nexusmem 0.10.3 → 0.10.5

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli/index.ts
-import { Command } from "commander";
-import pc22 from "picocolors";
+import { Command, Option } from "commander";
+import pc23 from "picocolors";
 
 // src/config/workspace.ts
 import { existsSync } from "fs";
@@ -334,7 +334,7 @@ function toSpawnError(err, cwd, args) {
 }
 var BASE_ARGS = ["-c", "core.quotePath=false", "-c", "core.pager=", "--no-pager"];
 var RETRY_DELAYS_MS = [50, 150, 400];
-var realSleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var realSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 async function* gitStream(cwd, args, opts = {}) {
   const sleep = opts.sleep ?? realSleep;
   for (let attempt = 0; ; attempt += 1) {
@@ -361,9 +361,9 @@ async function* runGitOnce(cwd, args, opts) {
   child.stderr.on("data", (chunk2) => {
     if (stderr.length < 64 * 1024) stderr += chunk2;
   });
-  const exited = new Promise((resolve2, reject) => {
+  const exited = new Promise((resolve3, reject) => {
     child.once("error", (err) => reject(toSpawnError(err, cwd, fullArgs)));
-    child.once("close", (code2, signal2) => resolve2({ code: code2 ?? 0, signal: signal2 ?? null }));
+    child.once("close", (code2, signal2) => resolve3({ code: code2 ?? 0, signal: signal2 ?? null }));
   });
   exited.catch(() => {
   });
@@ -507,19 +507,145 @@ async function resolvePowerShellProfilePath(exe = "powershell") {
     return null;
   }
 }
+function resolveBashProfilePath() {
+  return join3(homedir2(), ".bashrc");
+}
+function resolveZshProfilePath() {
+  return join3(homedir2(), ".zshrc");
+}
 
-// src/hooks/powershell.ts
+// src/hooks/recorder-command.ts
+import { fileURLToPath as fileURLToPath2 } from "url";
+function defaultRecorderCommand() {
+  return { node: process.execPath, script: fileURLToPath2(new URL("../../dist/cli/recorder.js", import.meta.url)) };
+}
+function forPosixShell(path) {
+  return /^[A-Za-z]:\\/.test(path) ? path.replace(/\\/g, "/") : path;
+}
+
+// src/hooks/bash.ts
 var MARK_START = "# >>> nexusmem shell hook >>>";
 var MARK_END = "# <<< nexusmem shell hook <<<";
+function toBashLiteral(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function renderHookSnippet(logPath, recorder = defaultRecorderCommand()) {
+  return [
+    MARK_START,
+    `__nxm_log_path=${toBashLiteral(logPath)}`,
+    `__nxm_node=${toBashLiteral(forPosixShell(recorder.node))}`,
+    `__nxm_recorder=${toBashLiteral(forPosixShell(recorder.script))}`,
+    '__nxm_cmd_start=""',
+    '__nxm_last_cmd=""',
+    '__nxm_debug_trap_owned=""',
+    "",
+    "__nxm_json_escape() {",
+    "  local s=$1",
+    "  s=${s//\\\\/\\\\\\\\}",
+    '  s=${s//\\"/\\\\\\"}',
+    "  s=${s//$'\\n'/\\\\n}",
+    "  s=${s//$'\\t'/\\\\t}",
+    "  s=${s//$'\\r'/\\\\r}",
+    `  printf '%s' "$s"`,
+    "}",
+    "",
+    "# Sets $__nxm_ms rather than echoing, to avoid a subshell fork on the bash 5+ fast path.",
+    "__nxm_now_ms() {",
+    '  if [ -n "${EPOCHREALTIME:-}" ]; then',
+    "    local es=${EPOCHREALTIME/./}",
+    "    __nxm_ms=$(( es / 1000 ))",
+    "  else",
+    "    __nxm_ms=$(( $(date -u +%s) * 1000 ))",
+    "  fi",
+    "}",
+    "",
+    // A DEBUG trap fires per simple command, so a pipeline sets __nxm_cmd_start
+    // once (first stage) and precmd clears it after logging.
+    "__nxm_preexec() {",
+    '  case "$BASH_COMMAND" in __nxm_*) return ;; esac',
+    '  if [ -z "$__nxm_cmd_start" ]; then',
+    "    __nxm_now_ms; __nxm_cmd_start=$__nxm_ms",
+    "    __nxm_last_cmd=$BASH_COMMAND",
+    "  fi",
+    "}",
+    "",
+    "__nxm_precmd() {",
+    // Must be first: nothing above may run a command that would overwrite $?.
+    "  local __nxm_exit=$?",
+    '  [ -z "$__nxm_debug_trap_owned" ] && return',
+    '  [ -z "$__nxm_last_cmd" ] && return',
+    "",
+    "  local __nxm_dur=null",
+    '  if [ -n "$__nxm_cmd_start" ]; then',
+    "    __nxm_now_ms",
+    "    __nxm_dur=$(( __nxm_ms - __nxm_cmd_start ))",
+    "  fi",
+    "",
+    "  local __nxm_event",
+    `  __nxm_event=$(printf '{"ts":"%s","cwd":"%s","exitCode":%s,"durationMs":%s,"command":"%s"}' \\`,
+    '    "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" "$(__nxm_json_escape "$PWD")" "$__nxm_exit" "$__nxm_dur" \\',
+    '    "$(__nxm_json_escape "$__nxm_last_cmd")")',
+    // Only the recorder's stdin (a pipe, never a file) sees the raw command; it hashes, redacts, then appends.
+    `  ( printf '%s' "$__nxm_event" | "$__nxm_node" "$__nxm_recorder" --log "$__nxm_log_path" --shell bash-hook >/dev/null 2>&1 & )`,
+    "",
+    '  __nxm_cmd_start=""',
+    '  __nxm_last_cmd=""',
+    "}",
+    "",
+    "# Runs first in the chain (before any pre-existing PROMPT_COMMAND) so $? is still the real last-command status above.",
+    'case ";$PROMPT_COMMAND;" in',
+    '  *";__nxm_precmd;"*) ;;',
+    '  *) PROMPT_COMMAND="__nxm_precmd${PROMPT_COMMAND:+; $PROMPT_COMMAND}" ;;',
+    "esac",
+    "",
+    // Installed last, after every other statement in this block has already
+    // run once -- otherwise sourcing this file trips our own trap on our own
+    // remaining setup statements (confirmed live: the case/esac above got
+    // logged as if it were a real command, the one time this was ordered
+    // before the trap install).
+    "# Only takes over an unset DEBUG trap -- never overwrites one another tool",
+    "# (direnv, a debugger, ...) already owns. If something else already holds",
+    "# it, precmd above logs nothing rather than log with no command text.",
+    'if [ -z "$(trap -p DEBUG)" ]; then',
+    "  trap '__nxm_preexec' DEBUG",
+    "  __nxm_debug_trap_owned=1",
+    "fi",
+    MARK_END,
+    ""
+  ].join("\n");
+}
+function isHookInstalled(profileContent) {
+  return profileContent.includes(MARK_START);
+}
+function stripHookSnippet(profileContent) {
+  const startIdx = profileContent.indexOf(MARK_START);
+  const endIdx = profileContent.indexOf(MARK_END);
+  if (startIdx === -1 || endIdx === -1) return profileContent;
+  const afterBlock = profileContent.slice(endIdx + MARK_END.length).replace(/^\r?\n/, "");
+  return profileContent.slice(0, startIdx) + afterBlock;
+}
+function upsertHookSnippet(profileContent, logPath, recorder) {
+  const stripped = stripHookSnippet(profileContent).replace(/\s+$/, "");
+  const prefix = stripped.length > 0 ? `${stripped}
+
+` : "";
+  return `${prefix}${renderHookSnippet(logPath, recorder)}`;
+}
+
+// src/hooks/powershell.ts
+var MARK_START2 = "# >>> nexusmem shell hook >>>";
+var MARK_END2 = "# <<< nexusmem shell hook <<<";
 function toPowerShellLiteral(s) {
   return `'${s.replace(/'/g, "''")}'`;
 }
-function renderHookSnippet(logPath) {
+function renderHookSnippet2(logPath, recorder = defaultRecorderCommand()) {
   return [
-    MARK_START,
+    MARK_START2,
     "if (Test-Path Function:\\prompt) { $function:__ssd_original_prompt = $function:prompt }",
     "$global:__ssd_last_history_id = -1",
     `$global:__ssd_log_path = ${toPowerShellLiteral(logPath)}`,
+    `$global:__ssd_node = ${toPowerShellLiteral(recorder.node)}`,
+    `$global:__ssd_recorder = ${toPowerShellLiteral(recorder.script)}`,
     "function global:prompt {",
     // Must be first: Get-History (or anything else) below would overwrite $?.
     "  $__ssd_ok = $?",
@@ -536,47 +662,177 @@ function renderHookSnippet(logPath) {
     "        durationMs = [int](($__ssd_h.EndExecutionTime - $__ssd_h.StartExecutionTime).TotalMilliseconds)",
     "        command = $__ssd_h.CommandLine",
     "      }",
-    "      $__ssd_dir = Split-Path -Parent $global:__ssd_log_path",
-    "      if (-not (Test-Path $__ssd_dir)) { New-Item -ItemType Directory -Force -Path $__ssd_dir | Out-Null }",
-    "      Add-Content -LiteralPath $global:__ssd_log_path -Value ($__ssd_entry | ConvertTo-Json -Compress) -Encoding utf8",
+    // The raw command only ever reaches the recorder's stdin (a pipe, never a file); it hashes and redacts before writing.
+    "      $__ssd_psi = New-Object System.Diagnostics.ProcessStartInfo",
+    "      $__ssd_psi.FileName = $global:__ssd_node",
+    `      $__ssd_psi.Arguments = '"{0}" --log "{1}" --shell pwsh-hook' -f $global:__ssd_recorder, $global:__ssd_log_path`,
+    "      $__ssd_psi.UseShellExecute = $false",
+    "      $__ssd_psi.CreateNoWindow = $true",
+    "      $__ssd_psi.RedirectStandardInput = $true",
+    "      $__ssd_p = [System.Diagnostics.Process]::Start($__ssd_psi)",
+    // Bytes, not StandardInput.Write: Windows PowerShell would encode text in the console code page.
+    "      $__ssd_bytes = [System.Text.Encoding]::UTF8.GetBytes(($__ssd_entry | ConvertTo-Json -Compress))",
+    "      $__ssd_p.StandardInput.BaseStream.Write($__ssd_bytes, 0, $__ssd_bytes.Length)",
+    "      $__ssd_p.StandardInput.Close()",
+    "      $__ssd_p.Dispose()",
     "    } catch {}",
     "  }",
     "  if (Test-Path Function:\\__ssd_original_prompt) { & $function:__ssd_original_prompt }",
     `  else { "PS $($executionContext.SessionState.Path.CurrentLocation)$('>' * ($nestedPromptLevel + 1)) " }`,
     "}",
-    MARK_END,
+    MARK_END2,
     ""
   ].join("\n");
 }
-function isHookInstalled(profileContent) {
-  return profileContent.includes(MARK_START);
+function isHookInstalled2(profileContent) {
+  return profileContent.includes(MARK_START2);
 }
-function stripHookSnippet(profileContent) {
-  const startIdx = profileContent.indexOf(MARK_START);
-  const endIdx = profileContent.indexOf(MARK_END);
+function stripHookSnippet2(profileContent) {
+  const startIdx = profileContent.indexOf(MARK_START2);
+  const endIdx = profileContent.indexOf(MARK_END2);
   if (startIdx === -1 || endIdx === -1) return profileContent;
-  const afterBlock = profileContent.slice(endIdx + MARK_END.length).replace(/^\r?\n/, "");
+  const afterBlock = profileContent.slice(endIdx + MARK_END2.length).replace(/^\r?\n/, "");
   return profileContent.slice(0, startIdx) + afterBlock;
 }
-function upsertHookSnippet(profileContent, logPath) {
-  const stripped = stripHookSnippet(profileContent).replace(/\s+$/, "");
+function upsertHookSnippet2(profileContent, logPath, recorder) {
+  const stripped = stripHookSnippet2(profileContent).replace(/\s+$/, "");
+  const prefix = stripped.length > 0 ? `${stripped}
+
+` : "";
+  return `${prefix}${renderHookSnippet2(logPath, recorder)}`;
+}
+
+// src/hooks/zsh.ts
+var MARK_START3 = "# >>> nexusmem shell hook >>>";
+var MARK_END3 = "# <<< nexusmem shell hook <<<";
+function toZshLiteral(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function renderHookSnippet3(logPath, recorder = defaultRecorderCommand()) {
+  return [
+    MARK_START3,
+    `__nxm_log_path=${toZshLiteral(logPath)}`,
+    `__nxm_node=${toZshLiteral(forPosixShell(recorder.node))}`,
+    `__nxm_recorder=${toZshLiteral(forPosixShell(recorder.script))}`,
+    '__nxm_cmd_start=""',
+    '__nxm_last_cmd=""',
+    "zmodload zsh/datetime 2>/dev/null",
+    "",
+    "__nxm_json_escape() {",
+    "  local s=$1",
+    "  s=${s//\\\\/\\\\\\\\}",
+    '  s=${s//\\"/\\\\\\"}',
+    "  s=${s//$'\\n'/\\\\n}",
+    "  s=${s//$'\\t'/\\\\t}",
+    "  s=${s//$'\\r'/\\\\r}",
+    `  printf '%s' "$s"`,
+    "}",
+    "",
+    "__nxm_preexec() {",
+    "  __nxm_last_cmd=$1",
+    '  if [ -n "${EPOCHREALTIME:-}" ]; then',
+    "    __nxm_cmd_start=$(printf '%.0f' $(( EPOCHREALTIME * 1000 )))",
+    "  else",
+    "    __nxm_cmd_start=$(( $(date -u +%s) * 1000 ))",
+    "  fi",
+    "}",
+    "",
+    "__nxm_precmd() {",
+    // Must be first: nothing above may run a command that would overwrite $?.
+    "  local __nxm_exit=$?",
+    '  [ -z "$__nxm_last_cmd" ] && return',
+    "",
+    "  local __nxm_dur=null",
+    '  if [ -n "$__nxm_cmd_start" ]; then',
+    "    local __nxm_now",
+    '    if [ -n "${EPOCHREALTIME:-}" ]; then',
+    "      __nxm_now=$(printf '%.0f' $(( EPOCHREALTIME * 1000 )))",
+    "    else",
+    "      __nxm_now=$(( $(date -u +%s) * 1000 ))",
+    "    fi",
+    "    __nxm_dur=$(( __nxm_now - __nxm_cmd_start ))",
+    "  fi",
+    "",
+    "  local __nxm_event",
+    `  __nxm_event=$(printf '{"ts":"%s","cwd":"%s","exitCode":%s,"durationMs":%s,"command":"%s"}' \\`,
+    '    "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" "$(__nxm_json_escape "$PWD")" "$__nxm_exit" "$__nxm_dur" \\',
+    '    "$(__nxm_json_escape "$__nxm_last_cmd")")',
+    // Only the recorder's stdin (a pipe, never a file) sees the raw command; it hashes, redacts, then appends.
+    `  ( printf '%s' "$__nxm_event" | "$__nxm_node" "$__nxm_recorder" --log "$__nxm_log_path" --shell zsh-hook >/dev/null 2>&1 & )`,
+    "",
+    '  __nxm_cmd_start=""',
+    '  __nxm_last_cmd=""',
+    "}",
+    "",
+    // Membership check (not just append) so re-sourcing this file doesn't register twice.
+    "typeset -ga preexec_functions precmd_functions",
+    '(( ${preexec_functions[(Ie)__nxm_preexec]} )) || preexec_functions=(__nxm_preexec "${preexec_functions[@]}")',
+    '(( ${precmd_functions[(Ie)__nxm_precmd]} )) || precmd_functions=(__nxm_precmd "${precmd_functions[@]}")',
+    MARK_END3,
+    ""
+  ].join("\n");
+}
+function isHookInstalled3(profileContent) {
+  return profileContent.includes(MARK_START3);
+}
+function stripHookSnippet3(profileContent) {
+  const startIdx = profileContent.indexOf(MARK_START3);
+  const endIdx = profileContent.indexOf(MARK_END3);
+  if (startIdx === -1 || endIdx === -1) return profileContent;
+  const afterBlock = profileContent.slice(endIdx + MARK_END3.length).replace(/^\r?\n/, "");
+  return profileContent.slice(0, startIdx) + afterBlock;
+}
+function upsertHookSnippet3(profileContent, logPath, recorder) {
+  const stripped = stripHookSnippet3(profileContent).replace(/\s+$/, "");
   const prefix = stripped.length > 0 ? `${stripped}
 
