@@ -5302,20 +5455,6 @@ function deriveSessionIdFromRolloutPath(path5) {
   );
   return m ? m[1] ?? null : null;
 }
-function commandFieldToString(cmd) {
-  if (typeof cmd === "string") return cmd || null;
-  if (Array.isArray(cmd)) {
-    const parts = cmd.filter((p) => typeof p === "string");
-    if (parts.length === 0) return null;
-    const head = (parts[0] ?? "").split("/").pop() ?? "";
-    const flag = parts[1] ?? "";
-    if (parts.length >= 3 && SHELL_WRAPPER_BINARIES.has(head) && /^-[a-z]*c[a-z]*$/i.test(flag)) {
-      return parts.slice(2).join("\n");
-    }
-    return parts.join(" ");
-  }
-  return null;
-}
 function firstString(...values) {
   for (const v of values) {
     if (typeof v === "string" && v) return v;
@@ -5327,13 +5466,11 @@ function extractToolCallPayload(pt, p) {
   const failed = p.status === "failed";
   if (pt === "local_shell_call") {
     const action = p.action && typeof p.action === "object" ? p.action : null;
-    const command = commandFieldToString(action?.command);
     return {
       callId,
       server: "builtin",
       name: "shell",
       input: action,
-      commandFamilies: command ? extractCommandFamilies(command) : [],
       failed
     };
   }
@@ -5347,17 +5484,12 @@ function extractToolCallPayload(pt, p) {
     } catch {
     }
   }
-  if (SHELL_TOOL_NAMES2.has(observed)) {
-    const rec = input && typeof input === "object" && !Array.isArray(input) ? input : null;
-    const command = commandFieldToString(
-      rec?.command ?? rec?.cmd ?? (typeof input === "string" ? input : null)
-    );
+  if (SHELL_TOOL_NAMES.has(observed)) {
     return {
       callId,
       server: "builtin",
       name: "shell",
       input,
-      commandFamilies: command ? extractCommandFamilies(command) : [],
       failed
     };
   }
@@ -5368,12 +5500,11 @@ function extractToolCallPayload(pt, p) {
       server: `mcp:${normalizeToolName(p.server).slice(0, 116)}`,
       name: normalizeToolName(observed),
       input,
-      commandFamilies: [],
       failed
     };
   }
   const { server, name } = splitObservedToolName(observed);
-  return { callId, server, name, input, commandFamilies: [], failed };
+  return { callId, server, name, input, failed };
 }
 function outputIndicatesError(p) {
   const out = p.output ?? p.result;
@@ -5386,6 +5517,7 @@ function outputIndicatesError(p) {
 async function parseCodexRollout(ctx) {
   const events = [];
   const toolCalls = [];
+  const scriptContexts = [];
   let chunk = [];
   let emitted = 0;
   const emit = async (e) => {
@@ -5468,8 +5600,16 @@ async function parseCodexRollout(ctx) {
         }
         const srcId = sourceEventId(ctx.deviceId, ctx.sourceFile, offsetAtLineStart);
         const { args_hash, signature_hash, args_bytes } = hashArgs(extracted.input);
+        const externalCallId = (extracted.callId ?? fallbackCallId(srcId, 0)).slice(0, 120);
+        const localCtx = extractLocalToolContext({
+          server: extracted.server,
+          name: extracted.name,
+          input: extracted.input,
+          cwd
+        });
+        if (localCtx) scriptContexts.push({ external_call_id: externalCallId, ...localCtx });
         const draft = {
-          external_call_id: (extracted.callId ?? fallbackCallId(srcId, 0)).slice(0, 120),
+          external_call_id: externalCallId,
           session_id: sessionId,
           source_event_id: srcId,
           agent: "codex_cli",
@@ -5486,7 +5626,12 @@ async function parseCodexRollout(ctx) {
           args_bytes,
           result_bytes: 0,
           model,
-          command_families: extracted.commandFamilies
+          action: extractToolAction({
+            server: extracted.server,
+            name: extracted.name,
+            input: extracted.input,
+            cwd
+          })
         };
         toolCalls.push(draft);
         if (extracted.callId) openCalls.set(extracted.callId, draft);
@@ -5598,17 +5743,18 @@ async function parseCodexRollout(ctx) {
   return {
     events,
     toolCalls,
+    scriptContexts,
     stats: { rawLines, emittedEvents: emitted, skipped },
     sourceFile: ctx.sourceFile
   };
 }
-var TOOL_CALL_PAYLOAD_TYPES, TOOL_CALL_OUTPUT_PAYLOAD_TYPES, SHELL_TOOL_NAMES2, SHELL_WRAPPER_BINARIES;
+var TOOL_CALL_PAYLOAD_TYPES, TOOL_CALL_OUTPUT_PAYLOAD_TYPES, SHELL_TOOL_NAMES;
 var init_codex = __esm({
   "../../packages/parsers/src/codex/index.ts"() {
     "use strict";
     init_src();
     init_git();
-    init_shell_families();
+    init_tool_action();
     init_tool_hash();
     init_types();
     TOOL_CALL_PAYLOAD_TYPES = /* @__PURE__ */ new Set([
@@ -5623,13 +5769,12 @@ var init_codex = __esm({
       "custom_tool_call_output",
       "mcp_tool_call_output"
     ]);
-    SHELL_TOOL_NAMES2 = /* @__PURE__ */ new Set([
+    SHELL_TOOL_NAMES = /* @__PURE__ */ new Set([
       "shell",
       "local_shell_call",
       "exec_command",
       "run_terminal_cmd"
     ]);
-    SHELL_WRAPPER_BINARIES = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish"]);
   }
 });
 
@@ -8192,6 +8337,7 @@ var init_src2 = __esm({
     "use strict";
     init_types();
     init_git();
+    init_tool_action();
     init_claude_code();
     init_codex();
     init_cursor();
@@ -12030,12 +12176,12 @@ var require_infra = __commonJS({
     var assert2 = __require("assert");
     var { utf8DecodeBytes } = require_encoding();
     function collectASequenceOfCodePoints(condition, input, position) {
-      let result = "";
+      let result2 = "";
       while (position.position < input.length && condition(input[position.position])) {
-        result += input[position.position];
+        result2 += input[position.position];
         position.position++;
       }
-      return result;
+      return result2;
     }
     function collectASequenceOfCodePointsFast(char, input, position) {
       const idx = input.indexOf(char, position.position);
@@ -12080,16 +12226,16 @@ var require_infra = __commonJS({
       if ((2 << 15) - 1 > length) {
         return String.fromCharCode.apply(null, input);
       }
-      let result = "";
+      let result2 = "";
       let i = 0;
       let addition = (2 << 15) - 1;
       while (i < length) {
         if (i + addition > length) {
           addition = length - i;
         }
-        result += String.fromCharCode.apply(null, input.subarray(i, i += addition));
+        result2 += String.fromCharCode.apply(null, input.subarray(i, i += addition));
       }
-      return result;
+      return result2;
     }
     var invalidIsomorphicEncodeValueRegex = /[^\x00-\xFF]/;
     function isomorphicEncode(input) {
@@ -12114,12 +12260,12 @@ var require_infra = __commonJS({
       return lead === 0 && trail === str.length - 1 ? str : str.slice(lead, trail + 1);
     }
     function serializeJavascriptValueToJSONString(value) {
-      const result = JSON.stringify(value);
-      if (result === void 0) {
+      const result2 = JSON.stringify(value);
+      if (result2 === void 0) {
         throw new TypeError("Value is not JSON serializable");
       }
-      assert2(typeof result === "string");
-      return result;
+      assert2(typeof result2 === "string");
+      return result2;
     }
     module.exports = {
       collectASequenceOfCodePoints,
@@ -12506,9 +12652,9 @@ var require_runtime_features = __commonJS({
        * @returns {boolean}
        */
       #detectRuntimeFeature(feature) {
-        const result = detectRuntimeFeature(feature);
-        this.#map.set(feature, result);
-        return result;
+        const result2 = detectRuntimeFeature(feature);
+        this.#map.set(feature, result2);
+        return result2;
       }
     };
     var instance = new RuntimeFeatures();
@@ -12773,16 +12919,16 @@ var require_webidl = __commonJS({
             message: `${argument} ("${webidl.util.TypeValueToString(O)}") is not an Object.`
           });
         }
-        const result = {};
+        const result2 = {};
         if (!types.isProxy(O)) {
           const keys2 = [...Object.getOwnPropertyNames(O), ...Object.getOwnPropertySymbols(O)];
           for (const key of keys2) {
             const keyName = webidl.util.Stringify(key);
             const typedKey = keyConverter(key, prefix, `Key ${keyName} in ${argument}`);
             const typedValue = valueConverter(O[key], prefix, `${argument}[${keyName}]`);
-            result[typedKey] = typedValue;
+            result2[typedKey] = typedValue;
           }
-          return result;
+          return result2;
         }
         const keys = Reflect.ownKeys(O);
         for (const key of keys) {
@@ -12790,10 +12936,10 @@ var require_webidl = __commonJS({
           if (desc?.enumerable) {
             const typedKey = keyConverter(key, prefix, argument);
             const typedValue = valueConverter(O[key], prefix, argument);
-            result[typedKey] = typedValue;
+            result2[typedKey] = typedValue;
           }
         }
-        return result;
+        return result2;
       };
     };
     webidl.interfaceConverter = function(TypeCheck, name) {
@@ -13489,20 +13635,20 @@ var require_util2 = __commonJS({
           }
           const { [keyIndex]: key, [valueIndex]: value } = values[index];
           this.#index = index + 1;
-          let result;
+          let result2;
           switch (this.#kind) {
             case "key":
-              result = key;
+              result2 = key;
               break;
             case "value":
-              result = value;
+              result2 = value;
               break;
             case "key+value":
-              result = [key, value];
+              result2 = [key, value];
               break;
           }
           return {
-            value: result,
+            value: result2,
             done: false
           };
         }
@@ -14109,8 +14255,8 @@ var require_formdata_parser = __commonJS({
           throw parsingError("expected CRLF");
         }
         position.position += 2;
-        const result = parseMultipartFormDataHeaders(input, position);
-        let { name, filename, contentType, encoding } = result;
+        const result2 = parseMultipartFormDataHeaders(input, position);
+        let { name, filename, contentType, encoding } = result2;
         position.position += 2;
         let body;
         {
@@ -14530,8 +14676,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
       if (action != null) {
         ;
         (async () => {
-          const result = action();
-          const iterator = result?.[Symbol.asyncIterator]?.();
+          const result2 = action();
+          const iterator = result2?.[Symbol.asyncIterator]?.();
           if (iterator) {
             for await (const bytes of iterator) {
               if (isErrored(stream)) break;
@@ -14539,8 +14685,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
                 controller.enqueue(new Uint8Array(bytes));
               }
             }
-          } else if (result?.length && !isErrored(stream)) {
-            controller.enqueue(typeof result === "string" ? textEncoder.encode(result) : new Uint8Array(result));
+          } else if (result2?.length && !isErrored(stream)) {
+            controller.enqueue(typeof result2 === "string" ? textEncoder.encode(result2) : new Uint8Array(result2));
           }
           queueMicrotask(() => readableStreamClose(controller));
         })();
@@ -15906,17 +16052,17 @@ var require_client_h2 = __commonJS({
       }
     } = http2;
     function parseH2Headers(headers) {
-      const result = [];
+      const result2 = [];
       for (const [name, value] of Object.entries(headers)) {
         if (Array.isArray(value)) {
           for (const subvalue of value) {
-            result.push(Buffer.from(name), Buffer.from(subvalue));
+            result2.push(Buffer.from(name), Buffer.from(subvalue));
           }
         } else {
-          result.push(Buffer.from(name), Buffer.from(value));
