@remnic/cli 9.54.7 → 9.55.0

package/dist/index.js

@@ -18,7 +18,7 @@ async function persistEnrichmentCandidate(storage, entityName, candidate) {
 }
 
 // src/index.ts
-import fs14 from "fs";
+import fs15 from "fs";
 import os3 from "os";
 import path17 from "path";
 import { createHash as createHash4 } from "crypto";
@@ -26,13 +26,13 @@ import * as childProcess2 from "child_process";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { gzipSync } from "zlib";
 import {
-  parseConfig as parseConfig6,
+  parseConfig as parseConfig7,
   isOpenaiApiKeyDisabled,
   resolveEnvVars,
-  resolveRemnicConfigRecord as resolveRemnicConfigRecord5,
-  Orchestrator as Orchestrator3,
+  resolveRemnicConfigRecord as resolveRemnicConfigRecord6,
+  Orchestrator as Orchestrator4,
   EngramAccessService as EngramAccessService2,
-  initLogger as initLogger2,
+  initLogger as initLogger3,
   onboard,
   curate,
   listReviewItems,
@@ -2466,8 +2466,53 @@ function assertBenchModuleFreshForDevelopment() {
   assertLocalBenchBuildFreshForDevelopment(import.meta.url);
 }
 
-// src/daemon-service-candidates.ts
+// src/cmd-security.ts
 import fs7 from "fs";
+import {
+  Orchestrator as Orchestrator3,
+  parseConfig as parseConfig6,
+  initLogger as initLogger2,
+  resolveRemnicConfigRecord as resolveRemnicConfigRecord5,
+  runAuditMemoryCliCommand,
+  formatAuditMemoryReport
+} from "@remnic/core";
+async function cmdSecurity(rest) {
+  const action = rest[0] ?? "help";
+  if (action !== "audit-memory") {
+    console.error(
+      "Unknown security subcommand. Usage: remnic security audit-memory [--since <iso-date>] [--quarantine] [--json]"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  initLogger2();
+  const configPath = resolveConfigPath();
+  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
+  const config = parseConfig6(resolveRemnicConfigRecord5(raw));
+  const orchestrator = new Orchestrator3(config);
+  await orchestrator.initialize();
+  try {
+    const sinceFlag = rest.indexOf("--since");
+    if (sinceFlag >= 0 && !rest[sinceFlag + 1]) {
+      console.error("--since requires a value");
+      process.exitCode = 1;
+      return;
+    }
+    const json = rest.includes("--json");
+    const report = await runAuditMemoryCliCommand({
+      memoryDir: config.memoryDir,
+      storage: orchestrator.storage,
+      since: sinceFlag >= 0 ? rest[sinceFlag + 1] : void 0,
+      quarantine: rest.includes("--quarantine")
+    });
+    console.log(json ? JSON.stringify(report, null, 2) : formatAuditMemoryReport(report));
+  } finally {
+    orchestrator.abortDeferredInit();
+  }
+}
+
+// src/daemon-service-candidates.ts
+import fs8 from "fs";
 import path5 from "path";
 var LAUNCHD_LABEL = "ai.remnic.daemon";
 var LEGACY_REMNIC_SERVER_LAUNCHD_LABEL = "ai.remnic.server";
@@ -2489,7 +2534,7 @@ function systemdUnitPaths(homeDir) {
 function anyFileExists(paths) {
   return paths.some((candidate) => {
     try {
-      return fs7.statSync(candidate).isFile();
+      return fs8.statSync(candidate).isFile();
     } catch {
       return false;
     }
@@ -2501,7 +2546,7 @@ function commandNames(command) {
 }
 function isRunnableNodeScript(filePath) {
   try {
-    const text = fs7.readFileSync(filePath, "utf8").slice(0, 4096);
+    const text = fs8.readFileSync(filePath, "utf8").slice(0, 4096);
     const firstLine = text.split(/\r?\n/, 1)[0] ?? "";
     if (/^#!.*\bnode\b/.test(firstLine)) return true;
     if (firstLine.startsWith("#!")) return false;
@@ -2514,7 +2559,7 @@ function isRunnableNodeScript(filePath) {
 function resolveShimNodeScript(filePath) {
   let text;
   try {
-    text = fs7.readFileSync(filePath, "utf8").slice(0, 16384);
+    text = fs8.readFileSync(filePath, "utf8").slice(0, 16384);
   } catch {
     return void 0;
   }
@@ -2526,8 +2571,8 @@ function resolveShimNodeScript(filePath) {
     const candidate = raw.replaceAll("${basedir}", basedir).replaceAll("$basedir", basedir).replaceAll("\\ ", " ");
     const resolved = path5.isAbsolute(candidate) ? candidate : path5.resolve(basedir, candidate);
     try {
-      if (fs7.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
-        return fs7.realpathSync(resolved);
+      if (fs8.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
+        return fs8.realpathSync(resolved);
       }
     } catch {
     }
@@ -2535,7 +2580,7 @@ function resolveShimNodeScript(filePath) {
   return void 0;
 }
 function resolveRunnableNodeScript(filePath) {
-  const realPath = fs7.realpathSync(filePath);
+  const realPath = fs8.realpathSync(filePath);
   if (isRunnableNodeScript(realPath)) return realPath;
   return resolveShimNodeScript(realPath);
 }
@@ -2545,9 +2590,9 @@ function findCommandOnPath(command, pathEnv = process.env.PATH ?? "") {
     for (const name of commandNames(command)) {
       const candidate = path5.join(dir, name);
       try {
-        const stat2 = fs7.statSync(candidate);
+        const stat2 = fs8.statSync(candidate);
         if (!stat2.isFile()) continue;
-        if (process.platform !== "win32") fs7.accessSync(candidate, fs7.constants.X_OK);
+        if (process.platform !== "win32") fs8.accessSync(candidate, fs8.constants.X_OK);
         const runnable = resolveRunnableNodeScript(candidate);
         if (runnable) return runnable;
       } catch {
@@ -4038,7 +4083,7 @@ function finalizeBenchStatus(filePath) {
 }
 
 // src/bench-fallback.ts
-import fs8 from "fs";
+import fs9 from "fs";
 import path9 from "path";
 var FALLBACK_RESULTS_DIRNAME = "fallback-runs";
 function buildBenchRunnerArgs(parsed, benchmarkId, outputDir) {
@@ -4110,7 +4155,7 @@ function createFallbackBenchOutputDir(resultsDir, benchmarkId, pid, startedAtMs
   );
 }
 function resolveFallbackBenchResultPath(outputDir) {
-  const entries = fs8.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
+  const entries = fs9.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
   if (entries.length === 0) {
     throw new Error(`Fallback benchmark runner did not write a JSON result artifact in ${outputDir}`);
   }
@@ -4118,7 +4163,7 @@ function resolveFallbackBenchResultPath(outputDir) {
 }
 
 // src/openclaw-upgrade-swap.ts
-import fs9 from "fs";
+import fs10 from "fs";
 import path10 from "path";
 function describeError(error) {
   return error instanceof Error ? error.message : String(error);
@@ -4130,7 +4175,7 @@ function createSiblingTempFilePath(targetPath, label) {
 function resolveAtomicWriteMode(targetPath, explicitMode) {
   if (explicitMode !== void 0) return explicitMode;
   try {
-    return fs9.statSync(targetPath).mode & 4095;
+    return fs10.statSync(targetPath).mode & 4095;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return 384;
@@ -4140,8 +4185,8 @@ function resolveAtomicWriteMode(targetPath, explicitMode) {
 }
 function resolveAtomicReplacementPath(targetPath) {
   try {
-    if (fs9.lstatSync(targetPath).isSymbolicLink()) {
-      return fs9.realpathSync(targetPath);
+    if (fs10.lstatSync(targetPath).isSymbolicLink()) {
+      return fs10.realpathSync(targetPath);
     }
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -4158,7 +4203,7 @@ function createSiblingSwapPath(targetDir, label) {
 function cleanupDisplacedDirectoryBestEffort(displacedDir, context) {
   if (!displacedDir) return void 0;
   try {
-    fs9.rmSync(displacedDir, { recursive: true, force: true });
+    fs10.rmSync(displacedDir, { recursive: true, force: true });
     return void 0;
   } catch (error) {
     return `Warning: ${context}, but failed to remove the displaced plugin copy at ${displacedDir}: ${describeError(error)}`;
