@remnic/cli 9.54.8 → 9.56.0

package/dist/index.js

@@ -18,21 +18,21 @@ async function persistEnrichmentCandidate(storage, entityName, candidate) {
 }
 
 // src/index.ts
-import fs14 from "fs";
+import fs15 from "fs";
 import os3 from "os";
-import path17 from "path";
+import path18 from "path";
 import { createHash as createHash4 } from "crypto";
 import * as childProcess2 from "child_process";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { gzipSync } from "zlib";
 import {
-  parseConfig as parseConfig6,
+  parseConfig as parseConfig7,
   isOpenaiApiKeyDisabled,
   resolveEnvVars,
-  resolveRemnicConfigRecord as resolveRemnicConfigRecord5,
-  Orchestrator as Orchestrator3,
+  resolveRemnicConfigRecord as resolveRemnicConfigRecord6,
+  Orchestrator as Orchestrator4,
   EngramAccessService as EngramAccessService2,
-  initLogger as initLogger2,
+  initLogger as initLogger3,
   onboard,
   curate,
   listReviewItems,
@@ -2466,8 +2466,53 @@ function assertBenchModuleFreshForDevelopment() {
   assertLocalBenchBuildFreshForDevelopment(import.meta.url);
 }
 
-// src/daemon-service-candidates.ts
+// src/cmd-security.ts
 import fs7 from "fs";
+import {
+  Orchestrator as Orchestrator3,
+  parseConfig as parseConfig6,
+  initLogger as initLogger2,
+  resolveRemnicConfigRecord as resolveRemnicConfigRecord5,
+  runAuditMemoryCliCommand,
+  formatAuditMemoryReport
+} from "@remnic/core";
+async function cmdSecurity(rest) {
+  const action = rest[0] ?? "help";
+  if (action !== "audit-memory") {
+    console.error(
+      "Unknown security subcommand. Usage: remnic security audit-memory [--since <iso-date>] [--quarantine] [--json]"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  initLogger2();
+  const configPath = resolveConfigPath();
+  const raw = fs7.existsSync(configPath) ? JSON.parse(fs7.readFileSync(configPath, "utf8")) : {};
+  const config = parseConfig6(resolveRemnicConfigRecord5(raw));
+  const orchestrator = new Orchestrator3(config);
+  await orchestrator.initialize();
+  try {
+    const sinceFlag = rest.indexOf("--since");
+    if (sinceFlag >= 0 && !rest[sinceFlag + 1]) {
+      console.error("--since requires a value");
+      process.exitCode = 1;
+      return;
+    }
+    const json = rest.includes("--json");
+    const report = await runAuditMemoryCliCommand({
+      memoryDir: config.memoryDir,
+      storage: orchestrator.storage,
+      since: sinceFlag >= 0 ? rest[sinceFlag + 1] : void 0,
+      quarantine: rest.includes("--quarantine")
+    });
+    console.log(json ? JSON.stringify(report, null, 2) : formatAuditMemoryReport(report));
+  } finally {
+    orchestrator.abortDeferredInit();
+  }
+}
+
+// src/daemon-service-candidates.ts
+import fs8 from "fs";
 import path5 from "path";
 var LAUNCHD_LABEL = "ai.remnic.daemon";
 var LEGACY_REMNIC_SERVER_LAUNCHD_LABEL = "ai.remnic.server";
@@ -2489,7 +2534,7 @@ function systemdUnitPaths(homeDir) {
 function anyFileExists(paths) {
   return paths.some((candidate) => {
     try {
-      return fs7.statSync(candidate).isFile();
+      return fs8.statSync(candidate).isFile();
     } catch {
       return false;
     }
@@ -2501,7 +2546,7 @@ function commandNames(command) {
 }
 function isRunnableNodeScript(filePath) {
   try {
-    const text = fs7.readFileSync(filePath, "utf8").slice(0, 4096);
+    const text = fs8.readFileSync(filePath, "utf8").slice(0, 4096);
     const firstLine = text.split(/\r?\n/, 1)[0] ?? "";
     if (/^#!.*\bnode\b/.test(firstLine)) return true;
     if (firstLine.startsWith("#!")) return false;
@@ -2514,7 +2559,7 @@ function isRunnableNodeScript(filePath) {
 function resolveShimNodeScript(filePath) {
   let text;
   try {
-    text = fs7.readFileSync(filePath, "utf8").slice(0, 16384);
+    text = fs8.readFileSync(filePath, "utf8").slice(0, 16384);
   } catch {
     return void 0;
   }
@@ -2526,8 +2571,8 @@ function resolveShimNodeScript(filePath) {
     const candidate = raw.replaceAll("${basedir}", basedir).replaceAll("$basedir", basedir).replaceAll("\\ ", " ");
     const resolved = path5.isAbsolute(candidate) ? candidate : path5.resolve(basedir, candidate);
     try {
-      if (fs7.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
-        return fs7.realpathSync(resolved);
+      if (fs8.statSync(resolved).isFile() && isRunnableNodeScript(resolved)) {
+        return fs8.realpathSync(resolved);
       }
     } catch {
     }
@@ -2535,7 +2580,7 @@ function resolveShimNodeScript(filePath) {
   return void 0;
 }
 function resolveRunnableNodeScript(filePath) {
-  const realPath = fs7.realpathSync(filePath);
+  const realPath = fs8.realpathSync(filePath);
   if (isRunnableNodeScript(realPath)) return realPath;
   return resolveShimNodeScript(realPath);
 }
@@ -2545,9 +2590,9 @@ function findCommandOnPath(command, pathEnv = process.env.PATH ?? "") {
     for (const name of commandNames(command)) {
       const candidate = path5.join(dir, name);
       try {
-        const stat2 = fs7.statSync(candidate);
+        const stat2 = fs8.statSync(candidate);
         if (!stat2.isFile()) continue;
-        if (process.platform !== "win32") fs7.accessSync(candidate, fs7.constants.X_OK);
+        if (process.platform !== "win32") fs8.accessSync(candidate, fs8.constants.X_OK);
         const runnable = resolveRunnableNodeScript(candidate);
         if (runnable) return runnable;
       } catch {
@@ -4038,7 +4083,7 @@ function finalizeBenchStatus(filePath) {
 }
 
 // src/bench-fallback.ts
-import fs8 from "fs";
+import fs9 from "fs";
 import path9 from "path";
 var FALLBACK_RESULTS_DIRNAME = "fallback-runs";
 function buildBenchRunnerArgs(parsed, benchmarkId, outputDir) {
@@ -4110,7 +4155,7 @@ function createFallbackBenchOutputDir(resultsDir, benchmarkId, pid, startedAtMs
   );
 }
 function resolveFallbackBenchResultPath(outputDir) {
-  const entries = fs8.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
+  const entries = fs9.readdirSync(outputDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
   if (entries.length === 0) {
     throw new Error(`Fallback benchmark runner did not write a JSON result artifact in ${outputDir}`);
   }
@@ -4118,7 +4163,7 @@ function resolveFallbackBenchResultPath(outputDir) {
 }
 
 // src/openclaw-upgrade-swap.ts
-import fs9 from "fs";
+import fs10 from "fs";
 import path10 from "path";
 function describeError(error) {
   return error instanceof Error ? error.message : String(error);
@@ -4130,7 +4175,7 @@ function createSiblingTempFilePath(targetPath, label) {
 function resolveAtomicWriteMode(targetPath, explicitMode) {
   if (explicitMode !== void 0) return explicitMode;
   try {
-    return fs9.statSync(targetPath).mode & 4095;
+    return fs10.statSync(targetPath).mode & 4095;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return 384;
@@ -4140,8 +4185,8 @@ function resolveAtomicWriteMode(targetPath, explicitMode) {
 }
 function resolveAtomicReplacementPath(targetPath) {
   try {
-    if (fs9.lstatSync(targetPath).isSymbolicLink()) {
-      return fs9.realpathSync(targetPath);
+    if (fs10.lstatSync(targetPath).isSymbolicLink()) {
+      return fs10.realpathSync(targetPath);
     }
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -4158,7 +4203,7 @@ function createSiblingSwapPath(targetDir, label) {
 function cleanupDisplacedDirectoryBestEffort(displacedDir, context) {
   if (!displacedDir) return void 0;
   try {
-    fs9.rmSync(displacedDir, { recursive: true, force: true });
+    fs10.rmSync(displacedDir, { recursive: true, force: true });
     return void 0;
   } catch (error) {
     return `Warning: ${context}, but failed to remove the displaced plugin copy at ${displacedDir}: ${describeError(error)}`;
@@ -4166,43 +4211,43 @@ function cleanupDisplacedDirectoryBestEffort(displacedDir, context) {
 }
 function atomicWriteFileSync(targetPath, data, options = {}) {
   const resolvedTargetPath = resolveAtomicReplacementPath(targetPath);
-  fs9.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
+  fs10.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
   const tempPath = createSiblingTempFilePath(resolvedTargetPath, "write");
   const mode = resolveAtomicWriteMode(resolvedTargetPath, options.mode);
   try {
     if (options.hooks?.writeTempFileSync) {
       options.hooks.writeTempFileSync(tempPath);
     } else {
-      fs9.writeFileSync(tempPath, data, { mode });
+      fs10.writeFileSync(tempPath, data, { mode });
     }
-    fs9.chmodSync(tempPath, mode);
-    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs9.renameSync;
+    fs10.chmodSync(tempPath, mode);
+    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs10.renameSync;
     renameTempFileSync(tempPath, resolvedTargetPath);
   } catch (error) {
-    fs9.rmSync(tempPath, { force: true });
+    fs10.rmSync(tempPath, { force: true });
     throw error;
   }
 }
 function atomicCopyFileSync(sourcePath, targetPath, options = {}) {
-  if (!fs9.existsSync(sourcePath)) return;
+  if (!fs10.existsSync(sourcePath)) return;
   const resolvedTargetPath = resolveAtomicReplacementPath(targetPath);
-  fs9.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
+  fs10.mkdirSync(path10.dirname(resolvedTargetPath), { recursive: true });
   const tempPath = createSiblingTempFilePath(resolvedTargetPath, "copy");
-  const mode = fs9.statSync(sourcePath).mode & 4095;
+  const mode = fs10.statSync(sourcePath).mode & 4095;
   try {
-    const copyTempFileSync = options.hooks?.copyTempFileSync ?? fs9.copyFileSync;
+    const copyTempFileSync = options.hooks?.copyTempFileSync ?? fs10.copyFileSync;
     copyTempFileSync(sourcePath, tempPath);
-    fs9.chmodSync(tempPath, mode);
-    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs9.renameSync;
+    fs10.chmodSync(tempPath, mode);
+    const renameTempFileSync = options.hooks?.renameTempFileSync ?? fs10.renameSync;
     renameTempFileSync(tempPath, resolvedTargetPath);
   } catch (error) {
-    fs9.rmSync(tempPath, { force: true });
+    fs10.rmSync(tempPath, { force: true });
     throw error;
   }
 }
 function cleanupRollbackDirectory(rollbackDir) {
   if (!rollbackDir) return;
-  fs9.rmSync(rollbackDir, { recursive: true, force: true });
+  fs10.rmSync(rollbackDir, { recursive: true, force: true });
 }
 function cleanupRollbackDirectoryBestEffort(rollbackDir) {
   if (!rollbackDir) return void 0;
@@ -4214,20 +4259,20 @@ function cleanupRollbackDirectoryBestEffort(rollbackDir) {
   }
 }
 function restoreDirectoryFromRollback(targetDir, rollbackDir) {
-  if (!fs9.existsSync(rollbackDir)) {
+  if (!fs10.existsSync(rollbackDir)) {
     throw new Error(`Rollback directory is missing: ${rollbackDir}`);
   }
-  fs9.mkdirSync(path10.dirname(targetDir), { recursive: true });
-  const displacedDir = fs9.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "rollback-restore") : void 0;
+  fs10.mkdirSync(path10.dirname(targetDir), { recursive: true });
+  const displacedDir = fs10.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "rollback-restore") : void 0;
   if (displacedDir) {
-    fs9.renameSync(targetDir, displacedDir);
+    fs10.renameSync(targetDir, displacedDir);
   }
   try {
-    fs9.renameSync(rollbackDir, targetDir);
+    fs10.renameSync(rollbackDir, targetDir);
   } catch (restoreError) {
