@remnic/core 1.1.12 → 1.1.13

package/dist/chunk-326G7DJK.js

@@ -0,0 +1,2185 @@
+import {
+  buildTokenEntry,
+  commitTokenEntry,
+  generateToken,
+  loadTokenStore,
+  revokeToken,
+  saveTokenStore
+} from "./chunk-MSWG7JI6.js";
+import {
+  coerceInstallExtension
+} from "./chunk-PHK3HARR.js";
+import {
+  launchProcessSync
+} from "./chunk-NNVTUXEB.js";
+import {
+  expandTildePath
+} from "./chunk-QRNI5JBH.js";
+import {
+  mergeEnv,
+  readEnvVar,
+  resolveHomeDir
+} from "./chunk-XIG5PDM7.js";
+import {
+  log
+} from "./chunk-2ODBA7MQ.js";
+
+// src/connectors/index.ts
+import fs2 from "fs";
+import path2 from "path";
+import os from "os";
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+
+// src/connectors/codex-marketplace.ts
+import fs from "fs";
+import path from "path";
+var MARKETPLACE_SCHEMA_VERSION = 1;
+var MARKETPLACE_MANIFEST_FILENAME = "marketplace.json";
+var VALID_INSTALL_TYPES = /* @__PURE__ */ new Set(["github", "git", "local", "url"]);
+function generateMarketplaceManifest(options) {
+  const version = options?.packageVersion ?? readPackageVersion() ?? "0.0.0";
+  return {
+    version: MARKETPLACE_SCHEMA_VERSION,
+    name: "remnic",
+    description: "Remnic: Local-first AI memory with semantic search and consolidation",
+    plugins: [
+      {
+        name: "remnic",
+        version,
+        description: "Persistent memory plugin for Codex CLI",
+        repository: "joshuaswarren/remnic",
+        installType: "github",
+        entry: "packages/plugin-codex",
+        configSchema: "openclaw.plugin.json"
+      }
+    ]
+  };
+}
+function validateMarketplaceManifest(manifest) {
+  const validation = checkMarketplaceManifest(manifest);
+  if (!validation.valid) {
+    throw new Error(
+      `Invalid marketplace manifest: ${validation.errors.join("; ")}`
+    );
+  }
+  return manifest;
+}
+function checkMarketplaceManifest(manifest) {
+  const errors = [];
+  if (typeof manifest !== "object" || manifest === null) {
+    return { valid: false, errors: ["manifest must be a non-null object"] };
+  }
+  const obj = manifest;
+  if (obj.version !== MARKETPLACE_SCHEMA_VERSION) {
+    errors.push(`version must be ${MARKETPLACE_SCHEMA_VERSION}, got ${JSON.stringify(obj.version)}`);
+  }
+  if (typeof obj.name !== "string" || obj.name.trim().length === 0) {
+    errors.push("name must be a non-empty string");
+  }
+  if (typeof obj.description !== "string" || obj.description.trim().length === 0) {
+    errors.push("description must be a non-empty string");
+  }
+  if (!Array.isArray(obj.plugins)) {
+    errors.push("plugins must be an array");
+  } else if (obj.plugins.length === 0) {
+    errors.push("plugins must contain at least one entry");
+  } else {
+    for (let i = 0; i < obj.plugins.length; i++) {
+      const plugin = obj.plugins[i];
+      const prefix = `plugins[${i}]`;
+      if (typeof plugin !== "object" || plugin === null) {
+        errors.push(`${prefix} must be a non-null object`);
+        continue;
+      }
+      if (typeof plugin.name !== "string" || plugin.name.trim().length === 0) {
+        errors.push(`${prefix}.name must be a non-empty string`);
+      }
+      if (typeof plugin.version !== "string" || plugin.version.trim().length === 0) {
+        errors.push(`${prefix}.version must be a non-empty string`);
+      }
+      if (typeof plugin.description !== "string" || plugin.description.trim().length === 0) {
+        errors.push(`${prefix}.description must be a non-empty string`);
+      }
+      if (typeof plugin.repository !== "string" || plugin.repository.trim().length === 0) {
+        errors.push(`${prefix}.repository must be a non-empty string`);
+      }
+      if (typeof plugin.installType !== "string" || !VALID_INSTALL_TYPES.has(plugin.installType)) {
+        errors.push(
+          `${prefix}.installType must be one of: ${[...VALID_INSTALL_TYPES].join(", ")}; got ${JSON.stringify(plugin.installType)}`
+        );
+      }
+      if ("manifestUrl" in plugin && plugin.manifestUrl !== void 0) {
+        if (typeof plugin.manifestUrl !== "string" || plugin.manifestUrl.trim().length === 0) {
+          errors.push(`${prefix}.manifestUrl must be a non-empty string when provided`);
+        }
+      }
+      if ("entry" in plugin && plugin.entry !== void 0) {
+        if (typeof plugin.entry !== "string" || plugin.entry.trim().length === 0) {
+          errors.push(`${prefix}.entry must be a non-empty string when provided`);
+        }
+      }
+      if ("configSchema" in plugin && plugin.configSchema !== void 0) {
+        if (typeof plugin.configSchema !== "string" || plugin.configSchema.trim().length === 0) {
+          errors.push(`${prefix}.configSchema must be a non-empty string when provided`);
+        }
+      }
+    }
+  }
+  return { valid: errors.length === 0, errors };
+}
+async function writeMarketplaceManifest(outputDir, manifest) {
+  const validation = checkMarketplaceManifest(manifest);
+  if (!validation.valid) {
+    throw new Error(
+      `Refusing to write invalid manifest: ${validation.errors.join("; ")}`
+    );
+  }
+  fs.mkdirSync(outputDir, { recursive: true });
+  const destPath = path.join(outputDir, MARKETPLACE_MANIFEST_FILENAME);
+  const tmpPath = `${destPath}.tmp.${process.pid}`;
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  fs.writeFileSync(tmpPath, content);
+  fs.renameSync(tmpPath, destPath);
+}
+async function installFromMarketplace(source, sourceType, config, logger) {
+  const _log = logger ?? {
+    info: (msg) => log.info(`[marketplace] ${msg}`),
+    warn: (msg) => log.warn(`[marketplace] ${msg}`),
+    debug: (msg) => log.debug(`[marketplace] ${msg}`)
+  };
+  if (!config.codexMarketplaceEnabled) {
+    return {
+      ok: false,
+      message: "Codex marketplace is disabled in config (codexMarketplaceEnabled: false)",
+      source,
+      sourceType,
+      pluginsFound: [],
+      errors: ["marketplace_disabled"]
+    };
+  }
+  try {
+    const manifest = await resolveManifest(source, sourceType, _log);
+    const pluginNames = manifest.plugins.map((p) => p.name);
+    _log.info(`marketplace install: found ${pluginNames.length} plugin(s) from ${sourceType}://${source}`);
+    return {
+      ok: true,
+      message: `Successfully resolved ${pluginNames.length} plugin(s) from marketplace: ${pluginNames.join(", ")}`,
+      source,
+      sourceType,
+      pluginsFound: pluginNames,
+      errors: []
+    };
+  } catch (err) {
+    const errMsg = err instanceof Error ? err.message : String(err);
+    _log.warn(`marketplace install failed: ${errMsg}`);
+    return {
+      ok: false,
+      message: `Failed to install from marketplace: ${errMsg}`,
+      source,
+      sourceType,
+      pluginsFound: [],
+      errors: [errMsg]
+    };
+  }
+}
+async function resolveManifest(source, sourceType, logger) {
+  switch (sourceType) {
+    case "local":
+      return resolveLocal(source, logger);
+    case "url":
+      return resolveUrl(source, logger);
+    case "github":
+      return resolveGithub(source, logger);
+    case "git":
+      return resolveGit(source, logger);
+    default: {
+      const _ = sourceType;
+      throw new Error(`Invalid source type: ${String(_)}`);
+    }
+  }
+}
+function resolveLocal(dirPath, logger) {
+  const manifestPath = path.join(dirPath, MARKETPLACE_MANIFEST_FILENAME);
+  if (!fs.existsSync(manifestPath)) {
+    throw new Error(`marketplace.json not found at ${manifestPath}`);
+  }
+  logger.debug?.(`reading local marketplace manifest: ${manifestPath}`);
+  const raw = fs.readFileSync(manifestPath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Invalid JSON in ${manifestPath}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`marketplace.json at ${manifestPath} is not a valid object`);
+  }
+  return validateMarketplaceManifest(parsed);
+}
+async function resolveUrl(url, logger) {
+  logger.debug?.(`fetching marketplace manifest from URL: ${url}`);
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(url);
+  } catch {
+    throw new Error(`Invalid URL: ${url}`);
+  }
+  if (parsedUrl.protocol !== "https:" && parsedUrl.protocol !== "http:") {
+    throw new Error(`Unsupported URL protocol: ${parsedUrl.protocol} (use https or http)`);
+  }
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status} fetching ${url}`);
+  }
+  const body = await response.json();
+  return validateMarketplaceManifest(body);
+}
+async function resolveGithub(repo, logger) {
+  if (!/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/u.test(repo)) {
+    throw new Error(`Invalid GitHub repo format: "${repo}" (expected owner/repo)`);
+  }
+  const rawUrl = `https://raw.githubusercontent.com/${repo}/HEAD/${MARKETPLACE_MANIFEST_FILENAME}`;
+  logger.debug?.(`fetching marketplace manifest from GitHub: ${rawUrl}`);
+  return resolveUrl(rawUrl, logger);
+}
+async function resolveGit(gitUrl, logger) {
+  const ghMatch = gitUrl.match(
+    /^(?:https?:\/\/)?github\.com\/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+?)(?:\.git)?$/u
+  );
+  if (ghMatch?.[1]) {
+    logger.debug?.(`git URL looks like GitHub \u2014 delegating to github resolver`);
+    return resolveGithub(ghMatch[1], logger);
+  }
+  throw new Error(
+    `Git URL resolution requires a GitHub-format URL for now. Got: ${gitUrl}. Use --type github or --type url instead.`
+  );
+}
+function readPackageVersion() {
+  const candidates = [
+    path.resolve(import.meta.dirname ?? ".", "../../../.."),
+    path.resolve(import.meta.dirname ?? ".", "../../../../.."),
+    path.resolve(import.meta.dirname ?? ".", "..")
