@i4ctime/q-ring 0.11.5 → 0.12.0

package/README.md

@@ -182,7 +182,7 @@ qring tunnel list
 
 ### Teleportation — Encrypted Sharing
 
-Pack secrets into AES-256-GCM encrypted bundles for secure transfer between machines.
+Pack secrets into AES-256-GCM encrypted bundles for secure transfer between machines. Keys are derived with PBKDF2-HMAC-SHA512 (210 000 iterations) from your passphrase; each bundle records its iteration count, so bundles produced by older versions still unpack.
 
 ```bash
 # Pack secrets (prompts for passphrase)
@@ -197,7 +197,7 @@ qring teleport unpack <bundle> --dry-run
 
 ### Import — Bulk Secret Ingestion
 
-Import secrets from `.env` files directly into q-ring. Supports standard dotenv syntax including comments, quoted values, and escape sequences.
+Import secrets from `.env` files directly into q-ring. Supports standard dotenv syntax including comments, quoted values, and escape sequences. The CLI accepts either a file path or raw content; the `import_dotenv` MCP tool only accepts raw content (it never reads files from disk) so an agent can't coerce it into reading arbitrary local files.
 
 ```bash
 # Import all secrets from a .env file
@@ -335,7 +335,7 @@ qring hook test <id>
 
 Hooks are fire-and-forget: a failing hook never blocks secret operations. The hook registry is stored at `~/.config/q-ring/hooks.json`.
 
-**SSRF protection:** HTTP hook URLs targeting private/loopback IP ranges (`127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`) are blocked by default. DNS resolution is checked before the request is sent. To allow hooks targeting local services (e.g. during development), set the environment variable `Q_RING_ALLOW_PRIVATE_HOOKS=1`.
+**SSRF protection:** HTTP hook URLs targeting private/loopback IP ranges (`127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`) are blocked by default. DNS is checked up front *and* re-validated at connect time, so a hostname can't pass the check then rebind to a private address before the socket opens. To allow hooks targeting local services (e.g. during development), set the environment variable `Q_RING_ALLOW_PRIVATE_HOOKS=1`.
 
 ### Configurable Rotation
 
@@ -397,7 +397,7 @@ qring get DB_URL
 
 ### User Approvals (Zero-Trust Agent)
 
-Protect sensitive production secrets from being read autonomously by the MCP server without explicit user approval. Each approval token is HMAC-verified, scoped, reasoned, and time-limited.
+Protect sensitive production secrets from being read autonomously by the MCP server without explicit user approval. Each approval token is HMAC-verified, scoped, reasoned, and time-limited. The gate applies to bulk reads too — `export_secrets` and `teleport_pack` over MCP skip approval-protected keys that lack a valid grant.
 
 ```bash
 # Mark a secret as requiring approval
@@ -508,6 +508,8 @@ qring wizard myservice --hook-exec "pm2 restart app"
 
 Define project-level governance rules in `.q-ring.json` to control which MCP tools can be used, which keys are accessible, and which commands can be executed. Policy is enforced at both the MCP server and keyring level.
 
+Over MCP, policy is resolved from the directory the server was **launched** in — not from the `projectPath` a caller passes — so an agent can't sidestep restrictions by pointing at a directory with no policy. Launch the MCP server from your project root (where `.q-ring.json` lives). Edits to `.q-ring.json` are picked up automatically (the policy cache invalidates on file change), so you don't need to restart the server.
+
 ```bash
 # View the active policy
 qring policy
@@ -626,7 +628,7 @@ qring agent --once
 
 ### Quantum Status Dashboard — Live Monitoring
 
-Launch a real-time dashboard in your browser that turns the entire quantum subsystem into one glanceable page. The dashboard is a single self-contained HTML page served locally — no dependencies, no cloud, no config — and streams updates every 5 seconds via Server-Sent Events while preserving search input and scroll position across ticks.
+Launch a real-time dashboard in your browser that turns the entire quantum subsystem into one glanceable page. It's a single self-contained HTML page served locally — no cloud, no config, fully offline — built as a Preact + htm app (runtime bundled and inlined). It streams updates every 5 seconds via Server-Sent Events and diffs the DOM in place, so data refreshes without re-running entrance animations and your search input, caret, and scroll position are preserved across ticks.
 
