@remnic/core 1.1.12 → 1.1.13

package/dist/index.js

@@ -13,8 +13,49 @@ import {
   writePeerProfile
 } from "./chunk-4DWOBS2A.js";
 import {
-  buildTokenEntry,
-  commitTokenEntry,
+  EnrichmentProviderRegistry,
+  WebSearchProvider,
+  appendAuditEntry,
+  defaultEnrichmentPipelineConfig,
+  readAuditLog,
+  runEnrichmentPipeline
+} from "./chunk-N2D6GXBM.js";
+import {
+  MARKETPLACE_MANIFEST_FILENAME,
+  MARKETPLACE_SCHEMA_VERSION,
+  checkMarketplaceManifest,
+  doctorConnector,
+  generateMarketplaceManifest,
+  getConnectorToken,
+  installConnector,
+  installFromMarketplace,
+  listConnectors,
+  loadRegistry,
+  removeConnector,
+  saveRegistry,
+  validateMarketplaceManifest,
+  writeMarketplaceManifest
+} from "./chunk-326G7DJK.js";
+import "./chunk-V5OCT34X.js";
+import {
+  executeResolution,
+  isValidResolutionVerb
+} from "./chunk-47VWKCAF.js";
+import {
+  ACTIVE_STATUSES,
+  judgeContradictionPairs,
+  runContradictionScan
+} from "./chunk-DK5LDEQM.js";
+import {
+  computePairId,
+  isCoolingDown,
+  listPairs,
+  readPair,
+  resolvePair,
+  writePair,
+  writePairs
+} from "./chunk-APO3DCMU.js";
+import {
   generateToken,
   getAllValidTokens,
   getAllValidTokensCached,
@@ -23,7 +64,7 @@ import {
   resolveConnectorFromToken,
   revokeToken,
   saveTokenStore
-} from "./chunk-HQZVVSVB.js";
+} from "./chunk-MSWG7JI6.js";
 import {
   runGraphRecall
 } from "./chunk-DGVM5SFL.js";
@@ -53,22 +94,48 @@ import {
   runBulkImportCliCommand,
   runBulkImportPipeline,
   validateImportTurn
-} from "./chunk-7ZM3BFKK.js";
-import "./chunk-ZNQN6ZTA.js";
+} from "./chunk-CHEL3SKB.js";
+import "./chunk-ICRIXAP2.js";
+import "./chunk-EHRTFRWW.js";
+import "./chunk-S7KDBTWT.js";
+import "./chunk-TZOLIGIG.js";
+import "./chunk-TK4UEOSK.js";
+import "./chunk-TFO23QT4.js";
+import "./chunk-7OZ53EXP.js";
+import "./chunk-GIF42EW3.js";
+import "./chunk-66DHUKLO.js";
+import "./chunk-Z734BLO3.js";
+import "./chunk-DOM4GKSW.js";
+import "./chunk-W4L6CZKA.js";
+import "./chunk-3JXBXXM2.js";
+import "./chunk-6H2TESSP.js";
+import "./chunk-TKWGAOLV.js";
+import "./chunk-FIT6DMX6.js";
+import "./chunk-TPMQ3G6Z.js";
+import "./chunk-JLFA7DQG.js";
+import "./chunk-KLAO5DGL.js";
+import "./chunk-PZIAX57I.js";
+import "./chunk-65PG43EQ.js";
+import "./chunk-KJTKLXTH.js";
+import "./chunk-PK7H5L6Y.js";
+import "./chunk-LT3NLYSI.js";
+import "./chunk-TMM4S4IJ.js";
+import "./chunk-XVZ7B3HG.js";
 import {
   clearAuthTokenSecretCache,
   isAgentAccessSecretRef,
   resolveAgentAccessAuthToken
 } from "./chunk-MXC3AP5I.js";
-import "./chunk-X7HPGUVG.js";
+import "./chunk-4CRG46BG.js";
 import {
   parseXrayBudgetFlag,
   parseXrayCliOptions
-} from "./chunk-Y3VMVTYX.js";
+} from "./chunk-MT4HVDUZ.js";
 import {
   parseStrictCliDate
 } from "./chunk-AJA46VX5.js";
-import "./chunk-DZZPC36E.js";
+import "./chunk-UXHQAFNA.js";
+import "./chunk-MT25YHYH.js";
 import "./chunk-HL4DB7TO.js";
 import "./chunk-ZPKBYX2F.js";
 import "./chunk-3SLRNYNG.js";
@@ -77,7 +144,7 @@ import "./chunk-Y4Z4I6WK.js";
 import "./chunk-5HRY2WRF.js";
 import {
   reportBufferSurpriseDistribution
-} from "./chunk-ASAITVLA.js";
+} from "./chunk-YBPYIAA5.js";
 import {
   DEFAULT_SURPRISE_K,
   computeSurprise
@@ -85,35 +152,53 @@ import {
 import {
   getMemoryForActiveMemory,
   recallForActiveMemory
-} from "./chunk-G4SK7DSQ.js";
+} from "./chunk-2WWLHTZY.js";
 import "./chunk-6MKAMLQL.js";
 import {
   DEFAULT_TAXONOMY,
   Orchestrator,
-  applyLcmSchema,
   branchNamespaceName,
   buildProcedureRecallSection,
   decideSemanticDedup,
   defaultWorkspaceDir,
   describeCodingScope,
-  ensureLcmStateDir,
   generateResolverDocument,
   getTaxonomyDir,
   getTaxonomyFilePath,
   loadTaxonomy,
-  migrateFromEngram,
-  openLcmDatabase,
   projectNamespaceName,
   resolveCodingNamespaceOverlay,
-  rollbackFromEngramMigration,
   sanitizeSessionKeyForFilename,
   saveTaxonomy,
   validateSlug,
   validateTaxonomy
-} from "./chunk-BZSQEPRW.js";
+} from "./chunk-GA454ALV.js";
 import "./chunk-CK5NTM2S.js";
-import "./chunk-FQDPCE3I.js";
+import {
+  migrateFromEngram,
+  rollbackFromEngramMigration
+} from "./chunk-KOSORCJG.js";
+import "./chunk-BFBF3XEF.js";
+import "./chunk-HHLLAQGZ.js";
+import "./chunk-UWK5OXUJ.js";
+import "./chunk-VNO6ZJ35.js";
+import "./chunk-34DQE4KF.js";
+import "./chunk-56K5QLHX.js";
+import "./chunk-7N4KAIGN.js";
+import "./chunk-TPDBFYEG.js";
+import "./chunk-ZTFCYYEZ.js";
+import {
+  applyLcmSchema,
+  ensureLcmStateDir,
+  openLcmDatabase
+} from "./chunk-7XYTQGCC.js";
+import "./chunk-TECVW3JP.js";
+import "./chunk-RYED3SPJ.js";
+import "./chunk-KUJVMMZQ.js";
+import "./chunk-U4SCL7B7.js";
 import "./chunk-FSFEQI74.js";
+import "./chunk-OIGNEXKZ.js";
+import "./chunk-MDYG7VI7.js";
 import "./chunk-Z5AAYHUC.js";
 import {
   computeTierValueScore,
@@ -121,14 +206,12 @@ import {
 } from "./chunk-S75M5ZRK.js";
 import "./chunk-TPB3I2AC.js";
 import "./chunk-UHGBNIOS.js";
-import "./chunk-7V22HTMD.js";
-import "./chunk-ETOW6ACV.js";
+import "./chunk-H3ME6L6D.js";
+import "./chunk-XJNBEDFE.js";
 import {
   buildTargetedFactRecallSection,
   shouldRecallTargetedFactEvidence
 } from "./chunk-VWT3F4IV.js";
-import "./chunk-OIGNEXKZ.js";
-import "./chunk-MDYG7VI7.js";
 import "./chunk-JR4ZC3G4.js";
 import "./chunk-5IZL4DCV.js";
 import "./chunk-5NPGSAVB.js";
@@ -162,7 +245,7 @@ import {
   builtInLiveConnectorDefinitions,
   hasEnabledLiveConnector,
   runLiveConnectorsOnce
-} from "./chunk-XMVFHBHT.js";
+} from "./chunk-U3WSW6PZ.js";
 import "./chunk-H63EDPFJ.js";
 import {
   hasBroadGraphIntent,
@@ -172,7 +255,7 @@ import {
   planRecallMode
 } from "./chunk-PD6O7AXF.js";
 import "./chunk-YAZNBMNF.js";
-import "./chunk-DF3RVK3X.js";
+import "./chunk-LCR46JY5.js";
 import {
   clearVerdictCache,
   createVerdictCache,
@@ -185,19 +268,21 @@ import {
 } from "./chunk-C4SQJZAF.js";
 import {
   ExtractionEngine
-} from "./chunk-ZG7PTKBK.js";
+} from "./chunk-W3LR522O.js";
 import "./chunk-4RA3C3EV.js";
 import "./chunk-WW3QQF4H.js";
 import "./chunk-54V4BZWP.js";
-import "./chunk-QR3C7BKQ.js";
-import "./chunk-HELQZFZO.js";
+import {
+  ModelRegistry
+} from "./chunk-QR3C7BKQ.js";
+import "./chunk-EDTHC6UD.js";
 import {
   buildFocusedListRecallSection,
   shouldRecallFocusedListEvidence
 } from "./chunk-DB5A3NHS.js";
 import {
   buildEntityRecallSection
-} from "./chunk-UVMUAWVT.js";
+} from "./chunk-7IASACLB.js";
 import {
   buildEventOrderRecallSection,
   shouldRecallEventOrderEvidence
@@ -229,21 +314,25 @@ import {
   FILTER_LABELS,
   isDirectAnswerEligible
 } from "./chunk-Y4FHOFJ2.js";
-import "./chunk-Z2E7VW55.js";
+import "./chunk-NMZY542O.js";
 import {
   CODEX_THREAD_KEY_PREFIX
 } from "./chunk-3PG3H5TD.js";
 import "./chunk-2NMMFZ5T.js";
+import {
+  buildExtensionsBlockForConsolidation
+} from "./chunk-I5V2VDIW.js";
+import {
+  runCodexMaterialize,
+  runPostConsolidationMaterialize
+} from "./chunk-ME6ESPZU.js";
 import {
   MATERIALIZE_VERSION,
   SENTINEL_FILE,
-  buildExtensionsBlockForConsolidation,
   describeMemoriesDir,
   ensureSentinel,
-  materializeForNamespace,
-  runCodexMaterialize,
-  runPostConsolidationMaterialize
-} from "./chunk-CPKTBRS2.js";
+  materializeForNamespace
+} from "./chunk-RHY3HH7P.js";
 import {
   REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT,
   discoverMemoryExtensions,
@@ -251,20 +340,37 @@ import {
   renderExtensionsFooter,
   resolveExtensionsRoot
 } from "./chunk-EJI5XIBB.js";
-import "./chunk-FMEBPEAO.js";
+import "./chunk-2PRQG7PV.js";
+import "./chunk-LUDTDZLK.js";
 import "./chunk-PYXS46O7.js";
 import "./chunk-3QKK7QOS.js";
-import "./chunk-JESOB2HO.js";
-import "./chunk-JRNQ3RNA.js";
-import "./chunk-WEJG4TB5.js";
+import "./chunk-P4NEIHUT.js";
+import "./chunk-W4RVMTHR.js";
+import "./chunk-MC26UJIM.js";
 import "./chunk-CULXMQJH.js";
-import "./chunk-E6K4NIEU.js";
+import "./chunk-5375UYTQ.js";
+import "./chunk-FF4KLI5W.js";
 import "./chunk-EABGC2TL.js";
+import "./chunk-PU63GXWS.js";
+import "./chunk-6RVI47ZR.js";
 import {
-  LanceDbBackend,
-  MeilisearchBackend,
   OramaBackend
-} from "./chunk-HL5LRPNA.js";
+} from "./chunk-XVVIG67A.js";
+import "./chunk-PIRJPV5T.js";
+import "./chunk-RXDLTSWT.js";
+import {
+  LanceDbBackend
+} from "./chunk-3VAL7ZL2.js";
+import {
+  MeilisearchBackend
+} from "./chunk-TMQLARTH.js";
+import "./chunk-MJFNCJXV.js";
+import "./chunk-NJ3MJQZX.js";
+import "./chunk-QQUAB63I.js";
+import "./chunk-PR5FBTFU.js";
+import "./chunk-FJ43PRLT.js";
+import "./chunk-LLQ2LLWF.js";
+import "./chunk-7DTASS5T.js";
 import "./chunk-YRMVARQP.js";
 import {
   LEGACY_PLUGIN_ID,
@@ -273,7 +379,7 @@ import {
 } from "./chunk-U66YHYC7.js";
 import {
   QmdClient
-} from "./chunk-P77UEOU2.js";
+} from "./chunk-BJ3KMYTB.js";
 import {
   DEFAULT_POLL_INTERVAL_MS,
   GOOGLE_DRIVE_CONNECTOR_ID,
@@ -288,26 +394,21 @@ import {
   defaultGoogleDriveClientFactory,
   validateGoogleDriveConfig,
   validateNotionConfig
-} from "./chunk-4IS4SXIQ.js";
+} from "./chunk-HXXBL2KD.js";
 import {
   CONNECTOR_ID_PATTERN,
   isValidConnectorId,
   listConnectorStates,
   readConnectorState,
   writeConnectorState
-} from "./chunk-6TBWYBJ3.js";
+} from "./chunk-LPMVBPA3.js";
 import "./chunk-JXS5PDQ7.js";
 import "./chunk-HMDCOMYU.js";
 import "./chunk-7SEAZFFB.js";
-import "./chunk-K6WK37A6.js";
+import "./chunk-D46YSIYX.js";
 import "./chunk-AJU4PJGY.js";
 import "./chunk-C6QPK5GG.js";
-import "./chunk-FYIYMQ5N.js";
-import {
-  coerceInstallExtension,
-  parseConfig
-} from "./chunk-HY3L4WKC.js";
-import "./chunk-Z5LAYHGJ.js";
+import "./chunk-2KI4QFHU.js";
 import {
   CONNECTORS_OUTPUT_FORMATS,
   parseConnectorsFormat,
@@ -318,36 +419,53 @@ import {
   renderConnectorsRunResult,
   runConnectorPollOnce
 } from "./chunk-OZHRDTDX.js";
+import "./chunk-3UXOZBHV.js";
 import "./chunk-KVE7R4CG.js";
 import "./chunk-4WMCPJWX.js";
 import {
   SmartBuffer
-} from "./chunk-JBMSGZEQ.js";
+} from "./chunk-5RGLBDQF.js";
 import {
   FallbackLlmClient
-} from "./chunk-AQJNPMOA.js";
-import "./chunk-PH4C2U43.js";
+} from "./chunk-DINWEURR.js";
+import "./chunk-FLTNHQK6.js";
 import "./chunk-7SI52C65.js";
 import "./chunk-L2EXJQJP.js";
 import "./chunk-UZB5KHKX.js";
 import {
   setCodexCliFallbackRunnerForProcess
 } from "./chunk-RK6F44Y6.js";
+import {
+  isOpenaiApiKeyDisabled,
+  parseConfig,
+  resolveEnvVars
+} from "./chunk-2QR3XXIC.js";
+import {
+  coerceInstallExtension
+} from "./chunk-PHK3HARR.js";
+import "./chunk-Z5LAYHGJ.js";
 import "./chunk-6HZ6AO2P.js";
 import "./chunk-JWPLJLDU.js";
 import {
   BootstrapEngine
 } from "./chunk-N53K2EXC.js";
 import "./chunk-XYIK4LF6.js";
-import "./chunk-URB2WSKZ.js";
+import "./chunk-NZL6GGQE.js";
 import "./chunk-PVGDJXVK.js";
 import "./chunk-NGAVDO7E.js";
 import {
   EngramAccessHttpServer
-} from "./chunk-RVPLBATS.js";
+} from "./chunk-CQZRLNMV.js";
+import "./chunk-SEDEKFYQ.js";
+import "./chunk-6FC5EGNV.js";
+import "./chunk-3Y4P7RXM.js";
+import "./chunk-6LVVDPJ4.js";
+import "./chunk-7MNMYOFP.js";
+import "./chunk-FKFMOY3N.js";
+import "./chunk-FAJ7FZYM.js";
 import {
   EngramMcpServer
-} from "./chunk-XAMBKFQS.js";
+} from "./chunk-WZYKANL3.js";
 import {
   REMNIC_CHATGPT_MEMORY_INSPECTOR_CANONICAL_TOOL,
   REMNIC_CHATGPT_MEMORY_INSPECTOR_MIME_TYPE,
@@ -368,10 +486,12 @@ import {
   EngramAccessService,
   computeProcedureStats,
   formatProcedureStatsText
-} from "./chunk-MNU6ZBWT.js";
+} from "./chunk-M23FSH32.js";
+import "./chunk-ZKSK55RC.js";
+import "./chunk-WELDCG6C.js";
 import {
   importCapsule
-} from "./chunk-IB3BFHGN.js";
+} from "./chunk-GGKRUQOO.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-H7XKCNR6.js";
 import {
@@ -381,18 +501,18 @@ import {
   renderXrayJson,
   renderXrayMarkdown,
   renderXrayText
-} from "./chunk-E2UCDP5S.js";
+} from "./chunk-FBYESMQ2.js";
 import "./chunk-SOBJ6NEY.js";
 import {
   normalizeOriginUrl,
   resolveGitContext,
   stableHash
-} from "./chunk-D54LZC5L.js";
+} from "./chunk-FDU6HUUL.js";
 import {
   isTrustZoneName
 } from "./chunk-QDZ2RLEC.js";
-import "./chunk-JKDVIE52.js";
-import "./chunk-242S3I2A.js";
+import "./chunk-MGKYQQYF.js";
+import "./chunk-GL6I6MEQ.js";
 import {
   isLcmMessagePartKind,
   normalizeExplicitParts,
@@ -402,33 +522,30 @@ import {
   parseOpenClawMessageParts,
   parsePiMessageParts,
   partsFromRenderedText
-} from "./chunk-D4GAOFF6.js";
+} from "./chunk-3APJ5EVB.js";
 import "./chunk-5UM2VJ6D.js";
-import "./chunk-4YM32CRU.js";
+import "./chunk-EFJ3MQ4V.js";
 import {
   memoryWorthOutcomeEligibleCategories,
   recordMemoryOutcome
 } from "./chunk-EIR5VLIH.js";
 import "./chunk-PCUKNJAZ.js";
-import "./chunk-EEQLFRUM.js";
+import "./chunk-RRF5UOBJ.js";
 import "./chunk-NBNN5GOB.js";
-import {
-  launchProcessSync
-} from "./chunk-OR64ZGRZ.js";
+import "./chunk-NNVTUXEB.js";
 import {
   buildProcedureMarkdownBody,
   parseProcedureStepsFromBody
 } from "./chunk-QDW3E4RD.js";
-import "./chunk-GVPWB7EY.js";
-import "./chunk-2LGMW3DJ.js";
+import "./chunk-25MQ7IHJ.js";
 import {
   CrossNamespaceBudget,
   DEFAULT_CROSS_NAMESPACE_BUDGET
 } from "./chunk-GDFS42HT.js";
+import "./chunk-U3PN77QT.js";
 import "./chunk-RK2Y4XOM.js";
 import "./chunk-2LSZVONP.js";
 import "./chunk-WIICJPET.js";
-import "./chunk-G2WADRQ3.js";
 import {
   BRIEFING_FORMAT_ALLOWED,
   FileCalendarSource,
@@ -441,14 +558,19 @@ import {
   renderBriefingMarkdown,
   resolveBriefingSaveDir,
   validateBriefingFormat
-} from "./chunk-ZVTKDVVM.js";
+} from "./chunk-VW676BEI.js";
 import {
   StorageManager,
+  parseEntityFile,
+  serializeEntityFile
+} from "./chunk-7AAT6G4Q.js";
+import "./chunk-5UZXUTVO.js";
+import "./chunk-YNJHCGDT.js";
+import {
   parseFlexibleIsoTimestamp,
   parseIsoOffsetTimestamp,
   parseIsoUtcTimestamp
-} from "./chunk-3B6KIRBH.js";
-import "./chunk-YNJHCGDT.js";
+} from "./chunk-P7FMDTKL.js";
 import {
   CITATION_UNKNOWN,
   DEFAULT_CITATION_FORMAT,
@@ -464,15 +586,18 @@ import {
   DEFAULT_RECALL_DISCLOSURE,
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-23ZZK64Y.js";
-import "./chunk-SCU65EZI.js";
-import "./chunk-XJKFSSDW.js";
+} from "./chunk-Q7P4WJDP.js";
+import {
+  normalizeProjectionPreview,
+  normalizeProjectionTags
+} from "./chunk-SCU65EZI.js";
+import "./chunk-3KW65B36.js";
+import "./chunk-3HPAPHUK.js";
 import "./chunk-PFV5C235.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";
 import "./chunk-FVQJYWH7.js";
-import "./chunk-4DJQYKMN.js";
 import "./chunk-G7D6GZ5J.js";
 import {
   createVersion,
@@ -483,17 +608,18 @@ import {
 } from "./chunk-FAAFWE4G.js";
 import {
   expandTildePath
-} from "./chunk-IXEJRKCZ.js";
-import {
-  mergeEnv,
-  readEnvVar,
-  resolveHomeDir
-} from "./chunk-MARWOCVP.js";
-import "./chunk-74EMIVE4.js";
+} from "./chunk-QRNI5JBH.js";
+import "./chunk-ZY2MNJR6.js";
+import "./chunk-MY6TPVXW.js";
 import "./chunk-DT5TVLJE.js";
 import {
   resolvePrincipal
-} from "./chunk-N5AKDXAI.js";
+} from "./chunk-UWVJF25J.js";
+import "./chunk-4DJQYKMN.js";
+import {
+  readEnvVar,
+  resolveHomeDir
+} from "./chunk-XIG5PDM7.js";
 import "./chunk-TBBDFYXW.js";
 import {
   initLogger,
@@ -518,16 +644,18 @@ import {
   recallRequestSchema,
   suggestionSubmitRequestSchema,
   validateRequest
-} from "./chunk-U5JMRGKX.js";
-import "./chunk-BBE34QBJ.js";
-import "./chunk-767ODGE6.js";
+} from "./chunk-A2XUIMJ3.js";
+import "./chunk-2F2W355T.js";
+import "./chunk-KNKUID7G.js";
+import {
+  CAPSULE_ID_PATTERN
+} from "./chunk-WEHSQBFR.js";
+import "./chunk-J4EB7DNW.js";
+import "./chunk-I6K5FBRQ.js";
 import {
   assertIsDirectoryNotSymlink,
   assertRealpathInsideRoot
-} from "./chunk-457A4P3L.js";
-import {
-  CAPSULE_ID_PATTERN
-} from "./chunk-OA3L7BFR.js";
+} from "./chunk-AGZQD76C.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
@@ -2229,15 +2357,21 @@ function walkMdFiles(dir, callback) {
 // src/review/index.ts
 import fs6 from "fs";
 import path10 from "path";
+var DEFAULT_CONFIDENCE_THRESHOLD = 0.7;
 function listReviewItems(options) {
   const startTime = Date.now();
   const {
     memoryDir,
     reason: filterReason,
     limit = 50,
-    confidenceThreshold = 0.7
+    confidenceThreshold = DEFAULT_CONFIDENCE_THRESHOLD
   } = options;
   const items = [];
+  const addItem = (item) => {
+    if (items.length >= limit) return;
+    if (filterReason && item.reviewReason !== filterReason) return;
+    items.push(item);
+  };
