@atbash/sdk 0.19.2-dev.0 → 0.20.0-dev.0

package/dist/index.mjs

@@ -166,12 +166,12 @@ var AtbashAPIError = class extends Error {
    * ran does not carry. The path is the fact that settles it.
    */
   path;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path5) {
-    super(enrich(status, body, statusText, endpoint, path5));
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path4) {
+    super(enrich(status, body, statusText, endpoint, path4));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
-    this.path = path5;
+    this.path = path4;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -180,9 +180,18 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint, path5) {
+var JudgeRefusalError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JudgeRefusalError";
+  }
+};
+function isRefusalStatus(status) {
+  return status >= 400 && status < 500 && status !== 408;
+}
+function enrich(status, body, statusText, endpoint, path4) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}${path5 ? ` from ${path5}` : ""}: ${body || statusText}`;
+  let msg = `API error ${status}${path4 ? ` from ${path4}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -203,6 +212,61 @@ function enrich(status, body, statusText, endpoint, path5) {
   return msg;
 }
 
+// src-ts/jail-hold.ts
+var DEFAULTS = { ceilingMs: 3e4, pollMs: 1e3 };
+var holds = /* @__PURE__ */ new Map();
+var blockedAt = /* @__PURE__ */ new Map();
+var BLOCK_MEMORY_MS = 10 * 6e4;
+var config = { ...DEFAULTS };
+function isJailHeld(pubkey) {
+  return holds.has(pubkey);
+}
+function recordBlock(pubkey) {
+  const now = Date.now();
+  for (const [key, at] of blockedAt) if (now - at > BLOCK_MEMORY_MS) blockedAt.delete(key);
+  blockedAt.set(pubkey, now);
+}
+function blockedSince(pubkey, startedAt) {
+  const at = blockedAt.get(pubkey);
+  return at !== void 0 && startedAt <= at;
+}
+function holdJail(pubkey, confirmJailed, onGiveUp) {
+  if (holds.has(pubkey)) return;
+  const hold = { timer: null };
+  holds.set(pubkey, hold);
+  const deadline = Date.now() + config.ceilingMs;
+  const tick = async () => {
+    if (holds.get(pubkey) !== hold) return;
+    let jailed = false;
+    try {
+      jailed = await confirmJailed();
+    } catch {
+    }
+    if (holds.get(pubkey) !== hold) return;
+    if (jailed) {
+      holds.delete(pubkey);
+      return;
+    }
+    if (Date.now() >= deadline) {
+      holds.delete(pubkey);
+      onGiveUp?.();
+      return;
+    }
+    const timer = setTimeout(() => void tick(), config.pollMs);
+    timer.unref?.();
+    hold.timer = timer;
+  };
+  void tick();
+}
+function releaseJailHolds() {
+  for (const hold of holds.values()) if (hold.timer) clearTimeout(hold.timer);
+  holds.clear();
+  blockedAt.clear();
+}
+function configureJailHold(next) {
+  config = { ...DEFAULTS, ...next };
+}
+
 // src-ts/http/client.ts
 var HttpClient = class {
   baseUrl;
@@ -211,8 +275,8 @@ var HttpClient = class {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.timeoutMs = timeoutMs;
   }
-  buildUrl(path5, query) {
-    const url = new URL(this.baseUrl + path5);
+  buildUrl(path4, query) {
+    const url = new URL(this.baseUrl + path4);
     if (query) {
       for (const [k, v] of Object.entries(query)) {
         if (v !== void 0 && v !== null && v !== "") {
@@ -222,14 +286,14 @@ var HttpClient = class {
     }
     return url.toString();
   }
-  async get(path5, query, headers) {
-    return this.fetch(this.buildUrl(path5, query), {
+  async get(path4, query, headers) {
+    return this.fetch(this.buildUrl(path4, query), {
       method: "GET",
       ...headers && { headers }
     });
   }
-  async post(path5, body, headers) {
-    return this.fetch(this.buildUrl(path5), {
+  async post(path4, body, headers) {
+    return this.fetch(this.buildUrl(path4), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...headers },
       body: JSON.stringify(body)
@@ -553,7 +617,7 @@ import {
 import { OTLPLogExporter } from "@opentelemetry/exporter-logs-otlp-http";
 import { BatchLogRecordProcessor, LoggerProvider } from "@opentelemetry/sdk-logs";
 import { createHash } from "crypto";
-var SDK_VERSION = true ? "0.19.2-dev.0" : "";
+var SDK_VERSION = true ? "0.20.0-dev.0" : "";