+  ];
+  for (const candidate of candidates) {
+    const pkgPath = path.join(candidate, "package.json");
+    try {
+      if (!fs.existsSync(pkgPath)) continue;
+      const raw = fs.readFileSync(pkgPath, "utf-8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed === "object" && parsed !== null && typeof parsed.version === "string") {
+        return parsed.version;
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+
+// src/connectors/index.ts
+var BUILTIN_CONNECTORS = [
+  {
+    id: "claude-code",
+    name: "Claude Code",
+    version: "1.0.0",
+    description: "Anthropic's Claude Code CLI \u2014 direct memory access via MCP",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: true,
+      entities: true,
+      realtimeSync: true,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server",
+      namespace: "Optional namespace (default: 'default')"
+    },
+    homepage: "https://claude.ai/code",
+    author: "Anthropic",
+    tags: ["official", "ai", "claude"],
+    requiresToken: true
+  },
+  {
+    id: "codex-cli",
+    name: "Codex CLI",
+    version: "1.0.0",
+    description: "OpenAI Codex CLI \u2014 memory via MCP tool",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: false,
+      entities: false,
+      realtimeSync: false,
+      batch: true,
+      maxBudgetChars: 8e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server",
+      namespace: "Optional namespace"
+    },
+    homepage: "https://openai.com/codex",
+    author: "OpenAI",
+    tags: ["official", "ai", "codex"],
+    requiresToken: true
+  },
+  {
+    id: "cursor",
+    name: "Cursor IDE",
+    version: "1.0.0",
+    description: "Cursor IDE \u2014 memory via config file + tool calls",
+    capabilities: {
+      observe: false,
+      recall: true,
+      store: false,
+      search: true,
+      entities: false,
+      realtimeSync: false,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "embedded"
+    },
+    configSchema: {
+      memoryDir: "Path to Remnic memory directory"
+    },
+    homepage: "https://cursor.com",
+    author: "Cursor Inc.",
+    tags: ["official", "ide"]
+  },
+  {
+    id: "cline",
+    name: "Cline",
+    version: "1.0.0",
+    description: "VS Code Cline extension \u2014 memory via MCP",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: false,
+      entities: false,
+      realtimeSync: false,
+      batch: true,
+      maxBudgetChars: 8e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server",
+      namespace: "Optional namespace"
+    },
+    homepage: "https://github.com/cline/cline",
+    author: "Cline",
+    tags: ["community", "vscode"]
+  },
+  {
+    id: "github-copilot",
+    name: "GitHub Copilot",
+    version: "1.0.0",
+    description: "GitHub Copilot \u2014 memory via MCP server",
+    capabilities: {
+      observe: false,
+      recall: true,
+      store: false,
+      search: true,
+      entities: false,
+      realtimeSync: false,
+      batch: false,
+      maxBudgetChars: 16e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server"
+    },
+    homepage: "https://github.com/features/copilot",
+    author: "GitHub",
+    tags: ["official", "ai", "github"]
+  },
+  {
+    id: "roo-code",
+    name: "Roo Code",
+    version: "1.0.0",
+    description: "Roo Code \u2014 memory via MCP",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: false,
+      entities: false,
+      realtimeSync: false,
+      batch: true,
+      maxBudgetChars: 16e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server",
+      namespace: "Optional namespace"
+    },
+    homepage: "https://roocode.com",
+    author: "Roo Code",
+    tags: ["community", "vscode"]
+  },
+  {
+    id: "windsurf",
+    name: "Windsurf",
+    version: "1.0.0",
+    description: "Windsurf IDE \u2014 memory via MCP",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: true,
+      entities: false,
+      realtimeSync: false,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server"
+    },
+    homepage: "https://windsurf.com",
+    author: "Codeium",
+    tags: ["official", "ide"]
+  },
+  {
+    id: "amp",
+    name: "Amp",
+    version: "1.0.0",
+    description: "Amp coding agent \u2014 memory via MCP",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: true,
+      entities: false,
+      realtimeSync: false,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server"
+    },
+    homepage: "https://ampcode.com",
+    author: "Sourcegraph",
+    tags: ["official", "ai"]
+  },
+  {
+    id: "pi",
+    name: "Pi Coding Agent",
+    version: "1.0.0",
+    description: "Pi Coding Agent \u2014 native extension for recall, observe, MCP tools, and compaction coordination",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: true,
+      entities: true,
+      realtimeSync: true,
+      batch: true,
+      maxBudgetChars: 32e3,
+      connectionType: "http"
+    },
+    configSchema: {
+      remnicDaemonUrl: "URL of the Remnic daemon (default: http://127.0.0.1:4318)",
+      namespace: "Optional namespace",
+      installExtension: "Install the Pi extension into ~/.pi/agent/extensions/remnic (default: true)"
+    },
+    homepage: "https://pi.dev",
+    author: "Remnic",
+    tags: ["official", "ai", "pi", "coding-agent"],
+    requiresToken: true
+  },
+  {
+    id: "replit",
+    name: "Replit Agent",
+    version: "1.0.0",
+    description: "Replit Agent \u2014 memory via HTTP API (reduced capabilities)",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: false,
+      entities: false,
+      realtimeSync: false,
+      batch: false,
+      maxBudgetChars: 8e3,
+      connectionType: "http"
+    },
+    configSchema: {
+      apiUrl: "URL of the Remnic HTTP API",
+      authToken: "Bearer token for authentication"
+    },
+    homepage: "https://replit.com",
+    author: "Replit",
+    tags: ["official", "cloud"],
+    requiresToken: true
+  },
+  {
+    id: "generic-mcp",
+    name: "Generic MCP Client",
+    version: "1.0.0",
+    description: "Any MCP-compatible client \u2014 connect via standard MCP protocol",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: true,
+      entities: true,
+      realtimeSync: true,
+      batch: true,
+      maxBudgetChars: 64e3,
+      connectionType: "mcp"
+    },
+    configSchema: {
+      mcpServerUrl: "URL of the MCP Remnic server",
+      namespace: "Optional namespace",
+      authToken: "Bearer token for authentication"
+    },
+    homepage: "https://github.com/joshuaswarren/remnic",
+    author: "Remnic",
+    tags: ["generic", "mcp"],
+    requiresToken: true
+  },
+  {
+    id: "weclone",
+    name: "WeClone Avatar",
+    version: "1.0.0",
+    description: "Memory-aware OpenAI-compatible proxy for deployed WeClone avatars \u2014 injects Remnic recall into chat completions and buffers turns via observe",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: false,
+      search: false,
+      entities: false,
+      realtimeSync: false,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "http"
+    },
+    configSchema: {
+      wecloneApiUrl: "Base URL of the WeClone OpenAI-compatible API (e.g. http://localhost:8000/v1)",
+      proxyPort: "Local port where the memory proxy will listen (default 8100)",
+      remnicDaemonUrl: "URL of the Remnic daemon exposing /engram/v1/recall and /engram/v1/observe",
+      sessionStrategy: "Per-caller session mapping strategy: 'caller-id' | 'single'",
+      wecloneModelName: "Optional fine-tuned model name passed through to WeClone"
+    },
+    homepage: "https://github.com/xming521/weclone",
+    author: "Remnic",
+    tags: ["official", "ai", "weclone", "proxy"],
+    requiresToken: true
+  },
+  {
+    id: "hermes",
+    name: "Hermes Agent",
+    version: "1.0.0",
+    description: "Hermes Agent MemoryProvider \u2014 automatic recall/observe on every turn via Python plugin protocol",
+    capabilities: {
+      observe: true,
+      recall: true,
+      store: true,
+      search: true,
+      entities: false,
+      realtimeSync: true,
+      batch: false,
+      maxBudgetChars: 32e3,
+      connectionType: "http"
+    },
+    configSchema: {
+      host: "Remnic daemon host (default: 127.0.0.1)",
+      port: "Remnic daemon port (default: 4318)",
+      profile: "Hermes profile name (default: default)"
+    },
+    homepage: "https://github.com/joshuaswarren/remnic/tree/main/packages/plugin-hermes",
+    author: "Remnic",
+    tags: ["official", "python", "hermes"],
+    requiresToken: true
+  }
+];
+var REGISTRY_DIR_NAME = ".engram-connectors";
+function getRegistryPath() {
+  const xdgConfigHome = readEnvVar("XDG_CONFIG_HOME");