+          result2.push(Buffer.from(name), Buffer.from(value));
         }
       }
-      return result;
+      return result2;
     }
     function connectH2(client, socket) {
       client[kSocket] = socket;
@@ -17526,11 +17672,11 @@ var require_balanced_pool = __commonJS({
         return this;
       }
       _updateBalancedPoolStats() {
-        let result = 0;
+        let result2 = 0;
         for (let i = 0; i < this[kClients].length; i++) {
-          result = getGreatestCommonDivisor(this[kClients][i][kWeight], result);
+          result2 = getGreatestCommonDivisor(this[kClients][i][kWeight], result2);
         }
-        this[kGreatestCommonDivisor] = result;
+        this[kGreatestCommonDivisor] = result2;
       }
       removeUpstream(upstream) {
         const upstreamOrigin = util2.parseOrigin(upstream).origin;
@@ -17772,26 +17918,26 @@ var require_agent = __commonJS({
         if (this[kOrigins].size >= this[kOptions].maxOrigins && !this[kOrigins].has(key)) {
           throw new MaxOriginsReachedError();
         }
-        const result = this[kClients].get(key);
-        let dispatcher = result && result.dispatcher;
+        const result2 = this[kClients].get(key);
+        let dispatcher = result2 && result2.dispatcher;
         if (!dispatcher) {
           const closeClientIfUnused = (connected) => {
-            const result2 = this[kClients].get(key);
-            if (result2) {
-              if (connected) result2.count -= 1;
-              if (result2.count <= 0) {
+            const result3 = this[kClients].get(key);
+            if (result3) {
+              if (connected) result3.count -= 1;
+              if (result3.count <= 0) {
                 this[kClients].delete(key);
-                if (!result2.dispatcher.destroyed) {
-                  result2.dispatcher.close();
+                if (!result3.dispatcher.destroyed) {
+                  result3.dispatcher.close();
                 }
               }
               this[kOrigins].delete(key);
             }
           };
           dispatcher = this[kFactory](opts.origin, this[kOptions]).on("drain", this[kOnDrain]).on("connect", (origin, targets) => {
-            const result2 = this[kClients].get(key);
-            if (result2) {
-              result2.count += 1;
+            const result3 = this[kClients].get(key);
+            if (result3) {
+              result3.count += 1;
             }
             this[kOnConnect](origin, targets);
           }).on("disconnect", (origin, targets, err) => {
@@ -20723,20 +20869,20 @@ var require_mock_utils = __commonJS({
     }
     function generateKeyValues(data) {
       const keys = Object.keys(data);
-      const result = [];
+      const result2 = [];
       for (let i = 0; i < keys.length; ++i) {
         const key = keys[i];
         const value = data[key];
         const name = Buffer.from(`${key}`);
         if (Array.isArray(value)) {
           for (let j = 0; j < value.length; ++j) {
-            result.push(name, Buffer.from(`${value[j]}`));
+            result2.push(name, Buffer.from(`${value[j]}`));
           }
         } else {
-          result.push(name, Buffer.from(`${value}`));
+          result2.push(name, Buffer.from(`${value}`));
         }
       }
-      return result;
+      return result2;
     }
     function getStatusText(statusCode) {
       return STATUS_CODES[statusCode] || "unknown";
@@ -21210,16 +21356,16 @@ var require_mock_call_history = __commonJS({
       }
       toString() {
         const options = { betweenKeyValueSeparator: "->", betweenPairSeparator: "|" };
-        let result = "";
+        let result2 = "";
         this.toMap().forEach((value, key) => {
           if (typeof value === "string" || value === void 0 || value === null) {
-            result = `${result}${key}${options.betweenKeyValueSeparator}${value}${options.betweenPairSeparator}`;
+            result2 = `${result2}${key}${options.betweenKeyValueSeparator}${value}${options.betweenPairSeparator}`;
           }
           if (typeof value === "object" && value !== null || Array.isArray(value)) {
-            result = `${result}${key}${options.betweenKeyValueSeparator}${JSON.stringify(value)}${options.betweenPairSeparator}`;
+            result2 = `${result2}${key}${options.betweenKeyValueSeparator}${JSON.stringify(value)}${options.betweenPairSeparator}`;
           }
         });
-        return result.slice(0, -1);
+        return result2.slice(0, -1);
       }
     };
     var MockCallHistory = class {
@@ -21562,20 +21708,20 @@ var require_mock_agent = __commonJS({
         return this[kOptions] && this[kOptions].connections === 1 ? new MockClient(origin, mockOptions) : new MockPool(origin, mockOptions);
       }
       [kMockAgentGet](origin) {
-        const result = this[kClients].get(origin);
-        if (result?.dispatcher) {
-          return result.dispatcher;
+        const result2 = this[kClients].get(origin);
+        if (result2?.dispatcher) {
+          return result2.dispatcher;
         }
         if (typeof origin !== "string") {
           const dispatcher = this[kFactory]("http://localhost:9999");
           this[kMockAgentSet](origin, dispatcher);
           return dispatcher;
         }
-        for (const [keyMatcher, result2] of Array.from(this[kClients])) {
-          if (result2 && typeof keyMatcher !== "string" && matchValue(keyMatcher, origin)) {
+        for (const [keyMatcher, result3] of Array.from(this[kClients])) {
+          if (result3 && typeof keyMatcher !== "string" && matchValue(keyMatcher, origin)) {
             const dispatcher = this[kFactory](origin);
             this[kMockAgentSet](origin, dispatcher);
-            dispatcher[kDispatches] = result2.dispatcher[kDispatches];
+            dispatcher[kDispatches] = result3.dispatcher[kDispatches];
             return dispatcher;
           }
         }
@@ -21585,7 +21731,7 @@ var require_mock_agent = __commonJS({
       }
       pendingInterceptors() {
         const mockAgentClients = this[kClients];
-        return Array.from(mockAgentClients.entries()).flatMap(([origin, result]) => result.dispatcher[kDispatches].map((dispatch) => ({ ...dispatch, origin }))).filter(({ pending: pending2 }) => pending2);
+        return Array.from(mockAgentClients.entries()).flatMap(([origin, result2]) => result2.dispatcher[kDispatches].map((dispatch) => ({ ...dispatch, origin }))).filter(({ pending: pending2 }) => pending2);
       }
       assertNoPendingInterceptors({ pendingInterceptorsFormatter = new PendingInterceptorsFormatter() } = {}) {
         const pending2 = this.pendingInterceptors();
@@ -21695,7 +21841,7 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@7.25.0/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile, readFile, mkdir: mkdir2 } = __require("fs/promises");
+    var { writeFile: writeFile2, readFile: readFile2, mkdir: mkdir3 } = __require("fs/promises");
     var { dirname: dirname9, resolve: resolve6 } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
@@ -21897,7 +22043,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve6(path5), "utf8");
+          const data = await readFile2(resolve6(path5), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -21927,12 +22073,12 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         const resolvedPath = resolve6(path5);
-        await mkdir2(dirname9(resolvedPath), { recursive: true });
+        await mkdir3(dirname9(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
           snapshot
         }));
-        await writeFile(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+        await writeFile2(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
       }
       /**
        * Clears all recorded snapshots
@@ -23714,8 +23860,8 @@ var require_date = __commonJS({
         }
         second = (code1 - 48) * 10 + (code2 - 48);
       }
-      const result = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
-      return result.getUTCDay() === weekday ? result : void 0;
+      const result2 = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
+      return result2.getUTCDay() === weekday ? result2 : void 0;
     }
     function parseAscTimeDate(date) {
       if (date.length !== 24 || date[7] !== " " || date[10] !== " " || date[19] !== " ") {
@@ -23877,8 +24023,8 @@ var require_date = __commonJS({
         return void 0;
       }
       const year = (yearDigit1 - 48) * 1e3 + (yearDigit2 - 48) * 100 + (yearDigit3 - 48) * 10 + (yearDigit4 - 48);
-      const result = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
-      return result.getUTCDay() === weekday ? result : void 0;
+      const result2 = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
+      return result2.getUTCDay() === weekday ? result2 : void 0;
     }
     function parseRfc850Date(date) {
       let commaIndex = -1;
@@ -24027,8 +24173,8 @@ var require_date = __commonJS({
         }
         second = (code1 - 48) * 10 + (code2 - 48);
       }
-      const result = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
-      return result.getUTCDay() === weekday ? result : void 0;
+      const result2 = new Date(Date.UTC(year, monthIdx, day, hour, minute, second));
+      return result2.getUTCDay() === weekday ? result2 : void 0;
     }
     module.exports = {
       parseHttpDate
@@ -24232,11 +24378,11 @@ var require_cache_handler = __commonJS({
               });
             }
           };
-          const result = this.#store.get(this.#cacheKey);
-          if (result && typeof result.then === "function") {
-            result.then(handle304);
+          const result2 = this.#store.get(this.#cacheKey);
+          if (result2 && typeof result2.then === "function") {
+            result2.then(handle304);
           } else {
-            handle304(result);
+            handle304(result2);
           }
         } else {
           if (typeof resHeaders.etag === "string" && isEtagUsable(resHeaders.etag)) {
@@ -24705,11 +24851,11 @@ var require_cache2 = __commonJS({
     }
     var nop = () => {
     };
-    function needsRevalidation(result, cacheControlDirectives, { headers = {} }) {
+    function needsRevalidation(result2, cacheControlDirectives, { headers = {} }) {
       if (cacheControlDirectives?.["no-cache"]) {
         return true;
       }
-      if (result.cacheControlDirectives?.["no-cache"] && !Array.isArray(result.cacheControlDirectives["no-cache"])) {
+      if (result2.cacheControlDirectives?.["no-cache"] && !Array.isArray(result2.cacheControlDirectives["no-cache"])) {
         return true;
       }
       if (headers["if-modified-since"] || headers["if-none-match"]) {
@@ -24717,29 +24863,29 @@ var require_cache2 = __commonJS({
       }
       return false;
     }
-    function isStale(result, cacheControlDirectives) {
+    function isStale(result2, cacheControlDirectives) {
       const now = Date.now();
-      if (now > result.staleAt) {
+      if (now > result2.staleAt) {
         if (cacheControlDirectives?.["max-stale"]) {
-          const gracePeriod = result.staleAt + cacheControlDirectives["max-stale"] * 1e3;
+          const gracePeriod = result2.staleAt + cacheControlDirectives["max-stale"] * 1e3;
           return now > gracePeriod;
         }
         return true;
       }
       if (cacheControlDirectives?.["min-fresh"]) {
-        const timeLeftTillStale = result.staleAt - now;
+        const timeLeftTillStale = result2.staleAt - now;
         const threshold = cacheControlDirectives["min-fresh"] * 1e3;
         return timeLeftTillStale <= threshold;
       }
       return false;
     }
-    function withinStaleWhileRevalidateWindow(result) {
-      const staleWhileRevalidate = result.cacheControlDirectives?.["stale-while-revalidate"];
+    function withinStaleWhileRevalidateWindow(result2) {
+      const staleWhileRevalidate = result2.cacheControlDirectives?.["stale-while-revalidate"];
       if (!staleWhileRevalidate) {
         return false;
       }
