@massu/core 1.16.1 → 1.16.3

package/dist/hooks/session-start.js

@@ -49,16 +49,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/lib/memory-path.ts
-function encodeMemoryDirName(projectRoot) {
-  return projectRoot.replace(/\//g, "-");
-}
-var init_memory_path = __esm({
-  "src/lib/memory-path.ts"() {
-    "use strict";
-  }
-});
-
 // src/credentials.ts
 import { homedir } from "os";
 import { resolve } from "path";
@@ -127,6 +117,345 @@ var init_credentials = __esm({
   }
 });
 
+// src/lib/fileLock.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname } from "path";
+import * as lockfile from "proper-lockfile";
+function readLockHolderPid(lockPath) {
+  try {
+    const raw = readFileSync2(`${lockPath}.pid`, "utf-8").trim();
+    const pid = Number.parseInt(raw, 10);
+    if (!Number.isFinite(pid) || pid <= 0) return null;
+    return pid;
+  } catch {
+    return null;
+  }
+}
+function busyWaitSync(ms) {
+  if (typeof SharedArrayBuffer === "undefined" || typeof Atomics === "undefined") {
+    throw new Error(
+      `withFileLockSync requires SharedArrayBuffer + Atomics for its retry-loop wait. This Node runtime does not provide them \u2014 refusing to fall back to a CPU spinloop. If you hit this in a sandboxed serverless env, the fix is to perform the lock-protected operation in a host runtime that supports Atomics.`
+    );
+  }
+  const sab = new SharedArrayBuffer(4);
+  const view = new Int32Array(sab);
+  Atomics.wait(view, 0, 0, ms);
+}
+function withFileLockSync(lockPath, fn, opts = {}) {
+  mkdirSync2(dirname(lockPath), { recursive: true });
+  const staleMs = opts.staleMs ?? 3e4;
+  const blockMs = opts.retries === 0 ? 0 : opts.blockMs ?? 3e4;
+  const pollIntervalMs = opts.pollIntervalMs ?? 100;
+  const now = opts.now ?? Date.now;
+  const sleep = opts.sleep ?? busyWaitSync;
+  const makeBusyError = opts.errorFactory ?? ((path, pid, retrySeconds, code) => new FileLockBusyError(path, pid, retrySeconds, code));
+  let release = null;
+  const deadline = now() + blockMs;
+  for (; ; ) {
+    try {
+      release = lockfile.lockSync(lockPath, {
+        stale: staleMs,
+        retries: 0,
+        realpath: false
+      });
+      try {
+        writeFileSync2(`${lockPath}.pid`, String(process.pid), "utf-8");
+      } catch {
+      }
+      break;
+    } catch (err) {
+      const e = err;
+      const code = e.code;
+      if (code !== "ELOCKED" && code !== "EBUSY") {
+        throw err;
+      }
+      if (now() >= deadline) {
+        const holderPid = readLockHolderPid(lockPath);
+        const remainingMs = Math.max(0, deadline - now());
+        const retryAfterSeconds = blockMs === 0 ? Math.round(staleMs / 1e3) : Math.round(remainingMs / 1e3);
+        throw makeBusyError(lockPath, holderPid, retryAfterSeconds, code);
+      }
+      sleep(pollIntervalMs);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    try {
+      if (release) release();
+    } catch {
+    }
+    try {
+      rmSync2(`${lockPath}.pid`, { force: true });
+    } catch {
+    }
+  }
+}
+var FileLockBusyError;
+var init_fileLock = __esm({
+  "src/lib/fileLock.ts"() {
+    "use strict";
+    FileLockBusyError = class extends Error {
+      constructor(lockPath, holderPid, retryAfterSeconds, causeCode) {
+        const pidPart = holderPid != null ? `(PID=${holderPid})` : "(PID=unknown)";
+        super(`File lock at ${lockPath} held by another process ${pidPart} \u2014 try again in ${retryAfterSeconds}s`);
+        this.lockPath = lockPath;
+        this.holderPid = holderPid;
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.causeCode = causeCode;
+        this.name = "FileLockBusyError";
+      }
+      lockPath;
+      holderPid;
+      retryAfterSeconds;
+      causeCode;
+    };
+  }
+});
+
+// src/lib/sqlite-loader.ts
+import { createRequire } from "module";
+import { spawnSync } from "child_process";
+import { accessSync, appendFileSync, chmodSync as chmodSync2, constants as fsConstants, existsSync as existsSync2, mkdirSync as mkdirSync3 } from "fs";
+import { dirname as dirname2, join } from "path";
+function isNativeAbiError(err) {
+  const code = err?.code;
+  if (code === "ERR_DLOPEN_FAILED") return true;
+  const msg = err instanceof Error ? err.message : String(err);
+  return /NODE_MODULE_VERSION/.test(msg) || /was compiled against a different Node\.js version/.test(msg) || /ERR_DLOPEN_FAILED/.test(msg) || /\.node\b/.test(msg) && /dlopen|invalid ELF|mach-o|image not found|no such file|not a valid Win32/i.test(msg);
+}
+function loadBetterSqlite3(opts = {}) {
+  if (_testCtor) return _testCtor;
+  if (opts.fresh) bustNativeCache();
+  return req("better-sqlite3");
+}
+function bustNativeCache() {
+  try {
+    const cache = req.cache;
+    if (!cache) return;
+    for (const key of Object.keys(cache)) {
+      if (/better[-_]sqlite3|better_sqlite3\.node|[\\/]bindings[\\/]/.test(key)) {
+        delete cache[key];
+      }
+    }
+  } catch {
+  }
+}
+function openDatabase(dbPath, opts = {}) {
+  const { selfHeal: selfHealOpt = true, ...ctorOpts } = opts;
+  const selfHeal = selfHealOpt && process.env.MASSU_HOOK_RUNTIME !== "1";
+  const Ctor = loadBetterSqlite3();
+  try {
+    return new Ctor(dbPath, ctorOpts);
+  } catch (err) {
+    if (!isNativeAbiError(err)) {
+      throw err;
+    }
+    if (!selfHeal) {
+      recordHealEvent({ phase: "skipped", reason: "self-heal-disabled", abiTo: process.versions.modules });
+      throw new MemoryEngineUnusableError("abi-mismatch", detailOf(err));
+    }
+    const result = (_testHeal ?? attemptNativeHeal)(err);
+    if (!result.healed && !result.contended) {
+      throw new MemoryEngineUnusableError(result.reason ?? "heal-failed", result.detail ?? detailOf(err));
+    }
+    try {
+      const FreshCtor = loadBetterSqlite3({ fresh: true });
+      return new FreshCtor(dbPath, ctorOpts);
+    } catch (retryErr) {
+      throw new MemoryEngineUnusableError("heal-failed", detailOf(retryErr));
+    }
+  }
+}
+function attemptNativeHeal(err) {
+  const start = Date.now();
+  const abiTo = process.versions.modules;
+  const abiFrom = parseAbiFrom(err);
+  let pkgDir;
+  try {
+    pkgDir = dirname2(req.resolve("better-sqlite3/package.json"));
+  } catch {
+    recordHealEvent({ phase: "skipped", reason: "not-resolvable", abiFrom, abiTo });
+    return { healed: false, reason: "missing", abiFrom, abiTo, detail: "better-sqlite3 not resolvable" };
+  }
+  if (!isWritable(pkgDir)) {
+    recordHealEvent({ phase: "skipped", reason: "dir-not-writable", abiFrom, abiTo });
+    return { healed: false, reason: "heal-failed", abiFrom, abiTo, detail: `install dir not writable: ${pkgDir}` };
+  }
+  recordHealEvent({ phase: "attempt", reason: "abi-mismatch", abiFrom, abiTo });
+  try {
+    return withFileLockSync(
+      join(credentialsDir(), "native-heal.lock"),
+      () => runRebuild(pkgDir, abiFrom, abiTo, start),
+      { blockMs: 6e4, staleMs: 3e5 }
+    );
+  } catch (lockErr) {
+    const detail = lockErr instanceof Error ? lockErr.message : String(lockErr);
+    recordHealEvent({ phase: "failed", reason: "heal-failed", abiFrom, abiTo, detail: `lock: ${detail}` });
+    return { healed: false, contended: true, reason: "heal-failed", abiFrom, abiTo, detail: `heal lock contended: ${detail}` };
+  }
+}
+function runRebuild(pkgDir, abiFrom, abiTo, start) {
+  try {
+    const FreshCtor = loadBetterSqlite3({ fresh: true });
+    new FreshCtor(":memory:").close();
+    const res2 = {
+      healed: true,
+      abiFrom,
+      abiTo,
+      durationMs: Date.now() - start,
+      detail: "already healed by a concurrent process"
+    };
+    recordHealEvent({ phase: "success", reason: "already-healed", abiFrom, abiTo, durationMs: res2.durationMs });
+    return res2;
+  } catch (probeErr) {
+    if (!isNativeAbiError(probeErr)) {
+      return { healed: false, reason: "heal-failed", abiFrom, abiTo, durationMs: Date.now() - start, detail: detailOf(probeErr) };
+    }
+  }
+  const prebuildBin = resolveLocalBin(pkgDir, "prebuild-install");
+  if (prebuildBin) {
+    const r = spawnSync(process.execPath, [prebuildBin], {
+      cwd: pkgDir,
+      encoding: "utf-8",
+      timeout: 12e4
+    });
+    if (r.status === 0) {
+      const res2 = { healed: true, method: "prebuild-install", abiFrom, abiTo, durationMs: Date.now() - start };
+      recordHealEvent({ phase: "success", reason: "abi-mismatch", ...res2 });
+      return res2;
+    }
+  }
+  const gypBin = resolveNodeGypBin();
+  if (gypBin && hasCompiler()) {
+    const r = spawnSync(process.execPath, [gypBin, "rebuild", "--release"], {
+      cwd: pkgDir,
+      encoding: "utf-8",
+      timeout: 3e5
+    });
+    if (r.status === 0) {
+      const res2 = { healed: true, method: "node-gyp", abiFrom, abiTo, durationMs: Date.now() - start };
+      recordHealEvent({ phase: "success", reason: "abi-mismatch", ...res2 });
+      return res2;
+    }
+  }
+  const res = {
+    healed: false,
+    reason: "heal-failed",
+    abiFrom,
+    abiTo,
+    durationMs: Date.now() - start,
+    detail: prebuildBin ? "prebuild-install failed; node-gyp fallback unavailable or failed" : "no prebuild-install bin resolvable"
+  };
+  recordHealEvent({ phase: "failed", reason: "heal-failed", abiFrom, abiTo, durationMs: res.durationMs });
+  return res;
+}
+function recordHealEvent(event) {
+  try {
+    const rec = {
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      node: process.versions.node,
+      platform: process.platform,
+      arch: process.arch,
+      ...event
+    };
+    const dir = credentialsDir();
+    mkdirSync3(dir, { recursive: true });
+    const file = join(dir, "native-heal-events.jsonl");
+    appendFileSync(file, JSON.stringify(rec) + "\n", "utf-8");
+    try {
+      chmodSync2(file, 384);
+    } catch {
+    }
+  } catch {
+  }
+}
+function parseAbiFrom(err) {
+  const msg = err instanceof Error ? err.message : String(err ?? "");
+  const m = /NODE_MODULE_VERSION (\d+)/.exec(msg);
+  if (m && /^\d+$/.test(m[1])) return m[1];
+  return void 0;
+}
+function detailOf(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return msg.slice(0, 300);
+}
+function isWritable(dir) {
+  try {
+    accessSync(dir, fsConstants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveLocalBin(pkgDir, name) {
+  const candidates = [
+    join(pkgDir, "node_modules", ".bin", name),
+    // nested install
+    join(pkgDir, "..", ".bin", name),
+    // hoisted (node_modules/.bin)
+    join(pkgDir, "..", "..", "node_modules", ".bin", name)
+    // workspace hoist
+  ];
+  for (const c of candidates) {
+    if (existsSync2(c)) return c;
+  }
+  return void 0;
+}
+function resolveNodeGypBin() {
+  try {
+    return req.resolve("node-gyp/bin/node-gyp.js");
+  } catch {
+    return void 0;
+  }
+}
+function hasCompiler() {
+  for (const cc of ["cc", "clang", "gcc"]) {
+    try {
+      const r = spawnSync(cc, ["--version"], { encoding: "utf-8", timeout: 5e3 });
+      if (r.status === 0) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+var req, NATIVE_DB_REMEDY, MemoryEngineUnusableError, _testCtor, _testHeal;
+var init_sqlite_loader = __esm({
+  "src/lib/sqlite-loader.ts"() {
+    "use strict";
+    init_credentials();
+    init_fileLock();
+    req = createRequire(import.meta.url);
+    NATIVE_DB_REMEDY = "Run 'massu heal' to rebuild the database engine for your Node version, then restart your MCP client / Claude Code.";
+    MemoryEngineUnusableError = class extends Error {
+      reason;
+      remedy;
+      detail;
+      constructor(reason, detail) {
+        super(
+          `Massu memory engine is unusable (${reason}). ${NATIVE_DB_REMEDY}` + (detail ? ` [${detail}]` : "")
+        );
+        this.name = "MemoryEngineUnusableError";
+        this.reason = reason;
+        this.remedy = NATIVE_DB_REMEDY;
+        this.detail = detail;
+      }
+    };
+    _testCtor = null;
+    _testHeal = null;
+  }
+});
+
+// src/lib/memory-path.ts
+function encodeMemoryDirName(projectRoot) {
+  return projectRoot.replace(/\//g, "-");
+}
+var init_memory_path = __esm({
+  "src/lib/memory-path.ts"() {
+    "use strict";
+  }
+});
+
 // src/config-memory-schema.ts
 import { z } from "zod";
 var MemoryConfigSchema;
@@ -266,8 +595,8 @@ var init_config_memory_schema = __esm({
 });
 
