@mickey-kras/hindsight-memory-router-coding-agents 0.8.9 → 0.8.14

package/dist/grok-stop-hook.js

@@ -36,12 +36,10 @@ function requireBank(access, bank, operation) {
 }
 function classifyOperation(method, suffix) {
   if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
-  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
-    suffix
-  ))
+  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
     return "read";
   if (method === "GET" && suffix === "") return "read";
-  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
     suffix
   ))
     return "write";
@@ -379,6 +377,54 @@ var RouterTransport = class {
 // ../../coding-agents/human-session.ts
 import { createHash as createHash2 } from "crypto";
 import { createRequire } from "module";
+
+// src/harness/names.ts
+var HARNESS_NAMES = [
+  "opencode",
+  // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
+  // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
+  "opencode2",
+  // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
+  // has NO hook binary — deliberately absent from HOOK_BINS below.
+  "kilo",
+  // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
+  "cline-cli",
+  // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
+  // Codex hook bridges are optional packages, so there is no hook binary to install either.
+  "dsh",
+  // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
+  // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
+  "pi",
+  "prime-agent",
+  "claude-code",
+  "cursor-cli",
+  "codex",
+  "dcode",
+  "antigravity-cli",
+  "devin-cli",
+  "copilot-cli",
+  "grok-build",
+  "qwen-code",
+  // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
+  // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
+  "factory-droid",
+  // ZCode is a per-prompt HOOK host too, registered in its own CLI config
+  // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
+  "zcode",
+  // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
+  "traecode",
+  "kimi-code",
+  // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
+  // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
+  "workbuddy",
+  // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
+  // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
+  // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
+  // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
+  "codebuddy"
+];
+
+// ../../coding-agents/human-session.ts
 var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
 var HumanLoginRequiredError = class extends AccessDeniedError {
   constructor() {
@@ -404,14 +450,14 @@ function humanRouterUrl(value) {
   if (url.search || url.hash) throw new HumanLoginRequiredError();
   return canonical2;
 }
-function secureEntry(routerUrl, credentialRef) {
+function secureEntry(routerUrl, credentialRef, harness) {
   try {
-    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
+    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
       throw new HumanLoginRequiredError();
     }
     const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
-    const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
-    return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
+    const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
+    return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
   } catch {
     throw new HumanLoginRequiredError();
   }
@@ -429,9 +475,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
     routerUrl: session.routerUrl
   };
 }
-function readHumanSession(routerUrl, credentialRef) {
+function readHumanSession(routerUrl, credentialRef, harness) {
   try {
-    const password = secureEntry(routerUrl, credentialRef).getPassword();
+    const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
     if (!password || password.length > 4096) throw new HumanLoginRequiredError();
     return validateHumanSession(JSON.parse(password), routerUrl);
   } catch {
@@ -443,11 +489,11 @@ function readHumanSession(routerUrl, credentialRef) {
 function harnessTransport(harness) {
   return transportForConfig(harness, loadManagedConfig(process.env, harness));
 }
-function transportForConfig(harness, { config: config2, principal }) {
+function transportForConfig(harness, { config: config2, principal, principalId }) {
   if (principal.human) {
     const routerUrl = humanRouterUrl(config2.routerUrl);
     const reference = principal.human.credentialRef;
-    let session = readHumanSession(routerUrl, reference);
+    let session = readHumanSession(routerUrl, reference, principalId);
     return new RouterTransport({
       routerUrl,
       access: principal,
@@ -455,7 +501,7 @@ function transportForConfig(harness, { config: config2, principal }) {
       tokenPattern: HUMAN_TOKEN_PATTERN,
       unauthorizedError: () => new HumanLoginRequiredError(),
       token: () => {
-        session = readHumanSession(routerUrl, reference);
+        session = readHumanSession(routerUrl, reference, principalId);
         return session.token;
       }
     });
@@ -1214,7 +1260,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
 ];
 
 // package.json
-var version = "0.8.9";
+var version = "0.8.14";
 