-    if (displacedDir && fs9.existsSync(displacedDir)) {
+    if (displacedDir && fs10.existsSync(displacedDir)) {
       try {
-        fs9.renameSync(displacedDir, targetDir);
+        fs10.renameSync(displacedDir, targetDir);
       } catch (revertError) {
         throw new AggregateError(
           [restoreError, revertError],
@@ -4243,23 +4288,23 @@ function restoreDirectoryFromRollback(targetDir, rollbackDir) {
   return cleanupDisplacedDirectoryBestEffort(displacedDir, `restored the previous plugin copy into ${targetDir}`);
 }
 function restoreDirectoryFromBackup(targetDir, backupDir) {
-  if (!fs9.existsSync(backupDir)) {
+  if (!fs10.existsSync(backupDir)) {
     throw new Error(`Plugin backup directory is missing: ${backupDir}`);
   }
-  fs9.mkdirSync(path10.dirname(targetDir), { recursive: true });
+  fs10.mkdirSync(path10.dirname(targetDir), { recursive: true });
   const stagedDir = createSiblingSwapPath(targetDir, "backup-restore");
-  const displacedDir = fs9.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "pre-backup-restore") : void 0;
-  fs9.cpSync(backupDir, stagedDir, { recursive: true });
+  const displacedDir = fs10.existsSync(targetDir) ? createSiblingSwapPath(targetDir, "pre-backup-restore") : void 0;
+  fs10.cpSync(backupDir, stagedDir, { recursive: true });
   if (displacedDir) {
-    fs9.renameSync(targetDir, displacedDir);
+    fs10.renameSync(targetDir, displacedDir);
   }
   try {
-    fs9.renameSync(stagedDir, targetDir);
+    fs10.renameSync(stagedDir, targetDir);
   } catch (restoreError) {
-    fs9.rmSync(targetDir, { recursive: true, force: true });
-    if (displacedDir && fs9.existsSync(displacedDir)) {
+    fs10.rmSync(targetDir, { recursive: true, force: true });
+    if (displacedDir && fs10.existsSync(displacedDir)) {
       try {
-        fs9.renameSync(displacedDir, targetDir);
+        fs10.renameSync(displacedDir, targetDir);
       } catch (revertError) {
         throw new AggregateError(
           [restoreError, revertError],
@@ -4267,7 +4312,7 @@ function restoreDirectoryFromBackup(targetDir, backupDir) {
         );
       }
     }
-    fs9.rmSync(stagedDir, { recursive: true, force: true });
+    fs10.rmSync(stagedDir, { recursive: true, force: true });
     throw new Error(
       `Failed to restore the plugin backup into ${targetDir}. The durable backup remains preserved at ${backupDir}.`,
       { cause: restoreError }
@@ -4292,7 +4337,7 @@ function rollbackOpenclawUpgrade({
   let configRemovalAttempted = false;
   let pluginRestored = false;
   try {
-    if (rollbackDir && fs9.existsSync(rollbackDir)) {
+    if (rollbackDir && fs10.existsSync(rollbackDir)) {
       const cleanupWarning = restoreDirectoryFromRollback(pluginDir, rollbackDir);
       notes.push(`Restored previous plugin from rollback copy at ${rollbackDir}`);
       if (cleanupWarning) notes.push(cleanupWarning);
@@ -4302,7 +4347,7 @@ function rollbackOpenclawUpgrade({
     rollbackRestoreError = error instanceof Error ? error.message : String(error);
   }
   try {
-    if (!pluginRestored && pluginBackupDir && fs9.existsSync(pluginBackupDir)) {
+    if (!pluginRestored && pluginBackupDir && fs10.existsSync(pluginBackupDir)) {
       const cleanupWarning = restoreDirectoryFromBackup(pluginDir, pluginBackupDir);
       if (rollbackRestoreError) {
         notes.push(`Rollback copy restore failed; restored previous plugin from durable backup at ${pluginBackupDir}`);
@@ -4327,12 +4372,12 @@ function rollbackOpenclawUpgrade({
     notes.push("No previous plugin copy was available for automatic restore");
   }
   try {
-    if (configBackupPath && fs9.existsSync(configBackupPath)) {
+    if (configBackupPath && fs10.existsSync(configBackupPath)) {
       restoreFileFromBackup(configPath, configBackupPath);
       notes.push(`Restored OpenClaw config from backup at ${configBackupPath}`);
-    } else if (removeConfigIfUnbacked && fs9.existsSync(configPath)) {
+    } else if (removeConfigIfUnbacked && fs10.existsSync(configPath)) {
       configRemovalAttempted = true;
-      fs9.rmSync(configPath, { force: true });
+      fs10.rmSync(configPath, { force: true });
       notes.push("Removed OpenClaw config created during the failed upgrade");
     }
   } catch (error) {
@@ -4385,7 +4430,7 @@ Run this manually when you're ready:
 
 // src/openclaw-managed-upgrade-loader.ts
 import { execFileSync } from "child_process";
-import fs10 from "fs";
+import fs11 from "fs";
 import os from "os";
 import path11 from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL2 } from "url";
@@ -4461,7 +4506,7 @@ function buildOpenclawManagedUpgradePackageSpec(version = "latest") {
 function readCliAdapterRange() {
   const moduleDir = path11.dirname(fileURLToPath3(import.meta.url));
   const manifestPath = path11.resolve(moduleDir, "../package.json");
-  const manifest = JSON.parse(fs10.readFileSync(manifestPath, "utf8"));
+  const manifest = JSON.parse(fs11.readFileSync(manifestPath, "utf8"));
   if (manifest.name !== "@remnic/cli") {
     throw new Error(`Invalid @remnic/cli package manifest at ${manifestPath}.`);
   }
@@ -4505,7 +4550,7 @@ async function loadOpenclawManagedUpgradeModule(packageSpec, hooks = {}) {
     const adapterMissing = isSpecifierNotFoundError(error, OPENCLAW_PLUGIN_PACKAGE) || isSpecifierNotFoundError(error, MANAGED_UPGRADE_SPECIFIER) || isManagedUpgradeSubpathMissing(error);
     if (!adapterMissing) throw error;
   }
-  const temporaryRoot = fs10.mkdtempSync(path11.join(os.tmpdir(), "remnic-openclaw-upgrade-"));
+  const temporaryRoot = fs11.mkdtempSync(path11.join(os.tmpdir(), "remnic-openclaw-upgrade-"));
   try {
     const toolingPackageSpec = `${OPENCLAW_PLUGIN_PACKAGE}@${readCliAdapterRange()}`;
     const installArgs = [
@@ -4520,12 +4565,12 @@ async function loadOpenclawManagedUpgradeModule(packageSpec, hooks = {}) {
     ];
     (hooks.runNpmInstall ?? runNpmInstall)(installArgs);
     const resolverPath = path11.join(temporaryRoot, "load-managed-upgrade.mjs");
-    fs10.writeFileSync(resolverPath, `export * from ${JSON.stringify(MANAGED_UPGRADE_SPECIFIER)};
+    fs11.writeFileSync(resolverPath, `export * from ${JSON.stringify(MANAGED_UPGRADE_SPECIFIER)};
 `, "utf8");
     return await importModule(pathToFileURL2(resolverPath).href);
   } finally {
     try {
-      fs10.rmSync(temporaryRoot, { recursive: true, force: true });
+      fs11.rmSync(temporaryRoot, { recursive: true, force: true });
     } catch (error) {
       const detail = error instanceof Error ? error.message : String(error);
       console.warn(`Could not remove temporary managed upgrade project at ${temporaryRoot}: ${detail}`);
@@ -4534,7 +4579,7 @@ async function loadOpenclawManagedUpgradeModule(packageSpec, hooks = {}) {
 }
 
 // src/daemon-service.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import path12 from "path";
 import * as childProcess from "child_process";
 import { fileURLToPath as fileURLToPath4 } from "url";
@@ -4546,7 +4591,7 @@ function launchdUnloadPlist(plistPath, processApi = childProcess) {
   processApi.execFileSync("launchctl", ["unload", plistPath], { stdio: "pipe" });
 }
 function resolveServerBinDetails(options = {}) {
-  const existsSync4 = options.existsSync ?? fs11.existsSync;
+  const existsSync4 = options.existsSync ?? fs12.existsSync;
   const findCommandOnPath2 = options.findCommandOnPath ?? findCommandOnPath;
   const moduleDir = options.moduleDir ?? thisModuleDir;
   const packageResolve = options.packageResolve ?? resolveImportSpecifier;
@@ -4605,8 +4650,8 @@ function resolveServerBin(options = {}) {
   return resolveServerBinDetails(options).path;
 }
 function readVerifiedDaemonPid(options) {
-  const readFileSync4 = options.readFileSync ?? fs11.readFileSync;
-  const unlinkSync = options.unlinkSync ?? fs11.unlinkSync;
+  const readFileSync4 = options.readFileSync ?? fs12.readFileSync;
+  const unlinkSync = options.unlinkSync ?? fs12.unlinkSync;
   const processKill = options.processKill ?? process.kill;
   const platform = options.platform ?? process.platform;
   const execFileSync4 = options.execFileSync ?? ((command, args, execOptions) => childProcess.execFileSync(command, args, execOptions));
@@ -4706,8 +4751,8 @@ function removePidFileBestEffort(file, unlinkSync) {
   }
 }
 function inspectLaunchdPlist(plistPath, options = {}) {
-  const existsSync4 = options.existsSync ?? fs11.existsSync;
-  const readFileSync4 = options.readFileSync ?? fs11.readFileSync;
+  const existsSync4 = options.existsSync ?? fs12.existsSync;
+  const readFileSync4 = options.readFileSync ?? fs12.readFileSync;
   if (!existsSync4(plistPath)) {
     return {
       installed: false,
@@ -4941,7 +4986,7 @@ function stripConfigArgv(args) {
 }
 
 // src/import-dispatch.ts
-import fs12 from "fs";
+import fs13 from "fs";
 import {
   runImporter,
   validateImportBatchSize,
@@ -5455,7 +5500,7 @@ async function cmdImport(rest, targetFactory, disposeTarget, ioOverrides = {}) {
   let materializedTarget;
   let materializePromise;
   const io = {
-    readFile: ioOverrides.readFile ?? (async (p) => fs12.promises.readFile(p, "utf-8")),
+    readFile: ioOverrides.readFile ?? (async (p) => fs13.promises.readFile(p, "utf-8")),
     loadAdapter: ioOverrides.loadAdapter ?? (async (name) => (await loadImporterModule(name)).adapter),
     runImporter: ioOverrides.runImporter ?? runImporter,
     getWriteTarget: async () => {
@@ -5568,7 +5613,7 @@ async function cmdCapture(rest, io) {
 }
 
 // src/import-lossless-claw-cmd.ts
-import fs13 from "fs";
+import fs14 from "fs";
 import path14 from "path";
 import {
   applyLcmSchema,
@@ -5680,15 +5725,15 @@ async function loadImportLosslessClawModule() {
 
 // src/import-lossless-claw-cmd.ts
 function assertDirectoryOrAbsent(p, label) {
-  if (fs13.existsSync(p) && !fs13.statSync(p).isDirectory()) {
+  if (fs14.existsSync(p) && !fs14.statSync(p).isDirectory()) {
     throw new Error(`${label} is not a directory: ${p}`);
   }
 }
 function assertFile(p, label) {
-  if (!fs13.existsSync(p)) {
+  if (!fs14.existsSync(p)) {
     throw new Error(`${label} does not exist: ${p}`);
   }
-  if (!fs13.statSync(p).isFile()) {
+  if (!fs14.statSync(p).isFile()) {
     throw new Error(`${label} is not a file: ${p}`);
   }
 }
@@ -5720,7 +5765,7 @@ async function cmdImportLosslessClaw(argv, io, deps = {}) {
     try {
       if (parsed.dryRun) {
         const lcmPath = path14.join(memoryDir, "state", "lcm.sqlite");
-        if (fs13.existsSync(lcmPath)) {
+        if (fs14.existsSync(lcmPath)) {
           destDb = mod.openExistingLcmDatabaseReadOnly(lcmPath);
         } else {
           destDb = mod.openInMemoryDestinationDatabase();
@@ -6459,8 +6504,158 @@ async function cmdBenchCoding(args) {
   if (result.exitCode !== 0) process.exitCode = result.exitCode;
 }
 
-// src/bench-research-commands.ts
+// src/bench-security-commands.ts
 import path16 from "path";
+var DEFAULT_OUTPUT_DIR = path16.join(
+  resolveHomeDir(),
+  ".remnic",
+  "bench",
+  "results",
+  "h5-injection-suite"
+);
+var BENCH_SECURITY_USAGE = `Usage: remnic bench security injection-suite --seeds N [options]
+
+H5 injection-suite runner. Resume, host-fault pause, multi-host claim
+leases, and --limit follow the H6 contract (issue #1963 / PR #2312).
