@mickey-kras/hindsight-memory-router-coding-agents 0.8.9 → 0.8.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (59) hide show
  1. package/dist/antigravity-hook.js +70 -24
  2. package/dist/antigravity-statusline.js +60 -14
  3. package/dist/antigravity-stop-hook.js +70 -24
  4. package/dist/claude-hook.js +70 -24
  5. package/dist/claude-sessionstart-hook.js +70 -24
  6. package/dist/claude-stop-hook.js +70 -24
  7. package/dist/cline.js +70 -24
  8. package/dist/codebuddy-hook.js +70 -24
  9. package/dist/codebuddy-sessionstart-hook.js +70 -24
  10. package/dist/codebuddy-stop-hook.js +70 -24
  11. package/dist/codex-hook.js +70 -24
  12. package/dist/codex-sessionstart-hook.js +70 -24
  13. package/dist/codex-stop-hook.js +70 -24
  14. package/dist/copilot-hook.js +70 -24
  15. package/dist/copilot-sessionstart-hook.js +70 -24
  16. package/dist/copilot-stop-hook.js +70 -24
  17. package/dist/cursor-hook.js +70 -24
  18. package/dist/cursor-sessionstart-hook.js +70 -24
  19. package/dist/cursor-stop-hook.js +70 -24
  20. package/dist/dcode-hook.js +70 -24
  21. package/dist/dcode-sessionstart-hook.js +70 -24
  22. package/dist/dcode-stop-hook.js +70 -24
  23. package/dist/deepen.js +70 -68
  24. package/dist/devin-hook.js +70 -24
  25. package/dist/devin-sessionstart-hook.js +70 -24
  26. package/dist/devin-stop-hook.js +70 -24
  27. package/dist/droid-hook.js +70 -24
  28. package/dist/droid-sessionstart-hook.js +70 -24
  29. package/dist/droid-stop-hook.js +70 -24
  30. package/dist/dsh.js +70 -24
  31. package/dist/grok-hook.js +70 -24
  32. package/dist/grok-sessionstart-hook.js +70 -24
  33. package/dist/grok-stop-hook.js +70 -24
  34. package/dist/hindsight-seed.js +60 -14
  35. package/dist/index.js +70 -24
  36. package/dist/installer.js +70 -21
  37. package/dist/kilo.js +70 -24
  38. package/dist/kimi-hook.js +70 -24
  39. package/dist/kimi-sessionstart-hook.js +70 -24
  40. package/dist/kimi-stop-hook.js +70 -24
  41. package/dist/mcp-server.js +79 -24
  42. package/dist/opencode2.js +70 -24
  43. package/dist/pi.js +70 -24
  44. package/dist/prime-agent.js +70 -24
  45. package/dist/qwen-hook.js +70 -24
  46. package/dist/qwen-sessionstart-hook.js +70 -24
  47. package/dist/qwen-stop-hook.js +70 -24
  48. package/dist/status.js +70 -24
  49. package/dist/traecode-hook.js +70 -24
  50. package/dist/traecode-sessionstart-hook.js +70 -24
  51. package/dist/traecode-stop-hook.js +70 -24
  52. package/dist/workbuddy-hook.js +70 -24
  53. package/dist/workbuddy-sessionstart-hook.js +70 -24
  54. package/dist/workbuddy-stop-hook.js +70 -24
  55. package/dist/zcode-hook.js +70 -24
  56. package/dist/zcode-sessionstart-hook.js +70 -24
  57. package/dist/zcode-stop-hook.js +70 -24
  58. package/npm-shrinkwrap.json +257 -711
  59. package/package.json +8 -5
@@ -36,12 +36,10 @@ function requireBank(access, bank, operation) {
36
36
  }
37
37
  function classifyOperation(method, suffix) {
38
38
  if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
39
- if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
40
- suffix
41
- ))
39
+ if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
42
40
  return "read";
43
41
  if (method === "GET" && suffix === "") return "read";
44
- if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
42
+ if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
45
43
  suffix
46
44
  ))
47
45
  return "write";
@@ -379,6 +377,54 @@ var RouterTransport = class {
379
377
  // ../../coding-agents/human-session.ts
380
378
  import { createHash as createHash2 } from "crypto";
381
379
  import { createRequire } from "module";
380
+
381
+ // src/harness/names.ts
382
+ var HARNESS_NAMES = [
383
+ "opencode",
384
+ // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
385
+ // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
386
+ "opencode2",
387
+ // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
388
+ // has NO hook binary — deliberately absent from HOOK_BINS below.
