@mickey-kras/hindsight-memory-router-coding-agents 0.0.0-stage → 0.8.7

package/dist/antigravity-statusline.js

@@ -0,0 +1,1329 @@
+#!/usr/bin/env node
+
+// ../../shared/patterns.ts
+var PRINCIPAL_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+var TOKEN_FORMAT_PATTERN = /^mr_[A-Za-z0-9._-]{1,64}_[0-9a-f]{64}$/;
+var BANK_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+
+// ../../shared/bank-access.ts
+var AccessDeniedError = class extends Error {
+  statusCode = 403;
+  constructor() {
+    super("memory access denied");
+    this.name = "AccessDeniedError";
+  }
+};
+function visibleBanks(access) {
+  const banks = [.../* @__PURE__ */ new Set([...access.writeBank ? [access.writeBank] : [], ...access.additionalReadBanks])];
+  if (banks.some((bank) => !BANK_ID_PATTERN.test(bank) || bank === "." || bank === "..")) {
+    throw new AccessDeniedError();
+  }
+  return banks;
+}
+function requireBank(access, bank, operation) {
+  if (!visibleBanks(access).includes(bank) || operation === "write" && access.writeBank !== bank) {
+    throw new AccessDeniedError();
+  }
+}
+function classifyOperation(method, suffix) {
+  if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
+  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
+    suffix
+  ))
+    return "read";
+  if (method === "GET" && suffix === "") return "read";
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
+    suffix
+  ))
+    return "write";
+  throw new AccessDeniedError();
+}
+
+// ../../coding-agents/runtime.ts
+import { realpathSync } from "fs";
+import { isAbsolute as isAbsolute2, resolve, sep } from "path";
+
+// ../../shared/managed-config.ts
+import { readFileSync } from "fs";
+import { isAbsolute } from "path";
+
+// ../../shared/tool-prefix.ts
+var ToolPrefixError = class extends Error {
+};
+var DEFAULT_TOOL_PREFIX = "hindsight_";
+var PREFIX_PATTERN = /^[a-z][a-z0-9_]*_$/;
+function validatedToolPrefix(value) {
+  if (value === void 0) return DEFAULT_TOOL_PREFIX;
+  if (typeof value !== "string" || value.length > 32 || !PREFIX_PATTERN.test(value)) {
+    throw new ToolPrefixError(
+      "invalid toolPrefix: expected 2-32 lowercase letters, digits or underscores, ending in underscore"
+    );
+  }
+  return value;
+}
+function toolBrand(value = void 0) {
+  const prefix = validatedToolPrefix(value);
+  const id = prefix.slice(0, -1).replaceAll(/_+/g, "-").replace(/-$/, "");
+  return {
+    prefix,
+    id,
+    skillName: `${id}-coding-agent`,
+    displayName: prefix === DEFAULT_TOOL_PREFIX ? "Hindsight" : id
+  };
+}
+
+// ../../shared/managed-config.ts
+var TOKEN_ENV_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+function validatedPrincipal(configured) {
+  const human = configured.human;
+  if ((human === void 0 ? typeof configured.tokenEnv !== "string" || !TOKEN_ENV_PATTERN.test(configured.tokenEnv) : typeof human !== "object" || human === null || Object.keys(human).length !== 1 || typeof human.credentialRef !== "string" || !/^[A-Za-z0-9._-]{1,64}$/.test(human.credentialRef) || Object.hasOwn(configured, "tokenEnv")) || "token" in configured || "apiToken" in configured) {
+    throw new AccessDeniedError();
+  }
+  if (configured.source !== void 0 && (typeof configured.source !== "string" || configured.source.trim() === "")) {
+    throw new AccessDeniedError();
+  }
+  if (typeof configured.writeBank === "string" && configured.writeBank.trim() === "") {
+    throw new AccessDeniedError();
+  }
+  if (configured.additionalReadBanks !== void 0 && !Array.isArray(configured.additionalReadBanks)) {
+    throw new AccessDeniedError();
+  }
+  const principal = { ...configured, additionalReadBanks: configured.additionalReadBanks ?? [] };
+  visibleBanks(principal);
+  return principal;
+}
+function validatePositiveInteger(value) {
+  if (value !== void 0 && (!Number.isSafeInteger(value) || value <= 0)) throw new AccessDeniedError();
+}
+function validateQueueOptions(config) {
+  for (const value of [
+    config.recallTimeoutMs,
+    config.recallMaxTokens,
+    config.retainQueueFlushIntervalMs,
+    config.queueMaxItems,
+    config.queueMaxBytes
+  ]) {
+    validatePositiveInteger(value);
+  }
+  if (config.queueMaxAgeMs !== void 0 && (!Number.isSafeInteger(config.queueMaxAgeMs) || config.queueMaxAgeMs !== -1 && config.queueMaxAgeMs <= 0)) {
+    throw new AccessDeniedError();
+  }
+  if (config.queueDir !== void 0 && (typeof config.queueDir !== "string" || !isAbsolute(config.queueDir))) {
+    throw new AccessDeniedError();
+  }
+}
+function loadValidatedManagedConfig(env) {
+  const path = env.HINDSIGHT_ROUTER_CONFIG;
+  if (!path || !isAbsolute(path)) throw new AccessDeniedError();
+  const config = JSON.parse(readFileSync(path, "utf8"));
+  const toolPrefix = validatedToolPrefix(config.toolPrefix);
+  validateQueueOptions(config);
+  return { ...config, toolPrefix };
+}
+function loadManagedConfig(env, principalId) {
+  try {
+    if (!principalId) throw new AccessDeniedError();
+    const config = loadValidatedManagedConfig(env);
+    if (!Object.hasOwn(config.principals ?? {}, principalId)) throw new AccessDeniedError();
+    const principal = validatedPrincipal(config.principals[principalId]);
+    validateQueueOptions(config);
+    return { config, principalId, principal };
+  } catch {
+    throw new AccessDeniedError();
+  }
+}
+
+// ../../shared/router-transport.ts
+import { createHash } from "crypto";
+
+// ../../shared/router-url.ts
+var RouterUrlError = class extends Error {
+  constructor(reason) {
+    super(`routerUrl rejected: ${reason}`);
+    this.name = "RouterUrlError";
+  }
+};
+function validateRouterUrl(value) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new RouterUrlError("missing");
+  }
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    throw new RouterUrlError("invalid");
+  }
+  if (url.protocol !== "https:") {
+    throw new RouterUrlError("not-https");
+  }
+  const hostname = url.hostname.replace(/\.$/, "");
+  if (hostname === "hindsight.vectorize.io" || hostname.endsWith(".hindsight.vectorize.io")) {
+    throw new RouterUrlError("upstream");
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new RouterUrlError("userinfo");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+
+// ../../shared/router-transport.ts
+var RouterRequestError = class extends Error {
+  constructor(statusCode, retryAfterMs = 0) {
+    super(`memory request failed (${statusCode})`);
+    this.statusCode = statusCode;
+    this.retryAfterMs = retryAfterMs;
+    this.name = "RouterRequestError";
+  }
+  statusCode;
+  retryAfterMs;
+};
+function boundedRetryAfterMs(header) {
+  if (!header?.trim()) return 0;
+  const value = header.trim();
