@mickey-kras/hindsight-memory-router-coding-agents 0.8.9 → 0.8.14

package/dist/installer.js

@@ -2456,12 +2456,10 @@ function requireBank(access, bank, operation) {
 }
 function classifyOperation(method, suffix) {
   if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
-  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
-    suffix
-  ))
+  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
     return "read";
   if (method === "GET" && suffix === "") return "read";
-  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
     suffix
   ))
     return "write";
@@ -2756,6 +2754,54 @@ var RouterTransport = class {
 // ../../coding-agents/human-session.ts
 import { createHash as createHash2 } from "crypto";
 import { createRequire } from "module";
+
+// src/harness/names.ts
+var HARNESS_NAMES = [
+  "opencode",
+  // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
+  // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
+  "opencode2",
+  // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
+  // has NO hook binary — deliberately absent from HOOK_BINS below.
+  "kilo",
+  // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
+  "cline-cli",
+  // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
+  // Codex hook bridges are optional packages, so there is no hook binary to install either.
+  "dsh",
+  // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
+  // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
+  "pi",
+  "prime-agent",
+  "claude-code",
+  "cursor-cli",
+  "codex",
+  "dcode",
+  "antigravity-cli",
+  "devin-cli",
+  "copilot-cli",
+  "grok-build",
+  "qwen-code",
+  // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
+  // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
+  "factory-droid",
+  // ZCode is a per-prompt HOOK host too, registered in its own CLI config
+  // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
+  "zcode",
+  // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
+  "traecode",
+  "kimi-code",
+  // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
+  // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
+  "workbuddy",
+  // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
+  // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
+  // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
+  // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
+  "codebuddy"
+];
+
+// ../../coding-agents/human-session.ts
 var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
 var HumanLoginRequiredError = class extends AccessDeniedError {
   constructor() {
@@ -2781,14 +2827,14 @@ function humanRouterUrl(value) {
   if (url.search || url.hash) throw new HumanLoginRequiredError();
   return canonical;
 }
-function secureEntry(routerUrl, credentialRef) {
+function secureEntry(routerUrl, credentialRef, harness) {
   try {
-    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
+    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
       throw new HumanLoginRequiredError();
     }
     const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
-    const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
-    return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
+    const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
+    return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
   } catch {
     throw new HumanLoginRequiredError();
   }
@@ -2806,9 +2852,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
     routerUrl: session.routerUrl
   };
 }
-function readHumanSession(routerUrl, credentialRef) {
+function readHumanSession(routerUrl, credentialRef, harness) {
   try {
-    const password = secureEntry(routerUrl, credentialRef).getPassword();
+    const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
     if (!password || password.length > 4096) throw new HumanLoginRequiredError();
     return validateHumanSession(JSON.parse(password), routerUrl);
   } catch {
@@ -2820,11 +2866,11 @@ function readHumanSession(routerUrl, credentialRef) {
 function harnessTransport(harness) {
   return transportForConfig(harness, loadManagedConfig(process.env, harness));
 }
-function transportForConfig(harness, { config: config2, principal }) {
+function transportForConfig(harness, { config: config2, principal, principalId }) {
   if (principal.human) {
     const routerUrl = humanRouterUrl(config2.routerUrl);
     const reference = principal.human.credentialRef;
-    let session = readHumanSession(routerUrl, reference);
+    let session = readHumanSession(routerUrl, reference, principalId);
     return new RouterTransport({
       routerUrl,
       access: principal,
@@ -2832,7 +2878,7 @@ function transportForConfig(harness, { config: config2, principal }) {
       tokenPattern: HUMAN_TOKEN_PATTERN,
       unauthorizedError: () => new HumanLoginRequiredError(),
       token: () => {
-        session = readHumanSession(routerUrl, reference);
+        session = readHumanSession(routerUrl, reference, principalId);
         return session.token;
       }
     });
@@ -2978,9 +3024,9 @@ async function openLoginBrowser(url) {
     });
   });
 }
-async function loginHuman(routerUrl, credentialRef, openBrowser = openLoginBrowser) {
+async function loginHuman(routerUrl, credentialRef, harness, openBrowser = openLoginBrowser) {
   const base = humanRouterUrl(routerUrl);
-  const entry = secureEntry(base, credentialRef);
+  const entry = secureEntry(base, credentialRef, harness);
   entry.getPassword();
   const state = randomBytes(32).toString("base64url");
   const verifier = randomBytes(32).toString("base64url");
@@ -3068,9 +3114,9 @@ async function loginHuman(routerUrl, credentialRef, openBrowser = openLoginBrows
     if (server.listening) await new Promise((resolve6) => server.close(() => resolve6()));
   }
 }
-async function signOutHuman(routerUrl, credentialRef) {
+async function signOutHuman(routerUrl, credentialRef, harness) {
   const base = humanRouterUrl(routerUrl);
-  const entry = secureEntry(base, credentialRef);
+  const entry = secureEntry(base, credentialRef, harness);
   let revoked = false;
   try {
     const stored = entry.getPassword();
@@ -3094,17 +3140,20 @@ async function runHumanAuth(argv, log2, interactive) {
     if (!["login", "sign-out"].includes(command) || args.length > 1 || args.some((arg) => arg.startsWith("--"))) {
       throw new HumanLoginRequiredError();
     }
-    const { config: config2, principal } = loadManagedConfig(process.env, args[0] ?? process.env.HINDSIGHT_MCP_HARNESS);
+    const { config: config2, principal, principalId } = loadManagedConfig(
+      process.env,
+      args[0] ?? process.env.HINDSIGHT_MCP_HARNESS
+    );
     if (!principal.human) throw new HumanLoginRequiredError();
     if (command === "login") {
       if (!interactive) throw new HumanLoginRequiredError();
-      await loginHuman(config2.routerUrl, principal.human.credentialRef);
+      await loginHuman(config2.routerUrl, principal.human.credentialRef, principalId);
       log2(
         "Signed in. Run install for the configured coding agent. Sessions expire within one hour; login again when required."
       );
       return 0;
     }
-    const revoked = await signOutHuman(config2.routerUrl, principal.human.credentialRef);
+    const revoked = await signOutHuman(config2.routerUrl, principal.human.credentialRef, principalId);
     log2(
       revoked ? "Signed out." : "Local credential removed; server revocation could not be confirmed. The session remains valid until expiry or operator revocation."
     );
@@ -3407,7 +3456,7 @@ var PAGE_TAXONOMY = [
 var PAGE_NAMES = PAGE_TAXONOMY.map((page) => page.name);
 