       const now = Date.now();
-      const staleWhileRevalidateExpiry = result.staleAt + staleWhileRevalidate * 1e3;
+      const staleWhileRevalidateExpiry = result2.staleAt + staleWhileRevalidate * 1e3;
       return now <= staleWhileRevalidateExpiry;
     }
     function handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl) {
@@ -24772,8 +24918,8 @@ var require_cache2 = __commonJS({
       }
       return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler));
     }
-    function sendCachedValue(handler, opts, result, age, context, isStale2) {
-      const stream = util2.isStream(result.body) ? result.body : Readable3.from(result.body ?? []);
+    function sendCachedValue(handler, opts, result2, age, context, isStale2) {
+      const stream = util2.isStream(result2.body) ? result2.body : Readable3.from(result2.body ?? []);
       assert2(!stream.destroyed, "stream should not be destroyed");
       assert2(!stream.readableDidRead, "stream should not be readableDidRead");
       const controller = {
@@ -24813,11 +24959,11 @@ var require_cache2 = __commonJS({
       if (stream.destroyed) {
         return;
       }
-      const headers = { ...result.headers, age: String(age) };
+      const headers = { ...result2.headers, age: String(age) };
       if (isStale2) {
         headers.warning = '110 - "response is stale"';
       }
-      handler.onResponseStart?.(controller, result.statusCode, headers, result.statusMessage);
+      handler.onResponseStart?.(controller, result2.statusCode, headers, result2.statusMessage);
       if (opts.method === "HEAD") {
         stream.destroy();
       } else {
@@ -24826,38 +24972,38 @@ var require_cache2 = __commonJS({
         });
       }
     }
-    function handleResult2(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl, result) {
-      if (!result) {
+    function handleResult2(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl, result2) {
+      if (!result2) {
         return handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl);
       }
       const now = Date.now();
-      if (now > result.deleteAt) {
+      if (now > result2.deleteAt) {
         return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler));
       }
-      const age = Math.round((now - result.cachedAt) / 1e3);
+      const age = Math.round((now - result2.cachedAt) / 1e3);
       if (reqCacheControl?.["max-age"] && age >= reqCacheControl["max-age"]) {
         return dispatch(opts, handler);
       }
-      const stale = isStale(result, reqCacheControl);
-      const revalidate = needsRevalidation(result, reqCacheControl, opts);
+      const stale = isStale(result2, reqCacheControl);
+      const revalidate = needsRevalidation(result2, reqCacheControl, opts);
       if (stale || revalidate) {
         if (util2.isStream(opts.body) && util2.bodyLength(opts.body) !== 0) {
           return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler));
         }
-        if (!revalidate && withinStaleWhileRevalidateWindow(result)) {
-          sendCachedValue(handler, opts, result, age, null, true);
+        if (!revalidate && withinStaleWhileRevalidateWindow(result2)) {
+          sendCachedValue(handler, opts, result2, age, null, true);
           queueMicrotask(() => {
             const headers2 = {
               ...opts.headers,
-              "if-modified-since": new Date(result.cachedAt).toUTCString()
+              "if-modified-since": new Date(result2.cachedAt).toUTCString()
             };
-            if (result.etag) {
-              headers2["if-none-match"] = result.etag;
+            if (result2.etag) {
+              headers2["if-none-match"] = result2.etag;
             }
-            if (result.vary) {
-              for (const key in result.vary) {
-                if (result.vary[key] != null) {
-                  headers2[key] = result.vary[key];
+            if (result2.vary) {
+              for (const key in result2.vary) {
+                if (result2.vary[key] != null) {
+                  headers2[key] = result2.vary[key];
                 }
               }
             }
@@ -24886,21 +25032,21 @@ var require_cache2 = __commonJS({
           return true;
         }
         let withinStaleIfErrorThreshold = false;
-        const staleIfErrorExpiry = result.cacheControlDirectives["stale-if-error"] ?? reqCacheControl?.["stale-if-error"];
+        const staleIfErrorExpiry = result2.cacheControlDirectives["stale-if-error"] ?? reqCacheControl?.["stale-if-error"];
         if (staleIfErrorExpiry) {
-          withinStaleIfErrorThreshold = now < result.staleAt + staleIfErrorExpiry * 1e3;
+          withinStaleIfErrorThreshold = now < result2.staleAt + staleIfErrorExpiry * 1e3;
         }
         const headers = {
           ...opts.headers,
-          "if-modified-since": new Date(result.cachedAt).toUTCString()
+          "if-modified-since": new Date(result2.cachedAt).toUTCString()
         };
-        if (result.etag) {
-          headers["if-none-match"] = result.etag;
+        if (result2.etag) {
+          headers["if-none-match"] = result2.etag;
         }
-        if (result.vary) {
-          for (const key in result.vary) {
-            if (result.vary[key] != null) {
-              headers[key] = result.vary[key];
+        if (result2.vary) {
+          for (const key in result2.vary) {
+            if (result2.vary[key] != null) {
+              headers[key] = result2.vary[key];
             }
           }
         }
@@ -24912,9 +25058,9 @@ var require_cache2 = __commonJS({
           new CacheRevalidationHandler(
             (success, context) => {
               if (success) {
-                sendCachedValue(handler, opts, result, age, context, stale);
-              } else if (util2.isStream(result.body)) {
-                result.body.on("error", nop).destroy();
+                sendCachedValue(handler, opts, result2, age, context, stale);
+              } else if (util2.isStream(result2.body)) {
+                result2.body.on("error", nop).destroy();
               }
             },
             new CacheHandler(globalOpts, cacheKey, handler),
@@ -24925,7 +25071,7 @@ var require_cache2 = __commonJS({
       if (util2.isStream(opts.body)) {
         opts.body.on("error", nop).destroy();
       }
-      sendCachedValue(handler, opts, result, age, null, false);
+      sendCachedValue(handler, opts, result2, age, null, false);
     }
     module.exports = (opts = {}) => {
       const {
@@ -24987,16 +25133,16 @@ var require_cache2 = __commonJS({
             return dispatch(opts2, handler);
           }
           const cacheKey = makeCacheKey(opts2);
-          const result = store2.get(cacheKey);
-          if (result && typeof result.then === "function") {
-            return result.then((result2) => handleResult2(
+          const result2 = store2.get(cacheKey);
+          if (result2 && typeof result2.then === "function") {
+            return result2.then((result3) => handleResult2(
               dispatch,
               globalOpts,
               cacheKey,
               handler,
               opts2,
               reqCacheControl,
-              result2
+              result3
             ));
           } else {
             return handleResult2(
@@ -25006,7 +25152,7 @@ var require_cache2 = __commonJS({
               handler,
               opts2,
               reqCacheControl,
-              result
+              result2
             );
           }
         };
@@ -25099,8 +25245,8 @@ var require_decompress = __commonJS({
         decompressor.on("readable", () => {
           let chunk;
           while ((chunk = decompressor.read()) !== null) {
-            const result = super.onResponseData(controller, chunk);
-            if (result === false) {
+            const result2 = super.onResponseData(controller, chunk);
+            if (result2 === false) {
               break;
             }
           }
@@ -27720,12 +27866,12 @@ var require_subresource_integrity = __commonJS({
       return false;
     };
     function getStrongestMetadata(metadataList) {
-      const result = [];
+      const result2 = [];
       let strongest = null;
       for (const item of metadataList) {
         assert2(isValidSRIHashAlgorithm(item.alg), "Invalid SRI hash algorithm token");
-        if (result.length === 0) {
-          result.push(item);
+        if (result2.length === 0) {
+          result2.push(item);
           strongest = item;
           continue;
         }
@@ -27740,16 +27886,16 @@ var require_subresource_integrity = __commonJS({
           continue;
         } else if (newAlgorithmIndex > currentAlgorithmIndex) {
           strongest = item;
-          result[0] = item;
-          result.length = 1;
+          result2[0] = item;
+          result2.length = 1;
         } else {
-          result.push(item);
+          result2.push(item);
         }
       }
-      return result;
+      return result2;
     }
     function parseMetadata(metadata) {
-      const result = [];
+      const result2 = [];
       for (const item of metadata.split(" ")) {
         const expressionAndOptions = item.split("?", 1);
         const algorithmExpression = expressionAndOptions[0];
@@ -27766,9 +27912,9 @@ var require_subresource_integrity = __commonJS({
           alg: algorithm,
           val: base64Value
         };
-        result.push(metadata2);
+        result2.push(metadata2);
       }
-      return result;
+      return result2;
     }
     var applyAlgorithmToBytes = (algorithm, bytes) => {
       return crypto3.hash(algorithm, bytes, "base64");
@@ -31717,10 +31863,10 @@ var require_websocket = __commonJS({
         const wasClean = this.#handler.closeState.has(sentCloseFrameState.SENT) && this.#handler.closeState.has(sentCloseFrameState.RECEIVED);
         let code = 1005;
         let reason = "";
-        const result = this.#parser?.closingInfo;
-        if (result && !result.error) {
-          code = result.code ?? 1005;
-          reason = result.reason;
+        const result2 = this.#parser?.closingInfo;
+        if (result2 && !result2.error) {
+          code = result2.code ?? 1005;
+          reason = result2.reason;
         }
         this.#handler.readyState = states.CLOSED;
         if (!this.#handler.closeState.has(sentCloseFrameState.RECEIVED)) {
@@ -32157,12 +32303,12 @@ var require_websocketstream = __commonJS({
         if (!this.#handler.wasEverConnected) {
           this.#openedPromise.reject(new WebSocketError("Socket never opened"));
         }
-        const result = this.#parser?.closingInfo;
-        let code = result?.code ?? 1005;
+        const result2 = this.#parser?.closingInfo;
+        let code = result2?.code ?? 1005;
         if (!this.#handler.closeState.has(sentCloseFrameState.SENT) && !this.#handler.closeState.has(sentCloseFrameState.RECEIVED)) {
           code = 1006;
         }
-        const reason = result?.reason == null ? "" : utf8DecodeBytes(Buffer.from(result.reason));
+        const reason = result2?.reason == null ? "" : utf8DecodeBytes(Buffer.from(result2.reason));
         if (wasClean) {
           this.#readableStreamController.close();
           if (!this.#writableStream.locked) {
@@ -33007,10 +33153,11 @@ function expBackoff(attempt) {
   const i = Math.min(Math.max(attempt, 0), BACKOFF_MS.length - 1);
   return BACKOFF_MS[i];
 }
-var BACKOFF_MS, BACKSTOP_SCAN_MS;
+var INGEST_BATCH_MAX_EVENTS, BACKOFF_MS, BACKSTOP_SCAN_MS;
 var init_config = __esm({
   "../../packages/companion-core/src/config/index.ts"() {
     "use strict";
+    INGEST_BATCH_MAX_EVENTS = 1e3;
     BACKOFF_MS = [1e3, 2500, 5e3, 1e4, 2e4, 6e4];
     BACKSTOP_SCAN_MS = 5 * 6e4;
   }
@@ -33133,7 +33280,7 @@ var init_http = __esm({
               },
               // wellFormedStringify, not JSON.stringify: a truncated-emoji
               // lone surrogate in any excerpt 400s the whole batch on the
-              // serde_json side. See the helper's doc comment.
