@burtson-labs/host-kit 0.3.3 → 0.4.0

package/README.md

@@ -22,9 +22,11 @@ pnpm add @burtson-labs/host-kit
 
 ## <img src="https://api.iconify.design/lucide/puzzle.svg?color=%23a60ee5&width=22" align="absmiddle"> What's in the box
 
-- **Memory loader** — discovers and merges `BANDIT.md` / `CLAUDE.md` / `AGENTS.md` files across workspace + global locations
+- **Memory loader** — discovers and merges `BANDIT.md` / `CLAUDE.md` / `AGENTS.md` files across workspace + global locations; deduplicates overlapping content at load time; `consolidateMemory()` unifies multiple entry files into a single canonical `BANDIT.md` (symlink on macOS/Linux, copy-with-drift-warning on Windows)
+- **Topic memory** — lazy-load index at `.bandit/memory/MEMORY.md` (preferred) with back-compat reads from legacy root `MEMORY.md`; writes always go to `.bandit/memory/`; `migrateMemoryToBanditDir()` moves an existing root `memory/` layout into `.bandit/memory/` idempotently
 - **`@-mention` expansion** — detects `@path/to/file` in user input and inlines file contents (with secret redaction) or attaches images as base64
-- **Hook runner** — executes PreToolUse / PostToolUse / Stop / UserPromptSubmit hooks from `.bandit/settings.json` matching the Claude Code spec
+- **Hook runner** — executes PreToolUse / PostToolUse / Stop / UserPromptSubmit hooks; `loadHookSettings` merges the **global** `~/.bandit/settings.json` under the workspace `.bandit/settings.json` so hooks + permissions + the guard apply across every repo
+- **Pre-tool security guard** — `evaluateSecurityGuard(call, settings, ctx)`: an opt-in, in-process safety net (no shell spawn) that blocks catastrophic tool calls (`rm -rf /`, `curl … | sh`, disk wipes, credential exfil, writes to system/credential paths) before they run. Wired into `beforeToolExecute` in both hosts
 - **MCP loader** — reads `mcp-servers.json` (global + workspace, workspace wins), auto-injects `BANDIT_API_KEY`, registers servers with the pool
 - **Turn trace reader** — parses workspace and global `.bandit/turns/*.jsonl` into summaries and markdown timelines for CLI `/trace`, IDE `/trace`, tests, and future bug-bundle export
 - **Insights** — usage analytics aggregator (CLI sessions → human report)

package/dist/hooks.d.ts

@@ -15,6 +15,7 @@
  *   PreToolUse / PostToolUse provide: name, primary (first param value), duration (ms, Post only).
  * - A non-zero exit code from a PreToolUse hook aborts the tool call.
  */
+import type { SecurityGuardSettings } from './securityGuard';
 export type HookEvent = 'PreToolUse' | 'PostToolUse' | 'Stop';
 export interface HookRule {
     match?: string;
@@ -29,8 +30,15 @@ export interface PermissionsBlock {
 export interface HookSettings {
     hooks?: Partial<Record<HookEvent, HookRule[]>>;
     permissions?: PermissionsBlock;
+    /** Built-in pre-tool security guard (opt-in, off by default). Read under
+     *  `security.guard`. See securityGuard.ts. */
+    security?: {
+        guard?: SecurityGuardSettings;
+    };
 }
-export declare function loadHookSettings(cwd: string): Promise<HookSettings>;
+export declare function loadHookSettings(cwd: string, opts?: {
+    homeDir?: string;
+}): Promise<HookSettings>;
 /**
  * Persist an entry in the workspace settings.json permissions.allow list.
  * Called when the user picks "Always allow" in a permission prompt and wants

package/dist/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAyBzE;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,EAAE,CAAC,CAYvB"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;kDAC8C;IAC9C,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,qBAAqB,CAAA;KAAE,CAAC;CAC9C;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CA0CtG;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,EAAE,CAAC,CAYvB"}

package/dist/hooks.js

@@ -56,9 +56,16 @@ exports.runHooks = runHooks;
 const cp = __importStar(require("child_process"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const os = __importStar(require("os"));
 const DEFAULT_TIMEOUT_MS = 10000;
-async function loadHookSettings(cwd) {
+async function loadHookSettings(cwd, opts) {
+    // Global (~/.bandit) first, then workspace, then workspace .local — later
+    // files extend the earlier ones (hook/permission arrays concatenate; the
+    // security guard's scalar fields take the last value defined). This is what
+    // makes a user's GLOBAL hooks + guard apply to every repo, with per-project
+    // overrides on top. `opts.homeDir` overrides the global location (tests).
     const candidates = [
+        path.join(opts?.homeDir ?? os.homedir(), '.bandit', 'settings.json'),
         path.resolve(cwd, '.bandit/settings.json'),
         path.resolve(cwd, '.bandit/settings.local.json')
     ];
@@ -77,6 +84,17 @@ async function loadHookSettings(cwd) {
                 merged.permissions.deny = [...(merged.permissions.deny ?? []), ...(parsed.permissions.deny ?? [])];
                 merged.permissions.ask = [...(merged.permissions.ask ?? []), ...(parsed.permissions.ask ?? [])];
             }
+            if (parsed.security?.guard) {
+                const g = parsed.security.guard;
+                const cur = merged.security?.guard ?? {};
+                merged.security = {
+                    guard: {
+                        enabled: g.enabled ?? cur.enabled,
+                        blockCommands: [...(cur.blockCommands ?? []), ...(g.blockCommands ?? [])],
+                        protectPaths: [...(cur.protectPaths ?? []), ...(g.protectPaths ?? [])]
+                    }
+                };
+            }
         }
         catch {
             // Missing / invalid — skip silently.

