@remnic/cli 9.55.0 → 9.57.0

package/dist/index.js

@@ -20,7 +20,7 @@ async function persistEnrichmentCandidate(storage, entityName, candidate) {
 // src/index.ts
 import fs15 from "fs";
 import os3 from "os";
-import path17 from "path";
+import path18 from "path";
 import { createHash as createHash4 } from "crypto";
 import * as childProcess2 from "child_process";
 import { fileURLToPath as fileURLToPath5 } from "url";
@@ -6504,8 +6504,158 @@ async function cmdBenchCoding(args) {
   if (result.exitCode !== 0) process.exitCode = result.exitCode;
 }
 
-// src/bench-research-commands.ts
+// src/bench-security-commands.ts
 import path16 from "path";
+var DEFAULT_OUTPUT_DIR = path16.join(
+  resolveHomeDir(),
+  ".remnic",
+  "bench",
+  "results",
+  "h5-injection-suite"
+);
+var BENCH_SECURITY_USAGE = `Usage: remnic bench security injection-suite --seeds N [options]
+
+H5 injection-suite runner. Resume, host-fault pause, multi-host claim
+leases, and --limit follow the H6 contract (issue #1963 / PR #2312).
+
+Options:
+  --seeds N                 Positive seed count (required)
+  --variants-per-family N   Variants per attack family (default: 25)
+  --model-profile ID        Profile label recorded on each row (default: local-dry)
+  --executor local|ollama|openai-compat
+                            local = deterministic screen/fence (default)
+                            ollama = native /api/chat
+                            openai-compat = /v1/chat/completions
+  --base-url URL            Endpoint (default: http://127.0.0.1:11434)
+  --model NAME              Model id (default: qwen3.8-27b-64k:latest)
+  --request-timeout-ms N    Per-call timeout (default: 300000)
+  --out DIR                 New run directory (default: ~/.remnic/bench/results/h5-injection-suite)
+  --run DIR                 Existing run directory; implies --resume
+  --resume                  Continue an existing run (required if DIR already has run.json)
+  --limit N                 Execute at most N planned rows (dry-run / smoke)
+`;
+function parsePositiveInteger(raw, flag) {
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 1) {
+    throw new Error(`${flag} must be a positive integer`);
+  }
+  return value;
+}
+function parseBenchSecurityArgs(args) {
+  if (args.length === 0 || args[0] === "--help" || args[0] === "-h") return { help: true };
+  if (args[0] !== "injection-suite") {
+    throw new Error(`unknown bench security subcommand ${args[0]}`);
+  }
+  let seeds;
+  let variantsPerFamily = 25;
+  let modelProfileId = "local-dry";
+  let outputDir = DEFAULT_OUTPUT_DIR;
+  let resume = false;
+  let limit;
+  let executor = "local";
+  let baseUrl;
+  let model;
+  let requestTimeoutMs;
+  for (let index = 1; index < args.length; index += 1) {
+    const flag = args[index] ?? "";
+    const next = args[index + 1];
+    if (flag === "--seeds") {
+      seeds = parsePositiveInteger(next, "--seeds");
+      index += 1;
+    } else if (flag === "--variants-per-family") {
+      variantsPerFamily = parsePositiveInteger(next, "--variants-per-family");
+      index += 1;
+    } else if (flag === "--model-profile") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --model-profile");
+      modelProfileId = next;
+      index += 1;
+    } else if (flag === "--executor") {
+      if (next !== "local" && next !== "ollama" && next !== "openai-compat") {
+        throw new Error("--executor must be local, ollama, or openai-compat");
+      }
+      executor = next;
+      index += 1;
+    } else if (flag === "--base-url") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --base-url");
+      baseUrl = next;
+      index += 1;
+    } else if (flag === "--model") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --model");
+      model = next;
+      index += 1;
+    } else if (flag === "--request-timeout-ms") {
+      requestTimeoutMs = parsePositiveInteger(next, "--request-timeout-ms");
+      index += 1;
+    } else if (flag === "--out") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --out");
+      outputDir = expandTilde(next);
+      index += 1;
+    } else if (flag === "--run") {
+      if (next === void 0 || next.startsWith("-")) throw new Error("missing value for --run");
+      outputDir = expandTilde(next);
+      resume = true;
+      index += 1;
+    } else if (flag === "--resume") {
+      resume = true;
+    } else if (flag === "--limit") {
+      limit = parsePositiveInteger(next, "--limit");
+      index += 1;
+    } else {
+      throw new Error(`unknown option ${flag}`);
+    }
+  }
+  if (seeds === void 0) throw new Error("injection-suite requires --seeds N");
+  return {
+    seeds,
+    variantsPerFamily,
+    modelProfileId,
+    outputDir,
+    resume,
+    executor,
+    ...limit === void 0 ? {} : { limit },
+    ...baseUrl === void 0 ? {} : { baseUrl },
+    ...model === void 0 ? {} : { model },
+    ...requestTimeoutMs === void 0 ? {} : { requestTimeoutMs }
+  };
+}
+async function cmdBenchSecurity(args) {
+  try {
+    const parsed = parseBenchSecurityArgs(args);
+    if ("help" in parsed) {
+      console.log(BENCH_SECURITY_USAGE);
+      return;
+    }
+    const bench = await loadBenchModule();
+    const run = bench.runInjectionSuiteCliCommand;
+    if (typeof run !== "function") {
+      throw new Error("Installed @remnic/bench is missing runInjectionSuiteCliCommand");
+    }
+    const result = await run({
+      seeds: parsed.seeds,
+      variantsPerFamily: parsed.variantsPerFamily,
+      modelProfileId: parsed.modelProfileId,
+      outputDir: parsed.outputDir,
+      executor: parsed.executor,
+      ...parsed.resume ? { resume: true } : {},
+      ...parsed.limit === void 0 ? {} : { limit: parsed.limit },
+      ...parsed.baseUrl === void 0 ? {} : { baseUrl: parsed.baseUrl },
+      ...parsed.model === void 0 ? {} : { model: parsed.model },
+      ...parsed.requestTimeoutMs === void 0 ? {} : { requestTimeoutMs: parsed.requestTimeoutMs }
+    });
+    if (result.exitCode === 0) console.log(result.output);
+    else console.error(result.output);
+    if (result.exitCode !== 0) process.exitCode = result.exitCode;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`${message}
+
+${BENCH_SECURITY_USAGE}`);
+    process.exitCode = 1;
+  }
+}
+
+// src/bench-research-commands.ts
+import path17 from "path";
 function emit(result) {
   if (result.output) {
     console.log(result.output);
@@ -6523,7 +6673,7 @@ async function runBenchResearchCommand(parsed) {
     emit(
       await runAttributeCliCommand({
         runRef: parsed.runRef,
-        resultsDir: parsed.resultsDir ?? path16.join(resolveHomeDir(), ".remnic", "bench", "results"),
+        resultsDir: parsed.resultsDir ?? path17.join(resolveHomeDir(), ".remnic", "bench", "results"),
         memoryDir: parsed.memoryDir,
         qmdPath: parsed.qmdPath,
         collection: parsed.collection,
@@ -6552,8 +6702,8 @@ async function runBenchResearchCommand(parsed) {
 
 // src/bench-usage.ts
 function getBenchUsageText() {
-  return `Usage: remnic bench <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|attribute|drift-gen|coding> [options] [benchmark...]
-       remnic benchmark <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|check|report|attribute|drift-gen|coding> [options] [benchmark...]
+  return `Usage: remnic bench <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|attribute|drift-gen|coding|security> [options] [benchmark...]
+       remnic benchmark <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|check|report|attribute|drift-gen|coding|security> [options] [benchmark...]