+              // ingest server's strict JSON decoder. See the helper's doc comment.
               body: wellFormedStringify(batch)
             });
           } catch (err) {
@@ -33286,8 +33433,8 @@ var require_main = __commonJS({
       options = options || {};
       const vaultPath = _vaultPath(options);
       options.path = vaultPath;
-      const result = DotenvModule.configDotenv(options);
-      if (!result.parsed) {
+      const result2 = DotenvModule.configDotenv(options);
+      if (!result2.parsed) {
         const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
         err.code = "MISSING_DATA";
         throw err;
@@ -33298,7 +33445,7 @@ var require_main = __commonJS({
       for (let i = 0; i < length; i++) {
         try {
           const key = keys[i].trim();
-          const attrs = _instructions(result, key);
+          const attrs = _instructions(result2, key);
           decrypted = DotenvModule.decrypt(attrs.ciphertext, attrs.key);
           break;
         } catch (error) {
@@ -33327,7 +33474,7 @@ var require_main = __commonJS({
       }
       return "";
     }
-    function _instructions(result, dotenvKey) {
+    function _instructions(result2, dotenvKey) {
       let uri;
       try {
         uri = new URL(dotenvKey);
@@ -33352,7 +33499,7 @@ var require_main = __commonJS({
         throw err;
       }
       const environmentKey = `DOTENV_VAULT_${environment.toUpperCase()}`;
-      const ciphertext = result.parsed[environmentKey];
+      const ciphertext = result2.parsed[environmentKey];
       if (!ciphertext) {
         const err = new Error(`NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate environment ${environmentKey} in your .env.vault file.`);
         err.code = "NOT_FOUND_DOTENV_ENVIRONMENT";
@@ -34240,14 +34387,14 @@ var init_temp = __esm({
         }
       },
       truncate: (filePath) => {
-        const basename4 = path2.basename(filePath);
-        if (basename4.length <= LIMIT_BASENAME_LENGTH)
+        const basename5 = path2.basename(filePath);
+        if (basename5.length <= LIMIT_BASENAME_LENGTH)
           return filePath;
-        const truncable = /^(\.?)(.*?)((?:\.[^.]+)?(?:\.tmp-\d{10}[a-f0-9]{6})?)$/.exec(basename4);
+        const truncable = /^(\.?)(.*?)((?:\.[^.]+)?(?:\.tmp-\d{10}[a-f0-9]{6})?)$/.exec(basename5);
         if (!truncable)
           return filePath;
-        const truncationLength = basename4.length - LIMIT_BASENAME_LENGTH;
-        return `${filePath.slice(0, -basename4.length)}${truncable[1]}${truncable[2].slice(0, -truncationLength)}${truncable[3]}`;
+        const truncationLength = basename5.length - LIMIT_BASENAME_LENGTH;
+        return `${filePath.slice(0, -basename5.length)}${truncable[1]}${truncable[2].slice(0, -truncationLength)}${truncable[3]}`;
       }
     };
     node_default(Temp.purgeSyncAll);
@@ -36239,10 +36386,10 @@ var require_keyword = __commonJS({
       if (def.async && !schemaEnv.$async)
         throw new Error("async keyword in sync schema");
     }
-    function useKeyword(gen, keyword, result) {
-      if (result === void 0)
+    function useKeyword(gen, keyword, result2) {
+      if (result2 === void 0)
         throw new Error(`keyword "${keyword}" failed to compile`);
-      return gen.scopeValue("keyword", typeof result == "function" ? { ref: result } : { ref: result, code: (0, codegen_1.stringify)(result) });
+      return gen.scopeValue("keyword", typeof result2 == "function" ? { ref: result2 } : { ref: result2, code: (0, codegen_1.stringify)(result2) });
     }
     function validSchemaType(schema, schemaType, allowUndefined = false) {
       return !schemaType.length || schemaType.some((st) => st === "array" ? Array.isArray(schema) : st === "object" ? schema && typeof schema == "object" && !Array.isArray(schema) : typeof schema == st || allowUndefined && typeof schema == "undefined");
@@ -42016,7 +42163,7 @@ var init_debounce_fn = __esm({
       }
       let timeout;
       let maxTimeout;
-      let result;
+      let result2;
       const debouncedFunction = function(...arguments_) {
         const context = this;
         const later = () => {
@@ -42026,7 +42173,7 @@ var init_debounce_fn = __esm({
             maxTimeout = void 0;
           }
           if (after) {
-            result = inputFunction.apply(context, arguments_);
+            result2 = inputFunction.apply(context, arguments_);
           }
         };
         const maxLater = () => {
@@ -42036,7 +42183,7 @@ var init_debounce_fn = __esm({
             timeout = void 0;
           }
           if (after) {
-            result = inputFunction.apply(context, arguments_);
+            result2 = inputFunction.apply(context, arguments_);
           }
         };
         const shouldCallNow = before && !timeout;
@@ -42046,9 +42193,9 @@ var init_debounce_fn = __esm({
           maxTimeout = setTimeout(maxLater, maxWait);
         }
         if (shouldCallNow) {
-          result = inputFunction.apply(context, arguments_);
+          result2 = inputFunction.apply(context, arguments_);
         }
-        return result;
+        return result2;
       };
       mimicFunction(debouncedFunction, inputFunction);
       debouncedFunction.cancel = () => {
@@ -43042,9 +43189,9 @@ var require_range = __commonJS({
         if (rangeMap.size > 1 && rangeMap.has("")) {
           rangeMap.delete("");
         }
-        const result = [...rangeMap.values()];
-        cache.set(memoKey, result);
-        return result;
+        const result2 = [...rangeMap.values()];
+        cache.set(memoKey, result2);
+        return result2;
       }
       intersects(range, options) {
         if (!(range instanceof _Range)) {
@@ -43098,16 +43245,16 @@ var require_range = __commonJS({
     var isNullSet = (c) => c.value === "<0.0.0-0";
     var isAny = (c) => c.value === "";
     var isSatisfiable = (comparators, options) => {
-      let result = true;
+      let result2 = true;
       const remainingComparators = comparators.slice();
       let testComparator = remainingComparators.pop();
-      while (result && remainingComparators.length) {
-        result = remainingComparators.every((otherComparator) => {
+      while (result2 && remainingComparators.length) {
+        result2 = remainingComparators.every((otherComparator) => {
           return testComparator.intersects(otherComparator, options);
         });
         testComparator = remainingComparators.pop();
       }
-      return result;
+      return result2;
     };
     var parseComparator = (comp, options) => {
       comp = comp.replace(re[t.BUILD], "");
@@ -44886,15 +45033,15 @@ function ingestClient() {
   return _ingest;
 }
 async function uploadBatch(batch) {
-  const result = await ingestClient().upload(batch);
-  if (result.kind !== "commit") {
-    throw new Error(`upload failed: ${result.reason}`);
+  const result2 = await ingestClient().upload(batch);
+  if (result2.kind !== "commit") {
+    throw new Error(`upload failed: ${result2.reason}`);
   }
   return {
-    accepted: result.response.accepted,
-    new_sessions: result.response.new_sessions,
-    updated_sessions: result.response.updated_sessions,
-    batch_id: result.response.batch_id
+    accepted: result2.response.accepted,
+    new_sessions: result2.response.new_sessions,
+    updated_sessions: result2.response.updated_sessions,
+    batch_id: result2.response.batch_id
   };
 }
 var import_undici, DeviceMeUnauthorized, _ingest;
@@ -45237,6 +45384,38 @@ var init_title = __esm({
   }
 });
 
+// ../../packages/companion-core/src/pipeline/script-summary.ts
+function buildScriptSummaryUserPrompt(input) {
+  const body = input.content.slice(0, SCRIPT_SUMMARY_INPUT_MAX_CHARS);
+  return [
+    `Script reference: ${input.ref}`,
+    "Contents:",
+    "```",
+    body,
+    "```",
+    "",
+    "One sentence (\u2264200 chars): what does running this script do?"
+  ].join("\n");
+}
+var SCRIPT_SUMMARY_OUTPUT_MAX_CHARS, SCRIPT_SUMMARY_TEMPERATURE, SCRIPT_SUMMARY_MAX_TOKENS, SCRIPT_SUMMARY_INPUT_MAX_CHARS, SCRIPT_SUMMARY_SYSTEM_PROMPT;
+var init_script_summary = __esm({
+  "../../packages/companion-core/src/pipeline/script-summary.ts"() {
+    "use strict";
+    SCRIPT_SUMMARY_OUTPUT_MAX_CHARS = 200;
+    SCRIPT_SUMMARY_TEMPERATURE = 0.2;
+    SCRIPT_SUMMARY_MAX_TOKENS = 120;
+    SCRIPT_SUMMARY_INPUT_MAX_CHARS = 6e3;
+    SCRIPT_SUMMARY_SYSTEM_PROMPT = `You summarise what a script file does, for an engineer scanning a dashboard.
+
+Rules:
+- Output ONE plain sentence (at most 200 characters) stating what the script DOES when it runs.
+- Be concrete and factual: the actions it performs and the systems it touches.
+- No preamble ("This script\u2026"), no markdown, no quotes, no line breaks.
+- Do not invent behaviour that is not in the file. If the file is trivial or unreadable, say so briefly.