 // package.json
-var version = "0.8.9";
+var version = "0.8.14";
 
 // src/core/util.ts
 import { accessSync, constants } from "fs";

package/dist/kilo.js

@@ -34,12 +34,10 @@ function requireBank(access, bank, operation) {
 }
 function classifyOperation(method, suffix) {
   if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
-  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
-    suffix
-  ))
+  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
     return "read";
   if (method === "GET" && suffix === "") return "read";
-  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
     suffix
   ))
     return "write";
@@ -451,6 +449,54 @@ var RouterTransport = class {
 // ../../coding-agents/human-session.ts
 import { createHash as createHash2 } from "crypto";
 import { createRequire } from "module";
+
+// src/harness/names.ts
+var HARNESS_NAMES = [
+  "opencode",
+  // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
+  // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
+  "opencode2",
+  // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
+  // has NO hook binary — deliberately absent from HOOK_BINS below.
+  "kilo",
+  // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
+  "cline-cli",
+  // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
+  // Codex hook bridges are optional packages, so there is no hook binary to install either.
+  "dsh",
+  // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
+  // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
+  "pi",
+  "prime-agent",
+  "claude-code",
+  "cursor-cli",
+  "codex",
+  "dcode",
+  "antigravity-cli",
+  "devin-cli",
+  "copilot-cli",
+  "grok-build",
+  "qwen-code",
+  // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
+  // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
+  "factory-droid",
+  // ZCode is a per-prompt HOOK host too, registered in its own CLI config
+  // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
+  "zcode",
+  // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
+  "traecode",
+  "kimi-code",
+  // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
+  // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
+  "workbuddy",
+  // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
+  // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
+  // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
+  // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
+  "codebuddy"
+];
+
+// ../../coding-agents/human-session.ts
 var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
 var HumanLoginRequiredError = class extends AccessDeniedError {
   constructor() {
@@ -476,14 +522,14 @@ function humanRouterUrl(value) {
   if (url2.search || url2.hash) throw new HumanLoginRequiredError();
   return canonical2;
 }
-function secureEntry(routerUrl, credentialRef) {
+function secureEntry(routerUrl, credentialRef, harness) {
   try {
-    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
+    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
       throw new HumanLoginRequiredError();
     }
     const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
-    const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
-    return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
+    const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
+    return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
   } catch {
     throw new HumanLoginRequiredError();
   }
@@ -501,9 +547,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
     routerUrl: session.routerUrl
   };
 }
-function readHumanSession(routerUrl, credentialRef) {
+function readHumanSession(routerUrl, credentialRef, harness) {
   try {
-    const password = secureEntry(routerUrl, credentialRef).getPassword();
+    const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
     if (!password || password.length > 4096) throw new HumanLoginRequiredError();
     return validateHumanSession(JSON.parse(password), routerUrl);
   } catch {
@@ -515,11 +561,11 @@ function readHumanSession(routerUrl, credentialRef) {
 function harnessTransport(harness) {
   return transportForConfig(harness, loadManagedConfig(process.env, harness));
 }
-function transportForConfig(harness, { config: config2, principal }) {
+function transportForConfig(harness, { config: config2, principal, principalId }) {
   if (principal.human) {
     const routerUrl = humanRouterUrl(config2.routerUrl);
     const reference = principal.human.credentialRef;
-    let session = readHumanSession(routerUrl, reference);
+    let session = readHumanSession(routerUrl, reference, principalId);
     return new RouterTransport({
       routerUrl,
       access: principal,
@@ -527,7 +573,7 @@ function transportForConfig(harness, { config: config2, principal }) {
       tokenPattern: HUMAN_TOKEN_PATTERN,
       unauthorizedError: () => new HumanLoginRequiredError(),
       token: () => {
-        session = readHumanSession(routerUrl, reference);
+        session = readHumanSession(routerUrl, reference, principalId);
         return session.token;
       }
     });
@@ -1334,7 +1380,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
 ];
 