 What you get:
 
@@ -644,14 +646,16 @@ What you get:
 
 Top-bar controls let you **pause** SSE updates (handy while reading the audit feed), **refresh** on demand, or jump to the raw JSON snapshot at `/api/status`. Keyboard shortcuts: `/` focus secrets search · `P` pause · `R` refresh.
 
+The dashboard binds to `127.0.0.1` only and **never** exposes secret values, but it does surface key names, the audit log, and approval grants — so every route is gated by a random, per-launch token. `qring status` prints (and opens) the full URL including `?token=…`; requests without the token get a `403`. Stop the server to invalidate the token.
+
 ```bash
-# Open the dashboard (auto-launches your browser)
+# Open the dashboard (auto-launches your browser at http://127.0.0.1:9876/?token=…)
 qring status
 
 # Specify a custom port
 qring status --port 4200
 
-# Don't auto-open the browser
+# Don't auto-open the browser (copy the printed tokenized URL yourself)
 qring status --no-open
 ```
 
@@ -663,95 +667,95 @@ q-ring includes a full MCP server with 44 tools for AI agent integration.
 
 | Tool | Description |
 |------|-------------|
-| `get_secret` | Retrieve with superposition collapse + observer logging |
-| `list_secrets` | List keys with quantum metadata, filterable by tag/expiry/pattern |
-| `set_secret` | Store with optional TTL, env state, tags, rotation format |
-| `delete_secret` | Remove a secret |
-| `has_secret` | Boolean check (respects decay) |
-| `export_secrets` | Export as .env/JSON with optional key and tag filters |
-| `import_dotenv` | Parse and import secrets from .env content |
-| `check_project` | Validate project secrets against `.q-ring.json` manifest |
-| `env_generate` | Generate .env content from the project manifest |
+| `get_secret` | Read a secret value (collapses superposition, audits the read) |
+| `list_secrets` | List keys + metadata in scope (values never exposed); filter by tag, expiry, glob |
+| `set_secret` | Create or overwrite a single secret with optional TTL, per-env state, tags, rotation format |
+| `delete_secret` | Permanently remove a secret value (not undoable from q-ring) |
+| `has_secret` | Boolean existence check that respects decay (no audit read) |
+| `export_secrets` | Render multiple secrets as `.env` or JSON for one-off export (skips approval-protected keys without a grant) |
+| `import_dotenv` | Parse `.env` text and bulk-store every key/value pair (accepts raw content only — never reads files) |
+| `check_project` | Compare `.q-ring.json` manifest against the keyring for missing/expired/stale keys |
+| `env_generate` | Render a complete `.env` body from the project manifest, with warnings for gaps |
 
 ### Quantum Tools
 
 | Tool | Description |
 |------|-------------|
-| `inspect_secret` | Full quantum state (states, decay, entanglement, access count) |
-| `detect_environment` | Wavefunction collapse — detect current env context |
-| `generate_secret` | Quantum noise — generate and optionally save secrets |
-| `entangle_secrets` | Link two secrets for synchronized rotation |
-| `disentangle_secrets` | Remove entanglement between two secrets |
+| `inspect_secret` | Show metadata for one key (states, decay, entanglement, access count) without revealing the value |
+| `detect_environment` | Resolve which env slug should drive superposition collapse for the current context |
+| `generate_secret` | Generate a CSPRNG-backed value in a chosen format and optionally store it |
+| `entangle_secrets` | Link two keys so future writes/rotations propagate the same value |
+| `disentangle_secrets` | Break the sync link between two keys (does not delete values) |
 
 ### Tunneling Tools
 
 | Tool | Description |
 |------|-------------|
-| `tunnel_create` | Create ephemeral in-memory secret |
-| `tunnel_read` | Read (may self-destruct) |
-| `tunnel_list` | List active tunnels |
-| `tunnel_destroy` | Immediately destroy |
+| `tunnel_create` | Stash a value in process memory and return an opaque ID (never touches disk) |
+| `tunnel_read` | Fetch a tunneled value by ID — may self-destruct on read |
+| `tunnel_list` | Enumerate active tunnels with remaining read budget and TTL (IDs only) |
+| `tunnel_destroy` | Immediately remove a tunnel from memory before its TTL/reads run out |
 