389
+ "kilo",
390
+ // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
391
+ "cline-cli",
392
+ // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
393
+ // Codex hook bridges are optional packages, so there is no hook binary to install either.
394
+ "dsh",
395
+ // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
396
+ // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
397
+ "pi",
398
+ "prime-agent",
399
+ "claude-code",
400
+ "cursor-cli",
401
+ "codex",
402
+ "dcode",
403
+ "antigravity-cli",
404
+ "devin-cli",
405
+ "copilot-cli",
406
+ "grok-build",
407
+ "qwen-code",
408
+ // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
409
+ // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
410
+ "factory-droid",
411
+ // ZCode is a per-prompt HOOK host too, registered in its own CLI config
412
+ // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
413
+ "zcode",
414
+ // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
415
+ "traecode",
416
+ "kimi-code",
417
+ // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
418
+ // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
419
+ "workbuddy",
420
+ // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
421
+ // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
422
+ // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
423
+ // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
424
+ "codebuddy"
425
+ ];
426
+
427
+ // ../../coding-agents/human-session.ts
382
428
  var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
383
429
  var HumanLoginRequiredError = class extends AccessDeniedError {
384
430
  constructor() {
@@ -404,14 +450,14 @@ function humanRouterUrl(value) {
404
450
  if (url.search || url.hash) throw new HumanLoginRequiredError();
405
451
  return canonical2;
406
452
  }
407
- function secureEntry(routerUrl, credentialRef) {
453
+ function secureEntry(routerUrl, credentialRef, harness) {
408
454
  try {
409
- if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
455
+ if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
410
456
  throw new HumanLoginRequiredError();
411
457
  }
412
458
  const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
413
- const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
414
- return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
459
+ const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
460
+ return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
415
461
  } catch {
416
462
  throw new HumanLoginRequiredError();
417
463
  }
@@ -429,9 +475,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
429
475
  routerUrl: session.routerUrl
430
476
  };
431
477
  }
432
- function readHumanSession(routerUrl, credentialRef) {
478
+ function readHumanSession(routerUrl, credentialRef, harness) {
433
479
  try {
434
- const password = secureEntry(routerUrl, credentialRef).getPassword();
480
+ const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
435
481
  if (!password || password.length > 4096) throw new HumanLoginRequiredError();
436
482
  return validateHumanSession(JSON.parse(password), routerUrl);
437
483
  } catch {
@@ -443,11 +489,11 @@ function readHumanSession(routerUrl, credentialRef) {
443
489
  function harnessTransport(harness) {
444
490
  return transportForConfig(harness, loadManagedConfig(process.env, harness));
445
491
  }
446
- function transportForConfig(harness, { config: config2, principal }) {
492
+ function transportForConfig(harness, { config: config2, principal, principalId }) {
447
493
  if (principal.human) {
448
494
  const routerUrl = humanRouterUrl(config2.routerUrl);
449
495
  const reference = principal.human.credentialRef;
450
- let session = readHumanSession(routerUrl, reference);
496
+ let session = readHumanSession(routerUrl, reference, principalId);
451
497
  return new RouterTransport({
452
498
  routerUrl,
453
499
  access: principal,
@@ -455,7 +501,7 @@ function transportForConfig(harness, { config: config2, principal }) {
455
501
  tokenPattern: HUMAN_TOKEN_PATTERN,
456
502
  unauthorizedError: () => new HumanLoginRequiredError(),
457
503
  token: () => {
458
- session = readHumanSession(routerUrl, reference);
504
+ session = readHumanSession(routerUrl, reference, principalId);