 var SDK_LANGUAGE = "node";
 function sdkResourceAttributes() {
   const attrs = {
@@ -584,8 +648,8 @@ function isTelemetryOptedOut() {
     const filePath = join2(home2, ".config", "atbash", "telemetry.json");
     const raw = readFileSync2(filePath, "utf-8").trim();
     if (!raw) return false;
-    const config = JSON.parse(raw);
-    return config.enabled === false;
+    const config2 = JSON.parse(raw);
+    return config2.enabled === false;
   } catch {
     return false;
   }
@@ -630,26 +694,26 @@ function customCollector() {
   }
   return { url: url.replace(/\/+$/, ""), headers: () => headers };
 }
-function setupTelemetry(config) {
-  if (!config.enabled) return;
+function setupTelemetry(config2) {
+  if (!config2.enabled) return;
   if (isTelemetryOptedOut()) return;
-  if (config.source && !sourceExplicitlySet && SOURCE_SHAPE.test(config.source)) {
-    defaultSource = config.source;
+  if (config2.source && !sourceExplicitlySet && SOURCE_SHAPE.test(config2.source)) {
+    defaultSource = config2.source;
     sourceExplicitlySet = true;
   }
-  if (config.exportIntervalMs !== void 0 && requestedExportIntervalMs === void 0) {
-    requestedExportIntervalMs = config.exportIntervalMs;
+  if (config2.exportIntervalMs !== void 0 && requestedExportIntervalMs === void 0) {
+    requestedExportIntervalMs = config2.exportIntervalMs;
   }
   if (meterProvider) return;
   const collector = customCollector();
-  if (!collector && (!config.endpoint || !config.getAuthHeaders)) return;
+  if (!collector && (!config2.endpoint || !config2.getAuthHeaders)) return;
   if (!collector && /^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(
-    config.endpoint
+    config2.endpoint
   ))
     return;
   const destination = collector ?? {
-    url: `${config.endpoint.replace(/\/+$/, "")}/api/telemetry`,
-    headers: () => config.getAuthHeaders()
+    url: `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`,
+    headers: () => config2.getAuthHeaders()
   };
   const proxyUrl = destination.url;
   const exporter = new OTLPMetricExporter({
@@ -684,7 +748,7 @@ function setupTelemetry(config) {
     description: "SDK function execution duration",
     unit: "ms"
   });
-  counterHasher = config.hashAgentKey ?? defaultAgentKeyHasher;
+  counterHasher = config2.hashAgentKey ?? defaultAgentKeyHasher;
   const logExporter = new OTLPLogExporter({
     // A real collector takes OTLP at its own signal paths; the Atbash proxy
     // takes a query parameter, because it is one authenticated route.
@@ -703,8 +767,8 @@ function setupTelemetry(config) {
     });
   }
   configureEvents(loggerProvider.getLogger("atbash-sdk"), {
-    source: sourceOrDefault(config.source),
-    hashAgentKey: config.hashAgentKey ?? defaultAgentKeyHasher,
+    source: sourceOrDefault(config2.source),
+    hashAgentKey: config2.hashAgentKey ?? defaultAgentKeyHasher,
     version: SDK_VERSION
   });
 }
@@ -782,13 +846,13 @@ function loadUserConfig() {
     return {};
   }
 }
-function saveUserConfig(config) {
+function saveUserConfig(config2) {
   const dir = getConfigDir();
   if (!existsSync2(dir)) {
     mkdirSync(dir, { recursive: true, mode: 448 });
   }
   const filePath = getConfigPath();
-  writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", {
+  writeFileSync(filePath, JSON.stringify(config2, null, 2) + "\n", {
     mode: 384
   });
   chmodSync(filePath, 384);
@@ -823,6 +887,7 @@ function forcedChainNetwork(flagValue) {
 }
 
 // src-ts/client.ts
+var AGENT_NOT_REGISTERED = "Agent not registered. Onboard the agent at the dashboard before submitting actions.";
 function generateToolCallId() {
   return `tc-${Date.now()}-${randomHex(4)}`;
 }
@@ -1171,6 +1236,15 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * return the signed tx hex. The server broadcasts to chain.
    */
   async logToolCall(action, context = "", options = {}) {
+    return this._logToolCall(action, context, options, false);
+  }
+  /**
+   * `raisePreflightErrors` (the judge path, like Python's
+   * `raise_preflight_errors`): a failed registration check throws instead of
+   * becoming `{ success: false }`, so the caller can tell Atbash's "no"
+   * (not registered, or a 4xx) from an outage.
