@atbash/sdk 0.10.9-dev.0 → 0.10.11-dev.0

package/dist/index.mjs

@@ -3021,8 +3021,8 @@ var HttpClient = class {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.timeoutMs = timeoutMs;
   }
-  buildUrl(path6, query) {
-    const url = new URL(this.baseUrl + path6);
+  buildUrl(path7, query) {
+    const url = new URL(this.baseUrl + path7);
     if (query) {
       for (const [k, v] of Object.entries(query)) {
         if (v !== void 0 && v !== null && v !== "") {
@@ -3032,14 +3032,14 @@ var HttpClient = class {
     }
     return url.toString();
   }
-  async get(path6, query, headers) {
-    return this.fetch(this.buildUrl(path6, query), {
+  async get(path7, query, headers) {
+    return this.fetch(this.buildUrl(path7, query), {
       method: "GET",
       ...headers && { headers }
     });
   }
-  async post(path6, body, headers) {
-    return this.fetch(this.buildUrl(path6), {
+  async post(path7, body, headers) {
+    return this.fetch(this.buildUrl(path7), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...headers },
       body: JSON.stringify(body)
@@ -3216,6 +3216,10 @@ var callCounter = null;
 var durationHistogram = null;
 var defaultSource = "sdk";
 function isTelemetryOptedOut() {
+  const disabled = process.env.ATBASH_TELEMETRY_DISABLED?.trim().toLowerCase();
+  if (disabled && ["1", "true", "yes", "on"].includes(disabled)) {
+    return true;
+  }
   try {
     const home2 = process.env.HOME || homedir2() || "";
     const filePath = join2(home2, ".config", "atbash", "telemetry.json");
@@ -3236,14 +3240,14 @@ function setupTelemetry(config2) {
   if (!config2.enabled) return;
   if (meterProvider) return;
   if (isTelemetryOptedOut()) return;
+  if (!config2.endpoint || !config2.getAuthHeaders) return;
+  if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(config2.endpoint)) return;
   defaultSource = config2.source ?? "sdk";
-  const apiKey = process.env.HONEYCOMB_API_KEY ?? native.HONEYCOMB_KEY;
-  if (!apiKey) return;
+  const proxyUrl = `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`;
+  const getAuthHeaders = config2.getAuthHeaders;
   const exporter = new OTLPMetricExporter({
-    url: "https://api.honeycomb.io/v1/metrics",
-    headers: {
-      "x-honeycomb-team": apiKey
-    }
+    url: proxyUrl,
+    headers: async () => getAuthHeaders()
   });
   const reader = new PeriodicExportingMetricReader({
     exporter,
@@ -3381,6 +3385,16 @@ var Atbash = class _Atbash {
    * calls don't re-hit the dashboard. Cleared by `clearChainCache()`.
    */
   _chainCache = /* @__PURE__ */ new Map();
+  /**
+   * Short-TTL cache for `/api/ai/exists`. The `registered` field is
+   * monotonic (once true, stays true), so most calls in a burst re-fetch
+   * data that hasn't changed. The `org_encryption_pubkey` field CAN change
+   * — an org toggling encryption mid-session — so the TTL is deliberately
+   * short (see `AGENT_EXISTS_TTL_MS`). Keyed by (pubkey, network) so
+   * cross-agent / cross-network calls don't collide.
+   */
+  _agentExistsCache = null;
+  static AGENT_EXISTS_TTL_MS = 5e3;
   /**
    * Cached bearer token for risk-engine / insurance read calls. Built
    * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
@@ -3408,6 +3422,16 @@ var Atbash = class _Atbash {
         verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
+    try {
+      setupTelemetry({
+        enabled: true,
+        source: "sdk",
+        endpoint: this.endpoint,
+        getAuthHeaders: () => this.authHeaders()
+      });
+    } catch (err) {
+      this.logger.warn?.("[atbash] telemetry setup failed \u2014 continuing without metrics", { error: String(err) });
+    }
   }
   /**
    * Say which environment this build talks to, once per process.
