@andespindola/brainlink 1.1.0 → 1.3.0

package/dist/application/vault-git-core.js

@@ -0,0 +1,168 @@
+// Git primitives for vault versioning, with no dependency on the indexing layer
+// so they can be reused by the auto-version hook that runs *after* indexing
+// (avoiding a cycle with index-vault). Only the canonical Markdown is versioned;
+// the derived `.brainlink/` directory is git-ignored. Git is driven through the
+// system binary via execFile (never a shell), and a missing binary degrades to a
+// clear, actionable error.
+import { execFile } from 'node:child_process';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { ensureVault } from '../infrastructure/file-system-vault.js';
+import { encryptVaultTree, vaultEncryptionEnabled } from './vault-encryption.js';
+const execFileAsync = promisify(execFile);
+export class GitUnavailableError extends Error {
+    constructor() {
+        super('git executable not found. Install git to use vault versioning.');
+        this.name = 'GitUnavailableError';
+    }
+}
+export class GitCommandError extends Error {
+    constructor(args, stderr) {
+        super(`git ${args.join(' ')} failed: ${stderr.trim() || 'unknown error'}`);
+        this.name = 'GitCommandError';
+    }
+}
+const isMissingBinary = (error) => error instanceof Error && 'code' in error && error.code === 'ENOENT';
+export const runGit = async (cwd, args) => {
+    try {
+        const { stdout } = await execFileAsync('git', [...args], { cwd, maxBuffer: 64 * 1024 * 1024 });
+        return stdout;
+    }
+    catch (error) {
+        if (isMissingBinary(error)) {
+            throw new GitUnavailableError();
+        }
+        const stderr = error.stderr ?? (error instanceof Error ? error.message : String(error));
+        throw new GitCommandError(args, stderr);
+    }
+};
+const isInsideGitRepo = async (cwd) => {
+    try {
+        const out = await runGit(cwd, ['rev-parse', '--is-inside-work-tree']);
+        return out.trim() === 'true';
+    }
+    catch (error) {
+        if (error instanceof GitUnavailableError) {
+            throw error;
+        }
+        return false;
+    }
+};
+const baseGitignoreLines = ['.brainlink/', '*.tmp', '.DS_Store'];
+// In encrypted mode the plaintext Markdown is never committed — only the
+// `<note>.md.enc` ciphertext is — so the working `.md` files are git-ignored.
+const encryptedGitignoreLines = [...baseGitignoreLines, '*.md'];
+const ensureGitignore = async (vaultRoot, lines) => {
+    const path = join(vaultRoot, '.gitignore');
+    let current = '';
+    try {
+        current = await readFile(path, 'utf8');
+    }
+    catch {
+        current = '';
+    }
+    const existing = new Set(current.split('\n').map((line) => line.trim()));
+    const missing = lines.filter((line) => !existing.has(line));
+    if (missing.length === 0 && current.length > 0) {
+        return;
+    }
+    const next = `${[current.trimEnd(), ...missing].filter(Boolean).join('\n')}\n`;
+    await writeFile(path, next, 'utf8');
+};
+// Reject credentials embedded in a remote URL: they would be written to
+// .git/config in clear text. Users should rely on SSH or a git credential
+// helper instead.
+export const assertSafeRemote = (remote) => {
+    if (/\/\/[^/@]*:[^/@]*@/.test(remote) || /x-access-token|:[^/]*@github/.test(remote)) {
+        throw new Error('Refusing a remote URL with an inline credential. Use SSH or a git credential helper.');
+    }
+};
+export const markdownOnly = (paths) => paths.filter((path) => path.toLowerCase().endsWith('.md'));
+// True when the repo has an 'origin' remote, so auto-versioning knows whether a
+// push is possible.