package/dist/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BH,4CAyBC;AAOD,8CAiBC;AAcD,4BAiBC;AAzGD,kDAAoC;AACpC,uCAAyB;AACzB,2CAA6B;AAqB7B,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAE3B,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,uBAAuB,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC;KACjD,CAAC;IACF,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC;IAC1F,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;YAC/C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAgB,EAAE,CAAC;oBAC1D,MAAM,CAAC,KAAM,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,CAAC,WAAY,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAY,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxG,MAAM,CAAC,WAAY,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAY,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBACrG,MAAM,CAAC,WAAY,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAY,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAiB,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;IAClD,QAAQ,CAAC,WAAW,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACvF,CAAC;AAcM,KAAK,UAAU,QAAQ,CAC5B,KAAgB,EAChB,QAAsB,EACtB,GAAgB,EAChB,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,GAAgB;IAChD,OAAO,QAAQ;SACZ,OAAO,CAAC,qBAAqB,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;SAC/D,OAAO,CAAC,wBAAwB,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SACjE,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCH,4CA0CC;AAOD,8CAiBC;AAcD,4BAiBC;AA/HD,kDAAoC;AACpC,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAyBzB,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAE3B,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAA2B;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,uBAAuB,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC;KACjD,CAAC;IACF,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC;IAC1F,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;YAC/C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAgB,EAAE,CAAC;oBAC1D,MAAM,CAAC,KAAM,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,CAAC,WAAY,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAY,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxG,MAAM,CAAC,WAAY,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAY,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBACrG,MAAM,CAAC,WAAY,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAY,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAChC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;gBACzC,MAAM,CAAC,QAAQ,GAAG;oBAChB,KAAK,EAAE;wBACL,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO;wBACjC,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;wBACzE,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;qBACvE;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAiB,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;IAClD,QAAQ,CAAC,WAAW,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACvF,CAAC;AAcM,KAAK,UAAU,QAAQ,CAC5B,KAAgB,EAChB,QAAsB,EACtB,GAAgB,EAChB,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,GAAgB;IAChD,OAAO,QAAQ;SACZ,OAAO,CAAC,qBAAqB,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;SAC/D,OAAO,CAAC,wBAAwB,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;SACjE,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -1,11 +1,12 @@
-export { loadMemory, loadCombinedMemory, appendMemory, type MemoryBundle } from './memory';
-export { loadMemoryIndex, renderMemoryIndexBlock, MAX_INDEX_BYTES, MAX_MEMORY_FILE_BYTES, MEMORY_DIR, MEMORY_INDEX_FILE, type MemoryIndex, type MemoryIndexEntry, type MemoryWarnFn } from './memoryIndex';
+export { loadMemory, loadCombinedMemory, appendMemory, consolidateMemory, type MemoryBundle, type ConsolidationStrategy, type ConsolidationResult } from './memory';
+export { loadMemoryIndex, renderMemoryIndexBlock, writeMemoryTopic, migrateMemoryToBanditDir, MAX_INDEX_BYTES, MAX_MEMORY_FILE_BYTES, MEMORY_DIR, MEMORY_INDEX_FILE, BANDIT_DIR, BANDIT_MEMORY_DIR, BANDIT_MEMORY_INDEX_FILE, type MemoryIndex, type MemoryIndexEntry, type MemoryWarnFn } from './memoryIndex';
 export { buildReadMemoryTool } from './tools/readMemoryTool';
 export { loadMcpServersConfig, registerMcpServersFromDisk, globalMcpServersPath, persistMcpActivation, addMcpServerToConfig } from './mcp';
 export { buildGitHubServerConfig, looksLikeGitHubToken, buildSlackServerConfig, looksLikeSlackToken, looksLikeSlackTeamId, buildGitLabServerConfig, looksLikeGitLabToken, buildGmailServerConfig, looksLikeGmailCredentialsPath, buildCustomServerConfig } from './mcpConnectors';
 export { loadApprovedMcpFingerprints, approveMcpFingerprint, revokeMcpFingerprint, mcpTrustPath } from './mcpTrust';
 export { loadMcpToolCache, saveMcpToolEntry, pruneMcpToolCache, mcpToolCachePath } from './mcpToolCache';
 export { loadHookSettings, persistAllowEntry, runHooks, type HookEvent, type HookRule, type HookSettings, type HookContext, type HookResult, type PermissionsBlock } from './hooks';
+export { evaluateSecurityGuard, type SecurityGuardSettings, type SecurityGuardContext, type SecurityGuardDecision } from './securityGuard';
 export { expandMentions, type ExpandedPrompt } from './mentions';
 export { TodoStore, buildTodoWriteTool, buildWebFetchTool, buildWebSearchTool, type WebSearchToolOptions, buildRememberTool } from './tools/extraTools';
 export { buildTaskTool, buildCheckTaskTool, buildListTasksTool, type TaskToolOptions } from './tools/taskTool';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,OAAO,CAAC;AACf,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,oBAAoB,EACzB,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/G,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,EACb,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,OAAO,CAAC;AACf,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,oBAAoB,EACzB,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/G,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,EACb,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,18 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeInsights = exports.parseTestOutput = exports.buildTestCommand = exports.detectTestFramework = exports.buildTestRunTool = exports.buildListTasksTool = exports.buildCheckTaskTool = exports.buildTaskTool = exports.buildRememberTool = exports.buildWebSearchTool = exports.buildWebFetchTool = exports.buildTodoWriteTool = exports.TodoStore = exports.expandMentions = exports.runHooks = exports.persistAllowEntry = exports.loadHookSettings = exports.mcpToolCachePath = exports.pruneMcpToolCache = exports.saveMcpToolEntry = exports.loadMcpToolCache = exports.mcpTrustPath = exports.revokeMcpFingerprint = exports.approveMcpFingerprint = exports.loadApprovedMcpFingerprints = exports.buildCustomServerConfig = exports.looksLikeGmailCredentialsPath = exports.buildGmailServerConfig = exports.looksLikeGitLabToken = exports.buildGitLabServerConfig = exports.looksLikeSlackTeamId = exports.looksLikeSlackToken = exports.buildSlackServerConfig = exports.looksLikeGitHubToken = exports.buildGitHubServerConfig = exports.addMcpServerToConfig = exports.persistMcpActivation = exports.globalMcpServersPath = exports.registerMcpServersFromDisk = exports.loadMcpServersConfig = exports.buildReadMemoryTool = exports.MEMORY_INDEX_FILE = exports.MEMORY_DIR = exports.MAX_MEMORY_FILE_BYTES = exports.MAX_INDEX_BYTES = exports.renderMemoryIndexBlock = exports.loadMemoryIndex = exports.appendMemory = exports.loadCombinedMemory = exports.loadMemory = void 0;
-exports.CheckpointStore = exports.isChatCapable = exports.suggestOllamaMatch = exports.listInstalledOllamaModels = exports.formatTurnTraceMarkdown = exports.summarizeTurnTrace = exports.parseTurnLog = exports.readTurnTraceById = exports.readTurnTrace = exports.listTurnTraces = exports.listTurnTraceFiles = exports.previewText = exports.openTurnLog = exports.SessionPermissionStore = exports.mergePolicies = exports.emptyPolicy = exports.evaluatePermission = exports.InMemoryBackgroundTaskStore = exports.buildInsightsAiCallback = exports.buildAiInput = exports.writeInsightsReport = exports.renderInsightsHtml = void 0;
+exports.buildTaskTool = exports.buildRememberTool = exports.buildWebSearchTool = exports.buildWebFetchTool = exports.buildTodoWriteTool = exports.TodoStore = exports.expandMentions = exports.evaluateSecurityGuard = exports.runHooks = exports.persistAllowEntry = exports.loadHookSettings = exports.mcpToolCachePath = exports.pruneMcpToolCache = exports.saveMcpToolEntry = exports.loadMcpToolCache = exports.mcpTrustPath = exports.revokeMcpFingerprint = exports.approveMcpFingerprint = exports.loadApprovedMcpFingerprints = exports.buildCustomServerConfig = exports.looksLikeGmailCredentialsPath = exports.buildGmailServerConfig = exports.looksLikeGitLabToken = exports.buildGitLabServerConfig = exports.looksLikeSlackTeamId = exports.looksLikeSlackToken = exports.buildSlackServerConfig = exports.looksLikeGitHubToken = exports.buildGitHubServerConfig = exports.addMcpServerToConfig = exports.persistMcpActivation = exports.globalMcpServersPath = exports.registerMcpServersFromDisk = exports.loadMcpServersConfig = exports.buildReadMemoryTool = exports.BANDIT_MEMORY_INDEX_FILE = exports.BANDIT_MEMORY_DIR = exports.BANDIT_DIR = exports.MEMORY_INDEX_FILE = exports.MEMORY_DIR = exports.MAX_MEMORY_FILE_BYTES = exports.MAX_INDEX_BYTES = exports.migrateMemoryToBanditDir = exports.writeMemoryTopic = exports.renderMemoryIndexBlock = exports.loadMemoryIndex = exports.consolidateMemory = exports.appendMemory = exports.loadCombinedMemory = exports.loadMemory = void 0;
+exports.CheckpointStore = exports.isChatCapable = exports.suggestOllamaMatch = exports.listInstalledOllamaModels = exports.formatTurnTraceMarkdown = exports.summarizeTurnTrace = exports.parseTurnLog = exports.readTurnTraceById = exports.readTurnTrace = exports.listTurnTraces = exports.listTurnTraceFiles = exports.previewText = exports.openTurnLog = exports.SessionPermissionStore = exports.mergePolicies = exports.emptyPolicy = exports.evaluatePermission = exports.InMemoryBackgroundTaskStore = exports.buildInsightsAiCallback = exports.buildAiInput = exports.writeInsightsReport = exports.renderInsightsHtml = exports.computeInsights = exports.parseTestOutput = exports.buildTestCommand = exports.detectTestFramework = exports.buildTestRunTool = exports.buildListTasksTool = exports.buildCheckTaskTool = void 0;
 var memory_1 = require("./memory");
 Object.defineProperty(exports, "loadMemory", { enumerable: true, get: function () { return memory_1.loadMemory; } });
 Object.defineProperty(exports, "loadCombinedMemory", { enumerable: true, get: function () { return memory_1.loadCombinedMemory; } });
 Object.defineProperty(exports, "appendMemory", { enumerable: true, get: function () { return memory_1.appendMemory; } });
+Object.defineProperty(exports, "consolidateMemory", { enumerable: true, get: function () { return memory_1.consolidateMemory; } });
 var memoryIndex_1 = require("./memoryIndex");
 Object.defineProperty(exports, "loadMemoryIndex", { enumerable: true, get: function () { return memoryIndex_1.loadMemoryIndex; } });
 Object.defineProperty(exports, "renderMemoryIndexBlock", { enumerable: true, get: function () { return memoryIndex_1.renderMemoryIndexBlock; } });
+Object.defineProperty(exports, "writeMemoryTopic", { enumerable: true, get: function () { return memoryIndex_1.writeMemoryTopic; } });
+Object.defineProperty(exports, "migrateMemoryToBanditDir", { enumerable: true, get: function () { return memoryIndex_1.migrateMemoryToBanditDir; } });
 Object.defineProperty(exports, "MAX_INDEX_BYTES", { enumerable: true, get: function () { return memoryIndex_1.MAX_INDEX_BYTES; } });
 Object.defineProperty(exports, "MAX_MEMORY_FILE_BYTES", { enumerable: true, get: function () { return memoryIndex_1.MAX_MEMORY_FILE_BYTES; } });
 Object.defineProperty(exports, "MEMORY_DIR", { enumerable: true, get: function () { return memoryIndex_1.MEMORY_DIR; } });
 Object.defineProperty(exports, "MEMORY_INDEX_FILE", { enumerable: true, get: function () { return memoryIndex_1.MEMORY_INDEX_FILE; } });
+Object.defineProperty(exports, "BANDIT_DIR", { enumerable: true, get: function () { return memoryIndex_1.BANDIT_DIR; } });
+Object.defineProperty(exports, "BANDIT_MEMORY_DIR", { enumerable: true, get: function () { return memoryIndex_1.BANDIT_MEMORY_DIR; } });
+Object.defineProperty(exports, "BANDIT_MEMORY_INDEX_FILE", { enumerable: true, get: function () { return memoryIndex_1.BANDIT_MEMORY_INDEX_FILE; } });
 var readMemoryTool_1 = require("./tools/readMemoryTool");
 Object.defineProperty(exports, "buildReadMemoryTool", { enumerable: true, get: function () { return readMemoryTool_1.buildReadMemoryTool; } });
 var mcp_1 = require("./mcp");
@@ -46,6 +52,8 @@ var hooks_1 = require("./hooks");
 Object.defineProperty(exports, "loadHookSettings", { enumerable: true, get: function () { return hooks_1.loadHookSettings; } });
 Object.defineProperty(exports, "persistAllowEntry", { enumerable: true, get: function () { return hooks_1.persistAllowEntry; } });
 Object.defineProperty(exports, "runHooks", { enumerable: true, get: function () { return hooks_1.runHooks; } });
+var securityGuard_1 = require("./securityGuard");
+Object.defineProperty(exports, "evaluateSecurityGuard", { enumerable: true, get: function () { return securityGuard_1.evaluateSecurityGuard; } });
 var mentions_1 = require("./mentions");
 Object.defineProperty(exports, "expandMentions", { enumerable: true, get: function () { return mentions_1.expandMentions; } });
 var extraTools_1 = require("./tools/extraTools");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAAA,mCAA2F;AAAlF,oGAAA,UAAU,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,sGAAA,YAAY,OAAA;AACrD,6CAUuB;AATrB,8GAAA,eAAe,OAAA;AACf,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AACf,oHAAA,qBAAqB,OAAA;AACrB,yGAAA,UAAU,OAAA;AACV,gHAAA,iBAAiB,OAAA;AAKnB,yDAA6D;AAApD,qHAAA,mBAAmB,OAAA;AAC5B,6BAMe;AALb,2GAAA,oBAAoB,OAAA;AACpB,iHAAA,0BAA0B,OAAA;AAC1B,2GAAA,oBAAoB,OAAA;AACpB,2GAAA,oBAAoB,OAAA;AACpB,2GAAA,oBAAoB,OAAA;AAEtB,iDAWyB;AAVvB,wHAAA,uBAAuB,OAAA;AACvB,qHAAA,oBAAoB,OAAA;AACpB,uHAAA,sBAAsB,OAAA;AACtB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,wHAAA,uBAAuB,OAAA;AACvB,qHAAA,oBAAoB,OAAA;AACpB,uHAAA,sBAAsB,OAAA;AACtB,8HAAA,6BAA6B,OAAA;AAC7B,wHAAA,uBAAuB,OAAA;AAEzB,uCAKoB;AAJlB,uHAAA,2BAA2B,OAAA;AAC3B,iHAAA,qBAAqB,OAAA;AACrB,gHAAA,oBAAoB,OAAA;AACpB,wGAAA,YAAY,OAAA;AAEd,+CAKwB;AAJtB,gHAAA,gBAAgB,OAAA;AAChB,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AACjB,gHAAA,gBAAgB,OAAA;AAElB,iCAUiB;AATf,yGAAA,gBAAgB,OAAA;AAChB,0GAAA,iBAAiB,OAAA;AACjB,iGAAA,QAAQ,OAAA;AAQV,uCAAiE;AAAxD,0GAAA,cAAc,OAAA;AACvB,iDAO4B;AAN1B,uGAAA,SAAS,OAAA;AACT,gHAAA,kBAAkB,OAAA;AAClB,+GAAA,iBAAiB,OAAA;AACjB,gHAAA,kBAAkB,OAAA;AAElB,+GAAA,iBAAiB,OAAA;AAEnB,6CAA+G;AAAtG,yGAAA,aAAa,OAAA;AAAE,8GAAA,kBAAkB,OAAA;AAAE,8GAAA,kBAAkB,OAAA;AAC9D,mDAO6B;AAN3B,+GAAA,gBAAgB,OAAA;AAChB,kHAAA,mBAAmB,OAAA;AACnB,+GAAA,gBAAgB,OAAA;AAChB,8GAAA,eAAe,OAAA;AAIjB,uCAaoB;AAZlB,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAClB,+GAAA,mBAAmB,OAAA;AACnB,wGAAA,YAAY,OAAA;AACZ,mHAAA,uBAAuB,OAAA;AASzB,qDAM2B;AALzB,8HAAA,2BAA2B,OAAA;AAM7B,6CAOuB;AANrB,iHAAA,kBAAkB,OAAA;AAClB,0GAAA,WAAW,OAAA;AACX,4GAAA,aAAa,OAAA;AACb,qHAAA,sBAAsB,OAAA;AAIxB,qCAgBmB;AAfjB,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,6GAAA,kBAAkB,OAAA;AAClB,yGAAA,cAAc,OAAA;AACd,wGAAA,aAAa,OAAA;AACb,4GAAA,iBAAiB,OAAA;AACjB,uGAAA,YAAY,OAAA;AACZ,6GAAA,kBAAkB,OAAA;AAClB,kHAAA,uBAAuB,OAAA;AAQzB,+CAKwB;AAJtB,yHAAA,yBAAyB,OAAA;AACzB,kHAAA,kBAAkB,OAAA;AAClB,6GAAA,aAAa,OAAA;AAGf,6CAKuB;AAJrB,8GAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAAA,mCAQkB;AAPhB,oGAAA,UAAU,OAAA;AACV,4GAAA,kBAAkB,OAAA;AAClB,sGAAA,YAAY,OAAA;AACZ,2GAAA,iBAAiB,OAAA;AAKnB,6CAeuB;AAdrB,8GAAA,eAAe,OAAA;AACf,qHAAA,sBAAsB,OAAA;AACtB,+GAAA,gBAAgB,OAAA;AAChB,uHAAA,wBAAwB,OAAA;AACxB,8GAAA,eAAe,OAAA;AACf,oHAAA,qBAAqB,OAAA;AACrB,yGAAA,UAAU,OAAA;AACV,gHAAA,iBAAiB,OAAA;AACjB,yGAAA,UAAU,OAAA;AACV,gHAAA,iBAAiB,OAAA;AACjB,uHAAA,wBAAwB,OAAA;AAK1B,yDAA6D;AAApD,qHAAA,mBAAmB,OAAA;AAC5B,6BAMe;AALb,2GAAA,oBAAoB,OAAA;AACpB,iHAAA,0BAA0B,OAAA;AAC1B,2GAAA,oBAAoB,OAAA;AACpB,2GAAA,oBAAoB,OAAA;AACpB,2GAAA,oBAAoB,OAAA;AAEtB,iDAWyB;AAVvB,wHAAA,uBAAuB,OAAA;AACvB,qHAAA,oBAAoB,OAAA;AACpB,uHAAA,sBAAsB,OAAA;AACtB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,wHAAA,uBAAuB,OAAA;AACvB,qHAAA,oBAAoB,OAAA;AACpB,uHAAA,sBAAsB,OAAA;AACtB,8HAAA,6BAA6B,OAAA;AAC7B,wHAAA,uBAAuB,OAAA;AAEzB,uCAKoB;AAJlB,uHAAA,2BAA2B,OAAA;AAC3B,iHAAA,qBAAqB,OAAA;AACrB,gHAAA,oBAAoB,OAAA;AACpB,wGAAA,YAAY,OAAA;AAEd,+CAKwB;AAJtB,gHAAA,gBAAgB,OAAA;AAChB,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AACjB,gHAAA,gBAAgB,OAAA;AAElB,iCAUiB;AATf,yGAAA,gBAAgB,OAAA;AAChB,0GAAA,iBAAiB,OAAA;AACjB,iGAAA,QAAQ,OAAA;AAQV,iDAKyB;AAJvB,sHAAA,qBAAqB,OAAA;AAKvB,uCAAiE;AAAxD,0GAAA,cAAc,OAAA;AACvB,iDAO4B;AAN1B,uGAAA,SAAS,OAAA;AACT,gHAAA,kBAAkB,OAAA;AAClB,+GAAA,iBAAiB,OAAA;AACjB,gHAAA,kBAAkB,OAAA;AAElB,+GAAA,iBAAiB,OAAA;AAEnB,6CAA+G;AAAtG,yGAAA,aAAa,OAAA;AAAE,8GAAA,kBAAkB,OAAA;AAAE,8GAAA,kBAAkB,OAAA;AAC9D,mDAO6B;AAN3B,+GAAA,gBAAgB,OAAA;AAChB,kHAAA,mBAAmB,OAAA;AACnB,+GAAA,gBAAgB,OAAA;AAChB,8GAAA,eAAe,OAAA;AAIjB,uCAaoB;AAZlB,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAClB,+GAAA,mBAAmB,OAAA;AACnB,wGAAA,YAAY,OAAA;AACZ,mHAAA,uBAAuB,OAAA;AASzB,qDAM2B;AALzB,8HAAA,2BAA2B,OAAA;AAM7B,6CAOuB;AANrB,iHAAA,kBAAkB,OAAA;AAClB,0GAAA,WAAW,OAAA;AACX,4GAAA,aAAa,OAAA;AACb,qHAAA,sBAAsB,OAAA;AAIxB,qCAgBmB;AAfjB,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,6GAAA,kBAAkB,OAAA;AAClB,yGAAA,cAAc,OAAA;AACd,wGAAA,aAAa,OAAA;AACb,4GAAA,iBAAiB,OAAA;AACjB,uGAAA,YAAY,OAAA;AACZ,6GAAA,kBAAkB,OAAA;AAClB,kHAAA,uBAAuB,OAAA;AAQzB,+CAKwB;AAJtB,yHAAA,yBAAyB,OAAA;AACzB,kHAAA,kBAAkB,OAAA;AAClB,6GAAA,aAAa,OAAA;AAGf,6CAKuB;AAJrB,8GAAA,eAAe,OAAA"}

