@hasna/mementos 0.14.85 → 0.14.87

package/dist/cli/index.js

@@ -1011,7 +1011,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          }
+          } else {}
         };
       }
       return this;
@@ -2274,6 +2274,7 @@ function translateSql(sql) {
   let translated = sql.replace(/\?/g, () => `$${++parameterIndex}`);
   const ISO_FMT = `'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'`;
   translated = translated.replace(/datetime\s*\(\s*'now'\s*\)/gi, `to_char(now() AT TIME ZONE 'UTC', ${ISO_FMT})`);
+  translated = translated.replace(/strftime\s*\(\s*'%Y-%m-%dT%H:%M:%fZ'\s*,\s*'now'\s*\)/gi, `to_char(now() AT TIME ZONE 'UTC', ${ISO_FMT})`);
   translated = translated.replace(/datetime\s*\(\s*'now'\s*,\s*'(-?\d+)\s+(minutes?|hours?|days?|seconds?)'\s*\)/gi, (_match, amount, unit) => {
     const parsed = parseInt(String(amount), 10);
     const absolute = Math.abs(parsed);
@@ -2758,16 +2759,24 @@ function transferRows(target, table, rows, options) {
   const conflictColumn = options.conflictColumn ?? "updated_at";
   let written = 0;
   let skipped = 0;
+  let maxSyncedAt = null;
   const errors = [];
+  const bumpMaxSyncedAt = (row) => {
+    const value = row[conflictColumn];
+    if (typeof value === "string" && (maxSyncedAt === null || value > maxSyncedAt)) {
+      maxSyncedAt = value;
+    }
+  };
   if (rows.length === 0) {
-    return { written, skipped, errors };
+    return { written, skipped, errors, maxSyncedAt };
   }
   const columns = Object.keys(rows[0] ?? {});
   if (!columns.includes(primaryKey)) {
     return {
       written,
       skipped,
-      errors: [`Table "${table}" has no "${primaryKey}" column; skipping`]
+      errors: [`Table "${table}" has no "${primaryKey}" column; skipping`],
+      maxSyncedAt
     };
   }
   const hasConflictColumn = columns.includes(conflictColumn);
@@ -2780,6 +2789,7 @@ function transferRows(target, table, rows, options) {
           const incomingTime = Date.parse(String(row[conflictColumn]));
           if (Number.isFinite(existingTime) && Number.isFinite(incomingTime) && existingTime >= incomingTime) {
             skipped++;
+            bumpMaxSyncedAt(row);
             continue;
           }
         }
@@ -2792,11 +2802,12 @@ function transferRows(target, table, rows, options) {
         target.run(`INSERT INTO "${table}" (${columnList}) VALUES (${placeholders})`, ...columns.map((column) => row[column]));
       }
       written++;
+      bumpMaxSyncedAt(row);
     } catch (error) {
       errors.push(`Row ${String(row[primaryKey] ?? "unknown")}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
-  return { written, skipped, errors };
+  return { written, skipped, errors, maxSyncedAt };
 }
 function incrementalSyncPush(local, remote, tables, options = {}) {
   return runIncrementalSync("push", local, remote, local, tables, options);
@@ -2834,22 +2845,29 @@ function runIncrementalSync(direction, source, target, metaDb, tables, options)
         rows = source.all(`SELECT * FROM "${table}"`);
         stat.first_sync = true;
       }
+      let maxSyncedAt = null;
       for (let offset = 0;offset < rows.length; offset += batchSize) {
         const batch = rows.slice(offset, offset + batchSize);
         const result = transferRows(target, table, batch, options);
         stat.synced_rows += result.written;
         stat.skipped_rows += result.skipped;
         stat.errors.push(...result.errors);
+        if (result.maxSyncedAt !== null && (maxSyncedAt === null || result.maxSyncedAt > maxSyncedAt)) {
+          maxSyncedAt = result.maxSyncedAt;
+        }
       }
       if (rows.length === 0) {
         stat.skipped_rows = stat.total_rows;
       }
-      upsertSyncMeta(metaDb, {
-        table_name: table,
-        last_synced_at: new Date().toISOString(),
-        last_synced_row_count: stat.synced_rows,
-        direction
-      });
+      const nextCursor = maxSyncedAt ?? meta?.last_synced_at ?? null;
+      if (rows.length > 0 && stat.errors.length === 0 && nextCursor !== null) {
+        upsertSyncMeta(metaDb, {
+          table_name: table,
+          last_synced_at: nextCursor,
+          last_synced_row_count: stat.synced_rows,
+          direction
+        });
+      }
     } catch (error) {
       stat.errors.push(`Table "${table}": ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -2877,8 +2895,13 @@ var init_storage = __esm(() => {
     data;
     closed = false;
     lastError = null;
+    generation = 0;
     static DATA_BYTES = 128 * 1024 * 1024;
-    static QUERY_TIMEOUT_MS = 60000;
+    static queryTimeoutMs() {
+      const raw = process.env["MEMENTOS_PGSYNC_QUERY_TIMEOUT_MS"]?.trim();
+      const parsed = raw ? Number(raw) : Number.NaN;
+      return Number.isFinite(parsed) && parsed > 0 ? parsed : 60000;
+    }
     static resolveWorkerPath() {
       const ext = import.meta.url.endsWith(".ts") ? ".ts" : ".js";
       const here = fileURLToPath(new URL(".", import.meta.url));
@@ -2893,12 +2916,12 @@ var init_storage = __esm(() => {
       }
       return candidates[0];
     }
-    constructor(connectionString) {
-      const control = new SharedArrayBuffer(8);
+    constructor(connectionString, workerPath) {
+      const control = new SharedArrayBuffer(12);
       const dataSab = new SharedArrayBuffer(PgSyncPool.DATA_BYTES);
       this.status = new Int32Array(control);
       this.data = new Uint8Array(dataSab);
-      this.worker = new Worker(PgSyncPool.resolveWorkerPath(), {
+      this.worker = new Worker(workerPath ?? PgSyncPool.resolveWorkerPath(), {
         workerData: {
           dsn: stripSslParams(connectionString),
           ssl: sslConfigFor(connectionString),
@@ -2916,21 +2939,35 @@ var init_storage = __esm(() => {
         throw new Error("PgSyncPool is closed");
       if (this.lastError)
         throw this.lastError;
+      const timeoutMs = PgSyncPool.queryTimeoutMs();
+      const gen = ++this.generation;
       Atomics.store(this.status, 0, 0);
-      this.worker.postMessage({ sql, params });
-      const waitResult = Atomics.wait(this.status, 0, 0, PgSyncPool.QUERY_TIMEOUT_MS);
-      const code = Atomics.load(this.status, 0);
-      if (code === 0 || waitResult === "timed-out") {
-        if (this.lastError)
-          throw this.lastError;
-        throw new Error("PostgreSQL query timed out after 60s");
-      }
-      const len = Atomics.load(this.status, 1);
-      const payload = JSON.parse(new TextDecoder().decode(this.data.subarray(0, len)));
-      if (code === 2) {
-        throw new Error(payload.message ?? "PostgreSQL error");
+      Atomics.store(this.status, 2, 0);
+      this.worker.postMessage({ sql, params, gen });
+      const deadline = Date.now() + timeoutMs;
+      for (;; ) {
+        const remaining = deadline - Date.now();
+        const responding = Atomics.load(this.status, 0);
+        if (responding === gen) {
+          const code = Atomics.load(this.status, 2);
+          const len = Atomics.load(this.status, 1);
+          const payload = JSON.parse(new TextDecoder().decode(this.data.subarray(0, len)));
+          if (code === 2) {
+            throw new Error(payload.message ?? "PostgreSQL error");
+          }
+          return payload;
+        }
+        if (responding !== 0) {
+          Atomics.compareExchange(this.status, 0, responding, 0);
+          continue;
+        }
+        if (remaining <= 0) {
+          if (this.lastError)
+            throw this.lastError;
+          throw new Error(`PostgreSQL query timed out after ${timeoutMs}ms`);
+        }
+        Atomics.wait(this.status, 0, 0, remaining);
       }
-      return payload;
     }
     end() {
       if (this.closed)
@@ -4982,6 +5019,30 @@ function redactSecrets(text) {
   }
   return result;
 }
+function redactValueTree(value) {
+  if (typeof value === "string")
+    return redactSecrets(value);
+  if (Array.isArray(value))
+    return value.map(redactValueTree);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactValueTree(v);
+    }
+    return out;
+  }
+  return value;
+}
+function redactMemoryForOutput(memory) {
+  return {
+    ...memory,
+    key: redactSecrets(memory.key),
+    value: redactSecrets(memory.value),
+    summary: memory.summary ? redactSecrets(memory.summary) : null,
+    when_to_use: memory.when_to_use ? redactSecrets(memory.when_to_use) : null,
+    metadata: redactValueTree(memory.metadata)
+  };
+}
 var REDACTED = "[REDACTED]", SECRET_PATTERNS;
 var init_redact = __esm(() => {
   SECRET_PATTERNS = [
@@ -5267,6 +5328,7 @@ __export(exports_memories, {
   updateMemory: () => updateMemory,
   touchMemory: () => touchMemory,
   semanticSearch: () => semanticSearch,
+  reservedAgentIdViolation: () => reservedAgentIdViolation,
   parseMemoryRow: () => parseMemoryRow,
   listMemoryHistoryPage: () => listMemoryHistoryPage,
   listMemoryHistory: () => listMemoryHistory,
@@ -5338,7 +5400,20 @@ function parseMemoryRow(row) {
     accessed_at: row["accessed_at"] || null
   };
 }
+function reservedAgentIdViolation(agentId) {
+  if (!agentId)
+    return null;
+  const normalized = agentId.trim().toLowerCase();
+  if (RESERVED_AGENT_IDS.has(normalized)) {
+    return `Reserved placeholder agent id "${agentId}" cannot own a memory. ` + `Refusing to write: test harnesses must not write memories under placeholder agent ` + `identities. Register a real agent (mementos register-agent <name>) and pass its id.`;
+  }
+  return null;
+}
 function createMemory(input, dedupeMode = "merge", db) {
+  const reservedViolation = reservedAgentIdViolation(input.agent_id);
+  if (reservedViolation) {
+    throw new Error(reservedViolation);
+  }
   if (!db && isApiMode()) {
     const { status, data } = apiJson("POST", "/memories", { ...input, dedupe: dedupeMode });
     if (!data || !data.id) {
@@ -5388,7 +5463,8 @@ function createMemory(input, dedupeMode = "merge", db) {
            importance = ?, metadata = ?, expires_at = ?,
            when_to_use = ?,
            pinned = COALESCE(pinned, 0),
-           version = version + 1, updated_at = ?