459
505
  return session.token;
460
506
  }
461
507
  });
@@ -1214,7 +1260,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
1214
1260
  ];
1215
1261
 
1216
1262
  // package.json
1217
- var version = "0.8.9";
1263
+ var version = "0.8.14";
1218
1264
 
1219
1265
  // src/core/util.ts
1220
1266
  import { accessSync, constants } from "fs";
@@ -1728,7 +1774,7 @@ var HindsightClient = class _HindsightClient {
1728
1774
  */
1729
1775
  async tree() {
1730
1776
  if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
1731
- const r = await this.req("GET", this.bankUrl("/knowledge-base/tree"));
1777
+ const r = await this.req("GET", this.bankUrl("/pages/tree"));
1732
1778
  if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
1733
1779
  if (r.status === 404) return [];
1734
1780
  this.knowledgePagesSupported = true;
@@ -1776,7 +1822,7 @@ var HindsightClient = class _HindsightClient {
1776
1822
  if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
1777
1823
  const r = await this.req(
1778
1824
  "GET",
1779
- this.bankUrl(`/knowledge-base/pages/${encodeURIComponent(pageId)}`)
1825
+ this.bankUrl(`/pages/${encodeURIComponent(pageId)}`)
1780
1826
  );
1781
1827
  if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
1782
1828
  return shapePage(await r.json());
@@ -1789,7 +1835,7 @@ var HindsightClient = class _HindsightClient {
1789
1835
  const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
1790
1836
  const r = await this.req(
1791
1837
  "GET",
1792
- this.bankUrl(`/knowledge-base/search${q}`),
1838
+ this.bankUrl(`/pages/search${q}`),
1793
1839
  void 0,
1794
1840
  [],
1795
1841
  opts.timeoutMs
@@ -1808,7 +1854,7 @@ var HindsightClient = class _HindsightClient {
1808
1854
  /**
1809
1855
  * Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
1810
1856
  *
1811
- * Matched by NAME, not id: `/knowledge-base/pages` mints its own `kp-…` id, so a stable
1857
+ * Matched by NAME, not id: `/pages` mints its own `kp-…` id, so a stable
1812
1858
  * client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
1813
1859
  * off a slug). Names are unique per folder server-side, which makes them a sound key.
1814
1860
  *
@@ -1847,7 +1893,7 @@ var HindsightClient = class _HindsightClient {
1847
1893
  trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
1848
1894
  };
1849
1895
  if (!hit) {
1850
- const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), body, [409]);
1896
+ const r = await this.req("POST", this.bankUrl("/pages"), body, [409]);
1851
1897
  if (await this.pagesUnsupported(r)) {
1852
1898
  this.log(
1853
1899
  `[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
@@ -1874,7 +1920,7 @@ var HindsightClient = class _HindsightClient {
1874
1920
  if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
1875
1921
  const r = await this.req(
1876
1922
  "PATCH",
1877
- this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(hit.id)}`),
1923
+ this.bankUrl(`/pages/nodes/${encodeURIComponent(hit.id)}`),
1878
1924
  patch
1879
1925
  );
1880
1926
  if (await this.pagesUnsupported(r)) {
@@ -1928,7 +1974,7 @@ var HindsightClient = class _HindsightClient {
1928
1974
  if (!patch.trigger && !patch.source_query) continue;
1929
1975
  const r = await this.req(
1930
1976
  "PATCH",
1931
- this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(page.id)}`),
1977
+ this.bankUrl(`/pages/nodes/${encodeURIComponent(page.id)}`),
1932
1978
  patch
1933
1979
  );
1934
1980
  if (r.status === 404) continue;
@@ -1957,7 +2003,7 @@ var HindsightClient = class _HindsightClient {
1957
2003
  let pageId = args.relatesToPageId;
1958
2004
  if (!pageId) {
1959
2005
  const folderId = await this.ensureFolder("Initiatives");
1960
- const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), {
2006
+ const r = await this.req("POST", this.bankUrl("/pages"), {
1961
2007
  name: args.title,
1962
2008
  source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
1963
2009
  parent_id: folderId,
@@ -1985,7 +2031,7 @@ var HindsightClient = class _HindsightClient {
1985
2031
  /** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
1986
2032
  async ensureFolder(name) {
1987
2033
  try {
1988