   const suggestionsDir = path10.join(memoryDir, "suggestions");
   if (fs6.existsSync(suggestionsDir)) {
     walkMd(suggestionsDir, (filePath, content) => {
@@ -2245,7 +2379,7 @@ function listReviewItems(options) {
       const fm = parseFrontmatter4(content);
       const body = extractBody4(content);
       if (!fm?.id) return;
-      items.push({
+      addItem({
         id: fm.id,
         content: body,
         category: fm.category ?? "suggestion",
@@ -2265,7 +2399,7 @@ function listReviewItems(options) {
       const fm = parseFrontmatter4(content);
       const body = extractBody4(content);
       if (!fm?.id) return;
-      items.push({
+      addItem({
         id: fm.id,
         content: body,
         category: fm.category ?? "review",
@@ -2291,8 +2425,9 @@ function listReviewItems(options) {
       if (!fm?.id) return;
       const confidence = parseConfidence(fm.confidence, 1);
       if (confidence >= confidenceThreshold) return;
+      if (parseBoolean(fm.reviewDismissed)) return;
       if (items.some((i) => i.id === fm.id)) return;
-      items.push({
+      addItem({
         id: fm.id,
         content: body,
         category: fm.category ?? category.slice(0, -1),
@@ -2305,95 +2440,136 @@ function listReviewItems(options) {
       });
     });
   }
-  const filtered = filterReason ? items.filter((i) => i.reviewReason === filterReason) : items;
   return {
-    items: filtered.slice(0, limit),
-    total: filtered.length,
+    items,
+    total: items.length,
     durationMs: Date.now() - startTime
   };
 }
-function performReview(memoryDir, itemId, action) {
+function performReview(memoryDir, itemId, action, options = {}) {
   switch (action) {
     case "approve":
-      return approveItem(memoryDir, itemId);
+      return approveItem(memoryDir, itemId, options);
     case "dismiss":
-      return dismissItem(memoryDir, itemId);
+      return dismissItem(memoryDir, itemId, options);
     case "flag":
-      return flagItem(memoryDir, itemId);
+      return flagItem(memoryDir, itemId, options);
   }
 }
-function approveItem(memoryDir, itemId) {
-  const locations = ["suggestions", "review"];
-  for (const loc of locations) {
-    const dir = path10.join(memoryDir, loc);
-    if (!fs6.existsSync(dir)) continue;
-    const found = findFileById(dir, itemId);
-    if (!found) continue;
-    const content = fs6.readFileSync(found, "utf8");
-    const fm = parseFrontmatter4(content);
-    const body = extractBody4(content);
-    if (!fm) return { itemId, action: "approve", message: "Could not parse frontmatter" };
-    const category = fm.category ?? "fact";
-    const targetDir = getCategoryDir(memoryDir, category);
-    const dateDir = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-    const outputPath = path10.join(targetDir, dateDir, path10.basename(found));
-    const updatedContent = content.replace(/confidence: [\d.]+/, "confidence: 0.9").replace(/confidenceTier: \w+/, "confidenceTier: high");
-    fs6.mkdirSync(path10.dirname(outputPath), { recursive: true });
-    fs6.writeFileSync(outputPath, updatedContent);
-    fs6.unlinkSync(found);
+function approveItem(memoryDir, itemId, options) {
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "approve", message: "Item not found" };
+  }
+  const content = fs6.readFileSync(found.filePath, "utf8");
+  const fm = parseFrontmatter4(content);
+  if (!fm) return { itemId, action: "approve", message: "Could not parse frontmatter" };
+  const updatedContent = updateFrontmatterFields(content, {
+    confidence: "0.9",
+    confidenceTier: "high",
+    reviewDismissed: null
+  });
+  if (found.location === "category") {
+    fs6.writeFileSync(found.filePath, updatedContent, "utf8");
     return {
       itemId,
       action: "approve",
-      updatedPath: outputPath,
-      message: `Promoted to ${category} with confidence 0.9`
+      updatedPath: found.filePath,
+      message: "Approved low-confidence memory in place with confidence 0.9"
     };
   }
-  return { itemId, action: "approve", message: "Item not found" };
+  const category = fm.category ?? "fact";
+  const targetDir = getCategoryDir(memoryDir, category);
+  const dateDir = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+  const outputPath = path10.join(targetDir, dateDir, path10.basename(found.filePath));
+  fs6.mkdirSync(path10.dirname(outputPath), { recursive: true });
+  const promotedPath = writeFileWithoutClobber(outputPath, updatedContent, itemId);
+  fs6.unlinkSync(found.filePath);
+  return {
+    itemId,
+    action: "approve",
+    updatedPath: promotedPath,
+    message: `Promoted to ${category} with confidence 0.9`
+  };
 }
-function dismissItem(memoryDir, itemId) {
-  const locations = ["suggestions", "review"];
-  for (const loc of locations) {
-    const dir = path10.join(memoryDir, loc);
-    if (!fs6.existsSync(dir)) continue;
-    const found = findFileById(dir, itemId);
-    if (found) {
-      fs6.unlinkSync(found);
-      return { itemId, action: "dismiss", message: "Dismissed and removed" };
-    }
+function dismissItem(memoryDir, itemId, options) {
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "dismiss", message: "Item not found" };
+  }
+  if (found.location === "queue") {
+    fs6.unlinkSync(found.filePath);
+    return { itemId, action: "dismiss", message: "Dismissed and removed" };
+  }
+  const content = fs6.readFileSync(found.filePath, "utf8");
+  fs6.writeFileSync(
+    found.filePath,
+    updateFrontmatterFields(content, {
+      reviewDismissed: "true",
+      reviewDismissedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }),
+    "utf8"
+  );
+  return {
+    itemId,
+    action: "dismiss",
+    updatedPath: found.filePath,
+    message: "Dismissed low-confidence memory in place"
+  };
+}
+function flagItem(memoryDir, itemId, options) {
+  const found = findReviewFileById(memoryDir, itemId, options);
+  if (!found) {
+    return { itemId, action: "flag", message: "Item not found" };
   }
-  return { itemId, action: "dismiss", message: "Item not found" };
+  const content = fs6.readFileSync(found.filePath, "utf8");
+  const fixed = updateFrontmatterFields(content, {
+    flagged: "true",
+    flaggedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  fs6.writeFileSync(found.filePath, fixed);
+  return {
+    itemId,
+    action: "flag",
+    updatedPath: found.filePath,
+    message: "Flagged for further review"
+  };
 }
-function flagItem(memoryDir, itemId) {
-  const locations = ["suggestions", "review"];
-  for (const loc of locations) {
+function findReviewFileById(memoryDir, id, options = {}) {
+  for (const loc of ["suggestions", "review"]) {
     const dir = path10.join(memoryDir, loc);
     if (!fs6.existsSync(dir)) continue;
-    const found = findFileById(dir, itemId);
-    if (found) {
-      const content = fs6.readFileSync(found, "utf8");
-      const fixed = content.replace(
-        /^(---\n)/,
-        `---
-flagged: true
-flaggedAt: ${(/* @__PURE__ */ new Date()).toISOString()}
-`
-      );
-      fs6.writeFileSync(found, fixed);
-      return { itemId, action: "flag", message: "Flagged for further review" };
-    }
+    const found = findFileById(dir, id);
+    if (found) return { filePath: found, location: "queue" };
+  }
+  for (const category of ALL_CATEGORY_DIRS) {
+    const dir = path10.join(memoryDir, category);
+    if (!fs6.existsSync(dir)) continue;
+    const found = findFileById(dir, id, (fm) => isLowConfidenceReviewCandidate(fm, options));
+    if (found) return { filePath: found, location: "category" };
   }
-  return { itemId, action: "flag", message: "Item not found" };
+  return null;
 }
-function findFileById(dir, id) {
+function findFileById(dir, id, include) {
   const files = walkMdPaths(dir);
   for (const filePath of files) {
     const content = readFileSafe3(filePath);
     if (!content) continue;
     const fm = parseFrontmatter4(content);
-    if (fm?.id === id) return filePath;
+    if (fm?.id === id && (!include || include(fm))) return filePath;
   }
   return null;
 }
+function isLowConfidenceReviewCandidate(fm, options) {
+  const threshold = options.confidenceThreshold ?? DEFAULT_CONFIDENCE_THRESHOLD;
+  return parseConfidence(fm.confidence, 1) < threshold && !parseBoolean(fm.reviewDismissed);
+}
+function parseBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "true" || normalized === "1" || normalized === "yes";
+}
 function parseConfidence(value, fallback) {
   if (typeof value === "number") return Number.isFinite(value) ? value : fallback;
   if (typeof value === "string") {
@@ -2402,6 +2578,36 @@ function parseConfidence(value, fallback) {
   }
   return fallback;
 }
+function updateFrontmatterFields(content, fields) {
+  const match = content.match(/^(---\n)([\s\S]*?)(\n---(?:\n|$))/);
+  if (!match) return content;
+  const seen = /* @__PURE__ */ new Set();
+  const lines = match[2].split("\n");
+  const nextLines = [];
+  for (const line of lines) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) {
+      nextLines.push(line);
+      continue;
+    }
+    const key = line.slice(0, colonIdx).trim();
+    if (!Object.prototype.hasOwnProperty.call(fields, key)) {
+      nextLines.push(line);
+      continue;
+    }
+    seen.add(key);
+    const value = fields[key];
+    if (value !== null) {
+      nextLines.push(`${key}: ${value}`);
+    }
+  }
+  for (const [key, value] of Object.entries(fields)) {
+    if (value !== null && !seen.has(key)) {
+      nextLines.push(`${key}: ${value}`);
+    }
+  }
+  return `${match[1]}${nextLines.join("\n")}${match[3]}${content.slice(match[0].length)}`;
+}
 function readFileSafe3(filePath) {
   try {
     return fs6.readFileSync(filePath, "utf8");
@@ -2409,6 +2615,46 @@ function readFileSafe3(filePath) {
     return null;
   }
 }
+function writeFileWithoutClobber(basePath, content, discriminator) {
+  const parsed = path10.parse(basePath);
+  const safeDiscriminator = sanitizeFilePart(discriminator);
+  for (let attempt = 0; attempt < 1e3; attempt++) {
+    const candidate = attempt === 0 ? basePath : path10.join(
+      parsed.dir,
+      `${parsed.name}-${safeDiscriminator}${attempt === 1 ? "" : `-${attempt}`}${parsed.ext || ".md"}`
+    );
+    try {
+      fs6.writeFileSync(candidate, content, { encoding: "utf8", flag: "wx" });
+      return candidate;
+    } catch (error) {
+      if (error.code === "EEXIST") continue;
+      throw error;
+    }
+  }
+  throw new Error(`Could not find a free review promotion path for ${basePath}`);
+}
+function sanitizeFilePart(value) {
+  const chars = [];
+  let previousWasDash = false;
+  for (const char of value) {
+    const next = isSafeFilePartChar(char) ? char : "-";
+    if (next === "-" && previousWasDash) continue;
+    chars.push(next);
+    previousWasDash = next === "-";
+    if (chars.length >= 64) break;
+  }
+  let start = 0;
+  let end = chars.length;
+  while (start < end && chars[start] === "-") start++;
+  while (end > start && chars[end - 1] === "-") end--;
+  const sanitized = chars.slice(start, end).join("");
+  return sanitized || "review-item";
+}
+function isSafeFilePartChar(value) {
+  if (value.length !== 1) return false;
+  const code = value.charCodeAt(0);
+  return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || value === "." || value === "_" || value === "-";
+}
 function parseFrontmatter4(content) {
   const match = content.match(/^---\n([\s\S]*?)\n---/);
   if (!match) return null;
@@ -2619,2232 +2865,101 @@ function hashContent3(content) {
   return crypto5.createHash("sha256").update(content).digest("hex").slice(0, 16);
 }
 
-// src/connectors/index.ts
-import fs9 from "fs";
-import path13 from "path";
-import os from "os";
-import { createRequire } from "module";
-import { fileURLToPath } from "url";
-
-// src/connectors/codex-marketplace.ts
+// src/spaces/index.ts
 import fs8 from "fs";
 import path12 from "path";
-var MARKETPLACE_SCHEMA_VERSION = 1;
-var MARKETPLACE_MANIFEST_FILENAME = "marketplace.json";
-var VALID_INSTALL_TYPES = /* @__PURE__ */ new Set(["github", "git", "local", "url"]);
-function generateMarketplaceManifest(options) {
-  const version = options?.packageVersion ?? readPackageVersion() ?? "0.0.0";
-  return {
-    version: MARKETPLACE_SCHEMA_VERSION,
-    name: "remnic",
-    description: "Remnic: Local-first AI memory with semantic search and consolidation",
-    plugins: [
-      {
-        name: "remnic",
-        version,
-        description: "Persistent memory plugin for Codex CLI",
-        repository: "joshuaswarren/remnic",
-        installType: "github",
-        entry: "packages/plugin-codex",
-        configSchema: "openclaw.plugin.json"
-      }
-    ]
-  };
-}
-function validateMarketplaceManifest(manifest) {
-  const validation = checkMarketplaceManifest(manifest);
-  if (!validation.valid) {
-    throw new Error(
-      `Invalid marketplace manifest: ${validation.errors.join("; ")}`
-    );
-  }
-  return manifest;
+import crypto6 from "crypto";
+var MANIFEST_VERSION = 1;
+function getSpacesDir(baseDir) {
+  const homeDir = baseDir ?? resolveHomeDir();
+  return path12.join(homeDir, ".config", "engram", "spaces");
 }
-function checkMarketplaceManifest(manifest) {
-  const errors = [];
-  if (typeof manifest !== "object" || manifest === null) {
-    return { valid: false, errors: ["manifest must be a non-null object"] };
-  }
-  const obj = manifest;
-  if (obj.version !== MARKETPLACE_SCHEMA_VERSION) {
-    errors.push(`version must be ${MARKETPLACE_SCHEMA_VERSION}, got ${JSON.stringify(obj.version)}`);
-  }
-  if (typeof obj.name !== "string" || obj.name.trim().length === 0) {
-    errors.push("name must be a non-empty string");
-  }
-  if (typeof obj.description !== "string" || obj.description.trim().length === 0) {
-    errors.push("description must be a non-empty string");
-  }
-  if (!Array.isArray(obj.plugins)) {
-    errors.push("plugins must be an array");
-  } else if (obj.plugins.length === 0) {
-    errors.push("plugins must contain at least one entry");
-  } else {
-    for (let i = 0; i < obj.plugins.length; i++) {
-      const plugin = obj.plugins[i];
-      const prefix = `plugins[${i}]`;
-      if (typeof plugin !== "object" || plugin === null) {
-        errors.push(`${prefix} must be a non-null object`);
-        continue;
-      }
-      if (typeof plugin.name !== "string" || plugin.name.trim().length === 0) {
-        errors.push(`${prefix}.name must be a non-empty string`);
-      }
-      if (typeof plugin.version !== "string" || plugin.version.trim().length === 0) {
-        errors.push(`${prefix}.version must be a non-empty string`);
-      }
-      if (typeof plugin.description !== "string" || plugin.description.trim().length === 0) {
-        errors.push(`${prefix}.description must be a non-empty string`);
-      }
-      if (typeof plugin.repository !== "string" || plugin.repository.trim().length === 0) {
-        errors.push(`${prefix}.repository must be a non-empty string`);
-      }
-      if (typeof plugin.installType !== "string" || !VALID_INSTALL_TYPES.has(plugin.installType)) {
-        errors.push(
-          `${prefix}.installType must be one of: ${[...VALID_INSTALL_TYPES].join(", ")}; got ${JSON.stringify(plugin.installType)}`
-        );
-      }
-      if ("manifestUrl" in plugin && plugin.manifestUrl !== void 0) {
-        if (typeof plugin.manifestUrl !== "string" || plugin.manifestUrl.trim().length === 0) {
-          errors.push(`${prefix}.manifestUrl must be a non-empty string when provided`);
-        }
-      }
-      if ("entry" in plugin && plugin.entry !== void 0) {
-        if (typeof plugin.entry !== "string" || plugin.entry.trim().length === 0) {
-          errors.push(`${prefix}.entry must be a non-empty string when provided`);
-        }
-      }
-      if ("configSchema" in plugin && plugin.configSchema !== void 0) {
-        if (typeof plugin.configSchema !== "string" || plugin.configSchema.trim().length === 0) {
-          errors.push(`${prefix}.configSchema must be a non-empty string when provided`);
-        }
-      }
-    }
-  }
-  return { valid: errors.length === 0, errors };
+function getManifestPath(baseDir) {
+  return path12.join(getSpacesDir(baseDir), "manifest.json");
 }
-async function writeMarketplaceManifest(outputDir, manifest) {
-  const validation = checkMarketplaceManifest(manifest);
-  if (!validation.valid) {
-    throw new Error(