package/dist/memory.d.ts

@@ -2,6 +2,20 @@
  * Memory — auto-load workspace-local context files (BANDIT.md / CLAUDE.md)
  * and inline them into the system prompt so the agent follows project rules
  * without being re-told on every turn.
+ *
+ * ## Deduplication (v0.4)
+ *
+ * When a repo has more than one of BANDIT.md / CLAUDE.md / AGENTS.md (e.g.
+ * a migration-in-progress state), loadMemory will skip files whose content
+ * is identical — or whose entire text is already present inside a
+ * previously-loaded file — so the model doesn't see duplicated context.
+ *
+ * ## Consolidation
+ *
+ * `consolidateMemory(cwd)` merges all found entry files into a single
+ * canonical BANDIT.md and makes the others point at it. On macOS/Linux a
+ * symlink is preferred; on Windows (or when the symlink attempt fails) it
+ * writes an exact copy with a drift warning header.
  */
 import { type MemoryWarnFn } from './memoryIndex';
 export interface MemoryBundle {
@@ -10,7 +24,7 @@ export interface MemoryBundle {
     sources: string[];
 }
 /**
- * loadMemory + MEMORY.md index, fused into a single bundle the host can
+ * loadMemory + topic-memory index, fused into a single bundle the host can
  * inject as the system-prompt memory block. Always-loaded files come
  * first; the index follows under its own source marker so the model
  * knows which entries are full content vs. on-demand topic pointers.
@@ -19,6 +33,19 @@ export interface MemoryBundle {
  * the `/memory` slash command and boot-status output.
  */
 export declare function loadCombinedMemory(cwd: string, warn?: MemoryWarnFn): Promise<MemoryBundle>;
+/**
+ * Read and deduplicate memory candidate files.
+ *
+ * Dedup strategy: after normalising whitespace, if the trimmed content of a
+ * candidate is entirely contained within the already-accumulated text (or is
+ * byte-identical to a previously loaded file) we skip it. This handles the
+ * common case where CLAUDE.md was copied verbatim into BANDIT.md during a
+ * migration, or where .bandit/memory.md echoes the root BANDIT.md.
+ *
+ * We do NOT try to dedupe at the paragraph/section level — that would require
+ * NLP and is overkill. The simple containment check catches >90% of real-world
+ * cases.
+ */
 export declare function loadMemory(cwd: string): Promise<MemoryBundle>;
 /**
  * Append a single fact to project memory so it survives across sessions.
@@ -35,4 +62,40 @@ export declare function loadMemory(cwd: string): Promise<MemoryBundle>;
  * and needs to see WHERE the fact landed.
  */
 export declare function appendMemory(cwd: string, fact: string): Promise<string>;
+export type ConsolidationStrategy = 'symlink-or-copy' | 'copy';
+export interface ConsolidationResult {
+    /** Absolute path of the canonical file (root BANDIT.md). */
+    canonical: string;
+    /** Files that were made to point at the canonical (symlinked or copied). */
+    redirected: string[];
+    /** 'symlink' when the OS supports it, 'copy' as fallback. */
+    method: 'symlink' | 'copy';
+    /** Files that were already identical/symlinked (skipped). */
+    skipped: string[];
+}
+/**
+ * Consolidate multiple memory entry files (BANDIT.md / CLAUDE.md / AGENTS.md)
+ * into a single canonical `BANDIT.md`. The canonical file gets the merged
+ * content; each other file that previously had unique content becomes a
+ * pointer (symlink or copy) to BANDIT.md.
+ *
+ * ## Symlink vs copy decision
+ *
+ * - macOS / Linux: the function attempts `fs.symlink(canonical, other)`. If
+ *   it succeeds, method === 'symlink'.
+ * - Windows (or when symlink creation fails with EPERM / ENOTSUP): falls back
+ *   to writing an exact copy of BANDIT.md into the other file, prefixed with a
+ *   comment warning that it can drift. method === 'copy'.
+ * - Callers can force 'copy' via the `strategy` option to skip the symlink
+ *   attempt entirely.
+ *
+ * **Tradeoff**: symlinks are invisible to tools that `cat` the file, so editors
+ * show the canonical content transparently. Copies can drift if BANDIT.md is
+ * updated without running consolidateMemory again. There is no perfect answer;
+ * symlinks are preferred wherever supported.
+ *
+ * @param cwd       Workspace root
+ * @param strategy  'symlink-or-copy' (default) | 'copy'
+ */
+export declare function consolidateMemory(cwd: string, strategy?: ConsolidationStrategy): Promise<ConsolidationResult>;
 //# sourceMappingURL=memory.d.ts.map

package/dist/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAWvB,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAUhG;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAsBnE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC7E"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAWvB,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAUhG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA+BnE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC7E;AAID,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6DAA6D;IAC7D,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,qBAAyC,GAClD,OAAO,CAAC,mBAAmB,CAAC,CAkG9B"}