 // src/config.ts
-import { resolve as resolve2, dirname } from "path";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2, dirname as dirname3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { parse as parseYaml } from "yaml";
 import { z as z2 } from "zod";
@@ -275,22 +604,22 @@ function findProjectRoot() {
   const cwd = process.cwd();
   let dir = cwd;
   while (true) {
-    if (existsSync2(resolve2(dir, "massu.config.yaml"))) {
+    if (existsSync3(resolve2(dir, "massu.config.yaml"))) {
       return dir;
     }
-    const parent = dirname(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
   dir = cwd;
   while (true) {
-    if (existsSync2(resolve2(dir, "package.json"))) {
+    if (existsSync3(resolve2(dir, "package.json"))) {
       return dir;
     }
-    if (existsSync2(resolve2(dir, ".git"))) {
+    if (existsSync3(resolve2(dir, ".git"))) {
       return dir;
     }
-    const parent = dirname(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -307,8 +636,8 @@ function getConfig() {
   const root = getProjectRoot();
   const configPath = resolve2(root, "massu.config.yaml");
   let rawYaml = {};
-  if (existsSync2(configPath)) {
-    const content = readFileSync2(configPath, "utf-8");
+  if (existsSync3(configPath)) {
+    const content = readFileSync3(configPath, "utf-8");
     rawYaml = parseYaml(content) ?? {};
   }
   const result = RawConfigSchema.safeParse(rawYaml);
@@ -389,9 +718,13 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
   const resolvedEndpoint = resolveEndpoint({ configEndpoint: _config.cloud?.endpoint });
   if (resolvedKey.apiKey) {
     _config.cloud = {
-      enabled: true,
       sync: { memory: true, analytics: true, audit: true },
       ..._config.cloud,
+      // Spread FIRST, then decide `enabled`, so a workspace that declares a `cloud:`
+      // block only to tune `requestTimeoutMs` does not disable its own sync. An
+      // EXPLICIT `enabled: false` is still honoured; `undefined` (not stated) means
+      // "a key resolved, so turn it on". (plan-2026-07-20-cloud-sync-timeout)
+      enabled: _config.cloud?.enabled ?? true,
       apiKey: resolvedKey.apiKey,
       endpoint: resolvedEndpoint
     };
@@ -611,9 +944,22 @@ var init_config = __esm({
       })).default([])
     }).optional();
     CloudConfigSchema = z2.object({
-      enabled: z2.boolean().default(false),
+      // OPTIONAL, not `.default(false)`. A zod default is indistinguishable from an
+      // explicit value once parsed, so `.default(false)` meant that merely declaring a
+      // `cloud:` block (to set any OTHER key) silently produced `enabled: false`, which
+      // then overrode the `enabled: true` auto-enable below via object spread — turning
+      // cloud sync OFF as a side effect of tuning it. `undefined` now means "not stated",
+      // and the auto-enable preserves it. (plan-2026-07-20-cloud-sync-timeout)
+      enabled: z2.boolean().optional(),
       apiKey: z2.string().optional(),
       endpoint: z2.string().optional(),
+      // Per-request POST budget for the `/sync` ingest. cloud-sync.ts reads this
+      // (`(cloud as { requestTimeoutMs?: number }).requestTimeoutMs`) but it was ABSENT
+      // from this schema, and zod strips unknown keys — so the knob was unreachable from
+      // massu.config.yaml and the default could never be tuned. Measured 2026-07-20: a
+      // 423-observation payload takes ~9.2s against the live ingest. Capped at
+      // SYNC_DEADLINE_MS (20s) since the overall deadline clamps each attempt anyway.
+      requestTimeoutMs: z2.number().int().positive().max(2e4).optional(),
       sync: z2.object({
         memory: z2.boolean().default(true),
         analytics: z2.boolean().default(true),
@@ -850,27 +1196,26 @@ var init_memory_vector = __esm({
 });
 