@@ -4166,43 +4211,43 @@ function cleanupDisplacedDirectoryBestEffort(displacedDir, context) {
 }
 function atomicWriteFileSync(targetPath, data, options = {}) {
   const resolvedTargetPath = resolveAtomicReplacementPath(targetPath);
-  fs9.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
+  fs10.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
   const tempPath = createSiblingTempFilePath(resolvedTargetPath, "write");
   const mode = resolveAtomicWriteMode(resolvedTargetPath, options.mode);
   try {
     if (options.hooks?.writeTempFileSync) {
       options.hooks.writeTempFileSync(tempPath);
     } else {
-      fs9.writeFileSync(tempPath, data, { mode });
+      fs10.writeFileSync(tempPath, data, { mode });
     }
-    fs9.chmodSync(tempPath, mode);
-    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs9.renameSync;
+    fs10.chmodSync(tempPath, mode);
+    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs10.renameSync;
     renameTempFileSync(tempPath, resolvedTargetPath);
   } catch (error) {
-    fs9.rmSync(tempPath, { force: true });
+    fs10.rmSync(tempPath, { force: true });
     throw error;
   }
 }
 function atomicCopyFileSync(sourcePath, targetPath, options = {}) {
-  if (!fs9.existsSync(sourcePath)) return;
+  if (!fs10.existsSync(sourcePath)) return;
   const resolvedTargetPath = resolveAtomicReplacementPath(targetPath);
-  fs9.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
+  fs10.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
   const tempPath = createSiblingTempFilePath(resolvedTargetPath, "copy");
-  const mode = fs9.statSync(sourcePath).mode & 4095;
+  const mode = fs10.statSync(sourcePath).mode & 4095;
   try {
-    const copyTempFileSync = options.hooks?.copyTempFileSync ?? fs9.copyFileSync;
+    const copyTempFileSync = options.hooks?.copyTempFileSync ?? fs10.copyFileSync;
     copyTempFileSync(sourcePath, tempPath);
-    fs9.chmodSync(tempPath, mode);
-    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs9.renameSync;
+    fs10.chmodSync(tempPath, mode);
+    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs10.renameSync;
     renameTempFileSync(tempPath, resolvedTargetPath);
   } catch (error) {
-    fs9.rmSync(tempPath, { force: true });
+    fs10.rmSync(tempPath, { force: true });
     throw error;
   }
 }
 function cleanupRollbackDirectory(rollbackDir) {
   if (!rollbackDir) return;
-  fs9.rmSync(rollbackDir, { recursive: true, force: true });
+  fs10.rmSync(rollbackDir, { recursive: true, force: true });
 }
 function cleanupRollbackDirectoryBestEffort(rollbackDir) {
   if (!rollbackDir) return void 0;
@@ -4214,20 +4259,20 @@ function cleanupRollbackDirectoryBestEffort(rollbackDir) {
   }
 }
 function restoreDirectoryFromRollback(targetDir, rollbackDir) {
-  if (!fs9.existsSync(rollbackDir)) {
+  if (!fs10.existsSync(rollbackDir)) {
     throw new Error(`Rollback directory is missing: ${rollbackDir}`);
   }
-  fs9.mkdirSync(path10.dirname(targetDir), { recursive: true });
-  const displacedDir = fs9.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "rollback-restore") : void 0;
+  fs10.mkdirSync(path10.dirname(targetDir), { recursive: true });
+  const displacedDir = fs10.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "rollback-restore") : void 0;
   if (displacedDir) {
-    fs9.renameSync(targetDir, displacedDir);
+    fs10.renameSync(targetDir, displacedDir);
   }
   try {
-    fs9.renameSync(rollbackDir, targetDir);
+    fs10.renameSync(rollbackDir, targetDir);
   } catch (restoreError) {
-    if (displacedDir && fs9.existsSync(displacedDir)) {
+    if (displacedDir && fs10.existsSync(displacedDir)) {
       try {
-        fs9.renameSync(displacedDir, targetDir);
+        fs10.renameSync(displacedDir, targetDir);
       } catch (revertError) {
         throw new AggregateError(
           [restoreError, revertError],
@@ -4243,23 +4288,23 @@ function restoreDirectoryFromRollback(targetDir, rollbackDir) {
   return cleanupDisplacedDirectoryBestEffort(displacedDir, `restored the previous plugin copy into ${targetDir}`);
 }
 function restoreDirectoryFromBackup(targetDir, backupDir) {
-  if (!fs9.existsSync(backupDir)) {
+  if (!fs10.existsSync(backupDir)) {
     throw new Error(`Plugin backup directory is missing: ${backupDir}`);
   }
-  fs9.mkdirSync(path10.dirname(targetDir), { recursive: true });
+  fs10.mkdirSync(path10.dirname(targetDir), { recursive: true });
   const stagedDir = createSiblingSwapPath(targetDir, "backup-restore");
-  const displacedDir = fs9.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "pre-backup-restore") : void 0;
-  fs9.cpSync(backupDir, stagedDir, { recursive: true });
+  const displacedDir = fs10.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "pre-backup-restore") : void 0;
+  fs10.cpSync(backupDir, stagedDir, { recursive: true });
   if (displacedDir) {
-    fs9.renameSync(targetDir, displacedDir);
+    fs10.renameSync(targetDir, displacedDir);
   }
   try {
-    fs9.renameSync(stagedDir, targetDir);
+    fs10.renameSync(stagedDir, targetDir);
   } catch (restoreError) {
-    fs9.rmSync(targetDir, { recursive: true, force: true });
-    if (displacedDir && fs9.existsSync(displacedDir)) {
+    fs10.rmSync(targetDir, { recursive: true, force: true });
+    if (displacedDir && fs10.existsSync(displacedDir)) {
       try {
-        fs9.renameSync(displacedDir, targetDir);
+        fs10.renameSync(displacedDir, targetDir);
       } catch (revertError) {
         throw new AggregateError(
           [restoreError, revertError],
@@ -4267,7 +4312,7 @@ function restoreDirectoryFromBackup(targetDir, backupDir) {
         );
       }
     }
-    fs9.rmSync(stagedDir, { recursive: true, force: true });
+    fs10.rmSync(stagedDir, { recursive: true, force: true });
     throw new Error(
       `Failed to restore the plugin backup into ${targetDir}. The durable backup remains preserved at ${backupDir}.`,
       { cause: restoreError }
@@ -4292,7 +4337,7 @@ function rollbackOpenclawUpgrade({
   let configRemovalAttempted = false;
   let pluginRestored = false;
   try {
-    if (rollbackDir && fs9.existsSync(rollbackDir)) {
+    if (rollbackDir && fs10.existsSync(rollbackDir)) {
       const cleanupWarning = restoreDirectoryFromRollback(pluginDir, rollbackDir);
       notes.push(`Restored previous plugin from rollback copy at ${rollbackDir}`);
       if (cleanupWarning) notes.push(cleanupWarning);
@@ -4302,7 +4347,7 @@ function rollbackOpenclawUpgrade({
     rollbackRestoreError = error instanceof Error ? error.message : String(error);
   }
   try {
-    if (!pluginRestored && pluginBackupDir && fs9.existsSync(pluginBackupDir)) {
+    if (!pluginRestored && pluginBackupDir && fs10.existsSync(pluginBackupDir)) {
       const cleanupWarning = restoreDirectoryFromBackup(pluginDir, pluginBackupDir);
       if (rollbackRestoreError) {
         notes.push(`Rollback copy restore failed; restored previous plugin from durable backup at ${pluginBackupDir}`);
@@ -4327,12 +4372,12 @@ function rollbackOpenclawUpgrade({
     notes.push("No previous plugin copy was available for automatic restore");
   }
   try {
-    if (configBackupPath && fs9.existsSync(configBackupPath)) {
+    if (configBackupPath && fs10.existsSync(configBackupPath)) {
       restoreFileFromBackup(configPath, configBackupPath);
       notes.push(`Restored OpenClaw config from backup at ${configBackupPath}`);
-    } else if (removeConfigIfUnbacked && fs9.existsSync(configPath)) {
+    } else if (removeConfigIfUnbacked && fs10.existsSync(configPath)) {
