@mickey-kras/hindsight-memory-router-coding-agents 0.8.9 → 0.8.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/antigravity-hook.js +70 -24
- package/dist/antigravity-statusline.js +60 -14
- package/dist/antigravity-stop-hook.js +70 -24
- package/dist/claude-hook.js +70 -24
- package/dist/claude-sessionstart-hook.js +70 -24
- package/dist/claude-stop-hook.js +70 -24
- package/dist/cline.js +70 -24
- package/dist/codebuddy-hook.js +70 -24
- package/dist/codebuddy-sessionstart-hook.js +70 -24
- package/dist/codebuddy-stop-hook.js +70 -24
- package/dist/codex-hook.js +70 -24
- package/dist/codex-sessionstart-hook.js +70 -24
- package/dist/codex-stop-hook.js +70 -24
- package/dist/copilot-hook.js +70 -24
- package/dist/copilot-sessionstart-hook.js +70 -24
- package/dist/copilot-stop-hook.js +70 -24
- package/dist/cursor-hook.js +70 -24
- package/dist/cursor-sessionstart-hook.js +70 -24
- package/dist/cursor-stop-hook.js +70 -24
- package/dist/dcode-hook.js +70 -24
- package/dist/dcode-sessionstart-hook.js +70 -24
- package/dist/dcode-stop-hook.js +70 -24
- package/dist/deepen.js +70 -68
- package/dist/devin-hook.js +70 -24
- package/dist/devin-sessionstart-hook.js +70 -24
- package/dist/devin-stop-hook.js +70 -24
- package/dist/droid-hook.js +70 -24
- package/dist/droid-sessionstart-hook.js +70 -24
- package/dist/droid-stop-hook.js +70 -24
- package/dist/dsh.js +70 -24
- package/dist/grok-hook.js +70 -24
- package/dist/grok-sessionstart-hook.js +70 -24
- package/dist/grok-stop-hook.js +70 -24
- package/dist/hindsight-seed.js +60 -14
- package/dist/index.js +70 -24
- package/dist/installer.js +70 -21
- package/dist/kilo.js +70 -24
- package/dist/kimi-hook.js +70 -24
- package/dist/kimi-sessionstart-hook.js +70 -24
- package/dist/kimi-stop-hook.js +70 -24
- package/dist/mcp-server.js +79 -24
- package/dist/opencode2.js +70 -24
- package/dist/pi.js +70 -24
- package/dist/prime-agent.js +70 -24
- package/dist/qwen-hook.js +70 -24
- package/dist/qwen-sessionstart-hook.js +70 -24
- package/dist/qwen-stop-hook.js +70 -24
- package/dist/status.js +70 -24
- package/dist/traecode-hook.js +70 -24
- package/dist/traecode-sessionstart-hook.js +70 -24
- package/dist/traecode-stop-hook.js +70 -24
- package/dist/workbuddy-hook.js +70 -24
- package/dist/workbuddy-sessionstart-hook.js +70 -24
- package/dist/workbuddy-stop-hook.js +70 -24
- package/dist/zcode-hook.js +70 -24
- package/dist/zcode-sessionstart-hook.js +70 -24
- package/dist/zcode-stop-hook.js +70 -24
- package/npm-shrinkwrap.json +257 -711
- package/package.json +8 -5
package/dist/dcode-stop-hook.js
CHANGED
|
@@ -36,12 +36,10 @@ function requireBank(access, bank, operation) {
|
|
|
36
36
|
}
|
|
37
37
|
function classifyOperation(method, suffix) {
|
|
38
38
|
if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
|
|
39
|
-
if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|
|
|
40
|
-
suffix
|
|
41
|
-
))
|
|
39
|
+
if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
|
|
42
40
|
return "read";
|
|
43
41
|
if (method === "GET" && suffix === "") return "read";
|
|
44
|
-
if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|
|
|
42
|
+
if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
|
|
45
43
|
suffix
|
|
46
44
|
))
|
|
47
45
|
return "write";
|
|
@@ -379,6 +377,54 @@ var RouterTransport = class {
|
|
|
379
377
|
// ../../coding-agents/human-session.ts
|
|
380
378
|
import { createHash as createHash2 } from "crypto";
|
|
381
379
|
import { createRequire } from "module";
|
|
380
|
+
|
|
381
|
+
// src/harness/names.ts
|
|
382
|
+
var HARNESS_NAMES = [
|
|
383
|
+
"opencode",
|
|
384
|
+
// opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
|
|
385
|
+
// package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
|
|
386
|
+
"opencode2",
|
|
387
|
+
// Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
|
|
388
|
+
// has NO hook binary — deliberately absent from HOOK_BINS below.
