@remnic/core 1.0.1 → 1.0.3

package/dist/index.js

@@ -1,4 +1,6 @@
 import {
+  buildTokenEntry,
+  commitTokenEntry,
   generateToken,
   getAllValidTokens,
   getAllValidTokensCached,
@@ -7,105 +9,180 @@ import {
   resolveConnectorFromToken,
   revokeToken,
   saveTokenStore
-} from "./chunk-KL4CP4SB.js";
+} from "./chunk-O5ETUNBT.js";
+import {
+  clearBulkImportSources,
+  clearTrainingExportAdapters,
+  convertMemoriesToRecords,
+  formatBatchTranscript,
+  getBulkImportSource,
+  getTrainingExportAdapter,
+  isImportRole,
+  listBulkImportSources,
+  listTrainingExportAdapters,
+  parseIsoTimestamp,
+  parseStrictCliDate,
+  registerBulkImportSource,
+  registerTrainingExportAdapter,
+  runBulkImportCliCommand,
+  runBulkImportPipeline,
+  validateImportTurn
+} from "./chunk-YFYL2SIJ.js";
+import "./chunk-KWP7T3DP.js";
+import "./chunk-AYPYCLR7.js";
+import "./chunk-X4WESCKA.js";
+import "./chunk-HL4DB7TO.js";
+import "./chunk-ZPKBYX2F.js";
+import "./chunk-3SLRNYNG.js";
+import "./chunk-LIRZNNUP.js";
+import "./chunk-Y4Z4I6WK.js";
 import {
   Orchestrator,
+  buildProcedureRecallSection,
+  decideSemanticDedup,
   defaultWorkspaceDir,
   migrateFromEngram,
   rollbackFromEngramMigration,
   sanitizeSessionKeyForFilename
-} from "./chunk-OTFNI3OO.js";
-import "./chunk-UYSKNO6E.js";
-import "./chunk-IFFFR3MR.js";
+} from "./chunk-XMGSSBFX.js";
+import "./chunk-JROGC36Y.js";
+import "./chunk-FSFEQI74.js";
+import "./chunk-W6SL7OFG.js";
 import "./chunk-Z5AAYHUC.js";
-import "./chunk-4A24LIM2.js";
+import "./chunk-S75M5ZRK.js";
 import "./chunk-TPB3I2AC.js";
 import "./chunk-UHGBNIOS.js";
-import "./chunk-ZKYI7UVO.js";
-import "./chunk-LP47L3ZX.js";
+import "./chunk-BTY5RRRF.js";
 import "./chunk-ETOW6ACV.js";
-import "./chunk-GPGBSNKM.js";
+import "./chunk-KVE7R4CG.js";
+import "./chunk-JR4ZC3G4.js";
+import "./chunk-C7VW7C3F.js";
+import "./chunk-K4FLSOR5.js";
 import "./chunk-V3RXWQIE.js";
-import "./chunk-G3AG3KZN.js";
-import "./chunk-2CJCWDMR.js";
-import "./chunk-HG2NKWR2.js";
+import "./chunk-5IZL4DCV.js";
+import "./chunk-YDBIWGNI.js";
+import "./chunk-7DHTMOND.js";
+import "./chunk-S4LX5EBI.js";
 import "./chunk-X7XN6YU4.js";
-import "./chunk-BRK4ODMI.js";
-import "./chunk-C7VW7C3F.js";
+import "./chunk-5NPGSAVB.js";
 import "./chunk-YCN4BVDK.js";
-import "./chunk-L5RPWGFK.js";
-import "./chunk-GJR6D6KC.js";
+import "./chunk-D654IBA6.js";
 import "./chunk-H63EDPFJ.js";
-import "./chunk-WWIQTB2Y.js";
 import {
-  ExtractionEngine
-} from "./chunk-6UJQNRIO.js";
-import "./chunk-MWGVGUIS.js";
-import "./chunk-763GUIOU.js";
-import "./chunk-ONRU4L2N.js";
-import "./chunk-MDDAA2AO.js";
+  hasBroadGraphIntent,
+  inferIntentFromText,
+  intentCompatibilityScore,
+  isTaskInitiationIntent,
+  planRecallMode
+} from "./chunk-BKQJBXXX.js";
 import "./chunk-YAZNBMNF.js";
-import {
-  loadDaySummaryPrompt
-} from "./chunk-2PO5ZRKV.js";
-import "./chunk-VEWZZM3H.js";
-import "./chunk-QPKFPHOO.js";
+import "./chunk-ALXMCZEU.js";
 import {
   buildEntityRecallSection
-} from "./chunk-V4YC4LUK.js";
-import "./chunk-HLBYLYRD.js";
-import "./chunk-OTAVQCSF.js";
+} from "./chunk-74JR4N5J.js";
+import {
+  clearVerdictCache,
+  createVerdictCache,
+  judgeFactDurability,
+  verdictCacheSize
+} from "./chunk-LAYN4LDC.js";
+import {
+  ExtractionEngine
+} from "./chunk-2VFW5K5U.js";
+import "./chunk-UEYA6UC7.js";
+import "./chunk-NBNN5GOB.js";
+import "./chunk-UPMD5XND.js";
+import "./chunk-FEMOX5AD.js";
+import "./chunk-VEWZZM3H.js";
+import "./chunk-PAORGQRI.js";
+import "./chunk-PYXS46O7.js";
 import "./chunk-3QKK7QOS.js";
-import "./chunk-UIYZ5T3I.js";
-import "./chunk-UCYSTFZR.js";
-import "./chunk-J47FNDR7.js";
+import "./chunk-GJQPH5G3.js";
+import "./chunk-JRNQ3RNA.js";
+import "./chunk-MYQWXITD.js";
 import "./chunk-CULXMQJH.js";
-import "./chunk-UV2FO7J4.js";
-import "./chunk-T4WRIV2C.js";
+import "./chunk-E6K4NIEU.js";
+import "./chunk-EABGC2TL.js";
 import "./chunk-LOBRX7VD.js";
 import {
   LanceDbBackend,
   MeilisearchBackend,
   OramaBackend
-} from "./chunk-IZME7KW2.js";
+} from "./chunk-HITJFT7E.js";
 import "./chunk-YRMVARQP.js";
+import {
+  LEGACY_PLUGIN_ID,
+  PLUGIN_ID,
+  resolveRemnicPluginEntry
+} from "./chunk-U66YHYC7.js";
 import {
   QmdClient
-} from "./chunk-TVVVQQAK.js";
-import "./chunk-BDFZXRSO.js";
-import "./chunk-LK6SGL53.js";
+} from "./chunk-7PA4OZEU.js";
+import "./chunk-J4IYOZZ5.js";
 import "./chunk-AAI7JARD.js";
-import "./chunk-C6QPK5GG.js";
-import "./chunk-Q6FETXJA.js";
+import "./chunk-7SEAZFFB.js";
 import "./chunk-K6WK37A6.js";
-import "./chunk-SCHEKPYH.js";
-import "./chunk-ORZMT74A.js";
-import "./chunk-B7LOFDVE.js";
+import "./chunk-LK6SGL53.js";
+import {
+  CODEX_THREAD_KEY_PREFIX
+} from "./chunk-3PG3H5TD.js";
 import "./chunk-FYIYMQ5N.js";
 import "./chunk-2NMMFZ5T.js";
 import {
+  coerceInstallExtension,
   parseConfig
-} from "./chunk-ISY75RLM.js";
+} from "./chunk-OJFGVJS6.js";
 import "./chunk-Z5LAYHGJ.js";
+import "./chunk-C6QPK5GG.js";
+import {
+  buildExtensionsFooterForSummary,
+  loadDaySummaryPrompt
+} from "./chunk-GZCUW5IC.js";
+import {
+  MATERIALIZE_VERSION,
+  SENTINEL_FILE,
+  buildExtensionsBlockForConsolidation,
+  describeMemoriesDir,
+  ensureSentinel,
+  materializeForNamespace,
+  runCodexMaterialize,
+  runPostConsolidationMaterialize
+} from "./chunk-RCICHSHL.js";
+import {
+  REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT,
+  discoverMemoryExtensions,
+  renderExtensionsBlock,
+  renderExtensionsFooter,
+  resolveExtensionsRoot
+} from "./chunk-EJI5XIBB.js";
+import "./chunk-C2EFFULQ.js";
+import "./chunk-4WMCPJWX.js";
+import "./chunk-6HZ6AO2P.js";
 import "./chunk-JWPLJLDU.js";
 import {
   BootstrapEngine
-} from "./chunk-YNI4S5WT.js";
-import "./chunk-DORBM6OB.js";
+} from "./chunk-N53K2EXC.js";
+import "./chunk-URB2WSKZ.js";
+import "./chunk-UVJFDP7P.js";
 import "./chunk-XYIK4LF6.js";
-import "./chunk-XUHI52HK.js";
-import "./chunk-M5ZBBBJI.js";
-import "./chunk-OOSWAUYB.js";
+import "./chunk-QKAH5B6E.js";
+import "./chunk-KEG4GNGI.js";
+import "./chunk-ODWDQNRE.js";
 import "./chunk-Y27UJK6V.js";
 import "./chunk-UZB5KHKX.js";
-import "./chunk-M5KEYE5E.js";
 import "./chunk-NGAVDO7E.js";
 import {
   EngramAccessHttpServer
-} from "./chunk-ZJLY4QSU.js";
+} from "./chunk-PMB3WGDL.js";
 import {
   EngramMcpServer
-} from "./chunk-CXWFUJR2.js";
+} from "./chunk-NSB3WSYS.js";
+import {
+  buildCitationGuidance,
+  formatOaiMemCitation,
+  parseOaiMemCitation,
+  sanitizeNoteForCitation
+} from "./chunk-IQT3XTKW.js";
 import "./chunk-MARWOCVP.js";
 import {
   formatZodError,
@@ -114,47 +191,484 @@ import {
   recallRequestSchema,
   suggestionSubmitRequestSchema,
   validateRequest
-} from "./chunk-PGK3VUHN.js";
+} from "./chunk-MTLYEMJB.js";
 import {
   EngramAccessInputError,
   EngramAccessService
-} from "./chunk-QY2BHY5O.js";
-import "./chunk-N5AKDXAI.js";
+} from "./chunk-V7XCAHIB.js";
 import {
   isTrustZoneName
 } from "./chunk-EQINRHYR.js";
-import "./chunk-J3BT33K7.js";
+import "./chunk-POBPGDWI.js";
+import "./chunk-QDYXG4CS.js";
+import "./chunk-QNJMBKFK.js";
 import "./chunk-EEQLFRUM.js";
+import {
+  buildProcedureMarkdownBody,
+  parseProcedureStepsFromBody
+} from "./chunk-QDW3E4RD.js";
+import "./chunk-4NRAJUDS.js";
+import "./chunk-DT5TVLJE.js";
+import "./chunk-TBBDFYXW.js";
+import "./chunk-DGXUHMOV.js";
+import "./chunk-LPSF4OQH.js";
+import "./chunk-XKECPATV.js";
+import {
+  BRIEFING_FORMAT_ALLOWED,
+  FileCalendarSource,
+  briefingFilename,
+  buildBriefing,
+  focusMatchesEntity,
+  focusMatchesMemory,
+  parseBriefingFocus,
+  parseBriefingWindow,
+  renderBriefingMarkdown,
+  resolveBriefingSaveDir,
+  validateBriefingFormat
+} from "./chunk-ECKDIK5F.js";
 import {
   StorageManager
-} from "./chunk-QWUUMMIK.js";
-import "./chunk-U4PV25RD.js";
-import "./chunk-ESSMF2FR.js";
+} from "./chunk-POMSFKTB.js";
+import "./chunk-U2IQTSBY.js";
+import {
+  CITATION_UNKNOWN,
+  DEFAULT_CITATION_FORMAT,
+  attachCitation,
+  deriveSessionId,
+  formatCitation,
+  hasCitation,
+  parseAllCitations,
+  parseCitation,
+  stripCitation
+} from "./chunk-4KAN3GZ3.js";
+import {
+  createVersion,
+  diffVersions,
+  getVersion,
+  listVersions,
+  revertToVersion
+} from "./chunk-6ZH4TU6I.js";
+import "./chunk-6PFRXT4K.js";
 import "./chunk-TP4FZJIZ.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-BOUYNNYD.js";
-import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";
-import "./chunk-YNCQ7E4M.js";
-import "./chunk-HLXVTBF3.js";
+import "./chunk-DM2T26WE.js";
 import "./chunk-M62O4P4T.js";
-import "./chunk-DT5TVLJE.js";
+import "./chunk-4DJQYKMN.js";
 import {
   initLogger,
   log
-} from "./chunk-KWBU5S5U.js";
-import "./chunk-DGXUHMOV.js";
-import "./chunk-LPSF4OQH.js";
-import "./chunk-XKECPATV.js";
-import "./chunk-6HZ6AO2P.js";
-import "./chunk-QCCCQT3O.js";
+} from "./chunk-2ODBA7MQ.js";
+import {
+  getMemoryForActiveMemory,
+  recallForActiveMemory
+} from "./chunk-G4SK7DSQ.js";
+import "./chunk-6MKAMLQL.js";
+import {
+  resolvePrincipal
+} from "./chunk-N5AKDXAI.js";
 
-// src/projection/index.ts
+// src/binary-lifecycle/types.ts
+var DEFAULT_SCAN_PATTERNS = [
+  "*.png",
+  "*.jpg",
+  "*.jpeg",
+  "*.gif",
+  "*.pdf",
+  "*.mp3",
+  "*.mp4",
+  "*.wav"
+];
+var DEFAULT_MAX_BINARY_SIZE_BYTES = 50 * 1024 * 1024;
+var DEFAULT_GRACE_PERIOD_DAYS = 7;
+
+// src/binary-lifecycle/backend.ts
 import fs from "fs";
+import fsp from "fs/promises";
+import path from "path";
+var FilesystemBackend = class {
+  type = "filesystem";
+  basePath;
+  constructor(basePath) {
+    if (!basePath || basePath.trim().length === 0) {
+      throw new Error("FilesystemBackend requires a non-empty basePath");
+    }
+    this.basePath = basePath;
+  }
+  async upload(localPath, remotePath) {
+    const dest = path.join(this.basePath, remotePath);
+    const destDir = path.dirname(dest);
+    await fsp.mkdir(destDir, { recursive: true });
+    await fsp.copyFile(localPath, dest);
+    return dest;
+  }
+  async exists(remotePath) {
+    const dest = path.join(this.basePath, remotePath);
+    try {
+      await fsp.access(dest, fs.constants.F_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async delete(remotePath) {
+    const dest = path.join(this.basePath, remotePath);
+    try {
+      await fsp.unlink(dest);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+};
+var NoneBackend = class {
+  type = "none";
+  async upload(_localPath, remotePath) {
+    return remotePath;
+  }
+  async exists(_remotePath) {
+    return false;
+  }
+  async delete(_remotePath) {
+  }
+};
+function createBackend(cfg) {
+  switch (cfg.type) {
+    case "filesystem": {
+      if (!cfg.basePath) {
+        throw new Error(
+          'BinaryStorageBackendConfig.basePath is required when type is "filesystem"'
+        );
+      }
+      return new FilesystemBackend(cfg.basePath);
+    }
+    case "s3":
+      throw new Error("S3 binary storage backend is not yet implemented");
+    case "none":
+      return new NoneBackend();
+    default:
+      throw new Error(`Unknown binary storage backend type: ${String(cfg.type)}`);
+  }
+}
+
+// src/binary-lifecycle/scanner.ts
+import fsp2 from "fs/promises";
 import path2 from "path";
+function matchesPatterns(filename, patterns) {
+  const lower = filename.toLowerCase();
+  for (const pattern of patterns) {
+    if (pattern.startsWith("*.")) {
+      const ext = pattern.slice(1).toLowerCase();
+      if (lower.endsWith(ext)) return true;
+    } else if (lower === pattern.toLowerCase()) {
+      return true;
+    }
+  }
+  return false;
+}
+async function scanForBinaries(memoryDir, config, manifest) {
+  const tracked = new Set(manifest.assets.map((a) => a.originalPath));
+  const results = [];
+  async function walk(dir) {
+    let entries;
+    try {
+      entries = await fsp2.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const fullPath = path2.join(dir, entry.name);
+      const relativePath = path2.relative(memoryDir, fullPath).split(path2.sep).join("/");
+      if (entry.isDirectory()) {
+        if (entry.name === ".binary-lifecycle") continue;
+        await walk(fullPath);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (!matchesPatterns(entry.name, config.scanPatterns)) continue;
+      if (tracked.has(relativePath)) continue;
+      try {
+        const stat = await fsp2.stat(fullPath);
+        if (stat.size > config.maxBinarySizeBytes) continue;
+        if (stat.size === 0) continue;
+      } catch {
+        continue;
+      }
+      results.push(relativePath);
+    }
+  }
+  await walk(memoryDir);
+  return results;
+}
+
+// src/binary-lifecycle/manifest.ts
+import fsp3 from "fs/promises";
+import path3 from "path";
+import crypto from "crypto";
+var MANIFEST_DIR = ".binary-lifecycle";
+var MANIFEST_FILE = "manifest.json";
+function manifestDir(memoryDir) {
+  return path3.join(memoryDir, MANIFEST_DIR);
+}
+function manifestPath(memoryDir) {
+  return path3.join(memoryDir, MANIFEST_DIR, MANIFEST_FILE);
+}
+async function readManifest(memoryDir) {
+  const filePath = manifestPath(memoryDir);
+  try {
+    const raw = await fsp3.readFile(filePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return emptyManifest();
+    }
+    const obj = parsed;
+    if (obj.version !== 1 || !Array.isArray(obj.assets)) {
+      return emptyManifest();
+    }
+    return parsed;
+  } catch {
+    return emptyManifest();
+  }
+}
+async function writeManifest(memoryDir, manifest) {
+  const dir = manifestDir(memoryDir);
+  await fsp3.mkdir(dir, { recursive: true });
+  const dest = manifestPath(memoryDir);
+  const tmpSuffix = crypto.randomBytes(8).toString("hex");
+  const tmpPath = `${dest}.${tmpSuffix}.tmp`;
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  await fsp3.writeFile(tmpPath, content, "utf-8");
+  try {
+    await fsp3.rename(tmpPath, dest);
+  } catch (renameErr) {
+    try {
+      await fsp3.unlink(tmpPath);
+    } catch {
+    }
+    throw renameErr;
+  }
+}
+function emptyManifest() {
+  return { version: 1, assets: [] };
+}
+
+// src/binary-lifecycle/pipeline.ts
+import fsp4 from "fs/promises";
+import path4 from "path";
+import crypto2 from "crypto";
+async function hashFile(filePath) {
+  const content = await fsp4.readFile(filePath);
+  return crypto2.createHash("sha256").update(content).digest("hex");
+}
+function guessMimeType(ext) {
+  const map = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".pdf": "application/pdf",
+    ".mp3": "audio/mpeg",
+    ".mp4": "video/mp4",
+    ".wav": "audio/wav"
+  };
+  return map[ext.toLowerCase()] ?? "application/octet-stream";
+}
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function stageMirror(memoryDir, newPaths, backend, assets, log2, dryRun) {
+  let mirrored = 0;
+  const errors = [];
+  for (const relPath of newPaths) {
+    const fullPath = path4.join(memoryDir, relPath);
+    try {
+      const stat = await fsp4.stat(fullPath);
+      const contentHash = await hashFile(fullPath);
+      const ext = path4.extname(relPath);
+      const mimeType = guessMimeType(ext);
+      const remotePath = relPath;
+      let backendLocation = remotePath;
+      if (!dryRun) {
+        backendLocation = await backend.upload(fullPath, remotePath);
+      }
+      const record = {
+        originalPath: relPath,
+        mirroredPath: backendLocation,
+        contentHash,
+        sizeBytes: stat.size,
+        mimeType,
+        mirroredAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "mirrored"
+      };
+      assets.push(record);
+      mirrored++;
+      log2.info(`[binary-lifecycle] mirrored: ${relPath} (${stat.size} bytes)${dryRun ? " [dry-run]" : ""}`);
+    } catch (err) {
+      const msg = `mirror failed for ${relPath}: ${err instanceof Error ? err.message : String(err)}`;
+      log2.error(`[binary-lifecycle] ${msg}`);
+      errors.push(msg);
+    }
+  }
+  return { mirrored, errors };
+}
+async function stageRedirect(memoryDir, assets, log2, dryRun) {
+  let redirected = 0;
+  const errors = [];
+  const candidates = assets.filter((a) => a.status === "mirrored");
+  if (candidates.length === 0) return { redirected, errors };
+  const mdFiles = await findMarkdownFiles(memoryDir);
+  for (const asset of candidates) {
+    let matchCount = 0;
+    let writeFailCount = 0;
+    for (const mdPath of mdFiles) {
+      try {
+        const content = await fsp4.readFile(mdPath, "utf-8");
+        const mdDir = path4.dirname(mdPath);
+        const assetAbsolute = path4.join(memoryDir, asset.originalPath);
+        const relativeToMd = path4.relative(mdDir, assetAbsolute);
+        const relativeForward = relativeToMd.split(path4.sep).join("/");
+        const escaped = escapeRegex(relativeForward);
+        const pattern = new RegExp(
+          `(!?\\[[^\\]]*\\]\\()(\\.\\/)?(${escaped})(\\))`,
+          "g"
+        );
+        if (!pattern.test(content)) continue;
+        matchCount++;
+        if (!dryRun) {
+          pattern.lastIndex = 0;
+          const updated = content.replace(pattern, (_match, open, _dotSlash, _file, close) => {
+            return `${open}${asset.mirroredPath}${close}`;
+          });
+          await fsp4.writeFile(mdPath, updated, "utf-8");
+        }
+      } catch (err) {
+        writeFailCount++;
+        const msg = `redirect scan failed for ${mdPath}: ${err instanceof Error ? err.message : String(err)}`;
+        log2.error(`[binary-lifecycle] ${msg}`);
+        errors.push(msg);
+      }
+    }
+    if (matchCount > 0 && writeFailCount === 0) {
+      asset.status = "redirected";
+      asset.redirectedAt = (/* @__PURE__ */ new Date()).toISOString();
+      redirected++;
+      log2.info(`[binary-lifecycle] redirected: ${asset.originalPath}${dryRun ? " [dry-run]" : ""}`);
+    } else if (matchCount > 0 && writeFailCount > 0) {
+      asset.status = "error";
+      log2.warn(
+        `[binary-lifecycle] redirect partial failure for ${asset.originalPath}: ${matchCount} match(es), ${writeFailCount} write failure(s) \u2014 status set to error`
+      );
+    }
+  }
+  return { redirected, errors };
+}
+async function stageClean(memoryDir, assets, gracePeriodDays, log2, dryRun, forceClean) {
+  let cleaned = 0;
+  const errors = [];
+  const now = Date.now();
+  const graceMs = gracePeriodDays * 24 * 60 * 60 * 1e3;
+  const candidates = assets.filter(
+    (a) => a.status === "redirected"
+  );
+  for (const asset of candidates) {
+    const mirroredMs = new Date(asset.mirroredAt).getTime();
+    const ageMs = now - mirroredMs;
+    if (!forceClean && ageMs < graceMs) {
+      continue;
+    }
+    const fullPath = path4.join(memoryDir, asset.originalPath);
+    try {
+      if (!dryRun) {
+        await fsp4.unlink(fullPath);
+      }
+      asset.status = "cleaned";
+      asset.cleanedAt = (/* @__PURE__ */ new Date()).toISOString();
+      cleaned++;
+      log2.info(`[binary-lifecycle] cleaned: ${asset.originalPath}${dryRun ? " [dry-run]" : ""}`);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        asset.status = "cleaned";
+        asset.cleanedAt = (/* @__PURE__ */ new Date()).toISOString();
+        cleaned++;
+      } else {
+        const msg = `clean failed for ${asset.originalPath}: ${err instanceof Error ? err.message : String(err)}`;
+        log2.error(`[binary-lifecycle] ${msg}`);
+        errors.push(msg);
+      }
+    }
+  }
+  return { cleaned, errors };
+}
+async function findMarkdownFiles(dir) {
+  const results = [];
+  async function walk(current) {
+    let entries;
+    try {
+      entries = await fsp4.readdir(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path4.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === ".binary-lifecycle") continue;
