@mnemonik/cli 7.140.1 → 7.140.3

package/dist/identity/migrate.js

@@ -885,6 +885,88 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+function parseIdentityFile(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", detail: "identity file must contain a JSON object" };
+  }
+  const record = value;
+  if (record.schemaVersion !== 1) {
+    return { kind: "unknown_version", version: record.schemaVersion };
+  }
+  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
+  if (unknownKey)
+    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
+  if (!isCanonicalUuid(record.projectId)) {
+    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+  }
+  if ("projectName" in record && typeof record.projectName !== "string") {
+    return { kind: "malformed", detail: '"projectName" must be a string when present' };
+  }
+  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
+    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
+  }
+  const fingerprint = record.repositoryFingerprint;
+  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
+  if (unknownFingerprintKey) {
+    return {
+      kind: "malformed",
+      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
+    };
+  }
+  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
+    return {
+      kind: "malformed",
+      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
+    };
+  }
+  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
+  return {
+    kind: "ok",
+    identity: {
+      schemaVersion: 1,
+      projectId: record.projectId,
+      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
+      ...repositoryFingerprint ? { repositoryFingerprint } : {}
+    }
+  };
+}
+var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
+    IDENTITY_KEYS = /* @__PURE__ */ new Set([
+      "schemaVersion",
+      "projectId",
+      "projectName",
+      "repositoryFingerprint"
+    ]);
+    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -982,74 +1064,6 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-function parseIdentityFile(text) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch (error) {
-    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return { kind: "malformed", detail: "identity file must contain a JSON object" };
-  }
-  const record = value;
-  if (record.schemaVersion !== 1) {
-    return { kind: "unknown_version", version: record.schemaVersion };
-  }
-  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
-  if (unknownKey)
-    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
-  if (!isCanonicalUuid(record.projectId)) {
-    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
-  }
-  if ("projectName" in record && typeof record.projectName !== "string") {
-    return { kind: "malformed", detail: '"projectName" must be a string when present' };
-  }
-  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
-    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
-  }
-  const fingerprint = record.repositoryFingerprint;
-  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
-  if (unknownFingerprintKey) {
-    return {
-      kind: "malformed",
-      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
-    };
-  }
-  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
-    return {
-      kind: "malformed",
-      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
-    };
-  }
-  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
-  return {
-    kind: "ok",
-    identity: {
-      schemaVersion: 1,
-      projectId: record.projectId,
-      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
-      ...repositoryFingerprint ? { repositoryFingerprint } : {}
-    }
-  };
-}
-var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
-    IDENTITY_KEYS = /* @__PURE__ */ new Set([
-      "schemaVersion",
-      "projectId",
-      "projectName",
-      "repositoryFingerprint"
-    ]);
-    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
 var init_repositoryRoot = __esm({
   "packages/shared/dist/repositoryRoot.js"() {
@@ -1058,6 +1072,18 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1129,10 +1155,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -2720,7 +2748,7 @@ import { homedir as homedir3 } from "node:os";
 import { dirname as dirname4, isAbsolute, join as join5, resolve as resolve2, sep as sep2 } from "node:path";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 
@@ -2757,6 +2785,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6982,6 +7013,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -6997,6 +7029,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/local-setup/dist/storage.js
 init_hookRuntime();

package/dist/install/hosts.js

@@ -875,7 +875,7 @@ var require_ignore = __commonJS({
 import { CODEX_TRUST_MESSAGE } from "../humanReason.js";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 

package/dist/install/journal.js

@@ -885,6 +885,27 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -982,13 +1003,6 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
 var init_repositoryRoot = __esm({
   "packages/shared/dist/repositoryRoot.js"() {
@@ -997,6 +1011,18 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1068,10 +1094,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -2659,7 +2687,7 @@ import { access, lstat as lstat2, mkdir as mkdir2, open as open2, readFile as re
 import { dirname as dirname4, isAbsolute, join as join5, relative, resolve as resolve2 } from "node:path";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 
@@ -2696,6 +2724,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6921,6 +6952,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -6936,6 +6968,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/local-setup/dist/storage.js
 init_hookRuntime();

