@atbash/sdk 0.19.1-dev.0 → 0.20.0-dev.0

package/dist/index.js

@@ -42,6 +42,7 @@ __export(src_ts_exports, {
   EciesDomain: () => EciesDomain,
   HttpClient: () => HttpClient,
   HttpTransportError: () => HttpTransportError,
+  JudgeRefusalError: () => JudgeRefusalError,
   KEY_FILENAMES: () => KEY_FILENAMES,
   MemoryGuardManager: () => MemoryGuardManager,
   MemoryIntegrityError: () => MemoryIntegrityError,
@@ -60,6 +61,7 @@ __export(src_ts_exports, {
   columnAad: () => columnAad,
   commitMemoryVersion: () => commitMemoryVersion,
   configureEvents: () => configureEvents,
+  configureJailHold: () => configureJailHold,
   containsEvasionCharacters: () => containsEvasionCharacters,
   containsSecret: () => containsSecret,
   createFileLogger: () => createFileLogger,
@@ -88,12 +90,14 @@ __export(src_ts_exports, {
   getRollbackHistory: () => getRollbackHistory,
   guardMemoryWrite: () => guardMemoryWrite,
   isEnvelope: () => isEnvelope,
+  isJailHeld: () => isJailHeld,
   isValidPrivateKey: () => isValidPrivateKey,
   keyFingerprintOf: () => keyFingerprintOf,
   keyPathCandidates: () => keyPathCandidates,
   loadAgent: () => loadAgent,
   loadAgentFromFile: () => loadAgentFromFile,
   loadUserConfig: () => loadUserConfig,
+  memorySlotOf: () => memorySlotOf,
   normalizeActionForHash: () => normalizeActionForHash,
   normalizeActionType: () => normalizeActionType,
   normalizeForMatching: () => normalizeForMatching,
@@ -107,6 +111,7 @@ __export(src_ts_exports, {
   recordEvent: () => recordEvent,
   redactJsonStrings: () => redactJsonStrings,
   redactSecrets: () => redactSecrets,
+  releaseJailHolds: () => releaseJailHolds,
   resolve: () => resolve,
   resolveKeyPath: () => resolveKeyPath,
   rollbackMemory: () => rollbackMemory,
@@ -293,12 +298,12 @@ var AtbashAPIError = class extends Error {
    * ran does not carry. The path is the fact that settles it.
    */
   path;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path5) {
-    super(enrich(status, body, statusText, endpoint, path5));
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path4) {
+    super(enrich(status, body, statusText, endpoint, path4));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
-    this.path = path5;
+    this.path = path4;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -307,9 +312,18 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint, path5) {
+var JudgeRefusalError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JudgeRefusalError";
+  }
+};
+function isRefusalStatus(status) {
+  return status >= 400 && status < 500 && status !== 408;
+}
+function enrich(status, body, statusText, endpoint, path4) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}${path5 ? ` from ${path5}` : ""}: ${body || statusText}`;
+  let msg = `API error ${status}${path4 ? ` from ${path4}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -330,6 +344,61 @@ function enrich(status, body, statusText, endpoint, path5) {
   return msg;
 }
 
+// src-ts/jail-hold.ts
+var DEFAULTS = { ceilingMs: 3e4, pollMs: 1e3 };
+var holds = /* @__PURE__ */ new Map();
+var blockedAt = /* @__PURE__ */ new Map();
+var BLOCK_MEMORY_MS = 10 * 6e4;
+var config = { ...DEFAULTS };
+function isJailHeld(pubkey) {
+  return holds.has(pubkey);
+}
+function recordBlock(pubkey) {
+  const now = Date.now();
