@atbash/sdk 0.10.12-dev.0 → 0.12.0-dev.0

package/dist/index.js

@@ -2896,13 +2896,13 @@ __export(src_ts_exports, {
   encryptedLength: () => encryptedLength,
   flushTelemetry: () => flushTelemetry,
   generateKeypair: () => generateKeypair,
-  getActiveMemory: () => getActiveMemory,
+  getActiveAgentMemory: () => getActiveAgentMemory,
   getActiveMemoryId: () => getActiveMemoryId,
-  getAllAgentMemory: () => getAllAgentMemory,
   getConfigDir: () => getConfigDir,
   getConfigPath: () => getConfigPath,
   getMemoryById: () => getMemoryById,
   getMemoryHistory: () => getMemoryHistory,
+  getRecentAgentMemory: () => getRecentAgentMemory,
   getRollbackHistory: () => getRollbackHistory,
   guardMemoryWrite: () => guardMemoryWrite,
   isEnvelope: () => isEnvelope,
@@ -3392,6 +3392,8 @@ var ENV_MAP = {
   agentKey: "ATBASH_AGENT_KEY",
   orgName: "ATBASH_ORG_NAME",
   judgeEndpoint: "ATBASH_ENDPOINT",
+  // Same variable name the Hermes plugin already documents.
+  judgeVerifyPubKey: "ATBASH_JUDGE_VERIFY_PUBKEY",
   blockchainRid: "ATBASH_BLOCKCHAIN_RID",
   provider: "ATBASH_PROVIDER",
   providerModel: "ATBASH_PROVIDER_MODEL",
@@ -3481,16 +3483,27 @@ var Atbash = class _Atbash {
    * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
    * server-side replay protection windows never expire it mid-session.
    */
-  _authBearer = null;
+  // Keyed by blockchainRid so bearers for the public and private chains can
+  // coexist. The dashboard derives `authNetwork` from the BRID inside the
+  // signed envelope, so a bearer signed for chain A cannot authenticate a
+  // request routed to chain B — every chain the client talks to needs its own.
+  _authBearers = /* @__PURE__ */ new Map();
   /** Guards `logEnvironmentOnce` — hosts construct several clients. */
   static environmentLogged = false;
   constructor(privkey, options = {}) {
     this.auth = native.loadAgent(privkey);
-    this.endpoint = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/+$/, "") || DEFAULT_ENDPOINT;
+    const validated = validateJudgeEndpoint(
+      options.verifyPubKey ? {
+        policy: "self-hosted",
+        endpoint: options.endpoint ?? DEFAULT_ENDPOINT,
+        verifyPubKey: options.verifyPubKey
+      } : { endpoint: options.endpoint }
+    );
+    this.endpoint = validated.url;
     this.nodeUrls = options.nodeUrls ? [...options.nodeUrls] : DEFAULT_CHROMIA_NODE_URLS;
     this.blockchainRid = options.blockchainRid ?? native.DEFAULT_BLOCKCHAIN_RID;
     this.orgName = options.orgName;
-    this.verifyPubKey = options.verifyPubKey;
+    this.verifyPubKey = validated.verifyPubKey ?? void 0;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
     this.failClosed = options.failClosed !== false;
     this.debug = options.debug === true;
@@ -3548,8 +3561,19 @@ var Atbash = class _Atbash {
    * self-hosted endpoint's `verifyPubKey` becomes the client default.