- const tree = await (await this.req("GET", this.bankUrl("/knowledge-base/tree"))).json();
2034
+ const tree = await (await this.req("GET", this.bankUrl("/pages/tree"))).json();
1989
2035
  const hit = (tree.roots || []).find(
1990
2036
  (n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
1991
2037
  );
@@ -1994,7 +2040,7 @@ var HindsightClient = class _HindsightClient {
1994
2040
  if (error instanceof AccessDeniedError) throw error;
1995
2041
  }
1996
2042
  try {
1997
- const r = await this.req("POST", this.bankUrl("/knowledge-base/folders"), { name });
2043
+ const r = await this.req("POST", this.bankUrl("/pages/folders"), { name });
1998
2044
  return (await r.json()).id;
1999
2045
  } catch (error) {
2000
2046
  if (error instanceof AccessDeniedError) throw error;
package/dist/deepen.js CHANGED
@@ -36,12 +36,10 @@ function requireBank(access, bank, operation) {
36
36
  }
37
37
  function classifyOperation(method, suffix) {
38
38
  if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
39
- if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|knowledge-base)(?:\/[^/]+)*$/.test(
40
- suffix
41
- ))
39
+ if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
42
40
  return "read";
43
41
  if (method === "GET" && suffix === "") return "read";
44
- if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|knowledge-base|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
42
+ if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
45
43
  suffix
46
44
  ))
47
45
  return "write";
@@ -349,6 +347,54 @@ var RouterTransport = class {
349
347
  // ../../coding-agents/human-session.ts
350
348
  import { createHash as createHash2 } from "crypto";
351
349
  import { createRequire } from "module";
350
+
351
+ // src/harness/names.ts
352
+ var HARNESS_NAMES = [
353
+ "opencode",
354
+ // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
355
+ // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
356
+ "opencode2",
357
+ // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
358
+ // has NO hook binary — deliberately absent from HOOK_BINS below.
359
+ "kilo",
360
+ // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
361
+ "cline-cli",
362
+ // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
363
+ // Codex hook bridges are optional packages, so there is no hook binary to install either.
364
+ "dsh",
365
+ // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
366
+ // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
367
+ "pi",
368
+ "prime-agent",
369
+ "claude-code",
370
+ "cursor-cli",
371
+ "codex",
372
+ "dcode",
373
+ "antigravity-cli",
374
+ "devin-cli",
375
+ "copilot-cli",
376
+ "grok-build",
377
+ "qwen-code",
378
+ // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
379
+ // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
380
+ "factory-droid",
381
+ // ZCode is a per-prompt HOOK host too, registered in its own CLI config
382
+ // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
383
+ "zcode",
384
+ // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
385
+ "traecode",
386
+ "kimi-code",
387
+ // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
388
+ // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
389
+ "workbuddy",
390
+ // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
391
+ // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
392
+ // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
393
+ // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
394
+ "codebuddy"
395
+ ];
396
+
397
+ // ../../coding-agents/human-session.ts
352
398
  var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
353
399
  var HumanLoginRequiredError = class extends AccessDeniedError {
354
400
  constructor() {
@@ -374,14 +420,14 @@ function humanRouterUrl(value) {
374
420
  if (url.search || url.hash) throw new HumanLoginRequiredError();
375
421
  return canonical2;
376
422
  }
377
- function secureEntry(routerUrl, credentialRef) {
423
+ function secureEntry(routerUrl, credentialRef, harness) {
378
424
  try {
379
- if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
425
+ if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
380
426
  throw new HumanLoginRequiredError();
381
427
  }
382
428
  const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