@@ -3480,9 +3504,18 @@ var Atbash = class _Atbash {
    */
   async checkAgentExists(pubkey, opts) {
     const pk = pubkey ?? this.auth.pubkey;
+    const network = opts?.network;
+    const now = Date.now();
+    const cached = this._agentExistsCache;
+    if (cached && cached.pubkey === pk && cached.network === network && cached.expiresAt > now) {
+      if (pk === this.auth.pubkey) {
+        this._orgKeyFromChain = cached.orgKey;
+      }
+      return cached.registered;
+    }
     return this.track("checkAgentExists", pk, async () => {
       const query = { pubkey: pk };
-      if (opts?.network) query.network = opts.network;
+      if (network) query.network = network;
       const resp = await this.http.get(
         "/api/ai/exists",
         query,
@@ -3490,11 +3523,21 @@ var Atbash = class _Atbash {
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp);
+      const registered = Boolean(data?.registered);
+      const orgKey = typeof data?.org_encryption_pubkey === "string" && data.org_encryption_pubkey ? data.org_encryption_pubkey : null;
+      if (registered) {
+        this._agentExistsCache = {
+          pubkey: pk,
+          network,
+          expiresAt: Date.now() + _Atbash.AGENT_EXISTS_TTL_MS,
+          registered,
+          orgKey
+        };
+      }
       if (pk === this.auth.pubkey) {
-        const key3 = data?.org_encryption_pubkey;
-        this._orgKeyFromChain = typeof key3 === "string" && key3 ? key3 : null;
+        this._orgKeyFromChain = orgKey;
       }
-      return Boolean(data?.registered);
+      return registered;
     });
   }
   /* ── log_tool_call (sign-only) ─────────────────────────────────────────── */
@@ -3575,12 +3618,19 @@ var Atbash = class _Atbash {
     }
     let chainOpts = options.chainOpts;
     if (options.orgName) {
-      const mapNetwork = await this.getActiveNetworkForOrg(options.orgName);
-      if (mapNetwork) {
-        chainOpts = { network: mapNetwork };
-      } else if (!chainOpts?.blockchainRid) {
-        const resolved = await this.resolveChainFromMap(options.orgName, null);
-        chainOpts = { ...chainOpts, network: resolved.network };
+      const cached = this._chainCache.get(options.orgName);
+      if (cached) {
+        chainOpts = { network: cached.network };
+      } else {
+        const mapNetwork = await this.getActiveNetworkForOrg(options.orgName);
+        if (mapNetwork) {
+          const chain = mapNetwork === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+          this._chainCache.set(options.orgName, chain);
+          chainOpts = { network: mapNetwork };
+        } else if (!chainOpts?.blockchainRid) {
+          const resolved = await this.resolveChainFromMap(options.orgName, null);
+          chainOpts = { ...chainOpts, network: resolved.network };
+        }
       }
     }
     const brid = this.bridFromChainOpts(chainOpts);
@@ -3895,19 +3945,25 @@ var Atbash = class _Atbash {
     });
   }
   /* ── risk-engine batched (action-dispatched POST) ──────────────────────── */
-  getAgentDetail(agentPubkey) {
-    return this.track(
-      "getAgentDetail",
-      agentPubkey,
-      () => this.riskEnginePost({ action: "agent-detail-batch", agent: agentPubkey })
-    );
+  async getAgentDetail(agentPubkey, options = {}) {
+    return this.track("getAgentDetail", agentPubkey, async () => {
+      const network = await this.resolveAgentLookupNetwork(options);
+      return this.riskEnginePost(
+        { action: "agent-detail-batch", agent: agentPubkey },
+        network
+      );
+    });
   }
-  async getAgentPolicy(agentPubkey) {
+  async getAgentPolicy(agentPubkey, options = {}) {
     return this.track("getAgentPolicy", agentPubkey, async () => {
-      const raw2 = await this.riskEnginePost({
-        action: "agent-policy-batch",
-        agent: agentPubkey
-      });
+      const network = await this.resolveAgentLookupNetwork(options);
+      const raw2 = await this.riskEnginePost(
+        {
+          action: "agent-policy-batch",
+          agent: agentPubkey
+        },
+        network
+      );
       return {
         policy: String(raw2.policy ?? ""),
         isJailed: Boolean(raw2.is_jailed),
@@ -4029,6 +4085,10 @@ var Atbash = class _Atbash {
   clearChainCache() {
     this._chainCache.clear();
   }
+  /** Drop the short-TTL `/api/ai/exists` cache. Useful in tests. */
+  clearAgentExistsCache() {
+    this._agentExistsCache = null;
+  }
   /* ── internals ─────────────────────────────────────────────────────────── */
   /**
    * Wrap an SDK method body in telemetry — records the call at start
@@ -4060,6 +4120,20 @@ var Atbash = class _Atbash {
     if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
     return this.blockchainRid;
   }
+  /**
+   * Resolve the dashboard chain used by agent metadata/policy reads.
+   * Explicit per-call network overrides win; otherwise use the supplied org
+   * or the client's configured default org. A custom BRID is intentionally
+   * left untouched because it cannot be represented by the dashboard's
+   * public/private query selector.