|
|
389
|
+
"kilo",
|
|
390
|
+
// Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
|
|
391
|
+
"cline-cli",
|
|
392
|
+
// DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
|
|
393
|
+
// Codex hook bridges are optional packages, so there is no hook binary to install either.
|
|
394
|
+
"dsh",
|
|
395
|
+
// pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
|
|
396
|
+
// dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
|
|
397
|
+
"pi",
|
|
398
|
+
"prime-agent",
|
|
399
|
+
"claude-code",
|
|
400
|
+
"cursor-cli",
|
|
401
|
+
"codex",
|
|
402
|
+
"dcode",
|
|
403
|
+
"antigravity-cli",
|
|
404
|
+
"devin-cli",
|
|
405
|
+
"copilot-cli",
|
|
406
|
+
"grok-build",
|
|
407
|
+
"qwen-code",
|
|
408
|
+
// Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
|
|
409
|
+
// stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
|
|
410
|
+
"factory-droid",
|
|
411
|
+
// ZCode is a per-prompt HOOK host too, registered in its own CLI config
|
|
412
|
+
// (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
|
|
413
|
+
"zcode",
|
|
414
|
+
// TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
|
|
415
|
+
"traecode",
|
|
416
|
+
"kimi-code",
|
|
417
|
+
// WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
|
|
418
|
+
// the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
|
|
419
|
+
"workbuddy",
|
|
420
|
+
// CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
|
|
421
|
+
// renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
|
|
422
|
+
// registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
|
|
423
|
+
// writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
|
|
424
|
+
"codebuddy"
|
|
425
|
+
];
|
|
426
|
+
|
|
427
|
+
// ../../coding-agents/human-session.ts
|
|
382
428
|
var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
|
|
383
429
|
var HumanLoginRequiredError = class extends AccessDeniedError {
|
|
384
430
|
constructor() {
|
|
@@ -404,14 +450,14 @@ function humanRouterUrl(value) {
|
|
|
404
450
|
if (url.search || url.hash) throw new HumanLoginRequiredError();
|
|
405
451
|
return canonical2;
|
|
406
452
|
}
|
|
407
|
-
function secureEntry(routerUrl, credentialRef) {
|
|
453
|
+
function secureEntry(routerUrl, credentialRef, harness) {
|
|
408
454
|
try {
|
|
409
|
-
if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
|
|
455
|
+
if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
|
|
410
456
|
throw new HumanLoginRequiredError();
|
|
411
457
|
}
|
|
412
458
|
const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
|
|
413
|
-
const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
|
|
414
|
-
return new NativeEntry(service, credentialRef
|
|
459
|
+
const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
|
|
460
|
+
return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
|
|
415
461
|
} catch {
|
|
416
462
|
throw new HumanLoginRequiredError();
|
|
417
463
|
}
|
|
@@ -429,9 +475,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
|
|
|
429
475
|
routerUrl: session.routerUrl
|
|
430
476
|
};
|
|
431
477
|
}
|
|
432
|
-
function readHumanSession(routerUrl, credentialRef) {
|
|
478
|
+
function readHumanSession(routerUrl, credentialRef, harness) {
|
|
433
479
|
try {
|
|
434
|
-
const password = secureEntry(routerUrl, credentialRef).getPassword();
|
|
480
|
+
const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
|
|
435
481
|
if (!password || password.length > 4096) throw new HumanLoginRequiredError();
|
|
436
482
|