+   */
+  async _logToolCall(action, context, options, raisePreflightErrors) {
     const start = performance.now();
     recordCall("logToolCall", void 0, this.auth.pubkey);
     let exists;
@@ -1180,18 +1254,20 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       });
     } catch (err) {
       recordDuration("logToolCall", performance.now() - start, "error");
+      if (raisePreflightErrors) throw err;
       return { success: false, toolCallId: null, error: errorMessage(err) };
     }
     if (!exists) {
       recordDuration("logToolCall", performance.now() - start, "error");
+      if (raisePreflightErrors) throw new JudgeRefusalError(AGENT_NOT_REGISTERED);
       return {
         success: false,
         toolCallId: null,
-        error: "Agent not registered. Onboard the agent at the dashboard before submitting actions."
+        error: AGENT_NOT_REGISTERED
       };
     }
     const toolCallId = generateToolCallId();
-    const brid = options.chainOpts?.blockchainRid || options.chainOpts?.network ? this.bridFromChainOpts(options.chainOpts) : await this.defaultOrgBrid() ?? this.blockchainRid;
+    const brid = await this.callBrid(options.chainOpts);
     const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey ?? this._orgKeyFromChain;
     try {
       const signedHex = orgKey ? signEncryptedToolCall(
@@ -1241,6 +1317,8 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (!action?.trim()) {
       throw new Error("action is required and cannot be empty.");
     }
+    if (isJailHeld(this.auth.pubkey)) return this.localJailBlock();
+    const startedAt = Date.now();
     let chainOpts = options.chainOpts;
     if (options.orgName && this._explicitChain) {
       chainOpts = options.chainOpts ?? { network: this._defaultChain.network };
@@ -1265,12 +1343,13 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         }
       }
     }
-    const brid = this.bridFromChainOpts(chainOpts);
-    const logResult = await this.logToolCall(action, context, {
-      toolName: options.toolName,
-      toolArgsJson: options.toolArgsJson,
-      chainOpts
-    });
+    const brid = await this.callBrid(chainOpts);
+    const logResult = await this._logToolCall(
+      action,
+      context,
+      { toolName: options.toolName, toolArgsJson: options.toolArgsJson, chainOpts },
+      true
+    );
     if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
       throw new Error(logResult.error || "Failed to sign log_tool_call");
     }
@@ -1307,10 +1386,16 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (verifyPubKey !== void 0) {
       verifyResponseSignature(bodyBytes, resp, verifyPubKey);
     }
-    const data = parseJson(bodyBytes);
+    const parsed = tryParseJson(bodyBytes.toString("utf-8"));
+    if (!isRecord2(parsed)) {
+      throw new JudgeRefusalError(
+        "The judge's reply could not be read, so the action was not approved."
+      );
+    }
+    const data = parsed;
     const rawScore = data.score;
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
-    return {
+    const result = {
       verdict: normalizeVerdict(data.verdict),
       allow: this.executable(data),
       actionType: normalizeActionType(data.action_type),
@@ -1326,6 +1411,45 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       score,
       refusal: explicitRefusal(data)
     };
+    return this.applyJailHold(result, startedAt);
+  }
+  /**
+   * Start a local hold on an enforced, on-chain BLOCK (the verdict that jails).
+   * Refuse any other result that lands while the agent is held, or whose
+   * request was already in flight when the block arrived: the server judged it
+   * on pre-jail state.
+   */
+  applyJailHold(result, startedAt) {
+    const pubkey = this.auth.pubkey;
+    if (result.verdict === "BLOCK" && result.enforced && result.onChain) {
+      recordBlock(pubkey);
+      holdJail(
+        pubkey,
+        () => this.getAgentPolicy(pubkey).then((p) => p.isJailed),
+        () => this.logger.warn?.("[atbash] local jail hold released: the chain did not confirm the jail in time")
+      );
+      return result;
+    }
+    return isJailHeld(pubkey) || blockedSince(pubkey, startedAt) ? this.localJailBlock(result.toolCallId) : result;
+  }
+  /** The server's jailed refusal, produced locally while the agent is held. */
+  localJailBlock(toolCallId = generateToolCallId()) {
+    return {
+      verdict: "BLOCK",
+      allow: false,
+      actionType: "block",
+      reason: "Agent is jailed. All actions are blocked until the organization owner unjails this agent.",
+      confidence: 1,
+      provider: "policy",
+      latencyMs: 0,
+      toolCallId,
+      onChain: false,
+      enforced: true,
+      enforcementMode: "enforce",
+      status: "",
+      score: void 0,
+      refusal: "BLOCK"
+    };
   }
   /* ── audit_tool_call (redact → judge → decision) ───────────────────────── */
   /**
@@ -1377,6 +1501,9 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
           reason: `The judge's reply failed its signature check (${errorMessage(err)}), so it was not trusted.`
         };
       }
+      if (err instanceof JudgeRefusalError || err instanceof AtbashAPIError && isRefusalStatus(err.status)) {
+        return { ...this.failJudge(errorMessage(err), err), allow: false };
+      }
       return this.failJudge(errorMessage(err), err);
     }
   }
@@ -1406,6 +1533,15 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * never overrides a refusal.