+           version = version + 1, updated_at = ?,
+           updated_by_agent = ?
          WHERE id = ?`, [
         safeValue,
         input.category || "knowledge",
@@ -5399,6 +5475,7 @@ function createMemory(input, dedupeMode = "merge", db) {
         expiresAt,
         input.when_to_use || null,
         timestamp,
+        input.agent_id || null,
         existing.id
       ]);
       d.run("DELETE FROM memory_tags WHERE memory_id = ?", [existing.id]);
@@ -5503,6 +5580,12 @@ function bulkUpsertMemories(memories, db) {
         errors.push(`Rejected "${key}": ${formatEnumViolation(violation)}`);
         continue;
       }
+      const agentViolation = reservedAgentIdViolation(typeof mem["agent_id"] === "string" ? mem["agent_id"] : undefined);
+      if (agentViolation) {
+        rejected++;
+        errors.push(`Rejected "${key}": ${agentViolation}`);
+        continue;
+      }
       const timestamp = now();
       let tags = [];
       const rawTags = mem["tags"];
@@ -5781,6 +5864,11 @@ function listMemoriesPage(filter, db) {
       agent_id: f.agent_id,
       project_id: f.project_id,
       session_id: f.session_id,
+      machine_id: f.machine_id,
+      visible_to_machine_id: f.visible_to_machine_id,
+      search: f.search,
+      source: f.source,
+      flag: f.flag,
       namespace: f.namespace,
       as_of: f.as_of,
       limit: f.limit,
@@ -6060,20 +6148,29 @@ function updateMemory(id, input, db) {
     sets.push("when_to_use = ?");
     params.push(input.when_to_use ?? null);
   }
+  if (input.updated_by_agent !== undefined) {
+    sets.push("updated_by_agent = ?");
+    params.push(input.updated_by_agent ?? null);
+  }
   if (input.tags !== undefined) {
     sets.push("tags = ?");
     params.push(JSON.stringify(input.tags));
-    d.run("DELETE FROM memory_tags WHERE memory_id = ?", [memoryId]);
-    const insertTag = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
-    for (const tag of input.tags) {
-      insertTag.run(memoryId, tag);
-    }
   }
   params.push(memoryId);
-  const result = d.run(`UPDATE memories SET ${sets.join(", ")} WHERE id = ?`, params);
-  if (result.changes === 0) {
-    throw new Error(`Update affected no rows for memory ${memoryId}: the record was read but not written. ` + `This is a bug in @hasna/mementos, not a bad argument \u2014 please report it.`);
-  }
+  d.transaction(() => {
+    const res = d.run(`UPDATE memories SET ${sets.join(", ")} WHERE id = ?`, params);
+    if (res.changes === 0) {
+      throw new Error(`Update affected no rows for memory ${memoryId}: the record was read but not written. ` + `This is a bug in @hasna/mementos, not a bad argument \u2014 please report it.`);
+    }
+    if (input.tags !== undefined) {
+      d.run("DELETE FROM memory_tags WHERE memory_id = ?", [memoryId]);
+      const insertTag = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
+      for (const tag of input.tags) {
+        insertTag.run(memoryId, tag);
+      }
+    }
+    return res;
+  });
   const updated = getMemory(memoryId, d);
   if (input.value !== undefined) {
     try {
@@ -6244,7 +6341,7 @@ async function semanticSearch(queryText, options = {}, db) {
   scored.sort((a, b) => b.score - a.score);
   return scored.slice(0, limit);
 }
-var RECALL_PROMOTE_THRESHOLD = 3;
+var RESERVED_AGENT_IDS, RECALL_PROMOTE_THRESHOLD = 3;
 var init_memories = __esm(() => {
   init_types();
   init_database();
@@ -6254,9 +6351,32 @@ var init_memories = __esm(() => {
   init_poisoning();
   init_entity_memories();
   init_api_mode();
+  RESERVED_AGENT_IDS = new Set([
+    "agent-a",
+    "agent-x",
+    "agent-z",
+    "nonexistent-agent"
+  ]);
 });
 
 // src/db/agents.ts
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+function resolveWritingAgentName() {
+  const envName = process.env["MEMENTOS_AGENT"]?.trim();
+  if (envName)
+    return envName;
+  try {
+    const path = join5(homedir3(), ".hasna", "conversations", "agent-id");
+    if (existsSync4(path)) {
+      const fileAgent = readFileSync2(path, "utf8").trim();
+      if (fileAgent)
+        return fileAgent;
+    }
+  } catch {}
+  return null;
+}
 function parseAgentRow(row) {
   return {
     id: row["id"],
@@ -6459,17 +6579,17 @@ var init_agents = __esm(() => {
 });
 
 // src/lib/package-version.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join5 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getMementosPackageVersion() {
   const here = dirname2(fileURLToPath2(import.meta.url));
   for (const candidate of [
-    join5(here, "..", "..", "package.json"),
-    join5(here, "..", "package.json")
+    join6(here, "..", "..", "package.json"),
+    join6(here, "..", "package.json")
   ]) {
     try {
-      const parsed = JSON.parse(readFileSync2(candidate, "utf8"));
+      const parsed = JSON.parse(readFileSync3(candidate, "utf8"));
       if (typeof parsed.version === "string" && parsed.version.trim())
         return parsed.version;
     } catch {}
@@ -7472,13 +7592,13 @@ __export(exports_helpers, {
   DEFAULT_COMPACT_LIMIT: () => DEFAULT_COMPACT_LIMIT
 });
 import chalk from "chalk";
-import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname3, join as join6, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname3, join as join7, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function getPackageVersion() {
   try {
-    const pkgPath = join6(dirname3(fileURLToPath3(import.meta.url)), "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync3(pkgPath, "utf-8"));
+    const pkgPath = join7(dirname3(fileURLToPath3(import.meta.url)), "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -8037,16 +8157,16 @@ function validateConfigKeyValue(key, value, DEFAULT_CONFIG) {
   return null;
 }
 function getConfigPath() {
-  const { homedir: homedir3 } = __require("os");
-  return join6(homedir3(), ".hasna", "mementos", "config.json");
+  const { homedir: homedir4 } = __require("os");
+  return join7(homedir4(), ".hasna", "mementos", "config.json");
 }
 function readFileConfig() {
-  const { existsSync: existsSync4 } = __require("fs");
+  const { existsSync: existsSync5 } = __require("fs");
   const configPath = getConfigPath();
-  if (!existsSync4(configPath))
+  if (!existsSync5(configPath))
     return {};
   try {
-    const data = JSON.parse(readFileSync3(configPath, "utf-8"));
+    const data = JSON.parse(readFileSync4(configPath, "utf-8"));
     if (data === null || typeof data !== "object" || Array.isArray(data)) {
       throw new Error("expected a JSON object");
     }
@@ -8057,10 +8177,10 @@ function readFileConfig() {
   }
 }
 function writeFileConfig(data) {
-  const { existsSync: existsSync4, writeFileSync: writeFileSync3, mkdirSync: mkdirSync3 } = __require("fs");
+  const { existsSync: existsSync5, writeFileSync: writeFileSync3, mkdirSync: mkdirSync3 } = __require("fs");
   const configPath = getConfigPath();
   const dir = dirname3(configPath);
-  if (!existsSync4(dir))
+  if (!existsSync5(dir))
     mkdirSync3(dir, { recursive: true });
   writeFileSync3(configPath, JSON.stringify(data, null, 2) + `
 `, "utf-8");
@@ -8488,7 +8608,7 @@ function buildFilterConditions(filter) {
   const conditions = [];
   const params = [];
   conditions.push("m.status = 'active'");
-  conditions.push("(m.expires_at IS NULL OR m.expires_at >= datetime('now'))");
+  conditions.push("(m.expires_at IS NULL OR m.expires_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))");
   if (!filter)
     return { conditions, params };
   if (filter.scope) {
@@ -9856,6 +9976,7 @@ var init_auto_memory = __esm(() => {
 // src/db/webhook_hooks.ts
 var exports_webhook_hooks = {};
 __export(exports_webhook_hooks, {
+  validateWebhookHandlerUrl: () => validateWebhookHandlerUrl,
   updateWebhookHook: () => updateWebhookHook,
   recordWebhookInvocation: () => recordWebhookInvocation,
   listWebhookHooks: () => listWebhookHooks,
@@ -9863,6 +9984,8 @@ __export(exports_webhook_hooks, {
   deleteWebhookHook: () => deleteWebhookHook,
   createWebhookHook: () => createWebhookHook
 });
+import { isIP } from "net";
+import { lookup as dnsLookup } from "dns/promises";
 function parseRow(row) {
   return {
     id: row["id"],
@@ -9879,7 +10002,153 @@ function parseRow(row) {
     failureCount: row["failure_count"]
   };
 }
-function createWebhookHook(input, db) {