+export const hasRemote = async (root, remote = 'origin') => {
+    const remotes = await runGit(root, ['remote']).catch(() => '');
+    return remotes.split('\n').map((line) => line.trim()).includes(remote);
+};
+export const initVaultGit = async (vaultPath, options = {}) => {
+    const root = await ensureVault(vaultPath);
+    await mkdir(root, { recursive: true });
+    const already = await isInsideGitRepo(root);
+    if (!already) {
+        await runGit(root, ['init']);
+    }
+    await ensureGitignore(root, (await vaultEncryptionEnabled()) ? encryptedGitignoreLines : baseGitignoreLines);
+    if (options.remote) {
+        assertSafeRemote(options.remote);
+        const verb = (await hasRemote(root)) ? 'set-url' : 'add';
+        await runGit(root, ['remote', verb, 'origin', options.remote]);
+    }
+    return { root, initialized: !already };
+};
+export const vaultGitStatus = async (vaultPath) => {
+    const root = await ensureVault(vaultPath);
+    const branch = (await runGit(root, ['rev-parse', '--abbrev-ref', 'HEAD']).catch(() => 'HEAD')).trim();
+    const porcelain = await runGit(root, ['status', '--porcelain']);
+    const changed = porcelain
+        .split('\n')
+        .map((line) => line.slice(3).trim())
+        .filter(Boolean);
+    return { branch, dirty: changed.length > 0, changedMarkdown: markdownOnly(changed) };
+};
+// Stage and commit the versioned content. Returns null when there is nothing to
+// commit. In encrypted mode the ciphertext mirror is refreshed first and only
+// `<note>.md.enc` is staged; otherwise the plaintext Markdown is staged.
+export const commitVault = async (vaultPath, message) => {
+    const root = await ensureVault(vaultPath);
+    const encrypted = await vaultEncryptionEnabled();
+    if (encrypted) {
+        await encryptVaultTree(root);
+        await ensureGitignore(root, encryptedGitignoreLines);
+    }
+    const patterns = encrypted
+        ? ['*.md.enc', ':(glob)**/*.md.enc', '.gitignore']
+        : ['*.md', ':(glob)**/*.md', '.gitignore'];
+    await runGit(root, ['add', '-A', '--', ...patterns]);
+    const staged = await runGit(root, ['diff', '--cached', '--name-only']);
+    if (staged.trim().length === 0) {
+        return null;
+    }
+    await runGit(root, ['commit', '-m', message]);
+    return (await runGit(root, ['rev-parse', 'HEAD'])).trim();
+};
+export const pushVault = async (vaultPath, branch) => {
+    const root = await ensureVault(vaultPath);
+    const target = branch ?? (await runGit(root, ['rev-parse', '--abbrev-ref', 'HEAD'])).trim();
+    await runGit(root, ['push', '-u', 'origin', target]);
+};
+export const vaultHistory = async (vaultPath, limit = 20) => {
+    const root = await ensureVault(vaultPath);
+    const out = await runGit(root, [
+        'log',
+        `-n${Math.max(1, Math.floor(limit))}`,
+        '--format=%H%x00%an%x00%aI%x00%s',
+        '--',
+        '*.md'
+    ]).catch(() => '');
+    return out
+        .split('\n')
+        .map((line) => line.split('\u0000'))
+        .filter((parts) => parts.length === 4)
+        .map(([hash, author, date, subject]) => ({ hash: hash, author: author, date: date, subject: subject }));
+};
+// Best-effort commit + push of the canonical Markdown, used by the auto-version
+// hook after a successful index. A no-op unless the vault is a git repo with an
+// origin remote. Commits only when Markdown actually changed.
+export const autoVersionVault = async (vaultPath, message) => {
+    const root = await ensureVault(vaultPath);
+    if (!(await isInsideGitRepo(root)) || !(await hasRemote(root))) {
+        return { committed: null, pushed: false };
+    }
+    const committed = await commitVault(vaultPath, message);
+    if (!committed) {
+        return { committed: null, pushed: false };
+    }
+    await pushVault(vaultPath);
+    return { committed, pushed: true };
+};

package/dist/application/vault-git.js

@@ -1,141 +1,13 @@
-// Git-backed versioning for the vault's canonical Markdown. The derived
-// `.brainlink/` directory is git-ignored; only `.md` is versioned. After any
-// operation that changes Markdown on disk (pull, restore), the index is rebuilt
-// so the vault stays immediately usable ("no losing the use of the data").
-//
-// Git is driven through the system binary via execFile (never a shell, args as
-// an array) to keep runtime dependencies minimal and history/merge behavior
-// native. A missing git binary degrades to a clear, actionable error.