+   */
+  async resolveAgentLookupNetwork(options) {
+    if (options.chainOpts?.network) return options.chainOpts.network;
+    if (options.chainOpts?.blockchainRid) return void 0;
+    const orgName = options.orgName ?? this.orgName;
+    if (!orgName) return void 0;
+    return (await this.resolveChainForOrg(orgName)).network;
+  }
   /**
    * Get-or-create a Bearer token for dashboard reads. The token is a
    * signed `log_tool_call` op (locally signed, never submitted) — the
@@ -4102,10 +4176,11 @@ var Atbash = class _Atbash {
     if (resp.status !== 200) throw await this.httpError(resp);
     return this.json(resp);
   }
-  async riskEnginePost(body) {
+  async riskEnginePost(body, network) {
     let resp;
     try {
-      resp = await this.http.post("/api/risk-engine", body, this.authHeaders());
+      const path7 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
+      resp = await this.http.post(path7, body, this.authHeaders());
     } catch (err) {
       throw this.transportError(err);
     }
@@ -4378,24 +4453,29 @@ async function scanMemory(entry, auth, opts) {
     toolArgsJson: opts?.toolArgsJson ?? JSON.stringify({ key: entry.key, source: entry.source }),
     mode: "memory-scan"
   });
-  const knownAction = result.actionType === "allow" || result.actionType === "block" || result.actionType === "hold_for_user_confirm";
-  const missingVerdict = result.verdict === "No verdict" && result.status !== "logged";
-  const unknownAction = result.actionType !== "" && !knownAction;
-  if (missingVerdict || unknownAction) {
-    return {
-      safe: false,
-      verdict: "red",
-      reason: unknownAction ? `judge returned unrecognised action_type "${result.actionType}"` : "judge returned no verdict",
-      confidence: result.confidence,
-      score: native.defaultScoreForVerdict("red"),
-      toolCallId: result.toolCallId
-    };
+  if (result.verdict === "No verdict" && result.status !== "logged") {
+    throw new Error(
+      `memory scan: judge returned no verdict without an audit-tier marker (status: ${result.status || "absent"})`
+    );
   }
-  const verdict = native.mapVerdict(
-    result.actionType,
+  const KNOWN_ACTIONS = ["allow", "block", "hold_for_user_confirm"];
+  const action = result.actionType.trim().toLowerCase();
+  if (result.verdict !== "No verdict" && !KNOWN_ACTIONS.includes(action)) {
+    throw new Error(
+      `memory scan: unrecognized action_type from judge (${result.actionType || "absent"})`
+    );
+  }
+  const mapped = native.mapVerdict(
+    action,
     result.confidence,
     threshold
   );
+  let verdict = mapped;
+  if (result.verdict === "BLOCK") {
+    verdict = "red";
+  } else if (result.verdict === "HOLD" && mapped === "green") {
+    verdict = "yellow";
+  }
   const parsed = native.parseScoreFromReason(result.reason);
   const score = result.score ?? parsed.score ?? native.defaultScoreForVerdict(verdict);
   return {
@@ -9301,8 +9381,8 @@ Reporter$3.prototype.wrapResult = function wrapResult(result) {
     errors: state2.errors
   };
 };
-function ReporterError$1(path6, msg) {
-  this.path = path6;
+function ReporterError$1(path7, msg) {
+  this.path = path7;
   this.rethrow(msg);
 }
 inherits$v(ReporterError$1, Error);
@@ -29523,8 +29603,8 @@ Reporter.prototype.wrapResult = function wrapResult2(result) {
     errors: state2.errors
   };
 };
-function ReporterError(path6, msg) {
-  this.path = path6;
+function ReporterError(path7, msg) {
+  this.path = path7;
   this.rethrow(msg);
 }
 inherits(ReporterError, Error);
@@ -32554,8 +32634,8 @@ var parseUtil = {};
   const errors_js_12 = errors$3;
   const en_js_12 = __importDefault2(en);
   const makeIssue = (params) => {
-    const { data, path: path6, errorMaps, issueData } = params;
-    const fullPath = [...path6, ...issueData.path || []];
+    const { data, path: path7, errorMaps, issueData } = params;
+    const fullPath = [...path7, ...issueData.path || []];
     const fullIssue = {
       ...issueData,
       path: fullPath
@@ -32692,11 +32772,11 @@ var errorUtil_js_1 = errorUtil$1;
 var parseUtil_js_1 = parseUtil;
 var util_js_1 = util;
 var ParseInputLazyPath = class {
-  constructor(parent, value, path6, key3) {
+  constructor(parent, value, path7, key3) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path6;
+    this._path = path7;
     this._key = key3;
   }
   get path() {
@@ -39602,21 +39682,21 @@ function createTimeoutController(timeout) {
   const timeoutId = setTimeout(() => controller.abort(timeoutError), timeout);
   return { controller, timeoutId };
 }
-function handleRequest(method, path6, endpoint, timeout, postObject) {
+function handleRequest(method, path7, endpoint, timeout, postObject) {
   return __awaiter$2(this, void 0, void 0, function* () {
