@mickey-kras/hindsight-memory-router-coding-agents 0.0.0-stage → 0.8.7

package/dist/status.js

@@ -0,0 +1,2516 @@
+#!/usr/bin/env node
+
+// ../../coding-agents/runtime.ts
+import { realpathSync } from "fs";
+import { isAbsolute as isAbsolute2, resolve, sep } from "path";
+
+// ../../shared/patterns.ts
+var PRINCIPAL_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+var TOKEN_FORMAT_PATTERN = /^mr_[A-Za-z0-9._-]{1,64}_[0-9a-f]{64}$/;
+var BANK_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+
+// ../../shared/bank-access.ts
+var AccessDeniedError = class extends Error {
+  statusCode = 403;
+  constructor() {
+    super("memory access denied");
+    this.name = "AccessDeniedError";
+  }
+};
+function visibleBanks(access) {
+  const banks = [.../* @__PURE__ */ new Set([...access.writeBank ? [access.writeBank] : [], ...access.additionalReadBanks])];
+  if (banks.some((bank) => !BANK_ID_PATTERN.test(bank) || bank === "." || bank === "..")) {
+    throw new AccessDeniedError();
+  }
+  return banks;
+}
+function requireBank(access, bank, operation) {
+  if (!visibleBanks(access).includes(bank) || operation === "write" && access.writeBank !== bank) {
+    throw new AccessDeniedError();
+  }
+}
+function classifyOperation(method, suffix) {
+  if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
+  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
+    suffix
+  ))
+    return "read";
+  if (method === "GET" && suffix === "") return "read";
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
+    suffix
+  ))
+    return "write";
+  throw new AccessDeniedError();
+}
+
+// ../../shared/managed-config.ts
+import { readFileSync } from "fs";
+import { isAbsolute } from "path";
+
+// ../../shared/tool-prefix.ts
+var ToolPrefixError = class extends Error {
+};
+var DEFAULT_TOOL_PREFIX = "hindsight_";
+var PREFIX_PATTERN = /^[a-z][a-z0-9_]*_$/;
+function validatedToolPrefix(value) {
+  if (value === void 0) return DEFAULT_TOOL_PREFIX;
+  if (typeof value !== "string" || value.length > 32 || !PREFIX_PATTERN.test(value)) {
+    throw new ToolPrefixError(
+      "invalid toolPrefix: expected 2-32 lowercase letters, digits or underscores, ending in underscore"
+    );
+  }
+  return value;
+}
+
+// ../../shared/managed-config.ts
+var TOKEN_ENV_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+function validatedPrincipal(configured) {
+  const human = configured.human;
+  if ((human === void 0 ? typeof configured.tokenEnv !== "string" || !TOKEN_ENV_PATTERN.test(configured.tokenEnv) : typeof human !== "object" || human === null || Object.keys(human).length !== 1 || typeof human.credentialRef !== "string" || !/^[A-Za-z0-9._-]{1,64}$/.test(human.credentialRef) || Object.hasOwn(configured, "tokenEnv")) || "token" in configured || "apiToken" in configured) {
+    throw new AccessDeniedError();
+  }
+  if (configured.source !== void 0 && (typeof configured.source !== "string" || configured.source.trim() === "")) {
+    throw new AccessDeniedError();
+  }
+  if (typeof configured.writeBank === "string" && configured.writeBank.trim() === "") {
+    throw new AccessDeniedError();
+  }
+  if (configured.additionalReadBanks !== void 0 && !Array.isArray(configured.additionalReadBanks)) {
+    throw new AccessDeniedError();
+  }
+  const principal = { ...configured, additionalReadBanks: configured.additionalReadBanks ?? [] };
+  visibleBanks(principal);
+  return principal;
+}
+function validatePositiveInteger(value) {
+  if (value !== void 0 && (!Number.isSafeInteger(value) || value <= 0)) throw new AccessDeniedError();
+}
+function validateQueueOptions(config) {
+  for (const value of [
+    config.recallTimeoutMs,
+    config.recallMaxTokens,
+    config.retainQueueFlushIntervalMs,
+    config.queueMaxItems,
+    config.queueMaxBytes
+  ]) {
+    validatePositiveInteger(value);
+  }
+  if (config.queueMaxAgeMs !== void 0 && (!Number.isSafeInteger(config.queueMaxAgeMs) || config.queueMaxAgeMs !== -1 && config.queueMaxAgeMs <= 0)) {
+    throw new AccessDeniedError();
+  }
+  if (config.queueDir !== void 0 && (typeof config.queueDir !== "string" || !isAbsolute(config.queueDir))) {
+    throw new AccessDeniedError();
+  }
+}
+function loadValidatedManagedConfig(env) {
+  const path = env.HINDSIGHT_ROUTER_CONFIG;
+  if (!path || !isAbsolute(path)) throw new AccessDeniedError();
+  const config = JSON.parse(readFileSync(path, "utf8"));
+  const toolPrefix = validatedToolPrefix(config.toolPrefix);
+  validateQueueOptions(config);
+  return { ...config, toolPrefix };
+}
+function loadManagedConfig(env, principalId) {
+  try {
+    if (!principalId) throw new AccessDeniedError();
+    const config = loadValidatedManagedConfig(env);
+    if (!Object.hasOwn(config.principals ?? {}, principalId)) throw new AccessDeniedError();
+    const principal = validatedPrincipal(config.principals[principalId]);
+    validateQueueOptions(config);
+    return { config, principalId, principal };
+  } catch {
+    throw new AccessDeniedError();
+  }
+}
+
+// ../../shared/router-transport.ts
+import { createHash } from "crypto";
+
+// ../../shared/router-url.ts
+var RouterUrlError = class extends Error {
+  constructor(reason) {
+    super(`routerUrl rejected: ${reason}`);
+    this.name = "RouterUrlError";
+  }
+};
+function validateRouterUrl(value) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new RouterUrlError("missing");
+  }
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    throw new RouterUrlError("invalid");
+  }
+  if (url.protocol !== "https:") {
+    throw new RouterUrlError("not-https");
+  }
+  const hostname = url.hostname.replace(/\.$/, "");
+  if (hostname === "hindsight.vectorize.io" || hostname.endsWith(".hindsight.vectorize.io")) {
+    throw new RouterUrlError("upstream");
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new RouterUrlError("userinfo");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+
+// ../../shared/router-transport.ts
+var RouterRequestError = class extends Error {
+  constructor(statusCode, retryAfterMs2 = 0) {
+    super(`memory request failed (${statusCode})`);
+    this.statusCode = statusCode;
+    this.retryAfterMs = retryAfterMs2;
+    this.name = "RouterRequestError";
+  }
+  statusCode;
+  retryAfterMs;
+};
+function boundedRetryAfterMs(header) {
+  if (!header?.trim()) return 0;
+  const value = header.trim();
+  const delay = /^\d+(?:\.\d+)?$/.test(value) ? Number(value) * 1e3 : Date.parse(value) - Date.now();
+  return Number.isFinite(delay) ? Math.min(6e4, Math.max(0, delay)) : 0;
+}
+var ROUTING_KEYS = ["bankId", "bank_id", "bank_ids"];
+function assertAuthorizedUrl(url, method, baseUrl, access) {
+  const listing = url === `${baseUrl}/v1/default/banks` && method === "GET";
+  if (listing || [`${baseUrl}/version`, `${baseUrl}/v1/version`].includes(url) && method === "GET") {
+    return listing;
+  }
+  const prefix = `${baseUrl}/v1/default/banks/`;
+  if (!url.startsWith(prefix)) throw new AccessDeniedError();
+  const path = url.slice(prefix.length).split("?")[0];
+  const split = path.indexOf("/");
+  const bank = decodeURIComponent(split < 0 ? path : path.slice(0, split));
+  const suffix = split < 0 ? "" : path.slice(split);
+  requireBank(access, bank, classifyOperation(method, suffix));
+  return false;
+}
+async function filterVisibleBanks(response, access) {
+  const data = await response.json();
+  if (!Array.isArray(data.banks)) throw new RouterRequestError(502);
+  const allowed = new Set(visibleBanks(access));
+  const banks = data.banks.filter(
+    (bank) => bank !== null && typeof bank === "object" && allowed.has(bank.bank_id ?? "")
+  );
+  return Response.json({ banks, total: banks.length });
+}
+function assertSafeRequest(url, body) {
+  const rawPath = /^[a-z][a-z\d+.-]*:\/\/[^/?#]*([^?#]*)/i.exec(url)?.[1] ?? "";
+  if (url.includes("#") || /\\/.test(rawPath) || /%(?:2e|2f|5c|25)/i.test(rawPath) || /\/\.\.?(?:\/|$)/.test(rawPath)) {
+    throw new AccessDeniedError();
+  }
+  const parsed = new URL(url);
+  if (ROUTING_KEYS.some((key) => parsed.searchParams.has(key))) throw new AccessDeniedError();
+  if (typeof body === "string") {
+    let parsedBody;
+    try {
+      parsedBody = JSON.parse(body);
+    } catch {
+      throw new AccessDeniedError();
+    }
+    if (parsedBody && typeof parsedBody === "object" && ROUTING_KEYS.some((key) => Object.hasOwn(parsedBody, key))) {
+      throw new AccessDeniedError();
+    }
+  }
+  if (parsed.username || parsed.password) throw new AccessDeniedError();
+  return parsed;
+}
+var GLOBAL_DISPATCHER = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
+function signalOnlyDispatcher() {
+  Reflect.get(globalThis, "Headers");
+  const d = globalThis[GLOBAL_DISPATCHER];
+  if (typeof d?.compose !== "function") return void 0;
+  return d.compose(
+    (dispatch) => (opts, handler) => dispatch({ ...opts, headersTimeout: 0, bodyTimeout: 0 }, handler)
+  );
+}
+var RouterTransport = class {
+  baseUrl;
+  access;
+  #token;
+  #send;
+  #principalId;
+  #tokenPattern;
+  #unauthorizedError;
+  #deniedToken;
+  #deniedError;
+  constructor(options) {
+    this.baseUrl = validateRouterUrl(options.routerUrl);
+    const url = new URL(this.baseUrl);
+    if (url.search || url.hash) throw new AccessDeniedError();
+    this.access = Object.freeze({
+      writeBank: options.access.writeBank,
+      additionalReadBanks: Object.freeze([...options.access.additionalReadBanks])
+    });
+    visibleBanks(this.access);
+    this.#principalId = options.principalId;
+    this.#tokenPattern = options.tokenPattern ?? TOKEN_FORMAT_PATTERN;
+    this.#unauthorizedError = options.unauthorizedError ?? (() => new AccessDeniedError());
+    this.#token = options.token;
+    this.#send = options.fetch ?? ((input, init) => fetch(input, init));
+    this.credential();
+  }
+  hasCredentials() {
+    try {
+      this.credential();
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  assertAuthorized() {
+    this.credential();
+  }
+  authorizationIdentity() {
+    this.credential();
+    const principal = typeof this.#principalId === "function" ? this.#principalId() : this.#principalId;
+    if (!principal) throw new AccessDeniedError();
+    return createHash("sha256").update(principal).digest("hex");
+  }
+  credential() {
+    const token = this.#token();
+    if (!token || !this.#tokenPattern.test(token)) throw new AccessDeniedError();
+    if (this.#deniedToken === token) throw this.#deniedError ?? new AccessDeniedError();
+    if (this.#deniedToken !== void 0) {
+      this.#deniedToken = void 0;
+      this.#deniedError = void 0;
+    }
+    return token;
+  }
+  bankUrl(bank, suffix = "") {
+    requireBank(this.access, bank, "read");
+    return `${this.baseUrl}/v1/default/banks/${encodeURIComponent(bank)}${suffix}`;
+  }
+  async request(url, init = {}) {
+    const token = this.credential();
+    const method = init.method ?? "GET";
+    assertSafeRequest(url, init.body);
+    const listing = assertAuthorizedUrl(url, method, this.baseUrl, this.access);
+    const response = await this.send(url, init, token);
+    if (response.status === 401 || response.status === 403) {
+      const error = response.status === 401 ? this.#unauthorizedError() : new AccessDeniedError();
+      this.#deniedToken = token;
+      this.#deniedError = error;
+      response.body?.cancel().catch(() => void 0);
+      throw error;
+    }
+    if (!response.ok && (response.status !== 404 || method !== "GET")) {
+      response.body?.cancel().catch(() => void 0);
+      throw new RouterRequestError(
+        response.status,
+        response.status === 429 ? boundedRetryAfterMs(response.headers.get("retry-after")) : 0
+      );
+    }
+    if (listing && response.ok) {
+      return filterVisibleBanks(response, this.access);
+    }
+    if (response.status === 404) {
+      response.body?.cancel().catch(() => void 0);
+      return new Response(null, { status: 404 });
+    }
+    return response;
+  }
+  async send(url, init, token) {
+    try {
+      init.signal?.throwIfAborted();
+      const signal = init.signal ?? AbortSignal.timeout(15e3);
+      const dispatcher = signalOnlyDispatcher();
+      return await this.#send(url, {
+        ...init,
+        ...dispatcher ? { dispatcher } : {},
+        redirect: "error",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept-Encoding": "identity",
+          Authorization: `Bearer ${token}`,
+          ...this.#principalId ? {
+            "x-memory-router-agent": typeof this.#principalId === "string" ? this.#principalId : this.#principalId()
+          } : {}
+        },
+        signal
+      });
+    } catch (error) {
+      init.signal?.throwIfAborted();
+      process.stderr.write(`memory request failed: ${error instanceof Error ? error.name : typeof error}
+`);
+      throw new RouterRequestError(503);
+    }
+  }
+};
+
+// ../../coding-agents/human-session.ts
+import { createHash as createHash2 } from "crypto";
+import { createRequire } from "module";
+var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
+var HumanLoginRequiredError = class extends AccessDeniedError {
+  constructor() {
+    super();
+    this.message = "human session unavailable; unlock OS secure storage and run hindsight-coding-agents login; if native support is missing, reinstall from a verified package";
+    this.name = "HumanLoginRequiredError";
+  }
+};