+  const configDir = xdgConfigHome ? path2.join(xdgConfigHome, "engram") : path2.join(resolveHomeDir(), ".config", "engram");
+  return path2.join(configDir, REGISTRY_DIR_NAME, "registry.json");
+}
+function loadRegistry() {
+  const regPath = getRegistryPath();
+  if (!fs2.existsSync(regPath)) {
+    const registry = {
+      connectors: BUILTIN_CONNECTORS,
+      registryPath: regPath
+    };
+    saveRegistry(registry);
+    return registry;
+  }
+  const raw = fs2.readFileSync(regPath, "utf8");
+  try {
+    const parsed = JSON.parse(raw);
+    const builtinIds = new Set(BUILTIN_CONNECTORS.map((b) => b.id));
+    const customOnly = (parsed.connectors ?? []).filter((c) => !builtinIds.has(c.id));
+    const merged = [...BUILTIN_CONNECTORS, ...customOnly];
+    return {
+      connectors: merged,
+      registryPath: regPath
+    };
+  } catch {
+    const registry = {
+      connectors: BUILTIN_CONNECTORS,
+      registryPath: regPath
+    };
+    saveRegistry(registry);
+    return registry;
+  }
+}
+function saveRegistry(registry) {
+  const regPath = registry.registryPath;
+  fs2.mkdirSync(path2.dirname(regPath), { recursive: true });
+  fs2.writeFileSync(regPath, JSON.stringify({ connectors: registry.connectors }, null, 2));
+}
+function listConnectors() {
+  const registry = loadRegistry();
+  const connectorsDir = getConnectorsDir();
+  const installedIds = /* @__PURE__ */ new Set();
+  if (fs2.existsSync(connectorsDir)) {
+    for (const entry of fs2.readdirSync(connectorsDir)) {
+      if (entry.endsWith(".json")) {
+        try {
+          const config = JSON.parse(
+            fs2.readFileSync(path2.join(connectorsDir, entry), "utf8")
+          );
+          installedIds.add(config.connectorId);
+        } catch {
+        }
+      }
+    }
+  }
+  const available = registry.connectors.map((manifest) => ({
+    ...manifest,
+    installed: installedIds.has(manifest.id)
+  }));
+  const installed = [];
+  for (const id of installedIds) {
+    const configPath = path2.join(connectorsDir, `${id}.json`);
+    try {
+      const raw = JSON.parse(fs2.readFileSync(configPath, "utf8"));
+      const { token: _redacted, ...config } = raw;
+      installed.push({
+        connectorId: id,
+        config,
+        status: "installed",
+        installedAt: raw.installedAt
+      });
+    } catch {
+    }
+  }
+  return { installed, available };
+}
+function getConnectorToken(connectorId) {
+  try {
+    return loadTokenStore().tokens.find((t) => t.connector === connectorId)?.token;
+  } catch {
+    return void 0;
+  }
+}
+function readSavedConnectorConfig(configPath) {
+  if (!fs2.existsSync(configPath)) return {};
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(configPath, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const {
+      connectorId: _connectorId,
+      installedAt: _installedAt,
+      token: _token,
+      ...config
+    } = parsed;
+    return config;
+  } catch {
+    return {};
+  }
+}
+function removeClearedSavedConnectorConfig(savedConnectorConfig, rawUserConfig) {
+  const merged = { ...savedConnectorConfig };
+  for (const [key, value] of Object.entries(rawUserConfig)) {
+    if (value === void 0 || value === null || value === "") {
+      delete merged[key];
+    }
+  }
+  return merged;
+}
+function compactConnectorConfigOverrides(rawUserConfig) {
+  const safeUserConfig = {};
+  for (const [key, value] of Object.entries(rawUserConfig)) {
+    if (value === void 0 || value === null || value === "") continue;
+    safeUserConfig[key] = value;
+  }
+  return safeUserConfig;
+}
+function installConnector(options) {
+  const registry = loadRegistry();
+  const manifest = registry.connectors.find((c) => c.id === options.connectorId);
+  if (!manifest) {
+    return {
+      connectorId: options.connectorId,
+      status: "error",
+      message: `Unknown connector: ${options.connectorId}`
+    };
+  }
+  const existing = listConnectors().installed.find(
+    (c) => c.connectorId === options.connectorId
+  );
+  if (existing && !options.force) {
+    return {
+      connectorId: options.connectorId,
+      status: "already_installed",
+      message: "Already installed. Use --force to reinstall."
+    };
+  }
+  const configDir = getConnectorsDir();
+  fs2.mkdirSync(configDir, { recursive: true });
+  const configPath = path2.join(configDir, `${options.connectorId}.json`);
+  const savedConnectorConfig = existing ? readSavedConnectorConfig(configPath) : {};
+  let hermesSavedProfile;
+  let hermesSavedHost;
+  let hermesSavedPort;
+  let hermesResolvedProfile;
+  let hermesResolvedHost;
+  let hermesResolvedPort;
+  if (options.connectorId === "hermes") {
+    if (fs2.existsSync(configPath)) {
+      try {
+        const prev = JSON.parse(fs2.readFileSync(configPath, "utf8"));
+        if (prev?.profile != null) {
+          try {
+            hermesSavedProfile = sanitizeHermesProfile(String(prev.profile));
+          } catch {
+          }
+        }
+        if (prev?.host != null) {
+          try {
+            hermesSavedHost = sanitizeHermesHost(String(prev.host));
+          } catch {
+          }
+        }
+        if (prev?.port != null) {
+          try {
+            const coercedPort = Number(String(prev.port));
+            hermesSavedPort = sanitizeHermesPort(coercedPort);
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+    hermesResolvedProfile = hermesSavedProfile ?? "default";
+    hermesResolvedHost = hermesSavedHost ?? "127.0.0.1";
+    if (options.config?.port !== void 0) {
+      try {
+        hermesResolvedPort = sanitizeHermesPort(Number(String(options.config.port)));
+      } catch (err) {
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (hermesResolvedPort === void 0) {
+      hermesResolvedPort = hermesSavedPort ?? 4318;
+    }
+    if (options.config?.profile !== void 0) {
+      try {
+        hermesResolvedProfile = sanitizeHermesProfile(String(options.config.profile));
+      } catch (err) {
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (options.config?.host !== void 0) {
+      try {
+        hermesResolvedHost = sanitizeHermesHost(String(options.config.host));
+      } catch (err) {
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+  }
+  const nonHermesPriorTokenStore = options.connectorId !== "hermes" && manifest.requiresToken ? loadTokenStore() : null;
+  let tokenEntry = null;
+  if (options.connectorId === "hermes") {
+    try {
+      tokenEntry = buildTokenEntry(options.connectorId);
+    } catch {
+    }
+  } else if (manifest.requiresToken) {
+    try {
+      tokenEntry = generateToken(options.connectorId);
+    } catch {
+      if (nonHermesPriorTokenStore !== null) {
+        try {
+          saveTokenStore(nonHermesPriorTokenStore);
+        } catch {
+        }
+      }
+    }
+  }
+  if (options.connectorId !== "hermes" && manifest.requiresToken && tokenEntry === null) {
+    return {
+      connectorId: options.connectorId,
+      status: "error",
+      message: `${manifest.name} install aborted: token generation failed. Run \`remnic token generate ${options.connectorId}\` to create the token, then reinstall.`
+    };
+  }
+  const { token: _callerToken, ...rawUserConfig } = options.config ?? {};
+  const savedConnectorConfigForMerge = removeClearedSavedConnectorConfig(savedConnectorConfig, rawUserConfig);
+  const safeUserConfig = compactConnectorConfigOverrides(rawUserConfig);
+  const resolvedConfig = {
+    ...savedConnectorConfigForMerge,
+    ...safeUserConfig,
+    connectorId: options.connectorId,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    // For hermes, always overlay the sanitized/coerced resolved values so that
+    // the connector JSON always has a numeric port and validated profile/host.
+    // This also ensures options.config string values (from --config=port=5555)
+    // are replaced with their sanitized numeric equivalents (Fix 2 root cause).
+    ...hermesResolvedProfile !== void 0 ? {
+      profile: hermesResolvedProfile,
+      host: hermesResolvedHost,
+      port: hermesResolvedPort
+    } : {}
+  };
+  if (options.connectorId === "hermes") {
+    const rawProfile = hermesResolvedProfile;
+    const hermesHost = hermesResolvedHost;
+    const hermesPort = hermesResolvedPort;
+    let hermesProfile;
+    try {
+      hermesProfile = sanitizeHermesProfile(rawProfile);
+    } catch (err) {
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `Hermes install aborted: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    if (!tokenEntry) {
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: "Hermes install aborted: token store unavailable. Run `remnic token generate hermes` then reinstall to complete setup."