       configRemovalAttempted = true;
-      fs9.rmSync(configPath, { force: true });
+      fs10.rmSync(configPath, { force: true });
       notes.push("Removed OpenClaw config created during the failed upgrade");
     }
   } catch (error) {
@@ -4385,7 +4430,7 @@ Run this manually when you're ready:
 
 // src/openclaw-managed-upgrade-loader.ts
 import { execFileSync } from "child_process";
-import fs10 from "fs";
+import fs11 from "fs";
 import os from "os";
 import path11 from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL2 } from "url";
@@ -4461,7 +4506,7 @@ function buildOpenclawManagedUpgradePackageSpec(version = "latest") {
 function readCliAdapterRange() {
   const moduleDir = path11.dirname(fileURLToPath3(import.meta.url));
   const manifestPath = path11.resolve(moduleDir, "../package.json");
-  const manifest = JSON.parse(fs10.readFileSync(manifestPath, "utf8"));
+  const manifest = JSON.parse(fs11.readFileSync(manifestPath, "utf8"));
   if (manifest.name !== "@remnic/cli") {
     throw new Error(`Invalid @remnic/cli package manifest at ${manifestPath}.`);
   }
@@ -4505,7 +4550,7 @@ async function loadOpenclawManagedUpgradeModule(packageSpec, hooks = {}) {
     const adapterMissing = isSpecifierNotFoundError(error, OPENCLAW_PLUGIN_PACKAGE) || isSpecifierNotFoundError(error, MANAGED_UPGRADE_SPECIFIER) || isManagedUpgradeSubpathMissing(error);
     if (!adapterMissing) throw error;
   }
-  const temporaryRoot = fs10.mkdtempSync(path11.join(os.tmpdir(), "remnic-openclaw-upgrade-"));
+  const temporaryRoot = fs11.mkdtempSync(path11.join(os.tmpdir(), "remnic-openclaw-upgrade-"));
   try {
     const toolingPackageSpec = `${OPENCLAW_PLUGIN_PACKAGE}@${readCliAdapterRange()}`;
     const installArgs = [
@@ -4520,12 +4565,12 @@ async function loadOpenclawManagedUpgradeModule(packageSpec, hooks = {}) {
     ];
     (hooks.runNpmInstall ?? runNpmInstall)(installArgs);
     const resolverPath = path11.join(temporaryRoot, "load-managed-upgrade.mjs");
-    fs10.writeFileSync(resolverPath, `export * from ${JSON.stringify(MANAGED_UPGRADE_SPECIFIER)};
+    fs11.writeFileSync(resolverPath, `export * from ${JSON.stringify(MANAGED_UPGRADE_SPECIFIER)};
 `, "utf8");
     return await importModule(pathToFileURL2(resolverPath).href);
   } finally {
     try {
-      fs10.rmSync(temporaryRoot, { recursive: true, force: true });
+      fs11.rmSync(temporaryRoot, { recursive: true, force: true });
     } catch (error) {
       const detail = error instanceof Error ? error.message : String(error);
       console.warn(`Could not remove temporary managed upgrade project at ${temporaryRoot}: ${detail}`);
@@ -4534,7 +4579,7 @@ async function loadOpenclawManagedUpgradeModule(packageSpec, hooks = {}) {
 }
 
 // src/daemon-service.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import path12 from "path";
 import * as childProcess from "child_process";
 import { fileURLToPath as fileURLToPath4 } from "url";
@@ -4546,7 +4591,7 @@ function launchdUnloadPlist(plistPath, processApi = childProcess) {
   processApi.execFileSync("launchctl", ["unload", plistPath], { stdio: "pipe" });
 }
 function resolveServerBinDetails(options = {}) {
-  const existsSync4 = options.existsSync ?? fs11.existsSync;
+  const existsSync4 = options.existsSync ?? fs12.existsSync;
   const findCommandOnPath2 = options.findCommandOnPath ?? findCommandOnPath;
   const moduleDir = options.moduleDir ?? thisModuleDir;
   const packageResolve = options.packageResolve ?? resolveImportSpecifier;
@@ -4605,8 +4650,8 @@ function resolveServerBin(options = {}) {
   return resolveServerBinDetails(options).path;
 }
 function readVerifiedDaemonPid(options) {
-  const readFileSync4 = options.readFileSync ?? fs11.readFileSync;
-  const unlinkSync = options.unlinkSync ?? fs11.unlinkSync;
+  const readFileSync4 = options.readFileSync ?? fs12.readFileSync;
+  const unlinkSync = options.unlinkSync ?? fs12.unlinkSync;
   const processKill = options.processKill ?? process.kill;
   const platform = options.platform ?? process.platform;
   const execFileSync4 = options.execFileSync ?? ((command, args, execOptions) => childProcess.execFileSync(command, args, execOptions));
@@ -4706,8 +4751,8 @@ function removePidFileBestEffort(file, unlinkSync) {
   }
 }
 function inspectLaunchdPlist(plistPath, options = {}) {
-  const existsSync4 = options.existsSync ?? fs11.existsSync;
-  const readFileSync4 = options.readFileSync ?? fs11.readFileSync;
+  const existsSync4 = options.existsSync ?? fs12.existsSync;
+  const readFileSync4 = options.readFileSync ?? fs12.readFileSync;
   if (!existsSync4(plistPath)) {
     return {
       installed: false,
@@ -4941,7 +4986,7 @@ function stripConfigArgv(args) {
 }
 
 // src/import-dispatch.ts
-import fs12 from "fs";
+import fs13 from "fs";
 import {
   runImporter,
   validateImportBatchSize,
@@ -5455,7 +5500,7 @@ async function cmdImport(rest, targetFactory, disposeTarget, ioOverrides = {}) {
   let materializedTarget;
   let materializePromise;
   const io = {
-    readFile: ioOverrides.readFile ?? (async (p) => fs12.promises.readFile(p, "utf-8")),
+    readFile: ioOverrides.readFile ?? (async (p) => fs13.promises.readFile(p, "utf-8")),
     loadAdapter: ioOverrides.loadAdapter ?? (async (name) => (await loadImporterModule(name)).adapter),
     runImporter: ioOverrides.runImporter ?? runImporter,
     getWriteTarget: async () => {
@@ -5568,7 +5613,7 @@ async function cmdCapture(rest, io) {
 }
 
 // src/import-lossless-claw-cmd.ts
-import fs13 from "fs";
+import fs14 from "fs";
 import path14 from "path";
 import {
   applyLcmSchema,
@@ -5680,15 +5725,15 @@ async function loadImportLosslessClawModule() {
 
 // src/import-lossless-claw-cmd.ts
 function assertDirectoryOrAbsent(p, label) {
-  if (fs13.existsSync(p) && !fs13.statSync(p).isDirectory()) {
+  if (fs14.existsSync(p) && !fs14.statSync(p).isDirectory()) {
     throw new Error(`${label} is not a directory: ${p}`);
   }
 }
 function assertFile(p, label) {
-  if (!fs13.existsSync(p)) {
+  if (!fs14.existsSync(p)) {
     throw new Error(`${label} does not exist: ${p}`);
   }
-  if (!fs13.statSync(p).isFile()) {
+  if (!fs14.statSync(p).isFile()) {
     throw new Error(`${label} is not a file: ${p}`);
   }
 }
@@ -5720,7 +5765,7 @@ async function cmdImportLosslessClaw(argv, io, deps = {}) {
     try {
       if (parsed.dryRun) {
         const lcmPath = path14.join(memoryDir, "state", "lcm.sqlite");
-        if (fs13.existsSync(lcmPath)) {
+        if (fs14.existsSync(lcmPath)) {
           destDb = mod.openExistingLcmDatabaseReadOnly(lcmPath);
         } else {
           destDb = mod.openInMemoryDestinationDatabase();
@@ -6921,7 +6966,7 @@ async function resolveAllBenchmarks() {
   if (packageBenchmarks) {
     return packageBenchmarks.filter((entry) => entry.runnerAvailable).map((entry) => entry.id);
   }
-  if (!fs14.existsSync(EVAL_RUNNER_PATH)) {
+  if (!fs15.existsSync(EVAL_RUNNER_PATH)) {
     return [];
   }
   return BENCHMARK_CATALOG.filter((entry) => entry.category !== "ingestion").map((entry) => entry.id);
@@ -6969,7 +7014,7 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
       `Fallback benchmark runner does not support provider-backed, gateway, or thinking/timeout flags (${unsupportedOptions.join(", ")}). Build/install @remnic/bench to use those options.`
     );
   }
-  if (!fs14.existsSync(EVAL_RUNNER_PATH)) {
+  if (!fs15.existsSync(EVAL_RUNNER_PATH)) {
     console.error(
       "Benchmark runner not found. Expected eval runner at evals/run.ts or a phase-1 @remnic/bench runtime export."