-      `Refusing to write invalid manifest: ${validation.errors.join("; ")}`
-    );
-  }
-  fs8.mkdirSync(outputDir, { recursive: true });
-  const destPath = path12.join(outputDir, MARKETPLACE_MANIFEST_FILENAME);
-  const tmpPath = `${destPath}.tmp.${process.pid}`;
-  const content = JSON.stringify(manifest, null, 2) + "\n";
-  fs8.writeFileSync(tmpPath, content);
-  fs8.renameSync(tmpPath, destPath);
-}
-async function installFromMarketplace(source, sourceType, config, logger) {
-  const _log = logger ?? {
-    info: (msg) => log.info(`[marketplace] ${msg}`),
-    warn: (msg) => log.warn(`[marketplace] ${msg}`),
-    debug: (msg) => log.debug(`[marketplace] ${msg}`)
-  };
-  if (!config.codexMarketplaceEnabled) {
-    return {
-      ok: false,
-      message: "Codex marketplace is disabled in config (codexMarketplaceEnabled: false)",
-      source,
-      sourceType,
-      pluginsFound: [],
-      errors: ["marketplace_disabled"]
-    };
-  }
-  try {
-    const manifest = await resolveManifest(source, sourceType, _log);
-    const pluginNames = manifest.plugins.map((p) => p.name);
-    _log.info(`marketplace install: found ${pluginNames.length} plugin(s) from ${sourceType}://${source}`);
-    return {
-      ok: true,
-      message: `Successfully resolved ${pluginNames.length} plugin(s) from marketplace: ${pluginNames.join(", ")}`,
-      source,
-      sourceType,
-      pluginsFound: pluginNames,
-      errors: []
-    };
-  } catch (err) {
-    const errMsg = err instanceof Error ? err.message : String(err);
-    _log.warn(`marketplace install failed: ${errMsg}`);
-    return {
-      ok: false,
-      message: `Failed to install from marketplace: ${errMsg}`,
-      source,
-      sourceType,
-      pluginsFound: [],
-      errors: [errMsg]
+function loadManifest(baseDir, memoryDirOverride) {
+  const manifestPath2 = getManifestPath(baseDir);
+  if (!fs8.existsSync(manifestPath2)) {
+    const personalSpace = createPersonalSpace(baseDir, memoryDirOverride);
+    const manifest = {
+      activeSpaceId: personalSpace.id,
+      spaces: [personalSpace],
+      version: MANIFEST_VERSION
     };
+    saveManifest(manifest, baseDir);
+    return manifest;
   }
+  const raw = JSON.parse(fs8.readFileSync(manifestPath2, "utf8"));
+  return raw;
 }
-async function resolveManifest(source, sourceType, logger) {
-  switch (sourceType) {
-    case "local":
-      return resolveLocal(source, logger);
-    case "url":
-      return resolveUrl(source, logger);
-    case "github":
-      return resolveGithub(source, logger);
-    case "git":
-      return resolveGit(source, logger);
-    default: {
-      const _ = sourceType;
-      throw new Error(`Invalid source type: ${String(_)}`);
-    }
-  }
+function saveManifest(manifest, baseDir) {
+  const manifestPath2 = getManifestPath(baseDir);
+  fs8.mkdirSync(path12.dirname(manifestPath2), { recursive: true });
+  fs8.writeFileSync(manifestPath2, JSON.stringify(manifest, null, 2) + "\n");
 }
-function resolveLocal(dirPath, logger) {
-  const manifestPath2 = path12.join(dirPath, MARKETPLACE_MANIFEST_FILENAME);
-  if (!fs8.existsSync(manifestPath2)) {
-    throw new Error(`marketplace.json not found at ${manifestPath2}`);
-  }
-  logger.debug?.(`reading local marketplace manifest: ${manifestPath2}`);
-  const raw = fs8.readFileSync(manifestPath2, "utf-8");
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error(`Invalid JSON in ${manifestPath2}`);
-  }
-  if (typeof parsed !== "object" || parsed === null) {
-    throw new Error(`marketplace.json at ${manifestPath2} is not a valid object`);
-  }
-  return validateMarketplaceManifest(parsed);
+function createPersonalSpace(baseDir, memoryDirOverride) {
+  const homeDir = baseDir ?? resolveHomeDir();
+  const standalonePath = path12.join(homeDir, ".engram", "memory");
+  const openclawPath = path12.join(homeDir, ".openclaw", "workspace", "memory", "local");
+  const memoryDir = memoryDirOverride ?? readEnvVar("ENGRAM_MEMORY_DIR") ?? (fs8.existsSync(standalonePath) ? standalonePath : fs8.existsSync(openclawPath) ? openclawPath : standalonePath);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    id: "personal",
+    name: "Personal",
+    kind: "personal",
+    description: "Default personal memory space",
+    memoryDir,
+    createdAt: now,
+    updatedAt: now,
+    owner: readEnvVar("USER")
+  };
 }
-async function resolveUrl(url, logger) {
-  logger.debug?.(`fetching marketplace manifest from URL: ${url}`);
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(url);
-  } catch {
-    throw new Error(`Invalid URL: ${url}`);
-  }
-  if (parsedUrl.protocol !== "https:" && parsedUrl.protocol !== "http:") {
-    throw new Error(`Unsupported URL protocol: ${parsedUrl.protocol} (use https or http)`);
-  }
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new Error(`HTTP ${response.status} fetching ${url}`);
-  }
-  const body = await response.json();
-  return validateMarketplaceManifest(body);
+function listSpaces(baseDir) {
+  const manifest = loadManifest(baseDir);
+  return manifest.spaces;
 }
-async function resolveGithub(repo, logger) {
-  if (!/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/u.test(repo)) {
-    throw new Error(`Invalid GitHub repo format: "${repo}" (expected owner/repo)`);
-  }
-  const rawUrl = `https://raw.githubusercontent.com/${repo}/HEAD/${MARKETPLACE_MANIFEST_FILENAME}`;
-  logger.debug?.(`fetching marketplace manifest from GitHub: ${rawUrl}`);
-  return resolveUrl(rawUrl, logger);
+function getActiveSpace(baseDir) {
+  const manifest = loadManifest(baseDir);
+  const space = manifest.spaces.find((s) => s.id === manifest.activeSpaceId);
+  if (!space) throw new Error(`Active space ${manifest.activeSpaceId} not found`);
+  return space;
 }
-async function resolveGit(gitUrl, logger) {
-  const ghMatch = gitUrl.match(
-    /^(?:https?:\/\/)?github\.com\/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+?)(?:\.git)?$/u
-  );
-  if (ghMatch?.[1]) {
-    logger.debug?.(`git URL looks like GitHub \u2014 delegating to github resolver`);
-    return resolveGithub(ghMatch[1], logger);
+function createSpace(options) {
+  const manifest = loadManifest(options.baseDir);
+  const id = options.name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-");
+  if (manifest.spaces.some((s) => s.id === id)) {
+    throw new Error(`Space "${id}" already exists`);
+  }
+  if (options.parentSpaceId && !manifest.spaces.some((s) => s.id === options.parentSpaceId)) {
+    throw new Error(`Parent space "${options.parentSpaceId}" not found`);
   }
-  throw new Error(
-    `Git URL resolution requires a GitHub-format URL for now. Got: ${gitUrl}. Use --type github or --type url instead.`
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const memoryDir = options.memoryDir ?? path12.join(
+    getSpacesDir(options.baseDir),
+    id,
+    "memory"
   );
-}
-function readPackageVersion() {
-  const candidates = [
-    path12.resolve(import.meta.dirname ?? ".", "../../../.."),
-    path12.resolve(import.meta.dirname ?? ".", "../../../../.."),
-    path12.resolve(import.meta.dirname ?? ".", "..")
-  ];
-  for (const candidate of candidates) {
-    const pkgPath = path12.join(candidate, "package.json");
-    try {
-      if (!fs8.existsSync(pkgPath)) continue;
-      const raw = fs8.readFileSync(pkgPath, "utf-8");
-      const parsed = JSON.parse(raw);
-      if (typeof parsed === "object" && parsed !== null && typeof parsed.version === "string") {
-        return parsed.version;
-      }
-    } catch {
-    }
-  }
-  return void 0;
-}
-
-// src/connectors/index.ts
-var BUILTIN_CONNECTORS = [
-  {
-    id: "claude-code",
-    name: "Claude Code",
-    version: "1.0.0",
-    description: "Anthropic's Claude Code CLI \u2014 direct memory access via MCP",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: true,
-      entities: true,
-      realtimeSync: true,
-      batch: false,
-      maxBudgetChars: 32e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server",
-      namespace: "Optional namespace (default: 'default')"
-    },
-    homepage: "https://claude.ai/code",
-    author: "Anthropic",
-    tags: ["official", "ai", "claude"],
-    requiresToken: true
-  },
-  {
-    id: "codex-cli",
-    name: "Codex CLI",
-    version: "1.0.0",
-    description: "OpenAI Codex CLI \u2014 memory via MCP tool",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: false,
-      entities: false,
-      realtimeSync: false,
-      batch: true,
-      maxBudgetChars: 8e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server",
-      namespace: "Optional namespace"
-    },
-    homepage: "https://openai.com/codex",
-    author: "OpenAI",
-    tags: ["official", "ai", "codex"],
-    requiresToken: true
-  },
-  {
-    id: "cursor",
-    name: "Cursor IDE",
-    version: "1.0.0",
-    description: "Cursor IDE \u2014 memory via config file + tool calls",
-    capabilities: {
-      observe: false,
-      recall: true,
-      store: false,
-      search: true,
-      entities: false,
-      realtimeSync: false,
-      batch: false,
-      maxBudgetChars: 32e3,
-      connectionType: "embedded"
-    },
-    configSchema: {
-      memoryDir: "Path to Remnic memory directory"
-    },
-    homepage: "https://cursor.com",
-    author: "Cursor Inc.",
-    tags: ["official", "ide"]
-  },
-  {
-    id: "cline",
-    name: "Cline",
-    version: "1.0.0",
-    description: "VS Code Cline extension \u2014 memory via MCP",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: false,
-      entities: false,
-      realtimeSync: false,
-      batch: true,
-      maxBudgetChars: 8e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server",
-      namespace: "Optional namespace"
-    },
-    homepage: "https://github.com/cline/cline",
-    author: "Cline",
-    tags: ["community", "vscode"]
-  },
-  {
-    id: "github-copilot",
-    name: "GitHub Copilot",
-    version: "1.0.0",
-    description: "GitHub Copilot \u2014 memory via MCP server",
-    capabilities: {
-      observe: false,
-      recall: true,
-      store: false,
-      search: true,
-      entities: false,
-      realtimeSync: false,
-      batch: false,
-      maxBudgetChars: 16e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server"
-    },
-    homepage: "https://github.com/features/copilot",
-    author: "GitHub",
-    tags: ["official", "ai", "github"]
-  },
-  {
-    id: "roo-code",
-    name: "Roo Code",
-    version: "1.0.0",
-    description: "Roo Code \u2014 memory via MCP",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: false,
-      entities: false,
-      realtimeSync: false,
-      batch: true,
-      maxBudgetChars: 16e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server",
-      namespace: "Optional namespace"
-    },
-    homepage: "https://roocode.com",
-    author: "Roo Code",
-    tags: ["community", "vscode"]
-  },
-  {
-    id: "windsurf",
-    name: "Windsurf",
-    version: "1.0.0",
-    description: "Windsurf IDE \u2014 memory via MCP",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: true,
-      entities: false,
-      realtimeSync: false,
-      batch: false,
-      maxBudgetChars: 32e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server"
-    },
-    homepage: "https://windsurf.com",
-    author: "Codeium",
-    tags: ["official", "ide"]
-  },
-  {
-    id: "amp",
-    name: "Amp",
-    version: "1.0.0",
-    description: "Amp coding agent \u2014 memory via MCP",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: true,
-      entities: false,
-      realtimeSync: false,
-      batch: false,
-      maxBudgetChars: 32e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server"
-    },
-    homepage: "https://ampcode.com",
-    author: "Sourcegraph",
-    tags: ["official", "ai"]
-  },
-  {
-    id: "pi",
-    name: "Pi Coding Agent",
-    version: "1.0.0",
-    description: "Pi Coding Agent \u2014 native extension for recall, observe, MCP tools, and compaction coordination",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: true,
-      entities: true,
-      realtimeSync: true,
-      batch: true,
-      maxBudgetChars: 32e3,
-      connectionType: "http"
-    },
-    configSchema: {
-      remnicDaemonUrl: "URL of the Remnic daemon (default: http://127.0.0.1:4318)",
-      namespace: "Optional namespace",
-      installExtension: "Install the Pi extension into ~/.pi/agent/extensions/remnic (default: true)"
-    },
-    homepage: "https://pi.dev",
-    author: "Remnic",
-    tags: ["official", "ai", "pi", "coding-agent"],
-    requiresToken: true
-  },
-  {
-    id: "replit",
-    name: "Replit Agent",
-    version: "1.0.0",
-    description: "Replit Agent \u2014 memory via HTTP API (reduced capabilities)",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: false,
-      entities: false,
-      realtimeSync: false,
-      batch: false,
-      maxBudgetChars: 8e3,
-      connectionType: "http"
-    },
-    configSchema: {
-      apiUrl: "URL of the Remnic HTTP API",
-      authToken: "Bearer token for authentication"
-    },
-    homepage: "https://replit.com",
-    author: "Replit",
-    tags: ["official", "cloud"],
-    requiresToken: true
-  },
-  {
-    id: "generic-mcp",
-    name: "Generic MCP Client",
-    version: "1.0.0",
-    description: "Any MCP-compatible client \u2014 connect via standard MCP protocol",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: true,
-      entities: true,
-      realtimeSync: true,
-      batch: true,
-      maxBudgetChars: 64e3,
-      connectionType: "mcp"
-    },
-    configSchema: {
-      mcpServerUrl: "URL of the MCP Remnic server",
-      namespace: "Optional namespace",
-      authToken: "Bearer token for authentication"
-    },
-    homepage: "https://github.com/joshuaswarren/remnic",
-    author: "Remnic",
-    tags: ["generic", "mcp"],
-    requiresToken: true
-  },
-  {
-    id: "weclone",
-    name: "WeClone Avatar",
-    version: "1.0.0",
-    description: "Memory-aware OpenAI-compatible proxy for deployed WeClone avatars \u2014 injects Remnic recall into chat completions and buffers turns via observe",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: false,
-      search: false,
-      entities: false,
-      realtimeSync: false,
-      batch: false,
-      maxBudgetChars: 32e3,
-      connectionType: "http"
-    },
-    configSchema: {
-      wecloneApiUrl: "Base URL of the WeClone OpenAI-compatible API (e.g. http://localhost:8000/v1)",
-      proxyPort: "Local port where the memory proxy will listen (default 8100)",
-      remnicDaemonUrl: "URL of the Remnic daemon exposing /engram/v1/recall and /engram/v1/observe",
-      sessionStrategy: "Per-caller session mapping strategy: 'caller-id' | 'single'",
-      wecloneModelName: "Optional fine-tuned model name passed through to WeClone"
-    },
-    homepage: "https://github.com/xming521/weclone",
-    author: "Remnic",
-    tags: ["official", "ai", "weclone", "proxy"],
-    requiresToken: true
-  },
-  {
-    id: "hermes",
-    name: "Hermes Agent",
-    version: "1.0.0",
-    description: "Hermes Agent MemoryProvider \u2014 automatic recall/observe on every turn via Python plugin protocol",
-    capabilities: {
-      observe: true,
-      recall: true,
-      store: true,
-      search: true,
-      entities: false,
-      realtimeSync: true,
-      batch: false,
-      maxBudgetChars: 32e3,
-      connectionType: "http"
-    },
-    configSchema: {
-      host: "Remnic daemon host (default: 127.0.0.1)",
-      port: "Remnic daemon port (default: 4318)",
-      profile: "Hermes profile name (default: default)"
-    },
-    homepage: "https://github.com/joshuaswarren/remnic/tree/main/packages/plugin-hermes",
-    author: "Remnic",
-    tags: ["official", "python", "hermes"],
-    requiresToken: true
-  }
-];
-var REGISTRY_DIR_NAME = ".engram-connectors";
-function getRegistryPath() {
-  const xdgConfigHome = readEnvVar("XDG_CONFIG_HOME");
-  const configDir = xdgConfigHome ? path13.join(xdgConfigHome, "engram") : path13.join(resolveHomeDir(), ".config", "engram");
-  return path13.join(configDir, REGISTRY_DIR_NAME, "registry.json");
-}
-function loadRegistry() {
-  const regPath = getRegistryPath();
-  if (!fs9.existsSync(regPath)) {
-    const registry = {
-      connectors: BUILTIN_CONNECTORS,
-      registryPath: regPath
-    };
-    saveRegistry(registry);
-    return registry;
-  }