+        await walk(full);
+      } else if (entry.isFile() && entry.name.endsWith(".md")) {
+        results.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  return results;
+}
+async function runBinaryLifecyclePipeline(memoryDir, config, backend, log2, opts) {
+  const dryRun = opts?.dryRun ?? false;
+  const forceClean = opts?.forceClean ?? false;
+  const manifest = await readManifest(memoryDir);
+  const newPaths = await scanForBinaries(memoryDir, config, manifest);
+  const scanned = newPaths.length;
+  const mirrorResult = await stageMirror(
+    memoryDir,
+    newPaths,
+    backend,
+    manifest.assets,
+    log2,
+    dryRun
+  );
+  const redirectResult = await stageRedirect(memoryDir, manifest.assets, log2, dryRun);
+  const cleanResult = await stageClean(
+    memoryDir,
+    manifest.assets,
+    config.gracePeriodDays,
+    log2,
+    dryRun,
+    forceClean
+  );
+  manifest.lastScanAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (!dryRun) {
+    await writeManifest(memoryDir, manifest);
+  }
+  const allErrors = [
+    ...mirrorResult.errors,
+    ...redirectResult.errors,
+    ...cleanResult.errors
+  ];
+  return {
+    scanned,
+    mirrored: mirrorResult.mirrored,
+    redirected: redirectResult.redirected,
+    cleaned: cleanResult.cleaned,
+    errors: allErrors,
+    dryRun
+  };
+}
+
+// src/projection/index.ts
+import fs2 from "fs";
+import path6 from "path";
 
 // src/utils/category-dir.ts
-import path from "path";
+import path5 from "path";
 var CATEGORY_DIR_MAP = {
   correction: "corrections",
   question: "questions",
@@ -165,7 +679,8 @@ var CATEGORY_DIR_MAP = {
   principle: "principles",
   rule: "rules",
   skill: "skills",
-  relationship: "relationships"
+  relationship: "relationships",
+  procedure: "procedures"
 };
 var ALL_CATEGORY_DIRS = [
   "facts",
@@ -177,7 +692,7 @@ var ALL_CATEGORY_KEYS = [
 ];
 function getCategoryDir(memoryDir, category) {
   const dir = CATEGORY_DIR_MAP[category];
-  return dir ? path.join(memoryDir, dir) : path.join(memoryDir, "facts");
+  return dir ? path5.join(memoryDir, dir) : path5.join(memoryDir, "facts");
 }
 
 // src/projection/index.ts
@@ -194,11 +709,11 @@ async function generateContextTree(options) {
   let nodesGenerated = 0;
   let nodesSkipped = 0;
   const categoryCounts = {};
-  fs.mkdirSync(outputDir, { recursive: true });
+  fs2.mkdirSync(outputDir, { recursive: true });
   const allCategories = filterCategories ?? ALL_CATEGORY_KEYS.filter((c) => c !== "question");
   for (const category of allCategories) {
     const categoryDir = getCategoryDir(memoryDir, category);
-    if (!fs.existsSync(categoryDir)) continue;
+    if (!fs2.existsSync(categoryDir)) continue;
     categoryCounts[category] = 0;
     const files = walkR(categoryDir);
     let count = 0;
@@ -207,7 +722,7 @@ async function generateContextTree(options) {
         nodesSkipped++;
         continue;
       }
-      const content = fs.readFileSync(filePath, "utf8");
+      const content = fs2.readFileSync(filePath, "utf8");
       const fm = parseFrontmatter(content);
       if (!fm) {
         nodesSkipped++;
@@ -218,17 +733,17 @@ async function generateContextTree(options) {
         nodesSkipped++;
         continue;
       }
-      const outputPath = path2.join(outputDir, node.path);
-      fs.mkdirSync(path2.dirname(outputPath), { recursive: true });
-      fs.writeFileSync(outputPath, node.content);
+      const outputPath = path6.join(outputDir, node.path);
+      fs2.mkdirSync(path6.dirname(outputPath), { recursive: true });
+      fs2.writeFileSync(outputPath, node.content);
       nodesGenerated++;
       categoryCounts[category] = (categoryCounts[category] ?? 0) + 1;
       count++;
     }
   }
   if (includeEntities) {
-    const entitiesDir = path2.join(memoryDir, "entities");
-    if (fs.existsSync(entitiesDir)) {
+    const entitiesDir = path6.join(memoryDir, "entities");
+    if (fs2.existsSync(entitiesDir)) {
       categoryCounts["entity"] = 0;
       const entityFiles = walkR(entitiesDir);
       let count = 0;
@@ -237,12 +752,12 @@ async function generateContextTree(options) {
           nodesSkipped++;
           continue;
         }
-        const content = fs.readFileSync(filePath, "utf8");
-        const fileName = path2.basename(filePath, ".md");
+        const content = fs2.readFileSync(filePath, "utf8");
+        const fileName = path6.basename(filePath, ".md");
         const node = projectEntityNode(fileName, content);
-        const outputPath = path2.join(outputDir, "entities", `${fileName}.md`);
-        fs.mkdirSync(path2.dirname(outputPath), { recursive: true });
-        fs.writeFileSync(outputPath, node.content);
+        const outputPath = path6.join(outputDir, "entities", `${fileName}.md`);
+        fs2.mkdirSync(path6.dirname(outputPath), { recursive: true });
+        fs2.writeFileSync(outputPath, node.content);
         nodesGenerated++;
         categoryCounts["entity"] = (categoryCounts["entity"] ?? 0) + 1;
         count++;
@@ -250,8 +765,8 @@ async function generateContextTree(options) {
     }
   }
   if (includeQuestions) {
-    const questionsDir = path2.join(memoryDir, "questions");
-    if (fs.existsSync(questionsDir)) {
+    const questionsDir = path6.join(memoryDir, "questions");
+    if (fs2.existsSync(questionsDir)) {
       categoryCounts["question"] = 0;
       const qFiles = walkR(questionsDir);
       let count = 0;
@@ -260,7 +775,7 @@ async function generateContextTree(options) {
           nodesSkipped++;
           continue;
         }
-        const content = fs.readFileSync(filePath, "utf8");
+        const content = fs2.readFileSync(filePath, "utf8");
         const fm = parseFrontmatter(content);
         if (!fm) {
           nodesSkipped++;
@@ -271,9 +786,9 @@ async function generateContextTree(options) {
           nodesSkipped++;
           continue;
         }
-        const outputPath = path2.join(outputDir, node.path);
-        fs.mkdirSync(path2.dirname(outputPath), { recursive: true });
-        fs.writeFileSync(outputPath, node.content);
+        const outputPath = path6.join(outputDir, node.path);
+        fs2.mkdirSync(path6.dirname(outputPath), { recursive: true });
+        fs2.writeFileSync(outputPath, node.content);
         nodesGenerated++;
         categoryCounts["question"] = (categoryCounts["question"] ?? 0) + 1;
         count++;
@@ -281,7 +796,7 @@ async function generateContextTree(options) {
     }
   }
   const index = generateIndex(categoryCounts, outputDir);
-  fs.writeFileSync(path2.join(outputDir, "INDEX.md"), index);
+  fs2.writeFileSync(path6.join(outputDir, "INDEX.md"), index);
   return {
     nodesGenerated,
     nodesSkipped,
@@ -293,8 +808,8 @@ async function generateContextTree(options) {
 function walkR(dir) {
   const results = [];
   function walk(directory) {
-    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-      const fullPath = path2.join(directory, entry.name);
+    for (const entry of fs2.readdirSync(directory, { withFileTypes: true })) {
+      const fullPath = path6.join(directory, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
       } else if (entry.name.endsWith(".md")) {
@@ -336,13 +851,13 @@ function extractBody(content) {
 }
 function projectNode(filePath, category, fm, rawContent) {
   const body = extractBody(rawContent);
-  const fileName = path2.basename(filePath, ".md");
-  const dateDir = path2.basename(path2.dirname(filePath));
+  const fileName = path6.basename(filePath, ".md");
+  const dateDir = path6.basename(path6.dirname(filePath));
   let relPath;
   if (/^\d{4}-\d{2}-\d{2}$/.test(dateDir)) {
-    relPath = path2.join(category, dateDir, `${fileName}.md`);
+    relPath = path6.join(category, dateDir, `${fileName}.md`);
   } else {
-    relPath = path2.join(category, `${fileName}.md`);
+    relPath = path6.join(category, `${fileName}.md`);
   }
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   const md = `# ${fm.id}
@@ -388,7 +903,7 @@ function projectEntityNode(fileName, content) {
 ${content}
 `;
   return {
-    path: path2.join("entities", `${fileName}.md`),
+    path: path6.join("entities", `${fileName}.md`),
     category: "entity",
     title: fileName,
     content: md,
@@ -440,8 +955,8 @@ function generateIndex(categoryCounts, outputDir) {
 }
 
 // src/onboarding/index.ts
-import fs2 from "fs";
-import path3 from "path";
+import fs3 from "fs";
+import path7 from "path";
 var LANGUAGE_RULES = [
   {
     language: "TypeScript",
@@ -567,13 +1082,13 @@ function walkDir(root, exclude, maxDepth) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs2.readdirSync(dir, { withFileTypes: true });
+      entries = fs3.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (exclude.has(entry.name)) continue;
-      const fullPath = path3.join(dir, entry.name);
+      const fullPath = path7.join(dir, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath, depth + 1);
       } else if (entry.isFile()) {
@@ -588,11 +1103,11 @@ function detectLanguages(files, root) {
   const results = [];
   const extCounts = /* @__PURE__ */ new Map();
   for (const f of files) {
-    const ext = path3.extname(f).toLowerCase();
+    const ext = path7.extname(f).toLowerCase();
     if (ext) extCounts.set(ext, (extCounts.get(ext) ?? 0) + 1);
   }
   const rootFiles = new Set(
-    files.filter((f) => path3.dirname(f) === root).map((f) => path3.basename(f))
+    files.filter((f) => path7.dirname(f) === root).map((f) => path7.basename(f))
   );
   for (const rule of LANGUAGE_RULES) {
     const evidence = [];
@@ -636,18 +1151,18 @@ function detectLanguages(files, root) {
 }
 function detectShape(files, root) {
   const rootFiles = new Set(
-    files.filter((f) => path3.dirname(f) === root).map((f) => path3.basename(f))
+    files.filter((f) => path7.dirname(f) === root).map((f) => path7.basename(f))
   );
   const rootDirs = /* @__PURE__ */ new Set();
   try {
-    for (const entry of fs2.readdirSync(root, { withFileTypes: true })) {
+    for (const entry of fs3.readdirSync(root, { withFileTypes: true })) {
       if (entry.isDirectory()) rootDirs.add(entry.name);
     }
   } catch {
   }
   const evidence = [];
   if (rootFiles.has("package.json")) {
-    const pkg = readJsonSafe(path3.join(root, "package.json"));
+    const pkg = readJsonSafe(path7.join(root, "package.json"));
     if (pkg?.workspaces) {
       evidence.push("package.json has workspaces");
       return { shape: "monorepo", evidence };
@@ -661,13 +1176,13 @@ function detectShape(files, root) {
     evidence.push("workspace manifest found");
     return { shape: "workspace", evidence };
   }
-  const cargoToml = readTomlWorkspace(path3.join(root, "Cargo.toml"));
+  const cargoToml = readTomlWorkspace(path7.join(root, "Cargo.toml"));
   if (cargoToml) {
     evidence.push("Cargo.toml has workspace");
     return { shape: "workspace", evidence };
   }
   if (rootFiles.has("package.json")) {
-    const pkg = readJsonSafe(path3.join(root, "package.json"));
+    const pkg = readJsonSafe(path7.join(root, "package.json"));
     if (pkg?.exports || pkg?.main) {
       if (pkg?.bin) {
         evidence.push("package.json has bin");
@@ -701,8 +1216,8 @@ function discoverDocs(files, root) {
     { pattern: /^\.editorconfig$/i, kind: "config" }
   ];
   for (const filePath of files) {
-    const basename = path3.basename(filePath).toLowerCase();
-    const relPath = path3.relative(root, filePath);
+    const basename = path7.basename(filePath).toLowerCase();
+    const relPath = path7.relative(root, filePath);
     let kind;
     for (const { pattern, kind: k } of docPatterns) {
       if (pattern.test(basename)) {
@@ -714,14 +1229,14 @@ function discoverDocs(files, root) {
       kind = "docs";
     }
     if (!kind && (basename.endsWith(".md") || basename.endsWith(".mdx"))) {
-      if (path3.dirname(relPath) === "." || isUnderDocsDir(relPath)) {
+      if (path7.dirname(relPath) === "." || isUnderDocsDir(relPath)) {
         kind = "docs";
       }
     }
     if (kind) {
       let size = 0;
       try {
-        size = fs2.statSync(filePath).size;
+        size = fs3.statSync(filePath).size;
       } catch {
       }
       docs.push({
@@ -735,7 +1250,7 @@ function discoverDocs(files, root) {
   return docs;
 }
 function isUnderDocsDir(relPath) {
-  const parts = relPath.split(path3.sep);
+  const parts = relPath.split(path7.sep);
   return parts[0] === "docs" || parts[0] === "doc" || parts[0] === "documentation";
 }
 function buildPlan(languages, shape, docs, _root) {
@@ -763,14 +1278,14 @@ function buildPlan(languages, shape, docs, _root) {
 }
 function readJsonSafe(filePath) {
   try {
-    return JSON.parse(fs2.readFileSync(filePath, "utf8"));
+    return JSON.parse(fs3.readFileSync(filePath, "utf8"));
   } catch {
     return null;
   }
 }
 function readTomlWorkspace(filePath) {
   try {
-    const content = fs2.readFileSync(filePath, "utf8");
+    const content = fs3.readFileSync(filePath, "utf8");
     return content.includes("[workspace]");
   } catch {
     return false;
@@ -778,9 +1293,9 @@ function readTomlWorkspace(filePath) {
 }
 
 // src/curation/index.ts
-import fs3 from "fs";
-import path4 from "path";
-import crypto from "crypto";
+import fs4 from "fs";
+import path8 from "path";
+import crypto3 from "crypto";
 async function curate(options) {
   const startTime = Date.now();
   const {
@@ -865,18 +1380,18 @@ async function curate(options) {
   };
 }
 function resolveTargets(targetPath) {
-  const stat = fs3.statSync(targetPath);
+  const stat = fs4.statSync(targetPath);
   if (stat.isFile()) return [targetPath];
   const results = [];
   const extensions = /* @__PURE__ */ new Set([".md", ".txt", ".mdx", ".rst"]);
   function walk(dir) {
-    for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
-      const fullPath = path4.join(dir, entry.name);
+    for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
+      const fullPath = path8.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name !== "node_modules" && entry.name !== ".git") {
           walk(fullPath);
         }
-      } else if (extensions.has(path4.extname(entry.name).toLowerCase())) {
+      } else if (extensions.has(path8.extname(entry.name).toLowerCase())) {
         results.push(fullPath);
       }
     }
@@ -885,7 +1400,7 @@ function resolveTargets(targetPath) {
   return results;
 }
 function extractStatements(content, filePath, projectRoot, source, sourceFileHash, categoryOverride, confidence, entityRef, tags) {
-  const relativePath = path4.relative(projectRoot, filePath);
+  const relativePath = path8.relative(projectRoot, filePath);
   const statements = [];
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const paragraphs = content.split(/\n{2,}/).map((p) => p.trim()).filter((p) => p.length > 20 && p.length < 2e3);
@@ -976,11 +1491,11 @@ function findContradiction(stmt, existing) {
 }
 function loadExistingMemories(memoryDir) {
   const result = /* @__PURE__ */ new Map();
-  if (!fs3.existsSync(memoryDir)) return result;
+  if (!fs4.existsSync(memoryDir)) return result;
   const dirs = ALL_CATEGORY_DIRS;
   for (const dir of dirs) {
-    const fullDir = path4.join(memoryDir, dir);
-    if (!fs3.existsSync(fullDir)) continue;
+    const fullDir = path8.join(memoryDir, dir);
+    if (!fs4.existsSync(fullDir)) continue;
     walkFiles(fullDir, (filePath) => {
       const content = readFileSafe(filePath);
       if (!content) return;
@@ -1001,10 +1516,10 @@ function writeStatement(stmt, memoryDir) {
   const now = /* @__PURE__ */ new Date();
   const dateDir = now.toISOString().split("T")[0];
   const categoryDir = getCategoryDir(memoryDir, stmt.category);
-  const dir = path4.join(categoryDir, dateDir);
-  fs3.mkdirSync(dir, { recursive: true });
+  const dir = path8.join(categoryDir, dateDir);
+  fs4.mkdirSync(dir, { recursive: true });
   const fileName = `${stmt.category}-${Date.now()}-${stmt.id.slice(0, 8)}.md`;
-  const filePath = path4.join(dir, fileName);
+  const filePath = path8.join(dir, fileName);
   const frontmatter = [
     "---",
     `id: ${stmt.id}`,
@@ -1025,17 +1540,17 @@ function writeStatement(stmt, memoryDir) {
 ${stmt.content}
 `;
   try {
-    fs3.writeFileSync(filePath, body);
+    fs4.writeFileSync(filePath, body);
     return filePath;
   } catch {
     return null;
   }
 }
 function generateId() {
-  return crypto.randomUUID();
+  return crypto3.randomUUID();
 }
 function hashContent(content) {
-  return crypto.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  return crypto3.createHash("sha256").update(content).digest("hex").slice(0, 16);
 }
 function tierFromConfidence(confidence) {
   if (confidence >= 0.95) return "explicit";
@@ -1045,7 +1560,7 @@ function tierFromConfidence(confidence) {
 }
 function readFileSafe(filePath) {
   try {
-    return fs3.readFileSync(filePath, "utf8");
+    return fs4.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -1074,8 +1589,8 @@ function extractBody2(content) {
   return match ? match[1].trim() : content.trim();
 }
 function walkFiles(dir, callback) {
-  for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path4.join(dir, entry.name);
+  for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path8.join(dir, entry.name);
     if (entry.isDirectory()) {
       walkFiles(fullPath, callback);
     } else if (entry.name.endsWith(".md")) {
@@ -1085,9 +1600,9 @@ function walkFiles(dir, callback) {
 }
 
 // src/dedup/index.ts
-import fs4 from "fs";
-import path5 from "path";
-import crypto2 from "crypto";
+import fs5 from "fs";
+import path9 from "path";
+import crypto4 from "crypto";
 function findDuplicates(options) {
   const startTime = Date.now();
   const { memoryDir, threshold = 0.85, maxLoad = 1e4 } = options;
@@ -1214,8 +1729,8 @@ function loadMemories(memoryDir, categories, maxLoad = 1e4) {
   const allCategories = categories ?? ALL_CATEGORY_DIRS;
   for (const category of allCategories) {
     if (result.length >= maxLoad) break;
-    const dir = path5.join(memoryDir, category);
-    if (!fs4.existsSync(dir)) continue;
+    const dir = path9.join(memoryDir, category);
+    if (!fs5.existsSync(dir)) continue;
     walkMdFiles(dir, (filePath) => {
       if (result.length >= maxLoad) return;
       const content = readFileSafe2(filePath);
@@ -1234,11 +1749,11 @@ function loadMemories(memoryDir, categories, maxLoad = 1e4) {
   return result;
 }
 function hashContent2(content) {
-  return crypto2.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  return crypto4.createHash("sha256").update(content).digest("hex").slice(0, 16);
 }
 function readFileSafe2(filePath) {
   try {
-    return fs4.readFileSync(filePath, "utf8");
+    return fs5.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -1261,8 +1776,8 @@ function extractBody3(content) {
   return match ? match[1].trim() : content.trim();
 }
 function walkMdFiles(dir, callback) {
-  for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path5.join(dir, entry.name);
+  for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path9.join(dir, entry.name);
     if (entry.isDirectory()) {
       walkMdFiles(fullPath, callback);
     } else if (entry.name.endsWith(".md")) {
@@ -1272,8 +1787,8 @@ function walkMdFiles(dir, callback) {
 }
 
 // src/review/index.ts
-import fs5 from "fs";
-import path6 from "path";
+import fs6 from "fs";
+import path10 from "path";
 function listReviewItems(options) {
   const startTime = Date.now();
   const {
@@ -1283,8 +1798,8 @@ function listReviewItems(options) {
     confidenceThreshold = 0.7
   } = options;
   const items = [];
-  const suggestionsDir = path6.join(memoryDir, "suggestions");