+      };
+    }
+    let yamlResult;
+    try {
+      yamlResult = upsertHermesConfig({
+        profile: hermesProfile,
+        host: hermesHost,
+        port: hermesPort,
+        token: tokenEntry.token
+      });
+    } catch (err) {
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `Hermes install aborted: config.yaml write failed \u2014 ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    if (!yamlResult.updated) {
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `Hermes install aborted: ${yamlResult.reason ?? "config.yaml not written"}. Create the Hermes profile directory first, then reinstall.`
+      };
+    }
+    const priorTokenStore = loadTokenStore();
+    let committed = false;
+    try {
+      commitTokenEntry(tokenEntry);
+      committed = true;
+    } catch (commitErr) {
+      let tokensRolledBack = true;
+      let tokensRollbackErrMsg = "";
+      try {
+        saveTokenStore(priorTokenStore);
+      } catch (tokenRestoreErr) {
+        tokensRolledBack = false;
+        tokensRollbackErrMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
+      }
+      let yamlRolledBack = true;
+      let yamlRollbackErrMsg = "";
+      try {
+        if (yamlResult.priorContent === null) {
+          fs2.unlinkSync(yamlResult.configPath);
+        } else if (typeof yamlResult.priorContent === "string") {
+          writeSecretFileSync(yamlResult.configPath, yamlResult.priorContent);
+        }
+      } catch (yamlRestoreErr) {
+        yamlRolledBack = false;
+        yamlRollbackErrMsg = yamlRestoreErr instanceof Error ? yamlRestoreErr.message : String(yamlRestoreErr);
+      }
+      const commitErrMsg = commitErr instanceof Error ? commitErr.message : String(commitErr);
+      let message;
+      if (tokensRolledBack && yamlRolledBack) {
+        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. config.yaml and tokens.json restored to prior state. Resolve the tokens.json access issue, then reinstall.`;
+      } else if (!yamlRolledBack && tokensRolledBack) {
+        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. tokens.json restored but config.yaml rollback ALSO failed (${yamlRollbackErrMsg}). Hermes daemon may be in an inconsistent state: config references a stale token. Manually inspect ${yamlResult.configPath} and reinstall.`;
+      } else if (yamlRolledBack && !tokensRolledBack) {
+        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. config.yaml restored but tokens.json rollback ALSO failed (${tokensRollbackErrMsg}). Hermes daemon may be in an inconsistent state: tokens.json is corrupt or incomplete. Manually inspect ~/.remnic/tokens.json and reinstall.`;
+      } else {
+        message = `Hermes install failed during token commit \u2014 ${commitErrMsg}. BOTH rollbacks failed: config.yaml rollback failed (${yamlRollbackErrMsg}); tokens.json rollback failed (${tokensRollbackErrMsg}). Hermes daemon is likely in an inconsistent state. Manually inspect ${yamlResult.configPath} and ~/.remnic/tokens.json, then reinstall.`;
+      }
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message
+      };
+    }
+    try {
+      writeSecretFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));
+    } catch (writeErr) {
+      let tokenRollbackFailed = false;
+      let tokenRollbackMsg = "token store restored to pre-install snapshot";
+      try {
+        saveTokenStore(priorTokenStore);
+      } catch (tokenRestoreErr) {
+        tokenRollbackFailed = true;
+        tokenRollbackMsg = `token rollback failed: ${tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr)}`;
+      }
+      let yamlRollbackMsg = "config.yaml restored";
+      try {
+        if (yamlResult.priorContent === null) {
+          let unlinkSucceeded = false;
+          let unlinkErr;
+          try {
+            fs2.unlinkSync(yamlResult.configPath);
+            unlinkSucceeded = true;
+          } catch (err) {
+            unlinkErr = err;
+          }
+          if (unlinkSucceeded) {
+            yamlRollbackMsg = "config.yaml removed (was newly created)";
+          } else {
+            const unlinkMsg = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
+            yamlRollbackMsg = `config.yaml rollback failed: could not remove newly-created file \u2014 ${unlinkMsg}`;
+          }
+        } else if (typeof yamlResult.priorContent === "string") {
+          writeSecretFileSync(yamlResult.configPath, yamlResult.priorContent);
+          yamlRollbackMsg = "config.yaml restored to prior content";
+        }
+      } catch (yamlRollbackErr) {
+        yamlRollbackMsg = `config.yaml rollback failed: ${yamlRollbackErr instanceof Error ? yamlRollbackErr.message : String(yamlRollbackErr)}`;
+      }
+      const urgentSuffix = tokenRollbackFailed ? ` tokens.json may be in an inconsistent state \u2014 manually restore hermes token with 'remnic token generate hermes'.` : "";
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `Hermes install aborted: connector config write failed \u2014 connector directory may not be writable. Rollback: ${tokenRollbackMsg}; ${yamlRollbackMsg}.${urgentSuffix} Resolve the permission issue, then reinstall.`
+      };
+    }
+    const notes = [];
+    notes.push(`Updated Hermes config: ${yamlResult.configPath}`);
+    if (hermesProfile === "default") {
+      const legacyDefaultConfigPath = hermesDefaultProfileConfigPath();
+      if (!sameHermesConfigTarget(yamlResult.configPath, legacyDefaultConfigPath)) {
+        try {
+          const legacyDefaultCleanResult = removeHermesConfigFile(legacyDefaultConfigPath);
+          if (legacyDefaultCleanResult.updated) {
+            notes.push(`Cleaned stale remnic: block from legacy default profile: ${legacyDefaultConfigPath}`);
+          }
+        } catch {
+          notes.push("Note: could not clean stale remnic: block from legacy default profile");
+        }
+      }
+    }
+    let oldProfileResolvesToDifferentFile = false;
+    if (hermesSavedProfile !== void 0) {
+      try {
+        oldProfileResolvesToDifferentFile = !sameHermesConfigTarget(hermesConfigPath(hermesSavedProfile), hermesConfigPath(hermesProfile));
+      } catch {
+        oldProfileResolvesToDifferentFile = false;
+      }
+    }
+    if (oldProfileResolvesToDifferentFile) {
+      try {
+        const oldCleanResult = removeHermesConfig({ profile: hermesSavedProfile });
+        if (oldCleanResult.updated) {
+          notes.push(`Cleaned stale remnic: block from previous profile: ${oldCleanResult.configPath}`);
+        }
+      } catch {
+        notes.push(`Note: could not clean stale remnic: block from previous profile "${hermesSavedProfile}"`);
+      }
+    }
+    if (committed && tokenEntry) {
+      const daemonOk = checkDaemonHealth(hermesHost, hermesPort, tokenEntry.token);
+      if (daemonOk) {
+        notes.push("Daemon health check: OK");
+      } else {
+        notes.push(
+          `Daemon not reachable at ${hermesHost}:${hermesPort} \u2014 start with: remnic daemon start`
+        );
+      }
+    }
+    const suffix = notes.length > 0 ? `
+  ${notes.join("\n  ")}` : "";
+    return {
+      connectorId: options.connectorId,
+      status: "installed",
+      configPath,
+      message: `Installed ${manifest.name} v${manifest.version}${suffix}`
+    };
+  }
+  let extensionMessage = "";
+  let extensionInstalled = false;
+  let extensionHandle = null;
+  if (options.connectorId === "codex-cli") {
+    const coerced = coerceInstallExtension(resolvedConfig.installExtension);
+    if (coerced !== void 0) {
+      resolvedConfig.installExtension = coerced;
+    }
+    const shouldInstall = resolvedConfig.installExtension !== false;
+    resolvedConfig.installExtension = shouldInstall;
+    const codexHomeOverride = typeof resolvedConfig.codexHome === "string" && resolvedConfig.codexHome.length > 0 ? resolvedConfig.codexHome : null;
+    const resolvedCodexHome = resolveCodexHome(codexHomeOverride);
+    resolvedConfig.codexHome = resolvedCodexHome;
+    if (shouldInstall) {
+      try {
+        const extensionSourceOverride = typeof resolvedConfig.extensionSourceDir === "string" && resolvedConfig.extensionSourceDir.length > 0 ? resolvedConfig.extensionSourceDir : null;
+        const extResult = installCodexMemoryExtension({
+          codexHome: resolvedCodexHome,
+          sourceDir: extensionSourceOverride
+        });
+        extensionMessage = ` (memory extension: ${extResult.remnicExtensionDir})`;
+        extensionInstalled = true;
+        extensionHandle = extResult;
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : "unknown error";
+        let extensionErrTokenRolledBack = false;
+        let extensionErrTokenRollbackMsg = "";
+        if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
+          try {
+            saveTokenStore(nonHermesPriorTokenStore);
+            extensionErrTokenRolledBack = true;
+          } catch (tokenRestoreErr) {
+            extensionErrTokenRolledBack = false;
+            extensionErrTokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
+          }
+        }
+        const tokenRollbackSuffix = manifest.requiresToken ? extensionErrTokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${extensionErrTokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
+        return {
+          connectorId: options.connectorId,
+          status: "error",
+          message: `Memory extension install failed \u2014 ${errMsg}.${tokenRollbackSuffix} Resolve the issue, then reinstall.`
+        };
+      }
+    } else {
+      extensionMessage = " (memory extension: skipped via installExtension=false)";
+    }
+  }
+  let weCloneProxyHandleRollback = null;
+  if (options.connectorId === "weclone") {
+    try {
+      let proxyConfigPath = null;
+      if (existing && fs2.existsSync(configPath)) {
+        try {
+          const savedRegistryConfig = JSON.parse(fs2.readFileSync(configPath, "utf8"));
+          if (typeof savedRegistryConfig.proxyConfigPath === "string" && savedRegistryConfig.proxyConfigPath.length > 0) {
+            proxyConfigPath = savedRegistryConfig.proxyConfigPath;
+          }
+        } catch {
+        }
+      }
+      if (proxyConfigPath === null) {
+        proxyConfigPath = resolveWeCloneProxyConfigPath();
+      }
+      const prior = readWeCloneProxyConfigIfExists(proxyConfigPath);
+      const proxyConfig = buildWeCloneProxyConfig({
+        userConfig: safeUserConfig,
+        priorConfig: prior ? safeParseJson(prior) : null,
+        authToken: tokenEntry?.token
+      });
+      fs2.mkdirSync(path2.dirname(proxyConfigPath), { recursive: true });
+      weCloneProxyHandleRollback = () => {
+        try {
+          if (prior === null) {
+            if (fs2.existsSync(proxyConfigPath)) {
+              fs2.unlinkSync(proxyConfigPath);
+            }
+          } else {
+            writeSecretFileSync(proxyConfigPath, prior);
+          }
+        } catch {
+        }
+      };
+      try {
+        writeSecretFileSync(
+          proxyConfigPath,
+          JSON.stringify(proxyConfig, null, 2)
+        );
+      } catch (writeErr) {
+        try {
+          weCloneProxyHandleRollback();
+        } catch {
+        }
+        weCloneProxyHandleRollback = null;
+        throw writeErr;
+      }
+      resolvedConfig.proxyConfigPath = proxyConfigPath;
+      resolvedConfig.proxyPort = proxyConfig.proxyPort;
+      resolvedConfig.wecloneApiUrl = proxyConfig.wecloneApiUrl;
+      resolvedConfig.remnicDaemonUrl = proxyConfig.remnicDaemonUrl;
+      resolvedConfig.sessionStrategy = proxyConfig.sessionStrategy;
+    } catch (weCloneErr) {
+      let tokenRolledBack = false;
+      let tokenRollbackMsg = "";
+      if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
+        try {
+          saveTokenStore(nonHermesPriorTokenStore);
+          tokenRolledBack = true;
+        } catch (tokenRestoreErr) {
+          tokenRolledBack = false;
+          tokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
+        }
+      }
+      const tokenSuffix = manifest.requiresToken && tokenEntry !== null ? tokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${tokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
+      return {
+        connectorId: options.connectorId,
+        status: "error",
+        message: `WeClone install aborted: proxy config write failed \u2014 ${weCloneErr instanceof Error ? weCloneErr.message : String(weCloneErr)}.${tokenSuffix} Resolve the write permission issue on ~/.remnic/connectors/, then reinstall.`
+      };
+    }
+  }
+  const INTERNAL_KEYS_DENYLIST = [
+    "extensionSourceDir"
+    // test-only override for the plugin-codex source path
+  ];
+  for (const key of INTERNAL_KEYS_DENYLIST) {
+    delete resolvedConfig[key];
+  }
+  try {
+    writeSecretFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));
+  } catch (writeErr) {
+    let configWriteTokenRolledBack = false;
+    let configWriteTokenRollbackMsg = "";
+    if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {
+      try {
+        saveTokenStore(nonHermesPriorTokenStore);
+        configWriteTokenRolledBack = true;
+      } catch (tokenRestoreErr) {
+        configWriteTokenRolledBack = false;
+        configWriteTokenRollbackMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);
+      }
+    }
+    if (extensionInstalled && extensionHandle !== null) {
+      try {
+        extensionHandle.rollback();
+      } catch {
+        console.warn(
+          "[remnic/connectors] installConnector: config write failed and extension rollback also failed \u2014 manual cleanup of memories_extensions/remnic may be required."