+- Never include secrets, tokens, passwords, or personal data, even if they appear in the file.`;
+  }
+});
+
 // ../../packages/companion-core/src/pipeline/index.ts
 async function buildSegmentsForSession(events, adapters2, onProgress) {
   if (events.length === 0) return [];
@@ -45549,6 +45728,7 @@ var init_pipeline = __esm({
     init_cognition();
     init_prompts();
     init_title();
+    init_script_summary();
     SEGMENT_TIME_GAP_MS = 15 * 6e4;
     SEGMENT_TOPIC_THRESHOLD = 0.35;
     SEGMENT_MAX_TURNS = 100;
@@ -45806,8 +45986,8 @@ var init_ollama = __esm({
 });
 
 // ../../packages/companion-core/src/node/llama.ts
-import { mkdir } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
+import { mkdir } from "fs/promises";
 import { homedir as homedir5 } from "os";
 import { dirname as dirname5, join as join5 } from "path";
 function defaultLlamaConfig() {
@@ -45839,23 +46019,17 @@ async function ensureLlamaModel(cfg = defaultLlamaConfig()) {
   await mkdir(dirname5(cfg.modelPath), { recursive: true });
   const res = await fetch(cfg.modelUrl);
   if (!res.ok || !res.body) {
-    throw new Error(
-      `model download failed: ${res.status} ${res.statusText} (${cfg.modelUrl})`
-    );
+    throw new Error(`model download failed: ${res.status} ${res.statusText} (${cfg.modelUrl})`);
   }
   const total = Number(res.headers.get("content-length") ?? 0);
   const totalMb = total > 0 ? (total / (1024 * 1024)).toFixed(0) : "?";
-  console.log(
-    `[modelstat] downloading summariser model (~${totalMb} MB) \u2192 ${cfg.modelPath}`
-  );
+  console.log(`[modelstat] downloading summariser model (~${totalMb} MB) \u2192 ${cfg.modelPath}`);
   const tmp = `${cfg.modelPath}.partial`;
   const { createWriteStream: createWriteStream2 } = await import("fs");
   const { Readable: Readable3 } = await import("stream");
-  const { rename } = await import("fs/promises");
+  const { rename: rename2 } = await import("fs/promises");
   const out = createWriteStream2(tmp);
-  const isTty = Boolean(
-    process.stdout.isTTY
-  );
+  const isTty = Boolean(process.stdout.isTTY);
   let received = 0;
   let lastLog = 0;
   let lastBytes = 0;
@@ -45899,7 +46073,7 @@ async function ensureLlamaModel(cfg = defaultLlamaConfig()) {
   });
   renderProgress(true);
   if (isTty) process.stdout.write("\n");
-  await rename(tmp, cfg.modelPath);
+  await rename2(tmp, cfg.modelPath);
   console.log(`[modelstat] summariser model ready (${cfg.modelPath})`);
   return cfg.modelPath;
 }
@@ -45920,6 +46094,9 @@ async function loadOnce(cfg) {
     const entitlerContext = await model.createContext({
       contextSize: cfg.contextSize
     });
+    const scriptContext = await model.createContext({
+      contextSize: cfg.contextSize
+    });
     const summarizer = new llamaMod.LlamaChatSession({
       contextSequence: summariserContext.getSequence(),
       systemPrompt: SUMMARISER_SYSTEM_PROMPT
@@ -45932,7 +46109,11 @@ async function loadOnce(cfg) {
       contextSequence: entitlerContext.getSequence(),
       systemPrompt: TITLER_SYSTEM_PROMPT
     });
-    loaded = { summarizer, cognizer, entitler };
+    const scriptSummarizer2 = new llamaMod.LlamaChatSession({
+      contextSequence: scriptContext.getSequence(),
+      systemPrompt: SCRIPT_SUMMARY_SYSTEM_PROMPT
+    });
+    loaded = { summarizer, cognizer, entitler, scriptSummarizer: scriptSummarizer2 };
     return loaded;
   })();
   try {
@@ -46022,12 +46203,42 @@ function llamaEntitle(cfg = defaultLlamaConfig()) {
     }
   };
 }
+function llamaScriptSummarize(cfg = defaultLlamaConfig()) {
+  return async ({ ref, content }) => {
+    if (!content || content.trim().length === 0) return null;
+    let loadedSessions;
+    try {
+      loadedSessions = await loadOnce(cfg);
+    } catch {
+      return null;
+    }
+    const { scriptSummarizer: scriptSummarizer2 } = loadedSessions;
+    const run = inflight.then(async () => {
+      scriptSummarizer2.resetChatHistory();
+      const raw = await scriptSummarizer2.prompt(buildScriptSummaryUserPrompt({ ref, content }), {
+        temperature: SCRIPT_SUMMARY_TEMPERATURE,
+        // Qwen3.5 reasons before answering — give it room on top of the
+        // one-sentence answer budget; the slice below enforces the cap.
+        maxTokens: SCRIPT_SUMMARY_MAX_TOKENS + 400
+      });
+      const oneLine = stripThinking(raw ?? "").replace(/\s+/g, " ").trim();
+      return oneLine ? oneLine.slice(0, SCRIPT_SUMMARY_OUTPUT_MAX_CHARS) : null;
+    });
+    inflight = run.catch(() => void 0);
+    try {
+      return await run;
+    } catch {
+      return null;
+    }
+  };
+}
 var DEFAULT_LLAMA_MODEL_URL, LLAMA_MAX_TOKENS, loaded, loadPromise, inflight;
 var init_llama = __esm({
   "../../packages/companion-core/src/node/llama.ts"() {
     "use strict";
-    init_prompts();
     init_cognition();
+    init_prompts();
+    init_script_summary();
     init_title();
     DEFAULT_LLAMA_MODEL_URL = "https://huggingface.co/lmstudio-community/Qwen3.5-4B-GGUF/resolve/main/Qwen3.5-4B-Q4_K_M.gguf";
     LLAMA_MAX_TOKENS = 1024;
@@ -46135,6 +46346,7 @@ __export(node_exports, {
   ensureLlamaModel: () => ensureLlamaModel,
   llamaCognize: () => llamaCognize,
   llamaEntitle: () => llamaEntitle,
+  llamaScriptSummarize: () => llamaScriptSummarize,
   llamaSummarize: () => llamaSummarize,
   ollamaCognize: () => ollamaCognize,
   ollamaEmbed: () => ollamaEmbed,
@@ -46264,22 +46476,92 @@ var init_privacy_filter = __esm({
   }
 });
 
+// src/enrich-scripts.ts
+function defaultRoots(cwd) {
+  if (!cwd) return [];
+  const seg = cwd.replace(/\/+$/, "").split("/");
+  const ancestors = [];
+  for (let i = seg.length; i >= Math.max(1, seg.length - 3); i--) {
+    ancestors.push(seg.slice(0, i).join("/") || "/");
+  }
+  const subdirs = ["scripts", "bin", "tools", "ci", ".github/scripts"];
+  const roots = [...ancestors];
+  for (const a of ancestors) for (const s of subdirs) roots.push(`${a}/${s}`);
+  return roots;
+}
+async function enrichToolCallScripts(drafts, contexts, deps) {
+  if (contexts.length === 0) return;
+  const ctxById = new Map(contexts.map((c) => [c.external_call_id, c]));
+  for (const draft of drafts) {
+    if (!draft.action) continue;
+    const ctx = ctxById.get(draft.external_call_id);
+    if (!ctx) continue;
+    try {
+      await enrichOneAction(draft.action, ctx, deps);
+    } catch {
+    }
+  }
+}
+async function enrichOneAction(action, ctx, deps) {
+  const redactedCommand = action.command_redacted;
+  if (!redactedCommand) return;
+  const refs = detectScriptRefs(ctx.command);
+  if (refs.length === 0) return;
+  const roots = (deps.roots ?? defaultRoots)(ctx.cwd);
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const ref of refs) {
+    if (out.length >= MAX_SCRIPTS_PER_CALL) break;
+    const token = redact(ref, ctx.cwd ?? void 0).text.trim();
+    if (!token || token.startsWith("[REDACTED") || seen.has(token)) continue;
+    if (!redactedCommand.includes(token)) continue;
+    const path5 = resolveScriptPath(ref, roots, deps.exists);
+    if (!path5) continue;
+    let content;
+    try {
+      content = await deps.readFile(path5);
+    } catch {
+      continue;
+    }
+    if (!content.trim()) continue;
+    const summaryRaw = await deps.summarize({ ref, content });
+    if (!summaryRaw) continue;
+    const summary = redact(summaryRaw).text.trim().slice(0, MAX_SUMMARY_CHARS);
+    if (!summary) continue;
+    seen.add(token);
+    out.push({ token, summary });
+  }
+  if (out.length > 0) action.scripts = out;
+}
+var MAX_SCRIPTS_PER_CALL, MAX_SUMMARY_CHARS;
+var init_enrich_scripts = __esm({
+  "src/enrich-scripts.ts"() {
+    "use strict";
+    init_src();
+    init_src2();
+    MAX_SCRIPTS_PER_CALL = 8;
+    MAX_SUMMARY_CHARS = 200;
+  }
+});
+
 // src/pipeline.ts
 var pipeline_exports = {};
 __export(pipeline_exports, {
   buildSegments: () => buildSegments,
   buildSessionTitles: () => buildSessionTitles2,
+  enrichScripts: () => enrichScripts,
   preflightSummariser: () => preflightSummariser
 });
+import { existsSync as existsSync8 } from "fs";
+import { readFile as fsReadFile } from "fs/promises";
 async function bundledAdapters() {
   const llamaCfg = defaultLlamaConfig();
   return {
-    // transformers.js BGE-small embedder — the same model the server
-    // uses, so segment vectors land in the same 384-dim space as
-    // leaf-description vectors and cosine similarity is directly
-    // meaningful. (This path used to ship vector-less with empty
-    // arrays; hooking embeddings here gives proper segment-vs-leaf
-    // matching at classify time.)
+    // transformers.js BGE-small embedder — the wire embedding is
+    // 384-dim (BGE-small), so segment vectors are directly comparable
+    // across runtimes via cosine similarity. (This path used to ship
+    // vector-less with empty arrays; hooking embeddings here attaches a
+    // real abstract embedding to each segment.)