+  for (const [key, at] of blockedAt) if (now - at > BLOCK_MEMORY_MS) blockedAt.delete(key);
+  blockedAt.set(pubkey, now);
+}
+function blockedSince(pubkey, startedAt) {
+  const at = blockedAt.get(pubkey);
+  return at !== void 0 && startedAt <= at;
+}
+function holdJail(pubkey, confirmJailed, onGiveUp) {
+  if (holds.has(pubkey)) return;
+  const hold = { timer: null };
+  holds.set(pubkey, hold);
+  const deadline = Date.now() + config.ceilingMs;
+  const tick = async () => {
+    if (holds.get(pubkey) !== hold) return;
+    let jailed = false;
+    try {
+      jailed = await confirmJailed();
+    } catch {
+    }
+    if (holds.get(pubkey) !== hold) return;
+    if (jailed) {
+      holds.delete(pubkey);
+      return;
+    }
+    if (Date.now() >= deadline) {
+      holds.delete(pubkey);
+      onGiveUp?.();
+      return;
+    }
+    const timer = setTimeout(() => void tick(), config.pollMs);
+    timer.unref?.();
+    hold.timer = timer;
+  };
+  void tick();
+}
+function releaseJailHolds() {
+  for (const hold of holds.values()) if (hold.timer) clearTimeout(hold.timer);
+  holds.clear();
+  blockedAt.clear();
+}
+function configureJailHold(next) {
+  config = { ...DEFAULTS, ...next };
+}
+
 // src-ts/http/client.ts
 var HttpClient = class {
   baseUrl;
@@ -338,8 +407,8 @@ var HttpClient = class {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.timeoutMs = timeoutMs;
   }
-  buildUrl(path5, query) {
-    const url = new URL(this.baseUrl + path5);
+  buildUrl(path4, query) {
+    const url = new URL(this.baseUrl + path4);
     if (query) {
       for (const [k, v] of Object.entries(query)) {
         if (v !== void 0 && v !== null && v !== "") {
@@ -349,14 +418,14 @@ var HttpClient = class {
     }
     return url.toString();
   }
-  async get(path5, query, headers) {
-    return this.fetch(this.buildUrl(path5, query), {
+  async get(path4, query, headers) {
+    return this.fetch(this.buildUrl(path4, query), {
       method: "GET",
       ...headers && { headers }
     });
   }
-  async post(path5, body, headers) {
-    return this.fetch(this.buildUrl(path5), {
+  async post(path4, body, headers) {
+    return this.fetch(this.buildUrl(path4), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...headers },
       body: JSON.stringify(body)
@@ -622,11 +691,12 @@ function eventsOptedOut() {
   const flag = process.env.ATBASH_TELEMETRY_EVENTS_DISABLED?.trim().toLowerCase();
   return Boolean(flag && ["1", "true", "yes", "on"].includes(flag));
 }
+var SOURCE_SHAPE = /^(?:sdk|cli|plugin:[a-z0-9][a-z0-9._-]{0,31})$/;
 function configureEvents(next, opts = {}) {
   logger = next;
   eventsEnabled = next !== null && !eventsOptedOut();
   if (opts.version) sdkVersion = opts.version;
-  if (opts.source) eventSource = opts.source;
+  if (opts.source && SOURCE_SHAPE.test(opts.source)) eventSource = opts.source;
   hashAgentKey = opts.hashAgentKey ?? null;
 }
 function eventsAreOn() {
@@ -673,6 +743,20 @@ var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
 var import_exporter_logs_otlp_http = require("@opentelemetry/exporter-logs-otlp-http");
 var import_sdk_logs = require("@opentelemetry/sdk-logs");
 var import_node_crypto = require("crypto");
+var SDK_VERSION = true ? "0.20.0-dev.0" : "";
+var SDK_LANGUAGE = "node";
+function sdkResourceAttributes() {
+  const attrs = {
+    "service.name": "atbash-sdk",