-import { execFile } from 'node:child_process';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { promisify } from 'node:util';
+// Vault versioning operations that reindex after changing Markdown on disk
+// (pull, restore, clone) so the vault stays immediately usable ("no losing the
+// use of the data"). The git primitives live in vault-git-core (which has no
+// indexing dependency) and are re-exported here so callers keep a single import.
 import { indexVault } from './index-vault.js';
 import { ensureVault } from '../infrastructure/file-system-vault.js';
-const execFileAsync = promisify(execFile);
-export class GitUnavailableError extends Error {
-    constructor() {
-        super('git executable not found. Install git to use vault versioning.');
-        this.name = 'GitUnavailableError';
-    }
-}
-export class GitCommandError extends Error {
-    constructor(args, stderr) {
-        super(`git ${args.join(' ')} failed: ${stderr.trim() || 'unknown error'}`);
-        this.name = 'GitCommandError';
-    }
-}
-const isMissingBinary = (error) => error instanceof Error && 'code' in error && error.code === 'ENOENT';
-const runGit = async (cwd, args) => {
-    try {
-        const { stdout } = await execFileAsync('git', [...args], { cwd, maxBuffer: 64 * 1024 * 1024 });
-        return stdout;
-    }
-    catch (error) {
-        if (isMissingBinary(error)) {
-            throw new GitUnavailableError();
-        }
-        const stderr = error.stderr ?? (error instanceof Error ? error.message : String(error));
-        throw new GitCommandError(args, stderr);
-    }
-};
-const isInsideGitRepo = async (cwd) => {
-    try {
-        const out = await runGit(cwd, ['rev-parse', '--is-inside-work-tree']);
-        return out.trim() === 'true';
-    }
-    catch (error) {
-        if (error instanceof GitUnavailableError) {
-            throw error;
-        }
-        return false;
-    }
-};
-const gitignoreLines = ['.brainlink/', '*.tmp', '.DS_Store'];
-const ensureGitignore = async (vaultRoot) => {
-    const path = join(vaultRoot, '.gitignore');
-    let current = '';
-    try {
-        current = await readFile(path, 'utf8');
-    }
-    catch {
-        current = '';
-    }
-    const existing = new Set(current.split('\n').map((line) => line.trim()));
-    const missing = gitignoreLines.filter((line) => !existing.has(line));
-    if (missing.length === 0 && current.length > 0) {
-        return;
-    }
-    const next = `${[current.trimEnd(), ...missing].filter(Boolean).join('\n')}\n`;
-    await writeFile(path, next, 'utf8');
-};
-// Reject credentials embedded in a remote URL: they would be written to
-// .git/config in clear text. Users should rely on SSH or a git credential
-// helper instead.
-const assertSafeRemote = (remote) => {
-    if (/\/\/[^/@]*:[^/@]*@/.test(remote) || /x-access-token|:[^/]*@github/.test(remote)) {
-        throw new Error('Refusing a remote URL with an inline credential. Use SSH or a git credential helper.');
-    }
-};
-const markdownOnly = (paths) => paths.filter((path) => path.toLowerCase().endsWith('.md'));
-export const initVaultGit = async (vaultPath, options = {}) => {
-    const root = await ensureVault(vaultPath);
-    await mkdir(root, { recursive: true });
-    const already = await isInsideGitRepo(root);
-    if (!already) {
-        await runGit(root, ['init']);
-    }
-    await ensureGitignore(root);
-    if (options.remote) {
-        assertSafeRemote(options.remote);
-        const remotes = await runGit(root, ['remote']);
-        const verb = remotes.split('\n').map((line) => line.trim()).includes('origin') ? 'set-url' : 'add';
-        await runGit(root, ['remote', verb, 'origin', options.remote]);
-    }
-    return { root, initialized: !already };
-};
-export const vaultGitStatus = async (vaultPath) => {
-    const root = await ensureVault(vaultPath);
-    const branch = (await runGit(root, ['rev-parse', '--abbrev-ref', 'HEAD']).catch(() => 'HEAD')).trim();
-    const porcelain = await runGit(root, ['status', '--porcelain']);
-    const changed = porcelain
-        .split('\n')
-        .map((line) => line.slice(3).trim())
-        .filter(Boolean);
-    return { branch, dirty: changed.length > 0, changedMarkdown: markdownOnly(changed) };
-};
-// Stage and commit only Markdown. Returns null when there is nothing to commit.