 ### Teleportation Tools
 
 | Tool | Description |
 |------|-------------|
-| `teleport_pack` | Encrypt secrets into a portable bundle |
-| `teleport_unpack` | Decrypt and import a bundle |
+| `teleport_pack` | Encrypt selected secrets into a passphrase-protected AES-256-GCM bundle |
+| `teleport_unpack` | Decrypt a teleport bundle and import each secret (with optional dry-run) |
 
 ### Validation Tools
 
 | Tool | Description |
 |------|-------------|
-| `validate_secret` | Test if a secret is valid with its target service (OpenAI, Stripe, GitHub, etc.) |
-| `list_providers` | List all available validation providers |
+| `validate_secret` | Hit the upstream service (OpenAI/Stripe/GitHub/AWS/HTTP) to confirm a single key is still live |
+| `list_providers` | Enumerate built-in validation providers and their auto-detect prefixes |
 
 ### Hook Tools
 
 | Tool | Description |
 |------|-------------|
-| `register_hook` | Register a shell/HTTP/signal callback on secret changes |
-| `list_hooks` | List all registered hooks with match criteria and status |
-| `remove_hook` | Remove a registered hook by ID |
+| `register_hook` | Register a shell/HTTP/signal side-effect that fires on write/delete/rotate |
+| `list_hooks` | Show every registered hook with match criteria, type, and enabled flag |
+| `remove_hook` | Detach a single hook by ID without touching any secrets |
 
 ### Execution & Scanning Tools
 
 | Tool | Description |
 |------|-------------|
-| `exec_with_secrets` | Run a shell command securely with secrets injected, auto-redacted output, and exec profile enforcement |
-| `scan_codebase_for_secrets` | Scan a directory for hardcoded secrets using regex heuristics and entropy analysis |
-| `lint_files` | Lint specific files for hardcoded secrets with optional auto-fix |
+| `exec_with_secrets` | Run a child command with secrets injected as env vars and any leaked values redacted from output |
+| `scan_codebase_for_secrets` | Walk a directory tree and flag hardcoded secrets via regex + entropy heuristics |
+| `lint_files` | Inspect a specific file list for hardcoded secrets with optional auto-fix to `process.env.KEY` |
 
 ### AI Agent Tools
 
 | Tool | Description |
 |------|-------------|
-| `get_project_context` | Safe, redacted overview of project secrets, environment, manifest, and activity |
-| `agent_remember` | Store a key-value pair in encrypted agent memory (persists across sessions) |
-| `agent_recall` | Retrieve from agent memory, or list all stored keys |
-| `agent_forget` | Delete a key from agent memory |
-| `analyze_secrets` | Usage analytics: most accessed, stale, unused, and rotation recommendations |
+| `get_project_context` | Single redacted snapshot of secrets, env, manifest, hooks, and recent audit activity |
+| `agent_remember` | Persist a non-secret note in encrypted agent memory across sessions |
+| `agent_recall` | Read a memory value, or list every stored key when no key is supplied |
+| `agent_forget` | Permanently delete a key from agent memory |
+| `analyze_secrets` | Usage profile: most-accessed, stale, never-accessed, no-rotation candidates |
 
 ### Observer & Health Tools
 
 | Tool | Description |
 |------|-------------|
-| `audit_log` | Query access history |
-| `detect_anomalies` | Scan for unusual access patterns |
-| `verify_audit_chain` | Verify tamper-evident hash chain integrity |
-| `export_audit` | Export audit events in jsonl, json, or csv format |
-| `health_check` | Full health report |
-| `status_dashboard` | Launch the quantum status dashboard (SSE) — live KPIs, health, secrets table, manifest, policy, approvals, hooks, agent memory, anomalies, and audit feed |
-| `agent_scan` | Run autonomous agent scan |
+| `audit_log` | Query the tamper-evident audit log filtered by key, action, and limit |
+| `detect_anomalies` | Surface burst-read and off-hours findings from audit history |
+| `verify_audit_chain` | Recompute the audit hash chain and report the first break point if tampered |
+| `export_audit` | Export audit events as jsonl, json, or csv for archival/SIEM |
+| `health_check` | Read-only scope sweep: decay/stale/expired counts plus current anomalies |
+| `status_dashboard` | Start a local SSE dashboard with live KPIs, secrets, hooks, and audit feed (returns a token-gated `127.0.0.1` URL) |
+| `agent_scan` | Multi-project health pass with optional `autoRotate` for expired secrets |
 