package/dist/install/journey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"journey.d.ts","sourceRoot":"","sources":["../../src/install/journey.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA+B3C,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAEhB,MAAM,YAAY,CAAC;AAQpB,eAAO,MAAM,uBAAuB,4DAA4D,CAAC;AACjG,eAAO,MAAM,uBAAuB,0EACqC,CAAC;AAC1E,eAAO,MAAM,oBAAoB,qEACmC,CAAC;AAErE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,SAAS,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;IAC3D,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,GAAG,eAAe,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACzC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EACxB,QAAQ,EAAE,SAAS,UAAU,EAAE,GAC9B,UAAU,CAAC,QAAQ,CAAC,CAKtB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,OAAO,GACf,kBAAkB,EAAE,CAUtB;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,EACvC,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,EACxC,KAAK,GAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAM,GAClD,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B7D;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACjC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAChC,UAAU,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAC1C,OAAO,CAAC,MAAM,CAAC,CAyjCjB"}
+{"version":3,"file":"journey.d.ts","sourceRoot":"","sources":["../../src/install/journey.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA+B3C,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAEhB,MAAM,YAAY,CAAC;AAQpB,eAAO,MAAM,uBAAuB,4DAA4D,CAAC;AACjG,eAAO,MAAM,uBAAuB,0EACqC,CAAC;AAC1E,eAAO,MAAM,oBAAoB,qEACmC,CAAC;AAErE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,SAAS,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;IAC3D,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,GAAG,eAAe,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACzC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EACxB,QAAQ,EAAE,SAAS,UAAU,EAAE,GAC9B,UAAU,CAAC,QAAQ,CAAC,CAKtB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,OAAO,GACf,kBAAkB,EAAE,CAUtB;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,EACvC,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,EACxC,KAAK,GAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAM,GAClD,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B7D;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACjC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAChC,UAAU,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAC1C,OAAO,CAAC,MAAM,CAAC,CAsjCjB"}

package/dist/install/journey.js

@@ -885,6 +885,27 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -982,13 +1003,6 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
 var init_repositoryRoot = __esm({
   "packages/shared/dist/repositoryRoot.js"() {
@@ -997,6 +1011,18 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1068,10 +1094,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -2659,7 +2687,7 @@ import { homedir as homedir3 } from "node:os";
 import { setTimeout as delay2 } from "node:timers/promises";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 
@@ -2696,6 +2724,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6921,6 +6952,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -6936,6 +6968,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/shared/dist/readiness.js
 var READINESS_SCHEMA_VERSION = 1;
@@ -7907,7 +7940,6 @@ async function joinedInstall(flags2, deps, output, authorize, management) {
             const options = {
               cwd: repo.path,
               allowCreate: true,
-              allowNestedInherit: false,
               ...linkProjectId ? { intent: { action: "link", projectId: linkProjectId } } : {}
             };
             const target = await journal.plan(join5(repo.path, ".mnemonik.json"), null, {
@@ -7958,7 +7990,6 @@ async function joinedInstall(flags2, deps, output, authorize, management) {
           const result2 = await executor?.apply({
             cwd: project.root,
             allowCreate: true,
-            allowNestedInherit: false,
             ...linkProjectId ? { intent: { action: "link", projectId: linkProjectId } } : {}
           });
           if (result2?.status !== "done") throw new Error("project_apply_failed");
@@ -8154,7 +8185,6 @@ async function joinedInstall(flags2, deps, output, authorize, management) {
               await executor?.rollback({
                 cwd: projectRoot,
                 allowCreate: true,
-                allowNestedInherit: false,
                 ...linkProjectId ? { intent: { action: "link", projectId: linkProjectId } } : {}
               });
               await journal.restore(target);