 
 Commands:
   list                     List published benchmark packs
@@ -6591,6 +6741,8 @@ Commands:
   coding                   H6 synthetic coding benchmark commands
                            Run \`remnic bench coding --help\` for repo generation,
                            repeated-failure runs, resume, and offline stats replay
+  security                 H5 injection-suite runner (resume/pause/--limit)
+                           Run \`remnic bench security --help\`
   check                    Legacy latency regression gate (compatibility)
   attribute --run <id> [--results-dir <path>] [--memory-dir <path>] [--threshold <value>]
                            [--qmd <path> --collection <name>]
@@ -6793,15 +6945,15 @@ registerPublisher("omp", () => new LazyPluginPiPublisher("omp", (mod) => mod.Omp
 function readCompatEnv(primary, legacy) {
   return process.env[primary] ?? process.env[legacy];
 }
-var PID_DIR = path17.join(resolveHomeDir(), ".remnic");
-var LEGACY_PID_DIR = path17.join(resolveHomeDir(), ".engram");
-var PID_FILE = path17.join(PID_DIR, "server.pid");
-var LEGACY_PID_FILE = path17.join(LEGACY_PID_DIR, "server.pid");
-var LOG_FILE = path17.join(PID_DIR, "server.log");
-var LEGACY_LOG_FILE = path17.join(LEGACY_PID_DIR, "server.log");
-var CLI_MODULE_DIR = path17.dirname(fileURLToPath5(import.meta.url));
-var CLI_REPO_ROOT = path17.resolve(CLI_MODULE_DIR, "../../..");
-var EVAL_RUNNER_PATH = path17.join(CLI_REPO_ROOT, "evals", "run.ts");
+var PID_DIR = path18.join(resolveHomeDir(), ".remnic");
+var LEGACY_PID_DIR = path18.join(resolveHomeDir(), ".engram");
+var PID_FILE = path18.join(PID_DIR, "server.pid");
+var LEGACY_PID_FILE = path18.join(LEGACY_PID_DIR, "server.pid");
+var LOG_FILE = path18.join(PID_DIR, "server.log");
+var LEGACY_LOG_FILE = path18.join(LEGACY_PID_DIR, "server.log");
+var CLI_MODULE_DIR = path18.dirname(fileURLToPath5(import.meta.url));
+var CLI_REPO_ROOT = path18.resolve(CLI_MODULE_DIR, "../../..");
+var EVAL_RUNNER_PATH = path18.join(CLI_REPO_ROOT, "evals", "run.ts");
 var OPENCLAW_GATEWAY_LABEL = "ai.openclaw.gateway";
 var CLI_SUCCESS_EXIT_GRACE_MS = 5e3;
 var CLI_OUTPUT_FLUSH_GRACE_MS = 250;
@@ -7021,8 +7173,8 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
     process.exit(1);
   }
   const tsxCandidates = [
-    path17.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
-    path17.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
+    path18.join(CLI_REPO_ROOT, "node_modules", ".bin", "tsx"),
+    path18.join(CLI_REPO_ROOT, "packages", "remnic-cli", "node_modules", ".bin", "tsx")
   ];
   const tsxCmd = tsxCandidates.find((candidate) => fs15.existsSync(candidate)) ?? "tsx";
   const fallbackOutputDir = createFallbackBenchOutputDir(
@@ -7041,7 +7193,7 @@ async function runBenchViaFallback(parsed, benchmarkId, runtimeProfile) {
   return resolveFallbackBenchResultPath(fallbackOutputDir);
 }
 function resolveBenchOutputDir() {
-  return path17.join(resolveHomeDir(), ".remnic", "bench", "results");
+  return path18.join(resolveHomeDir(), ".remnic", "bench", "results");
 }
 var DOWNLOADABLE_BENCHMARK_DATASETS = [
   "ama-bench",
@@ -7086,8 +7238,8 @@ var MEMORY_AGENT_BENCH_SPLIT_FILENAMES = [
 ];
 var MEMORY_AGENT_BENCH_ENTITY_MAPPING_CANDIDATES = [
   "entity2id.json",
-  path17.join("processed_data", "Recsys_Redial", "entity2id.json"),
-  path17.join("Recsys_Redial", "entity2id.json")
+  path18.join("processed_data", "Recsys_Redial", "entity2id.json"),
+  path18.join("Recsys_Redial", "entity2id.json")
 ];
 var DOWNLOADED_DATASET_MARKERS = {
   "ama-bench": { anyOf: ["open_end_qa_set.jsonl"] },
@@ -7162,7 +7314,7 @@ var PERSONAMEM_DATASET_FILE_CANDIDATES = [
   "benchmark/benchmark.csv",
   "benchmark.csv"
 ];
-var PERSONAMEM_COMPLETION_MARKER = path17.join(
+var PERSONAMEM_COMPLETION_MARKER = path18.join(
   "data",
   "chat_history_32k",
   ".download-complete"
@@ -7170,10 +7322,10 @@ var PERSONAMEM_COMPLETION_MARKER = path17.join(
 function resolveRealpathWithinDataset(datasetPath, relativePath) {
   try {
     const datasetRoot = fs15.realpathSync(datasetPath);
-    const candidatePath = path17.resolve(datasetRoot, relativePath);
+    const candidatePath = path18.resolve(datasetRoot, relativePath);
     const candidateRealPath = fs15.realpathSync(candidatePath);
-    const relativeToRoot = path17.relative(datasetRoot, candidateRealPath);
-    if (relativeToRoot.startsWith("..") || path17.isAbsolute(relativeToRoot)) {
+    const relativeToRoot = path18.relative(datasetRoot, candidateRealPath);
+    if (relativeToRoot.startsWith("..") || path18.isAbsolute(relativeToRoot)) {
       return null;
     }
     return candidateRealPath;
@@ -7229,7 +7381,7 @@ function parseCsvRows(raw) {
 }
 function isPersonaMemDatasetComplete(datasetPath) {
   try {
-    const completionMarkerPath = path17.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
+    const completionMarkerPath = path18.join(datasetPath, PERSONAMEM_COMPLETION_MARKER);
     if (fs15.statSync(completionMarkerPath).isFile()) {
       return true;
     }
@@ -7237,7 +7389,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
   }
   const datasetFile = PERSONAMEM_DATASET_FILE_CANDIDATES.find((candidate) => {
     try {
-      return fs15.statSync(path17.join(datasetPath, candidate)).isFile();
+      return fs15.statSync(path18.join(datasetPath, candidate)).isFile();
     } catch {
       return false;
     }
@@ -7246,7 +7398,7 @@ function isPersonaMemDatasetComplete(datasetPath) {
     return false;
   }
   try {
-    const rows = parseCsvRows(fs15.readFileSync(path17.join(datasetPath, datasetFile), "utf8"));
+    const rows = parseCsvRows(fs15.readFileSync(path18.join(datasetPath, datasetFile), "utf8"));
     if (rows.length < 2) {
       return false;
     }
@@ -7269,14 +7421,14 @@ function isPersonaMemDatasetComplete(datasetPath) {
 }
 function hasDatasetFile(datasetPath, relativePath) {
   try {
-    return fs15.statSync(path17.join(datasetPath, relativePath)).isFile();
+    return fs15.statSync(path18.join(datasetPath, relativePath)).isFile();
   } catch {
     return false;
   }
 }
 function hasMemoryAgentBenchEntityMapping(datasetPath) {
-  const absoluteDatasetPath = path17.resolve(datasetPath);
-  const roots = [absoluteDatasetPath, path17.dirname(absoluteDatasetPath)];
+  const absoluteDatasetPath = path18.resolve(datasetPath);
+  const roots = [absoluteDatasetPath, path18.dirname(absoluteDatasetPath)];
   return hasDatasetFile(absoluteDatasetPath, "entity2id.json") || roots.some(
     (root) => MEMORY_AGENT_BENCH_ENTITY_MAPPING_CANDIDATES.filter((relativePath) => relativePath !== "entity2id.json").some((relativePath) => hasDatasetFile(root, relativePath))
   );
@@ -7287,7 +7439,7 @@ function memoryAgentBenchDatasetHasRecSysSamples(datasetPath) {
     ...MEMORY_AGENT_BENCH_SPLIT_FILENAMES
   ];
   return candidateFilenames.some((filename) => {
-    const filePath = path17.join(datasetPath, filename);
+    const filePath = path18.join(datasetPath, filename);
     try {
       if (!fs15.statSync(filePath).isFile()) {
         return false;
@@ -7326,7 +7478,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.allOf) {
     const hasAllRequiredFiles = marker.allOf.every((name) => {
       try {
-        return fs15.statSync(path17.join(datasetPath, name)).isFile();
+        return fs15.statSync(path18.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -7338,7 +7490,7 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   if (marker.anyOf) {
     const hasMarkerFile = marker.anyOf.some((name) => {
       try {
-        return fs15.statSync(path17.join(datasetPath, name)).isFile();