+
+Options:
+  --seeds N                 Positive seed count (required)
+  --variants-per-family N   Variants per attack family (default: 25)
+  --model-profile ID        Profile label recorded on each row (default: local-dry)
+  --executor local|ollama|openai-compat
+                            local = deterministic screen/fence (default)
+                            ollama = native /api/chat
+                            openai-compat = /v1/chat/completions
+  --base-url URL            Endpoint (default: http://127.0.0.1:11434)
+  --model NAME              Model id (default: qwen2.5:7b-instruct)
+  --request-timeout-ms N    Per-call timeout (default: 120000)
+  --out DIR                 New run directory (default: ~/.remnic/bench/results/h5-injection-suite)
+  --run DIR                 Existing run directory; implies --resume
+  --resume                  Continue an existing run (required if DIR already has run.json)
+  --limit N                 Execute at most N planned rows (dry-run / smoke)
+`;
+function parsePositiveInteger(raw, flag) {
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 1) {
+    throw new Error(`${flag} must be a positive integer`);
+  }
+  return value;
+}
+function parseBenchSecurityArgs(args) {
+  if (args.length === 0 || args[0] === "--help" || args[0] === "-h") return { help: true };
+  if (args[0] !== "injection-suite") {
+    throw new Error(`unknown bench security subcommand ${args[0]}`);
+  }
+  let seeds;
+  let variantsPerFamily = 25;
+  let modelProfileId = "local-dry";
+  let outputDir = DEFAULT_OUTPUT_DIR;
+  let resume = false;
+  let limit;
+  let executor = "local";
+  let baseUrl;
+  let model;
+  let requestTimeoutMs;
+  for (let index = 1; index < args.length; index += 1) {
+    const flag = args[index] ?? "";
+    const next = args[index + 1];
+    if (flag === "--seeds") {
+      seeds = parsePositiveInteger(next, "--seeds");
+      index += 1;
+    } else if (flag === "--variants-per-family") {
+      variantsPerFamily = parsePositiveInteger(next, "--variants-per-family");
+      index += 1;
+    } else if (flag === "--model-profile") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --model-profile");
+      modelProfileId = next;
+      index += 1;
+    } else if (flag === "--executor") {
+      if (next !== "local" && next !== "ollama" && next !== "openai-compat") {
+        throw new Error("--executor must be local, ollama, or openai-compat");
+      }
+      executor = next;
+      index += 1;
+    } else if (flag === "--base-url") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --base-url");
+      baseUrl = next;
+      index += 1;
+    } else if (flag === "--model") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --model");
+      model = next;
+      index += 1;
+    } else if (flag === "--request-timeout-ms") {
+      requestTimeoutMs = parsePositiveInteger(next, "--request-timeout-ms");
+      index += 1;
+    } else if (flag === "--out") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --out");
+      outputDir = expandTilde(next);
+      index += 1;
+    } else if (flag === "--run") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --run");
+      outputDir = expandTilde(next);
+      resume = true;
+      index += 1;
+    } else if (flag === "--resume") {
+      resume = true;
+    } else if (flag === "--limit") {
+      limit = parsePositiveInteger(next, "--limit");
+      index += 1;
+    } else {
+      throw new Error(`unknown option ${flag}`);
+    }
+  }
+  if (seeds === void 0) throw new Error("injection-suite requires --seeds N");
+  return {
+    seeds,
+    variantsPerFamily,
+    modelProfileId,
+    outputDir,
+    resume,
+    executor,
+    ...limit === void 0 ? {} : { limit },
+    ...baseUrl === void 0 ? {} : { baseUrl },
+    ...model === void 0 ? {} : { model },
+    ...requestTimeoutMs === void 0 ? {} : { requestTimeoutMs }
+  };
+}
+async function cmdBenchSecurity(args) {
+  try {
+    const parsed = parseBenchSecurityArgs(args);
+    if ("help" in parsed) {
+      console.log(BENCH_SECURITY_USAGE);
+      return;
+    }
+    const bench = await loadBenchModule();
+    const run = bench.runInjectionSuiteCliCommand;
+    if (typeof run !== "function") {
+      throw new Error("Installed @remnic/bench is missing runInjectionSuiteCliCommand");
+    }
+    const result = await run({
+      seeds: parsed.seeds,
+      variantsPerFamily: parsed.variantsPerFamily,
+      modelProfileId: parsed.modelProfileId,
+      outputDir: parsed.outputDir,
+      executor: parsed.executor,
+      ...parsed.resume ? { resume: true } : {},
+      ...parsed.limit === void 0 ? {} : { limit: parsed.limit },
+      ...parsed.baseUrl === void 0 ? {} : { baseUrl: parsed.baseUrl },
+      ...parsed.model === void 0 ? {} : { model: parsed.model },
+      ...parsed.requestTimeoutMs === void 0 ? {} : { requestTimeoutMs: parsed.requestTimeoutMs }
+    });
+    if (result.exitCode === 0) console.log(result.output);
+    else console.error(result.output);
+    if (result.exitCode !== 0) process.exitCode = result.exitCode;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`${message}
+
+${BENCH_SECURITY_USAGE}`);
+    process.exitCode = 1;
+  }
+}
+
+// src/bench-research-commands.ts
+import path17 from "path";
 function emit(result) {
   if (result.output) {
     console.log(result.output);
@@ -6478,7 +6673,7 @@ async function runBenchResearchCommand(parsed) {
     emit(
       await runAttributeCliCommand({
         runRef: parsed.runRef,
-        resultsDir: parsed.resultsDir ?? path16.join(resolveHomeDir(), ".remnic", "bench", "results"),
+        resultsDir: parsed.resultsDir ?? path17.join(resolveHomeDir(), ".remnic", "bench", "results"),
         memoryDir: parsed.memoryDir,
         qmdPath: parsed.qmdPath,
         collection: parsed.collection,
@@ -6507,8 +6702,8 @@ async function runBenchResearchCommand(parsed) {
 
 // src/bench-usage.ts
 function getBenchUsageText() {
-  return `Usage: remnic bench <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|attribute|drift-gen|coding> [options] [benchmark...]
-       remnic benchmark <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|check|report|attribute|drift-gen|coding> [options] [benchmark...]
+  return `Usage: remnic bench <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|attribute|drift-gen|coding|security> [options] [benchmark...]
+       remnic benchmark <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|check|report|attribute|drift-gen|coding|security> [options] [benchmark...]
 
 Commands:
   list                     List published benchmark packs
@@ -6546,6 +6741,8 @@ Commands:
   coding                   H6 synthetic coding benchmark commands
                            Run \`remnic bench coding --help\` for repo generation,
                            repeated-failure runs, resume, and offline stats replay
+  security                 H5 injection-suite runner (resume/pause/--limit)
+                           Run \`remnic bench security --help\`
   check                    Legacy latency regression gate (compatibility)
   attribute --run <id> [--results-dir <path>] [--memory-dir <path>] [--threshold <value>]
                            [--qmd <path> --collection <name>]
@@ -6748,15 +6945,15 @@ registerPublisher("omp", () => new LazyPluginPiPublisher("omp", (mod) => mod.Omp
 function readCompatEnv(primary, legacy) {
   return process.env[primary] ?? process.env[legacy];
 }
-var PID_DIR = path17.join(resolveHomeDir(), ".remnic");
-var LEGACY_PID_DIR = path17.join(resolveHomeDir(), ".engram");
-var PID_FILE = path17.join(PID_DIR, "server.pid");
-var LEGACY_PID_FILE = path17.join(LEGACY_PID_DIR, "server.pid");
-var LOG_FILE = path17.join(PID_DIR, "server.log");
-var LEGACY_LOG_FILE = path17.join(LEGACY_PID_DIR, "server.log");
-var CLI_MODULE_DIR = path17.dirname(fileURLToPath5(import.meta.url));
-var CLI_REPO_ROOT = path17.resolve(CLI_MODULE_DIR, "../../..");
-var EVAL_RUNNER_PATH = path17.join(CLI_REPO_ROOT, "evals", "run.ts");
+var PID_DIR = path18.join(resolveHomeDir(), ".remnic");
+var LEGACY_PID_DIR = path18.join(resolveHomeDir(), ".engram");
+var PID_FILE = path18.join(PID_DIR, "server.pid");
+var LEGACY_PID_FILE = path18.join(LEGACY_PID_DIR, "server.pid");
+var LOG_FILE = path18.join(PID_DIR, "server.log");
+var LEGACY_LOG_FILE = path18.join(LEGACY_PID_DIR, "server.log");
+var CLI_MODULE_DIR = path18.dirname(fileURLToPath5(import.meta.url));
+var CLI_REPO_ROOT = path18.resolve(CLI_MODULE_DIR, "../../..");
+var EVAL_RUNNER_PATH = path18.join(CLI_REPO_ROOT, "evals", "run.ts");
 var OPENCLAW_GATEWAY_LABEL = "ai.openclaw.gateway";
 var CLI_SUCCESS_EXIT_GRACE_MS = 5e3;
 var CLI_OUTPUT_FLUSH_GRACE_MS = 250;
@@ -6921,7 +7118,7 @@ async function resolveAllBenchmarks() {
   if (packageBenchmarks) {
     return packageBenchmarks.filter((entry) => entry.runnerAvailable).map((entry) => entry.id);
   }
-  if (!fs14.existsSync(EVAL_RUNNER_PATH)) {
+  if (!fs15.existsSync(EVAL_RUNNER_PATH)) {
     return [];
   }
   return BENCHMARK_CATALOG.filter((entry) => entry.category !== "ingestion").map((entry) => entry.id);
@@ -6969,17 +7166,17 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
       `Fallback benchmark runner does not support provider-backed, gateway, or thinking/timeout flags (${unsupportedOptions.join(", ")}). Build/install @remnic/bench to use those options.`
     );
   }
-  if (!fs14.existsSync(EVAL_RUNNER_PATH)) {
+  if (!fs15.existsSync(EVAL_RUNNER_PATH)) {
     console.error(
       "Benchmark runner not found. Expected eval runner at evals/run.ts or a phase-1 @remnic/bench runtime export."
     );
     process.exit(1);
   }
   const tsxCandidates = [
-    path17.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
-    path17.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
+    path18.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
+    path18.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
   ];
-  const tsxCmd = tsxCandidates.find((candidate) => fs14.existsSync(candidate)) ?? "tsx";
+  const tsxCmd = tsxCandidates.find((candidate) => fs15.existsSync(candidate)) ?? "tsx";
   const fallbackOutputDir = createFallbackBenchOutputDir(
     parsed.resultsDir ?? resolveBenchOutputDir(),
     benchmarkId,
@@ -6996,7 +7193,7 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
   return resolveFallbackBenchResultPath(fallbackOutputDir);
 }
 function resolveBenchOutputDir() {
-  return path17.join(resolveHomeDir(), ".remnic", "bench", "results");
+  return path18.join(resolveHomeDir(), ".remnic", "bench", "results");
 }
 var DOWNLOADABLE_BENCHMARK_DATASETS = [
   "ama-bench",
@@ -7041,8 +7238,8 @@ var MEMORY_AGENT_BENCH_SPLIT_FILENAMES = [
 ];
 var MEMORY_AGENT_BENCH_ENTITY_MAPPING_CANDIDATES = [
   "entity2id.json",
-  path17.join("processed_data", "Recsys_Redial", "entity2id.json"),
-  path17.join("Recsys_Redial", "entity2id.json")
+  path18.join("processed_data", "Recsys_Redial", "entity2id.json"),
+  path18.join("Recsys_Redial", "entity2id.json")
 ];
 var DOWNLOADED_DATASET_MARKERS = {
   "ama-bench": { anyOf: ["open_end_qa_set.jsonl"] },
@@ -7117,18 +7314,18 @@ var PERSONAMEM_DATASET_FILE_CANDIDATES = [
   "benchmark/benchmark.csv",
   "benchmark.csv"
 ];
-var PERSONAMEM_COMPLETION_MARKER = path17.join(
+var PERSONAMEM_COMPLETION_MARKER = path18.join(
   "data",
   "chat_history_32k",
   ".download-complete"
 );
 function resolveRealpathWithinDataset(datasetPath, relativePath) {
   try {
-    const datasetRoot = fs14.realpathSync(datasetPath);
-    const candidatePath = path17.resolve(datasetRoot, relativePath);
-    const candidateRealPath = fs14.realpathSync(candidatePath);
-    const relativeToRoot = path17.relative(datasetRoot, candidateRealPath);
-    if (relativeToRoot.startsWith("..") || path17.isAbsolute(relativeToRoot)) {
+    const datasetRoot = fs15.realpathSync(datasetPath);
+    const candidatePath = path18.resolve(datasetRoot, relativePath);
+    const candidateRealPath = fs15.realpathSync(candidatePath);
+    const relativeToRoot = path18.relative(datasetRoot, candidateRealPath);
+    if (relativeToRoot.startsWith("..") || path18.isAbsolute(relativeToRoot)) {
       return null;
     }
     return candidateRealPath;
@@ -7184,15 +7381,15 @@ function parseCsvRows(raw) {
 }
 function isPersonaMemDatasetComplete(datasetPath) {
   try {
-    const completionMarkerPath = path17.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
-    if (fs14.statSync(completionMarkerPath).isFile()) {
+    const completionMarkerPath = path18.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
+    if (fs15.statSync(completionMarkerPath).isFile()) {
       return true;
     }
   } catch {
   }
   const datasetFile = PERSONAMEM_DATASET_FILE_CANDIDATES.find((candidate) => {
     try {
-      return fs14.statSync(path17.join(datasetPath, candidate)).isFile();
+      return fs15.statSync(path18.join(datasetPath, candidate)).isFile();
     } catch {
       return false;
     }
@@ -7201,7 +7398,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     return false;
   }
   try {
-    const rows = parseCsvRows(fs14.readFileSync(path17.join(datasetPath, datasetFile), "utf8"));
+    const rows = parseCsvRows(fs15.readFileSync(path18.join(datasetPath, datasetFile), "utf8"));
     if (rows.length < 2) {
       return false;
     }
@@ -7216,7 +7413,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     }
     return historyPaths.every((relativePath) => {
       const resolvedPath = resolveRealpathWithinDataset(datasetPath, relativePath);
-      return resolvedPath !== null && fs14.statSync(resolvedPath).isFile();
+      return resolvedPath !== null && fs15.statSync(resolvedPath).isFile();
     });
   } catch {
     return false;
@@ -7224,14 +7421,14 @@ function isPersonaMemDatasetComplete(datasetPath) {
 }
 function hasDatasetFile(datasetPath, relativePath) {
   try {
-    return fs14.statSync(path17.join(datasetPath, relativePath)).isFile();
+    return fs15.statSync(path18.join(datasetPath, relativePath)).isFile();
   } catch {
     return false;
   }
 }
 function hasMemoryAgentBenchEntityMapping(datasetPath) {