+function isBlockedIpv4(parts) {
+  const a = parts[0];
+  const b = parts[1];
+  if (a === 0)
+    return true;
+  if (a === 127)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 10)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  return false;
+}
+function isBlockedIpv6(bytes) {
+  const mapped = bytes.slice(0, 10).every((b) => b === 0) && bytes[10] === 255 && bytes[11] === 255;
+  if (mapped)
+    return isBlockedIpv4(bytes.slice(12, 16));
+  if (bytes.every((b) => b === 0))
+    return true;
+  if (bytes.slice(0, 15).every((b) => b === 0) && bytes[15] === 1)
+    return true;
+  if ((bytes[0] & 254) === 252)
+    return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128)
+    return true;
+  return false;
+}
+function quadToGroups(quad) {
+  const nums = quad.split(".").map((p) => Number(p));
+  const [a, b, c, d] = nums;
+  const valid = [a, b, c, d].every((n) => n !== undefined && Number.isInteger(n) && n >= 0 && n <= 255);
+  if (!valid)
+    return null;
+  return [a << 8 | b, c << 8 | d];
+}
+function parseIpv6Bytes(host) {
+  const groups = host.split("::");
+  if (groups.length > 2)
+    return null;
+  const headRaw = groups[0] ?? "";
+  const tailRaw = groups[1] ?? "";
+  const head = headRaw === "" ? [] : headRaw.split(":");
+  const tail = tailRaw === "" ? [] : tailRaw.split(":");
+  const headNums = [];
+  for (const g of head) {
+    if (!/^[0-9a-f]{1,4}$/i.test(g))
+      return null;
+    headNums.push(parseInt(g, 16));
+  }
+  const tailNums = [];
+  for (const g of tail) {
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(g)) {
+      const quads = quadToGroups(g);
+      if (!quads)
+        return null;
+      tailNums.push(...quads);
+    } else if (/^[0-9a-f]{1,4}$/i.test(g)) {
+      tailNums.push(parseInt(g, 16));
+    } else {
+      return null;
+    }
+  }
+  const hasCompression = groups.length === 2;
+  if (!hasCompression && headNums.length !== 8)
+    return null;
+  if (hasCompression && headNums.length + tailNums.length >= 8)
+    return null;
+  const zeros = 8 - headNums.length - tailNums.length;
+  const all = [...headNums, ...new Array(zeros).fill(0), ...tailNums];
+  const bytes = [];
+  for (const n of all) {
+    bytes.push(n >> 8 & 255, n & 255);
+  }
+  return bytes;
+}
+function defaultResolveHost(hostname2) {
+  return dnsLookup(hostname2, { all: true, verbatim: true });
+}
+function assertResolvedAddressPublic(address, url) {
+  const version = isIP(address);
+  if (version === 4) {
+    if (isBlockedIpv4(address.split(".").map((p) => Number(p)))) {
+      throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+    }
+  } else if (version === 6) {
+    const bytes = parseIpv6Bytes(address);
+    if (!bytes || isBlockedIpv6(bytes)) {
+      throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+    }
+  } else {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+}
+async function validateWebhookHandlerUrl(url, opts) {
+  const resolveHost = opts?.lookup ?? defaultResolveHost;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 must be a valid http(s) URL`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 only http and https are allowed`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 embedded credentials are not allowed`);
+  }
+  const host = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  const version = isIP(host);
+  if (version === 4 || version === 6) {
+    if (version === 4) {
+      if (isBlockedIpv4(host.split(".").map((p) => Number(p)))) {
+        throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+      }
+    } else {
+      const bytes = parseIpv6Bytes(host);
+      if (!bytes || isBlockedIpv6(bytes)) {
+        throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+      }
+    }
+    return;
+  }
+  if (/^[0-9]+(\.[0-9]+)*$/.test(host) || /^0x[0-9a-f]+$/i.test(host) || host.includes("%")) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  let addrs;
+  try {
+    addrs = await resolveHost(host);
+  } catch {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  if (addrs.length === 0) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  for (const { address } of addrs) {
+    assertResolvedAddressPublic(address, url);
+  }
+}
+async function createWebhookHook(input, db, opts) {
+  await validateWebhookHandlerUrl(input.handlerUrl, opts);
   if (!db && isApiMode()) {
     const { data } = apiJson("POST", "/webhooks", {
       type: input.type,
@@ -9997,6 +10266,7 @@ function recordWebhookInvocation(id, success, db) {
     d.run("UPDATE webhook_hooks SET invocation_count = invocation_count + 1, failure_count = failure_count + 1 WHERE id = ?", [id]);
   }
 }
+var BLOCKED_TARGET_MESSAGE = "Invalid webhook handler URL \u2014 loopback, link-local, and private network targets are not allowed";
 var init_webhook_hooks = __esm(() => {
   init_database();
   init_api_mode();
@@ -10568,7 +10838,7 @@ async function detectContradiction(newKey, newValue, options = {}, db) {
     conditions.push("project_id = ?");
     params.push(project_id);
   }
-  conditions.push("(valid_until IS NULL OR valid_until > datetime('now'))");
+  conditions.push("(valid_until IS NULL OR valid_until > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))");
   const sql = `SELECT * FROM memories WHERE ${conditions.join(" AND ")} ORDER BY importance DESC LIMIT 10`;
   const rows = d.query(sql).all(...params);
   if (rows.length === 0) {
@@ -10615,6 +10885,7 @@ var init_contradiction = __esm(() => {
 var exports_built_in_hooks = {};
 __export(exports_built_in_hooks, {
   reloadWebhooks: () => reloadWebhooks,
+  makeWebhookHandler: () => makeWebhookHandler,
   loadWebhooksFromDb: () => loadWebhooksFromDb
 });
 async function getAutoMemory() {
@@ -10624,13 +10895,19 @@ async function getAutoMemory() {
   }
   return _processConversationTurn;
 }
-function loadWebhooksFromDb() {
+async function loadWebhooksFromDb() {
   if (_webhooksLoaded)
     return;
   _webhooksLoaded = true;
   try {
     const webhooks = listWebhookHooks({ enabled: true });
     for (const wh of webhooks) {
+      try {
+        await validateWebhookHandlerUrl(wh.handlerUrl);
+      } catch (err) {
+        console.error(`[hooks] Skipping webhook ${wh.id} (${wh.type}): ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
       hookRegistry.register({
         type: wh.type,
         blocking: wh.blocking,
@@ -10648,9 +10925,10 @@ function loadWebhooksFromDb() {
     console.error("[hooks] Failed to load webhooks from DB:", err);
   }
 }
-function makeWebhookHandler(webhookId, url) {
+function makeWebhookHandler(webhookId, url, opts) {
   return async (context) => {
     try {
+      await validateWebhookHandlerUrl(url, opts);
       const res = await fetch(url, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -10663,9 +10941,9 @@ function makeWebhookHandler(webhookId, url) {
     }
   };
 }
-function reloadWebhooks() {
+async function reloadWebhooks() {
   _webhooksLoaded = false;
-  loadWebhooksFromDb();
+  await loadWebhooksFromDb();
 }
 var _processConversationTurn = null, _webhooksLoaded = false;
 var init_built_in_hooks = __esm(() => {
@@ -11762,10 +12040,12 @@ var init_synthesis2 = __esm(() => {
 var exports_session_jobs = {};
 __export(exports_session_jobs, {
   updateSessionJob: () => updateSessionJob,
+  recoverStaleProcessingJobs: () => recoverStaleProcessingJobs,
   listSessionJobs: () => listSessionJobs,
   getSessionJob: () => getSessionJob,
   getNextPendingJob: () => getNextPendingJob,
-  createSessionJob: () => createSessionJob
+  createSessionJob: () => createSessionJob,
+  claimSessionJob: () => claimSessionJob
 });
 function parseJobRow(row) {
   return {
@@ -11895,6 +12175,18 @@ function getNextPendingJob(db) {
     return null;
   return parseJobRow(row);
 }
+function claimSessionJob(id, db) {
+  const d = db || getDatabase();
+  const startedAt = now();
+  const result = d.run("UPDATE session_memory_jobs SET status = 'processing', started_at = ? WHERE id = ? AND status = 'pending'", [startedAt, id]);
+  return result.changes;
+}
+function recoverStaleProcessingJobs(maxAgeMs, db) {
+  const d = db || getDatabase();
+  const cutoff = new Date(Date.now() - maxAgeMs).toISOString();
+  const result = d.run("UPDATE session_memory_jobs SET status = 'pending', started_at = NULL WHERE status = 'processing' AND started_at < ?", [cutoff]);