    */
   decide(result) {
+    const inner = this.decideInner(result);
+    if (!result.enforcementMode) return inner;
+    return {
+      ...inner,
+      enforced: result.enforced,
+      enforcementMode: result.enforcementMode
+    };
+  }
+  decideInner(result) {
     const toolCallId = result.toolCallId;
     const deny = (verdict, reason) => ({
       allow: false,
@@ -1519,17 +1655,17 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
   /**
    * Return the current status of a previously submitted judgment.
    *
-   * `chainOpts` names which chain the judgment was signed against. The
-   * server's GET /api/v1/judge routes to that chain when the SDK sends
-   * a `brid` query param; without it, the server falls back to public.
-   * Callers on the private chain must pass a `chainOpts` (or configure
-   * the client on the private chain) — otherwise polling a POSTed
-   * judgment on the private chain 404s at the server.
+   * `chainOpts` names which chain the judgment was signed against; the SDK
+   * sends it as the `brid` query param the server routes by. Without it the
+   * read uses the same chain `judgeAction` signs for (see `callBrid`): the
+   * client's org chain when it has an `orgName`, else the client default.
+   * A judgment signed with an explicit per-call `chainOpts` (or a per-call
+   * `orgName` on another chain) must be polled with that same `chainOpts`.
    */
   async getJudgmentStatus(judgmentId, agentPubkey, chainOpts) {
     const pk = agentPubkey ?? this.auth.pubkey;
-    const brid = this.bridFromChainOpts(chainOpts);
     return this.track("getJudgmentStatus", pk, async () => {
+      const brid = await this.callBrid(chainOpts);
       const resp = await this.http.get(
         "/api/v1/judge",
         { tool_call_id: judgmentId, agent_pubkey: pk, brid },
@@ -1867,6 +2003,18 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
     return this.blockchainRid;
   }
+  /**
+   * The chain one call's transactions are signed for: the per-call override
+   * when given, otherwise the client's org, otherwise the client default.
+   * log_tool_call, judge_action and the judgment-status read all use this, so
+   * a request never pairs transactions signed for two different chains.
+   */
+  async callBrid(chainOpts) {
+    if (chainOpts?.blockchainRid || chainOpts?.network) {
+      return this.bridFromChainOpts(chainOpts);
+    }
+    return await this.defaultOrgBrid() ?? this.blockchainRid;
+  }
   /**
    * Resolve the dashboard chain used by agent metadata/policy reads.
    * Explicit per-call network overrides win; otherwise use the supplied org
@@ -1912,8 +2060,8 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
   async riskEnginePost(body, network, brid) {
     let resp;
     try {
-      const path5 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
-      resp = await this.http.post(path5, body, this.authHeaders(brid));
+      const path4 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
+      resp = await this.http.post(path4, body, this.authHeaders(brid));
     } catch (err) {
       throw this.transportError(err);
     }
@@ -2174,10 +2322,6 @@ function tryParseJson(text) {
     return void 0;
   }
 }
-function parseJson(bytes) {
-  const parsed = tryParseJson(bytes.toString("utf-8"));
-  return parsed === void 0 ? {} : parsed;
-}
 function requestPath(url) {
   if (!url) return void 0;
   try {
@@ -2456,10 +2600,10 @@ function resolveBlockchainRid(chainOpts) {
       'chainOpts.nodeUrls no longer selects a chain on its own \u2014 memory reaches the chain through the Atbash service, not a node. Set `blockchainRid`, or `network: "public" | "private"`.'