+    "sdk.language": SDK_LANGUAGE
+  };
+  if (SDK_VERSION) attrs["sdk.version"] = SDK_VERSION;
+  return attrs;
+}
+function sourceOrDefault(candidate) {
+  return typeof candidate === "string" && SOURCE_SHAPE.test(candidate) ? candidate : defaultSource;
+}
+var exitHookInstalled = false;
 var meterProvider = null;
 var loggerProvider = null;
 var callCounter = null;
@@ -690,8 +774,8 @@ function isTelemetryOptedOut() {
     const filePath = (0, import_node_path2.join)(home2, ".config", "atbash", "telemetry.json");
     const raw = (0, import_node_fs2.readFileSync)(filePath, "utf-8").trim();
     if (!raw) return false;
-    const config = JSON.parse(raw);
-    return config.enabled === false;
+    const config2 = JSON.parse(raw);
+    return config2.enabled === false;
   } catch {
     return false;
   }
@@ -736,26 +820,26 @@ function customCollector() {
   }
   return { url: url.replace(/\/+$/, ""), headers: () => headers };
 }
-function setupTelemetry(config) {
-  if (!config.enabled) return;
+function setupTelemetry(config2) {
+  if (!config2.enabled) return;
   if (isTelemetryOptedOut()) return;
-  if (config.source && !sourceExplicitlySet) {
-    defaultSource = config.source;
+  if (config2.source && !sourceExplicitlySet && SOURCE_SHAPE.test(config2.source)) {
+    defaultSource = config2.source;
     sourceExplicitlySet = true;
   }
-  if (config.exportIntervalMs !== void 0 && requestedExportIntervalMs === void 0) {
-    requestedExportIntervalMs = config.exportIntervalMs;
+  if (config2.exportIntervalMs !== void 0 && requestedExportIntervalMs === void 0) {
+    requestedExportIntervalMs = config2.exportIntervalMs;
   }
   if (meterProvider) return;
   const collector = customCollector();
-  if (!collector && (!config.endpoint || !config.getAuthHeaders)) return;
+  if (!collector && (!config2.endpoint || !config2.getAuthHeaders)) return;
   if (!collector && /^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(
-    config.endpoint
+    config2.endpoint
   ))
     return;
   const destination = collector ?? {
-    url: `${config.endpoint.replace(/\/+$/, "")}/api/telemetry`,
-    headers: () => config.getAuthHeaders()
+    url: `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`,
+    headers: () => config2.getAuthHeaders()
   };
   const proxyUrl = destination.url;
   const exporter = new import_exporter_metrics_otlp_http.OTLPMetricExporter({
@@ -779,9 +863,7 @@ function setupTelemetry(config) {
     exportIntervalMillis: requestedExportIntervalMs ?? 6e4
   });
   meterProvider = new import_sdk_metrics.MeterProvider({
-    resource: (0, import_resources.resourceFromAttributes)({
-      "service.name": "atbash-sdk"
-    }),
+    resource: (0, import_resources.resourceFromAttributes)(sdkResourceAttributes()),
     readers: [reader]
   });
   const meter = meterProvider.getMeter("atbash-sdk");
@@ -792,7 +874,7 @@ function setupTelemetry(config) {
     description: "SDK function execution duration",
     unit: "ms"
   });
-  counterHasher = config.hashAgentKey ?? defaultAgentKeyHasher;
+  counterHasher = config2.hashAgentKey ?? defaultAgentKeyHasher;
   const logExporter = new import_exporter_logs_otlp_http.OTLPLogExporter({
     // A real collector takes OTLP at its own signal paths; the Atbash proxy
     // takes a query parameter, because it is one authenticated route.