+        );
+      }
+    }
+    if (weCloneProxyHandleRollback !== null) {
+      try {
+        weCloneProxyHandleRollback();
+      } catch {
+      }
+    }
+    const configWriteTokenSuffix = manifest.requiresToken && tokenEntry !== null ? configWriteTokenRolledBack ? " Token has been rolled back." : ` Token rollback FAILED (${configWriteTokenRollbackMsg}) \u2014 tokens.json may contain an orphaned entry. Manually inspect ~/.remnic/tokens.json and reinstall.` : "";
+    return {
+      connectorId: options.connectorId,
+      status: "error",
+      message: `${manifest.name} install aborted: connector config write failed \u2014 ${writeErr instanceof Error ? writeErr.message : String(writeErr)}.${configWriteTokenSuffix} Resolve the write permission issue, then reinstall.`
+    };
+  }
+  if (extensionInstalled && extensionHandle !== null) {
+    extensionHandle.commit();
+  }
+  return {
+    connectorId: options.connectorId,
+    status: "installed",
+    configPath,
+    message: `Installed ${manifest.name} v${manifest.version}${extensionMessage}`
+  };
+}
+function removeConnector(connectorId) {
+  const configDir = getConnectorsDir();
+  const configPath = path2.join(configDir, `${connectorId}.json`);
+  let codexHomeOverride = null;
+  let savedInstallExtension = void 0;
+  let configParsed = false;
+  if (connectorId === "codex-cli" && fs2.existsSync(configPath)) {
+    try {
+      const parsed = JSON.parse(fs2.readFileSync(configPath, "utf8"));
+      configParsed = true;
+      if (typeof parsed.codexHome === "string" && parsed.codexHome.length > 0) {
+        codexHomeOverride = parsed.codexHome;
+      }
+      const coerced = coerceInstallExtension(parsed.installExtension);
+      if (coerced !== void 0) {
+        savedInstallExtension = coerced;
+      }
+    } catch {
+      console.debug(
+        "[remnic/connectors] removeConnector: codex-cli.json parse failed \u2014 skipping extension removal to avoid touching unverified paths"
+      );
+    }
+  }
+  if (!fs2.existsSync(configPath)) {
+    let staleTokenRevoked = false;
+    try {
+      staleTokenRevoked = revokeToken(connectorId);
+    } catch {
+    }
+    const message = staleTokenRevoked ? `${connectorId} is not installed. Removed stale token entry for ${connectorId}.` : "Not installed";
+    return {
+      connectorId,
+      configPath,
+      status: "not_found",
+      message
+    };
+  }
+  let storedProfile = "default";
+  if (connectorId === "hermes") {
+    try {
+      const stored = JSON.parse(fs2.readFileSync(configPath, "utf8"));
+      if (typeof stored?.profile === "string") storedProfile = stored.profile;
+    } catch {
+    }
+  }
+  let weCloneProxyConfigPath = null;
+  let weCloneRegistryParseFailed = false;
+  if (connectorId === "weclone") {
+    try {
+      const stored = JSON.parse(fs2.readFileSync(configPath, "utf8"));
+      if (typeof stored.proxyConfigPath === "string" && stored.proxyConfigPath.length > 0) {
+        weCloneProxyConfigPath = stored.proxyConfigPath;
+      }
+    } catch {
+      weCloneRegistryParseFailed = true;
+    }
+    if (weCloneProxyConfigPath === null && !weCloneRegistryParseFailed) {
+      try {
+        weCloneProxyConfigPath = resolveWeCloneProxyConfigPath();
+      } catch {
+      }
+    }
+  }
+  if (connectorId === "weclone" && weCloneRegistryParseFailed) {
+    console.warn(
+      "[remnic/connectors] removeConnector: weclone.json is malformed \u2014 aborting removal to preserve provenance. Fix or delete " + configPath + " manually and retry."
+    );
+    return {
+      connectorId,
+      configPath,
+      message: "Removal aborted: weclone.json is malformed. Registry config left in place for inspection; proxy config NOT removed.",
+      status: "skipped",
+      reason: "config-parse-failed"
+    };
+  }
+  if (connectorId === "codex-cli" && fs2.existsSync(configPath) && !configParsed) {
+    console.warn(
+      "[remnic/connectors] removeConnector: codex-cli.json is malformed \u2014 aborting removal to preserve provenance. Fix or delete " + configPath + " manually and retry."
+    );
+    return {
+      connectorId,
+      configPath,
+      message: "Removal aborted: codex-cli.json is malformed. Config file left in place for inspection.",
+      status: "skipped",
+      reason: "config-parse-failed"
+    };
+  }
+  let extensionMessage = "";
+  if (connectorId === "codex-cli") {
+    if (savedInstallExtension === false) {
+      extensionMessage = " (memory extension: skipped \u2014 installExtension=false)";
+    } else if (savedInstallExtension !== true || codexHomeOverride === null) {
+      extensionMessage = " (memory extension: skipped \u2014 no install provenance in saved config)";
+    } else {
+      const extResult = removeCodexMemoryExtension({ codexHome: codexHomeOverride });
+      extensionMessage = extResult.removed ? ` (memory extension removed: ${extResult.remnicExtensionDir})` : " (no memory extension present)";
+    }
+  }
+  try {
+    fs2.unlinkSync(configPath);
+  } catch (unlinkErr) {
+    const sanitizedErr = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
+    return {
+      connectorId,
+      configPath,
+      status: "error",
+      message: `${connectorId} remove aborted: could not delete connector file (${sanitizedErr}). Token and any connector-specific state were not modified.`
+    };
+  }
+  const notes = [];
+  let tokenRevoked = true;
+  try {
+    revokeToken(connectorId);
+  } catch (revokeErr) {
+    tokenRevoked = false;
+    const revokeMsg = revokeErr instanceof Error ? revokeErr.message : String(revokeErr);
+    notes.push(`Warning: token revocation failed \u2014 ${revokeMsg}. The token for ${connectorId} may still be present in tokens.json.`);
+  }
+  let weCloneProxyDeleteFailed = null;
+  if (connectorId === "weclone") {
+    if (weCloneProxyConfigPath === null) {
+      notes.push(
+        "WeClone proxy config cleanup skipped: no persisted path found in saved config (likely a legacy install predating proxyConfigPath provenance)."
+      );
+    } else {
+      const expectedSuffix = path2.join("connectors", "weclone.json");
+      const isSafePath = path2.isAbsolute(weCloneProxyConfigPath) && weCloneProxyConfigPath.endsWith(expectedSuffix);
+      if (!isSafePath) {
+        weCloneProxyDeleteFailed = `Proxy config path ${JSON.stringify(weCloneProxyConfigPath)} failed safety validation (must be absolute and end with "${expectedSuffix}"). Refusing to delete \u2014 remove the file manually if it exists.`;
+      } else {
+        try {
+          if (fs2.existsSync(weCloneProxyConfigPath)) {
+            fs2.unlinkSync(weCloneProxyConfigPath);
+            notes.push(`Removed WeClone proxy config: ${weCloneProxyConfigPath}`);
+          }
+        } catch (err) {
+          weCloneProxyDeleteFailed = err instanceof Error ? err.message : String(err);
+        }
+      }
+    }
+  }
+  if (weCloneProxyDeleteFailed !== null && weCloneProxyConfigPath !== null) {
+    const tokenStatus = tokenRevoked ? "the registry config was deleted and the token was revoked" : "the registry config was deleted but TOKEN REVOCATION ALSO FAILED \u2014 inspect ~/.remnic/tokens.json and revoke manually";
+    return {
+      connectorId,
+      configPath,
+      status: "error",
+      message: `WeClone remove partially succeeded: ${tokenStatus}, but the proxy config at ${weCloneProxyConfigPath} could not be deleted (${weCloneProxyDeleteFailed}). Manually remove that file \u2014 it may still contain a Remnic daemon bearer token.`
+    };
+  }
+  if (connectorId === "hermes") {
+    try {
+      const yamlResult = removeHermesConfig({ profile: storedProfile });
+      if (yamlResult.updated) {
+        notes.push(`Removed remnic: block from Hermes config: ${yamlResult.configPath}`);
+      } else if (yamlResult.reason?.startsWith("Hermes config cleanup partially failed:")) {
+        const tokenStatus = tokenRevoked ? "the connector registry config was deleted and the token was revoked" : "the connector registry config was deleted but TOKEN REVOCATION ALSO FAILED \u2014 inspect ~/.remnic/tokens.json and revoke manually";
+        return {
+          connectorId,
+          configPath,
+          status: "error",
+          message: `Hermes remove partially succeeded: ${tokenStatus}, but ${yamlResult.reason}. Updated paths: ${yamlResult.configPath}. Manually remove any stale remnic: block and token material from the failed Hermes config path.`
+        };
+      } else if (yamlResult.skipped) {
+        notes.push(`Hermes config cleanup skipped: ${yamlResult.reason}`);
+      }
+    } catch (err) {
+      notes.push(
+        `Hermes config cleanup skipped: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  const suffix = notes.length > 0 ? `
+  ${notes.join("\n  ")}` : "";
+  return {
+    connectorId,
+    configPath,
+    status: "removed",
+    message: `Removed${extensionMessage}${suffix}`
+  };
+}
+function sanitizeHermesProfile(profile) {
+  if (typeof profile !== "string" || profile.length === 0) {
+    throw new Error("Hermes profile name must be a non-empty string");
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(profile)) {
+    throw new Error(
+      `Invalid Hermes profile name: ${JSON.stringify(profile)} \u2014 must match [A-Za-z0-9][A-Za-z0-9._-]*`
+    );
+  }
+  if (profile.includes("..")) {
+    throw new Error(`Invalid Hermes profile name: ${JSON.stringify(profile)} \u2014 must not contain ".."`);
+  }
+  return profile;
+}
+function hermesConfigPath(profile) {
+  const safeProfile = sanitizeHermesProfile(profile);
+  const hermesRoot = path2.resolve(resolveHomeDir(), ".hermes");
+  const rootConfigPath = path2.join(hermesRoot, "config.yaml");
+  const profilesRoot = path2.join(hermesRoot, "profiles");
+  if (safeProfile === "default") {
+    const defaultProfileDir = path2.join(profilesRoot, safeProfile);
+    if (isFile(rootConfigPath) || !fs2.existsSync(rootConfigPath) && !isDirectory(defaultProfileDir)) {
+      return rootConfigPath;
+    }
+  }
+  const cfgPath = path2.resolve(profilesRoot, safeProfile, "config.yaml");
+  const rel = path2.relative(profilesRoot, cfgPath);
+  if (rel.startsWith("..") || path2.isAbsolute(rel)) {