return validateHumanSession(JSON.parse(password), routerUrl);
|
|
437
483
|
} catch {
|
|
@@ -443,11 +489,11 @@ function readHumanSession(routerUrl, credentialRef) {
|
|
|
443
489
|
function harnessTransport(harness) {
|
|
444
490
|
return transportForConfig(harness, loadManagedConfig(process.env, harness));
|
|
445
491
|
}
|
|
446
|
-
function transportForConfig(harness, { config: config2, principal }) {
|
|
492
|
+
function transportForConfig(harness, { config: config2, principal, principalId }) {
|
|
447
493
|
if (principal.human) {
|
|
448
494
|
const routerUrl = humanRouterUrl(config2.routerUrl);
|
|
449
495
|
const reference = principal.human.credentialRef;
|
|
450
|
-
let session = readHumanSession(routerUrl, reference);
|
|
496
|
+
let session = readHumanSession(routerUrl, reference, principalId);
|
|
451
497
|
return new RouterTransport({
|
|
452
498
|
routerUrl,
|
|
453
499
|
access: principal,
|
|
@@ -455,7 +501,7 @@ function transportForConfig(harness, { config: config2, principal }) {
|
|
|
455
501
|
tokenPattern: HUMAN_TOKEN_PATTERN,
|
|
456
502
|
unauthorizedError: () => new HumanLoginRequiredError(),
|
|
457
503
|
token: () => {
|
|
458
|
-
session = readHumanSession(routerUrl, reference);
|
|
504
|
+
session = readHumanSession(routerUrl, reference, principalId);
|
|
459
505
|
return session.token;
|
|
460
506
|
}
|
|
461
507
|
});
|
|
@@ -1214,7 +1260,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
|
|
|
1214
1260
|
];
|
|
1215
1261
|
|
|
1216
1262
|
// package.json
|
|
1217
|
-
var version = "0.8.
|
|
1263
|
+
var version = "0.8.14";
|
|
1218
1264
|
|
|
1219
1265
|
// src/core/util.ts
|
|
1220
1266
|
import { accessSync, constants } from "fs";
|
|
@@ -1728,7 +1774,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1728
1774
|
*/
|
|
1729
1775
|
async tree() {
|
|
1730
1776
|
if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
|
|
1731
|
-
const r = await this.req("GET", this.bankUrl("/
|
|
1777
|
+
const r = await this.req("GET", this.bankUrl("/pages/tree"));
|
|
1732
1778
|
if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
|
|
1733
1779
|
if (r.status === 404) return [];
|
|
1734
1780
|
this.knowledgePagesSupported = true;
|
|
@@ -1776,7 +1822,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1776
1822
|
if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
|
|
1777
1823
|
const r = await this.req(
|
|
1778
1824
|
"GET",
|
|
1779
|
-
this.bankUrl(`/
|
|
1825
|
+
this.bankUrl(`/pages/${encodeURIComponent(pageId)}`)
|
|
1780
1826
|
);
|
|
1781
1827
|
if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
|
|
1782
1828
|
return shapePage(await r.json());
|
|
@@ -1789,7 +1835,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1789
1835
|
const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
|
|
1790
1836
|
const r = await this.req(
|
|
1791
1837
|
"GET",
|
|
1792
|
-
this.bankUrl(`/
|
|
1838
|
+
this.bankUrl(`/pages/search${q}`),
|
|
1793
1839
|
void 0,
|
|
1794
1840
|
[],
|
|
1795
1841
|
opts.timeoutMs
|
|
@@ -1808,7 +1854,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1808
1854
|
/**
|
|
1809
1855
|
* Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
|
|
1810
1856
|
*
|
|
1811
|
-
* Matched by NAME, not id: `/
|
|
1857
|
+
* Matched by NAME, not id: `/pages` mints its own `kp-…` id, so a stable
|
|
1812
1858
|
* client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
|
|
1813
1859
|
* off a slug). Names are unique per folder server-side, which makes them a sound key.