@@ -800,12 +882,20 @@ function setupTelemetry(config) {
     headers: async () => destination.headers()
   });
   loggerProvider = new import_sdk_logs.LoggerProvider({
-    resource: (0, import_resources.resourceFromAttributes)({ "service.name": "atbash-sdk" }),
+    resource: (0, import_resources.resourceFromAttributes)(sdkResourceAttributes()),
     processors: [new import_sdk_logs.BatchLogRecordProcessor({ exporter: logExporter })]
   });
+  if (!exitHookInstalled && typeof process?.once === "function") {
+    exitHookInstalled = true;
+    process.once("beforeExit", () => {
+      shutdownTelemetry().catch(() => {
+      });
+    });
+  }
   configureEvents(loggerProvider.getLogger("atbash-sdk"), {
-    source: config.source ?? defaultSource,
-    hashAgentKey: config.hashAgentKey ?? defaultAgentKeyHasher
+    source: sourceOrDefault(config2.source),
+    hashAgentKey: config2.hashAgentKey ?? defaultAgentKeyHasher,
+    version: SDK_VERSION
   });
 }
 function recordCall(functionName, source, agentPubkey) {
@@ -813,7 +903,7 @@ function recordCall(functionName, source, agentPubkey) {
   if (!callCounter) return;
   callCounter.add(1, {
     "function.name": functionName,
-    source: source ?? defaultSource,
+    source: sourceOrDefault(source),
     // Hashed on this path too. The counters and the events export to the same
     // place in the same request, so a raw key here would make hashing it on
     // the event beside it pointless.
@@ -825,7 +915,7 @@ function recordDuration(functionName, durationMs, status, source) {
   durationHistogram.record(durationMs, {
     "function.name": functionName,
     status,
-    source: source ?? defaultSource
+    source: sourceOrDefault(source)
   });
 }
 async function flushTelemetry() {
@@ -876,13 +966,13 @@ function loadUserConfig() {
     return {};
   }
 }
-function saveUserConfig(config) {
+function saveUserConfig(config2) {
   const dir = getConfigDir();
   if (!(0, import_node_fs3.existsSync)(dir)) {
     (0, import_node_fs3.mkdirSync)(dir, { recursive: true, mode: 448 });
   }
   const filePath = getConfigPath();
-  (0, import_node_fs3.writeFileSync)(filePath, JSON.stringify(config, null, 2) + "\n", {
+  (0, import_node_fs3.writeFileSync)(filePath, JSON.stringify(config2, null, 2) + "\n", {
     mode: 384
   });
   (0, import_node_fs3.chmodSync)(filePath, 384);
@@ -917,6 +1007,7 @@ function forcedChainNetwork(flagValue) {
 }
 
 // src-ts/client.ts
+var AGENT_NOT_REGISTERED = "Agent not registered. Onboard the agent at the dashboard before submitting actions.";
 function generateToolCallId() {
   return `tc-${Date.now()}-${randomHex(4)}`;
 }
@@ -1265,6 +1356,15 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * return the signed tx hex. The server broadcasts to chain.
    */
   async logToolCall(action, context = "", options = {}) {
+    return this._logToolCall(action, context, options, false);
+  }
+  /**
+   * `raisePreflightErrors` (the judge path, like Python's
+   * `raise_preflight_errors`): a failed registration check throws instead of
+   * becoming `{ success: false }`, so the caller can tell Atbash's "no"
+   * (not registered, or a 4xx) from an outage.
+   */
+  async _logToolCall(action, context, options, raisePreflightErrors) {
     const start = performance.now();
     recordCall("logToolCall", void 0, this.auth.pubkey);
     let exists;
@@ -1274,18 +1374,20 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       });
     } catch (err) {
       recordDuration("logToolCall", performance.now() - start, "error");
+      if (raisePreflightErrors) throw err;
       return { success: false, toolCallId: null, error: errorMessage(err) };
     }
     if (!exists) {
       recordDuration("logToolCall", performance.now() - start, "error");
+      if (raisePreflightErrors) throw new JudgeRefusalError(AGENT_NOT_REGISTERED);
       return {
         success: false,
         toolCallId: null,
-        error: "Agent not registered. Onboard the agent at the dashboard before submitting actions."