package/dist/memory.js

@@ -3,6 +3,20 @@
  * Memory — auto-load workspace-local context files (BANDIT.md / CLAUDE.md)
  * and inline them into the system prompt so the agent follows project rules
  * without being re-told on every turn.
+ *
+ * ## Deduplication (v0.4)
+ *
+ * When a repo has more than one of BANDIT.md / CLAUDE.md / AGENTS.md (e.g.
+ * a migration-in-progress state), loadMemory will skip files whose content
+ * is identical — or whose entire text is already present inside a
+ * previously-loaded file — so the model doesn't see duplicated context.
+ *
+ * ## Consolidation
+ *
+ * `consolidateMemory(cwd)` merges all found entry files into a single
+ * canonical BANDIT.md and makes the others point at it. On macOS/Linux a
+ * symlink is preferred; on Windows (or when the symlink attempt fails) it
+ * writes an exact copy with a drift warning header.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -41,7 +55,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadCombinedMemory = loadCombinedMemory;
 exports.loadMemory = loadMemory;
 exports.appendMemory = appendMemory;
+exports.consolidateMemory = consolidateMemory;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const memoryIndex_1 = require("./memoryIndex");
 const CANDIDATES = [
@@ -53,7 +69,7 @@ const CANDIDATES = [
 ];
 const MAX_BYTES = 32 * 1024;
 /**
- * loadMemory + MEMORY.md index, fused into a single bundle the host can
+ * loadMemory + topic-memory index, fused into a single bundle the host can
  * inject as the system-prompt memory block. Always-loaded files come
  * first; the index follows under its own source marker so the model
  * knows which entries are full content vs. on-demand topic pointers.
@@ -67,15 +83,30 @@ async function loadCombinedMemory(cwd, warn) {
     const indexBlock = (0, memoryIndex_1.renderMemoryIndexBlock)(index);
     if (!indexBlock)
         return base;
-    const headed = `<!-- source: ${memoryIndex_1.MEMORY_INDEX_FILE} -->\n${indexBlock}`;
+    const headed = `<!-- source: ${memoryIndex_1.BANDIT_MEMORY_INDEX_FILE} -->\n${indexBlock}`;
     return {
         content: base.content ? `${base.content}\n\n${headed}` : headed,
-        sources: index.source ? [...base.sources, memoryIndex_1.MEMORY_INDEX_FILE] : base.sources
+        sources: index.source ? [...base.sources, memoryIndex_1.BANDIT_MEMORY_INDEX_FILE] : base.sources
     };
 }
+/**
+ * Read and deduplicate memory candidate files.
+ *
+ * Dedup strategy: after normalising whitespace, if the trimmed content of a
+ * candidate is entirely contained within the already-accumulated text (or is
+ * byte-identical to a previously loaded file) we skip it. This handles the
+ * common case where CLAUDE.md was copied verbatim into BANDIT.md during a
+ * migration, or where .bandit/memory.md echoes the root BANDIT.md.
+ *
+ * We do NOT try to dedupe at the paragraph/section level — that would require
+ * NLP and is overkill. The simple containment check catches >90% of real-world
+ * cases.
+ */
 async function loadMemory(cwd) {
     const sections = [];
     const sources = [];
+    // Accumulated normalised text for containment checks
+    const seen = [];
     for (const rel of CANDIDATES) {
         const abs = path.resolve(cwd, rel);
         try {
@@ -84,8 +115,14 @@ async function loadMemory(cwd) {
                 continue;
             const truncated = raw.byteLength > MAX_BYTES;
             const text = raw.subarray(0, MAX_BYTES).toString('utf-8');
+            // Dedup: skip if trimmed content is identical to or fully contained
+            // within something we've already loaded.
+            const normalised = text.trim();
+            if (normalised && isDuplicate(normalised, seen))
+                continue;
             sections.push(`<!-- source: ${rel} -->\n${text}${truncated ? '\n… (truncated)' : ''}`);
             sources.push(rel);
+            seen.push(normalised);
         }
         catch {
             // Not present — that's fine.
@@ -148,4 +185,143 @@ async function appendMemory(cwd, fact) {
     await fs.promises.writeFile(abs, next, 'utf-8');
     return abs;
 }
+/**
+ * Consolidate multiple memory entry files (BANDIT.md / CLAUDE.md / AGENTS.md)
+ * into a single canonical `BANDIT.md`. The canonical file gets the merged
+ * content; each other file that previously had unique content becomes a
+ * pointer (symlink or copy) to BANDIT.md.
+ *
+ * ## Symlink vs copy decision
+ *
+ * - macOS / Linux: the function attempts `fs.symlink(canonical, other)`. If
+ *   it succeeds, method === 'symlink'.
+ * - Windows (or when symlink creation fails with EPERM / ENOTSUP): falls back
+ *   to writing an exact copy of BANDIT.md into the other file, prefixed with a
+ *   comment warning that it can drift. method === 'copy'.
+ * - Callers can force 'copy' via the `strategy` option to skip the symlink
+ *   attempt entirely.
+ *
+ * **Tradeoff**: symlinks are invisible to tools that `cat` the file, so editors
+ * show the canonical content transparently. Copies can drift if BANDIT.md is
+ * updated without running consolidateMemory again. There is no perfect answer;
+ * symlinks are preferred wherever supported.
+ *
+ * @param cwd       Workspace root
+ * @param strategy  'symlink-or-copy' (default) | 'copy'
+ */
+async function consolidateMemory(cwd, strategy = 'symlink-or-copy') {
+    const ENTRY_FILES = ['BANDIT.md', 'CLAUDE.md', 'AGENTS.md'];
+    const canonical = path.resolve(cwd, 'BANDIT.md');
+    // Gather unique content from all present files
+    const present = [];
+    for (const rel of ENTRY_FILES) {
+        const abs = path.resolve(cwd, rel);
+        try {
+            const content = await fs.promises.readFile(abs, 'utf-8');
+            if (content.trim())
+                present.push({ rel, abs, content });
+        }
+        catch {
+            // Not present
+        }
+    }
+    if (present.length === 0) {
+        // Nothing to consolidate — return an empty result
+        return { canonical, redirected: [], method: 'copy', skipped: [] };
+    }
+    // Check if all non-canonical files are already symlinks pointing at canonical
+    const canonicalEntry = present.find((f) => f.rel === 'BANDIT.md');
+    // Build merged content: deduplicate sections from all sources
+    const mergedParts = [];
+    const mergedSeen = [];
+    for (const { rel, content } of present) {
+        const normalised = content.trim();
+        if (!normalised || isDuplicate(normalised, mergedSeen))
+            continue;
+        mergedParts.push(content.trimEnd());
+        mergedSeen.push(normalised);
+        if (rel !== 'BANDIT.md') {
+            // Add a provenance comment when merging in content from another file
+            mergedParts[mergedParts.length - 1] =
+                `<!-- merged from ${rel} -->\n${mergedParts[mergedParts.length - 1]}`;
+        }
+    }
+    // If BANDIT.md doesn't exist yet, provide scaffold
+    if (!canonicalEntry) {
+        mergedParts.unshift('# Project Memory\n');
+    }
+    const merged = mergedParts.join('\n\n') + '\n';
+    await fs.promises.writeFile(canonical, merged, 'utf-8');
+    // Redirect other files to the canonical
+    const redirected = [];
+    const skipped = [];
+    let method = 'copy';
+    const useSymlink = strategy === 'symlink-or-copy' && !isWindows();
+    for (const { rel, abs } of present) {
+        if (rel === 'BANDIT.md')
+            continue;
+        // Check if already a symlink pointing at canonical
+        try {
+            const lstat = await fs.promises.lstat(abs);
+            if (lstat.isSymbolicLink()) {
+                const target = await fs.promises.readlink(abs);
+                const resolvedTarget = path.resolve(path.dirname(abs), target);
+                if (resolvedTarget === canonical) {
+                    skipped.push(abs);
+                    continue;
+                }
+            }
+        }
+        catch {
+            // Not a symlink — fall through
+        }
+        if (useSymlink) {
+            try {
+                // Remove the old file first, then create symlink
+                await fs.promises.unlink(abs);
+                // Use a relative symlink so the repo is portable
+                const rel_target = path.relative(path.dirname(abs), canonical);
+                await fs.promises.symlink(rel_target, abs);
+                method = 'symlink';
+                redirected.push(abs);
+                continue;
+            }
+            catch {
+                // Symlink failed — fall through to copy
+            }
+        }
+        // Copy: write a copy with a drift-warning header
+        const driftWarning = `<!-- COPY of BANDIT.md — generated by consolidateMemory.\n` +
+            `     This file may drift if BANDIT.md is updated without re-running consolidation.\n` +
+            `     On macOS/Linux prefer symlinks (strategy: 'symlink-or-copy'). -->\n\n`;
+        const copy = await fs.promises.readFile(canonical, 'utf-8');
+        await fs.promises.writeFile(abs, driftWarning + copy, 'utf-8');
+        redirected.push(abs);
+    }
+    return { canonical, redirected, method, skipped };
+}
+// ── Internal helpers ────────────────────────────────────────────────────────
+/**
+ * Returns true when `candidate` is already represented in `seen`:
+ * either as an exact match, or as a substring of an already-loaded block.
+ *
+ * Normalises runs of whitespace before comparing so minor formatting
+ * differences (trailing newlines, blank-line count) don't prevent dedup.
+ */
+function normaliseWS(s) {
+    return s.replace(/\s+/g, ' ').trim();
+}
+function isDuplicate(candidate, seen) {
+    const normCandidate = normaliseWS(candidate);
+    for (const s of seen) {
+        const normS = normaliseWS(s);
+        if (normS === normCandidate || normS.includes(normCandidate)) {
+            return true;
+        }
+    }
+    return false;
+}
+function isWindows() {
+    return os.platform() === 'win32';
+}
 //# sourceMappingURL=memory.js.map