    */
   static fromConfig(options = {}) {
+    const configuredEndpoint = resolve("judgeEndpoint") || void 0;
+    const configuredVerifyPubKey = resolve("judgeVerifyPubKey") || void 0;
+    if (!options.judge && configuredVerifyPubKey && !configuredEndpoint) {
+      throw new Error(
+        "judgeVerifyPubKey / ATBASH_JUDGE_VERIFY_PUBKEY is set but no judge endpoint is configured: set judgeEndpoint / ATBASH_ENDPOINT to the self-hosted judge"
+      );
+    }
     const validated = validateJudgeEndpoint(
-      options.judge ?? { endpoint: resolve("judgeEndpoint") || void 0 }
+      options.judge ?? (configuredVerifyPubKey && configuredEndpoint ? {
+        policy: "self-hosted",
+        endpoint: configuredEndpoint,
+        verifyPubKey: configuredVerifyPubKey
+      } : { endpoint: configuredEndpoint })
     );
     const agentKey = resolve("agentKey", options.agentKey);
     const auth = agentKey ? native.loadAgent(agentKey) : loadAgentFromFile(options.keyPath);
@@ -3597,10 +3621,11 @@ var Atbash = class _Atbash {
     return this.track("checkAgentExists", pk, async () => {
       const query = { pubkey: pk };
       if (network) query.network = network;
+      const brid = this.bridFromChainOpts(network ? { network } : void 0);
       const resp = await this.http.get(
         "/api/ai/exists",
         query,
-        this.authHeaders()
+        this.authHeaders(brid)
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp);
@@ -3955,15 +3980,15 @@ var Atbash = class _Atbash {
       () => this.riskEngineRecords("tool-calls", { limit: maxCount })
     );
   }
-  getOrgToolCalls(orgName, maxCount) {
-    return this.track(
-      "getOrgToolCalls",
-      void 0,
-      () => this.riskEngineRecords("org-tool-calls", {
-        org: orgName,
-        limit: maxCount
-      })
-    );
+  async getOrgToolCalls(orgName, maxCount) {
+    return this.track("getOrgToolCalls", void 0, async () => {
+      const brid = await this.bridForOrg(orgName);
+      return this.riskEngineRecords(
+        "org-tool-calls",
+        { org: orgName, limit: maxCount },
+        brid
+      );
+    });
   }
   getAgentToolCalls(agentPubkey, maxCount) {
     return this.track(
@@ -3993,7 +4018,12 @@ var Atbash = class _Atbash {
   }
   async getOrgTierInfo(orgName) {
     return this.track("getOrgTierInfo", void 0, async () => {
-      const raw2 = await this.riskEngineGet("org-tier-info", { org: orgName });
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "org-tier-info",
+        { org: orgName },
+        brid
+      );
       if (!isRecord(raw2)) return null;
       return {
         orgName: String(raw2.org_name ?? ""),
@@ -4005,20 +4035,24 @@ var Atbash = class _Atbash {
   }
   async getPendingHeldActions(orgName, maxCount) {
     return this.track("getPendingHeldActions", void 0, async () => {
-      const raw2 = await this.riskEngineGet("pending-held-actions", {
-        org: orgName,
-        limit: maxCount
-      });
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "pending-held-actions",
+        { org: orgName, limit: maxCount },
+        brid
+      );
       if (!Array.isArray(raw2)) return [];
       return raw2.map((item) => toHeldAction(item));
     });
   }
   async getHeldActionReviews(orgName, maxCount) {
     return this.track("getHeldActionReviews", void 0, async () => {
-      const raw2 = await this.riskEngineGet("held-action-reviews", {
-        org: orgName,
-        limit: maxCount
-      });
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "held-action-reviews",
+        { org: orgName, limit: maxCount },
+        brid
+      );
       if (!Array.isArray(raw2)) return [];
       return raw2.map(
         (item) => toHeldActionReview(item)
@@ -4029,21 +4063,25 @@ var Atbash = class _Atbash {
   async getAgentDetail(agentPubkey, options = {}) {
     return this.track("getAgentDetail", agentPubkey, async () => {
       const network = await this.resolveAgentLookupNetwork(options);
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
       return this.riskEnginePost(
         { action: "agent-detail-batch", agent: agentPubkey },
-        network
+        network,
+        brid
       );
     });
   }
   async getAgentPolicy(agentPubkey, options = {}) {
     return this.track("getAgentPolicy", agentPubkey, async () => {
       const network = await this.resolveAgentLookupNetwork(options);
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
       const raw2 = await this.riskEnginePost(
         {
           action: "agent-policy-batch",
           agent: agentPubkey
         },
-        network
+        network,
+        brid
       );
       return {
         policy: String(raw2.policy ?? ""),
@@ -4077,7 +4115,8 @@ var Atbash = class _Atbash {
     return this.track("getOrgSubscription", void 0, async () => {
       const params = { org: orgName };
       if (network) params.network = network;
-      const raw2 = await this.riskEngineGet("org-subscription", params);
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
+      const raw2 = await this.riskEngineGet("org-subscription", params, brid);
       if (!isRecord(raw2)) return null;
       return coerceOrgSubscription(raw2, orgName);
     });
@@ -4090,21 +4129,22 @@ var Atbash = class _Atbash {
    * entry (caller falls back to per-chain subscription resolution).