+        return fs15.statSync(path18.join(datasetPath, name)).isFile();
       } catch {
         return false;
       }
@@ -7366,9 +7518,9 @@ function isDatasetDownloaded(datasetPath, benchmarkId) {
   return false;
 }
 async function launchBenchUi(resultsDir) {
-  const benchUiDir = path17.join(CLI_REPO_ROOT, "packages", "bench-ui");
+  const benchUiDir = path18.join(CLI_REPO_ROOT, "packages", "bench-ui");
   const pnpmCmd = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
-  if (!fs15.existsSync(path17.join(benchUiDir, "package.json"))) {
+  if (!fs15.existsSync(path18.join(benchUiDir, "package.json"))) {
     console.error("ERROR: @remnic/bench-ui is not available in this checkout.");
     process.exit(1);
   }
@@ -7395,24 +7547,24 @@ async function launchBenchUi(resultsDir) {
   });
 }
 function resolveRepoDatasetRoot() {
-  const repoCandidate = path17.join(CLI_REPO_ROOT, "evals", "datasets");
+  const repoCandidate = path18.join(CLI_REPO_ROOT, "evals", "datasets");
   if (isRepoCheckout()) {
     return repoCandidate;
   }
-  return path17.join(resolveHomeDir(), ".remnic", "bench", "datasets");
+  return path18.join(resolveHomeDir(), ".remnic", "bench", "datasets");
 }
 function listDownloadableBenchmarks() {
   return [...DOWNLOADABLE_BENCHMARK_DATASETS];
 }
 function resolveDatasetDownloadScriptPath() {
-  const bundled = path17.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
+  const bundled = path18.join(CLI_MODULE_DIR, "assets", "download-datasets.sh");
   if (fs15.existsSync(bundled)) {
     return bundled;
   }
-  return path17.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
+  return path18.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh");
 }
 function isRepoCheckout() {
-  return fs15.existsSync(path17.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs15.existsSync(path17.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
+  return fs15.existsSync(path18.join(CLI_REPO_ROOT, "pnpm-workspace.yaml")) && fs15.existsSync(path18.join(CLI_REPO_ROOT, "evals", "scripts", "download-datasets.sh"));
 }
 function runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, jsonMode) {
   const stdio = jsonMode ? ["inherit", process.stderr, "inherit"] : "inherit";
@@ -7463,7 +7615,7 @@ function resolveBenchDatasetDir(benchmarkId, quick, datasetDirOverride) {
   if (quick) {
     return void 0;
   }
-  const datasetDir = path17.join(resolveRepoDatasetRoot(), benchmarkId);
+  const datasetDir = path18.join(resolveRepoDatasetRoot(), benchmarkId);
   if (isDatasetDownloaded(datasetDir, benchmarkId)) {
     return datasetDir;
   }
@@ -7720,12 +7872,12 @@ async function exportBenchPackageResult(parsed) {
     process.exit(1);
   }
   const result = await loadBenchmarkResult(summary.path);
-  const reportCardProvenance = parsed.format === "html" ? await loadBenchmarkReportCardProvenance(path17.dirname(summary.path), result.meta.id) : void 0;
+  const reportCardProvenance = parsed.format === "html" ? await loadBenchmarkReportCardProvenance(path18.dirname(summary.path), result.meta.id) : void 0;
   const rendered = renderBenchmarkResultExport(result, parsed.format, {
     ...reportCardProvenance ? { reportCardProvenance } : {}
   });
   if (parsed.output) {
-    fs15.mkdirSync(path17.dirname(parsed.output), { recursive: true });
+    fs15.mkdirSync(path18.dirname(parsed.output), { recursive: true });
     fs15.writeFileSync(parsed.output, rendered);
     console.log(`Exported ${summary.id} as ${parsed.format} to ${parsed.output}`);
     return;
@@ -7743,7 +7895,7 @@ async function manageBenchDatasets(parsed) {
       process.exit(1);
     }
     const status = supported.map((benchmarkId) => {
-      const datasetPath = path17.join(datasetRoot, benchmarkId);
+      const datasetPath = path18.join(datasetRoot, benchmarkId);
       return {
         benchmark: benchmarkId,
         downloaded: isDatasetDownloaded(datasetPath, benchmarkId),
@@ -7781,7 +7933,7 @@ async function manageBenchDatasets(parsed) {
     runDatasetDownloadScript(scriptPath, benchmarkId, datasetRoot, parsed.json === true);
     downloaded.push({
       benchmark: benchmarkId,
-      path: path17.join(datasetRoot, benchmarkId)
+      path: path18.join(datasetRoot, benchmarkId)
     });
   }
   if (parsed.json) {
@@ -7920,10 +8072,10 @@ async function calibrateBenchJudges(parsed, rawArgs) {
   }
   const bench = await loadBenchModule();
   const resultsDir = expandTilde(
-    parsed.resultsDir ?? path17.join(resolveHomeDir(), ".remnic", "bench", "results")
+    parsed.resultsDir ?? path18.join(resolveHomeDir(), ".remnic", "bench", "results")
   );
   const calibrationDir = expandTilde(
-    parsed.calibrationDir ?? path17.join(resolveHomeDir(), ".remnic", "bench", "calibration")
+    parsed.calibrationDir ?? path18.join(resolveHomeDir(), ".remnic", "bench", "calibration")
   );
   const stored = await bench.listBenchmarkResults(resultsDir);
   const allForBenchmark = stored.filter((entry) => entry.benchmark === benchmarkId);
@@ -8483,7 +8635,7 @@ async function loadPublishedPromotionHelpers() {
   return {
     async promoteArtifactsToPublished(args) {
       const { mkdirSync, readFileSync: readFileSync4, writeFileSync } = await import("fs");
-      const path18 = await import("path");
+      const path19 = await import("path");
       mkdirSync(args.publishedOutDir, { recursive: true });
       if (args.artifactPaths.length === 0) {
         console.warn(
@@ -8500,13 +8652,13 @@ async function loadPublishedPromotionHelpers() {
         const modelSlug = args.model.replace(/[^a-zA-Z0-9_.-]/g, "-");
         const rawProfile = parsedObj.config?.runtimeProfile;
         const profileSlug = typeof rawProfile === "string" && rawProfile.length > 0 ? `-${rawProfile.replace(/[^a-zA-Z0-9_.-]/g, "-")}` : "";
-        const target = path18.join(
+        const target = path19.join(
           args.publishedOutDir,
           `${today}-${args.benchmarkId}-${modelSlug}${profileSlug}-${gitShaShort}.json`
         );
         writeFileSync(target, raw, "utf8");
         console.log(
-          `[bench published] Promoted ${path18.basename(artifactPath)} \u2192 ${target}`
+          `[bench published] Promoted ${path19.basename(artifactPath)} \u2192 ${target}`
         );
       }
       void benchModule;
@@ -8613,7 +8765,7 @@ async function runBenchViaPackage(parsed, benchmarkId, runtimeProfile, benchStat
   const previousCodexDiagnosticsDir = process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV];
   const previousCodexDiagnosticsMode = process.env[CODEX_CLI_BENCH_DIAGNOSTICS_MODE_ENV];
   if (!previousCodexDiagnosticsDir) {
-    process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV] = path17.join(
+    process.env[CODEX_CLI_BENCH_DIAGNOSTICS_DIR_ENV] = path18.join(
       outputDir,
       "codex-cli-diagnostics"
     );
@@ -8763,7 +8915,7 @@ async function preparePersistedJudgeCalibrationAttachment(benchModule, benchmark
     );
   }
   const calibrationDir = expandTilde(
-    calibrationBinding.calibrationDir ?? path17.join(resolveHomeDir(), ".remnic", "bench", "calibration")
+    calibrationBinding.calibrationDir ?? path18.join(resolveHomeDir(), ".remnic", "bench", "calibration")
   );
   const state = await benchModule.loadJudgeCalibrationState?.(benchmarkId, calibrationDir);
   if (!state) {
@@ -9134,19 +9286,19 @@ function loadConvergeCommandConfig() {
   return loadStandaloneConvergeCommandConfig();
 }
 function resolveConfigPath(cliPath) {
-  if (cliPath) return path17.resolve(expandTilde(cliPath));
+  if (cliPath) return path18.resolve(expandTilde(cliPath));
   const envPath = readCompatEnv("REMNIC_CONFIG_PATH", "ENGRAM_CONFIG_PATH");