+  return result.changes;
+}
 var init_session_jobs = __esm(() => {
   init_database();
   init_api_mode();
@@ -12433,7 +12725,11 @@ async function processSessionJob(jobId, db) {
     return result;
   }
   try {
-    updateSessionJob(jobId, { status: "processing", started_at: new Date().toISOString() }, db);
+    const changes = claimSessionJob(jobId, db);
+    if (changes === 0) {
+      result.errors.push(`Job already claimed or not pending: ${jobId}`);
+      return result;
+    }
   } catch (e) {
     result.errors.push(`Failed to mark job as processing: ${String(e)}`);
     return result;
@@ -12556,6 +12852,9 @@ function startSessionQueueWorker() {
     return;
   _workerStarted = true;
   setInterval(() => {
+    try {
+      recoverStaleProcessingJobs(30 * 60 * 1000);
+    } catch {}
     _processNext();
   }, 5000);
 }
@@ -12609,13 +12908,13 @@ __export(exports_session_registry, {
   closeRegistry: () => closeRegistry,
   cleanStaleSessions: () => cleanStaleSessions
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync5 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5 } from "fs";
+import { dirname as dirname6, join as join10 } from "path";
 function getDb() {
   if (_db2)
     return _db2;
   const dir = dirname6(DB_PATH);
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     mkdirSync5(dir, { recursive: true });
   _db2 = new SqliteAdapter(DB_PATH);
   _db2.run("PRAGMA journal_mode = WAL");
@@ -12790,7 +13089,7 @@ function closeRegistry() {
 var DB_PATH, _db2 = null;
 var init_session_registry = __esm(() => {
   init_storage();
-  DB_PATH = join9(process.env["HOME"] || process.env["USERPROFILE"] || "~", ".open-sessions-registry.db");
+  DB_PATH = join10(process.env["HOME"] || process.env["USERPROFILE"] || "~", ".open-sessions-registry.db");
 });
 
 // src/db/pg-migrations.ts
@@ -27266,7 +27565,7 @@ class JSONSchemaGenerator {
               if (val === undefined) {
                 if (this.unrepresentable === "throw") {
                   throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                }
+                } else {}
               } else if (typeof val === "bigint") {
                 if (this.unrepresentable === "throw") {
                   throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -48916,7 +49215,7 @@ var require_tracestate_impl = __commonJS((exports) => {
           const value = listMember.slice(i + 1, part.length);
           if ((0, tracestate_validators_1.validateKey)(key) && (0, tracestate_validators_1.validateValue)(value)) {
             agg.set(key, value);
-          }
+          } else {}
         }
         return agg;
       }, new Map);
@@ -62271,8 +62570,8 @@ var {
 
 // src/cli/index.tsx
 init_database();
-import { readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname8, join as join13 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname8, join as join14 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/db/machines.ts
@@ -64271,6 +64570,18 @@ function registerCrudCommands(program2) {
         }
         resolvedAgentId = ag.id;
       }
+      const requestedSource = opts.source;
+      const claimsAgentAuthor = !requestedSource || requestedSource === "agent";
+      if (!resolvedAgentId && claimsAgentAuthor) {
+        const writingName = resolveWritingAgentName();
+        if (writingName) {
+          resolvedAgentId = getAgent(writingName)?.id ?? registerAgent(writingName).id;
+        } else if (requestedSource === "agent") {
+          throw new Error(`No agent identity: an agent-source save needs a writing agent, and none could be resolved.
+` + `Pass --agent <name>, set MEMENTOS_AGENT, or write the fleet identity file ` + `(~/.hasna/conversations/agent-id, produced by "conversations agents register").
+` + `To write without claiming an agent author, omit --source or pass ` + `--source user|system|auto|imported.`);
+        }
+      }
       const input = {
         key,
         value,
@@ -64280,7 +64591,7 @@ function registerCrudCommands(program2) {
         tags: mergedTags,
         summary: opts.summary,
         ttl_ms: opts.ttl ? parseDuration(opts.ttl) : undefined,
-        source: opts.source,
+        source: requestedSource,
         agent_id: resolvedAgentId,
         session_id: globalOpts.session
       };
@@ -64347,6 +64658,10 @@ function registerCrudCommands(program2) {
       const updateInput = {
         version: existing.version
       };
+      const writingName = resolveWritingAgentName();
+      if (writingName) {
+        updateInput.updated_by_agent = getAgent(writingName)?.id ?? registerAgent(writingName).id;
+      }
       if (opts.value !== undefined)
         updateInput.value = opts.value;
       if (opts.importance !== undefined)
@@ -64374,7 +64689,7 @@ function registerCrudCommands(program2) {
         if (violation)
           throw new Error(formatEnumViolation(violation));
       }
-      const changedFields = Object.keys(updateInput).filter((k) => k !== "version");
+      const changedFields = Object.keys(updateInput).filter((k) => k !== "version" && k !== "updated_by_agent");
       if (changedFields.length === 0) {
         throw new Error(`Nothing to update: no fields were given for ${existing.key} (${existing.id.slice(0, 8)}). ` + `Pass at least one of --value, --scope, --category, --status, --importance, --tags, --summary, --pin/--unpin. ` + `Note that -s is the global --session, not --scope.`);
       }
@@ -64404,8 +64719,7 @@ function registerCrudCommands(program2) {
       }
       const matches = getMemoriesByKey(keyOrId, opts.scope, opts.agent, opts.project);
       if (matches.length === 0) {
-        const looksLikeId = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(keyOrId);
-        if (isApiMode() && looksLikeId && deleteMemory(keyOrId)) {
+        if (isApiMode() && keyOrId.length > 0 && deleteMemory(keyOrId)) {
           if (globalOpts.json) {
             outputJson({ deleted: keyOrId });
           } else {
@@ -64977,7 +65291,7 @@ function registerRemoveCommand(program2) {
       if (mem)
         id = mem.id;
     }
-    if (!id && isApiMode() && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(nameOrId)) {
+    if (!id && isApiMode() && nameOrId.length > 0) {
       id = nameOrId;
     }
     if (!id) {
@@ -65094,6 +65408,7 @@ function registerRecallCommand(program2) {
 // src/cli/commands/memory-cmd-list.ts
 init_projects();
 init_memories();
+init_redact();
 init_helpers();
 import chalk12 from "chalk";
 import { resolve as resolve7 } from "path";
@@ -65141,36 +65456,37 @@ function registerListCommand(program2) {
         };
       }, limit, offset);
       const memories = hasMore && limit !== undefined ? collected.slice(0, limit) : collected;
+      const sanitized = memories.map(redactMemoryForOutput);
       if (fmt === "json") {
-        outputJson(memories);
+        outputJson(sanitized);
         return;
       }
       if (fmt === "csv") {
         console.log("key,value,scope,category,importance,id");
-        for (const m of memories) {
+        for (const m of sanitized) {
           const v = m.value.replace(/"/g, '""');
           console.log(`"${m.key}","${v}",${m.scope},${m.category},${m.importance},${m.id.slice(0, 8)}`);
         }
         return;
       }
       if (fmt === "yaml") {
-        outputYaml(memories);
+        outputYaml(sanitized);
         return;
       }
-      if (memories.length === 0) {
+      if (sanitized.length === 0) {
         console.log(chalk12.yellow("No memories found."));
         return;
       }
-      console.log(chalk12.bold(`${memories.length}${hasMore ? "+" : ""} memor${memories.length === 1 ? "y" : "ies"}:`));
-      for (const m of memories) {
+      console.log(chalk12.bold(`${sanitized.length}${hasMore ? "+" : ""} memor${sanitized.length === 1 ? "y" : "ies"}:`));
+      for (const m of sanitized) {
         console.log(formatMemoryLine(m, {
           valueLength: opts.verbose ? 120 : 64,
           preferSummary: !opts.verbose
         }));
       }
       printPageHint({
-        shown: memories.length,
-        limit: limit ?? memories.length,
+        shown: sanitized.length,
+        limit: limit ?? sanitized.length,
         offset,
         hasMore,
         command: "mementos list",
@@ -65210,7 +65526,10 @@ function getMemoryStats(db) {