     );
@@ -6979,7 +7024,7 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
     path17.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
     path17.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
   ];
-  const tsxCmd = tsxCandidates.find((candidate) => fs14.existsSync(candidate)) ?? "tsx";
+  const tsxCmd = tsxCandidates.find((candidate) => fs15.existsSync(candidate)) ?? "tsx";
   const fallbackOutputDir = createFallbackBenchOutputDir(
     parsed.resultsDir ?? resolveBenchOutputDir(),
     benchmarkId,
@@ -7124,9 +7169,9 @@ var PERSONAMEM_COMPLETION_MARKER = path17.join(
 );
 function resolveRealpathWithinDataset(datasetPath, relativePath) {
   try {
-    const datasetRoot = fs14.realpathSync(datasetPath);
+    const datasetRoot = fs15.realpathSync(datasetPath);
     const candidatePath = path17.resolve(datasetRoot, relativePath);
-    const candidateRealPath = fs14.realpathSync(candidatePath);
+    const candidateRealPath = fs15.realpathSync(candidatePath);
     const relativeToRoot = path17.relative(datasetRoot, candidateRealPath);
     if (relativeToRoot.startsWith("..") || path17.isAbsolute(relativeToRoot)) {
       return null;
@@ -7185,14 +7230,14 @@ function parseCsvRows(raw) {
 function isPersonaMemDatasetComplete(datasetPath) {
   try {
     const completionMarkerPath = path17.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
-    if (fs14.statSync(completionMarkerPath).isFile()) {
+    if (fs15.statSync(completionMarkerPath).isFile()) {
       return true;
     }
   } catch {
   }
   const datasetFile = PERSONAMEM_DATASET_FILE_CANDIDATES.find((candidate) => {
     try {
-      return fs14.statSync(path17.join(datasetPath, candidate)).isFile();
+      return fs15.statSync(path17.join(datasetPath, candidate)).isFile();
     } catch {
       return false;
     }
@@ -7201,7 +7246,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     return false;
   }
   try {
-    const rows = parseCsvRows(fs14.readFileSync(path17.join(datasetPath, datasetFile), "utf8"));
+    const rows = parseCsvRows(fs15.readFileSync(path17.join(datasetPath, datasetFile), "utf8"));
     if (rows.length < 2) {
       return false;
     }
@@ -7216,7 +7261,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     }
     return historyPaths.every((relativePath) => {
       const resolvedPath = resolveRealpathWithinDataset(datasetPath, relativePath);
-      return resolvedPath !== null && fs14.statSync(resolvedPath).isFile();
+      return resolvedPath !== null && fs15.statSync(resolvedPath).isFile();
     });
   } catch {
     return false;
@@ -7224,7 +7269,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
 }
 function hasDatasetFile(datasetPath, relativePath) {
   try {
-    return fs14.statSync(path17.join(datasetPath, relativePath)).isFile();
+    return fs15.statSync(path17.join(datasetPath, relativePath)).isFile();
   } catch {
     return false;
   }
@@ -7244,10 +7289,10 @@ function memoryAgentBenchDatasetHasRecSysSamples(datasetPath) {
   return candidateFilenames.some((filename) => {
     const filePath = path17.join(datasetPath, filename);
     try {
-      if (!fs14.statSync(filePath).isFile()) {
+      if (!fs15.statSync(filePath).isFile()) {
         return false;
       }
-      const raw = fs14.readFileSync(filePath, "utf8");
+      const raw = fs15.readFileSync(filePath, "utf8");
       return /"source"\s*:\s*"recsys[_-]/i.test(raw);
     } catch {
       return false;
@@ -7263,7 +7308,7 @@ function isMemoryAgentBenchDatasetComplete(datasetPath) {
 function isDatasetDownloaded(datasetPath, benchmarkId) {
   let stats;
   try {
-    stats = fs14.statSync(datasetPath);
+    stats = fs15.statSync(datasetPath);
   } catch {
     return false;
   }
@@ -7273,7 +7318,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   const marker = DOWNLOADED_DATASET_MARKERS[benchmarkId];
   if (!marker) {
     try {
-      return fs14.readdirSync(datasetPath).length > 0;
+      return fs15.readdirSync(datasetPath).length > 0;
     } catch {
       return false;
     }
@@ -7281,7 +7326,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.allOf) {
     const hasAllRequiredFiles = marker.allOf.every((name) => {
       try {
-        return fs14.statSync(path17.join(datasetPath, name)).isFile();
+        return fs15.statSync(path17.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -7293,7 +7338,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.anyOf) {
     const hasMarkerFile = marker.anyOf.some((name) => {
       try {
-        return fs14.statSync(path17.join(datasetPath, name)).isFile();
+        return fs15.statSync(path17.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -7311,7 +7356,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   }
   if (marker.ext) {
     try {
-      return fs14.readdirSync(datasetPath).some(
+      return fs15.readdirSync(datasetPath).some(
         (name) => name.endsWith(marker.ext) && !marker.exclude?.includes(name)
       );
     } catch {
@@ -7323,7 +7368,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
 async function launchBenchUi(resultsDir) {
   const benchUiDir = path17.join(CLI_REPO_ROOT, "packages", "bench-ui");
   const pnpmCmd = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
-  if (!fs14.existsSync(path17.join(benchUiDir, "package.json"))) {
+  if (!fs15.existsSync(path17.join(benchUiDir, "package.json"))) {
     console.error("ERROR: @remnic/bench-ui is not available in this checkout.");
     process.exit(1);
   }
@@ -7361,13 +7406,13 @@ function listDownloadableBenchmarks() {
 }
 function resolveDatasetDownloadScriptPath() {
   const bundled = path17.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
-  if (fs14.existsSync(bundled)) {
+  if (fs15.existsSync(bundled)) {
     return bundled;
   }
   return path17.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
 }
 function isRepoCheckout() {
-  return fs14.existsSync(path17.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs14.existsSync(path17.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
+  return fs15.existsSync(path17.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs15.existsSync(path17.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
 }
 function runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, jsonMode) {
   const stdio = jsonMode ? ["inherit", process.stderr, "inherit"] : "inherit";
@@ -7680,8 +7725,8 @@ async function exportBenchPackageResult(parsed) {
     ...reportCardProvenance ? { reportCardProvenance } : {}
   });
   if (parsed.output) {
-    fs14.mkdirSync(path17.dirname(parsed.output), { recursive: true });
-    fs14.writeFileSync(parsed.output, rendered);
+    fs15.mkdirSync(path17.dirname(parsed.output), { recursive: true });
+    fs15.writeFileSync(parsed.output, rendered);
     console.log(`Exported ${summary.id} as ${parsed.format} to ${parsed.output}`);
     return;
   }
@@ -7726,7 +7771,7 @@ async function manageBenchDatasets(parsed) {
     process.exit(1);
   }
   const scriptPath = resolveDatasetDownloadScriptPath();
-  if (!fs14.existsSync(scriptPath)) {
+  if (!fs15.existsSync(scriptPath)) {
     console.error(`ERROR: dataset download script not found: ${scriptPath}`);
     process.exit(1);
   }
@@ -7926,7 +7971,7 @@ async function calibrateBenchJudges(parsed, rawArgs) {
     );
     process.exit(1);
   }
-  const sourceResultSha256 = createHash4("sha256").update(fs14.readFileSync(latest.path)).digest("hex");
+  const sourceResultSha256 = createHash4("sha256").update(fs15.readFileSync(latest.path)).digest("hex");
   const expandedManifestPath = expandTilde(manifestPath);
   if (!bench.resolveLocalLabJudgeProviderConfig) {
     console.error(
@@ -8341,7 +8386,7 @@ function loadPinnedLoCoMoTaskSelector(parsed) {
   }
   let decoded;
   try {
-    decoded = JSON.parse(fs14.readFileSync(parsed.taskIdsFile, "utf8"));
+    decoded = JSON.parse(fs15.readFileSync(parsed.taskIdsFile, "utf8"));
   } catch (error) {
     throw new Error(
       `Unable to read --task-ids-file ${parsed.taskIdsFile}: ${error instanceof Error ? error.message : String(error)}`
@@ -9016,7 +9061,7 @@ function resolveBenchReproDatasetDir(datasetDir) {
     return void 0;
   }
   try {
-    return fs14.realpathSync(datasetDir);
+    return fs15.realpathSync(datasetDir);
   } catch {
     return datasetDir;
   }
@@ -9070,13 +9115,13 @@ async function writeBenchReproManifestForPackageRun(args) {
 }
 function loadStandaloneConvergeCommandConfig() {
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  return parseConfig6(resolveRemnicConfigRecord5(raw));
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  return parseConfig7(resolveRemnicConfigRecord6(raw));
 }
 function parseConvergePluginConfig(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
   if (Object.keys(value).length === 0) return void 0;
-  return parseConfig6(resolveRemnicConfigRecord5(value));
+  return parseConfig7(resolveRemnicConfigRecord6(value));
 }
 function loadConvergeCommandConfig() {
   if (readCompatEnv("REMNIC_CONFIG_PATH", "ENGRAM_CONFIG_PATH")) {