 // src/db-backup.ts
-import Database from "better-sqlite3";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync2 } from "fs";
-import { resolve as resolve3, join, basename, dirname as dirname2 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync3 } from "fs";
+import { resolve as resolve3, join as join2, basename, dirname as dirname4 } from "path";
 import { homedir as homedir3 } from "os";
 function dbBackupsRoot(home = homedir3()) {
   return resolve3(home, ".massu", "db-backups");
 }
 function projectBackupDir(projectRoot, home = homedir3()) {
   const slug = basename(projectRoot).replace(/[^A-Za-z0-9._-]/g, "_") || "project";
-  return join(dbBackupsRoot(home), slug);
+  return join2(dbBackupsRoot(home), slug);
 }
 function backupStamp(nowMs) {
   return new Date(nowMs).toISOString().replace(/[:.]/g, "-");
 }
 function listDbBackups(projectRoot, home = homedir3()) {
   const dir = projectBackupDir(projectRoot, home);
-  if (!existsSync3(dir)) return [];
+  if (!existsSync4(dir)) return [];
   const out = [];
   for (const f of readdirSync(dir)) {
     if (!f.endsWith(".db")) continue;
-    const p = join(dir, f);
+    const p = join2(dir, f);
     const st = statSync(p);
     const db = f.replace(/-\d{4}-\d{2}-\d{2}T.*$/, "");
     out.push({ db, path: p, bytes: st.size, mtimeMs: st.mtimeMs });
@@ -883,13 +1228,13 @@ function hasFreshDbBackup(projectRoot, dbPath, nowMs = Date.now(), home = homedi
   if (backups.length === 0) return false;
   const newest = backups[0];
   if (nowMs - newest.mtimeMs > FRESH_WINDOW_MS) return false;
-  if (existsSync3(dbPath) && statSync(dbPath).mtimeMs > newest.mtimeMs) return false;
+  if (existsSync4(dbPath) && statSync(dbPath).mtimeMs > newest.mtimeMs) return false;
   return true;
 }
 function integrityOk(dbPath) {
   let db = null;
   try {
-    db = new Database(dbPath, { readonly: true });
+    db = openDatabase(dbPath, { readonly: true });
     const rows = db.pragma("integrity_check");
     return rows.length === 1 && rows[0].integrity_check === "ok";
   } catch {
@@ -902,16 +1247,16 @@ function integrityOk(dbPath) {
   }
 }
 function backupDb(projectRoot, dbPath, nowMs = Date.now(), home = homedir3()) {
-  if (!existsSync3(dbPath)) {
+  if (!existsSync4(dbPath)) {
     throw new DbBackupError(`cannot back up a database that does not exist: ${dbPath}`);
   }
   const dir = projectBackupDir(projectRoot, home);
-  mkdirSync2(dir, { recursive: true });
+  mkdirSync4(dir, { recursive: true });
   const name = basename(dbPath, ".db");
-  const dest = join(dir, `${name}-${backupStamp(nowMs)}.db`);
+  const dest = join2(dir, `${name}-${backupStamp(nowMs)}.db`);
   let src = null;
   try {
-    src = new Database(dbPath, { readonly: true });
+    src = openDatabase(dbPath, { readonly: true });
     src.exec(`VACUUM INTO '${dest.replace(/'/g, "''")}'`);
   } catch (err) {
     throw new DbBackupError(
@@ -950,7 +1295,7 @@ function pruneDbBackups(projectRoot, dbName, keep = DEFAULT_RETENTION, home = ho
 }
 function backupBeforeSchemaChange(projectRoot, dbPath, onError, nowMs = Date.now(), home = homedir3()) {
   try {
-    if (!existsSync3(dbPath)) return null;
+    if (!existsSync4(dbPath)) return null;
     if (hasFreshDbBackup(projectRoot, dbPath, nowMs, home)) return null;
     return backupDb(projectRoot, dbPath, nowMs, home);
   } catch (err) {
@@ -962,6 +1307,7 @@ var DEFAULT_RETENTION, FRESH_WINDOW_MS, DbBackupError;
 var init_db_backup = __esm({
   "src/db-backup.ts"() {
     "use strict";
+    init_sqlite_loader();
     DEFAULT_RETENTION = 5;
     FRESH_WINDOW_MS = 24 * 60 * 60 * 1e3;
     DbBackupError = class extends Error {
@@ -1074,21 +1420,21 @@ var init_rule_candidate_store = __esm({
 });
 
 // src/hooks/lib/hook-failure-signal.ts
-import { appendFileSync, mkdirSync as mkdirSync3, existsSync as existsSync4 } from "fs";
-import { join as join2, dirname as dirname3 } from "path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, existsSync as existsSync5 } from "fs";
+import { join as join3, dirname as dirname5 } from "path";
 function resolveFailureLogPath() {
   const explicit = process.env.MASSU_HOOK_FAILURE_LOG;
   if (explicit) return explicit;
   let dir = process.cwd();
   for (let i = 0; i < 12; i++) {
-    if (existsSync4(join2(dir, ".massu")) || existsSync4(join2(dir, "massu.config.yaml"))) {
-      return join2(dir, ".massu", "hook-failures.jsonl");
+    if (existsSync5(join3(dir, ".massu")) || existsSync5(join3(dir, "massu.config.yaml"))) {
+      return join3(dir, ".massu", "hook-failures.jsonl");
     }
-    const parent = dirname3(dir);
+    const parent = dirname5(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return join2(process.cwd(), ".massu", "hook-failures.jsonl");
+  return join3(process.cwd(), ".massu", "hook-failures.jsonl");
 }
 function recordHookFailure(hook, error, context) {
   const record = {
@@ -1101,8 +1447,8 @@ function recordHookFailure(hook, error, context) {
   let wroteSomething = false;
   try {
     const path = resolveFailureLogPath();
-    mkdirSync3(dirname3(path), { recursive: true });
-    appendFileSync(path, JSON.stringify(record) + "\n", "utf-8");
+    mkdirSync5(dirname5(path), { recursive: true });
+    appendFileSync2(path, JSON.stringify(record) + "\n", "utf-8");
     wroteSomething = true;
   } catch {
   }
@@ -1145,9 +1491,9 @@ var init_hook_failure_signal = __esm({
 });
 
 // src/memory-embedder-tokenizer.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 function loadVocab(vocabPath) {
-  const lines = readFileSync3(vocabPath, "utf-8").split("\n");
+  const lines = readFileSync4(vocabPath, "utf-8").split("\n");
   const vocab = /* @__PURE__ */ new Map();
   for (let i = 0; i < lines.length; i++) {
     const tok = lines[i].replace(/\r$/, "");
@@ -1267,9 +1613,9 @@ var init_memory_embedder_tokenizer = __esm({
 