   const byCategory = d.query("SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY category").all();
   const byStatus = d.query("SELECT status, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY status").all();
   const pinnedCount = d.query("SELECT COUNT(*) as c FROM memories WHERE pinned = 1 AND status = 'active'").get().c;
-  const expiredCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
+  const expiredCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired'").get().c;
+  const expiresAtCount = d.query("SELECT COUNT(*) as c FROM memories WHERE expires_at IS NOT NULL").get().c;
+  const nowIso = new Date().toISOString();
+  const expiredDueCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < ?)").get(nowIso).c;
   const stats = {
     total,
     by_scope: { global: 0, shared: 0, private: 0, working: 0 },
@@ -65218,7 +65537,9 @@ function getMemoryStats(db) {
     by_status: { active: 0, archived: 0, expired: 0 },
     by_agent: {},
     pinned_count: pinnedCount,
-    expired_count: expiredCount
+    expired_count: expiredCount,
+    expires_at_count: expiresAtCount,
+    expired_due_count: expiredDueCount
   };
   for (const row of byScope)
     if (row.scope in stats.by_scope)
@@ -65252,7 +65573,9 @@ function normalizeStats(data) {
     by_status: { active: 0, archived: 0, expired: 0, ...data?.by_status ?? {} },
     by_agent: data?.by_agent ?? {},
     pinned_count: data?.pinned_count ?? 0,
-    expired_count: data?.expired_count ?? 0
+    expired_count: data?.expired_count ?? 0,
+    expires_at_count: data?.expires_at_count ?? 0,
+    expired_due_count: data?.expired_due_count ?? 0
   };
 }
 function getMemoryReport(filter = {}, db) {
@@ -65310,7 +65633,7 @@ function getStaleMemoriesPage(filter = {}, db) {
   const limit = filter.limit ?? 20;
   const offset = filter.offset ?? 0;
   if (!db && isApiMode()) {
-    const q = toQuery({ days, project_id: filter.project_id, agent_id: filter.agent_id, limit, offset });
+    const q = toQuery({ days, project_id: filter.project_id, agent_id: filter.agent_id, pinned: filter.pinned, limit, offset });
     const { data } = apiJson("GET", `/memories/stale${q}`);
     const rows2 = data?.memories ?? [];
     return {
@@ -65322,8 +65645,14 @@ function getStaleMemoriesPage(filter = {}, db) {
   }
   const d = db || getDatabase();
   const cutoffDate = new Date(Date.now() - days * 86400000).toISOString();
-  const conds = ["status = 'active'", "(accessed_at IS NULL OR accessed_at < ?)", "pinned = 0"];
+  const conds = ["status = 'active'", "(accessed_at IS NULL OR accessed_at < ?)"];
   const params = [cutoffDate];
+  if (filter.pinned !== undefined) {
+    conds.push("pinned = ?");
+    params.push(filter.pinned ? 1 : 0);
+  } else {
+    conds.push("pinned = 0");
+  }
   if (filter.project_id) {
     conds.push("project_id = ?");
     params.push(filter.project_id);
@@ -65500,7 +65829,7 @@ init_projects();
 init_helpers();
 function registerStaleCommand(program2) {
   const handleError = makeHandleError(program2);
-  program2.command("stale").description("Find memories not accessed recently (for cleanup/review)").option("--days <n>", "Stale threshold in days (default: 30)", parseInt).option("--project <path>", "Project filter").option("--agent <name>", "Agent filter").option("--limit <n>", "Max results (default: 20)", parseInt).option("--offset <n>", "Offset for pagination", parseInt).option("--cursor <n>", "Cursor offset for the next page", parseInt).option("--format <fmt>", "Output format: compact (default), json").option("--verbose", "Show wider memory snippets").action((opts) => {
+  program2.command("stale").description("Find memories not accessed recently (for cleanup/review)").option("--days <n>", "Stale threshold in days (default: 30)", parseInt).option("--pinned", "Review stale PINNED memories (default view excludes pinned)").option("--project <path>", "Project filter").option("--agent <name>", "Agent filter").option("--limit <n>", "Max results (default: 20)", parseInt).option("--offset <n>", "Offset for pagination", parseInt).option("--cursor <n>", "Cursor offset for the next page", parseInt).option("--format <fmt>", "Output format: compact (default), json").option("--verbose", "Show wider memory snippets").action((opts) => {
     try {
       const globalOpts = program2.opts();
       const days = opts.days || 30;
@@ -65521,6 +65850,7 @@ function registerStaleCommand(program2) {
       const { rows: collected, hasMore } = collectPagedRows((cursor, pageLimit) => {
         const page = getStaleMemoriesPage({
           days,
+          pinned: opts.pinned ? true : undefined,
           project_id: projectId,
           agent_id: agentId,
           limit: pageLimit,
@@ -65822,7 +66152,7 @@ init_memories();
 init_helpers();
 import chalk18 from "chalk";
 import { resolve as resolve12 } from "path";
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 function registerImportCommand(program2) {
   const handleError = makeHandleError(program2);
   program2.command("import [file]").description("Import memories from a JSON file or stdin (use '-' or pipe data)").option("--overwrite", "Overwrite existing memories (default: merge)").action(async (file, opts) => {
@@ -65832,7 +66162,7 @@ function registerImportCommand(program2) {
       if (file === "-" || !file && !process.stdin.isTTY) {
         raw = await Bun.stdin.text();
       } else if (file) {
-        raw = readFileSync4(resolve12(file), "utf-8");
+        raw = readFileSync5(resolve12(file), "utf-8");
       } else {
         console.error(chalk18.red("No input: provide a file path, use '-' for stdin, or pipe data."));
         process.exit(1);
@@ -65862,14 +66192,14 @@ function registerImportCommand(program2) {
 import chalk19 from "chalk";
 
 // src/lib/config.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2, cpSync as cpSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { basename, dirname as dirname4, join as join7, resolve as resolve13 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync6, readdirSync, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2, cpSync as cpSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { basename, dirname as dirname4, join as join8, resolve as resolve13 } from "path";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
 function homeDir() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir3();
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir4();
 }
 var DEFAULT_CONFIG = {
   default_scope: "private",
@@ -65927,11 +66257,11 @@ function isValidCategory(value) {
   return VALID_CATEGORIES2.includes(value);
 }
 function loadConfig() {
-  const configPath = join7(homeDir(), ".hasna", "mementos", "config.json");
+  const configPath = join8(homeDir(), ".hasna", "mementos", "config.json");
   let fileConfig = {};
-  if (existsSync4(configPath)) {
+  if (existsSync5(configPath)) {
     try {
-      const raw = readFileSync5(configPath, "utf-8");
+      const raw = readFileSync6(configPath, "utf-8");
       fileConfig = JSON.parse(raw);
     } catch {}
   }
@@ -65957,8 +66287,8 @@ function findFileWalkingUp(filename) {
   let dir = process.cwd();
   const legacyHomeMementosDb = resolve13(homeDir(), ".mementos", "mementos.db");
   while (true) {
-    const candidate = join7(dir, filename);
-    if (existsSync4(candidate) && resolve13(candidate) !== legacyHomeMementosDb) {
+    const candidate = join8(dir, filename);
+    if (existsSync5(candidate) && resolve13(candidate) !== legacyHomeMementosDb) {
       return candidate;
     }
     const parent = dirname4(dir);
@@ -65971,7 +66301,7 @@ function findFileWalkingUp(filename) {
 function findGitRoot2() {
   let dir = process.cwd();
   while (true) {
-    if (existsSync4(join7(dir, ".git"))) {
+    if (existsSync5(join8(dir, ".git"))) {
       return dir;
     }
     const parent = dirname4(dir);
@@ -65982,27 +66312,27 @@ function findGitRoot2() {
   }
 }
 function profilesDir() {
-  return join7(homeDir(), ".hasna", "mementos", "profiles");
+  return join8(homeDir(), ".hasna", "mementos", "profiles");
 }
 function globalConfigPath() {
-  return join7(homeDir(), ".hasna", "mementos", "config.json");
+  return join8(homeDir(), ".hasna", "mementos", "config.json");
 }
 function readGlobalConfig() {
   const p = globalConfigPath();
-  if (!existsSync4(p))