@@ -9099,13 +9144,13 @@ function resolveConfigPath(cliPath) {
     path17.join(resolveHomeDir(), ".config", "engram", "config.json")
   ];
   for (const candidate of candidates) {
-    if (fs14.existsSync(candidate)) return candidate;
+    if (fs15.existsSync(candidate)) return candidate;
   }
   return path17.join(resolveHomeDir(), ".config", "remnic", "config.json");
 }
 function resolveExistingBenchRemnicConfigPath(cliPath) {
   const configPath = resolveConfigPath(cliPath);
-  if (fs14.existsSync(configPath)) {
+  if (fs15.existsSync(configPath)) {
     return configPath;
   }
   if (cliPath) {
@@ -9115,7 +9160,7 @@ function resolveExistingBenchRemnicConfigPath(cliPath) {
 }
 function resolveExistingBenchOpenclawConfigPath(cliPath) {
   const configPath = resolveOpenclawConfigPath(cliPath);
-  if (fs14.existsSync(configPath)) {
+  if (fs15.existsSync(configPath)) {
     return configPath;
   }
   if (cliPath) {
@@ -9222,8 +9267,8 @@ function resolveMemoryDir() {
     const envMemoryDir = readCompatEnv("REMNIC_MEMORY_DIR", "ENGRAM_MEMORY_DIR");
     if (envMemoryDir) return normalizeMemoryDirPath(envMemoryDir);
     const configPath = resolveConfigPath();
-    const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord5(raw);
+    const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord6(raw);
     if (typeof remnicCfg.memoryDir === "string" && remnicCfg.memoryDir.length > 0) {
       return normalizeMemoryDirPath(remnicCfg.memoryDir);
     }
@@ -9231,18 +9276,18 @@ function resolveMemoryDir() {
     const standalonePath = path17.join(home, ".remnic", "memory");
     const legacyStandalonePath = path17.join(home, ".engram", "memory");
     const openclawPath = path17.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
-    if (fs14.existsSync(standalonePath)) return standalonePath;
-    if (fs14.existsSync(legacyStandalonePath)) return legacyStandalonePath;
+    if (fs15.existsSync(standalonePath)) return standalonePath;
+    if (fs15.existsSync(legacyStandalonePath)) return legacyStandalonePath;
     return openclawPath;
   })();
   const manifestPath = getManifestPath();
-  if (fs14.existsSync(manifestPath)) {
+  if (fs15.existsSync(manifestPath)) {
     try {
       const active = getActiveSpace();
       if (active?.memoryDir) {
         const activeMemoryDir = normalizeMemoryDirPath(active.memoryDir);
-        if (!fs14.existsSync(activeMemoryDir)) {
-          fs14.mkdirSync(activeMemoryDir, { recursive: true });
+        if (!fs15.existsSync(activeMemoryDir)) {
+          fs15.mkdirSync(activeMemoryDir, { recursive: true });
         }
         return activeMemoryDir;
       }
@@ -9291,13 +9336,13 @@ function resolveOpenclawConfigPath(cliPath) {
   const envPath = process.env.OPENCLAW_CONFIG_PATH || process.env.OPENCLAW_ENGRAM_CONFIG_PATH;
   if (envPath) return path17.resolve(expandTilde(envPath));
   for (const candidate of DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR) {
-    if (fs14.existsSync(candidate)) return candidate;
+    if (fs15.existsSync(candidate)) return candidate;
   }
   return path17.join(resolveOpenclawStateDir(), "openclaw.json");
 }
 function readOpenclawConfig(configPath) {
-  if (!fs14.existsSync(configPath)) return {};
-  const raw = fs14.readFileSync(configPath, "utf-8");
+  if (!fs15.existsSync(configPath)) return {};
+  const raw = fs15.readFileSync(configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -9399,9 +9444,9 @@ function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
   return `${yyyy}${mm}${dd}-${hh}${min}${ss}`;
 }
 function backupPathIfPresent(sourcePath, backupPath) {
-  if (!fs14.existsSync(sourcePath)) return false;
-  fs14.mkdirSync(path17.dirname(backupPath), { recursive: true });
-  fs14.cpSync(sourcePath, backupPath, { recursive: true });
+  if (!fs15.existsSync(sourcePath)) return false;
+  fs15.mkdirSync(path17.dirname(backupPath), { recursive: true });
+  fs15.cpSync(sourcePath, backupPath, { recursive: true });
   return true;
 }
 function restartOpenclawGateway() {
@@ -9420,7 +9465,7 @@ function restartOpenclawGateway() {
 }
 function cmdInit() {
   const configPath = path17.join(process.cwd(), "remnic.config.json");
-  if (fs14.existsSync(configPath)) {
+  if (fs15.existsSync(configPath)) {
     console.log(`Config already exists: ${configPath}`);
     return;
   }
@@ -9436,7 +9481,7 @@ function cmdInit() {
       authToken: "${REMNIC_AUTH_TOKEN}"
     }
   };
-  fs14.writeFileSync(configPath, JSON.stringify(template, null, 2) + "\n");
+  fs15.writeFileSync(configPath, JSON.stringify(template, null, 2) + "\n");
   console.log(`Created ${configPath}`);
   console.log("\nSet these environment variables:");
   console.log("  export OPENAI_API_KEY=sk-...");
@@ -9506,7 +9551,7 @@ async function cmdStatus(json) {
 }
 function oauthReadConfigRecord(configPath) {
   try {
-    const parsed = JSON.parse(fs14.readFileSync(configPath, "utf8"));
+    const parsed = JSON.parse(fs15.readFileSync(configPath, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -9920,12 +9965,12 @@ async function cmdQuery(queryText, json, explain) {
     console.error("Usage: remnic query <text>");
     process.exit(1);
   }
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
-  const orchestrator = new Orchestrator3(config);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
+  const orchestrator = new Orchestrator4(config);
   await orchestrator.initialize();
   const service = new EngramAccessService2(orchestrator);
   const recallRequest = buildQueryRecallRequest(queryText);
@@ -10091,12 +10136,12 @@ async function runXrayCommand(rest, io) {
 async function cmdXray(rest) {
   const { rawQuery, options } = extractXrayRawArgs(rest);
   parseXrayCliOptions(rawQuery, options);
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
-  const orchestrator = new Orchestrator3(config);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
+  const orchestrator = new Orchestrator4(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
   const service = new EngramAccessService2(orchestrator);
@@ -10114,11 +10159,11 @@ async function cmdXray(rest) {
   }
 }
 async function cmdVersions(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   if (!config.versioningEnabled) {
     console.error("Page versioning is disabled (versioningEnabled = false).");
     process.exit(1);
@@ -10230,11 +10275,11 @@ Options:
   }
 }
 async function cmdEnrich(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   const subcommand = rest[0];
   if (subcommand === "audit") {
     const memoryDir2 = expandTilde(config.memoryDir);
@@ -10262,7 +10307,7 @@ async function cmdEnrich(rest) {
     pipelineConfig2.providers = [
       { id: "web-search", enabled: true, costTier: "cheap" }
     ];
-    const orchestrator2 = new Orchestrator3(config);
+    const orchestrator2 = new Orchestrator4(config);
     await orchestrator2.initialize();
     await orchestrator2.deferredReady;
     const searchBackend2 = orchestrator2.qmd;
@@ -10298,7 +10343,7 @@ Registered providers:`);
     console.error("Usage: remnic enrich <entity-name> | --all | --dry-run | audit | providers");
     process.exit(1);
   }
-  const orchestrator = new Orchestrator3(config);
+  const orchestrator = new Orchestrator4(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
   const storage = await orchestrator.getStorage(config.defaultNamespace);
@@ -10424,7 +10469,7 @@ Registered providers:`);
   }
 }
 async function cmdProcedural(rest) {
-  initLogger2();
+  initLogger3();
   const subcommand = rest[0];
   if (!subcommand || subcommand === "--help" || subcommand === "-h") {
     console.log(`remnic procedural \u2014 Procedural memory operations (issue #567)
@@ -10477,9 +10522,9 @@ Shared with:
     process.exit(1);
   }
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   const memoryDir = expandTilde(
     typeof memoryDirOverride === "string" && memoryDirOverride.length > 0 ? memoryDirOverride : config.memoryDir ?? resolveMemoryDir()
   );
@@ -10492,11 +10537,11 @@ Shared with:
   process.stdout.write(formatProcedureStatsText(report));
 }
 async function cmdExtensions(action, rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   const root = resolveExtensionsRoot(config);
   const noopLog = { warn: () => {
   }, debug: () => {
@@ -10545,7 +10590,7 @@ Root: ${root}`);
       const extensions = await discoverMemoryExtensions(root, warnLog);
       let entries = [];
       try {
-        entries = fs14.readdirSync(root);
+        entries = fs15.readdirSync(root);
       } catch {
         console.log(`Extensions root does not exist: ${root}`);
         process.exitCode = 0;
@@ -10556,7 +10601,7 @@ Root: ${root}`);
       for (const entry of entries) {
         const entryPath = path17.join(root, entry);
         try {
-          if (!fs14.statSync(entryPath).isDirectory()) continue;
+          if (!fs15.statSync(entryPath).isDirectory()) continue;
         } catch {
           continue;
         }