 // src/memory-embedder.ts
 import { fileURLToPath } from "url";
-import { dirname as dirname4, join as join3 } from "path";
-import { existsSync as existsSync5 } from "fs";
-import { createRequire } from "module";
+import { dirname as dirname6, join as join4 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { createRequire as createRequire2 } from "module";
 function getActiveEmbedModel() {
   return _activeModel;
 }
@@ -1290,21 +1636,21 @@ function embeddingsDisabled() {
 }
 function resolveModelDir() {
   try {
-    let dir = dirname4(fileURLToPath(import.meta.url));
+    let dir = dirname6(fileURLToPath(import.meta.url));
     let root = null;
     for (let i = 0; i < 8; i++) {
-      if (existsSync5(join3(dir, "package.json"))) {
+      if (existsSync6(join4(dir, "package.json"))) {
         root = dir;
         break;
       }
-      const parent = dirname4(dir);
+      const parent = dirname6(dir);
       if (parent === dir) break;
       dir = parent;
     }
     if (!root) return null;
     for (const rel of ["dist/embedder", "assets/embedder"]) {
-      const candidate = join3(root, rel);
-      if (existsSync5(join3(candidate, "model_quantized.onnx"))) return candidate;
+      const candidate = join4(root, rel);
+      if (existsSync6(join4(candidate, "model_quantized.onnx"))) return candidate;
     }
     return null;
   } catch {
@@ -1313,9 +1659,9 @@ function resolveModelDir() {
 }
 function resolveWasmDir() {
   try {
-    const req = createRequire(import.meta.url);
-    const main2 = req.resolve(ORT_PKG);
-    return dirname4(main2);
+    const req2 = createRequire2(import.meta.url);
+    const main2 = req2.resolve(ORT_PKG);
+    return dirname6(main2);
   } catch {
     return null;
   }
@@ -1335,8 +1681,8 @@ async function getSession() {
       ort.env.wasm.proxy = false;
       ort.env.wasm.wasmPaths = wasmDir.endsWith("/") ? wasmDir : wasmDir + "/";
       _ortTensor = ort.Tensor;
-      const modelPath = join3(modelDir, "model_quantized.onnx");
-      const vocabPath = join3(modelDir, "vocab.txt");
+      const modelPath = join4(modelDir, "model_quantized.onnx");
+      const vocabPath = join4(modelDir, "vocab.txt");
       _vocab = loadVocab(vocabPath);
       const session = await ort.InferenceSession.create(modelPath, {
         executionProviders: ["wasm"],
@@ -1673,9 +2019,8 @@ __export(memory_db_exports, {
   upsertObservationEmbedding: () => upsertObservationEmbedding,
   usageWarmupElapsed: () => usageWarmupElapsed
 });
-import Database2 from "better-sqlite3";
-import { dirname as dirname5, basename as basename2 } from "path";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
+import { dirname as dirname7, basename as basename2 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6 } from "fs";
 function sanitizeFts5Query(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return '""';
@@ -1691,12 +2036,12 @@ function sanitizeFts5QueryOr(raw) {
 }
 function getMemoryDb() {
   const dbPath = getResolvedPaths().memoryDbPath;
-  const dir = dirname5(dbPath);
-  if (!existsSync6(dir)) {
-    mkdirSync4(dir, { recursive: true });
+  const dir = dirname7(dbPath);
+  if (!existsSync7(dir)) {
+    mkdirSync6(dir, { recursive: true });
   }
-  const preExisting = existsSync6(dbPath);
-  const db = new Database2(dbPath);
+  const preExisting = existsSync7(dbPath);
+  const db = openDatabase(dbPath);
   db.pragma("journal_mode = WAL");
   db.pragma("foreign_keys = ON");
   const onDisk = db.pragma("user_version", { simple: true });
@@ -3402,6 +3747,7 @@ var MEMORY_SCHEMA_VERSION, TOOL_COST_EVENTS_RETENTION_DAYS, MAX_DRAFT_TEXT_LEN,
 var init_memory_db = __esm({
   "src/memory-db.ts"() {
     "use strict";
+    init_sqlite_loader();
     init_config();
     init_memory_vector();
     init_db_backup();
@@ -3423,20 +3769,20 @@ var init_memory_db = __esm({
 
 // src/lib/safe-write.ts
 import {
-  writeFileSync as writeFileSync2,
+  writeFileSync as writeFileSync3,
   renameSync,
   openSync,
   fsyncSync,
   closeSync,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   realpathSync,
   unlinkSync as unlinkSync2,
-  accessSync,
+  accessSync as accessSync2,
   statSync as statSync2,
-  chmodSync as chmodSync2,
+  chmodSync as chmodSync3,
   constants
 } from "fs";
-import { dirname as dirname6, resolve as resolve5, relative, isAbsolute, basename as basename3, sep } from "path";
+import { dirname as dirname8, resolve as resolve5, relative, isAbsolute, basename as basename3, sep } from "path";
 import { createHash as createHash2 } from "crypto";
 function assertContainedIn(rootDir, candidate, opts = {}) {
   if (candidate.includes("\0")) {
@@ -3468,8 +3814,8 @@ function isContainedIn(rootDir, candidate, opts = {}) {
   if (rel === "" && !opts.allowRoot) return false;
   if (rel.startsWith("..") || isAbsolute(rel)) return false;
   let probe = abs;
-  while (!existsSync7(probe) && probe.length > 1) {
-    const parent = dirname6(probe);
+  while (!existsSync8(probe) && probe.length > 1) {
+    const parent = dirname8(probe);
     if (parent === probe) break;
     probe = parent;
   }
@@ -3486,17 +3832,17 @@ function isContainedIn(rootDir, candidate, opts = {}) {
   return !realRel.startsWith("..") && !isAbsolute(realRel);
 }
 function atomicWriteFileSync(destPath, contents) {
-  const dir = dirname6(destPath);
+  const dir = dirname8(destPath);
   const tmp = resolve5(dir, `.${basename3(destPath)}.massu-tmp-${process.pid}`);
   let destMode;
-  if (existsSync7(destPath)) {
-    accessSync(destPath, constants.W_OK);
+  if (existsSync8(destPath)) {
+    accessSync2(destPath, constants.W_OK);
     destMode = statSync2(destPath).mode & 511;
   }
   let fd;
   try {
-    writeFileSync2(tmp, contents, "utf-8");
-    if (destMode !== void 0) chmodSync2(tmp, destMode);
+    writeFileSync3(tmp, contents, "utf-8");
+    if (destMode !== void 0) chmodSync3(tmp, destMode);
     fd = openSync(tmp, "r+");
     fsyncSync(fd);
     closeSync(fd);
@@ -3510,7 +3856,7 @@ function atomicWriteFileSync(destPath, contents) {
       }
     }
     try {
-      if (existsSync7(tmp)) unlinkSync2(tmp);
+      if (existsSync8(tmp)) unlinkSync2(tmp);
     } catch {
     }
     throw err;
@@ -3589,7 +3935,7 @@ var init_safe_write = __esm({
 
 // src/memory-authorship.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync8, mkdirSync as mkdirSync5, chmodSync as chmodSync3, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync9, mkdirSync as mkdirSync7, chmodSync as chmodSync4, statSync as statSync3 } from "fs";
 import { homedir as homedir4 } from "os";
 import { resolve as resolve6 } from "path";
 function renderKeyPath(home = homedir4()) {
@@ -3598,8 +3944,8 @@ function renderKeyPath(home = homedir4()) {
 function readRenderKey(home = homedir4()) {
   const p = renderKeyPath(home);
   try {
-    if (!existsSync8(p)) return void 0;
-    const raw = readFileSync4(p);
+    if (!existsSync9(p)) return void 0;
+    const raw = readFileSync5(p);
     if (raw.length !== 32) return void 0;
     return raw;
   } catch {
@@ -3612,15 +3958,15 @@ function ensureRenderKey(home = homedir4()) {
   const p = renderKeyPath(home);
   try {
     const dir = resolve6(home, ".massu");
-    mkdirSync5(dir, { recursive: true, mode: 448 });
+    mkdirSync7(dir, { recursive: true, mode: 448 });
     try {
-      chmodSync3(dir, 448);
+      chmodSync4(dir, 448);
     } catch {
     }
     const key = randomBytes(32);
-    writeFileSync3(p, key, { mode: 384 });
+    writeFileSync4(p, key, { mode: 384 });
     try {
-      chmodSync3(p, 384);
+      chmodSync4(p, 384);
     } catch {
     }
     return key;
@@ -3665,105 +4011,9 @@ var init_memory_authorship = __esm({
   }
 });
 