 ` : "";
-  return `${prefix}${renderHookSnippet(logPath)}`;
+  return `${prefix}${renderHookSnippet3(logPath, recorder)}`;
 }
 
 // src/hooks/install.ts
+var SHELL_MODULES = {
+  pwsh: {
+    renderHookSnippet: (logPath) => renderHookSnippet2(logPath),
+    isHookInstalled: isHookInstalled2,
+    stripHookSnippet: stripHookSnippet2,
+    upsertHookSnippet: upsertHookSnippet2,
+    resolveProfilePath: async (override) => override ?? await resolvePowerShellProfilePath()
+  },
+  bash: {
+    renderHookSnippet: (logPath) => renderHookSnippet(logPath),
+    isHookInstalled,
+    stripHookSnippet,
+    upsertHookSnippet,
+    resolveProfilePath: async (override) => override ?? resolveBashProfilePath()
+  },
+  zsh: {
+    renderHookSnippet: (logPath) => renderHookSnippet3(logPath),
+    isHookInstalled: isHookInstalled3,
+    stripHookSnippet: stripHookSnippet3,
+    upsertHookSnippet: upsertHookSnippet3,
+    resolveProfilePath: async (override) => override ?? resolveZshProfilePath()
+  }
+};
+function detectShellKind() {
+  if (process.platform === "win32") return "pwsh";
+  return (process.env.SHELL ?? "").includes("zsh") ? "zsh" : "bash";
+}
 var ProfileNotFoundError = class extends Error {
-  constructor() {
-    super("Could not resolve a PowerShell profile path (tried `powershell -Command $PROFILE`). Pass --profile explicitly.");
+  constructor(shell) {
+    super(
+      shell === "pwsh" ? "Could not resolve a PowerShell profile path (tried `powershell -Command $PROFILE`). Pass --profile explicitly." : `Could not resolve a ${shell} profile path. Pass --profile explicitly.`
+    );
+    this.shell = shell;
     this.name = "ProfileNotFoundError";
   }
+  shell;
 };
-async function resolveHookTarget(profileOverride, logPathOverride) {
-  const profilePath = profileOverride ?? await resolvePowerShellProfilePath();
-  if (!profilePath) throw new ProfileNotFoundError();
-  return { profilePath, logPath: logPathOverride ?? hookLogPath() };
+async function resolveHookTarget(shellOverride, profileOverride, logPathOverride) {
+  const shell = shellOverride ?? detectShellKind();
+  const profilePath = await SHELL_MODULES[shell].resolveProfilePath(profileOverride);
+  if (!profilePath) throw new ProfileNotFoundError(shell);
+  return { shell, profilePath, logPath: logPathOverride ?? hookLogPath() };
 }
 async function readProfile(path) {
   try {
@@ -586,49 +842,58 @@ async function readProfile(path) {
   }
 }
 async function installHook(target) {
+  const mod = SHELL_MODULES[target.shell];
   const current = await readProfile(target.profilePath);
-  const alreadyInstalled = isHookInstalled(current);
-  const next = upsertHookSnippet(current, target.logPath);
+  const alreadyInstalled = mod.isHookInstalled(current);
+  const next = mod.upsertHookSnippet(current, target.logPath);
   if (next === current) return { changed: false, alreadyInstalled };
   await mkdir2(dirname(target.profilePath), { recursive: true });
   await writeFile2(target.profilePath, next, "utf8");
   return { changed: true, alreadyInstalled };
 }
 async function removeHook(target) {
+  const mod = SHELL_MODULES[target.shell];
   const current = await readProfile(target.profilePath);
-  if (!isHookInstalled(current)) return { changed: false };
-  await writeFile2(target.profilePath, stripHookSnippet(current), "utf8");
+  if (!mod.isHookInstalled(current)) return { changed: false };
+  await writeFile2(target.profilePath, mod.stripHookSnippet(current), "utf8");
   return { changed: true };
 }
 async function hookStatus(target) {
-  const current = await readProfile(target.profilePath);
-  return { installed: isHookInstalled(current) };
+  const mod = SHELL_MODULES[target.shell];
+  const current = (await readProfile(target.profilePath)).replace(/\r\n/g, "\n");
+  const installed = mod.isHookInstalled(current);
+  const expected = mod.renderHookSnippet(target.logPath).trimEnd();
+  const endMarker = expected.slice(expected.lastIndexOf("\n") + 1);
+  const start = current.indexOf(expected.slice(0, expected.indexOf("\n")));
+  const end = current.indexOf(endMarker, start);
+  const upToDate = installed && start !== -1 && end !== -1 && current.slice(start, end + endMarker.length) === expected;
+  return { installed, upToDate };
 }
 
 // src/hooks/install-git-precommit.ts
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/hooks/git-hook-snippet.ts
 var SHEBANG = "#!/bin/sh";
-function isHookInstalled2(content, markers) {
+function isHookInstalled4(content, markers) {
   return content.includes(markers.markStart);
 }
 function isForeignHook(content, markers) {
-  return content.trim().length > 0 && !isHookInstalled2(content, markers);
+  return content.trim().length > 0 && !isHookInstalled4(content, markers);
 }
-function stripHookSnippet2(content, markers) {
+function stripHookSnippet4(content, markers) {
   const startIdx = content.indexOf(markers.markStart);
   const endIdx = content.indexOf(markers.markEnd);
   if (startIdx === -1 || endIdx === -1) return content;
   const afterBlock = content.slice(endIdx + markers.markEnd.length).replace(/^\r?\n/, "");
   return content.slice(0, startIdx) + afterBlock;
 }
-function upsertHookSnippet2(content, markers, renderHookSnippet4) {
-  const stripped = stripHookSnippet2(content, markers).replace(/\s+$/, "");
+function upsertHookSnippet4(content, markers, renderHookSnippet6) {
+  const stripped = stripHookSnippet4(content, markers).replace(/\s+$/, "");
   const prefix = stripped.length > 0 ? `${stripped}
 
 ` : "";
-  return `${prefix}${renderHookSnippet4()}`;
+  return `${prefix}${renderHookSnippet6()}`;
 }
 function ensureShebang(content) {
   if (content.startsWith("#!")) return content;
@@ -638,12 +903,12 @@ ${content}` : `${SHEBANG}
 }
 
 // src/hooks/git-pre-commit.ts
-var MARK_START2 = "# >>> nexusmem precommit hook >>>";
-var MARK_END2 = "# <<< nexusmem precommit hook <<<";
-var MARKERS = { markStart: MARK_START2, markEnd: MARK_END2 };
-function renderHookSnippet2() {
+var MARK_START4 = "# >>> nexusmem precommit hook >>>";
+var MARK_END4 = "# <<< nexusmem precommit hook <<<";
+var MARKERS = { markStart: MARK_START4, markEnd: MARK_END4 };
+function renderHookSnippet4() {
   return [
-    MARK_START2,
+    MARK_START4,
     "# Runs `nexusmem precheck` before each commit -- advisory only, never",
     "# blocks a commit on its own (this hook does not pass --strict).",
     "# Installed by: nexusmem hook git install",
@@ -651,24 +916,34 @@ function renderHookSnippet2() {
     "if command -v nexusmem >/dev/null 2>&1; then",
     "  nexusmem precheck",
     "fi",
-    MARK_END2,
+    MARK_END4,
     ""
   ].join("\n");
 }
-function isHookInstalled3(content) {
-  return isHookInstalled2(content, MARKERS);
+function isHookInstalled5(content) {
+  return isHookInstalled4(content, MARKERS);
 }
 function isForeignHook2(content) {
   return isForeignHook(content, MARKERS);
 }
-function stripHookSnippet3(content) {
-  return stripHookSnippet2(content, MARKERS);
+function stripHookSnippet5(content) {
+  return stripHookSnippet4(content, MARKERS);
 }
-function upsertHookSnippet3(content) {
-  return upsertHookSnippet2(content, MARKERS, renderHookSnippet2);
+function upsertHookSnippet5(content) {
+  return upsertHookSnippet4(content, MARKERS, renderHookSnippet4);
 }
 var ensureShebang2 = ensureShebang;
 
+// src/hooks/git-hooks-dir.ts
+import { isAbsolute, join as join4, resolve as resolve2 } from "path";
+async function resolveHooksDir(repoRoot) {
+  const raw = await gitOrNull(repoRoot, ["config", "--path", "core.hooksPath"]);
+  const hooksPathConfig = raw?.trim() || null;
+  if (!hooksPathConfig) return { dir: join4(repoRoot, ".git", "hooks"), hooksPathConfig: null };
+  const dir = isAbsolute(hooksPathConfig) ? hooksPathConfig : resolve2(repoRoot, hooksPathConfig);
+  return { dir, hooksPathConfig };
+}
+
 // src/hooks/git-hook-install.ts
 import { chmod, mkdir as mkdir3, readFile as readFile3, unlink, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname2 } from "path";
@@ -724,16 +999,17 @@ var ForeignGitHookError = class extends Error {
   hookPath;
 };
 var KIND = {
-  isHookInstalled: isHookInstalled3,
+  isHookInstalled: isHookInstalled5,
   isForeignHook: isForeignHook2,
-  stripHookSnippet: stripHookSnippet3,
-  upsertHookSnippet: upsertHookSnippet3,
+  stripHookSnippet: stripHookSnippet5,
+  upsertHookSnippet: upsertHookSnippet5,
   ensureShebang: ensureShebang2,
   SHEBANG,
   createForeignError: (hookPath) => new ForeignGitHookError(hookPath)
 };
-function resolveGitHookTarget(repoRoot) {
-  return { hookPath: join4(repoRoot, ".git", "hooks", "pre-commit") };
+async function resolveGitHookTarget(repoRoot) {
+  const { dir, hooksPathConfig } = await resolveHooksDir(repoRoot);
+  return { hookPath: join5(dir, "pre-commit"), hooksPathConfig };
 }
 async function installGitHook(target, opts = {}) {
   return installGitHookGeneric(target, KIND, opts);
@@ -746,41 +1022,67 @@ async function gitHookStatus(target) {
 }
 
 // src/hooks/install-git-postcommit.ts
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/hooks/git-post-commit.ts
-var MARK_START3 = "# >>> nexusmem postcommit hook >>>";
-var MARK_END3 = "# <<< nexusmem postcommit hook <<<";
-var MARKERS2 = { markStart: MARK_START3, markEnd: MARK_END3 };
+var MARK_START5 = "# >>> nexusmem postcommit hook >>>";
+var MARK_END5 = "# <<< nexusmem postcommit hook <<<";
+var MARKERS2 = { markStart: MARK_START5, markEnd: MARK_END5 };
 var LOG_PATH = ".nexusmem/post-commit-sync.log";
 var LOG_TRUNCATE_THRESHOLD = 2e3;
-function renderHookSnippet3() {
+var STATE_PATH = ".nexusmem/post-commit-sync-state.json";
+function renderHookSnippet5() {
   return [
-    MARK_START3,
+    MARK_START5,
     "# Runs a full `nexusmem sync` (including embedding) in the background after",
     "# each commit -- detached, so this never makes `git commit` itself wait.",
     `# Output goes to ${LOG_PATH} (reset once it passes ${LOG_TRUNCATE_THRESHOLD} lines), not the terminal.`,
+    `# Last-run outcome is also written to ${STATE_PATH} (\`nexusmem status\` reads it).`,
     "# Installed by: nexusmem hook git-post install",
     "# Remove with:  nexusmem hook git-post remove",
     "if command -v nexusmem >/dev/null 2>&1; then",
     "  mkdir -p .nexusmem",
-    `  nohup sh -c '[ "$(wc -l <${LOG_PATH} 2>/dev/null || echo 0)" -gt ${LOG_TRUNCATE_THRESHOLD} ] && : >${LOG_PATH}; nexusmem sync --quiet --auto >>${LOG_PATH} 2>&1' >/dev/null 2>&1 &`,
+    "  nohup sh -c '",
+    `    [ "$(wc -l <${LOG_PATH} 2>/dev/null || echo 0)" -gt ${LOG_TRUNCATE_THRESHOLD} ] && : >${LOG_PATH}`,
+    `    nexusmem sync --quiet --auto >>${LOG_PATH} 2>&1`,
+    "    ec=$?",
+    '    ok=$([ "$ec" -eq 0 ] && echo true || echo false)',
+    // Atomic rename, not truncate-in-place like the log above: this file is
+    // wholesale-replaced each run (no concurrent-appender fd to protect), so
+    // a rename avoids a reader ever seeing a half-written, unparseable JSON file.
+    // Double-quoted, not single: this whole block is already inside the
+    // outer nohup sh -c '...' single-quoted argument below, and single
+    // quotes cannot nest -- one here would close that argument early.
+    `    printf "{\\"ts\\":\\"%s\\",\\"ok\\":%s,\\"exitCode\\":%s}\\n" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$ok" "$ec" >${STATE_PATH}.tmp && mv ${STATE_PATH}.tmp ${STATE_PATH}`,
+    "  ' >/dev/null 2>&1 &",
     "fi",
-    MARK_END3,
+    MARK_END5,
     ""
   ].join("\n");
 }
-function isHookInstalled4(content) {
-  return isHookInstalled2(content, MARKERS2);
+function parsePostCommitSyncState(raw) {
+  let obj;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof obj !== "object" || obj === null) return null;
+  const o = obj;
+  if (typeof o.ts !== "string" || typeof o.ok !== "boolean" || typeof o.exitCode !== "number") return null;
+  return { ts: o.ts, ok: o.ok, exitCode: o.exitCode };
+}
+function isHookInstalled6(content) {
+  return isHookInstalled4(content, MARKERS2);
 }
 function isForeignHook3(content) {
   return isForeignHook(content, MARKERS2);
 }
-function stripHookSnippet4(content) {
-  return stripHookSnippet2(content, MARKERS2);
+function stripHookSnippet6(content) {
+  return stripHookSnippet4(content, MARKERS2);
 }
-function upsertHookSnippet4(content) {
-  return upsertHookSnippet2(content, MARKERS2, renderHookSnippet3);
+function upsertHookSnippet6(content) {
+  return upsertHookSnippet4(content, MARKERS2, renderHookSnippet5);
 }
 var ensureShebang3 = ensureShebang;
 