+  const delay = /^\d+(?:\.\d+)?$/.test(value) ? Number(value) * 1e3 : Date.parse(value) - Date.now();
+  return Number.isFinite(delay) ? Math.min(6e4, Math.max(0, delay)) : 0;
+}
+var ROUTING_KEYS = ["bankId", "bank_id", "bank_ids"];
+function assertAuthorizedUrl(url, method, baseUrl, access) {
+  const listing = url === `${baseUrl}/v1/default/banks` && method === "GET";
+  if (listing || [`${baseUrl}/version`, `${baseUrl}/v1/version`].includes(url) && method === "GET") {
+    return listing;
+  }
+  const prefix = `${baseUrl}/v1/default/banks/`;
+  if (!url.startsWith(prefix)) throw new AccessDeniedError();
+  const path = url.slice(prefix.length).split("?")[0];
+  const split = path.indexOf("/");
+  const bank = decodeURIComponent(split < 0 ? path : path.slice(0, split));
+  const suffix = split < 0 ? "" : path.slice(split);
+  requireBank(access, bank, classifyOperation(method, suffix));
+  return false;
+}
+async function filterVisibleBanks(response, access) {
+  const data = await response.json();
+  if (!Array.isArray(data.banks)) throw new RouterRequestError(502);
+  const allowed = new Set(visibleBanks(access));
+  const banks = data.banks.filter(
+    (bank) => bank !== null && typeof bank === "object" && allowed.has(bank.bank_id ?? "")
+  );
+  return Response.json({ banks, total: banks.length });
+}
+function assertSafeRequest(url, body) {
+  const rawPath = /^[a-z][a-z\d+.-]*:\/\/[^/?#]*([^?#]*)/i.exec(url)?.[1] ?? "";
+  if (url.includes("#") || /\\/.test(rawPath) || /%(?:2e|2f|5c|25)/i.test(rawPath) || /\/\.\.?(?:\/|$)/.test(rawPath)) {
+    throw new AccessDeniedError();
+  }
+  const parsed = new URL(url);
+  if (ROUTING_KEYS.some((key) => parsed.searchParams.has(key))) throw new AccessDeniedError();
+  if (typeof body === "string") {
+    let parsedBody;
+    try {
+      parsedBody = JSON.parse(body);
+    } catch {
+      throw new AccessDeniedError();
+    }
+    if (parsedBody && typeof parsedBody === "object" && ROUTING_KEYS.some((key) => Object.hasOwn(parsedBody, key))) {
+      throw new AccessDeniedError();
+    }
+  }
+  if (parsed.username || parsed.password) throw new AccessDeniedError();
+  return parsed;
+}
+var GLOBAL_DISPATCHER = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
+function signalOnlyDispatcher() {
+  Reflect.get(globalThis, "Headers");
+  const d = globalThis[GLOBAL_DISPATCHER];
+  if (typeof d?.compose !== "function") return void 0;
+  return d.compose(
+    (dispatch) => (opts, handler) => dispatch({ ...opts, headersTimeout: 0, bodyTimeout: 0 }, handler)
+  );
+}
+var RouterTransport = class {
+  baseUrl;
+  access;
+  #token;
+  #send;
+  #principalId;
+  #tokenPattern;
+  #unauthorizedError;
+  #deniedToken;
+  #deniedError;
+  constructor(options) {
+    this.baseUrl = validateRouterUrl(options.routerUrl);
+    const url = new URL(this.baseUrl);
+    if (url.search || url.hash) throw new AccessDeniedError();
+    this.access = Object.freeze({
+      writeBank: options.access.writeBank,
+      additionalReadBanks: Object.freeze([...options.access.additionalReadBanks])
+    });
+    visibleBanks(this.access);
+    this.#principalId = options.principalId;
+    this.#tokenPattern = options.tokenPattern ?? TOKEN_FORMAT_PATTERN;
+    this.#unauthorizedError = options.unauthorizedError ?? (() => new AccessDeniedError());
+    this.#token = options.token;
+    this.#send = options.fetch ?? ((input, init) => fetch(input, init));
+    this.credential();
+  }
+  hasCredentials() {
+    try {
+      this.credential();
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  assertAuthorized() {
+    this.credential();
+  }
+  authorizationIdentity() {
+    this.credential();
+    const principal = typeof this.#principalId === "function" ? this.#principalId() : this.#principalId;
+    if (!principal) throw new AccessDeniedError();
+    return createHash("sha256").update(principal).digest("hex");
+  }
+  credential() {
+    const token = this.#token();
+    if (!token || !this.#tokenPattern.test(token)) throw new AccessDeniedError();
+    if (this.#deniedToken === token) throw this.#deniedError ?? new AccessDeniedError();
+    if (this.#deniedToken !== void 0) {
+      this.#deniedToken = void 0;
+      this.#deniedError = void 0;
+    }
+    return token;
+  }
+  bankUrl(bank, suffix = "") {
+    requireBank(this.access, bank, "read");
+    return `${this.baseUrl}/v1/default/banks/${encodeURIComponent(bank)}${suffix}`;
+  }
+  async request(url, init = {}) {
+    const token = this.credential();
+    const method = init.method ?? "GET";
+    assertSafeRequest(url, init.body);
+    const listing = assertAuthorizedUrl(url, method, this.baseUrl, this.access);
+    const response = await this.send(url, init, token);
+    if (response.status === 401 || response.status === 403) {
+      const error = response.status === 401 ? this.#unauthorizedError() : new AccessDeniedError();
+      this.#deniedToken = token;
+      this.#deniedError = error;
+      response.body?.cancel().catch(() => void 0);
+      throw error;
+    }
+    if (!response.ok && (response.status !== 404 || method !== "GET")) {
+      response.body?.cancel().catch(() => void 0);
+      throw new RouterRequestError(
+        response.status,
+        response.status === 429 ? boundedRetryAfterMs(response.headers.get("retry-after")) : 0
+      );
+    }
+    if (listing && response.ok) {
+      return filterVisibleBanks(response, this.access);
+    }
+    if (response.status === 404) {
+      response.body?.cancel().catch(() => void 0);
+      return new Response(null, { status: 404 });
+    }
+    return response;
+  }
+  async send(url, init, token) {
+    try {
+      init.signal?.throwIfAborted();
+      const signal = init.signal ?? AbortSignal.timeout(15e3);
+      const dispatcher = signalOnlyDispatcher();
+      return await this.#send(url, {
+        ...init,
+        ...dispatcher ? { dispatcher } : {},
+        redirect: "error",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept-Encoding": "identity",
+          Authorization: `Bearer ${token}`,
+          ...this.#principalId ? {
+            "x-memory-router-agent": typeof this.#principalId === "string" ? this.#principalId : this.#principalId()
+          } : {}
+        },
+        signal
+      });
+    } catch (error) {
+      init.signal?.throwIfAborted();
+      process.stderr.write(`memory request failed: ${error instanceof Error ? error.name : typeof error}
+`);
+      throw new RouterRequestError(503);
+    }
+  }
+};
+
+// ../../coding-agents/human-session.ts
+import { createHash as createHash2 } from "crypto";
+import { createRequire } from "module";
+var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
+var HumanLoginRequiredError = class extends AccessDeniedError {