-// src/lib/fileLock.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname7 } from "path";
-import * as lockfile from "proper-lockfile";
-function readLockHolderPid(lockPath) {
-  try {
-    const raw = readFileSync5(`${lockPath}.pid`, "utf-8").trim();
-    const pid = Number.parseInt(raw, 10);
-    if (!Number.isFinite(pid) || pid <= 0) return null;
-    return pid;
-  } catch {
-    return null;
-  }
-}
-function busyWaitSync(ms) {
-  if (typeof SharedArrayBuffer === "undefined" || typeof Atomics === "undefined") {
-    throw new Error(
-      `withFileLockSync requires SharedArrayBuffer + Atomics for its retry-loop wait. This Node runtime does not provide them \u2014 refusing to fall back to a CPU spinloop. If you hit this in a sandboxed serverless env, the fix is to perform the lock-protected operation in a host runtime that supports Atomics.`
-    );
-  }
-  const sab = new SharedArrayBuffer(4);
-  const view = new Int32Array(sab);
-  Atomics.wait(view, 0, 0, ms);
-}
-function withFileLockSync(lockPath, fn, opts = {}) {
-  mkdirSync6(dirname7(lockPath), { recursive: true });
-  const staleMs = opts.staleMs ?? 3e4;
-  const blockMs = opts.retries === 0 ? 0 : opts.blockMs ?? 3e4;
-  const pollIntervalMs = opts.pollIntervalMs ?? 100;
-  const now = opts.now ?? Date.now;
-  const sleep = opts.sleep ?? busyWaitSync;
-  const makeBusyError = opts.errorFactory ?? ((path, pid, retrySeconds, code) => new FileLockBusyError(path, pid, retrySeconds, code));
-  let release = null;
-  const deadline = now() + blockMs;
-  for (; ; ) {
-    try {
-      release = lockfile.lockSync(lockPath, {
-        stale: staleMs,
-        retries: 0,
-        realpath: false
-      });
-      try {
-        writeFileSync4(`${lockPath}.pid`, String(process.pid), "utf-8");
-      } catch {
-      }
-      break;
-    } catch (err) {
-      const e = err;
-      const code = e.code;
-      if (code !== "ELOCKED" && code !== "EBUSY") {
-        throw err;
-      }
-      if (now() >= deadline) {
-        const holderPid = readLockHolderPid(lockPath);
-        const remainingMs = Math.max(0, deadline - now());
-        const retryAfterSeconds = blockMs === 0 ? Math.round(staleMs / 1e3) : Math.round(remainingMs / 1e3);
-        throw makeBusyError(lockPath, holderPid, retryAfterSeconds, code);
-      }
-      sleep(pollIntervalMs);
-    }
-  }
-  try {
-    return fn();
-  } finally {
-    try {
-      if (release) release();
-    } catch {
-    }
-    try {
-      rmSync3(`${lockPath}.pid`, { force: true });
-    } catch {
-    }
-  }
-}
-var FileLockBusyError;
-var init_fileLock = __esm({
-  "src/lib/fileLock.ts"() {
-    "use strict";
-    FileLockBusyError = class extends Error {
-      constructor(lockPath, holderPid, retryAfterSeconds, causeCode) {
-        const pidPart = holderPid != null ? `(PID=${holderPid})` : "(PID=unknown)";
-        super(`File lock at ${lockPath} held by another process ${pidPart} \u2014 try again in ${retryAfterSeconds}s`);
-        this.lockPath = lockPath;
-        this.holderPid = holderPid;
-        this.retryAfterSeconds = retryAfterSeconds;
-        this.causeCode = causeCode;
-        this.name = "FileLockBusyError";
-      }
-      lockPath;
-      holderPid;
-      retryAfterSeconds;
-      causeCode;
-    };
-  }
-});
-
 // src/memory-index-region.ts
-import { readFileSync as readFileSync6, existsSync as existsSync9 } from "fs";
-import { dirname as dirname8, join as join4 } from "path";
+import { readFileSync as readFileSync6, existsSync as existsSync10 } from "fs";
+import { dirname as dirname9, join as join5 } from "path";
 function parseRegion(content) {
   const begins = countOccurrences(content, BEGIN_SENTINEL);
   const ends = countOccurrences(content, END_SENTINEL);
@@ -3849,7 +4099,7 @@ function assertOutsideRegionUnchanged(pre, post) {
   }
 }
 function memoryIndexLockPath(memoryDir) {
-  return join4(dirname8(memoryDir), ".massu-memory-index.lock");
+  return join5(dirname9(memoryDir), ".massu-memory-index.lock");
 }
 function withMemoryIndexLock(memoryDir, fn) {
   return withFileLockSync(memoryIndexLockPath(memoryDir), fn, {
@@ -3861,7 +4111,7 @@ function withMemoryIndexLock(memoryDir, fn) {
   });
 }
 function readMemoryIndex(indexPath) {
-  if (!existsSync9(indexPath)) return void 0;
+  if (!existsSync10(indexPath)) return void 0;
   try {
     return readFileSync6(indexPath, "utf8");
   } catch {
@@ -3900,11 +4150,11 @@ var init_memory_index_region = __esm({
 });
 
 // src/rule-candidate-snapshot.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync5, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync7, writeFileSync as writeFileSync5, unlinkSync as unlinkSync3 } from "fs";
 function takeSnapshots(paths) {
   const out = /* @__PURE__ */ new Map();
   for (const p of paths) {
-    if (existsSync10(p)) out.set(p, readFileSync7(p, "utf-8"));
+    if (existsSync11(p)) out.set(p, readFileSync7(p, "utf-8"));
     else out.set(p, null);
   }
   return out;
@@ -3914,7 +4164,7 @@ function restoreSnapshots(snapshot) {
   for (const [path, content] of snapshot) {
     try {
       if (content === null) {
-        if (existsSync10(path)) unlinkSync3(path);
+        if (existsSync11(path)) unlinkSync3(path);
       } else {
         writeFileSync5(path, content, "utf-8");
       }
@@ -3931,8 +4181,8 @@ var init_rule_candidate_snapshot = __esm({
 });
 
 // src/memory-file-ingest.ts
-import { readFileSync as readFileSync9, existsSync as existsSync12, readdirSync as readdirSync2 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync13, readdirSync as readdirSync2 } from "fs";
+import { join as join7 } from "path";
 import { parse as parseYaml2 } from "yaml";
 import { basename as pathBasename } from "path";
 import { createHash as createHash3 } from "crypto";
@@ -4038,7 +4288,7 @@ function upsertMemoryFileMirror(db, f) {
   return "inserted";
 }
 function ingestMemoryFile(db, sessionId, filePath) {
-  if (!existsSync12(filePath)) return "skipped";
+  if (!existsSync13(filePath)) return "skipped";
   const content = readFileSync9(filePath, "utf-8");
   if (Buffer.byteLength(content, "utf-8") > MAX_MEMORY_FILE_BYTES) {
     process.stderr.write(
@@ -4109,21 +4359,21 @@ ${body}` : body;
 }
 function backfillMemoryFiles(db, memoryDir, sessionId) {
   const stats = { inserted: 0, updated: 0, skipped: 0, total: 0 };
-  if (!existsSync12(memoryDir)) return stats;
+  if (!existsSync13(memoryDir)) return stats;
   const files = readdirSync2(memoryDir).filter(
     (f) => f.endsWith(".md") && f !== "MEMORY.md"
   );
   stats.total = files.length;
   const sid = sessionId ?? `backfill-${Date.now()}`;
   for (const file of files) {
-    const result = ingestMemoryFile(db, sid, join6(memoryDir, file));
+    const result = ingestMemoryFile(db, sid, join7(memoryDir, file));
     stats[result]++;
   }
   return stats;
 }
 function reconcileMemoryFileObservations(db, memoryDir, sessionId) {
   try {
-    if (!existsSync12(memoryDir)) return 0;
+    if (!existsSync13(memoryDir)) return 0;
     let entries;
     try {
       entries = readdirSync2(memoryDir);
@@ -4135,7 +4385,7 @@ function reconcileMemoryFileObservations(db, memoryDir, sessionId) {
     for (const file of files) {
       liveNames.add(stripMdExtension(file));
       try {
-        const content = readFileSync9(join6(memoryDir, file), "utf-8");
+        const content = readFileSync9(join7(memoryDir, file), "utf-8");
         const fm = readMemoryFileFrontmatter(content);
         if (fm && typeof fm.name === "string" && fm.name) liveNames.add(fm.name);
       } catch {
@@ -4289,15 +4539,15 @@ var init_memory_render_path = __esm({
 });
 