+    throw new Error(
+      `Invalid Hermes profile path: resolved outside ${profilesRoot}`
+    );
+  }
+  return cfgPath;
+}
+function isDirectory(filePath) {
+  try {
+    return fs2.statSync(filePath).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isFile(filePath) {
+  try {
+    return fs2.statSync(filePath).isFile();
+  } catch {
+    return false;
+  }
+}
+function hermesConfigTarget(filePath) {
+  try {
+    return fs2.realpathSync.native(filePath);
+  } catch {
+    return path2.resolve(filePath);
+  }
+}
+function sameHermesConfigTarget(leftPath, rightPath) {
+  return hermesConfigTarget(leftPath) === hermesConfigTarget(rightPath);
+}
+function hermesDefaultProfileConfigPath() {
+  const hermesRoot = path2.resolve(resolveHomeDir(), ".hermes");
+  return path2.join(hermesRoot, "profiles", "default", "config.yaml");
+}
+function hermesConfigCleanupPaths(profile) {
+  const cfgPath = hermesConfigPath(profile);
+  const safeProfile = sanitizeHermesProfile(profile);
+  if (safeProfile !== "default") {
+    return [cfgPath];
+  }
+  return [.../* @__PURE__ */ new Set([cfgPath, hermesDefaultProfileConfigPath()])];
+}
+function sanitizeHermesHost(host) {
+  if (typeof host !== "string" || host.length === 0) {
+    throw new Error("Hermes host must be a non-empty string");
+  }
+  if (host.length > 253) {
+    throw new Error(`Hermes host too long (max 253 chars): ${JSON.stringify(host.slice(0, 32))}\u2026`);
+  }
+  if (host.startsWith("[")) {
+    if (!host.endsWith("]")) {
+      throw new Error(
+        `Invalid Hermes host: ${JSON.stringify(host)} \u2014 unbalanced brackets in IPv6 literal`
+      );
+    }
+    const inner = host.slice(1, -1);
+    if (inner.length === 0 || !/^[0-9A-Fa-f:]+$/.test(inner)) {
+      throw new Error(
+        `Invalid Hermes host: ${JSON.stringify(host)} \u2014 bracketed IPv6 literal must contain only hex digits and colons`
+      );
+    }
+    return host;
+  }
+  if (host.includes(":")) {
+    throw new Error(
+      `Invalid Hermes host: ${JSON.stringify(host)} \u2014 host must not include a port; supply the port separately with --config port=<n>`
+    );
+  }
+  if (!/^[A-Za-z0-9._\-]+$/.test(host)) {
+    throw new Error(
+      `Invalid Hermes host: ${JSON.stringify(host)} \u2014 must be a plain hostname or IP literal`
+    );
+  }
+  return host;
+}
+function sanitizeHermesPort(port) {
+  const numeric = Number(port);
+  if (!Number.isInteger(numeric)) {
+    throw new Error(
+      `Invalid Hermes port "${port}": must be a positive integer`
+    );
+  }
+  if (numeric < 1 || numeric > 65535) {
+    throw new Error(`Invalid Hermes port: ${JSON.stringify(port)} \u2014 must be an integer in [1, 65535]`);
+  }
+  return numeric;
+}
+function writeSecretFileSync(filePath, data) {
+  fs2.writeFileSync(filePath, data, { mode: 384 });
+  try {
+    fs2.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function upsertHermesConfig(opts) {
+  const cfgPath = hermesConfigPath(opts.profile);
+  const profileDir = path2.dirname(cfgPath);
+  const safeHost = sanitizeHermesHost(opts.host);
+  const safePort = sanitizeHermesPort(opts.port);
+  if (!/^[A-Za-z0-9_]+$/.test(opts.token)) {
+    throw new Error("Invalid Hermes token: contains non-alphanumeric characters");
+  }
+  if (!isDirectory(profileDir)) {
+    return {
+      updated: false,
+      skipped: true,
+      reason: `Hermes profile directory not found: ${profileDir}`,
+      configPath: cfgPath
+    };
+  }
+  const block = [
+    "remnic:",
+    `  host: "${safeHost}"`,
+    `  port: ${safePort}`,
+    `  token: "${opts.token}"`
+  ].join("\n");
+  if (!fs2.existsSync(cfgPath)) {
+    writeSecretFileSync(cfgPath, block + "\n");
+    return { updated: true, skipped: false, configPath: cfgPath, priorContent: null };
+  }
+  const raw = fs2.readFileSync(cfgPath, "utf8");
+  const hasRemnicBlock = /^remnic:/m.test(raw);
+  if (!hasRemnicBlock) {
+    const separator = raw.endsWith("\n") ? "\n" : "\n\n";
+    writeSecretFileSync(cfgPath, raw + separator + block + "\n");
+    return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };
+  }
+  const splitLines = raw.split("\n");
+  if (splitLines.length > 0 && splitLines[splitLines.length - 1] === "") {
+    splitLines.pop();
+  }
+  const lines = splitLines;
+  const newLines = [];
+  let inRemnicBlock = false;
+  let blockWritten = false;
+  const written = { host: false, port: false, token: false };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^remnic:/.test(line)) {
+      inRemnicBlock = true;
+      newLines.push(line);
+      continue;
+    }
+    if (inRemnicBlock) {
+      if (line.length > 0 && !/^\s/.test(line)) {
+        if (!written.host) newLines.push(`  host: "${safeHost}"`);
+        if (!written.port) newLines.push(`  port: ${safePort}`);
+        if (!written.token) newLines.push(`  token: "${opts.token}"`);
+        blockWritten = true;
+        inRemnicBlock = false;
+        newLines.push(line);
+        continue;
+      }
+      if (/^\s+host:/.test(line)) {
+        newLines.push(`  host: "${safeHost}"`);
+        written.host = true;
+      } else if (/^\s+port:/.test(line)) {
+        newLines.push(`  port: ${safePort}`);
+        written.port = true;
+      } else if (/^\s+token:/.test(line)) {
+        newLines.push(`  token: "${opts.token}"`);
+        written.token = true;
+      } else {
+        newLines.push(line);
+      }
+      continue;
+    }
+    newLines.push(line);
+  }
+  if (inRemnicBlock && !blockWritten) {
+    if (!written.host) newLines.push(`  host: "${safeHost}"`);
+    if (!written.port) newLines.push(`  port: ${safePort}`);
+    if (!written.token) newLines.push(`  token: "${opts.token}"`);
+  }
+  writeSecretFileSync(cfgPath, newLines.join("\n") + "\n");
+  return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };
+}
+function removeHermesConfig(opts) {
+  const cfgPaths = hermesConfigCleanupPaths(opts.profile);
+  const results = cfgPaths.map((cfgPath) => {
+    try {
+      return removeHermesConfigFile(cfgPath);
+    } catch (err) {
+      return {
+        updated: false,
+        skipped: true,
+        reason: `Hermes config cleanup failed: ${err instanceof Error ? err.message : String(err)}`,
+        configPath: cfgPath
+      };
+    }
+  });
+  const updated = results.filter((result) => result.updated);
+  const cleanupFailures = results.filter((result) => result.reason?.startsWith("Hermes config cleanup failed:"));
+  if (updated.length > 0) {
+    const updatedPaths = updated.map((result) => result.configPath).join(", ");
+    if (cleanupFailures.length > 0) {
+      const failedPaths = cleanupFailures.map((result) => result.configPath).join(", ");
+      return {
+        updated: false,
+        skipped: true,
+        reason: `Hermes config cleanup partially failed: updated ${updatedPaths}; failed ${failedPaths}`,
+        configPath: `${updatedPaths}; failed: ${failedPaths}`
+      };
+    }
+    return {
+      updated: true,
+      skipped: false,
+      configPath: updatedPaths
+    };
+  }
+  const cleanupFailure = cleanupFailures[0];
+  if (cleanupFailure) {
+    return cleanupFailure;
+  }
+  const existingWithoutBlock = results.find((result) => result.reason !== "Hermes config.yaml not found");
+  return existingWithoutBlock ?? results[0] ?? {
+    updated: false,
+    skipped: true,
+    reason: "Hermes config.yaml not found",
+    configPath: hermesConfigPath(opts.profile)
+  };
+}
+function removeHermesConfigFile(cfgPath) {
+  if (!fs2.existsSync(cfgPath)) {
+    return {
+      updated: false,
+      skipped: true,
+      reason: "Hermes config.yaml not found",
+      configPath: cfgPath
+    };
+  }
+  const raw = fs2.readFileSync(cfgPath, "utf8");
+  if (!/^remnic:/m.test(raw)) {
+    return {
+      updated: false,
+      skipped: true,
+      reason: "No remnic: block found in config.yaml",
+      configPath: cfgPath
+    };
+  }
+  const lines = raw.split("\n");
+  const newLines = [];
+  let inRemnicBlock = false;
+  for (const line of lines) {
+    if (/^remnic:/.test(line)) {
+      inRemnicBlock = true;
+      continue;
+    }
+    if (inRemnicBlock) {
+      if (line.length > 0 && !/^\s/.test(line)) {
+        inRemnicBlock = false;
+        newLines.push(line);
+      }
+      continue;
+    }
+    newLines.push(line);
+  }
+  while (newLines.length > 0 && newLines[newLines.length - 1]?.trim() === "") {
+    newLines.pop();
+  }
+  writeSecretFileSync(cfgPath, newLines.length > 0 ? newLines.join("\n") + "\n" : "");
+  return { updated: true, skipped: false, configPath: cfgPath };
+}
+var HEALTH_EXIT_OK = 0;
+var HEALTH_EXIT_UNAUTHORIZED = 2;
+function checkDaemonHealth(host, port, authToken) {
+  try {
+    const safePort = Math.trunc(Number(port));
+    if (!Number.isFinite(safePort) || safePort < 1 || safePort > 65535) {
+      return false;
+    }
+    const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    const script = [
+      "const http = require('http');",
+      "const env = process['env'];",
+      "const headers = {};",
+      "if (env.REMNIC_HEALTH_TOKEN) {",
+      "  headers['authorization'] = 'Bearer ' + env.REMNIC_HEALTH_TOKEN;",
+      "}",
+      "const req = http.get({",
+      "  host: env.REMNIC_HEALTH_HOST,",
+      "  port: parseInt(env.REMNIC_HEALTH_PORT, 10),",
+      "  path: '/engram/v1/health',",
+      "  headers,",
+      "  timeout: 3000,",
+      "}, (res) => { process.exit(res.statusCode === 200 ? 0 : res.statusCode === 401 ? 2 : 1); });",
+      "req.on('error', () => process.exit(1));",
+      "req.on('timeout', () => { req.destroy(); process.exit(1); });"
+    ].join("\n");
+    const env = mergeEnv({
+      REMNIC_HEALTH_HOST: bareHost,
+      REMNIC_HEALTH_PORT: String(safePort)
+    });
+    if (authToken) {
+      env.REMNIC_HEALTH_TOKEN = authToken;
+    }
+    const processPath = process.execPath;
+    const launchOptions = { timeout: 4e3, env };
+    const result = launchProcessSync(processPath, ["-e", script], launchOptions);
+    if (result.status === HEALTH_EXIT_OK) {
+      return true;
+    }
+    if (result.status === HEALTH_EXIT_UNAUTHORIZED) {
+      console.error(
+        "[remnic/connectors] health probe got 401 \u2014 retrying after token cache TTL..."