383
- const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
384
- return new NativeEntry(service, credentialRef, { linux: { store: "secret-service" } });
429
+ const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
430
+ return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
385
431
  } catch {
386
432
  throw new HumanLoginRequiredError();
387
433
  }
@@ -399,9 +445,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
399
445
  routerUrl: session.routerUrl
400
446
  };
401
447
  }
402
- function readHumanSession(routerUrl, credentialRef) {
448
+ function readHumanSession(routerUrl, credentialRef, harness) {
403
449
  try {
404
- const password = secureEntry(routerUrl, credentialRef).getPassword();
450
+ const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
405
451
  if (!password || password.length > 4096) throw new HumanLoginRequiredError();
406
452
  return validateHumanSession(JSON.parse(password), routerUrl);
407
453
  } catch {
@@ -413,11 +459,11 @@ function readHumanSession(routerUrl, credentialRef) {
413
459
  function harnessTransport(harness) {
414
460
  return transportForConfig(harness, loadManagedConfig(process.env, harness));
415
461
  }
416
- function transportForConfig(harness, { config, principal }) {
462
+ function transportForConfig(harness, { config, principal, principalId }) {
417
463
  if (principal.human) {
418
464
  const routerUrl = humanRouterUrl(config.routerUrl);
419
465
  const reference = principal.human.credentialRef;
420
- let session = readHumanSession(routerUrl, reference);
466
+ let session = readHumanSession(routerUrl, reference, principalId);
421
467
  return new RouterTransport({
422
468
  routerUrl,
423
469
  access: principal,
@@ -425,7 +471,7 @@ function transportForConfig(harness, { config, principal }) {
425
471
  tokenPattern: HUMAN_TOKEN_PATTERN,
426
472
  unauthorizedError: () => new HumanLoginRequiredError(),
427
473
  token: () => {
428
- session = readHumanSession(routerUrl, reference);
474
+ session = readHumanSession(routerUrl, reference, principalId);
429
475
  return session.token;
430
476
  }
431
477
  });
@@ -1171,7 +1217,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
1171
1217
  ];
1172
1218
 
1173
1219
  // package.json
1174
- var version = "0.8.9";
1220
+ var version = "0.8.14";
1175
1221
 
1176
1222
  // src/core/util.ts
1177
1223
  import { accessSync, constants } from "fs";
@@ -1685,7 +1731,7 @@ var HindsightClient = class _HindsightClient {
1685
1731
  */
1686
1732
  async tree() {
1687
1733
  if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
1688
- const r = await this.req("GET", this.bankUrl("/knowledge-base/tree"));
1734
+ const r = await this.req("GET", this.bankUrl("/pages/tree"));
1689
1735
  if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
1690
1736
  if (r.status === 404) return [];
1691
1737
  this.knowledgePagesSupported = true;
@@ -1733,7 +1779,7 @@ var HindsightClient = class _HindsightClient {
1733
1779
  if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
1734
1780
  const r = await this.req(
1735
1781
  "GET",
1736
- this.bankUrl(`/knowledge-base/pages/${encodeURIComponent(pageId)}`)
1782
+ this.bankUrl(`/pages/${encodeURIComponent(pageId)}`)
1737
1783
  );
1738
1784
  if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
1739
1785
  return shapePage(await r.json());
@@ -1746,7 +1792,7 @@ var HindsightClient = class _HindsightClient {
1746
1792
  const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
1747
1793
  const r = await this.req(
1748
1794
  "GET",
1749
- this.bankUrl(`/knowledge-base/search${q}`),
1795
+ this.bankUrl(`/pages/search${q}`),
1750
1796
  void 0,
1751
1797
  [],
1752
1798
  opts.timeoutMs
@@ -1765,7 +1811,7 @@ var HindsightClient = class _HindsightClient {
1765
1811
  /**
1766
1812
  * Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
1767
1813
  *
1768
- * Matched by NAME, not id: `/knowledge-base/pages` mints its own `kp-…` id, so a stable
1814
+ * Matched by NAME, not id: `/pages` mints its own `kp-…` id, so a stable
1769
1815
  * client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
1770
1816
  * off a slug). Names are unique per folder server-side, which makes them a sound key.
