@remnic/core 9.3.519 → 9.3.521

package/dist/index.js

@@ -967,7 +967,6 @@ var DEFAULT_MAX_BINARY_SIZE_BYTES = 50 * 1024 * 1024;
 var DEFAULT_GRACE_PERIOD_DAYS = 7;
 
 // src/binary-lifecycle/backend.ts
-import fs from "fs";
 import fsp from "fs/promises";
 import path from "path";
 var FilesystemBackend = class {
@@ -980,40 +979,172 @@ var FilesystemBackend = class {
     this.basePath = path.resolve(basePath);
   }
   resolveRemotePath(remotePath) {
-    if (path.isAbsolute(remotePath)) {
-      throw new Error(`FilesystemBackend remotePath must be relative: ${JSON.stringify(remotePath)}`);
-    }
-    const resolved = path.resolve(this.basePath, remotePath);
+    const resolved = path.isAbsolute(remotePath) ? path.resolve(remotePath) : path.resolve(this.basePath, remotePath);
     const relative = path.relative(this.basePath, resolved);
     if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
       throw new Error(`FilesystemBackend remotePath escapes basePath: ${JSON.stringify(remotePath)}`);
     }
     return resolved;
   }
-  async upload(localPath, remotePath) {
+  isInsideBase(candidate, realBase) {
+    const relative = path.relative(realBase, candidate);
+    return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  }
+  async realBasePathIfExists() {
+    try {
+      const stat = await fsp.lstat(this.basePath);
+      if (stat.isSymbolicLink()) {
+        throw new Error(`FilesystemBackend basePath must not be a symlink: ${this.basePath}`);
+      }
+      if (!stat.isDirectory()) {
+        throw new Error(`FilesystemBackend basePath must be a directory: ${this.basePath}`);
+      }
+      return await fsp.realpath(this.basePath);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        return null;
+      }
+      throw err;
+    }
+  }
+  async ensureBaseDirectory() {
+    await fsp.mkdir(this.basePath, { recursive: true });
+    const realBase = await this.realBasePathIfExists();
+    if (realBase === null) {
+      throw new Error(`FilesystemBackend failed to create basePath: ${this.basePath}`);
+    }
+    return realBase;
+  }
+  async ensureSafeParentDirectory(dest) {
+    const realBase = await this.ensureBaseDirectory();
+    const destDir = path.dirname(dest);
+    const relativeDir = path.relative(this.basePath, destDir);
+    const segments = relativeDir === "" ? [] : relativeDir.split(path.sep);
+    let current = this.basePath;
+    for (const segment of segments) {
+      if (segment === "." || segment === "") continue;
+      current = path.join(current, segment);
+      try {
+        const stat = await fsp.lstat(current);
+        if (stat.isSymbolicLink()) {
+          throw new Error(`FilesystemBackend remotePath traverses symlink: ${current}`);
+        }
+        if (!stat.isDirectory()) {
+          throw new Error(`FilesystemBackend remotePath parent is not a directory: ${current}`);
+        }
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          throw err;
+        }
+        await fsp.mkdir(current);
+      }
+    }
+    const realParent = await fsp.realpath(destDir);
+    if (!this.isInsideBase(realParent, realBase)) {
+      throw new Error(`FilesystemBackend remotePath parent escapes basePath: ${dest}`);
+    }
+    return realBase;
+  }
+  async resolveExistingRemotePath(remotePath) {
     const dest = this.resolveRemotePath(remotePath);
+    const realBase = await this.realBasePathIfExists();
+    if (realBase === null) {
+      return null;
+    }
     const destDir = path.dirname(dest);
-    await fsp.mkdir(destDir, { recursive: true });
-    await fsp.copyFile(localPath, dest);
+    const relativeDir = path.relative(this.basePath, destDir);
+    const segments = relativeDir === "" ? [] : relativeDir.split(path.sep);
+    let current = this.basePath;
+    for (const segment of segments) {
+      if (segment === "." || segment === "") continue;
+      current = path.join(current, segment);
+      let stat;
+      try {
+        stat = await fsp.lstat(current);
+      } catch (err) {
+        if (err.code === "ENOENT") {
+          return null;
+        }
+        throw err;
+      }
+      if (stat.isSymbolicLink()) {