+  constructor() {
+    super();
+    this.message = "human session unavailable; unlock OS secure storage and run hindsight-coding-agents login; if native support is missing, reinstall from a verified package";
+    this.name = "HumanLoginRequiredError";
+  }
+};
+function humanRouterUrl(value) {
+  const input = value.trim();
+  if (Array.from(input).some((character) => {
+    const code = character.codePointAt(0);
+    return code !== void 0 && (code <= 31 || code === 127);
+  })) {
+    throw new HumanLoginRequiredError();
+  }
+  const parts = /^https:\/\/([^/?#\\@]+)(\/[^?#]*)?$/i.exec(input);
+  if (!parts) throw new HumanLoginRequiredError();
+  const rawPath = parts[2] ?? "";
+  if (input.includes("\\") || /%|\/\.\.?(?:\/|$)|(?:\/{2}$)/.test(rawPath)) throw new HumanLoginRequiredError();
+  const canonical2 = validateRouterUrl(input);
+  const url = new URL(canonical2);
+  if (url.search || url.hash) throw new HumanLoginRequiredError();
+  return canonical2;
+}
+function secureEntry(routerUrl, credentialRef) {
+  try {
+    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
+      throw new HumanLoginRequiredError();
+    }
+    const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
+    const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
+    return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
+  } catch {
+    throw new HumanLoginRequiredError();
+  }
+}
+function validateHumanSession(value, routerUrl, allowExpired = false) {
+  if (typeof value !== "object" || value === null) throw new HumanLoginRequiredError();
+  const session = value;
+  const now = Math.floor(Date.now() / 1e3);
+  if (typeof session.token !== "string" || !HUMAN_TOKEN_PATTERN.test(session.token) || typeof session.principal_id !== "string" || !PRINCIPAL_ID_PATTERN.test(session.principal_id) || typeof session.expires_at !== "number" || !Number.isSafeInteger(session.expires_at) || !allowExpired && session.expires_at <= now || session.expires_at > now + 3660 || session.routerUrl !== humanRouterUrl(routerUrl))
+    throw new HumanLoginRequiredError();
+  return {
+    token: session.token,
+    principal_id: session.principal_id,
+    expires_at: session.expires_at,
+    routerUrl: session.routerUrl
+  };
+}
+function readHumanSession(routerUrl, credentialRef) {
+  try {
+    const password = secureEntry(routerUrl, credentialRef).getPassword();
+    if (!password || password.length > 4096) throw new HumanLoginRequiredError();
+    return validateHumanSession(JSON.parse(password), routerUrl);
+  } catch {
+    throw new HumanLoginRequiredError();
+  }
+}
+
+// ../../coding-agents/runtime.ts
+function transportForConfig(harness, { config, principal }) {
+  if (principal.human) {
+    const routerUrl = humanRouterUrl(config.routerUrl);
+    const reference = principal.human.credentialRef;
+    let session = readHumanSession(routerUrl, reference);
+    return new RouterTransport({
+      routerUrl,
+      access: principal,
+      principalId: () => session.principal_id,
+      tokenPattern: HUMAN_TOKEN_PATTERN,
+      unauthorizedError: () => new HumanLoginRequiredError(),
+      token: () => {
+        session = readHumanSession(routerUrl, reference);
+        return session.token;
+      }
+    });
+  }
+  const tokenEnv = principal.tokenEnv;
+  if (!tokenEnv) throw new AccessDeniedError();
+  return new RouterTransport({
+    routerUrl: config.routerUrl,
+    access: principal,
+    principalId: harness,
+    token: () => process.env[tokenEnv]
+  });
+}
+function managedSettings(harness) {
+  if (!harness) throw new AccessDeniedError();
+  const snapshot = loadManagedConfig(process.env, harness);
+  const transport = transportForConfig(harness, snapshot);
+  const { config } = snapshot;
+  const readOnlySettings = transport.access.writeBank ? {} : {
+    retainSessions: false,
+    autoSeed: false,
+    codebaseSurvey: false,
+    gitIngest: "none"
+  };
+  return {
+    harness,
+    routerHarness: harness,
+    toolPrefix: config.toolPrefix,
+    apiUrl: transport.baseUrl,
+    apiToken: void 0,
+    serverMode: "self-hosted",
+    dynamicBankId: false,
+    autoUpdate: false,
+    optInOnly: true,
+    manageBankConfig: false,
+    ...readOnlySettings
+  };
+}
+function managedBank(harness, directory) {
+  return bankForPrincipal(loadManagedConfig(process.env, harness).principal, directory);
+}
+function bankForPrincipal(principal, directory) {
+  if (!directory) throw new AccessDeniedError();
+  let location;
+  try {
+    location = realpathSync(directory);
+  } catch {
+    throw new AccessDeniedError();
+  }
+  const match = Object.entries(principal.mapPathToBank ?? {}).flatMap(([path, bank]) => {
+    if (!isAbsolute2(path)) return [];
+    try {
+      return [[realpathSync(resolve(path)), bank]];
+    } catch {
+      return [];
+    }
+  }).filter(([path]) => isWithinDirectory(location, path)).sort(([a], [b]) => b.length - a.length)[0];
+  if (!match) throw new AccessDeniedError();
+  requireBank(principal, match[1], "read");
+  return match[1];
+}
+function isWithinDirectory(location, directory) {
+  return location === directory || location.startsWith(directory.endsWith(sep) ? directory : directory + sep);
+}
+
+// src/core/config.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join7 } from "path";
+
+// src/core/seed.ts
+import { spawn as realSpawn } from "child_process";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var DEFAULT_SEED_LIMIT = 300;
+
+// src/core/bank.ts
+import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { basename, dirname as dirname4, join as join5, normalize, sep as sep2 } from "path";
+
+// src/core/diag.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+
+// src/core/log.ts
+import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
+import { homedir } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+function logsDir() {
+  return join2(homedir(), ".hindsight", "coding-agents-logs");
+}
+var LOG_MAX_BYTES = 10 * 1024 * 1024;
+function appendLogLine(file, text) {
+  mkdirSync(dirname2(file), { recursive: true, mode: 448 });
+  try {
+    if (statSync(file).size >= LOG_MAX_BYTES) renameSync(file, `${file}.1`);
+  } catch {
+  }
+  appendFileSync(file, text, { mode: 384 });
+}
+var WEIGHT = { debug: 10, info: 20, warn: 30, error: 40 };
+var current = ["debug", "info", "warn", "error"].find(
+  (l) => l === process.env.HINDSIGHT_LOG_LEVEL
+) ?? "info";
+function logFilePath() {
+  return process.env.HINDSIGHT_LOG_FILE || join2(logsDir(), "plugin.log");
+}
+var NUMERIC_FIELDS = /* @__PURE__ */ new Set([
+  "ms",
+  "chars",
+  "count",
+  "turns",
+  "timeoutMs",
+  "pages",
+  "newChats",
+  "failures",
+  "hostCatalog",
+  "hindsight",
+  "commits",