+        error: AGENT_NOT_REGISTERED
       };
     }
     const toolCallId = generateToolCallId();
-    const brid = options.chainOpts?.blockchainRid || options.chainOpts?.network ? this.bridFromChainOpts(options.chainOpts) : await this.defaultOrgBrid() ?? this.blockchainRid;
+    const brid = await this.callBrid(options.chainOpts);
     const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey ?? this._orgKeyFromChain;
     try {
       const signedHex = orgKey ? signEncryptedToolCall(
@@ -1335,6 +1437,8 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (!action?.trim()) {
       throw new Error("action is required and cannot be empty.");
     }
+    if (isJailHeld(this.auth.pubkey)) return this.localJailBlock();
+    const startedAt = Date.now();
     let chainOpts = options.chainOpts;
     if (options.orgName && this._explicitChain) {
       chainOpts = options.chainOpts ?? { network: this._defaultChain.network };
@@ -1359,12 +1463,13 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         }
       }
     }
-    const brid = this.bridFromChainOpts(chainOpts);
-    const logResult = await this.logToolCall(action, context, {
-      toolName: options.toolName,
-      toolArgsJson: options.toolArgsJson,
-      chainOpts
-    });
+    const brid = await this.callBrid(chainOpts);
+    const logResult = await this._logToolCall(
+      action,
+      context,
+      { toolName: options.toolName, toolArgsJson: options.toolArgsJson, chainOpts },
+      true
+    );
     if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
       throw new Error(logResult.error || "Failed to sign log_tool_call");
     }
@@ -1401,10 +1506,16 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (verifyPubKey !== void 0) {
       verifyResponseSignature(bodyBytes, resp, verifyPubKey);
     }
-    const data = parseJson(bodyBytes);
+    const parsed = tryParseJson(bodyBytes.toString("utf-8"));
+    if (!isRecord2(parsed)) {
+      throw new JudgeRefusalError(
+        "The judge's reply could not be read, so the action was not approved."
+      );
+    }
+    const data = parsed;
     const rawScore = data.score;
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
-    return {
+    const result = {
       verdict: normalizeVerdict(data.verdict),
       allow: this.executable(data),
       actionType: normalizeActionType(data.action_type),
@@ -1420,6 +1531,45 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       score,
       refusal: explicitRefusal(data)
     };
+    return this.applyJailHold(result, startedAt);
+  }
+  /**
+   * Start a local hold on an enforced, on-chain BLOCK (the verdict that jails).
+   * Refuse any other result that lands while the agent is held, or whose
+   * request was already in flight when the block arrived: the server judged it
+   * on pre-jail state.
+   */
+  applyJailHold(result, startedAt) {
+    const pubkey = this.auth.pubkey;
+    if (result.verdict === "BLOCK" && result.enforced && result.onChain) {
+      recordBlock(pubkey);
+      holdJail(
+        pubkey,
+        () => this.getAgentPolicy(pubkey).then((p) => p.isJailed),
+        () => this.logger.warn?.("[atbash] local jail hold released: the chain did not confirm the jail in time")
+      );
+      return result;
+    }
+    return isJailHeld(pubkey) || blockedSince(pubkey, startedAt) ? this.localJailBlock(result.toolCallId) : result;
+  }
+  /** The server's jailed refusal, produced locally while the agent is held. */
+  localJailBlock(toolCallId = generateToolCallId()) {
+    return {
+      verdict: "BLOCK",
+      allow: false,
+      actionType: "block",
+      reason: "Agent is jailed. All actions are blocked until the organization owner unjails this agent.",
+      confidence: 1,
+      provider: "policy",
+      latencyMs: 0,
+      toolCallId,
+      onChain: false,
+      enforced: true,
+      enforcementMode: "enforce",
+      status: "",
+      score: void 0,
+      refusal: "BLOCK"
+    };
   }
   /* ── audit_tool_call (redact → judge → decision) ───────────────────────── */
   /**
@@ -1471,6 +1621,9 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
           reason: `The judge's reply failed its signature check (${errorMessage(err)}), so it was not trusted.`
         };
       }
+      if (err instanceof JudgeRefusalError || err instanceof AtbashAPIError && isRefusalStatus(err.status)) {
+        return { ...this.failJudge(errorMessage(err), err), allow: false };
+      }
       return this.failJudge(errorMessage(err), err);
     }
   }
@@ -1500,6 +1653,15 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * never overrides a refusal.