|
|
1814
1860
|
*
|
|
@@ -1847,7 +1893,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1847
1893
|
trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
|
|
1848
1894
|
};
|
|
1849
1895
|
if (!hit) {
|
|
1850
|
-
const r = await this.req("POST", this.bankUrl("/
|
|
1896
|
+
const r = await this.req("POST", this.bankUrl("/pages"), body, [409]);
|
|
1851
1897
|
if (await this.pagesUnsupported(r)) {
|
|
1852
1898
|
this.log(
|
|
1853
1899
|
`[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
|
|
@@ -1874,7 +1920,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1874
1920
|
if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
|
|
1875
1921
|
const r = await this.req(
|
|
1876
1922
|
"PATCH",
|
|
1877
|
-
this.bankUrl(`/
|
|
1923
|
+
this.bankUrl(`/pages/nodes/${encodeURIComponent(hit.id)}`),
|
|
1878
1924
|
patch
|
|
1879
1925
|
);
|
|
1880
1926
|
if (await this.pagesUnsupported(r)) {
|
|
@@ -1928,7 +1974,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1928
1974
|
if (!patch.trigger && !patch.source_query) continue;
|
|
1929
1975
|
const r = await this.req(
|
|
1930
1976
|
"PATCH",
|
|
1931
|
-
this.bankUrl(`/
|
|
1977
|
+
this.bankUrl(`/pages/nodes/${encodeURIComponent(page.id)}`),
|
|
1932
1978
|
patch
|
|
1933
1979
|
);
|
|
1934
1980
|
if (r.status === 404) continue;
|
|
@@ -1957,7 +2003,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1957
2003
|
let pageId = args.relatesToPageId;
|
|
1958
2004
|
if (!pageId) {
|
|
1959
2005
|
const folderId = await this.ensureFolder("Initiatives");
|
|
1960
|
-
const r = await this.req("POST", this.bankUrl("/
|
|
2006
|
+
const r = await this.req("POST", this.bankUrl("/pages"), {
|
|
1961
2007
|
name: args.title,
|
|
1962
2008
|
source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
|
|
1963
2009
|
parent_id: folderId,
|
|
@@ -1985,7 +2031,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1985
2031
|
/** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
|
|
1986
2032
|
async ensureFolder(name) {
|
|
1987
2033
|
try {
|
|
1988
|
-
const tree = await (await this.req("GET", this.bankUrl("/
|
|
2034
|
+
const tree = await (await this.req("GET", this.bankUrl("/pages/tree"))).json();
|
|
1989
2035
|
const hit = (tree.roots || []).find(
|
|
1990
2036
|
(n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
|
|
1991
2037
|
);
|
|
@@ -1994,7 +2040,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1994
2040
|
if (error instanceof AccessDeniedError) throw error;
|
|
1995
2041
|
}
|
|
1996
2042
|
try {
|
|
1997
|
-
const r = await this.req("POST", this.bankUrl("/
|
|
2043
|
+
const r = await this.req("POST", this.bankUrl("/pages/folders"), { name });
|
|
1998
2044
|
return (await r.json()).id;
|
|
1999
2045
|
} catch (error) {
|
|
2000
2046
|
if (error instanceof AccessDeniedError) throw error;
|
package/dist/deepen.js
CHANGED
|
@@ -36,12 +36,10 @@ function requireBank(access, bank, operation) {
|
|
|
36
36
|
}
|
|
37
37
|
function classifyOperation(method, suffix) {
|
|
38
38
|
if (method === "POST" && ["/memories/recall", "/reflect"].includes(suffix)) return "read";
|
|
39
|
-
if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|
|
|
40
|
-
suffix
|
|
41
|
-
))
|
|
39
|
+
if (method === "GET" && /^\/(?:config|stats|tags|graph|documents|operations|memories|mental-models|pages)(?:\/[^/]+)*$/.test(suffix))
|
|
42
40
|
return "read";
|
|
43
41
|
if (method === "GET" && suffix === "") return "read";
|
|
44
|
-
if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|
|
|
42
|
+
if (["POST", "PUT", "PATCH", "DELETE"].includes(method) && /^(?:\/(?:config|import|memories|documents|mental-models|pages|consolidate|consolidation)(?:\/[^/]+)*)?$/.test(
|
|
45
43
|
suffix
|
|
46
44
|
))
|
|
47
45
|
return "write";
|
|
@@ -349,6 +347,54 @@ var RouterTransport = class {
|
|
|
349
347
|
// ../../coding-agents/human-session.ts
|
|
350
348
|
import { createHash as createHash2 } from "crypto";
|
|
351
349
|
import { createRequire } from "module";
|
|
350
|
+
|
|
351
|
+
// src/harness/names.ts
|
|
352
|
+
var HARNESS_NAMES = [
|
|
353
|
+
"opencode",
|
|
354
|
+
// opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
|
|
355
|
+
// package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
|
|
356
|
+
"opencode2",
|
|
357
|
+
// Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
|
|
358
|
+
// has NO hook binary — deliberately absent from HOOK_BINS below.