+        throw new Error(`FilesystemBackend remotePath traverses symlink: ${current}`);
+      }
+      if (!stat.isDirectory()) {
+        return null;
+      }
+    }
+    const realParent = await fsp.realpath(destDir).catch((err) => {
+      if (err.code === "ENOENT") return null;
+      throw err;
+    });
+    if (realParent === null) {
+      return null;
+    }
+    if (!this.isInsideBase(realParent, realBase)) {
+      throw new Error(`FilesystemBackend remotePath parent escapes basePath: ${JSON.stringify(remotePath)}`);
+    }
+    try {
+      const stat = await fsp.lstat(dest);
+      if (stat.isSymbolicLink()) {
+        throw new Error(`FilesystemBackend remotePath points to symlink: ${dest}`);
+      }
+      if (!stat.isFile()) {
+        return null;
+      }
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        return null;
+      }
+      throw err;
+    }
+    const realDest = await fsp.realpath(dest);
+    if (!this.isInsideBase(realDest, realBase)) {
+      throw new Error(`FilesystemBackend remotePath escapes basePath: ${JSON.stringify(remotePath)}`);
+    }
     return dest;
   }
-  async exists(remotePath) {
+  async upload(localPath, remotePath) {
+    if (path.isAbsolute(remotePath)) {
+      throw new Error(`FilesystemBackend upload remotePath must be relative: ${JSON.stringify(remotePath)}`);
+    }
     const dest = this.resolveRemotePath(remotePath);
+    const realBase = await this.ensureSafeParentDirectory(dest);
     try {
-      await fsp.access(dest, fs.constants.F_OK);
-      return true;
-    } catch {
-      return false;
+      const stat = await fsp.lstat(dest);
+      if (stat.isSymbolicLink()) {
+        throw new Error(`FilesystemBackend remotePath points to symlink: ${dest}`);
+      }
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        throw err;
+      }
     }
+    await fsp.copyFile(localPath, dest);
+    const realDest = await fsp.realpath(dest);
+    if (!this.isInsideBase(realDest, realBase)) {
+      throw new Error(`FilesystemBackend remotePath escapes basePath: ${JSON.stringify(remotePath)}`);
+    }
+    return remotePath;
+  }
+  async exists(remotePath) {
+    const dest = await this.resolveExistingRemotePath(remotePath);
+    return dest !== null;
   }
   async delete(remotePath) {
-    const dest = this.resolveRemotePath(remotePath);
+    const dest = await this.resolveExistingRemotePath(remotePath);
+    if (dest === null) {
+      return;
+    }
     try {
       await fsp.unlink(dest);
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
   }
+  getRedirectTarget(remotePath) {
+    return this.resolveRemotePath(remotePath);
+  }
 };
 var NoneBackend = class {
   type = "none";
@@ -1125,20 +1256,29 @@ function manifestPath(memoryDir) {
 }
 async function readManifest(memoryDir) {
   const filePath = manifestPath(memoryDir);
+  let raw;
   try {
-    const raw = await fsp3.readFile(filePath, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-      return emptyManifest();
-    }
-    const obj = parsed;
-    if (obj.version !== 1 || !Array.isArray(obj.assets)) {
+    raw = await fsp3.readFile(filePath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
       return emptyManifest();
     }
-    return parsed;
-  } catch {
-    return emptyManifest();
+    throw new Error(`Failed to read binary lifecycle manifest at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
   }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Invalid binary lifecycle manifest JSON at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Invalid binary lifecycle manifest shape at ${filePath}: expected object`);
+  }
+  const obj = parsed;
+  if (obj.version !== 1 || !Array.isArray(obj.assets)) {
+    throw new Error(`Invalid binary lifecycle manifest shape at ${filePath}: expected version 1 with assets array`);
+  }
+  return parsed;
 }
 async function writeManifest(memoryDir, manifest) {
   const dir = manifestDir(memoryDir);
@@ -1186,11 +1326,33 @@ function guessMimeType(ext) {
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function resolveManifestAssetPath(memoryDir, originalPath) {