-export const commitVault = async (vaultPath, message) => {
-    const root = await ensureVault(vaultPath);
-    await runGit(root, ['add', '-A', '--', '*.md', ':(glob)**/*.md', '.gitignore']);
-    const staged = await runGit(root, ['diff', '--cached', '--name-only']);
-    if (staged.trim().length === 0) {
-        return null;
-    }
-    await runGit(root, ['commit', '-m', message]);
-    return (await runGit(root, ['rev-parse', 'HEAD'])).trim();
-};
-export const vaultHistory = async (vaultPath, limit = 20) => {
-    const root = await ensureVault(vaultPath);
-    const out = await runGit(root, [
-        'log',
-        `-n${Math.max(1, Math.floor(limit))}`,
-        '--format=%H%x00%an%x00%aI%x00%s',
-        '--',
-        '*.md'
-    ]).catch(() => '');
-    return out
-        .split('\n')
-        .map((line) => line.split('\u0000'))
-        .filter((parts) => parts.length === 4)
-        .map(([hash, author, date, subject]) => ({ hash: hash, author: author, date: date, subject: subject }));
-};
+import { decryptVaultTree, vaultEncryptionEnabled } from './vault-encryption.js';
+import { assertSafeRemote, GitCommandError, markdownOnly, runGit } from './vault-git-core.js';
+export * from './vault-git-core.js';
 const reindexAfterMarkdownChange = async (vaultPath, changedMarkdown, skipIndex) => !skipIndex && changedMarkdown.length > 0 ? indexVault(vaultPath) : undefined;
-export const pushVault = async (vaultPath, branch) => {
-    const root = await ensureVault(vaultPath);
-    const target = branch ?? (await runGit(root, ['rev-parse', '--abbrev-ref', 'HEAD'])).trim();
-    await runGit(root, ['push', '-u', 'origin', target]);
-};
 // Pull from origin and reindex when Markdown changed, so the vault is usable
 // immediately. On a merge conflict the merge is aborted and a clear error is
 // raised rather than leaving conflict markers in the Markdown.
@@ -152,21 +24,38 @@ export const pullVault = async (vaultPath, options = {}) => {
             : error;
     }
     const after = (await runGit(root, ['rev-parse', 'HEAD']).catch(() => '')).trim();
-    const diff = before && after && before !== after
-        ? await runGit(root, ['diff', '--name-only', before, after, '--', '*.md'])
-        : '';
+    const changed = Boolean(before && after && before !== after);
+    // Encrypted vaults track ciphertext; rebuild the plaintext Markdown from it
+    // before reindexing. Individual filenames are not reported (the diff is over
+    // opaque `.md.enc`).
+    if (await vaultEncryptionEnabled()) {
+        if (changed) {
+            await decryptVaultTree(root);
+        }
+        const index = changed ? await reindexAfterMarkdownChange(vaultPath, ['(encrypted)'], options.skipIndex === true) : undefined;
+        return { changedMarkdown: changed ? ['(encrypted)'] : [], index };
+    }
+    const diff = changed ? await runGit(root, ['diff', '--name-only', before, after, '--', '*.md']) : '';
     const changedMarkdown = markdownOnly(diff.split('\n').map((line) => line.trim()).filter(Boolean));
     const index = await reindexAfterMarkdownChange(vaultPath, changedMarkdown, options.skipIndex === true);
     return { changedMarkdown, index };
 };
 export const restoreVault = async (vaultPath, ref, options = {}) => {
     const root = await ensureVault(vaultPath);
-    const head = (await runGit(root, ['rev-parse', 'HEAD']).catch(() => '')).trim();
-    const diff = await runGit(root, ['diff', '--name-only', ref, '--', '*.md']).catch(() => '');
+    const encrypted = await vaultEncryptionEnabled();
+    const diff = await runGit(root, ['diff', '--name-only', ref, '--', encrypted ? '*.md.enc' : '*.md']).catch(() => '');
     await runGit(root, ['checkout', ref, '--', '.']);
+    // Restore is an explicit request to materialize this ref's Markdown, so in
+    // encrypted mode always rebuild the plaintext from the (now checked-out)
+    // ciphertext — the plaintext is derived and may be missing or stale even when
+    // the ciphertext already matched the ref.