-  const raw = fs9.readFileSync(regPath, "utf8");
-  try {
-    const parsed = JSON.parse(raw);
-    const builtinIds = new Set(BUILTIN_CONNECTORS.map((b) => b.id));
-    const customOnly = (parsed.connectors ?? []).filter((c) => !builtinIds.has(c.id));
-    const merged = [...BUILTIN_CONNECTORS, ...customOnly];
-    return {
-      connectors: merged,
-      registryPath: regPath
-    };
-  } catch {
-    const registry = {
-      connectors: BUILTIN_CONNECTORS,
-      registryPath: regPath
-    };
-    saveRegistry(registry);
-    return registry;
-  }
-}
-function saveRegistry(registry) {
-  const regPath = registry.registryPath;
-  fs9.mkdirSync(path13.dirname(regPath), { recursive: true });
-  fs9.writeFileSync(regPath, JSON.stringify({ connectors: registry.connectors }, null, 2));
-}
-function listConnectors() {
-  const registry = loadRegistry();
-  const connectorsDir = getConnectorsDir();
-  const installedIds = /* @__PURE__ */ new Set();
-  if (fs9.existsSync(connectorsDir)) {
-    for (const entry of fs9.readdirSync(connectorsDir)) {
-      if (entry.endsWith(".json")) {
-        try {
-          const config = JSON.parse(
-            fs9.readFileSync(path13.join(connectorsDir, entry), "utf8")
-          );
-          installedIds.add(config.connectorId);
-        } catch {
-        }
-      }
-    }
-  }
-  const available = registry.connectors.map((manifest) => ({
-    ...manifest,
-    installed: installedIds.has(manifest.id)
-  }));
-  const installed = [];
-  for (const id of installedIds) {
-    const configPath = path13.join(connectorsDir, `${id}.json`);
-    try {
-      const raw = JSON.parse(fs9.readFileSync(configPath, "utf8"));
-      const { token: _redacted, ...config } = raw;
-      installed.push({
-        connectorId: id,
-        config,
-        status: "installed",
-        installedAt: raw.installedAt
-      });
-    } catch {
-    }
-  }
-  return { installed, available };
-}
-function getConnectorToken(connectorId) {
-  try {
-    return loadTokenStore().tokens.find((t) => t.connector === connectorId)?.token;
-  } catch {
-    return void 0;
-  }
-}
-function readSavedConnectorConfig(configPath) {
-  if (!fs9.existsSync(configPath)) return {};
-  try {
-    const parsed = JSON.parse(fs9.readFileSync(configPath, "utf8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-    const {
-      connectorId: _connectorId,
-      installedAt: _installedAt,
-      token: _token,
-      ...config
-    } = parsed;
-    return config;
-  } catch {
-    return {};
-  }
-}
-function removeClearedSavedConnectorConfig(savedConnectorConfig, rawUserConfig) {
-  const merged = { ...savedConnectorConfig };
-  for (const [key, value] of Object.entries(rawUserConfig)) {
-    if (value === void 0 || value === null || value === "") {
-      delete merged[key];
-    }
-  }
-  return merged;
-}
-function compactConnectorConfigOverrides(rawUserConfig) {
-  const safeUserConfig = {};
-  for (const [key, value] of Object.entries(rawUserConfig)) {
-    if (value === void 0 || value === null || value === "") continue;
-    safeUserConfig[key] = value;
-  }
-  return safeUserConfig;
-}
-function installConnector(options) {
-  const registry = loadRegistry();
-  const manifest = registry.connectors.find((c) => c.id === options.connectorId);
-  if (!manifest) {
-    return {
-      connectorId: options.connectorId,
-      status: "error",
-      message: `Unknown connector: ${options.connectorId}`
-    };
-  }
-  const existing = listConnectors().installed.find(
-    (c) => c.connectorId === options.connectorId
-  );
-  if (existing && !options.force) {
-    return {
-      connectorId: options.connectorId,
-      status: "already_installed",
-      message: "Already installed. Use --force to reinstall."
-    };
-  }
-  const configDir = getConnectorsDir();
-  fs9.mkdirSync(configDir, { recursive: true });
-  const configPath = path13.join(configDir, `${options.connectorId}.json`);
-  const savedConnectorConfig = existing ? readSavedConnectorConfig(configPath) : {};
-  let hermesSavedProfile;
-  let hermesSavedHost;
-  let hermesSavedPort;
-  let hermesResolvedProfile;
-  let hermesResolvedHost;
-  let hermesResolvedPort;
-  if (options.connectorId === "hermes") {
-    if (fs9.existsSync(configPath)) {
-      try {
-        const prev = JSON.parse(fs9.readFileSync(configPath, "utf8"));
-        if (prev?.profile != null) {
-          try {
-            hermesSavedProfile = sanitizeHermesProfile(String(prev.profile));
-          } catch {
-          }
-        }
-        if (prev?.host != null) {
-          try {
-            hermesSavedHost = sanitizeHermesHost(String(prev.host));
-          } catch {
-          }
-        }
-        if (prev?.port != null) {
-          try {
-            const coercedPort = Number(String(prev.port));
-            hermesSavedPort = sanitizeHermesPort(coercedPort);
-          } catch {
-          }
-        }
-      } catch {
-      }
-    }
-    hermesResolvedProfile = hermesSavedProfile ?? "default";
-    hermesResolvedHost = hermesSavedHost ?? "127.0.0.1";
-    if (options.config?.port !== void 0) {
-      try {
-        hermesResolvedPort = sanitizeHermesPort(Number(String(options.config.port)));
-      } catch (err) {
-        return {
-          connectorId: options.connectorId,
-          status: "error",
-          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
-        };
-      }
-    }
-    if (hermesResolvedPort === void 0) {
-      hermesResolvedPort = hermesSavedPort ?? 4318;
-    }
-    if (options.config?.profile !== void 0) {
-      try {
-        hermesResolvedProfile = sanitizeHermesProfile(String(options.config.profile));
-      } catch (err) {
-        return {
-          connectorId: options.connectorId,
-          status: "error",
-          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
-        };
-      }
-    }
-    if (options.config?.host !== void 0) {
-      try {
-        hermesResolvedHost = sanitizeHermesHost(String(options.config.host));
-      } catch (err) {
-        return {
-          connectorId: options.connectorId,
-          status: "error",
-          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
-        };
-      }
-    }
-  }
-  const nonHermesPriorTokenStore = options.connectorId !== "hermes" && manifest.requiresToken ? loadTokenStore() : null;
-  let tokenEntry = null;
-  if (options.connectorId === "hermes") {
-    try {
-      tokenEntry = buildTokenEntry(options.connectorId);
-    } catch {
-    }
-  } else if (manifest.requiresToken) {
-    try {
-      tokenEntry = generateToken(options.connectorId);
-    } catch {
-      if (nonHermesPriorTokenStore !== null) {
-        try {
-          saveTokenStore(nonHermesPriorTokenStore);
-        } catch {
-        }
-      }
-    }
-  }
-  if (options.connectorId !== "hermes" && manifest.requiresToken && tokenEntry === null) {
-    return {
-      connectorId: options.connectorId,
-      status: "error",
-      message: `${manifest.name} install aborted: token generation failed. Run \`remnic token generate ${options.connectorId}\` to create the token, then reinstall.`
-    };
-  }
-  const { token: _callerToken, ...rawUserConfig } = options.config ?? {};
-  const savedConnectorConfigForMerge = removeClearedSavedConnectorConfig(savedConnectorConfig, rawUserConfig);
-  const safeUserConfig = compactConnectorConfigOverrides(rawUserConfig);
-  const resolvedConfig = {
-    ...savedConnectorConfigForMerge,
-    ...safeUserConfig,
-    connectorId: options.connectorId,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    // For hermes, always overlay the sanitized/coerced resolved values so that
-    // the connector JSON always has a numeric port and validated profile/host.
-    // This also ensures options.config string values (from --config=port=5555)
-    // are replaced with their sanitized numeric equivalents (Fix 2 root cause).
-    ...hermesResolvedProfile !== void 0 ? {
-      profile: hermesResolvedProfile,
-      host: hermesResolvedHost,
-      port: hermesResolvedPort
-    } : {}
-  };
-  if (options.connectorId === "hermes") {
-    const rawProfile = hermesResolvedProfile;
-    const hermesHost = hermesResolvedHost;
-    const hermesPort = hermesResolvedPort;
-    let hermesProfile;
-    try {
-      hermesProfile = sanitizeHermesProfile(rawProfile);
-    } catch (err) {
-      return {
-        connectorId: options.connectorId,
-        status: "error",
-        message: `Hermes install aborted: ${err instanceof Error ? err.message : String(err)}`
-      };
-    }
-    if (!tokenEntry) {
-      return {
-        connectorId: options.connectorId,
-        status: "error",
-        message: "Hermes install aborted: token store unavailable. Run `remnic token generate hermes` then reinstall to complete setup."
-      };
-    }
-    let yamlResult;
-    try {
-      yamlResult = upsertHermesConfig({
-        profile: hermesProfile,
-        host: hermesHost,
-        port: hermesPort,
-        token: tokenEntry.token
-      });
-    } catch (err) {
-      return {
-        connectorId: options.connectorId,
-        status: "error",
-        message: `Hermes install aborted: config.yaml write failed \u2014 ${err instanceof Error ? err.message : String(err)}`
-      };
-    }
-    if (!yamlResult.updated) {
-      return {
-        connectorId: options.connectorId,
-        status: "error",
-        message: `Hermes install aborted: ${yamlResult.reason ?? "config.yaml not written"}. Create the Hermes profile directory first, then reinstall.`
-      };
-    }
-    const priorTokenStore = loadTokenStore();
-    let committed = false;
-    try {
-      commitTokenEntry(tokenEntry);
-      committed = true;
-    } catch (commitErr) {
-      let tokensRolledBack = true;
-      let tokensRollbackErrMsg = "";
-      try {
-        saveTokenStore(priorTokenStore);
-      } catch (tokenRestoreErr) {
-        tokensRolledBack = false;
-        tokensRollbackErrMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
-      }
-      let yamlRolledBack = true;
-      let yamlRollbackErrMsg = "";
-      try {
-        if (yamlResult.priorContent === null) {
-          fs9.unlinkSync(yamlResult.configPath);
-        } else if (typeof yamlResult.priorContent === "string") {
-          writeSecretFileSync(yamlResult.configPath, yamlResult.priorContent);
-        }
-      } catch (yamlRestoreErr) {
-        yamlRolledBack = false;
-        yamlRollbackErrMsg = yamlRestoreErr instanceof Error ? yamlRestoreErr.message : String(yamlRestoreErr);
-      }
-      const commitErrMsg = commitErr instanceof Error ? commitErr.message : String(commitErr);
-      let message;
-      if (tokensRolledBack && yamlRolledBack) {
-        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. config.yaml and tokens.json restored to prior state. Resolve the tokens.json access issue, then reinstall.`;
-      } else if (!yamlRolledBack && tokensRolledBack) {
-        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. tokens.json restored but config.yaml rollback ALSO failed (${yamlRollbackErrMsg}). Hermes daemon may be in an inconsistent state: config references a stale token. Manually inspect ${yamlResult.configPath} and reinstall.`;
-      } else if (yamlRolledBack && !tokensRolledBack) {
-        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. config.yaml restored but tokens.json rollback ALSO failed (${tokensRollbackErrMsg}). Hermes daemon may be in an inconsistent state: tokens.json is corrupt or incomplete. Manually inspect ~/.remnic/tokens.json and reinstall.`;
-      } else {
-        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. BOTH rollbacks failed: config.yaml rollback failed (${yamlRollbackErrMsg}); tokens.json rollback failed (${tokensRollbackErrMsg}). Hermes daemon is likely in an inconsistent state. Manually inspect ${yamlResult.configPath} and ~/.remnic/tokens.json, then reinstall.`;
-      }
-      return {
-        connectorId: options.connectorId,
-        status: "error",
-        message
-      };
-    }
-    try {
-      writeSecretFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));
-    } catch (writeErr) {
-      let tokenRollbackFailed = false;
-      let tokenRollbackMsg = "token store restored to pre-install snapshot";
-      try {
-        saveTokenStore(priorTokenStore);
-      } catch (tokenRestoreErr) {
-        tokenRollbackFailed = true;
-        tokenRollbackMsg = `token rollback failed: ${tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr)}`;
-      }
-      let yamlRollbackMsg = "config.yaml restored";
-      try {
-        if (yamlResult.priorContent === null) {
-          let unlinkSucceeded = false;
-          let unlinkErr;
-          try {
-            fs9.unlinkSync(yamlResult.configPath);
-            unlinkSucceeded = true;
-          } catch (err) {
-            unlinkErr = err;
-          }
-          if (unlinkSucceeded) {
-            yamlRollbackMsg = "config.yaml removed (was newly created)";
-          } else {
-            const unlinkMsg = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
-            yamlRollbackMsg = `config.yaml rollback failed: could not remove newly-created file \u2014 ${unlinkMsg}`;
-          }
-        } else if (typeof yamlResult.priorContent === "string") {
-          writeSecretFileSync(yamlResult.configPath, yamlResult.priorContent);
-          yamlRollbackMsg = "config.yaml restored to prior content";
-        }
-      } catch (yamlRollbackErr) {
-        yamlRollbackMsg = `config.yaml rollback failed: ${yamlRollbackErr instanceof Error ? yamlRollbackErr.message : String(yamlRollbackErr)}`;
-      }
-      const urgentSuffix = tokenRollbackFailed ? ` tokens.json may be in an inconsistent state \u2014 manually restore hermes token with 'remnic token generate hermes'.` : "";
-      return {
-        connectorId: options.connectorId,
-        status: "error",
-        message: `Hermes install aborted: connector config write failed \u2014 connector directory may not be writable. Rollback: ${tokenRollbackMsg}; ${yamlRollbackMsg}.${urgentSuffix} Resolve the permission issue, then reinstall.`
-      };
-    }
-    const notes = [];
-    notes.push(`Updated Hermes config: ${yamlResult.configPath}`);
-    if (hermesProfile === "default") {
-      const legacyDefaultConfigPath = hermesDefaultProfileConfigPath();
-      if (!sameHermesConfigTarget(yamlResult.configPath, legacyDefaultConfigPath)) {
-        try {
-          const legacyDefaultCleanResult = removeHermesConfigFile(legacyDefaultConfigPath);
-          if (legacyDefaultCleanResult.updated) {
-            notes.push(`Cleaned stale remnic: block from legacy default profile: ${legacyDefaultConfigPath}`);
-          }
-        } catch {
-          notes.push("Note: could not clean stale remnic: block from legacy default profile");
-        }
-      }
-    }
-    let oldProfileResolvesToDifferentFile = false;
-    if (hermesSavedProfile !== void 0) {
-      try {
-        oldProfileResolvesToDifferentFile = !sameHermesConfigTarget(hermesConfigPath(hermesSavedProfile), hermesConfigPath(hermesProfile));
-      } catch {
-        oldProfileResolvesToDifferentFile = false;
-      }
-    }
-    if (oldProfileResolvesToDifferentFile) {
-      try {
-        const oldCleanResult = removeHermesConfig({ profile: hermesSavedProfile });
-        if (oldCleanResult.updated) {
-          notes.push(`Cleaned stale remnic: block from previous profile: ${oldCleanResult.configPath}`);
-        }
-      } catch {
-        notes.push(`Note: could not clean stale remnic: block from previous profile "${hermesSavedProfile}"`);
-      }
-    }
-    if (committed && tokenEntry) {
-      const daemonOk = checkDaemonHealth(hermesHost, hermesPort, tokenEntry.token);
-      if (daemonOk) {
-        notes.push("Daemon health check: OK");
-      } else {
-        notes.push(
-          `Daemon not reachable at ${hermesHost}:${hermesPort} \u2014 start with: remnic daemon start`
-        );
-      }
-    }
-    const suffix = notes.length > 0 ? `
-  ${notes.join("\n  ")}` : "";
-    return {
-      connectorId: options.connectorId,
-      status: "installed",
-      configPath,
-      message: `Installed ${manifest.name} v${manifest.version}${suffix}`
-    };
-  }
-  let extensionMessage = "";
-  let extensionInstalled = false;
-  let extensionHandle = null;