@@ -796,16 +1098,17 @@ var ForeignPostCommitHookError = class extends Error {
   hookPath;
 };
 var KIND2 = {
-  isHookInstalled: isHookInstalled4,
+  isHookInstalled: isHookInstalled6,
   isForeignHook: isForeignHook3,
-  stripHookSnippet: stripHookSnippet4,
-  upsertHookSnippet: upsertHookSnippet4,
+  stripHookSnippet: stripHookSnippet6,
+  upsertHookSnippet: upsertHookSnippet6,
   ensureShebang: ensureShebang3,
   SHEBANG,
   createForeignError: (hookPath) => new ForeignPostCommitHookError(hookPath)
 };
-function resolvePostCommitHookTarget(repoRoot) {
-  return { hookPath: join5(repoRoot, ".git", "hooks", "post-commit") };
+async function resolvePostCommitHookTarget(repoRoot) {
+  const { dir, hooksPathConfig } = await resolveHooksDir(repoRoot);
+  return { hookPath: join6(dir, "post-commit"), hooksPathConfig };
 }
 async function installPostCommitGitHook(target, opts = {}) {
   return installGitHookGeneric(target, KIND2, opts);
@@ -1146,6 +1449,17 @@ var V12 = `
 ALTER TABLE nodes ADD COLUMN retrieved_count INTEGER NOT NULL DEFAULT 0;
 ALTER TABLE nodes ADD COLUMN last_retrieved_at INTEGER;
 `;
+var V13 = `
+ALTER TABLE nodes ADD COLUMN capture_mode TEXT NOT NULL DEFAULT 'unknown';
+ALTER TABLE nodes ADD COLUMN source_ts TEXT;
+
+UPDATE nodes
+SET source_ts = CASE
+  WHEN kind = 'doc_section' THEN NULL
+  WHEN kind = 'shell_command' AND json_extract(meta, '$.tsApprox') = 1 THEN NULL
+  ELSE ts
+END;
+`;
 var MIGRATIONS = [
   { version: 1, up: (db) => db.exec(V1) },
   { version: 2, up: (db) => db.exec(V2) },
@@ -1158,7 +1472,8 @@ var MIGRATIONS = [
   { version: 9, up: (db) => db.exec(V9) },
   { version: 10, up: (db) => db.exec(V10) },
   { version: 11, up: (db) => db.exec(V11) },
-  { version: 12, up: (db) => db.exec(V12) }
+  { version: 12, up: (db) => db.exec(V12) },
+  { version: 13, up: (db) => db.exec(V13) }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
 function currentSchemaVersion(db) {
@@ -1268,15 +1583,16 @@ function epochOf(ts) {
   return Number.isNaN(parsed) ? Date.now() : parsed;
 }
 function upsertNodes(db, nodes) {
-  const exists = db.prepare("SELECT body, signal, title FROM nodes WHERE id = ?");
+  const exists = db.prepare("SELECT body, signal, title, capture_mode AS captureMode, source_ts AS sourceTs FROM nodes WHERE id = ?");
+  const projectCreatedAt = db.prepare("SELECT created_at AS createdAt FROM projects WHERE id = ?");
   const dropStaleEmbedding = db.prepare("DELETE FROM nodes_vec WHERE rowid = (SELECT rowid FROM nodes WHERE id = ?)");
   const insertNode = db.prepare(
-    `INSERT INTO nodes (id, kind, project_id, ts, ts_epoch, source, title, body, signal, meta, provenance, supersedes, created_at)
-     VALUES (@id, @kind, @projectId, @ts, @tsEpoch, @source, @title, @body, @signal, @meta, @provenance, @supersedes, @now)
+    `INSERT INTO nodes (id, kind, project_id, ts, ts_epoch, source, title, body, signal, meta, provenance, supersedes, created_at, capture_mode, source_ts)
+     VALUES (@id, @kind, @projectId, @ts, @tsEpoch, @source, @title, @body, @signal, @meta, @provenance, @supersedes, @now, @captureMode, @sourceTs)
      ON CONFLICT(id) DO UPDATE SET
        ts = excluded.ts, ts_epoch = excluded.ts_epoch, source = excluded.source,
        title = excluded.title, body = excluded.body, signal = excluded.signal, meta = excluded.meta,
-       provenance = excluded.provenance`
+       provenance = excluded.provenance, capture_mode = excluded.capture_mode, source_ts = excluded.source_ts`
   );
   const clearFiles = db.prepare("DELETE FROM node_files WHERE node_id = ?");
   const insertFile = db.prepare(
@@ -1288,6 +1604,7 @@ function upsertNodes(db, nodes) {
   );
   const stats2 = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
   const denyEntriesByProject = /* @__PURE__ */ new Map();
+  const createdAtByProject = /* @__PURE__ */ new Map();
   const run = db.transaction((batch) => {
     const now = Date.now();
     for (const node of batch) {
@@ -1300,14 +1617,28 @@ function upsertNodes(db, nodes) {
         stats2.denied += 1;
         continue;
       }
+      let initializedAt = createdAtByProject.get(node.projectId);
+      if (initializedAt === void 0) {
+        initializedAt = projectCreatedAt.get(node.projectId)?.createdAt ?? null;
+        createdAtByProject.set(node.projectId, initializedAt);
+      }
+      const sourceTs = node.sourceTs === void 0 ? node.ts : node.sourceTs;
+      const sourceEpoch = sourceTs === null ? Number.NaN : Date.parse(sourceTs);
+      let captureMode = "unknown";
+      if (sourceTs !== null && !Number.isNaN(sourceEpoch)) {
+        if (node.captureMode === "backfilled") captureMode = "backfilled";
+        else if (node.captureMode === "unknown") captureMode = "unknown";
+        else if (initializedAt !== null && sourceEpoch < initializedAt) captureMode = "backfilled";
+        else if (initializedAt !== null && sourceEpoch <= now) captureMode = "observed";
+      }
       const prior = exists.get(node.id);
       if (prior) {
-        if (prior.body === node.body && prior.signal === node.signal && prior.title === node.title) {
+        if (prior.body === node.body && prior.signal === node.signal && prior.title === node.title && prior.captureMode === captureMode && prior.sourceTs === sourceTs) {
           stats2.unchanged += 1;
           continue;
         }
         stats2.updated += 1;
-        dropStaleEmbedding.run(node.id);
+        if (prior.body !== node.body || prior.title !== node.title) dropStaleEmbedding.run(node.id);
       } else {
         stats2.inserted += 1;
       }
@@ -1323,6 +1654,8 @@ function upsertNodes(db, nodes) {
         signal: node.signal,
         meta: JSON.stringify(node.meta),
         provenance: node.provenance ?? defaultProvenanceForKind(node.kind),
+        captureMode,
+        sourceTs,
         supersedes: node.supersedes ?? null,
         now
       });
@@ -1360,13 +1693,14 @@ function clearProject(db, projectId) {
 function getNodesByIds(db, ids) {
   if (ids.length === 0) return [];
   return db.prepare(
-    `SELECT id, kind, project_id AS projectId, ts, title, body, signal, provenance, trust_state AS trustState
+    `SELECT id, kind, project_id AS projectId, ts, source_ts AS sourceTs, title, body, signal, provenance,
+              capture_mode AS captureMode, trust_state AS trustState
        FROM nodes WHERE id IN (SELECT value FROM json_each(?))`
   ).all(JSON.stringify(ids));
 }
 function listRecentNodes(db, projectId, limit = 20) {
   return db.prepare(
-    `SELECT id, kind, ts, source, title, signal, provenance
+    `SELECT id, kind, ts, source_ts AS sourceTs, source, title, signal, provenance, capture_mode AS captureMode
        FROM nodes
        WHERE project_id = ?
        ORDER BY ts_epoch DESC
@@ -1645,7 +1979,8 @@ function vectorSearch(db, projectId, embedding, limit = 20, opts = {}) {
   const asOfEpoch = opts.asOfEpoch ?? null;
   const k = asOfEpoch === null ? limit : Math.max(limit * 8, 50);
   return db.prepare(
-    `SELECT n.id, n.kind, n.ts, n.title, n.body, n.signal, n.provenance, n.trust_state AS trustState, v.distance AS distance
+    `SELECT n.id, n.kind, n.ts, n.source_ts AS sourceTs, n.title, n.body, n.signal, n.provenance,
+              n.capture_mode AS captureMode, n.trust_state AS trustState, v.distance AS distance
        FROM nodes_vec v
        JOIN nodes n ON n.rowid = v.rowid
        WHERE v.embedding MATCH ? AND k = ? AND v.project_id = ?
@@ -1676,7 +2011,8 @@ function search(db, projectId, query, limit = 20, opts = {}) {
   if (!match) return [];
   const asOfEpoch = opts.asOfEpoch ?? null;
   const rows = db.prepare(
-    `SELECT n.id, n.kind, n.ts, n.title, n.body, n.signal, n.provenance, n.trust_state AS trustState,
+    `SELECT n.id, n.kind, n.ts, n.source_ts AS sourceTs, n.title, n.body, n.signal, n.provenance,
+              n.capture_mode AS captureMode, n.trust_state AS trustState,
               bm25(nodes_fts, 10.0, 1.0) AS rank
        FROM nodes_fts
        JOIN nodes n ON n.rowid = nodes_fts.rowid
@@ -2180,14 +2516,18 @@ async function runForget(opts) {
 
 // src/cli/commands/hook-git.ts
 import pc2 from "picocolors";
+function hooksPathNote(hooksPathConfig) {
+  return `  ${pc2.dim(`core.hooksPath=${hooksPathConfig}`)}`;
+}
 async function runHookGitInstall(opts) {
   const repo = await readRepoInfo(opts.cwd);
-  const target = resolveGitHookTarget(repo.root);
+  const target = await resolveGitHookTarget(repo.root);
   const result = await installGitHook(target, { force: opts.force });
   const lines = [
     result.changed ? `${pc2.green(result.alreadyInstalled ? "updated" : "installed")} git pre-commit hook` : `${pc2.dim("already up to date")}`,
     `  hook ${target.hookPath}`
   ];
+  if (target.hooksPathConfig) lines.push(hooksPathNote(target.hooksPathConfig));
   if (result.appendedToForeign) {
     lines.push(`  ${pc2.yellow("appended after an existing pre-commit hook -- review")} ${target.hookPath}`);
   }
@@ -2202,7 +2542,7 @@ async function runHookGitInstall(opts) {
 }
 async function runHookGitRemove(opts) {
   const repo = await readRepoInfo(opts.cwd);
-  const target = resolveGitHookTarget(repo.root);
+  const target = await resolveGitHookTarget(repo.root);
   const result = await removeGitHook(target);
   process.stdout.write(
     result.changed ? `${pc2.green("removed")} nexusmem's block from ${target.hookPath}
@@ -2213,20 +2553,28 @@ async function runHookGitRemove(opts) {
 }
 async function runHookGitStatus(opts) {
   const repo = await readRepoInfo(opts.cwd);
-  const target = resolveGitHookTarget(repo.root);
+  const target = await resolveGitHookTarget(repo.root);
   const result = await gitHookStatus(target);
   const statusLabel = result.installed ? pc2.green("installed") : result.foreign ? pc2.yellow("a foreign hook exists (not nexusmem) -- nexusmem hook git install --force to append") : pc2.yellow("not installed");
-  process.stdout.write([`${pc2.dim("hook  ")} ${target.hookPath}`, `${pc2.dim("status")} ${statusLabel}`, ""].join("\n"));
+  process.stdout.write(
+    [
+      `${pc2.dim("hook  ")} ${target.hookPath}`,
+      `${pc2.dim("status")} ${statusLabel}`,
+      target.hooksPathConfig ? hooksPathNote(target.hooksPathConfig) : "",
+      ""
+    ].filter((line) => line !== "").concat("").join("\n")
+  );
   return 0;
 }
 async function runHookGitPostInstall(opts) {
   const repo = await readRepoInfo(opts.cwd);
-  const target = resolvePostCommitHookTarget(repo.root);
+  const target = await resolvePostCommitHookTarget(repo.root);
   const result = await installPostCommitGitHook(target, { force: opts.force });
   const lines = [
     result.changed ? `${pc2.green(result.alreadyInstalled ? "updated" : "installed")} git post-commit hook` : `${pc2.dim("already up to date")}`,
     `  hook ${target.hookPath}`
   ];
+  if (target.hooksPathConfig) lines.push(hooksPathNote(target.hooksPathConfig));
   if (result.appendedToForeign) {
     lines.push(`  ${pc2.yellow("appended after an existing post-commit hook -- review")} ${target.hookPath}`);
   }
@@ -2242,7 +2590,7 @@ async function runHookGitPostInstall(opts) {
 }
 async function runHookGitPostRemove(opts) {
   const repo = await readRepoInfo(opts.cwd);
-  const target = resolvePostCommitHookTarget(repo.root);
+  const target = await resolvePostCommitHookTarget(repo.root);
   const result = await removePostCommitGitHook(target);
   process.stdout.write(
     result.changed ? `${pc2.green("removed")} nexusmem's block from ${target.hookPath}
@@ -2253,26 +2601,43 @@ async function runHookGitPostRemove(opts) {
 }
 async function runHookGitPostStatus(opts) {
   const repo = await readRepoInfo(opts.cwd);
-  const target = resolvePostCommitHookTarget(repo.root);
+  const target = await resolvePostCommitHookTarget(repo.root);
   const result = await postCommitGitHookStatus(target);
   const statusLabel = result.installed ? pc2.green("installed") : result.foreign ? pc2.yellow("a foreign hook exists (not nexusmem) -- nexusmem hook git-post install --force to append") : pc2.yellow("not installed");
-  process.stdout.write([`${pc2.dim("hook  ")} ${target.hookPath}`, `${pc2.dim("status")} ${statusLabel}`, ""].join("\n"));
+  process.stdout.write(
+    [
+      `${pc2.dim("hook  ")} ${target.hookPath}`,
+      `${pc2.dim("status")} ${statusLabel}`,
+      target.hooksPathConfig ? hooksPathNote(target.hooksPathConfig) : "",
+      ""
+    ].filter((line) => line !== "").concat("").join("\n")
+  );
   return 0;
 }
 