-  if (envPath) return path17.resolve(expandTilde(envPath));
+  if (envPath) return path18.resolve(expandTilde(envPath));
   const candidates = [
-    path17.join(process.cwd(), "remnic.config.json"),
-    path17.join(process.cwd(), "engram.config.json"),
-    path17.join(resolveHomeDir(), ".config", "remnic", "config.json"),
-    path17.join(resolveHomeDir(), ".config", "engram", "config.json")
+    path18.join(process.cwd(), "remnic.config.json"),
+    path18.join(process.cwd(), "engram.config.json"),
+    path18.join(resolveHomeDir(), ".config", "remnic", "config.json"),
+    path18.join(resolveHomeDir(), ".config", "engram", "config.json")
   ];
   for (const candidate of candidates) {
     if (fs15.existsSync(candidate)) return candidate;
   }
-  return path17.join(resolveHomeDir(), ".config", "remnic", "config.json");
+  return path18.join(resolveHomeDir(), ".config", "remnic", "config.json");
 }
 function resolveExistingBenchRemnicConfigPath(cliPath) {
   const configPath = resolveConfigPath(cliPath);
@@ -9260,7 +9412,7 @@ async function resolvePackageBenchRuntime(benchModule, parsed, runtimeProfile) {
   );
 }
 function normalizeMemoryDirPath(memoryDir) {
-  return path17.resolve(expandTilde(memoryDir));
+  return path18.resolve(expandTilde(memoryDir));
 }
 function resolveMemoryDir() {
   const configMemoryDir = (() => {
@@ -9273,9 +9425,9 @@ function resolveMemoryDir() {
       return normalizeMemoryDirPath(remnicCfg.memoryDir);
     }
     const home = resolveHomeDir();
-    const standalonePath = path17.join(home, ".remnic", "memory");
-    const legacyStandalonePath = path17.join(home, ".engram", "memory");
-    const openclawPath = path17.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
+    const standalonePath = path18.join(home, ".remnic", "memory");
+    const legacyStandalonePath = path18.join(home, ".engram", "memory");
+    const openclawPath = path18.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
     if (fs15.existsSync(standalonePath)) return standalonePath;
     if (fs15.existsSync(legacyStandalonePath)) return legacyStandalonePath;
     return openclawPath;
@@ -9324,21 +9476,21 @@ function resolveFlagStrict(args, flag) {
 var REMNIC_OPENCLAW_LEGACY_PLUGIN_ID = "openclaw-engram";
 function resolveOpenclawStateDir() {
   const configuredStateDir = process.env.OPENCLAW_STATE_DIR?.trim();
-  return configuredStateDir ? path17.resolve(expandTilde(configuredStateDir)) : path17.join(resolveHomeDir(), ".openclaw");
+  return configuredStateDir ? path18.resolve(expandTilde(configuredStateDir)) : path18.join(resolveHomeDir(), ".openclaw");
 }
 var DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR = [
   process.env.OPENCLAW_CONFIG_PATH,
   process.env.OPENCLAW_ENGRAM_CONFIG_PATH,
-  path17.join(resolveOpenclawStateDir(), "openclaw.json")
+  path18.join(resolveOpenclawStateDir(), "openclaw.json")
 ].filter(Boolean);
 function resolveOpenclawConfigPath(cliPath) {
-  if (cliPath) return path17.resolve(expandTilde(cliPath));
+  if (cliPath) return path18.resolve(expandTilde(cliPath));
   const envPath = process.env.OPENCLAW_CONFIG_PATH || process.env.OPENCLAW_ENGRAM_CONFIG_PATH;
-  if (envPath) return path17.resolve(expandTilde(envPath));
+  if (envPath) return path18.resolve(expandTilde(envPath));
   for (const candidate of DEFAULT_OPENCLAW_CONFIG_PATHS_FOR_DOCTOR) {
     if (fs15.existsSync(candidate)) return candidate;
   }
-  return path17.join(resolveOpenclawStateDir(), "openclaw.json");
+  return path18.join(resolveOpenclawStateDir(), "openclaw.json");
 }
 function readOpenclawConfig(configPath) {
   if (!fs15.existsSync(configPath)) return {};
@@ -9397,10 +9549,10 @@ function buildRemnicOpenclawHooksPolicy(legacyHooks, existingHooks) {
 function resolveOpenclawInstallMemoryDir(args) {
   const existingMemoryDir = (typeof args.existingNewEntryConfig.memoryDir === "string" ? args.existingNewEntryConfig.memoryDir : void 0) || (args.migrateLegacy && typeof args.legacyConfigToMerge.memoryDir === "string" ? args.legacyConfigToMerge.memoryDir : void 0);
   if (args.requestedMemoryDir) {
-    return path17.resolve(expandTilde(args.requestedMemoryDir));
+    return path18.resolve(expandTilde(args.requestedMemoryDir));
   }
   if (existingMemoryDir) {
-    return path17.resolve(expandTilde(existingMemoryDir));
+    return path18.resolve(expandTilde(existingMemoryDir));
   }
   return args.fallbackMemoryDir;
 }
@@ -9418,21 +9570,21 @@ function resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir) {
     if (!config || typeof config !== "object" || Array.isArray(config)) continue;
     const memoryDir = config.memoryDir;
     if (typeof memoryDir === "string" && memoryDir.trim().length > 0) {
-      return path17.resolve(expandTilde(memoryDir));
+      return path18.resolve(expandTilde(memoryDir));
     }
   }
   return fallbackMemoryDir;
 }
 function resolveOpenclawPluginDir(cliPath) {
-  if (cliPath) return path17.resolve(expandTilde(cliPath));
+  if (cliPath) return path18.resolve(expandTilde(cliPath));
   return resolveOpenclawManagedPluginDir();
 }
 function resolveOpenclawManagedPluginDir() {
-  return path17.join(resolveOpenclawStateDir(), "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
+  return path18.join(resolveOpenclawStateDir(), "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
 }
 function resolveOpenclawLegacyPluginDir(cliPath) {
-  if (cliPath) return path17.resolve(expandTilde(cliPath));
-  return path17.join(resolveOpenclawStateDir(), "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID);
+  if (cliPath) return path18.resolve(expandTilde(cliPath));
+  return path18.join(resolveOpenclawStateDir(), "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID);
 }
 function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
   const yyyy = now.getFullYear().toString();
@@ -9445,7 +9597,7 @@ function formatOpenclawUpgradeStamp(now = /* @__PURE__ */ new Date()) {
 }
 function backupPathIfPresent(sourcePath, backupPath) {
   if (!fs15.existsSync(sourcePath)) return false;
-  fs15.mkdirSync(path17.dirname(backupPath), { recursive: true });
+  fs15.mkdirSync(path18.dirname(backupPath), { recursive: true });
   fs15.cpSync(sourcePath, backupPath, { recursive: true });
   return true;
 }
@@ -9464,7 +9616,7 @@ function restartOpenclawGateway() {
   });
 }
 function cmdInit() {
-  const configPath = path17.join(process.cwd(), "remnic.config.json");
+  const configPath = path18.join(process.cwd(), "remnic.config.json");
   if (fs15.existsSync(configPath)) {
     console.log(`Config already exists: ${configPath}`);
     return;
@@ -9472,7 +9624,7 @@ function cmdInit() {
   const template = {
     remnic: {
       openaiApiKey: "${OPENAI_API_KEY}",
-      memoryDir: path17.join(process.cwd(), ".remnic", "memory"),
+      memoryDir: path18.join(process.cwd(), ".remnic", "memory"),
       memoryOsPreset: "balanced"
     },
     server: {
@@ -9609,7 +9761,7 @@ function oauthResolveOperatorToken() {
   }
   return void 0;
 }
-async function oauthFetch(method, path18, token, body) {
+async function oauthFetch(method, path19, token, body) {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), 5e3);
   try {
@@ -9628,7 +9780,7 @@ async function oauthFetch(method, path18, token, body) {
     if (body !== void 0) {
       init.body = JSON.stringify(body);
     }
-    const response = await fetch(`${oauthResolveBaseUrl()}${path18}`, init);
+    const response = await fetch(`${oauthResolveBaseUrl()}${path19}`, init);
     if (response.status === 401) {
       throw new Error(
         "operator token rejected by remnic-server (HTTP 401). Update `server.authToken` or `REMNIC_AUTH_TOKEN` to match the running daemon."