 // src/core/util.ts
 import { accessSync, constants } from "fs";
@@ -1728,7 +1774,7 @@ var HindsightClient = class _HindsightClient {
    */
   async tree() {
     if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
-    const r = await this.req("GET", this.bankUrl("/knowledge-base/tree"));
+    const r = await this.req("GET", this.bankUrl("/pages/tree"));
     if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
     if (r.status === 404) return [];
     this.knowledgePagesSupported = true;
@@ -1776,7 +1822,7 @@ var HindsightClient = class _HindsightClient {
     if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
     const r = await this.req(
       "GET",
-      this.bankUrl(`/knowledge-base/pages/${encodeURIComponent(pageId)}`)
+      this.bankUrl(`/pages/${encodeURIComponent(pageId)}`)
     );
     if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
     return shapePage(await r.json());
@@ -1789,7 +1835,7 @@ var HindsightClient = class _HindsightClient {
     const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
     const r = await this.req(
       "GET",
-      this.bankUrl(`/knowledge-base/search${q}`),
+      this.bankUrl(`/pages/search${q}`),
       void 0,
       [],
       opts.timeoutMs
@@ -1808,7 +1854,7 @@ var HindsightClient = class _HindsightClient {
   /**
    * Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
    *
-   * Matched by NAME, not id: `/knowledge-base/pages` mints its own `kp-…` id, so a stable
+   * Matched by NAME, not id: `/pages` mints its own `kp-…` id, so a stable
    * client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
    * off a slug). Names are unique per folder server-side, which makes them a sound key.
    *
@@ -1847,7 +1893,7 @@ var HindsightClient = class _HindsightClient {
         trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
       };
       if (!hit) {
-        const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), body, [409]);
+        const r = await this.req("POST", this.bankUrl("/pages"), body, [409]);
         if (await this.pagesUnsupported(r)) {
           this.log(
             `[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
@@ -1874,7 +1920,7 @@ var HindsightClient = class _HindsightClient {
         if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
         const r = await this.req(
           "PATCH",
-          this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(hit.id)}`),
+          this.bankUrl(`/pages/nodes/${encodeURIComponent(hit.id)}`),
           patch
         );
         if (await this.pagesUnsupported(r)) {
@@ -1928,7 +1974,7 @@ var HindsightClient = class _HindsightClient {
       if (!patch.trigger && !patch.source_query) continue;
       const r = await this.req(
         "PATCH",
-        this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(page.id)}`),
+        this.bankUrl(`/pages/nodes/${encodeURIComponent(page.id)}`),
         patch
       );
       if (r.status === 404) continue;
@@ -1957,7 +2003,7 @@ var HindsightClient = class _HindsightClient {
     let pageId = args.relatesToPageId;
     if (!pageId) {
       const folderId = await this.ensureFolder("Initiatives");
-      const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), {
+      const r = await this.req("POST", this.bankUrl("/pages"), {
         name: args.title,
         source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
         parent_id: folderId,
@@ -1985,7 +2031,7 @@ var HindsightClient = class _HindsightClient {
   /** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
   async ensureFolder(name) {
     try {
-      const tree = await (await this.req("GET", this.bankUrl("/knowledge-base/tree"))).json();
+      const tree = await (await this.req("GET", this.bankUrl("/pages/tree"))).json();
       const hit = (tree.roots || []).find(
         (n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
       );
@@ -1994,7 +2040,7 @@ var HindsightClient = class _HindsightClient {
       if (error instanceof AccessDeniedError) throw error;
     }
     try {
-      const r = await this.req("POST", this.bankUrl("/knowledge-base/folders"), { name });
+      const r = await this.req("POST", this.bankUrl("/pages/folders"), { name });
       return (await r.json()).id;
     } catch (error) {
       if (error instanceof AccessDeniedError) throw error;

package/dist/hindsight-seed.js

@@ -27,12 +27,10 @@ function requireBank(access, bank, operation) {
 }
 function classifyOperation(method, suffix) {
   if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
-  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
-    suffix
-  ))
+  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
     return "read";
   if (method === "GET" && suffix === "") return "read";
-  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
     suffix
   ))
     return "write";
@@ -354,6 +352,54 @@ var RouterTransport = class {
 // ../../coding-agents/human-session.ts
 import { createHash as createHash2 } from "crypto";
 import { createRequire } from "module";
+
+// src/harness/names.ts
+var HARNESS_NAMES = [
+  "opencode",
+  // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
+  // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
+  "opencode2",
+  // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
+  // has NO hook binary — deliberately absent from HOOK_BINS below.
+  "kilo",
+  // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
+  "cline-cli",
+  // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
+  // Codex hook bridges are optional packages, so there is no hook binary to install either.
+  "dsh",
+  // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
+  // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
+  "pi",
+  "prime-agent",
+  "claude-code",
+  "cursor-cli",
+  "codex",
+  "dcode",
+  "antigravity-cli",
+  "devin-cli",
+  "copilot-cli",
+  "grok-build",
+  "qwen-code",
+  // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
+  // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
+  "factory-droid",
+  // ZCode is a per-prompt HOOK host too, registered in its own CLI config
+  // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
+  "zcode",
+  // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
+  "traecode",
+  "kimi-code",
+  // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
+  // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
+  "workbuddy",
+  // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
+  // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
+  // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
+  // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
+  "codebuddy"
+];
+
+// ../../coding-agents/human-session.ts
 var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
 var HumanLoginRequiredError = class extends AccessDeniedError {
   constructor() {
@@ -379,14 +425,14 @@ function humanRouterUrl(value) {
   if (url.search || url.hash) throw new HumanLoginRequiredError();
   return canonical;
 }
-function secureEntry(routerUrl, credentialRef) {
+function secureEntry(routerUrl, credentialRef, harness) {
   try {
-    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
+    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
       throw new HumanLoginRequiredError();
     }
     const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
-    const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
-    return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
+    const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
+    return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
   } catch {
     throw new HumanLoginRequiredError();
   }
@@ -404,9 +450,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
     routerUrl: session.routerUrl
   };
 }
-function readHumanSession(routerUrl, credentialRef) {
+function readHumanSession(routerUrl, credentialRef, harness) {
   try {
-    const password = secureEntry(routerUrl, credentialRef).getPassword();
+    const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
     if (!password || password.length > 4096) throw new HumanLoginRequiredError();
     return validateHumanSession(JSON.parse(password), routerUrl);
   } catch {
@@ -415,11 +461,11 @@ function readHumanSession(routerUrl, credentialRef) {
 }
 