     );
   }
-  const config = chainForNetwork(
+  const config2 = chainForNetwork(
     chainOpts?.network ?? forcedChainNetwork() ?? "private"
   );
-  return config.blockchainRid;
+  return config2.blockchainRid;
 }
 async function commitMemoryVersion(plaintext, auth, opts) {
   const key = await deriveMemoryKey(auth.privkey);
@@ -2685,7 +2829,34 @@ function classifyMemoryWrite(event, ctx, opts = {}) {
 // src-ts/memory/guard.ts
 import { promises as fs } from "fs";
 import os from "os";
-import path from "path";
+
+// src-ts/memory/slot.ts
+import nodePath from "path";
+function asciiLower(s) {
+  return s.replace(/[A-Z]/g, (c) => String.fromCharCode(c.charCodeAt(0) | 32));
+}
+function spelledAs(target, base, p = nodePath) {
+  const resolved = p.resolve(base);
+  if (p.sep !== "\\") return resolved;
+  const prefix = resolved.replace(/[\\/]+$/, "");
+  const t = asciiLower(target);
+  const b = asciiLower(prefix);
+  if (t === b || t.startsWith(b + "\\") || t.startsWith(b + "/")) {
+    return target.slice(0, prefix.length);
+  }
+  return resolved;
+}
+function memorySlotOf(target, home2, root, extraHomes, p = nodePath) {
+  const resolved = p.resolve(target);
+  return native.memorySlotForPath(
+    resolved,
+    home2 ? spelledAs(resolved, home2, p) : "",
+    root ? spelledAs(resolved, root, p) : void 0,
+    extraHomes
+  );
+}
+
+// src-ts/memory/guard.ts
 function emitDebugProbe(event, ctx, memEntry, logger2) {
   if (!logger2?.info) return;
   const ev = event ?? {};
@@ -2711,7 +2882,7 @@ function emitDebugProbe(event, ctx, memEntry, logger2) {
 }
 function memorySlotFor(key, root, extraHomes) {
   const home2 = process.env.HOME || os.homedir() || "";
-  return native.memorySlotForPath(path.resolve(key), home2, root, extraHomes);
+  return memorySlotOf(key, home2, root, extraHomes);
 }
 async function resultingDocument(memEntry, event, ctx) {
   const edits = native.extractMemoryEdits(event, ctx);
@@ -2914,7 +3085,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
 
 // src-ts/memory/pointer-store.ts
 import { promises as fs2 } from "fs";
-import path2 from "path";
+import path from "path";
 var VERSION = 2;
 var ZERO = { activeId: null, checkedAt: 0 };
 var PointerStore = class {
@@ -2967,19 +3138,19 @@ var PointerStore = class {
     this.cache = { version: VERSION, agents: {} };
   }
   async persist(file) {
-    await fs2.mkdir(path2.dirname(this.filePath), { recursive: true });
+    await fs2.mkdir(path.dirname(this.filePath), { recursive: true });
     const tmp = `${this.filePath}.${process.pid}.tmp`;
     await fs2.writeFile(tmp, JSON.stringify(file, null, 2), "utf8");
     await fs2.rename(tmp, this.filePath);
   }
 };
 function defaultPointerPath(workspaceDir = process.cwd()) {
-  return path2.join(workspaceDir, ".atbash", "memory-pointer.json");
+  return path.join(workspaceDir, ".atbash", "memory-pointer.json");
 }
 
 // src-ts/memory/file-logger.ts
 import { promises as fs3 } from "fs";
-import path3 from "path";
+import path2 from "path";
 function formatMeta(meta) {
   if (!meta || Object.keys(meta).length === 0) return "";
   try {
@@ -2992,7 +3163,7 @@ function createFileLogger(filePath, upstream) {
   let queue = Promise.resolve();
   let writeError;
   async function ensureDir() {
-    await fs3.mkdir(path3.dirname(filePath), { recursive: true });
+    await fs3.mkdir(path2.dirname(filePath), { recursive: true });
   }
   function append(level, message, meta) {
     const line = `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${message}${formatMeta(meta)}
@@ -3018,7 +3189,7 @@ function createFileLogger(filePath, upstream) {
   };
 }
 function defaultPluginLogPath(workspaceDir = process.cwd()) {
-  return path3.join(workspaceDir, ".atbash", "plugin.log");
+  return path2.join(workspaceDir, ".atbash", "plugin.log");
 }
 
 // src-ts/memory/read-classifier.ts
@@ -3034,14 +3205,14 @@ function classifyMemoryRead(event, ctx, opts = {}) {