-  if (options.connectorId === "codex-cli") {
-    const coerced = coerceInstallExtension(resolvedConfig.installExtension);
-    if (coerced !== void 0) {
-      resolvedConfig.installExtension = coerced;
-    }
-    const shouldInstall = resolvedConfig.installExtension !== false;
-    resolvedConfig.installExtension = shouldInstall;
-    const codexHomeOverride = typeof resolvedConfig.codexHome === "string" && resolvedConfig.codexHome.length > 0 ? resolvedConfig.codexHome : null;
-    const resolvedCodexHome = resolveCodexHome(codexHomeOverride);
-    resolvedConfig.codexHome = resolvedCodexHome;
-    if (shouldInstall) {
-      try {
-        const extensionSourceOverride = typeof resolvedConfig.extensionSourceDir === "string" && resolvedConfig.extensionSourceDir.length > 0 ? resolvedConfig.extensionSourceDir : null;
-        const extResult = installCodexMemoryExtension({
-          codexHome: resolvedCodexHome,
-          sourceDir: extensionSourceOverride
-        });
-        extensionMessage = ` (memory extension: ${extResult.remnicExtensionDir})`;
-        extensionInstalled = true;
-        extensionHandle = extResult;
-      } catch (err) {
-        const errMsg = err instanceof Error ? err.message : "unknown error";
-        let extensionErrTokenRolledBack = false;
-        let extensionErrTokenRollbackMsg = "";
-        if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
-          try {
-            saveTokenStore(nonHermesPriorTokenStore);
-            extensionErrTokenRolledBack = true;
-          } catch (tokenRestoreErr) {
-            extensionErrTokenRolledBack = false;
-            extensionErrTokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
-          }
-        }
-        const tokenRollbackSuffix = manifest.requiresToken ? extensionErrTokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${extensionErrTokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
-        return {
-          connectorId: options.connectorId,
-          status: "error",
-          message: `Memory extension install failed \u2014 ${errMsg}.${tokenRollbackSuffix} Resolve the issue, then reinstall.`
-        };
-      }
-    } else {
-      extensionMessage = " (memory extension: skipped via installExtension=false)";
-    }
-  }
-  let weCloneProxyHandleRollback = null;
-  if (options.connectorId === "weclone") {
-    try {
-      let proxyConfigPath = null;
-      if (existing && fs9.existsSync(configPath)) {
-        try {
-          const savedRegistryConfig = JSON.parse(fs9.readFileSync(configPath, "utf8"));
-          if (typeof savedRegistryConfig.proxyConfigPath === "string" && savedRegistryConfig.proxyConfigPath.length > 0) {
-            proxyConfigPath = savedRegistryConfig.proxyConfigPath;
-          }
-        } catch {
-        }
-      }
-      if (proxyConfigPath === null) {
-        proxyConfigPath = resolveWeCloneProxyConfigPath();
-      }
-      const prior = readWeCloneProxyConfigIfExists(proxyConfigPath);
-      const proxyConfig = buildWeCloneProxyConfig({
-        userConfig: safeUserConfig,
-        priorConfig: prior ? safeParseJson(prior) : null,
-        authToken: tokenEntry?.token
-      });
-      fs9.mkdirSync(path13.dirname(proxyConfigPath), { recursive: true });
-      weCloneProxyHandleRollback = () => {
-        try {
-          if (prior === null) {
-            if (fs9.existsSync(proxyConfigPath)) {
-              fs9.unlinkSync(proxyConfigPath);
-            }
-          } else {
-            writeSecretFileSync(proxyConfigPath, prior);
-          }
-        } catch {
-        }
-      };
-      try {
-        writeSecretFileSync(
-          proxyConfigPath,
-          JSON.stringify(proxyConfig, null, 2)
-        );
-      } catch (writeErr) {
-        try {
-          weCloneProxyHandleRollback();
-        } catch {
-        }
-        weCloneProxyHandleRollback = null;
-        throw writeErr;
-      }
-      resolvedConfig.proxyConfigPath = proxyConfigPath;
-      resolvedConfig.proxyPort = proxyConfig.proxyPort;
-      resolvedConfig.wecloneApiUrl = proxyConfig.wecloneApiUrl;
-      resolvedConfig.remnicDaemonUrl = proxyConfig.remnicDaemonUrl;
-      resolvedConfig.sessionStrategy = proxyConfig.sessionStrategy;
-    } catch (weCloneErr) {
-      let tokenRolledBack = false;
-      let tokenRollbackMsg = "";
-      if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
-        try {
-          saveTokenStore(nonHermesPriorTokenStore);
-          tokenRolledBack = true;
-        } catch (tokenRestoreErr) {
-          tokenRolledBack = false;
-          tokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
-        }
-      }
-      const tokenSuffix = manifest.requiresToken && tokenEntry !== null ? tokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${tokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
-      return {
-        connectorId: options.connectorId,
-        status: "error",
-        message: `WeClone install aborted: proxy config write failed \u2014 ${weCloneErr instanceof Error ? weCloneErr.message : String(weCloneErr)}.${tokenSuffix} Resolve the write permission issue on ~/.remnic/connectors/, then reinstall.`
-      };
-    }
-  }
-  const INTERNAL_KEYS_DENYLIST = [
-    "extensionSourceDir"
-    // test-only override for the plugin-codex source path
-  ];
-  for (const key of INTERNAL_KEYS_DENYLIST) {
-    delete resolvedConfig[key];
-  }
-  try {
-    writeSecretFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));
-  } catch (writeErr) {
-    let configWriteTokenRolledBack = false;
-    let configWriteTokenRollbackMsg = "";
-    if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
-      try {
-        saveTokenStore(nonHermesPriorTokenStore);
-        configWriteTokenRolledBack = true;
-      } catch (tokenRestoreErr) {
-        configWriteTokenRolledBack = false;
-        configWriteTokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
-      }
-    }
-    if (extensionInstalled && extensionHandle !== null) {
-      try {
-        extensionHandle.rollback();
-      } catch {
-        console.warn(
-          "[remnic/connectors] installConnector: config write failed and extension rollback also failed \u2014 manual cleanup of memories_extensions/remnic may be required."
-        );
-      }
-    }
-    if (weCloneProxyHandleRollback !== null) {
-      try {
-        weCloneProxyHandleRollback();
-      } catch {
-      }
-    }
-    const configWriteTokenSuffix = manifest.requiresToken && tokenEntry !== null ? configWriteTokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${configWriteTokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
-    return {
-      connectorId: options.connectorId,
-      status: "error",
-      message: `${manifest.name} install aborted: connector config write failed \u2014 ${writeErr instanceof Error ? writeErr.message : String(writeErr)}.${configWriteTokenSuffix} Resolve the write permission issue, then reinstall.`
-    };
-  }
-  if (extensionInstalled && extensionHandle !== null) {
-    extensionHandle.commit();
-  }
-  return {
-    connectorId: options.connectorId,
-    status: "installed",
-    configPath,
-    message: `Installed ${manifest.name} v${manifest.version}${extensionMessage}`
-  };
-}
-function removeConnector(connectorId) {
-  const configDir = getConnectorsDir();
-  const configPath = path13.join(configDir, `${connectorId}.json`);
-  let codexHomeOverride = null;
-  let savedInstallExtension = void 0;
-  let configParsed = false;
-  if (connectorId === "codex-cli" && fs9.existsSync(configPath)) {
-    try {
-      const parsed = JSON.parse(fs9.readFileSync(configPath, "utf8"));
-      configParsed = true;
-      if (typeof parsed.codexHome === "string" && parsed.codexHome.length > 0) {
-        codexHomeOverride = parsed.codexHome;
-      }
-      const coerced = coerceInstallExtension(parsed.installExtension);
-      if (coerced !== void 0) {
-        savedInstallExtension = coerced;
-      }
-    } catch {
-      console.debug(
-        "[remnic/connectors] removeConnector: codex-cli.json parse failed \u2014 skipping extension removal to avoid touching unverified paths"
-      );
-    }
-  }
-  if (!fs9.existsSync(configPath)) {
-    let staleTokenRevoked = false;
-    try {
-      staleTokenRevoked = revokeToken(connectorId);
-    } catch {
-    }
-    const message = staleTokenRevoked ? `${connectorId} is not installed. Removed stale token entry for ${connectorId}.` : "Not installed";
-    return {
-      connectorId,
-      configPath,
-      status: "not_found",
-      message
-    };
-  }
-  let storedProfile = "default";
-  if (connectorId === "hermes") {
-    try {
-      const stored = JSON.parse(fs9.readFileSync(configPath, "utf8"));
-      if (typeof stored?.profile === "string") storedProfile = stored.profile;
-    } catch {
-    }
-  }
-  let weCloneProxyConfigPath = null;
-  let weCloneRegistryParseFailed = false;
-  if (connectorId === "weclone") {
-    try {
-      const stored = JSON.parse(fs9.readFileSync(configPath, "utf8"));
-      if (typeof stored.proxyConfigPath === "string" && stored.proxyConfigPath.length > 0) {
-        weCloneProxyConfigPath = stored.proxyConfigPath;
-      }
-    } catch {
-      weCloneRegistryParseFailed = true;
-    }
-    if (weCloneProxyConfigPath === null && !weCloneRegistryParseFailed) {
-      try {
-        weCloneProxyConfigPath = resolveWeCloneProxyConfigPath();
-      } catch {
-      }
-    }
-  }
-  if (connectorId === "weclone" && weCloneRegistryParseFailed) {
-    console.warn(
-      "[remnic/connectors] removeConnector: weclone.json is malformed \u2014 aborting removal to preserve provenance. Fix or delete " + configPath + " manually and retry."
-    );
-    return {
-      connectorId,
-      configPath,
-      message: "Removal aborted: weclone.json is malformed. Registry config left in place for inspection; proxy config NOT removed.",
-      status: "skipped",
-      reason: "config-parse-failed"
-    };
-  }
-  if (connectorId === "codex-cli" && fs9.existsSync(configPath) && !configParsed) {
-    console.warn(
-      "[remnic/connectors] removeConnector: codex-cli.json is malformed \u2014 aborting removal to preserve provenance. Fix or delete " + configPath + " manually and retry."
-    );
-    return {
-      connectorId,
-      configPath,
-      message: "Removal aborted: codex-cli.json is malformed. Config file left in place for inspection.",
-      status: "skipped",
-      reason: "config-parse-failed"
-    };
-  }
-  let extensionMessage = "";
-  if (connectorId === "codex-cli") {
-    if (savedInstallExtension === false) {
-      extensionMessage = " (memory extension: skipped \u2014 installExtension=false)";
-    } else if (savedInstallExtension !== true || codexHomeOverride === null) {
-      extensionMessage = " (memory extension: skipped \u2014 no install provenance in saved config)";
-    } else {
-      const extResult = removeCodexMemoryExtension({ codexHome: codexHomeOverride });
-      extensionMessage = extResult.removed ? ` (memory extension removed: ${extResult.remnicExtensionDir})` : " (no memory extension present)";
-    }
-  }
-  try {
-    fs9.unlinkSync(configPath);
-  } catch (unlinkErr) {
-    const sanitizedErr = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
-    return {
-      connectorId,
-      configPath,
-      status: "error",
-      message: `${connectorId} remove aborted: could not delete connector file (${sanitizedErr}). Token and any connector-specific state were not modified.`
-    };
-  }
-  const notes = [];
-  let tokenRevoked = true;
-  try {
-    revokeToken(connectorId);
-  } catch (revokeErr) {
-    tokenRevoked = false;
-    const revokeMsg = revokeErr instanceof Error ? revokeErr.message : String(revokeErr);
-    notes.push(`Warning: token revocation failed \u2014 ${revokeMsg}. The token for ${connectorId} may still be present in tokens.json.`);
-  }
-  let weCloneProxyDeleteFailed = null;
-  if (connectorId === "weclone") {
-    if (weCloneProxyConfigPath === null) {
-      notes.push(
-        "WeClone proxy config cleanup skipped: no persisted path found in saved config (likely a legacy install predating proxyConfigPath provenance)."
-      );
-    } else {
-      const expectedSuffix = path13.join("connectors", "weclone.json");
-      const isSafePath = path13.isAbsolute(weCloneProxyConfigPath) && weCloneProxyConfigPath.endsWith(expectedSuffix);
-      if (!isSafePath) {
-        weCloneProxyDeleteFailed = `Proxy config path ${JSON.stringify(weCloneProxyConfigPath)} failed safety validation (must be absolute and end with "${expectedSuffix}"). Refusing to delete \u2014 remove the file manually if it exists.`;
-      } else {
-        try {
-          if (fs9.existsSync(weCloneProxyConfigPath)) {
-            fs9.unlinkSync(weCloneProxyConfigPath);
-            notes.push(`Removed WeClone proxy config: ${weCloneProxyConfigPath}`);
-          }
-        } catch (err) {
-          weCloneProxyDeleteFailed = err instanceof Error ? err.message : String(err);
-        }
-      }
-    }
-  }
-  if (weCloneProxyDeleteFailed !== null && weCloneProxyConfigPath !== null) {
-    const tokenStatus = tokenRevoked ? "the registry config was deleted and the token was revoked" : "the registry config was deleted but TOKEN REVOCATION ALSO FAILED \u2014 inspect ~/.remnic/tokens.json and revoke manually";
-    return {
-      connectorId,
-      configPath,
-      status: "error",
-      message: `WeClone remove partially succeeded: ${tokenStatus}, but the proxy config at ${weCloneProxyConfigPath} could not be deleted (${weCloneProxyDeleteFailed}). Manually remove that file \u2014 it may still contain a Remnic daemon bearer token.`
-    };
-  }
-  if (connectorId === "hermes") {
-    try {
-      const yamlResult = removeHermesConfig({ profile: storedProfile });
-      if (yamlResult.updated) {
-        notes.push(`Removed remnic: block from Hermes config: ${yamlResult.configPath}`);
-      } else if (yamlResult.reason?.startsWith("Hermes config cleanup partially failed:")) {
-        const tokenStatus = tokenRevoked ? "the connector registry config was deleted and the token was revoked" : "the connector registry config was deleted but TOKEN REVOCATION ALSO FAILED \u2014 inspect ~/.remnic/tokens.json and revoke manually";
-        return {
-          connectorId,
-          configPath,
-          status: "error",
-          message: `Hermes remove partially succeeded: ${tokenStatus}, but ${yamlResult.reason}. Updated paths: ${yamlResult.configPath}. Manually remove any stale remnic: block and token material from the failed Hermes config path.`
-        };
-      } else if (yamlResult.skipped) {
-        notes.push(`Hermes config cleanup skipped: ${yamlResult.reason}`);
-      }
-    } catch (err) {
-      notes.push(
-        `Hermes config cleanup skipped: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  }
-  const suffix = notes.length > 0 ? `
-  ${notes.join("\n  ")}` : "";
-  return {
-    connectorId,
-    configPath,
-    status: "removed",
-    message: `Removed${extensionMessage}${suffix}`
-  };
-}
-function sanitizeHermesProfile(profile) {
-  if (typeof profile !== "string" || profile.length === 0) {
-    throw new Error("Hermes profile name must be a non-empty string");
-  }
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(profile)) {
-    throw new Error(
-      `Invalid Hermes profile name: ${JSON.stringify(profile)} \u2014 must match [A-Za-z0-9][A-Za-z0-9._-]*`
-    );
-  }
-  if (profile.includes("..")) {
-    throw new Error(`Invalid Hermes profile name: ${JSON.stringify(profile)} \u2014 must not contain ".."`);
-  }
-  return profile;
-}
-function hermesConfigPath(profile) {
-  const safeProfile = sanitizeHermesProfile(profile);
-  const hermesRoot = path13.resolve(resolveHomeDir(), ".hermes");
-  const rootConfigPath = path13.join(hermesRoot, "config.yaml");
-  const profilesRoot = path13.join(hermesRoot, "profiles");
-  if (safeProfile === "default") {
-    const defaultProfileDir = path13.join(profilesRoot, safeProfile);
-    if (isFile(rootConfigPath) || !fs9.existsSync(rootConfigPath) && !isDirectory(defaultProfileDir)) {
-      return rootConfigPath;
-    }
-  }
-  const cfgPath = path13.resolve(profilesRoot, safeProfile, "config.yaml");
-  const rel = path13.relative(profilesRoot, cfgPath);
-  if (rel.startsWith("..") || path13.isAbsolute(rel)) {