|
|
359
|
+
"kilo",
|
|
360
|
+
// Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
|
|
361
|
+
"cline-cli",
|
|
362
|
+
// DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
|
|
363
|
+
// Codex hook bridges are optional packages, so there is no hook binary to install either.
|
|
364
|
+
"dsh",
|
|
365
|
+
// pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
|
|
366
|
+
// dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
|
|
367
|
+
"pi",
|
|
368
|
+
"prime-agent",
|
|
369
|
+
"claude-code",
|
|
370
|
+
"cursor-cli",
|
|
371
|
+
"codex",
|
|
372
|
+
"dcode",
|
|
373
|
+
"antigravity-cli",
|
|
374
|
+
"devin-cli",
|
|
375
|
+
"copilot-cli",
|
|
376
|
+
"grok-build",
|
|
377
|
+
"qwen-code",
|
|
378
|
+
// Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
|
|
379
|
+
// stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
|
|
380
|
+
"factory-droid",
|
|
381
|
+
// ZCode is a per-prompt HOOK host too, registered in its own CLI config
|
|
382
|
+
// (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
|
|
383
|
+
"zcode",
|
|
384
|
+
// TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
|
|
385
|
+
"traecode",
|
|
386
|
+
"kimi-code",
|
|
387
|
+
// WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
|
|
388
|
+
// the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
|
|
389
|
+
"workbuddy",
|
|
390
|
+
// CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
|
|
391
|
+
// renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
|
|
392
|
+
// registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
|
|
393
|
+
// writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
|
|
394
|
+
"codebuddy"
|
|
395
|
+
];
|
|
396
|
+
|
|
397
|
+
// ../../coding-agents/human-session.ts
|
|
352
398
|
var HUMAN_TOKEN_PATTERN = /^mrh_[0-9a-f]{32}_[0-9a-f]{64}$/;
|
|
353
399
|
var HumanLoginRequiredError = class extends AccessDeniedError {
|
|
354
400
|
constructor() {
|
|
@@ -374,14 +420,14 @@ function humanRouterUrl(value) {
|
|
|
374
420
|
if (url.search || url.hash) throw new HumanLoginRequiredError();
|
|
375
421
|
return canonical2;
|
|
376
422
|
}
|
|
377
|
-
function secureEntry(routerUrl, credentialRef) {
|
|
423
|
+
function secureEntry(routerUrl, credentialRef, harness) {
|
|
378
424
|
try {
|
|
379
|
-
if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef)) {
|
|
425
|
+
if (!["darwin", "win32", "linux"].includes(process.platform) || !/^[A-Za-z0-9._-]{1,64}$/.test(credentialRef) || !HARNESS_NAMES.includes(harness)) {
|
|
380
426
|
throw new HumanLoginRequiredError();
|
|
381
427
|
}
|
|
382
428
|
const { Entry: NativeEntry } = createRequire(import.meta.url)("@napi-rs/keyring");
|
|
383
|
-
const service = `hindsight-memory-router:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
|
|
384
|
-
return new NativeEntry(service, credentialRef
|
|
429
|
+
const service = `hindsight-memory-router:human-v2:${createHash2("sha256").update(humanRouterUrl(routerUrl)).digest("hex")}`;
|
|
430
|
+
return new NativeEntry(service, `${harness}:${credentialRef}`, { linux: { store: "secret-service" } });
|
|
385
431
|
} catch {
|
|
386
432
|
throw new HumanLoginRequiredError();
|
|
387
433
|
}
|
|
@@ -399,9 +445,9 @@ function validateHumanSession(value, routerUrl, allowExpired = false) {
|
|
|
399
445
|
routerUrl: session.routerUrl
|
|
400
446
|
};
|
|
401
447
|
}
|
|
402
|
-
function readHumanSession(routerUrl, credentialRef) {
|
|
448
|
+
function readHumanSession(routerUrl, credentialRef, harness) {
|
|
403
449
|
try {
|
|
404
|
-