 // ../../coding-agents/runtime.ts
-function transportForConfig(harness, { config, principal }) {
+function transportForConfig(harness, { config, principal, principalId }) {
   if (principal.human) {
     const routerUrl = humanRouterUrl(config.routerUrl);
     const reference = principal.human.credentialRef;
-    let session = readHumanSession(routerUrl, reference);
+    let session = readHumanSession(routerUrl, reference, principalId);
     return new RouterTransport({
       routerUrl,
       access: principal,
@@ -427,7 +473,7 @@ function transportForConfig(harness, { config, principal }) {
       tokenPattern: HUMAN_TOKEN_PATTERN,
       unauthorizedError: () => new HumanLoginRequiredError(),
       token: () => {
-        session = readHumanSession(routerUrl, reference);
+        session = readHumanSession(routerUrl, reference, principalId);
         return session.token;
       }
     });
@@ -761,7 +807,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
 ];
 
 // package.json
-var version = "0.8.9";
+var version = "0.8.14";
 
 // src/core/util.ts
 import { accessSync, constants } from "fs";

package/dist/index.js

@@ -34,12 +34,10 @@ function requireBank(access, bank, operation) {
 }
 function classifyOperation(method, suffix) {
   if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
-  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
-    suffix
-  ))
+  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
     return "read";
   if (method === "GET" && suffix === "") return "read";
-  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
     suffix
   ))
     return "write";
@@ -451,6 +449,54 @@ var RouterTransport = class {
 // ../../coding-agents/human-session.ts
 import { createHash as createHash2 } from "crypto";
 import { createRequire } from "module";
+
+// src/harness/names.ts
+var HARNESS_NAMES = [
+  "opencode",
+  // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
+  // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
+  "opencode2",
+  // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
+  // has NO hook binary — deliberately absent from HOOK_BINS below.
+  "kilo",
+  // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
+  "cline-cli",
+  // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
+  // Codex hook bridges are optional packages, so there is no hook binary to install either.
+  "dsh",
+  // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
+  // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
+  "pi",
+  "prime-agent",
+  "claude-code",
+  "cursor-cli",
+  "codex",
+  "dcode",
+  "antigravity-cli",
+  "devin-cli",
+  "copilot-cli",
+  "grok-build",
+  "qwen-code",
+  // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
+  // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
+  "factory-droid",
+  // ZCode is a per-prompt HOOK host too, registered in its own CLI config
+  // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
+  "zcode",
+  // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
+  "traecode",
+  "kimi-code",
+  // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
+  // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
+  "workbuddy",
+  // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
+  // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
+  // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
+  // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
+  "codebuddy"
+];
+
+// ../../coding-agents/human-session.ts
 var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
 var HumanLoginRequiredError = class extends AccessDeniedError {
   constructor() {
@@ -476,14 +522,14 @@ function humanRouterUrl(value) {
   if (url2.search || url2.hash) throw new HumanLoginRequiredError();
   return canonical2;
 }
-function secureEntry(routerUrl, credentialRef) {
+function secureEntry(routerUrl, credentialRef, harness) {
   try {
-    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
+    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
       throw new HumanLoginRequiredError();
     }
     const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
-    const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
-    return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
+    const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
+    return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
   } catch {
     throw new HumanLoginRequiredError();
   }
@@ -501,9 +547,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
     routerUrl: session.routerUrl
   };
 }
-function readHumanSession(routerUrl, credentialRef) {
+function readHumanSession(routerUrl, credentialRef, harness) {
   try {
-    const password = secureEntry(routerUrl, credentialRef).getPassword();
+    const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
     if (!password || password.length > 4096) throw new HumanLoginRequiredError();
     return validateHumanSession(JSON.parse(password), routerUrl);
   } catch {
@@ -515,11 +561,11 @@ function readHumanSession(routerUrl, credentialRef) {
 function harnessTransport(harness) {
   return transportForConfig(harness, loadManagedConfig(process.env, harness));
 }
-function transportForConfig(harness, { config: config2, principal }) {
+function transportForConfig(harness, { config: config2, principal, principalId }) {
   if (principal.human) {
     const routerUrl = humanRouterUrl(config2.routerUrl);
     const reference = principal.human.credentialRef;
-    let session = readHumanSession(routerUrl, reference);
+    let session = readHumanSession(routerUrl, reference, principalId);
     return new RouterTransport({
       routerUrl,
       access: principal,
@@ -527,7 +573,7 @@ function transportForConfig(harness, { config: config2, principal }) {
       tokenPattern: HUMAN_TOKEN_PATTERN,
       unauthorizedError: () => new HumanLoginRequiredError(),
       token: () => {
-        session = readHumanSession(routerUrl, reference);
+        session = readHumanSession(routerUrl, reference, principalId);
         return session.token;
       }
     });
@@ -1334,7 +1380,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
 ];
 