+function humanRouterUrl(value) {
+  const input = value.trim();
+  if (Array.from(input).some((character) => {
+    const code = character.codePointAt(0);
+    return code !== void 0 && (code <= 31 || code === 127);
+  })) {
+    throw new HumanLoginRequiredError();
+  }
+  const parts = /^https:\/\/([^/?#\\@]+)(\/[^?#]*)?$/i.exec(input);
+  if (!parts) throw new HumanLoginRequiredError();
+  const rawPath = parts[2] ?? "";
+  if (input.includes("\\") || /%|\/\.\.?(?:\/|$)|(?:\/{2}$)/.test(rawPath)) throw new HumanLoginRequiredError();
+  const canonical2 = validateRouterUrl(input);
+  const url = new URL(canonical2);
+  if (url.search || url.hash) throw new HumanLoginRequiredError();
+  return canonical2;
+}
+function secureEntry(routerUrl, credentialRef) {
+  try {
+    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
+      throw new HumanLoginRequiredError();
+    }
+    const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
+    const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
+    return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
+  } catch {
+    throw new HumanLoginRequiredError();
+  }
+}
+function validateHumanSession(value, routerUrl, allowExpired = false) {
+  if (typeof value !== "object" || value === null) throw new HumanLoginRequiredError();
+  const session = value;
+  const now = Math.floor(Date.now() / 1e3);
+  if (typeof session.token !== "string" || !HUMAN_TOKEN_PATTERN.test(session.token) || typeof session.principal_id !== "string" || !PRINCIPAL_ID_PATTERN.test(session.principal_id) || typeof session.expires_at !== "number" || !Number.isSafeInteger(session.expires_at) || !allowExpired && session.expires_at <= now || session.expires_at > now + 3660 || session.routerUrl !== humanRouterUrl(routerUrl))
+    throw new HumanLoginRequiredError();
+  return {
+    token: session.token,
+    principal_id: session.principal_id,
+    expires_at: session.expires_at,
+    routerUrl: session.routerUrl
+  };
+}
+function readHumanSession(routerUrl, credentialRef) {
+  try {
+    const password = secureEntry(routerUrl, credentialRef).getPassword();
+    if (!password || password.length > 4096) throw new HumanLoginRequiredError();
+    return validateHumanSession(JSON.parse(password), routerUrl);
+  } catch {
+    throw new HumanLoginRequiredError();
+  }
+}
+
+// ../../coding-agents/runtime.ts
+function harnessTransport(harness) {
+  return transportForConfig(harness, loadManagedConfig(process.env, harness));
+}
+function transportForConfig(harness, { config, principal }) {
+  if (principal.human) {
+    const routerUrl = humanRouterUrl(config.routerUrl);
+    const reference = principal.human.credentialRef;
+    let session = readHumanSession(routerUrl, reference);
+    return new RouterTransport({
+      routerUrl,
+      access: principal,
+      principalId: () => session.principal_id,
+      tokenPattern: HUMAN_TOKEN_PATTERN,
+      unauthorizedError: () => new HumanLoginRequiredError(),
+      token: () => {
+        session = readHumanSession(routerUrl, reference);
+        return session.token;
+      }
+    });
+  }
+  const tokenEnv = principal.tokenEnv;
+  if (!tokenEnv) throw new AccessDeniedError();
+  return new RouterTransport({
+    routerUrl: config.routerUrl,
+    access: principal,
+    principalId: harness,
+    token: () => process.env[tokenEnv]
+  });
+}
+function managedSettings(harness) {
+  if (!harness) throw new AccessDeniedError();
+  const snapshot = loadManagedConfig(process.env, harness);
+  const transport = transportForConfig(harness, snapshot);
+  const { config } = snapshot;
+  const readOnlySettings = transport.access.writeBank ? {} : {
+    retainSessions: false,
+    autoSeed: false,
+    codebaseSurvey: false,
+    gitIngest: "none"
+  };
+  return {
+    harness,
+    routerHarness: harness,
+    toolPrefix: config.toolPrefix,
+    apiUrl: transport.baseUrl,
+    apiToken: void 0,
+    serverMode: "self-hosted",
+    dynamicBankId: false,
+    autoUpdate: false,
+    optInOnly: true,
+    manageBankConfig: false,
+    ...readOnlySettings
+  };
+}
+function managedBank(harness, directory) {
+  return bankForPrincipal(loadManagedConfig(process.env, harness).principal, directory);
+}
+function bankForPrincipal(principal, directory) {
+  if (!directory) throw new AccessDeniedError();
+  let location;
+  try {
+    location = realpathSync(directory);
+  } catch {
+    throw new AccessDeniedError();
+  }
+  const match = Object.entries(principal.mapPathToBank ?? {}).flatMap(([path, bank]) => {
+    if (!isAbsolute2(path)) return [];
+    try {
+      return [[realpathSync(resolve(path)), bank]];
+    } catch {
+      return [];
+    }
+  }).filter(([path]) => isWithinDirectory(location, path)).sort(([a], [b]) => b.length - a.length)[0];
+  if (!match) throw new AccessDeniedError();
+  requireBank(principal, match[1], "read");
+  return match[1];
+}
+function isWithinDirectory(location, directory) {
+  return location === directory || location.startsWith(directory.endsWith(sep) ? directory : directory + sep);
+}
+
+// src/core/bank.ts
+import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { basename, dirname as dirname3, join as join4, normalize, sep as sep2 } from "path";
+
+// src/core/diag.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+
+// src/core/log.ts
+import { appendFileSync, mkdirSync, renameSync, statSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function logsDir() {
+  return join(homedir(), ".hindsight", "coding-agents-logs");
+}
+var LOG_MAX_BYTES = 10 * 1024 * 1024;
+function appendLogLine(file, text) {
+  mkdirSync(dirname(file), { recursive: true, mode: 448 });
+  try {
+    if (statSync(file).size >= LOG_MAX_BYTES) renameSync(file, `${file}.1`);
+  } catch {
+  }
+  appendFileSync(file, text, { mode: 384 });
+}
+var WEIGHT = { debug: 10, info: 20, warn: 30, error: 40 };
+var current = ["debug", "info", "warn", "error"].find(
+  (l) => l === process.env.HINDSIGHT_LOG_LEVEL
+) ?? "info";
+function logFilePath() {
+  return process.env.HINDSIGHT_LOG_FILE || join(logsDir(), "plugin.log");
+}
+var NUMERIC_FIELDS = /* @__PURE__ */ new Set([
+  "ms",
+  "chars",
+  "count",
+  "turns",
+  "timeoutMs",
+  "pages",
+  "newChats",
+  "failures",
+  "hostCatalog",
+  "hindsight",
+  "commits",
+  "limit"
+]);
+var BOOLEAN_FIELDS = /* @__PURE__ */ new Set(["cold", "wired", "hasSession", "appendSupported", "retry", "settled"]);
+var ERROR_CLASSES = ["timeout", "aborted", "connection_refused", "dns_failure", "operation_failed"];
+function errorClass(value) {
+  const seen = /* @__PURE__ */ new Set();
+  let error = value;
+  while (error && typeof error === "object" && !seen.has(error) && seen.size < 8) {
+    seen.add(error);
+    const detail = error;
+    if (detail.timedOut === true || detail.name === "TimeoutError" || detail.code === "ETIMEDOUT") return "timeout";
+    if (detail.name === "AbortError") return "aborted";
+    if (detail.code === "ECONNREFUSED") return "connection_refused";
+    if (detail.code === "ENOTFOUND" || detail.code === "EAI_AGAIN") return "dns_failure";
+    error = detail.cause;
+  }
+  return "operation_failed";
+}
+function logMetadata(extra = {}) {
+  const safe = {};
+  for (const [key, value] of Object.entries(extra)) {
+    if (NUMERIC_FIELDS.has(key) && typeof value === "number" && Number.isFinite(value)) safe[key] = value;
+    else if (key === "status" && typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599) safe[key] = value;
+    else if (BOOLEAN_FIELDS.has(key) && typeof value === "boolean") safe[key] = value;
+    else if (key === "mode" && (value === "append" || value === "replace" || value === "skip")) safe[key] = value;
+    else if (key === "error") safe.errorClass = errorClass(value);
+    else if (key === "errorClass" && ERROR_CLASSES.some((known) => known === value)) safe.errorClass = String(value);
+  }
+  return safe;
+}
+function write(level, scope, msg, extra) {
+  if (WEIGHT[level] < WEIGHT[current]) return;
+  try {
+    const metadata = logMetadata(extra);
+    appendLogLine(
+      logFilePath(),
+      `${(/* @__PURE__ */ new Date()).toISOString()} ${level.toUpperCase().padEnd(5)} [${scope}] ${msg}` + (Object.keys(metadata).length ? ` ${JSON.stringify(metadata)}` : "") + "\n"
+    );
+  } catch {
+  }
+}
+var log = {
+  debug: (scope, msg, extra) => write("debug", scope, msg, extra),
+  info: (scope, msg, extra) => write("info", scope, msg, extra),
+  warn: (scope, msg, extra) => write("warn", scope, msg, extra),
+  error: (scope, msg, extra) => write("error", scope, msg, extra)
+};
+
+// src/core/diag.ts
+function diagFilePath() {
+  return process.env.HINDSIGHT_DIAG_FILE || join2(logsDir(), "diag.jsonl");
+}
+function diag(harness, event, extra = {}) {
+  try {
+    const metadata = logMetadata(extra);
+    log.debug(harness, `diag:${event}`, metadata);
+    appendLogLine(
+      diagFilePath(),
+      JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), harness, event, ...metadata }) + "\n"
+    );
+  } catch {
+  }
+}
+
+// src/core/git-layout.ts
+import { lstatSync, readFileSync as readFileSync3, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname2, isAbsolute as isAbsolute3, join as join3, resolve as resolve2 } from "path";
+var TRANSIENT = /* @__PURE__ */ new Set(["EAGAIN", "EMFILE", "ENFILE", "EBUSY", "EINTR", "EIO", "ETIMEDOUT"]);
+var ATTEMPTS = 3;
+var BACKOFF_MS = 20;
+function errorCode(error) {
+  return error?.code ?? "";
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+var TransientProbeError = class extends Error {
+};
+function entryKind(path) {
+  try {
+    const st = lstatSync(path);
+    return st.isDirectory() ? "dir" : "file";
+  } catch (error) {
+    if (TRANSIENT.has(errorCode(error))) throw new TransientProbeError(errorCode(error));
+    return "none";
+  }
+}
+function readTextOrNull(path) {
+  try {
+    return readFileSync3(path, "utf8");
+  } catch (error) {
+    if (TRANSIENT.has(errorCode(error))) throw new TransientProbeError(errorCode(error));
+    return null;
+  }
+}
+function gitDirFromPointer(text, holder) {
+  const match = /^\s*gitdir:\s*(.+?)\s*$/m.exec(text);
+  if (!match) return null;
+  const target = match[1];
+  return isAbsolute3(target) ? target : resolve2(holder, target);
+}
+function commonDirOf(gitDir) {
+  const pointer = entryKind(join3(gitDir, "commondir")) === "file" ? readTextOrNull(join3(gitDir, "commondir"))?.trim() : null;
+  if (!pointer) return gitDir;
+  return isAbsolute3(pointer) ? pointer : resolve2(gitDir, pointer);
+}
+function isBare(commonDir) {
+  const config = readTextOrNull(join3(commonDir, "config"));
+  return config !== null && /^\s*bare\s*=\s*true\s*$/im.test(config);
+}
+function looksLikeBareRepository(directory) {
+  return entryKind(join3(directory, "HEAD")) === "file" && entryKind(join3(directory, "objects")) === "dir" && entryKind(join3(directory, "refs")) === "dir";
+}
+function canonical(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return path;
+  }
+}
+function resolved(commonDir) {
+  if (entryKind(commonDir) !== "dir") return null;
+  const canonicalDir = canonical(commonDir);
+  return { status: "resolved", commonDir: canonicalDir, bare: isBare(canonicalDir) };
+}
+function probeOnce(directory) {
+  let current2 = resolve2(directory);
+  for (; ; ) {
+    const dotGit = join3(current2, ".git");
+    const kind = entryKind(dotGit);
+    if (kind === "dir") {
+      const layout = resolved(commonDirOf(dotGit));
+      if (layout) return layout;
+    } else if (kind === "file") {
+      const text = readTextOrNull(dotGit);
+      const gitDir = text ? gitDirFromPointer(text, current2) : null;
+      const layout = gitDir ? resolved(commonDirOf(gitDir)) : null;
+      if (layout) return layout;
+    }
+    if (looksLikeBareRepository(current2)) {
+      const layout = resolved(current2);
+      if (layout) return layout;
+    }
+    const parent = dirname2(current2);
+    if (parent === current2) return { status: "absent" };
+    current2 = parent;
+  }
+}
+function probeGitLayout(directory) {
+  if (!directory) return { status: "absent" };
+  let last = "";
+  for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
+    if (attempt) sleepSync(BACKOFF_MS * attempt);
+    try {
+      return probeOnce(directory);
+    } catch (error) {
+      last = error instanceof TransientProbeError ? error.message : errorCode(error) || "unknown";
+    }
+  }
+  return { status: "failed", reason: last };
+}
+
+// src/core/bank.ts
+var BankResolutionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BankResolutionError";
+  }
+};
+function resolveProjectRoot(directory) {
+  if (!directory) return { status: "absent" };
+  const layout = probeGitLayout(directory);
+  if (layout.status !== "resolved") return layout;
+  const commonDir = layout.commonDir;
+  if (basename(commonDir) === ".git") return { status: "resolved", root: dirname3(commonDir) };
+  if (basename(commonDir).startsWith(".") && layout.bare) {
+    return { status: "resolved", root: dirname3(commonDir) };
+  }
+  return { status: "resolved", root: commonDir };
+}
+function projectNameOf(directory, sessionRoot) {
+  return gitProjectName(directory, true, sessionRoot);
+}
+var PROJECT_ROOT_ENV = ["CLAUDE_PROJECT_DIR"];
+function nearestExistingDir(directory) {
+  let current2 = directory;
+  while (current2) {
+    if (existsSync(current2)) return current2;