+    if (encrypted) {
+        const rebuilt = await decryptVaultTree(root);
+        const index = await reindexAfterMarkdownChange(vaultPath, rebuilt.written > 0 ? ['(encrypted)'] : [], options.skipIndex === true);
+        return { changedMarkdown: rebuilt.written > 0 ? ['(encrypted)'] : [], index };
+    }
     const changedMarkdown = markdownOnly(diff.split('\n').map((line) => line.trim()).filter(Boolean));
     const index = await reindexAfterMarkdownChange(vaultPath, changedMarkdown, options.skipIndex === true);
-    void head;
     return { changedMarkdown, index };
 };
 // Clone a remote vault and build its index from scratch so it is immediately
@@ -175,6 +64,12 @@ export const cloneVault = async (remote, targetPath, options = {}) => {
     assertSafeRemote(remote);
     await runGit(process.cwd(), ['clone', remote, targetPath]);
     const root = await ensureVault(targetPath);
+    // Encrypted clone: decrypt the ciphertext mirror before indexing. Requires the
+    // vault key on this machine (BRAINLINK_VAULT_KEY or a copied key file);
+    // decryption throws a clear error if the key is missing or wrong.
+    if (await vaultEncryptionEnabled()) {
+        await decryptVaultTree(root);
+    }
     const index = options.skipIndex === true ? undefined : await indexVault(root, { full: true });
     return { root, index };
 };

package/dist/cli/commands/read-commands.js

@@ -1,5 +1,5 @@
 import { getBrokenLinksReport, getExtendedStats, getOrphansReport, getStats, validateVault } from '../../application/analyze-vault.js';
-import { buildContextPackage, readContextDataSignature } from '../../application/build-context.js';
+import { buildContextPackage, readContextDataSignature, readVolatileSignature } from '../../application/build-context.js';
 import { getGraph } from '../../application/get-graph.js';
 import { listAgents } from '../../application/list-agents.js';
 import { listBacklinks, listLinks } from '../../application/list-links.js';
@@ -82,24 +82,28 @@ export const registerReadCommands = (program) => {
         const resolved = await resolveOptions(options);
         const mode = sanitizeSearchMode(options.mode, resolved.defaults.defaultSearchMode);
         const strategy = sanitizeContextStrategy(options.strategy, resolved.defaults.defaultContextStrategy);
-        const contextPackage = await buildContextPackage(resolved.vault, query, parsePositiveInteger(options.limit ?? String(resolved.defaults.defaultSearchLimit), resolved.defaults.defaultSearchLimit), parsePositiveInteger(options.tokens ?? String(resolved.defaults.defaultContextTokens), resolved.defaults.defaultContextTokens), resolved.agent, mode, strategy, resolved.defaults.defaultContextCacheTtlMs);
+        const contextPackage = await buildContextPackage(resolved.vault, query, parsePositiveInteger(options.limit ?? String(resolved.defaults.defaultSearchLimit), resolved.defaults.defaultSearchLimit), parsePositiveInteger(options.tokens ?? String(resolved.defaults.defaultContextTokens), resolved.defaults.defaultContextTokens), resolved.agent, mode, strategy, resolved.defaults.defaultContextCacheTtlMs, resolved.defaults.cagPackTtlMs);
         print(options.json, contextPackage, () => contextPackage.content);
     });
     program
         .command('context-packs')
         .option('-v, --vault <vault>', 'vault directory')
         .option('-a, --agent <agent>', 'accepted for consistency; context packs are already keyed by agent')
-        .option('--stale', 'operate only on packs stale for the current index and volatile-memory signature')
+        .option('--stale', 'operate only on packs whose cited documents (or volatile memory) have changed')
         .option('--clear', 'remove context packs instead of listing them')
         .option('--json', 'print machine-readable JSON')
         .description('list or clear persisted CAG context packs')
         .action(async (options) => {
         const resolved = await resolveOptions(options);
         const dataSignature = await readContextDataSignature(resolved.vault);
+        const freshness = {
+            volatileSignature: await readVolatileSignature(resolved.vault),
+            ttlMs: resolved.defaults.cagPackTtlMs
+        };
         if (options.clear) {
             const result = await clearContextPacks(resolved.vault, {
                 staleOnly: options.stale === true,
-                dataSignature
+                freshness
             });
             print(options.json, { vault: resolved.vault, dataSignature, ...result }, () => [
                 `Removed context packs: ${result.removed.length}`,
@@ -107,7 +111,7 @@ export const registerReadCommands = (program) => {
             ].join('\n'));
             return;
         }
-        const packs = await listContextPacks(resolved.vault, dataSignature);
+        const packs = await listContextPacks(resolved.vault, freshness);
         const visiblePacks = options.stale ? packs.filter((pack) => pack.stale) : packs;
         print(options.json, { vault: resolved.vault, dataSignature, packs: visiblePacks }, () => visiblePacks.length === 0
             ? 'No context packs found.'