-  const absoluteDatasetPath = path17.resolve(datasetPath);
-  const roots = [absoluteDatasetPath, path17.dirname(absoluteDatasetPath)];
+  const absoluteDatasetPath = path18.resolve(datasetPath);
+  const roots = [absoluteDatasetPath, path18.dirname(absoluteDatasetPath)];
   return hasDatasetFile(absoluteDatasetPath, "entity2id.json") || roots.some(
     (root) => MEMORY_AGENT_BENCH_ENTITY_MAPPING_CANDIDATES.filter((relativePath) => relativePath !== "entity2id.json").some((relativePath) => hasDatasetFile(root, relativePath))
   );
@@ -7242,12 +7439,12 @@ function memoryAgentBenchDatasetHasRecSysSamples(datasetPath) {
     ...MEMORY_AGENT_BENCH_SPLIT_FILENAMES
   ];
   return candidateFilenames.some((filename) => {
-    const filePath = path17.join(datasetPath, filename);
+    const filePath = path18.join(datasetPath, filename);
     try {
-      if (!fs14.statSync(filePath).isFile()) {
+      if (!fs15.statSync(filePath).isFile()) {
         return false;
       }
-      const raw = fs14.readFileSync(filePath, "utf8");
+      const raw = fs15.readFileSync(filePath, "utf8");
       return /"source"\s*:\s*"recsys[_-]/i.test(raw);
     } catch {
       return false;
@@ -7263,7 +7460,7 @@ function isMemoryAgentBenchDatasetComplete(datasetPath) {
 function isDatasetDownloaded(datasetPath, benchmarkId) {
   let stats;
   try {
-    stats = fs14.statSync(datasetPath);
+    stats = fs15.statSync(datasetPath);
   } catch {
     return false;
   }
@@ -7273,7 +7470,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   const marker = DOWNLOADED_DATASET_MARKERS[benchmarkId];
   if (!marker) {
     try {
-      return fs14.readdirSync(datasetPath).length > 0;
+      return fs15.readdirSync(datasetPath).length > 0;
     } catch {
       return false;
     }
@@ -7281,7 +7478,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.allOf) {
     const hasAllRequiredFiles = marker.allOf.every((name) => {
       try {
-        return fs14.statSync(path17.join(datasetPath, name)).isFile();
+        return fs15.statSync(path18.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -7293,7 +7490,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.anyOf) {
     const hasMarkerFile = marker.anyOf.some((name) => {
       try {
-        return fs14.statSync(path17.join(datasetPath, name)).isFile();
+        return fs15.statSync(path18.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -7311,7 +7508,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   }
   if (marker.ext) {
     try {
-      return fs14.readdirSync(datasetPath).some(
+      return fs15.readdirSync(datasetPath).some(
         (name) => name.endsWith(marker.ext) && !marker.exclude?.includes(name)
       );
     } catch {
@@ -7321,9 +7518,9 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   return false;
 }
 async function launchBenchUi(resultsDir) {
-  const benchUiDir = path17.join(CLI_REPO_ROOT, "packages", "bench-ui");
+  const benchUiDir = path18.join(CLI_REPO_ROOT, "packages", "bench-ui");
   const pnpmCmd = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
-  if (!fs14.existsSync(path17.join(benchUiDir, "package.json"))) {
+  if (!fs15.existsSync(path18.join(benchUiDir, "package.json"))) {
     console.error("ERROR: @remnic/bench-ui is not available in this checkout.");
     process.exit(1);
   }
@@ -7350,24 +7547,24 @@ async function launchBenchUi(resultsDir) {
   });
 }
 function resolveRepoDatasetRoot() {
-  const repoCandidate = path17.join(CLI_REPO_ROOT, "evals", "datasets");
+  const repoCandidate = path18.join(CLI_REPO_ROOT, "evals", "datasets");
   if (isRepoCheckout()) {
     return repoCandidate;
   }
-  return path17.join(resolveHomeDir(), ".remnic", "bench", "datasets");
+  return path18.join(resolveHomeDir(), ".remnic", "bench", "datasets");
 }
 function listDownloadableBenchmarks() {
   return [...DOWNLOADABLE_BENCHMARK_DATASETS];
 }
 function resolveDatasetDownloadScriptPath() {
-  const bundled = path17.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
-  if (fs14.existsSync(bundled)) {
+  const bundled = path18.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
+  if (fs15.existsSync(bundled)) {
     return bundled;
   }
-  return path17.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
+  return path18.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
 }
 function isRepoCheckout() {
-  return fs14.existsSync(path17.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs14.existsSync(path17.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
+  return fs15.existsSync(path18.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs15.existsSync(path18.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
 }
 function runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, jsonMode) {
   const stdio = jsonMode ? ["inherit", process.stderr, "inherit"] : "inherit";
@@ -7418,7 +7615,7 @@ function resolveBenchDatasetDir(benchmarkId, quick, datasetDirOverride) {
   if (quick) {
     return void 0;
   }
-  const datasetDir = path17.join(resolveRepoDatasetRoot(), benchmarkId);
+  const datasetDir = path18.join(resolveRepoDatasetRoot(), benchmarkId);
   if (isDatasetDownloaded(datasetDir, benchmarkId)) {
     return datasetDir;
   }
@@ -7675,13 +7872,13 @@ async function exportBenchPackageResult(parsed) {
     process.exit(1);
   }
   const result = await loadBenchmarkResult(summary.path);
-  const reportCardProvenance = parsed.format === "html" ? await loadBenchmarkReportCardProvenance(path17.dirname(summary.path), result.meta.id) : void 0;
+  const reportCardProvenance = parsed.format === "html" ? await loadBenchmarkReportCardProvenance(path18.dirname(summary.path), result.meta.id) : void 0;
   const rendered = renderBenchmarkResultExport(result, parsed.format, {
     ...reportCardProvenance ? { reportCardProvenance } : {}
   });
   if (parsed.output) {
-    fs14.mkdirSync(path17.dirname(parsed.output), { recursive: true });
-    fs14.writeFileSync(parsed.output, rendered);
+    fs15.mkdirSync(path18.dirname(parsed.output), { recursive: true });
+    fs15.writeFileSync(parsed.output, rendered);
     console.log(`Exported ${summary.id} as ${parsed.format} to ${parsed.output}`);
     return;
   }
@@ -7698,7 +7895,7 @@ async function manageBenchDatasets(parsed) {
       process.exit(1);
     }
     const status = supported.map((benchmarkId) => {
-      const datasetPath = path17.join(datasetRoot, benchmarkId);
+      const datasetPath = path18.join(datasetRoot, benchmarkId);
       return {
         benchmark: benchmarkId,
         downloaded: isDatasetDownloaded(datasetPath, benchmarkId),
@@ -7726,7 +7923,7 @@ async function manageBenchDatasets(parsed) {
     process.exit(1);
   }
   const scriptPath = resolveDatasetDownloadScriptPath();
-  if (!fs14.existsSync(scriptPath)) {
+  if (!fs15.existsSync(scriptPath)) {
     console.error(`ERROR: dataset download script not found: ${scriptPath}`);
     process.exit(1);
   }
@@ -7736,7 +7933,7 @@ async function manageBenchDatasets(parsed) {
     runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, parsed.json === true);
     downloaded.push({
       benchmark: benchmarkId,
-      path: path17.join(datasetRoot, benchmarkId)
+      path: path18.join(datasetRoot, benchmarkId)
     });
   }
   if (parsed.json) {
@@ -7875,10 +8072,10 @@ async function calibrateBenchJudges(parsed, rawArgs) {
   }
   const bench = await loadBenchModule();
   const resultsDir = expandTilde(
-    parsed.resultsDir ?? path17.join(resolveHomeDir(), ".remnic", "bench", "results")
+    parsed.resultsDir ?? path18.join(resolveHomeDir(), ".remnic", "bench", "results")
   );
   const calibrationDir = expandTilde(
-    parsed.calibrationDir ?? path17.join(resolveHomeDir(), ".remnic", "bench", "calibration")
+    parsed.calibrationDir ?? path18.join(resolveHomeDir(), ".remnic", "bench", "calibration")
   );
   const stored = await bench.listBenchmarkResults(resultsDir);
   const allForBenchmark = stored.filter((entry) => entry.benchmark === benchmarkId);
@@ -7926,7 +8123,7 @@ async function calibrateBenchJudges(parsed, rawArgs) {
     );
     process.exit(1);
   }
-  const sourceResultSha256 = createHash4("sha256").update(fs14.readFileSync(latest.path)).digest("hex");
+  const sourceResultSha256 = createHash4("sha256").update(fs15.readFileSync(latest.path)).digest("hex");
   const expandedManifestPath = expandTilde(manifestPath);
   if (!bench.resolveLocalLabJudgeProviderConfig) {
     console.error(
@@ -8341,7 +8538,7 @@ function loadPinnedLoCoMoTaskSelector(parsed) {
   }
   let decoded;
   try {
-    decoded = JSON.parse(fs14.readFileSync(parsed.taskIdsFile, "utf8"));
+    decoded = JSON.parse(fs15.readFileSync(parsed.taskIdsFile, "utf8"));
   } catch (error) {
     throw new Error(
       `Unable to read --task-ids-file ${parsed.taskIdsFile}: ${error instanceof Error ? error.message : String(error)}`
@@ -8438,7 +8635,7 @@ async function loadPublishedPromotionHelpers() {
   return {
     async promoteArtifactsToPublished(args) {
       const { mkdirSync, readFileSync: readFileSync4, writeFileSync } = await import("fs");
-      const path18 = await import("path");
+      const path19 = await import("path");
       mkdirSync(args.publishedOutDir, { recursive: true });
       if (args.artifactPaths.length === 0) {
         console.warn(
@@ -8455,13 +8652,13 @@ async function loadPublishedPromotionHelpers() {
         const modelSlug = args.model.replace(/[^a-zA-Z0-9_.-]/g, "-");
         const rawProfile = parsedObj.config?.runtimeProfile;
         const profileSlug = typeof rawProfile === "string" && rawProfile.length > 0 ? `-${rawProfile.replace(/[^a-zA-Z0-9_.-]/g, "-")}` : "";
-        const target = path18.join(
+        const target = path19.join(
           args.publishedOutDir,
           `${today}-${args.benchmarkId}-${modelSlug}${profileSlug}-${gitShaShort}.json`
         );
         writeFileSync(target, raw, "utf8");
         console.log(
-          `[bench published] Promoted ${path18.basename(artifactPath)} \u2192 ${target}`
+          `[bench published] Promoted ${path19.basename(artifactPath)} \u2192 ${target}`
         );
       }
       void benchModule;
@@ -8568,7 +8765,7 @@ async function runBenchViaPackage(parsed, benchmarkId, runtimeProfile, benchStat
   const previousCodexDiagnosticsDir = process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV];
   const previousCodexDiagnosticsMode = process.env[CODEX_CLI_BENCH_DIAGNOSTICS_MODE_ENV];
   if (!previousCodexDiagnosticsDir) {
-    process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV] = path17.join(
+    process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV] = path18.join(
       outputDir,
       "codex-cli-diagnostics"
     );
@@ -8718,7 +8915,7 @@ async function preparePersistedJudgeCalibrationAttachment(benchModule, benchmark
     );
   }
   const calibrationDir = expandTilde(
-    calibrationBinding.calibrationDir ?? path17.join(resolveHomeDir(), ".remnic", "bench", "calibration")
+    calibrationBinding.calibrationDir ?? path18.join(resolveHomeDir(), ".remnic", "bench", "calibration")
   );
   const state = await benchModule.loadJudgeCalibrationState?.(benchmarkId, calibrationDir);
   if (!state) {
@@ -9016,7 +9213,7 @@ function resolveBenchReproDatasetDir(datasetDir) {
     return void 0;
   }
   try {
-    return fs14.realpathSync(datasetDir);
+    return fs15.realpathSync(datasetDir);
   } catch {
     return datasetDir;
   }
@@ -9070,13 +9267,13 @@ async function writeBenchReproManifestForPackageRun(args) {
 }
 function loadStandaloneConvergeCommandConfig() {
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  return parseConfig6(resolveRemnicConfigRecord5(raw));
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  return parseConfig7(resolveRemnicConfigRecord6(raw));
 }
 function parseConvergePluginConfig(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
   if (Object.keys(value).length === 0) return void 0;
-  return parseConfig6(resolveRemnicConfigRecord5(value));
+  return parseConfig7(resolveRemnicConfigRecord6(value));
 }
 function loadConvergeCommandConfig() {
   if (readCompatEnv("REMNIC_CONFIG_PATH", "ENGRAM_CONFIG_PATH")) {
@@ -9089,23 +9286,23 @@ function loadConvergeCommandConfig() {
   return loadStandaloneConvergeCommandConfig();
 }
 function resolveConfigPath(cliPath) {
-  if (cliPath) return path17.resolve(expandTilde(cliPath));
+  if (cliPath) return path18.resolve(expandTilde(cliPath));
   const envPath = readCompatEnv("REMNIC_CONFIG_PATH", "ENGRAM_CONFIG_PATH");
-  if (envPath) return path17.resolve(expandTilde(envPath));
+  if (envPath) return path18.resolve(expandTilde(envPath));
   const candidates = [
-    path17.join(process.cwd(), "remnic.config.json"),
-    path17.join(process.cwd(), "engram.config.json"),
-    path17.join(resolveHomeDir(), ".config", "remnic", "config.json"),
-    path17.join(resolveHomeDir(), ".config", "engram", "config.json")
+    path18.join(process.cwd(), "remnic.config.json"),
+    path18.join(process.cwd(), "engram.config.json"),
+    path18.join(resolveHomeDir(), ".config", "remnic", "config.json"),
+    path18.join(resolveHomeDir(), ".config", "engram", "config.json")
   ];
   for (const candidate of candidates) {
-    if (fs14.existsSync(candidate)) return candidate;
+    if (fs15.existsSync(candidate)) return candidate;
   }
-  return path17.join(resolveHomeDir(), ".config", "remnic", "config.json");
+  return path18.join(resolveHomeDir(), ".config", "remnic", "config.json");
 }
 function resolveExistingBenchRemnicConfigPath(cliPath) {
   const configPath = resolveConfigPath(cliPath);
-  if (fs14.existsSync(configPath)) {
+  if (fs15.existsSync(configPath)) {
     return configPath;
   }
   if (cliPath) {
@@ -9115,7 +9312,7 @@ function resolveExistingBenchRemnicConfigPath(cliPath) {
 }
 function resolveExistingBenchOpenclawConfigPath(cliPath) {
   const configPath = resolveOpenclawConfigPath(cliPath);
-  if (fs14.existsSync(configPath)) {
+  if (fs15.existsSync(configPath)) {
     return configPath;
   }
   if (cliPath) {
@@ -9215,34 +9412,34 @@ async function resolvePackageBenchRuntime(benchModule, parsed, runtimeProfile) {
   );
 }
 function normalizeMemoryDirPath(memoryDir) {