 // src/memory-tombstones.ts
-import { readFileSync as readFileSync11, appendFileSync as appendFileSync2, existsSync as existsSync14 } from "fs";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync11, appendFileSync as appendFileSync3, existsSync as existsSync15 } from "fs";
+import { join as join9 } from "path";
 function tombstoneLedgerPath(memoryDir) {
-  return join8(memoryDir, TOMBSTONE_LEDGER);
+  return join9(memoryDir, TOMBSTONE_LEDGER);
 }
 function readTombstones(memoryDir) {
   const out = /* @__PURE__ */ new Map();
   const p = tombstoneLedgerPath(memoryDir);
-  if (!existsSync14(p)) return out;
+  if (!existsSync15(p)) return out;
   let raw;
   try {
     raw = readFileSync11(p, "utf8");
@@ -4368,15 +4618,15 @@ var init_memory_llm = __esm({
 // src/memory-backup.ts
 import {
   readdirSync as readdirSync3,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   copyFileSync as copyFileSync2,
   statSync as statSync4,
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   rmSync as rmSync4,
   readFileSync as readFileSync12
 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join9, resolve as resolve7 } from "path";
+import { join as join10, resolve as resolve7 } from "path";
 function backupsRoot(home = homedir6()) {
   return resolve7(home, ".massu", "memory-backups");
 }
@@ -4384,10 +4634,10 @@ function backupStamp2(nowMs) {
   return new Date(nowMs).toISOString().replace(/:/g, "-");
 }
 function newestMtimeMs(dir) {
-  if (!existsSync15(dir)) return 0;
+  if (!existsSync16(dir)) return 0;
   let newest = 0;
   for (const entry of readdirSync3(dir)) {
-    const p = join9(dir, entry);
+    const p = join10(dir, entry);
     try {
       const st = statSync4(p);
       if (st.isFile() && st.mtimeMs > newest) newest = st.mtimeMs;
@@ -4399,10 +4649,10 @@ function newestMtimeMs(dir) {
 }
 function listBackups(home = homedir6()) {
   const root = backupsRoot(home);
-  if (!existsSync15(root)) return [];
+  if (!existsSync16(root)) return [];
   const out = [];
   for (const stamp of readdirSync3(root)) {
-    const dir = join9(root, stamp);
+    const dir = join10(root, stamp);
     try {
       const st = statSync4(dir);
       if (!st.isDirectory()) continue;
@@ -4420,21 +4670,21 @@ function hasFreshBackup(memoryDir, home = homedir6()) {
   return backups[0].createdMs >= newestChange;
 }
 function takeBackup(memoryDir, nowMs, home = homedir6(), retention = DEFAULT_RETENTION2) {
-  if (!existsSync15(memoryDir)) {
+  if (!existsSync16(memoryDir)) {
     throw new BackupError(`memory directory does not exist: ${memoryDir}`);
   }
   const stamp = backupStamp2(nowMs);
-  const dir = join9(backupsRoot(home), stamp);
+  const dir = join10(backupsRoot(home), stamp);
   try {
-    mkdirSync9(dir, { recursive: true, mode: 448 });
+    mkdirSync10(dir, { recursive: true, mode: 448 });
     for (const entry of readdirSync3(memoryDir)) {
-      const srcPath = join9(memoryDir, entry);
+      const srcPath = join10(memoryDir, entry);
       try {
         if (!statSync4(srcPath).isFile()) continue;
       } catch {
         continue;
       }
-      copyFileSync2(srcPath, join9(dir, entry));
+      copyFileSync2(srcPath, join10(dir, entry));
     }
   } catch (err) {
     throw new BackupError(`backup failed: ${err.message}`);
@@ -4499,8 +4749,8 @@ __export(memory_renderer_exports, {
   renderMemoryFiles: () => renderMemoryFiles,
   stripFrontmatter: () => stripFrontmatter
 });
-import { existsSync as existsSync16, readFileSync as readFileSync13 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync13 } from "fs";
+import { join as join11 } from "path";
 import { homedir as homedir7 } from "os";
 import { createHash as createHash5 } from "crypto";
 function renderMemoryFiles(db, candidates, opts) {
@@ -4514,7 +4764,7 @@ function renderMemoryFiles(db, candidates, opts) {
   const audit = opts.audit ?? (() => {
   });
   const { memoryDir } = opts;
-  if (!existsSync16(memoryDir)) {
+  if (!existsSync17(memoryDir)) {
     return EMPTY("no_memory_dir");
   }
   try {
@@ -4582,7 +4832,7 @@ function renderLocked(db, candidates, o) {
       refusals.push({ name: c.name, reason: "tombstoned" });
       continue;
     }
-    if (existsSync16(absPath)) {
+    if (existsSync17(absPath)) {
       const existing = readFileSync13(absPath, "utf8");
       const fm = readMemoryFileFrontmatter(existing);
       const storeRow = db.prepare(
@@ -4632,7 +4882,7 @@ function renderLocked(db, candidates, o) {
       return EMPTY("backup_failed");
     }
   }
-  const indexPath = o.indexPath ?? join10(memoryDir, "MEMORY.md");
+  const indexPath = o.indexPath ?? join11(memoryDir, "MEMORY.md");
   const targets = [...planned.map((p) => p.absPath), indexPath];
   const snapshot = takeSnapshots(targets);
   let bytesWritten = 0;
@@ -4996,12 +5246,12 @@ var init_manifest_registry = __esm({
 });
 
 // src/detect/package-detector.ts
-import { readFileSync as readFileSync14, existsSync as existsSync17, statSync as statSync5, lstatSync, readdirSync as readdirSync4 } from "fs";
-import { join as join11, relative as relative2 } from "path";
+import { readFileSync as readFileSync14, existsSync as existsSync18, statSync as statSync5, lstatSync, readdirSync as readdirSync4 } from "fs";
+import { join as join12, relative as relative2 } from "path";
 import { parse as parseToml } from "smol-toml";
 function safeRead(path) {
   try {
-    if (!existsSync17(path)) return null;
+    if (!existsSync18(path)) return null;
     const ls = lstatSync(path);
     if (ls.isSymbolicLink()) return null;
     const st = statSync5(path);
@@ -5037,7 +5287,7 @@ function parsePackageJson(path, directory, root, warnings) {
   const peer = Object.keys(
     pkg.peerDependencies ?? {}
   );
-  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync17(join11(directory, "tsconfig.json"));
+  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync18(join12(directory, "tsconfig.json"));
   const language = hasTs ? "typescript" : "javascript";
   const scripts = Object.keys(
     pkg.scripts ?? {}
@@ -5463,8 +5713,8 @@ function detectManifestsInDir(dir, root, warnings) {
   let dirEntries = null;
   for (const entry of getManifestRegistry2()) {
     if (!entry.pattern.startsWith("*")) {
-      const path = join11(dir, entry.pattern);
-      if (!existsSync17(path)) continue;
+      const path = join12(dir, entry.pattern);
+      if (!existsSync18(path)) continue;
       const m = entry.parse(path, dir, root, warnings);
       if (m !== null) out.push(m);
     } else {
@@ -5477,8 +5727,8 @@ function detectManifestsInDir(dir, root, warnings) {
       }
       for (const fname of dirEntries) {
         if (!matchManifestPattern2(fname, entry.pattern)) continue;
-        const path = join11(dir, fname);
-        if (!existsSync17(path)) continue;
+        const path = join12(dir, fname);
+        if (!existsSync18(path)) continue;
         const m = entry.parse(path, dir, root, warnings);
         if (m !== null) out.push(m);
       }
@@ -5488,7 +5738,7 @@ function detectManifestsInDir(dir, root, warnings) {
 }
 function listSubdirs(dir) {
   try {
-    return readdirSync4(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_DIRS.has(e.name)).map((e) => join11(dir, e.name));
+    return readdirSync4(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_DIRS.has(e.name)).map((e) => join12(dir, e.name));
   } catch {
     return [];
   }
@@ -5498,8 +5748,8 @@ function detectPackageManifests(projectRoot) {
   const manifests = [];
   manifests.push(...detectManifestsInDir(projectRoot, projectRoot, warnings));
   for (const ws of WORKSPACE_DIRS) {
-    const wsRoot = join11(projectRoot, ws);
-    if (!existsSync17(wsRoot)) continue;
+    const wsRoot = join12(projectRoot, ws);
+    if (!existsSync18(wsRoot)) continue;
     for (const sub of listSubdirs(wsRoot)) {
       manifests.push(...detectManifestsInDir(sub, projectRoot, warnings));
       for (const sub2 of listSubdirs(sub)) {
@@ -11678,13 +11928,13 @@ var init_source_dir_detector = __esm({
 });
 