 // src-ts/memory/guard-manager.ts
 import { promises as fs4 } from "fs";
 import os2 from "os";
-import path4 from "path";
+import path3 from "path";
 var DEFAULT_SYNC_TTL_MS = 3e4;
 var MemoryGuardManager = class {
   constructor(opts) {
     this.opts = opts;
     const workspaceDir = opts.workspaceDir;
     this.workspaceDir = workspaceDir;
-    this.memoryFilePath = opts.memoryFilePath ?? path4.join(workspaceDir, "MEMORY.md");
+    this.memoryFilePath = opts.memoryFilePath ?? path3.join(workspaceDir, "MEMORY.md");
     this.pointerStore = new PointerStore(opts.pointerFilePath ?? defaultPointerPath(workspaceDir));
     this.logger = createFileLogger(
       opts.logFilePath ?? defaultPluginLogPath(workspaceDir),
@@ -3256,7 +3427,7 @@ var MemoryGuardManager = class {
    */
   async locate(slot, roots) {
     for (const root of roots) {
-      const candidate = path4.join(root, slot);
+      const candidate = path3.join(root, slot);
       try {
         await fs4.access(candidate);
         return candidate;
@@ -3271,7 +3442,7 @@ var MemoryGuardManager = class {
   /** Roots a chain slot may be joined to, most specific first. */
   async memoryRoots() {
     const roots = [];
-    if (this.opts.memoryRoot) roots.push(path4.resolve(this.opts.memoryRoot));
+    if (this.opts.memoryRoot) roots.push(path3.resolve(this.opts.memoryRoot));
     const home2 = process.env.HOME || os2.homedir() || "";
     if (home2) {
       const names = [
@@ -3279,7 +3450,7 @@ var MemoryGuardManager = class {
         ...this.opts.agentHomeDirs ?? []
       ];
       for (const name of names) {
-        const candidate = path4.join(home2, name);
+        const candidate = path3.join(home2, name);
         try {
           if ((await fs4.stat(candidate)).isDirectory()) roots.push(candidate);
         } catch {
@@ -3417,7 +3588,7 @@ var MemoryGuardManager = class {
         const rec = bag;
         for (const k of KEYS) {
           const v = rec[k];
-          if (typeof v === "string" && v) found.add(path4.resolve(this.workspaceDir, v));
+          if (typeof v === "string" && v) found.add(path3.resolve(this.workspaceDir, v));
         }
       }
     }
@@ -3464,12 +3635,7 @@ var MemoryGuardManager = class {
    */
   slotFor(target) {
     const home2 = process.env.HOME || os2.homedir() || "";
-    return native.memorySlotForPath(
-      path4.resolve(target),
-      home2,
-      this.opts.memoryRoot,
-      this.opts.agentHomeDirs
-    );
+    return memorySlotOf(target, home2, this.opts.memoryRoot, this.opts.agentHomeDirs);
   }
   /**
    * Verify every memory file this call reads, each against its own chain slot.
@@ -3618,7 +3784,7 @@ var MemoryGuardManager = class {
   }
   /** Replace `target` in one step, so a reader never sees a half-written file. */
   async writeFileAtomic(target, content) {
-    await fs4.mkdir(path4.dirname(target), { recursive: true });
+    await fs4.mkdir(path3.dirname(target), { recursive: true });
     const tmp = `${target}.${process.pid}.tmp`;
     await fs4.writeFile(tmp, content, "utf8");
     await fs4.rename(tmp, target);
@@ -3758,6 +3924,7 @@ export {
   EciesDomain,
   HttpClient,
   HttpTransportError,
+  JudgeRefusalError,
   KEY_FILENAMES,
   MemoryGuardManager,
   MemoryIntegrityError,
@@ -3776,6 +3943,7 @@ export {
   columnAad,
   commitMemoryVersion,
   configureEvents,
+  configureJailHold,
   containsEvasionCharacters,
   containsSecret,
   createFileLogger,
@@ -3804,12 +3972,14 @@ export {
   getRollbackHistory,
   guardMemoryWrite,
   isEnvelope,
+  isJailHeld,
   isValidPrivateKey,
   keyFingerprintOf,
   keyPathCandidates,
   loadAgent,
   loadAgentFromFile,
   loadUserConfig,
+  memorySlotOf,
   normalizeActionForHash,
   normalizeActionType,
   normalizeForMatching,
@@ -3823,6 +3993,7 @@ export {
   recordEvent,
   redactJsonStrings,
   redactSecrets,
+  releaseJailHolds,
   resolve,
   resolveKeyPath,
   rollbackMemory,