@@ -10183,7 +10335,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions list <page-path>");
         process.exit(1);
       }
-      const absPath = path17.resolve(pagePath);
+      const absPath = path18.resolve(pagePath);
       const history = await listVersions(absPath, versioningConfig, memDir);
       if (json) {
         console.log(JSON.stringify(history, null, 2));
@@ -10208,7 +10360,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions show <page-path> <version-id>");
         process.exit(1);
       }
-      const absPath = path17.resolve(pagePath);
+      const absPath = path18.resolve(pagePath);
       try {
         const content = await getVersion(absPath, versionId, versioningConfig, memDir);
         console.log(content);
@@ -10226,7 +10378,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions diff <page-path> <v1> <v2>");
         process.exit(1);
       }
-      const absPath = path17.resolve(pagePath);
+      const absPath = path18.resolve(pagePath);
       try {
         const diffOutput = await diffVersions(absPath, v1, v2, versioningConfig, memDir);
         console.log(diffOutput);
@@ -10243,7 +10395,7 @@ async function cmdVersions(rest) {
         console.error("Usage: remnic versions revert <page-path> <version-id>");
         process.exit(1);
       }
-      const absPath = path17.resolve(pagePath);
+      const absPath = path18.resolve(pagePath);
       try {
         const version = await revertToVersion(absPath, versionId, versioningConfig, void 0, memDir);
         if (json) {
@@ -10283,7 +10435,7 @@ async function cmdEnrich(rest) {
   const subcommand = rest[0];
   if (subcommand === "audit") {
     const memoryDir2 = expandTilde(config.memoryDir);
-    const auditDir2 = path17.join(memoryDir2, "enrichment");
+    const auditDir2 = path18.join(memoryDir2, "enrichment");
     const sinceFlag = resolveFlag(rest.slice(1), "--since");
     const entries = await readAuditLog(auditDir2, sinceFlag ?? void 0);
     if (entries.length === 0) {
@@ -10408,7 +10560,7 @@ Registered providers:`);
     return;
   }
   const memoryDir = expandTilde(config.memoryDir);
-  const auditDir = path17.join(memoryDir, "enrichment");
+  const auditDir = path18.join(memoryDir, "enrichment");
   let totalPersisted = 0;
   for (const result of results) {
     for (const candidate of result.acceptedCandidates) {
@@ -10599,7 +10751,7 @@ Root: ${root}`);
       const validNames = new Set(extensions.map((e) => e.name));
       let errors = 0;
       for (const entry of entries) {
-        const entryPath = path17.join(root, entry);
+        const entryPath = path18.join(root, entry);
         try {
           if (!fs15.statSync(entryPath).isDirectory()) continue;
         } catch {
@@ -10715,7 +10867,7 @@ async function cmdBriefing(rest) {
       const saveDir = resolveBriefingSaveDir(config.briefing.saveDir);
       fs15.mkdirSync(saveDir, { recursive: true });
       const filename = briefingFilename(new Date(result.window.to), format);
-      const filePath = path17.join(saveDir, filename);
+      const filePath = path18.join(saveDir, filename);
       fs15.writeFileSync(filePath, payload + (payload.endsWith("\n") ? "" : "\n"));
       console.error(`Saved briefing: ${filePath}`);
     } catch (err) {
@@ -10871,7 +11023,7 @@ async function cmdDoctor() {
       const rawMemoryDir = entryConfig?.memoryDir;
       const configuredMemoryDir = typeof rawMemoryDir === "string" ? rawMemoryDir : void 0;
       if (configuredMemoryDir) {
-        const resolvedMemDir = path17.resolve(expandTilde(configuredMemoryDir));
+        const resolvedMemDir = path18.resolve(expandTilde(configuredMemoryDir));
         let memDirOk = false;
         let memDirDetail = `${resolvedMemDir} (not found)`;
         let memDirRemediation = `Run \`remnic openclaw install --memory-dir "${resolvedMemDir}"\` to create the directory.`;
@@ -11071,7 +11223,7 @@ async function cmdMigrate(json, rollback) {
   console.log(`  Rollback: ${result.rollbackCommand}`);
 }
 function cmdOnboard(dirPath, json) {
-  const directory = path17.resolve(dirPath || process.cwd());
+  const directory = path18.resolve(dirPath || process.cwd());
   const result = onboard({ directory });
   if (json) {
     console.log(JSON.stringify(result, null, 2));
@@ -11090,7 +11242,7 @@ Suggested namespace: ${result.plan.suggestedNamespace}`);
 async function cmdCurate(targetPath, json) {
   const memoryDir = resolveMemoryDir();
   const result = await curate({
-    targetPath: path17.resolve(targetPath),
+    targetPath: path18.resolve(targetPath),
     memoryDir,
     source: "curation",
     checkDuplicates: true,
@@ -11220,7 +11372,7 @@ async function cmdSync(action, rest, json) {
 }
 function localOfflineSourceId(memoryDir) {
   const host = os3.hostname() || "unknown-host";
-  const dirHash = createHash4("sha256").update(path17.resolve(memoryDir)).digest("hex").slice(0, 16);
+  const dirHash = createHash4("sha256").update(path18.resolve(memoryDir)).digest("hex").slice(0, 16);
   return `remnic-local:${host}:${dirHash}`;
 }
 function normalizeOfflineRemoteUrl(raw) {
@@ -11618,10 +11770,10 @@ var OFFLINE_SYNC_CONTENT_MISSING_RETRY_MAX = 3;
 var OFFLINE_SYNC_CONTENT_MISSING_RETRY_DELAY_MS = 250;
 var OfflineRemoteFileChangedError = class extends Error {
   path;
-  constructor(path18) {
-    super(`remote file changed while fetching offline content: ${path18}`);
+  constructor(path19) {
+    super(`remote file changed while fetching offline content: ${path19}`);
     this.name = "OfflineRemoteFileChangedError";
-    this.path = path18;
+    this.path = path19;
   }
 };
 function isOfflineRemoteFileChangedError(error) {
@@ -11882,7 +12034,7 @@ async function pushOfflineFileContentFromChunkReader(args) {
   }
   const hash = createHash4("sha256");
   const chunks = args.readFileChunks({
-    root: path17.resolve(args.memoryDir),
+    root: path18.resolve(args.memoryDir),
     path: args.file.path,
     filePath,
     chunkSize: OFFLINE_SYNC_FILE_CONTENT_UPLOAD_CHUNK_BYTES
@@ -12992,7 +13144,7 @@ Environment fallbacks:
   REMNIC_OFFLINE_REMOTE_URL, REMNIC_OFFLINE_TOKEN, REMNIC_AUTH_TOKEN`);
     return;
   }
-  const memoryDir = path17.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
+  const memoryDir = path18.resolve(expandTilde(resolveRequiredValueFlag(rest, "--memory-dir") ?? resolveMemoryDir()));
   const namespace = resolveRequiredValueFlag(rest, "--namespace");
   const includeTranscripts = !hasFlag(rest, "--no-transcripts");
   const stateOverride = resolveRequiredValueFlag(rest, "--state");
@@ -13012,7 +13164,7 @@ Environment fallbacks:
   const needsRemote = action === "prepare" || action === "sync" || action === "watch";
   const remoteUrl = needsRemote ? resolveOfflineRemoteUrl(rest) : resolveOptionalOfflineRemoteUrl(rest);
   const token = needsRemote ? resolveOfflineToken(rest) : void 0;
-  const statePath = statePathExplicit ? path17.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
+  const statePath = statePathExplicit ? path18.resolve(expandTilde(stateOverride)) : remoteUrl !== void 0 ? defaultOfflineSyncStatePath(memoryDir, remoteUrl, namespace) : void 0;