 // src/detect/monorepo-detector.ts
-import { readFileSync as readFileSync15, existsSync as existsSync18, statSync as statSync6, lstatSync as lstatSync2, readdirSync as readdirSync5 } from "fs";
-import { join as join12, relative as relative3 } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync19, statSync as statSync6, lstatSync as lstatSync2, readdirSync as readdirSync5 } from "fs";
+import { join as join13, relative as relative3 } from "path";
 import { parse as parseYaml3 } from "yaml";
 import { parse as parseToml2 } from "smol-toml";
 function safeReadText(path) {
   try {
-    if (!existsSync18(path)) return null;
+    if (!existsSync19(path)) return null;
     const ls = lstatSync2(path);
     if (ls.isSymbolicLink()) return null;
     const st = statSync6(path);
@@ -11696,20 +11946,20 @@ function safeReadText(path) {
 }
 function firstManifestIn(dir) {
   for (const m of MANIFEST_PRIORITY) {
-    if (existsSync18(join12(dir, m))) return m;
+    if (existsSync19(join13(dir, m))) return m;
   }
   return null;
 }
 function manifestName(dir, manifest) {
   try {
     if (manifest === "package.json") {
-      const raw = safeReadText(join12(dir, "package.json"));
+      const raw = safeReadText(join13(dir, "package.json"));
       if (!raw) return null;
       const pkg = JSON.parse(raw);
       return typeof pkg.name === "string" ? pkg.name : null;
     }
     if (manifest === "pyproject.toml") {
-      const raw = safeReadText(join12(dir, "pyproject.toml"));
+      const raw = safeReadText(join13(dir, "pyproject.toml"));
       if (!raw) return null;
       const toml = parseToml2(raw);
       const project = toml.project;
@@ -11720,7 +11970,7 @@ function manifestName(dir, manifest) {
       return null;
     }
     if (manifest === "Cargo.toml") {
-      const raw = safeReadText(join12(dir, "Cargo.toml"));
+      const raw = safeReadText(join13(dir, "Cargo.toml"));
       if (!raw) return null;
       const toml = parseToml2(raw);
       const pkg = toml.package;
@@ -11728,7 +11978,7 @@ function manifestName(dir, manifest) {
       return null;
     }
     if (manifest === "go.mod") {
-      const raw = safeReadText(join12(dir, "go.mod"));
+      const raw = safeReadText(join13(dir, "go.mod"));
       if (!raw) return null;
       for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
@@ -11752,7 +12002,7 @@ function pkgFromDir(root, dir) {
 }
 function listSubdirs2(dir) {
   try {
-    return readdirSync5(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_DIRS2.has(e.name)).map((e) => join12(dir, e.name));
+    return readdirSync5(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_DIRS2.has(e.name)).map((e) => join13(dir, e.name));
   } catch {
     return [];
   }
@@ -11760,8 +12010,8 @@ function listSubdirs2(dir) {
 function genericWorkspaces(root) {
   const out = [];
   for (const parent of CONVENTIONAL_WORKSPACE_PARENTS) {
-    const p = join12(root, parent);
-    if (!existsSync18(p)) continue;
+    const p = join13(root, parent);
+    if (!existsSync19(p)) continue;
     for (const sub of listSubdirs2(p)) {
       const pkg = pkgFromDir(root, sub);
       if (pkg) out.push(pkg);
@@ -11770,7 +12020,7 @@ function genericWorkspaces(root) {
   return out;
 }
 function detectYarnWorkspaces(root) {
-  const raw = safeReadText(join12(root, "package.json"));
+  const raw = safeReadText(join13(root, "package.json"));
   if (!raw) return null;
   let pkg;
   try {
@@ -11785,7 +12035,7 @@ function detectYarnWorkspaces(root) {
   return expandWorkspaceGlobs(root, globs);
 }
 function detectPnpmWorkspaces(root) {
-  const raw = safeReadText(join12(root, "pnpm-workspace.yaml"));
+  const raw = safeReadText(join13(root, "pnpm-workspace.yaml"));
   if (!raw) return null;
   try {
     const parsed = parseYaml3(raw);
@@ -11801,8 +12051,8 @@ function expandWorkspaceGlobs(root, globs) {
   for (const pattern of globs) {
     const parts = pattern.split("/");
     if (parts.length === 2 && (parts[1] === "*" || parts[1] === "**")) {
-      const parent = join12(root, parts[0]);
-      if (!existsSync18(parent)) continue;
+      const parent = join13(root, parts[0]);
+      if (!existsSync19(parent)) continue;
       for (const sub of listSubdirs2(parent)) {
         const pkg = pkgFromDir(root, sub);
         if (pkg && !seen.has(pkg.path)) {
@@ -11812,8 +12062,8 @@ function expandWorkspaceGlobs(root, globs) {
       }
       continue;
     }
-    const direct = join12(root, pattern);
-    if (existsSync18(direct)) {
+    const direct = join13(root, pattern);
+    if (existsSync19(direct)) {
       const pkg = pkgFromDir(root, direct);
       if (pkg && !seen.has(pkg.path)) {
         seen.add(pkg.path);
@@ -11824,16 +12074,16 @@ function expandWorkspaceGlobs(root, globs) {
   return out;
 }
 function hasTurbo(root) {
-  return existsSync18(join12(root, "turbo.json"));
+  return existsSync19(join13(root, "turbo.json"));
 }
 function hasNx(root) {
-  return existsSync18(join12(root, "nx.json"));
+  return existsSync19(join13(root, "nx.json"));
 }
 function hasLerna(root) {
-  return existsSync18(join12(root, "lerna.json"));
+  return existsSync19(join13(root, "lerna.json"));
 }
 function hasBazel(root) {
-  return existsSync18(join12(root, "WORKSPACE")) || existsSync18(join12(root, "WORKSPACE.bazel")) || existsSync18(join12(root, "MODULE.bazel"));
+  return existsSync19(join13(root, "WORKSPACE")) || existsSync19(join13(root, "WORKSPACE.bazel")) || existsSync19(join13(root, "MODULE.bazel"));
 }
 function detectMonorepo(projectRoot) {
   const nested = [];
@@ -12024,8 +12274,8 @@ var init_vr_command_map = __esm({
 });
 
 // src/detect/domain-inferrer.ts
-import { existsSync as existsSync19, readdirSync as readdirSync6 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync6 } from "fs";
+import { join as join14 } from "path";
 function titleCase(s) {
   if (!s) return s;
   return s.split(/[-_\s]+/).filter(Boolean).map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(" ");
@@ -12045,8 +12295,8 @@ function topLevelSrcSubdirs(root, sourceDirs) {
   const effective = sourceDirs.length > 0 ? sourceDirs : ["src"];
   const seen = /* @__PURE__ */ new Set();
   for (const rel of effective) {
-    const abs = join13(root, rel);
-    if (!existsSync19(abs)) continue;
+    const abs = join14(root, rel);
+    if (!existsSync20(abs)) continue;
     try {
       for (const e of readdirSync6(abs, { withFileTypes: true })) {
         if (!e.isDirectory()) continue;
@@ -12133,8 +12383,8 @@ var init_domain_inferrer = __esm({
 });
 