1771
1817
  *
@@ -1804,7 +1850,7 @@ var HindsightClient = class _HindsightClient {
1804
1850
  trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
1805
1851
  };
1806
1852
  if (!hit) {
1807
- const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), body, [409]);
1853
+ const r = await this.req("POST", this.bankUrl("/pages"), body, [409]);
1808
1854
  if (await this.pagesUnsupported(r)) {
1809
1855
  this.log(
1810
1856
  `[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
@@ -1831,7 +1877,7 @@ var HindsightClient = class _HindsightClient {
1831
1877
  if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
1832
1878
  const r = await this.req(
1833
1879
  "PATCH",
1834
- this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(hit.id)}`),
1880
+ this.bankUrl(`/pages/nodes/${encodeURIComponent(hit.id)}`),
1835
1881
  patch
1836
1882
  );
1837
1883
  if (await this.pagesUnsupported(r)) {
@@ -1885,7 +1931,7 @@ var HindsightClient = class _HindsightClient {
1885
1931
  if (!patch.trigger && !patch.source_query) continue;
1886
1932
  const r = await this.req(
1887
1933
  "PATCH",
1888
- this.bankUrl(`/knowledge-base/nodes/${encodeURIComponent(page.id)}`),
1934
+ this.bankUrl(`/pages/nodes/${encodeURIComponent(page.id)}`),
1889
1935
  patch
1890
1936
  );
1891
1937
  if (r.status === 404) continue;
@@ -1914,7 +1960,7 @@ var HindsightClient = class _HindsightClient {
1914
1960
  let pageId = args.relatesToPageId;
1915
1961
  if (!pageId) {
1916
1962
  const folderId = await this.ensureFolder("Initiatives");
1917
- const r = await this.req("POST", this.bankUrl("/knowledge-base/pages"), {
1963
+ const r = await this.req("POST", this.bankUrl("/pages"), {
1918
1964
  name: args.title,
1919
1965
  source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
1920
1966
  parent_id: folderId,
@@ -1942,7 +1988,7 @@ var HindsightClient = class _HindsightClient {
1942
1988
  /** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
1943
1989
  async ensureFolder(name) {
1944
1990
  try {
1945
- const tree = await (await this.req("GET", this.bankUrl("/knowledge-base/tree"))).json();
1991
+ const tree = await (await this.req("GET", this.bankUrl("/pages/tree"))).json();
1946
1992
  const hit = (tree.roots || []).find(
1947
1993
  (n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
1948
1994
  );
@@ -1951,7 +1997,7 @@ var HindsightClient = class _HindsightClient {
1951
1997
  if (error instanceof AccessDeniedError) throw error;
1952
1998
  }
1953
1999
  try {
1954
- const r = await this.req("POST", this.bankUrl("/knowledge-base/folders"), { name });
2000
+ const r = await this.req("POST", this.bankUrl("/pages/folders"), { name });
1955
2001
  return (await r.json()).id;
1956
2002
  } catch (error) {
1957
2003
  if (error instanceof AccessDeniedError) throw error;
@@ -2762,50 +2808,6 @@ var noRuntimeAdapter = (name, hint) => ({
2762
2808
  throw new Error(hint);
2763
2809
  }
2764
2810
  });
2765
- var HARNESS_NAMES = [
2766
- "opencode",
2767
- // opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
2768
- // package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
2769
- "opencode2",
2770
- // Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
2771
- // has NO hook binary — deliberately absent from HOOK_BINS below.
2772
- "kilo",
2773
- // Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
2774
- "cline-cli",
2775
- // DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
2776
- // Codex hook bridges are optional packages, so there is no hook binary to install either.
2777
- "dsh",
2778
- // pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
2779
- // dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
2780
- "pi",
2781
- "prime-agent",
2782
- "claude-code",
2783
- "cursor-cli",
2784
- "codex",
2785
- "dcode",
2786
- "antigravity-cli",
2787
- "devin-cli",
2788
- "copilot-cli",
2789
- "grok-build",
2790
- "qwen-code",
2791
- // Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
2792
- // stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
2793
- "factory-droid",
2794
- // ZCode is a per-prompt HOOK host too, registered in its own CLI config
2795
- // (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
2796
- "zcode",
2797
- // TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
2798
- "traecode",
2799
- "kimi-code",
2800
- // WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
2801
- // the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
2802
- "workbuddy",
2803
- // CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
2804
- // renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
2805
- // registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
2806
- // writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
2807
- "codebuddy"
2808
- ];
2809
2811
  var HOOK_BINS = {
2810
2812
  "claude-code": "hindsight-claude-hook",
2811
2813
  "cursor-cli": "hindsight-cursor-hook",