     if (method == enums_1$2.Method.GET) {
-      return yield get(path6, endpoint, timeout);
+      return yield get(path7, endpoint, timeout);
     } else {
-      return yield post(path6, endpoint, timeout, postObject);
+      return yield post(path7, endpoint, timeout, postObject);
     }
   });
 }
-function get(path6, endpoint, timeout) {
+function get(path7, endpoint, timeout) {
   return __awaiter$2(this, void 0, void 0, function* () {
-    logger.debug(`GET URL ${new URL(path6, endpoint).href}`);
+    logger.debug(`GET URL ${new URL(path7, endpoint).href}`);
     try {
       const { controller, timeoutId } = createTimeoutController(timeout);
-      const response = yield fetch(new URL(path6, endpoint).href, {
+      const response = yield fetch(new URL(path7, endpoint).href, {
         signal: controller === null || controller === void 0 ? void 0 : controller.signal
       });
       if (timeoutId)
@@ -39654,9 +39734,9 @@ function constructBufferResponseBody(response) {
     return responseText ? responseText : response.statusText;
   });
 }
-function post(path6, endpoint, timeout, requestBody) {
+function post(path7, endpoint, timeout, requestBody) {
   return __awaiter$2(this, void 0, void 0, function* () {
-    logger.debug(`POST URL ${new URL(path6, endpoint).href}`);
+    logger.debug(`POST URL ${new URL(path7, endpoint).href}`);
     logger.debug(`POST body ${JSON.stringify(requestBody)}`);
     if (buffer_1.Buffer.isBuffer(requestBody)) {
       try {
@@ -39670,7 +39750,7 @@ function post(path6, endpoint, timeout, requestBody) {
           },
           signal: controller === null || controller === void 0 ? void 0 : controller.signal
         };
-        const response = yield fetch(new URL(path6, endpoint).href, requestOptions);
+        const response = yield fetch(new URL(path7, endpoint).href, requestOptions);
         if (timeoutId)
           clearTimeout(timeoutId);
         const transactionTimestamp = response.headers.get("X-Transaction-Timestamp");
@@ -39681,7 +39761,7 @@ function post(path6, endpoint, timeout, requestBody) {
     } else {
       try {
         const { controller, timeoutId } = createTimeoutController(timeout);
-        const response = yield fetch(new URL(path6, endpoint).href, {
+        const response = yield fetch(new URL(path7, endpoint).href, {
           method: "post",
           body: JSON.stringify(requestBody),
           headers: {
@@ -39861,10 +39941,10 @@ function requireFailoverStrategies() {
       }
     }
     function abortOnError(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path6, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path7, config: config2, postObject, timeoutOverride }) {
         return yield retryRequest({
           method,
-          path: path6,
+          path: path7,
           config: config2,
           postObject,
           timeoutOverride,
@@ -39875,10 +39955,10 @@ function requireFailoverStrategies() {
       });
     }
     function tryNextOnError(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path6, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path7, config: config2, postObject, timeoutOverride }) {
         return yield retryRequest({
           method,
-          path: path6,
+          path: path7,
           config: config2,
           postObject,
           timeoutOverride,
@@ -39894,7 +39974,7 @@ function requireFailoverStrategies() {
       return endpointPoolLength - (endpointPoolLength - 1) / 3;
     }
     function queryMajority(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path6, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path7, config: config2, postObject, timeoutOverride }) {
         var _b;
         const bftMajorityThreshold = calculateBftMajorityThreshold(config2.endpointPool.length);
         const failureThreshold = config2.endpointPool.length - bftMajorityThreshold + 1;
@@ -39905,7 +39985,7 @@ function requireFailoverStrategies() {
         const promises = availableNodes.map((node2) => __awaiter2(this, void 0, void 0, function* () {
           try {
             const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-            const response = yield (0, httpUtil_1.handleRequest)(method, path6, node2.url, requestTimeout, postObject);
+            const response = yield (0, httpUtil_1.handleRequest)(method, path7, node2.url, requestTimeout, postObject);
             const { statusCode } = response;
             if (statusCode && (0, http_utils_1.isSuccessfulStatusCode)(statusCode)) {
               outcomes.push({ type: "SUCCESS", result: response });
@@ -39952,7 +40032,7 @@ function requireFailoverStrategies() {
       });
     }
     function singleEndpoint(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path6, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path7, config: config2, postObject, timeoutOverride }) {