    */
   decide(result) {
+    const inner = this.decideInner(result);
+    if (!result.enforcementMode) return inner;
+    return {
+      ...inner,
+      enforced: result.enforced,
+      enforcementMode: result.enforcementMode
+    };
+  }
+  decideInner(result) {
     const toolCallId = result.toolCallId;
     const deny = (verdict, reason) => ({
       allow: false,
@@ -1613,17 +1775,17 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
   /**
    * Return the current status of a previously submitted judgment.
    *
-   * `chainOpts` names which chain the judgment was signed against. The
-   * server's GET /api/v1/judge routes to that chain when the SDK sends
-   * a `brid` query param; without it, the server falls back to public.
-   * Callers on the private chain must pass a `chainOpts` (or configure
-   * the client on the private chain) — otherwise polling a POSTed
-   * judgment on the private chain 404s at the server.
+   * `chainOpts` names which chain the judgment was signed against; the SDK
+   * sends it as the `brid` query param the server routes by. Without it the
+   * read uses the same chain `judgeAction` signs for (see `callBrid`): the
+   * client's org chain when it has an `orgName`, else the client default.
+   * A judgment signed with an explicit per-call `chainOpts` (or a per-call
+   * `orgName` on another chain) must be polled with that same `chainOpts`.
    */
   async getJudgmentStatus(judgmentId, agentPubkey, chainOpts) {
     const pk = agentPubkey ?? this.auth.pubkey;
-    const brid = this.bridFromChainOpts(chainOpts);
     return this.track("getJudgmentStatus", pk, async () => {
+      const brid = await this.callBrid(chainOpts);
       const resp = await this.http.get(
         "/api/v1/judge",
         { tool_call_id: judgmentId, agent_pubkey: pk, brid },
@@ -1961,6 +2123,18 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
     return this.blockchainRid;
   }
+  /**
+   * The chain one call's transactions are signed for: the per-call override
+   * when given, otherwise the client's org, otherwise the client default.
+   * log_tool_call, judge_action and the judgment-status read all use this, so
+   * a request never pairs transactions signed for two different chains.
+   */
+  async callBrid(chainOpts) {
+    if (chainOpts?.blockchainRid || chainOpts?.network) {
+      return this.bridFromChainOpts(chainOpts);
+    }
+    return await this.defaultOrgBrid() ?? this.blockchainRid;
+  }
   /**
    * Resolve the dashboard chain used by agent metadata/policy reads.
    * Explicit per-call network overrides win; otherwise use the supplied org
@@ -2006,8 +2180,8 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
   async riskEnginePost(body, network, brid) {
     let resp;
     try {
-      const path5 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
-      resp = await this.http.post(path5, body, this.authHeaders(brid));
+      const path4 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
+      resp = await this.http.post(path4, body, this.authHeaders(brid));
     } catch (err) {
       throw this.transportError(err);
     }
@@ -2268,10 +2442,6 @@ function tryParseJson(text) {
     return void 0;
   }
 }
-function parseJson(bytes) {
-  const parsed = tryParseJson(bytes.toString("utf-8"));
-  return parsed === void 0 ? {} : parsed;
-}
 function requestPath(url) {
   if (!url) return void 0;
   try {
@@ -2550,10 +2720,10 @@ function resolveBlockchainRid(chainOpts) {
       'chainOpts.nodeUrls no longer selects a chain on its own \u2014 memory reaches the chain through the Atbash service, not a node. Set `blockchainRid`, or `network: "public" | "private"`.'