 ### Governance & Policy Tools
 
 | Tool | Description |
 |------|-------------|
-| `check_policy` | Check if an action (tool use, key read, exec) is allowed by project policy |
-| `get_policy_summary` | Get a summary of the project's governance policy configuration |
-| `rotate_secret` | Attempt issuer-native rotation via detected or specified provider |
-| `ci_validate_secrets` | CI-oriented batch validation of all secrets with structured pass/fail report |
+| `check_policy` | Dry-run a tool/key/exec action against `.q-ring.json` policy without performing it |
+| `get_policy_summary` | High-level overview of policy rule counts and approval/rotation requirements |
+| `rotate_secret` | Ask the upstream provider to issue a new credential and store it back in the keyring |
+| `ci_validate_secrets` | Batch-validate every accessible secret in scope and return a structured pass/fail report |
 
 ### Cursor / Kiro Configuration
 

package/dist/{chunk-A4RZVP3P.js → chunk-5TQNDJT3.js}

@@ -555,87 +555,11 @@ import { randomUUID } from "crypto";
 // src/utils/http-request.ts
 import { request as httpsRequest } from "https";
 import { request as httpRequestPlain } from "http";
-var DEFAULT_TIMEOUT_MS = 1e4;
-var DEFAULT_MAX_RESPONSE_BYTES = 65536;
-function httpRequest(opts) {
-  const {
-    url,
-    method = "GET",
-    headers = {},
-    body,
-    timeoutMs = DEFAULT_TIMEOUT_MS,
-    maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES
-  } = opts;
-  return new Promise((resolve, reject) => {
-    const parsed = new URL(url);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      reject(new Error(`Unsupported URL protocol: ${parsed.protocol}`));
-      return;
-    }
-    const reqFn = parsed.protocol === "https:" ? httpsRequest : httpRequestPlain;
-    const reqHeaders = { ...headers };
-    if (body && !reqHeaders["Content-Length"]) {
-      reqHeaders["Content-Length"] = Buffer.byteLength(body);
-    }
-    const req = reqFn(
-      url,
-      { method, headers: reqHeaders, timeout: timeoutMs },
-      (res) => {
-        const chunks = [];
-        let totalBytes = 0;
-        let truncated = false;
-        res.on("data", (chunk) => {
-          totalBytes += chunk.length;
-          if (totalBytes > maxResponseBytes) {
-            truncated = true;
-            res.destroy();
-            return;
-          }
-          chunks.push(chunk);
-        });
-        let settled = false;
-        const settle = (result) => {
-          if (!settled) {
-            settled = true;
-            resolve(result);
-          }
-        };
-        const fail = (err) => {
-          if (!settled) {
-            settled = true;
-            reject(err);
-          }
-        };
-        res.on("error", (err) => fail(new Error(`Response error: ${err.message}`)));
-        res.on("end", () => {
-          settle({
-            statusCode: res.statusCode ?? 0,
-            body: Buffer.concat(chunks).toString("utf8"),
-            truncated
-          });
-        });
-        res.on("close", () => {
-          settle({
-            statusCode: res.statusCode ?? 0,
-            body: Buffer.concat(chunks).toString("utf8"),
-            truncated
-          });
-        });
-      }
-    );
-    req.on("error", (err) => reject(new Error(`Network error: ${err.message}`)));
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("Request timed out"));
-    });
-    if (body) req.write(body);
-    req.end();
-  });
-}
 