-  return path17.resolve(expandTilde(memoryDir));
+  return path18.resolve(expandTilde(memoryDir));
 }
 function resolveMemoryDir() {
   const configMemoryDir = (() => {
     const envMemoryDir = readCompatEnv("REMNIC_MEMORY_DIR", "ENGRAM_MEMORY_DIR");
     if (envMemoryDir) return normalizeMemoryDirPath(envMemoryDir);
     const configPath = resolveConfigPath();
-    const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord5(raw);
+    const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord6(raw);
     if (typeof remnicCfg.memoryDir === "string" && remnicCfg.memoryDir.length > 0) {
       return normalizeMemoryDirPath(remnicCfg.memoryDir);
     }
     const home = resolveHomeDir();
-    const standalonePath = path17.join(home, ".remnic", "memory");
-    const legacyStandalonePath = path17.join(home, ".engram", "memory");
-    const openclawPath = path17.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
-    if (fs14.existsSync(standalonePath)) return standalonePath;
-    if (fs14.existsSync(legacyStandalonePath)) return legacyStandalonePath;
+    const standalonePath = path18.join(home, ".remnic", "memory");
+    const legacyStandalonePath = path18.join(home, ".engram", "memory");
+    const openclawPath = path18.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
+    if (fs15.existsSync(standalonePath)) return standalonePath;
+    if (fs15.existsSync(legacyStandalonePath)) return legacyStandalonePath;
     return openclawPath;
   })();
   const manifestPath = getManifestPath();
-  if (fs14.existsSync(manifestPath)) {
+  if (fs15.existsSync(manifestPath)) {
     try {
       const active = getActiveSpace();
       if (active?.memoryDir) {
         const activeMemoryDir = normalizeMemoryDirPath(active.memoryDir);
-        if (!fs14.existsSync(activeMemoryDir)) {
-          fs14.mkdirSync(activeMemoryDir, { recursive: true });
+        if (!fs15.existsSync(activeMemoryDir)) {
+          fs15.mkdirSync(activeMemoryDir, { recursive: true });
         }
         return activeMemoryDir;
       }
@@ -9279,25 +9476,25 @@ function resolveFlagStrict(args, flag) {
 var REMNIC_OPENCLAW_LEGACY_PLUGIN_ID = "openclaw-engram";
 function resolveOpenclawStateDir() {
   const configuredStateDir = process.env.OPENCLAW_STATE_DIR?.trim();
-  return configuredStateDir ? path17.resolve(expandTilde(configuredStateDir)) : path17.join(resolveHomeDir(), ".openclaw");
+  return configuredStateDir ? path18.resolve(expandTilde(configuredStateDir)) : path18.join(resolveHomeDir(), ".openclaw");
 }
 var DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR = [
   process.env.OPENCLAW_CONFIG_PATH,
   process.env.OPENCLAW_ENGRAM_CONFIG_PATH,
-  path17.join(resolveOpenclawStateDir(), "openclaw.json")
+  path18.join(resolveOpenclawStateDir(), "openclaw.json")
 ].filter(Boolean);
 function resolveOpenclawConfigPath(cliPath) {
-  if (cliPath) return path17.resolve(expandTilde(cliPath));
+  if (cliPath) return path18.resolve(expandTilde(cliPath));
   const envPath = process.env.OPENCLAW_CONFIG_PATH || process.env.OPENCLAW_ENGRAM_CONFIG_PATH;
-  if (envPath) return path17.resolve(expandTilde(envPath));
+  if (envPath) return path18.resolve(expandTilde(envPath));
   for (const candidate of DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR) {
-    if (fs14.existsSync(candidate)) return candidate;
+    if (fs15.existsSync(candidate)) return candidate;
   }
-  return path17.join(resolveOpenclawStateDir(), "openclaw.json");
+  return path18.join(resolveOpenclawStateDir(), "openclaw.json");
 }
 function readOpenclawConfig(configPath) {
-  if (!fs14.existsSync(configPath)) return {};
-  const raw = fs14.readFileSync(configPath, "utf-8");
+  if (!fs15.existsSync(configPath)) return {};
+  const raw = fs15.readFileSync(configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -9352,10 +9549,10 @@ function buildRemnicOpenclawHooksPolicy(legacyHooks, existingHooks) {
 function resolveOpenclawInstallMemoryDir(args) {
   const existingMemoryDir = (typeof args.existingNewEntryConfig.memoryDir === "string" ? args.existingNewEntryConfig.memoryDir : void 0) || (args.migrateLegacy && typeof args.legacyConfigToMerge.memoryDir === "string" ? args.legacyConfigToMerge.memoryDir : void 0);
   if (args.requestedMemoryDir) {
-    return path17.resolve(expandTilde(args.requestedMemoryDir));
+    return path18.resolve(expandTilde(args.requestedMemoryDir));
   }
   if (existingMemoryDir) {
-    return path17.resolve(expandTilde(existingMemoryDir));
+    return path18.resolve(expandTilde(existingMemoryDir));
   }
   return args.fallbackMemoryDir;
 }
@@ -9373,21 +9570,21 @@ function resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir) {
     if (!config || typeof config !== "object" || Array.isArray(config)) continue;
     const memoryDir = config.memoryDir;
     if (typeof memoryDir === "string" && memoryDir.trim().length > 0) {
-      return path17.resolve(expandTilde(memoryDir));
+      return path18.resolve(expandTilde(memoryDir));
     }
   }
   return fallbackMemoryDir;
 }
 function resolveOpenclawPluginDir(cliPath) {
-  if (cliPath) return path17.resolve(expandTilde(cliPath));
+  if (cliPath) return path18.resolve(expandTilde(cliPath));
   return resolveOpenclawManagedPluginDir();
 }
 function resolveOpenclawManagedPluginDir() {
-  return path17.join(resolveOpenclawStateDir(), "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
+  return path18.join(resolveOpenclawStateDir(), "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
 }
 function resolveOpenclawLegacyPluginDir(cliPath) {
-  if (cliPath) return path17.resolve(expandTilde(cliPath));
-  return path17.join(resolveOpenclawStateDir(), "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID);
+  if (cliPath) return path18.resolve(expandTilde(cliPath));
+  return path18.join(resolveOpenclawStateDir(), "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID);
 }
 function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
   const yyyy = now.getFullYear().toString();
@@ -9399,9 +9596,9 @@ function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
   return `${yyyy}${mm}${dd}-${hh}${min}${ss}`;
 }
 function backupPathIfPresent(sourcePath, backupPath) {
-  if (!fs14.existsSync(sourcePath)) return false;
-  fs14.mkdirSync(path17.dirname(backupPath), { recursive: true });
-  fs14.cpSync(sourcePath, backupPath, { recursive: true });
+  if (!fs15.existsSync(sourcePath)) return false;
+  fs15.mkdirSync(path18.dirname(backupPath), { recursive: true });
+  fs15.cpSync(sourcePath, backupPath, { recursive: true });
   return true;
 }
 function restartOpenclawGateway() {
@@ -9419,15 +9616,15 @@ function restartOpenclawGateway() {
   });
 }
 function cmdInit() {
-  const configPath = path17.join(process.cwd(), "remnic.config.json");
-  if (fs14.existsSync(configPath)) {
+  const configPath = path18.join(process.cwd(), "remnic.config.json");
+  if (fs15.existsSync(configPath)) {
     console.log(`Config already exists: ${configPath}`);
     return;
   }
   const template = {
     remnic: {
       openaiApiKey: "${OPENAI_API_KEY}",
-      memoryDir: path17.join(process.cwd(), ".remnic", "memory"),
+      memoryDir: path18.join(process.cwd(), ".remnic", "memory"),
       memoryOsPreset: "balanced"
     },
     server: {
@@ -9436,7 +9633,7 @@ function cmdInit() {
       authToken: "${REMNIC_AUTH_TOKEN}"
     }
   };
-  fs14.writeFileSync(configPath, JSON.stringify(template, null, 2) + "\n");
+  fs15.writeFileSync(configPath, JSON.stringify(template, null, 2) + "\n");
   console.log(`Created ${configPath}`);
   console.log("\nSet these environment variables:");
   console.log("  export OPENAI_API_KEY=sk-...");
@@ -9506,7 +9703,7 @@ async function cmdStatus(json) {
 }
 function oauthReadConfigRecord(configPath) {
   try {
-    const parsed = JSON.parse(fs14.readFileSync(configPath, "utf8"));
+    const parsed = JSON.parse(fs15.readFileSync(configPath, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -9564,7 +9761,7 @@ function oauthResolveOperatorToken() {
   }
   return void 0;
 }
-async function oauthFetch(method, path18, token, body) {
+async function oauthFetch(method, path19, token, body) {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), 5e3);
   try {
@@ -9583,7 +9780,7 @@ async function oauthFetch(method, path18, token, body) {
     if (body !== void 0) {
       init.body = JSON.stringify(body);
     }
-    const response = await fetch(`${oauthResolveBaseUrl()}${path18}`, init);
+    const response = await fetch(`${oauthResolveBaseUrl()}${path19}`, init);
     if (response.status === 401) {
       throw new Error(
         "operator token rejected by remnic-server (HTTP 401). Update `server.authToken` or `REMNIC_AUTH_TOKEN` to match the running daemon."
@@ -9920,12 +10117,12 @@ async function cmdQuery(queryText, json, explain) {
     console.error("Usage: remnic query <text>");
     process.exit(1);
   }
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
-  const orchestrator = new Orchestrator3(config);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
+  const orchestrator = new Orchestrator4(config);
   await orchestrator.initialize();
   const service = new EngramAccessService2(orchestrator);
   const recallRequest = buildQueryRecallRequest(queryText);
@@ -10091,12 +10288,12 @@ async function runXrayCommand(rest, io) {
 async function cmdXray(rest) {
   const { rawQuery, options } = extractXrayRawArgs(rest);
   parseXrayCliOptions(rawQuery, options);
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
-  const orchestrator = new Orchestrator3(config);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
+  const orchestrator = new Orchestrator4(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
   const service = new EngramAccessService2(orchestrator);
@@ -10114,11 +10311,11 @@ async function cmdXray(rest) {
   }
 }
 async function cmdVersions(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   if (!config.versioningEnabled) {
     console.error("Page versioning is disabled (versioningEnabled = false).");
     process.exit(1);
@@ -10138,7 +10335,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions list <page-path>");
         process.exit(1);
       }
-      const absPath = path17.resolve(pagePath);
+      const absPath = path18.resolve(pagePath);
       const history = await listVersions(absPath, versioningConfig, memDir);
       if (json) {
         console.log(JSON.stringify(history, null, 2));
@@ -10163,7 +10360,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions show <page-path> <version-id>");
         process.exit(1);
       }
-      const absPath = path17.resolve(pagePath);
+      const absPath = path18.resolve(pagePath);
       try {
         const content = await getVersion(absPath, versionId, versioningConfig, memDir);
         console.log(content);
@@ -10181,7 +10378,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions diff <page-path> <v1> <v2>");
         process.exit(1);
       }
-      const absPath = path17.resolve(pagePath);
+      const absPath = path18.resolve(pagePath);
       try {
         const diffOutput = await diffVersions(absPath, v1, v2, versioningConfig, memDir);
         console.log(diffOutput);
@@ -10198,7 +10395,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions revert <page-path> <version-id>");
         process.exit(1);
       }
-      const absPath = path17.resolve(pagePath);
+      const absPath = path18.resolve(pagePath);
       try {
         const version = await revertToVersion(absPath, versionId, versioningConfig, void 0, memDir);
         if (json) {
@@ -10230,15 +10427,15 @@ Options:
   }
 }
 async function cmdEnrich(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   const subcommand = rest[0];
   if (subcommand === "audit") {
     const memoryDir2 = expandTilde(config.memoryDir);
-    const auditDir2 = path17.join(memoryDir2, "enrichment");
+    const auditDir2 = path18.join(memoryDir2, "enrichment");
     const sinceFlag = resolveFlag(rest.slice(1), "--since");
     const entries = await readAuditLog(auditDir2, sinceFlag ?? void 0);
     if (entries.length === 0) {
@@ -10262,7 +10459,7 @@ async function cmdEnrich(rest) {
     pipelineConfig2.providers = [
       { id: "web-search", enabled: true, costTier: "cheap" }
     ];
-    const orchestrator2 = new Orchestrator3(config);
+    const orchestrator2 = new Orchestrator4(config);
     await orchestrator2.initialize();
     await orchestrator2.deferredReady;
     const searchBackend2 = orchestrator2.qmd;
@@ -10298,7 +10495,7 @@ Registered providers:`);
     console.error("Usage: remnic enrich <entity-name> | --all | --dry-run | audit | providers");
     process.exit(1);
   }
-  const orchestrator = new Orchestrator3(config);
+  const orchestrator = new Orchestrator4(config);
   await orchestrator.initialize();
   await orchestrator.deferredReady;
   const storage = await orchestrator.getStorage(config.defaultNamespace);
@@ -10363,7 +10560,7 @@ Registered providers:`);
     return;
   }
   const memoryDir = expandTilde(config.memoryDir);
-  const auditDir = path17.join(memoryDir, "enrichment");
+  const auditDir = path18.join(memoryDir, "enrichment");
   let totalPersisted = 0;
   for (const result of results) {
     for (const candidate of result.acceptedCandidates) {
@@ -10424,7 +10621,7 @@ Registered providers:`);
   }
 }
 async function cmdProcedural(rest) {
-  initLogger2();
+  initLogger3();
   const subcommand = rest[0];
   if (!subcommand || subcommand === "--help" || subcommand === "-h") {
     console.log(`remnic procedural \u2014 Procedural memory operations (issue #567)
@@ -10477,9 +10674,9 @@ Shared with:
     process.exit(1);
   }
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   const memoryDir = expandTilde(
     typeof memoryDirOverride === "string" && memoryDirOverride.length > 0 ? memoryDirOverride : config.memoryDir ?? resolveMemoryDir()
   );
@@ -10492,11 +10689,11 @@ Shared with:
   process.stdout.write(formatProcedureStatsText(report));
 }
 async function cmdExtensions(action, rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   const root = resolveExtensionsRoot(config);
   const noopLog = { warn: () => {