     embed: createTransformersJsEmbedder(),
     summarize: llamaSummarize(llamaCfg),
     tokenize: (text) => Math.max(1, Math.ceil(text.length / 4)),
@@ -46309,9 +46591,7 @@ async function getAdapters() {
       `modelstat agent can't start: the bundled summariser (node-llama-cpp) failed to load. Re-run \`modelstat connect\` (or \`npm i -g modelstat\`) so the native runtime is re-staged beside the bundle. Underlying error: ${err.message}`
     );
   }
-  console.log(
-    "[modelstat] using bundled local summariser (Qwen3.5-4B, runs on this machine)"
-  );
+  console.log("[modelstat] using bundled local summariser (Qwen3.5-4B, runs on this machine)");
   adapters = await bundledAdapters();
   return adapters;
 }
@@ -46322,6 +46602,19 @@ async function buildSessionTitles2(segments) {
   const a = await getAdapters();
   return buildSessionTitles(segments, a.entitle);
 }
+async function enrichScripts(drafts, contexts = []) {
+  if (contexts.length === 0 || drafts.length === 0) return;
+  await getAdapters();
+  if (!scriptSummarizer) scriptSummarizer = llamaScriptSummarize(defaultLlamaConfig());
+  await enrichToolCallScripts(drafts, contexts, {
+    summarize: scriptSummarizer,
+    exists: existsSync8,
+    readFile: async (path5) => {
+      const buf = await fsReadFile(path5);
+      return buf.subarray(0, MAX_SCRIPT_READ_BYTES).toString("utf8");
+    }
+  });
+}
 async function preflightSummariser() {
   const a = await getAdapters();
   const out = await a.summarize({
@@ -46335,14 +46628,17 @@ async function preflightSummariser() {
   }
   return out.length > 60 ? `${out.slice(0, 57)}\u2026` : out;
 }
-var adapters;
+var adapters, MAX_SCRIPT_READ_BYTES, scriptSummarizer;
 var init_pipeline2 = __esm({
   "src/pipeline.ts"() {
     "use strict";
-    init_pipeline();
     init_node2();
+    init_pipeline();
     init_privacy_filter();
+    init_enrich_scripts();
     adapters = null;
+    MAX_SCRIPT_READ_BYTES = 64 * 1024;
+    scriptSummarizer = null;
   }
 });
 
@@ -46372,7 +46668,7 @@ async function scanAll(cb = {}) {
           path: full,
           parse: async (sink2) => {
             const r = await parseClaudeCodeJsonl({ deviceId, sourceFile: full, onEvents: sink2 });
-            return { toolCalls: r.toolCalls ?? [] };
+            return { toolCalls: r.toolCalls ?? [], scriptContexts: r.scriptContexts ?? [] };
           }
         });
       }
@@ -46396,7 +46692,7 @@ async function scanAll(cb = {}) {
               path: full,
               parse: async (sink2) => {
                 const r = await parseCodexRollout({ deviceId, sourceFile: full, onEvents: sink2 });
-                return { toolCalls: r.toolCalls ?? [] };
+                return { toolCalls: r.toolCalls ?? [], scriptContexts: r.scriptContexts ?? [] };
               }
             });
           }
@@ -46489,6 +46785,14 @@ async function scanAll(cb = {}) {
     filesScanned += 1;
     try {
       const r = await job.parse(sink);
+      try {
+        await enrichScripts(r.toolCalls, r.scriptContexts ?? []);
+      } catch (e) {
+        console.warn(
+          `  ! script-summary enrichment skipped for ${job.path}:`,
+          e.message
+        );
+      }
       await bufferToolCalls(r.toolCalls);
       if (cs) pendingCursors.push({ path: job.path, cs });
     } catch (e) {
@@ -46503,13 +46807,14 @@ var init_scan = __esm({
   "src/scan.ts"() {
     "use strict";
     init_src3();
+    init_config();
     init_queue();
     init_src2();
     init_api();
     init_config2();
     init_pipeline2();
-    AGENT_VERSION = true ? "agent-0.0.50" : "agent-dev";
-    BATCH_MAX_EVENTS = 2e3;
+    AGENT_VERSION = true ? "agent-0.0.52" : "agent-dev";
+    BATCH_MAX_EVENTS = INGEST_BATCH_MAX_EVENTS;
     BATCH_MAX_TOOL_CALLS = 2e4;
     BATCH_BUFFER_HARD_CAP = BATCH_MAX_EVENTS * 2;
     ZERO_TOKENS = {
@@ -46525,7 +46830,7 @@ var init_scan = __esm({
 // src/lock.ts
 import {
   closeSync,
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   mkdirSync as mkdirSync4,
   openSync,
   readFileSync as readFileSync5,
@@ -46725,6 +47030,250 @@ var init_processing_version = __esm({
   }
 });
 
+// ../../packages/remote-config/src/loader.ts
+function getFetch(env2) {
+  return env2.fetch ?? fetch;
+}
+async function fetchConfig(kind, env2) {
+  const url = `${env2.apiUrl.replace(/\/+$/, "")}/v1/config/${encodeURIComponent(kind.kind)}`;
+  let body;
+  try {
+    const res = await getFetch(env2)(url);
+    if (!res.ok) throw new Error(`status ${res.status}`);
+    body = await res.json();
+  } catch (e) {
+    env2.logger?.warn?.(`[remote-config] ${kind.kind} fetch failed`, e);
+    return null;
+  }
+  const parsed = kind.schema.safeParse(body);
+  if (!parsed.success) {
+    env2.logger?.warn?.(`[remote-config] ${kind.kind} payload schema invalid`);
+    return null;
+  }
+  return { value: parsed.data, version: parsed.data.version };
+}
+async function readCachedConfig(kind, env2) {
+  if (!env2.cache) return null;
+  let raw;
+  try {
+    raw = await env2.cache.read(kind.kind);
+  } catch (e) {
+    env2.logger?.warn?.(`[remote-config] ${kind.kind} cache read failed`, e);
+    return null;
+  }
+  if (raw == null) return null;
+  const parsed = kind.schema.safeParse(raw);
+  if (!parsed.success) {
+    env2.logger?.warn?.(`[remote-config] ${kind.kind} disk cache rejected`);
+    return null;
+  }
+  return { value: parsed.data, version: parsed.data.version };
+}
+async function writeCache(kind, env2, value) {
+  if (!env2.cache) return;
+  try {
+    await env2.cache.write(kind.kind, value);
+  } catch (e) {
+    env2.logger?.warn?.(`[remote-config] ${kind.kind} cache write failed`, e);
+  }
+}
+function result(kind, value, version, source) {
+  return { kind, value, version, source };
+}
+var RemoteConfigStore;
+var init_loader = __esm({
+  "../../packages/remote-config/src/loader.ts"() {
+    "use strict";
+    RemoteConfigStore = class {
+      env;
+      kinds;
+      state = /* @__PURE__ */ new Map();
+      constructor(env2, kinds) {
+        this.env = env2;
+        this.kinds = new Map(kinds.map((k) => [k.kind, k]));
+        for (const k of kinds) {
+          this.state.set(k.kind, {
+            value: k.bundledFallback,
+            version: k.bundledFallback.version,
+            source: "bundled"
+          });
+        }
+      }
+      /** Seed from the disk cache without touching the network — the instant,
+       * offline-safe startup path. Call once, then `refreshAll` in the
+       * background. Anything not on disk (or rejected) stays on its fallback. */
+      async initFromCache() {
+        await Promise.all(
+          [...this.kinds.values()].map(async (k) => {
+            const cached2 = await readCachedConfig(k, this.env);
+            const current = this.state.get(k.kind);
+            if (cached2 && (!current || cached2.version >= current.version)) {
+              this.state.set(k.kind, { value: cached2.value, version: cached2.version, source: "disk" });
+            }
+          })
+        );
+      }
+      /** Fetch one kind, swapping it in only if strictly newer. Never throws
+       * and never downgrades the held value on failure. */
+      async refresh(kindName) {
+        const kind = this.kinds.get(kindName);
+        if (!kind) throw new Error(`unknown config kind: ${kindName}`);
+        const current = this.state.get(kindName);
+        const currentVersion = current?.version ?? kind.bundledFallback.version;
+        const fetched = await fetchConfig(kind, this.env);
+        if (!fetched) return;
+        if (fetched.version <= currentVersion) return;
+        await writeCache(kind, this.env, fetched.value);
+        this.state.set(kindName, { value: fetched.value, version: fetched.version, source: "remote" });
+      }
+      async refreshAll() {
+        await Promise.all([...this.kinds.keys()].map((k) => this.refresh(k)));
+      }
+      /** The current best value for a kind. Total — falls back to bundled. */
+      get(kindName) {
+        const entry = this.state.get(kindName);
+        if (!entry) throw new Error(`unknown config kind: ${kindName}`);
+        return entry.value;
+      }
+      /** Like `get`, but also reports the version + provenance. */
+      getResult(kindName) {
+        const entry = this.state.get(kindName);
+        if (!entry) throw new Error(`unknown config kind: ${kindName}`);
+        return result(kindName, entry.value, entry.version, entry.source);
+      }
+    };
+  }
+});
+
+// ../../packages/remote-config/src/schema.ts
+var VersionedConfig;
+var init_schema = __esm({
+  "../../packages/remote-config/src/schema.ts"() {
+    "use strict";
+    init_zod();
+    VersionedConfig = external_exports.object({
+      version: external_exports.number().int().nonnegative()
+    });
+  }
+});
+
+// ../../packages/remote-config/src/types.ts
+var init_types3 = __esm({
+  "../../packages/remote-config/src/types.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/remote-config/src/index.ts
+var init_src4 = __esm({
+  "../../packages/remote-config/src/index.ts"() {
+    "use strict";
+    init_loader();
+    init_schema();
+    init_types3();
+  }
+});
+
+// ../../packages/remote-config/src/node.ts
+import { chmod, mkdir as mkdir2, readFile, rename, writeFile } from "fs/promises";
+import { homedir as homedir10 } from "os";
+import { join as join10 } from "path";
+function defaultRoot() {
+  return join10(homedir10(), ".modelstat", "config");
+}
+function safeKind(kind) {
+  if (!/^[a-z0-9_-]{1,64}$/.test(kind)) throw new Error(`unsafe config kind: ${kind}`);
+  return kind;
+}
+function createNodeDiskCache(opts = {}) {
+  const dir = opts.dir ?? defaultRoot();
+  async function writeAtomic2(path5, data) {
+    const tmp = `${path5}.${process.pid}.tmp`;
+    await writeFile(tmp, data, { mode: 384 });
+    await rename(tmp, path5);
+    try {
+      await chmod(path5, 384);
+    } catch {
+    }
+  }
+  return {
+    async read(kind) {
+      const k = safeKind(kind);
+      try {
+        const raw = await readFile(join10(dir, `${k}.json`), "utf8");
+        return JSON.parse(raw);
+      } catch {
+        return null;
+      }
+    },
+    async write(kind, payload) {
+      const k = safeKind(kind);
+      await mkdir2(dir, { recursive: true, mode: 448 });
+      await writeAtomic2(join10(dir, `${k}.json`), `${JSON.stringify(payload)}
+`);
+    }
+  };
+}
+var init_node3 = __esm({
+  "../../packages/remote-config/src/node.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/companion-core/src/policies/index.ts
+var policies_exports = {};
+__export(policies_exports, {
+  createPolicyRefresher: () => createPolicyRefresher
+});
+function createPolicyRefresher(opts) {
+  const env2 = {
+    apiUrl: opts.apiUrl,
+    cache: createNodeDiskCache(opts.cacheDir ? { dir: opts.cacheDir } : {}),
+    ...opts.fetch ? { fetch: opts.fetch } : {},
+    ...opts.logger ? { logger: opts.logger } : {}
+  };
+  const store2 = new RemoteConfigStore(env2, [policiesKind]);
+  let timer = null;
+  const apply = () => {
+    const bundle = store2.get("policies");
+    setRemoteRedactionPatterns(compilePolicyPatterns(bundle));
+  };
+  const refresh = async () => {
+    await store2.refresh("policies");
+    apply();
+  };
+  return {
+    async start() {
+      await store2.initFromCache();
+      apply();
+      void refresh().catch(() => {
+      });
+      timer = setInterval(
+        () => void refresh().catch(() => {