package/dist/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCH,gDAUC;AAED,gCAsBC;AAgBD,oCAkCC;AArHD,uCAAyB;AACzB,2CAA6B;AAC7B,+CAKuB;AAEvB,MAAM,UAAU,GAAG;IACjB,WAAW;IACX,WAAW;IACX,WAAW,EAAE,sFAAsF;IACnG,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AACF,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAQ5B;;;;;;;;GAQG;AACI,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAmB;IACvE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,IAAA,6BAAe,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAA,oCAAsB,EAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,gBAAgB,+BAAiB,SAAS,UAAU,EAAE,CAAC;IACtE,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM;QAC/D,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,+BAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;KAC5E,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC;gBAAE,SAAS;YACnC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,gBAAgB,GAAG,SAAS,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,+CAA+C;QAC/C,QAAQ;YACN,sBAAsB;gBACtB,qEAAqE;gBACrE,wEAAwE;gBACxE,uEAAuE;gBACvE,kBAAkB,CAAC;IACvB,CAAC;IACD,iEAAiE;IACjE,6CAA6C;IAC7C,MAAM,aAAa,GAAG,UAAU,CAAC;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,aAAa,EAAE,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,KAAK,OAAO,EAAE,CAAC;IAC9B,IAAI,IAAY,CAAC;IACjB,IAAI,UAAU,EAAE,CAAC;QACf,oEAAoE;QACpE,oEAAoE;QACpE,kBAAkB;QAClB,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,MAAM,IAAI,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACrF,IAAI,GAAG,GAAG,QAAQ,GAAG,GAAG,GAAG,aAAa,OAAO,MAAM,IAAI,CAAC;IAC5D,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCH,gDAUC;AAeD,gCA+BC;AAgBD,oCAkCC;AAyCD,8CAqGC;AA1RD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,+CAKuB;AAEvB,MAAM,UAAU,GAAG;IACjB,WAAW;IACX,WAAW;IACX,WAAW,EAAE,sFAAsF;IACnG,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AACF,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAQ5B;;;;;;;;GAQG;AACI,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAmB;IACvE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,IAAA,6BAAe,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAA,oCAAsB,EAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,gBAAgB,sCAAwB,SAAS,UAAU,EAAE,CAAC;IAC7E,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM;QAC/D,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,sCAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;KACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,qDAAqD;IACrD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC;gBAAE,SAAS;YACnC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAE1D,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,UAAU,IAAI,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC;gBAAE,SAAS;YAE1D,QAAQ,CAAC,IAAI,CAAC,gBAAgB,GAAG,SAAS,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,+CAA+C;QAC/C,QAAQ;YACN,sBAAsB;gBACtB,qEAAqE;gBACrE,wEAAwE;gBACxE,uEAAuE;gBACvE,kBAAkB,CAAC;IACvB,CAAC;IACD,iEAAiE;IACjE,6CAA6C;IAC7C,MAAM,aAAa,GAAG,UAAU,CAAC;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,aAAa,EAAE,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,KAAK,OAAO,EAAE,CAAC;IAC9B,IAAI,IAAY,CAAC;IACjB,IAAI,UAAU,EAAE,CAAC;QACf,oEAAoE;QACpE,oEAAoE;QACpE,kBAAkB;QAClB,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,MAAM,IAAI,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACrF,IAAI,GAAG,GAAG,QAAQ,GAAG,GAAG,GAAG,aAAa,OAAO,MAAM,IAAI,CAAC;IAC5D,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACI,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,WAAkC,iBAAiB;IAEnD,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAEjD,+CAA+C;IAC/C,MAAM,OAAO,GAAyD,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,IAAI,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,kDAAkD;QAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;IAElE,8DAA8D;IAC9D,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC;YAAE,SAAS;QACjE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,qEAAqE;YACrE,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjC,oBAAoB,GAAG,SAAS,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC/C,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAExD,wCAAwC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAuB,MAAM,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,KAAK,iBAAiB,IAAI,CAAC,SAAS,EAAE,CAAC;IAElE,KAAK,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QAElC,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC/D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,iDAAiD;gBACjD,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9B,iDAAiD;gBACjD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC/D,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC3C,MAAM,GAAG,SAAS,CAAC;gBACnB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;YAC1C,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,YAAY,GAChB,4DAA4D;YAC5D,sFAAsF;YACtF,4EAA4E,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,IAAc;IACpD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;AACnC,CAAC"}

package/dist/memoryIndex.d.ts

@@ -2,6 +2,9 @@ export declare const MAX_INDEX_BYTES: number;
 export declare const MAX_MEMORY_FILE_BYTES: number;
 export declare const MEMORY_DIR = "memory";
 export declare const MEMORY_INDEX_FILE = "MEMORY.md";
+export declare const BANDIT_DIR = ".bandit";
+export declare const BANDIT_MEMORY_DIR = ".bandit/memory";
+export declare const BANDIT_MEMORY_INDEX_FILE = ".bandit/memory/MEMORY.md";
 export interface MemoryIndexEntry {
     /** Slug derived from filename (e.g. "auth-conventions"). Used as the `name` arg to read_memory. */
     name: string;
@@ -19,7 +22,7 @@ export interface MemoryIndex {
     indexContent: string;
     /** Parsed entries; dangling links are dropped (with a warning). */
     entries: MemoryIndexEntry[];
-    /** Absolute path of MEMORY.md if found, else null. */
+    /** Absolute path of MEMORY.md if found, else null. Prefers .bandit/memory/MEMORY.md. */
     source: string | null;
 }
 /**
@@ -34,5 +37,36 @@ export type MemoryWarnFn = (msg: string) => void;
  * entries so the caller can `if (block) ...` without a null check.
  */
 export declare function renderMemoryIndexBlock(index: MemoryIndex): string;
+/**
+ * Load the memory index, searching both `.bandit/memory/MEMORY.md` (preferred)
+ * and the legacy root `MEMORY.md`. Entries from `.bandit/memory/` win on slug
+ * collisions. Returns a merged MemoryIndex.
+ */
 export declare function loadMemoryIndex(cwd: string, warn?: MemoryWarnFn): Promise<MemoryIndex>;
+/**
+ * Write a new topic file + update the index. Always writes to `.bandit/memory/`.
+ *
+ * @param cwd     Workspace root
+ * @param slug    Plain slug, e.g. "auth-conventions"
+ * @param title   Human label for the index entry
+ * @param hook    One-line hook (when is this relevant?)
+ * @param body    Full markdown body for the topic file
+ * @returns The absolute path of the written topic file
+ */
+export declare function writeMemoryTopic(cwd: string, slug: string, title: string, hook: string, body: string): Promise<string>;
+/**
+ * One-time, idempotent migration: moves root `MEMORY.md` + `memory/` into
+ * `.bandit/memory/`. Safe to call on every startup — bails out early if:
+ *   - the target `.bandit/memory/MEMORY.md` already exists, OR
+ *   - the source root `MEMORY.md` does not exist.
+ *
+ * Steps:
+ *   1. Creates `.bandit/memory/` if needed.
+ *   2. Copies each `memory/<slug>.md` to `.bandit/memory/<slug>.md`.
+ *   3. Copies (rewrites) `MEMORY.md` to `.bandit/memory/MEMORY.md`.
+ *   4. Does NOT delete the originals (safe — caller can clean up if desired).
+ *
+ * @returns Array of absolute paths written (empty when migration is skipped).
+ */
+export declare function migrateMemoryToBanditDir(cwd: string): Promise<string[]>;
 //# sourceMappingURL=memoryIndex.d.ts.map

package/dist/memoryIndex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memoryIndex.d.ts","sourceRoot":"","sources":["../src/memoryIndex.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,eAAe,QAAW,CAAC;AACxC,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAC/C,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,0FAA0F;IAC1F,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAQD;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;AAMjD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAWjE;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,YAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CAuDzG"}
+{"version":3,"file":"memoryIndex.d.ts","sourceRoot":"","sources":["../src/memoryIndex.ts"],"names":[],"mappings":"AA+BA,eAAO,MAAM,eAAe,QAAW,CAAC;AACxC,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAG/C,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAG7C,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAClD,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,MAAM,WAAW,gBAAgB;IAC/B,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,0FAA0F;IAC1F,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,wFAAwF;IACxF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAUD;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;AAMjD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAWjE;AAuED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,YAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CA2DzG;AAID;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkD7E"}