-  if (fs5.existsSync(suggestionsDir)) {
+  const suggestionsDir = path10.join(memoryDir, "suggestions");
+  if (fs6.existsSync(suggestionsDir)) {
     walkMd(suggestionsDir, (filePath, content) => {
       if (items.length >= limit) return;
       const fm = parseFrontmatter4(content);
@@ -1303,8 +1818,8 @@ function listReviewItems(options) {
       });
     });
   }
-  const reviewDir = path6.join(memoryDir, "review");
-  if (fs5.existsSync(reviewDir)) {
+  const reviewDir = path10.join(memoryDir, "review");
+  if (fs6.existsSync(reviewDir)) {
     walkMd(reviewDir, (filePath, content) => {
       if (items.length >= limit) return;
       const fm = parseFrontmatter4(content);
@@ -1327,8 +1842,8 @@ function listReviewItems(options) {
   const categories = ALL_CATEGORY_DIRS;
   for (const category of categories) {
     if (items.length >= limit) break;
-    const dir = path6.join(memoryDir, category);
-    if (!fs5.existsSync(dir)) continue;
+    const dir = path10.join(memoryDir, category);
+    if (!fs6.existsSync(dir)) continue;
     walkMd(dir, (filePath, content) => {
       if (items.length >= limit) return;
       const fm = parseFrontmatter4(content);
@@ -1370,22 +1885,22 @@ function performReview(memoryDir, itemId, action) {
 function approveItem(memoryDir, itemId) {
   const locations = ["suggestions", "review"];
   for (const loc of locations) {
-    const dir = path6.join(memoryDir, loc);
-    if (!fs5.existsSync(dir)) continue;
+    const dir = path10.join(memoryDir, loc);
+    if (!fs6.existsSync(dir)) continue;
     const found = findFileById(dir, itemId);
     if (!found) continue;
-    const content = fs5.readFileSync(found, "utf8");
+    const content = fs6.readFileSync(found, "utf8");
     const fm = parseFrontmatter4(content);
     const body = extractBody4(content);
     if (!fm) return { itemId, action: "approve", message: "Could not parse frontmatter" };
     const category = fm.category ?? "fact";
     const targetDir = getCategoryDir(memoryDir, category);
     const dateDir = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-    const outputPath = path6.join(targetDir, dateDir, path6.basename(found));
+    const outputPath = path10.join(targetDir, dateDir, path10.basename(found));
     const updatedContent = content.replace(/confidence: [\d.]+/, "confidence: 0.9").replace(/confidenceTier: \w+/, "confidenceTier: high");
-    fs5.mkdirSync(path6.dirname(outputPath), { recursive: true });
-    fs5.writeFileSync(outputPath, updatedContent);
-    fs5.unlinkSync(found);
+    fs6.mkdirSync(path10.dirname(outputPath), { recursive: true });
+    fs6.writeFileSync(outputPath, updatedContent);
+    fs6.unlinkSync(found);
     return {
       itemId,
       action: "approve",
@@ -1398,11 +1913,11 @@ function approveItem(memoryDir, itemId) {
 function dismissItem(memoryDir, itemId) {
   const locations = ["suggestions", "review"];
   for (const loc of locations) {
-    const dir = path6.join(memoryDir, loc);
-    if (!fs5.existsSync(dir)) continue;
+    const dir = path10.join(memoryDir, loc);
+    if (!fs6.existsSync(dir)) continue;
     const found = findFileById(dir, itemId);
     if (found) {
-      fs5.unlinkSync(found);
+      fs6.unlinkSync(found);
       return { itemId, action: "dismiss", message: "Dismissed and removed" };
     }
   }
@@ -1411,11 +1926,11 @@ function dismissItem(memoryDir, itemId) {
 function flagItem(memoryDir, itemId) {
   const locations = ["suggestions", "review"];
   for (const loc of locations) {
-    const dir = path6.join(memoryDir, loc);
-    if (!fs5.existsSync(dir)) continue;
+    const dir = path10.join(memoryDir, loc);
+    if (!fs6.existsSync(dir)) continue;
     const found = findFileById(dir, itemId);
     if (found) {
-      const content = fs5.readFileSync(found, "utf8");
+      const content = fs6.readFileSync(found, "utf8");
       const fixed = content.replace(
         /^(---\n)/,
         `---
@@ -1423,7 +1938,7 @@ flagged: true
 flaggedAt: ${(/* @__PURE__ */ new Date()).toISOString()}
 `
       );
-      fs5.writeFileSync(found, fixed);
+      fs6.writeFileSync(found, fixed);
       return { itemId, action: "flag", message: "Flagged for further review" };
     }
   }
@@ -1449,7 +1964,7 @@ function parseConfidence(value, fallback) {
 }
 function readFileSafe3(filePath) {
   try {
-    return fs5.readFileSync(filePath, "utf8");
+    return fs6.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -1472,8 +1987,8 @@ function extractBody4(content) {
   return match ? match[1].trim() : content.trim();
 }
 function walkMd(dir, callback) {
-  for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path6.join(dir, entry.name);
+  for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path10.join(dir, entry.name);
     if (entry.isDirectory()) {
       walkMd(fullPath, callback);
     } else if (entry.name.endsWith(".md")) {
@@ -1484,8 +1999,8 @@ function walkMd(dir, callback) {
 }
 function walkMdPaths(dir) {
   const results = [];
-  for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path6.join(dir, entry.name);
+  for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path10.join(dir, entry.name);
     if (entry.isDirectory()) {
       results.push(...walkMdPaths(fullPath));
     } else if (entry.name.endsWith(".md")) {
@@ -1496,9 +2011,9 @@ function walkMdPaths(dir) {
 }
 
 // src/sync/index.ts
-import fs6 from "fs";
-import path7 from "path";
-import crypto3 from "crypto";
+import fs7 from "fs";
+import path11 from "path";
+import crypto5 from "crypto";
 var DEFAULT_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".txt", ".mdx", ".rst"]);
 var DEFAULT_EXCLUDE2 = /* @__PURE__ */ new Set([
   "node_modules",
@@ -1519,7 +2034,7 @@ function syncChanges(options) {
   } = options;
   const extSet = new Set(extensions);
   const excludeSet = /* @__PURE__ */ new Set([...DEFAULT_EXCLUDE2, ...excludeDirs]);
-  const stateFilePath = options.stateFile ?? path7.join(memoryDir, ".sync-state.json");
+  const stateFilePath = options.stateFile ?? path11.join(memoryDir, ".sync-state.json");
   const prevState = loadState(stateFilePath);
   const currentFiles = scanFiles(sourceDir, extSet, excludeSet);
   const changes = computeDiff(currentFiles, prevState.fileHashes, sourceDir);
@@ -1535,8 +2050,8 @@ function syncChanges(options) {
     for (const [relPath, hash] of Object.entries(currentFiles)) {
       newState.fileHashes[relPath] = hash;
     }
-    fs6.mkdirSync(path7.dirname(stateFilePath), { recursive: true });
-    fs6.writeFileSync(stateFilePath, JSON.stringify(newState, null, 2));
+    fs7.mkdirSync(path11.dirname(stateFilePath), { recursive: true });
+    fs7.writeFileSync(stateFilePath, JSON.stringify(newState, null, 2));
   }
   return {
     scanned: Object.keys(currentFiles).length,
@@ -1578,21 +2093,21 @@ function scanFiles(root, extensions, exclude) {
   function walk(dir) {
     let entries;
     try {
-      entries = fs6.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (exclude.has(entry.name)) continue;
-      const fullPath = path7.join(dir, entry.name);
+      const fullPath = path11.join(dir, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
       } else if (entry.isFile()) {
-        const ext = path7.extname(entry.name).toLowerCase();
+        const ext = path11.extname(entry.name).toLowerCase();
         if (!extensions.has(ext)) continue;
-        const relPath = path7.relative(root, fullPath);
+        const relPath = path11.relative(root, fullPath);
         try {
-          const content = fs6.readFileSync(fullPath, "utf8");
+          const content = fs7.readFileSync(fullPath, "utf8");
           result[relPath] = hashContent3(content);
         } catch {
         }
@@ -1605,11 +2120,11 @@ function scanFiles(root, extensions, exclude) {
 function computeDiff(current, previous, sourceDir) {
   const changes = [];
   for (const [relPath, hash] of Object.entries(current)) {
-    const fullPath = path7.join(sourceDir, relPath);
+    const fullPath = path11.join(sourceDir, relPath);
     if (!(relPath in previous)) {
       let size = 0;
       try {
-        size = fs6.statSync(fullPath).size;
+        size = fs7.statSync(fullPath).size;
       } catch {
       }
       changes.push({
@@ -1622,7 +2137,7 @@ function computeDiff(current, previous, sourceDir) {
     } else if (previous[relPath] !== hash) {
       let size = 0;
       try {
-        size = fs6.statSync(fullPath).size;
+        size = fs7.statSync(fullPath).size;
       } catch {
       }
       changes.push({
@@ -1638,7 +2153,7 @@ function computeDiff(current, previous, sourceDir) {
   for (const relPath of Object.keys(previous)) {
     if (!(relPath in current)) {
       changes.push({
-        filePath: path7.join(sourceDir, relPath),
+        filePath: path11.join(sourceDir, relPath),
         relativePath: relPath,
         type: "deleted",
         currentHash: "",
@@ -1650,7 +2165,7 @@ function computeDiff(current, previous, sourceDir) {
 }
 function loadState(stateFilePath) {
   try {
-    const raw = fs6.readFileSync(stateFilePath, "utf8");
+    const raw = fs7.readFileSync(stateFilePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return {
@@ -1661,60 +2176,313 @@ function loadState(stateFilePath) {
   }
 }
 function hashContent3(content) {
-  return crypto3.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  return crypto5.createHash("sha256").update(content).digest("hex").slice(0, 16);
 }
 
 // src/connectors/index.ts
-import fs7 from "fs";
-import path8 from "path";
-var BUILTIN_CONNECTORS = [
-  {
-    id: "claude-code",
-    name: "Claude Code",
-    version: "1.0.0",
-    description: "Anthropic's Claude Code CLI \u2014 direct memory access via MCP",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: true,
-      entities: true,
-      realtimeSync: true,
-      batch: false,
-      maxBudgetChars: 32e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server",
-      namespace: "Optional namespace (default: 'default')"
-    },
-    homepage: "https://claude.ai/code",
-    author: "Anthropic",
-    tags: ["official", "ai", "claude"]
-  },
-  {
-    id: "codex-cli",
-    name: "Codex CLI",
-    version: "1.0.0",
-    description: "OpenAI Codex CLI \u2014 memory via MCP tool",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: false,
-      entities: false,
-      realtimeSync: false,
-      batch: true,
-      maxBudgetChars: 8e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server",
-      namespace: "Optional namespace"
-    },
-    homepage: "https://openai.com/codex",
-    author: "OpenAI",
-    tags: ["official", "ai", "codex"]
+import fs8 from "fs";
+import path13 from "path";
+import os from "os";
+import { spawnSync } from "child_process";
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+
+// src/connectors/codex-marketplace.ts
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import path12 from "path";
+var MARKETPLACE_SCHEMA_VERSION = 1;
+var MARKETPLACE_MANIFEST_FILENAME = "marketplace.json";
+var VALID_INSTALL_TYPES = /* @__PURE__ */ new Set(["github", "git", "local", "url"]);
+function generateMarketplaceManifest(options) {
+  const version = options?.packageVersion ?? readPackageVersion() ?? "0.0.0";
+  return {
+    version: MARKETPLACE_SCHEMA_VERSION,
+    name: "remnic",
+    description: "Remnic: Local-first AI memory with semantic search and consolidation",
+    plugins: [
+      {
+        name: "remnic",
+        version,
+        description: "Persistent memory plugin for Codex CLI",
+        repository: "joshuaswarren/remnic",
+        installType: "github",
+        entry: "packages/plugin-codex",
+        configSchema: "openclaw.plugin.json"
+      }
+    ]
+  };
+}
+function validateMarketplaceManifest(manifest) {
+  const validation = checkMarketplaceManifest(manifest);
+  if (!validation.valid) {
+    throw new Error(
+      `Invalid marketplace manifest: ${validation.errors.join("; ")}`
+    );
+  }
+  return manifest;
+}
+function checkMarketplaceManifest(manifest) {
+  const errors = [];
+  if (typeof manifest !== "object" || manifest === null) {
+    return { valid: false, errors: ["manifest must be a non-null object"] };
+  }
+  const obj = manifest;
+  if (obj.version !== MARKETPLACE_SCHEMA_VERSION) {
+    errors.push(`version must be ${MARKETPLACE_SCHEMA_VERSION}, got ${JSON.stringify(obj.version)}`);
+  }
+  if (typeof obj.name !== "string" || obj.name.trim().length === 0) {
+    errors.push("name must be a non-empty string");
+  }
+  if (typeof obj.description !== "string" || obj.description.trim().length === 0) {
+    errors.push("description must be a non-empty string");
+  }
+  if (!Array.isArray(obj.plugins)) {
+    errors.push("plugins must be an array");
+  } else if (obj.plugins.length === 0) {
+    errors.push("plugins must contain at least one entry");
+  } else {
+    for (let i = 0; i < obj.plugins.length; i++) {
+      const plugin = obj.plugins[i];
+      const prefix = `plugins[${i}]`;
+      if (typeof plugin !== "object" || plugin === null) {
+        errors.push(`${prefix} must be a non-null object`);
+        continue;
+      }
+      if (typeof plugin.name !== "string" || plugin.name.trim().length === 0) {
+        errors.push(`${prefix}.name must be a non-empty string`);
+      }
+      if (typeof plugin.version !== "string" || plugin.version.trim().length === 0) {
+        errors.push(`${prefix}.version must be a non-empty string`);
+      }
+      if (typeof plugin.description !== "string" || plugin.description.trim().length === 0) {
+        errors.push(`${prefix}.description must be a non-empty string`);
+      }
+      if (typeof plugin.repository !== "string" || plugin.repository.trim().length === 0) {
+        errors.push(`${prefix}.repository must be a non-empty string`);
+      }
+      if (typeof plugin.installType !== "string" || !VALID_INSTALL_TYPES.has(plugin.installType)) {
+        errors.push(
+          `${prefix}.installType must be one of: ${[...VALID_INSTALL_TYPES].join(", ")}; got ${JSON.stringify(plugin.installType)}`
+        );
+      }
+      if ("manifestUrl" in plugin && plugin.manifestUrl !== void 0) {
+        if (typeof plugin.manifestUrl !== "string" || plugin.manifestUrl.trim().length === 0) {
+          errors.push(`${prefix}.manifestUrl must be a non-empty string when provided`);
+        }
+      }
+      if ("entry" in plugin && plugin.entry !== void 0) {
+        if (typeof plugin.entry !== "string" || plugin.entry.trim().length === 0) {
+          errors.push(`${prefix}.entry must be a non-empty string when provided`);
+        }
+      }
+      if ("configSchema" in plugin && plugin.configSchema !== void 0) {
+        if (typeof plugin.configSchema !== "string" || plugin.configSchema.trim().length === 0) {
+          errors.push(`${prefix}.configSchema must be a non-empty string when provided`);
+        }
+      }
+    }
+  }
+  return { valid: errors.length === 0, errors };
+}
+async function writeMarketplaceManifest(outputDir, manifest) {
+  const validation = checkMarketplaceManifest(manifest);
+  if (!validation.valid) {
+    throw new Error(
+      `Refusing to write invalid manifest: ${validation.errors.join("; ")}`
+    );
+  }
+  mkdirSync(outputDir, { recursive: true });
+  const destPath = path12.join(outputDir, MARKETPLACE_MANIFEST_FILENAME);
+  const tmpPath = `${destPath}.tmp.${process.pid}`;
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  writeFileSync(tmpPath, content);
+  renameSync(tmpPath, destPath);
+}
+async function installFromMarketplace(source, sourceType, config, logger) {
+  const _log = logger ?? {
+    info: (msg) => log.info(`[marketplace] ${msg}`),
+    warn: (msg) => log.warn(`[marketplace] ${msg}`),
+    debug: (msg) => log.debug(`[marketplace] ${msg}`)
+  };
+  if (!config.codexMarketplaceEnabled) {
+    return {
+      ok: false,
+      message: "Codex marketplace is disabled in config (codexMarketplaceEnabled: false)",
+      source,
+      sourceType,
+      pluginsFound: [],
+      errors: ["marketplace_disabled"]
+    };
+  }
+  try {
+    const manifest = await resolveManifest(source, sourceType, _log);
+    const pluginNames = manifest.plugins.map((p) => p.name);
+    _log.info(`marketplace install: found ${pluginNames.length} plugin(s) from ${sourceType}://${source}`);
+    return {
+      ok: true,
+      message: `Successfully resolved ${pluginNames.length} plugin(s) from marketplace: ${pluginNames.join(", ")}`,
+      source,
+      sourceType,
+      pluginsFound: pluginNames,
+      errors: []
+    };
+  } catch (err) {
+    const errMsg = err instanceof Error ? err.message : String(err);
+    _log.warn(`marketplace install failed: ${errMsg}`);
+    return {
+      ok: false,
+      message: `Failed to install from marketplace: ${errMsg}`,
+      source,
+      sourceType,
+      pluginsFound: [],
+      errors: [errMsg]
+    };
+  }
+}
+async function resolveManifest(source, sourceType, logger) {
+  switch (sourceType) {
+    case "local":
+      return resolveLocal(source, logger);
+    case "url":
+      return resolveUrl(source, logger);
+    case "github":
+      return resolveGithub(source, logger);
+    case "git":
+      return resolveGit(source, logger);
+    default: {
+      const _ = sourceType;
+      throw new Error(`Invalid source type: ${String(_)}`);
+    }
+  }
+}
+function resolveLocal(dirPath, logger) {
+  const manifestPath2 = path12.join(dirPath, MARKETPLACE_MANIFEST_FILENAME);
+  if (!existsSync(manifestPath2)) {
+    throw new Error(`marketplace.json not found at ${manifestPath2}`);
+  }
+  logger.debug?.(`reading local marketplace manifest: ${manifestPath2}`);
+  const raw = readFileSync(manifestPath2, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Invalid JSON in ${manifestPath2}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`marketplace.json at ${manifestPath2} is not a valid object`);
+  }
+  return validateMarketplaceManifest(parsed);
+}
+async function resolveUrl(url, logger) {
+  logger.debug?.(`fetching marketplace manifest from URL: ${url}`);
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+  } catch {
+    throw new Error(`Invalid URL: ${url}`);
+  }
+  if (parsedUrl.protocol !== "https:" && parsedUrl.protocol !== "http:") {
+    throw new Error(`Unsupported URL protocol: ${parsedUrl.protocol} (use https or http)`);
+  }
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status} fetching ${url}`);
+  }
+  const body = await response.json();
+  return validateMarketplaceManifest(body);
+}
+async function resolveGithub(repo, logger) {
+  if (!/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/u.test(repo)) {
+    throw new Error(`Invalid GitHub repo format: "${repo}" (expected owner/repo)`);
+  }
+  const rawUrl = `https://raw.githubusercontent.com/${repo}/HEAD/${MARKETPLACE_MANIFEST_FILENAME}`;
+  logger.debug?.(`fetching marketplace manifest from GitHub: ${rawUrl}`);
+  return resolveUrl(rawUrl, logger);
+}
+async function resolveGit(gitUrl, logger) {
+  const ghMatch = gitUrl.match(
+    /^(?:https?:\/\/)?github\.com\/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+?)(?:\.git)?$/u
+  );
+  if (ghMatch?.[1]) {
+    logger.debug?.(`git URL looks like GitHub \u2014 delegating to github resolver`);
+    return resolveGithub(ghMatch[1], logger);
+  }
+  throw new Error(
+    `Git URL resolution requires a GitHub-format URL for now. Got: ${gitUrl}. Use --type github or --type url instead.`
+  );
+}
+function readPackageVersion() {
+  const candidates = [
+    path12.resolve(import.meta.dirname ?? ".", "../../../.."),
+    path12.resolve(import.meta.dirname ?? ".", "../../../../.."),
+    path12.resolve(import.meta.dirname ?? ".", "..")