    */
   async getActiveNetworkForOrg(orgName) {
+    let resp;
     try {
-      const resp = await this.http.get(
+      resp = await this.http.get(
         "/api/org-network",
-        { org: orgName },
+        { org: orgName.trim() },
         this.authHeaders()
       );
-      if (resp.status !== 200) return null;
-      const data = await this.json(resp);
-      if (data?.network === "public" || data?.network === "private") {
-        return data.network;
-      }
-      return null;
-    } catch {
-      return null;
+    } catch (err) {
+      throw this.transportError(err);
+    }
+    if (resp.status !== 200) throw await this.httpError(resp);
+    const data = await this.json(resp);
+    if (data?.network === "public" || data?.network === "private") {
+      return data.network;
     }
+    return null;
   }
   /**
    * Resolve which chain an org's actions should run against. Cached
@@ -4116,10 +4156,11 @@ var Atbash = class _Atbash {
    * Defaults to the public chain when nothing else resolves.
    */
   async resolveChainForOrg(orgName) {
-    const cached = this._chainCache.get(orgName);
+    const name2 = orgName.trim();
+    const cached = this._chainCache.get(name2);
     if (cached) return cached;
-    const mapNetwork = await this.getActiveNetworkForOrg(orgName);
-    return this.resolveChainFromMap(orgName, mapNetwork);
+    const mapNetwork = await this.getActiveNetworkForOrg(name2);
+    return this.resolveChainFromMap(name2, mapNetwork);
   }
   /**
    * Resolve a chain given an already-fetched `org_networks` map result.
@@ -4135,29 +4176,38 @@ var Atbash = class _Atbash {
       this._chainCache.set(orgName, chain);
       return chain;
     }
-    try {
-      const [pubSub, privSub] = await Promise.all([
-        this.getOrgSubscription(orgName, "public").catch(() => null),
-        this.getOrgSubscription(orgName, "private").catch(() => null)
-      ]);
-      if (pubSub?.is_private_blockchain) {
-        this._chainCache.set(orgName, PRIVATE_CHAIN);
-        return PRIVATE_CHAIN;
-      }
-      if (pubSub && privSub) {
-        const chain = privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
-        this._chainCache.set(orgName, chain);
-        return chain;
-      }
-      if (pubSub) {
-        this._chainCache.set(orgName, PUBLIC_CHAIN);
-        return PUBLIC_CHAIN;
-      }
-      if (privSub?.is_private_blockchain) {
-        this._chainCache.set(orgName, PRIVATE_CHAIN);
-        return PRIVATE_CHAIN;
-      }
-    } catch {
+    const [pubRes, privRes] = await Promise.allSettled([
+      this.getOrgSubscription(orgName, "public"),
+      this.getOrgSubscription(orgName, "private")
+    ]);
+    const pubSub = pubRes.status === "fulfilled" ? pubRes.value : null;
+    const privSub = privRes.status === "fulfilled" ? privRes.value : null;
+    const failure = pubRes.status === "rejected" ? pubRes.reason : privRes.status === "rejected" ? privRes.reason : null;
+    if (pubSub?.is_private_blockchain) {
+      this._chainCache.set(orgName, PRIVATE_CHAIN);
+      return PRIVATE_CHAIN;
+    }
+    if (pubSub && privSub) {
+      const chain = privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+      this._chainCache.set(orgName, chain);
+      return chain;
+    }
+    if (pubSub) {
+      this._chainCache.set(orgName, PUBLIC_CHAIN);
+      return PUBLIC_CHAIN;
+    }
+    if (privSub?.is_private_blockchain) {
+      this._chainCache.set(orgName, PRIVATE_CHAIN);
+      return PRIVATE_CHAIN;
+    }
+    if (failure) {
+      const detail = failure instanceof Error ? failure.message : String(failure);
+      throw new AtbashAPIError(
+        failure instanceof AtbashAPIError ? failure.status : 0,
+        `could not resolve the chain for org "${orgName}": ${detail}`,
+        "",
+        this.endpoint
+      );
     }
     this._chainCache.set(orgName, PUBLIC_CHAIN);
     return PUBLIC_CHAIN;
@@ -4222,11 +4272,11 @@ var Atbash = class _Atbash {
    * for 4 minutes; refreshed after that so a long-lived client never
    * trips the server's replay window.