+      );
+      launchProcessSync(processPath, ["-e", "setTimeout(() => {}, 6000)"], {
+        timeout: 7e3,
+        env: {}
+      });
+      const retry = launchProcessSync(processPath, ["-e", script], launchOptions);
+      return retry.status === HEALTH_EXIT_OK;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+async function doctorConnector(connectorId) {
+  const installed = listConnectors().installed;
+  const instance = installed.find((c) => c.connectorId === connectorId);
+  if (!instance) {
+    return {
+      connectorId,
+      checks: [{ name: "Installed", ok: false, detail: "Not installed" }],
+      healthy: false
+    };
+  }
+  const configPath = path2.join(getConnectorsDir(), `${connectorId}.json`);
+  const checks = [];
+  checks.push({
+    name: "Config file",
+    ok: fs2.existsSync(configPath),
+    detail: configPath
+  });
+  try {
+    const raw = fs2.readFileSync(configPath, "utf8");
+    JSON.parse(raw);
+    checks.push({ name: "Config valid", ok: true, detail: "OK" });
+  } catch (e) {
+    checks.push({ name: "Config valid", ok: false, detail: String(e) });
+  }
+  const mcpUrl = instance.config.mcpServerUrl;
+  if (mcpUrl) {
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 3e3);
+      const response = await fetch(mcpUrl, { signal: controller.signal });
+      clearTimeout(timeoutId);
+      checks.push({ name: "MCP server", ok: response.ok, detail: mcpUrl });
+    } catch (e) {
+      checks.push({
+        name: "MCP server",
+        ok: false,
+        detail: `Cannot reach ${mcpUrl}: ${e instanceof Error ? e.message : "unknown"}`
+      });
+    }
+  }
+  const memoryDir = instance.config.memoryDir;
+  if (memoryDir) {
+    if (fs2.existsSync(memoryDir)) {
+      checks.push({ name: "Memory directory", ok: true, detail: memoryDir });
+    } else {
+      checks.push({ name: "Memory directory", ok: false, detail: `Not found: ${memoryDir}` });
+    }
+  }
+  const healthy = checks.every((c) => c.ok);
+  return { connectorId, checks, healthy };
+}
+var CODEX_MEMORIES_SUBDIR = "memories";
+var CODEX_EXTENSIONS_SUBDIR = "memories_extensions";
+var REMNIC_EXTENSION_DIR_NAME = "remnic";
+function resolveCodexHome(override) {
+  if (override && typeof override === "string" && override.trim().length > 0) {
+    return path2.resolve(override.trim());
+  }
+  const envHome = readEnvVar("CODEX_HOME");
+  if (envHome && envHome.trim().length > 0) {
+    return path2.resolve(envHome.trim());
+  }
+  const home = readEnvVar("HOME") || readEnvVar("USERPROFILE") || resolveHomeDir();
+  return path2.resolve(home, ".codex");
+}
+function resolveCodexMemoryExtensionPaths(codexHomeOverride) {
+  const codexHome = resolveCodexHome(codexHomeOverride);
+  const memoriesDir = path2.join(codexHome, CODEX_MEMORIES_SUBDIR);
+  const extensionsRoot = path2.join(path2.dirname(memoriesDir), CODEX_EXTENSIONS_SUBDIR);
+  const remnicExtensionDir = path2.join(extensionsRoot, REMNIC_EXTENSION_DIR_NAME);
+  return { codexHome, memoriesDir, extensionsRoot, remnicExtensionDir };
+}
+function locatePluginCodexExtensionSource(override) {
+  if (override && typeof override === "string" && override.trim().length > 0) {
+    const resolved = path2.resolve(override.trim());
+    if (fs2.existsSync(resolved) && fs2.statSync(resolved).isDirectory()) {
+      return resolved;
+    }
+    throw new Error(`Codex extension source directory not found: ${resolved}`);
+  }
+  const EXTENSION_SUBPATH = path2.join("memories_extensions", "remnic");
+  const WORKSPACE_RELATIVE_PATH = path2.join(
+    "packages",
+    "plugin-codex",
+    "memories_extensions",
+    "remnic"
+  );
+  const searched = [];
+  try {
+    const moduleDir = path2.dirname(fileURLToPath(import.meta.url));
+    const bundledCandidate = path2.join(moduleDir, "codex");
+    searched.push(bundledCandidate);
+    if (fs2.existsSync(bundledCandidate) && fs2.statSync(bundledCandidate).isDirectory()) {
+      return bundledCandidate;
+    }
+    const distConnectorsCandidate = path2.join(moduleDir, "connectors", "codex");
+    searched.push(distConnectorsCandidate);
+    if (fs2.existsSync(distConnectorsCandidate) && fs2.statSync(distConnectorsCandidate).isDirectory()) {
+      return distConnectorsCandidate;
+    }
+  } catch {
+  }
+  try {
+    const requireFromHere = createRequire(import.meta.url);
+    const pluginPkgJsonPath = requireFromHere.resolve("@remnic/plugin-codex/package.json");
+    const pluginPkgRoot = path2.dirname(pluginPkgJsonPath);
+    const candidate = path2.join(pluginPkgRoot, EXTENSION_SUBPATH);
+    searched.push(candidate);
+    if (fs2.existsSync(candidate) && fs2.statSync(candidate).isDirectory()) {
+      return candidate;
+    }
+  } catch {
+  }
+  try {
+    const moduleDir = path2.dirname(fileURLToPath(import.meta.url));
+    let dir = moduleDir;
+    for (let depth = 0; depth < 8; depth += 1) {
+      const candidate = path2.join(
+        dir,
+        "node_modules",
+        "@remnic",
+        "plugin-codex",
+        EXTENSION_SUBPATH
+      );
+      searched.push(candidate);
+      if (fs2.existsSync(candidate) && fs2.statSync(candidate).isDirectory()) {
+        return candidate;
+      }
+      const parent = path2.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch {
+  }
+  const anchors = [];
+  try {
+    anchors.push(path2.dirname(fileURLToPath(import.meta.url)));
+  } catch {
+  }
+  anchors.push(process.cwd());
+  for (const anchor of anchors) {
+    let dir = anchor;
+    for (let depth = 0; depth < 12; depth += 1) {
+      const candidate = path2.join(dir, WORKSPACE_RELATIVE_PATH);
+      searched.push(candidate);
+      if (fs2.existsSync(candidate) && fs2.statSync(candidate).isDirectory()) {
+        return candidate;
+      }
+      const parent = path2.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  throw new Error(
+    "Could not locate the plugin-codex memories_extensions/remnic source directory.\nPaths searched:\n" + searched.map((p) => `  - ${p}`).join("\n") + "\nInstall @remnic/plugin-codex or pass sourceDir explicitly."