+    const parent = dirname3(current2);
+    if (parent === current2) return "";
+    current2 = parent;
+  }
+  return "";
+}
+function dirName(directory) {
+  return directory && basename(directory) || "unknown";
+}
+function mainWorktreeRoot(directory, sessionRoot = "") {
+  const candidates = [
+    nearestExistingDir(directory),
+    sessionRoot,
+    ...PROJECT_ROOT_ENV.map((v) => process.env[v] || "")
+  ];
+  let failure = null;
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    const projectRoot = resolveProjectRoot(candidate);
+    if (projectRoot.status === "resolved") return projectRoot;
+    if (projectRoot.status === "failed") failure = projectRoot;
+  }
+  return failure ?? { status: "absent" };
+}
+function gitProjectName(directory, resolveWorktrees, sessionRoot = "") {
+  if (resolveWorktrees) {
+    const projectRoot = mainWorktreeRoot(directory, sessionRoot);
+    if (projectRoot.status === "resolved") return basename(projectRoot.root);
+    if (projectRoot.status === "failed") {
+      throw new BankResolutionError(
+        `git probe failed for ${directory} (${projectRoot.reason}) \u2014 refusing to guess a bank id`
+      );
+    }
+  }
+  return dirName(sessionRoot || directory);
+}
+function configuredDir(dir) {
+  const expanded = dir === "~" || dir.startsWith("~/") ? join4(homedir2(), dir.slice(1)) : dir;
+  return normalize(expanded).replace(new RegExp(`\\${sep2}+$`), "");
+}
+function isWithin(directory, configured) {
+  return directory === configured || directory.startsWith(configured + sep2);
+}
+function isOptedIn(config, directory) {
+  try {
+    managedBank(config.routerHarness, directory);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function mapLookup(map, directory) {
+  const cwd = normalize(directory);
+  let best;
+  for (const [dir, value] of Object.entries(map)) {
+    const p = configuredDir(dir);
+    if (isWithin(cwd, p)) {
+      if (!best || p.length > best.len) best = { len: p.length, value };
+    }
+  }
+  return best?.value;
+}
+function lookupDirectories(config, directory, sessionRoot = "") {
+  const directories = [normalize(directory)];
+  if (config.resolveWorktrees ?? true) {
+    const projectRoot = mainWorktreeRoot(directory, sessionRoot);
+    const normalizedRoot = projectRoot.status === "resolved" ? normalize(projectRoot.root) : "";
+    if (normalizedRoot && normalizedRoot !== directories[0]) directories.push(normalizedRoot);
+  }
+  return directories;
+}
+function pathSection(config, paths, directory) {
+  if (!directory || !paths) return void 0;
+  return lookupDirectories(config, directory).map((candidate) => mapLookup(paths, candidate)).find((section) => section !== void 0);
+}
+function deriveBankId(config, directory, harness = "coding", sessionRoot) {
+  return managedBank(harness, directory);
+}
+function deriveBankIdOrSkip(config, directory, harness = "coding", sessionRoot) {
+  try {
+    return deriveBankId(config, directory, harness, sessionRoot);
+  } catch (error) {
+    if (!(error instanceof BankResolutionError)) throw error;
+    log.warn(harness, "bank unresolved: skipping (repository could not be identified)", {
+      directory,
+      error
+    });
+    diag(harness, "bank_unresolved", { directory, error });
+    return null;
+  }
+}
+
+// src/core/config.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join7 } from "path";
+
+// src/core/seed.ts
+import { spawn as realSpawn } from "child_process";
+import { dirname as dirname4, join as join5 } from "path";
+import { fileURLToPath } from "url";
+var DEFAULT_SEED_LIMIT = 300;
+
+// ../../shared/recall-item.ts
+function recallItemText(item) {
+  const value = item.text ?? item.content;
+  return typeof value === "string" ? value : JSON.stringify(item);
+}
+function formatRecallItem(item) {
+  const type = typeof item.type === "string" ? ` [${item.type}]` : "";
+  const doc = typeof item.document_id === "string" ? ` [doc:${item.document_id}]` : "";
+  return `- ${recallItemText(item)}${type}${doc}`;
+}
+
+// ../../shared/request-error.ts
+function isAuthorizationError(error) {
+  const status = error?.statusCode;
+  return status === 401 || status === 403;
+}
+function isTransientRequestError(error) {
+  const status = error?.statusCode;
+  if (error instanceof DOMException) {
+    return ["AbortError", "NetworkError", "TimeoutError"].includes(error.name);
+  }
+  if (error instanceof TypeError) {
+    if (error.message === "fetch failed") return true;
+    const cause = error.cause;
+    return error.message === "terminated" && typeof cause?.code === "string" && [
+      "UND_ERR_SOCKET",
+      "UND_ERR_BODY_TIMEOUT",
+      "UND_ERR_RES_CONTENT_LENGTH_MISMATCH",
+      "ECONNRESET",
+      "ETIMEDOUT",
+      "EPIPE"
+    ].includes(cause.code);
+  }
+  return status === 408 || status === 429 || typeof status === "number" && status >= 500;
+}
+
+// ../../shared/recall-coordinator.ts
+var RecallAuthorizationError = class extends Error {
+  statusCode = 403;
+  bank;
+  constructor(bank) {
+    super(`recall authorization denied for bank ${bank}`);
+    this.name = "RecallAuthorizationError";
+    this.bank = bank;
+  }
+};
+function timeoutAfter(ms, controller) {
+  let rejectTimeout;
+  const promise = new Promise((_, reject) => {
+    rejectTimeout = reject;
+  });
+  const timer = setTimeout(() => {
+    controller.abort();
+    rejectTimeout(new DOMException(`recall timed out after ${ms}ms`, "TimeoutError"));
+  }, ms);
+  return { promise, timer };
+}
+function estimateTokens(item) {
+  const characters = Math.max(JSON.stringify({ results: [item] }, null, 2).length, formatRecallItem(item).length + 2);
+  return Math.max(1, Math.ceil(characters / 4));
+}
+function validateRecallResults(response) {
+  if (typeof response !== "object" || response === null || Array.isArray(response)) {
+    throw new RouterRequestError(502);
+  }
+  const results = "results" in response ? response.results : void 0;
+  if (results === void 0) return [];
+  if (!Array.isArray(results) || !results.every(
+    (item) => typeof item === "object" && item !== null && !Array.isArray(item)
+  )) {
+    throw new RouterRequestError(502);
+  }
+  return results;
+}
+function mergeSettledResults(settled, banks) {
+  const failedBanks = [];
+  const representatives = /* @__PURE__ */ new Map();
+  settled.forEach((outcome, index) => {
+    const bank = banks[index];
+    if (outcome.status === "rejected") {
+      if (isAuthorizationError(outcome.reason)) throw new RecallAuthorizationError(bank);
+      if (!isTransientRequestError(outcome.reason)) throw outcome.reason;
+      failedBanks.push(bank);
+      return;
+    }
+    for (const item of outcome.value.results) {
+      const key = recallItemText(item);
+      const candidate = { bank, item };
+      const previous = representatives.get(key);
+      if (!previous || compareBankItems(candidate, previous) < 0) {
+        representatives.set(key, candidate);
+      }
+    }
+  });
+  return { merged: [...representatives.values()], failedBanks };
+}
+function compareBankItems(a, b) {
+  const scoreA = typeof a.item.score === "number" ? a.item.score : Number.NEGATIVE_INFINITY;
+  const scoreB = typeof b.item.score === "number" ? b.item.score : Number.NEGATIVE_INFINITY;
+  if (scoreA !== scoreB) return scoreB - scoreA;
+  if (a.bank !== b.bank) return a.bank < b.bank ? -1 : 1;
+  const contentA = recallItemText(a.item);
+  const contentB = recallItemText(b.item);
+  if (contentA === contentB) return 0;
+  return contentA < contentB ? -1 : 1;
+}
+function trimToTokenBudget(items, maxTokens) {
+  if (maxTokens === void 0) return items;
+  const kept = [];
+  let spent = 0;
+  for (const item of items) {
+    const tokens = estimateTokens(item);
+    if (spent + tokens <= maxTokens) {
+      spent += tokens;
+      kept.push(item);
+    }
+  }
+  return kept;
+}
+var RecallCoordinator = class {
+  async recall(client2, request) {
+    const banks = request.banks;
+    if (banks.length === 0) {
+      return { results: [], partial: false, failedBanks: [] };
+    }
+    if (!Number.isSafeInteger(request.timeoutMs) || request.timeoutMs <= 0) {
+      throw new RangeError("recall timeout must be a positive integer");
+    }
+    if (request.maxTokens !== void 0 && (!Number.isSafeInteger(request.maxTokens) || request.maxTokens <= 0)) {
+      throw new RangeError("recall token budget must be a positive integer");
+    }
+    const deadline = Date.now() + request.timeoutMs;
+    const perBankTokens = request.maxTokens ? Math.max(1, Math.floor(request.maxTokens / banks.length)) : void 0;
+    const settled = await Promise.allSettled(
+      banks.map(async (bank) => {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+          throw new DOMException(`recall timed out after ${request.timeoutMs}ms`, "TimeoutError");
+        }
+        const controller = new AbortController();
+        const call = client2.recall(bank, request.query, {
+          maxTokens: perBankTokens,
+          budget: request.budget,
+          types: request.types,
+          preferObservations: request.preferObservations,
+          signal: controller.signal
+        });
+        const timeout = timeoutAfter(remaining, controller);
+        try {
+          const response = await Promise.race([call, timeout.promise]);
+          return { bank, results: validateRecallResults(response) };
+        } finally {
+          clearTimeout(timeout.timer);
+        }
+      })
+    );
+    const { merged, failedBanks } = mergeSettledResults(settled, banks);
+    merged.sort(compareBankItems);
+    const results = trimToTokenBudget(
+      merged.map((entry) => entry.item),
+      request.maxTokens
+    );
+    return { results, partial: failedBanks.length > 0, failedBanks };
+  }
+};
+
+// ../../shared/read-execution.ts
+async function readAcrossBanks(transport, operation, body, options) {
+  const suffix = operation === "recall" ? "/memories/recall" : "/reflect";
+  const query = typeof body.query === "string" ? body.query : "";
+  return new RecallCoordinator().recall(
+    {
+      retain: async () => {
+        throw new Error("read-only execution");
+      },
+      async recall(bank, _query, request) {
+        const response = await transport.request(transport.bankUrl(bank, suffix), {
+          method: "POST",
+          signal: options.signal && request?.signal ? AbortSignal.any([options.signal, request.signal]) : options.signal ?? request?.signal,
+          body: JSON.stringify({ ...body, max_tokens: request?.maxTokens })
+        });
+        const data = await response.json();
+        if (operation === "reflect") {
+          return { results: data.text ? [{ text: data.text }] : [] };
+        }
+        return { results: data.results };
+      }
+    },
+    {
+      banks: visibleBanks(transport.access),
+      query,
+      timeoutMs: options.timeoutMs,
+      maxTokens: options.maxTokens
+    }
+  );
+}
+
+// src/core/missions.ts
+import { createHash as createHash3 } from "crypto";
+var RETAIN_EXTRACTION_MODES = ["concise", "verbose", "verbatim", "chunks"];
+var DEFAULT_RETAIN_EXTRACTION_MODE = "concise";
+function pageScopeRule(project) {
+  if (project === void 0)
+    return ` This bank is shared by several projects: attribute each thing you include to the repository or project its sources name, and group by project where that helps. Leave out facts about external tools, libraries and services those projects merely use, configure, deploy or discuss \u2014 they belong to somebody else's codebase \u2014 including any commit SHA or identifier from such a dependency's repository.`;
+  return ` Scope this page to ${project} ITSELF: the bank also holds facts about external tools, libraries and services that ${project} merely uses, configures, deploys or discusses, and those belong to somebody else's codebase. Include something only when its subject is ${project}'s own code, configuration or process; when it is about a dependency, leave it out however well-evidenced it looks \u2014 including any commit SHA or identifier that belongs to that dependency's repository rather than this one.`;
+}
+var PAGE_TAXONOMY = [
+  {
+    name: "Component map",
+    source_query: "From this project's commit history and past discussions, what are the main components/modules/subsystems, what is each responsible for, and how do they relate to or depend on one another? Describe the structure and responsibilities.",
+    tags: ["knowledge:component"]
+  },
+  {
+    name: "Core concepts",
+    source_query: "What are the core concepts, domain abstractions, and key entities in this project \u2014 the vocabulary a developer must understand? For each, explain what it represents and its role, drawn from how they are introduced and discussed across the history and conversations.",
+    tags: ["knowledge:concept"]
+  },
+  {
+    name: "Conventions and patterns",
+    source_query: "What conventions, idioms, and recurring patterns does this project follow \u2014 its approach to testing, error handling, naming, structure, and how changes are typically made? Describe how THIS project does things, as evidenced across its history and discussions.",
+    tags: ["knowledge:convention"]
+  },
+  {
+    name: "Key decisions and rationale",