package/dist/memoryIndex.js

@@ -33,31 +33,52 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MEMORY_INDEX_FILE = exports.MEMORY_DIR = exports.MAX_MEMORY_FILE_BYTES = exports.MAX_INDEX_BYTES = void 0;
+exports.BANDIT_MEMORY_INDEX_FILE = exports.BANDIT_MEMORY_DIR = exports.BANDIT_DIR = exports.MEMORY_INDEX_FILE = exports.MEMORY_DIR = exports.MAX_MEMORY_FILE_BYTES = exports.MAX_INDEX_BYTES = void 0;
 exports.renderMemoryIndexBlock = renderMemoryIndexBlock;
 exports.loadMemoryIndex = loadMemoryIndex;
+exports.writeMemoryTopic = writeMemoryTopic;
+exports.migrateMemoryToBanditDir = migrateMemoryToBanditDir;
 /**
  * Lazy-load topic memory.
  *
- * MEMORY.md at the workspace root is an INDEX — one bullet per topic, each
- * pointing at a markdown file in a sibling `memory/` directory. The index
- * itself goes into the system prompt every turn (small — capped at 4 KB).
- * The linked files are NOT preloaded; the agent reads them via the
- * `read_memory` tool when it decides a topic is relevant.
+ * ## Path layout (new — v0.4)
  *
- * Index entry format:
+ * Preferred location (new repos / post-migration):
+ *   .bandit/memory/MEMORY.md   ← index file
+ *   .bandit/memory/<slug>.md   ← topic files
+ *
+ * Legacy location (back-compat for repos that already have them):
+ *   MEMORY.md                  ← index file (root)
+ *   memory/<slug>.md           ← topic files (root)
+ *
+ * Both locations are searched at read time; entries are merged, with
+ * `.bandit/memory/` winning on slug collisions. WRITES always go to
+ * `.bandit/memory/`.
+ *
+ * ## Index entry format
  *
  *   - [Topic title](memory/file.md) — one-line hook for relevance matching
  *
  * The hook is what the agent sees and reasons about. Pick hooks that name
  * the situation ("when editing auth code", "when the user mentions X").
+ *
+ * Note: the link path inside MEMORY.md is ALWAYS written as `memory/file.md`
+ * regardless of which physical MEMORY.md is hosting it — the `read_memory`
+ * tool resolves the slug against its originating directory.
  */
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 exports.MAX_INDEX_BYTES = 4 * 1024;
 exports.MAX_MEMORY_FILE_BYTES = 32 * 1024;
+// ── Legacy root paths (back-compat) ────────────────────────────────────────
 exports.MEMORY_DIR = 'memory';
 exports.MEMORY_INDEX_FILE = 'MEMORY.md';
+// ── Preferred .bandit/memory/ paths ────────────────────────────────────────
+exports.BANDIT_DIR = '.bandit';
+exports.BANDIT_MEMORY_DIR = '.bandit/memory';
+exports.BANDIT_MEMORY_INDEX_FILE = '.bandit/memory/MEMORY.md';
+// Matches em-dash, en-dash, or double-hyphen as the separator.
+// The link path is always `memory/<file>` regardless of which MEMORY.md hosts it.
 const ENTRY_RE = /^[-*]\s*\[([^\]]+)\]\(memory\/([^)]+)\)\s*(?:[—–-]+)\s*(.+)$/;
 function slugFromFilename(file) {
     return file.replace(/\.md$/i, '');
@@ -82,23 +103,28 @@ function renderMemoryIndexBlock(index) {
         ...lines
     ].join('\n');
 }
-async function loadMemoryIndex(cwd, warn = defaultWarn) {
-    const abs = path.resolve(cwd, exports.MEMORY_INDEX_FILE);
+async function parseIndexFile(abs, 
+/** Physical directory that contains the `memory/` subfolder for this index. */
+physicalMemoryDir, 
+/** Prefix to use in relPath (e.g. "memory" or ".bandit/memory"). */
+relDirPrefix, warn) {
     let raw;
     try {
         raw = await fs.promises.readFile(abs);
     }
     catch {
-        return { indexContent: '', entries: [], source: null };
+        return null;
     }
     if (raw.byteLength === 0) {
         return { indexContent: '', entries: [], source: abs };
     }
     const truncated = raw.byteLength > exports.MAX_INDEX_BYTES;
     const text = raw.subarray(0, exports.MAX_INDEX_BYTES).toString('utf-8');
-    const indexContent = truncated ? `${text}\n… (truncated — MEMORY.md exceeds ${exports.MAX_INDEX_BYTES} bytes; split topics into smaller files)` : text;
+    const indexContent = truncated
+        ? `${text}\n… (truncated — MEMORY.md exceeds ${exports.MAX_INDEX_BYTES} bytes; split topics into smaller files)`
+        : text;
     const entries = [];
-    const seen = new Set();
+    const seenInFile = new Set();
     for (const line of text.split(/\r?\n/)) {
         const match = ENTRY_RE.exec(line.trim());
         if (!match)
@@ -109,8 +135,8 @@ async function loadMemoryIndex(cwd, warn = defaultWarn) {
             warn(`skipped entry "${title}" — invalid memory/ path "${file}"`);
             continue;
         }
-        const relPath = path.posix.join(exports.MEMORY_DIR, file);
-        const absPath = path.resolve(cwd, exports.MEMORY_DIR, file);
+        const relPath = `${relDirPrefix}/${file}`;
+        const absPath = path.resolve(physicalMemoryDir, file);
         let exists = false;
         try {
             const stat = await fs.promises.stat(absPath);
@@ -124,19 +150,177 @@ async function loadMemoryIndex(cwd, warn = defaultWarn) {
             continue;
         }
         const name = slugFromFilename(file);
-        if (seen.has(name)) {
+        if (seenInFile.has(name)) {
             warn(`duplicate slug "${name}" — keeping first occurrence`);
             continue;
         }
-        seen.add(name);
-        entries.push({
-            name,
-            title: title.trim(),
-            hook: hookRaw.trim(),
-            relPath,
-            absPath
-        });
+        seenInFile.add(name);
+        entries.push({ name, title: title.trim(), hook: hookRaw.trim(), relPath, absPath });
     }
     return { indexContent, entries, source: abs };
 }
+// ── Public: merged loader ───────────────────────────────────────────────────
+/**
+ * Load the memory index, searching both `.bandit/memory/MEMORY.md` (preferred)
+ * and the legacy root `MEMORY.md`. Entries from `.bandit/memory/` win on slug
+ * collisions. Returns a merged MemoryIndex.
+ */
+async function loadMemoryIndex(cwd, warn = defaultWarn) {
+    // 1. Try preferred location: .bandit/memory/MEMORY.md
+    const banditIndexAbs = path.resolve(cwd, exports.BANDIT_MEMORY_INDEX_FILE);
+    const banditMemDirAbs = path.resolve(cwd, exports.BANDIT_MEMORY_DIR);
+    const banditResult = await parseIndexFile(banditIndexAbs, banditMemDirAbs, exports.BANDIT_MEMORY_DIR, warn);
+    // 2. Try legacy location: root MEMORY.md / memory/
+    const rootIndexAbs = path.resolve(cwd, exports.MEMORY_INDEX_FILE);
+    const rootMemDirAbs = path.resolve(cwd, exports.MEMORY_DIR);
+    const rootResult = await parseIndexFile(rootIndexAbs, rootMemDirAbs, exports.MEMORY_DIR, warn);
+    // Neither found
+    if (!banditResult && !rootResult) {
+        return { indexContent: '', entries: [], source: null };
+    }
+    // Merge: preferred (.bandit/memory) wins on slug collision
+    const seen = new Set();
+    const entries = [];
+    // Add preferred entries first
+    if (banditResult) {
+        for (const e of banditResult.entries) {
+            if (seen.has(e.name)) {
+                warn(`duplicate slug "${e.name}" — keeping first occurrence`);
+                continue;
+            }
+            seen.add(e.name);
+            entries.push(e);
+        }
+    }
+    // Add legacy root entries (skip slugs already covered by preferred)
+    if (rootResult) {
+        for (const e of rootResult.entries) {
+            if (seen.has(e.name)) {
+                // Root has the same slug — silently skip (preferred wins)
+                continue;
+            }
+            seen.add(e.name);
+            entries.push(e);
+        }
+    }
+    // indexContent: combine both if both exist; preferred first
+    let indexContent = '';
+    if (banditResult?.indexContent) {
+        indexContent = banditResult.indexContent;
+        if (rootResult?.indexContent) {
+            indexContent += '\n\n<!-- legacy root MEMORY.md -->\n' + rootResult.indexContent;
+        }
+    }
+    else if (rootResult?.indexContent) {
+        indexContent = rootResult.indexContent;
+    }
+    // source: preferred if present, else root
+    const source = banditResult?.source ?? rootResult?.source ?? null;
+    return { indexContent, entries, source };
+}
+// ── Write helpers ───────────────────────────────────────────────────────────
+/**
+ * Write a new topic file + update the index. Always writes to `.bandit/memory/`.
+ *
+ * @param cwd     Workspace root
+ * @param slug    Plain slug, e.g. "auth-conventions"
+ * @param title   Human label for the index entry
+ * @param hook    One-line hook (when is this relevant?)
+ * @param body    Full markdown body for the topic file
+ * @returns The absolute path of the written topic file
+ */
+async function writeMemoryTopic(cwd, slug, title, hook, body) {
+    if (!slug || slug.includes('/') || slug.includes('..') || path.isAbsolute(slug)) {
+        throw new Error(`writeMemoryTopic: invalid slug "${slug}"`);
+    }
+    const safeSlug = slug.replace(/\.md$/i, '');
+    const memDir = path.resolve(cwd, exports.BANDIT_MEMORY_DIR);
+    await fs.promises.mkdir(memDir, { recursive: true });
+    const topicPath = path.resolve(memDir, `${safeSlug}.md`);
+    await fs.promises.writeFile(topicPath, body, 'utf-8');
+    // Update the index
+    const indexPath = path.resolve(cwd, exports.BANDIT_MEMORY_INDEX_FILE);
+    let existing = '';
+    try {
+        existing = await fs.promises.readFile(indexPath, 'utf-8');
+    }
+    catch {
+        existing = '# Memory Index\n\n';
+    }
+    const newLine = `- [${title}](memory/${safeSlug}.md) — ${hook}`;
+    // If slug already in index, replace the line; otherwise append
+    const slugPattern = new RegExp(`^[-*]\\s*\\[[^\\]]*\\]\\(memory\\/${safeSlug}\\.md\\).*$`, 'm');
+    let next;
+    if (slugPattern.test(existing)) {
+        next = existing.replace(slugPattern, newLine);
+    }
+    else {
+        next = existing.endsWith('\n') ? `${existing}${newLine}\n` : `${existing}\n${newLine}\n`;
+    }
+    await fs.promises.writeFile(indexPath, next, 'utf-8');
+    return topicPath;
+}
+// ── Migration ───────────────────────────────────────────────────────────────
+/**
+ * One-time, idempotent migration: moves root `MEMORY.md` + `memory/` into
+ * `.bandit/memory/`. Safe to call on every startup — bails out early if:
+ *   - the target `.bandit/memory/MEMORY.md` already exists, OR
+ *   - the source root `MEMORY.md` does not exist.
+ *
+ * Steps:
+ *   1. Creates `.bandit/memory/` if needed.
+ *   2. Copies each `memory/<slug>.md` to `.bandit/memory/<slug>.md`.
+ *   3. Copies (rewrites) `MEMORY.md` to `.bandit/memory/MEMORY.md`.
+ *   4. Does NOT delete the originals (safe — caller can clean up if desired).
+ *
+ * @returns Array of absolute paths written (empty when migration is skipped).
+ */
+async function migrateMemoryToBanditDir(cwd) {
+    const targetIndex = path.resolve(cwd, exports.BANDIT_MEMORY_INDEX_FILE);
+    // Idempotent: already migrated
+    try {
+        await fs.promises.access(targetIndex);
+        return []; // target exists — skip
+    }
+    catch {
+        // Target doesn't exist — proceed
+    }
+    const sourceIndex = path.resolve(cwd, exports.MEMORY_INDEX_FILE);
+    try {
+        await fs.promises.access(sourceIndex);
+    }
+    catch {
+        return []; // Source doesn't exist — nothing to migrate
+    }
+    const targetDir = path.resolve(cwd, exports.BANDIT_MEMORY_DIR);
+    await fs.promises.mkdir(targetDir, { recursive: true });
+    const written = [];
+    // Copy topic files
+    const sourceMemDir = path.resolve(cwd, exports.MEMORY_DIR);
+    let topicFiles = [];
+    try {
+        const entries = await fs.promises.readdir(sourceMemDir);
+        topicFiles = entries.filter((f) => f.toLowerCase().endsWith('.md'));
+    }
+    catch {
+        // No memory/ dir — fine, just copy the index
+    }
+    for (const file of topicFiles) {
+        const src = path.resolve(sourceMemDir, file);
+        const dst = path.resolve(targetDir, file);
+        try {
+            const content = await fs.promises.readFile(src);
+            await fs.promises.writeFile(dst, content);
+            written.push(dst);
+        }
+        catch {
+            // Skip files we can't read
+        }
+    }
+    // Copy the index
+    const indexContent = await fs.promises.readFile(sourceIndex);
+    await fs.promises.writeFile(targetIndex, indexContent);
+    written.push(targetIndex);
+    return written;
+}
 //# sourceMappingURL=memoryIndex.js.map