+  ];
+  for (const candidate of candidates) {
+    const pkgPath = path12.join(candidate, "package.json");
+    try {
+      if (!existsSync(pkgPath)) continue;
+      const raw = readFileSync(pkgPath, "utf-8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed === "object" && parsed !== null && typeof parsed.version === "string") {
+        return parsed.version;
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+
+// src/connectors/index.ts
+var BUILTIN_CONNECTORS = [
+  {
+    id: "claude-code",
+    name: "Claude Code",
+    version: "1.0.0",
+    description: "Anthropic's Claude Code CLI \u2014 direct memory access via MCP",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: true,
+      entities: true,
+      realtimeSync: true,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server",
+      namespace: "Optional namespace (default: 'default')"
+    },
+    homepage: "https://claude.ai/code",
+    author: "Anthropic",
+    tags: ["official", "ai", "claude"],
+    requiresToken: true
+  },
+  {
+    id: "codex-cli",
+    name: "Codex CLI",
+    version: "1.0.0",
+    description: "OpenAI Codex CLI \u2014 memory via MCP tool",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: false,
+      entities: false,
+      realtimeSync: false,
+      batch: true,
+      maxBudgetChars: 8e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server",
+      namespace: "Optional namespace"
+    },
+    homepage: "https://openai.com/codex",
+    author: "OpenAI",
+    tags: ["official", "ai", "codex"],
+    requiresToken: true
   },
   {
     id: "cursor",
@@ -1878,7 +2646,8 @@ var BUILTIN_CONNECTORS = [
     },
     homepage: "https://replit.com",
     author: "Replit",
-    tags: ["official", "cloud"]
+    tags: ["official", "cloud"],
+    requiresToken: true
   },
   {
     id: "generic-mcp",
@@ -1903,17 +2672,72 @@ var BUILTIN_CONNECTORS = [
     },
     homepage: "https://github.com/joshuaswarren/remnic",
     author: "Remnic",
-    tags: ["generic", "mcp"]
+    tags: ["generic", "mcp"],
+    requiresToken: true
+  },
+  {
+    id: "weclone",
+    name: "WeClone Avatar",
+    version: "1.0.0",
+    description: "Memory-aware OpenAI-compatible proxy for deployed WeClone avatars \u2014 injects Remnic recall into chat completions and buffers turns via observe",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: false,
+      search: false,
+      entities: false,
+      realtimeSync: false,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "http"
+    },
+    configSchema: {
+      wecloneApiUrl: "Base URL of the WeClone OpenAI-compatible API (e.g. http://localhost:8000/v1)",
+      proxyPort: "Local port where the memory proxy will listen (default 8100)",
+      remnicDaemonUrl: "URL of the Remnic daemon exposing /engram/v1/recall and /engram/v1/observe",
+      sessionStrategy: "Per-caller session mapping strategy: 'caller-id' | 'single'",
+      wecloneModelName: "Optional fine-tuned model name passed through to WeClone"
+    },
+    homepage: "https://github.com/xming521/weclone",
+    author: "Remnic",
+    tags: ["official", "ai", "weclone", "proxy"],
+    requiresToken: true
+  },
+  {
+    id: "hermes",
+    name: "Hermes Agent",
+    version: "1.0.0",
+    description: "Hermes Agent MemoryProvider \u2014 automatic recall/observe on every turn via Python plugin protocol",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: true,
+      entities: false,
+      realtimeSync: true,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "http"
+    },
+    configSchema: {
+      host: "Remnic daemon host (default: 127.0.0.1)",
+      port: "Remnic daemon port (default: 4318)",
+      profile: "Hermes profile name (default: default)"
+    },
+    homepage: "https://github.com/joshuaswarren/remnic/tree/main/packages/plugin-hermes",
+    author: "Remnic",
+    tags: ["official", "python", "hermes"],
+    requiresToken: true
   }
 ];
 var REGISTRY_DIR_NAME = ".engram-connectors";
 function getRegistryPath() {
-  const configDir = process.env.XDG_CONFIG_HOME ? path8.join(process.env.XDG_CONFIG_HOME, "engram") : path8.join(process.env.HOME ?? "~", ".config", "engram");
-  return path8.join(configDir, REGISTRY_DIR_NAME, "registry.json");
+  const configDir = process.env.XDG_CONFIG_HOME ? path13.join(process.env.XDG_CONFIG_HOME, "engram") : path13.join(process.env.HOME ?? "~", ".config", "engram");
+  return path13.join(configDir, REGISTRY_DIR_NAME, "registry.json");
 }
 function loadRegistry() {
   const regPath = getRegistryPath();
-  if (!fs7.existsSync(regPath)) {
+  if (!fs8.existsSync(regPath)) {
     const registry = {
       connectors: BUILTIN_CONNECTORS,
       registryPath: regPath
@@ -1921,14 +2745,12 @@ function loadRegistry() {
     saveRegistry(registry);
     return registry;
   }
-  const raw = fs7.readFileSync(regPath, "utf8");
+  const raw = fs8.readFileSync(regPath, "utf8");
   try {
     const parsed = JSON.parse(raw);
-    const customIds = new Set((parsed.connectors ?? []).map((c) => c.id));
-    const merged = [
-      ...BUILTIN_CONNECTORS.filter((b) => !customIds.has(b.id)),
-      ...parsed.connectors ?? []
-    ];
+    const builtinIds = new Set(BUILTIN_CONNECTORS.map((b) => b.id));
+    const customOnly = (parsed.connectors ?? []).filter((c) => !builtinIds.has(c.id));
+    const merged = [...BUILTIN_CONNECTORS, ...customOnly];
     return {
       connectors: merged,
       registryPath: regPath
@@ -1944,19 +2766,19 @@ function loadRegistry() {
 }
 function saveRegistry(registry) {
   const regPath = registry.registryPath;
-  fs7.mkdirSync(path8.dirname(regPath), { recursive: true });
-  fs7.writeFileSync(regPath, JSON.stringify({ connectors: registry.connectors }, null, 2));
+  fs8.mkdirSync(path13.dirname(regPath), { recursive: true });
+  fs8.writeFileSync(regPath, JSON.stringify({ connectors: registry.connectors }, null, 2));
 }
 function listConnectors() {
   const registry = loadRegistry();
   const connectorsDir = getConnectorsDir();
   const installedIds = /* @__PURE__ */ new Set();
-  if (fs7.existsSync(connectorsDir)) {
-    for (const entry of fs7.readdirSync(connectorsDir)) {
+  if (fs8.existsSync(connectorsDir)) {
+    for (const entry of fs8.readdirSync(connectorsDir)) {
       if (entry.endsWith(".json")) {
         try {
           const config = JSON.parse(
-            fs7.readFileSync(path8.join(connectorsDir, entry), "utf8")
+            fs8.readFileSync(path13.join(connectorsDir, entry), "utf8")
           );
           installedIds.add(config.connectorId);
         } catch {
@@ -1970,14 +2792,15 @@ function listConnectors() {
   }));
   const installed = [];
   for (const id of installedIds) {
-    const configPath = path8.join(connectorsDir, `${id}.json`);
+    const configPath = path13.join(connectorsDir, `${id}.json`);
     try {
-      const config = JSON.parse(fs7.readFileSync(configPath, "utf8"));
+      const raw = JSON.parse(fs8.readFileSync(configPath, "utf8"));
+      const { token: _redacted, ...config } = raw;
       installed.push({
         connectorId: id,
         config,
         status: "installed",
-        installedAt: config.installedAt
+        installedAt: raw.installedAt
       });
     } catch {
     }
@@ -2005,38 +2828,890 @@ function installConnector(options) {
     };
   }
   const configDir = getConnectorsDir();
-  fs7.mkdirSync(configDir, { recursive: true });
-  const configPath = path8.join(configDir, `${options.connectorId}.json`);
+  fs8.mkdirSync(configDir, { recursive: true });
+  const configPath = path13.join(configDir, `${options.connectorId}.json`);
+  let hermesSavedProfile;
+  let hermesSavedHost;
+  let hermesSavedPort;
+  let hermesResolvedProfile;
+  let hermesResolvedHost;
+  let hermesResolvedPort;
+  if (options.connectorId === "hermes") {
+    if (fs8.existsSync(configPath)) {
+      try {
+        const prev = JSON.parse(fs8.readFileSync(configPath, "utf8"));
+        if (prev?.profile != null) {
+          try {
+            hermesSavedProfile = sanitizeHermesProfile(String(prev.profile));
+          } catch {
+          }
+        }
+        if (prev?.host != null) {
+          try {
+            hermesSavedHost = sanitizeHermesHost(String(prev.host));
+          } catch {
+          }
+        }
+        if (prev?.port != null) {
+          try {
+            const coercedPort = Number(String(prev.port));
+            hermesSavedPort = sanitizeHermesPort(coercedPort);
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+    hermesResolvedProfile = hermesSavedProfile ?? "default";
+    hermesResolvedHost = hermesSavedHost ?? "127.0.0.1";
+    if (options.config?.port !== void 0) {
+      try {
+        hermesResolvedPort = sanitizeHermesPort(Number(String(options.config.port)));
+      } catch (err) {
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (hermesResolvedPort === void 0) {
+      hermesResolvedPort = hermesSavedPort ?? 4318;
+    }
+    if (options.config?.profile !== void 0) {
+      try {
+        hermesResolvedProfile = sanitizeHermesProfile(String(options.config.profile));
+      } catch (err) {
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (options.config?.host !== void 0) {
+      try {
+        hermesResolvedHost = sanitizeHermesHost(String(options.config.host));
+      } catch (err) {
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+  }
+  const nonHermesPriorTokenStore = options.connectorId !== "hermes" && manifest.requiresToken ? loadTokenStore() : null;
+  let tokenEntry = null;
+  if (options.connectorId === "hermes") {
+    try {
+      tokenEntry = buildTokenEntry(options.connectorId);
+    } catch {
+    }
+  } else if (manifest.requiresToken) {
+    try {
+      tokenEntry = generateToken(options.connectorId);
+    } catch {
+      if (nonHermesPriorTokenStore !== null) {
+        try {
+          saveTokenStore(nonHermesPriorTokenStore);
+        } catch {
+        }
+      }
+    }
+  }
+  if (options.connectorId !== "hermes" && manifest.requiresToken && tokenEntry === null) {
+    return {
+      connectorId: options.connectorId,
+      status: "error",
+      message: `${manifest.name} install aborted: token generation failed. Run \`remnic token generate ${options.connectorId}\` to create the token, then reinstall.`
+    };
+  }
+  const { token: _callerToken, ...safeUserConfig } = options.config ?? {};
   const resolvedConfig = {
     connectorId: options.connectorId,
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    ...options.config
-  };
-  fs7.writeFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));
-  return {
-    connectorId: options.connectorId,
-    status: "installed",
-    configPath,
-    message: `Installed ${manifest.name} v${manifest.version}`
+    ...safeUserConfig,
+    // For hermes, always overlay the sanitized/coerced resolved values so that
+    // the connector JSON always has a numeric port and validated profile/host.
+    // This also ensures options.config string values (from --config=port=5555)
+    // are replaced with their sanitized numeric equivalents (Fix 2 root cause).
+    ...hermesResolvedProfile !== void 0 ? {
+      profile: hermesResolvedProfile,
+      host: hermesResolvedHost,
+      port: hermesResolvedPort
+    } : {}
   };
-}
-function removeConnector(connectorId) {
-  const configDir = getConnectorsDir();
-  const configPath = path8.join(configDir, `${connectorId}.json`);
-  if (!fs7.existsSync(configPath)) {
+  if (options.connectorId === "hermes") {
+    const rawProfile = hermesResolvedProfile;
+    const hermesHost = hermesResolvedHost;
+    const hermesPort = hermesResolvedPort;
+    let hermesProfile;
+    try {
+      hermesProfile = sanitizeHermesProfile(rawProfile);
+    } catch (err) {
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `Hermes install aborted: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    if (!tokenEntry) {
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: "Hermes install aborted: token store unavailable. Run `remnic token generate hermes` then reinstall to complete setup."
+      };
+    }
+    let yamlResult;
+    try {
+      yamlResult = upsertHermesConfig({
+        profile: hermesProfile,
+        host: hermesHost,
+        port: hermesPort,
+        token: tokenEntry.token
+      });
+    } catch (err) {
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `Hermes install aborted: config.yaml write failed \u2014 ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    if (!yamlResult.updated) {
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `Hermes install aborted: ${yamlResult.reason ?? "config.yaml not written"}. Create the Hermes profile directory first, then reinstall.`
+      };
+    }
+    const priorTokenStore = loadTokenStore();
+    let committed = false;
+    try {
+      commitTokenEntry(tokenEntry);
+      committed = true;
+    } catch (commitErr) {
+      let tokensRolledBack = true;
+      let tokensRollbackErrMsg = "";
+      try {
+        saveTokenStore(priorTokenStore);
+      } catch (tokenRestoreErr) {
+        tokensRolledBack = false;
+        tokensRollbackErrMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
+      }
+      let yamlRolledBack = true;
+      let yamlRollbackErrMsg = "";
+      try {
+        if (yamlResult.priorContent === null) {
+          fs8.unlinkSync(yamlResult.configPath);
+        } else if (typeof yamlResult.priorContent === "string") {
+          writeSecretFileSync(yamlResult.configPath, yamlResult.priorContent);
+        }
+      } catch (yamlRestoreErr) {
+        yamlRolledBack = false;
+        yamlRollbackErrMsg = yamlRestoreErr instanceof Error ? yamlRestoreErr.message : String(yamlRestoreErr);
+      }
+      const commitErrMsg = commitErr instanceof Error ? commitErr.message : String(commitErr);
+      let message;
+      if (tokensRolledBack && yamlRolledBack) {
+        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. config.yaml and tokens.json restored to prior state. Resolve the tokens.json access issue, then reinstall.`;
+      } else if (!yamlRolledBack && tokensRolledBack) {
+        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. tokens.json restored but config.yaml rollback ALSO failed (${yamlRollbackErrMsg}). Hermes daemon may be in an inconsistent state: config references a stale token. Manually inspect ~/.hermes/profiles/${hermesProfile}/config.yaml and reinstall.`;
+      } else if (yamlRolledBack && !tokensRolledBack) {
+        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. config.yaml restored but tokens.json rollback ALSO failed (${tokensRollbackErrMsg}). Hermes daemon may be in an inconsistent state: tokens.json is corrupt or incomplete. Manually inspect ~/.remnic/tokens.json and reinstall.`;
+      } else {
+        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. BOTH rollbacks failed: config.yaml rollback failed (${yamlRollbackErrMsg}); tokens.json rollback failed (${tokensRollbackErrMsg}). Hermes daemon is likely in an inconsistent state. Manually inspect ~/.hermes/profiles/${hermesProfile}/config.yaml and ~/.remnic/tokens.json, then reinstall.`;
+      }
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message
+      };
+    }
+    try {
+      writeSecretFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));
+    } catch (writeErr) {
+      let tokenRollbackFailed = false;
+      let tokenRollbackMsg = "token store restored to pre-install snapshot";
+      try {
+        saveTokenStore(priorTokenStore);
+      } catch (tokenRestoreErr) {
+        tokenRollbackFailed = true;
+        tokenRollbackMsg = `token rollback failed: ${tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr)}`;
+      }
+      let yamlRollbackMsg = "config.yaml restored";
+      try {
+        if (yamlResult.priorContent === null) {
+          let unlinkSucceeded = false;
+          let unlinkErr;
+          try {
+            fs8.unlinkSync(yamlResult.configPath);
+            unlinkSucceeded = true;
+          } catch (err) {
+            unlinkErr = err;
+          }
+          if (unlinkSucceeded) {
+            yamlRollbackMsg = "config.yaml removed (was newly created)";
+          } else {
+            const unlinkMsg = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
+            yamlRollbackMsg = `config.yaml rollback failed: could not remove newly-created file \u2014 ${unlinkMsg}`;
+          }
+        } else if (typeof yamlResult.priorContent === "string") {
+          writeSecretFileSync(yamlResult.configPath, yamlResult.priorContent);
+          yamlRollbackMsg = "config.yaml restored to prior content";
+        }
+      } catch (yamlRollbackErr) {
+        yamlRollbackMsg = `config.yaml rollback failed: ${yamlRollbackErr instanceof Error ? yamlRollbackErr.message : String(yamlRollbackErr)}`;
+      }
+      const urgentSuffix = tokenRollbackFailed ? ` tokens.json may be in an inconsistent state \u2014 manually restore hermes token with 'remnic token generate hermes'.` : "";
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `Hermes install aborted: connector config write failed \u2014 connector directory may not be writable. Rollback: ${tokenRollbackMsg}; ${yamlRollbackMsg}.${urgentSuffix} Resolve the permission issue, then reinstall.`
+      };
+    }
+    const notes = [];
+    notes.push(`Updated Hermes config: ${yamlResult.configPath}`);
+    let oldProfileResolvesToDifferentFile = false;
+    if (hermesSavedProfile !== void 0) {
+      try {
+        oldProfileResolvesToDifferentFile = hermesConfigPath(hermesSavedProfile) !== hermesConfigPath(hermesProfile);
+      } catch {
+        oldProfileResolvesToDifferentFile = false;
+      }
+    }
+    if (oldProfileResolvesToDifferentFile) {
+      try {
+        const oldCleanResult = removeHermesConfig({ profile: hermesSavedProfile });
+        if (oldCleanResult.updated) {
+          notes.push(`Cleaned stale remnic: block from previous profile: ${oldCleanResult.configPath}`);
+        }
+      } catch {
+        notes.push(`Note: could not clean stale remnic: block from previous profile "${hermesSavedProfile}"`);
+      }
+    }
+    if (committed && tokenEntry) {
+      const daemonOk = checkDaemonHealth(hermesHost, hermesPort, tokenEntry.token);
+      if (daemonOk) {
+        notes.push("Daemon health check: OK");
+      } else {
+        notes.push(
+          `Daemon not reachable at ${hermesHost}:${hermesPort} \u2014 start with: remnic daemon start`
+        );
+      }
+    }
+    const suffix = notes.length > 0 ? `
+  ${notes.join("\n  ")}` : "";
     return {
-      connectorId,
+      connectorId: options.connectorId,
+      status: "installed",
       configPath,
-      message: "Not installed"
+      message: `Installed ${manifest.name} v${manifest.version}${suffix}`
     };
   }
-  fs7.unlinkSync(configPath);
-  return {
-    connectorId,
-    configPath,
-    message: "Removed"
+  let extensionMessage = "";
+  let extensionInstalled = false;
+  let extensionHandle = null;
+  if (options.connectorId === "codex-cli") {
+    const coerced = coerceInstallExtension(resolvedConfig.installExtension);
+    if (coerced !== void 0) {
+      resolvedConfig.installExtension = coerced;
+    }
+    const shouldInstall = resolvedConfig.installExtension !== false;
+    resolvedConfig.installExtension = shouldInstall;
+    const codexHomeOverride = typeof resolvedConfig.codexHome === "string" && resolvedConfig.codexHome.length > 0 ? resolvedConfig.codexHome : null;
+    const resolvedCodexHome = resolveCodexHome(codexHomeOverride);
+    resolvedConfig.codexHome = resolvedCodexHome;
+    if (shouldInstall) {
+      try {
+        const extensionSourceOverride = typeof resolvedConfig.extensionSourceDir === "string" && resolvedConfig.extensionSourceDir.length > 0 ? resolvedConfig.extensionSourceDir : null;
+        const extResult = installCodexMemoryExtension({
+          codexHome: resolvedCodexHome,
+          sourceDir: extensionSourceOverride
+        });
+        extensionMessage = ` (memory extension: ${extResult.remnicExtensionDir})`;
+        extensionInstalled = true;
+        extensionHandle = extResult;
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : "unknown error";
+        let extensionErrTokenRolledBack = false;
+        let extensionErrTokenRollbackMsg = "";
+        if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
+          try {
+            saveTokenStore(nonHermesPriorTokenStore);
+            extensionErrTokenRolledBack = true;
+          } catch (tokenRestoreErr) {
+            extensionErrTokenRolledBack = false;
+            extensionErrTokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
+          }
+        }
+        const tokenRollbackSuffix = manifest.requiresToken ? extensionErrTokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${extensionErrTokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: `Memory extension install failed \u2014 ${errMsg}.${tokenRollbackSuffix} Resolve the issue, then reinstall.`
+        };
+      }
+    } else {
+      extensionMessage = " (memory extension: skipped via installExtension=false)";
+    }
+  }
+  let weCloneProxyHandleRollback = null;
+  if (options.connectorId === "weclone") {
+    try {
+      let proxyConfigPath = null;
+      if (existing && fs8.existsSync(configPath)) {
+        try {
+          const savedRegistryConfig = JSON.parse(fs8.readFileSync(configPath, "utf8"));
+          if (typeof savedRegistryConfig.proxyConfigPath === "string" && savedRegistryConfig.proxyConfigPath.length > 0) {
+            proxyConfigPath = savedRegistryConfig.proxyConfigPath;
+          }
+        } catch {
+        }
+      }
+      if (proxyConfigPath === null) {
+        proxyConfigPath = resolveWeCloneProxyConfigPath();
+      }
+      const prior = readWeCloneProxyConfigIfExists(proxyConfigPath);
+      const proxyConfig = buildWeCloneProxyConfig({
+        userConfig: safeUserConfig,
+        priorConfig: prior ? safeParseJson(prior) : null,
+        authToken: tokenEntry?.token
+      });
+      fs8.mkdirSync(path13.dirname(proxyConfigPath), { recursive: true });
+      weCloneProxyHandleRollback = () => {
+        try {
+          if (prior === null) {
+            if (fs8.existsSync(proxyConfigPath)) {
+              fs8.unlinkSync(proxyConfigPath);
+            }
+          } else {
+            writeSecretFileSync(proxyConfigPath, prior);
+          }
+        } catch {
+        }
+      };
+      try {
+        writeSecretFileSync(
+          proxyConfigPath,
+          JSON.stringify(proxyConfig, null, 2)
+        );
+      } catch (writeErr) {
+        try {
+          weCloneProxyHandleRollback();
+        } catch {
+        }
+        weCloneProxyHandleRollback = null;
+        throw writeErr;
+      }
+      resolvedConfig.proxyConfigPath = proxyConfigPath;
+      resolvedConfig.proxyPort = proxyConfig.proxyPort;
+      resolvedConfig.wecloneApiUrl = proxyConfig.wecloneApiUrl;
+      resolvedConfig.remnicDaemonUrl = proxyConfig.remnicDaemonUrl;
+      resolvedConfig.sessionStrategy = proxyConfig.sessionStrategy;
+    } catch (weCloneErr) {
+      let tokenRolledBack = false;
+      let tokenRollbackMsg = "";
+      if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
+        try {
+          saveTokenStore(nonHermesPriorTokenStore);
+          tokenRolledBack = true;
+        } catch (tokenRestoreErr) {
+          tokenRolledBack = false;
+          tokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
+        }
+      }
+      const tokenSuffix = manifest.requiresToken && tokenEntry !== null ? tokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${tokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `WeClone install aborted: proxy config write failed \u2014 ${weCloneErr instanceof Error ? weCloneErr.message : String(weCloneErr)}.${tokenSuffix} Resolve the write permission issue on ~/.remnic/connectors/, then reinstall.`
+      };
+    }
+  }
+  const INTERNAL_KEYS_DENYLIST = [
+    "extensionSourceDir"
+    // test-only override for the plugin-codex source path
+  ];
+  for (const key of INTERNAL_KEYS_DENYLIST) {
+    delete resolvedConfig[key];
+  }
+  try {
+    writeSecretFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));
+  } catch (writeErr) {
+    let configWriteTokenRolledBack = false;
+    let configWriteTokenRollbackMsg = "";
+    if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
+      try {
+        saveTokenStore(nonHermesPriorTokenStore);
+        configWriteTokenRolledBack = true;
+      } catch (tokenRestoreErr) {
+        configWriteTokenRolledBack = false;
+        configWriteTokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
+      }
+    }
+    if (extensionInstalled && extensionHandle !== null) {
+      try {
+        extensionHandle.rollback();
+      } catch {
+        console.warn(
+          "[remnic/connectors] installConnector: config write failed and extension rollback also failed \u2014 manual cleanup of memories_extensions/remnic may be required."