   if (action === "prepare") {
     if (!remoteUrl || !token || !statePath) throw new Error("offline prepare requires remote URL and token");
     fs15.mkdirSync(memoryDir, { recursive: true });
@@ -13194,11 +13346,11 @@ Environment fallbacks:
           failures: result.largeFilePushFailures
         });
         largeFileFailureCounts = advanced.counts;
-        for (const path18 of advanced.newlySkipped) {
-          if (skippedLargeFiles.has(path18)) continue;
-          skippedLargeFiles.add(path18);
+        for (const path19 of advanced.newlySkipped) {
+          if (skippedLargeFiles.has(path19)) continue;
+          skippedLargeFiles.add(path19);
           console.warn(
-            `offline sync: permanently skipping ${path18} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
+            `offline sync: permanently skipping ${path19} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
           );
         }
         const pulled = result.pull ? result.pull.upserted + result.pull.deleted : 0;
@@ -13213,11 +13365,11 @@ Environment fallbacks:
             failures: error.failures
           });
           largeFileFailureCounts = advanced.counts;
-          for (const path18 of advanced.newlySkipped) {
-            if (skippedLargeFiles.has(path18)) continue;
-            skippedLargeFiles.add(path18);
+          for (const path19 of advanced.newlySkipped) {
+            if (skippedLargeFiles.has(path19)) continue;
+            skippedLargeFiles.add(path19);
             console.warn(
-              `offline sync: permanently skipping ${path18} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
+              `offline sync: permanently skipping ${path19} after ${OFFLINE_LARGE_FILE_SKIP_AFTER_FAILURES} failed large-file pushes for this watcher process (see issue #1786; use --exclude or offlineSyncExcludes to silence permanently)`
             );
           }
         }
@@ -13358,7 +13510,7 @@ async function cmdConnectors(action, rest, json) {
             const connectorDaemonUrl = typeof effectiveConnectorConfig.remnicDaemonUrl === "string" && effectiveConnectorConfig.remnicDaemonUrl.trim().length > 0 ? effectiveConnectorConfig.remnicDaemonUrl.trim() : void 0;
             const pubResult = await pub.publish({
               config: { memoryDir, namespace: connectorNamespace, daemonUrl: connectorDaemonUrl },
-              skillsRoot: path17.join(memoryDir, "skills"),
+              skillsRoot: path18.join(memoryDir, "skills"),
               rollbackTokenEntry: preInstallTokenEntry,
               log: { info: console.log, warn: console.warn, error: console.error }
             });
@@ -13718,15 +13870,15 @@ async function cmdConnectorsMarketplace(subAction, rest, json) {
     }
     const manifest = generateMarketplaceManifest();
     await writeMarketplaceManifest(outputDir, manifest);
-    const outPath = path17.join(outputDir, "marketplace.json");
+    const outPath = path18.join(outputDir, "marketplace.json");
     if (json) {
       console.log(JSON.stringify({ status: "generated", path: outPath }, null, 2));
     } else {
       console.log(`Generated marketplace.json at ${outPath}`);
     }
   } else if (subAction === "validate") {
-    const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path17.join(process.cwd(), "marketplace.json");
-    const resolved = path17.resolve(targetPath);
+    const targetPath = rest.filter((a) => !a.startsWith("--"))[0] ?? path18.join(process.cwd(), "marketplace.json");
+    const resolved = path18.resolve(targetPath);
     if (!fs15.existsSync(resolved)) {
       console.error(`File not found: ${resolved}`);
       process.exit(1);
@@ -14009,6 +14161,7 @@ async function cmdLegacyBenchmark(action, rest, json) {
 }
 async function cmdBench(rest) {
   if (rest[0] === "coding") return cmdBenchCoding(rest.slice(1));
+  if (rest[0] === "security") return cmdBenchSecurity(rest.slice(1));
   if (rest[0] === "procedural-ablation") {
     await cmdBenchProceduralAblation(rest.slice(1));
     return;
@@ -14135,7 +14288,7 @@ async function cmdBench(rest) {
     }
     const completeCount = prevStatus.benchmarks.filter((b) => b.status === "complete").length;
     const failedCount = prevStatus.benchmarks.filter((b) => b.status === "failed").length;
-    printBenchStatusLine(parsed.json, `Resuming from: ${path17.basename(latestStatusPath)}`);
+    printBenchStatusLine(parsed.json, `Resuming from: ${path18.basename(latestStatusPath)}`);
     printBenchStatusLine(parsed.json, `  Previous run: ${prevStatus.startedAt}`);
     printBenchStatusLine(parsed.json, `  Benchmarks: ${prevStatus.benchmarks.length} total, ${completeCount} complete, ${failedCount} failed`);
     const before = selectedBenchmarks.length;
@@ -14303,9 +14456,9 @@ Options:
     );
     process.exit(1);
   } else {
-    fixturePath = path17.resolve(expandTilde(fixturePathRaw));
+    fixturePath = path18.resolve(expandTilde(fixturePathRaw));
   }
-  const outPath = path17.resolve(expandTilde(outPathRaw));
+  const outPath = path18.resolve(expandTilde(outPathRaw));
   const benchModule = await loadBenchModule();
   const runner = benchModule.runProceduralAblationCli;
   if (typeof runner !== "function") {
@@ -14324,7 +14477,7 @@ Options:
   );
   console.log(`wrote ${outPath}`);
 }
-var LOGS_DIR = path17.join(PID_DIR, "logs");
+var LOGS_DIR = path18.join(PID_DIR, "logs");
 var LAUNCHD_PLIST_PATHS = launchdPlistPaths(resolveHomeDir());
 var [LAUNCHD_PLIST_PATH] = LAUNCHD_PLIST_PATHS;
 var SYSTEMD_UNIT_PATHS = systemdUnitPaths(resolveHomeDir());
@@ -14401,7 +14554,7 @@ function selectLaunchdInspection(openclawPluginModeConfigured) {
   for (const plistPath of LAUNCHD_PLIST_PATHS.slice(1)) {
     const legacy = inspectLaunchdPlist(plistPath);
     if (!legacy.installed) continue;
-    const label = path17.basename(plistPath, ".plist");
+    const label = path18.basename(plistPath, ".plist");
     return legacy.ok ? {
       ...legacy,
       warn: true,
@@ -14435,10 +14588,10 @@ function daemonInstall() {
   const vars = { HOME: home, NODE_PATH: nodePath, REMNIC_SERVER_BIN: serverBin };
   fs15.mkdirSync(LOGS_DIR, { recursive: true });
   if (isMacOS()) {
-    const templatePath = path17.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
+    const templatePath = path18.resolve(import.meta.dirname, "../templates/launchd/ai.remnic.daemon.plist");
     const template = fs15.readFileSync(templatePath, "utf8");
     const plist = renderTemplate(template, vars);
-    fs15.mkdirSync(path17.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
+    fs15.mkdirSync(path18.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
     fs15.writeFileSync(LAUNCHD_PLIST_PATH, plist);
     try {
       launchdLoadPlist(LAUNCHD_PLIST_PATH);
@@ -14455,10 +14608,10 @@ function daemonInstall() {
     console.log(`  RunAtLoad: true, KeepAlive: true`);
     console.log(`  Logs: ${LOGS_DIR}/daemon.log`);
   } else if (isLinux()) {
-    const templatePath = path17.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