 // package.json
-var version = "0.8.9";
+var version = "0.8.14";
 
 // src/core/util.ts
 import { accessSync, constants } from "fs";
@@ -1867,7 +1913,7 @@ var HindsightClient = class _HindsightClient {
    */
   async tree() {
     if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
-    const r = await this.req("GET", this.bankUrl("/knowledge-base/tree"));
+    const r = await this.req("GET", this.bankUrl("/pages/tree"));
     if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
     if (r.status === 404) return [];
     this.knowledgePagesSupported = true;
@@ -1915,7 +1961,7 @@ var HindsightClient = class _HindsightClient {
     if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
     const r = await this.req(
       "GET",
-      this.bankUrl(`/knowledge-base/pages/${encodeURIComponent(pageId)}`)
+      this.bankUrl(`/pages/${encodeURIComponent(pageId)}`)
     );
     if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
     return shapePage(await r.json());
@@ -1928,7 +1974,7 @@ var HindsightClient = class _HindsightClient {
     const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
     const r = await this.req(
       "GET",
-      this.bankUrl(`/knowledge-base/search${q}`),
+      this.bankUrl(`/pages/search${q}`),
       void 0,
       [],
       opts.timeoutMs
@@ -1947,7 +1993,7 @@ var HindsightClient = class _HindsightClient {
   /**
    * Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
    *
-   * Matched by NAME, not id: `/knowledge-base/pages` mints its own `kp-…` id, so a stable
+   * Matched by NAME, not id: `/pages` mints its own `kp-…` id, so a stable
    * client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
    * off a slug). Names are unique per folder server-side, which makes them a sound key.
    *
@@ -1986,7 +2032,7 @@ var HindsightClient = class _HindsightClient {
         trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
       };
       if (!hit) {
-        const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), body, [409]);
+        const r = await this.req("POST", this.bankUrl("/pages"), body, [409]);
         if (await this.pagesUnsupported(r)) {
           this.log(
             `[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
@@ -2013,7 +2059,7 @@ var HindsightClient = class _HindsightClient {
         if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
         const r = await this.req(
           "PATCH",
-          this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(hit.id)}`),
+          this.bankUrl(`/pages/nodes/${encodeURIComponent(hit.id)}`),
           patch
         );
         if (await this.pagesUnsupported(r)) {
@@ -2067,7 +2113,7 @@ var HindsightClient = class _HindsightClient {
       if (!patch.trigger && !patch.source_query) continue;
       const r = await this.req(
         "PATCH",
-        this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(page.id)}`),
+        this.bankUrl(`/pages/nodes/${encodeURIComponent(page.id)}`),
         patch
       );
       if (r.status === 404) continue;
@@ -2096,7 +2142,7 @@ var HindsightClient = class _HindsightClient {
     let pageId = args.relatesToPageId;
     if (!pageId) {
       const folderId = await this.ensureFolder("Initiatives");
-      const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), {
+      const r = await this.req("POST", this.bankUrl("/pages"), {
         name: args.title,
         source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
         parent_id: folderId,
@@ -2124,7 +2170,7 @@ var HindsightClient = class _HindsightClient {
   /** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
   async ensureFolder(name) {
     try {
-      const tree = await (await this.req("GET", this.bankUrl("/knowledge-base/tree"))).json();
+      const tree = await (await this.req("GET", this.bankUrl("/pages/tree"))).json();
       const hit = (tree.roots || []).find(
         (n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
       );
@@ -2133,7 +2179,7 @@ var HindsightClient = class _HindsightClient {
       if (error62 instanceof AccessDeniedError) throw error62;
     }
     try {
-      const r = await this.req("POST", this.bankUrl("/knowledge-base/folders"), { name });
+      const r = await this.req("POST", this.bankUrl("/pages/folders"), { name });
       return (await r.json()).id;
     } catch (error62) {
       if (error62 instanceof AccessDeniedError) throw error62;