+        }),
+        opts.intervalMs ?? DEFAULT_REFRESH_MS
+      );
+      timer.unref?.();
+    },
+    refresh,
+    stop() {
+      if (timer) clearInterval(timer);
+      timer = null;
+    }
+  };
+}
+var DEFAULT_REFRESH_MS, policiesKind;
+var init_policies2 = __esm({
+  "../../packages/companion-core/src/policies/index.ts"() {
+    "use strict";
+    init_src();
+    init_src4();
+    init_node3();
+    DEFAULT_REFRESH_MS = 15 * 60 * 1e3;
+    policiesKind = POLICIES_CONFIG_KIND;
+  }
+});
+
 // ../../node_modules/.pnpm/readdirp@4.1.2/node_modules/readdirp/esm/index.js
 import { stat as stat3, lstat, readdir as readdir2, realpath } from "fs/promises";
 import { Readable as Readable2 } from "stream";
@@ -46892,10 +47441,10 @@ var init_esm = __esm({
       }
       async _formatEntry(dirent, path5) {
         let entry;
-        const basename4 = this._isDirent ? dirent.name : dirent;
+        const basename5 = this._isDirent ? dirent.name : dirent;
         try {
-          const fullPath = presolve(pjoin(path5, basename4));
-          entry = { path: prelative(this._root, fullPath), fullPath, basename: basename4 };
+          const fullPath = presolve(pjoin(path5, basename5));
+          entry = { path: prelative(this._root, fullPath), fullPath, basename: basename5 };
           entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
         } catch (err) {
           this._onError(err);
@@ -47424,9 +47973,9 @@ var init_handler = __esm({
       _watchWithNodeFs(path5, listener) {
         const opts = this.fsw.options;
         const directory = sysPath.dirname(path5);
-        const basename4 = sysPath.basename(path5);
+        const basename5 = sysPath.basename(path5);
         const parent = this.fsw._getWatchedDir(directory);
-        parent.add(basename4);
+        parent.add(basename5);
         const absolutePath = sysPath.resolve(path5);
         const options = {
           persistent: opts.persistent
@@ -47436,7 +47985,7 @@ var init_handler = __esm({
         let closer;
         if (opts.usePolling) {
           const enableBin = opts.interval !== opts.binaryInterval;
-          options.interval = enableBin && isBinaryPath(basename4) ? opts.binaryInterval : opts.interval;
+          options.interval = enableBin && isBinaryPath(basename5) ? opts.binaryInterval : opts.interval;
           closer = setFsWatchFileListener(path5, absolutePath, options, {
             listener,
             rawEmitter: this.fsw._emitRaw
@@ -47459,10 +48008,10 @@ var init_handler = __esm({
           return;
         }
         const dirname9 = sysPath.dirname(file);
-        const basename4 = sysPath.basename(file);
+        const basename5 = sysPath.basename(file);
         const parent = this.fsw._getWatchedDir(dirname9);
         let prevStats = stats;
-        if (parent.has(basename4))
+        if (parent.has(basename5))
           return;
         const listener = async (path5, newStats) => {
           if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file, 5))
@@ -47487,9 +48036,9 @@ var init_handler = __esm({
                 prevStats = newStats2;
               }
             } catch (error) {
-              this.fsw._remove(dirname9, basename4);
+              this.fsw._remove(dirname9, basename5);
             }
-          } else if (parent.has(basename4)) {
+          } else if (parent.has(basename5)) {
             const at = newStats.atimeMs;
             const mt = newStats.mtimeMs;
             if (!at || at <= mt || mt !== prevStats.mtimeMs) {
@@ -48453,7 +49002,7 @@ __export(daemon_exports, {
   setQueue: () => setQueue,
   setStat: () => setStat
 });
-import { existsSync as existsSync10, statSync as statSync2 } from "fs";
+import { existsSync as existsSync11, statSync as statSync2 } from "fs";
 function setPhase(phase, message) {
   status.phase = phase;
   status.message = message ?? null;
@@ -48533,12 +49082,12 @@ async function sendHeartbeat() {
   writeLocalStatus(body).catch(() => void 0);
 }
 async function rotateRunawayLogs() {
-  const { homedir: homedir11 } = await import("os");
-  const { join: join13 } = await import("path");
-  const { open: open2, stat: stat6, truncate, writeFile } = await import("fs/promises");
-  const dir = join13(homedir11(), ".modelstat", "logs");
+  const { homedir: homedir12 } = await import("os");
+  const { join: join14 } = await import("path");
+  const { open: open2, stat: stat6, truncate, writeFile: writeFile2 } = await import("fs/promises");
+  const dir = join14(homedir12(), ".modelstat", "logs");
   for (const name of ["out.log", "err.log"]) {
-    const p = join13(dir, name);
+    const p = join14(dir, name);
     try {
       const st = await stat6(p);
       if (st.size <= LOG_MAX_BYTES) continue;
@@ -48547,7 +49096,7 @@ async function rotateRunawayLogs() {
       try {
         const buf = Buffer.alloc(keep);
         await fh.read(buf, 0, keep, st.size - keep);
-        await writeFile(p.replace(/\.log$/, ".old.log"), buf);
+        await writeFile2(p.replace(/\.log$/, ".old.log"), buf);
       } finally {
         await fh.close();
       }
@@ -48560,21 +49109,21 @@ async function rotateRunawayLogs() {
   }
 }
 async function writeLocalStatus(snapshot) {
-  const { homedir: homedir11 } = await import("os");
-  const { join: join13 } = await import("path");
-  const { writeFile, mkdir: mkdir2, rename } = await import("fs/promises");
+  const { homedir: homedir12 } = await import("os");
+  const { join: join14 } = await import("path");
+  const { writeFile: writeFile2, mkdir: mkdir3, rename: rename2 } = await import("fs/promises");
   if (!lastStatusPath) {
-    const dir = join13(homedir11(), ".modelstat");
+    const dir = join14(homedir12(), ".modelstat");
     try {
-      await mkdir2(dir, { recursive: true });
+      await mkdir3(dir, { recursive: true });
     } catch {
     }
-    lastStatusPath = join13(dir, "last-status.json");
+    lastStatusPath = join14(dir, "last-status.json");
   }
   const tmp = `${lastStatusPath}.tmp`;
   try {
-    await writeFile(tmp, JSON.stringify({ ...snapshot, written_at: (/* @__PURE__ */ new Date()).toISOString() }));
-    await rename(tmp, lastStatusPath);
+    await writeFile2(tmp, JSON.stringify({ ...snapshot, written_at: (/* @__PURE__ */ new Date()).toISOString() }));
+    await rename2(tmp, lastStatusPath);
   } catch {
   }
 }
@@ -48604,7 +49153,7 @@ async function runScanCycle(reason) {
     const r = await scanAll({
       onFile(path5, index, total) {
         setProgress(index + 1, total);
-        setMessage(`Scanning ${index + 1}/${total}: ${basename3(path5)}`);
+        setMessage(`Scanning ${index + 1}/${total}: ${basename4(path5)}`);
       },
       onProgress(p) {
         const sess = p.sessionTotal > 1 ? ` \xB7 session ${p.session}/${p.sessionTotal}` : "";
@@ -48638,7 +49187,7 @@ async function runScanCycle(reason) {
 function requestScan(reason) {
   return scanRunner.trigger(reason);
 }
-function basename3(p) {
+function basename4(p) {
   return p.split("/").pop() ?? p;
 }
 async function runDaemon(opts = {}) {
@@ -48694,20 +49243,26 @@ async function runDaemon(opts = {}) {
   }
   await runDiscovery();
   await requestScan("startup");
+  try {
+    const { createPolicyRefresher: createPolicyRefresher2 } = await Promise.resolve().then(() => (init_policies2(), policies_exports));
+    await createPolicyRefresher2({ apiUrl: state.apiUrl }).start();
+  } catch (err) {
+    setMessage(`policy refresh unavailable: ${err.message}`);
+  }
   const chokidar = (await Promise.resolve().then(() => (init_esm2(), esm_exports))).default;
-  const { homedir: homedir11, platform: platform6 } = await import("os");
-  const { join: join13 } = await import("path");
-  const home2 = homedir11();
+  const { homedir: homedir12, platform: platform6 } = await import("os");
+  const { join: join14 } = await import("path");
+  const home2 = homedir12();
   const dirs = [
-    join13(home2, ".claude/projects"),
-    join13(home2, ".codex/sessions"),
-    join13(home2, ".cursor/ai-tracking"),
-    join13(home2, ".gemini"),
+    join14(home2, ".claude/projects"),
+    join14(home2, ".codex/sessions"),
+    join14(home2, ".cursor/ai-tracking"),
+    join14(home2, ".gemini"),
     ...platform6() === "darwin" ? [
-      join13(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join13(home2, "Library/Application Support/Claude")
-    ] : [join13(home2, ".config/Cursor/User/workspaceStorage")]
-  ].filter((p) => existsSync10(p) && statSync2(p).isDirectory());
+      join14(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join14(home2, "Library/Application Support/Claude")
+    ] : [join14(home2, ".config/Cursor/User/workspaceStorage")]
+  ].filter((p) => existsSync11(p) && statSync2(p).isDirectory());
   setPhase("watching", `Watching ${dirs.length} directories`);
   const watcher = chokidar.watch(dirs, {
     persistent: true,
@@ -48724,9 +49279,9 @@ async function runDaemon(opts = {}) {
     }, 1e3);
   };
   watcher.on("add", (p) => {
-    if (p.endsWith(".jsonl") || p.endsWith(".db")) scheduleScan(`add ${basename3(p)}`);
+    if (p.endsWith(".jsonl") || p.endsWith(".db")) scheduleScan(`add ${basename4(p)}`);
   }).on("change", (p) => {
-    if (p.endsWith(".jsonl") || p.endsWith(".db")) scheduleScan(`change ${basename3(p)}`);
+    if (p.endsWith(".jsonl") || p.endsWith(".db")) scheduleScan(`change ${basename4(p)}`);
   }).on("error", (e) => {
     setMessage(`watcher error: ${e.message}`);
   });
@@ -48758,7 +49313,7 @@ var init_daemon = __esm({
     init_machine_key();
     init_scan();
     init_single_flight();
-    AGENT_VERSION2 = true ? "agent-0.0.50" : "agent-dev";
+    AGENT_VERSION2 = true ? "agent-0.0.52" : "agent-dev";
     HEARTBEAT_INTERVAL_MS = 1e4;
     SCAN_INTERVAL_MS = 5 * 60 * 1e3;
     DISCOVERY_INTERVAL_MS = 6e4;
@@ -48786,37 +49341,37 @@ var watch_exports = {};
 __export(watch_exports, {
   watchForever: () => watchForever
 });
-import { existsSync as existsSync11 } from "fs";
-import { homedir as homedir10, platform as platform4 } from "os";
-import { join as join12 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { homedir as homedir11, platform as platform4 } from "os";
+import { join as join13 } from "path";
 function resolveWatchDirs() {
-  const home2 = homedir10();
-  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join12(home2, ".config");
-  const xdgData = process.env.XDG_DATA_HOME ?? join12(home2, ".local/share");
+  const home2 = homedir11();
+  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join13(home2, ".config");
+  const xdgData = process.env.XDG_DATA_HOME ?? join13(home2, ".local/share");
   const candidates = [
     // universal (default HOME-rooted CLI data dirs)
-    join12(home2, ".claude/projects"),
-    join12(home2, ".codex/sessions"),
-    join12(home2, ".cursor/ai-tracking"),
-    join12(home2, ".gemini"),
-    join12(home2, ".aider"),
+    join13(home2, ".claude/projects"),
+    join13(home2, ".codex/sessions"),
+    join13(home2, ".cursor/ai-tracking"),
+    join13(home2, ".gemini"),
+    join13(home2, ".aider"),
     // XDG / Linux
-    join12(xdgConfig, "claude/projects"),
-    join12(xdgConfig, "codex/sessions"),
-    join12(xdgConfig, "Cursor/User/workspaceStorage"),
-    join12(xdgConfig, "Code/User/workspaceStorage"),
-    join12(xdgConfig, "Code - Insiders/User/workspaceStorage"),
-    join12(xdgData, "claude/projects"),
+    join13(xdgConfig, "claude/projects"),