+  "limit"
+]);
+var BOOLEAN_FIELDS = /* @__PURE__ */ new Set(["cold", "wired", "hasSession", "appendSupported", "retry", "settled"]);
+var ERROR_CLASSES = ["timeout", "aborted", "connection_refused", "dns_failure", "operation_failed"];
+function errorClass(value) {
+  const seen = /* @__PURE__ */ new Set();
+  let error = value;
+  while (error && typeof error === "object" && !seen.has(error) && seen.size < 8) {
+    seen.add(error);
+    const detail = error;
+    if (detail.timedOut === true || detail.name === "TimeoutError" || detail.code === "ETIMEDOUT") return "timeout";
+    if (detail.name === "AbortError") return "aborted";
+    if (detail.code === "ECONNREFUSED") return "connection_refused";
+    if (detail.code === "ENOTFOUND" || detail.code === "EAI_AGAIN") return "dns_failure";
+    error = detail.cause;
+  }
+  return "operation_failed";
+}
+function logMetadata(extra = {}) {
+  const safe = {};
+  for (const [key, value] of Object.entries(extra)) {
+    if (NUMERIC_FIELDS.has(key) && typeof value === "number" && Number.isFinite(value)) safe[key] = value;
+    else if (key === "status" && typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599) safe[key] = value;
+    else if (BOOLEAN_FIELDS.has(key) && typeof value === "boolean") safe[key] = value;
+    else if (key === "mode" && (value === "append" || value === "replace" || value === "skip")) safe[key] = value;
+    else if (key === "error") safe.errorClass = errorClass(value);
+    else if (key === "errorClass" && ERROR_CLASSES.some((known) => known === value)) safe.errorClass = String(value);
+  }
+  return safe;
+}
+function write(level, scope, msg, extra) {
+  if (WEIGHT[level] < WEIGHT[current]) return;
+  try {
+    const metadata = logMetadata(extra);
+    appendLogLine(
+      logFilePath(),
+      `${(/* @__PURE__ */ new Date()).toISOString()} ${level.toUpperCase().padEnd(5)} [${scope}] ${msg}` + (Object.keys(metadata).length ? ` ${JSON.stringify(metadata)}` : "") + "\n"
+    );
+  } catch {
+  }
+}
+var log = {
+  debug: (scope, msg, extra) => write("debug", scope, msg, extra),
+  info: (scope, msg, extra) => write("info", scope, msg, extra),
+  warn: (scope, msg, extra) => write("warn", scope, msg, extra),
+  error: (scope, msg, extra) => write("error", scope, msg, extra)
+};
+
+// src/core/diag.ts
+function diagFilePath() {
+  return process.env.HINDSIGHT_DIAG_FILE || join3(logsDir(), "diag.jsonl");
+}
+function diag(harness, event, extra = {}) {
+  try {
+    const metadata = logMetadata(extra);
+    log.debug(harness, `diag:${event}`, metadata);
+    appendLogLine(
+      diagFilePath(),
+      JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), harness, event, ...metadata }) + "\n"
+    );
+  } catch {
+  }
+}
+
+// src/core/git-layout.ts
+import { lstatSync, readFileSync as readFileSync3, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join4, resolve as resolve2 } from "path";
+var TRANSIENT = /* @__PURE__ */ new Set(["EAGAIN", "EMFILE", "ENFILE", "EBUSY", "EINTR", "EIO", "ETIMEDOUT"]);
+var ATTEMPTS = 3;
+var BACKOFF_MS = 20;
+function errorCode(error) {
+  return error?.code ?? "";
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+var TransientProbeError = class extends Error {
+};
+function entryKind(path) {
+  try {
+    const st = lstatSync(path);
+    return st.isDirectory() ? "dir" : "file";
+  } catch (error) {
+    if (TRANSIENT.has(errorCode(error))) throw new TransientProbeError(errorCode(error));
+    return "none";
+  }
+}
+function readTextOrNull(path) {
+  try {
+    return readFileSync3(path, "utf8");
+  } catch (error) {
+    if (TRANSIENT.has(errorCode(error))) throw new TransientProbeError(errorCode(error));
+    return null;
+  }
+}
+function gitDirFromPointer(text, holder) {
+  const match = /^\s*gitdir:\s*(.+?)\s*$/m.exec(text);
+  if (!match) return null;
+  const target = match[1];
+  return isAbsolute3(target) ? target : resolve2(holder, target);
+}
+function commonDirOf(gitDir) {
+  const pointer = entryKind(join4(gitDir, "commondir")) === "file" ? readTextOrNull(join4(gitDir, "commondir"))?.trim() : null;
+  if (!pointer) return gitDir;
+  return isAbsolute3(pointer) ? pointer : resolve2(gitDir, pointer);
+}
+function isBare(commonDir) {
+  const config = readTextOrNull(join4(commonDir, "config"));
+  return config !== null && /^\s*bare\s*=\s*true\s*$/im.test(config);
+}
+function looksLikeBareRepository(directory) {
+  return entryKind(join4(directory, "HEAD")) === "file" && entryKind(join4(directory, "objects")) === "dir" && entryKind(join4(directory, "refs")) === "dir";
+}
+function canonical(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return path;
+  }
+}
+function resolved(commonDir) {
+  if (entryKind(commonDir) !== "dir") return null;
+  const canonicalDir = canonical(commonDir);
+  return { status: "resolved", commonDir: canonicalDir, bare: isBare(canonicalDir) };
+}
+function probeOnce(directory) {
+  let current2 = resolve2(directory);
+  for (; ; ) {
+    const dotGit = join4(current2, ".git");
+    const kind = entryKind(dotGit);
+    if (kind === "dir") {
+      const layout = resolved(commonDirOf(dotGit));
+      if (layout) return layout;
+    } else if (kind === "file") {
+      const text = readTextOrNull(dotGit);
+      const gitDir = text ? gitDirFromPointer(text, current2) : null;
+      const layout = gitDir ? resolved(commonDirOf(gitDir)) : null;
+      if (layout) return layout;
+    }
+    if (looksLikeBareRepository(current2)) {
+      const layout = resolved(current2);
+      if (layout) return layout;
+    }
+    const parent = dirname3(current2);
+    if (parent === current2) return { status: "absent" };
+    current2 = parent;
+  }
+}
+function probeGitLayout(directory) {
+  if (!directory) return { status: "absent" };
+  let last = "";
+  for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
+    if (attempt) sleepSync(BACKOFF_MS * attempt);
+    try {
+      return probeOnce(directory);
+    } catch (error) {
+      last = error instanceof TransientProbeError ? error.message : errorCode(error) || "unknown";
+    }
+  }
+  return { status: "failed", reason: last };
+}
+
+// src/core/bank.ts
+var BankResolutionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BankResolutionError";
+  }
+};
+function resolveProjectRoot(directory) {
+  if (!directory) return { status: "absent" };
+  const layout = probeGitLayout(directory);
+  if (layout.status !== "resolved") return layout;
+  const commonDir = layout.commonDir;
+  if (basename(commonDir) === ".git") return { status: "resolved", root: dirname4(commonDir) };
+  if (basename(commonDir).startsWith(".") && layout.bare) {
+    return { status: "resolved", root: dirname4(commonDir) };
+  }