+    source_query: "What are the significant technical decisions made in this project and the rationale behind them \u2014 the durable 'why we do it this way' a developer should know? Summarize the decisions and their reasoning from the commit rationales and past conversations.",
+    tags: ["knowledge:decision"]
+  },
+  {
+    name: "Initiatives and enhancements",
+    source_query: "Based on this repository's commit history, what are the major initiatives, features, and enhancements the project has worked on? Summarize the themes and notable changes over time. When a source memory's context carries a `[[page:<id>]]` link, repeat that link in the summary of what it describes, so each initiative links to its detailed page.",
+    tags: ["knowledge:feature-work"]
+  }
+];
+var PAGE_NAMES = PAGE_TAXONOMY.map((page) => page.name);
+function pagesFor(project, pages = {}, customPages = {}) {
+  const scope = pageScopeRule(project);
+  const byName = new Map(
+    Object.entries(pages).map(([name, override]) => [name.trim().toLowerCase(), override])
+  );
+  const out = [];
+  for (const page of PAGE_TAXONOMY) {
+    const override = byName.get(page.name.toLowerCase());
+    if (override === false) continue;
+    out.push({ ...page, source_query: (override?.source_query || page.source_query) + scope });
+  }
+  for (const [name, page] of Object.entries(customPages)) {
+    out.push({ name: name.trim(), source_query: page.source_query + scope, tags: page.tags ?? [] });
+  }
+  return out;
+}
+var PAGE_MAX_TOKENS = 4096;
+var PAGE_TAGS_MATCH = "all";
+var PAGE_FACT_TYPES = ["world", "experience", "observation"];
+var DEFAULT_PAGE_TRIGGER_CRON = "H * * * *";
+var CRON_FIELD_RANGES = [
+  [0, 59],
+  // minute
+  [0, 23],
+  // hour
+  [1, 31],
+  // day of month
+  [1, 12],
+  // month
+  [0, 6]
+  // day of week
+];
+var HASHED_FIELD = /^H(?:\((\d+)-(\d+)\))?$/;
+function isHashedCron(cron) {
+  return /(^|\s)H/.test(cron);
+}
+function parseHashedCron(cron) {
+  const fields = cron.trim().split(/\s+/);
+  if (fields.length !== CRON_FIELD_RANGES.length) return void 0;
+  for (const [i, field] of fields.entries()) {
+    if (!field.startsWith("H")) continue;
+    const m = HASHED_FIELD.exec(field);
+    if (!m) return void 0;
+    if (m[1] === void 0) continue;
+    const [lo, hi] = [Number(m[1]), Number(m[2])];
+    const [min, max] = CRON_FIELD_RANGES[i];
+    if (lo > hi || lo < min || hi > max) return void 0;
+  }
+  return fields;
+}
+function hashedValue(seed, field, lo, hi) {
+  const digest = createHash3("sha256").update(`${seed}\0${field}`).digest();
+  return lo + digest.readUInt32BE(0) % (hi - lo + 1);
+}
+function expandCronHash(cron, seed) {
+  if (!isHashedCron(cron)) return cron;
+  const fields = parseHashedCron(cron);
+  if (!fields) return cron;
+  return fields.map((field, i) => {
+    const m = HASHED_FIELD.exec(field);
+    if (!m) return field;
+    const [lo, hi] = m[1] === void 0 ? CRON_FIELD_RANGES[i] : [Number(m[1]), Number(m[2])];
+    return String(hashedValue(seed, i, lo, hi));
+  }).join(" ");
+}
+function pageTriggerFor(trigger, bank, page) {
+  const cron = trigger.refresh_cron;
+  if (!cron || !isHashedCron(cron)) return trigger;
+  return { ...trigger, refresh_cron: expandCronHash(cron, `${bank}\0${page}`) };
+}
+function buildPageTrigger(cfg2 = {}) {
+  const base = { fact_types: PAGE_FACT_TYPES, tags_match: PAGE_TAGS_MATCH };
+  switch (cfg2.pageTriggerType) {
+    case "auto-refresh":
+      return { ...base, refresh_after_consolidation: true };
+    case "manual":
+      return { ...base, refresh_after_consolidation: false };
+    // "cron" and an unset type alike: the default schedule stands in for a missing expression, so
+    // a trigger built from a partial config is never a cron trigger with nothing to fire on.
+    default:
+      return { ...base, refresh_cron: cfg2.pageTriggerCron || DEFAULT_PAGE_TRIGGER_CRON };
+  }
+}
+function pageTriggerDrifted(current2, desired) {
+  return current2.tags_match !== desired.tags_match || (current2.refresh_cron ?? null) !== (desired.refresh_cron ?? null) || Boolean(current2.refresh_after_consolidation) !== Boolean(desired.refresh_after_consolidation);
+}
+function pageTriggerPatch(desired) {
+  if (desired.refresh_after_consolidation === false) return { ...desired, refresh_cron: null };
+  return desired;
+}
+var PLUGIN_GOVERNED_BANK_FIELDS = [
+  "retain_strategies",
+  "entity_labels",
+  "retain_extraction_mode"
+];
+
+// package.json
+var version = "0.8.7";
+
+// src/core/util.ts
+import { accessSync, constants } from "fs";
+import { delimiter, join as join6 } from "path";
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function semverGte(version2, min) {
+  const parts = (v) => {
+    const m = v.trim().match(/^(\d+)\.(\d+)(?:\.(\d+))?/);
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3] ?? 0)] : void 0;
+  };
+  const a = version2 ? parts(version2) : void 0;
+  const b = parts(min);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return true;
+}
+async function pool(items, n, fn, onError, onProgress) {
+  let i = 0, done = 0;
+  async function worker() {
+    while (i < items.length) {
+      const idx = i++;
+      try {
+        await fn(items[idx], idx);
+      } catch (e) {
+        onError?.(idx, e);
+      }
+      onProgress?.(++done, items.length);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(n, items.length) }, worker));
+}
+
+// src/core/hindsight.ts
+var USER_AGENT = `hindsight-coding-agents/${version}`;
+function resolveRetainScopes(tags, configured) {
+  if (configured !== "per_source") return configured;
+  const sources = [...new Set((tags ?? []).filter((t) => t.startsWith("source:")))].sort((a, b) => a.localeCompare(b));
+  return [[], ...sources.map((s) => [s])];
+}
+var DEFAULT_OBSERVATION_SCOPES = "shared";
+var MIN_IDEMPOTENT_RETAIN_VERSION = "0.8.6";
+var RateLimitedError = class extends Error {
+  constructor(retryAfterMs2) {
+    super(`rate limited; retry after ${Math.round(retryAfterMs2 / 1e3)}s`);
+    this.retryAfterMs = retryAfterMs2;
+    this.name = "RateLimitedError";
+  }
+  retryAfterMs;
+  code = "rate_limited";
+};
+function retryAfterMs(header) {
+  return boundedRetryAfterMs(header);
+}
+var KnowledgePagesUnavailableError = class extends Error {
+  code = "knowledge_pages_unavailable";
+  constructor() {
+    super("Hindsight server does not support knowledge pages");
+    this.name = "KnowledgePagesUnavailableError";
+  }
+};
+async function isEndpointMissing(r) {
+  try {
+    const j = await r.json();
+    return String(j?.detail ?? "").trim().toLowerCase() === "not found";
+  } catch {
+    return false;
+  }
+}
+var TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "error"]);
+var ReflectError = class extends Error {
+  constructor(message, status, timedOut, options) {
+    super(message, options);
+    this.status = status;
+    this.timedOut = timedOut;
+    this.name = "ReflectError";
+  }
+  status;
+  timedOut;
+  /** A timeout or a 5xx means reflect's synthesis (the slow LLM path) broke, while the cheap
+   *  retrieval endpoints may still answer — worth falling back. A 4xx will fail the same way on
+   *  every endpoint (auth, missing bank), so it is not. */
+  get fallbackEligible() {
+    return this.timedOut || this.status !== void 0 && this.status >= 500;
+  }
+  /** A 4xx the next attempt would get again (bad key, missing bank, rejected body) — retrying it
+   *  only spends another doomed call (#5207). 408/429 are "not now", so they stay retryable. */
+  get permanent() {
+    const s = this.status;
+    return s !== void 0 && s >= 400 && s < 500 && s !== 408 && s !== 429;
+  }
+};
+var DEFAULT_MAX_PARALLEL_RETAINS = 10;
+var DEFAULT_PAGE_SEARCH_LIMIT = 10;
+var DEFAULT_RECALL_OPTIONS = {
+  types: ["observation"],
+  budget: "low",
+  max_tokens: 2e3,
+  include: { entities: null }
+};
+var POLL_CYCLE_MS = 5e3;
+var POLL_MAX_SERVER_ERRORS = 12;
+var RETRY_AFTER_FLOOR_MS = 10 * 1e3;
+var RETRY_AFTER_CEILING_MS = 60 * 1e3;
+var RATE_LIMIT_BACKOFF_MS = 1e3;
+function shapePage(page) {
+  const p = page ?? {};
+  const body = typeof p.body === "string" && p.body.trim() ? p.body : p.markdown;
+  return {
+    id: p.id,
+    name: p.name,
+    ...p.description ? { description: p.description } : {},
+    ...Array.isArray(p.tags) && p.tags.length ? { tags: p.tags } : {},
+    ...p.timestamp ? { last_updated_at: p.timestamp } : {},
+    body
+  };
+}
+var HindsightClient = class _HindsightClient {
+  transport;
+  routerHarness;
+  apiUrl;
+  bank;
+  project;
+  opIds = [];
+  // async operation ids collected by retain(), for drain()
+  /** Tri-state capability probe: unknown until the first page request, then cached. */
+  knowledgePagesSupported;
+  /** Tri-state capability probe: unknown until the first append-mode retain, then cached. */
+  idempotentRetain;
+  log;
+  maxParallelRetains;
+  observationScopes;
+  pageSearchLimit;
+  recallOptions;
+  rateLimitPatienceMs;
+  constructor(o, parent) {
+    this.routerHarness = parent?.routerHarness ?? o.routerHarness;
+    this.transport = parent?.transport ?? harnessTransport(o.routerHarness);
+    this.apiUrl = this.transport.baseUrl;
+    if (o.apiUrl.replace(/\/+$/, "") !== this.apiUrl) throw new AccessDeniedError();
+    this.transport.bankUrl(o.bank);
+    this.bank = o.bank;
+    this.project = o.project;
+    this.log = o.log ?? (() => {
+    });
+    this.maxParallelRetains = o.maxParallelRetains || DEFAULT_MAX_PARALLEL_RETAINS;
+    this.observationScopes = o.observationScopes ?? DEFAULT_OBSERVATION_SCOPES;
+    this.pageSearchLimit = o.pageSearchLimit || DEFAULT_PAGE_SEARCH_LIMIT;
+    this.recallOptions = { ...DEFAULT_RECALL_OPTIONS, ...o.recallOptions };
+    this.rateLimitPatienceMs = o.rateLimitPatienceMs ?? 0;
+  }
+  assertAuthorized() {
+    this.transport.assertAuthorized();
+  }
+  visibleBanks() {
+    return visibleBanks(this.transport.access);
+  }
+  readScope() {
+    return { identity: this.transport.authorizationIdentity(), banks: this.visibleBanks().sort(), endpoint: this.apiUrl, bankId: this.bank };
+  }
+  forBank(bank) {
+    this.assertAuthorized();
+    this.transport.bankUrl(bank);
+    return new _HindsightClient({
+      routerHarness: this.routerHarness,
+      apiUrl: this.apiUrl,
+      bank,
+      project: this.project,
+      maxParallelRetains: this.maxParallelRetains,
+      observationScopes: this.observationScopes,
+      pageSearchLimit: this.pageSearchLimit,
+      recallOptions: this.recallOptions,
+      log: this.log
+    }, this);
+  }
+  get apiToken() {
+    return void 0;
+  }
+  hasCredentials() {
+    return this.transport.hasCredentials();
+  }
+  async fetchWithAuth(url, init, timeoutMs = 15e3) {
+    if (url === this.bankUrl("/memories/recall")) {
+      const body = JSON.parse(String(init.body));
+      const result = await readAcrossBanks(this.transport, "recall", body, { timeoutMs, maxTokens: 4096, signal: init.signal ?? void 0 });
+      if (result.partial) this.log("partial memory read: assigned bank unavailable");
+      return Response.json({ results: result.results });
+    }
+    return this.transport.request(url, init);
+  }
+  bankUrl(suffix = "") {
+    return `${this.apiUrl}/v1/default/banks/${encodeURIComponent(this.bank)}${suffix}`;
+  }
+  /** `tolerate` adds statuses that are returned to the caller instead of thrown (404 always is). */
+  async req(method, url, body, tolerate = [], timeoutMs = 15e3) {
+    const payload = body ? JSON.stringify(body) : void 0;
+    let r;
+    for (let attempt = 0, waited = 0; ; attempt++) {
+      try {
+        r = await this.fetchWithAuth(url, {
+          method,
+          body: payload,
+          signal: AbortSignal.timeout(timeoutMs)
+        }, timeoutMs);
+      } catch (error) {
+        if (!(error instanceof RouterRequestError) || error.statusCode !== 404 && error.statusCode !== 429 && !tolerate.includes(error.statusCode)) throw error;
+        r = new Response(null, {
+          status: error.statusCode,
+          ...error.statusCode === 429 ? { headers: { "retry-after": String(error.retryAfterMs / 1e3) } } : {}
+        });
+      }
+      if (r.status !== 429 || tolerate.includes(429)) break;
+      const asked = retryAfterMs(r.headers.get("retry-after"));
+      const backoff = Math.min(RETRY_AFTER_CEILING_MS, RATE_LIMIT_BACKOFF_MS * 2 ** attempt);
+      const wait = Math.min(RETRY_AFTER_CEILING_MS, Math.max(asked, backoff)) * (1 + Math.random() / 2);
+      if (waited + wait > this.rateLimitPatienceMs) throw new RateLimitedError(asked);
+      await sleep(wait);
+      waited += wait;
+    }
+    if (!r.ok && r.status !== 404 && !tolerate.includes(r.status))
+      throw new Error(
+        `memory request failed (${r.status})`
+      );
+    return r;
+  }
+  /** Retain one memory. ALWAYS async: enqueue extraction server-side and collect its op-id for
+   *  drain(). Nothing in this plugin can afford to block a coding agent's hook on extraction. */
+  async retain(content, context, documentId, tags, strategy, opts = {}) {
+    const item = {
+      content,
+      context,
+      document_id: documentId,
+      tags,
+      strategy,
+      // Sent on EVERY retain, including the server default `combined`, so the scoping a bank's
+      // observations were built under is a property of the write rather than of whichever server
+      // version happened to process it. Servers older than 0.4.15 ignore the field.