const password = secureEntry(routerUrl, credentialRef).getPassword();
|
|
450
|
+
const password = secureEntry(routerUrl, credentialRef, harness).getPassword();
|
|
405
451
|
if (!password || password.length > 4096) throw new HumanLoginRequiredError();
|
|
406
452
|
return validateHumanSession(JSON.parse(password), routerUrl);
|
|
407
453
|
} catch {
|
|
@@ -413,11 +459,11 @@ function readHumanSession(routerUrl, credentialRef) {
|
|
|
413
459
|
function harnessTransport(harness) {
|
|
414
460
|
return transportForConfig(harness, loadManagedConfig(process.env, harness));
|
|
415
461
|
}
|
|
416
|
-
function transportForConfig(harness, { config, principal }) {
|
|
462
|
+
function transportForConfig(harness, { config, principal, principalId }) {
|
|
417
463
|
if (principal.human) {
|
|
418
464
|
const routerUrl = humanRouterUrl(config.routerUrl);
|
|
419
465
|
const reference = principal.human.credentialRef;
|
|
420
|
-
let session = readHumanSession(routerUrl, reference);
|
|
466
|
+
let session = readHumanSession(routerUrl, reference, principalId);
|
|
421
467
|
return new RouterTransport({
|
|
422
468
|
routerUrl,
|
|
423
469
|
access: principal,
|
|
@@ -425,7 +471,7 @@ function transportForConfig(harness, { config, principal }) {
|
|
|
425
471
|
tokenPattern: HUMAN_TOKEN_PATTERN,
|
|
426
472
|
unauthorizedError: () => new HumanLoginRequiredError(),
|
|
427
473
|
token: () => {
|
|
428
|
-
session = readHumanSession(routerUrl, reference);
|
|
474
|
+
session = readHumanSession(routerUrl, reference, principalId);
|
|
429
475
|
return session.token;
|
|
430
476
|
}
|
|
431
477
|
});
|
|
@@ -1171,7 +1217,7 @@ var PLUGIN_GOVERNED_BANK_FIELDS = [
|
|
|
1171
1217
|
];
|
|
1172
1218
|
|
|
1173
1219
|
// package.json
|
|
1174
|
-
var version = "0.8.
|
|
1220
|
+
var version = "0.8.14";
|
|
1175
1221
|
|
|
1176
1222
|
// src/core/util.ts
|
|
1177
1223
|
import { accessSync, constants } from "fs";
|
|
@@ -1685,7 +1731,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1685
1731
|
*/
|
|
1686
1732
|
async tree() {
|
|
1687
1733
|
if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
|
|
1688
|
-
const r = await this.req("GET", this.bankUrl("/
|
|
1734
|
+
const r = await this.req("GET", this.bankUrl("/pages/tree"));
|
|
1689
1735
|
if (await this.pagesUnsupported(r)) throw new KnowledgePagesUnavailableError();
|
|
1690
1736
|
if (r.status === 404) return [];
|
|
1691
1737
|
this.knowledgePagesSupported = true;
|
|
@@ -1733,7 +1779,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1733
1779
|
if (this.knowledgePagesSupported === false) throw new KnowledgePagesUnavailableError();
|
|
1734
1780
|
const r = await this.req(
|
|
1735
1781
|
"GET",
|
|
1736
|
-
this.bankUrl(`/
|
|
1782
|
+
this.bankUrl(`/pages/${encodeURIComponent(pageId)}`)
|
|
1737
1783
|
);
|
|
1738
1784
|
if (r.status === 404) throw new Error(`knowledge page not found: ${pageId}`);
|
|
1739
1785
|
return shapePage(await r.json());
|
|
@@ -1746,7 +1792,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1746
1792
|
const q = `?q=${encodeURIComponent(query)}&limit=${opts.limit ?? this.pageSearchLimit}`;
|
|
1747
1793
|
const r = await this.req(
|
|
1748
1794
|
"GET",
|
|
1749
|
-
this.bankUrl(`/
|
|
1795
|
+
this.bankUrl(`/pages/search${q}`),
|
|
1750
1796
|
void 0,
|
|
1751
1797
|
[],
|
|
1752
1798
|
opts.timeoutMs
|
|
@@ -1765,7 +1811,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1765
1811
|
/**
|
|
1766
1812
|
* Seed the fixed page taxonomy as knowledge-base pages at the tree root, idempotently.