+  return { status: "resolved", root: commonDir };
+}
+var PROJECT_ROOT_ENV = ["CLAUDE_PROJECT_DIR"];
+function nearestExistingDir(directory) {
+  let current2 = directory;
+  while (current2) {
+    if (existsSync(current2)) return current2;
+    const parent = dirname4(current2);
+    if (parent === current2) return "";
+    current2 = parent;
+  }
+  return "";
+}
+function mainWorktreeRoot(directory, sessionRoot = "") {
+  const candidates = [
+    nearestExistingDir(directory),
+    sessionRoot,
+    ...PROJECT_ROOT_ENV.map((v) => process.env[v] || "")
+  ];
+  let failure = null;
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    const projectRoot = resolveProjectRoot(candidate);
+    if (projectRoot.status === "resolved") return projectRoot;
+    if (projectRoot.status === "failed") failure = projectRoot;
+  }
+  return failure ?? { status: "absent" };
+}
+function configuredDir(dir) {
+  const expanded = dir === "~" || dir.startsWith("~/") ? join5(homedir2(), dir.slice(1)) : dir;
+  return normalize(expanded).replace(new RegExp(`\\${sep2}+$`), "");
+}
+function isWithin(directory, configured) {
+  return directory === configured || directory.startsWith(configured + sep2);
+}
+function isOptedIn(config, directory) {
+  try {
+    managedBank(config.routerHarness, directory);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function mapLookup(map, directory) {
+  const cwd = normalize(directory);
+  let best;
+  for (const [dir, value] of Object.entries(map)) {
+    const p = configuredDir(dir);
+    if (isWithin(cwd, p)) {
+      if (!best || p.length > best.len) best = { len: p.length, value };
+    }
+  }
+  return best?.value;
+}
+function lookupDirectories(config, directory, sessionRoot = "") {
+  const directories = [normalize(directory)];
+  if (config.resolveWorktrees ?? true) {
+    const projectRoot = mainWorktreeRoot(directory, sessionRoot);
+    const normalizedRoot = projectRoot.status === "resolved" ? normalize(projectRoot.root) : "";
+    if (normalizedRoot && normalizedRoot !== directories[0]) directories.push(normalizedRoot);
+  }
+  return directories;
+}
+function pathSection(config, paths, directory) {
+  if (!directory || !paths) return void 0;
+  return lookupDirectories(config, directory).map((candidate) => mapLookup(paths, candidate)).find((section) => section !== void 0);
+}
+function deriveBankId(config, directory, harness = "coding", sessionRoot) {
+  return managedBank(harness, directory);
+}
+function deriveBankIdOrSkip(config, directory, harness = "coding", sessionRoot) {
+  try {
+    return deriveBankId(config, directory, harness, sessionRoot);
+  } catch (error) {
+    if (!(error instanceof BankResolutionError)) throw error;
+    log.warn(harness, "bank unresolved: skipping (repository could not be identified)", {
+      directory,
+      error
+    });
+    diag(harness, "bank_unresolved", { directory, error });
+    return null;
+  }
+}
+
+// src/core/missions.ts
+import { createHash as createHash3 } from "crypto";
+var RETAIN_EXTRACTION_MODES = ["concise", "verbose", "verbatim", "chunks"];
+var DEFAULT_RETAIN_EXTRACTION_MODE = "concise";
+var PAGE_TAXONOMY = [
+  {
+    name: "Component map",
+    source_query: "From this project's commit history and past discussions, what are the main components/modules/subsystems, what is each responsible for, and how do they relate to or depend on one another? Describe the structure and responsibilities.",
+    tags: ["knowledge:component"]
+  },
+  {
+    name: "Core concepts",
+    source_query: "What are the core concepts, domain abstractions, and key entities in this project \u2014 the vocabulary a developer must understand? For each, explain what it represents and its role, drawn from how they are introduced and discussed across the history and conversations.",
+    tags: ["knowledge:concept"]
+  },
+  {
+    name: "Conventions and patterns",
+    source_query: "What conventions, idioms, and recurring patterns does this project follow \u2014 its approach to testing, error handling, naming, structure, and how changes are typically made? Describe how THIS project does things, as evidenced across its history and discussions.",
+    tags: ["knowledge:convention"]
+  },
+  {
+    name: "Key decisions and rationale",
+    source_query: "What are the significant technical decisions made in this project and the rationale behind them \u2014 the durable 'why we do it this way' a developer should know? Summarize the decisions and their reasoning from the commit rationales and past conversations.",
+    tags: ["knowledge:decision"]
+  },
+  {
+    name: "Initiatives and enhancements",
+    source_query: "Based on this repository's commit history, what are the major initiatives, features, and enhancements the project has worked on? Summarize the themes and notable changes over time. When a source memory's context carries a `[[page:<id>]]` link, repeat that link in the summary of what it describes, so each initiative links to its detailed page.",
+    tags: ["knowledge:feature-work"]
+  }
+];
+var PAGE_NAMES = PAGE_TAXONOMY.map((page) => page.name);
+var DEFAULT_PAGE_TRIGGER_CRON = "H * * * *";
+var CRON_FIELD_RANGES = [
+  [0, 59],
+  // minute
+  [0, 23],
+  // hour
+  [1, 31],
+  // day of month
+  [1, 12],
+  // month
+  [0, 6]
+  // day of week
+];
+var HASHED_FIELD = /^H(?:\((\d+)-(\d+)\))?$/;
+function isHashedCron(cron) {
+  return /(^|\s)H/.test(cron);
+}
+function parseHashedCron(cron) {
+  const fields = cron.trim().split(/\s+/);
+  if (fields.length !== CRON_FIELD_RANGES.length) return void 0;
+  for (const [i, field] of fields.entries()) {
+    if (!field.startsWith("H")) continue;
+    const m = HASHED_FIELD.exec(field);
+    if (!m) return void 0;
+    if (m[1] === void 0) continue;
+    const [lo, hi] = [Number(m[1]), Number(m[2])];
+    const [min, max] = CRON_FIELD_RANGES[i];
+    if (lo > hi || lo < min || hi > max) return void 0;
+  }
+  return fields;
+}
+var PLUGIN_GOVERNED_BANK_FIELDS = [
+  "retain_strategies",
+  "entity_labels",
+  "retain_extraction_mode"
+];
+
+// package.json
+var version = "0.8.7";
+
+// src/core/util.ts
+import { accessSync, constants } from "fs";
+import { delimiter, join as join6 } from "path";
+
+// src/core/hindsight.ts
+var USER_AGENT = `hindsight-coding-agents/${version}`;
+var DEFAULT_OBSERVATION_SCOPES = "shared";
+var DEFAULT_PAGE_SEARCH_LIMIT = 10;
+var RETRY_AFTER_FLOOR_MS = 10 * 1e3;
+var RETRY_AFTER_CEILING_MS = 60 * 1e3;
+
+// src/core/config.ts
+var CONFIG_PATH = process.env.HINDSIGHT_CONFIG || join7(homedir3(), ".hindsight", "coding-agent.json");
+var DEFAULT_DAEMON_PORT = 9077;
+var DEFAULT_DAEMON_PROFILE = "coding-agent";
+function resolvePageTrigger(raw) {