    */
-  getAuthBearer() {
+  getAuthBearer(brid) {
+    const chainBrid = brid ?? this.blockchainRid;
     const now = Date.now();
-    if (this._authBearer && now - this._authBearer.issuedAt < 4 * 60 * 1e3) {
-      return this._authBearer.hex;
-    }
+    const cached = this._authBearers.get(chainBrid);
+    if (cached && now - cached.issuedAt < 4 * 60 * 1e3) return cached.hex;
     const nonce = `auth-${now.toString(36)}-${randomHex(4)}`;
     const hex = native.signLogToolCall(
       nonce,
@@ -4235,21 +4285,21 @@ var Atbash = class _Atbash {
       "auth-bearer",
       "",
       this.auth.privkey,
-      this.blockchainRid
+      chainBrid
     );
-    this._authBearer = { hex, issuedAt: now };
+    this._authBearers.set(chainBrid, { hex, issuedAt: now });
     return hex;
   }
-  authHeaders() {
-    return { Authorization: `Bearer ${this.getAuthBearer()}` };
+  authHeaders(brid) {
+    return { Authorization: `Bearer ${this.getAuthBearer(brid)}` };
   }
-  async riskEngineGet(action, params) {
+  async riskEngineGet(action, params, brid) {
     let resp;
     try {
       resp = await this.http.get(
         "/api/risk-engine",
         { action, ...params },
-        this.authHeaders()
+        this.authHeaders(brid)
       );
     } catch (err) {
       throw this.transportError(err);
@@ -4257,11 +4307,11 @@ var Atbash = class _Atbash {
     if (resp.status !== 200) throw await this.httpError(resp);
     return this.json(resp);
   }
-  async riskEnginePost(body, network) {
+  async riskEnginePost(body, network, brid) {
     let resp;
     try {
       const path7 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
-      resp = await this.http.post(path7, body, this.authHeaders());
+      resp = await this.http.post(path7, body, this.authHeaders(brid));
     } catch (err) {
       throw this.transportError(err);
     }
@@ -4269,11 +4319,23 @@ var Atbash = class _Atbash {
     const data = await this.json(resp);
     return isRecord(data) ? data : {};
   }
-  async riskEngineRecords(action, params) {
-    const raw2 = await this.riskEngineGet(action, params);
+  async riskEngineRecords(action, params, brid) {
+    const raw2 = await this.riskEngineGet(action, params, brid);
     if (!Array.isArray(raw2)) return [];
     return raw2.map((item) => toToolCallRecord(item));
   }
+  /**
+   * BRID for an org — one round-trip to the map, honoring the client's chain
+   * cache. Returns undefined when the org is unknown, so the caller falls
+   * back to the client default (best-effort discovery).