 // src/cli/commands/hook.ts
 import pc3 from "picocolors";
+function shellCaveats(shell) {
+  if (shell !== "bash") return [];
+  return [
+    `Note: on macOS, Terminal.app opens login shells, which read ~/.bash_profile, not ~/.bashrc --`,
+    `if commands aren't being logged there, source this file from your .bash_profile.`,
+    `Note: if another tool already owns this shell's DEBUG trap, commands won't be logged at all`,
+    `(rather than logged with the wrong exit code) -- check \`nexusmem hook status\` after installing.`
+  ];
+}
 async function runHookInstall(opts) {
-  const target = await resolveHookTarget(opts.profile, opts.logPath);
+  const target = await resolveHookTarget(opts.shell, opts.profile, opts.logPath);
   const result = await installHook(target);
   process.stdout.write(
     [
-      result.changed ? `${pc3.green(result.alreadyInstalled ? "updated" : "installed")} shell hook` : `${pc3.dim("already up to date")}`,
+      result.changed ? `${pc3.green(result.alreadyInstalled ? "updated" : "installed")} shell hook (${target.shell})` : `${pc3.dim("already up to date")}`,
       `  profile ${target.profilePath}`,
       `  log     ${target.logPath}`,
       "",
-      `New commands in any PowerShell session using this profile will now log their timestamp, cwd and exit code.`,
-      `Open a new PowerShell window (or run \`. $PROFILE\`) for it to take effect.`,
+      `New commands in any ${target.shell} session using this profile will now log their timestamp, cwd and exit code.`,
+      target.shell === "pwsh" ? `Open a new PowerShell window (or run \`. $PROFILE\`) for it to take effect.` : `Open a new shell (or run \`. ${target.profilePath}\`) for it to take effect.`,
+      ...shellCaveats(target.shell),
       `Run ${pc3.bold("nexusmem hook remove")} to undo this.`,
       ""
     ].join("\n")
@@ -2280,7 +2645,7 @@ async function runHookInstall(opts) {
   return 0;
 }
 async function runHookRemove(opts) {
-  const target = await resolveHookTarget(opts.profile, opts.logPath);
+  const target = await resolveHookTarget(opts.shell, opts.profile, opts.logPath);
   const result = await removeHook(target);
   process.stdout.write(
     result.changed ? `${pc3.green("removed")} shell hook from ${target.profilePath}
@@ -2290,13 +2655,14 @@ async function runHookRemove(opts) {
   return 0;
 }
 async function runHookStatus(opts) {
-  const target = await resolveHookTarget(opts.profile, opts.logPath);
+  const target = await resolveHookTarget(opts.shell, opts.profile, opts.logPath);
   const result = await hookStatus(target);
   process.stdout.write(
     [
+      `${pc3.dim("shell  ")} ${target.shell}`,
       `${pc3.dim("profile")} ${target.profilePath}`,
       `${pc3.dim("log    ")} ${target.logPath}`,
-      `${pc3.dim("status ")} ${result.installed ? pc3.green("installed") : pc3.yellow("not installed")}`,
+      `${pc3.dim("status ")} ${!result.installed ? pc3.yellow("not installed") : result.upToDate ? pc3.green("installed") : pc3.yellow("installed, OUTDATED -- run `nexusmem hook install` again (hooks before 0.10.5 write commands to disk unredacted)")}`,
       ""
     ].join("\n")
   );
@@ -2310,7 +2676,7 @@ import pc4 from "picocolors";
 // src/config/registry.ts
 import { existsSync as existsSync2 } from "fs";
 import { mkdir as mkdir4, readFile as readFile5, rename, writeFile as writeFile5 } from "fs/promises";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { z as z3 } from "zod";
 var ENTRY_SCHEMA = z3.object({
   projectId: z3.string().min(1),
@@ -2325,7 +2691,7 @@ var REGISTRY_SCHEMA = z3.object({
   projects: z3.array(ENTRY_SCHEMA).default([])
 });
 function registryPath() {
-  return join6(globalWorkspaceDir(), "projects.json");
+  return join7(globalWorkspaceDir(), "projects.json");
 }
 async function readRegistry() {
   let raw;
@@ -2419,10 +2785,10 @@ async function runInit(opts) {
       const result = await installHook(target);
       lines.push(
         "",
-        `${pc4.green(result.changed ? "installed" : "already installed")} shell hook`,
+        `${pc4.green(result.changed ? "installed" : "already installed")} shell hook (${target.shell})`,
         `  profile ${target.profilePath}`,
         `  log     ${target.logPath}`,
-        `  open a new PowerShell window (or run \`. $PROFILE\`) for it to take effect`
+        target.shell === "pwsh" ? `  open a new PowerShell window (or run \`. $PROFILE\`) for it to take effect` : `  open a new shell (or run \`. ${target.profilePath}\`) for it to take effect`
       );
     } catch (err) {
       if (err instanceof ProfileNotFoundError) {
@@ -2550,6 +2916,13 @@ function approxTokens(text) {
 // src/retrieval/pack.ts
 var DEFAULT_SUMMARY_CHARS = 320;
 var NODE_OVERHEAD_TOKENS = 8;
+function renderedLabels(provenance, captureMode, trustState, project) {
+  const labels = [`[${provenance}]`];
+  if (captureMode !== "unknown") labels.push(`[capture:${captureMode}]`);
+  if (trustState !== "candidate") labels.push(`[${trustState}]`);
+  if (project) labels.push(`[${project}]`);
+  return labels.join(" ");
+}
 var CONVERSATION_ANSWER_MARKER = "\n\nA: ";
 var MAX_PER_FAMILY = 2;
 var CHUNKED_KINDS = /* @__PURE__ */ new Set(["conversation_turn", "doc_section", "code_diff"]);
@@ -2680,7 +3053,8 @@ function packContext(ranked, tokensBudget, opts = {}) {
       continue;
     }
     const summary = summarize(hit, summaryChars, query);
-    const tokens = approxTokens(hit.title) + approxTokens(summary) + NODE_OVERHEAD_TOKENS;
+    const captureMode = hit.captureMode ?? "unknown";
+    const tokens = approxTokens(hit.title) + approxTokens(summary) + approxTokens(renderedLabels(hit.provenance, captureMode, hit.trustState, hit.project)) + NODE_OVERHEAD_TOKENS;
     if (tokensUsed + tokens > tokensBudget) {
       droppedForBudget += 1;
       continue;
@@ -2689,12 +3063,14 @@ function packContext(ranked, tokensBudget, opts = {}) {
       id: hit.id,
       kind: hit.kind,
       ts: hit.ts,
+      sourceTs: hit.sourceTs === void 0 ? hit.ts : hit.sourceTs,
       title: hit.title,
       signal: hit.signal,
       score: hit.score,
       summary,
       tokens,
       provenance: hit.provenance,
+      captureMode,
       trustState: hit.trustState,
       ...hit.project ? { project: hit.project } : {}
     });
@@ -2707,10 +3083,9 @@ function renderContextBlock(query, result) {
   if (result.nodes.length === 0) return `No remembered context matched "${query}".`;
   const lines = [`Relevant history for: ${query}`, ""];
   for (const node of result.nodes) {
-    const project = node.project ? `[${node.project}] ` : "";
-    const provenance = `[${node.provenance}] `;
-    const trust = node.trustState !== "candidate" ? `[${node.trustState}] ` : "";
-    lines.push(`- ${node.ts.slice(0, 10)} ${provenance}${trust}${project}${node.title}`);
+    const labels = renderedLabels(node.provenance, node.captureMode, node.trustState, node.project);
+    const date = node.sourceTs === null ? "date unknown" : node.sourceTs.slice(0, 10);
+    lines.push(`- ${date} ${labels} ${node.title}`);
     if (node.summary && node.summary !== node.title) {
       if (node.kind === "code_diff") {
         for (const line of node.summary.split("\n")) lines.push(`  ${line}`);
@@ -2755,13 +3130,17 @@ function correlateFailures(store, projectId, opts = {}) {
     `SELECT id, ts_epoch, json_extract(meta, '$.command') AS command, json_extract(meta, '$.cwd') AS cwd
        FROM nodes
        WHERE project_id = ? AND kind = 'shell_command'
+         AND source_ts IS NOT NULL
          AND json_extract(meta, '$.exitCode') IS NOT NULL
-         AND json_extract(meta, '$.exitCode') != 0`
+         AND json_extract(meta, '$.exitCode') != 0
+         AND json_extract(meta, '$.cwd') IS NOT NULL`
   ).all(projectId);
   const findRetry = db.prepare(
     `SELECT id FROM nodes
      WHERE project_id = ? AND kind = 'shell_command'
+       AND source_ts IS NOT NULL
        AND json_extract(meta, '$.exitCode') = 0
+       AND json_extract(meta, '$.cwd') IS NOT NULL
        AND ts_epoch > ? AND ts_epoch <= ?
        AND lower(trim(json_extract(meta, '$.command'))) = ?
        AND (json_extract(meta, '$.cwd') IS ? OR json_extract(meta, '$.cwd') = ?)
@@ -2844,10 +3223,12 @@ function mergeSearchAndVectorHits(bm25Hits, vectorHits) {
       id: hit.id,
       kind: hit.kind,
       ts: hit.ts,
+      sourceTs: hit.sourceTs === void 0 ? hit.ts : hit.sourceTs,
       title: hit.title,
       body: hit.body,
       signal: hit.signal,
       provenance: hit.provenance,
+      captureMode: hit.captureMode ?? "unknown",
       trustState: hit.trustState,
       rank: 0
     });
@@ -2943,6 +3324,8 @@ function pullLinkedResolutions(resolveStore, ranked) {
           body: resolution.body,
           signal: resolution.signal,
           provenance: resolution.provenance,
+          captureMode: resolution.captureMode ?? "unknown",
+          sourceTs: resolution.sourceTs,
           trustState: resolution.trustState,
           rank: 0,
           // no bm25/vector rank of its own -- never read again past this point
@@ -3120,6 +3503,7 @@ var OllamaEmbeddingProvider = class {
 };
 
 // src/cli/commands/sync.ts
+import { existsSync as existsSync5 } from "fs";
 import pc7 from "picocolors";
 
 // src/conversation/chunk.ts
@@ -3159,6 +3543,16 @@ function chunkAssistantText(text, maxChars) {
 }
 