+  if (raw.pageTriggerType === "manual") return { type: "manual" };
+  if (raw.pageTriggerType === "auto-refresh") return { type: "auto-refresh" };
+  if (raw.pageTriggerType !== void 0 && raw.pageTriggerType !== "cron")
+    log.warn(
+      "config",
+      "ignoring invalid pageTriggerType \u2014 expected cron|auto-refresh|manual"
+    );
+  const cron = raw.pageTriggerCron?.trim();
+  if (!cron) return { type: "cron", cron: DEFAULT_PAGE_TRIGGER_CRON };
+  if (!isHashedCron(cron) || parseHashedCron(cron)) return { type: "cron", cron };
+  log.warn(
+    "config",
+    `pageTriggerCron has a malformed hashed field \u2014 write \`H\` or \`H(<lo>-<hi>)\` within the field's own range, e.g. "H H(0-5) * * *" \u2014 falling back to ${JSON.stringify(DEFAULT_PAGE_TRIGGER_CRON)}`
+  );
+  return { type: "cron", cron: DEFAULT_PAGE_TRIGGER_CRON };
+}
+function resolvePages(raw) {
+  const value = raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [name, entry] of Object.entries(value)) {
+    if (!PAGE_NAMES.some((known) => known.toLowerCase() === name.trim().toLowerCase())) {
+      log.warn(
+        "config",
+        `ignoring unknown pages entry \u2014 no seeded page has that name; expected one of: ${PAGE_NAMES.join(", ")}`
+      );
+      continue;
+    }
+    if (entry === false) {
+      out[name] = false;
+      continue;
+    }
+    const query = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.source_query : void 0;
+    if (typeof query === "string" && query.trim()) {
+      out[name] = { source_query: query };
+      continue;
+    }
+    log.warn(
+      "config",
+      'ignoring invalid pages entry \u2014 expected false, or {"source_query": "<your question>"}'
+    );
+  }
+  return out;
+}
+function resolveCustomPages(raw) {
+  const value = raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [rawName, entry] of Object.entries(value)) {
+    const name = rawName.trim();
+    if (!name) continue;
+    if (PAGE_NAMES.some((known) => known.toLowerCase() === name.toLowerCase())) {
+      log.warn(
+        "config",
+        "ignoring customPages entry with a seeded page name; reword it under `pages` instead"
+      );
+      continue;
+    }
+    const query = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.source_query : void 0;
+    if (typeof query !== "string" || !query.trim()) {
+      log.warn(
+        "config",
+        'ignoring invalid customPages entry \u2014 expected {"source_query": "<your question>"}'
+      );
+      continue;
+    }
+    const rawTags = entry.tags;
+    const tags = Array.isArray(rawTags) ? rawTags.filter((t) => typeof t === "string" && t.trim() !== "") : [];
+    out[name] = tags.length ? { source_query: query, tags } : { source_query: query };
+  }
+  return out;
+}
+var DEFAULT_REFLECT_TIMEOUT_MS = 2e4;
+var DEFAULT_REFLECT_TOOL_TIMEOUT_MS = 33e4;
+var DEFAULT_INJECT_TIMEOUT_MS = 7e3;
+var REFLECT_BUDGETS = ["low", "mid", "high"];
+function resolveReflectBudget(raw) {
+  const value = raw.reflectBudget;
+  if (value === void 0) return "high";
+  if (typeof value === "string" && REFLECT_BUDGETS.includes(value))
+    return value;
+  log.warn("config", "ignoring invalid reflectBudget \u2014 expected low|mid|high");
+  return "high";
+}
+var OBSERVATION_SCOPE_MODES = [
+  "shared",
+  "combined",
+  "per_tag",
+  "all_combinations",
+  "per_source"
+];
+function resolveObservationScopes(raw) {
+  const value = raw;
+  if (typeof value === "string")
+    return OBSERVATION_SCOPE_MODES.includes(value) ? value : DEFAULT_OBSERVATION_SCOPES;
+  if (Array.isArray(value)) {
+    const scopes = value.filter((scope) => Array.isArray(scope)).map((scope) => scope.filter((t) => typeof t === "string" && t.trim() !== ""));
+    if (scopes.length) return scopes;
+  }
+  return DEFAULT_OBSERVATION_SCOPES;
+}
+function resolveDefaultBankConfig(raw) {
+  const value = raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [key, v] of Object.entries(value)) {
+    if (PLUGIN_GOVERNED_BANK_FIELDS.includes(key)) {
+      log.warn(
+        "config",
+        `ignoring defaultBankConfig.${key} \u2014 the plugin manages this field itself` + (key === "retain_extraction_mode" ? " (set retainExtractionMode instead)" : "")
+      );
+      continue;
+    }
+    out[key] = v;
+  }
+  return out;
+}
+var AUTO_INJECT_MODES = ["reflect", "pages", "recall", "none"];
+function resolveAutoInject(raw) {
+  if (raw.autoReflect !== void 0) {
+    const replacement = raw.autoReflect === false ? "none" : "reflect";
+    log.warn("config", `autoReflect is deprecated \u2014 use autoInject: "${replacement}" instead`);
+  }
+  if (AUTO_INJECT_MODES.includes(raw.autoInject)) return raw.autoInject;
+  return raw.autoReflect === false ? "none" : "reflect";
+}
+function resolveConfig(raw = {}) {
+  const serverMode = ["cloud", "self-hosted", "daemon"].includes(raw.serverMode) ? raw.serverMode : "self-hosted";
+  const apiPort = raw.apiPort || DEFAULT_DAEMON_PORT;
+  const pageTrigger = resolvePageTrigger(raw);
+  return {
+    serverMode,
+    // Only loadConfig can supply the operator-managed router endpoint.
+    apiUrl: raw.apiUrl ?? "",
+    apiToken: raw.apiToken || void 0,
+    apiPort,
+    daemonIdleTimeout: raw.daemonIdleTimeout,
+    daemonProfile: raw.daemonProfile || DEFAULT_DAEMON_PROFILE,
+    embedVersion: raw.embedVersion || void 0,
+    embedPackagePath: raw.embedPackagePath || void 0,
+    bankId: raw.bankId,
+    dynamicBankId: raw.dynamicBankId,
+    bankIdTemplate: raw.bankIdTemplate,
+    mapPathToBank: raw.mapPathToBank,
+    resolveWorktrees: raw.resolveWorktrees,
+    optInOnly: raw.optInOnly ?? false,
+    // Same shape as retainTags: a config typo must not become a path that silently approves nothing.
+    optInPaths: Array.isArray(raw.optInPaths) ? raw.optInPaths.filter((p) => typeof p === "string" && p.trim() !== "") : [],
+    harness: raw.harness ?? "opencode",
+    disabled: raw.disabled ?? false,
+    retainSessions: raw.retainSessions ?? true,
+    // write sessions back by default, every harness
+    manageBankConfig: raw.manageBankConfig ?? true,
+    retainExtractionMode: RETAIN_EXTRACTION_MODES.includes(raw.retainExtractionMode) ? raw.retainExtractionMode : DEFAULT_RETAIN_EXTRACTION_MODE,
+    defaultBankConfig: resolveDefaultBankConfig(raw.defaultBankConfig),
+    maxParallelRetains: raw.maxParallelRetains || 10,
+    reflectTimeoutMs: raw.reflectTimeoutMs || DEFAULT_REFLECT_TIMEOUT_MS,
+    // Inherit an explicitly-raised reflectTimeoutMs (that is what users reaching for a longer
+    // reflect already set), but never let it LOWER the tool below the default — a short window is
+    // set to bound the automatic hook, not to cut off a call the agent is waiting on.