+      observation_scopes: resolveRetainScopes(tags, this.observationScopes)
+    };
+    if (opts.timestamp) item.timestamp = opts.timestamp;
+    if (opts.metadata) item.metadata = opts.metadata;
+    if (opts.updateMode) item.update_mode = opts.updateMode;
+    const body = { items: [item], async: true };
+    if (opts.operationId) body.operation_id = opts.operationId;
+    const r = await this.req("POST", this.bankUrl("/memories"), body);
+    try {
+      const j = await r.json();
+      if (j.operation_id) this.opIds.push(j.operation_id);
+    } catch {
+    }
+  }
+  /**
+   * Whether this server honours `operation_id` on an async retain, and can therefore be appended to
+   * safely (see MIN_IDEMPOTENT_RETAIN_VERSION). Probed once per client via the version endpoint; anything
+   * unreachable, unparseable or older answers "no", which costs efficiency, never correctness.
+   */
+  async supportsIdempotentRetain() {
+    if (this.idempotentRetain === void 0) {
+      this.idempotentRetain = await this.probeIdempotentRetain();
+      this.log(`server retain idempotency: ${this.idempotentRetain ? "supported" : "unavailable"}`);
+    }
+    return this.idempotentRetain;
+  }
+  /** `/v1/version` first: an ingress that routes only `/v1` to the API (the Helm chart's default)
+   *  hands a bare `/version` to the control plane, whose HTML 404 or login redirect read as "no",
+   *  so append silently never turned on (#5286). Servers that predate the alias still answer
+   *  `/version`, so that stays as the fallback. */
+  async probeIdempotentRetain() {
+    for (const path of ["/v1/version", "/version"]) {
+      try {
+        const r = await this.req("GET", `${this.apiUrl}${path}`);
+        if (!r.ok) continue;
+        const j = await r.json();
+        return semverGte(j.api_version, MIN_IDEMPOTENT_RETAIN_VERSION);
+      } catch (error) {
+        if (error instanceof AccessDeniedError) throw error;
+      }
+    }
+    return false;
+  }
+  /**
+   * Whether a session write-back may use `update_mode="append"`: the server must dedupe by
+   * `operation_id` AND the bank must keep document text, or the server rejects the append in the
+   * background (#4613). Only an explicit `store_document_text: false` answers "no" — an unreachable
+   * or unparseable config assumes the default (stored), so a flaky probe never downgrades appends.
+   */
+  async supportsAppendRetain() {
+    if (!await this.supportsIdempotentRetain()) return false;
+    try {
+      const r = await this.req("GET", this.bankUrl("/config"));
+      if (!r.ok) return true;
+      const j = await r.json();
+      return j.config?.store_document_text !== false;
+    } catch (error) {
+      if (error instanceof AccessDeniedError) throw error;
+      return true;
+    }
+  }
+  /**
+   * Every document_id currently in the bank under a strategy tag (e.g. `source:git`), paginated into a
+   * Set. Powers the incremental git-sync's "what's already ingested?" check — since git commits are stored
+   * with document_id `git:<sha>`, the returned Set lets a caller diff a ref's commits against memory.
+   */
+  async listDocumentIds(tag, tagsMatch = "all") {
+    const ids = /* @__PURE__ */ new Set();
+    const limit = 500;
+    for (let offset = 0; ; offset += limit) {
+      const q = `?tags=${encodeURIComponent(tag)}&tags_match=${tagsMatch}&limit=${limit}&offset=${offset}`;
+      const r = await this.req("GET", this.bankUrl(`/documents${q}`));
+      let items = [];
+      let total = 0;
+      try {
+        const j = await r.json();
+        items = j.items || [];
+        total = j.total ?? 0;
+      } catch {
+        break;
+      }
+      for (const it of items) if (it.id) ids.add(it.id);
+      if (items.length < limit || ids.size >= total) break;
+    }
+    return ids;
+  }
+  /**
+   * The tags on one document, or undefined when the bank holds none with that id. Read from the
+   * document LISTING narrowed by `q` (a substring match on the id, so the exact id is picked out of
+   * the page) rather than GET /documents/{id}, which also sends the document's full text: the
+   * caller, the git-log freshness check on SessionStart, reads a ~100k-character document for one tag.
+   */
+  async documentTags(documentId) {
+    const limit = 100;
+    for (let offset = 0; ; offset += limit) {
+      const q = `?q=${encodeURIComponent(documentId)}&limit=${limit}&offset=${offset}`;
+      const r = await this.req("GET", this.bankUrl(`/documents${q}`));
+      const j = await r.json();
+      const items = j.items ?? [];
+      const hit = items.find((it) => it.id === documentId);
+      if (hit) return hit.tags ?? [];
+      if (items.length < limit || offset + limit >= (j.total ?? 0)) return void 0;
+    }
+  }
+  /** Whether the bank holds any document at all — a one-row listing. A bank that does not exist
+   *  yet (404) holds none; any other failure throws, so a caller can tell "empty" from "unknown". */
+  async hasDocuments() {
+    const r = await this.req("GET", this.bankUrl("/documents?limit=1"));
+    if (r.status === 404) return false;
+    const j = await r.json();
+    return (j.total ?? j.items?.length ?? 0) > 0;
+  }
+  /** Seed knowledge pages for an operator-provisioned bank. Bank creation, reset and
+   *  configuration belong to the router operator; the client only maintains pages. */
+  async configureBank(opts = {}) {
+    if (opts.reset || opts.manage === true) throw new AccessDeniedError();
+    await this.seedPages(opts.pageTrigger, opts.pages, opts.customPages);
+  }
+  /** Explicitly delete one document (and its cascaded memory units/links). Background sync must
+   *  never use this as a cleanup primitive: a document id alone does not prove repository ownership. */
+  async deleteDocument(documentId) {
+    await this.req("DELETE", this.bankUrl(`/documents/${encodeURIComponent(documentId)}`));
+  }
+  /** Count of operations still ACTIVE on this bank — the list includes terminal ops (completed/
+   *  failed/cancelled), so filter by status. Powers syncStatus's "extractions drained" check. */
+  async activeOperations(timeoutMs = 15e3) {
+    const r = await this.req("GET", this.bankUrl("/operations"), void 0, [429], timeoutMs);
+    if (!r.ok) throw new RouterRequestError(r.status, boundedRetryAfterMs(r.headers.get("retry-after")));
+    try {
+      const body = await r.json();
+      if (!body || typeof body !== "object" || Array.isArray(body)) throw new RouterRequestError(502);
+      const { operations, items } = body;
+      const ops = operations ?? items;
+      if (!Array.isArray(ops)) throw new RouterRequestError(502);
+      let active = 0;
+      for (const op of ops) {
+        if (!op || typeof op !== "object" || !("status" in op) || typeof op.status !== "string" || !op.status) {
+          throw new RouterRequestError(502);
+        }
+        if (!TERMINAL.has(op.status.toLowerCase())) active++;
+      }
+      return active;
+    } catch {
+      throw new RouterRequestError(502);
+    }
+  }
+  /**
+   * Poll each enqueued operation by id until terminal. LIST only shows active ops, so per-id GET is reliable.
+   *
+   * Concurrency is capped at `maxParallelRetains` (the API rate-limits bursts, not single
+   * requests — a 200 to a lone GET with 429s under `Promise.all` over every pending op). A 429
+   * leaves the op pending and backs the next cycle off by its `Retry-After` (10s floor) instead
+   * of hammering the next cycle 5s later.
+   */
+  async drain(ids, label, maxMs = 60 * 60 * 1e3) {
+    if (!ids.length) return;
+    this.log(`[wait] draining ${ids.length} ${label} operations \u2026`);
+    const start = Date.now();
+    const pending = new Set(ids);
+    const serverErrors = /* @__PURE__ */ new Map();
+    let failed = 0;
+    const giveUp = (id, status) => {
+      pending.delete(id);
+      failed++;
+      this.log(`  \u2026 ${label} op ${id} -> HTTP ${status}, counted as failed`);
+    };
+    while (pending.size && Date.now() - start < maxMs) {
+      let backoffMs = POLL_CYCLE_MS;
+      await pool([...pending], this.maxParallelRetains, async (id) => {
+        try {
+          const r = await this.fetchWithAuth(this.bankUrl(`/operations/${encodeURIComponent(id)}`), { method: "GET" });
+          if (r.status === 429) {
+            backoffMs = Math.min(
+              RETRY_AFTER_CEILING_MS,
+              Math.max(backoffMs, RETRY_AFTER_FLOOR_MS, retryAfterMs(r.headers.get("retry-after")))
+            );
+            return;
+          }
+          if (r.status >= 500) {
+            const n = (serverErrors.get(id) ?? 0) + 1;
+            serverErrors.set(id, n);
+            if (n >= POLL_MAX_SERVER_ERRORS) giveUp(id, r.status);
+            return;
+          }
+          if (!r.ok) return giveUp(id, r.status);
+          serverErrors.delete(id);
+          const st = ((await r.json()).status || "").toLowerCase();
+          if (TERMINAL.has(st)) {
+            pending.delete(id);
+            if (st !== "completed") failed++;
+          }
+        } catch (error) {
+          if (error instanceof AccessDeniedError) throw error;
+          if (error instanceof RouterRequestError) {
+            if (error.statusCode === 429) {
+              backoffMs = Math.min(RETRY_AFTER_CEILING_MS, Math.max(backoffMs, RETRY_AFTER_FLOOR_MS, error.retryAfterMs));
+            } else if (error.statusCode >= 500) {
+              const n = (serverErrors.get(id) ?? 0) + 1;
+              serverErrors.set(id, n);
+              if (n >= POLL_MAX_SERVER_ERRORS) giveUp(id, error.statusCode);
+            } else {
+              giveUp(id, error.statusCode);
+            }
+          }
+        }
+      }, (_index, error) => {
+        if (error instanceof AccessDeniedError) throw error;
+      });
+      if (pending.size) {
+        this.log(`  \u2026 ${pending.size}/${ids.length} ${label} ops pending`);
+        await sleep(backoffMs);
+      }
+    }
+    this.log(
+      `[wait] ${label} drained \u2014 ${ids.length - pending.size} done, ${failed} failed` + (pending.size ? `, ${pending.size} still pending at timeout` : "")
+    );
+  }
+  /**
+   * Reflect: synthesized, root-cause answer over the bank. Bounded so a slow server never hangs a
+   * caller — but `timeoutMs` is REQUIRED, deliberately: the right deadline differs by an order of
+   * magnitude between the automatic hook (20s, to fit the host's window) and the agent-invoked
+   * tool (minutes, on a populated bank). This used to default to 120s, which silently overrode the
+   * tool's configured window and aborted every high-budget synthesis mid-flight (#3590).
+   */
+  async reflect(query, opts) {
+    const result = await readAcrossBanks(this.transport, "reflect", { query, budget: opts.budget ?? "high" }, { timeoutMs: opts.timeoutMs, maxTokens: 4096 });
+    if (result.failedBanks.length === this.visibleBanks().length) {
+      throw new ReflectError("reflection unavailable for all assigned banks", 503, false);
+    }
+    if (result.partial) this.log("partial memory read: assigned bank unavailable");
+    return result.results.map((item) => item.text ?? item.content ?? "").join("\n\n");
+  }
+  /**
+   * Raw recall with no LLM in the loop, so it still answers when reflect's synthesis times out or
+   * 5xxs. The body is `recallOptions` (consolidated observations by default) — a bank that grows
+   * no observations widens it rather than getting nothing back. Returns the texts in rank order.