   }, debug: () => {
@@ -10545,7 +10742,7 @@ Root: ${root}`);
       const extensions = await discoverMemoryExtensions(root, warnLog);
       let entries = [];
       try {
-        entries = fs14.readdirSync(root);
+        entries = fs15.readdirSync(root);
       } catch {
         console.log(`Extensions root does not exist: ${root}`);
         process.exitCode = 0;
@@ -10554,9 +10751,9 @@ Root: ${root}`);
       const validNames = new Set(extensions.map((e) => e.name));
       let errors = 0;
       for (const entry of entries) {
-        const entryPath = path17.join(root, entry);
+        const entryPath = path18.join(root, entry);
         try {
-          if (!fs14.statSync(entryPath).isDirectory()) continue;
+          if (!fs15.statSync(entryPath).isDirectory()) continue;
         } catch {
           continue;
         }
@@ -10586,11 +10783,11 @@ Root: ${root}`);
   }
 }
 async function cmdBriefing(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   if (!config.briefing.enabled) {
     console.error("Briefing is disabled in config (briefing.enabled = false).");
     process.exit(1);
@@ -10643,7 +10840,7 @@ async function cmdBriefing(rest) {
     process.exit(1);
   }
   const format = effectiveFormatFlag === "json" ? "json" : effectiveFormatFlag === "markdown" ? "markdown" : config.briefing.defaultFormat;
-  const orchestrator = new Orchestrator3(config);
+  const orchestrator = new Orchestrator4(config);
   await orchestrator.initialize();
   const storage = await orchestrator.getStorage(config.defaultNamespace);
   const calendarSource = config.briefing.calendarSource ? new FileCalendarSource(config.briefing.calendarSource) : void 0;
@@ -10668,10 +10865,10 @@ async function cmdBriefing(rest) {
   if (save) {
     try {
       const saveDir = resolveBriefingSaveDir(config.briefing.saveDir);
-      fs14.mkdirSync(saveDir, { recursive: true });
+      fs15.mkdirSync(saveDir, { recursive: true });
       const filename = briefingFilename(new Date(result.window.to), format);
-      const filePath = path17.join(saveDir, filename);
-      fs14.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
+      const filePath = path18.join(saveDir, filename);
+      fs15.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
       console.error(`Saved briefing: ${filePath}`);
     } catch (err) {
       console.error(`Failed to save briefing: ${err instanceof Error ? err.message : String(err)}`);
@@ -10689,7 +10886,7 @@ async function cmdDoctor() {
     detail: `${nodeVersion} (requires >= 22.12.0)`
   });
   const configPath = resolveConfigPath();
-  const configExists = fs14.existsSync(configPath);
+  const configExists = fs15.existsSync(configPath);
   checks.push({ name: "Config file", ok: configExists, detail: configPath });
   let standaloneConfig;
   let standaloneConfigError;
@@ -10697,11 +10894,11 @@ async function cmdDoctor() {
   let configuredNs = { invalid: false };
   if (configExists) {
     try {
-      const raw = JSON.parse(fs14.readFileSync(configPath, "utf8"));
-      const remnicCfg = resolveRemnicConfigRecord5(raw);
+      const raw = JSON.parse(fs15.readFileSync(configPath, "utf8"));
+      const remnicCfg = resolveRemnicConfigRecord6(raw);
       standaloneOpenaiApiKeyExplicitlyFalse = isOpenaiApiKeyDisabled(remnicCfg.openaiApiKey);
       configuredNs = readConfiguredNamespace(remnicCfg);
-      standaloneConfig = parseConfig6(remnicCfg);
+      standaloneConfig = parseConfig7(remnicCfg);
     } catch (err) {
       standaloneConfigError = err instanceof Error ? err.message : String(err);
     }
@@ -10710,10 +10907,10 @@ async function cmdDoctor() {
   try {
     memoryDir = resolveMemoryDir();
   } catch {
-    memoryDir = parseConfig6({}).memoryDir;
+    memoryDir = parseConfig7({}).memoryDir;
   }
   try {
-    fs14.mkdirSync(memoryDir, { recursive: true });
+    fs15.mkdirSync(memoryDir, { recursive: true });
     checks.push({ name: "Memory directory", ok: true, detail: memoryDir });
   } catch {
     checks.push({ name: "Memory directory", ok: false, detail: `cannot create ${memoryDir}` });
@@ -10742,7 +10939,7 @@ async function cmdDoctor() {
   });
   if (nsPolicyCheck) checks.push(nsPolicyCheck);
   const openclawConfigPath = resolveOpenclawConfigPath();
-  const openclawConfigExists = fs14.existsSync(openclawConfigPath);
+  const openclawConfigExists = fs15.existsSync(openclawConfigPath);
   let openclawConfig = {};
   let openclawConfigValid = false;
   let openclawPluginModeConfigured = false;
@@ -10750,7 +10947,7 @@ async function cmdDoctor() {
   let activeOpenclawEntryConfig = null;
   if (openclawConfigExists) {
     try {
-      const parsed = JSON.parse(fs14.readFileSync(openclawConfigPath, "utf-8"));
+      const parsed = JSON.parse(fs15.readFileSync(openclawConfigPath, "utf-8"));
       if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
         openclawConfig = parsed;
         openclawConfigValid = true;
@@ -10826,13 +11023,13 @@ async function cmdDoctor() {
       const rawMemoryDir = entryConfig?.memoryDir;
       const configuredMemoryDir = typeof rawMemoryDir === "string" ? rawMemoryDir : void 0;
       if (configuredMemoryDir) {
-        const resolvedMemDir = path17.resolve(expandTilde(configuredMemoryDir));
+        const resolvedMemDir = path18.resolve(expandTilde(configuredMemoryDir));
         let memDirOk = false;
         let memDirDetail = `${resolvedMemDir} (not found)`;
         let memDirRemediation = `Run \`remnic openclaw install --memory-dir "${resolvedMemDir}"\` to create the directory.`;
-        if (fs14.existsSync(resolvedMemDir)) {
+        if (fs15.existsSync(resolvedMemDir)) {
           try {
-            const stat2 = fs14.statSync(resolvedMemDir);
+            const stat2 = fs15.statSync(resolvedMemDir);
             if (stat2.isDirectory()) {
               memDirOk = true;
               memDirDetail = resolvedMemDir;
@@ -10974,12 +11171,12 @@ async function cmdDoctor() {
 }
 function cmdConfig() {
   const configPath = resolveConfigPath();
-  if (!fs14.existsSync(configPath)) {
+  if (!fs15.existsSync(configPath)) {
     console.log("No config file found. Run `remnic init` to create one.");
     return;
   }
   console.log(`Config: ${configPath}`);
-  const rawConfig = fs14.readFileSync(configPath, "utf8");
+  const rawConfig = fs15.readFileSync(configPath, "utf8");
   const redacted = rawConfig.replace(
     /("(?:openaiApiKey|localLlmApiKey|authToken|apiKey|remoteSearchApiKey|meilisearchApiKey|opikApiKey)"\s*:\s*")([^"]*)(")/g,
     "$1[REDACTED]$3"
@@ -11026,7 +11223,7 @@ async function cmdMigrate(json, rollback) {
   console.log(`  Rollback: ${result.rollbackCommand}`);
 }
 function cmdOnboard(dirPath, json) {
-  const directory = path17.resolve(dirPath || process.cwd());
+  const directory = path18.resolve(dirPath || process.cwd());
   const result = onboard({ directory });
   if (json) {
     console.log(JSON.stringify(result, null, 2));
@@ -11045,7 +11242,7 @@ Suggested namespace: ${result.plan.suggestedNamespace}`);
 async function cmdCurate(targetPath, json) {
   const memoryDir = resolveMemoryDir();
   const result = await curate({
-    targetPath: path17.resolve(targetPath),
+    targetPath: path18.resolve(targetPath),
     memoryDir,
     source: "curation",
     checkDuplicates: true,
@@ -11087,9 +11284,9 @@ async function cmdReview(action, rest) {
     const configPath = resolveConfigPath();
     let tombstonesConfig = null;
     try {
-      const rawCfg = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-      const remnicCfg = resolveRemnicConfigRecord5(rawCfg);
-      const config = parseConfig6(remnicCfg);
+      const rawCfg = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+      const remnicCfg = resolveRemnicConfigRecord6(rawCfg);
+      const config = parseConfig7(remnicCfg);
       tombstonesConfig = {
         enabled: config.tombstonesEnabled,
         semanticMatch: config.tombstonesSemanticMatch,
@@ -11175,7 +11372,7 @@ async function cmdSync(action, rest, json) {
 }
 function localOfflineSourceId(memoryDir) {
   const host = os3.hostname() || "unknown-host";
-  const dirHash = createHash4("sha256").update(path17.resolve(memoryDir)).digest("hex").slice(0, 16);
+  const dirHash = createHash4("sha256").update(path18.resolve(memoryDir)).digest("hex").slice(0, 16);
   return `remnic-local:${host}:${dirHash}`;
 }
 function normalizeOfflineRemoteUrl(raw) {
@@ -11573,10 +11770,10 @@ var OFFLINE_SYNC_CONTENT_MISSING_RETRY_MAX = 3;
 var OFFLINE_SYNC_CONTENT_MISSING_RETRY_DELAY_MS = 250;
 var OfflineRemoteFileChangedError = class extends Error {
   path;
-  constructor(path18) {
-    super(`remote file changed while fetching offline content: ${path18}`);
+  constructor(path19) {
+    super(`remote file changed while fetching offline content: ${path19}`);
     this.name = "OfflineRemoteFileChangedError";
-    this.path = path18;
+    this.path = path19;
   }
 };
 function isOfflineRemoteFileChangedError(error) {
@@ -11831,13 +12028,13 @@ async function pushOfflineFileContent(args) {
 }
 async function pushOfflineFileContentFromChunkReader(args) {
   const filePath = resolveOfflineDirectHydrationPath(args.memoryDir, args.file.path);
-  const stat2 = fs14.statSync(filePath);
+  const stat2 = fs15.statSync(filePath);
   if (stat2.mtimeMs !== args.file.mtimeMs) {
     throw new Error(`local file changed while pushing offline content: ${args.file.path}`);
   }
   const hash = createHash4("sha256");
   const chunks = args.readFileChunks({
-    root: path17.resolve(args.memoryDir),
+    root: path18.resolve(args.memoryDir),
     path: args.file.path,
     filePath,
     chunkSize: OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES
@@ -12322,7 +12519,7 @@ function advanceOfflineBaseFilesForSuccessfulPush(options) {
   return [...next.values()].sort((left, right) => left.path.localeCompare(right.path));
 }
 async function runOfflineSyncOnce(options) {
-  fs14.mkdirSync(options.memoryDir, { recursive: true });
+  fs15.mkdirSync(options.memoryDir, { recursive: true });
   let activeStatePath = options.statePath;
   let priorState = await readOfflineSyncState(activeStatePath);
   let syncNamespace = options.namespace ?? priorState?.namespace;
@@ -12947,7 +13144,7 @@ Environment fallbacks:
   REMNIC_OFFLINE_REMOTE_URL, REMNIC_OFFLINE_TOKEN, REMNIC_AUTH_TOKEN`);
     return;
   }
-  const memoryDir = path17.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
+  const memoryDir = path18.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
   const namespace = resolveRequiredValueFlag(rest, "--namespace");
   const includeTranscripts = !hasFlag(rest, "--no-transcripts");
   const stateOverride = resolveRequiredValueFlag(rest, "--state");
@@ -12955,7 +13152,7 @@ Environment fallbacks:
   const configPath = resolveConfigPath();
   let config;
   try {
-    const rawConfig = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
+    const rawConfig = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
     config = parseConfigQuietly(pickOfflineConfigRecord(rawConfig));
   } catch {
     throw new Error(
@@ -12967,10 +13164,10 @@ Environment fallbacks:
   const needsRemote = action === "prepare" || action === "sync" || action === "watch";
   const remoteUrl = needsRemote ? resolveOfflineRemoteUrl(rest) : resolveOptionalOfflineRemoteUrl(rest);
   const token = needsRemote ? resolveOfflineToken(rest) : void 0;
-  const statePath = statePathExplicit ? path17.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
+  const statePath = statePathExplicit ? path18.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
   if (action === "prepare") {
     if (!remoteUrl || !token || !statePath) throw new Error("offline prepare requires remote URL and token");
-    fs14.mkdirSync(memoryDir, { recursive: true });
+    fs15.mkdirSync(memoryDir, { recursive: true });
     const remoteSnapshot = await fetchOfflineSnapshot({
       remoteUrl,
       token,
@@ -13069,7 +13266,7 @@ Environment fallbacks:
     return;
   }
   if (action === "status") {
-    fs14.mkdirSync(memoryDir, { recursive: true });
+    fs15.mkdirSync(memoryDir, { recursive: true });
     const state = statePath ? await readOfflineSyncState(statePath) : null;
     if (state && remoteUrl && statePath) {
       assertOfflineStateMatches({
@@ -13149,11 +13346,11 @@ Environment fallbacks:
           failures: result.largeFilePushFailures
         });
         largeFileFailureCounts = advanced.counts;
-        for (const path18 of advanced.newlySkipped) {
-          if (skippedLargeFiles.has(path18)) continue;
-          skippedLargeFiles.add(path18);
+        for (const path19 of advanced.newlySkipped) {
+          if (skippedLargeFiles.has(path19)) continue;
+          skippedLargeFiles.add(path19);
           console.warn(
-            `offline sync: permanently skipping ${path18} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
+            `offline sync: permanently skipping ${path19} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
           );
         }
         const pulled = result.pull ? result.pull.upserted + result.pull.deleted : 0;
@@ -13168,11 +13365,11 @@ Environment fallbacks:
             failures: error.failures
           });
           largeFileFailureCounts = advanced.counts;
-          for (const path18 of advanced.newlySkipped) {
-            if (skippedLargeFiles.has(path18)) continue;
-            skippedLargeFiles.add(path18);
+          for (const path19 of advanced.newlySkipped) {
+            if (skippedLargeFiles.has(path19)) continue;
+            skippedLargeFiles.add(path19);
             console.warn(
-              `offline sync: permanently skipping ${path18} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
+              `offline sync: permanently skipping ${path19} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
             );
           }
         }
@@ -13207,7 +13404,7 @@ function cmdDedup(json) {
 function readInstalledConnectorConfig(configPath, fallback) {
   if (!configPath) return fallback;
   try {
-    const parsed = JSON.parse(fs14.readFileSync(configPath, "utf8"));