         let statusCode = null;
         let rspBody = null;
         let error4 = null;
@@ -39963,7 +40043,7 @@ function requireFailoverStrategies() {
         }
         for (let attempt = 0; attempt < config2.attemptsPerEndpoint; attempt++) {
           const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-          const response = yield (0, httpUtil_1.handleRequest)(method, path6, endpoint.url, requestTimeout, postObject);
+          const response = yield (0, httpUtil_1.handleRequest)(method, path7, endpoint.url, requestTimeout, postObject);
           if (response) {
             ({ error: error4, statusCode, rspBody, transactionTimestamp } = response);
           }
@@ -39978,7 +40058,7 @@ function requireFailoverStrategies() {
       });
     }
     function retryRequest(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path6, config: config2, postObject, useNextNodeOnError, recoveryThreshold, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path7, config: config2, postObject, useNextNodeOnError, recoveryThreshold, timeoutOverride }) {
         var _b, _c, _d;
         let statusCode = null;
         let rspBody = null;
@@ -39989,7 +40069,7 @@ function requireFailoverStrategies() {
         for (const node2 of availableNodes) {
           for (let attempt = 0; attempt < config2.attemptsPerEndpoint; attempt++) {
             const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-            const response = yield (0, httpUtil_1.handleRequest)(method, path6, node2.url, requestTimeout, postObject);
+            const response = yield (0, httpUtil_1.handleRequest)(method, path7, node2.url, requestTimeout, postObject);
             error4 = (_b = response === null || response === void 0 ? void 0 : response.error) !== null && _b !== void 0 ? _b : null;
             statusCode = (_c = response === null || response === void 0 ? void 0 : response.statusCode) !== null && _c !== void 0 ? _c : null;
             rspBody = (_d = response === null || response === void 0 ? void 0 : response.rspBody) !== null && _d !== void 0 ? _d : null;
@@ -40132,19 +40212,19 @@ function requireRequestWithFailoverStrategy() {
   const enums_12 = enums;
   const failoverStrategies_1 = requireFailoverStrategies();
   function requestWithFailoverStrategy$1(method_1, path_1, config_1, postObject_1) {
-    return __awaiter2(this, arguments, void 0, function* (method, path6, config2, postObject, forceSingleEndpoint = false, timeoutOverride) {
+    return __awaiter2(this, arguments, void 0, function* (method, path7, config2, postObject, forceSingleEndpoint = false, timeoutOverride) {
       switch (config2.failoverStrategy) {
         case enums_12.FailoverStrategy.AbortOnError:
-          return yield (0, failoverStrategies_1.abortOnError)({ method, path: path6, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.abortOnError)({ method, path: path7, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.TryNextOnError:
-          return yield (0, failoverStrategies_1.tryNextOnError)({ method, path: path6, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.tryNextOnError)({ method, path: path7, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.SingleEndpoint:
-          return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path6, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path7, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.QueryMajority:
           if (forceSingleEndpoint) {
-            return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path6, config: config2, postObject, timeoutOverride });
+            return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path7, config: config2, postObject, timeoutOverride });
           }
-          return yield (0, failoverStrategies_1.queryMajority)({ method, path: path6, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.queryMajority)({ method, path: path7, config: config2, postObject, timeoutOverride });
         default:
           throw new Error(`Unsupported failover strategy: ${config2.failoverStrategy}`);
       }
@@ -41343,7 +41423,7 @@ var networkSettings = {};
     const restNetworkSettingsValidationContext = RestNetworkSettingsSchema.safeParse(networkSettings2);
     if ("error" in restNetworkSettingsValidationContext) {
       const { error: { issues } = {} } = restNetworkSettingsValidationContext;
-      const errorMessage2 = issues === null || issues === void 0 ? void 0 : issues.map(({ message, path: path6 }) => `${path6[0]}: ${message}`).join(", ");
+      const errorMessage2 = issues === null || issues === void 0 ? void 0 : issues.map(({ message, path: path7 }) => `${path7[0]}: ${message}`).join(", ");
       if (throwOnError) {