+   *
+   * The name predates `recallOptions` (the observation type used to be hardcoded here) and is
+   * kept deliberately: this is the client's published surface, so renaming it would break
+   * importers for a cosmetic gain. The doc above is the contract, not the name.
+   */
+  async recallObservations(query, opts) {
+    const r = await this.req(
+      "POST",
+      this.bankUrl("/memories/recall"),
+      // `query` is applied AFTER the spread: everything else is the caller's to override, but a
+      // config that could replace the goal with a fixed string would silently recall for the
+      // wrong question on every turn.
+      { ...this.recallOptions, query },
+      [],
+      opts.timeoutMs
+    );
+    if (r.status === 404) return [];
+    const j = await r.json();
+    return (j.results ?? []).map((x) => (x.text ?? "").trim()).filter(Boolean);
+  }
+  /**
+   * Latch `knowledgePagesSupported = false` iff this response really means the endpoint is absent.
+   * Returns whether it latched. A bank-not-found 404 is NOT a capability verdict — it is the
+   * expected answer before the bank's first retain — so it must never cache a negative (#4607).
+   *
+   * Only 404 is tested: `req` throws on every other non-ok status it was not told to tolerate, so
+   * the 405/501 this used to check for never reach a caller in the first place.
+   */
+  async pagesUnsupported(r) {
+    if (r.status !== 404 || !await isEndpointMissing(r)) return false;
+    this.knowledgePagesSupported = false;
+    return true;
+  }
+  /**
+   * The bank's knowledge-base tree (folders + pages, nested). The tree carries names, source
+   * queries and staleness but NOT synthesized content, so it is cheap enough to poll.
+   */
+  async tree() {
+    if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
+    const r = await this.req("GET", this.bankUrl("/knowledge-base/tree"));
+    if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
+    if (r.status === 404) return [];
+    this.knowledgePagesSupported = true;
+    try {
+      return (await r.json()).roots ?? [];
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * List knowledge pages (ids + names only — no synthesized content), flattened out of the tree
+   * and shaped as `{items:[…]}` for `parsePageList`. Folders are dropped: they carry no content
+   * to read, and a caller enumerating pages wants leaves, not structure.
+   *
+   * NOTE the ids are knowledge-base node ids (`kp-…`), NOT the backing mental-model ids. Every
+   * page read/update in this client goes through the same knowledge-base ids, so a page id from
+   * here, from `searchKnowledgePages`, or from a `[[page:<id>]]` link all resolve identically.
+   */
+  async listPages() {
+    const items = [];
+    const walk = (nodes, folder) => {
+      for (const n of nodes) {
+        if (!n?.id || !n?.name) continue;
+        if (n.kind === "page") {
+          items.push({
+            id: n.id,
+            name: n.name,
+            ...n.description ? { description: n.description } : {},
+            ...folder ? { folder } : {}
+          });
+        }
+        if (n.children?.length) walk(n.children, n.kind === "folder" ? n.name : folder);
+      }
+    };
+    walk(await this.tree());
+    return { items };
+  }
+  /**
+   * Read one knowledge page's synthesized content by knowledge-base id, shaped by `shapePage` so
+   * the body arrives once. The endpoint omits the internal reflect trace that built
+   * the page — that is 70-95% of the raw bytes and can blow past an MCP host's per-tool-result
+   * token cap.
+   */
+  async getPage(pageId) {
+    if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
+    const r = await this.req(
+      "GET",
+      this.bankUrl(`/knowledge-base/pages/${encodeURIComponent(pageId)}`)
+    );
+    if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
+    return shapePage(await r.json());
+  }
+  /** Hybrid (BM25 + vector, RRF-fused) server-side search over the bank's knowledge pages.
+   *  Returns page-level hits with a relevance snippet — the real search behind
+   *  hindsight_search_knowledge_pages. */
+  async searchKnowledgePages(query, opts = {}) {
+    if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
+    const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
+    const r = await this.req(
+      "GET",
+      this.bankUrl(`/knowledge-base/search${q}`),
+      void 0,
+      [],
+      opts.timeoutMs
+    );
+    if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
+    if (r.status === 404) return [];
+    const j = await r.json();
+    return (j.results ?? []).map((x) => ({
+      id: x.id,
+      name: x.name,
+      ...x.source_query ? { source_query: x.source_query } : {},
+      snippet: x.snippet ?? "",
+      score: x.score ?? 0
+    }));
+  }
+  /**
+   * Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
+   *
+   * Matched by NAME, not id: `/knowledge-base/pages` mints its own `kp-…` id, so a stable
+   * client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
+   * off a slug). Names are unique per folder server-side, which makes them a sound key.
+   *
+   * An existing page is PATCHed rather than recreated so a plugin upgrade that rewords a
+   * `source_query` re-syncs onto the live page instead of orphaning its synthesized content —
+   * which is how `pageScopeRule`'s repo name reaches banks seeded by an earlier version.
+   */
+  async seedPages(pageTrigger = buildPageTrigger(), pagesConfig = {}, customPages = {}) {
+    const pages = pagesFor(this.project, pagesConfig, customPages);
+    const existing = /* @__PURE__ */ new Map();
+    let roots;
+    try {
+      roots = await this.tree();
+    } catch (e) {
+      if (e instanceof KnowledgePagesUnavailableError) {
+        this.log(`[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`);
+        return;
+      }
+      throw e;
+    }
+    for (const n of roots) {
+      if (n.kind === "page" && n.name) existing.set(n.name.toLowerCase(), n);
+    }
+    let created = 0;
+    let updated = 0;
+    let vanished = 0;
+    for (const page of pages) {
+      const hit = existing.get(page.name.toLowerCase());
+      const body = {
+        name: page.name,
+        source_query: page.source_query,
+        tags: page.tags,
+        max_tokens: PAGE_MAX_TOKENS,
+        // Resolved HERE, not in `buildPageTrigger`: a hashed cron (`H`) needs the page's identity,
+        // and one trigger is built per session for all of them.
+        trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
+      };
+      if (!hit) {
+        const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), body, [409]);
+        if (await this.pagesUnsupported(r)) {
+          this.log(
+            `[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
+          );
+          return;
+        }
+        if (r.status === 404) {
+          this.log(`[bank] ${this.bank} does not exist yet; pages seed on the next session`);
+          return;
+        }
+        if (r.status !== 409) created++;
+      } else {
+        const sourceDrift = hit.description !== page.source_query;
+        const triggerDrift = hit.trigger != null && pageTriggerDrifted(hit.trigger, body.trigger);
+        if (!sourceDrift && !triggerDrift) continue;
+        const patch = {};
+        if (sourceDrift) {
+          patch.source_query = page.source_query;
+          patch.tags = page.tags;
+          this.log(
+            `[bank] re-syncing "${page.name}" to its configured source_query \u2014 set pages[${JSON.stringify(page.name)}].source_query to keep your own wording`
+          );
+        }
+        if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
+        const r = await this.req(
+          "PATCH",
+          this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(hit.id)}`),
+          patch
+        );
+        if (await this.pagesUnsupported(r)) {
+          this.log(
+            `[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
+          );
+          return;
+        }
+        if (r.status === 404) {
+          vanished++;
+          continue;
+        }
+        updated++;
+      }
+    }
+    const initiatives = await this.resyncInitiativeTriggers(roots, pageTrigger);
+    this.log(
+      `[bank] knowledge pages seeded on ${this.bank} (scoped to ${this.project ?? "the shared bank"}): ${created} created, ${updated} re-synced, ${pages.length - created - updated - vanished} unchanged` + (vanished ? `, ${vanished} deleted under us` : "") + (initiatives ? `, ${initiatives} initiative pages re-synced` : "")
+    );
+  }
+  /**
+   * Bring the captured initiative pages onto the same refresh policy as the seeded taxonomy.
+   *
+   * `captureInitiative` stamps this very trigger when it creates a page, so on a bank seeded under
+   * an older default they are the same drift as the taxonomy — and on a real repo they are most of
+   * it: five taxonomy pages against one page per initiative, each an LLM synthesis per
+   * consolidation under the auto-refresh that used to be the default (#3506).
+   *
+   * Their `name` and `source_query` are written once, from the initiative's own title, and
+   * re-stating either would rebuild a page whose question never changed. The one exception is
+   * the scope clause: a page captured while the clause named the BANK is scoped to a project no
+   * memory is about and comes out empty (#4490), so exactly that clause is swapped for the current
+   * one — the rest of the query, the user's wording included, is kept. The tree read above is
+   * reused rather than re-fetched.
+   */
+  async resyncInitiativeTriggers(roots, pageTrigger) {
+    const folder = roots.find(
+      (n) => n.kind === "folder" && (n.name || "").toLowerCase() === "initiatives"
+    );
+    const bankScope = pageScopeRule(this.bank);
+    let updated = 0;
+    for (const page of folder?.children ?? []) {
+      if (page.kind !== "page") continue;
+      const patch = {};
+      const query = page.description?.replace(bankScope, pageScopeRule(this.project));
+      if (query !== page.description) patch.source_query = query;
+      if (page.trigger != null) {
+        const desired = pageTriggerFor(pageTrigger, this.bank, page.name);
+        if (pageTriggerDrifted(page.trigger, desired)) patch.trigger = pageTriggerPatch(desired);
+      }
+      if (!patch.trigger && !patch.source_query) continue;
+      const r = await this.req(
+        "PATCH",
+        this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(page.id)}`),
+        patch
+      );
+      if (r.status === 404) continue;
+      updated++;
+    }
+    return updated;
+  }
+  /** URL/id-safe slug: lowercase, non-alphanumerics → "-", trim dashes, cap length; fallback "initiative". */
+  slugify(s) {
+    return s.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/(?:^-+)|(?:-+$)/g, "").slice(0, 60) || "initiative";
+  }
+  /**
+   * Active-path capture: register a major feature as a per-initiative page + a marker memory.
+   * New initiative → creates a page under the Initiatives folder.
+   * Update (relatesToPageId) → no new page; only a marker accruing to the existing page, so an
+   * enhancement or a mid-work plan change lands on the initiative it belongs to.
+   *
+   * The marker carries its page id in two places, neither of them a tag (#3641):
+   * `metadata.relatedPageId` for provenance (visible on the document, and to a reflect loop that
+   * expands one), and a `[[page:<id>]]` link in the retain CONTEXT, which is the only one of the
+   * three channels a page synthesis actually reads — reflect's search results keep `context` and
+   * `tags` but strip `metadata` (`_UNREAD_RESULT_FIELDS`), and the id has no business in a tag
+   * vocabulary that exists to be matched with exact set-ops.