     );
   }
-  const config = chainForNetwork(
+  const config2 = chainForNetwork(
     chainOpts?.network ?? forcedChainNetwork() ?? "private"
   );
-  return config.blockchainRid;
+  return config2.blockchainRid;
 }
 async function commitMemoryVersion(plaintext, auth, opts) {
   const key = await deriveMemoryKey(auth.privkey);
@@ -2779,7 +2949,34 @@ function classifyMemoryWrite(event, ctx, opts = {}) {
 // src-ts/memory/guard.ts
 var import_node_fs4 = require("fs");
 var import_node_os4 = __toESM(require("os"));
+
+// src-ts/memory/slot.ts
 var import_node_path4 = __toESM(require("path"));
+function asciiLower(s) {
+  return s.replace(/[A-Z]/g, (c) => String.fromCharCode(c.charCodeAt(0) | 32));
+}
+function spelledAs(target, base, p = import_node_path4.default) {
+  const resolved = p.resolve(base);
+  if (p.sep !== "\\") return resolved;
+  const prefix = resolved.replace(/[\\/]+$/, "");
+  const t = asciiLower(target);
+  const b = asciiLower(prefix);
+  if (t === b || t.startsWith(b + "\\") || t.startsWith(b + "/")) {
+    return target.slice(0, prefix.length);
+  }
+  return resolved;
+}
+function memorySlotOf(target, home2, root, extraHomes, p = import_node_path4.default) {
+  const resolved = p.resolve(target);
+  return native.memorySlotForPath(
+    resolved,
+    home2 ? spelledAs(resolved, home2, p) : "",
+    root ? spelledAs(resolved, root, p) : void 0,
+    extraHomes
+  );
+}
+
+// src-ts/memory/guard.ts
 function emitDebugProbe(event, ctx, memEntry, logger2) {
   if (!logger2?.info) return;
   const ev = event ?? {};
@@ -2805,7 +3002,7 @@ function emitDebugProbe(event, ctx, memEntry, logger2) {
 }
 function memorySlotFor(key, root, extraHomes) {
   const home2 = process.env.HOME || import_node_os4.default.homedir() || "";
-  return native.memorySlotForPath(import_node_path4.default.resolve(key), home2, root, extraHomes);
+  return memorySlotOf(key, home2, root, extraHomes);
 }
 async function resultingDocument(memEntry, event, ctx) {
   const edits = native.extractMemoryEdits(event, ctx);
@@ -3558,12 +3755,7 @@ var MemoryGuardManager = class {
    */
   slotFor(target) {
     const home2 = process.env.HOME || import_node_os5.default.homedir() || "";
-    return native.memorySlotForPath(
-      import_node_path7.default.resolve(target),
-      home2,
-      this.opts.memoryRoot,
-      this.opts.agentHomeDirs
-    );
+    return memorySlotOf(target, home2, this.opts.memoryRoot, this.opts.agentHomeDirs);
   }
   /**
    * Verify every memory file this call reads, each against its own chain slot.
@@ -3853,6 +4045,7 @@ function diffMemorySnapshots(before, after) {
   EciesDomain,
   HttpClient,
   HttpTransportError,
+  JudgeRefusalError,
   KEY_FILENAMES,
   MemoryGuardManager,
   MemoryIntegrityError,
@@ -3871,6 +4064,7 @@ function diffMemorySnapshots(before, after) {
   columnAad,
   commitMemoryVersion,
   configureEvents,
+  configureJailHold,
   containsEvasionCharacters,
   containsSecret,
   createFileLogger,
@@ -3899,12 +4093,14 @@ function diffMemorySnapshots(before, after) {
   getRollbackHistory,
   guardMemoryWrite,
   isEnvelope,
+  isJailHeld,
   isValidPrivateKey,
   keyFingerprintOf,
   keyPathCandidates,
   loadAgent,
   loadAgentFromFile,
   loadUserConfig,
+  memorySlotOf,
   normalizeActionForHash,
   normalizeActionType,
   normalizeForMatching,
@@ -3918,6 +4114,7 @@ function diffMemorySnapshots(before, after) {
   recordEvent,
   redactJsonStrings,
   redactSecrets,
+  releaseJailHolds,
   resolve,
   resolveKeyPath,
   rollbackMemory,