|
|
1767
1813
|
*
|
|
1768
|
-
* Matched by NAME, not id: `/
|
|
1814
|
+
* Matched by NAME, not id: `/pages` mints its own `kp-…` id, so a stable
|
|
1769
1815
|
* client-chosen id isn't available to match on (unlike the old mental-model path, which keyed
|
|
1770
1816
|
* off a slug). Names are unique per folder server-side, which makes them a sound key.
|
|
1771
1817
|
*
|
|
@@ -1804,7 +1850,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1804
1850
|
trigger: pageTriggerFor(pageTrigger, this.bank, page.name)
|
|
1805
1851
|
};
|
|
1806
1852
|
if (!hit) {
|
|
1807
|
-
const r = await this.req("POST", this.bankUrl("/
|
|
1853
|
+
const r = await this.req("POST", this.bankUrl("/pages"), body, [409]);
|
|
1808
1854
|
if (await this.pagesUnsupported(r)) {
|
|
1809
1855
|
this.log(
|
|
1810
1856
|
`[bank] knowledge pages unavailable on ${this.apiUrl}; continuing without pages`
|
|
@@ -1831,7 +1877,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1831
1877
|
if (triggerDrift) patch.trigger = pageTriggerPatch(body.trigger);
|
|
1832
1878
|
const r = await this.req(
|
|
1833
1879
|
"PATCH",
|
|
1834
|
-
this.bankUrl(`/
|
|
1880
|
+
this.bankUrl(`/pages/nodes/${encodeURIComponent(hit.id)}`),
|
|
1835
1881
|
patch
|
|
1836
1882
|
);
|
|
1837
1883
|
if (await this.pagesUnsupported(r)) {
|
|
@@ -1885,7 +1931,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1885
1931
|
if (!patch.trigger && !patch.source_query) continue;
|
|
1886
1932
|
const r = await this.req(
|
|
1887
1933
|
"PATCH",
|
|
1888
|
-
this.bankUrl(`/
|
|
1934
|
+
this.bankUrl(`/pages/nodes/${encodeURIComponent(page.id)}`),
|
|
1889
1935
|
patch
|
|
1890
1936
|
);
|
|
1891
1937
|
if (r.status === 404) continue;
|
|
@@ -1914,7 +1960,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1914
1960
|
let pageId = args.relatesToPageId;
|
|
1915
1961
|
if (!pageId) {
|
|
1916
1962
|
const folderId = await this.ensureFolder("Initiatives");
|
|
1917
|
-
const r = await this.req("POST", this.bankUrl("/
|
|
1963
|
+
const r = await this.req("POST", this.bankUrl("/pages"), {
|
|
1918
1964
|
name: args.title,
|
|
1919
1965
|
source_query: `Summarize the "${args.title}" initiative: what is being built or changed and why, and its current state \u2014 drawn from the project's memory.` + pageScopeRule(this.project),
|
|
1920
1966
|
parent_id: folderId,
|
|
@@ -1942,7 +1988,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1942
1988
|
/** Find a root folder by name (case-insensitive) or create it; returns its id. Fail-open to undefined. */
|
|
1943
1989
|
async ensureFolder(name) {
|
|
1944
1990
|
try {
|
|
1945
|
-
const tree = await (await this.req("GET", this.bankUrl("/
|
|
1991
|
+
const tree = await (await this.req("GET", this.bankUrl("/pages/tree"))).json();
|
|
1946
1992
|
const hit = (tree.roots || []).find(
|
|
1947
1993
|
(n) => n.kind === "folder" && (n.name || "").toLowerCase() === name.toLowerCase()
|
|
1948
1994
|
);
|
|
@@ -1951,7 +1997,7 @@ var HindsightClient = class _HindsightClient {
|
|
|
1951
1997
|
if (error instanceof AccessDeniedError) throw error;
|
|
1952
1998
|
}
|
|
1953
1999
|
try {
|
|
1954
|
-
const r = await this.req("POST", this.bankUrl("/
|
|
2000
|
+
const r = await this.req("POST", this.bankUrl("/pages/folders"), { name });
|
|
1955
2001
|
return (await r.json()).id;
|
|
1956
2002
|
} catch (error) {
|
|
1957
2003
|
if (error instanceof AccessDeniedError) throw error;
|
|
@@ -2762,50 +2808,6 @@ var noRuntimeAdapter = (name, hint) => ({
|
|
|
2762
2808
|
throw new Error(hint);
|
|
2763
2809
|
}
|
|
2764
2810
|
});
|
|
2765
|
-
var HARNESS_NAMES = [
|
|
2766
|
-
"opencode",
|
|
2767
|
-
// opencode v2 (binary `opencode2`) — a ground-up rewrite of the plugin API, loaded from the
|
|
2768
|
-
// package's root index.js (src/opencode2.ts). Like opencode it has NO hook binary.