+   */
+  async captureInitiative(args) {
+    let pageId = args.relatesToPageId;
+    if (!pageId) {
+      const folderId = await this.ensureFolder("Initiatives");
+      const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), {
+        name: args.title,
+        source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
+        parent_id: folderId,
+        tags: ["knowledge:feature-work"],
+        max_tokens: PAGE_MAX_TOKENS,
+        trigger: pageTriggerFor(args.pageTrigger ?? buildPageTrigger(), this.bank, args.title)
+      });
+      try {
+        const j = await r.json();
+        pageId = j.page_id ?? j.id;
+      } catch {
+      }
+      pageId ||= `initiative-${this.slugify(args.title)}`;
+    }
+    const verb = args.relatesToPageId ? "Update to an existing initiative" : "New initiative";
+    const content = `${verb}: ${args.title}. ${args.summary}`;
+    const markerId = `initiative-marker-${this.slugify(pageId)}${args.relatesToPageId ? "-update" : ""}`;
+    const tags = [.../* @__PURE__ */ new Set([...args.stamp?.tags ?? [], "knowledge:feature-work"])];
+    const context = `initiative marker for [[page:${pageId}]]`;
+    await this.retain(content, context, markerId, tags, "document", {
+      metadata: { ...args.stamp?.metadata ?? {}, relatedPageId: pageId }
+    });
+    return { page_id: pageId };
+  }
+  /** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
+  async ensureFolder(name) {
+    try {
+      const tree = await (await this.req("GET", this.bankUrl("/knowledge-base/tree"))).json();
+      const hit = (tree.roots || []).find(
+        (n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
+      );
+      if (hit?.id) return hit.id;
+    } catch (error) {
+      if (error instanceof AccessDeniedError) throw error;
+    }
+    try {
+      const r = await this.req("POST", this.bankUrl("/knowledge-base/folders"), { name });
+      return (await r.json()).id;
+    } catch (error) {
+      if (error instanceof AccessDeniedError) throw error;
+      return void 0;
+    }
+  }
+};
+
+// src/core/config.ts
+var CONFIG_PATH = process.env.HINDSIGHT_CONFIG || join7(homedir3(), ".hindsight", "coding-agent.json");
+var DEFAULT_DAEMON_PORT = 9077;
+var DEFAULT_DAEMON_PROFILE = "coding-agent";
+function resolvePageTrigger(raw) {
+  if (raw.pageTriggerType === "manual") return { type: "manual" };
+  if (raw.pageTriggerType === "auto-refresh") return { type: "auto-refresh" };
+  if (raw.pageTriggerType !== void 0 && raw.pageTriggerType !== "cron")
+    log.warn(
+      "config",
+      "ignoring invalid pageTriggerType \u2014 expected cron|auto-refresh|manual"
+    );
+  const cron = raw.pageTriggerCron?.trim();
+  if (!cron) return { type: "cron", cron: DEFAULT_PAGE_TRIGGER_CRON };
+  if (!isHashedCron(cron) || parseHashedCron(cron)) return { type: "cron", cron };
+  log.warn(
+    "config",
+    `pageTriggerCron has a malformed hashed field \u2014 write \`H\` or \`H(<lo>-<hi>)\` within the field's own range, e.g. "H H(0-5) * * *" \u2014 falling back to ${JSON.stringify(DEFAULT_PAGE_TRIGGER_CRON)}`
+  );
+  return { type: "cron", cron: DEFAULT_PAGE_TRIGGER_CRON };
+}
+function resolvePages(raw) {
+  const value = raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [name, entry] of Object.entries(value)) {
+    if (!PAGE_NAMES.some((known) => known.toLowerCase() === name.trim().toLowerCase())) {
+      log.warn(
+        "config",
+        `ignoring unknown pages entry \u2014 no seeded page has that name; expected one of: ${PAGE_NAMES.join(", ")}`
+      );
+      continue;
+    }
+    if (entry === false) {
+      out[name] = false;
+      continue;
+    }
+    const query = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.source_query : void 0;
+    if (typeof query === "string" && query.trim()) {
+      out[name] = { source_query: query };
+      continue;
+    }
+    log.warn(
+      "config",
+      'ignoring invalid pages entry \u2014 expected false, or {"source_query": "<your question>"}'
+    );
+  }
+  return out;
+}
+function resolveCustomPages(raw) {
+  const value = raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [rawName, entry] of Object.entries(value)) {
+    const name = rawName.trim();
+    if (!name) continue;
+    if (PAGE_NAMES.some((known) => known.toLowerCase() === name.toLowerCase())) {
+      log.warn(
+        "config",
+        "ignoring customPages entry with a seeded page name; reword it under `pages` instead"
+      );
+      continue;
+    }
+    const query = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.source_query : void 0;
+    if (typeof query !== "string" || !query.trim()) {
+      log.warn(
+        "config",
+        'ignoring invalid customPages entry \u2014 expected {"source_query": "<your question>"}'
+      );
+      continue;
+    }
+    const rawTags = entry.tags;
+    const tags = Array.isArray(rawTags) ? rawTags.filter((t) => typeof t === "string" && t.trim() !== "") : [];
+    out[name] = tags.length ? { source_query: query, tags } : { source_query: query };
+  }
+  return out;
+}
+var DEFAULT_REFLECT_TIMEOUT_MS = 2e4;
+var DEFAULT_REFLECT_TOOL_TIMEOUT_MS = 33e4;
+var DEFAULT_INJECT_TIMEOUT_MS = 7e3;
+var REFLECT_BUDGETS = ["low", "mid", "high"];
+function resolveReflectBudget(raw) {
+  const value = raw.reflectBudget;
+  if (value === void 0) return "high";
+  if (typeof value === "string" && REFLECT_BUDGETS.includes(value))
+    return value;
+  log.warn("config", "ignoring invalid reflectBudget \u2014 expected low|mid|high");
+  return "high";
+}
+var OBSERVATION_SCOPE_MODES = [
+  "shared",
+  "combined",
+  "per_tag",
+  "all_combinations",
+  "per_source"
+];
+function resolveObservationScopes(raw) {
+  const value = raw;
+  if (typeof value === "string")
+    return OBSERVATION_SCOPE_MODES.includes(value) ? value : DEFAULT_OBSERVATION_SCOPES;
+  if (Array.isArray(value)) {
+    const scopes = value.filter((scope) => Array.isArray(scope)).map((scope) => scope.filter((t) => typeof t === "string" && t.trim() !== ""));
+    if (scopes.length) return scopes;
+  }
+  return DEFAULT_OBSERVATION_SCOPES;
+}
+function resolveDefaultBankConfig(raw) {
+  const value = raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [key, v] of Object.entries(value)) {
+    if (PLUGIN_GOVERNED_BANK_FIELDS.includes(key)) {
+      log.warn(
+        "config",
+        `ignoring defaultBankConfig.${key} \u2014 the plugin manages this field itself` + (key === "retain_extraction_mode" ? " (set retainExtractionMode instead)" : "")
+      );
+      continue;
+    }
+    out[key] = v;
+  }
+  return out;
+}
+var AUTO_INJECT_MODES = ["reflect", "pages", "recall", "none"];
+function resolveAutoInject(raw) {
+  if (raw.autoReflect !== void 0) {
+    const replacement = raw.autoReflect === false ? "none" : "reflect";
+    log.warn("config", `autoReflect is deprecated \u2014 use autoInject: "${replacement}" instead`);
+  }
+  if (AUTO_INJECT_MODES.includes(raw.autoInject)) return raw.autoInject;
+  return raw.autoReflect === false ? "none" : "reflect";
+}
+function resolveConfig(raw = {}) {
+  const serverMode = ["cloud", "self-hosted", "daemon"].includes(raw.serverMode) ? raw.serverMode : "self-hosted";
+  const apiPort = raw.apiPort || DEFAULT_DAEMON_PORT;
+  const pageTrigger = resolvePageTrigger(raw);
+  return {
+    serverMode,
+    // Only loadConfig can supply the operator-managed router endpoint.
+    apiUrl: raw.apiUrl ?? "",
+    apiToken: raw.apiToken || void 0,
+    apiPort,
+    daemonIdleTimeout: raw.daemonIdleTimeout,
+    daemonProfile: raw.daemonProfile || DEFAULT_DAEMON_PROFILE,
+    embedVersion: raw.embedVersion || void 0,
+    embedPackagePath: raw.embedPackagePath || void 0,
+    bankId: raw.bankId,
+    dynamicBankId: raw.dynamicBankId,
+    bankIdTemplate: raw.bankIdTemplate,
+    mapPathToBank: raw.mapPathToBank,
+    resolveWorktrees: raw.resolveWorktrees,
+    optInOnly: raw.optInOnly ?? false,
+    // Same shape as retainTags: a config typo must not become a path that silently approves nothing.
+    optInPaths: Array.isArray(raw.optInPaths) ? raw.optInPaths.filter((p) => typeof p === "string" && p.trim() !== "") : [],
+    harness: raw.harness ?? "opencode",
+    disabled: raw.disabled ?? false,
+    retainSessions: raw.retainSessions ?? true,
+    // write sessions back by default, every harness
+    manageBankConfig: raw.manageBankConfig ?? true,
+    retainExtractionMode: RETAIN_EXTRACTION_MODES.includes(raw.retainExtractionMode) ? raw.retainExtractionMode : DEFAULT_RETAIN_EXTRACTION_MODE,
+    defaultBankConfig: resolveDefaultBankConfig(raw.defaultBankConfig),
+    maxParallelRetains: raw.maxParallelRetains || 10,
+    reflectTimeoutMs: raw.reflectTimeoutMs || DEFAULT_REFLECT_TIMEOUT_MS,
+    // Inherit an explicitly-raised reflectTimeoutMs (that is what users reaching for a longer
+    // reflect already set), but never let it LOWER the tool below the default — a short window is
+    // set to bound the automatic hook, not to cut off a call the agent is waiting on.
+    reflectToolTimeoutMs: raw.reflectToolTimeoutMs || Math.max(raw.reflectTimeoutMs || 0, DEFAULT_REFLECT_TOOL_TIMEOUT_MS),
+    injectTimeoutMs: raw.injectTimeoutMs || DEFAULT_INJECT_TIMEOUT_MS,
+    reflectBudget: resolveReflectBudget(raw),
+    autoInject: resolveAutoInject(raw),
+    pageSearchLimit: raw.pageSearchLimit || DEFAULT_PAGE_SEARCH_LIMIT,
+    // Same shape as retainMetadata: an object, or nothing. An array would spread into numeric
+    // keys and reach the API as garbage, so it is rejected like any other non-object.
+    recallOptions: raw.recallOptions && typeof raw.recallOptions === "object" && !Array.isArray(raw.recallOptions) ? { ...raw.recallOptions } : {},
+    toolGuideExtra: typeof raw.toolGuideExtra === "string" && raw.toolGuideExtra.trim() ? raw.toolGuideExtra : void 0,
+    // Every turn, not every tenth. The guide is what tells the agent WHEN to reach for memory, and
+    // at a cadence of 10 a normal session is told once, on turn 1, and never again. Measured over
+    // 40 real Claude Code turns, moving this from 10 to 1 took searches from 15% of turns to 32.5%
+    // with no wording change at all. The cost is the guide's ~2KB re-sent per turn, which caches.
+    pageRefreshEveryTurns: raw.pageRefreshEveryTurns || 1,
+    pageTriggerType: pageTrigger.type,
+    pageTriggerCron: pageTrigger.cron,
+    pages: resolvePages(raw.pages),
+    customPages: resolveCustomPages(raw.customPages),
+    autoSeed: raw.autoSeed ?? true,
+    seedLimit: raw.seedLimit || DEFAULT_SEED_LIMIT,
+    codebaseSurvey: raw.codebaseSurvey ?? true,
+    surveyModel: raw.surveyModel || "haiku",
+    surveyBudgetUsd: raw.surveyBudgetUsd || 2,
+    surveyRefreshCommits: raw.surveyRefreshCommits ?? 20,
+    gitIngest: ["message", "full", "none"].includes(raw.gitIngest) ? raw.gitIngest : "message",
+    // Hostile input is a config typo, not an attack: keep only string entries so a stray number or
+    // nested object cannot reach the API as a tag and fail the whole retain.
+    retainTags: Array.isArray(raw.retainTags) ? raw.retainTags.filter((t) => typeof t === "string" && t.trim() !== "") : [],
+    // Undefined, not "", when unset or blank: the retain call distinguishes "not configured" (use
+    // the built-in default) from a configured value, and an empty context would strip the default.
+    retainContext: typeof raw.retainContext === "string" && raw.retainContext.trim() !== "" ? raw.retainContext : void 0,
+    retainMetadata: raw.retainMetadata && typeof raw.retainMetadata === "object" ? Object.fromEntries(
+      Object.entries(raw.retainMetadata).filter(([, v]) => typeof v === "string")
+    ) : {},
+    observationScopes: resolveObservationScopes(raw.observationScopes),
+    banks: raw.banks && typeof raw.banks === "object" ? raw.banks : {},
+    paths: raw.paths && typeof raw.paths === "object" ? raw.paths : {},
+    logLevel: ["debug", "info", "warn", "error"].includes(raw.logLevel) ? raw.logLevel : "info",
+    autoUpdate: raw.autoUpdate ?? true
+  };
+}
+function readRaw(path) {
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch (e) {
+    if (e?.code !== "ENOENT") {
+      console.error(`hindsight: ignoring invalid config at ${path}: ${e?.message || e}`);
+    }
+    return {};
+  }
+}
+function mergeRaw(a, b) {
+  const { harnesses: _drop, ...flat } = b;
+  return {
+    ...a,
+    ...flat,
+    banks: { ...a.banks ?? {}, ...b.banks ?? {} },
+    paths: { ...a.paths ?? {}, ...b.paths ?? {} }
+  };
+}
+function applyLayer(raw, layer, harness) {
+  let out = mergeRaw(raw, layer);
+  const perHarness = harness ? layer.harnesses?.[harness] : void 0;
+  if (perHarness) out = mergeRaw(out, perHarness);
+  return out;
+}
+var ENV_KEYS = {
+  serverMode: "HINDSIGHT_SERVER_MODE",
+  apiUrl: "HINDSIGHT_API_URL",
+  apiToken: "HINDSIGHT_API_TOKEN",
+  // These four keep the names the old per-agent Claude Code plugin used, so a user migrating from
+  // it can carry their existing environment over unchanged.
+  apiPort: "HINDSIGHT_API_PORT",
+  daemonIdleTimeout: "HINDSIGHT_DAEMON_IDLE_TIMEOUT",
+  embedVersion: "HINDSIGHT_EMBED_VERSION",
+  embedPackagePath: "HINDSIGHT_EMBED_PACKAGE_PATH",
+  daemonProfile: "HINDSIGHT_DAEMON_PROFILE",
+  bankId: "HINDSIGHT_BANK_ID",
+  dynamicBankId: "HINDSIGHT_DYNAMIC_BANK_ID",
+  bankIdTemplate: "HINDSIGHT_BANK_ID_TEMPLATE",
+  resolveWorktrees: "HINDSIGHT_RESOLVE_WORKTREES",
+  optInOnly: "HINDSIGHT_OPT_IN_ONLY",
+  optInPaths: "HINDSIGHT_OPT_IN_PATHS",
+  harness: "HINDSIGHT_HARNESS",
+  disabled: "HINDSIGHT_DISABLED",
+  retainSessions: "HINDSIGHT_RETAIN_SESSIONS",
+  maxParallelRetains: "HINDSIGHT_MAX_PARALLEL_RETAINS",
+  reflectTimeoutMs: "HINDSIGHT_REFLECT_TIMEOUT_MS",
+  reflectToolTimeoutMs: "HINDSIGHT_REFLECT_TOOL_TIMEOUT_MS",
+  injectTimeoutMs: "HINDSIGHT_INJECT_TIMEOUT_MS",
+  reflectBudget: "HINDSIGHT_REFLECT_BUDGET",
+  autoInject: "HINDSIGHT_AUTO_INJECT",
+  pageSearchLimit: "HINDSIGHT_PAGE_SEARCH_LIMIT",
+  toolGuideExtra: "HINDSIGHT_TOOL_GUIDE_EXTRA",
+  autoReflect: "HINDSIGHT_AUTO_REFLECT",
+  pageRefreshEveryTurns: "HINDSIGHT_PAGE_REFRESH_EVERY_TURNS",
+  pageTriggerType: "HINDSIGHT_PAGE_TRIGGER_TYPE",
+  pageTriggerCron: "HINDSIGHT_PAGE_TRIGGER_CRON",
+  autoSeed: "HINDSIGHT_AUTO_SEED",
+  seedLimit: "HINDSIGHT_SEED_LIMIT",
+  codebaseSurvey: "HINDSIGHT_CODEBASE_SURVEY",
+  surveyModel: "HINDSIGHT_SURVEY_MODEL",
+  surveyBudgetUsd: "HINDSIGHT_SURVEY_BUDGET_USD",
+  surveyRefreshCommits: "HINDSIGHT_SURVEY_REFRESH_COMMITS",
+  logLevel: "HINDSIGHT_LOG_LEVEL",
+  autoUpdate: "HINDSIGHT_AUTO_UPDATE",
+  gitIngest: "HINDSIGHT_GIT_INGEST",
+  // Scalar modes only ("shared", "combined", "per_tag", "all_combinations"). An explicit scope
+  // list is a list OF lists, which does not survive flattening into one variable — file-only.