+  if (!existsSync5(p))
     return {};
   try {
-    return JSON.parse(readFileSync5(p, "utf-8"));
+    return JSON.parse(readFileSync6(p, "utf-8"));
   } catch {
     return {};
   }
 }
 function readGlobalConfigForWrite() {
   const p = globalConfigPath();
-  if (!existsSync4(p))
+  if (!existsSync5(p))
     return {};
   try {
-    const data = JSON.parse(readFileSync5(p, "utf-8"));
+    const data = JSON.parse(readFileSync6(p, "utf-8"));
     if (data === null || typeof data !== "object" || Array.isArray(data)) {
       throw new Error("expected a JSON object");
     }
@@ -66035,13 +66365,13 @@ function setActiveProfile(name) {
 }
 function listProfiles() {
   const dir = profilesDir();
-  if (!existsSync4(dir))
+  if (!existsSync5(dir))
     return [];
   return readdirSync(dir).filter((f) => f.endsWith(".db")).map((f) => basename(f, ".db")).sort();
 }
 function deleteProfile(name) {
-  const dbPath = join7(profilesDir(), `${name}.db`);
-  if (!existsSync4(dbPath))
+  const dbPath = join8(profilesDir(), `${name}.db`);
+  if (!existsSync5(dbPath))
     return false;
   unlinkSync2(dbPath);
   if (getActiveProfile() === name)
@@ -66050,10 +66380,10 @@ function deleteProfile(name) {
 }
 function getDbPath2() {
   const _home = homeDir();
-  const _newDir = join7(_home, ".hasna", "mementos");
-  const _oldDir = join7(_home, ".mementos");
-  if (!existsSync4(_newDir) && existsSync4(_oldDir)) {
-    mkdirSync3(join7(_home, ".hasna"), { recursive: true });
+  const _newDir = join8(_home, ".hasna", "mementos");
+  const _oldDir = join8(_home, ".mementos");
+  if (!existsSync5(_newDir) && existsSync5(_oldDir)) {
+    mkdirSync3(join8(_home, ".hasna"), { recursive: true });
     cpSync2(_oldDir, _newDir, { recursive: true });
   }
   const envDbPath = process.env["HASNA_MEMENTOS_DB_PATH"] ?? process.env["MEMENTOS_DB_PATH"];
@@ -66067,7 +66397,7 @@ function getDbPath2() {
   }
   const profile = getActiveProfile();
   if (profile) {
-    const profilePath = join7(profilesDir(), `${profile}.db`);
+    const profilePath = join8(profilesDir(), `${profile}.db`);
     ensureDir2(dirname4(profilePath));
     return profilePath;
   }
@@ -66075,21 +66405,21 @@ function getDbPath2() {
   if (dbScope === "project") {
     const gitRoot = findGitRoot2();
     if (gitRoot) {
-      const dbPath = join7(gitRoot, ".mementos", "mementos.db");
+      const dbPath = join8(gitRoot, ".mementos", "mementos.db");
       ensureDir2(dirname4(dbPath));
       return dbPath;
     }
   }
-  const found = findFileWalkingUp(join7(".mementos", "mementos.db"));
+  const found = findFileWalkingUp(join8(".mementos", "mementos.db"));
   if (found) {
     return found;
   }
-  const fallback = join7(homeDir(), ".hasna", "mementos", "mementos.db");
+  const fallback = join8(homeDir(), ".hasna", "mementos", "mementos.db");
   ensureDir2(dirname4(fallback));
   return fallback;
 }
 function ensureDir2(dir) {
-  if (!existsSync4(dir)) {
+  if (!existsSync5(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
 }
@@ -66207,7 +66537,7 @@ init_database();
 init_helpers();
 import chalk20 from "chalk";
 import { resolve as resolve14, dirname as dirname5 } from "path";
-import { existsSync as existsSync5, statSync, copyFileSync, mkdirSync as mkdirSync4, readdirSync as readdirSync2 } from "fs";
+import { existsSync as existsSync6, statSync, copyFileSync, mkdirSync as mkdirSync4, readdirSync as readdirSync2 } from "fs";
 function registerBackupCommand(program2) {
   const handleError = makeHandleError(program2);
   program2.command("backup [path]").description("Backup the SQLite database to a file").option("--list", "List available backups in ~/.hasna/mementos/backups/").action((targetPath, opts) => {
@@ -66216,7 +66546,7 @@ function registerBackupCommand(program2) {
       const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
       const backupsDir = resolve14(home, ".hasna", "mementos", "backups");
       if (opts.list) {
-        if (!existsSync5(backupsDir)) {
+        if (!existsSync6(backupsDir)) {
           if (globalOpts.json) {
             outputJson({ backups: [] });
             return;
@@ -66258,7 +66588,7 @@ function registerBackupCommand(program2) {
         return;
       }
       const dbPath = getDbPath();
-      if (!existsSync5(dbPath)) {
+      if (!existsSync6(dbPath)) {
         console.error(chalk20.red(`Database not found at ${dbPath}`));
         process.exit(1);
       }
@@ -66266,7 +66596,7 @@ function registerBackupCommand(program2) {
       if (targetPath) {
         dest = resolve14(targetPath);
       } else {
-        if (!existsSync5(backupsDir)) {
+        if (!existsSync6(backupsDir)) {
           mkdirSync4(backupsDir, { recursive: true });
         }
         const now3 = new Date;
@@ -66274,7 +66604,7 @@ function registerBackupCommand(program2) {
         dest = resolve14(backupsDir, `mementos-${ts}.db`);
       }
       const destDir = dirname5(dest);
-      if (!existsSync5(destDir)) {
+      if (!existsSync6(destDir)) {
         mkdirSync4(destDir, { recursive: true });
       }
       copyFileSync(dbPath, dest);
@@ -66295,29 +66625,31 @@ function registerBackupCommand(program2) {
 // src/cli/commands/io-restore.ts
 init_database();
 init_api_mode();
+init_memories();
 init_helpers();
 import chalk21 from "chalk";
 import { resolve as resolve15 } from "path";
-import { existsSync as existsSync6, statSync as statSync2, copyFileSync as copyFileSync2, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync7, statSync as statSync2, copyFileSync as copyFileSync2, readdirSync as readdirSync3 } from "fs";
+function readMemoriesFromBackup(source) {
+  const { Database: Database3 } = __require("bun:sqlite");
+  const backupDb = new Database3(source, { readonly: true });
+  try {
+    const rows = backupDb.query("SELECT * FROM memories").all();
+    return { rows, count: rows.length };
+  } finally {
+    backupDb.close();
+  }
+}
 function registerRestoreCommand(program2) {
   const handleError = makeHandleError(program2);
   program2.command("restore [file]").description("Restore the database from a backup file").option("--latest", "Restore the most recent backup from ~/.hasna/mementos/backups/").option("--force", "Skip confirmation and perform the restore").action((filePath, opts) => {
     try {
       const globalOpts = program2.opts();
-      if (isApiMode()) {
-        const msg = "restore operates on the local SQLite database and is not available in API mode (the self-hosted cloud store is authoritative). Unset HASNA_MEMENTOS_API_URL / HASNA_MEMENTOS_API_KEY to restore a local db.";
-        if (globalOpts.json) {
-          outputJson({ error: msg });
-        } else {
-          console.error(chalk21.red(msg));
-        }
-        process.exit(1);
-      }
       const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
       const backupsDir = resolve15(home, ".hasna", "mementos", "backups");
       let source;
       if (opts.latest) {
-        if (!existsSync6(backupsDir)) {
+        if (!existsSync7(backupsDir)) {
           console.error(chalk21.red("No backups directory found."));
           process.exit(1);
         }
@@ -66337,16 +66669,82 @@ function registerRestoreCommand(program2) {
         console.error(chalk21.red("Provide a backup file path or use --latest"));
         process.exit(1);
       }
-      if (!existsSync6(source)) {
+      if (!existsSync7(source)) {
         console.error(chalk21.red(`Backup file not found: ${source}`));
         process.exit(1);
       }
-      const dbPath = getDbPath();
       const backupStat = statSync2(source);
       const backupSizeMB = (backupStat.size / (1024 * 1024)).toFixed(1);
       const backupSizeStr = backupStat.size >= 1024 * 1024 ? `${backupSizeMB} MB` : `${(backupStat.size / 1024).toFixed(1)} KB`;
+      if (isApiMode()) {
+        const { rows, count } = readMemoriesFromBackup(source);
+        if (!opts.force) {
+          if (globalOpts.json) {
+            outputJson({
+              action: "restore",
+              source,
+              target: "cloud-api",
+              backup_size: backupStat.size,
+              backup_memories: count,
+              status: "dry_run",
+              message: "Restores the backup's memories into the hosted store; existing store rows are never overwritten. Use --force to confirm."