         throw new Error(errorMessage2);
       }
@@ -42725,6 +42805,7 @@ function classifyMemoryWrite(event, ctx, opts = {}) {
 }
 
 // src-ts/memory/guard.ts
+import path3 from "path";
 function emitDebugProbe(event, ctx, memEntry, logger2) {
   if (!logger2?.info) return;
   const ev = event ?? {};
@@ -42761,7 +42842,8 @@ async function guardMemoryWrite(input) {
     toolNames,
     enforce = true,
     debug: debug2 = false,
-    logger: logger2
+    logger: logger2,
+    memoryFilePath
   } = input;
   const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
   if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
@@ -42797,17 +42879,28 @@ async function guardMemoryWrite(input) {
       committed: false
     };
   }
-  commitMemoryVersion(memEntry.value, auth, {
-    score: scanResult.score,
-    orgName,
-    endpoint
-  }).catch((err) => {
-    const reason = err instanceof Error ? err.message : String(err);
-    logger2?.warn?.("[atbash] memory commit to chain failed", {
-      path: memEntry.key,
-      reason
+  const isManagedMemoryFile = memoryFilePath !== void 0 && path3.resolve(memEntry.key) === path3.resolve(memoryFilePath);
+  if (isManagedMemoryFile) {
+    commitMemoryVersion(memEntry.value, auth, {
+      score: scanResult.score,
+      orgName,
+      endpoint
+    }).catch((err) => {
+      const reason = err instanceof Error ? err.message : String(err);
+      logger2?.warn?.("[atbash] memory commit to chain failed", {
+        path: memEntry.key,
+        reason
+      });
     });
-  });
+  } else {
+    logger2?.info?.(
+      "[atbash] scanned but not committed \u2014 not the managed memory file",
+      {
+        path: memEntry.key,
+        memoryFilePath: memoryFilePath ?? "(not configured)"
+      }
+    );
+  }
   logger2?.info?.(
     scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
     { path: memEntry.key, score: scanResult.score, reason: scanResult.reason }
@@ -42816,7 +42909,7 @@ async function guardMemoryWrite(input) {
     handled: true,
     decision: { allow: true },
     scanResult,
-    committed: true
+    committed: isManagedMemoryFile
   };
 }
 
@@ -42835,26 +42928,26 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
   const now = Date.now();
   const withinTtl = !opts.force && now - pointer.checkedAt < ttl;
   if (withinTtl) {
-    return { drifted: false, pointer };
+    return { drifted: false, checked: false, pointer };
   }
   const currentId = await getActiveMemoryId(auth, opts.chainOpts);
   const nextPointer = { activeId: currentId, checkedAt: now };
   if (currentId === pointer.activeId) {
-    return { drifted: false, pointer: nextPointer };
+    return { drifted: false, checked: true, pointer: nextPointer };
   }
   if (currentId === null) {
-    return { drifted: true, current: null, pointer: nextPointer };
+    return { drifted: true, checked: true, current: null, pointer: nextPointer };
   }
   const row = await getMemoryById(currentId, auth, opts.chainOpts);
   if (row.decryptError) {
     throw new MemoryIntegrityError(currentId, row.decryptError);
   }
-  return { drifted: true, current: row, pointer: nextPointer };
+  return { drifted: true, checked: true, current: row, pointer: nextPointer };
 }
 
 // src-ts/memory/pointer-store.ts
 import { promises as fs } from "fs";
-import path3 from "path";
+import path4 from "path";
 var EMPTY = { version: 1, agents: {} };
 var PointerStore = class {
   constructor(filePath) {
@@ -42896,19 +42989,19 @@ var PointerStore = class {
     this.cache = { ...EMPTY, agents: {} };
   }
   async persist(file) {
-    await fs.mkdir(path3.dirname(this.filePath), { recursive: true });
+    await fs.mkdir(path4.dirname(this.filePath), { recursive: true });
     const tmp = `${this.filePath}.${process.pid}.tmp`;
     await fs.writeFile(tmp, JSON.stringify(file, null, 2), "utf8");
     await fs.rename(tmp, this.filePath);
   }
 };
 function defaultPointerPath(workspaceDir = process.cwd()) {
-  return path3.join(workspaceDir, ".atbash", "memory-pointer.json");
+  return path4.join(workspaceDir, ".atbash", "memory-pointer.json");
 }
 
 // src-ts/memory/file-logger.ts
 import { promises as fs2 } from "fs";
-import path4 from "path";
+import path5 from "path";
 function formatMeta(meta) {
   if (!meta || Object.keys(meta).length === 0) return "";
   try {
@@ -42920,7 +43013,7 @@ function formatMeta(meta) {
 function createFileLogger(filePath, upstream) {
   let queue = Promise.resolve();
   async function ensureDir() {
-    await fs2.mkdir(path4.dirname(filePath), { recursive: true });
+    await fs2.mkdir(path5.dirname(filePath), { recursive: true });
   }
   function append(level, message, meta) {
     const line = `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${message}${formatMeta(meta)}