 // src/conversation/redact.ts
+var MARK = "[redacted]";
+var NOT_MARK = String.raw`(?!\[redacted\])`;
+var keepPrefix = (groups) => `${groups[0]}${MARK}`;
+var SECRET_KEYWORD = String.raw`(?:(?:pass(?:word|wd|phrase)|secret|credential|api[_-]?key|(?:access|private|secret|client|signing|encryption|master)[_-]?key)s?|token)`;
+var SECRET_KEY = String.raw`(?:[A-Za-z0-9_.-]{0,100}?${SECRET_KEYWORD}|(?:-{1,2}|(?:[A-Za-z0-9]{1,40}[_.-]){1,8})pass)(?:[_.-][A-Za-z0-9]{1,40}){0,8}`;
+var TYPE_WORD = String.raw`(?:string|number|boolean|bool|int|str|null|undefined|none|nil|true|false|any|unknown|object)(?=[\s;,)|\]}>]|$)`;
+var SECRET_VALUE = String.raw`(?:"[^"\r\n]+"|'[^'\r\n]+'|\x60[^\x60\r\n]+\x60|[^\s'"\x60]+)`;
+var SAME_COMMAND = String.raw`[^\n|;&]{0,500}?`;
+var NOT_FLAG_OR_REDIRECT = String.raw`(?![-<>|&;])`;
+var AUTH_SCHEME = String.raw`(?:bearer|basic|token|digest|negotiate|ntlm)`;
 var RULES = [
   {
     name: "private-key-block",
@@ -3173,11 +3567,101 @@ var RULES = [
     pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
     highConfidence: true
   },
-  // key/token/secret/password = "value" or : value, in code, JSON, env-file or prose form.
+  // scheme://user:password@host -- the password may itself contain `@`, so the host starts after the last one.
+  {
+    name: "uri-credentials",
+    pattern: new RegExp(
+      String.raw`(\b[a-z][a-z0-9+.-]{1,30}://[^\s/?#'"@:]*:)${NOT_MARK}[^\s/?#'"]+(?=@[^\s/?#'"@]*(?:[/?#\s'"]|$))`,
+      "gi"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // A bearer token outside a header (`--oauth2-bearer x`); it must contain a digit so "bearer authentication" is left alone.
+  {
+    name: "bearer-token",
+    pattern: new RegExp(String.raw`(\bbearer[ \t]+)${NOT_MARK}(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{16,}=*`, "gi"),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Tool-anchored password arguments: `-p` means port or parents almost everywhere else. Case-sensitive (`-P` is mysql's port).
+  // mysql takes only the compact `-psecret` form; `-p secret` means "prompt, then use database secret".
+  {
+    name: "mysql-password-arg",
+    pattern: new RegExp(
+      String.raw`(\b(?:mysql|mysqldump|mysqladmin|mysqlimport|mysqlsh|mariadb|mariadb-dump)(?=[ \t])${SAME_COMMAND}[ \t]-p)${NOT_MARK}(?=\S)${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Only sshpass's own options may precede -p, so a wrapped `ssh -p 22` is never read as the password.
+  {
+    name: "sshpass-password-arg",
+    pattern: new RegExp(String.raw`(\bsshpass(?:[ \t]+-[^p\s]\S*)*[ \t]+-p[ \t]*)${NOT_MARK}(?=\S)${SECRET_VALUE}`, "g"),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  {
+    name: "mongo-password-arg",
+    pattern: new RegExp(
+      String.raw`(\bmongo(?:sh|dump|restore|export|import|stat|top|files)?(?=[ \t])${SAME_COMMAND}[ \t]-p[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  {
+    name: "redis-cli-password-arg",
+    pattern: new RegExp(
+      String.raw`(\bredis-cli(?=[ \t])${SAME_COMMAND}[ \t]-a[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  {
+    name: "curl-user-password",
+    pattern: new RegExp(
+      String.raw`(\bcurl(?=[ \t])${SAME_COMMAND}[ \t](?:-u|--user)(?:[ \t]+|=)?["']?[^\s:'"]*:)${NOT_MARK}[^\s'"]+`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Authorization: Bearer x / Basic x / token x. The scheme word is kept; it must not be mistaken for the value.
+  {
+    name: "authorization-header",
+    pattern: new RegExp(
+      String.raw`(\b(?:proxy-)?authorization["']?[ \t]*[:=][ \t]*["'\x60]?(?:${AUTH_SCHEME}[ \t]+)?)(?!${AUTH_SCHEME}[ \t])${NOT_MARK}[^\s'"\x60]+`,
+      "gi"
+    ),
+    highConfidence: false,
+    render: keepPrefix
+  },
+  // `--password secret`: a secret-named option whose value is the next argument. The flag must start a
+  // command-line word, so prose like "the `id`-token heuristic" is not read as a `-token` option.
+  {
+    name: "secret-option-arg",
+    pattern: new RegExp(
+      String.raw`(?<=^|[\s'"(])(-{1,2}${SECRET_KEY}[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "gi"
+    ),
+    highConfidence: false,
+    render: keepPrefix
+  },
+  // key/token/secret/password = "value" or : value, in code, JSON, env-file, shell or prose form.
+  // The key start is an explicit non-identifier lookbehind, not `\b`: `_` is a word character, so
+  // `\b` never fired inside DB_PASSWORD and the value leaked. Found live via `scan-shell`.
   {
     name: "key-value-secret",
-    pattern: /\b((?:api[_-]?key|secret|password|passwd|token|access[_-]?key)s?)\s*[:=]\s*['"]?[A-Za-z0-9_\-./+=]{8,}['"]?/gi,
-    highConfidence: false
+    pattern: new RegExp(
+      String.raw`(?<![A-Za-z0-9_.-])(${SECRET_KEY})["']?[ \t]*[:=](?![=>])[ \t]*(?!${TYPE_WORD})${NOT_MARK}${SECRET_VALUE}`,
+      "gi"
+    ),
+    highConfidence: false,
+    // Keep the key name so the redaction is legible ("apiKey: [redacted]").
+    render: (groups) => `${groups[0]}: ${MARK}`
   }
 ];
 function redact(text, profile = "all") {
@@ -3185,10 +3669,11 @@ function redact(text, profile = "all") {
   let out = text;
   for (const rule of RULES) {
     if (profile === "high-confidence" && !rule.highConfidence) continue;
-    out = out.replace(rule.pattern, (_match, ...rest) => {
+    out = out.replace(rule.pattern, (...args) => {
       redactedCount += 1;
-      const key = typeof rest[0] === "string" ? rest[0] : null;
-      return key ? `${key}: [redacted]` : "[redacted]";
+      const end = args.findIndex((arg, i) => i > 0 && typeof arg === "number");
+      const groups = args.slice(1, end).map((g) => typeof g === "string" ? g : "");
+      return rule.render ? rule.render(groups) : MARK;
     });
   }
   return { text: out, redactedCount };
@@ -3825,6 +4310,7 @@ function toMemoryNodes3(file, projectId, opts = {}) {
       kind: "doc_section",
       projectId,
       ts: file.ts,
+      sourceTs: null,
       source: "docs",
       title: sectionTitle(file.path, chunk2.heading, index, chunks.length),
       body: truncate(chunk2.text, maxBody),
@@ -4155,7 +4641,8 @@ function toMemoryNode3(entry, projectId, opts = {}) {
     id: makeNodeId(projectId, "shell_command", entry.naturalKey),
     kind: "shell_command",
     projectId,
-    ts: entry.ts,
+    ts: entry.ts ?? opts.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    sourceTs: entry.ts,
     source: `shell:${entry.shell}`,
     title: truncate(titleLine, MAX_TITLE_CHARS7),
     body: renderBody2(entry, redactedCommand, maxBody),
@@ -4163,17 +4650,29 @@ function toMemoryNode3(entry, projectId, opts = {}) {
     signal: scoreShellCommand(entry),
     provenance: "observed",
     meta: {
-      command: entry.command,
+      command: redactedCommand,
+      commandHash: entry.commandHash ?? sha256Hex(entry.command).slice(0, 12),
       cwd: entry.cwd,
       exitCode: entry.exitCode,
       durationMs: entry.durationMs,
       tsApprox: entry.tsApprox,
+      sourceTimestamp: entry.ts,
       shell: entry.shell
     }
   };
 }
 function collectShellHistory(entries, projectId, opts = {}) {
-  return entries.map((entry) => toMemoryNode3(entry, projectId, opts));
+  const recordedAt = opts.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const parsedBaseEpoch = Date.parse(recordedAt);
+  const baseEpoch = Number.isNaN(parsedBaseEpoch) ? Date.now() : parsedBaseEpoch;
+  return entries.map(
+    (entry, index) => toMemoryNode3(entry, projectId, {
+      ...opts,
+      // This is record-time ordering only. The source timestamp stays null,
+      // while increasing milliseconds preserve the history file's order.
+      recordedAt: new Date(baseEpoch + index).toISOString()
+    })
+  );
 }
 
 // src/conversation/claude-code-reader.ts
@@ -4184,18 +4683,18 @@ import { basename as basename2 } from "path";
 import { existsSync as existsSync3 } from "fs";
 import { readdir } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function claudeProjectSlug(repoRoot) {
   return repoRoot.replace(/[\\/:]/g, "-");
 }
 function claudeProjectTranscriptDir(repoRoot) {
-  return join7(homedir3(), ".claude", "projects", claudeProjectSlug(repoRoot));
+  return join8(homedir3(), ".claude", "projects", claudeProjectSlug(repoRoot));
 }
 async function listTranscriptFiles(repoRoot) {
   const dir = claudeProjectTranscriptDir(repoRoot);
   if (!existsSync3(dir)) return [];
   const entries = await readdir(dir, { withFileTypes: true });
-  return entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => join7(dir, e.name));
+  return entries.filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => join8(dir, e.name));
 }
 
 // src/conversation/claude-code-reader.ts
@@ -4278,7 +4777,7 @@ async function collectClaudeCodeTranscripts(repoRoot) {
 
 // src/docs/read.ts
 import { readFile as readFile7, stat } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var DEFAULT_PATHSPECS = ["*.md"];
 async function listDocFiles(repoRoot, opts = {}) {
   const pathspecs = opts.include ?? DEFAULT_PATHSPECS;
@@ -4291,7 +4790,7 @@ async function readDocFiles(repoRoot, opts = {}) {
   const unreadable = [];
   for (const relPath of paths) {
     const path = relPath.replace(/\\/g, "/");
-    const absPath = join8(repoRoot, relPath);
+    const absPath = join9(repoRoot, relPath);
     let content;
     let mtime;
     try {
@@ -4504,11 +5003,12 @@ ${full.body}`);
 
 // src/shell/detect.ts
 import { existsSync as existsSync4 } from "fs";
-import { readFile as readFile9, stat as stat2 } from "fs/promises";
+import { readFile as readFile9, stat as stat3 } from "fs/promises";
 
 // src/shell/hook-log.ts
-import { appendFile, mkdir as mkdir5, readFile as readFile8 } from "fs/promises";
+import { appendFile, mkdir as mkdir5, open, readFile as readFile8, rename as rename2, stat as stat2, unlink as unlink2, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname4 } from "path";
+var HOOK_SHELL_KINDS = /* @__PURE__ */ new Set(["pwsh-hook", "bash-hook", "zsh-hook"]);
 function parseHookLogLine(line) {
   const trimmed = line.trim();
   if (!trimmed) return null;
@@ -4521,12 +5021,15 @@ function parseHookLogLine(line) {
   if (typeof obj !== "object" || obj === null) return null;
   const o = obj;
   if (typeof o.ts !== "string" || typeof o.cwd !== "string" || typeof o.command !== "string") return null;
+  const commandHash = typeof o.commandHash === "string" && /^[0-9a-f]{12}$/.test(o.commandHash) ? o.commandHash : void 0;
   return {
+    ...commandHash ? { commandHash } : {},
     ts: o.ts,
     cwd: o.cwd,
     exitCode: typeof o.exitCode === "number" ? o.exitCode : null,
     durationMs: typeof o.durationMs === "number" ? o.durationMs : null,
-    command: o.command
+    command: o.command,
+    shell: typeof o.shell === "string" && HOOK_SHELL_KINDS.has(o.shell) ? o.shell : void 0
   };
 }
 async function readHookLog(path, fromLine) {
@@ -4534,17 +5037,101 @@ async function readHookLog(path, fromLine) {
   try {
     raw = await readFile8(path, "utf8");
   } catch {
-    return { entries: [], totalLines: fromLine };
+    return { entries: [], totalLines: fromLine, shellsSeen: /* @__PURE__ */ new Set() };
   }
   const lines = raw.split(/\r?\n/).filter((l) => l.length > 0);
-  const slice = fromLine > 0 && fromLine <= lines.length ? lines.slice(fromLine) : lines;
-  const entries = slice.map(parseHookLogLine).filter((e) => e !== null);
-  return { entries, totalLines: lines.length };
+  const allParsed = lines.map(parseHookLogLine);
+  const shellsSeen = /* @__PURE__ */ new Set();
+  for (const e of allParsed) if (e) shellsSeen.add(e.shell ?? "pwsh-hook");
+  const sliceStart = fromLine > 0 && fromLine <= lines.length ? fromLine : 0;
+  const entries = allParsed.slice(sliceStart).filter((e) => e !== null);
+  return { entries, totalLines: lines.length, shellsSeen };
+}
+function sanitizeLine(line) {
+  if (line.trim().length === 0) return { line, legacy: false };
+  let obj;
+  try {
+    obj = JSON.parse(line);
+  } catch {
+    return { line: redact(line).text, legacy: false };
+  }
+  const o = obj;
+  if (typeof o !== "object" || o === null || typeof o.command !== "string") return { line: redact(line).text, legacy: false };
+  const legacy = typeof o.commandHash !== "string";
+  const raw = o.command;
+  const { text } = redact(raw);
+  if (!legacy && text === raw) return { line, legacy };
+  const commandHash = legacy ? sha256Hex(raw).slice(0, 12) : o.commandHash;
+  return { line: JSON.stringify({ ...o, command: text, commandHash }), legacy };
+}
+function sanitizeText(raw) {
+  const parts = raw.split(/(\r?\n)/);
+  let changed = 0;
+  let legacy = 0;
+  for (let i = 0; i < parts.length; i += 2) {
+    const next = sanitizeLine(parts[i]);
+    if (next.legacy) legacy += 1;
+    if (next.line !== parts[i]) {
+      parts[i] = next.line;
+      changed += 1;
+    }
+  }
+  return { text: parts.join(""), changed, legacy };
+}
+async function readRange(path, start, end) {
+  const fh = await open(path, "r");
+  try {
+    const buf = Buffer.alloc(end - start);
+    await fh.read(buf, 0, buf.length, start);
+    return buf;
+  } finally {
+    await fh.close();
+  }
+}
+var RENAME_BUSY = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
+async function sanitizeHookLog(path, opts = {}) {
+  let raw;
+  try {
+    raw = await readFile8(path);
+  } catch {
+    return { linesChanged: 0, legacyLines: 0 };
+  }
+  const first = sanitizeText(raw.toString("utf8"));
+  if (first.changed === 0 || opts.dryRun) return { linesChanged: first.changed, legacyLines: first.legacy };
+  const tmp = `${path}.${process.pid}.scrub.tmp`;
+  let linesChanged = first.changed;
+  let legacyLines = first.legacy;
+  try {
+    await writeFile6(tmp, first.text, { encoding: "utf8", mode: 384 });
+    let consumed = raw.length;
+    for (let attempt = 0; ; attempt += 1) {
+      const size = (await stat2(path)).size;
+      if (size > consumed) {
+        const extra = sanitizeText((await readRange(path, consumed, size)).toString("utf8"));
+        await appendFile(tmp, extra.text, "utf8");
+        linesChanged += extra.changed;
+        legacyLines += extra.legacy;
+        consumed = size;
+      }
+      try {
+        await rename2(tmp, path);
+        break;
+      } catch (err) {
+        if (attempt >= 20 || !RENAME_BUSY.has(err.code ?? "")) throw err;
+        await new Promise((r) => setTimeout(r, 50));
+      }
+    }
+  } catch (err) {
+    await unlink2(tmp).catch(() => {
+    });
+    throw err;
+  }
+  return { linesChanged, legacyLines };
 }
 
 // src/shell/parse-bash.ts
 var EPOCH_COMMENT = /^#(\d{9,10})$/;
-function parseBashHistory(raw, mtimeMs, opts = {}) {
+function parseBashHistory(raw, _mtimeMs, opts = {}) {
   const lines = raw.split(/\r?\n/);
   const prelim = [];
   let pendingEpoch = null;
@@ -4561,12 +5148,11 @@ function parseBashHistory(raw, mtimeMs, opts = {}) {
   const tail = opts.tailLines ? prelim.slice(-opts.tailLines) : prelim;
   const startIndex = prelim.length - tail.length;
   return tail.map((p, i) => {
-    const fromEnd = tail.length - 1 - i;
     const approx = p.ts === null;
     return {
       naturalKey: `bash:${startIndex + i}:${sha256Hex(p.command).slice(0, 12)}`,
       command: p.command,
-      ts: p.ts ?? new Date(mtimeMs - fromEnd * 1e3).toISOString(),
+      ts: p.ts,
       tsApprox: approx,
       exitCode: null,
       cwd: null,
@@ -4577,16 +5163,15 @@ function parseBashHistory(raw, mtimeMs, opts = {}) {
 }
 