+            });
+            return;
+          }
+          console.log(chalk21.bold("Restore preview (hosted store):"));
+          console.log(`  Source:           ${chalk21.cyan(source)} (${backupSizeStr})`);
+          console.log(`  Backup memories:  ${chalk21.green(String(count))}`);
+          console.log(`  Target:           hosted store (cloud-api)`);
+          console.log(`  Semantics:        merges the backup's memories; existing rows are never overwritten`);
+          console.log();
+          console.log(chalk21.yellow("Use --force to confirm restore"));
+          return;
+        }
+        const result = bulkUpsertMemories(rows);
+        if (result.rejected > 0) {
+          const msg = `${result.rejected} of ${result.total} memories were rejected and did not persist. See errors.`;
+          if (globalOpts.json) {
+            outputJson({
+              action: "restore",
+              status: "failed",
+              source,
+              target: "cloud-api",
+              inserted: result.inserted,
+              skipped: result.skipped,
+              rejected: result.rejected,
+              total: result.total,
+              error: msg
+            });
+          } else {
+            console.error(chalk21.red(msg));
+          }
+          process.exit(1);
+        }
+        if (globalOpts.json) {
+          outputJson({
+            action: "restore",
+            source,
+            target: "cloud-api",
+            backup_size: backupStat.size,
+            backup_memories: count,
+            restored_memories: result.inserted,
+            inserted: result.inserted,
+            skipped: result.skipped,
+            rejected: result.rejected,
+            total: result.total,
+            status: "completed"
+          });
+          return;
+        }
+        console.log(`Restored from: ${chalk21.green(source)}`);
+        console.log(`  Restored memories: ${chalk21.green(String(result.inserted))} (inserted)`);
+        console.log(`  Skipped (already present): ${chalk21.yellow(String(result.skipped))}`);
+        console.log(`  Rejected: ${chalk21.yellow(String(result.rejected))}`);
+        return;
+      }
+      const dbPath = getDbPath();
       let currentCount = 0;
-      if (existsSync6(dbPath)) {
+      if (existsSync7(dbPath)) {
         try {
           const db = getDatabase();
           const row = db.query("SELECT COUNT(*) as count FROM memories").get();
@@ -67600,11 +67998,11 @@ init_memories();
 init_agents();
 init_projects();
 import chalk27 from "chalk";
-import { join as join8 } from "path";
-import { homedir as homedir4 } from "os";
+import { join as join9 } from "path";
+import { homedir as homedir5 } from "os";
 import {
-  readFileSync as readFileSync6,
-  existsSync as existsSync7,
+  readFileSync as readFileSync7,
+  existsSync as existsSync8,
   accessSync,
   statSync as statSync3,
   constants as fsConstants
@@ -67639,7 +68037,7 @@ function registerDoctorCommand(program2) {
     checks.push({ name: "Version", status: "ok", detail: version });
     const dbPath = getDbPath();
     let db = null;
-    if (dbPath !== ":memory:" && existsSync7(dbPath)) {
+    if (dbPath !== ":memory:" && existsSync8(dbPath)) {
       try {
         accessSync(dbPath, fsConstants.R_OK | fsConstants.W_OK);
         checks.push({ name: "Database file", status: "ok", detail: dbPath });
@@ -67658,7 +68056,7 @@ function registerDoctorCommand(program2) {
       checks.push({ name: "Database connection", status: "fail", detail: e instanceof Error ? e.message : String(e) });
     }
     try {
-      if (dbPath !== ":memory:" && existsSync7(dbPath)) {
+      if (dbPath !== ":memory:" && existsSync8(dbPath)) {
         const stats = statSync3(dbPath);
         const sizeKb = (stats.size / 1024).toFixed(1);
         const sizeMb = (stats.size / (1024 * 1024)).toFixed(2);
@@ -67791,9 +68189,9 @@ function registerDoctorCommand(program2) {
       checks.push({ name: "MCP server", status: "warn", detail: "could not check (is claude CLI installed?)" });
     }
     try {
-      const settingsFilePath = join8(homedir4(), ".claude", "settings.json");
-      if (existsSync7(settingsFilePath)) {
-        const settings = JSON.parse(readFileSync6(settingsFilePath, "utf-8"));
+      const settingsFilePath = join9(homedir5(), ".claude", "settings.json");
+      if (existsSync8(settingsFilePath)) {
+        const settings = JSON.parse(readFileSync7(settingsFilePath, "utf-8"));
         const hooksObj = settings["hooks"] || {};
         const stopHooks = hooksObj["Stop"] || [];
         const hasMementos = stopHooks.some((e) => e.hooks?.some((h) => h.command && h.command.includes("mementos")));
@@ -67809,11 +68207,11 @@ function registerDoctorCommand(program2) {
       checks.push({ name: "Stop hook", status: "warn", detail: "could not check stop hook" });
     }
     if (process.platform === "darwin") {
-      const plistFilePath = join8(homedir4(), "Library", "LaunchAgents", "com.hasna.mementos.plist");
+      const plistFilePath = join9(homedir5(), "Library", "LaunchAgents", "com.hasna.mementos.plist");
       checks.push({
         name: "Auto-start",
-        status: existsSync7(plistFilePath) ? "ok" : "warn",
-        detail: existsSync7(plistFilePath) ? "configured (starts on login)" : "not configured  \u2192  run: mementos init"
+        status: existsSync8(plistFilePath) ? "ok" : "warn",
+        detail: existsSync8(plistFilePath) ? "configured (starts on login)" : "not configured  \u2192  run: mementos init"
       });
     } else {
       checks.push({ name: "Auto-start", status: "ok", detail: `n/a on ${process.platform}` });
@@ -67892,9 +68290,9 @@ async function runCloudDoctor(globalOpts, checks) {
     checks.push({ name: "MCP server", status: "warn", detail: "could not check (is claude CLI installed?)" });
   }
   try {
-    const settingsFilePath = join8(homedir4(), ".claude", "settings.json");
-    if (existsSync7(settingsFilePath)) {
-      const settings = JSON.parse(readFileSync6(settingsFilePath, "utf-8"));
+    const settingsFilePath = join9(homedir5(), ".claude", "settings.json");
+    if (existsSync8(settingsFilePath)) {
+      const settings = JSON.parse(readFileSync7(settingsFilePath, "utf-8"));
       const hooksObj = settings["hooks"] || {};
       const stopHooks = hooksObj["Stop"] || [];
       const hasMementos = stopHooks.some((e) => e.hooks?.some((h) => h.command && h.command.includes("mementos")));
@@ -67910,11 +68308,11 @@ async function runCloudDoctor(globalOpts, checks) {
     checks.push({ name: "Stop hook", status: "warn", detail: "could not check stop hook" });
   }
   if (process.platform === "darwin") {
-    const plistFilePath = join8(homedir4(), "Library", "LaunchAgents", "com.hasna.mementos.plist");
+    const plistFilePath = join9(homedir5(), "Library", "LaunchAgents", "com.hasna.mementos.plist");
     checks.push({
       name: "Auto-start",
-      status: existsSync7(plistFilePath) ? "ok" : "warn",
-      detail: existsSync7(plistFilePath) ? "configured (starts on login)" : "not configured  \u2192  run: mementos init"
+      status: existsSync8(plistFilePath) ? "ok" : "warn",
+      detail: existsSync8(plistFilePath) ? "configured (starts on login)" : "not configured  \u2192  run: mementos init"
     });
   } else {
     checks.push({ name: "Auto-start", status: "ok", detail: `n/a on ${process.platform}` });
@@ -68358,7 +68756,7 @@ By type:`));
   webhooksCmd.command("create <type> <url>").description("Create a persistent webhook hook").option("--blocking", "Block the operation until the webhook responds").option("--priority <n>", "Hook priority (default 50)", "50").option("--agent <id>", "Scope to specific agent").option("--project <id>", "Scope to specific project").option("--description <text>", "Human-readable description").action(async (type, url, opts) => {
     const { createWebhookHook: createWebhookHook2 } = await Promise.resolve().then(() => (init_webhook_hooks(), exports_webhook_hooks));
     const { reloadWebhooks: reloadWebhooks2 } = await Promise.resolve().then(() => (init_built_in_hooks(), exports_built_in_hooks));
-    const wh = createWebhookHook2({
+    const wh = await createWebhookHook2({
       type,
       handlerUrl: url,
       blocking: opts.blocking ?? false,
@@ -68367,7 +68765,7 @@ By type:`));
       projectId: opts.project,
       description: opts.description
     });
-    reloadWebhooks2();
+    await reloadWebhooks2();
     console.log(chalk31.green("\u2713 Webhook created"));
     console.log(`  ID:   ${chalk31.cyan(wh.id)}`);
     console.log(`  Type: ${wh.type}`);
@@ -68388,7 +68786,7 @@ By type:`));
     const { reloadWebhooks: reloadWebhooks2 } = await Promise.resolve().then(() => (init_built_in_hooks(), exports_built_in_hooks));
     const updated = updateWebhookHook2(id, { enabled: true });
     if (updated) {
-      reloadWebhooks2();
+      await reloadWebhooks2();
       console.log(chalk31.green(`\u2713 Webhook ${id} enabled`));
     } else {
       console.error(chalk31.red(`Webhook not found: ${id}`));
@@ -68400,7 +68798,7 @@ By type:`));
     const { reloadWebhooks: reloadWebhooks2 } = await Promise.resolve().then(() => (init_built_in_hooks(), exports_built_in_hooks));
     const updated = updateWebhookHook2(id, { enabled: false });
     if (updated) {
-      reloadWebhooks2();
+      await reloadWebhooks2();
       console.log(chalk31.yellow(`\u2298 Webhook ${id} disabled`));
     } else {
       console.error(chalk31.red(`Webhook not found: ${id}`));
@@ -69440,6 +69838,7 @@ function syncMemoriesTable(source, target, local, direction, currentMachineId) {
     const countResult = source.get(`SELECT COUNT(*) as cnt FROM "${MEMORY_TABLE}"`);
     stat.total_rows = countResult?.cnt ?? 0;
     const rows = since ? source.all(`SELECT * FROM "${MEMORY_TABLE}" WHERE updated_at > ?`, since) : source.all(`SELECT * FROM "${MEMORY_TABLE}"`);
+    const erroredRowIds = new Set;
     for (const row of rows) {
       try {
         const sourceMachine = sourceMachineRef(row, currentMachineId);