+        );
+      }
+    }
+    if (weCloneProxyHandleRollback !== null) {
+      try {
+        weCloneProxyHandleRollback();
+      } catch {
+      }
+    }
+    const configWriteTokenSuffix = manifest.requiresToken && tokenEntry !== null ? configWriteTokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${configWriteTokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
+    return {
+      connectorId: options.connectorId,
+      status: "error",
+      message: `${manifest.name} install aborted: connector config write failed \u2014 ${writeErr instanceof Error ? writeErr.message : String(writeErr)}.${configWriteTokenSuffix} Resolve the write permission issue, then reinstall.`
+    };
+  }
+  if (extensionInstalled && extensionHandle !== null) {
+    extensionHandle.commit();
+  }
+  return {
+    connectorId: options.connectorId,
+    status: "installed",
+    configPath,
+    message: `Installed ${manifest.name} v${manifest.version}${extensionMessage}`
+  };
+}
+function removeConnector(connectorId) {
+  const configDir = getConnectorsDir();
+  const configPath = path13.join(configDir, `${connectorId}.json`);
+  let codexHomeOverride = null;
+  let savedInstallExtension = void 0;
+  let configParsed = false;
+  if (connectorId === "codex-cli" && fs8.existsSync(configPath)) {
+    try {
+      const parsed = JSON.parse(fs8.readFileSync(configPath, "utf8"));
+      configParsed = true;
+      if (typeof parsed.codexHome === "string" && parsed.codexHome.length > 0) {
+        codexHomeOverride = parsed.codexHome;
+      }
+      const coerced = coerceInstallExtension(parsed.installExtension);
+      if (coerced !== void 0) {
+        savedInstallExtension = coerced;
+      }
+    } catch {
+      console.debug(
+        "[remnic/connectors] removeConnector: codex-cli.json parse failed \u2014 skipping extension removal to avoid touching unverified paths"
+      );
+    }
+  }
+  if (!fs8.existsSync(configPath)) {
+    let staleTokenRevoked = false;
+    try {
+      staleTokenRevoked = revokeToken(connectorId);
+    } catch {
+    }
+    const message = staleTokenRevoked ? `${connectorId} is not installed. Removed stale token entry for ${connectorId}.` : "Not installed";
+    return {
+      connectorId,
+      configPath,
+      status: "not_found",
+      message
+    };
+  }
+  let storedProfile = "default";
+  if (connectorId === "hermes") {
+    try {
+      const stored = JSON.parse(fs8.readFileSync(configPath, "utf8"));
+      if (typeof stored?.profile === "string") storedProfile = stored.profile;
+    } catch {
+    }
+  }
+  let weCloneProxyConfigPath = null;
+  let weCloneRegistryParseFailed = false;
+  if (connectorId === "weclone") {
+    try {
+      const stored = JSON.parse(fs8.readFileSync(configPath, "utf8"));
+      if (typeof stored.proxyConfigPath === "string" && stored.proxyConfigPath.length > 0) {
+        weCloneProxyConfigPath = stored.proxyConfigPath;
+      }
+    } catch {
+      weCloneRegistryParseFailed = true;
+    }
+    if (weCloneProxyConfigPath === null && !weCloneRegistryParseFailed) {
+      try {
+        weCloneProxyConfigPath = resolveWeCloneProxyConfigPath();
+      } catch {
+      }
+    }
+  }
+  if (connectorId === "weclone" && weCloneRegistryParseFailed) {
+    console.warn(
+      "[remnic/connectors] removeConnector: weclone.json is malformed \u2014 aborting removal to preserve provenance. Fix or delete " + configPath + " manually and retry."
+    );
+    return {
+      connectorId,
+      configPath,
+      message: "Removal aborted: weclone.json is malformed. Registry config left in place for inspection; proxy config NOT removed.",
+      status: "skipped",
+      reason: "config-parse-failed"
+    };
+  }
+  if (connectorId === "codex-cli" && fs8.existsSync(configPath) && !configParsed) {
+    console.warn(
+      "[remnic/connectors] removeConnector: codex-cli.json is malformed \u2014 aborting removal to preserve provenance. Fix or delete " + configPath + " manually and retry."
+    );
+    return {
+      connectorId,
+      configPath,
+      message: "Removal aborted: codex-cli.json is malformed. Config file left in place for inspection.",
+      status: "skipped",
+      reason: "config-parse-failed"
+    };
+  }
+  let extensionMessage = "";
+  if (connectorId === "codex-cli") {
+    if (savedInstallExtension === false) {
+      extensionMessage = " (memory extension: skipped \u2014 installExtension=false)";
+    } else if (savedInstallExtension !== true || codexHomeOverride === null) {
+      extensionMessage = " (memory extension: skipped \u2014 no install provenance in saved config)";
+    } else {
+      const extResult = removeCodexMemoryExtension({ codexHome: codexHomeOverride });
+      extensionMessage = extResult.removed ? ` (memory extension removed: ${extResult.remnicExtensionDir})` : " (no memory extension present)";
+    }
+  }
+  try {
+    fs8.unlinkSync(configPath);
+  } catch (unlinkErr) {
+    const sanitizedErr = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
+    return {
+      connectorId,
+      configPath,
+      status: "error",
+      message: `${connectorId} remove aborted: could not delete connector file (${sanitizedErr}). Token and any connector-specific state were not modified.`
+    };
+  }
+  const notes = [];
+  let tokenRevoked = true;
+  try {
+    revokeToken(connectorId);
+  } catch (revokeErr) {
+    tokenRevoked = false;
+    const revokeMsg = revokeErr instanceof Error ? revokeErr.message : String(revokeErr);
+    notes.push(`Warning: token revocation failed \u2014 ${revokeMsg}. The token for ${connectorId} may still be present in tokens.json.`);
+  }
+  let weCloneProxyDeleteFailed = null;
+  if (connectorId === "weclone") {
+    if (weCloneProxyConfigPath === null) {
+      notes.push(
+        "WeClone proxy config cleanup skipped: no persisted path found in saved config (likely a legacy install predating proxyConfigPath provenance)."
+      );
+    } else {
+      const expectedSuffix = path13.join("connectors", "weclone.json");
+      const isSafePath = path13.isAbsolute(weCloneProxyConfigPath) && weCloneProxyConfigPath.endsWith(expectedSuffix);
+      if (!isSafePath) {
+        weCloneProxyDeleteFailed = `Proxy config path ${JSON.stringify(weCloneProxyConfigPath)} failed safety validation (must be absolute and end with "${expectedSuffix}"). Refusing to delete \u2014 remove the file manually if it exists.`;
+      } else {
+        try {
+          if (fs8.existsSync(weCloneProxyConfigPath)) {
+            fs8.unlinkSync(weCloneProxyConfigPath);
+            notes.push(`Removed WeClone proxy config: ${weCloneProxyConfigPath}`);
+          }
+        } catch (err) {
+          weCloneProxyDeleteFailed = err instanceof Error ? err.message : String(err);
+        }
+      }
+    }
+  }
+  if (weCloneProxyDeleteFailed !== null && weCloneProxyConfigPath !== null) {
+    const tokenStatus = tokenRevoked ? "the registry config was deleted and the token was revoked" : "the registry config was deleted but TOKEN REVOCATION ALSO FAILED \u2014 inspect ~/.remnic/tokens.json and revoke manually";
+    return {
+      connectorId,
+      configPath,
+      status: "error",
+      message: `WeClone remove partially succeeded: ${tokenStatus}, but the proxy config at ${weCloneProxyConfigPath} could not be deleted (${weCloneProxyDeleteFailed}). Manually remove that file \u2014 it may still contain a Remnic daemon bearer token.`
+    };
+  }
+  if (connectorId === "hermes") {
+    try {
+      const yamlResult = removeHermesConfig({ profile: storedProfile });
+      if (yamlResult.updated) {
+        notes.push(`Removed remnic: block from Hermes config: ${yamlResult.configPath}`);
+      } else if (yamlResult.skipped) {
+        notes.push(`Hermes config cleanup skipped: ${yamlResult.reason}`);
+      }
+    } catch (err) {
+      notes.push(
+        `Hermes config cleanup skipped: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  const suffix = notes.length > 0 ? `
+  ${notes.join("\n  ")}` : "";
+  return {
+    connectorId,
+    configPath,
+    status: "removed",
+    message: `Removed${extensionMessage}${suffix}`
   };
 }
+function sanitizeHermesProfile(profile) {
+  if (typeof profile !== "string" || profile.length === 0) {
+    throw new Error("Hermes profile name must be a non-empty string");
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(profile)) {
+    throw new Error(
+      `Invalid Hermes profile name: ${JSON.stringify(profile)} \u2014 must match [A-Za-z0-9][A-Za-z0-9._-]*`
+    );
+  }
+  if (profile.includes("..")) {
+    throw new Error(`Invalid Hermes profile name: ${JSON.stringify(profile)} \u2014 must not contain ".."`);
+  }
+  return profile;
+}
+function hermesConfigPath(profile) {
+  const safeProfile = sanitizeHermesProfile(profile);
+  const profilesRoot = path13.resolve(process.env.HOME ?? os.homedir(), ".hermes", "profiles");
+  const cfgPath = path13.resolve(profilesRoot, safeProfile, "config.yaml");
+  const rel = path13.relative(profilesRoot, cfgPath);
+  if (rel.startsWith("..") || path13.isAbsolute(rel)) {
+    throw new Error(
+      `Invalid Hermes profile path: resolved outside ${profilesRoot}`
+    );
+  }
+  return cfgPath;
+}
+function sanitizeHermesHost(host) {
+  if (typeof host !== "string" || host.length === 0) {
+    throw new Error("Hermes host must be a non-empty string");
+  }
+  if (host.length > 253) {
+    throw new Error(`Hermes host too long (max 253 chars): ${JSON.stringify(host.slice(0, 32))}\u2026`);
+  }
+  if (host.startsWith("[")) {
+    if (!host.endsWith("]")) {
+      throw new Error(
+        `Invalid Hermes host: ${JSON.stringify(host)} \u2014 unbalanced brackets in IPv6 literal`
+      );
+    }
+    const inner = host.slice(1, -1);
+    if (inner.length === 0 || !/^[0-9A-Fa-f:]+$/.test(inner)) {
+      throw new Error(
+        `Invalid Hermes host: ${JSON.stringify(host)} \u2014 bracketed IPv6 literal must contain only hex digits and colons`
+      );
+    }
+    return host;
+  }
+  if (host.includes(":")) {
+    throw new Error(
+      `Invalid Hermes host: ${JSON.stringify(host)} \u2014 host must not include a port; supply the port separately with --config port=<n>`
+    );
+  }
+  if (!/^[A-Za-z0-9._\-]+$/.test(host)) {
+    throw new Error(
+      `Invalid Hermes host: ${JSON.stringify(host)} \u2014 must be a plain hostname or IP literal`
+    );
+  }
+  return host;
+}
+function sanitizeHermesPort(port) {
+  const numeric = Number(port);
+  if (!Number.isInteger(numeric)) {
+    throw new Error(
+      `Invalid Hermes port "${port}": must be a positive integer`
+    );
+  }
+  if (numeric < 1 || numeric > 65535) {
+    throw new Error(`Invalid Hermes port: ${JSON.stringify(port)} \u2014 must be an integer in [1, 65535]`);
+  }
+  return numeric;
+}
+function writeSecretFileSync(filePath, data) {
+  fs8.writeFileSync(filePath, data, { mode: 384 });
+  try {
+    fs8.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function upsertHermesConfig(opts) {
+  const cfgPath = hermesConfigPath(opts.profile);
+  const profileDir = path13.dirname(cfgPath);
+  const safeHost = sanitizeHermesHost(opts.host);
+  const safePort = sanitizeHermesPort(opts.port);
+  if (!/^[A-Za-z0-9_]+$/.test(opts.token)) {
+    throw new Error("Invalid Hermes token: contains non-alphanumeric characters");
+  }
+  if (!fs8.existsSync(profileDir)) {
+    return {
+      updated: false,
+      skipped: true,
+      reason: `Hermes profile directory not found: ${profileDir}`,
+      configPath: cfgPath
+    };
+  }
+  const block = [
+    "remnic:",
+    `  host: "${safeHost}"`,
+    `  port: ${safePort}`,
+    `  token: "${opts.token}"`
+  ].join("\n");
+  if (!fs8.existsSync(cfgPath)) {
+    writeSecretFileSync(cfgPath, block + "\n");
+    return { updated: true, skipped: false, configPath: cfgPath, priorContent: null };
+  }
+  const raw = fs8.readFileSync(cfgPath, "utf8");
+  const hasRemnicBlock = /^remnic:/m.test(raw);
+  if (!hasRemnicBlock) {
+    const separator = raw.endsWith("\n") ? "\n" : "\n\n";
+    writeSecretFileSync(cfgPath, raw + separator + block + "\n");
+    return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };
+  }
+  const splitLines = raw.split("\n");
+  if (splitLines.length > 0 && splitLines[splitLines.length - 1] === "") {
+    splitLines.pop();
+  }
+  const lines = splitLines;
+  const newLines = [];
+  let inRemnicBlock = false;
+  let blockWritten = false;
+  const written = { host: false, port: false, token: false };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^remnic:/.test(line)) {
+      inRemnicBlock = true;
+      newLines.push(line);
+      continue;
+    }
+    if (inRemnicBlock) {
+      if (line.length > 0 && !/^\s/.test(line)) {
+        if (!written.host) newLines.push(`  host: "${safeHost}"`);
+        if (!written.port) newLines.push(`  port: ${safePort}`);
+        if (!written.token) newLines.push(`  token: "${opts.token}"`);
+        blockWritten = true;
+        inRemnicBlock = false;
+        newLines.push(line);
+        continue;
+      }
+      if (/^\s+host:/.test(line)) {
+        newLines.push(`  host: "${safeHost}"`);
+        written.host = true;
+      } else if (/^\s+port:/.test(line)) {
+        newLines.push(`  port: ${safePort}`);
+        written.port = true;
+      } else if (/^\s+token:/.test(line)) {
+        newLines.push(`  token: "${opts.token}"`);
+        written.token = true;
+      } else {
+        newLines.push(line);
+      }
+      continue;
+    }
+    newLines.push(line);
+  }
+  if (inRemnicBlock && !blockWritten) {
+    if (!written.host) newLines.push(`  host: "${safeHost}"`);
+    if (!written.port) newLines.push(`  port: ${safePort}`);
+    if (!written.token) newLines.push(`  token: "${opts.token}"`);
+  }
+  writeSecretFileSync(cfgPath, newLines.join("\n") + "\n");
+  return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };
+}
+function removeHermesConfig(opts) {
+  const cfgPath = hermesConfigPath(opts.profile);
+  if (!fs8.existsSync(cfgPath)) {
+    return {
+      updated: false,
+      skipped: true,
+      reason: "Hermes config.yaml not found",
+      configPath: cfgPath
+    };
+  }
+  const raw = fs8.readFileSync(cfgPath, "utf8");
+  if (!/^remnic:/m.test(raw)) {
+    return {
+      updated: false,
+      skipped: true,
+      reason: "No remnic: block found in config.yaml",
+      configPath: cfgPath
+    };
+  }
+  const lines = raw.split("\n");
+  const newLines = [];
+  let inRemnicBlock = false;
+  for (const line of lines) {
+    if (/^remnic:/.test(line)) {
+      inRemnicBlock = true;
+      continue;
+    }
+    if (inRemnicBlock) {
+      if (line.length > 0 && !/^\s/.test(line)) {
+        inRemnicBlock = false;
+        newLines.push(line);
+      }
+      continue;
+    }
+    newLines.push(line);
+  }
+  while (newLines.length > 0 && newLines[newLines.length - 1]?.trim() === "") {
+    newLines.pop();
+  }
+  writeSecretFileSync(cfgPath, newLines.length > 0 ? newLines.join("\n") + "\n" : "");
+  return { updated: true, skipped: false, configPath: cfgPath };
+}
+var HEALTH_EXIT_OK = 0;
+var HEALTH_EXIT_UNAUTHORIZED = 2;
+function checkDaemonHealth(host, port, authToken) {
+  try {
+    const safePort = Math.trunc(Number(port));
+    if (!Number.isFinite(safePort) || safePort < 1 || safePort > 65535) {
+      return false;
+    }
+    const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    const script = [
+      "const http = require('http');",
+      "const headers = {};",
+      "if (process.env.REMNIC_HEALTH_TOKEN) {",
+      "  headers['authorization'] = 'Bearer ' + process.env.REMNIC_HEALTH_TOKEN;",
+      "}",
+      "const req = http.get({",
+      "  host: process.env.REMNIC_HEALTH_HOST,",
+      "  port: parseInt(process.env.REMNIC_HEALTH_PORT, 10),",
+      "  path: '/engram/v1/health',",
+      "  headers,",
+      "  timeout: 3000,",
+      "}, (res) => { process.exit(res.statusCode === 200 ? 0 : res.statusCode === 401 ? 2 : 1); });",
+      "req.on('error', () => process.exit(1));",
+      "req.on('timeout', () => { req.destroy(); process.exit(1); });"
+    ].join("\n");
+    const env = {
+      ...process.env,
+      REMNIC_HEALTH_HOST: bareHost,
+      REMNIC_HEALTH_PORT: String(safePort)
+    };
+    if (authToken) {
+      env.REMNIC_HEALTH_TOKEN = authToken;
+    }
+    const spawnOpts = { timeout: 4e3, env };
+    const result = spawnSync(process.execPath, ["-e", script], spawnOpts);
+    if (result.status === HEALTH_EXIT_OK) {
+      return true;
+    }
+    if (result.status === HEALTH_EXIT_UNAUTHORIZED) {
+      console.error(
+        "[remnic/connectors] health probe got 401 \u2014 retrying after token cache TTL..."