 // package.json
-var version = "0.8.9";
+var version = "0.8.14";
 
 // src/core/util.ts
 import { accessSync, constants } from "fs";
@@ -1867,7 +1913,7 @@ var HindsightClient = class _HindsightClient {
    */
   async tree() {
     if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
-    const r = await this.req("GET", this.bankUrl("/knowledge-base/tree"));
+    const r = await this.req("GET", this.bankUrl("/pages/tree"));
     if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
     if (r.status === 404) return [];
     this.knowledgePagesSupported = true;
@@ -1915,7 +1961,7 @@ var HindsightClient = class _HindsightClient {
     if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
     const r = await this.req(
       "GET",
-      this.bankUrl(`/knowledge-base/pages/${encodeURIComponent(pageId)}`)
+      this.bankUrl(`/pages/${encodeURIComponent(pageId)}`)
     );
     if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
     return shapePage(await r.json());
@@ -1928,7 +1974,7 @@ var HindsightClient = class _HindsightClient {
     const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
     const r = await this.req(
       "GET",
-      this.bankUrl(`/knowledge-base/search${q}`),
+      this.bankUrl(`/pages/search${q}`),
       void 0,
       [],
       opts.timeoutMs
@@ -1947,7 +1993,7 @@ var HindsightClient = class _HindsightClient {
   /**
    * Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
    *
-   * Matched by NAME, not id: `/knowledge-base/pages` mints its own `kp-…` id, so a stable
+   * Matched by NAME, not id: `/pages` mints its own `kp-…` id, so a stable
    * client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
    * off a slug). Names are unique per folder server-side, which makes them a sound key.
    *
@@ -1986,7 +2032,7 @@ var HindsightClient = class _HindsightClient {
         trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
       };
       if (!hit) {
-        const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), body, [409]);
+        const r = await this.req("POST", this.bankUrl("/pages"), body, [409]);
         if (await this.pagesUnsupported(r)) {
           this.log(
             `[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
@@ -2013,7 +2059,7 @@ var HindsightClient = class _HindsightClient {
         if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
         const r = await this.req(
           "PATCH",
-          this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(hit.id)}`),
+          this.bankUrl(`/pages/nodes/${encodeURIComponent(hit.id)}`),
           patch
         );
         if (await this.pagesUnsupported(r)) {
@@ -2067,7 +2113,7 @@ var HindsightClient = class _HindsightClient {
       if (!patch.trigger && !patch.source_query) continue;
       const r = await this.req(
         "PATCH",
-        this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(page.id)}`),
+        this.bankUrl(`/pages/nodes/${encodeURIComponent(page.id)}`),
         patch
       );
       if (r.status === 404) continue;
@@ -2096,7 +2142,7 @@ var HindsightClient = class _HindsightClient {
     let pageId = args.relatesToPageId;
     if (!pageId) {
       const folderId = await this.ensureFolder("Initiatives");
-      const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), {
+      const r = await this.req("POST", this.bankUrl("/pages"), {
         name: args.title,
         source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
         parent_id: folderId,
@@ -2124,7 +2170,7 @@ var HindsightClient = class _HindsightClient {
   /** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
   async ensureFolder(name) {
     try {
-      const tree = await (await this.req("GET", this.bankUrl("/knowledge-base/tree"))).json();
+      const tree = await (await this.req("GET", this.bankUrl("/pages/tree"))).json();
       const hit = (tree.roots || []).find(
         (n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
       );
@@ -2133,7 +2179,7 @@ var HindsightClient = class _HindsightClient {
       if (error62 instanceof AccessDeniedError) throw error62;
     }
     try {
-      const r = await this.req("POST", this.bankUrl("/knowledge-base/folders"), { name });
+      const r = await this.req("POST", this.bankUrl("/pages/folders"), { name });
       return (await r.json()).id;
     } catch (error62) {
       if (error62 instanceof AccessDeniedError) throw error62;