+    const templatePath = path18.resolve(import.meta.dirname, "../templates/systemd/remnic.service");
     const template = fs15.readFileSync(templatePath, "utf8");
     const unit = renderTemplate(template, vars);
-    fs15.mkdirSync(path17.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
+    fs15.mkdirSync(path18.dirname(SYSTEMD_UNIT_PATH), { recursive: true });
     fs15.writeFileSync(SYSTEMD_UNIT_PATH, unit);
     try {
       childProcess2.execSync("systemctl --user daemon-reload", { stdio: "pipe" });
@@ -14937,7 +15090,7 @@ Clean complete: cleaned=${result.cleaned}`
 }
 async function cmdOpenclawInstall(opts) {
   const configPath = resolveOpenclawConfigPath(opts.configPath);
-  const fallbackMemoryDir = path17.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
+  const fallbackMemoryDir = path18.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
   console.log(`OpenClaw config: ${configPath}`);
   const existingConfig = readOpenclawConfig(configPath);
   const { plugins, entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
@@ -15040,7 +15193,7 @@ Remove it first and re-run, or choose a different path with --memory-dir.`
     fs15.mkdirSync(memoryDir, { recursive: true });
     console.log(`Created memory directory: ${memoryDir}`);
   }
-  const configDir = path17.dirname(configPath);
+  const configDir = path18.dirname(configPath);
   if (!fs15.existsSync(configDir)) {
     fs15.mkdirSync(configDir, { recursive: true });
   }
@@ -15069,12 +15222,12 @@ async function cmdOpenclawUpgrade(opts) {
   const pluginDir = resolveOpenclawPluginDir(opts.pluginDir);
   const managedTargetDir = resolveOpenclawManagedPluginDir();
   const legacyPluginDirForBackup = opts.legacyPluginDirForBackup ? resolveOpenclawLegacyPluginDir(opts.legacyPluginDirForBackup) : void 0;
-  const fallbackMemoryDir = path17.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
+  const fallbackMemoryDir = path18.join(resolveOpenclawStateDir(), "workspace", "memory", "local");
   const packageSpec = buildOpenclawManagedUpgradePackageSpec(opts.version);
   const configExistedBefore = fs15.existsSync(configPath);
   const existingConfig = readOpenclawConfig(configPath);
   const { entries, slots } = parseOpenclawPluginState(existingConfig, configPath);
-  const preservedMemoryDir = opts.memoryDir ? path17.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
+  const preservedMemoryDir = opts.memoryDir ? path18.resolve(expandTilde(opts.memoryDir)) : resolveCurrentOpenclawMemoryDir(entries, slots, fallbackMemoryDir);
   console.log(`OpenClaw config: ${configPath}`);
   console.log(`Plugin dir:      ${pluginDir}`);
   if (legacyPluginDirForBackup) {
@@ -15082,7 +15235,7 @@ async function cmdOpenclawUpgrade(opts) {
   }
   console.log(`Memory dir:      ${preservedMemoryDir}`);
   console.log(`Package spec:    ${packageSpec}`);
-  console.log(`Backup root:     ${path17.join(resolveOpenclawStateDir(), "backups")}`);
+  console.log(`Backup root:     ${path18.join(resolveOpenclawStateDir(), "backups")}`);
   const plannedActions = [
     `backup openclaw.json and the existing ${REMNIC_OPENCLAW_PLUGIN_ID} extension`,
     ...legacyPluginDirForBackup ? [`backup the existing ${REMNIC_OPENCLAW_LEGACY_PLUGIN_ID} extension without modifying it`] : [],
@@ -15120,9 +15273,9 @@ async function cmdOpenclawUpgrade(opts) {
     assertDirectoryPathOrMissing(legacyPluginDirForBackup, "Legacy OpenClaw plugin dir");
   }
   const backupDir = createOpenclawUpgradeBackupDir();
-  const configBackupPath = path17.join(backupDir, "openclaw.json");
-  const pluginBackupDir = path17.join(backupDir, "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
-  const legacyPluginBackupDir = legacyPluginDirForBackup ? path17.join(backupDir, "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID) : void 0;
+  const configBackupPath = path18.join(backupDir, "openclaw.json");
+  const pluginBackupDir = path18.join(backupDir, "extensions", REMNIC_OPENCLAW_PLUGIN_ID);
+  const legacyPluginBackupDir = legacyPluginDirForBackup ? path18.join(backupDir, "extensions", REMNIC_OPENCLAW_LEGACY_PLUGIN_ID) : void 0;
   const backupNotes = [];
   if (backupPathIfPresent(configPath, configBackupPath)) {
     backupNotes.push(`+ Backed up config to ${configBackupPath}`);
@@ -15172,7 +15325,7 @@ async function cmdOpenclawUpgrade(opts) {
     const managedRollbackDir = publishedInstallError ? publishedInstallError.managedRollbackDir : installResult?.managedRollbackDir;
     const managedRollbackTargetDir = publishedInstallError?.managedRollbackTargetDir ?? installResult?.managedRollbackTargetDir ?? managedTargetDir;
     const requiresHostManagedRestore = publishedInstallError?.requiresHostManagedRestore ?? installResult?.requiresHostManagedRestore ?? false;
-    const managedRollbackSharesPluginDir = managedRollbackDir && path17.resolve(managedRollbackTargetDir) === path17.resolve(pluginDir);
+    const managedRollbackSharesPluginDir = managedRollbackDir && path18.resolve(managedRollbackTargetDir) === path18.resolve(pluginDir);
     const pluginRollbackDir = managedRollbackSharesPluginDir ? requiresHostManagedRestore ? rollbackDir : rollbackDir ?? managedRollbackDir : rollbackDir;
     const shouldRestorePlugin = Boolean(
       installResult && !requiresHostManagedRestore || pluginRollbackDir || publishedInstallError?.shouldRestoreBackup
@@ -15229,7 +15382,7 @@ async function cmdOpenclawUpgrade(opts) {
       rollbackErrors.push(error);
     }
     if (pendingConfigRestoreError) rollbackErrors.push(pendingConfigRestoreError);
-    if (managedRollbackDir && path17.resolve(managedRollbackTargetDir) !== path17.resolve(pluginDir) && !requiresHostManagedRestore) {
+    if (managedRollbackDir && path18.resolve(managedRollbackTargetDir) !== path18.resolve(pluginDir) && !requiresHostManagedRestore) {
       try {
         rollbackNotes.push(
           ...rollbackOpenclawUpgrade({
@@ -15295,9 +15448,9 @@ async function cmdOpenclawMigrateEngram(opts) {
   console.log("  - Re-apply any local source patches to the new package only after verifying the published build.");
 }
 function createOpenclawUpgradeBackupDir() {
-  const backupsRoot = path17.join(resolveOpenclawStateDir(), "backups");
+  const backupsRoot = path18.join(resolveOpenclawStateDir(), "backups");
   fs15.mkdirSync(backupsRoot, { recursive: true });
-  return fs15.mkdtempSync(path17.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
+  return fs15.mkdtempSync(path18.join(backupsRoot, `remnic-openclaw-upgrade-${formatOpenclawUpgradeStamp()}-`));
 }
 async function cmdTaxonomy(rest) {
   initLogger3();
@@ -15339,8 +15492,8 @@ async function cmdTaxonomy(rest) {
       const doc = generateResolverDocument(taxonomy);
       console.log(doc);
       if (config.taxonomyAutoGenResolver) {
-        const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
-        fs15.mkdirSync(path17.dirname(resolverPath), { recursive: true });
+        const resolverPath = path18.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        fs15.mkdirSync(path18.dirname(resolverPath), { recursive: true });
         fs15.writeFileSync(resolverPath, doc);