-    throw new Error(
-      `Invalid Hermes profile path: resolved outside ${profilesRoot}`
-    );
-  }
-  return cfgPath;
-}
-function isDirectory(filePath) {
-  try {
-    return fs9.statSync(filePath).isDirectory();
-  } catch {
-    return false;
-  }
-}
-function isFile(filePath) {
-  try {
-    return fs9.statSync(filePath).isFile();
-  } catch {
-    return false;
-  }
-}
-function hermesConfigTarget(filePath) {
-  try {
-    return fs9.realpathSync.native(filePath);
-  } catch {
-    return path13.resolve(filePath);
-  }
-}
-function sameHermesConfigTarget(leftPath, rightPath) {
-  return hermesConfigTarget(leftPath) === hermesConfigTarget(rightPath);
-}
-function hermesDefaultProfileConfigPath() {
-  const hermesRoot = path13.resolve(resolveHomeDir(), ".hermes");
-  return path13.join(hermesRoot, "profiles", "default", "config.yaml");
-}
-function hermesConfigCleanupPaths(profile) {
-  const cfgPath = hermesConfigPath(profile);
-  const safeProfile = sanitizeHermesProfile(profile);
-  if (safeProfile !== "default") {
-    return [cfgPath];
-  }
-  return [.../* @__PURE__ */ new Set([cfgPath, hermesDefaultProfileConfigPath()])];
-}
-function sanitizeHermesHost(host) {
-  if (typeof host !== "string" || host.length === 0) {
-    throw new Error("Hermes host must be a non-empty string");
-  }
-  if (host.length > 253) {
-    throw new Error(`Hermes host too long (max 253 chars): ${JSON.stringify(host.slice(0, 32))}\u2026`);
-  }
-  if (host.startsWith("[")) {
-    if (!host.endsWith("]")) {
-      throw new Error(
-        `Invalid Hermes host: ${JSON.stringify(host)} \u2014 unbalanced brackets in IPv6 literal`
-      );
-    }
-    const inner = host.slice(1, -1);
-    if (inner.length === 0 || !/^[0-9A-Fa-f:]+$/.test(inner)) {
-      throw new Error(
-        `Invalid Hermes host: ${JSON.stringify(host)} \u2014 bracketed IPv6 literal must contain only hex digits and colons`
-      );
-    }
-    return host;
-  }
-  if (host.includes(":")) {
-    throw new Error(
-      `Invalid Hermes host: ${JSON.stringify(host)} \u2014 host must not include a port; supply the port separately with --config port=<n>`
-    );
-  }
-  if (!/^[A-Za-z0-9._\-]+$/.test(host)) {
-    throw new Error(
-      `Invalid Hermes host: ${JSON.stringify(host)} \u2014 must be a plain hostname or IP literal`
-    );
-  }
-  return host;
-}
-function sanitizeHermesPort(port) {
-  const numeric = Number(port);
-  if (!Number.isInteger(numeric)) {
-    throw new Error(
-      `Invalid Hermes port "${port}": must be a positive integer`
-    );
-  }
-  if (numeric < 1 || numeric > 65535) {
-    throw new Error(`Invalid Hermes port: ${JSON.stringify(port)} \u2014 must be an integer in [1, 65535]`);
-  }
-  return numeric;
-}
-function writeSecretFileSync(filePath, data) {
-  fs9.writeFileSync(filePath, data, { mode: 384 });
-  try {
-    fs9.chmodSync(filePath, 384);
-  } catch {
-  }
-}
-function upsertHermesConfig(opts) {
-  const cfgPath = hermesConfigPath(opts.profile);
-  const profileDir = path13.dirname(cfgPath);
-  const safeHost = sanitizeHermesHost(opts.host);
-  const safePort = sanitizeHermesPort(opts.port);
-  if (!/^[A-Za-z0-9_]+$/.test(opts.token)) {
-    throw new Error("Invalid Hermes token: contains non-alphanumeric characters");
-  }
-  if (!isDirectory(profileDir)) {
-    return {
-      updated: false,
-      skipped: true,
-      reason: `Hermes profile directory not found: ${profileDir}`,
-      configPath: cfgPath
-    };
-  }
-  const block = [
-    "remnic:",
-    `  host: "${safeHost}"`,
-    `  port: ${safePort}`,
-    `  token: "${opts.token}"`
-  ].join("\n");
-  if (!fs9.existsSync(cfgPath)) {
-    writeSecretFileSync(cfgPath, block + "\n");
-    return { updated: true, skipped: false, configPath: cfgPath, priorContent: null };
-  }
-  const raw = fs9.readFileSync(cfgPath, "utf8");
-  const hasRemnicBlock = /^remnic:/m.test(raw);
-  if (!hasRemnicBlock) {
-    const separator = raw.endsWith("\n") ? "\n" : "\n\n";
-    writeSecretFileSync(cfgPath, raw + separator + block + "\n");
-    return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };
-  }
-  const splitLines = raw.split("\n");
-  if (splitLines.length > 0 && splitLines[splitLines.length - 1] === "") {
-    splitLines.pop();
-  }
-  const lines = splitLines;
-  const newLines = [];
-  let inRemnicBlock = false;
-  let blockWritten = false;
-  const written = { host: false, port: false, token: false };
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (/^remnic:/.test(line)) {
-      inRemnicBlock = true;
-      newLines.push(line);
-      continue;
-    }
-    if (inRemnicBlock) {
-      if (line.length > 0 && !/^\s/.test(line)) {
-        if (!written.host) newLines.push(`  host: "${safeHost}"`);
-        if (!written.port) newLines.push(`  port: ${safePort}`);
-        if (!written.token) newLines.push(`  token: "${opts.token}"`);
-        blockWritten = true;
-        inRemnicBlock = false;
-        newLines.push(line);
-        continue;
-      }
-      if (/^\s+host:/.test(line)) {
-        newLines.push(`  host: "${safeHost}"`);
-        written.host = true;
-      } else if (/^\s+port:/.test(line)) {
-        newLines.push(`  port: ${safePort}`);
-        written.port = true;
-      } else if (/^\s+token:/.test(line)) {
-        newLines.push(`  token: "${opts.token}"`);
-        written.token = true;
-      } else {
-        newLines.push(line);
-      }
-      continue;
-    }
-    newLines.push(line);
-  }
-  if (inRemnicBlock && !blockWritten) {
-    if (!written.host) newLines.push(`  host: "${safeHost}"`);
-    if (!written.port) newLines.push(`  port: ${safePort}`);
-    if (!written.token) newLines.push(`  token: "${opts.token}"`);
-  }
-  writeSecretFileSync(cfgPath, newLines.join("\n") + "\n");
-  return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };
-}
-function removeHermesConfig(opts) {
-  const cfgPaths = hermesConfigCleanupPaths(opts.profile);
-  const results = cfgPaths.map((cfgPath) => {
-    try {
-      return removeHermesConfigFile(cfgPath);
-    } catch (err) {
-      return {
-        updated: false,
-        skipped: true,
-        reason: `Hermes config cleanup failed: ${err instanceof Error ? err.message : String(err)}`,
-        configPath: cfgPath
-      };
-    }
-  });
-  const updated = results.filter((result) => result.updated);
-  const cleanupFailures = results.filter((result) => result.reason?.startsWith("Hermes config cleanup failed:"));
-  if (updated.length > 0) {
-    const updatedPaths = updated.map((result) => result.configPath).join(", ");
-    if (cleanupFailures.length > 0) {
-      const failedPaths = cleanupFailures.map((result) => result.configPath).join(", ");
-      return {
-        updated: false,
-        skipped: true,
-        reason: `Hermes config cleanup partially failed: updated ${updatedPaths}; failed ${failedPaths}`,
-        configPath: `${updatedPaths}; failed: ${failedPaths}`
-      };
-    }
-    return {
-      updated: true,
-      skipped: false,
-      configPath: updatedPaths
-    };
-  }
-  const cleanupFailure = cleanupFailures[0];
-  if (cleanupFailure) {
-    return cleanupFailure;
-  }
-  const existingWithoutBlock = results.find((result) => result.reason !== "Hermes config.yaml not found");
-  return existingWithoutBlock ?? results[0] ?? {
-    updated: false,
-    skipped: true,
-    reason: "Hermes config.yaml not found",
-    configPath: hermesConfigPath(opts.profile)
-  };
-}
-function removeHermesConfigFile(cfgPath) {
-  if (!fs9.existsSync(cfgPath)) {
-    return {
-      updated: false,
-      skipped: true,
-      reason: "Hermes config.yaml not found",
-      configPath: cfgPath
-    };
-  }
-  const raw = fs9.readFileSync(cfgPath, "utf8");
-  if (!/^remnic:/m.test(raw)) {
-    return {
-      updated: false,
-      skipped: true,
-      reason: "No remnic: block found in config.yaml",
-      configPath: cfgPath
-    };
-  }
-  const lines = raw.split("\n");
-  const newLines = [];
-  let inRemnicBlock = false;
-  for (const line of lines) {
-    if (/^remnic:/.test(line)) {
-      inRemnicBlock = true;
-      continue;
-    }
-    if (inRemnicBlock) {
-      if (line.length > 0 && !/^\s/.test(line)) {
-        inRemnicBlock = false;
-        newLines.push(line);
-      }
-      continue;
-    }
-    newLines.push(line);
-  }
-  while (newLines.length > 0 && newLines[newLines.length - 1]?.trim() === "") {
-    newLines.pop();
-  }
-  writeSecretFileSync(cfgPath, newLines.length > 0 ? newLines.join("\n") + "\n" : "");
-  return { updated: true, skipped: false, configPath: cfgPath };
-}
-var HEALTH_EXIT_OK = 0;
-var HEALTH_EXIT_UNAUTHORIZED = 2;
-function checkDaemonHealth(host, port, authToken) {
-  try {
-    const safePort = Math.trunc(Number(port));
-    if (!Number.isFinite(safePort) || safePort < 1 || safePort > 65535) {
-      return false;
-    }
-    const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-    const script = [
-      "const http = require('http');",
-      "const env = process['env'];",
-      "const headers = {};",
-      "if (env.REMNIC_HEALTH_TOKEN) {",
-      "  headers['authorization'] = 'Bearer ' + env.REMNIC_HEALTH_TOKEN;",
-      "}",
-      "const req = http.get({",
-      "  host: env.REMNIC_HEALTH_HOST,",
-      "  port: parseInt(env.REMNIC_HEALTH_PORT, 10),",
-      "  path: '/engram/v1/health',",
-      "  headers,",
-      "  timeout: 3000,",
-      "}, (res) => { process.exit(res.statusCode === 200 ? 0 : res.statusCode === 401 ? 2 : 1); });",
-      "req.on('error', () => process.exit(1));",
-      "req.on('timeout', () => { req.destroy(); process.exit(1); });"
-    ].join("\n");
-    const env = mergeEnv({
-      REMNIC_HEALTH_HOST: bareHost,
-      REMNIC_HEALTH_PORT: String(safePort)
-    });
-    if (authToken) {
-      env.REMNIC_HEALTH_TOKEN = authToken;
-    }
-    const processPath = process.execPath;
-    const launchOptions = { timeout: 4e3, env };
-    const result = launchProcessSync(processPath, ["-e", script], launchOptions);
-    if (result.status === HEALTH_EXIT_OK) {
-      return true;
-    }
-    if (result.status === HEALTH_EXIT_UNAUTHORIZED) {
-      console.error(
-        "[remnic/connectors] health probe got 401 \u2014 retrying after token cache TTL..."
-      );
-      launchProcessSync(processPath, ["-e", "setTimeout(() => {}, 6000)"], {
-        timeout: 7e3,
-        env: {}
-      });
-      const retry = launchProcessSync(processPath, ["-e", script], launchOptions);
-      return retry.status === HEALTH_EXIT_OK;
-    }
-    return false;
-  } catch {
-    return false;
-  }
-}
-async function doctorConnector(connectorId) {
-  const installed = listConnectors().installed;
-  const instance = installed.find((c) => c.connectorId === connectorId);
-  if (!instance) {
-    return {
-      connectorId,
-      checks: [{ name: "Installed", ok: false, detail: "Not installed" }],
-      healthy: false
-    };
-  }
-  const configPath = path13.join(getConnectorsDir(), `${connectorId}.json`);
-  const checks = [];
-  checks.push({
-    name: "Config file",
-    ok: fs9.existsSync(configPath),
-    detail: configPath
-  });
-  try {
-    const raw = fs9.readFileSync(configPath, "utf8");
-    JSON.parse(raw);
-    checks.push({ name: "Config valid", ok: true, detail: "OK" });
-  } catch (e) {
-    checks.push({ name: "Config valid", ok: false, detail: String(e) });
-  }
-  const mcpUrl = instance.config.mcpServerUrl;
-  if (mcpUrl) {
-    try {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), 3e3);
-      const response = await fetch(mcpUrl, { signal: controller.signal });
-      clearTimeout(timeoutId);
-      checks.push({ name: "MCP server", ok: response.ok, detail: mcpUrl });
-    } catch (e) {
-      checks.push({
-        name: "MCP server",
-        ok: false,
-        detail: `Cannot reach ${mcpUrl}: ${e instanceof Error ? e.message : "unknown"}`
-      });
-    }
-  }
-  const memoryDir = instance.config.memoryDir;
-  if (memoryDir) {
-    if (fs9.existsSync(memoryDir)) {
-      checks.push({ name: "Memory directory", ok: true, detail: memoryDir });
-    } else {
-      checks.push({ name: "Memory directory", ok: false, detail: `Not found: ${memoryDir}` });
-    }
-  }
-  const healthy = checks.every((c) => c.ok);
-  return { connectorId, checks, healthy };
-}
-var CODEX_MEMORIES_SUBDIR = "memories";
-var CODEX_EXTENSIONS_SUBDIR = "memories_extensions";
-var REMNIC_EXTENSION_DIR_NAME = "remnic";
-function resolveCodexHome(override) {
-  if (override && typeof override === "string" && override.trim().length > 0) {
-    return path13.resolve(override.trim());
-  }
-  const envHome = readEnvVar("CODEX_HOME");
-  if (envHome && envHome.trim().length > 0) {
-    return path13.resolve(envHome.trim());
-  }
-  const home = readEnvVar("HOME") || readEnvVar("USERPROFILE") || resolveHomeDir();
-  return path13.resolve(home, ".codex");
-}
-function resolveCodexMemoryExtensionPaths(codexHomeOverride) {
-  const codexHome = resolveCodexHome(codexHomeOverride);
-  const memoriesDir = path13.join(codexHome, CODEX_MEMORIES_SUBDIR);
-  const extensionsRoot = path13.join(path13.dirname(memoriesDir), CODEX_EXTENSIONS_SUBDIR);
-  const remnicExtensionDir = path13.join(extensionsRoot, REMNIC_EXTENSION_DIR_NAME);
-  return { codexHome, memoriesDir, extensionsRoot, remnicExtensionDir };
-}
-function locatePluginCodexExtensionSource(override) {
-  if (override && typeof override === "string" && override.trim().length > 0) {
-    const resolved = path13.resolve(override.trim());
-    if (fs9.existsSync(resolved) && fs9.statSync(resolved).isDirectory()) {
-      return resolved;
-    }
-    throw new Error(`Codex extension source directory not found: ${resolved}`);
-  }
-  const EXTENSION_SUBPATH = path13.join("memories_extensions", "remnic");
-  const WORKSPACE_RELATIVE_PATH = path13.join(
-    "packages",
-    "plugin-codex",
-    "memories_extensions",
-    "remnic"
-  );
-  const searched = [];
-  try {
-    const moduleDir = path13.dirname(fileURLToPath(import.meta.url));
-    const bundledCandidate = path13.join(moduleDir, "codex");
-    searched.push(bundledCandidate);
-    if (fs9.existsSync(bundledCandidate) && fs9.statSync(bundledCandidate).isDirectory()) {
-      return bundledCandidate;
-    }
-    const distConnectorsCandidate = path13.join(moduleDir, "connectors", "codex");
-    searched.push(distConnectorsCandidate);
-    if (fs9.existsSync(distConnectorsCandidate) && fs9.statSync(distConnectorsCandidate).isDirectory()) {
-      return distConnectorsCandidate;
-    }
-  } catch {
-  }
-  try {
-    const requireFromHere = createRequire(import.meta.url);
-    const pluginPkgJsonPath = requireFromHere.resolve("@remnic/plugin-codex/package.json");
-    const pluginPkgRoot = path13.dirname(pluginPkgJsonPath);
-    const candidate = path13.join(pluginPkgRoot, EXTENSION_SUBPATH);
-    searched.push(candidate);
-    if (fs9.existsSync(candidate) && fs9.statSync(candidate).isDirectory()) {
-      return candidate;
-    }
-  } catch {
-  }
-  try {
-    const moduleDir = path13.dirname(fileURLToPath(import.meta.url));
-    let dir = moduleDir;
-    for (let depth = 0; depth < 8; depth += 1) {
-      const candidate = path13.join(
-        dir,
-        "node_modules",
-        "@remnic",
-        "plugin-codex",
-        EXTENSION_SUBPATH
-      );
-      searched.push(candidate);
-      if (fs9.existsSync(candidate) && fs9.statSync(candidate).isDirectory()) {
-        return candidate;
-      }
-      const parent = path13.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-  } catch {
-  }
-  const anchors = [];
-  try {
-    anchors.push(path13.dirname(fileURLToPath(import.meta.url)));
-  } catch {
-  }
-  anchors.push(process.cwd());
-  for (const anchor of anchors) {
-    let dir = anchor;
-    for (let depth = 0; depth < 12; depth += 1) {
-      const candidate = path13.join(dir, WORKSPACE_RELATIVE_PATH);
-      searched.push(candidate);
-      if (fs9.existsSync(candidate) && fs9.statSync(candidate).isDirectory()) {
-        return candidate;
-      }
-      const parent = path13.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-  }
-  throw new Error(
-    "Could not locate the plugin-codex memories_extensions/remnic source directory.\nPaths searched:\n" + searched.map((p) => `  - ${p}`).join("\n") + "\nInstall @remnic/plugin-codex or pass sourceDir explicitly."