+    reflectToolTimeoutMs: raw.reflectToolTimeoutMs || Math.max(raw.reflectTimeoutMs || 0, DEFAULT_REFLECT_TOOL_TIMEOUT_MS),
+    injectTimeoutMs: raw.injectTimeoutMs || DEFAULT_INJECT_TIMEOUT_MS,
+    reflectBudget: resolveReflectBudget(raw),
+    autoInject: resolveAutoInject(raw),
+    pageSearchLimit: raw.pageSearchLimit || DEFAULT_PAGE_SEARCH_LIMIT,
+    // Same shape as retainMetadata: an object, or nothing. An array would spread into numeric
+    // keys and reach the API as garbage, so it is rejected like any other non-object.
+    recallOptions: raw.recallOptions && typeof raw.recallOptions === "object" && !Array.isArray(raw.recallOptions) ? { ...raw.recallOptions } : {},
+    toolGuideExtra: typeof raw.toolGuideExtra === "string" && raw.toolGuideExtra.trim() ? raw.toolGuideExtra : void 0,
+    // Every turn, not every tenth. The guide is what tells the agent WHEN to reach for memory, and
+    // at a cadence of 10 a normal session is told once, on turn 1, and never again. Measured over
+    // 40 real Claude Code turns, moving this from 10 to 1 took searches from 15% of turns to 32.5%
+    // with no wording change at all. The cost is the guide's ~2KB re-sent per turn, which caches.
+    pageRefreshEveryTurns: raw.pageRefreshEveryTurns || 1,
+    pageTriggerType: pageTrigger.type,
+    pageTriggerCron: pageTrigger.cron,
+    pages: resolvePages(raw.pages),
+    customPages: resolveCustomPages(raw.customPages),
+    autoSeed: raw.autoSeed ?? true,
+    seedLimit: raw.seedLimit || DEFAULT_SEED_LIMIT,
+    codebaseSurvey: raw.codebaseSurvey ?? true,
+    surveyModel: raw.surveyModel || "haiku",
+    surveyBudgetUsd: raw.surveyBudgetUsd || 2,
+    surveyRefreshCommits: raw.surveyRefreshCommits ?? 20,
+    gitIngest: ["message", "full", "none"].includes(raw.gitIngest) ? raw.gitIngest : "message",
+    // Hostile input is a config typo, not an attack: keep only string entries so a stray number or
+    // nested object cannot reach the API as a tag and fail the whole retain.
+    retainTags: Array.isArray(raw.retainTags) ? raw.retainTags.filter((t) => typeof t === "string" && t.trim() !== "") : [],
+    // Undefined, not "", when unset or blank: the retain call distinguishes "not configured" (use
+    // the built-in default) from a configured value, and an empty context would strip the default.
+    retainContext: typeof raw.retainContext === "string" && raw.retainContext.trim() !== "" ? raw.retainContext : void 0,
+    retainMetadata: raw.retainMetadata && typeof raw.retainMetadata === "object" ? Object.fromEntries(
+      Object.entries(raw.retainMetadata).filter(([, v]) => typeof v === "string")
+    ) : {},
+    observationScopes: resolveObservationScopes(raw.observationScopes),
+    banks: raw.banks && typeof raw.banks === "object" ? raw.banks : {},
+    paths: raw.paths && typeof raw.paths === "object" ? raw.paths : {},
+    logLevel: ["debug", "info", "warn", "error"].includes(raw.logLevel) ? raw.logLevel : "info",
+    autoUpdate: raw.autoUpdate ?? true
+  };
+}
+function readRaw(path) {
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch (e) {
+    if (e?.code !== "ENOENT") {
+      console.error(`hindsight: ignoring invalid config at ${path}: ${e?.message || e}`);
+    }
+    return {};
+  }
+}
+function mergeRaw(a, b) {
+  const { harnesses: _drop, ...flat } = b;
+  return {
+    ...a,
+    ...flat,
+    banks: { ...a.banks ?? {}, ...b.banks ?? {} },
+    paths: { ...a.paths ?? {}, ...b.paths ?? {} }
+  };
+}
+function applyLayer(raw, layer, harness) {
+  let out = mergeRaw(raw, layer);
+  const perHarness = harness ? layer.harnesses?.[harness] : void 0;
+  if (perHarness) out = mergeRaw(out, perHarness);
+  return out;
+}
+var ENV_KEYS = {
+  serverMode: "HINDSIGHT_SERVER_MODE",
+  apiUrl: "HINDSIGHT_API_URL",
+  apiToken: "HINDSIGHT_API_TOKEN",
+  // These four keep the names the old per-agent Claude Code plugin used, so a user migrating from
+  // it can carry their existing environment over unchanged.
+  apiPort: "HINDSIGHT_API_PORT",
+  daemonIdleTimeout: "HINDSIGHT_DAEMON_IDLE_TIMEOUT",
+  embedVersion: "HINDSIGHT_EMBED_VERSION",
+  embedPackagePath: "HINDSIGHT_EMBED_PACKAGE_PATH",
+  daemonProfile: "HINDSIGHT_DAEMON_PROFILE",
+  bankId: "HINDSIGHT_BANK_ID",
+  dynamicBankId: "HINDSIGHT_DYNAMIC_BANK_ID",
+  bankIdTemplate: "HINDSIGHT_BANK_ID_TEMPLATE",
+  resolveWorktrees: "HINDSIGHT_RESOLVE_WORKTREES",
+  optInOnly: "HINDSIGHT_OPT_IN_ONLY",
+  optInPaths: "HINDSIGHT_OPT_IN_PATHS",
+  harness: "HINDSIGHT_HARNESS",
+  disabled: "HINDSIGHT_DISABLED",
+  retainSessions: "HINDSIGHT_RETAIN_SESSIONS",
+  maxParallelRetains: "HINDSIGHT_MAX_PARALLEL_RETAINS",
+  reflectTimeoutMs: "HINDSIGHT_REFLECT_TIMEOUT_MS",
+  reflectToolTimeoutMs: "HINDSIGHT_REFLECT_TOOL_TIMEOUT_MS",
+  injectTimeoutMs: "HINDSIGHT_INJECT_TIMEOUT_MS",
+  reflectBudget: "HINDSIGHT_REFLECT_BUDGET",
+  autoInject: "HINDSIGHT_AUTO_INJECT",
+  pageSearchLimit: "HINDSIGHT_PAGE_SEARCH_LIMIT",
+  toolGuideExtra: "HINDSIGHT_TOOL_GUIDE_EXTRA",
+  autoReflect: "HINDSIGHT_AUTO_REFLECT",
+  pageRefreshEveryTurns: "HINDSIGHT_PAGE_REFRESH_EVERY_TURNS",
+  pageTriggerType: "HINDSIGHT_PAGE_TRIGGER_TYPE",
+  pageTriggerCron: "HINDSIGHT_PAGE_TRIGGER_CRON",
+  autoSeed: "HINDSIGHT_AUTO_SEED",
+  seedLimit: "HINDSIGHT_SEED_LIMIT",
+  codebaseSurvey: "HINDSIGHT_CODEBASE_SURVEY",
+  surveyModel: "HINDSIGHT_SURVEY_MODEL",
+  surveyBudgetUsd: "HINDSIGHT_SURVEY_BUDGET_USD",
+  surveyRefreshCommits: "HINDSIGHT_SURVEY_REFRESH_COMMITS",
+  logLevel: "HINDSIGHT_LOG_LEVEL",
+  autoUpdate: "HINDSIGHT_AUTO_UPDATE",
+  gitIngest: "HINDSIGHT_GIT_INGEST",
+  // Scalar modes only ("shared", "combined", "per_tag", "all_combinations"). An explicit scope
+  // list is a list OF lists, which does not survive flattening into one variable — file-only.