+    const parsed = JSON.parse(fs15.readFileSync(configPath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return fallback;
     const { token: _token, ...config } = parsed;
     return config;
@@ -13313,7 +13510,7 @@ async function cmdConnectors(action, rest, json) {
             const connectorDaemonUrl = typeof effectiveConnectorConfig.remnicDaemonUrl === "string" && effectiveConnectorConfig.remnicDaemonUrl.trim().length > 0 ? effectiveConnectorConfig.remnicDaemonUrl.trim() : void 0;
             const pubResult = await pub.publish({
               config: { memoryDir, namespace: connectorNamespace, daemonUrl: connectorDaemonUrl },
-              skillsRoot: path17.join(memoryDir, "skills"),
+              skillsRoot: path18.join(memoryDir, "skills"),
               rollbackTokenEntry: preInstallTokenEntry,
               log: { info: console.log, warn: console.warn, error: console.error }
             });
@@ -13385,7 +13582,7 @@ async function cmdConnectors(action, rest, json) {
           const pub = factory();
           const available = await pub.isHostAvailable();
           const extRoot = available ? await pub.resolveExtensionRoot() : "(host not installed)";
-          const extensionExists = available && extRoot ? fs14.existsSync(extRoot) : false;
+          const extensionExists = available && extRoot ? fs15.existsSync(extRoot) : false;
           publisherChecks.push({
             name: `Publisher: ${targetHostId}`,
             ok: !available || extensionExists,
@@ -13459,7 +13656,7 @@ async function cmdConnectors(action, rest, json) {
     let connectorsCfg;
     const configPath = resolveConfigPath();
     try {
-      const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
+      const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
       connectorsCfg = parseConfigQuietly(raw).connectors;
     } catch {
       process.stderr.write(
@@ -13533,12 +13730,12 @@ async function cmdConnectors(action, rest, json) {
       process.exitCode = 2;
       return;
     }
-    initLogger2();
+    initLogger3();
     const configPath = resolveConfigPath();
-    const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord5(raw);
-    const config = parseConfig6(remnicCfg);
-    const orchestrator = new Orchestrator3(config);
+    const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord6(raw);
+    const config = parseConfig7(remnicCfg);
+    const orchestrator = new Orchestrator4(config);
     try {
       await orchestrator.initialize();
       await orchestrator.deferredReady;
@@ -13660,9 +13857,9 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
     console.error(`connectors marketplace: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
-  const rawConfig = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const pluginConfig = resolveRemnicConfigRecord5(rawConfig);
-  const config = parseConfig6(pluginConfig);
+  const rawConfig = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const pluginConfig = resolveRemnicConfigRecord6(rawConfig);
+  const config = parseConfig7(pluginConfig);
   if (subAction === "generate") {
     let outputDir;
     try {
@@ -13673,22 +13870,22 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
     }
     const manifest = generateMarketplaceManifest();
     await writeMarketplaceManifest(outputDir, manifest);
-    const outPath = path17.join(outputDir, "marketplace.json");
+    const outPath = path18.join(outputDir, "marketplace.json");
     if (json) {
       console.log(JSON.stringify({ status: "generated", path: outPath }, null, 2));
     } else {
       console.log(`Generated marketplace.json at ${outPath}`);
     }
   } else if (subAction === "validate") {
-    const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path17.join(process.cwd(), "marketplace.json");
-    const resolved = path17.resolve(targetPath);
-    if (!fs14.existsSync(resolved)) {
+    const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path18.join(process.cwd(), "marketplace.json");
+    const resolved = path18.resolve(targetPath);
+    if (!fs15.existsSync(resolved)) {
       console.error(`File not found: ${resolved}`);
       process.exit(1);
     }
     let parsed;
     try {
-      parsed = JSON.parse(fs14.readFileSync(resolved, "utf8"));
+      parsed = JSON.parse(fs15.readFileSync(resolved, "utf8"));
     } catch {
       console.error(`Invalid JSON in ${resolved}`);
       process.exit(1);
@@ -13887,12 +14084,12 @@ async function cmdSpace(action, rest, json) {
   }
 }
 async function cmdLegacyBenchmark(action, rest, json) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
-  const orchestrator = new Orchestrator3(config);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
+  const orchestrator = new Orchestrator4(config);
   const service = new EngramAccessService2(orchestrator);
   const { runBenchSuite, loadBaseline, checkRegression } = await loadBenchModule();
   const benchConfig = {
@@ -13964,6 +14161,7 @@ async function cmdLegacyBenchmark(action, rest, json) {
 }
 async function cmdBench(rest) {
   if (rest[0] === "coding") return cmdBenchCoding(rest.slice(1));
+  if (rest[0] === "security") return cmdBenchSecurity(rest.slice(1));
   if (rest[0] === "procedural-ablation") {
     await cmdBenchProceduralAblation(rest.slice(1));
     return;
@@ -14090,7 +14288,7 @@ async function cmdBench(rest) {
     }
     const completeCount = prevStatus.benchmarks.filter((b) => b.status === "complete").length;
     const failedCount = prevStatus.benchmarks.filter((b) => b.status === "failed").length;
-    printBenchStatusLine(parsed.json, `Resuming from: ${path17.basename(latestStatusPath)}`);
+    printBenchStatusLine(parsed.json, `Resuming from: ${path18.basename(latestStatusPath)}`);
     printBenchStatusLine(parsed.json, `  Previous run: ${prevStatus.startedAt}`);
     printBenchStatusLine(parsed.json, `  Benchmarks: ${prevStatus.benchmarks.length} total, ${completeCount} complete, ${failedCount} failed`);
     const before = selectedBenchmarks.length;
@@ -14258,9 +14456,9 @@ Options:
     );
     process.exit(1);
   } else {
-    fixturePath = path17.resolve(expandTilde(fixturePathRaw));
+    fixturePath = path18.resolve(expandTilde(fixturePathRaw));
   }
-  const outPath = path17.resolve(expandTilde(outPathRaw));
+  const outPath = path18.resolve(expandTilde(outPathRaw));
   const benchModule = await loadBenchModule();
   const runner = benchModule.runProceduralAblationCli;
   if (typeof runner !== "function") {
@@ -14279,7 +14477,7 @@ Options:
   );
   console.log(`wrote ${outPath}`);
 }
-var LOGS_DIR = path17.join(PID_DIR, "logs");
+var LOGS_DIR = path18.join(PID_DIR, "logs");
 var LAUNCHD_PLIST_PATHS = launchdPlistPaths(resolveHomeDir());
 var [LAUNCHD_PLIST_PATH] = LAUNCHD_PLIST_PATHS;
 var SYSTEMD_UNIT_PATHS = systemdUnitPaths(resolveHomeDir());
@@ -14293,7 +14491,7 @@ function readPid() {
 function inferPort() {
   try {
     const configPath = resolveConfigPath();
-    const raw = JSON.parse(fs14.readFileSync(configPath, "utf8"));
+    const raw = JSON.parse(fs15.readFileSync(configPath, "utf8"));
     return raw.server?.port ?? 4318;
   } catch {
     return 4318;
@@ -14356,7 +14554,7 @@ function selectLaunchdInspection(openclawPluginModeConfigured) {
   for (const plistPath of LAUNCHD_PLIST_PATHS.slice(1)) {
     const legacy = inspectLaunchdPlist(plistPath);
     if (!legacy.installed) continue;
-    const label = path17.basename(plistPath, ".plist");
+    const label = path18.basename(plistPath, ".plist");
     return legacy.ok ? {
       ...legacy,
       warn: true,
@@ -14388,13 +14586,13 @@ function daemonInstall() {
     process.exit(1);
   }
   const vars = { HOME: home, NODE_PATH: nodePath, REMNIC_SERVER_BIN: serverBin };
-  fs14.mkdirSync(LOGS_DIR, { recursive: true });
+  fs15.mkdirSync(LOGS_DIR, { recursive: true });
   if (isMacOS()) {
-    const templatePath = path17.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
-    const template = fs14.readFileSync(templatePath, "utf8");
+    const templatePath = path18.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
+    const template = fs15.readFileSync(templatePath, "utf8");
     const plist = renderTemplate(template, vars);
-    fs14.mkdirSync(path17.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
-    fs14.writeFileSync(LAUNCHD_PLIST_PATH, plist);
+    fs15.mkdirSync(path18.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
+    fs15.writeFileSync(LAUNCHD_PLIST_PATH, plist);
     try {
       launchdLoadPlist(LAUNCHD_PLIST_PATH);
     } catch (err) {
@@ -14410,11 +14608,11 @@ function daemonInstall() {
     console.log(`  RunAtLoad: true, KeepAlive: true`);
     console.log(`  Logs: ${LOGS_DIR}/daemon.log`);
   } else if (isLinux()) {
-    const templatePath = path17.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
-    const template = fs14.readFileSync(templatePath, "utf8");
+    const templatePath = path18.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
+    const template = fs15.readFileSync(templatePath, "utf8");
     const unit = renderTemplate(template, vars);
-    fs14.mkdirSync(path17.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
-    fs14.writeFileSync(SYSTEMD_UNIT_PATH, unit);
+    fs15.mkdirSync(path18.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
+    fs15.writeFileSync(SYSTEMD_UNIT_PATH, unit);
     try {
       childProcess2.execSync("systemctl --user daemon-reload", { stdio: "pipe" });
     } catch (err) {
@@ -14450,7 +14648,7 @@ function daemonUninstall() {
       } catch {
       }
       try {
-        fs14.unlinkSync(plistPath);
+        fs15.unlinkSync(plistPath);
         removed = true;
         console.log(`Removed launchd service: ${plistPath}`);
       } catch {
@@ -14470,7 +14668,7 @@ function daemonUninstall() {
     let removed = false;
     for (const unitPath of SYSTEMD_UNIT_PATHS) {
       try {
-        fs14.unlinkSync(unitPath);
+        fs15.unlinkSync(unitPath);
         removed = true;
         console.log(`Removed systemd service: ${unitPath}`);
       } catch {
@@ -14537,13 +14735,13 @@ async function daemonStatus() {
   console.log(`  Port:      ${port}`);
   console.log(`  Service:   ${serviceInstalled ? "installed" : "not installed"}`);
   console.log(`  Platform:  ${process.platform}`);
-  console.log(`  PID file:  ${fs14.existsSync(PID_FILE) ? PID_FILE : LEGACY_PID_FILE}`);
-  console.log(`  Log file:  ${fs14.existsSync(LOG_FILE) ? LOG_FILE : LEGACY_LOG_FILE}`);
+  console.log(`  PID file:  ${fs15.existsSync(PID_FILE) ? PID_FILE : LEGACY_PID_FILE}`);
+  console.log(`  Log file:  ${fs15.existsSync(LOG_FILE) ? LOG_FILE : LEGACY_LOG_FILE}`);
   try {
     const configPath = resolveConfigPath();
-    const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-    const remnicCfg = resolveRemnicConfigRecord5(raw);
-    const config = parseConfig6(remnicCfg);
+    const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+    const remnicCfg = resolveRemnicConfigRecord6(raw);
+    const config = parseConfig7(remnicCfg);
     const extRoot = resolveExtensionsRoot(config);
     const noopLog = { warn: () => {
     }, debug: () => {
@@ -14582,9 +14780,9 @@ function daemonStart() {
       return;
     }
   }
-  fs14.mkdirSync(PID_DIR, { recursive: true });
-  fs14.mkdirSync(LOGS_DIR, { recursive: true });
-  const logStream = fs14.openSync(LOG_FILE, "a");
+  fs15.mkdirSync(PID_DIR, { recursive: true });
+  fs15.mkdirSync(LOGS_DIR, { recursive: true });
+  const logStream = fs15.openSync(LOG_FILE, "a");
   const serverBin = resolveServerBin();
   const isSource = serverBin.endsWith(".ts");
   let cmd;
@@ -14606,7 +14804,7 @@ function daemonStart() {
     }
   });
   child.unref();
-  fs14.writeFileSync(PID_FILE, String(child.pid));
+  fs15.writeFileSync(PID_FILE, String(child.pid));
   console.log(`Started remnic server (pid ${child.pid})`);
   console.log(`  Log: ${LOG_FILE}`);
 }
@@ -14640,11 +14838,11 @@ function daemonStop() {
     console.log("Process not found (cleaning up PID file)");
   }
   try {
-    fs14.unlinkSync(PID_FILE);
+    fs15.unlinkSync(PID_FILE);
   } catch {
   }
   try {
-    fs14.unlinkSync(LEGACY_PID_FILE);
+    fs15.unlinkSync(LEGACY_PID_FILE);
   } catch {
   }
 }
@@ -14770,11 +14968,11 @@ async function promptYesNo(question, defaultYes = true) {
   });
 }
 async function cmdBinary(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   const memoryDir = resolveMemoryDir();
   const blConfig = {
     enabled: config.binaryLifecycleEnabled,
@@ -14892,7 +15090,7 @@ Clean complete: cleaned=${result.cleaned}`
 }
 async function cmdOpenclawInstall(opts) {
   const configPath = resolveOpenclawConfigPath(opts.configPath);
-  const fallbackMemoryDir = path17.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
+  const fallbackMemoryDir = path18.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
   console.log(`OpenClaw config: ${configPath}`);
   const existingConfig = readOpenclawConfig(configPath);
   const { plugins, entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
@@ -14963,7 +15161,7 @@ async function cmdOpenclawInstall(opts) {
   } else if (slotIsActiveLegacy) {
     changes.push(`  Slot left as "${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID}" \u2014 re-run with --yes to activate the new entry`);
   }
-  if (!fs14.existsSync(memoryDir)) changes.push(`+ Will create memory directory: ${memoryDir}`);
+  if (!fs15.existsSync(memoryDir)) changes.push(`+ Will create memory directory: ${memoryDir}`);
   if (hasLegacy && migrateLegacy) {
     changes.push(`~ Legacy '${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID}' entry retained (safe to remove after verifying hooks fire)`);
   }
@@ -14983,8 +15181,8 @@ async function cmdOpenclawInstall(opts) {
 Resulting plugins.slots.memory: ${dryRunPlugins.slots?.memory ?? "(unset)"}`);
     return;
   }
-  if (fs14.existsSync(memoryDir)) {
-    const st = fs14.statSync(memoryDir);
+  if (fs15.existsSync(memoryDir)) {
+    const st = fs15.statSync(memoryDir);
     if (!st.isDirectory()) {
       throw new Error(
         `Cannot use ${memoryDir} as the memory directory \u2014 a file already exists at that path.