+   */
+  async bridForOrg(orgName) {
+    try {
+      return (await this.resolveChainForOrg(orgName)).blockchainRid;
+    } catch {
+      return void 0;
+    }
+  }
   async raiseIfError(resp) {
     if (resp.ok) return;
     throw await this.httpError(resp);
@@ -42714,6 +42776,7 @@ async function resolveChainOptsForOrg(opts, auth) {
   if (opts?.orgName && !opts.chainOpts?.blockchainRid && auth) {
     const atbash = new Atbash(auth.privkey, {
       endpoint: opts.endpoint,
+      verifyPubKey: opts.verifyPubKey,
       orgName: opts.orgName
     });
     const resolved = await atbash.resolveChainForOrg(opts.orgName);
@@ -42753,13 +42816,15 @@ function buildSigner(auth) {
 }
 async function commitMemoryVersion(plaintext, auth, opts) {
   const score = opts?.score ?? 5;
+  const filePath = opts?.filePath ?? "";
   const key3 = await deriveMemoryKey(auth.privkey);
   const { ciphertext, nonce } = await encryptMemoryContent(plaintext, key3);
   const args = native.buildAddAgentMemoryArgs(
     auth.pubkey,
     ciphertext,
     nonce,
-    score
+    score,
+    filePath
   );
   const chainOpts = await resolveChainOptsForOrg(opts, auth);
   const client = await buildChainClient(chainOpts);
@@ -42771,7 +42836,8 @@ async function commitMemoryVersion(plaintext, auth, opts) {
         toGtxBytes(args.agent_pubkey),
         toGtxBytes(args.content_cipher),
         toGtxBytes(args.nonce),
-        args.score
+        args.score,
+        args.file_path
       ]
     },
     sigProvider
@@ -42793,6 +42859,7 @@ async function decryptRow(row, key3) {
   }
   return {
     id: parsed.id,
+    filePath: parsed.file_path,
     content,
     decryptError,
     score: parsed.score,
@@ -42801,39 +42868,52 @@ async function decryptRow(row, key3) {
     updatedAt: parsed.updated_at
   };
 }
-async function getActiveMemoryId(auth, chainOpts) {
+function paramsWithOptionalFilePath(agentPubkeyHex, filePath) {
+  const params = {
+    [native.ARG_AGENT_PUBKEY]: agentPubkeyHex
+  };
+  if (filePath !== null) {
+    params[native.ARG_FILE_PATH] = filePath;
+  }
+  return params;
+}
+async function getActiveMemoryId(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
-  const q = native.buildGetActiveMemoryIdQuery(auth.pubkey);
-  const raw2 = await client.query(native.QUERY_GET_ACTIVE_MEMORY_ID, {
-    [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex
-  });
+  const q = native.buildGetActiveMemoryIdQuery(auth.pubkey, filePath ?? null);
+  const raw2 = await client.query(
+    native.QUERY_GET_ACTIVE_MEMORY_ID,
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
+  );
   return native.parseActiveMemoryId(raw2);
 }
-async function getActiveMemory(auth, chainOpts) {
+async function getRecentAgentMemory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
   const key3 = await deriveMemoryKey(auth.privkey);
-  const q = native.buildGetAgentMemoryQuery(auth.pubkey);
-  const rows = await client.query(native.QUERY_GET_AGENT_MEMORY, {
-    [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex
-  });
+  const q = native.buildGetRecentAgentMemoryQuery(auth.pubkey, filePath ?? null);
+  const rows = await client.query(
+    native.QUERY_GET_RECENT_AGENT_MEMORY,
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
+  );
   return Promise.all((rows ?? []).map((r2) => decryptRow(r2, key3)));
 }
-async function getAllAgentMemory(auth, chainOpts) {
+async function getActiveAgentMemory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
   const key3 = await deriveMemoryKey(auth.privkey);
-  const q = native.buildGetAllAgentMemoryQuery(auth.pubkey);
-  const rows = await client.query(native.QUERY_GET_ALL_AGENT_MEMORY, {
-    [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex
-  });
+  const q = native.buildGetActiveAgentMemoryQuery(auth.pubkey, filePath ?? null);
+  const rows = await client.query(
+    native.QUERY_GET_ACTIVE_AGENT_MEMORY,
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
+  );
   return Promise.all((rows ?? []).map((r2) => decryptRow(r2, key3)));
 }
-async function getMemoryHistory(auth, chainOpts) {
+async function getMemoryHistory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
   const key3 = await deriveMemoryKey(auth.privkey);
-  const q = native.buildGetAgentMemoryHistoryQuery(auth.pubkey);