@@ -42940,7 +43033,7 @@ function createFileLogger(filePath, upstream) {
   };
 }
 function defaultPluginLogPath(workspaceDir = process.cwd()) {
-  return path4.join(workspaceDir, ".atbash", "plugin.log");
+  return path5.join(workspaceDir, ".atbash", "plugin.log");
 }
 
 // src-ts/memory/read-classifier.ts
@@ -42955,13 +43048,13 @@ function classifyMemoryRead(event, ctx, opts = {}) {
 
 // src-ts/memory/guard-manager.ts
 import { promises as fs3 } from "fs";
-import path5 from "path";
+import path6 from "path";
 var DEFAULT_SYNC_TTL_MS = 3e4;
 var MemoryGuardManager = class {
   constructor(opts) {
     this.opts = opts;
     const workspaceDir = opts.workspaceDir;
-    this.memoryFilePath = opts.memoryFilePath ?? path5.join(workspaceDir, "MEMORY.md");
+    this.memoryFilePath = opts.memoryFilePath ?? path6.join(workspaceDir, "MEMORY.md");
     this.pointerStore = new PointerStore(opts.pointerFilePath ?? defaultPointerPath(workspaceDir));
     this.logger = createFileLogger(
       opts.logFilePath ?? defaultPluginLogPath(workspaceDir),
@@ -42991,7 +43084,11 @@ var MemoryGuardManager = class {
   async runBootProbe() {
     try {
       const seed = { activeId: null, checkedAt: 0 };
-      const result = await syncLocalMemory(this.opts.auth, seed, { ttlMs: 0, force: true });
+      const result = await syncLocalMemory(this.opts.auth, seed, {
+        ttlMs: 0,
+        force: true,
+        chainOpts: this.opts.chainOpts
+      });
       if (!result.drifted && result.pointer.activeId == null) {
         this.logger.info(
           `[atbash] no active memory on chain for agent=${this.agentPubkeyHex.slice(0, 16)}\u2026 org=${this.opts.orgName ?? "(none)"} \u2014 either the agent isn't registered on this chain or hasn't written any memory. Sync will remain a no-op until a write lands.`
@@ -43023,15 +43120,19 @@ var MemoryGuardManager = class {
     }
   }
   /**
-   * Returns a `HookDecision` when the event is a memory read or write
-   * (host returns it verbatim to its runtime). Returns `null` when the
-   * event isn't memory-related — host falls through to its own audit.
+   * Returns a `HookDecision` when the guard reached a decision about this event.
+   * Returns `null` when it did not — either the event isn't memory-related, or it
+   * is but the guard could not check it. In both cases the host falls through to
+   * its own audit.
+   *
+   * A returned decision carries `audited` (see `HookDecision`). Only
+   * `{ allow: true, audited: true }` means "checked and cleared"; anything else
+   * that allows is a call the host still needs to judge.
    */
   async handleBeforeToolCall(event, ctx) {
     if (classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier)) {
       this.logger.info("[atbash] memory read intercepted \u2014 running sync check");
-      const readDecision = await this.handleMemoryRead();
-      return readDecision ?? { allow: true };
+      return await this.handleMemoryRead(event, ctx);
     }
     const guardLogger = {
       info: (msg, meta) => this.logger.info(msg, meta && typeof meta === "object" ? meta : void 0),
@@ -43048,7 +43149,9 @@ var MemoryGuardManager = class {
       toolNames: this.opts.memoryWriteToolNames,
       enforce: this.enforce,
       debug: this.opts.debug,
-      logger: guardLogger
+      logger: guardLogger,
+      // Only this file may reach the single, path-less chain memory slot.
+      memoryFilePath: this.memoryFilePath
     });
     return this.mapGuardResult(guard);
   }
@@ -43066,30 +43169,81 @@ var MemoryGuardManager = class {
         block: true,
         blockReason: d.reason ?? "",
         allow: false,
-        reason: d.reason
+        reason: d.reason,
+        // A block IS a decision — the most thoroughly checked one the guard
+        // makes. Without this a host following the documented `!audited ->
+        // judge it yourself` rule would re-judge its way past a red scan.
+        audited: true,
+        ...sr2 ? { verdict: sr2.verdict } : {}
       };
     }
     this.logger.info(
       `[atbash] guardMemoryWrite ALLOWED \u2014 verdict=${verdict} score=${score} committed=${guard.committed === true}`
     );
-    return { allow: true };
+    if (sr2 === void 0) {
+      return { allow: true, audited: false, reason: "memory scan did not run (observe mode)" };
+    }
+    if (sr2.verdict !== "green") {
+      return {
+        allow: true,
+        audited: false,
+        verdict: sr2.verdict,
+        reason: `memory scan returned ${sr2.verdict} but this guard is not enforcing it`
+      };
+    }
+    return { allow: true, audited: true, verdict: sr2.verdict };
   }
-  async handleMemoryRead() {
+  /**
+   * Whether the pointer state this manager tracks actually describes the file
+   * this call is about to read.