package/dist/kimi-hook.js

@@ -36,12 +36,10 @@ function requireBank(access, bank, operation) {
 }
 function classifyOperation(method, suffix) {
   if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
-  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
-    suffix
-  ))
+  if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
     return "read";
   if (method === "GET" && suffix === "") return "read";
-  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
     suffix
   ))
     return "write";
@@ -393,6 +391,54 @@ var RouterTransport = class {
 // ../../coding-agents/human-session.ts
 import { createHash as createHash2 } from "crypto";
 import { createRequire } from "module";
+
+// src/harness/names.ts
+var HARNESS_NAMES = [
+  "opencode",
+  // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
+  // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
+  "opencode2",
+  // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
+  // has NO hook binary — deliberately absent from HOOK_BINS below.
+  "kilo",
+  // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
+  "cline-cli",
+  // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
+  // Codex hook bridges are optional packages, so there is no hook binary to install either.
+  "dsh",
+  // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
+  // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
+  "pi",
+  "prime-agent",
+  "claude-code",
+  "cursor-cli",
+  "codex",
+  "dcode",
+  "antigravity-cli",
+  "devin-cli",
+  "copilot-cli",
+  "grok-build",
+  "qwen-code",
+  // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
+  // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
+  "factory-droid",
+  // ZCode is a per-prompt HOOK host too, registered in its own CLI config
+  // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
+  "zcode",
+  // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
+  "traecode",
+  "kimi-code",
+  // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
+  // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
+  "workbuddy",
+  // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
+  // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
+  // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
+  // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
+  "codebuddy"
+];
+
+// ../../coding-agents/human-session.ts
 var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
 var HumanLoginRequiredError = class extends AccessDeniedError {
   constructor() {
@@ -418,14 +464,14 @@ function humanRouterUrl(value) {
   if (url.search || url.hash) throw new HumanLoginRequiredError();
   return canonical2;
 }
-function secureEntry(routerUrl, credentialRef) {
+function secureEntry(routerUrl, credentialRef, harness) {
   try {
-    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
+    if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
       throw new HumanLoginRequiredError();
     }
     const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
-    const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
-    return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
+    const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
+    return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
   } catch {
     throw new HumanLoginRequiredError();
   }
@@ -443,9 +489,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
     routerUrl: session.routerUrl
   };
 }
-function readHumanSession(routerUrl, credentialRef) {
+function readHumanSession(routerUrl, credentialRef, harness) {
   try {
-    const password = secureEntry(routerUrl, credentialRef).getPassword();
+    const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
     if (!password || password.length > 4096) throw new HumanLoginRequiredError();
     return validateHumanSession(JSON.parse(password), routerUrl);
   } catch {
@@ -457,11 +503,11 @@ function readHumanSession(routerUrl, credentialRef) {
 function harnessTransport(harness) {
   return transportForConfig(harness, loadManagedConfig(process.env, harness));
 }
-function transportForConfig(harness, { config: config2, principal }) {
+function transportForConfig(harness, { config: config2, principal, principalId }) {
   if (principal.human) {
     const routerUrl = humanRouterUrl(config2.routerUrl);
     const reference = principal.human.credentialRef;
-    let session = readHumanSession(routerUrl, reference);
+    let session = readHumanSession(routerUrl, reference, principalId);
     return new RouterTransport({
       routerUrl,
       access: principal,
@@ -469,7 +515,7 @@ function transportForConfig(harness, { config: config2, principal }) {
       tokenPattern: HUMAN_TOKEN_PATTERN,
       unauthorizedError: () => new HumanLoginRequiredError(),
       token: () => {
-        session = readHumanSession(routerUrl, reference);
+        session = readHumanSession(routerUrl, reference, principalId);
         return session.token;
       }
     });
@@ -1277,7 +1323,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
 ];
 