@@ -14992,12 +15190,12 @@ Remove it first and re-run, or choose a different path with --memory-dir.`
       );
     }
   } else {
-    fs14.mkdirSync(memoryDir, { recursive: true });
+    fs15.mkdirSync(memoryDir, { recursive: true });
     console.log(`Created memory directory: ${memoryDir}`);
   }
-  const configDir = path17.dirname(configPath);
-  if (!fs14.existsSync(configDir)) {
-    fs14.mkdirSync(configDir, { recursive: true });
+  const configDir = path18.dirname(configPath);
+  if (!fs15.existsSync(configDir)) {
+    fs15.mkdirSync(configDir, { recursive: true });
   }
   atomicWriteFileSync(configPath, JSON.stringify(updatedConfig, null, 2) + "\n");
   console.log("\nDone! Summary of changes:");
@@ -15024,12 +15222,12 @@ async function cmdOpenclawUpgrade(opts) {
   const pluginDir = resolveOpenclawPluginDir(opts.pluginDir);
   const managedTargetDir = resolveOpenclawManagedPluginDir();
   const legacyPluginDirForBackup = opts.legacyPluginDirForBackup ? resolveOpenclawLegacyPluginDir(opts.legacyPluginDirForBackup) : void 0;
-  const fallbackMemoryDir = path17.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
+  const fallbackMemoryDir = path18.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
   const packageSpec = buildOpenclawManagedUpgradePackageSpec(opts.version);
-  const configExistedBefore = fs14.existsSync(configPath);
+  const configExistedBefore = fs15.existsSync(configPath);
   const existingConfig = readOpenclawConfig(configPath);
   const { entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
-  const preservedMemoryDir = opts.memoryDir ? path17.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
+  const preservedMemoryDir = opts.memoryDir ? path18.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
   console.log(`OpenClaw config: ${configPath}`);
   console.log(`Plugin dir:      ${pluginDir}`);
   if (legacyPluginDirForBackup) {
@@ -15037,7 +15235,7 @@ async function cmdOpenclawUpgrade(opts) {
   }
   console.log(`Memory dir:      ${preservedMemoryDir}`);
   console.log(`Package spec:    ${packageSpec}`);
-  console.log(`Backup root:     ${path17.join(resolveOpenclawStateDir(), "backups")}`);
+  console.log(`Backup root:     ${path18.join(resolveOpenclawStateDir(), "backups")}`);
   const plannedActions = [
     `backup openclaw.json and the existing ${REMNIC_OPENCLAW_PLUGIN_ID} extension`,
     ...legacyPluginDirForBackup ? [`backup the existing ${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID} extension without modifying it`] : [],
@@ -15075,9 +15273,9 @@ async function cmdOpenclawUpgrade(opts) {
     assertDirectoryPathOrMissing(legacyPluginDirForBackup, "Legacy OpenClaw plugin dir");
   }
   const backupDir = createOpenclawUpgradeBackupDir();
-  const configBackupPath = path17.join(backupDir, "openclaw.json");
-  const pluginBackupDir = path17.join(backupDir, "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
-  const legacyPluginBackupDir = legacyPluginDirForBackup ? path17.join(backupDir, "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID) : void 0;
+  const configBackupPath = path18.join(backupDir, "openclaw.json");
+  const pluginBackupDir = path18.join(backupDir, "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
+  const legacyPluginBackupDir = legacyPluginDirForBackup ? path18.join(backupDir, "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID) : void 0;
   const backupNotes = [];
   if (backupPathIfPresent(configPath, configBackupPath)) {
     backupNotes.push(`+ Backed up config to ${configBackupPath}`);
@@ -15127,7 +15325,7 @@ async function cmdOpenclawUpgrade(opts) {
     const managedRollbackDir = publishedInstallError ? publishedInstallError.managedRollbackDir : installResult?.managedRollbackDir;
     const managedRollbackTargetDir = publishedInstallError?.managedRollbackTargetDir ?? installResult?.managedRollbackTargetDir ?? managedTargetDir;
     const requiresHostManagedRestore = publishedInstallError?.requiresHostManagedRestore ?? installResult?.requiresHostManagedRestore ?? false;
-    const managedRollbackSharesPluginDir = managedRollbackDir && path17.resolve(managedRollbackTargetDir) === path17.resolve(pluginDir);
+    const managedRollbackSharesPluginDir = managedRollbackDir && path18.resolve(managedRollbackTargetDir) === path18.resolve(pluginDir);
     const pluginRollbackDir = managedRollbackSharesPluginDir ? requiresHostManagedRestore ? rollbackDir : rollbackDir ?? managedRollbackDir : rollbackDir;
     const shouldRestorePlugin = Boolean(
       installResult && !requiresHostManagedRestore || pluginRollbackDir || publishedInstallError?.shouldRestoreBackup
@@ -15184,7 +15382,7 @@ async function cmdOpenclawUpgrade(opts) {
       rollbackErrors.push(error);
     }
     if (pendingConfigRestoreError) rollbackErrors.push(pendingConfigRestoreError);
-    if (managedRollbackDir && path17.resolve(managedRollbackTargetDir) !== path17.resolve(pluginDir) && !requiresHostManagedRestore) {
+    if (managedRollbackDir && path18.resolve(managedRollbackTargetDir) !== path18.resolve(pluginDir) && !requiresHostManagedRestore) {
       try {
         rollbackNotes.push(
           ...rollbackOpenclawUpgrade({
@@ -15250,16 +15448,16 @@ async function cmdOpenclawMigrateEngram(opts) {
   console.log("  - Re-apply any local source patches to the new package only after verifying the published build.");
 }
 function createOpenclawUpgradeBackupDir() {
-  const backupsRoot = path17.join(resolveOpenclawStateDir(), "backups");
-  fs14.mkdirSync(backupsRoot, { recursive: true });
-  return fs14.mkdtempSync(path17.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
+  const backupsRoot = path18.join(resolveOpenclawStateDir(), "backups");
+  fs15.mkdirSync(backupsRoot, { recursive: true });
+  return fs15.mkdtempSync(path18.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
 }
 async function cmdTaxonomy(rest) {
-  initLogger2();
+  initLogger3();
   const configPath = resolveConfigPath();
-  const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-  const remnicCfg = resolveRemnicConfigRecord5(raw);
-  const config = parseConfig6(remnicCfg);
+  const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+  const remnicCfg = resolveRemnicConfigRecord6(raw);
+  const config = parseConfig7(remnicCfg);
   if (!config.taxonomyEnabled) {
     console.error(
       "Taxonomy is disabled in config (taxonomyEnabled = false). Enable it to use taxonomy commands."
@@ -15294,9 +15492,9 @@ async function cmdTaxonomy(rest) {
       const doc = generateResolverDocument(taxonomy);
       console.log(doc);
       if (config.taxonomyAutoGenResolver) {
-        const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs14.mkdirSync(path17.dirname(resolverPath), { recursive: true });
-        fs14.writeFileSync(resolverPath, doc);
+        const resolverPath = path18.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs15.mkdirSync(path18.dirname(resolverPath), { recursive: true });
+        fs15.writeFileSync(resolverPath, doc);
         console.error(`Written: ${resolverPath}`);
       }
       break;
@@ -15341,8 +15539,8 @@ async function cmdTaxonomy(rest) {
       console.log(`Added category "${id}" (${name}).`);
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
-        const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs14.writeFileSync(resolverPath, doc);
+        const resolverPath = path18.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs15.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
       break;
@@ -15372,8 +15570,8 @@ async function cmdTaxonomy(rest) {
       console.log(`Removed category "${id}".`);
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
-        const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs14.writeFileSync(resolverPath, doc);
+        const resolverPath = path18.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs15.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
       break;
@@ -15564,12 +15762,12 @@ async function runTrainingExport(args, stdout = process.stdout) {
       `Unknown training-export format "${args.format}". ${validList}`
     );
   }
-  if (!fs14.existsSync(args.memoryDir)) {
+  if (!fs15.existsSync(args.memoryDir)) {
     throw new Error(
       `--memory-dir "${args.memoryDir}" does not exist. Provide the path to an existing memory directory.`
     );
   }
-  if (!fs14.statSync(args.memoryDir).isDirectory()) {
+  if (!fs15.statSync(args.memoryDir).isDirectory()) {
     throw new Error(
       `--memory-dir "${args.memoryDir}" is not a directory. Provide the path to a memory directory, not a file.`
     );
@@ -15654,11 +15852,11 @@ async function runTrainingExport(args, stdout = process.stdout) {
     );
   }
   const formatted = adapter.formatRecords(records);
-  const outDir = path17.dirname(args.output);
-  fs14.mkdirSync(outDir, { recursive: true });
+  const outDir = path18.dirname(args.output);
+  fs15.mkdirSync(outDir, { recursive: true });
   const tmpPath = `${args.output}.tmp-${process.pid}-${Date.now()}`;
-  fs14.writeFileSync(tmpPath, formatted, "utf-8");
-  fs14.renameSync(tmpPath, args.output);
+  fs15.writeFileSync(tmpPath, formatted, "utf-8");
+  fs15.renameSync(tmpPath, args.output);
   stdout.write(
     `Exported ${records.length} records to ${args.output} (${adapter.name} format)
 `
@@ -15707,6 +15905,9 @@ async function main(argv = process.argv.slice(2)) {
     case "xray":
       await cmdXray(rest);
       break;
+    case "security":
+      await cmdSecurity(rest);
+      break;
     case "doctor":
       await cmdDoctor();
       break;
@@ -15762,7 +15963,7 @@ async function main(argv = process.argv.slice(2)) {
     case "tree": {
       const subAction = rest[0];
       const json = rest.includes("--json");
-      const outputDir = resolveFlag(rest, "--output") ?? path17.join(process.cwd(), ".remnic", "context-tree");
+      const outputDir = resolveFlag(rest, "--output") ?? path18.join(process.cwd(), ".remnic", "context-tree");
       const categoriesFlag = resolveFlag(rest, "--categories");
       const categories = categoriesFlag ? categoriesFlag.split(",") : void 0;
       const maxPerCategoryRaw = resolveFlag(rest, "--max-per-category");
@@ -15827,7 +16028,7 @@ async function main(argv = process.argv.slice(2)) {
             }
           }, 500);
         };
-        fs14.watch(memoryDir, { recursive: true }, (_event, filename) => {
+        fs15.watch(memoryDir, { recursive: true }, (_event, filename) => {
           if (filename && filename.startsWith(".")) return;
           rebuild();
         });
@@ -15835,12 +16036,12 @@ async function main(argv = process.argv.slice(2)) {
         });
       } else if (subAction === "validate") {
         const treeDir = outputDir;
-        if (!fs14.existsSync(treeDir)) {
+        if (!fs15.existsSync(treeDir)) {
           console.error(`Context tree not found at ${treeDir}. Run 'remnic tree generate' first.`);
           process.exit(1);
         }
-        const indexPath = path17.join(treeDir, "INDEX.md");
-        if (!fs14.existsSync(indexPath)) {
+        const indexPath = path18.join(treeDir, "INDEX.md");
+        if (!fs15.existsSync(indexPath)) {
           console.error(`INDEX.md missing in ${treeDir}. Tree may be corrupt \u2014 regenerate.`);
           process.exit(1);
         }
@@ -16022,10 +16223,10 @@ Other:
         let wearablesService;
         try {
           const configPath = resolveConfigPath();
-          const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-          const remnicCfg = resolveRemnicConfigRecord5(raw);
-          const config = parseConfig6(remnicCfg);
-          wearablesOrchestrator = new Orchestrator3(config);
+          const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+          const remnicCfg = resolveRemnicConfigRecord6(raw);
+          const config = parseConfig7(remnicCfg);
+          wearablesOrchestrator = new Orchestrator4(config);
           await wearablesOrchestrator.initialize();
           await wearablesOrchestrator.deferredReady;
           wearablesService = wearablesOrchestrator.getWearablesService();
@@ -16077,10 +16278,10 @@ Other:
       const targetFactory = async () => {
         if (!orchestratorSingleton) {
           const configPath = resolveConfigPath();
-          const raw = fs14.existsSync(configPath) ? JSON.parse(fs14.readFileSync(configPath, "utf8")) : {};
-          const remnicCfg = resolveRemnicConfigRecord5(raw);
-          const config = parseConfig6(remnicCfg);
-          orchestratorSingleton = new Orchestrator3(config);
+          const raw = fs15.existsSync(configPath) ? JSON.parse(fs15.readFileSync(configPath, "utf8")) : {};
+          const remnicCfg = resolveRemnicConfigRecord6(raw);
+          const config = parseConfig7(remnicCfg);
+          orchestratorSingleton = new Orchestrator4(config);
           await orchestratorSingleton.initialize();
           await orchestratorSingleton.deferredReady;
         }
@@ -16310,9 +16511,9 @@ Usage:
   remnic extensions <list|show|validate|reload>  Manage memory extensions
   remnic space <list|switch|create|delete|push|pull|share|promote|audit>  Manage spaces
     create accepts --parent <id> to set parent-child relationship
-  remnic bench <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|attribute|drift-gen|coding> [benchmark...] [--quick] [--all] [--dataset-dir <path>] [--results-dir <path>] [--baselines-dir <path>] [--threshold <value>] [--detail] [--format <json|csv|html>] [--output <path>] [--target remnic-ai] [--json]
+  remnic bench <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|attribute|drift-gen|coding|security> [benchmark...] [--quick] [--all] [--dataset-dir <path>] [--results-dir <path>] [--baselines-dir <path>] [--threshold <value>] [--detail] [--format <json|csv|html>] [--output <path>] [--target remnic-ai] [--json]
     benchmark is kept as a compatibility alias. check/report remain under that alias.
-  remnic benchmark <list|run|datasets|runs|compare|results|baseline|export|publish|ui|providers|check|report|attribute|drift-gen|coding> [queries...] [--explain] [--baseline=<path>] [--report=<path>]
+  remnic benchmark <list|run|datasets|runs|compare|results|baseline|export|publish|ui|providers|check|report|attribute|drift-gen|coding|security> [queries...] [--explain] [--baseline=<path>] [--report=<path>]
   remnic briefing [--since <window>] [--focus <filter>] [--save] [--format markdown|json]
     Daily context briefing. Windows: yesterday, today, NNh, NNd, NNw.
     Focus: person:<name>, project:<name>, topic:<name>.