+      );
+      spawnSync(process.execPath, ["-e", "setTimeout(() => {}, 6000)"], {
+        timeout: 7e3,
+        env: {}
+      });
+      const retry = spawnSync(process.execPath, ["-e", script], spawnOpts);
+      return retry.status === HEALTH_EXIT_OK;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
 async function doctorConnector(connectorId) {
   const installed = listConnectors().installed;
   const instance = installed.find((c) => c.connectorId === connectorId);
@@ -2047,15 +3722,15 @@ async function doctorConnector(connectorId) {
       healthy: false
     };
   }
-  const configPath = path8.join(getConnectorsDir(), `${connectorId}.json`);
+  const configPath = path13.join(getConnectorsDir(), `${connectorId}.json`);
   const checks = [];
   checks.push({
     name: "Config file",
-    ok: fs7.existsSync(configPath),
+    ok: fs8.existsSync(configPath),
     detail: configPath
   });
   try {
-    const raw = fs7.readFileSync(configPath, "utf8");
+    const raw = fs8.readFileSync(configPath, "utf8");
     JSON.parse(raw);
     checks.push({ name: "Config valid", ok: true, detail: "OK" });
   } catch (e) {
@@ -2077,37 +3752,398 @@ async function doctorConnector(connectorId) {
       });
     }
   }
-  const memoryDir = instance.config.memoryDir;
-  if (memoryDir) {
-    if (fs7.existsSync(memoryDir)) {
-      checks.push({ name: "Memory directory", ok: true, detail: memoryDir });
-    } else {
-      checks.push({ name: "Memory directory", ok: false, detail: `Not found: ${memoryDir}` });
+  const memoryDir = instance.config.memoryDir;
+  if (memoryDir) {
+    if (fs8.existsSync(memoryDir)) {
+      checks.push({ name: "Memory directory", ok: true, detail: memoryDir });
+    } else {
+      checks.push({ name: "Memory directory", ok: false, detail: `Not found: ${memoryDir}` });
+    }
+  }
+  const healthy = checks.every((c) => c.ok);
+  return { connectorId, checks, healthy };
+}
+var CODEX_MEMORIES_SUBDIR = "memories";
+var CODEX_EXTENSIONS_SUBDIR = "memories_extensions";
+var REMNIC_EXTENSION_DIR_NAME = "remnic";
+function resolveCodexHome(override) {
+  if (override && typeof override === "string" && override.trim().length > 0) {
+    return path13.resolve(override.trim());
+  }
+  const envHome = process.env.CODEX_HOME;
+  if (envHome && envHome.trim().length > 0) {
+    return path13.resolve(envHome.trim());
+  }
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "~";
+  return path13.resolve(home, ".codex");
+}
+function resolveCodexMemoryExtensionPaths(codexHomeOverride) {
+  const codexHome = resolveCodexHome(codexHomeOverride);
+  const memoriesDir = path13.join(codexHome, CODEX_MEMORIES_SUBDIR);
+  const extensionsRoot = path13.join(path13.dirname(memoriesDir), CODEX_EXTENSIONS_SUBDIR);
+  const remnicExtensionDir = path13.join(extensionsRoot, REMNIC_EXTENSION_DIR_NAME);
+  return { codexHome, memoriesDir, extensionsRoot, remnicExtensionDir };
+}
+function locatePluginCodexExtensionSource(override) {
+  if (override && typeof override === "string" && override.trim().length > 0) {
+    const resolved = path13.resolve(override.trim());
+    if (fs8.existsSync(resolved) && fs8.statSync(resolved).isDirectory()) {
+      return resolved;
+    }
+    throw new Error(`Codex extension source directory not found: ${resolved}`);
+  }
+  const EXTENSION_SUBPATH = path13.join("memories_extensions", "remnic");
+  const WORKSPACE_RELATIVE_PATH = path13.join(
+    "packages",
+    "plugin-codex",
+    "memories_extensions",
+    "remnic"
+  );
+  const searched = [];
+  try {
+    const moduleDir = path13.dirname(fileURLToPath(import.meta.url));
+    const bundledCandidate = path13.join(moduleDir, "codex");
+    searched.push(bundledCandidate);
+    if (fs8.existsSync(bundledCandidate) && fs8.statSync(bundledCandidate).isDirectory()) {
+      return bundledCandidate;
+    }
+    const distConnectorsCandidate = path13.join(moduleDir, "connectors", "codex");
+    searched.push(distConnectorsCandidate);
+    if (fs8.existsSync(distConnectorsCandidate) && fs8.statSync(distConnectorsCandidate).isDirectory()) {
+      return distConnectorsCandidate;
+    }
+  } catch {
+  }
+  try {
+    const requireFromHere = createRequire(import.meta.url);
+    const pluginPkgJsonPath = requireFromHere.resolve("@remnic/plugin-codex/package.json");
+    const pluginPkgRoot = path13.dirname(pluginPkgJsonPath);
+    const candidate = path13.join(pluginPkgRoot, EXTENSION_SUBPATH);
+    searched.push(candidate);
+    if (fs8.existsSync(candidate) && fs8.statSync(candidate).isDirectory()) {
+      return candidate;
+    }
+  } catch {
+  }
+  try {
+    const moduleDir = path13.dirname(fileURLToPath(import.meta.url));
+    let dir = moduleDir;
+    for (let depth = 0; depth < 8; depth += 1) {
+      const candidate = path13.join(
+        dir,
+        "node_modules",
+        "@remnic",
+        "plugin-codex",
+        EXTENSION_SUBPATH
+      );
+      searched.push(candidate);
+      if (fs8.existsSync(candidate) && fs8.statSync(candidate).isDirectory()) {
+        return candidate;
+      }
+      const parent = path13.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch {
+  }
+  const anchors = [];
+  try {
+    anchors.push(path13.dirname(fileURLToPath(import.meta.url)));
+  } catch {
+  }
+  anchors.push(process.cwd());
+  for (const anchor of anchors) {
+    let dir = anchor;
+    for (let depth = 0; depth < 12; depth += 1) {
+      const candidate = path13.join(dir, WORKSPACE_RELATIVE_PATH);
+      searched.push(candidate);
+      if (fs8.existsSync(candidate) && fs8.statSync(candidate).isDirectory()) {
+        return candidate;
+      }
+      const parent = path13.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  throw new Error(
+    "Could not locate the plugin-codex memories_extensions/remnic source directory.\nPaths searched:\n" + searched.map((p) => `  - ${p}`).join("\n") + "\nInstall @remnic/plugin-codex or pass sourceDir explicitly."
+  );
+}
+function copyDirRecursiveSync(src, dest) {
+  let count = 0;
+  fs8.mkdirSync(dest, { recursive: true });
+  const entries = fs8.readdirSync(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const from = path13.join(src, entry.name);
+    const to = path13.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      count += copyDirRecursiveSync(from, to);
+    } else if (entry.isFile()) {
+      fs8.copyFileSync(from, to);
+      count += 1;
+    }
+  }
+  return count;
+}
+function installCodexMemoryExtension(options = {}) {
+  const paths = resolveCodexMemoryExtensionPaths(options.codexHome ?? null);
+  const sourceDir = locatePluginCodexExtensionSource(options.sourceDir ?? null);
+  fs8.mkdirSync(paths.extensionsRoot, { recursive: true });
+  const tmpPrefix = `.${REMNIC_EXTENSION_DIR_NAME}.tmp-`;
+  const STALE_TMP_THRESHOLD_MS = 10 * 60 * 1e3;
+  const now = Date.now();
+  try {
+    const existingEntries = fs8.readdirSync(paths.extensionsRoot);
+    for (const entry of existingEntries) {
+      if (!entry.startsWith(tmpPrefix)) continue;
+      const stalePath = path13.join(paths.extensionsRoot, entry);
+      try {
+        const stat = fs8.statSync(stalePath);
+        const ageMs = now - stat.mtimeMs;
+        if (ageMs < STALE_TMP_THRESHOLD_MS) {
+          continue;
+        }
+        fs8.rmSync(stalePath, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  } catch {
+  }
+  const tmpName = `${tmpPrefix}${process.pid}-${Date.now()}`;
+  const tmpDir = path13.join(paths.extensionsRoot, tmpName);
+  let filesCopied = 0;
+  let commitFn = () => {
+  };
+  let rollbackFn = () => {
+  };
+  try {
+    filesCopied = copyDirRecursiveSync(sourceDir, tmpDir);
+    const backupDir = `${paths.remnicExtensionDir}.bak-${Date.now()}`;
+    const hadExisting = fs8.existsSync(paths.remnicExtensionDir);
+    if (hadExisting) {
+      fs8.renameSync(paths.remnicExtensionDir, backupDir);
+    }
+    try {
+      fs8.renameSync(tmpDir, paths.remnicExtensionDir);
+    } catch (renameErr) {
+      if (hadExisting) {
+        try {
+          fs8.renameSync(backupDir, paths.remnicExtensionDir);
+        } catch {
+        }
+      }
+      throw renameErr;
+    }
+    commitFn = () => {
+      if (hadExisting) {
+        try {
+          fs8.rmSync(backupDir, { recursive: true, force: true });
+        } catch {
+        }
+      }
+    };
+    rollbackFn = () => {
+      if (hadExisting) {
+        try {
+          if (fs8.existsSync(paths.remnicExtensionDir)) {
+            fs8.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
+          }
+          fs8.renameSync(backupDir, paths.remnicExtensionDir);
+        } catch {
+        }
+      } else {
+        try {
+          if (fs8.existsSync(paths.remnicExtensionDir)) {
+            fs8.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
+          }
+        } catch {
+        }
+      }
+    };
+  } catch (err) {
+    if (fs8.existsSync(tmpDir)) {
+      try {
+        fs8.rmSync(tmpDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    throw err;
+  }
+  const instructionsPath = path13.join(paths.remnicExtensionDir, "instructions.md");
+  return {
+    ...paths,
+    instructionsPath,
+    filesCopied,
+    commit: commitFn,
+    rollback: rollbackFn
+  };
+}
+function removeCodexMemoryExtension(options = {}) {
+  const paths = resolveCodexMemoryExtensionPaths(options.codexHome ?? null);
+  let removed = false;
+  if (fs8.existsSync(paths.remnicExtensionDir)) {
+    fs8.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
+    removed = true;
+  }
+  return { ...paths, removed };
+}
+function getConnectorsDir() {
+  const configDir = process.env.XDG_CONFIG_HOME ? path13.join(process.env.XDG_CONFIG_HOME, "engram") : path13.join(process.env.HOME ?? "~", ".config", "engram");
+  return path13.join(configDir, REGISTRY_DIR_NAME, "connectors");
+}
+var WECLONE_PROXY_CONFIG_DIRNAME = ".remnic";
+var WECLONE_PROXY_CONFIG_FILENAME = "weclone.json";
+function resolveWeCloneProxyConfigPath() {
+  const override = process.env.REMNIC_HOME ?? process.env.ENGRAM_HOME;
+  if (override && override.length > 0) {
+    return path13.resolve(override, "connectors", WECLONE_PROXY_CONFIG_FILENAME);
+  }
+  const envHome = process.env.HOME;
+  const home = envHome && envHome.length > 0 ? envHome : os.homedir();
+  return path13.resolve(
+    home,
+    WECLONE_PROXY_CONFIG_DIRNAME,
+    "connectors",
+    WECLONE_PROXY_CONFIG_FILENAME
+  );
+}
+function readWeCloneProxyConfigIfExists(configPath) {
+  try {
+    if (!fs8.existsSync(configPath)) return null;
+    return fs8.readFileSync(configPath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function safeParseJson(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+var WECLONE_DEFAULTS = {
+  wecloneApiUrl: "http://localhost:8000/v1",
+  wecloneModelName: "weclone-avatar",
+  proxyPort: 8100,
+  remnicDaemonUrl: "http://localhost:4318",
+  sessionStrategy: "single",
+  memoryInjection: {
+    maxTokens: 1500,
+    position: "system-append",
+    template: "[Memory Context]\n{memories}\n[End Memory Context]"
+  }
+};
+function resolveStringField(userConfig, priorConfig, key, fallback) {
+  const fromUser = userConfig[key];
+  if (typeof fromUser === "string" && fromUser.length > 0) return fromUser;
+  if (priorConfig) {
+    const fromPrior = priorConfig[key];
+    if (typeof fromPrior === "string" && fromPrior.length > 0) return fromPrior;
+  }
+  return fallback;
+}
+function coercePort(value) {
+  if (typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535) {
+    return value;
+  }
+  if (typeof value === "string" && value.length > 0) {
+    const n = Number(value);
+    if (Number.isInteger(n) && n >= 1 && n <= 65535) return n;
+  }
+  return null;
+}
+function resolvePort(userConfig, priorConfig, fallback) {
+  const fromUser = coercePort(userConfig.proxyPort);
+  if (fromUser !== null) return fromUser;
+  if (priorConfig) {
+    const fromPrior = coercePort(priorConfig.proxyPort);
+    if (fromPrior !== null) return fromPrior;
+  }
+  return fallback;
+}
+function resolveSessionStrategy(userConfig, priorConfig) {
+  const valid = /* @__PURE__ */ new Set(["caller-id", "single"]);
+  const fromUser = userConfig.sessionStrategy;
+  if (typeof fromUser === "string" && valid.has(fromUser)) {
+    return fromUser;
+  }
+  if (priorConfig) {
+    const fromPrior = priorConfig.sessionStrategy;
+    if (typeof fromPrior === "string" && valid.has(fromPrior)) {
+      return fromPrior;
     }
   }
-  const healthy = checks.every((c) => c.ok);
-  return { connectorId, checks, healthy };
+  return WECLONE_DEFAULTS.sessionStrategy;
 }
-function getConnectorsDir() {
-  const configDir = process.env.XDG_CONFIG_HOME ? path8.join(process.env.XDG_CONFIG_HOME, "engram") : path8.join(process.env.HOME ?? "~", ".config", "engram");
-  return path8.join(configDir, REGISTRY_DIR_NAME, "connectors");
+function buildWeCloneProxyConfig(args) {
+  const { userConfig, priorConfig, authToken } = args;
+  const wecloneApiUrl = resolveStringField(
+    userConfig,
+    priorConfig,
+    "wecloneApiUrl",
+    WECLONE_DEFAULTS.wecloneApiUrl
+  );
+  const wecloneModelName = resolveStringField(
+    userConfig,
+    priorConfig,
+    "wecloneModelName",
+    WECLONE_DEFAULTS.wecloneModelName
+  );
+  const remnicDaemonUrl = resolveStringField(
+    userConfig,
+    priorConfig,
+    "remnicDaemonUrl",
+    WECLONE_DEFAULTS.remnicDaemonUrl
+  );
+  const proxyPort = resolvePort(
+    userConfig,
+    priorConfig,
+    WECLONE_DEFAULTS.proxyPort
+  );
+  const sessionStrategy = resolveSessionStrategy(userConfig, priorConfig);
+  const memoryInjection = {
+    ...WECLONE_DEFAULTS.memoryInjection,
+    ...priorConfig && typeof priorConfig.memoryInjection === "object" && priorConfig.memoryInjection !== null && !Array.isArray(priorConfig.memoryInjection) ? priorConfig.memoryInjection : {},
+    ...typeof userConfig.memoryInjection === "object" && userConfig.memoryInjection !== null && !Array.isArray(userConfig.memoryInjection) ? userConfig.memoryInjection : {}
+  };
+  const config = {
+    wecloneApiUrl,
+    wecloneModelName,
+    proxyPort,
+    remnicDaemonUrl,
+    sessionStrategy,
+    memoryInjection
+  };
+  if (authToken && authToken.length > 0) {
+    config.remnicAuthToken = authToken;
+  } else if (typeof userConfig.remnicAuthToken === "string" && userConfig.remnicAuthToken.length > 0) {
+    config.remnicAuthToken = userConfig.remnicAuthToken;
+  } else if (priorConfig && typeof priorConfig.remnicAuthToken === "string" && priorConfig.remnicAuthToken.length > 0) {
+    config.remnicAuthToken = priorConfig.remnicAuthToken;
+  }
+  return config;
 }
 
 // src/spaces/index.ts
-import fs8 from "fs";
-import path9 from "path";
-import crypto4 from "crypto";
+import fs9 from "fs";
+import path14 from "path";
+import crypto6 from "crypto";
 var MANIFEST_VERSION = 1;
 function getSpacesDir(baseDir) {
   const homeDir = baseDir ?? process.env.HOME ?? "~";
-  return path9.join(homeDir, ".config", "engram", "spaces");
+  return path14.join(homeDir, ".config", "engram", "spaces");
 }
 function getManifestPath(baseDir) {
-  return path9.join(getSpacesDir(baseDir), "manifest.json");
+  return path14.join(getSpacesDir(baseDir), "manifest.json");
 }
 function loadManifest(baseDir, memoryDirOverride) {
-  const manifestPath = getManifestPath(baseDir);
-  if (!fs8.existsSync(manifestPath)) {
+  const manifestPath2 = getManifestPath(baseDir);
+  if (!fs9.existsSync(manifestPath2)) {
     const personalSpace = createPersonalSpace(baseDir, memoryDirOverride);
     const manifest = {
       activeSpaceId: personalSpace.id,
@@ -2117,19 +4153,19 @@ function loadManifest(baseDir, memoryDirOverride) {
     saveManifest(manifest, baseDir);
     return manifest;
   }
-  const raw = JSON.parse(fs8.readFileSync(manifestPath, "utf8"));
+  const raw = JSON.parse(fs9.readFileSync(manifestPath2, "utf8"));
   return raw;
 }
 function saveManifest(manifest, baseDir) {
-  const manifestPath = getManifestPath(baseDir);
-  fs8.mkdirSync(path9.dirname(manifestPath), { recursive: true });
-  fs8.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+  const manifestPath2 = getManifestPath(baseDir);
+  fs9.mkdirSync(path14.dirname(manifestPath2), { recursive: true });
+  fs9.writeFileSync(manifestPath2, JSON.stringify(manifest, null, 2) + "\n");
 }
 function createPersonalSpace(baseDir, memoryDirOverride) {
   const homeDir = baseDir ?? process.env.HOME ?? "~";
-  const standalonePath = path9.join(homeDir, ".engram", "memory");
-  const openclawPath = path9.join(homeDir, ".openclaw", "workspace", "memory", "local");
-  const memoryDir = memoryDirOverride ?? process.env.ENGRAM_MEMORY_DIR ?? (fs8.existsSync(standalonePath) ? standalonePath : fs8.existsSync(openclawPath) ? openclawPath : standalonePath);
+  const standalonePath = path14.join(homeDir, ".engram", "memory");
+  const openclawPath = path14.join(homeDir, ".openclaw", "workspace", "memory", "local");
+  const memoryDir = memoryDirOverride ?? process.env.ENGRAM_MEMORY_DIR ?? (fs9.existsSync(standalonePath) ? standalonePath : fs9.existsSync(openclawPath) ? openclawPath : standalonePath);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   return {
     id: "personal",
@@ -2162,7 +4198,7 @@ function createSpace(options) {
     throw new Error(`Parent space "${options.parentSpaceId}" not found`);
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const memoryDir = options.memoryDir ?? path9.join(
+  const memoryDir = options.memoryDir ?? path14.join(
     getSpacesDir(options.baseDir),
     id,
     "memory"
@@ -2178,7 +4214,7 @@ function createSpace(options) {
     owner: process.env.USER,
     parentSpaceId: options.parentSpaceId
   };
-  fs8.mkdirSync(memoryDir, { recursive: true });
+  fs9.mkdirSync(memoryDir, { recursive: true });
   manifest.spaces.push(space);
   manifest.updatedAt = now;
   saveManifest(manifest, options.baseDir);
@@ -2352,34 +4388,34 @@ function mergeSpaces(sourceSpaceId, targetSpaceId, options) {
   };
 }
 function getAuditLog(baseDir) {
-  const auditPath = path9.join(getSpacesDir(baseDir), "audit.jsonl");
-  if (!fs8.existsSync(auditPath)) return [];
-  const lines = fs8.readFileSync(auditPath, "utf8").trim().split("\n");
+  const auditPath = path14.join(getSpacesDir(baseDir), "audit.jsonl");
+  if (!fs9.existsSync(auditPath)) return [];
+  const lines = fs9.readFileSync(auditPath, "utf8").trim().split("\n");
   return lines.filter((l) => l.trim()).map((l) => JSON.parse(l));
 }
 function appendAudit(entry, baseDir) {
-  const auditPath = path9.join(getSpacesDir(baseDir), "audit.jsonl");
-  fs8.mkdirSync(path9.dirname(auditPath), { recursive: true });
+  const auditPath = path14.join(getSpacesDir(baseDir), "audit.jsonl");
+  fs9.mkdirSync(path14.dirname(auditPath), { recursive: true });
   const full = {
-    id: crypto4.randomUUID(),
+    id: crypto6.randomUUID(),
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     ...entry
   };
-  fs8.appendFileSync(auditPath, JSON.stringify(full) + "\n");
+  fs9.appendFileSync(auditPath, JSON.stringify(full) + "\n");
 }
 function copyMemories(sourceDir, targetDir, options) {
   let merged = 0;
   const conflicts = [];
   let skipped = 0;
-  if (!fs8.existsSync(sourceDir)) {
+  if (!fs9.existsSync(sourceDir)) {
     return { merged: 0, conflicts: [], skipped: 0 };
   }
-  fs8.mkdirSync(targetDir, { recursive: true });
+  fs9.mkdirSync(targetDir, { recursive: true });
   const sourceFiles = walkMd2(sourceDir);
   for (const sourcePath of sourceFiles) {
-    const content = fs8.readFileSync(sourcePath, "utf8");
-    const relativePath = path9.relative(sourceDir, sourcePath);
-    const targetPath = path9.join(targetDir, relativePath);
+    const content = fs9.readFileSync(sourcePath, "utf8");
+    const relativePath = path14.relative(sourceDir, sourcePath);
+    const targetPath = path14.join(targetDir, relativePath);
     const sourceHash = hashContent4(content);
     if (options?.filterIds?.length) {
       const fm = parseSimpleFrontmatter(content);
@@ -2388,8 +4424,8 @@ function copyMemories(sourceDir, targetDir, options) {
         continue;
       }
     }
-    if (fs8.existsSync(targetPath) && !options?.force) {
-      const targetContent = fs8.readFileSync(targetPath, "utf8");
+    if (fs9.existsSync(targetPath) && !options?.force) {
+      const targetContent = fs9.readFileSync(targetPath, "utf8");
       const targetHash = hashContent4(targetContent);
       if (sourceHash !== targetHash) {
         conflicts.push({
@@ -2405,20 +4441,20 @@ function copyMemories(sourceDir, targetDir, options) {
       skipped++;
       continue;
     }
-    fs8.mkdirSync(path9.dirname(targetPath), { recursive: true });
-    fs8.writeFileSync(targetPath, content);
+    fs9.mkdirSync(path14.dirname(targetPath), { recursive: true });
+    fs9.writeFileSync(targetPath, content);
     merged++;
   }
   return { merged, conflicts, skipped };
 }
 function hashContent4(content) {
-  return crypto4.createHash("sha256").update(content).digest("hex").slice(0, 16);
+  return crypto6.createHash("sha256").update(content).digest("hex").slice(0, 16);
 }
 function walkMd2(dir) {
   const results = [];
   function walk(d) {
-    for (const entry of fs8.readdirSync(d, { withFileTypes: true })) {
-      const fullPath = path9.join(d, entry.name);
+    for (const entry of fs9.readdirSync(d, { withFileTypes: true })) {
+      const fullPath = path14.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
       } else if (entry.name.endsWith(".md")) {
@@ -2442,72 +4478,1053 @@ function parseSimpleFrontmatter(content) {
   }
   return fm;
 }
+
+// src/memory-extension/shared-instructions.ts
+var REMNIC_SEMANTIC_OVERVIEW = `## Remnic Memory Types
+
+Remnic stores memories as plain Markdown files with YAML front-matter.