 // src/core/ssrf.ts
 import { lookup } from "dns/promises";
 import * as dns from "dns";
+import { lookup as dnsLookup } from "dns";
 import { isIPv4, isIPv6 } from "net";
 function lookupAddressesSync(hostname2) {
   const lookupSync2 = dns.lookupSync;
@@ -682,6 +606,36 @@ async function checkSSRF(url) {
   }
   return null;
 }
+function guardedLookup(hostname2, options, callback) {
+  if (process.env.Q_RING_ALLOW_PRIVATE_HOOKS === "1") {
+    dnsLookup(
+      hostname2,
+      options,
+      callback
+    );
+    return;
+  }
+  dnsLookup(
+    hostname2,
+    options,
+    (err, address, family) => {
+      if (err) return callback(err, address, family);
+      const list = Array.isArray(address) ? address : [{ address, family: family ?? 0 }];
+      for (const a of list) {
+        if (isPrivateIP(a.address)) {
+          const blocked = Object.assign(
+            new Error(
+              `Blocked: "${hostname2}" resolved to private address ${a.address} at connect time.`
+            ),
+            { code: "EQRINGSSRF" }
+          );
+          return callback(blocked, address, family);
+        }
+      }
+      callback(null, address, family);
+    }
+  );
+}
 function checkJitHttpProvisionUrl(url) {
   if (process.env.Q_RING_ALLOW_PRIVATE_HOOKS === "1") return null;
   try {
@@ -719,6 +673,91 @@ function checkJitHttpProvisionUrl(url) {
   return null;
 }
 
+// src/utils/http-request.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_MAX_RESPONSE_BYTES = 65536;
+function httpRequest(opts) {
+  const {
+    url,
+    method = "GET",
+    headers = {},
+    body,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES
+  } = opts;
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      reject(new Error(`Unsupported URL protocol: ${parsed.protocol}`));
+      return;
+    }
+    const reqFn = parsed.protocol === "https:" ? httpsRequest : httpRequestPlain;
+    const reqHeaders = { ...headers };
+    if (body && !reqHeaders["Content-Length"]) {
+      reqHeaders["Content-Length"] = Buffer.byteLength(body);
+    }
+    const req = reqFn(
+      url,
+      {
+        method,
+        headers: reqHeaders,
+        timeout: timeoutMs,
+        // Re-validate the resolved IP at connect time (DNS-rebinding guard).
+        lookup: guardedLookup
+      },
+      (res) => {
+        const chunks = [];
+        let totalBytes = 0;
+        let truncated = false;
+        res.on("data", (chunk) => {
+          totalBytes += chunk.length;
+          if (totalBytes > maxResponseBytes) {
+            truncated = true;
+            res.destroy();
+            return;
+          }
+          chunks.push(chunk);
+        });
+        let settled = false;
+        const settle = (result) => {
+          if (!settled) {
+            settled = true;
+            resolve(result);
+          }
+        };
+        const fail = (err) => {
+          if (!settled) {
+            settled = true;
+            reject(err);
+          }
+        };
+        res.on("error", (err) => fail(new Error(`Response error: ${err.message}`)));
+        res.on("end", () => {
+          settle({
+            statusCode: res.statusCode ?? 0,
+            body: Buffer.concat(chunks).toString("utf8"),
+            truncated
+          });
+        });
+        res.on("close", () => {
+          settle({
+            statusCode: res.statusCode ?? 0,
+            body: Buffer.concat(chunks).toString("utf8"),
+            truncated
+          });
+        });
+      }
+    );
+    req.on("error", (err) => reject(new Error(`Network error: ${err.message}`)));
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("Request timed out"));
+    });
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
 // src/core/hooks.ts
 function getRegistryPath2() {
   const dir = join5(homedir3(), ".config", "q-ring");
@@ -1128,15 +1167,29 @@ function listApprovals() {
 }
 