 // src/shell/parse-psreadline.ts
-function parsePsReadLineHistory(raw, mtimeMs, opts = {}) {
+function parsePsReadLineHistory(raw, _mtimeMs, opts = {}) {
   const allLines = raw.split(/\r?\n/).filter((l) => l.trim().length > 0);
   const tail = opts.tailLines ? allLines.slice(-opts.tailLines) : allLines;
   const startIndex = allLines.length - tail.length;
   return tail.map((command, i) => {
-    const fromEnd = tail.length - 1 - i;
     return {
       naturalKey: `pwsh:${startIndex + i}:${sha256Hex(command).slice(0, 12)}`,
       command,
-      ts: new Date(mtimeMs - fromEnd * 1e3).toISOString(),
+      ts: null,
       tsApprox: true,
       exitCode: null,
       cwd: null,
@@ -4598,7 +5183,7 @@ function parsePsReadLineHistory(raw, mtimeMs, opts = {}) {
 
 // src/shell/parse-zsh.ts
 var EXTENDED_PREFIX = /^: (\d+):(\d+);(.*)$/;
-function parseZshHistory(raw, mtimeMs, opts = {}) {
+function parseZshHistory(raw, _mtimeMs, opts = {}) {
   const rawLines = raw.split(/\r?\n/);
   const prelim = [];
   let i = 0;
@@ -4630,12 +5215,11 @@ ${rawLines[i]}`;
   const tail = opts.tailLines ? prelim.slice(-opts.tailLines) : prelim;
   const startIndex = prelim.length - tail.length;
   return tail.map((p, idx) => {
-    const fromEnd = tail.length - 1 - idx;
     const approx = p.ts === null;
     return {
       naturalKey: `zsh:${startIndex + idx}:${sha256Hex(p.command).slice(0, 12)}`,
       command: p.command,
-      ts: p.ts ?? new Date(mtimeMs - fromEnd * 1e3).toISOString(),
+      ts: p.ts,
       tsApprox: approx,
       exitCode: null,
       cwd: null,
@@ -4653,20 +5237,23 @@ function isUnderRoot(cwd, root) {
   return c === r || c.startsWith(`${r}/`);
 }
 function hookEntryToRaw(e) {
+  const shell = e.shell ?? "pwsh-hook";
+  const commandHash = e.commandHash ?? sha256Hex(e.command).slice(0, 12);
   return {
-    naturalKey: `pwsh-hook:${e.ts}:${sha256Hex(e.command).slice(0, 12)}`,
+    naturalKey: `${shell}:${e.ts}:${commandHash}`,
+    commandHash,
     command: e.command,
     ts: e.ts,
     tsApprox: false,
     exitCode: e.exitCode,
     cwd: e.cwd,
     durationMs: e.durationMs,
-    shell: "pwsh-hook"
+    shell
   };
 }
 async function tryReadScrapeSource(path, parse, tailLines) {
   if (!existsSync4(path)) return null;
-  const [raw, stats2] = await Promise.all([readFile9(path, "utf8"), stat2(path)]);
+  const [raw, stats2] = await Promise.all([readFile9(path, "utf8"), stat3(path)]);
   return parse(raw, stats2.mtimeMs, { tailLines });
 }
 async function collectAvailableShellHistory(opts = {}) {
@@ -4675,21 +5262,29 @@ async function collectAvailableShellHistory(opts = {}) {
   const preferHook = opts.preferHook ?? true;
   const hookPath = hookLogPath();
   const hookExists = existsSync4(hookPath);
+  let shellsSeen = /* @__PURE__ */ new Set();
   if (hookExists) {
     const fromLine = Number(opts.hookCursor ?? "0") || 0;
-    const { entries, totalLines } = await readHookLog(hookPath, fromLine);
+    const { entries, totalLines, shellsSeen: seen } = await readHookLog(hookPath, fromLine);
+    shellsSeen = seen;
     const scoped = opts.repoRoot ? entries.filter((e) => isUnderRoot(e.cwd, opts.repoRoot)) : entries;
     results.push({ name: "pwsh-hook", entries: scoped.map(hookEntryToRaw), cursorAfter: String(totalLines) });
   }
-  const skipPwshScrape = preferHook && hookExists;
+  const skipPwshScrape = preferHook && shellsSeen.has("pwsh-hook");
   if (!skipPwshScrape && process.platform === "win32") {
     const entries = await tryReadScrapeSource(psReadLineHistoryPath(), parsePsReadLineHistory, tailLines);
     if (entries) results.push({ name: "pwsh", entries });
   }
-  const bashEntries = await tryReadScrapeSource(bashHistoryPath(), parseBashHistory, tailLines);
-  if (bashEntries) results.push({ name: "bash", entries: bashEntries });
-  const zshEntries = await tryReadScrapeSource(zshHistoryPath(), parseZshHistory, tailLines);
-  if (zshEntries) results.push({ name: "zsh", entries: zshEntries });
+  const skipBashScrape = preferHook && shellsSeen.has("bash-hook");
+  if (!skipBashScrape) {
+    const bashEntries = await tryReadScrapeSource(bashHistoryPath(), parseBashHistory, tailLines);
+    if (bashEntries) results.push({ name: "bash", entries: bashEntries });
+  }
+  const skipZshScrape = preferHook && shellsSeen.has("zsh-hook");
+  if (!skipZshScrape) {
+    const zshEntries = await tryReadScrapeSource(zshHistoryPath(), parseZshHistory, tailLines);
+    if (zshEntries) results.push({ name: "zsh", entries: zshEntries });
+  }
   return results;
 }
 
@@ -4698,8 +5293,8 @@ function recomputeByNaturalKey(db, oldProjectId, newProjectId, kind, source, com
   const rows = source ? db.prepare("SELECT * FROM nodes WHERE project_id = ? AND kind = ? AND source = ?").all(oldProjectId, kind, source) : db.prepare("SELECT * FROM nodes WHERE project_id = ? AND kind = ?").all(oldProjectId, kind);
   const nodeExists = db.prepare("SELECT 1 FROM nodes WHERE id = ?");
   const insertNode = db.prepare(
-    `INSERT INTO nodes (id, kind, project_id, ts, ts_epoch, source, title, body, signal, meta, created_at)
-     VALUES (@id, @kind, @projectId, @ts, @tsEpoch, @source, @title, @body, @signal, @meta, @createdAt)`
+    `INSERT INTO nodes (id, kind, project_id, ts, ts_epoch, source, title, body, signal, meta, created_at, capture_mode, source_ts)
+     VALUES (@id, @kind, @projectId, @ts, @tsEpoch, @source, @title, @body, @signal, @meta, @createdAt, @captureMode, @sourceTs)`
   );
   const readFiles = db.prepare("SELECT path, previous_path, insertions, deletions, is_binary FROM node_files WHERE node_id = ?");
   const insertFile = db.prepare(
@@ -4746,7 +5341,9 @@ function recomputeByNaturalKey(db, oldProjectId, newProjectId, kind, source, com
         body: row.body,
         signal: row.signal,
         meta: row.meta,
-        createdAt: row.created_at
+        createdAt: row.created_at,
+        captureMode: row.capture_mode,
+        sourceTs: row.source_ts
       });
       for (const file of readFiles.all(row.id)) {
         insertFile.run({
@@ -4777,15 +5374,30 @@ function reconcileProjectId(db, oldProjectId, newProjectId) {
       (_row, meta) => typeof meta.sessionKey === "string" ? meta.sessionKey : null,
       denyEntries
     );
-    const hookShell = recomputeByNaturalKey(
-      db,
-      oldProjectId,
-      newProjectId,
-      "shell_command",
-      "shell:pwsh-hook",
-      (row, meta) => typeof meta.command === "string" ? `pwsh-hook:${row.ts}:${sha256Hex(meta.command).slice(0, 12)}` : null,
-      denyEntries
-    );
+    const HOOK_SHELL_SOURCES = [
+      { source: "shell:pwsh-hook", prefix: "pwsh-hook" },
+      { source: "shell:bash-hook", prefix: "bash-hook" },
+      { source: "shell:zsh-hook", prefix: "zsh-hook" }
+    ];
+    const hookShell = { migrated: 0, deduped: 0, skipped: 0, denied: 0 };
+    for (const { source, prefix } of HOOK_SHELL_SOURCES) {
+      const r = recomputeByNaturalKey(
+        db,
+        oldProjectId,
+        newProjectId,
+        "shell_command",
+        source,
+        (row, meta) => {
+          const hash = typeof meta.commandHash === "string" ? meta.commandHash : typeof meta.command === "string" ? sha256Hex(meta.command).slice(0, 12) : null;
+          return hash ? `${prefix}:${row.ts}:${hash}` : null;
+        },
+        denyEntries
+      );
+      hookShell.migrated += r.migrated;
+      hookShell.deduped += r.deduped;
+      hookShell.skipped += r.skipped;
+      hookShell.denied += r.denied;
+    }
     let deniedConversationTurns = 0;
     if (denyEntries.length > 0) {
       const conversationTurns = db.prepare(`SELECT id, title, body, meta FROM nodes WHERE project_id = ? AND kind = 'conversation_turn'`).all(oldProjectId);
@@ -4821,7 +5433,7 @@ function reconcileProjectId(db, oldProjectId, newProjectId) {
 
 // src/structure/collect.ts
 import { readFile as readFile10 } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // src/structure/extract.ts
 var IMPORT_PATTERNS = [
@@ -5260,7 +5872,7 @@ async function collectFileEdges(repoRoot) {
   const trackedPaths = new Set(paths);
   let goModulePath = null;
   try {
-    goModulePath = parseGoModulePath(await readFile10(join9(repoRoot, "go.mod"), "utf8"));
+    goModulePath = parseGoModulePath(await readFile10(join10(repoRoot, "go.mod"), "utf8"));
   } catch {
     goModulePath = null;
   }
@@ -5270,7 +5882,7 @@ async function collectFileEdges(repoRoot) {
   for (const path of paths) {
     let content;
     try {
-      content = await readFile10(join9(repoRoot, path), "utf8");
+      content = await readFile10(join10(repoRoot, path), "utf8");
     } catch {
       unreadable.push(path);
       continue;
@@ -5361,9 +5973,9 @@ ${node.body}`)
 
 // src/cli/sync-lock.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function lockPath(wsDir) {
-  return join10(wsDir, "sync.lock");
+  return join11(wsDir, "sync.lock");
 }
 function readOwner(path) {
   try {
@@ -5515,6 +6127,19 @@ async function syncShell(store, projectId, opts, repoRoot, config, log) {
     repoRoot,
     hookCursor: store.getSyncCursor(projectId, "shell:pwsh-hook")
   });
+  if (existsSync5(hookLogPath())) {
+    try {
+      const { linesChanged, legacyLines } = await sanitizeHookLog(hookLogPath());
+      if (linesChanged > 0) log(`  ${pc7.dim(`shell hook log: redacted ${linesChanged} line(s)`)}`);
+      if (legacyLines > 0) {
+        log(
+          `${pc7.yellow("shell")} ${legacyLines} hook-log line(s) were written by an outdated NexusMem shell hook that stores commands unredacted until a sync -- run \`nexusmem hook install\` again in each shell`
+        );
+      }
+    } catch (err) {
+      log(`${pc7.yellow("shell")} could not redact the hook log (${err.message}) -- run \`nexusmem scrub-secrets --yes\``);
+    }
+  }
   if (results.length === 0) {
     log(`${pc7.dim("shell")} no history source found on this machine`);
     return { totals, seen: 0 };
@@ -5708,10 +6333,10 @@ async function runAutoContradictionCheck(store, config, projectId, providers) {
     maxJudgments: config.contradictions.maxPerSync,
     model: config.contradictions.model
   });
-  const open = store.countContradictionSuggestions(projectId);
-  if (fresh.length === 0 && open === 0) return "";
+  const open2 = store.countContradictionSuggestions(projectId);
+  if (fresh.length === 0 && open2 === 0) return "";
   const freshPart = fresh.length > 0 ? pc7.yellow(`${fresh.length} new`) : `${fresh.length} new`;
-  return `  ${pc7.dim("contradictions:")} ${freshPart}${pc7.dim(`, ${open} open suggestion(s) -- run`)} ${pc7.bold("nexusmem stale")} ${pc7.dim("for detail")}
+  return `  ${pc7.dim("contradictions:")} ${freshPart}${pc7.dim(`, ${open2} open suggestion(s) -- run`)} ${pc7.bold("nexusmem stale")} ${pc7.dim("for detail")}
 `;
 }
 async function runSync(opts) {
@@ -6734,10 +7359,11 @@ async function runScanShell(opts) {
   return 0;
 }
 function formatNode6(node) {
-  const approx = node.meta.tsApprox ? pc18.dim("~") : " ";
+  const sourceTimestamp = typeof node.meta.sourceTimestamp === "string" ? node.meta.sourceTimestamp : null;
+  const timestamp = sourceTimestamp ? sourceTimestamp.slice(0, 16).replace("T", " ") : pc18.dim("unknown");
   const exit = node.meta.exitCode;
   const exitLabel = typeof exit === "number" && exit !== 0 ? pc18.red(`exit ${exit}`) : "";
-  return [formatSignal(node.signal, SHELL_SIGNAL_BANDS), approx + node.ts.slice(0, 16).replace("T", " "), node.title, exitLabel].filter(Boolean).join(" ");
+  return [formatSignal(node.signal, SHELL_SIGNAL_BANDS), timestamp, node.title, exitLabel].filter(Boolean).join(" ");
 }
 
 // src/cli/commands/scan-structure.ts
@@ -6768,8 +7394,286 @@ ${pc19.bold(String(edges.length))} edge(s) from ${filesScanned} tracked ${TRACKE
   return 0;
 }
 