@@ -10586,11 +10631,11 @@ Root: ${root}`);
   }
 }
 async function cmdBriefing(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   if (!config.briefing.enabled) {
     console.error("Briefing is disabled in config (briefing.enabled = false).");
     process.exit(1);
@@ -10643,7 +10688,7 @@ async function cmdBriefing(rest) {
     process.exit(1);
   }
   const format = effectiveFormatFlag === "json" ? "json" : effectiveFormatFlag === "markdown" ? "markdown" : config.briefing.defaultFormat;
-  const orchestrator = new Orchestrator3(config);
+  const orchestrator = new Orchestrator4(config);
   await orchestrator.initialize();
   const storage = await orchestrator.getStorage(config.defaultNamespace);
   const calendarSource = config.briefing.calendarSource ? new FileCalendarSource(config.briefing.calendarSource) : void 0;
@@ -10668,10 +10713,10 @@ async function cmdBriefing(rest) {
   if (save) {
     try {
       const saveDir = resolveBriefingSaveDir(config.briefing.saveDir);
-      fs14.mkdirSync(saveDir, { recursive: true });
+      fs15.mkdirSync(saveDir, { recursive: true });
       const filename = briefingFilename(new Date(result.window.to), format);
       const filePath = path17.join(saveDir, filename);
-      fs14.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
+      fs15.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
       console.error(`Saved briefing: ${filePath}`);
     } catch (err) {
       console.error(`Failed to save briefing: ${err instanceof Error ? err.message : String(err)}`);
@@ -10689,7 +10734,7 @@ async function cmdDoctor() {
     detail: `${nodeVersion} (requires >= 22.12.0)`
   });
   const configPath = resolveConfigPath();
-  const configExists = fs14.existsSync(configPath);
+  const configExists = fs15.existsSync(configPath);
   checks.push({ name: "Config file", ok: configExists, detail: configPath });
   let standaloneConfig;
   let standaloneConfigError;
@@ -10697,11 +10742,11 @@ async function cmdDoctor() {
   let configuredNs = { invalid: false };
   if (configExists) {
     try {
-      const raw = JSON.parse(fs14.readFileSync(configPath, "utf8"));
-      const remnicCfg = resolveRemnicConfigRecord5(raw);
+      const raw = JSON.parse(fs15.readFileSync(configPath, "utf8"));
+      const remnicCfg = resolveRemnicConfigRecord6(raw);
       standaloneOpenaiApiKeyExplicitlyFalse = isOpenaiApiKeyDisabled(remnicCfg.openaiApiKey);
       configuredNs = readConfiguredNamespace(remnicCfg);
-      standaloneConfig = parseConfig6(remnicCfg);
+      standaloneConfig = parseConfig7(remnicCfg);
     } catch (err) {
       standaloneConfigError = err instanceof Error ? err.message : String(err);
     }
@@ -10710,10 +10755,10 @@ async function cmdDoctor() {
   try {
     memoryDir = resolveMemoryDir();
   } catch {
-    memoryDir = parseConfig6({}).memoryDir;
+    memoryDir = parseConfig7({}).memoryDir;
   }
   try {
-    fs14.mkdirSync(memoryDir, { recursive: true });
+    fs15.mkdirSync(memoryDir, { recursive: true });
     checks.push({ name: "Memory directory", ok: true, detail: memoryDir });
   } catch {
     checks.push({ name: "Memory directory", ok: false, detail: `cannot create ${memoryDir}` });
@@ -10742,7 +10787,7 @@ async function cmdDoctor() {
   });
   if (nsPolicyCheck) checks.push(nsPolicyCheck);
   const openclawConfigPath = resolveOpenclawConfigPath();
-  const openclawConfigExists = fs14.existsSync(openclawConfigPath);
+  const openclawConfigExists = fs15.existsSync(openclawConfigPath);
   let openclawConfig = {};
   let openclawConfigValid = false;
   let openclawPluginModeConfigured = false;
@@ -10750,7 +10795,7 @@ async function cmdDoctor() {
   let activeOpenclawEntryConfig = null;
   if (openclawConfigExists) {
     try {
-      const parsed = JSON.parse(fs14.readFileSync(openclawConfigPath, "utf-8"));
+      const parsed = JSON.parse(fs15.readFileSync(openclawConfigPath, "utf-8"));
       if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
         openclawConfig = parsed;
         openclawConfigValid = true;
@@ -10830,9 +10875,9 @@ async function cmdDoctor() {
         let memDirOk = false;
         let memDirDetail = `${resolvedMemDir} (not found)`;
         let memDirRemediation = `Run \`remnic openclaw install --memory-dir "${resolvedMemDir}"\` to create the directory.`;
-        if (fs14.existsSync(resolvedMemDir)) {
+        if (fs15.existsSync(resolvedMemDir)) {
           try {
-            const stat2 = fs14.statSync(resolvedMemDir);
+            const stat2 = fs15.statSync(resolvedMemDir);
             if (stat2.isDirectory()) {
               memDirOk = true;
               memDirDetail = resolvedMemDir;
@@ -10974,12 +11019,12 @@ async function cmdDoctor() {
 }
 function cmdConfig() {
   const configPath = resolveConfigPath();
-  if (!fs14.existsSync(configPath)) {
+  if (!fs15.existsSync(configPath)) {
     console.log("No config file found. Run `remnic init` to create one.");
     return;
   }
   console.log(`Config: ${configPath}`);
-  const rawConfig = fs14.readFileSync(configPath, "utf8");
+  const rawConfig = fs15.readFileSync(configPath, "utf8");
   const redacted = rawConfig.replace(
     /("(?:openaiApiKey|localLlmApiKey|authToken|apiKey|remoteSearchApiKey|meilisearchApiKey|opikApiKey)"\s*:\s*")([^"]*)(")/g,
     "$1[REDACTED]$3"
@@ -11087,9 +11132,9 @@ async function cmdReview(action, rest) {
     const configPath = resolveConfigPath();
     let tombstonesConfig = null;
     try {
-      const rawCfg = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-      const remnicCfg = resolveRemnicConfigRecord5(rawCfg);
-      const config = parseConfig6(remnicCfg);
+      const rawCfg = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+      const remnicCfg = resolveRemnicConfigRecord6(rawCfg);
+      const config = parseConfig7(remnicCfg);
       tombstonesConfig = {
         enabled: config.tombstonesEnabled,
         semanticMatch: config.tombstonesSemanticMatch,
@@ -11831,7 +11876,7 @@ async function pushOfflineFileContent(args) {
 }
 async function pushOfflineFileContentFromChunkReader(args) {
   const filePath = resolveOfflineDirectHydrationPath(args.memoryDir, args.file.path);
-  const stat2 = fs14.statSync(filePath);
+  const stat2 = fs15.statSync(filePath);
   if (stat2.mtimeMs !== args.file.mtimeMs) {
     throw new Error(`local file changed while pushing offline content: ${args.file.path}`);
   }
@@ -12322,7 +12367,7 @@ function advanceOfflineBaseFilesForSuccessfulPush(options) {
   return [...next.values()].sort((left, right) => left.path.localeCompare(right.path));
 }
 async function runOfflineSyncOnce(options) {
-  fs14.mkdirSync(options.memoryDir, { recursive: true });
+  fs15.mkdirSync(options.memoryDir, { recursive: true });
   let activeStatePath = options.statePath;
   let priorState = await readOfflineSyncState(activeStatePath);
   let syncNamespace = options.namespace ?? priorState?.namespace;
@@ -12955,7 +13000,7 @@ Environment fallbacks:
   const configPath = resolveConfigPath();
   let config;
   try {
-    const rawConfig = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
+    const rawConfig = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
     config = parseConfigQuietly(pickOfflineConfigRecord(rawConfig));
   } catch {
     throw new Error(
@@ -12970,7 +13015,7 @@ Environment fallbacks:
   const statePath = statePathExplicit ? path17.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
   if (action === "prepare") {
     if (!remoteUrl || !token || !statePath) throw new Error("offline prepare requires remote URL and token");
-    fs14.mkdirSync(memoryDir, { recursive: true });
+    fs15.mkdirSync(memoryDir, { recursive: true });
     const remoteSnapshot = await fetchOfflineSnapshot({
       remoteUrl,
       token,
@@ -13069,7 +13114,7 @@ Environment fallbacks:
     return;
   }
   if (action === "status") {
-    fs14.mkdirSync(memoryDir, { recursive: true });
+    fs15.mkdirSync(memoryDir, { recursive: true });
     const state = statePath ? await readOfflineSyncState(statePath) : null;
     if (state && remoteUrl && statePath) {
       assertOfflineStateMatches({
@@ -13207,7 +13252,7 @@ function cmdDedup(json) {
 function readInstalledConnectorConfig(configPath, fallback) {
   if (!configPath) return fallback;
   try {
-    const parsed = JSON.parse(fs14.readFileSync(configPath, "utf8"));
+    const parsed = JSON.parse(fs15.readFileSync(configPath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return fallback;
     const { token: _token, ...config } = parsed;
     return config;
@@ -13385,7 +13430,7 @@ async function cmdConnectors(action, rest, json) {
           const pub = factory();
           const available = await pub.isHostAvailable();
           const extRoot = available ? await pub.resolveExtensionRoot() : "(host not installed)";
-          const extensionExists = available && extRoot ? fs14.existsSync(extRoot) : false;
+          const extensionExists = available && extRoot ? fs15.existsSync(extRoot) : false;