 // src/core/policy.ts
+import { statSync as statSync2 } from "fs";
+import { join as join7 } from "path";
 var cachedPolicy = null;
+var policyRoot = null;
+function resolvePolicyPath(projectPath) {
+  return policyRoot ?? projectPath ?? process.cwd();
+}
+function configMtime(pp) {
+  try {
+    return statSync2(join7(pp, ".q-ring.json")).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
 function loadPolicy(projectPath) {
-  const pp = projectPath ?? process.cwd();
-  if (cachedPolicy && cachedPolicy.path === pp) {
+  const pp = resolvePolicyPath(projectPath);
+  const mtimeMs = configMtime(pp);
+  if (cachedPolicy && cachedPolicy.path === pp && cachedPolicy.mtimeMs === mtimeMs) {
     return cachedPolicy.policy;
   }
   const config = readProjectConfig(pp);
   const policy = config?.policy ?? {};
-  cachedPolicy = { path: pp, policy };
+  cachedPolicy = { path: pp, mtimeMs, policy };
   return policy;
 }
 function checkSecretLifecyclePolicy(input, projectPath) {
@@ -1205,7 +1258,13 @@ function checkExecPolicy(command, projectPath) {
   const policy = loadPolicy(projectPath);
   if (!policy.exec) return { allowed: true, policySource: "no-policy" };
   if (policy.exec.denyCommands) {
-    const denied = policy.exec.denyCommands.find((d) => command.includes(d));
+    const denied = policy.exec.denyCommands.find((d) => {
+      const pattern = new RegExp(
+        `(^|[\\s/])${d.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(\\s|$)`,
+        "i"
+      );
+      return pattern.test(command);
+    });
     if (denied) {
       return {
         allowed: false,
@@ -1215,7 +1274,8 @@ function checkExecPolicy(command, projectPath) {
     }
   }
   if (policy.exec.allowCommands) {
-    const allowed = policy.exec.allowCommands.some((a) => command.startsWith(a));
+    const normalized = command.trimStart();
+    const allowed = policy.exec.allowCommands.some((a) => normalized.startsWith(a));
     if (!allowed) {
       return {
         allowed: false,
@@ -1242,7 +1302,7 @@ function getPolicySummary(projectPath) {
 // src/core/keyring.ts
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, unlinkSync } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 
 // src/utils/hash.ts
@@ -1446,10 +1506,10 @@ registry.register(httpProvider);
 
 // src/core/keyring.ts
 function withJitEnvelopeLock(service, key, fn) {
-  const dir = join7(homedir5(), ".config", "q-ring", "jit-locks");
+  const dir = join8(homedir5(), ".config", "q-ring", "jit-locks");
   mkdirSync5(dir, { recursive: true });
   const safe = Buffer.from(`${service}\0${key}`, "utf8").toString("base64url");
-  const lockPath = join7(dir, `${safe}.lock`);
+  const lockPath = join8(dir, `${safe}.lock`);
   const deadline = Date.now() + 8e3;
   while (Date.now() < deadline) {
     try {
@@ -1833,6 +1893,16 @@ function exportSecrets(opts = {}) {
     if (entry.envelope) {
       const decay = checkDecay(entry.envelope);
       if (decay.isExpired) continue;
+      if (source === "mcp" && entry.envelope.meta.requiresApproval && !hasApproval(entry.key, entry.scope)) {
+        logAudit({
+          action: "read",
+          key: entry.key,
+          scope: entry.scope,
+          source,
+          detail: "blocked: requires user approval (export)"
+        });
+        continue;
+      }
       const value = collapseValue(entry.envelope, env);
       if (value !== null) {
         rawValues.set(entry.key, value);
@@ -1964,7 +2034,7 @@ function tunnelList() {
 
 // src/core/memory.ts
 import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { homedir as homedir6, hostname, userInfo } from "os";
 import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes3 } from "crypto";
 import { Entry as Entry2 } from "@napi-rs/keyring";
@@ -1972,14 +2042,14 @@ var MEMORY_FILE = "agent-memory.enc";
 var KEYRING_SERVICE = "qring-memory-key";
 var KEYRING_ACCOUNT = "encryption-key";
 function getMemoryDir() {
-  const dir = join8(homedir6(), ".config", "q-ring");
+  const dir = join9(homedir6(), ".config", "q-ring");
   if (!existsSync6(dir)) {
     mkdirSync6(dir, { recursive: true });
   }
   return dir;
 }
 function getMemoryPath() {
-  return join8(getMemoryDir(), MEMORY_FILE);
+  return join9(getMemoryDir(), MEMORY_FILE);
 }
 function deriveLegacyKey() {
   const fingerprint = `qring-memory:${hostname()}:${userInfo().username}`;
@@ -2090,8 +2160,8 @@ export {
   exportAudit,
   detectAnomalies,
   listEntanglements,
-  httpRequest,
   checkSSRF,
+  httpRequest,
   registerHook,
   removeHook,
   listHooks,
@@ -2124,4 +2194,4 @@ export {
   forget,
   clearMemory
 };
-//# sourceMappingURL=chunk-A4RZVP3P.js.map
+//# sourceMappingURL=chunk-5TQNDJT3.js.map