package/dist/cli/commands/vault-sync-commands.js

@@ -1,4 +1,5 @@
 import { cloneVault, commitVault, initVaultGit, pullVault, pushVault, restoreVault, vaultGitStatus, vaultHistory } from '../../application/vault-git.js';
+import { provisionVaultRepo } from '../../application/provision-vault.js';
 import { exportVaultSnapshot, importVaultSnapshot } from '../../application/vault-snapshot.js';
 import { print, resolveOptions } from '../runtime.js';
 export const registerVaultSyncCommands = (program) => {
@@ -13,6 +14,27 @@ export const registerVaultSyncCommands = (program) => {
         const result = await initVaultGit(vault, { remote: options.remote });
         print(options.json, result, () => `${result.initialized ? 'Initialized' : 'Reused'} git repo at ${result.root}${options.remote ? ` (origin: ${options.remote})` : ''}.`);
     });
+    program
+        .command('vault-provision')
+        .option('--vault <vault>', 'vault directory')
+        .option('--name <name>', 'repository name to create', 'brainlink-vault')
+        .option('--public', 'create a public repository instead of private')
+        .option('--no-auto-version', 'do not enable autoVersion after provisioning')
+        .option('--no-encrypt', 'commit plaintext Markdown instead of encrypted ciphertext')
+        .option('-m, --message <message>', 'initial commit message')
+        .option('--json', 'print machine-readable JSON')
+        .description('create a private GitHub repo for the vault via gh, push it, and enable encrypted auto-versioning')
+        .action(async (options) => {
+        const { vault } = await resolveOptions(options);
+        const result = await provisionVaultRepo(vault, {
+            name: options.name,
+            private: options.public !== true,
+            enableAutoVersion: options.autoVersion !== false,
+            encrypt: options.encrypt !== false,
+            message: options.message
+        });
+        print(options.json, result, () => `${result.created ? 'Created' : 'Reused'} ${result.repo} and pushed the vault${result.encrypted ? ' (encrypted)' : ''}${result.autoVersionEnabled ? '; autoVersion enabled' : ''}.`);
+    });
     program
         .command('vault-commit')
         .requiredOption('-m, --message <message>', 'commit message')

package/dist/cli/commands/write/vault-lifecycle-commands.js

@@ -204,7 +204,7 @@ export const registerVaultLifecycleCommands = (program) => {
         const policy = await getBootstrapPolicy();
         const bootstrapStatus = await getBootstrapSessionStatus(resolved.vault, resolved.agent);
         const context = options.query
-            ? await buildContextPackage(resolved.vault, options.query, limit, tokens, resolved.agent, mode, strategy, resolved.defaults.defaultContextCacheTtlMs)
+            ? await buildContextPackage(resolved.vault, options.query, limit, tokens, resolved.agent, mode, strategy, resolved.defaults.defaultContextCacheTtlMs, resolved.defaults.cagPackTtlMs)
             : null;
         const agentIntegration = options.installAgent === false
             ? null

package/dist/infrastructure/config.js

@@ -11,17 +11,21 @@ export const defaultBrainlinkConfig = {
     defaultAgent: undefined,
     autoIndexOnWrite: true,
     autoCanonicalContextLinks: true,
+    autoVersion: false,
+    vaultEncryption: false,
     autoUpdateCheck: true,
     updateCheckIntervalMs: 86_400_000,
     defaultSearchLimit: 8,
     defaultContextTokens: 1500,
     defaultContextStrategy: 'auto',
     defaultContextCacheTtlMs: 120_000,
+    cagPackTtlMs: 0,
     embeddingProvider: 'local',
     embedding: {},
     defaultSearchMode: 'hybrid',