+Each memory has a **type** that describes its semantic role:
+
+| Type | Description |
+|------|-------------|
+| \`fact\` | An objective piece of knowledge the user confirmed or that was extracted from a session. |
+| \`preference\` | A stated or inferred user preference (e.g. coding style, tool choice). |
+| \`decision\` | An explicit decision or trade-off the user made. |
+| \`entity\` | A named thing the user cares about (project, service, person, API). |
+| \`skill\` | A reusable workflow or procedure documented for future sessions. |
+| \`correction\` | A fix or amendment to a previously stored memory. |
+| \`question\` | An open question or uncertainty flagged for future resolution. |
+| \`observation\` | A pattern noticed across sessions (e.g. "user always runs tests before commits"). |
+| \`summary\` | A condensed roll-up of recent sessions or a topic area. |
+
+When reading Remnic content, the front-matter \`type\` field tells you what
+kind of knowledge you are looking at and how much weight to give it.
+`;
+var REMNIC_CITATION_FORMAT = `## Citing Remnic Memories
+
+When a piece of your output draws on a Remnic file, cite it using the
+memory citation block format so the user can trace the source:
+
+\`\`\`
+<oai-mem-citation path="<path-relative-to-remnic-memory-base>" />
+\`\`\`
+
+The path must be **relative to the Remnic memory base** (the directory
+named \`memories/\` under \`<remnic-home>\`), not absolute. Examples:
+
+- \`<oai-mem-citation path="default/MEMORY.md" />\`
+- \`<oai-mem-citation path="my-project/skills/deploy/SKILL.md" />\`
+- \`<oai-mem-citation path="shared/memory_summary.md" />\`
+
+Cite each distinct source once near the fact it supports. Do not invent
+citations for files you have not actually read.
+`;
+var REMNIC_MCP_TOOL_INVENTORY = `## Remnic MCP Tools
+
+When the Remnic MCP server is reachable, the following tools are
+available. Prefer MCP tools over direct file reads when the host
+supports MCP connections.
+
+| Tool | Purpose |
+|------|---------|
+| \`remnic.recall\` | Retrieve contextually relevant memories for the current session. |
+| \`remnic.recall_explain\` | Like recall, but includes an explanation of why each memory was selected. |
+| \`remnic.memory_store\` | Persist a new memory (fact, preference, decision, etc.). |
+| \`remnic.memory_get\` | Fetch a specific memory by ID. |
+| \`remnic.memory_search\` | Full-text + semantic search across all memories. |
+| \`remnic.memory_timeline\` | Retrieve memories in chronological order within a time range. |
+| \`remnic.observe\` | Record an observation from the current conversation turn. |
+| \`remnic.entity_get\` | Look up a named entity and its relationships. |
+| \`remnic.memory_entities_list\` | List all known entities. |
+| \`remnic.memory_profile\` | Retrieve the user profile summary. |
+| \`remnic.day_summary\` | Generate a summary of memories from a specific day. |
+| \`remnic.briefing\` | Generate a structured briefing for an upcoming session. |
+| \`remnic.memory_feedback\` | Submit feedback on a recalled memory (useful, outdated, wrong). |
+| \`remnic.memory_promote\` | Promote a memory to a higher confidence tier. |
+| \`remnic.context_checkpoint\` | Save a conversation checkpoint for continuity. |
+| \`remnic.suggestion_submit\` | Submit a suggestion for a new memory to the review queue. |
+| \`remnic.review_queue_list\` | List pending suggestions in the review queue. |
+| \`remnic.work_task\` | Create or update a work task. |
+| \`remnic.work_project\` | Create or update a work project. |
+| \`remnic.work_board\` | View the work board. |
+
+Legacy \`engram.*\` prefixed names are accepted as aliases for all tools.
+`;
+var REMNIC_RECALL_DECISION_RULES = `## When to Use Recall vs Direct Read
+
+### Use \`remnic.recall\` (MCP) when:
+
+- The Remnic MCP server is reachable (the host has an active MCP
+  connection to the Remnic daemon).
+- You want contextually relevant memories ranked by the recall planner
+  (semantic search + reranking + importance scoring).
+- You need memories across multiple namespaces or topics.
+- The conversation benefits from Remnic's intent detection and
+  adaptive recall depth.
+
+### Use direct file reads when:
+
+- You are in a sandboxed environment with no network or MCP access
+  (e.g. Codex phase-2 consolidation).
+- You need a specific file you already know the path to.
+- The MCP server is unavailable or unhealthy.
+- You are operating on the raw memory files for maintenance or
+  migration purposes.
+
+### General guidance:
+
+- Prefer MCP tools when available \u2014 they provide ranked, deduplicated,
+  and context-aware results.
+- Fall back to file reads gracefully \u2014 never block on a failed MCP call
+  when the data is also on disk.
+- Never write directly to the Remnic memory directory unless you are an
+  authorized extraction or consolidation process.
+`;
+
+// src/memory-extension/codex-publisher.ts
+import fs10 from "fs";
+import os2 from "os";
+import path15 from "path";
+var REMNIC_EXTENSION_DIR_NAME2 = "remnic";
+var CodexMemoryExtensionPublisher = class {
+  hostId = "codex";
+  static capabilities = {
+    instructionsMd: true,
+    skillsFolder: true,
+    citationFormat: true,
+    readPathTemplate: true
+  };
+  async resolveExtensionRoot(env) {
+    const e = env ?? process.env;
+    const codexHome = e.CODEX_HOME?.trim() || path15.join(e.HOME ?? os2.homedir(), ".codex");
+    return path15.join(codexHome, "memories_extensions", REMNIC_EXTENSION_DIR_NAME2);
+  }
+  async isHostAvailable() {
+    try {
+      const home = process.env.CODEX_HOME?.trim() || path15.join(process.env.HOME ?? os2.homedir(), ".codex");
+      return fs10.existsSync(home);
+    } catch {
+      return false;
+    }
+  }
+  async renderInstructions(ctx) {
+    const memDir = ctx.config.memoryDir;
+    const ns = ctx.config.namespace ?? "default";
+    const sections = [
+      `# Remnic Memory Extension for Codex
+`,
+      `This document tells you how to use Remnic as an authoritative local memory source. Remnic is a local-first, file-backed memory system. All Remnic content lives on disk as plain Markdown.
+`,
+      REMNIC_SEMANTIC_OVERVIEW,
+      `## Where Remnic Content Lives
+
+Memory base directory: \`${memDir}\`
+
+Namespace: \`${ns}\`
+
+Under the base directory, memories are organized by namespace:
+
+\`\`\`
+${memDir}/<namespace>/
+  MEMORY.md               # compact top-of-mind memory
+  memory_summary.md       # optional longer summary
+  skills/
+    <skill-name>/SKILL.md # reusable workflows
+  rollout_summaries/
+    *.md                  # per-session rollup notes
+\`\`\`
+`,
+      REMNIC_CITATION_FORMAT,
+      REMNIC_MCP_TOOL_INVENTORY,
+      REMNIC_RECALL_DECISION_RULES,
+      `## Sandboxing Rules (Codex Phase-2)
+
+When running inside the Codex phase-2 consolidation sandbox:
+
+- **No network.** Do not attempt HTTP calls or MCP connections.
+- **No CLI invocation.** Do not shell out to \`remnic\` or \`engram\`.
+- **No MCP tool calls.** Use filesystem reads only.
+- **Local writes** are allowed only where Codex's sandbox policy permits.
+- **Respect missing files.** If a file does not exist, move on silently.
+`
+    ];
+    return sections.join("\n");
+  }
+  async publish(ctx) {
+    const extensionRoot = await this.resolveExtensionRoot();
+    const instructionsPath = path15.join(extensionRoot, "instructions.md");
+    const filesWritten = [];
+    const skipped = [];
+    ctx.log.info(`Publishing Codex memory extension to ${extensionRoot}`);
+    fs10.mkdirSync(extensionRoot, { recursive: true });
+    const content = await this.renderInstructions(ctx);
+    const tmpPath = `${instructionsPath}.tmp-${process.pid}-${Date.now()}`;
+    try {
+      fs10.writeFileSync(tmpPath, content, "utf-8");
+      fs10.renameSync(tmpPath, instructionsPath);
+      filesWritten.push(instructionsPath);
+      ctx.log.info(`Wrote ${instructionsPath}`);
+    } catch (err) {
+      try {
+        if (fs10.existsSync(tmpPath)) {
+          fs10.unlinkSync(tmpPath);
+        }
+      } catch {
+      }
+      throw err;
+    }
+    return {
+      hostId: this.hostId,
+      extensionRoot,
+      filesWritten,
+      skipped
+    };
+  }
+  async unpublish() {
+    const extensionRoot = await this.resolveExtensionRoot();
+    if (fs10.existsSync(extensionRoot)) {
+      fs10.rmSync(extensionRoot, { recursive: true, force: true });
+    }
+  }
+};
+
+// src/memory-extension/claude-code-publisher.ts
+var ClaudeCodeMemoryExtensionPublisher = class {
+  hostId = "claude-code";
+  static capabilities = {
+    instructionsMd: false,
+    skillsFolder: false,
+    citationFormat: false,
+    readPathTemplate: false
+  };
+  async resolveExtensionRoot() {
+    return "";
+  }
+  async isHostAvailable() {
+    return false;
+  }
+  async renderInstructions(_ctx) {
+    return "";
+  }
+  async publish(_ctx) {
+    return {
+      hostId: this.hostId,
+      extensionRoot: "",
+      filesWritten: [],
+      skipped: []
+    };
+  }
+  async unpublish() {
+  }
+};
+
+// src/memory-extension/hermes-publisher.ts
+var HermesMemoryExtensionPublisher = class {
+  hostId = "hermes";
+  static capabilities = {
+    instructionsMd: false,
+    skillsFolder: false,
+    citationFormat: false,
+    readPathTemplate: false
+  };
+  async resolveExtensionRoot() {
+    return "";
+  }
+  async isHostAvailable() {
+    return false;
+  }
+  async renderInstructions(_ctx) {
+    return "";
+  }
+  async publish(_ctx) {
+    return {
+      hostId: this.hostId,
+      extensionRoot: "",
+      filesWritten: [],
+      skipped: []
+    };
+  }
+  async unpublish() {
+  }
+};
+
+// src/memory-extension/index.ts
+var PUBLISHERS = {};
+function registerPublisher(hostId, factory) {
+  PUBLISHERS[hostId] = factory;
+}
+var CONNECTOR_TO_HOST = {
+  "codex-cli": "codex"
+};
+function hostIdForConnector(connectorId) {
+  return CONNECTOR_TO_HOST[connectorId] ?? connectorId;
+}
+function publisherFor(hostId) {
+  const factory = PUBLISHERS[hostId];
+  return factory ? factory() : void 0;
+}
+function publisherForConnector(connectorId) {
+  return publisherFor(hostIdForConnector(connectorId));
+}
+
+// src/taxonomy/default-taxonomy.ts
+var DEFAULT_TAXONOMY = {
+  version: 1,
+  categories: [
+    {
+      id: "corrections",
+      name: "Corrections",
+      description: "Corrections to previously stored information",
+      filingRules: ["Any update that supersedes a prior fact"],
+      priority: 10,
+      memoryCategories: ["correction"]
+    },
+    {
+      id: "principles",
+      name: "Principles",
+      description: "Rules, guidelines, and recurring patterns",
+      filingRules: ["A guiding principle, rule, or skill"],
+      priority: 20,
+      memoryCategories: ["principle", "rule", "skill"]
+    },
+    {
+      id: "procedures",
+      name: "Procedures",
+      description: "Ordered multi-step workflows the user repeats",
+      filingRules: ["A repeatable sequence of steps or commands for a task"],
+      priority: 25,
+      memoryCategories: ["procedure"]
+    },
+    {
+      id: "entities",
+      name: "Entities",
+      description: "People, organizations, places, projects",
+      filingRules: ["Named entity with attributes"],
+      priority: 30,
+      memoryCategories: ["entity", "relationship"]
+    },
+    {
+      id: "decisions",
+      name: "Decisions",
+      description: "Choices made and their rationale",
+      filingRules: ["A decision or commitment with reasoning"],
+      priority: 35,
+      memoryCategories: ["decision", "commitment"]
+    },
+    {
+      id: "preferences",
+      name: "Preferences",
+      description: "User likes, dislikes, and style choices",
+      filingRules: ["Anything expressing a preference or taste"],
+      priority: 40,
+      memoryCategories: ["preference"]
+    },
+    {
+      id: "facts",
+      name: "Facts",
+      description: "Objective statements about the world",
+      filingRules: ["Any factual claim or piece of information"],
+      priority: 50,
+      memoryCategories: ["fact"]
+    },
+    {
+      id: "moments",
+      name: "Moments",
+      description: "Significant events or experiences",
+      filingRules: ["A specific event worth remembering"],
+      priority: 60,
+      memoryCategories: ["moment"]
+    }
+  ]
+};
+
+// src/taxonomy/resolver.ts
+var DEFAULT_CATEGORY_ID = "facts";
+function resolveCategory(content, memoryCategory, taxonomy) {
+  const contentLower = content.toLowerCase();
+  const matches = taxonomy.categories.filter(
+    (cat) => cat.memoryCategories.includes(memoryCategory)
+  );
+  if (matches.length === 0) {
+    const fallback = taxonomy.categories.find((c) => c.id === DEFAULT_CATEGORY_ID) ?? taxonomy.categories[0];
+    if (!fallback) {
+      return {
+        categoryId: DEFAULT_CATEGORY_ID,
+        confidence: 0,
+        reason: "Taxonomy is empty; using default category",
+        alternatives: []
+      };
+    }
+    const alternatives2 = taxonomy.categories.filter((c) => c.id !== fallback.id).map((c) => ({
+      categoryId: c.id,
+      reason: c.description
+    }));
+    return {
+      categoryId: fallback.id,
+      confidence: 0.3,
+      reason: `No taxonomy category maps to MemoryCategory "${memoryCategory}"; falling back to "${fallback.name}"`,
+      alternatives: alternatives2
+    };
+  }
+  if (matches.length === 1) {
+    const match = matches[0];
+    const alternatives2 = taxonomy.categories.filter((c) => c.id !== match.id).map((c) => ({
+      categoryId: c.id,
+      reason: c.description
+    }));
+    return {
+      categoryId: match.id,
+      confidence: 1,
+      reason: `Unique match: MemoryCategory "${memoryCategory}" maps to "${match.name}"`,
+      alternatives: alternatives2
+    };
+  }
+  const scored = matches.map((cat) => ({
+    cat,
+    keywordScore: computeKeywordScore(contentLower, cat)
+  }));
+  scored.sort((a, b) => {
+    if (b.keywordScore !== a.keywordScore) return b.keywordScore - a.keywordScore;
+    return a.cat.priority - b.cat.priority;
+  });
+  const best = scored[0];
+  const runnerUp = scored[1];
+  const confidence = best.keywordScore > 0 && (!runnerUp || best.keywordScore > runnerUp.keywordScore) ? 0.9 : 0.7;
+  const alternatives = taxonomy.categories.filter((c) => c.id !== best.cat.id).map((c) => ({
+    categoryId: c.id,
+    reason: c.description
+  }));
+  const reason = best.keywordScore > 0 ? `Filing rules for "${best.cat.name}" matched content keywords (priority ${best.cat.priority})` : `Priority tie-break: "${best.cat.name}" has lowest priority number (${best.cat.priority})`;
+  return {
+    categoryId: best.cat.id,
+    confidence,
+    reason,
+    alternatives
+  };
+}
+function computeKeywordScore(contentLower, cat) {
+  let score = 0;
+  const ruleText = [...cat.filingRules, cat.description].join(" ").toLowerCase();
+  const keywords = ruleText.split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
+  for (const kw of keywords) {
+    if (contentLower.includes(kw)) {
+      score += 1;
+    }
+  }
+  return score;
+}
+
+// src/taxonomy/resolver-doc-generator.ts
+function generateResolverDocument(taxonomy) {
+  const sorted = [...taxonomy.categories].sort((a, b) => {
+    if (a.priority !== b.priority) return a.priority - b.priority;
+    return a.id.localeCompare(b.id);
+  });
+  const lines = [
+    "# Memory Filing Resolver",
+    "",
+    "Given a new piece of knowledge, follow this tree to determine where it belongs.",
+    ""
+  ];
+  let step = 1;
+  for (const cat of sorted) {
+    lines.push(`## Step ${step}: ${cat.description}?`);
+    lines.push("");
+    for (const rule of cat.filingRules) {
+      lines.push(`- ${rule}`);
+    }
+    lines.push("");
+    lines.push(
+      `> YES: File under **${cat.id}/** (priority ${cat.priority})`
+    );
+    lines.push("");
+    step++;
+  }
+  lines.push("## Tie-breaking");
+  lines.push("");
+  lines.push(
+    "If a fact could go in multiple categories, file under the one with the **lowest priority number**."