|
|
2769
|
-
"opencode2",
|
|
2770
|
-
// Kilo CLI is an opencode fork loaded as a persistent plugin (src/kilo.ts), so like opencode it
|
|
2771
|
-
// has NO hook binary — deliberately absent from HOOK_BINS below.
|
|
2772
|
-
"kilo",
|
|
2773
|
-
// Cline CLI loads dist/cline.js through its native plugin manager; file hooks cannot inject.
|
|
2774
|
-
"cline-cli",
|
|
2775
|
-
// DeepSeek Harness loads dist/dsh.js as a native Cordis plugin (src/dsh.ts). Its Claude Code /
|
|
2776
|
-
// Codex hook bridges are optional packages, so there is no hook binary to install either.
|
|
2777
|
-
"dsh",
|
|
2778
|
-
// pi loads dist/pi.js as an extension (src/pi.ts), and Prime Agent — a fork of pi — loads
|
|
2779
|
-
// dist/prime-agent.js the same way (src/prime-agent.ts). Neither has a hook binary.
|
|
2780
|
-
"pi",
|
|
2781
|
-
"prime-agent",
|
|
2782
|
-
"claude-code",
|
|
2783
|
-
"cursor-cli",
|
|
2784
|
-
"codex",
|
|
2785
|
-
"dcode",
|
|
2786
|
-
"antigravity-cli",
|
|
2787
|
-
"devin-cli",
|
|
2788
|
-
"copilot-cli",
|
|
2789
|
-
"grok-build",
|
|
2790
|
-
"qwen-code",
|
|
2791
|
-
// Factory Droid is a per-prompt HOOK host: the installer wires ~/.factory/hooks.json and the
|
|
2792
|
-
// stdio MCP registration in ~/.factory/mcp.json (see src/installer.ts).
|
|
2793
|
-
"factory-droid",
|
|
2794
|
-
// ZCode is a per-prompt HOOK host too, registered in its own CLI config
|
|
2795
|
-
// (~/.zcode/cli/config.json) under `hooks.events` — never the user's real Claude Code settings.
|
|
2796
|
-
"zcode",
|
|
2797
|
-
// TraeCode is a per-prompt HOOK host registered in ~/.trae-cn/hooks.json (see src/installer.ts).
|
|
2798
|
-
"traecode",
|
|
2799
|
-
"kimi-code",
|
|
2800
|
-
// WorkBuddy is a per-prompt HOOK host too: the installer wires ~/.workbuddy/settings.json and
|
|
2801
|
-
// the stdio MCP registration in ~/.workbuddy/mcp.json (see src/installer.ts).
|
|
2802
|
-
"workbuddy",
|
|
2803
|
-
// CodeBuddy Code is the SAME @genie/agent-cli HOOK host, one product config apart (WorkBuddy only
|
|
2804
|
-
// renames the home folder): the installer wires ~/.codebuddy/settings.json and the stdio MCP
|
|
2805
|
-
// registration in CodeBuddy's priority-chained MCP file (see src/installer.ts). The CLI
|
|
2806
|
-
// writes WorkBuddy's transcript format; the CodeBuddy IDE has a reader of its own.
|
|
2807
|
-
"codebuddy"
|
|
2808
|
-
];
|
|
2809
2811
|
var HOOK_BINS = {
|
|
2810
2812
|
"claude-code": "hindsight-claude-hook",
|
|
2811
2813
|
"cursor-cli": "hindsight-cursor-hook",
|