package/dist/memoryIndex.js.map

@@ -1 +1 @@
-{"version":3,"file":"memoryIndex.js","sourceRoot":"","sources":["../src/memoryIndex.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoEA,wDAWC;AAED,0CAuDC;AAxID;;;;;;;;;;;;;;;GAeG;AACH,uCAAyB;AACzB,2CAA6B;AAEhB,QAAA,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC;AAC3B,QAAA,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,QAAA,UAAU,GAAG,QAAQ,CAAC;AACtB,QAAA,iBAAiB,GAAG,WAAW,CAAC;AAwB7C,MAAM,QAAQ,GAAG,8DAA8D,CAAC;AAEhF,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAQD,MAAM,WAAW,GAAiB,CAAC,GAAG,EAAE,EAAE;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,KAAkB;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,CAClD,CAAC;IACF,OAAO;QACL,sFAAsF;QACtF,sOAAsO;QACtO,EAAE;QACF,GAAG,KAAK;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,OAAqB,WAAW;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAiB,CAAC,CAAC;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,GAAG,uBAAe,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,uBAAe,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,sCAAsC,uBAAe,0CAA0C,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/I,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,kBAAkB,KAAK,6BAA6B,IAAI,GAAG,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAU,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAU,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,kBAAkB,OAAO,6CAA6C,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,mBAAmB,IAAI,8BAA8B,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;YACnB,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YACpB,OAAO;YACP,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"memoryIndex.js","sourceRoot":"","sources":["../src/memoryIndex.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,wDAWC;AA4ED,0CA2DC;AAcD,4CAqCC;AAkBD,4DAkDC;AAlWD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,uCAAyB;AACzB,2CAA6B;AAEhB,QAAA,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC;AAC3B,QAAA,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,8EAA8E;AACjE,QAAA,UAAU,GAAG,QAAQ,CAAC;AACtB,QAAA,iBAAiB,GAAG,WAAW,CAAC;AAE7C,8EAA8E;AACjE,QAAA,UAAU,GAAG,SAAS,CAAC;AACvB,QAAA,iBAAiB,GAAG,gBAAgB,CAAC;AACrC,QAAA,wBAAwB,GAAG,0BAA0B,CAAC;AAwBnE,+DAA+D;AAC/D,kFAAkF;AAClF,MAAM,QAAQ,GAAG,8DAA8D,CAAC;AAEhF,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAQD,MAAM,WAAW,GAAiB,CAAC,GAAG,EAAE,EAAE;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,KAAkB;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,CAClD,CAAC;IACF,OAAO;QACL,sFAAsF;QACtF,sOAAsO;QACtO,EAAE;QACF,GAAG,KAAK;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAUD,KAAK,UAAU,cAAc,CAC3B,GAAW;AACX,+EAA+E;AAC/E,iBAAyB;AACzB,oEAAoE;AACpE,YAAoB,EACpB,IAAkB;IAElB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,GAAG,uBAAe,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,uBAAe,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,GAAG,IAAI,sCAAsC,uBAAe,0CAA0C;QACxG,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,kBAAkB,KAAK,6BAA6B,IAAI,GAAG,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,kBAAkB,OAAO,6CAA6C,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,mBAAmB,IAAI,8BAA8B,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,OAAqB,WAAW;IACjF,sDAAsD;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,gCAAwB,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAiB,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,eAAe,EAAE,yBAAiB,EAAE,IAAI,CAAC,CAAC;IAEpG,mDAAmD;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAiB,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,aAAa,EAAE,kBAAU,EAAE,IAAI,CAAC,CAAC;IAEvF,gBAAgB;IAChB,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,8BAA8B;IAC9B,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,0DAA0D;gBAC1D,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,YAAY,EAAE,YAAY,EAAE,CAAC;QAC/B,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QACzC,IAAI,UAAU,EAAE,YAAY,EAAE,CAAC;YAC7B,YAAY,IAAI,sCAAsC,GAAG,UAAU,CAAC,YAAY,CAAC;QACnF,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,EAAE,YAAY,EAAE,CAAC;QACpC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IACzC,CAAC;IAED,0CAA0C;IAC1C,MAAM,MAAM,GAAG,YAAY,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC;IAElE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;GASG;AACI,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,IAAY,EACZ,KAAa,EACb,IAAY,EACZ,IAAY;IAEZ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAiB,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,QAAQ,KAAK,CAAC,CAAC;IACzD,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAEtD,mBAAmB;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,gCAAwB,CAAC,CAAC;IAC9D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,oBAAoB,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,YAAY,QAAQ,UAAU,IAAI,EAAE,CAAC;IAChE,+DAA+D;IAC/D,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,qCAAqC,QAAQ,aAAa,EAAE,GAAG,CAAC,CAAC;IAChG,IAAI,IAAY,CAAC;IACjB,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,OAAO,IAAI,CAAC;IAC3F,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAEtD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,wBAAwB,CAAC,GAAW;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,gCAAwB,CAAC,CAAC;IAChE,+BAA+B;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,EAAE,CAAC,CAAC,uBAAuB;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAiB,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,4CAA4C;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,mBAAmB;IACnB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAU,CAAC,CAAC;IACnD,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE1B,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/securityGuard.d.ts

@@ -0,0 +1,29 @@
+export interface SecurityGuardSettings {
+    /** Master switch. Off by default. Set in `.bandit/settings.json` (or the
+     *  global `~/.bandit/settings.json`) under `security.guard`. */
+    enabled?: boolean;
+    /** Extra command-substring patterns (regex source) to block, on top of the
+     *  built-ins. */
+    blockCommands?: string[];
+    /** Extra absolute/`~` path prefixes to protect from writes. */
+    protectPaths?: string[];
+}
+export interface SecurityGuardContext {
+    workspaceRoot?: string;
+    homeDir?: string;
+}
+export interface SecurityGuardDecision {
+    allow: boolean;
+    reason?: string;
+    /** Identifier of the rule that fired (for logging / tests). */
+    rule?: string;
+}
+/**
+ * Evaluate a tool call against the guard. Returns `{allow:true}` when the guard
+ * is disabled or nothing matches. Never throws.
+ */
+export declare function evaluateSecurityGuard(call: {
+    name: string;
+    params: Record<string, string>;
+}, settings: SecurityGuardSettings | undefined, ctx?: SecurityGuardContext): SecurityGuardDecision;
+//# sourceMappingURL=securityGuard.d.ts.map

package/dist/securityGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityGuard.d.ts","sourceRoot":"","sources":["../src/securityGuard.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,qBAAqB;IACpC;oEACgE;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;qBACiB;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA6ED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EACtD,QAAQ,EAAE,qBAAqB,GAAG,SAAS,EAC3C,GAAG,GAAE,oBAAyB,GAC7B,qBAAqB,CA8BvB"}

package/dist/securityGuard.js

@@ -0,0 +1,164 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateSecurityGuard = evaluateSecurityGuard;
+/**
+ * Built-in pre-tool security guard — an in-process, no-shell-spawn safety net
+ * that blocks the handful of tool calls that are almost never legitimate
+ * (catastrophic `rm`, piping a remote script into a shell, writing to system /
+ * credential paths, exfiltrating an SSH/cloud key over the network, …).
+ *
+ * It runs in `beforeToolExecute` BEFORE the user's own PreToolUse hooks and the
+ * permission policy, so it's the first line of defense against the *model*
+ * footgunning (prompt injection, a hallucinated `rm -rf /`) — NOT a sandbox and
+ * NOT protection against a malicious user (who controls the settings).
+ *
+ * Opt-in, OFF by default (`security.guard.enabled`). Deliberately conservative:
+ * every rule targets a pattern that legitimate agent work essentially never
+ * produces, so false positives stay rare. Shared by the CLI and the IDE host.
+ */
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const WRITE_TOOLS = new Set(['write_file', 'apply_edit', 'replace_range', 'apply_patch', 'delete_file']);
+/** Recursive+force `rm` aimed at `/`, `~`, `$HOME`, or `/*`. */
+function isCatastrophicRm(cmd) {
+    if (!/\brm\b/.test(cmd))
+        return false;
+    const recursive = /(^|\s)-[a-zA-Z]*r[a-zA-Z]*\b/.test(cmd) || /--recursive\b/.test(cmd);
+    const force = /(^|\s)-[a-zA-Z]*f[a-zA-Z]*\b/.test(cmd) || /--force\b/.test(cmd) || /--no-preserve-root\b/.test(cmd);
+    if (!(recursive && force))
+        return false;
+    if (/--no-preserve-root\b/.test(cmd))
+        return true;
+    // A bare root/home/glob-of-root target (slash/tilde/$HOME/`/*` followed by
+    // end, whitespace, or another slash/star — so `/tmp/x` is NOT matched).
+    return /(\s|=|["'])(\/|~|\$\{?HOME\}?|\/\*)(\s|$|["']|\/(?:\*|\s|$)|\*)/.test(cmd)
+        || /\s\/\s*$/.test(cmd) || /\s~\s*$/.test(cmd) || /\s\/\*/.test(cmd);
+}
+const COMMAND_RULES = [
+    { id: 'rm-root', reason: 'recursive force-delete of a root/home path', test: isCatastrophicRm },
+    { id: 'curl-pipe-shell', reason: 'a downloaded script piped straight into a shell', test: (c) => /(?:curl|wget|fetch)\b[\s\S]*?\|\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|python[0-9.]*|perl|ruby|node)\b/i.test(c) },
+    { id: 'fork-bomb', reason: 'a fork bomb', test: (c) => /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/.test(c) },
+    { id: 'disk-destroy', reason: 'a raw write to a block device / filesystem', test: (c) => /\bmkfs(?:\.\w+)?\b/i.test(c) || /\bdd\b[\s\S]*\bof=\/dev\/(?:sd|nvme|hd|disk|mmcblk|vd)/i.test(c) || />\s*\/dev\/(?:sd|nvme|hd|disk|mmcblk|vd)/i.test(c) },
+    { id: 'chmod-chown-root', reason: 'a recursive permission/owner change on `/`', test: (c) => /\bchmod\s+(?:-[a-z]*R[a-z]*\s+)?0?[0-7]{3}\s+\/(?:\s|$)/i.test(c) || /\bchown\s+-[a-z]*R[a-z]*\b[\s\S]*\s\/(?:\s|$)/i.test(c) },
+    { id: 'redirect-sensitive', reason: 'output redirected into a system / credential path', test: (c) => />>?\s*(?:["']?)(?:\/etc\/|\/usr\/|\/bin\/|\/sbin\/|\/boot\/|~\/?\.ssh\/|\$HOME\/\.ssh\/|\.ssh\/authorized_keys|\/root\/)/i.test(c) },
+    {
+        id: 'secret-exfil',
+        reason: 'a credential file read AND sent over the network in one command',
+        test: (c) => {
+            const secretRead = /(?:\.ssh\/[\w.-]*(?:id_[a-z0-9]+|_rsa|_ed25519|_ecdsa|_dsa)\b|\bid_rsa\b|\.aws\/credentials|\.netrc\b|\.kube\/config\b|\.docker\/config\.json\b|\.gnupg\/)/i.test(c);
+            const netEgress = /\b(?:curl|wget|nc|netcat|ncat|telnet|scp|sftp)\b|https?:\/\//i.test(c);
+            return secretRead && netEgress;
+        }
+    }
+];
+const SENSITIVE_WRITE_PREFIXES = [
+    '/etc/', '/usr/', '/bin/', '/sbin/', '/boot/', '/sys/', '/proc/', '/dev/', '/root/',
+    '/System/', '/Library/'
+];
+const SENSITIVE_WRITE_SUFFIXES = [
+    '/.ssh/', '/.aws/', '/.gnupg/', '/.kube/config', '/.docker/config.json',
+    '/.bashrc', '/.zshrc', '/.profile', '/.bash_profile'
+];
+function checkWritePath(rawPath, ctx, extraProtected) {
+    const home = ctx.homeDir ?? os.homedir();
+    const expanded = rawPath.trim().replace(/^~(?=\/|$)/, home);
+    const norm = expanded.replace(/\\/g, '/');
+    for (const prefix of [...SENSITIVE_WRITE_PREFIXES, ...extraProtected]) {
+        if (norm === prefix.replace(/\/$/, '') || norm.startsWith(prefix)) {
+            return { allow: false, rule: 'write-sensitive', reason: `writing to a protected system/credential path (${prefix})` };
+        }
+    }
+    for (const suffix of SENSITIVE_WRITE_SUFFIXES) {
+        if (norm.includes(suffix)) {
+            return { allow: false, rule: 'write-sensitive', reason: `writing to a protected credential path (${suffix})` };
+        }
+    }
+    // Path traversal outside the workspace (only when we know the root and the
+    // path isn't an unrelated absolute temp path the host already allows).
+    if (ctx.workspaceRoot) {
+        const resolved = path.resolve(ctx.workspaceRoot, expanded);
+        const root = path.resolve(ctx.workspaceRoot);
+        if (resolved !== root && !resolved.startsWith(root + path.sep)) {
+            // Only flag when the original path explicitly traverses up; bare absolute
+            // temp paths (e.g. /tmp/x) aren't the guard's job and the host gates them.
+            if (/(^|\/)\.\.(\/|$)/.test(rawPath)) {
+                return { allow: false, rule: 'write-escape', reason: 'writing outside the workspace root via `..` traversal' };
+            }
+        }
+    }
+    return { allow: true };
+}
+/**
+ * Evaluate a tool call against the guard. Returns `{allow:true}` when the guard
+ * is disabled or nothing matches. Never throws.
+ */
+function evaluateSecurityGuard(call, settings, ctx = {}) {
+    if (!settings?.enabled)
+        return { allow: true };
+    try {
+        const name = call.name;
+        const params = call.params ?? {};
+        if (name === 'run_command') {
+            const cmd = `${params.cmd ?? ''} ${params.args ?? ''}`.trim();
+            if (!cmd)
+                return { allow: true };
+            for (const rule of COMMAND_RULES) {
+                if (rule.test(cmd))
+                    return { allow: false, rule: rule.id, reason: rule.reason };
+            }
+            for (const extra of settings.blockCommands ?? []) {
+                try {
+                    if (new RegExp(extra, 'i').test(cmd))
+                        return { allow: false, rule: 'custom-command', reason: `matched a configured blockCommands pattern (${extra})` };
+                }
+                catch { /* invalid user regex — ignore */ }
+            }
+            return { allow: true };
+        }
+        if (WRITE_TOOLS.has(name)) {
+            const target = params.path ?? '';
+            if (!target)
+                return { allow: true };
+            return checkWritePath(target, ctx, settings.protectPaths ?? []);
+        }
+        return { allow: true };
+    }
+    catch {
+        // The guard must never break a turn — fail open.
+        return { allow: true };
+    }
+}
+//# sourceMappingURL=securityGuard.js.map