+  );
+}
+function copyDirRecursiveSync(src, dest) {
+  let count = 0;
+  fs2.mkdirSync(dest, { recursive: true });
+  const entries = fs2.readdirSync(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const from = path2.join(src, entry.name);
+    const to = path2.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      count += copyDirRecursiveSync(from, to);
+    } else if (entry.isFile()) {
+      fs2.copyFileSync(from, to);
+      count += 1;
+    }
+  }
+  return count;
+}
+function installCodexMemoryExtension(options = {}) {
+  const paths = resolveCodexMemoryExtensionPaths(options.codexHome ?? null);
+  const sourceDir = locatePluginCodexExtensionSource(options.sourceDir ?? null);
+  fs2.mkdirSync(paths.extensionsRoot, { recursive: true });
+  const tmpPrefix = `.${REMNIC_EXTENSION_DIR_NAME}.tmp-`;
+  const STALE_TMP_THRESHOLD_MS = 10 * 60 * 1e3;
+  const now = Date.now();
+  try {
+    const existingEntries = fs2.readdirSync(paths.extensionsRoot);
+    for (const entry of existingEntries) {
+      if (!entry.startsWith(tmpPrefix)) continue;
+      const stalePath = path2.join(paths.extensionsRoot, entry);
+      try {
+        const stat = fs2.statSync(stalePath);
+        const ageMs = now - stat.mtimeMs;
+        if (ageMs < STALE_TMP_THRESHOLD_MS) {
+          continue;
+        }
+        fs2.rmSync(stalePath, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  } catch {
+  }
+  const tmpName = `${tmpPrefix}${process.pid}-${Date.now()}`;
+  const tmpDir = path2.join(paths.extensionsRoot, tmpName);
+  let filesCopied = 0;
+  let commitFn = () => {
+  };
+  let rollbackFn = () => {
+  };
+  try {
+    filesCopied = copyDirRecursiveSync(sourceDir, tmpDir);
+    const backupDir = `${paths.remnicExtensionDir}.bak-${Date.now()}`;
+    const hadExisting = fs2.existsSync(paths.remnicExtensionDir);
+    if (hadExisting) {
+      fs2.renameSync(paths.remnicExtensionDir, backupDir);
+    }
+    try {
+      fs2.renameSync(tmpDir, paths.remnicExtensionDir);
+    } catch (renameErr) {
+      if (hadExisting) {
+        try {
+          fs2.renameSync(backupDir, paths.remnicExtensionDir);
+        } catch {
+        }
+      }
+      throw renameErr;
+    }
+    commitFn = () => {
+      if (hadExisting) {
+        try {
+          fs2.rmSync(backupDir, { recursive: true, force: true });
+        } catch {
+        }
+      }
+    };
+    rollbackFn = () => {
+      if (hadExisting) {
+        try {
+          if (fs2.existsSync(paths.remnicExtensionDir)) {
+            fs2.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
+          }
+          fs2.renameSync(backupDir, paths.remnicExtensionDir);
+        } catch {
+        }
+      } else {
+        try {
+          if (fs2.existsSync(paths.remnicExtensionDir)) {
+            fs2.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
+          }
+        } catch {
+        }
+      }
+    };
+  } catch (err) {
+    if (fs2.existsSync(tmpDir)) {
+      try {
+        fs2.rmSync(tmpDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    throw err;
+  }
+  const instructionsPath = path2.join(paths.remnicExtensionDir, "instructions.md");
+  return {
+    ...paths,
+    instructionsPath,
+    filesCopied,
+    commit: commitFn,
+    rollback: rollbackFn
+  };
+}
+function removeCodexMemoryExtension(options = {}) {
+  const paths = resolveCodexMemoryExtensionPaths(options.codexHome ?? null);
+  let removed = false;
+  if (fs2.existsSync(paths.remnicExtensionDir)) {
+    fs2.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });
+    removed = true;
+  }
+  return { ...paths, removed };
+}
+function getConnectorsDir() {
+  const xdgConfigHome = readEnvVar("XDG_CONFIG_HOME");
+  const configDir = xdgConfigHome ? path2.join(xdgConfigHome, "engram") : path2.join(resolveHomeDir(), ".config", "engram");
+  return path2.join(configDir, REGISTRY_DIR_NAME, "connectors");
+}
+var WECLONE_PROXY_CONFIG_DIRNAME = ".remnic";
+var WECLONE_PROXY_CONFIG_FILENAME = "weclone.json";
+function resolveWeCloneProxyConfigPath() {
+  const remnicHome = readEnvVar("REMNIC_HOME");
+  const override = remnicHome && remnicHome.length > 0 ? remnicHome : readEnvVar("ENGRAM_HOME");
+  if (override && override.length > 0) {
+    return path2.resolve(expandTildePath(override), "connectors", WECLONE_PROXY_CONFIG_FILENAME);
+  }
+  const envHome = readEnvVar("HOME");
+  const home = envHome && envHome.length > 0 ? envHome : os.homedir();
+  return path2.resolve(
+    home,
+    WECLONE_PROXY_CONFIG_DIRNAME,
+    "connectors",
+    WECLONE_PROXY_CONFIG_FILENAME
+  );
+}
+function readWeCloneProxyConfigIfExists(configPath) {
+  try {
+    if (!fs2.existsSync(configPath)) return null;
+    return fs2.readFileSync(configPath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function safeParseJson(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+var WECLONE_DEFAULTS = {
+  wecloneApiUrl: "http://localhost:8000/v1",
+  wecloneModelName: "weclone-avatar",
+  proxyPort: 8100,
+  remnicDaemonUrl: "http://localhost:4318",
+  sessionStrategy: "single",
+  memoryInjection: {
+    maxTokens: 1500,
+    position: "system-append",
+    template: "[Memory Context]\n{memories}\n[End Memory Context]"
+  }
+};
+function resolveStringField(userConfig, priorConfig, key, fallback) {
+  const fromUser = userConfig[key];
+  if (typeof fromUser === "string" && fromUser.length > 0) return fromUser;
+  if (priorConfig) {
+    const fromPrior = priorConfig[key];
+    if (typeof fromPrior === "string" && fromPrior.length > 0) return fromPrior;
+  }
+  return fallback;
+}
+function coercePort(value) {
+  if (typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535) {
+    return value;
+  }
+  if (typeof value === "string" && value.length > 0) {
+    const n = Number(value);
+    if (Number.isInteger(n) && n >= 1 && n <= 65535) return n;
+  }
+  return null;
+}
+function resolvePort(userConfig, priorConfig, fallback) {
+  const fromUser = coercePort(userConfig.proxyPort);
+  if (fromUser !== null) return fromUser;
+  if (priorConfig) {
+    const fromPrior = coercePort(priorConfig.proxyPort);
+    if (fromPrior !== null) return fromPrior;
+  }
+  return fallback;
+}
+function resolveSessionStrategy(userConfig, priorConfig) {
+  const valid = /* @__PURE__ */ new Set(["caller-id", "single"]);
+  const fromUser = userConfig.sessionStrategy;
+  if (typeof fromUser === "string" && valid.has(fromUser)) {
+    return fromUser;
+  }
+  if (priorConfig) {
+    const fromPrior = priorConfig.sessionStrategy;
+    if (typeof fromPrior === "string" && valid.has(fromPrior)) {
+      return fromPrior;
+    }
+  }
+  return WECLONE_DEFAULTS.sessionStrategy;
+}
+function buildWeCloneProxyConfig(args) {
+  const { userConfig, priorConfig, authToken } = args;
+  const wecloneApiUrl = resolveStringField(
+    userConfig,
+    priorConfig,
+    "wecloneApiUrl",
+    WECLONE_DEFAULTS.wecloneApiUrl
+  );
+  const wecloneModelName = resolveStringField(
+    userConfig,
+    priorConfig,
+    "wecloneModelName",
+    WECLONE_DEFAULTS.wecloneModelName
+  );
+  const remnicDaemonUrl = resolveStringField(
+    userConfig,
+    priorConfig,
+    "remnicDaemonUrl",
+    WECLONE_DEFAULTS.remnicDaemonUrl
+  );
+  const proxyPort = resolvePort(
+    userConfig,
+    priorConfig,
+    WECLONE_DEFAULTS.proxyPort
+  );
+  const sessionStrategy = resolveSessionStrategy(userConfig, priorConfig);
+  const memoryInjection = {
+    ...WECLONE_DEFAULTS.memoryInjection,
+    ...priorConfig && typeof priorConfig.memoryInjection === "object" && priorConfig.memoryInjection !== null && !Array.isArray(priorConfig.memoryInjection) ? priorConfig.memoryInjection : {},
+    ...typeof userConfig.memoryInjection === "object" && userConfig.memoryInjection !== null && !Array.isArray(userConfig.memoryInjection) ? userConfig.memoryInjection : {}
+  };
+  const config = {
+    wecloneApiUrl,
+    wecloneModelName,
+    proxyPort,
+    remnicDaemonUrl,
+    sessionStrategy,
+    memoryInjection
+  };
+  if (authToken && authToken.length > 0) {
+    config.remnicAuthToken = authToken;
+  } else if (typeof userConfig.remnicAuthToken === "string" && userConfig.remnicAuthToken.length > 0) {
+    config.remnicAuthToken = userConfig.remnicAuthToken;
+  } else if (priorConfig && typeof priorConfig.remnicAuthToken === "string" && priorConfig.remnicAuthToken.length > 0) {
+    config.remnicAuthToken = priorConfig.remnicAuthToken;
+  }
+  return config;
+}
+
+export {
+  MARKETPLACE_SCHEMA_VERSION,
+  MARKETPLACE_MANIFEST_FILENAME,
+  generateMarketplaceManifest,
+  validateMarketplaceManifest,
+  checkMarketplaceManifest,
+  writeMarketplaceManifest,
+  installFromMarketplace,
+  getRegistryPath,
+  loadRegistry,
+  saveRegistry,
+  listConnectors,
+  getConnectorToken,
+  installConnector,
+  removeConnector,
+  upsertHermesConfig,
+  removeHermesConfig,
+  doctorConnector,
+  resolveCodexHome,
+  resolveCodexMemoryExtensionPaths,
+  locatePluginCodexExtensionSource,
+  installCodexMemoryExtension,
+  removeCodexMemoryExtension,
+  resolveWeCloneProxyConfigPath,
+  buildWeCloneProxyConfig
+};
+//# sourceMappingURL=chunk-326G7DJK.js.map