     chunkSize: 1200,
-    storageBackend: 'json',
+    storageBackend: 'binary',
+    hybridFusion: 'rrf',
     searchPack: {
         rowChunkSize: 5_000,
         compressionLevel: 5,
@@ -49,7 +53,9 @@ const embeddingProviders = new Set(['none', 'local', 'ollama', 'openai']);
 const searchModes = new Set(['fts', 'semantic', 'hybrid']);
 const contextStrategies = new Set(['rag', 'cag', 'auto']);
 const storageBackends = new Set(['json', 'binary', 'lmdb']);
+const hybridFusions = new Set(['rrf', 'linear']);
 const sanitizeStorageBackend = (value) => typeof value === 'string' && storageBackends.has(value) ? value : defaultBrainlinkConfig.storageBackend;
+const sanitizeHybridFusion = (value) => typeof value === 'string' && hybridFusions.has(value) ? value : defaultBrainlinkConfig.hybridFusion;
 const sanitizeEmbeddingProvider = (value) => typeof value === 'string' && embeddingProviders.has(value) ? value : defaultBrainlinkConfig.embeddingProvider;
 const sanitizeOptionalString = (value) => typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
 const sanitizeEmbeddingConfig = (value) => {
@@ -207,6 +213,8 @@ const sanitizeConfig = (value) => ({
     autoCanonicalContextLinks: typeof value.autoCanonicalContextLinks === 'boolean'
         ? value.autoCanonicalContextLinks
         : defaultBrainlinkConfig.autoCanonicalContextLinks,
+    autoVersion: typeof value.autoVersion === 'boolean' ? value.autoVersion : defaultBrainlinkConfig.autoVersion,
+    vaultEncryption: typeof value.vaultEncryption === 'boolean' ? value.vaultEncryption : defaultBrainlinkConfig.vaultEncryption,
     autoUpdateCheck: typeof value.autoUpdateCheck === 'boolean' ? value.autoUpdateCheck : defaultBrainlinkConfig.autoUpdateCheck,
     updateCheckIntervalMs: typeof value.updateCheckIntervalMs === 'number' && Number.isFinite(value.updateCheckIntervalMs) && value.updateCheckIntervalMs > 0
         ? Math.floor(value.updateCheckIntervalMs)
@@ -221,9 +229,11 @@ const sanitizeConfig = (value) => ({
     defaultContextCacheTtlMs: typeof value.defaultContextCacheTtlMs === 'number' && Number.isFinite(value.defaultContextCacheTtlMs) && value.defaultContextCacheTtlMs > 0
         ? Math.floor(value.defaultContextCacheTtlMs)
         : defaultBrainlinkConfig.defaultContextCacheTtlMs,
+    cagPackTtlMs: sanitizeIntegerInRange(value.cagPackTtlMs, defaultBrainlinkConfig.cagPackTtlMs, 0, 2_147_483_647),
     allowedVaults: [...sanitizeAllowedVaults(value.allowedVaults), ...readAllowedVaultsFromEnv()],
     chunkSize: typeof value.chunkSize === 'number' && value.chunkSize > 0 ? value.chunkSize : defaultBrainlinkConfig.chunkSize,
     storageBackend: sanitizeStorageBackend(value.storageBackend),
+    hybridFusion: sanitizeHybridFusion(value.hybridFusion),
     searchPack: sanitizeSearchPackConfig(value.searchPack),
     embeddingProvider: sanitizeEmbeddingProvider(value.embeddingProvider),
     embedding: sanitizeEmbeddingConfig(value.embedding),
@@ -238,7 +248,8 @@ export const resolveAgentRuntimeDefaults = (config, agent) => {
         defaultContextTokens: profile?.defaultContextTokens ?? config.defaultContextTokens,
         defaultSearchMode: profile?.defaultSearchMode ?? config.defaultSearchMode,
         defaultContextStrategy: profile?.defaultContextStrategy ?? config.defaultContextStrategy,
-        defaultContextCacheTtlMs: profile?.defaultContextCacheTtlMs ?? config.defaultContextCacheTtlMs
+        defaultContextCacheTtlMs: profile?.defaultContextCacheTtlMs ?? config.defaultContextCacheTtlMs,
+        cagPackTtlMs: config.cagPackTtlMs
     };
 };
 const mergeConfigLayers = (layers) => layers.reduce((state, config) => ({