package/dist/securityGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityGuard.js","sourceRoot":"","sources":["../src/securityGuard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwHA,sDAkCC;AA1JD;;;;;;;;;;;;;;GAcG;AACH,2CAA6B;AAC7B,uCAAyB;AAyBzB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAEzG,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpH,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,iEAAiE,CAAC,IAAI,CAAC,GAAG,CAAC;WAC7E,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzE,CAAC;AAID,MAAM,aAAa,GAAkB;IACnC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,4CAA4C,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC/F,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,iDAAiD,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oGAAoG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC/M,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjH,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,4CAA4C,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACpP,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,4CAA4C,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,0DAA0D,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC7N,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,mDAAmD,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,2HAA2H,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC3O;QACE,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,iEAAiE;QACzE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;YACV,MAAM,UAAU,GAAG,6JAA6J,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzL,MAAM,SAAS,GAAG,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1F,OAAO,UAAU,IAAI,SAAS,CAAC;QACjC,CAAC;KACF;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACnF,UAAU,EAAE,WAAW;CACxB,CAAC;AACF,MAAM,wBAAwB,GAAG;IAC/B,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,sBAAsB;IACvE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB;CACrD,CAAC;AAEF,SAAS,cAAc,CAAC,OAAe,EAAE,GAAyB,EAAE,cAAwB;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE1C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,wBAAwB,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC;QACtE,IAAI,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,kDAAkD,MAAM,GAAG,EAAE,CAAC;QACxH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,2CAA2C,MAAM,GAAG,EAAE,CAAC;QACjH,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,IAAsD,EACtD,QAA2C,EAC3C,MAA4B,EAAE;IAE9B,IAAI,CAAC,QAAQ,EAAE,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAEjC,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAClF,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC;oBAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+CAA+C,KAAK,GAAG,EAAE,CAAC;gBAAC,CAAC;gBAC/J,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpC,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;QACjD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/tools/readMemoryTool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readMemoryTool.d.ts","sourceRoot":"","sources":["../../src/tools/readMemoryTool.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAoC,MAAM,0BAA0B,CAAC;AAO5F,wBAAgB,mBAAmB,IAAI,SAAS,CAmE/C"}
+{"version":3,"file":"readMemoryTool.d.ts","sourceRoot":"","sources":["../../src/tools/readMemoryTool.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAoC,MAAM,0BAA0B,CAAC;AAO5F,wBAAgB,mBAAmB,IAAI,SAAS,CAqE/C"}

package/dist/tools/readMemoryTool.js

@@ -35,11 +35,11 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildReadMemoryTool = buildReadMemoryTool;
 /**
- * `read_memory` — load a single topic file from `memory/<name>.md` on
- * demand. Paired with `loadMemoryIndex` (the MEMORY.md index injected
- * into the system prompt every turn). The agent decides whether a topic
- * is relevant by reading the index's hook, then calls this tool to
- * pull the full file into context.
+ * `read_memory` — load a single topic file from `.bandit/memory/<name>.md`
+ * (preferred) or the legacy `memory/<name>.md` on demand. Paired with
+ * `loadMemoryIndex` (the MEMORY.md index injected into the system prompt
+ * every turn). The agent decides whether a topic is relevant by reading the
+ * index's hook, then calls this tool to pull the full file into context.
  *
  * Rejects path traversal (`..`, absolute paths). On miss, the error
  * lists the available slugs so the model can self-correct.
@@ -50,11 +50,11 @@ const memoryIndex_1 = require("../memoryIndex");
 function buildReadMemoryTool() {
     return {
         name: 'read_memory',
-        description: 'Read a single topic memory file by slug. Use this when MEMORY.md (shown in the system prompt) lists a topic whose hook matches the current task. The slug is the part after "memory/" in [Title](memory/<slug>.md) — without the .md suffix. Returns the full file content (capped at 32 KB).',
+        description: 'Read a single topic memory file by slug. Use this when the memory index (shown in the system prompt) lists a topic whose hook matches the current task. The slug is the part after "memory/" in [Title](memory/<slug>.md) — without the .md suffix. Returns the full file content (capped at 32 KB).',
         parameters: [
             {
                 name: 'name',
-                description: 'Memory file slug (no `memory/` prefix, no `.md` suffix). Example: "auth-conventions" loads memory/auth-conventions.md.',
+                description: 'Memory file slug (no `memory/` prefix, no `.md` suffix). Example: "auth-conventions" loads .bandit/memory/auth-conventions.md (or the legacy memory/auth-conventions.md).',
                 required: true
             }
         ],
@@ -82,8 +82,10 @@ function buildReadMemoryTool() {
             if (!entry) {
                 const available = index.entries.map((e) => e.name);
                 if (available.length === 0) {
+                    const banditIndexPath = path.resolve(ctx.workspaceRoot, memoryIndex_1.BANDIT_MEMORY_DIR, 'MEMORY.md');
+                    const rootIndexPath = path.resolve(ctx.workspaceRoot, 'MEMORY.md');
                     return {
-                        output: `No memory index found. MEMORY.md is missing or has no entries at ${path.resolve(ctx.workspaceRoot, 'MEMORY.md')}.`,
+                        output: `No memory index found. MEMORY.md is missing from both ${banditIndexPath} and ${rootIndexPath}.`,
                         isError: true
                     };
                 }
@@ -105,7 +107,7 @@ function buildReadMemoryTool() {
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
                 return {
-                    output: `Could not read ${memoryIndex_1.MEMORY_DIR}/${slug}.md: ${msg}`,
+                    output: `Could not read ${entry.relPath}: ${msg}`,
                     isError: true
                 };
             }

package/dist/tools/readMemoryTool.js.map

@@ -1 +1 @@
-{"version":3,"file":"readMemoryTool.js","sourceRoot":"","sources":["../../src/tools/readMemoryTool.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kDAmEC;AAtFD;;;;;;;;;GASG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,gDAIwB;AAExB,SAAgB,mBAAmB;IACjC,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,+RAA+R;QACjS,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EACT,wHAAwH;gBAC1H,QAAQ,EAAE,IAAI;aACf;SACF;QACD,KAAK,CAAC,OAAO,CAAC,MAA8B,EAAE,GAAyB;YACrE,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACzE,CAAC;YACD,qEAAqE;YACrE,oEAAoE;YACpE,iEAAiE;YACjE,mEAAmE;YACnE,IACE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACvB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACxB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,+EAA+E,SAAS,GAAG;oBACnG,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,IAAA,6BAAe,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACL,MAAM,EAAE,oEAAoE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG;wBAC3H,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,gBAAgB,IAAI,2BAA2B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC7E,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,GAAG,mCAAqB,CAAC;gBACzD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,mCAAqB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,iCAAiC,mCAAqB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvG,OAAO;oBACL,MAAM,EAAE,gBAAgB,KAAK,CAAC,OAAO,SAAS,IAAI,EAAE;oBACpD,OAAO,EAAE,KAAK;iBACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO;oBACL,MAAM,EAAE,kBAAkB,wBAAU,IAAI,IAAI,QAAQ,GAAG,EAAE;oBACzD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"readMemoryTool.js","sourceRoot":"","sources":["../../src/tools/readMemoryTool.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kDAqEC;AAxFD;;;;;;;;;GASG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,gDAIwB;AAExB,SAAgB,mBAAmB;IACjC,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,sSAAsS;QACxS,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EACT,2KAA2K;gBAC7K,QAAQ,EAAE,IAAI;aACf;SACF;QACD,KAAK,CAAC,OAAO,CAAC,MAA8B,EAAE,GAAyB;YACrE,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACzE,CAAC;YACD,qEAAqE;YACrE,oEAAoE;YACpE,iEAAiE;YACjE,mEAAmE;YACnE,IACE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACvB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACxB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,+EAA+E,SAAS,GAAG;oBACnG,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,IAAA,6BAAe,EAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,+BAAiB,EAAE,WAAW,CAAC,CAAC;oBACxF,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;oBACnE,OAAO;wBACL,MAAM,EAAE,yDAAyD,eAAe,QAAQ,aAAa,GAAG;wBACxG,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,gBAAgB,IAAI,2BAA2B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC7E,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,GAAG,mCAAqB,CAAC;gBACzD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,mCAAqB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,iCAAiC,mCAAqB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvG,OAAO;oBACL,MAAM,EAAE,gBAAgB,KAAK,CAAC,OAAO,SAAS,IAAI,EAAE;oBACpD,OAAO,EAAE,KAAK;iBACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO;oBACL,MAAM,EAAE,kBAAkB,KAAK,CAAC,OAAO,KAAK,GAAG,EAAE;oBACjD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burtson-labs/host-kit",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "Host-agnostic building blocks for the Bandit agent framework — memory files, hooks, mentions, and the extra tool set (todo_write, web_fetch).",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",