+    join13(xdgConfig, "codex/sessions"),
+    join13(xdgConfig, "Cursor/User/workspaceStorage"),
+    join13(xdgConfig, "Code/User/workspaceStorage"),
+    join13(xdgConfig, "Code - Insiders/User/workspaceStorage"),
+    join13(xdgData, "claude/projects"),
     // macOS
     ...platform4() === "darwin" ? [
-      join12(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
-      join12(home2, "Library/Application Support/Claude"),
-      join12(home2, "Library/Application Support/Code/User/workspaceStorage"),
-      join12(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
-      join12(home2, "Library/Application Support/Zed")
+      join13(home2, "Library/Application Support/Cursor/User/workspaceStorage"),
+      join13(home2, "Library/Application Support/Claude"),
+      join13(home2, "Library/Application Support/Code/User/workspaceStorage"),
+      join13(home2, "Library/Application Support/Windsurf/User/workspaceStorage"),
+      join13(home2, "Library/Application Support/Zed")
     ] : []
   ];
-  return Array.from(new Set(candidates)).filter((p) => existsSync11(p));
+  return Array.from(new Set(candidates)).filter((p) => existsSync12(p));
 }
 async function safeScan(reason) {
   if (scanning) {
@@ -48883,15 +49438,15 @@ init_config2();
 init_identity();
 init_machine_key();
 init_scan();
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { arch as cpuArch, hostname as hostname2, platform as platform5, release } from "os";
 import { createInterface as createInterface3 } from "readline";
 
 // src/service.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawn, spawnSync as spawnSync2 } from "child_process";
 import {
   copyFileSync,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync4,
   realpathSync,
@@ -48927,7 +49482,7 @@ function installBundle() {
   mkdirSync3(logDir(), { recursive: true });
   const src = runningCliPath();
   const dest = installedCliPath();
-  if (!existsSync8(src)) {
+  if (!existsSync9(src)) {
     throw new Error(
       `Can't find the CLI bundle to install from (${src}). Are you running a local dev build?`
     );
@@ -48946,7 +49501,7 @@ function sourceLlamaVersion(sourceCli) {
     let d = dirname6(realpathSync(req.resolve("node-llama-cpp")));
     for (let i = 0; i < 10; i++) {
       const pj = join7(d, "package.json");
-      if (existsSync8(pj)) {
+      if (existsSync9(pj)) {
         const p = JSON.parse(readFileSync4(pj, "utf8"));
         if (p.name === "node-llama-cpp" && p.version) return p.version;
       }
@@ -48963,10 +49518,7 @@ function installNativeRuntime(sourceCli) {
   const dest = binDir();
   try {
     const have = JSON.parse(
-      readFileSync4(
-        join7(dest, "node_modules", "node-llama-cpp", "package.json"),
-        "utf8"
-      )
+      readFileSync4(join7(dest, "node_modules", "node-llama-cpp", "package.json"), "utf8")
     );
     if (have.version === version) return [`node-llama-cpp@${version} (cached)`];
   } catch {
@@ -49013,7 +49565,7 @@ function locateTrayExecutable() {
     "/Applications/ModelstatTray.app/Contents/MacOS/modelstat-tray"
   ];
   for (const p of candidates) {
-    if (existsSync8(p)) return p;
+    if (existsSync9(p)) return p;
   }
   return null;
 }
@@ -49085,7 +49637,7 @@ function macUninstall() {
   const target = `gui/${uid}/${SERVICE_LABEL}`;
   launchctl(["bootout", target]);
   const plist = plistPath();
-  if (existsSync8(plist)) {
+  if (existsSync9(plist)) {
     try {
       unlinkSync(plist);
     } catch {
@@ -49148,7 +49700,7 @@ function linuxInstall() {
 function linuxUninstall() {
   systemctl(["disable", "--now", `${SYSTEMD_UNIT}.service`]);
   const unit = systemdUnitPath();
-  if (existsSync8(unit)) {
+  if (existsSync9(unit)) {
     try {
       unlinkSync(unit);
     } catch {
@@ -49192,7 +49744,7 @@ function logsDir() {
 }
 function installTrayApp(sourceAppPath) {
   if (platform3() !== "darwin") return null;
-  if (!existsSync8(sourceAppPath)) return null;
+  if (!existsSync9(sourceAppPath)) return null;
   const dest = join7(home(), "Applications", "ModelstatTray.app");
   mkdirSync3(dirname6(dest), { recursive: true });
   spawnSync2("rm", ["-rf", dest]);
@@ -49202,7 +49754,7 @@ function installTrayApp(sourceAppPath) {
   }
   return { installedAt: dest };
 }
-function bundledTrayAppPath() {
+async function bundledTrayAppPath(progress) {
   if (platform3() !== "darwin") return null;
   const here2 = dirname6(fileURLToPath2(import.meta.url));
   const candidates = [
@@ -49212,24 +49764,55 @@ function bundledTrayAppPath() {
     join7(here2, "..", "..", "tray-mac", "build", "ModelstatTray.app")
   ];
   for (const c of candidates) {
-    if (existsSync8(c)) return c;
+    if (existsSync9(c)) return c;
   }
-  const sourceDirs = [
-    join7(here2, "..", "vendor", "tray-mac"),
-    join7(here2, "..", "..", "tray-mac")
-  ];
+  const sourceDirs = [join7(here2, "..", "vendor", "tray-mac"), join7(here2, "..", "..", "tray-mac")];
   for (const src of sourceDirs) {
     const build = join7(src, "build-app.sh");
-    if (!existsSync8(build)) continue;
+    if (!existsSync9(build)) continue;
     if (!hasSwift()) return null;
-    const r = spawnSync2("bash", [build], { cwd: src, encoding: "utf8" });
-    if (r.status === 0) {
+    const code = await runTrayBuild(src, build, progress);
+    if (code === 0) {
       const app = join7(src, "build", "ModelstatTray.app");
-      if (existsSync8(app)) return app;
+      if (existsSync9(app)) return app;
     }
   }
   return null;
 }
+function createLineSplitter(onLine) {
+  let buf = "";
+  return {
+    push(chunk) {
+      buf += chunk;
+      for (; ; ) {
+        const nl = buf.indexOf("\n");
+        if (nl === -1) break;
+        const line = buf.slice(0, nl).trimEnd();
+        buf = buf.slice(nl + 1);
+        if (line) onLine(line);
+      }
+    },
+    flush() {
+      const line = buf.trim();
+      buf = "";
+      if (line) onLine(line);
+    }
+  };
+}
+function runTrayBuild(cwd, buildScript, progress) {
+  return new Promise((resolve6) => {
+    const child = spawn("bash", [buildScript], { cwd });
+    const splitter = createLineSplitter((line) => progress?.onLine?.(line));
+    const pump = (chunk) => splitter.push(chunk.toString("utf8"));
+    child.stdout?.on("data", pump);
+    child.stderr?.on("data", pump);
+    child.on("error", () => resolve6(null));
+    child.on("close", (code) => {
+      splitter.flush();
+      resolve6(code);
+    });
+  });
+}
 function hasSwift() {
   const r = spawnSync2("swift", ["--version"], { encoding: "utf8" });
   return r.status === 0;
@@ -49313,7 +49896,7 @@ function tryOpenBrowser(url) {
   const cmd = p === "darwin" ? "open" : p === "win32" ? "cmd" : "xdg-open";
   const args = p === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = spawn(cmd, args, {
+    const child = spawn2(cmd, args, {
       stdio: "ignore",
       detached: true
     });
@@ -49323,7 +49906,7 @@ function tryOpenBrowser(url) {
     return false;
   }
 }
-var AGENT_VERSION3 = true ? "agent-0.0.50" : "agent-dev";
+var AGENT_VERSION3 = true ? "agent-0.0.52" : "agent-dev";
 function osFamily() {
   const p = platform5();
   if (p === "darwin") return "macos";
@@ -49418,6 +50001,54 @@ function emitEvent(opts, event, fields = {}) {
   process.stdout.write(`${JSON.stringify({ v: 1, ts: Date.now(), event, ...fields })}
 `);
 }
+function createTrayBuildUi(opts) {
+  const isTty = !opts.json && process.stdout.isTTY === true;
+  let startedAt = null;
+  let ticker = null;
+  const paintTicker = () => {
+    if (startedAt === null) return;
+    const s = Math.round((Date.now() - startedAt) / 1e3);
+    process.stdout.write(`\r  \x1B[2m\u23F3 compiling menu-bar tray from source\u2026 ${s}s\x1B[0m\x1B[K`);
+  };
+  const begin = () => {
+    if (startedAt !== null) return;
+    startedAt = Date.now();
+    emitEvent(opts, "tray_build_started", {});
+    if (!opts.json) {
+      process.stdout.write(
+        "  \x1B[2mno prebuilt tray found \u2014 compiling a small Swift app locally (first run only, ~1 min)\x1B[0m\n"
+      );
+    }
+    if (isTty) {
+      paintTicker();
+      ticker = setInterval(paintTicker, 1e3);
+      ticker.unref?.();
+    }
+  };
+  return {
+    onLine: (line) => {
+      begin();
+      emitEvent(opts, "tray_build_progress", { line });
+      if (isTty) {
+        process.stdout.write(`\r\x1B[K  \x1B[2m${line}\x1B[0m
+`);
+      } else if (!opts.json) {
+        process.stdout.write(`  ${line}
+`);
+      }
+    },
+    finish: () => {
+      if (ticker) {
+        clearInterval(ticker);
+        ticker = null;
+      }
+      if (isTty && startedAt !== null) process.stdout.write("\r\x1B[K");
+      const elapsed = startedAt === null ? null : Date.now() - startedAt;
+      if (elapsed !== null) emitEvent(opts, "tray_build_done", { elapsed_ms: elapsed });
+      return elapsed;
+    }
+  };
+}
 async function cmdConnect(opts) {
   const step = (msg) => {
     if (opts.json) return;
@@ -49477,9 +50108,10 @@ async function cmdConnect(opts) {
       }
     }
   }
+  const apiBase = state.apiUrl.replace(/\/$/, "");
   const claimCode = state.claimCode ?? "(unknown)";
-  const claimUrl = state.claimUrl ?? `https://modelstat.ai/device/${claimCode}`;
-  const agentUrl = `https://modelstat.ai/device/${claimCode}/agent`;
+  const claimUrl = state.claimUrl ?? `${apiBase}/device/${claimCode}`;
+  const agentUrl = `${apiBase}/device/${claimCode}/agent`;
   emitEvent(opts, "registered", {
     device_uuid: state.deviceUuid,
     device_id: state.deviceId,
@@ -49489,12 +50121,18 @@ async function cmdConnect(opts) {
   });
   if (platform5() === "darwin") {
     step("Installing menu-bar tray (macOS)");
+    const buildUi = createTrayBuildUi(opts);
     try {
-      const src = bundledTrayAppPath();
+      const src = await bundledTrayAppPath({ onLine: buildUi.onLine });
+      const buildMs = buildUi.finish();
       if (src) {
+        if (buildMs !== null) ok(`tray compiled from source in ${Math.round(buildMs / 1e3)}s`);
         const out = installTrayApp(src);
         if (out) {
-          emitEvent(opts, "tray_installed", { path: out.installedAt });
+          emitEvent(opts, "tray_installed", {
+            path: out.installedAt,
+            ...buildMs !== null ? { build_ms: buildMs } : {}
+          });
           ok(`tray at ${out.installedAt}`);
         }
       } else {
@@ -49502,6 +50140,7 @@ async function cmdConnect(opts) {
         warn("no bundled tray \u2014 skipping (install Xcode CLI tools and re-run to get the icon)");
       }
     } catch (e) {
+      buildUi.finish();
       emitEvent(opts, "tray_install_failed", { error: e.message });
       warn(`tray install skipped: ${e.message}`);
     }
@@ -49705,11 +50344,11 @@ function fmtTokens(v) {
 }
 async function readLocalStatus() {
   try {
-    const { homedir: homedir11 } = await import("os");
-    const { join: join13 } = await import("path");
-    const { readFile } = await import("fs/promises");
-    const p = join13(homedir11(), ".modelstat", "last-status.json");
-    const txt = await readFile(p, "utf8");
+    const { homedir: homedir12 } = await import("os");
+    const { join: join14 } = await import("path");
+    const { readFile: readFile2 } = await import("fs/promises");
+    const p = join14(homedir12(), ".modelstat", "last-status.json");
+    const txt = await readFile2(p, "utf8");
     return JSON.parse(txt);
   } catch {
     return null;