+  observationScopes: "HINDSIGHT_OBSERVATION_SCOPES",
+  // Comma-separated, e.g. HINDSIGHT_RETAIN_TAGS="project:{gitProject},env:work". A LIST rather than
+  // a map, so it flattens cleanly; its sibling retainMetadata stays file-only for the reason above.
+  retainTags: "HINDSIGHT_RETAIN_TAGS",
+  manageBankConfig: "HINDSIGHT_MANAGE_BANK_CONFIG",
+  retainExtractionMode: "HINDSIGHT_RETAIN_EXTRACTION_MODE"
+};
+var ENV_BOOLEANS = /* @__PURE__ */ new Set([
+  "dynamicBankId",
+  "resolveWorktrees",
+  "optInOnly",
+  "disabled",
+  "retainSessions",
+  "autoReflect",
+  "autoSeed",
+  "codebaseSurvey",
+  "autoUpdate",
+  "manageBankConfig"
+]);
+var ENV_LISTS = /* @__PURE__ */ new Set(["retainTags", "optInPaths"]);
+var ENV_NUMBERS = /* @__PURE__ */ new Set([
+  "apiPort",
+  "daemonIdleTimeout",
+  "maxParallelRetains",
+  "reflectTimeoutMs",
+  "reflectToolTimeoutMs",
+  "injectTimeoutMs",
+  "pageSearchLimit",
+  "pageRefreshEveryTurns",
+  "seedLimit",
+  "surveyBudgetUsd",
+  "surveyRefreshCommits"
+]);
+function readEnvConfig(env = process.env) {
+  const out = {};
+  for (const [key, name] of Object.entries(ENV_KEYS)) {
+    const value = env[name];
+    if (value === void 0 || value.trim() === "") continue;
+    if (ENV_BOOLEANS.has(key)) {
+      out[key] = ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+    } else if (ENV_LISTS.has(key)) {
+      const items = value.split(",").map((v) => v.trim()).filter(Boolean);
+      if (items.length) out[key] = items;
+    } else if (ENV_NUMBERS.has(key)) {
+      const n = Number(value);
+      if (Number.isFinite(n)) out[key] = n;
+      else console.error(`hindsight: ignoring ${name}=${value} \u2014 not a number`);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function loadConfig(opts = {}) {
+  const o = typeof opts === "string" ? { path: opts } : opts;
+  const withEnv = applyLayer({}, readEnvConfig(), o.harness);
+  const raw = applyLayer(withEnv, readRaw(o.path ?? CONFIG_PATH), o.harness);
+  if (!raw.harness && o.harness) raw.harness = o.harness;
+  const managed = managedSettings(o.harness);
+  if (raw.apiUrl !== void 0 && raw.apiUrl.replace(/\/+$/, "") !== managed.apiUrl || raw.serverMode !== void 0 && raw.serverMode !== "self-hosted") throw new AccessDeniedError();
+  return { ...resolveConfig(raw), ...managed };
+}
+var BANK_OVERRIDE_EXCLUDED = [
+  "bankId",
+  "bankIdTemplate",
+  "mapPathToBank",
+  "dynamicBankId",
+  "resolveWorktrees",
+  // Approval is decided BEFORE the bank is resolved, so a `banks.<id>` section naming these could
+  // only ever arrive too late to matter — strip them rather than let them read as effective.
+  "optInOnly",
+  "optInPaths",
+  "harness",
+  "routerHarness",
+  "toolPrefix",
+  "apiUrl",
+  "apiToken",
+  "serverMode",
+  "autoUpdate"
+];
+function applyBankConfig(cfg2, resolvedId, directory) {
+  if (directory !== void 0 && !isOptedIn(cfg2, directory))
+    return { cfg: { ...cfg2, ...managedSettings(cfg2.routerHarness), disabled: true }, bankId: resolvedId };
+  const byPath = directory === void 0 ? void 0 : pathSection(cfg2, cfg2.paths, directory);
+  if (byPath) {
+    const { bank: _rename, ...rest } = overrideFields(byPath);
+    cfg2 = { ...cfg2, ...resolvePartial(cfg2, rest) };
+  }
+  const section = cfg2.banks[resolvedId];
+  if (!section) return { cfg: { ...cfg2, ...managedSettings(cfg2.routerHarness) }, bankId: resolvedId };
+  const safe = overrideFields(section);
+  const bankId = resolvedId;
+  delete safe.bank;
+  return { cfg: { ...cfg2, ...resolvePartial(cfg2, safe), ...managedSettings(cfg2.routerHarness) }, bankId };
+}
+function overrideFields(section) {
+  const safe = { ...section };
+  for (const k of BANK_OVERRIDE_EXCLUDED) delete safe[k];
+  delete safe.banks;
+  delete safe.paths;
+  return safe;
+}
+function resolvePartial(cfg2, patch) {
+  const full = resolveConfig(patch);
+  const out = {};
+  for (const key of Object.keys(patch)) {
+    if (key in full)
+      out[key] = full[key];
+  }
+  if ("autoReflect" in patch && !("autoInject" in patch)) out.autoInject = full.autoInject;
+  if ("serverMode" in patch || "apiUrl" in patch || "apiPort" in patch) {
+    const conn = resolveConfig({
+      serverMode: patch.serverMode ?? cfg2.serverMode,
+      apiPort: patch.apiPort ?? cfg2.apiPort,
+      apiUrl: patch.apiUrl ?? (cfg2.serverMode === "daemon" ? void 0 : cfg2.apiUrl)
+    });
+    out.serverMode = conn.serverMode;
+    out.apiUrl = conn.apiUrl;
+    out.apiPort = conn.apiPort;
+  }
+  return out;
+}
+
+// src/core/status.ts
+import { execFileSync as execFileSync3 } from "child_process";
+
+// src/core/git.ts
+import { execFileSync } from "child_process";
+import { resolve as resolve3 } from "path";
+function git(repo, ...args) {
+  return execFileSync("git", ["-C", repo, "-c", "log.showSignature=false", ...args], {
+    encoding: "utf8",
+    maxBuffer: 1 << 28,
+    windowsHide: true,
+    // execFileSync otherwise forwards failed git stderr into the host's TUI,
+    // even when callers catch the error. Keep diagnostics on the error instead.
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function repoNameOf(repo) {
+  return projectNameOf(resolve3(repo));
+}
+function commitsSince(dir, sinceSha) {
+  if (!/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/.test(sinceSha)) return null;
+  try {
+    const n = Number.parseInt(git(dir, "rev-list", "--count", `${sinceSha}..HEAD`).trim(), 10);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/core/knowledge-injection.ts
+function parsePageList(raw) {
+  const items = raw?.items;
+  if (!Array.isArray(items)) return [];
+  const out = [];
+  for (const it of items) {
+    const id = it?.id;
+    const name = it?.name;
+    if (typeof id === "string" && typeof name === "string") out.push({ id, title: name });
+  }
+  return out;
+}
+
+// src/core/survey.ts
+import { execFileSync as execFileSync2, spawn as realSpawn3 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir4, tmpdir } from "os";
+import { dirname as dirname5, join as join9 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+
+// src/core/survey-lease.ts
+import { spawn as realSpawn2 } from "child_process";
+import { randomUUID } from "crypto";
+import {
+  mkdirSync as mkdirSync2,
+  mkdtempSync,
+  readdirSync,
+  renameSync as renameSync2,
+  rmdirSync,
+  rmSync,
+  statSync as statSync2,
+  unlinkSync,
+  utimesSync,
+  writeFileSync
+} from "fs";
+import { join as join8 } from "path";
+
+// src/core/survey.ts
+var SURVEY_DOC_IDS = [
+  "repository-component-map",
+  "repository-core-concepts",
+  "repository-conventions-and-patterns",
+  "repository-tech-stack-and-features"
+];
+
+// src/core/status.ts
+function unavailable(error) {
+  if (isAuthorizationError(error)) throw error;
+  return null;
+}
+var DEEPEN_DIFF_TARGET = 300;
+function commitCount(repoDir) {
+  try {
+    const out = execFileSync3("git", ["-C", repoDir, "rev-list", "--count", "HEAD"], {
+      encoding: "utf8",
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"]
+      // failed probes must not write into the host TUI
+    });
+    return Number(out.trim()) || 0;
+  } catch {
+    return null;
+  }
+}
+async function syncStatus(client2, bank, repoDir) {
+  const gitIds = await client2.listDocumentIds("source:git", "all_strict");
+  const chatIds = await client2.listDocumentIds("source:chat", "all_strict").catch((error) => {
+    unavailable(error);
+    return /* @__PURE__ */ new Set();
+  });
+  const pages = parsePageList(await client2.listPages().catch(unavailable));
+  const activeOps = await client2.activeOperations().catch(unavailable);
+  const uploads = await client2.listDocumentIds("source:upload", "all_strict").catch((error) => {
+    unavailable(error);
+    return /* @__PURE__ */ new Set();
+  });
+  const surveyDocs = SURVEY_DOC_IDS.filter((id) => uploads.has(id)).length;
+  let surveyBaseline = null;
+  let surveyCommitsBehind = null;
+  if (repoDir) {
+    try {
+      const markers = await client2.listDocumentIds("source:survey-baseline", "all_strict");
+      let best;
+      for (const id of markers) {
+        const sha = id.replace(/^survey-baseline:/, "");
+        const behind = commitsSince(repoDir, sha);
+        if (behind !== null && (!best || behind < best.behind)) best = { sha, behind };
+      }
+      if (best) {
+        surveyBaseline = best.sha;
+        surveyCommitsBehind = best.behind;
+      }
+    } catch (error) {
+      unavailable(error);
+    }
+  }
+  const repoName = repoDir ? repoNameOf(repoDir) : void 0;
+  const gitlogPresent = repoName ? gitIds.has(`gitlog:${repoName}`) : [...gitIds].some((id) => id.startsWith("gitlog:"));
+  const gitDiffDocs = [...gitIds].filter((id) => id.startsWith("git:")).length;
+  const commits = repoDir ? commitCount(repoDir) : null;
+  const gitDiffTarget = commits === null ? null : Math.min(DEEPEN_DIFF_TARGET, commits);
+  return {
+    bank,
+    gitlogPresent,
+    gitDiffDocs,
+    gitDiffTarget,
+    chatDocs: chatIds.size,
+    pagesCount: pages.length,
+    surveyBaseline,
+    surveyDocs,
+    surveyCommitsBehind,
+    activeOps,
+    // Older Hindsight servers have no page surface. They are still fully usable for the
+    // legacy bank/retain pipeline, so page absence must not make syncStatus permanently false.
+    synced: gitlogPresent && (client2.knowledgePagesSupported === false || pages.length > 0) && activeOps === 0
+  };
+}
+
+// src/status.ts
+function arg(name) {
+  const i = process.argv.indexOf(`--${name}`);
+  if (i >= 0 && i + 1 < process.argv.length) return process.argv[i + 1];
+  return void 0;
+}
+var REPO = arg("repo");
+var cfg0 = loadConfig({ harness: arg("harness") ?? void 0, path: arg("config") });
+var BANK = arg("bank") ?? (REPO ? deriveBankIdOrSkip(cfg0, REPO, arg("harness") ?? cfg0.harness) : cfg0.bankId) ?? void 0;
+if (!BANK) {
+  console.error("usage: node status.js --repo <path> [--bank <id>] [--api-url U]");
+  process.exit(1);
+}
+var resolved0 = BANK ? applyBankConfig(cfg0, BANK, REPO) : { cfg: cfg0, bankId: BANK };
+var cfg = resolved0.cfg;
+var FINAL_BANK = resolved0.bankId ?? BANK;
+var client = new HindsightClient({
+  routerHarness: cfg.routerHarness,
+  apiUrl: cfg.apiUrl,
+  apiToken: arg("api-token") ?? cfg.apiToken,
+  bank: FINAL_BANK,
+  maxParallelRetains: cfg.maxParallelRetains,
+  observationScopes: cfg.observationScopes
+});
+syncStatus(client, FINAL_BANK, REPO).then((s) => console.log(JSON.stringify(s))).catch((e) => {
+  console.error("status failed:", e.message || e);
+  process.exit(1);
+});