+  );
+  lines.push("");
+  lines.push(`---`);
+  lines.push(`*Generated from taxonomy v${taxonomy.version}*`);
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/taxonomy/taxonomy-loader.ts
+import { readFile, mkdir, writeFile } from "fs/promises";
+import path16 from "path";
+var TAXONOMY_DIR = ".taxonomy";
+var TAXONOMY_FILE = "taxonomy.json";
+var MAX_SLUG_LENGTH = 32;
+var SLUG_RE = /^[a-z][a-z0-9-]*$/;
+function validateSlug(slug) {
+  if (slug.length === 0) {
+    throw new Error("Taxonomy category ID must not be empty");
+  }
+  if (slug.length > MAX_SLUG_LENGTH) {
+    throw new Error(
+      `Taxonomy category ID "${slug}" exceeds ${MAX_SLUG_LENGTH} characters`
+    );
+  }
+  if (!SLUG_RE.test(slug)) {
+    throw new Error(
+      `Taxonomy category ID "${slug}" is invalid: must be lowercase letters, digits, and hyphens, starting with a letter`
+    );
+  }
+}
+function validateTaxonomy(taxonomy) {
+  if (typeof taxonomy.version !== "number" || taxonomy.version < 1) {
+    throw new Error("Taxonomy version must be a positive integer");
+  }
+  if (!Array.isArray(taxonomy.categories)) {
+    throw new Error("Taxonomy categories must be an array");
+  }
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const cat of taxonomy.categories) {
+    validateSlug(cat.id);
+    if (seenIds.has(cat.id)) {
+      throw new Error(`Duplicate taxonomy category ID: "${cat.id}"`);
+    }
+    seenIds.add(cat.id);
+    if (typeof cat.name !== "string" || cat.name.trim().length === 0) {
+      throw new Error(`Taxonomy category "${cat.id}" must have a non-empty name`);
+    }
+    if (typeof cat.description !== "string" || cat.description.trim().length === 0) {
+      throw new Error(`Taxonomy category "${cat.id}" must have a non-empty description`);
+    }
+    if (!Array.isArray(cat.filingRules)) {
+      throw new Error(`Taxonomy category "${cat.id}" filingRules must be an array`);
+    }
+    if (typeof cat.priority !== "number" || !Number.isFinite(cat.priority)) {
+      throw new Error(`Taxonomy category "${cat.id}" must have a finite numeric priority`);
+    }
+    if (!Array.isArray(cat.memoryCategories)) {
+      throw new Error(`Taxonomy category "${cat.id}" memoryCategories must be an array`);
+    }
+    if (cat.parentId !== void 0) {
+      if (typeof cat.parentId !== "string") {
+        throw new Error(`Taxonomy category "${cat.id}" parentId must be a string if set`);
+      }
+    }
+  }
+  for (const cat of taxonomy.categories) {
+    if (cat.parentId !== void 0 && !seenIds.has(cat.parentId)) {
+      throw new Error(
+        `Taxonomy category "${cat.id}" references unknown parentId "${cat.parentId}"`
+      );
+    }
+  }
+}
+async function loadTaxonomy(memoryDir) {
+  const taxonomyPath = path16.join(memoryDir, TAXONOMY_DIR, TAXONOMY_FILE);
+  let raw;
+  try {
+    raw = await readFile(taxonomyPath, "utf-8");
+  } catch (err) {
+    if (err instanceof Error && err.code === "ENOENT") {
+      return structuredClone(DEFAULT_TAXONOMY);
+    }
+    throw err;
+  }
+  const parsed = JSON.parse(raw);
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("taxonomy.json must be a JSON object");
+  }
+  const obj = parsed;
+  const userVersion = typeof obj.version === "number" ? obj.version : DEFAULT_TAXONOMY.version;
+  const userCategories = Array.isArray(obj.categories) ? obj.categories : [];
+  const userIdCounts = /* @__PURE__ */ new Map();
+  for (const cat of userCategories) {
+    const id = typeof cat.id === "string" ? cat.id : String(cat.id);
+    userIdCounts.set(id, (userIdCounts.get(id) ?? 0) + 1);
+  }
+  const duplicateIds = [...userIdCounts.entries()].filter(([, count]) => count > 1).map(([id]) => id);
+  if (duplicateIds.length > 0) {
+    throw new Error(
+      `Duplicate category IDs in taxonomy.json: ${duplicateIds.map((id) => `"${id}"`).join(", ")}`
+    );
+  }
+  const mergedMap = /* @__PURE__ */ new Map();
+  for (const cat of DEFAULT_TAXONOMY.categories) {
+    mergedMap.set(cat.id, { ...cat });
+  }
+  for (const cat of userCategories) {
+    mergedMap.set(cat.id, cat);
+  }
+  const merged = {
+    version: userVersion,
+    categories: [...mergedMap.values()]
+  };
+  validateTaxonomy(merged);
+  return merged;
+}
+async function saveTaxonomy(memoryDir, taxonomy) {
+  validateTaxonomy(taxonomy);
+  const dir = path16.join(memoryDir, TAXONOMY_DIR);
+  await mkdir(dir, { recursive: true });
+  const filePath = path16.join(dir, TAXONOMY_FILE);
+  await writeFile(filePath, JSON.stringify(taxonomy, null, 2) + "\n", "utf-8");
+}
+function getTaxonomyDir(memoryDir) {
+  return path16.join(memoryDir, TAXONOMY_DIR);
+}
+function getTaxonomyFilePath(memoryDir) {
+  return path16.join(memoryDir, TAXONOMY_DIR, TAXONOMY_FILE);
+}
+
+// src/enrichment/types.ts
+function defaultEnrichmentPipelineConfig() {
+  return {
+    enabled: false,
+    providers: [],
+    importanceThresholds: {
+      critical: [],
+      high: [],
+      normal: [],
+      low: []
+    },
+    maxCandidatesPerEntity: 20,
+    autoEnrichOnCreate: false,
+    scheduleIntervalMs: 36e5
+  };
+}
+
+// src/enrichment/provider-registry.ts
+var EnrichmentProviderRegistry = class {
+  providers = /* @__PURE__ */ new Map();
+  /** Register a provider. Overwrites any existing provider with the same id. */
+  register(provider) {
+    this.providers.set(provider.id, provider);
+  }
+  /** Look up a single provider by id. */
+  get(id) {
+    return this.providers.get(id);
+  }
+  /**
+   * Return all registered providers whose id appears in the config's
+   * `providers` list with `enabled: true`.
+   */
+  listEnabled(config) {
+    const enabledIds = new Set(
+      config.providers.filter((p) => p.enabled).map((p) => p.id)
+    );
+    const result = [];
+    for (const [id, provider] of this.providers.entries()) {
+      if (enabledIds.has(id)) {
+        result.push(provider);
+      }
+    }
+    return result;
+  }
+  /**
+   * Return providers that should run for a given importance level.
+   * Providers are resolved from `config.importanceThresholds[level]` and
+   * filtered to only those that are both registered and enabled.
+   */
+  getForImportance(level, config) {
+    if (level === "trivial") return [];
+    const thresholds = config.importanceThresholds;
+    const providerIds = level === "critical" ? thresholds.critical : level === "high" ? thresholds.high : level === "normal" ? thresholds.normal : thresholds.low;
+    const enabledIds = new Set(
+      config.providers.filter((p) => p.enabled).map((p) => p.id)
+    );
+    const result = [];
+    for (const id of providerIds) {
+      if (!enabledIds.has(id)) continue;
+      const provider = this.providers.get(id);
+      if (provider) {
+        result.push(provider);
+      }
+    }
+    return result;
+  }
+};
+
+// src/enrichment/web-search-provider.ts
+var WebSearchProvider = class {
+  id = "web-search";
+  costTier = "cheap";
+  searchFn;
+  constructor(options = {}) {
+    this.searchFn = options.searchFn;
+  }
+  async isAvailable() {
+    return this.searchFn !== void 0;
+  }
+  async enrich(entity) {
+    if (!this.searchFn) return [];
+    const query = `${entity.name} ${entity.type}`;
+    let snippets;
+    try {
+      snippets = await this.searchFn(query);
+    } catch {
+      return [];
+    }
+    return snippets.filter((s) => typeof s === "string" && s.trim().length > 0).map((snippet) => ({
+      text: snippet.trim(),
+      source: this.id,
+      sourceUrl: void 0,
+      confidence: 0.5,
+      category: "fact",
+      tags: ["web-search"]
+    }));
+  }
+};
+
+// src/enrichment/pipeline.ts
+function isRateLimited(provider, config, buckets) {
+  const providerCfg = config.providers.find((p) => p.id === provider.id);
+  if (!providerCfg?.rateLimit) return false;
+  const now = Date.now();
+  let bucket = buckets.get(provider.id);
+  if (!bucket) {
+    bucket = {
+      minuteCount: 0,
+      minuteReset: now + 6e4,
+      dayCount: 0,
+      dayReset: now + 864e5
+    };
+    buckets.set(provider.id, bucket);
+  }
+  if (now >= bucket.minuteReset) {
+    bucket.minuteCount = 0;
+    bucket.minuteReset = now + 6e4;
+  }
+  if (now >= bucket.dayReset) {
+    bucket.dayCount = 0;
+    bucket.dayReset = now + 864e5;
+  }
+  const { maxPerMinute, maxPerDay } = providerCfg.rateLimit;
+  return bucket.minuteCount >= maxPerMinute || bucket.dayCount >= maxPerDay;
+}
+function recordCall(providerId, buckets) {
+  const bucket = buckets.get(providerId);
+  if (bucket) {
+    bucket.minuteCount += 1;
+    bucket.dayCount += 1;
+  }
+}
+async function runEnrichmentPipeline(entities, registry, config, log2) {
+  if (!config.enabled) return [];
+  if (entities.length === 0) return [];
+  const rateBuckets = /* @__PURE__ */ new Map();
+  const results = [];
+  for (const entity of entities) {
+    const providers = registry.getForImportance(entity.importanceLevel, config);
+    for (const provider of providers) {
+      const start = Date.now();
+      let available;
+      try {
+        available = await provider.isAvailable();
+      } catch {
+        available = false;
+      }
+      if (!available) {
+        log2.debug?.(
+          `enrichment: skipping provider ${provider.id} for ${entity.name} \u2014 unavailable`
+        );
+        results.push({
+          entityName: entity.name,
+          provider: provider.id,
+          candidatesFound: 0,
+          candidatesAccepted: 0,
+          candidatesRejected: 0,
+          acceptedCandidates: [],
+          elapsed: Date.now() - start
+        });
+        continue;
+      }
+      if (isRateLimited(provider, config, rateBuckets)) {
+        log2.debug?.(
+          `enrichment: skipping provider ${provider.id} for ${entity.name} \u2014 rate limited`
+        );
+        results.push({
+          entityName: entity.name,
+          provider: provider.id,
+          candidatesFound: 0,
+          candidatesAccepted: 0,
+          candidatesRejected: 0,
+          acceptedCandidates: [],
+          elapsed: Date.now() - start
+        });
+        continue;
+      }
+      let candidates;
+      try {
+        candidates = await provider.enrich(entity);
+      } catch (err) {
+        recordCall(provider.id, rateBuckets);
+        log2.error?.(
+          `enrichment: provider ${provider.id} failed for ${entity.name}: ${err instanceof Error ? err.message : String(err)}`
+        );
+        results.push({
+          entityName: entity.name,
+          provider: provider.id,
+          candidatesFound: 0,
+          candidatesAccepted: 0,
+          candidatesRejected: 0,
+          acceptedCandidates: [],
+          elapsed: Date.now() - start
+        });
+        continue;
+      }
+      recordCall(provider.id, rateBuckets);
+      for (const candidate of candidates) {
+        candidate.source = provider.id;
+      }
+      const maxCandidates = config.maxCandidatesPerEntity;
+      let accepted;
+      if (maxCandidates === 0) {
+        accepted = [];
+      } else if (maxCandidates > 0 && candidates.length > maxCandidates) {
+        accepted = candidates.slice(0, maxCandidates);
+      } else {
+        accepted = candidates;
+      }
+      const rejected = candidates.length - accepted.length;
+      results.push({
+        entityName: entity.name,
+        provider: provider.id,
+        candidatesFound: candidates.length,
+        candidatesAccepted: accepted.length,
+        candidatesRejected: rejected,
+        acceptedCandidates: accepted,
+        elapsed: Date.now() - start
+      });
+    }
+  }
+  return results;
+}
+
+// src/enrichment/audit.ts
+import { mkdir as mkdir2, readFile as readFile2, appendFile } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import path17 from "path";
+var AUDIT_FILENAME = "enrichment-audit.jsonl";
+function auditFilePath(auditDir) {
+  return path17.join(auditDir, AUDIT_FILENAME);
+}
+async function appendAuditEntry(auditDir, entry) {
+  await mkdir2(auditDir, { recursive: true });
+  const line = JSON.stringify(entry) + "\n";
+  await appendFile(auditFilePath(auditDir), line, "utf-8");
+}
+async function readAuditLog(auditDir, since) {
+  const filePath = auditFilePath(auditDir);
+  if (!existsSync2(filePath)) return [];
+  const raw = await readFile2(filePath, "utf-8");
+  const entries = [];
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (typeof parsed === "object" && parsed !== null && "timestamp" in parsed && "entityName" in parsed) {
+        const entry = parsed;
+        if (since && entry.timestamp < since) continue;
+        entries.push(entry);
+      }
+    } catch {
+    }
+  }
+  return entries;
+}
 export {
+  BRIEFING_FORMAT_ALLOWED,
   BootstrapEngine,
+  CITATION_UNKNOWN,
+  CODEX_THREAD_KEY_PREFIX,
+  ClaudeCodeMemoryExtensionPublisher,
+  CodexMemoryExtensionPublisher,
+  DEFAULT_CITATION_FORMAT,
+  DEFAULT_GRACE_PERIOD_DAYS,
+  DEFAULT_MAX_BINARY_SIZE_BYTES,
+  DEFAULT_SCAN_PATTERNS,
+  DEFAULT_TAXONOMY,
   EngramAccessHttpServer,
   EngramAccessInputError,
   EngramAccessService,
   EngramMcpServer,
+  EnrichmentProviderRegistry,
   ExtractionEngine,
+  FileCalendarSource,
+  FilesystemBackend,
+  HermesMemoryExtensionPublisher,
+  LEGACY_PLUGIN_ID,
   LanceDbBackend,
+  MARKETPLACE_MANIFEST_FILENAME,
+  MARKETPLACE_SCHEMA_VERSION,
+  MATERIALIZE_VERSION,
   MeilisearchBackend,
+  NoneBackend,
   OramaBackend,
   Orchestrator,
+  PLUGIN_ID,
+  PUBLISHERS,
   QmdClient,
+  REMNIC_CITATION_FORMAT,
+  REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT,
+  REMNIC_MCP_TOOL_INVENTORY,
+  REMNIC_RECALL_DECISION_RULES,
+  REMNIC_SEMANTIC_OVERVIEW,
+  SENTINEL_FILE,
   StorageManager,
+  WebSearchProvider,
+  appendAuditEntry,
+  attachCitation,
+  briefingFilename,
+  buildBriefing,
+  buildCitationGuidance,
   buildEntityRecallSection,
+  buildExtensionsBlockForConsolidation,
+  buildExtensionsFooterForSummary,
+  buildProcedureMarkdownBody,
+  buildProcedureRecallSection,
+  checkMarketplaceManifest,
+  clearBulkImportSources,
+  clearTrainingExportAdapters,
+  clearVerdictCache,
+  coerceInstallExtension,
+  convertMemoriesToRecords,
+  createBackend,
   createSpace,
+  createVerdictCache,
+  createVersion,
   curate,
+  decideSemanticDedup,
+  defaultEnrichmentPipelineConfig,
   defaultWorkspaceDir,
   deleteSpace,
+  deriveSessionId,
+  describeMemoriesDir,
+  diffVersions,
+  discoverMemoryExtensions,
   doctorConnector,
+  emptyManifest,
+  ensureSentinel,
   findContradictions,
   findDuplicates,
+  focusMatchesEntity,
+  focusMatchesMemory,
+  formatBatchTranscript,
+  formatCitation,
+  formatOaiMemCitation,
   formatZodError,
   generateContextTree,
+  generateMarketplaceManifest,
+  generateResolverDocument,
   generateToken,
   getActiveSpace,
   getAllValidTokens,
   getAllValidTokensCached,
   getAuditLog,
+  getBulkImportSource,
   getManifestPath,
+  getMemoryForActiveMemory,
   getSpacesDir,
+  getTaxonomyDir,
+  getTaxonomyFilePath,
+  getTrainingExportAdapter,
+  getVersion,
+  hasBroadGraphIntent,
+  hasCitation,
+  hostIdForConnector,
+  inferIntentFromText,
   initLogger,
   installConnector,
+  installFromMarketplace,
+  intentCompatibilityScore,
+  isImportRole,
+  isTaskInitiationIntent,
   isTrustZoneName,
+  judgeFactDurability,
+  listBulkImportSources,
   listConnectors,
   listReviewItems,
   listSpaces,
   listTokens,
+  listTrainingExportAdapters,
+  listVersions,
   loadDaySummaryPrompt,
   loadManifest,
   loadRegistry,
+  loadTaxonomy,
   loadTokenStore,
   log,
+  manifestDir,
+  manifestPath,
+  matchesPatterns,
+  materializeForNamespace,
   memoryStoreRequestSchema,
   mergeSpaces,
   migrateFromEngram,
   observeRequestSchema,
   onboard,
+  parseAllCitations,
+  parseBriefingFocus,
+  parseBriefingWindow,
+  parseCitation,
   parseConfig,
+  parseIsoTimestamp,
+  parseOaiMemCitation,
+  parseProcedureStepsFromBody,
+  parseStrictCliDate,
   performReview,
+  planRecallMode,
   promoteSpace,
+  publisherFor,
+  publisherForConnector,
   pullFromSpace,
   pushToSpace,
+  readAuditLog,
+  readManifest,
+  recallForActiveMemory,
   recallRequestSchema,
+  registerBulkImportSource,
+  registerPublisher,
+  registerTrainingExportAdapter,
   removeConnector,
+  renderBriefingMarkdown,
+  renderExtensionsBlock,
+  renderExtensionsFooter,
+  resolveBriefingSaveDir,
+  resolveCategory,
   resolveConnectorFromToken,
+  resolveExtensionsRoot,
+  resolvePrincipal,
+  resolveRemnicPluginEntry,
+  revertToVersion,
   revokeToken,
   rollbackFromEngramMigration,
+  runBinaryLifecyclePipeline,
+  runBulkImportCliCommand,
+  runBulkImportPipeline,
+  runCodexMaterialize,
+  runEnrichmentPipeline,
+  runPostConsolidationMaterialize,
+  sanitizeNoteForCitation,
   sanitizeSessionKeyForFilename,
   saveManifest,
   saveRegistry,
+  saveTaxonomy,
   saveTokenStore,
+  scanForBinaries,
   shareSpace,
+  stripCitation,
   suggestionSubmitRequestSchema,
   switchSpace,
   syncChanges,
+  validateBriefingFormat,
+  validateImportTurn,
+  validateMarketplaceManifest,
   validateRequest,
-  watchForChanges
+  validateSlug,
+  validateTaxonomy,
+  verdictCacheSize,
+  watchForChanges,
+  writeManifest,
+  writeMarketplaceManifest
 };
 //# sourceMappingURL=index.js.map