           publisherChecks.push({
             name: `Publisher: ${targetHostId}`,
             ok: !available || extensionExists,
@@ -13459,7 +13504,7 @@ async function cmdConnectors(action, rest, json) {
     let connectorsCfg;
     const configPath = resolveConfigPath();
     try {
-      const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
+      const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
       connectorsCfg = parseConfigQuietly(raw).connectors;
     } catch {
       process.stderr.write(
@@ -13533,12 +13578,12 @@ async function cmdConnectors(action, rest, json) {
       process.exitCode = 2;
       return;
     }
-    initLogger2();
+    initLogger3();
     const configPath = resolveConfigPath();
-    const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord5(raw);
-    const config = parseConfig6(remnicCfg);
-    const orchestrator = new Orchestrator3(config);
+    const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord6(raw);
+    const config = parseConfig7(remnicCfg);
+    const orchestrator = new Orchestrator4(config);
     try {
       await orchestrator.initialize();
       await orchestrator.deferredReady;
@@ -13660,9 +13705,9 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
     console.error(`connectors marketplace: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
-  const rawConfig = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const pluginConfig = resolveRemnicConfigRecord5(rawConfig);
-  const config = parseConfig6(pluginConfig);
+  const rawConfig = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const pluginConfig = resolveRemnicConfigRecord6(rawConfig);
+  const config = parseConfig7(pluginConfig);
   if (subAction === "generate") {
     let outputDir;
     try {
@@ -13682,13 +13727,13 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
   } else if (subAction === "validate") {
     const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path17.join(process.cwd(), "marketplace.json");
     const resolved = path17.resolve(targetPath);
-    if (!fs14.existsSync(resolved)) {
+    if (!fs15.existsSync(resolved)) {
       console.error(`File not found: ${resolved}`);
       process.exit(1);
     }
     let parsed;
     try {
-      parsed = JSON.parse(fs14.readFileSync(resolved, "utf8"));
+      parsed = JSON.parse(fs15.readFileSync(resolved, "utf8"));
     } catch {
       console.error(`Invalid JSON in ${resolved}`);
       process.exit(1);
@@ -13887,12 +13932,12 @@ async function cmdSpace(action, rest, json) {
   }
 }
 async function cmdLegacyBenchmark(action, rest, json) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
-  const orchestrator = new Orchestrator3(config);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
+  const orchestrator = new Orchestrator4(config);
   const service = new EngramAccessService2(orchestrator);
   const { runBenchSuite, loadBaseline, checkRegression } = await loadBenchModule();
   const benchConfig = {
@@ -14293,7 +14338,7 @@ function readPid() {
 function inferPort() {
   try {
     const configPath = resolveConfigPath();
-    const raw = JSON.parse(fs14.readFileSync(configPath, "utf8"));
+    const raw = JSON.parse(fs15.readFileSync(configPath, "utf8"));
     return raw.server?.port ?? 4318;
   } catch {
     return 4318;
@@ -14388,13 +14433,13 @@ function daemonInstall() {
     process.exit(1);
   }
   const vars = { HOME: home, NODE_PATH: nodePath, REMNIC_SERVER_BIN: serverBin };
-  fs14.mkdirSync(LOGS_DIR, { recursive: true });
+  fs15.mkdirSync(LOGS_DIR, { recursive: true });
   if (isMacOS()) {
     const templatePath = path17.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
-    const template = fs14.readFileSync(templatePath, "utf8");
+    const template = fs15.readFileSync(templatePath, "utf8");
     const plist = renderTemplate(template, vars);
-    fs14.mkdirSync(path17.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
-    fs14.writeFileSync(LAUNCHD_PLIST_PATH, plist);
+    fs15.mkdirSync(path17.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
+    fs15.writeFileSync(LAUNCHD_PLIST_PATH, plist);
     try {
       launchdLoadPlist(LAUNCHD_PLIST_PATH);
     } catch (err) {
@@ -14411,10 +14456,10 @@ function daemonInstall() {
     console.log(`  Logs: ${LOGS_DIR}/daemon.log`);
   } else if (isLinux()) {
     const templatePath = path17.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
-    const template = fs14.readFileSync(templatePath, "utf8");
+    const template = fs15.readFileSync(templatePath, "utf8");
     const unit = renderTemplate(template, vars);
-    fs14.mkdirSync(path17.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
-    fs14.writeFileSync(SYSTEMD_UNIT_PATH, unit);
+    fs15.mkdirSync(path17.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
+    fs15.writeFileSync(SYSTEMD_UNIT_PATH, unit);
     try {
       childProcess2.execSync("systemctl --user daemon-reload", { stdio: "pipe" });
     } catch (err) {
@@ -14450,7 +14495,7 @@ function daemonUninstall() {
       } catch {
       }
       try {
-        fs14.unlinkSync(plistPath);
+        fs15.unlinkSync(plistPath);
         removed = true;
         console.log(`Removed launchd service: ${plistPath}`);
       } catch {
@@ -14470,7 +14515,7 @@ function daemonUninstall() {
     let removed = false;
     for (const unitPath of SYSTEMD_UNIT_PATHS) {
       try {
-        fs14.unlinkSync(unitPath);
+        fs15.unlinkSync(unitPath);
         removed = true;
         console.log(`Removed systemd service: ${unitPath}`);
       } catch {
@@ -14537,13 +14582,13 @@ async function daemonStatus() {
   console.log(`  Port:      ${port}`);
   console.log(`  Service:   ${serviceInstalled ? "installed" : "not installed"}`);
   console.log(`  Platform:  ${process.platform}`);
-  console.log(`  PID file:  ${fs14.existsSync(PID_FILE) ? PID_FILE : LEGACY_PID_FILE}`);
-  console.log(`  Log file:  ${fs14.existsSync(LOG_FILE) ? LOG_FILE : LEGACY_LOG_FILE}`);
+  console.log(`  PID file:  ${fs15.existsSync(PID_FILE) ? PID_FILE : LEGACY_PID_FILE}`);
+  console.log(`  Log file:  ${fs15.existsSync(LOG_FILE) ? LOG_FILE : LEGACY_LOG_FILE}`);
   try {
     const configPath = resolveConfigPath();
-    const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord5(raw);
-    const config = parseConfig6(remnicCfg);
+    const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord6(raw);
+    const config = parseConfig7(remnicCfg);
     const extRoot = resolveExtensionsRoot(config);
     const noopLog = { warn: () => {
     }, debug: () => {
@@ -14582,9 +14627,9 @@ function daemonStart() {
       return;
     }
   }
-  fs14.mkdirSync(PID_DIR, { recursive: true });
-  fs14.mkdirSync(LOGS_DIR, { recursive: true });
-  const logStream = fs14.openSync(LOG_FILE, "a");
+  fs15.mkdirSync(PID_DIR, { recursive: true });
+  fs15.mkdirSync(LOGS_DIR, { recursive: true });
+  const logStream = fs15.openSync(LOG_FILE, "a");
   const serverBin = resolveServerBin();
   const isSource = serverBin.endsWith(".ts");
   let cmd;
@@ -14606,7 +14651,7 @@ function daemonStart() {
     }
   });
   child.unref();
-  fs14.writeFileSync(PID_FILE, String(child.pid));
+  fs15.writeFileSync(PID_FILE, String(child.pid));
   console.log(`Started remnic server (pid ${child.pid})`);
   console.log(`  Log: ${LOG_FILE}`);
 }
@@ -14640,11 +14685,11 @@ function daemonStop() {
     console.log("Process not found (cleaning up PID file)");
   }
   try {
-    fs14.unlinkSync(PID_FILE);
+    fs15.unlinkSync(PID_FILE);
   } catch {
   }
   try {
-    fs14.unlinkSync(LEGACY_PID_FILE);
+    fs15.unlinkSync(LEGACY_PID_FILE);
   } catch {
   }
 }
@@ -14770,11 +14815,11 @@ async function promptYesNo(question, defaultYes = true) {
   });
 }
 async function cmdBinary(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   const memoryDir = resolveMemoryDir();
   const blConfig = {
     enabled: config.binaryLifecycleEnabled,
@@ -14963,7 +15008,7 @@ async function cmdOpenclawInstall(opts) {
   } else if (slotIsActiveLegacy) {
     changes.push(`  Slot left as "${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID}" \u2014 re-run with --yes to activate the new entry`);
   }
-  if (!fs14.existsSync(memoryDir)) changes.push(`+ Will create memory directory: ${memoryDir}`);
+  if (!fs15.existsSync(memoryDir)) changes.push(`+ Will create memory directory: ${memoryDir}`);
   if (hasLegacy && migrateLegacy) {
     changes.push(`~ Legacy '${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID}' entry retained (safe to remove after verifying hooks fire)`);
   }
@@ -14983,8 +15028,8 @@ async function cmdOpenclawInstall(opts) {
 Resulting plugins.slots.memory: ${dryRunPlugins.slots?.memory ?? "(unset)"}`);
     return;
   }
-  if (fs14.existsSync(memoryDir)) {
-    const st = fs14.statSync(memoryDir);
+  if (fs15.existsSync(memoryDir)) {
+    const st = fs15.statSync(memoryDir);
     if (!st.isDirectory()) {
       throw new Error(
         `Cannot use ${memoryDir} as the memory directory \u2014 a file already exists at that path.