-  );
-}
-function copyDirRecursiveSync(src, dest) {
-  let count = 0;
-  fs9.mkdirSync(dest, { recursive: true });
-  const entries = fs9.readdirSync(src, { withFileTypes: true });
-  for (const entry of entries) {
-    const from = path13.join(src, entry.name);
-    const to = path13.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      count += copyDirRecursiveSync(from, to);
-    } else if (entry.isFile()) {
-      fs9.copyFileSync(from, to);
-      count += 1;
-    }
-  }
-  return count;
-}
-function installCodexMemoryExtension(options = {}) {
-  const paths = resolveCodexMemoryExtensionPaths(options.codexHome ?? null);
-  const sourceDir = locatePluginCodexExtensionSource(options.sourceDir ?? null);
-  fs9.mkdirSync(paths.extensionsRoot, { recursive: true });
-  const tmpPrefix = `.${REMNIC_EXTENSION_DIR_NAME}.tmp-`;
-  const STALE_TMP_THRESHOLD_MS = 10 * 60 * 1e3;
-  const now = Date.now();
-  try {
-    const existingEntries = fs9.readdirSync(paths.extensionsRoot);
-    for (const entry of existingEntries) {
-      if (!entry.startsWith(tmpPrefix)) continue;
-      const stalePath = path13.join(paths.extensionsRoot, entry);
-      try {
-        const stat = fs9.statSync(stalePath);
-        const ageMs = now - stat.mtimeMs;
-        if (ageMs < STALE_TMP_THRESHOLD_MS) {
-          continue;
-        }
-        fs9.rmSync(stalePath, { recursive: true, force: true });
-      } catch {
-      }
-    }
-  } catch {
-  }
-  const tmpName = `${tmpPrefix}${process.pid}-${Date.now()}`;
-  const tmpDir = path13.join(paths.extensionsRoot, tmpName);
-  let filesCopied = 0;
-  let commitFn = () => {
-  };
-  let rollbackFn = () => {
-  };
-  try {
-    filesCopied = copyDirRecursiveSync(sourceDir, tmpDir);
-    const backupDir = `${paths.remnicExtensionDir}.bak-${Date.now()}`;
-    const hadExisting = fs9.existsSync(paths.remnicExtensionDir);
-    if (hadExisting) {
-      fs9.renameSync(paths.remnicExtensionDir, backupDir);
-    }
-    try {
-      fs9.renameSync(tmpDir, paths.remnicExtensionDir);
-    } catch (renameErr) {
-      if (hadExisting) {
-        try {
-          fs9.renameSync(backupDir, paths.remnicExtensionDir);
-        } catch {
-        }
-      }
-      throw renameErr;
-    }
-    commitFn = () => {
-      if (hadExisting) {
-        try {
-          fs9.rmSync(backupDir, { recursive: true, force: true });
-        } catch {
-        }
-      }
-    };
-    rollbackFn = () => {
-      if (hadExisting) {
-        try {
-          if (fs9.existsSync(paths.remnicExtensionDir)) {
-            fs9.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
-          }
-          fs9.renameSync(backupDir, paths.remnicExtensionDir);
-        } catch {
-        }
-      } else {
-        try {
-          if (fs9.existsSync(paths.remnicExtensionDir)) {
-            fs9.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
-          }
-        } catch {
-        }
-      }
-    };
-  } catch (err) {
-    if (fs9.existsSync(tmpDir)) {
-      try {
-        fs9.rmSync(tmpDir, { recursive: true, force: true });
-      } catch {
-      }
-    }
-    throw err;
-  }
-  const instructionsPath = path13.join(paths.remnicExtensionDir, "instructions.md");
-  return {
-    ...paths,
-    instructionsPath,
-    filesCopied,
-    commit: commitFn,
-    rollback: rollbackFn
-  };
-}
-function removeCodexMemoryExtension(options = {}) {
-  const paths = resolveCodexMemoryExtensionPaths(options.codexHome ?? null);
-  let removed = false;
-  if (fs9.existsSync(paths.remnicExtensionDir)) {
-    fs9.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
-    removed = true;
-  }
-  return { ...paths, removed };
-}
-function getConnectorsDir() {
-  const xdgConfigHome = readEnvVar("XDG_CONFIG_HOME");
-  const configDir = xdgConfigHome ? path13.join(xdgConfigHome, "engram") : path13.join(resolveHomeDir(), ".config", "engram");
-  return path13.join(configDir, REGISTRY_DIR_NAME, "connectors");
-}
-var WECLONE_PROXY_CONFIG_DIRNAME = ".remnic";
-var WECLONE_PROXY_CONFIG_FILENAME = "weclone.json";
-function resolveWeCloneProxyConfigPath() {
-  const override = readEnvVar("REMNIC_HOME") ?? readEnvVar("ENGRAM_HOME");
-  if (override && override.length > 0) {
-    return path13.resolve(override, "connectors", WECLONE_PROXY_CONFIG_FILENAME);
-  }
-  const envHome = readEnvVar("HOME");
-  const home = envHome && envHome.length > 0 ? envHome : os.homedir();
-  return path13.resolve(
-    home,
-    WECLONE_PROXY_CONFIG_DIRNAME,
-    "connectors",
-    WECLONE_PROXY_CONFIG_FILENAME
-  );
-}
-function readWeCloneProxyConfigIfExists(configPath) {
-  try {
-    if (!fs9.existsSync(configPath)) return null;
-    return fs9.readFileSync(configPath, "utf8");
-  } catch {
-    return null;
-  }
-}
-function safeParseJson(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-      return parsed;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-var WECLONE_DEFAULTS = {
-  wecloneApiUrl: "http://localhost:8000/v1",
-  wecloneModelName: "weclone-avatar",
-  proxyPort: 8100,
-  remnicDaemonUrl: "http://localhost:4318",
-  sessionStrategy: "single",
-  memoryInjection: {
-    maxTokens: 1500,
-    position: "system-append",
-    template: "[Memory Context]\n{memories}\n[End Memory Context]"
-  }
-};
-function resolveStringField(userConfig, priorConfig, key, fallback) {
-  const fromUser = userConfig[key];
-  if (typeof fromUser === "string" && fromUser.length > 0) return fromUser;
-  if (priorConfig) {
-    const fromPrior = priorConfig[key];
-    if (typeof fromPrior === "string" && fromPrior.length > 0) return fromPrior;
-  }
-  return fallback;
-}
-function coercePort(value) {
-  if (typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535) {
-    return value;
-  }
-  if (typeof value === "string" && value.length > 0) {
-    const n = Number(value);
-    if (Number.isInteger(n) && n >= 1 && n <= 65535) return n;
-  }
-  return null;
-}
-function resolvePort(userConfig, priorConfig, fallback) {
-  const fromUser = coercePort(userConfig.proxyPort);
-  if (fromUser !== null) return fromUser;
-  if (priorConfig) {
-    const fromPrior = coercePort(priorConfig.proxyPort);
-    if (fromPrior !== null) return fromPrior;
-  }
-  return fallback;
-}
-function resolveSessionStrategy(userConfig, priorConfig) {
-  const valid = /* @__PURE__ */ new Set(["caller-id", "single"]);
-  const fromUser = userConfig.sessionStrategy;
-  if (typeof fromUser === "string" && valid.has(fromUser)) {
-    return fromUser;
-  }
-  if (priorConfig) {
-    const fromPrior = priorConfig.sessionStrategy;
-    if (typeof fromPrior === "string" && valid.has(fromPrior)) {
-      return fromPrior;
-    }
-  }
-  return WECLONE_DEFAULTS.sessionStrategy;
-}
-function buildWeCloneProxyConfig(args) {
-  const { userConfig, priorConfig, authToken } = args;
-  const wecloneApiUrl = resolveStringField(
-    userConfig,
-    priorConfig,
-    "wecloneApiUrl",
-    WECLONE_DEFAULTS.wecloneApiUrl
-  );
-  const wecloneModelName = resolveStringField(
-    userConfig,
-    priorConfig,
-    "wecloneModelName",
-    WECLONE_DEFAULTS.wecloneModelName
-  );
-  const remnicDaemonUrl = resolveStringField(
-    userConfig,
-    priorConfig,
-    "remnicDaemonUrl",
-    WECLONE_DEFAULTS.remnicDaemonUrl
-  );
-  const proxyPort = resolvePort(
-    userConfig,
-    priorConfig,
-    WECLONE_DEFAULTS.proxyPort
-  );
-  const sessionStrategy = resolveSessionStrategy(userConfig, priorConfig);
-  const memoryInjection = {
-    ...WECLONE_DEFAULTS.memoryInjection,
-    ...priorConfig && typeof priorConfig.memoryInjection === "object" && priorConfig.memoryInjection !== null && !Array.isArray(priorConfig.memoryInjection) ? priorConfig.memoryInjection : {},
-    ...typeof userConfig.memoryInjection === "object" && userConfig.memoryInjection !== null && !Array.isArray(userConfig.memoryInjection) ? userConfig.memoryInjection : {}
-  };
-  const config = {
-    wecloneApiUrl,
-    wecloneModelName,
-    proxyPort,
-    remnicDaemonUrl,
-    sessionStrategy,
-    memoryInjection
-  };
-  if (authToken && authToken.length > 0) {
-    config.remnicAuthToken = authToken;
-  } else if (typeof userConfig.remnicAuthToken === "string" && userConfig.remnicAuthToken.length > 0) {
-    config.remnicAuthToken = userConfig.remnicAuthToken;
-  } else if (priorConfig && typeof priorConfig.remnicAuthToken === "string" && priorConfig.remnicAuthToken.length > 0) {
-    config.remnicAuthToken = priorConfig.remnicAuthToken;
-  }
-  return config;
-}
-
-// src/spaces/index.ts
-import fs10 from "fs";
-import path14 from "path";
-import crypto6 from "crypto";
-var MANIFEST_VERSION = 1;
-function getSpacesDir(baseDir) {
-  const homeDir = baseDir ?? resolveHomeDir();
-  return path14.join(homeDir, ".config", "engram", "spaces");
-}
-function getManifestPath(baseDir) {
-  return path14.join(getSpacesDir(baseDir), "manifest.json");
-}
-function loadManifest(baseDir, memoryDirOverride) {
-  const manifestPath2 = getManifestPath(baseDir);
-  if (!fs10.existsSync(manifestPath2)) {
-    const personalSpace = createPersonalSpace(baseDir, memoryDirOverride);
-    const manifest = {
-      activeSpaceId: personalSpace.id,
-      spaces: [personalSpace],
-      version: MANIFEST_VERSION
-    };
-    saveManifest(manifest, baseDir);
-    return manifest;
-  }
-  const raw = JSON.parse(fs10.readFileSync(manifestPath2, "utf8"));
-  return raw;
-}
-function saveManifest(manifest, baseDir) {
-  const manifestPath2 = getManifestPath(baseDir);
-  fs10.mkdirSync(path14.dirname(manifestPath2), { recursive: true });
-  fs10.writeFileSync(manifestPath2, JSON.stringify(manifest, null, 2) + "\n");
-}
-function createPersonalSpace(baseDir, memoryDirOverride) {
-  const homeDir = baseDir ?? resolveHomeDir();
-  const standalonePath = path14.join(homeDir, ".engram", "memory");
-  const openclawPath = path14.join(homeDir, ".openclaw", "workspace", "memory", "local");
-  const memoryDir = memoryDirOverride ?? readEnvVar("ENGRAM_MEMORY_DIR") ?? (fs10.existsSync(standalonePath) ? standalonePath : fs10.existsSync(openclawPath) ? openclawPath : standalonePath);
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  return {
-    id: "personal",
-    name: "Personal",
-    kind: "personal",
-    description: "Default personal memory space",
-    memoryDir,
-    createdAt: now,
-    updatedAt: now,
-    owner: readEnvVar("USER")
-  };
-}
-function listSpaces(baseDir) {
-  const manifest = loadManifest(baseDir);
-  return manifest.spaces;
-}
-function getActiveSpace(baseDir) {
-  const manifest = loadManifest(baseDir);
-  const space = manifest.spaces.find((s) => s.id === manifest.activeSpaceId);
-  if (!space) throw new Error(`Active space ${manifest.activeSpaceId} not found`);
-  return space;
-}
-function createSpace(options) {
-  const manifest = loadManifest(options.baseDir);
-  const id = options.name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-");
-  if (manifest.spaces.some((s) => s.id === id)) {
-    throw new Error(`Space "${id}" already exists`);
-  }
-  if (options.parentSpaceId && !manifest.spaces.some((s) => s.id === options.parentSpaceId)) {
-    throw new Error(`Parent space "${options.parentSpaceId}" not found`);
-  }
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const memoryDir = options.memoryDir ?? path14.join(
-    getSpacesDir(options.baseDir),
-    id,
-    "memory"
-  );
-  const space = {
-    id,
-    name: options.name,
-    kind: options.kind,
-    description: options.description,
-    memoryDir,
-    createdAt: now,
-    updatedAt: now,
-    owner: readEnvVar("USER"),
-    parentSpaceId: options.parentSpaceId
-  };
-  fs10.mkdirSync(memoryDir, { recursive: true });
-  manifest.spaces.push(space);
-  manifest.updatedAt = now;
-  saveManifest(manifest, options.baseDir);
-  appendAudit({
-    action: "space.create",
-    sourceSpaceId: id,
-    details: `Created ${options.kind} space "${options.name}"`
-  }, options.baseDir);
-  return space;
+  const space = {
+    id,
+    name: options.name,
+    kind: options.kind,
+    description: options.description,
+    memoryDir,
+    createdAt: now,
+    updatedAt: now,
+    owner: readEnvVar("USER"),
+    parentSpaceId: options.parentSpaceId
+  };
+  fs8.mkdirSync(memoryDir, { recursive: true });
+  manifest.spaces.push(space);
+  manifest.updatedAt = now;
+  saveManifest(manifest, options.baseDir);
+  appendAudit({
+    action: "space.create",
+    sourceSpaceId: id,
+    details: `Created ${options.kind} space "${options.name}"`
+  }, options.baseDir);
+  return space;
 }
 function deleteSpace(spaceId, baseDir) {
   const manifest = loadManifest(baseDir);
@@ -5009,34 +3124,34 @@ function mergeSpaces(sourceSpaceId, targetSpaceId, options) {
   };
 }
 function getAuditLog(baseDir) {
-  const auditPath = path14.join(getSpacesDir(baseDir), "audit.jsonl");
-  if (!fs10.existsSync(auditPath)) return [];
-  const lines = fs10.readFileSync(auditPath, "utf8").trim().split("\n");
+  const auditPath = path12.join(getSpacesDir(baseDir), "audit.jsonl");
+  if (!fs8.existsSync(auditPath)) return [];
+  const lines = fs8.readFileSync(auditPath, "utf8").trim().split("\n");
   return lines.filter((l) => l.trim()).map((l) => JSON.parse(l));
 }
 function appendAudit(entry, baseDir) {
-  const auditPath = path14.join(getSpacesDir(baseDir), "audit.jsonl");
-  fs10.mkdirSync(path14.dirname(auditPath), { recursive: true });
+  const auditPath = path12.join(getSpacesDir(baseDir), "audit.jsonl");
+  fs8.mkdirSync(path12.dirname(auditPath), { recursive: true });
   const full = {
     id: crypto6.randomUUID(),
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     ...entry
   };
-  fs10.appendFileSync(auditPath, JSON.stringify(full) + "\n");
+  fs8.appendFileSync(auditPath, JSON.stringify(full) + "\n");
 }
 function copyMemories(sourceDir, targetDir, options) {
   let merged = 0;
   const conflicts = [];
   let skipped = 0;
-  if (!fs10.existsSync(sourceDir)) {
+  if (!fs8.existsSync(sourceDir)) {
     return { merged: 0, conflicts: [], skipped: 0 };
   }
-  fs10.mkdirSync(targetDir, { recursive: true });
+  fs8.mkdirSync(targetDir, { recursive: true });
   const sourceFiles = walkMd2(sourceDir);
   for (const sourcePath of sourceFiles) {
-    const content = fs10.readFileSync(sourcePath, "utf8");
-    const relativePath = path14.relative(sourceDir, sourcePath);
-    const targetPath = path14.join(targetDir, relativePath);
+    const content = fs8.readFileSync(sourcePath, "utf8");
+    const relativePath = path12.relative(sourceDir, sourcePath);
+    const targetPath = path12.join(targetDir, relativePath);
     const sourceHash = hashContent4(content);
     if (options?.filterIds?.length) {
       const fm = parseSimpleFrontmatter(content);
@@ -5045,8 +3160,8 @@ function copyMemories(sourceDir, targetDir, options) {
         continue;
       }
     }
-    if (fs10.existsSync(targetPath) && !options?.force) {
-      const targetContent = fs10.readFileSync(targetPath, "utf8");
+    if (fs8.existsSync(targetPath) && !options?.force) {
+      const targetContent = fs8.readFileSync(targetPath, "utf8");
       const targetHash = hashContent4(targetContent);
       if (sourceHash !== targetHash) {
         conflicts.push({
@@ -5062,8 +3177,8 @@ function copyMemories(sourceDir, targetDir, options) {
       skipped++;
       continue;
     }
-    fs10.mkdirSync(path14.dirname(targetPath), { recursive: true });
-    fs10.writeFileSync(targetPath, content);
+    fs8.mkdirSync(path12.dirname(targetPath), { recursive: true });
+    fs8.writeFileSync(targetPath, content);
     merged++;
   }
   return { merged, conflicts, skipped };
@@ -5074,8 +3189,8 @@ function hashContent4(content) {
 function walkMd2(dir) {
   const results = [];
   function walk(d) {
-    for (const entry of fs10.readdirSync(d, { withFileTypes: true })) {
-      const fullPath = path14.join(d, entry.name);
+    for (const entry of fs8.readdirSync(d, { withFileTypes: true })) {
+      const fullPath = path12.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
       } else if (entry.name.endsWith(".md")) {
@@ -5203,10 +3318,10 @@ var REMNIC_RECALL_DECISION_RULES = `## When to Use Recall vs Direct Read
 `;
 
 // src/memory-extension/codex-publisher.ts
-import fs11 from "fs";
-import os2 from "os";
-import path15 from "path";
-var REMNIC_EXTENSION_DIR_NAME2 = "remnic";
+import fs9 from "fs";
+import os from "os";
+import path13 from "path";
+var REMNIC_EXTENSION_DIR_NAME = "remnic";
 var CodexMemoryExtensionPublisher = class {
   hostId = "codex";
   static capabilities = {
@@ -5216,13 +3331,13 @@ var CodexMemoryExtensionPublisher = class {
     readPathTemplate: true
   };
   async resolveExtensionRoot(env) {
-    const codexHome = env === void 0 ? readEnvVar("CODEX_HOME")?.trim() || path15.join(resolveHomeDir(), ".codex") : env.CODEX_HOME?.trim() || path15.join(env.HOME ?? env.USERPROFILE ?? os2.homedir(), ".codex");
-    return path15.join(codexHome, "memories_extensions", REMNIC_EXTENSION_DIR_NAME2);
+    const codexHome = env === void 0 ? readEnvVar("CODEX_HOME")?.trim() || path13.join(resolveHomeDir(), ".codex") : env.CODEX_HOME?.trim() || path13.join(env.HOME ?? env.USERPROFILE ?? os.homedir(), ".codex");
+    return path13.join(codexHome, "memories_extensions", REMNIC_EXTENSION_DIR_NAME);
   }
   async isHostAvailable() {
     try {
-      const home = readEnvVar("CODEX_HOME")?.trim() || path15.join(resolveHomeDir(), ".codex");
-      return fs11.existsSync(home);
+      const home = readEnvVar("CODEX_HOME")?.trim() || path13.join(resolveHomeDir(), ".codex");
+      return fs9.existsSync(home);
     } catch {
       return false;
     }
@@ -5272,22 +3387,22 @@ When running inside the Codex phase-2 consolidation sandbox:
   }
   async publish(ctx) {
     const extensionRoot = await this.resolveExtensionRoot();
-    const instructionsPath = path15.join(extensionRoot, "instructions.md");
+    const instructionsPath = path13.join(extensionRoot, "instructions.md");
     const filesWritten = [];
     const skipped = [];
     ctx.log.info(`Publishing Codex memory extension to ${extensionRoot}`);
-    fs11.mkdirSync(extensionRoot, { recursive: true });
+    fs9.mkdirSync(extensionRoot, { recursive: true });
     const content = await this.renderInstructions(ctx);
     const tmpPath = `${instructionsPath}.tmp-${process.pid}-${Date.now()}`;
     try {
-      fs11.writeFileSync(tmpPath, content, "utf-8");
-      fs11.renameSync(tmpPath, instructionsPath);
+      fs9.writeFileSync(tmpPath, content, "utf-8");
+      fs9.renameSync(tmpPath, instructionsPath);
       filesWritten.push(instructionsPath);
       ctx.log.info(`Wrote ${instructionsPath}`);
     } catch (err) {
       try {
-        if (fs11.existsSync(tmpPath)) {
-          fs11.unlinkSync(tmpPath);
+        if (fs9.existsSync(tmpPath)) {
+          fs9.unlinkSync(tmpPath);
         }
       } catch {
       }
@@ -5302,8 +3417,8 @@ When running inside the Codex phase-2 consolidation sandbox:
   }
   async unpublish() {
     const extensionRoot = await this.resolveExtensionRoot();
-    if (fs11.existsSync(extensionRoot)) {
-      fs11.rmSync(extensionRoot, { recursive: true, force: true });
+    if (fs9.existsSync(extensionRoot)) {
+      fs9.rmSync(extensionRoot, { recursive: true, force: true });
     }
   }
 };
@@ -5387,264 +3502,6 @@ function publisherForConnector(connectorId) {
   return publisherFor(hostIdForConnector(connectorId));
 }
 
-// src/enrichment/types.ts
-function defaultEnrichmentPipelineConfig() {
-  return {
-    enabled: false,
-    providers: [],
-    importanceThresholds: {
-      critical: [],
-      high: [],
-      normal: [],
-      low: []
-    },
-    maxCandidatesPerEntity: 20,
-    autoEnrichOnCreate: false,
-    scheduleIntervalMs: 36e5
-  };
-}
-
-// src/enrichment/provider-registry.ts
-var EnrichmentProviderRegistry = class {
-  providers = /* @__PURE__ */ new Map();
-  /** Register a provider. Overwrites any existing provider with the same id. */
-  register(provider) {
-    this.providers.set(provider.id, provider);
-  }
-  /** Look up a single provider by id. */
-  get(id) {
-    return this.providers.get(id);
-  }
-  /**
-   * Return all registered providers whose id appears in the config's
-   * `providers` list with `enabled: true`.