 // package.json
-var version = "0.8.9";
+var version = "0.8.14";
 
 // src/core/util.ts
 import { accessSync, constants } from "fs";
@@ -1791,7 +1837,7 @@ var HindsightClient = class _HindsightClient {
    */
   async tree() {
     if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
-    const r = await this.req("GET", this.bankUrl("/knowledge-base/tree"));
+    const r = await this.req("GET", this.bankUrl("/pages/tree"));
     if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
     if (r.status === 404) return [];
     this.knowledgePagesSupported = true;
@@ -1839,7 +1885,7 @@ var HindsightClient = class _HindsightClient {
     if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
     const r = await this.req(
       "GET",
-      this.bankUrl(`/knowledge-base/pages/${encodeURIComponent(pageId)}`)
+      this.bankUrl(`/pages/${encodeURIComponent(pageId)}`)
     );
     if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
     return shapePage(await r.json());
@@ -1852,7 +1898,7 @@ var HindsightClient = class _HindsightClient {
     const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
     const r = await this.req(
       "GET",
-      this.bankUrl(`/knowledge-base/search${q}`),
+      this.bankUrl(`/pages/search${q}`),
       void 0,
       [],
       opts.timeoutMs
@@ -1871,7 +1917,7 @@ var HindsightClient = class _HindsightClient {
   /**
    * Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
    *
-   * Matched by NAME, not id: `/knowledge-base/pages` mints its own `kp-…` id, so a stable
+   * Matched by NAME, not id: `/pages` mints its own `kp-…` id, so a stable
    * client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
    * off a slug). Names are unique per folder server-side, which makes them a sound key.
    *
@@ -1910,7 +1956,7 @@ var HindsightClient = class _HindsightClient {
         trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
       };
       if (!hit) {
-        const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), body, [409]);
+        const r = await this.req("POST", this.bankUrl("/pages"), body, [409]);
         if (await this.pagesUnsupported(r)) {
           this.log(
             `[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
@@ -1937,7 +1983,7 @@ var HindsightClient = class _HindsightClient {
         if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
         const r = await this.req(
           "PATCH",
-          this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(hit.id)}`),
+          this.bankUrl(`/pages/nodes/${encodeURIComponent(hit.id)}`),
           patch
         );
         if (await this.pagesUnsupported(r)) {
@@ -1991,7 +2037,7 @@ var HindsightClient = class _HindsightClient {
       if (!patch.trigger && !patch.source_query) continue;
       const r = await this.req(
         "PATCH",
-        this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(page.id)}`),
+        this.bankUrl(`/pages/nodes/${encodeURIComponent(page.id)}`),
         patch
       );
       if (r.status === 404) continue;
@@ -2020,7 +2066,7 @@ var HindsightClient = class _HindsightClient {
     let pageId = args.relatesToPageId;
     if (!pageId) {
       const folderId = await this.ensureFolder("Initiatives");
-      const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), {
+      const r = await this.req("POST", this.bankUrl("/pages"), {
         name: args.title,
         source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
         parent_id: folderId,
@@ -2048,7 +2094,7 @@ var HindsightClient = class _HindsightClient {
   /** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
   async ensureFolder(name) {
     try {
-      const tree = await (await this.req("GET", this.bankUrl("/knowledge-base/tree"))).json();
+      const tree = await (await this.req("GET", this.bankUrl("/pages/tree"))).json();
       const hit = (tree.roots || []).find(
         (n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
       );
@@ -2057,7 +2103,7 @@ var HindsightClient = class _HindsightClient {
       if (error instanceof AccessDeniedError) throw error;
     }
     try {
-      const r = await this.req("POST", this.bankUrl("/knowledge-base/folders"), { name });
+      const r = await this.req("POST", this.bankUrl("/pages/folders"), { name });
       return (await r.json()).id;
     } catch (error) {
       if (error instanceof AccessDeniedError) throw error;