@@ -69498,18 +69897,34 @@ function syncMemoriesTable(source, target, local, direction, currentMachineId) {
         clearMemoryEmbedding(winnerDb, String(winner["id"]));
         stat.synced_rows++;
       } catch (error) {
+        erroredRowIds.add(String(row["id"] ?? "unknown"));
         stat.errors.push(`Memory ${String(row["id"] ?? "unknown")}: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
     if (rows.length === 0) {
       stat.skipped_rows = stat.total_rows;
     }
-    upsertMemorySyncMeta(local, {
-      table_name: MEMORY_TABLE,
-      direction,
-      last_synced_at: new Date().toISOString(),
-      last_synced_row_count: stat.synced_rows
-    });
+    if (rows.length > 0 && stat.errors.length === 0) {
+      let maxSyncedAt = null;
+      for (const row of rows) {
+        if (erroredRowIds.has(String(row["id"] ?? "unknown"))) {
+          continue;
+        }
+        const value = row["updated_at"];
+        if (typeof value === "string" && (maxSyncedAt === null || value > maxSyncedAt)) {
+          maxSyncedAt = value;
+        }
+      }
+      const nextCursor = maxSyncedAt ?? syncMeta?.last_synced_at ?? null;
+      if (nextCursor !== null) {
+        upsertMemorySyncMeta(local, {
+          table_name: MEMORY_TABLE,
+          direction,
+          last_synced_at: nextCursor,
+          last_synced_row_count: stat.synced_rows
+        });
+      }
+    }
   } catch (error) {
     stat.errors.push(error instanceof Error ? error.message : String(error));
   }
@@ -69899,19 +70314,19 @@ function registerStorageCommands(program2) {
 // src/cli/commands/init.ts
 import chalk41 from "chalk";
 import {
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   writeFileSync as writeFileSync4,
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync6
 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
-import { homedir as homedir5 } from "os";
+import { dirname as dirname7, join as join11 } from "path";
+import { homedir as homedir6 } from "os";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function registerInitCommand(program2) {
   program2.command("init").description("One-command setup: register MCP, install stop hook, configure auto-start").action(async () => {
     const { platform: platform2 } = process;
-    const home = homedir5();
+    const home = homedir6();
     const isMac = platform2 === "darwin";
     console.log("");
     console.log(chalk41.bold("  mementos \u2014 setting up your memory layer"));
@@ -69966,17 +70381,17 @@ function registerInitCommand(program2) {
     } else {
       console.log(chalk41.green("  \u2713 MCP server registered with Claude Code"));
     }
-    const hooksDir = join10(home, ".claude", "hooks");
-    const hookDest = join10(hooksDir, "mementos-stop-hook.ts");
-    const settingsPath = join10(home, ".claude", "settings.json");
+    const hooksDir = join11(home, ".claude", "hooks");
+    const hookDest = join11(hooksDir, "mementos-stop-hook.ts");
+    const settingsPath = join11(home, ".claude", "settings.json");
     const hookCommand = `bun ${hookDest}`;
     let hookAlreadyInstalled = false;
     let hookError = null;
     try {
       let settings = {};
-      if (existsSync9(settingsPath)) {
+      if (existsSync10(settingsPath)) {
         try {
-          settings = JSON.parse(readFileSync7(settingsPath, "utf-8"));
+          settings = JSON.parse(readFileSync8(settingsPath, "utf-8"));
         } catch {
           settings = {};
         }
@@ -69987,19 +70402,19 @@ function registerInitCommand(program2) {
       if (alreadyHasMementos) {
         hookAlreadyInstalled = true;
       } else {
-        if (!existsSync9(hooksDir)) {
+        if (!existsSync10(hooksDir)) {
           mkdirSync6(hooksDir, { recursive: true });
         }
-        if (!existsSync9(hookDest)) {
+        if (!existsSync10(hookDest)) {
           const packageDir = dirname7(dirname7(fileURLToPath4(import.meta.url)));
           const candidatePaths = [
-            join10(packageDir, "scripts", "hooks", "claude-stop-hook.ts"),
-            join10(packageDir, "..", "scripts", "hooks", "claude-stop-hook.ts"),
-            join10(home, ".bun", "install", "global", "node_modules", "@hasna", "mementos", "scripts", "hooks", "claude-stop-hook.ts")
+            join11(packageDir, "scripts", "hooks", "claude-stop-hook.ts"),
+            join11(packageDir, "..", "scripts", "hooks", "claude-stop-hook.ts"),
+            join11(home, ".bun", "install", "global", "node_modules", "@hasna", "mementos", "scripts", "hooks", "claude-stop-hook.ts")
           ];
           let hookSourceFound = false;
           for (const src of candidatePaths) {
-            if (existsSync9(src)) {
+            if (existsSync10(src)) {
               copyFileSync3(src, hookDest);
               hookSourceFound = true;
               break;
@@ -70065,7 +70480,7 @@ main().catch(() => {});
     if (!isMac) {
       console.log(chalk41.dim(`  \xB7 Auto-start skipped (not macOS \u2014 platform: ${platform2})`));
     } else {
-      const plistPath = join10(home, "Library", "LaunchAgents", "com.hasna.mementos.plist");
+      const plistPath = join11(home, "Library", "LaunchAgents", "com.hasna.mementos.plist");
       const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -70090,11 +70505,11 @@ main().catch(() => {});
 </plist>
 `;
       try {
-        if (existsSync9(plistPath)) {
+        if (existsSync10(plistPath)) {
           autoStartAlreadyInstalled = true;
         } else {
-          const launchAgentsDir = join10(home, "Library", "LaunchAgents");
-          if (!existsSync9(launchAgentsDir)) {
+          const launchAgentsDir = join11(home, "Library", "LaunchAgents");
+          if (!existsSync10(launchAgentsDir)) {
             mkdirSync6(launchAgentsDir, { recursive: true });
           }
           writeFileSync4(plistPath, plistContent, "utf-8");
@@ -70110,7 +70525,7 @@ main().catch(() => {});
         console.log(chalk41.green("  \u2713 Auto-start configured (starts on login)"));
       }
       if (!autoStartAlreadyInstalled && !autoStartError) {
-        const plistPath2 = join10(home, "Library", "LaunchAgents", "com.hasna.mementos.plist");
+        const plistPath2 = join11(home, "Library", "LaunchAgents", "com.hasna.mementos.plist");
         const loadResult = await run(["launchctl", "load", plistPath2]);
         if (!loadResult.ok) {
           console.log(chalk41.dim(`  \xB7 launchctl load: ${loadResult.output || "already loaded"}`));
@@ -71224,13 +71639,13 @@ function lessonTagForCli(kind) {
 
 // src/cli/brains.ts
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync8,
   writeFileSync as writeFileSync6,
   readdirSync as readdirSync4
 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join12 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join13 } from "path";
 import chalk43 from "chalk";
 
 // src/lib/gatherer.ts
@@ -71307,24 +71722,24 @@ var gatherTrainingData = async (options = {}) => {
 };
 
 // src/lib/model-config.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join12 } from "path";
 var DEFAULT_MODEL = "gpt-4o-mini";
-var CONFIG_DIR = join11(homedir6(), ".hasna", "mementos");
-var CONFIG_PATH = join11(CONFIG_DIR, "config.json");
+var CONFIG_DIR = join12(homedir7(), ".hasna", "mementos");
+var CONFIG_PATH = join12(CONFIG_DIR, "config.json");
 function readConfig() {
-  if (!existsSync10(CONFIG_PATH))
+  if (!existsSync11(CONFIG_PATH))
     return {};
   try {
-    const raw = readFileSync8(CONFIG_PATH, "utf-8");
+    const raw = readFileSync9(CONFIG_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 function writeConfig(config2) {
-  if (!existsSync10(CONFIG_DIR)) {
+  if (!existsSync11(CONFIG_DIR)) {
     mkdirSync7(CONFIG_DIR, { recursive: true });
   }
   writeFileSync5(CONFIG_PATH, JSON.stringify(config2, null, 2) + `
@@ -71372,12 +71787,12 @@ function makeBrainsCommand() {
         limit: opts.limit,
         since
       });
-      const outputDir = opts.output ?? join12(homedir7(), ".hasna", "mementos", "training");
-      if (!existsSync11(outputDir)) {
+      const outputDir = opts.output ?? join13(homedir8(), ".hasna", "mementos", "training");
+      if (!existsSync12(outputDir)) {
         mkdirSync8(outputDir, { recursive: true });
       }
       const timestamp2 = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
-      const outputPath = join12(outputDir, `mementos-training-${timestamp2}.jsonl`);
+      const outputPath = join13(outputDir, `mementos-training-${timestamp2}.jsonl`);
       const jsonl = result.examples.map((ex) => JSON.stringify(ex)).join(`
 `);
       writeFileSync6(outputPath, jsonl + `
@@ -71401,8 +71816,8 @@ function makeBrainsCommand() {
     try {
       let datasetPath = opts.dataset;
       if (!datasetPath) {
-        const trainingDir = join12(homedir7(), ".hasna", "mementos", "training");
-        if (!existsSync11(trainingDir)) {
+        const trainingDir = join13(homedir8(), ".hasna", "mementos", "training");
+        if (!existsSync12(trainingDir)) {
           printError("No training data found. Run `mementos brains gather` first.");
           process.exit(1);
         }
@@ -71412,9 +71827,9 @@ function makeBrainsCommand() {
           printError("No JSONL training files found. Run `mementos brains gather` first.");
           process.exit(1);
         }
-        datasetPath = join12(trainingDir, latestFile);
+        datasetPath = join13(trainingDir, latestFile);
       }
-      if (!datasetPath || !existsSync11(datasetPath)) {
+      if (!datasetPath || !existsSync12(datasetPath)) {
         printError(`Dataset file not found: ${datasetPath ?? "(unresolved)"}`);
         process.exit(1);
       }
@@ -71540,8 +71955,8 @@ function registerAllCommands(program2) {
 // src/cli/index.tsx
 function getPackageVersion2() {
   try {
-    const pkgPath = join13(dirname8(fileURLToPath5(import.meta.url)), "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+    const pkgPath = join14(dirname8(fileURLToPath5(import.meta.url)), "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";