-   */
-  listEnabled(config) {
-    const enabledIds = new Set(
-      config.providers.filter((p) => p.enabled).map((p) => p.id)
-    );
-    const result = [];
-    for (const [id, provider] of this.providers.entries()) {
-      if (enabledIds.has(id)) {
-        result.push(provider);
-      }
-    }
-    return result;
-  }
-  /**
-   * Return providers that should run for a given importance level.
-   * Providers are resolved from `config.importanceThresholds[level]` and
-   * filtered to only those that are both registered and enabled.
-   */
-  getForImportance(level, config) {
-    if (level === "trivial") return [];
-    const thresholds = config.importanceThresholds;
-    const providerIds = level === "critical" ? thresholds.critical : level === "high" ? thresholds.high : level === "normal" ? thresholds.normal : thresholds.low;
-    const enabledIds = new Set(
-      config.providers.filter((p) => p.enabled).map((p) => p.id)
-    );
-    const result = [];
-    for (const id of providerIds) {
-      if (!enabledIds.has(id)) continue;
-      const provider = this.providers.get(id);
-      if (provider) {
-        result.push(provider);
-      }
-    }
-    return result;
-  }
-};
-
-// src/enrichment/web-search-provider.ts
-var WebSearchProvider = class {
-  id = "web-search";
-  costTier = "cheap";
-  searchFn;
-  constructor(options = {}) {
-    this.searchFn = options.searchFn;
-  }
-  async isAvailable() {
-    return this.searchFn !== void 0;
-  }
-  async enrich(entity) {
-    if (!this.searchFn) return [];
-    const query = `${entity.name} ${entity.type}`;
-    let snippets;
-    try {
-      snippets = await this.searchFn(query);
-    } catch {
-      return [];
-    }
-    return snippets.filter((s) => typeof s === "string" && s.trim().length > 0).map((snippet) => ({
-      text: snippet.trim(),
-      source: this.id,
-      sourceUrl: void 0,
-      confidence: 0.5,
-      category: "fact",
-      tags: ["web-search"]
-    }));
-  }
-};
-
-// src/enrichment/pipeline.ts
-function isRateLimited(provider, config, buckets) {
-  const providerCfg = config.providers.find((p) => p.id === provider.id);
-  if (!providerCfg?.rateLimit) return false;
-  const now = Date.now();
-  let bucket = buckets.get(provider.id);
-  if (!bucket) {
-    bucket = {
-      minuteCount: 0,
-      minuteReset: now + 6e4,
-      dayCount: 0,
-      dayReset: now + 864e5
-    };
-    buckets.set(provider.id, bucket);
-  }
-  if (now >= bucket.minuteReset) {
-    bucket.minuteCount = 0;
-    bucket.minuteReset = now + 6e4;
-  }
-  if (now >= bucket.dayReset) {
-    bucket.dayCount = 0;
-    bucket.dayReset = now + 864e5;
-  }
-  const { maxPerMinute, maxPerDay } = providerCfg.rateLimit;
-  return bucket.minuteCount >= maxPerMinute || bucket.dayCount >= maxPerDay;
-}
-function recordCall(providerId, buckets) {
-  const bucket = buckets.get(providerId);
-  if (bucket) {
-    bucket.minuteCount += 1;
-    bucket.dayCount += 1;
-  }
-}
-async function runEnrichmentPipeline(entities, registry, config, log2) {
-  if (!config.enabled) return [];
-  if (entities.length === 0) return [];
-  const rateBuckets = /* @__PURE__ */ new Map();
-  const results = [];
-  for (const entity of entities) {
-    const providers = registry.getForImportance(entity.importanceLevel, config);
-    for (const provider of providers) {
-      const start = Date.now();
-      let available;
-      try {
-        available = await provider.isAvailable();
-      } catch {
-        available = false;
-      }
-      if (!available) {
-        log2.debug?.(
-          `enrichment: skipping provider ${provider.id} for ${entity.name} \u2014 unavailable`
-        );
-        results.push({
-          entityName: entity.name,
-          provider: provider.id,
-          candidatesFound: 0,
-          candidatesAccepted: 0,
-          candidatesRejected: 0,
-          acceptedCandidates: [],
-          elapsed: Date.now() - start
-        });
-        continue;
-      }
-      if (isRateLimited(provider, config, rateBuckets)) {
-        log2.debug?.(
-          `enrichment: skipping provider ${provider.id} for ${entity.name} \u2014 rate limited`
-        );
-        results.push({
-          entityName: entity.name,
-          provider: provider.id,
-          candidatesFound: 0,
-          candidatesAccepted: 0,
-          candidatesRejected: 0,
-          acceptedCandidates: [],
-          elapsed: Date.now() - start
-        });
-        continue;
-      }
-      let candidates;
-      try {
-        candidates = await provider.enrich(entity);
-      } catch (err) {
-        recordCall(provider.id, rateBuckets);
-        log2.error?.(
-          `enrichment: provider ${provider.id} failed for ${entity.name}: ${err instanceof Error ? err.message : String(err)}`
-        );
-        results.push({
-          entityName: entity.name,
-          provider: provider.id,
-          candidatesFound: 0,
-          candidatesAccepted: 0,
-          candidatesRejected: 0,
-          acceptedCandidates: [],
-          elapsed: Date.now() - start
-        });
-        continue;
-      }
-      recordCall(provider.id, rateBuckets);
-      for (const candidate of candidates) {
-        candidate.source = provider.id;
-      }
-      const maxCandidates = config.maxCandidatesPerEntity;
-      let accepted;
-      if (maxCandidates === 0) {
-        accepted = [];
-      } else if (maxCandidates > 0 && candidates.length > maxCandidates) {
-        accepted = candidates.slice(0, maxCandidates);
-      } else {
-        accepted = candidates;
-      }
-      const rejected = candidates.length - accepted.length;
-      results.push({
-        entityName: entity.name,
-        provider: provider.id,
-        candidatesFound: candidates.length,
-        candidatesAccepted: accepted.length,
-        candidatesRejected: rejected,
-        acceptedCandidates: accepted,
-        elapsed: Date.now() - start
-      });
-    }
-  }
-  return results;
-}
-
-// src/enrichment/audit.ts
-import { mkdir, readFile, appendFile } from "fs/promises";
-import { existsSync } from "fs";
-import path16 from "path";
-var AUDIT_FILENAME = "enrichment-audit.jsonl";
-function auditFilePath(auditDir) {
-  return path16.join(auditDir, AUDIT_FILENAME);
-}
-async function appendAuditEntry(auditDir, entry) {
-  await mkdir(auditDir, { recursive: true });
-  const line = JSON.stringify(entry) + "\n";
-  await appendFile(auditFilePath(auditDir), line, "utf-8");
-}
-async function readAuditLog(auditDir, since) {
-  const filePath = auditFilePath(auditDir);
-  if (!existsSync(filePath)) return [];
-  const raw = await readFile(filePath, "utf-8");
-  const entries = [];
-  for (const line of raw.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0) continue;
-    try {
-      const parsed = JSON.parse(trimmed);
-      if (typeof parsed === "object" && parsed !== null && "timestamp" in parsed && "entityName" in parsed) {
-        const entry = parsed;
-        if (since && entry.timestamp < since) continue;
-        entries.push(entry);
-      }
-    } catch {
-    }
-  }
-  return entries;
-}
-
 // src/importers/base.ts
 var DEFAULT_IMPORT_BATCH_SIZE = 25;
 var MIN_IMPORT_BATCH_SIZE = 1;
@@ -5766,20 +3623,20 @@ async function defaultWriteMemoriesToOrchestrator(target, memories) {
 }
 
 // src/transfer/capsule-fork.ts
-import { lstat, mkdir as mkdir2, readFile as readFile2, realpath, writeFile } from "fs/promises";
-import path17 from "path";
+import { lstat, mkdir, readFile, realpath, writeFile } from "fs/promises";
+import path14 from "path";
 async function forkCapsule(opts) {
   validateForkId(opts.forkId);
-  const rootAbs = path17.resolve(opts.targetRoot);
+  const rootAbs = path14.resolve(opts.targetRoot);
   await assertIsDirectoryNotSymlink(rootAbs, "forkCapsule", "targetRoot");
-  const forkDirAbs = path17.join(rootAbs, "forks", opts.forkId);
+  const forkDirAbs = path14.join(rootAbs, "forks", opts.forkId);
   const forkEntryExists = await pathEntryExists(forkDirAbs);
   if (forkEntryExists) {
     throw new Error(
       `forkCapsule: fork path already exists \u2014 forkId "${opts.forkId}" is already in use at: ${forkDirAbs}`
     );
   }
-  const archiveAbs = path17.resolve(opts.sourceArchive);
+  const archiveAbs = path14.resolve(opts.sourceArchive);
   const importResult = await importCapsule({
     archivePath: archiveAbs,
     root: rootAbs,
@@ -5801,10 +3658,10 @@ async function forkCapsule(opts) {
     importedRecords: importResult.imported.length,
     skippedRecords: importResult.skipped.length
   };
-  const lineagePath = path17.join(forkDirAbs, "lineage.json");
+  const lineagePath = path14.join(forkDirAbs, "lineage.json");
   const rootReal = await realpath(rootAbs);
   await assertRealpathInsideRoot(rootReal, lineagePath, `forks/${opts.forkId}/lineage.json`, "forkCapsule");
-  await mkdir2(path17.dirname(lineagePath), { recursive: true });
+  await mkdir(path14.dirname(lineagePath), { recursive: true });
   await writeFile(lineagePath, JSON.stringify(lineage, null, 2) + "\n", "utf-8");
   return {
     archivePath: archiveAbs,
@@ -5818,17 +3675,17 @@ async function readForkLineage(targetRoot, forkId) {
   if (typeof forkId !== "string" || forkId.length === 0 || forkId.length > 64 || !CAPSULE_ID_PATTERN.test(forkId)) {
     return null;
   }
-  const rootAbs = path17.resolve(targetRoot);
+  const rootAbs = path14.resolve(targetRoot);
   const rootReal = await realpath(rootAbs).catch(() => rootAbs);
-  const lineagePath = path17.join(rootReal, "forks", forkId, "lineage.json");
-  const rel = path17.relative(rootReal, lineagePath);
-  if (rel.startsWith("..") || path17.isAbsolute(rel)) {
+  const lineagePath = path14.join(rootReal, "forks", forkId, "lineage.json");
+  const rel = path14.relative(rootReal, lineagePath);
+  if (rel.startsWith("..") || path14.isAbsolute(rel)) {
     return null;
   }
   if (!await isLineagePathContained(rootReal, lineagePath)) {
     return null;
   }
-  const raw = await readFile2(lineagePath, "utf-8").catch(() => null);
+  const raw = await readFile(lineagePath, "utf-8").catch(() => null);
   if (raw === null) return null;
   try {
     const parsed = JSON.parse(raw);
@@ -5863,19 +3720,19 @@ async function pathEntryExists(absPath) {
 async function isLineagePathContained(rootReal, lineagePath) {
   let existing = lineagePath;
   const suffix = [];
-  while (existing !== path17.dirname(existing)) {
+  while (existing !== path14.dirname(existing)) {
     const st = await lstat(existing).catch(() => null);
     if (st !== null) break;
-    suffix.unshift(path17.basename(existing));
-    existing = path17.dirname(existing);
+    suffix.unshift(path14.basename(existing));
+    existing = path14.dirname(existing);
   }
   const existingReal = await realpath(existing).catch(() => existing);
-  const targetReal = suffix.length > 0 ? path17.join(existingReal, ...suffix) : existingReal;
-  const rel = path17.relative(rootReal, targetReal);
+  const targetReal = suffix.length > 0 ? path14.join(existingReal, ...suffix) : existingReal;
+  const rel = path14.relative(rootReal, targetReal);
   if (rel === "") return true;
   if (rel === "..") return false;
-  if (rel.startsWith(`..${path17.sep}`)) return false;
-  if (path17.isAbsolute(rel)) return false;
+  if (rel.startsWith(`..${path14.sep}`)) return false;
+  if (path14.isAbsolute(rel)) return false;
   return true;
 }
 export {
@@ -5883,6 +3740,7 @@ export {
   ACTION_CONFIDENCE_DECISIONS,
   ACTION_CONFIDENCE_RISK_CATEGORIES,
   ACTION_CONFIDENCE_RULE_KINDS,
+  ACTIVE_STATUSES,
   AccessAuditAdapter,
   BRIEFING_FORMAT_ALLOWED,
   BootstrapEngine,
@@ -5929,6 +3787,7 @@ export {
   MARKETPLACE_SCHEMA_VERSION,
   MATERIALIZE_VERSION,
   MeilisearchBackend,
+  ModelRegistry,
   NOTION_CONNECTOR_ID,
   NOTION_CURSOR_KIND,
   NOTION_DEFAULT_POLL_INTERVAL_MS,
@@ -6005,6 +3864,7 @@ export {
   collectStructuredPlanCues,
   collectTemporalLexicalCues,
   computeMemoryWorth,
+  computePairId,
   computeProcedureStats,
   computeSurprise,
   computeTierValueScore,
@@ -6034,6 +3894,7 @@ export {
   ensureLcmStateDir,
   ensureSentinel,
   evaluateActionConfidence,
+  executeResolution,
   expandTildePath,
   extractGraphEdges,
   facetHasBoundary,
@@ -6076,12 +3937,14 @@ export {
   installFromMarketplace,
   intentCompatibilityScore,
   isAgentAccessSecretRef,
+  isCoolingDown,
   isDirectAnswerEligible,
   isDurableVerdict,
   isEdgeType,
   isImportRole,
   isLcmMessagePartKind,
   isNodeType,
+  isOpenaiApiKeyDisabled,
   isReasoningTracePath,
   isRecallDisclosure,
   isReviewPrompt,
@@ -6092,10 +3955,13 @@ export {
   isUserModelDimension,
   isValidCachedVerdict,
   isValidConnectorId,
+  isValidResolutionVerb,
+  judgeContradictionPairs,
   judgeFactDurability,
   listBulkImportSources,
   listConnectorStates,
   listConnectors,
+  listPairs,
   listPeers,
   listReviewItems,
   listSpaces,
@@ -6120,6 +3986,8 @@ export {
   normalizeCachedVerdict,
   normalizeExplicitParts,
   normalizeOriginUrl,
+  normalizeProjectionPreview,
+  normalizeProjectionTags,
   normalizeQueryText,
   normalizeRetrievedMemoryProvenance,
   normalizeTurnExpansionEnd,
@@ -6139,6 +4007,7 @@ export {
   parseConnectorsListOptions,
   parseConnectorsRunName,
   parseConnectorsStatusOptions,
+  parseEntityFile,
   parseFlexibleIsoTimestamp,
   parseIsoOffsetTimestamp,
   parseIsoTimestamp,
@@ -6170,6 +4039,7 @@ export {
   readForkLineage,
   readInteractionLogRaw,
   readManifest,
+  readPair,
   readPeer,
   readPeerProfile,
   recallForActiveMemory,
@@ -6195,8 +4065,10 @@ export {
   resolveCategory,
   resolveCodingNamespaceOverlay,
   resolveConnectorFromToken,
+  resolveEnvVars,
   resolveExtensionsRoot,
   resolveGitContext,
+  resolvePair,
   resolvePrincipal,
   resolveRemnicPluginEntry,
   revertToVersion,
@@ -6207,6 +4079,7 @@ export {
   runBulkImportPipeline,
   runCodexMaterialize,
   runConnectorPollOnce,
+  runContradictionScan,
   runEnrichmentPipeline,
   runGraphRecall,
   runImporter,
@@ -6219,6 +4092,7 @@ export {
   saveTaxonomy,
   saveTokenStore,
   scanForBinaries,
+  serializeEntityFile,
   setCodexCliFallbackRunnerForProcess,
   shareSpace,
   shouldRecallEventOrderEvidence,
@@ -6247,6 +4121,8 @@ export {
   writeConnectorState,
   writeManifest,
   writeMarketplaceManifest,
+  writePair,
+  writePairs,
   writePeer,
   writePeerProfile
 };