-// src/cli/commands/stale.ts
+// src/cli/commands/scrub-secrets.ts
+import { existsSync as existsSync6 } from "fs";
+import { dirname as dirname6 } from "path";
 import pc20 from "picocolors";
+
+// src/store/scrub.ts
+import { chmod as chmod2, readdir as readdir2 } from "fs/promises";
+import { basename as basename4, dirname as dirname5, join as join12 } from "path";
+import Database2 from "better-sqlite3";
+var KIND_PROFILES = {
+  shell_command: "all",
+  conversation_turn: "all",
+  session_summary: "all",
+  code_diff: "high-confidence"
+};
+var SCRUB_KINDS = Object.keys(KIND_PROFILES);
+var ScrubRaceError = class extends Error {
+};
+function scrubMeta(kind, raw) {
+  let meta;
+  try {
+    meta = JSON.parse(raw);
+  } catch {
+    return redact(raw, KIND_PROFILES[kind]).text;
+  }
+  if (typeof meta !== "object" || meta === null) return raw;
+  const m = meta;
+  let changed = false;
+  if (kind === "shell_command" && typeof m.command === "string") {
+    const command = redact(m.command).text;
+    if (command !== m.command) {
+      if (typeof m.commandHash !== "string") m.commandHash = sha256Hex(m.command).slice(0, 12);
+      m.command = command;
+      changed = true;
+    }
+  }
+  if (kind === "conversation_turn" && typeof m.heading === "string") {
+    const heading = redact(m.heading).text;
+    if (heading !== m.heading) {
+      m.heading = heading;
+      changed = true;
+    }
+  }
+  return changed ? JSON.stringify(m) : raw;
+}
+function hasTable(db, name) {
+  return db.prepare(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`).get(name) !== void 0;
+}
+function plan(db) {
+  const byKind = Object.fromEntries(SCRUB_KINDS.map((k) => [k, { scanned: 0, changed: 0 }]));
+  const rows = [];
+  const select = db.prepare(
+    `SELECT rowid, kind, title, body, meta FROM nodes WHERE kind IN (${SCRUB_KINDS.map(() => "?").join(", ")})`
+  );
+  for (const row of select.iterate(...SCRUB_KINDS)) {
+    const profile = KIND_PROFILES[row.kind];
+    const title = redact(row.title, profile).text;
+    const body = redact(row.body, profile).text;
+    const meta = scrubMeta(row.kind, row.meta);
+    byKind[row.kind].scanned += 1;
+    if (title === row.title && body === row.body && meta === row.meta) continue;
+    byKind[row.kind].changed += 1;
+    rows.push({ rowid: row.rowid, title, body, meta, textChanged: title !== row.title || body !== row.body });
+  }
+  const reasons = [];
+  if (hasTable(db, "contradiction_checks")) {
+    const select2 = db.prepare("SELECT rowid, reason FROM contradiction_checks WHERE reason IS NOT NULL");
+    for (const r of select2.iterate()) {
+      const reason = redact(r.reason).text;
+      if (reason !== r.reason) reasons.push({ rowid: r.rowid, reason });
+    }
+  }
+  return { byKind, rows, reasons };
+}
+async function listBackups(dbPath) {
+  const prefix = `${basename4(dbPath)}.backup-`;
+  try {
+    return (await readdir2(dirname5(dbPath))).filter((name) => name.startsWith(prefix)).sort().map((name) => join12(dirname5(dbPath), name));
+  } catch {
+    return [];
+  }
+}
+function purgeRemnants(db) {
+  db.exec(`INSERT INTO nodes_fts (nodes_fts) VALUES ('rebuild')`);
+  try {
+    db.exec("VACUUM");
+  } catch (err) {
+    if (String(err.code ?? "").startsWith("SQLITE_BUSY")) return false;
+    throw err;
+  }
+  const [checkpoint] = db.pragma("wal_checkpoint(TRUNCATE)");
+  return checkpoint?.busy === 0;
+}
+async function scrubDatabase(dbPath, opts) {
+  const existingBackups = await listBackups(dbPath);
+  const base = { dbPath, existingBackups, embeddingsDropped: 0, reembedded: 0, embeddingsPending: 0 };
+  if (!opts.apply) {
+    const db2 = new Database2(dbPath, { readonly: true, fileMustExist: true });
+    try {
+      const p = plan(db2);
+      return {
+        ...base,
+        applied: false,
+        byKind: p.byKind,
+        rowsChanged: p.rows.length,
+        contradictionReasonsChanged: p.reasons.length,
+        backupPath: null,
+        remnantsPurged: null
+      };
+    } finally {
+      db2.close();
+    }
+  }
+  const store = MemoryStore.open(dbPath);
+  const db = store.raw;
+  try {
+    let backupPath = null;
+    const first = plan(db);
+    if (first.rows.length + first.reasons.length > 0) {
+      const stamp = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      backupPath = `${dbPath}.backup-${stamp}-pre-scrub-secrets`;
+      await db.backup(backupPath);
+      await chmod2(backupPath, 384).catch(() => {
+      });
+    }
+    const updateNode = db.prepare("UPDATE nodes SET title = ?, body = ?, meta = ? WHERE rowid = ?");
+    const dropVector = db.prepare("DELETE FROM nodes_vec WHERE rowid = ?");
+    const updateReason = db.prepare("UPDATE contradiction_checks SET reason = ? WHERE rowid = ?");
+    const { applied, dropped } = db.transaction(() => {
+      const p = plan(db);
+      if (!backupPath && p.rows.length + p.reasons.length > 0) {
+        throw new ScrubRaceError("the database changed while it was being scrubbed -- nothing was modified; re-run");
+      }
+      let dropped2 = 0;
+      for (const c of p.rows) {
+        updateNode.run(c.title, c.body, c.meta, c.rowid);
+        if (c.textChanged) dropped2 += dropVector.run(BigInt(c.rowid)).changes;
+      }
+      for (const r of p.reasons) updateReason.run(r.reason, r.rowid);
+      return { applied: p, dropped: dropped2 };
+    })();
+    let reembedded = 0;
+    let pending = dropped;
+    if (opts.embeddingProvider && dropped > 0) {
+      const changedRowids = applied.rows.filter((c) => c.textChanged).map((c) => c.rowid);
+      const projects = db.prepare(`SELECT DISTINCT project_id AS p FROM nodes WHERE rowid IN (${changedRowids.map(() => "?").join(", ")})`).all(...changedRowids);
+      pending = 0;
+      for (const { p } of projects) {
+        const r = await embedPendingNodes(store, opts.embeddingProvider, p);
+        reembedded += r.embedded;
+        pending += r.remaining;
+      }
+    }
+    const remnantsPurged = purgeRemnants(db);
+    return {
+      ...base,
+      applied: true,
+      byKind: applied.byKind,
+      rowsChanged: applied.rows.length,
+      contradictionReasonsChanged: applied.reasons.length,
+      embeddingsDropped: dropped,
+      reembedded,
+      embeddingsPending: Math.min(pending, dropped),
+      backupPath,
+      remnantsPurged
+    };
+  } finally {
+    store.close();
+  }
+}
+
+// src/cli/commands/scrub-secrets.ts
+async function runScrubSecrets(opts) {
+  const out = opts.out ?? ((chunk2) => void process.stdout.write(chunk2));
+  let incomplete = false;
+  const logPath = hookLogPath();
+  out(`${pc20.bold("shell hook log")} ${logPath}
+`);
+  if (!existsSync6(logPath)) {
+    out(`  ${pc20.dim("not present on this machine")}
+`);
+  } else {
+    try {
+      const { linesChanged, legacyLines } = await sanitizeHookLog(logPath, { dryRun: !opts.yes });
+      out(`  ${linesChanged} line(s) ${opts.yes ? "redacted" : "to redact"}
+`);
+      if (legacyLines > 0) {
+        out(
+          `  ${pc20.yellow(`${legacyLines} line(s) came from an outdated shell hook`)} that writes commands unredacted -- run \`nexusmem hook install\` again in each shell (see \`nexusmem hook status\`)
+`
+        );
+      }
+    } catch (err) {
+      incomplete = true;
+      out(`  ${pc20.red("could not redact the hook log")}: ${err.message}
+`);
+    }
+  }
+  const dbPaths = opts.allProjects ? [...new Set((await readLiveRegistry()).entries.map((e) => e.dbPath))] : [resolveWorkspace((await readRepoInfo(opts.cwd)).root).dbPath];
+  for (const dbPath of dbPaths) {
+    out(`
+${pc20.bold(dbPath)}
+`);
+    if (!existsSync6(dbPath)) {
+      out(`  ${pc20.dim("no database -- nothing to scrub")}
+`);
+      continue;
+    }
+    const lock = opts.yes ? acquireSyncLock(dirname6(dbPath)) : null;
+    if (opts.yes && !lock) {
+      incomplete = true;
+      out(`  ${pc20.yellow("a background sync is using this database -- re-run when it finishes")}
+`);
+      continue;
+    }
+    try {
+      const report = await scrubDatabase(dbPath, {
+        apply: opts.yes,
+        embeddingProvider: opts.yes && opts.embed ? new OllamaEmbeddingProvider() : null
+      });
+      printReport(report, out);
+      if (report.remnantsPurged === false) incomplete = true;
+    } catch (err) {
+      incomplete = true;
+      out(`  ${pc20.red("scrub failed")}: ${err.message}
+`);
+    } finally {
+      lock?.release();
+    }
+  }
+  if (!opts.yes) {
+    out(
+      `
+${pc20.bold("Dry run")}: nothing was changed. Re-run with --yes to back up each database, redact it in place, drop and re-embed stale vectors, rebuild the FTS index, VACUUM, and truncate the WAL.
+`
+    );
+  }
+  return incomplete ? 1 : 0;
+}
+function printReport(r, out) {
+  for (const kind of SCRUB_KINDS) {
+    const { scanned, changed } = r.byKind[kind];
+    out(`  ${kind.padEnd(22)} ${String(scanned).padStart(6)} scanned  ${changed} ${r.applied ? "redacted" : "to redact"}
+`);
+  }
+  out(`  ${"contradiction reasons".padEnd(22)} ${" ".repeat(14)}${r.contradictionReasonsChanged} ${r.applied ? "redacted" : "to redact"}
+`);
+  if (r.applied) {
+    if (r.backupPath) {
+      out(`  ${pc20.bold("backup")}  ${r.backupPath}
+`);
+      out(
+        `  ${pc20.yellow("WARNING")} that backup was taken BEFORE redaction and still contains every secret removed here. Verify this database, then delete the backup yourself -- NexusMem never deletes backups.
+`
+      );
+    } else {
+      out(`  ${pc20.dim("no row needed redaction -- no backup taken")}
+`);
+    }
+    if (r.embeddingsDropped > 0) {
+      out(
+        `  dropped ${r.embeddingsDropped} stale embedding(s), re-embedded ${r.reembedded}` + (r.embeddingsPending > 0 ? `; ${r.embeddingsPending} still pending (the next \`nexusmem sync\` embeds them)` : "") + "\n"
+      );
+    }
+    out(
+      r.remnantsPurged ? `  FTS index rebuilt, database VACUUMed, WAL truncated
+` : `  ${pc20.yellow("on-disk remnants NOT purged")}: the rows are redacted, but another process (MCP server, VS Code extension, a running sync) has this database open, which blocks VACUUM / WAL truncation. Close it and re-run \`nexusmem scrub-secrets --yes\`.
+`
+    );
+  }
+  if (r.existingBackups.length > 0) {
+    out(`  ${pc20.yellow("older backups")} (may hold unredacted secrets; NexusMem never deletes them):
+`);
+    for (const path of r.existingBackups) out(`    ${path}
+`);
+  }
+}
+
+// src/cli/commands/stale.ts
+import pc21 from "picocolors";
 var STALE_DEFAULT_MODEL = DEFAULT_SLM_MODEL;
 async function runStale(opts) {
   const { projectId, ws } = await loadContext(opts.cwd);
@@ -6779,15 +7683,15 @@ async function runStale(opts) {
     if (opts.dismiss) {
       const dismissed = store.dismissContradictionSuggestion(projectId, opts.dismiss);
       out(
-        dismissed > 0 ? `${pc20.green("dismissed")} the contradiction suggestion for ${opts.dismiss} -- it will not resurface
-` : `${pc20.dim("no open contradiction suggestion")} for ${opts.dismiss} -- nothing to dismiss
+        dismissed > 0 ? `${pc21.green("dismissed")} the contradiction suggestion for ${opts.dismiss} -- it will not resurface
+` : `${pc21.dim("no open contradiction suggestion")} for ${opts.dismiss} -- nothing to dismiss
 `
       );
       return 0;
     }
     const candidates = store.listStaleCandidates(projectId, { minAgeDays: opts.minAgeDays, limit: opts.limit });
     if (candidates.length === 0) {
-      out(`${pc20.dim("no stale candidates")} -- no unconfirmed node older than the threshold lacks a successor
+      out(`${pc21.dim("no stale candidates")} -- no unconfirmed node older than the threshold lacks a successor
 `);
       return 0;
     }
@@ -6809,15 +7713,15 @@ async function runStale(opts) {
     for (const s of suggestions) byCandidateId.set(s.candidateId, s);
     out(
       [
-        `${pc20.bold(String(candidates.length))} stale candidate(s) -- oldest first, none of these were changed:`,
+        `${pc21.bold(String(candidates.length))} stale candidate(s) -- oldest first, none of these were changed:`,
         ...candidates.map((c) => {
-          const line = `  ${pc20.dim(c.id)} ${pc20.yellow(`${c.ageDays}d old`)} [${c.kind}] ${c.title}`;
+          const line = `  ${pc21.dim(c.id)} ${pc21.yellow(`${c.ageDays}d old`)} [${c.kind}] ${c.title}`;
           const hit = byCandidateId.get(c.id);
           return hit ? `${line}
-    ${pc20.red("likely superseded by")} ${pc20.dim(hit.againstId)} ${hit.againstTitle} -- ${hit.reason}` : line;
+    ${pc21.red("likely superseded by")} ${pc21.dim(hit.againstId)} ${hit.againstTitle} -- ${hit.reason}` : line;
         }),
         "",
-        `run ${pc20.bold("nexusmem mark-stale <id> --supersedes <newId>")} on any that are actually wrong`
+        `run ${pc21.bold("nexusmem mark-stale <id> --supersedes <newId>")} on any that are actually wrong`
       ].join("\n").concat("\n")
     );
     return 0;
@@ -6827,9 +7731,10 @@ async function runStale(opts) {
 }
 