         console.error(`Written: ${resolverPath}`);
       }
@@ -15386,7 +15539,7 @@ async function cmdTaxonomy(rest) {
       console.log(`Added category "${id}" (${name}).`);
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
-        const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        const resolverPath = path18.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
         fs15.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
@@ -15417,7 +15570,7 @@ async function cmdTaxonomy(rest) {
       console.log(`Removed category "${id}".`);
       if (config.taxonomyAutoGenResolver) {
         const doc = generateResolverDocument(taxonomy);
-        const resolverPath = path17.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
+        const resolverPath = path18.join(config.memoryDir, ".taxonomy", "RESOLVER.md");
         fs15.writeFileSync(resolverPath, doc);
         console.error(`Regenerated: ${resolverPath}`);
       }
@@ -15699,7 +15852,7 @@ async function runTrainingExport(args, stdout = process.stdout) {
     );
   }
   const formatted = adapter.formatRecords(records);
-  const outDir = path17.dirname(args.output);
+  const outDir = path18.dirname(args.output);
   fs15.mkdirSync(outDir, { recursive: true });
   const tmpPath = `${args.output}.tmp-${process.pid}-${Date.now()}`;
   fs15.writeFileSync(tmpPath, formatted, "utf-8");
@@ -15810,7 +15963,7 @@ async function main(argv = process.argv.slice(2)) {
     case "tree": {
       const subAction = rest[0];
       const json = rest.includes("--json");
-      const outputDir = resolveFlag(rest, "--output") ?? path17.join(process.cwd(), ".remnic", "context-tree");
+      const outputDir = resolveFlag(rest, "--output") ?? path18.join(process.cwd(), ".remnic", "context-tree");
       const categoriesFlag = resolveFlag(rest, "--categories");
       const categories = categoriesFlag ? categoriesFlag.split(",") : void 0;
       const maxPerCategoryRaw = resolveFlag(rest, "--max-per-category");
@@ -15887,7 +16040,7 @@ async function main(argv = process.argv.slice(2)) {
           console.error(`Context tree not found at ${treeDir}. Run 'remnic tree generate' first.`);
           process.exit(1);
         }
-        const indexPath = path17.join(treeDir, "INDEX.md");
+        const indexPath = path18.join(treeDir, "INDEX.md");
         if (!fs15.existsSync(indexPath)) {
           console.error(`INDEX.md missing in ${treeDir}. Tree may be corrupt \u2014 regenerate.`);
           process.exit(1);
@@ -16358,9 +16511,9 @@ Usage:
   remnic extensions <list|show|validate|reload>  Manage memory extensions
   remnic space <list|switch|create|delete|push|pull|share|promote|audit>  Manage spaces
     create accepts --parent <id> to set parent-child relationship
-  remnic bench <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|attribute|drift-gen|coding> [benchmark...] [--quick] [--all] [--dataset-dir <path>] [--results-dir <path>] [--baselines-dir <path>] [--threshold <value>] [--detail] [--format <json|csv|html>] [--output <path>] [--target remnic-ai] [--json]
+  remnic bench <list|run|published|datasets|runs|compare|results|baseline|export|publish|ui|providers|judge-calibrate|attribute|drift-gen|coding|security> [benchmark...] [--quick] [--all] [--dataset-dir <path>] [--results-dir <path>] [--baselines-dir <path>] [--threshold <value>] [--detail] [--format <json|csv|html>] [--output <path>] [--target remnic-ai] [--json]
     benchmark is kept as a compatibility alias. check/report remain under that alias.
-  remnic benchmark <list|run|datasets|runs|compare|results|baseline|export|publish|ui|providers|check|report|attribute|drift-gen|coding> [queries...] [--explain] [--baseline=<path>] [--report=<path>]
+  remnic benchmark <list|run|datasets|runs|compare|results|baseline|export|publish|ui|providers|check|report|attribute|drift-gen|coding|security> [queries...] [--explain] [--baseline=<path>] [--report=<path>]
   remnic briefing [--since <window>] [--focus <filter>] [--save] [--format markdown|json]
     Daily context briefing. Windows: yesterday, today, NNh, NNd, NNw.
     Focus: person:<name>, project:<name>, topic:<name>.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/cli",
-  "version": "9.55.0",
+  "version": "9.57.0",
   "description": "CLI for Remnic memory — init, query, doctor, daemon management",
   "type": "module",
   "main": "dist/index.js",
@@ -26,25 +26,25 @@
   },
   "dependencies": {
     "yaml": "^2.4.2",
-    "@remnic/plugin-pi": "^9.55.0",
-    "@remnic/server": "^9.55.0",
-    "@remnic/core": "^9.55.0"
+    "@remnic/plugin-pi": "^9.57.0",
+    "@remnic/server": "^9.57.0",
+    "@remnic/core": "^9.57.0"
   },
   "peerDependencies": {
-    "@remnic/bench": "^9.55.0",
-    "@remnic/plugin-openclaw": "^9.55.0",
-    "@remnic/export-weclone": "^9.55.0",
-    "@remnic/import-weclone": "^9.55.0",
-    "@remnic/import-chatgpt": "^9.55.0",
-    "@remnic/import-claude": "^9.55.0",
-    "@remnic/import-gemini": "^9.55.0",
-    "@remnic/import-lossless-claw": "^9.55.0",
-    "@remnic/import-mem0": "^9.55.0",
-    "@remnic/import-supermemory": "^9.55.0",
-    "@remnic/connector-limitless": "^9.55.0",
-    "@remnic/connector-bee": "^9.55.0",
-    "@remnic/connector-omi": "^9.55.0",
-    "@remnic/capture-audio": "^9.55.0"
+    "@remnic/bench": "^9.57.0",
+    "@remnic/plugin-openclaw": "^9.57.0",
+    "@remnic/export-weclone": "^9.57.0",
+    "@remnic/import-weclone": "^9.57.0",
+    "@remnic/import-chatgpt": "^9.57.0",
+    "@remnic/import-claude": "^9.57.0",
+    "@remnic/import-gemini": "^9.57.0",
+    "@remnic/import-lossless-claw": "^9.57.0",
+    "@remnic/import-mem0": "^9.57.0",
+    "@remnic/import-supermemory": "^9.57.0",
+    "@remnic/connector-limitless": "^9.57.0",
+    "@remnic/connector-bee": "^9.57.0",
+    "@remnic/connector-omi": "^9.57.0",
+    "@remnic/capture-audio": "^9.57.0"
   },
   "peerDependenciesMeta": {
     "@remnic/bench": {
@@ -93,19 +93,19 @@
   "devDependencies": {
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "@remnic/bench": "9.55.0",
-    "@remnic/plugin-openclaw": "9.55.0",
-    "@remnic/export-weclone": "9.55.0",
-    "@remnic/import-claude": "9.55.0",
-    "@remnic/import-weclone": "9.55.0",
-    "@remnic/import-lossless-claw": "9.55.0",
-    "@remnic/import-gemini": "9.55.0",
-    "@remnic/import-mem0": "9.55.0",
-    "@remnic/import-supermemory": "9.55.0",
-    "@remnic/connector-limitless": "9.55.0",
-    "@remnic/connector-bee": "9.55.0",
-    "@remnic/import-chatgpt": "9.55.0",
-    "@remnic/connector-omi": "9.55.0"
+    "@remnic/plugin-openclaw": "9.57.0",
+    "@remnic/bench": "9.57.0",
+    "@remnic/export-weclone": "9.57.0",
+    "@remnic/import-weclone": "9.57.0",
+    "@remnic/import-chatgpt": "9.57.0",
+    "@remnic/import-claude": "9.57.0",
+    "@remnic/import-gemini": "9.57.0",
+    "@remnic/import-supermemory": "9.57.0",
+    "@remnic/import-mem0": "9.57.0",
+    "@remnic/connector-limitless": "9.57.0",
+    "@remnic/import-lossless-claw": "9.57.0",
+    "@remnic/connector-bee": "9.57.0",
+    "@remnic/connector-omi": "9.57.0"
   },
   "license": "MIT",
   "repository": {