+   *
+   * The classifier fires on nine patterns — including the bare tokens
+   * `"memory/"`, `"CLAUDE.md"` and `"AGENTS.md"` — but the sync path only ever
+   * reads, refreshes, or vouches for `this.memoryFilePath`. Without this check a
+   * read of `/repo/CLAUDE.md` (or any path merely containing `memory/`) would
+   * receive an `audited: true` for a file the guard never opened.
+   *
+   * Conservative on purpose: every path-shaped value found must resolve to the
+   * managed file. If none is found, or any one differs, the answer is no. That
+   * also covers events carrying two different path keys, where the classifier
+   * and the host could otherwise disagree about which one is authoritative.
+   */
+  vouchesForTarget(event, ctx) {
+    const KEYS = ["path", "file_path", "filePath", "notebook_path", "notebookPath", "target"];
+    const found = [];
+    for (const src of [event, ctx]) {
+      for (const bag of [src, src?.params]) {
+        if (!bag || typeof bag !== "object") continue;
+        const rec = bag;
+        for (const k of KEYS) {
+          if (typeof rec[k] === "string" && rec[k]) found.push(rec[k]);
+        }
+      }
+    }
+    if (found.length === 0) return false;
+    const managed = path6.resolve(this.memoryFilePath);
+    return found.every((p) => path6.resolve(p) === managed);
+  }
+  async handleMemoryRead(event, ctx) {
     const pointer = await this.pointerStore.get(this.agentPubkeyHex);
     let result;
     try {
-      result = await syncLocalMemory(this.opts.auth, pointer, { ttlMs: this.ttlMs });
+      result = await syncLocalMemory(this.opts.auth, pointer, {
+        ttlMs: this.ttlMs,
+        chainOpts: this.opts.chainOpts
+      });
     } catch (err) {
       if (err instanceof MemoryIntegrityError) {
         const reason = `Memory integrity check failed on id ${err.id} \u2014 read blocked.`;
         this.logger.warn("[atbash] MEMORY INTEGRITY FAILURE", { id: err.id, error: err.message });
         if (!this.enforce) return null;
-        return { block: true, blockReason: reason, allow: false, reason };
+        return { block: true, blockReason: reason, allow: false, reason, audited: true };
       }
       const msg = err instanceof Error ? err.message : String(err);
       this.logger.warn("[atbash] memory sync failed (serving local copy)", { error: msg });
       return null;
     }
+    let onDiskIsCurrent = result.checked;
     if (result.drifted) {
       const fresh = result.current;
       if (fresh) {
@@ -43097,7 +43251,7 @@ var MemoryGuardManager = class {
           const reason = `Rolled-back memory version #${fresh.id} scored ${fresh.score} (below threshold ${this.rollbackMinScore}) \u2014 read blocked.`;
           this.logger.warn("[atbash] blocking read on low-score rollback", { id: fresh.id, score: fresh.score });
           if (!this.enforce) return null;
-          return { block: true, blockReason: reason, allow: false, reason };
+          return { block: true, blockReason: reason, allow: false, reason, audited: true };
         }
         this.logger.info("[atbash] memory drift detected \u2014 refreshing local file", {
           id: fresh.id,
@@ -43108,16 +43262,26 @@ var MemoryGuardManager = class {
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           this.logger.warn("[atbash] failed to write refreshed memory (serving old)", { error: msg });
+          onDiskIsCurrent = false;
         }
       } else {
         this.logger.info("[atbash] active memory removed on chain", { pubkey: this.agentPubkeyHex });
+        onDiskIsCurrent = false;
       }
     }
-    await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
-    return null;
+    if (onDiskIsCurrent) {
+      await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
+    } else {
+      this.logger.warn(
+        "[atbash] not advancing memory pointer \u2014 local file is stale or revoked; reads stay unaudited until it is refreshed"
+      );
+    }
+    if (!onDiskIsCurrent) return null;
+    if (!this.vouchesForTarget(event, ctx)) return null;
+    return { allow: true, audited: true };
   }
   async writeMemoryAtomic(content) {
-    await fs3.mkdir(path5.dirname(this.memoryFilePath), { recursive: true });
+    await fs3.mkdir(path6.dirname(this.memoryFilePath), { recursive: true });
     const tmp = `${this.memoryFilePath}.${process.pid}.tmp`;
     await fs3.writeFile(tmp, content, "utf8");
     await fs3.rename(tmp, this.memoryFilePath);