 // src/cli/commands/status.ts
-import { basename as basename4 } from "path";
+import { basename as basename5, join as join13 } from "path";
 import { statSync } from "fs";
-import pc21 from "picocolors";
+import { readFile as readFile11 } from "fs/promises";
+import pc22 from "picocolors";
 function daySpan(oldest, newest) {
   const oldestDay = Date.parse(oldest.slice(0, 10));
   const newestDay = Date.parse(newest.slice(0, 10));
@@ -6847,7 +7752,7 @@ function buildShareText(repo, stats2, chains) {
     (p) => !p.startsWith("0 ")
   );
   const lines = [
-    `NexusMem has been watching ${basename4(repo.root)} for ${days} day(s):`,
+    `NexusMem has been watching ${basename5(repo.root)} for ${days} day(s):`,
     `  ${stats2.total} memories${parts.length ? ` (${parts.join(", ")})` : ""}`
   ];
   if (chains.failuresTotal) {
@@ -6868,6 +7773,32 @@ function fileSize(path) {
     return 0;
   }
 }
+function relativeTime(fromMs, nowMs) {
+  const diffSec = Math.max(0, Math.round((nowMs - fromMs) / 1e3));
+  if (diffSec < 60) return `${diffSec} second${diffSec === 1 ? "" : "s"} ago`;
+  const diffMin = Math.round(diffSec / 60);
+  if (diffMin < 60) return `${diffMin} minute${diffMin === 1 ? "" : "s"} ago`;
+  const diffHour = Math.round(diffMin / 60);
+  if (diffHour < 24) return `${diffHour} hour${diffHour === 1 ? "" : "s"} ago`;
+  const diffDay = Math.round(diffHour / 24);
+  return `${diffDay} day${diffDay === 1 ? "" : "s"} ago`;
+}
+async function getShellHookStatus(injected) {
+  try {
+    const target = injected ?? await resolveHookTarget();
+    return { shell: target.shell, installed: (await hookStatus(target)).installed };
+  } catch {
+    return null;
+  }
+}
+async function readLastAutoSync(repoRoot) {
+  try {
+    const raw = await readFile11(join13(repoRoot, STATE_PATH), "utf8");
+    return parsePostCommitSyncState(raw);
+  } catch {
+    return null;
+  }
+}
 async function runStatus(opts) {
   const out = opts.out ?? ((chunk2) => void process.stdout.write(chunk2));
   const { repo, ws, projectId } = await loadContext(opts.cwd);
@@ -6887,36 +7818,59 @@ async function runStatus(opts) {
     const structure = store.fileEdgeStats(projectId);
     const staleCount = store.countStaleCandidates(projectId);
     const flaggedCount = store.countContradictionSuggestions(projectId);
+    const [shellHook, preCommitTarget, postCommitTarget, lastAutoSync] = await Promise.all([
+      getShellHookStatus(opts.shellHookTarget),
+      resolveGitHookTarget(repo.root),
+      resolvePostCommitHookTarget(repo.root),
+      readLastAutoSync(repo.root)
+    ]);
+    const [preCommitStatus, postCommitStatus] = await Promise.all([
+      gitHookStatus(preCommitTarget),
+      postCommitGitHookStatus(postCommitTarget)
+    ]);
+    const now = (opts.now ?? Date.now)();
+    const hooksPathNote2 = (target) => target.hooksPathConfig ? pc22.dim(` (core.hooksPath=${target.hooksPathConfig})`) : "";
+    const installedLabel = (installed) => installed ? pc22.green("installed") : pc22.yellow("not installed");
+    const lastAutoSyncLabel = lastAutoSync ? `${lastAutoSync.ok ? pc22.green("ok") : pc22.red(`FAILED (exit ${lastAutoSync.exitCode})`)} ${pc22.dim(relativeTime(Date.parse(lastAutoSync.ts), now))}` : postCommitStatus.installed ? pc22.dim("never (or hook predates this field -- reinstall with `nexusmem hook git-post install`)") : pc22.dim("n/a -- hook not installed");
+    const hooksLines = [
+      pc22.dim("hooks"),
+      `    ${pc22.dim(`shell (${shellHook?.shell ?? "?"})`.padEnd(23))} ${shellHook ? installedLabel(shellHook.installed) : pc22.dim("unknown -- could not detect this machine\u2019s shell profile")}`,
+      `    ${pc22.dim("git pre-commit".padEnd(23))} ${installedLabel(preCommitStatus.installed)}${hooksPathNote2(preCommitTarget)}`,
+      `    ${pc22.dim("git post-commit".padEnd(23))} ${installedLabel(postCommitStatus.installed)}${hooksPathNote2(postCommitTarget)}`,
+      `    ${pc22.dim("last auto-sync".padEnd(23))} ${lastAutoSyncLabel}`
+    ];
     const dbBytes = fileSize(ws.dbPath) + fileSize(`${ws.dbPath}-wal`);
     const kinds = Object.entries(stats2.byKind).sort((a, b) => b[1] - a[1]).map(([kind, n]) => `    ${String(n).padStart(6)}  ${kind}`);
-    const staleProjectWarning = otherProjectIds.length ? `${pc21.yellow("stale   ")} ${otherProjectIds.length} prior project ${otherProjectIds.length === 1 ? "identity holds" : "identities hold"} ${otherProjectNodes} node(s) \u2014 run ${pc21.bold(
+    const staleProjectWarning = otherProjectIds.length ? `${pc22.yellow("stale   ")} ${otherProjectIds.length} prior project ${otherProjectIds.length === 1 ? "identity holds" : "identities hold"} ${otherProjectNodes} node(s) \u2014 run ${pc22.bold(
       "nexusmem sync --prune-source <name>"
     )} to remove stale source data` : "";
     out(
       [
-        `${pc21.dim("repo    ")} ${repo.root}`,
-        `${pc21.dim("branch  ")} ${repo.branch ?? pc21.yellow("(detached)")}`,
-        `${pc21.dim("project ")} ${pc21.cyan(projectId)}`,
-        `${pc21.dim("schema  ")} v${schema}${schema === LATEST_SCHEMA_VERSION ? "" : pc21.yellow(` (latest is v${LATEST_SCHEMA_VERSION})`)}`,
-        `${pc21.dim("database")} ${ws.dbPath} ${pc21.dim(`(${humanBytes(dbBytes)})`)}`,
+        `${pc22.dim("repo    ")} ${repo.root}`,
+        `${pc22.dim("branch  ")} ${repo.branch ?? pc22.yellow("(detached)")}`,
+        `${pc22.dim("project ")} ${pc22.cyan(projectId)}`,
+        `${pc22.dim("schema  ")} v${schema}${schema === LATEST_SCHEMA_VERSION ? "" : pc22.yellow(` (latest is v${LATEST_SCHEMA_VERSION})`)}`,
+        `${pc22.dim("database")} ${ws.dbPath} ${pc22.dim(`(${humanBytes(dbBytes)})`)}`,
         staleProjectWarning,
         "",
-        `${pc21.bold(String(stats2.total))} node(s)${stats2.total ? ` ${pc21.dim(`${stats2.oldest?.slice(0, 10)} .. ${stats2.newest?.slice(0, 10)}`)}` : ""}`,
+        `${pc22.bold(String(stats2.total))} node(s)${stats2.total ? ` ${pc22.dim(`${stats2.oldest?.slice(0, 10)} .. ${stats2.newest?.slice(0, 10)}`)}` : ""}`,
         ...kinds,
-        stats2.total ? `    ${pc21.dim(`${stats2.distinctFiles} distinct file path(s)`)}` : "",
+        stats2.total ? `    ${pc22.dim(`${stats2.distinctFiles} distinct file path(s)`)}` : "",
         "",
-        sources.length ? pc21.dim("sources") : pc21.yellow("no sources synced yet"),
+        sources.length ? pc22.dim("sources") : pc22.yellow("no sources synced yet"),
         ...sources.map((s) => {
           const when = s.lastRunAt ? new Date(s.lastRunAt).toISOString().slice(0, 16).replace("T", " ") : "never";
           const cursorLabel = s.source === "git" ? s.cursor?.slice(0, 7) ?? "-" : s.cursor ?? "-";
-          return `    ${s.source.padEnd(14)} ${pc21.dim(`last run ${when}`)}  ${pc21.dim(`cursor ${cursorLabel}`)}`;
+          return `    ${s.source.padEnd(14)} ${pc22.dim(`last run ${when}`)}  ${pc22.dim(`cursor ${cursorLabel}`)}`;
         }),
         "",
-        gitCursor && gitCursor !== repo.head ? `${pc21.yellow("git behind HEAD")} \u2014 run ${pc21.bold("nexusmem sync")}` : "",
-        chains.failuresTotal ? `${pc21.dim("chains  ")} ${pc21.bold(String(chains.resolvedTotal))}/${chains.failuresTotal} failure(s) resolved ${pc21.dim(`(${chains.resolvedByRetry} retry, ${chains.resolvedByDiscussion} discussion)`)}${chains.resolvedTotal < chains.failuresTotal ? ` \u2014 run ${pc21.bold("nexusmem sync --link-failures")} to link more` : ""}` : "",
-        structure.edges ? `${pc21.dim("structure")} ${pc21.bold(String(structure.edges))} import edge(s) across ${structure.files} file(s)` : "",
-        staleCount ? `${pc21.dim("aging   ")} ${pc21.bold(String(staleCount))} unconfirmed node(s) worth a look \u2014 run ${pc21.bold("nexusmem stale")}` : "",
-        flaggedCount ? `${pc21.dim("flagged ")} ${pc21.bold(String(flaggedCount))} likely-superseded node(s) awaiting review \u2014 run ${pc21.bold("nexusmem stale")} for detail` : ""
+        gitCursor && gitCursor !== repo.head ? `${pc22.yellow("git behind HEAD")} \u2014 run ${pc22.bold("nexusmem sync")}` : "",
+        chains.failuresTotal ? `${pc22.dim("chains  ")} ${pc22.bold(String(chains.resolvedTotal))}/${chains.failuresTotal} failure(s) resolved ${pc22.dim(`(${chains.resolvedByRetry} retry, ${chains.resolvedByDiscussion} discussion)`)}${chains.resolvedTotal < chains.failuresTotal ? ` \u2014 run ${pc22.bold("nexusmem sync --link-failures")} to link more` : ""}` : "",
+        structure.edges ? `${pc22.dim("structure")} ${pc22.bold(String(structure.edges))} import edge(s) across ${structure.files} file(s)` : "",
+        staleCount ? `${pc22.dim("aging   ")} ${pc22.bold(String(staleCount))} unconfirmed node(s) worth a look \u2014 run ${pc22.bold("nexusmem stale")}` : "",
+        flaggedCount ? `${pc22.dim("flagged ")} ${pc22.bold(String(flaggedCount))} likely-superseded node(s) awaiting review \u2014 run ${pc22.bold("nexusmem stale")} for detail` : "",
+        "",
+        ...hooksLines
       ].filter((line) => line !== "").join("\n").concat("\n")
     );
     return 0;
@@ -6939,7 +7893,7 @@ function guard(run) {
       process.exitCode = await run();
     } catch (err) {
       if (isExpected(err)) {
-        process.stderr.write(`${pc22.red("error")} ${err.message}
+        process.stderr.write(`${pc23.red("error")} ${err.message}
 `);
         process.exitCode = 1;
         return;
@@ -6992,12 +7946,16 @@ program.command("sync").description("Ingest new history into the local database"
     })
   )()
 );
-program.command("hook").description("Manage the opt-in PowerShell hook that logs cwd + exit code + timestamp").addCommand(
-  new Command("install").description("Install (or update) the hook in your PowerShell profile").option("--profile <path>", "override the auto-detected $PROFILE path").action((options) => guard(() => runHookInstall({ profile: options.profile }))())
+var SHELL_CHOICES = ["pwsh", "bash", "zsh"];
+function shellOption() {
+  return new Option("--shell <kind>", "pwsh, bash, or zsh -- default: auto-detected from platform/$SHELL").choices(SHELL_CHOICES);
+}
+program.command("hook").description("Manage the opt-in shell hook that logs cwd + exit code + timestamp").addCommand(
+  new Command("install").description("Install (or update) the hook in your shell profile").addOption(shellOption()).option("--profile <path>", "override the auto-detected profile path").action((options) => guard(() => runHookInstall({ shell: options.shell, profile: options.profile }))())
 ).addCommand(
-  new Command("remove").description("Remove the hook block from your PowerShell profile").option("--profile <path>", "override the auto-detected $PROFILE path").action((options) => guard(() => runHookRemove({ profile: options.profile }))())
+  new Command("remove").description("Remove the hook block from your shell profile").addOption(shellOption()).option("--profile <path>", "override the auto-detected profile path").action((options) => guard(() => runHookRemove({ shell: options.shell, profile: options.profile }))())
 ).addCommand(
-  new Command("status").description("Show whether the hook is installed").option("--profile <path>", "override the auto-detected $PROFILE path").action((options) => guard(() => runHookStatus({ profile: options.profile }))())
+  new Command("status").description("Show whether the hook is installed").addOption(shellOption()).option("--profile <path>", "override the auto-detected profile path").action((options) => guard(() => runHookStatus({ shell: options.shell, profile: options.profile }))())
 ).addCommand(
   new Command("git").description("Manage the opt-in git pre-commit hook that runs `nexusmem precheck` before each commit").addCommand(
     new Command("install").description("Install (or update) the hook in .git/hooks/pre-commit").option("-C, --cwd <path>", "repository path", process.cwd()).option("--force", "append after an existing foreign pre-commit hook instead of refusing", false).action((options) => guard(() => runHookGitInstall({ cwd: options.cwd, force: options.force }))())
@@ -7048,6 +8006,13 @@ program.command("forget").description(
     })
   )()
 );
+program.command("scrub-secrets").description(
+  "Redact secrets that older versions already stored (database rows, FTS index, embeddings, shell hook log) -- dry-run unless --yes"
+).option("-C, --cwd <path>", "repository path", process.cwd()).option("-a, --all-projects", "every repository in the NexusMem registry, not just this one", false).option("--no-embed", "leave re-embedding the redacted nodes to the next sync").option("--yes", "back up each database, then redact it in place", false).action(
+  (options) => guard(
+    () => runScrubSecrets({ cwd: options.cwd, allProjects: options.allProjects, yes: options.yes, embed: options.embed })
+  )()
+);
 program.command("mark-stale").description(
   "Mark a node as superseded by another -- the ranker down-weights it (never deletes it) so its replacement usually outranks it"
 ).argument("<nodeId>", "id of the node to mark stale").requiredOption("--supersedes <newNodeId>", "id of the node that supersedes it").option("-C, --cwd <path>", "repository path", process.cwd()).action(
@@ -7137,7 +8102,7 @@ program.command("scan-structure").description("Preview the JS/TS/Python/Go/Rust/
 program.command("mcp").description("Start the MCP server (stdio transport) for Claude Desktop, Cursor, Windsurf, etc.").action(() => guard(() => runMcpServer().then(() => 0))());
 program.parseAsync(process.argv).catch((err) => {
   const message = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`${pc22.red("error")} ${message}
+  process.stderr.write(`${pc23.red("error")} ${message}
 `);
   process.exitCode = 1;
 });