+  observationScopes: "HINDSIGHT_OBSERVATION_SCOPES",
+  // Comma-separated, e.g. HINDSIGHT_RETAIN_TAGS="project:{gitProject},env:work". A LIST rather than
+  // a map, so it flattens cleanly; its sibling retainMetadata stays file-only for the reason above.
+  retainTags: "HINDSIGHT_RETAIN_TAGS",
+  manageBankConfig: "HINDSIGHT_MANAGE_BANK_CONFIG",
+  retainExtractionMode: "HINDSIGHT_RETAIN_EXTRACTION_MODE"
+};
+var ENV_BOOLEANS = /* @__PURE__ */ new Set([
+  "dynamicBankId",
+  "resolveWorktrees",
+  "optInOnly",
+  "disabled",
+  "retainSessions",
+  "autoReflect",
+  "autoSeed",
+  "codebaseSurvey",
+  "autoUpdate",
+  "manageBankConfig"
+]);
+var ENV_LISTS = /* @__PURE__ */ new Set(["retainTags", "optInPaths"]);
+var ENV_NUMBERS = /* @__PURE__ */ new Set([
+  "apiPort",
+  "daemonIdleTimeout",
+  "maxParallelRetains",
+  "reflectTimeoutMs",
+  "reflectToolTimeoutMs",
+  "injectTimeoutMs",
+  "pageSearchLimit",
+  "pageRefreshEveryTurns",
+  "seedLimit",
+  "surveyBudgetUsd",
+  "surveyRefreshCommits"
+]);
+function readEnvConfig(env = process.env) {
+  const out = {};
+  for (const [key, name] of Object.entries(ENV_KEYS)) {
+    const value = env[name];
+    if (value === void 0 || value.trim() === "") continue;
+    if (ENV_BOOLEANS.has(key)) {
+      out[key] = ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+    } else if (ENV_LISTS.has(key)) {
+      const items = value.split(",").map((v) => v.trim()).filter(Boolean);
+      if (items.length) out[key] = items;
+    } else if (ENV_NUMBERS.has(key)) {
+      const n = Number(value);
+      if (Number.isFinite(n)) out[key] = n;
+      else console.error(`hindsight: ignoring ${name}=${value} \u2014 not a number`);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function loadConfig(opts = {}) {
+  const o = typeof opts === "string" ? { path: opts } : opts;
+  const withEnv = applyLayer({}, readEnvConfig(), o.harness);
+  const raw = applyLayer(withEnv, readRaw(o.path ?? CONFIG_PATH), o.harness);
+  if (!raw.harness && o.harness) raw.harness = o.harness;
+  const managed = managedSettings(o.harness);
+  if (raw.apiUrl !== void 0 && raw.apiUrl.replace(/\/+$/, "") !== managed.apiUrl || raw.serverMode !== void 0 && raw.serverMode !== "self-hosted") throw new AccessDeniedError();
+  return { ...resolveConfig(raw), ...managed };
+}
+var BANK_OVERRIDE_EXCLUDED = [
+  "bankId",
+  "bankIdTemplate",
+  "mapPathToBank",
+  "dynamicBankId",
+  "resolveWorktrees",
+  // Approval is decided BEFORE the bank is resolved, so a `banks.<id>` section naming these could
+  // only ever arrive too late to matter — strip them rather than let them read as effective.
+  "optInOnly",
+  "optInPaths",
+  "harness",
+  "routerHarness",
+  "toolPrefix",
+  "apiUrl",
+  "apiToken",
+  "serverMode",
+  "autoUpdate"
+];
+function applyBankConfig(cfg, resolvedId, directory) {
+  if (directory !== void 0 && !isOptedIn(cfg, directory))
+    return { cfg: { ...cfg, ...managedSettings(cfg.routerHarness), disabled: true }, bankId: resolvedId };
+  const byPath = directory === void 0 ? void 0 : pathSection(cfg, cfg.paths, directory);
+  if (byPath) {
+    const { bank: _rename, ...rest } = overrideFields(byPath);
+    cfg = { ...cfg, ...resolvePartial(cfg, rest) };
+  }
+  const section = cfg.banks[resolvedId];
+  if (!section) return { cfg: { ...cfg, ...managedSettings(cfg.routerHarness) }, bankId: resolvedId };
+  const safe = overrideFields(section);
+  const bankId = resolvedId;
+  delete safe.bank;
+  return { cfg: { ...cfg, ...resolvePartial(cfg, safe), ...managedSettings(cfg.routerHarness) }, bankId };
+}
+function overrideFields(section) {
+  const safe = { ...section };
+  for (const k of BANK_OVERRIDE_EXCLUDED) delete safe[k];
+  delete safe.banks;
+  delete safe.paths;
+  return safe;
+}
+function resolvePartial(cfg, patch) {
+  const full = resolveConfig(patch);
+  const out = {};
+  for (const key of Object.keys(patch)) {
+    if (key in full)
+      out[key] = full[key];
+  }
+  if ("autoReflect" in patch && !("autoInject" in patch)) out.autoInject = full.autoInject;
+  if ("serverMode" in patch || "apiUrl" in patch || "apiPort" in patch) {
+    const conn = resolveConfig({
+      serverMode: patch.serverMode ?? cfg.serverMode,
+      apiPort: patch.apiPort ?? cfg.apiPort,
+      apiUrl: patch.apiUrl ?? (cfg.serverMode === "daemon" ? void 0 : cfg.apiUrl)
+    });
+    out.serverMode = conn.serverMode;
+    out.apiUrl = conn.apiUrl;
+    out.apiPort = conn.apiPort;
+  }
+  return out;
+}
+
+// src/core/brand.ts
+function brandWord(prefix = DEFAULT_TOOL_PREFIX) {
+  const start = [0, 116, 217];
+  const end = [0, 146, 150];
+  const word = toolBrand(prefix).displayName;
+  let out = "";
+  for (let i = 0; i < word.length; i++) {
+    const t = i / Math.max(1, word.length - 1);
+    const [r, g, b] = start.map((s, k) => Math.round(s + (end[k] - s) * t));
+    out += `\x1B[38;2;${r};${g};${b}m${word[i]}`;
+  }
+  return `${out}\x1B[0m`;
+}
+
+// src/antigravity-statusline.ts
+function buildAntigravityStatusLine(state, cfg) {
+  const cwd = state.cwd || state.workspace?.current_dir;
+  if (!cwd) return brandWord(cfg.toolPrefix);
+  const bankId = deriveBankIdOrSkip(cfg, cwd, "antigravity-cli");
+  if (bankId === null) return brandWord(cfg.toolPrefix);
+  const resolved2 = applyBankConfig(cfg, bankId, cwd);
+  return resolved2.cfg.disabled ? "" : `${brandWord(cfg.toolPrefix)} \xB7 ${resolved2.bankId}`;
+}
+async function main() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  try {
+    const state = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    const cfg = loadConfig({ harness: "antigravity-cli" });
+    process.stdout.write(buildAntigravityStatusLine(state, cfg));
+  } catch {
+  }
+}
+if (process.argv[1]?.endsWith("antigravity-statusline.js")) void main();
+export {
+  buildAntigravityStatusLine
+};