-  const rows = await client.query(native.QUERY_GET_AGENT_MEMORY_HISTORY, {
-    [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex
-  });
+  const q = native.buildGetAgentMemoryHistoryQuery(auth.pubkey, filePath ?? null);
+  const rows = await client.query(
+    native.QUERY_GET_AGENT_MEMORY_HISTORY,
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
+  );
   return Promise.all((rows ?? []).map((r2) => decryptRow(r2, key3)));
 }
 async function getMemoryById(id, auth, chainOpts) {
@@ -42846,17 +42926,21 @@ async function getMemoryById(id, auth, chainOpts) {
   });
   return decryptRow(row, key3);
 }
-async function getRollbackHistory(auth, chainOpts) {
+async function getRollbackHistory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
-  const q = native.buildGetAgentMemoryRollbackHistoryQuery(auth.pubkey);
+  const q = native.buildGetAgentMemoryRollbackHistoryQuery(
+    auth.pubkey,
+    filePath ?? null
+  );
   const raw2 = await client.query(
     native.QUERY_GET_AGENT_MEMORY_ROLLBACK_HISTORY,
-    { [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex }
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
   );
   const parsed = native.parseRollbackRows(raw2 ?? []);
   return parsed.map((r2) => ({
     fromId: r2.from_id,
     toId: r2.to_id,
+    filePath: r2.file_path,
     reason: r2.reason,
     signer: Buffer.from(r2.signer).toString("hex"),
     createdAt: r2.created_at
@@ -42924,8 +43008,7 @@ async function guardMemoryWrite(input) {
     toolNames,
     enforce = true,
     debug: debug2 = false,
-    logger: logger2,
-    memoryFilePath
+    logger: logger2
   } = input;
   const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
   if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
@@ -42961,37 +43044,35 @@ async function guardMemoryWrite(input) {
       committed: false
     };
   }
-  const isManagedMemoryFile = memoryFilePath !== void 0 && import_node_path4.default.resolve(memEntry.key) === import_node_path4.default.resolve(memoryFilePath);
-  if (isManagedMemoryFile) {
-    commitMemoryVersion(memEntry.value, auth, {
-      score: scanResult.score,
-      orgName,
-      endpoint
-    }).catch((err) => {
-      const reason = err instanceof Error ? err.message : String(err);
-      logger2?.warn?.("[atbash] memory commit to chain failed", {
-        path: memEntry.key,
-        reason
-      });
+  const filePath = import_node_path4.default.basename(memEntry.key);
+  commitMemoryVersion(memEntry.value, auth, {
+    score: scanResult.score,
+    filePath,
+    orgName,
+    endpoint,
+    verifyPubKey
+  }).catch((err) => {
+    const reason = err instanceof Error ? err.message : String(err);
+    logger2?.warn?.("[atbash] memory commit to chain failed", {
+      path: memEntry.key,
+      filePath,
+      reason
     });
-  } else {
-    logger2?.info?.(
-      "[atbash] scanned but not committed \u2014 not the managed memory file",
-      {
-        path: memEntry.key,
-        memoryFilePath: memoryFilePath ?? "(not configured)"
-      }
-    );
-  }
+  });
   logger2?.info?.(
     scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
-    { path: memEntry.key, score: scanResult.score, reason: scanResult.reason }
+    {
+      path: memEntry.key,
+      filePath,
+      score: scanResult.score,
+      reason: scanResult.reason
+    }
   );
   return {
     handled: true,
     decision: { allow: true },
     scanResult,
-    committed: isManagedMemoryFile
+    committed: true
   };
 }
 
@@ -43231,9 +43312,7 @@ var MemoryGuardManager = class {
       toolNames: this.opts.memoryWriteToolNames,
       enforce: this.enforce,
       debug: this.opts.debug,
-      logger: guardLogger,
-      // Only this file may reach the single, path-less chain memory slot.
-      memoryFilePath: this.memoryFilePath
+      logger: guardLogger
     });
     return this.mapGuardResult(guard);
   }
@@ -43534,13 +43613,13 @@ function diffMemorySnapshots(before, after) {
   encryptedLength,
   flushTelemetry,
   generateKeypair,
-  getActiveMemory,
+  getActiveAgentMemory,
   getActiveMemoryId,
-  getAllAgentMemory,
   getConfigDir,
   getConfigPath,
   getMemoryById,
   getMemoryHistory,
+  getRecentAgentMemory,
   getRollbackHistory,
   guardMemoryWrite,
   isEnvelope,