@@ -14992,12 +15037,12 @@ Remove it first and re-run, or choose a different path with --memory-dir.`
       );
     }
   } else {
-    fs14.mkdirSync(memoryDir, { recursive: true });
+    fs15.mkdirSync(memoryDir, { recursive: true });
     console.log(`Created memory directory: ${memoryDir}`);
   }
   const configDir = path17.dirname(configPath);
-  if (!fs14.existsSync(configDir)) {
-    fs14.mkdirSync(configDir, { recursive: true });
+  if (!fs15.existsSync(configDir)) {
+    fs15.mkdirSync(configDir, { recursive: true });
   }
   atomicWriteFileSync(configPath, JSON.stringify(updatedConfig, null, 2) + "\n");
   console.log("\nDone! Summary of changes:");
@@ -15026,7 +15071,7 @@ async function cmdOpenclawUpgrade(opts) {
   const legacyPluginDirForBackup = opts.legacyPluginDirForBackup ? resolveOpenclawLegacyPluginDir(opts.legacyPluginDirForBackup) : void 0;
   const fallbackMemoryDir = path17.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
   const packageSpec = buildOpenclawManagedUpgradePackageSpec(opts.version);
-  const configExistedBefore = fs14.existsSync(configPath);
+  const configExistedBefore = fs15.existsSync(configPath);
   const existingConfig = readOpenclawConfig(configPath);
   const { entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
   const preservedMemoryDir = opts.memoryDir ? path17.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
@@ -15251,15 +15296,15 @@ async function cmdOpenclawMigrateEngram(opts) {
 }
 function createOpenclawUpgradeBackupDir() {
   const backupsRoot = path17.join(resolveOpenclawStateDir(), "backups");
-  fs14.mkdirSync(backupsRoot, { recursive: true });
-  return fs14.mkdtempSync(path17.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
+  fs15.mkdirSync(backupsRoot, { recursive: true });
+  return fs15.mkdtempSync(path17.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
 }
 async function cmdTaxonomy(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   if (!config.taxonomyEnabled) {
     console.error(
       "Taxonomy is disabled in config (taxonomyEnabled = false). Enable it to use taxonomy commands."
@@ -15295,8 +15340,8 @@ async function cmdTaxonomy(rest) {
       console.log(doc);
       if (config.taxonomyAutoGenResolver) {
         const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs14.mkdirSync(path17.dirname(resolverPath), { recursive: true });
-        fs14.writeFileSync(resolverPath, doc);
+        fs15.mkdirSync(path17.dirname(resolverPath), { recursive: true });
+        fs15.writeFileSync(resolverPath, doc);
         console.error(`Written: ${resolverPath}`);
       }
       break;
@@ -15342,7 +15387,7 @@ async function cmdTaxonomy(rest) {
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
         const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs14.writeFileSync(resolverPath, doc);
+        fs15.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
       break;
@@ -15373,7 +15418,7 @@ async function cmdTaxonomy(rest) {
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
         const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs14.writeFileSync(resolverPath, doc);
+        fs15.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
       break;
@@ -15564,12 +15609,12 @@ async function runTrainingExport(args, stdout = process.stdout) {
       `Unknown training-export format "${args.format}". ${validList}`
     );
   }
-  if (!fs14.existsSync(args.memoryDir)) {
+  if (!fs15.existsSync(args.memoryDir)) {
     throw new Error(
       `--memory-dir "${args.memoryDir}" does not exist. Provide the path to an existing memory directory.`
     );
   }
-  if (!fs14.statSync(args.memoryDir).isDirectory()) {
+  if (!fs15.statSync(args.memoryDir).isDirectory()) {
     throw new Error(
       `--memory-dir "${args.memoryDir}" is not a directory. Provide the path to a memory directory, not a file.`
     );
@@ -15655,10 +15700,10 @@ async function runTrainingExport(args, stdout = process.stdout) {
   }
   const formatted = adapter.formatRecords(records);
   const outDir = path17.dirname(args.output);
-  fs14.mkdirSync(outDir, { recursive: true });
+  fs15.mkdirSync(outDir, { recursive: true });
   const tmpPath = `${args.output}.tmp-${process.pid}-${Date.now()}`;
-  fs14.writeFileSync(tmpPath, formatted, "utf-8");
-  fs14.renameSync(tmpPath, args.output);
+  fs15.writeFileSync(tmpPath, formatted, "utf-8");
+  fs15.renameSync(tmpPath, args.output);
   stdout.write(
     `Exported ${records.length} records to ${args.output} (${adapter.name} format)
 `
@@ -15707,6 +15752,9 @@ async function main(argv = process.argv.slice(2)) {
     case "xray":
       await cmdXray(rest);
       break;
+    case "security":
+      await cmdSecurity(rest);
+      break;
     case "doctor":
       await cmdDoctor();
       break;
@@ -15827,7 +15875,7 @@ async function main(argv = process.argv.slice(2)) {
             }
           }, 500);
         };
-        fs14.watch(memoryDir, { recursive: true }, (_event, filename) => {
+        fs15.watch(memoryDir, { recursive: true }, (_event, filename) => {
           if (filename && filename.startsWith(".")) return;
           rebuild();
         });
@@ -15835,12 +15883,12 @@ async function main(argv = process.argv.slice(2)) {
         });
       } else if (subAction === "validate") {
         const treeDir = outputDir;
-        if (!fs14.existsSync(treeDir)) {
+        if (!fs15.existsSync(treeDir)) {
           console.error(`Context tree not found at ${treeDir}. Run 'remnic tree generate' first.`);
           process.exit(1);
         }
         const indexPath = path17.join(treeDir, "INDEX.md");
-        if (!fs14.existsSync(indexPath)) {
+        if (!fs15.existsSync(indexPath)) {
           console.error(`INDEX.md missing in ${treeDir}. Tree may be corrupt \u2014 regenerate.`);
           process.exit(1);
         }
@@ -16022,10 +16070,10 @@ Other:
         let wearablesService;
         try {
           const configPath = resolveConfigPath();
-          const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-          const remnicCfg = resolveRemnicConfigRecord5(raw);
-          const config = parseConfig6(remnicCfg);
-          wearablesOrchestrator = new Orchestrator3(config);
+          const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+          const remnicCfg = resolveRemnicConfigRecord6(raw);
+          const config = parseConfig7(remnicCfg);
+          wearablesOrchestrator = new Orchestrator4(config);
           await wearablesOrchestrator.initialize();
           await wearablesOrchestrator.deferredReady;
           wearablesService = wearablesOrchestrator.getWearablesService();
@@ -16077,10 +16125,10 @@ Other:
       const targetFactory = async () => {
         if (!orchestratorSingleton) {
           const configPath = resolveConfigPath();
-          const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-          const remnicCfg = resolveRemnicConfigRecord5(raw);
-          const config = parseConfig6(remnicCfg);
-          orchestratorSingleton = new Orchestrator3(config);
+          const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+          const remnicCfg = resolveRemnicConfigRecord6(raw);
+          const config = parseConfig7(remnicCfg);
+          orchestratorSingleton = new Orchestrator4(config);
           await orchestratorSingleton.initialize();
           await orchestratorSingleton.deferredReady;
         }