 // src/detect/regex-fallback.ts
-import { existsSync as existsSync20, readdirSync as readdirSync7, readFileSync as readFileSync16, statSync as statSync7 } from "fs";
-import { resolve as resolve8, join as join14, basename as basename4 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync7, readFileSync as readFileSync16, statSync as statSync7 } from "fs";
+import { resolve as resolve8, join as join15, basename as basename4 } from "path";
 function introspectPython(detection, projectRoot) {
   const sourceDir = resolveSourceDir(detection, "python", projectRoot);
   if (!sourceDir) return null;
@@ -12301,9 +12551,9 @@ function resolveSourceDir(detection, lang, projectRoot) {
   if (list.length > 0) {
     const first = list[0];
     const abs = resolve8(projectRoot, first);
-    return existsSync20(abs) ? abs : null;
+    return existsSync21(abs) ? abs : null;
   }
-  return existsSync20(projectRoot) ? projectRoot : null;
+  return existsSync21(projectRoot) ? projectRoot : null;
 }
 function sampleFiles(dir, nameRegex, pathFilter) {
   const out = [];
@@ -12323,7 +12573,7 @@ function sampleFiles(dir, nameRegex, pathFilter) {
       if (entry === "__pycache__") continue;
       if (entry === "venv" || entry === ".venv") continue;
       if (entry === "dist" || entry === "build") continue;
-      const child = join14(path, entry);
+      const child = join15(path, entry);
       let st;
       try {
         st = statSync7(child);
@@ -12727,8 +12977,8 @@ init_memory_db();
 
 // src/team-rule-sync.ts
 init_config();
-import { existsSync as existsSync11, writeFileSync as writeFileSync6, unlinkSync as unlinkSync4, mkdirSync as mkdirSync7 } from "fs";
-import { join as join5, dirname as dirname9 } from "path";
+import { existsSync as existsSync12, writeFileSync as writeFileSync6, unlinkSync as unlinkSync4, mkdirSync as mkdirSync8 } from "fs";
+import { join as join6, dirname as dirname10 } from "path";
 
 // src/license.ts
 init_config();
@@ -12819,7 +13069,7 @@ function verifyLicenseResponse(payload) {
   );
 }
 function isLicenseSignatureRequired() {
-  return process.env.MASSU_REQUIRE_SIGNED_LICENSE === "true";
+  return process.env.MASSU_REQUIRE_SIGNED_LICENSE !== "false";
 }
 
 // src/license.ts
@@ -13125,7 +13375,7 @@ async function pullTeamPromotions(db, opts = {}) {
       result.revoked_handled += 1;
       continue;
     }
-    if (existsSync11(candidatePath) || alreadyApplied(db, p.prompt_hash)) {
+    if (existsSync12(candidatePath) || alreadyApplied(db, p.prompt_hash)) {
       result.skipped += 1;
       continue;
     }
@@ -13161,7 +13411,7 @@ function isValidWirePromotion(p) {
   return typeof r.prompt_hash === "string" && PROMPT_HASH_RE.test(r.prompt_hash) && typeof r.destination === "string" && typeof r.draft_text === "string" && typeof r.promoted_by === "string" && typeof r.promoted_at === "string";
 }
 function sidecarPath(projectRoot, promptHash) {
-  return join5(projectRoot, ".massu", "rule-candidates", `${promptHash}.json`);
+  return join6(projectRoot, ".massu", "rule-candidates", `${promptHash}.json`);
 }
 function alreadyApplied(db, promptHash) {
   try {
@@ -13175,7 +13425,7 @@ function alreadyApplied(db, promptHash) {
   }
 }
 function handleRevocation(db, projectRoot, candidatePath, promptHash) {
-  if (existsSync11(candidatePath)) {
+  if (existsSync12(candidatePath)) {
     try {
       unlinkSync4(candidatePath);
     } catch {
@@ -13223,8 +13473,8 @@ function materializeCandidate(db, projectRoot, candidatePath, p, orgId) {
     draft_text: p.draft_text,
     ...p.review_attestation !== void 0 ? { publisher_review_attestation: p.review_attestation } : {}
   };
-  const dir = dirname9(candidatePath);
-  if (!existsSync11(dir)) mkdirSync7(dir, { recursive: true });
+  const dir = dirname10(candidatePath);
+  if (!existsSync12(dir)) mkdirSync8(dir, { recursive: true });
   writeFileSync6(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
   try {
     shareObservation(db, p.promoted_by, getProjectName(), "rule_promotion", promptText, {
@@ -13279,22 +13529,23 @@ function failSync(db, reason) {
 // src/hooks/session-start.ts
 init_memory_file_ingest();
 init_config();
-import { readFileSync as readFileSync17, existsSync as existsSync21 } from "fs";
-import { join as join15, resolve as resolve9 } from "path";
+init_sqlite_loader();
+import { readFileSync as readFileSync17, existsSync as existsSync22 } from "fs";
+import { join as join16, resolve as resolve9 } from "path";
 import { parse as parseYaml4 } from "yaml";
 
 // src/capability-advisor.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname10, join as join7 } from "path";
+import { dirname as dirname11, join as join8 } from "path";
 function advisorStatePath(home = homedir5()) {
-  return join7(home, ".massu", "advisor-state.json");
+  return join8(home, ".massu", "advisor-state.json");
 }
 function readAdvisorState(home) {
   try {
     const p = advisorStatePath(home);
-    if (!existsSync13(p)) return {};
+    if (!existsSync14(p)) return {};
     return JSON.parse(readFileSync10(p, "utf-8"));
   } catch {
     return {};
@@ -13303,7 +13554,7 @@ function readAdvisorState(home) {
 function writeAdvisorState(state, home) {
   try {
     const p = advisorStatePath(home);
-    mkdirSync8(dirname10(p), { recursive: true });
+    mkdirSync9(dirname11(p), { recursive: true });
     writeFileSync7(p, JSON.stringify(state, null, 2), { mode: 384 });
   } catch {
   }
@@ -13457,7 +13708,7 @@ var localModelAdvisor = {
 init_consolidation_config();
 
 // src/lib/pidLiveness.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 function isPidAlive(pid, opts = {}) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   const platform = opts.platformOverride ?? process.platform;
@@ -13482,7 +13733,7 @@ function checkPosix(pid, killOverride) {
 }
 function checkWindows(pid) {
   try {
-    const res = spawnSync("tasklist", ["/FI", `PID eq ${pid}`, "/NH"], {
+    const res = spawnSync2("tasklist", ["/FI", `PID eq ${pid}`, "/NH"], {
       encoding: "utf-8",
       windowsHide: true
     });
@@ -13665,9 +13916,8 @@ async function buildContext(db, sessionId, source, tokenBudget, taskId) {
   }
   try {
     const knowledgeDbPath = getResolvedPaths().knowledgeDbPath;
-    if (existsSync21(knowledgeDbPath)) {
-      const Database3 = (await import("better-sqlite3")).default;
-      const kdb = new Database3(knowledgeDbPath, { readonly: true });
+    if (existsSync22(knowledgeDbPath)) {
+      const kdb = openDatabase(knowledgeDbPath, { readonly: true, selfHeal: false });
       try {
         const stats = kdb.prepare(
           "SELECT COUNT(*) as doc_count, MAX(indexed_at) as last_indexed FROM knowledge_documents"
@@ -13729,8 +13979,8 @@ function estimateTokens(text) {
 }
 async function getGitBranch() {
   try {
-    const { spawnSync: spawnSync2 } = await import("child_process");
-    const result = spawnSync2("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    const { spawnSync: spawnSync3 } = await import("child_process");
+    const result = spawnSync3("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf-8",
       timeout: 5e3
     });
@@ -13756,7 +14006,7 @@ async function buildDriftBanner() {
     if (process.env.MASSU_DRIFT_QUIET === "1") return "";
     if (watcherIsLiveAndFresh()) return "";
     const configPath = resolve9(process.cwd(), "massu.config.yaml");
-    if (!existsSync21(configPath)) return "";
+    if (!existsSync22(configPath)) return "";
     const content = readFileSync17(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") return "";
@@ -13800,8 +14050,8 @@ function getMemoryDir() {
 }
 function loadCorrectionsPreventionRules() {
   try {
-    const correctionsPath = join15(getResolvedPaths().memoryDir, "corrections.md");
-    if (!existsSync21(correctionsPath)) return [];
+    const correctionsPath = join16(getResolvedPaths().memoryDir, "corrections.md");
+    if (!existsSync22(correctionsPath)) return [];
     return parseCorrectionRules(readFileSync17(correctionsPath, "utf-8"));
   } catch (_e) {
     return [];
@@ -13810,7 +14060,7 @@ function loadCorrectionsPreventionRules() {
 function readWatchStateRaw(cwd) {
   try {
     const path = resolve9(cwd, ".massu", "watch-state.json");
-    if (!existsSync21(path)) return null;
+    if (!existsSync22(path)) return null;
     const obj = JSON.parse(readFileSync17(path, "utf-8"));
     if (!obj || typeof obj !== "object") return null;
     return obj;