+  if (originalPath.length === 0 || originalPath.includes("\0") || originalPath.includes("\\") || path4.isAbsolute(originalPath) || path4.win32.isAbsolute(originalPath)) {
+    return null;
+  }
+  const memoryRoot = path4.resolve(memoryDir);
+  const fullPath = path4.resolve(memoryRoot, originalPath);
+  const relative = path4.relative(memoryRoot, fullPath);
+  if (relative === "" || relative === ".." || relative.startsWith(`..${path4.sep}`) || path4.isAbsolute(relative)) {
+    return null;
+  }
+  return fullPath;
+}
 function validateBinaryLifecycleConfig(config) {
   if (typeof config.gracePeriodDays !== "number" || !Number.isFinite(config.gracePeriodDays) || !Number.isInteger(config.gracePeriodDays) || config.gracePeriodDays < 0) {
     throw new Error("binary lifecycle gracePeriodDays must be a finite non-negative integer");
   }
 }
+function remotePathForAsset(backend, relPath) {
+  const normalized = relPath.split(path4.sep).join("/");
+  if (backend.type === "filesystem") {
+    return `.binary-lifecycle/mirrors/${normalized}`;
+  }
+  return normalized;
+}
+function markdownTargetForAsset(asset) {
+  return asset.redirectPath ?? asset.mirroredPath;
+}
 async function stageMirror(memoryDir, newPaths, backend, assets, log2, dryRun) {
   let mirrored = 0;
   const errors = [];
@@ -1201,14 +1363,16 @@ async function stageMirror(memoryDir, newPaths, backend, assets, log2, dryRun) {
       const contentHash = await hashFile2(fullPath);
       const ext = path4.extname(relPath);
       const mimeType = guessMimeType(ext);
-      const remotePath = relPath;
+      const remotePath = remotePathForAsset(backend, relPath);
       let backendLocation = remotePath;
       if (!dryRun) {
         backendLocation = await backend.upload(fullPath, remotePath);
       }
+      const redirectPath = backend.getRedirectTarget?.(backendLocation);
       const record = {
         originalPath: relPath,
         mirroredPath: backendLocation,
+        ...redirectPath ? { redirectPath } : {},
         contentHash,
         sizeBytes: stat.size,
         mimeType,
@@ -1232,62 +1396,193 @@ async function stageMirror(memoryDir, newPaths, backend, assets, log2, dryRun) {
   }
   return { mirrored, errors };
 }
-async function stageRedirect(memoryDir, assets, log2, dryRun) {
+async function stageRedirect(memoryDir, assets, log2, dryRun, readMarkdownFile, writeMarkdownFile) {
   let redirected = 0;
   const errors = [];
-  const candidates = assets.filter((a) => a.status === "mirrored");
+  const candidates = assets.filter((a) => a.status === "mirrored" || a.status === "error");
   if (candidates.length === 0) return { redirected, errors };
   const mdFiles = await findMarkdownFiles(memoryDir);
   for (const asset of candidates) {
-    let matchCount = 0;
-    let writeFailCount = 0;
+    const assetAbsolute = resolveManifestAssetPath(memoryDir, asset.originalPath);
+    if (assetAbsolute === null) {
+      const msg = `redirect blocked for ${asset.originalPath}: manifest path is outside memoryDir`;
+      log2.error(`[binary-lifecycle] ${msg}`);
+      errors.push(msg);
+      if (!dryRun) {
+        asset.status = "error";
+      }
+      continue;
+    }
+    const updates = [];
+    let scanFailCount = 0;
     for (const mdPath of mdFiles) {
       try {
-        const content = await fsp4.readFile(mdPath, "utf-8");
-        const mdDir = path4.dirname(mdPath);
-        const assetAbsolute = path4.join(memoryDir, asset.originalPath);
-        const relativeToMd = path4.relative(mdDir, assetAbsolute);
-        const relativeForward = relativeToMd.split(path4.sep).join("/");
-        const escaped = escapeRegex(relativeForward);
-        const pattern = new RegExp(
-          `(!?\\[[^\\]]*\\]\\()(\\.\\/)?(${escaped})(\\))`,
-          "g"
-        );
+        const content = await readMarkdownFile(mdPath);
+        const pattern = markdownReferencePattern(asset, assetAbsolute, mdPath);
         if (!pattern.test(content)) continue;
-        matchCount++;
-        if (!dryRun) {
-          pattern.lastIndex = 0;
-          const updated = content.replace(pattern, (_match, open, _dotSlash, _file, close) => {
-            return `${open}${asset.mirroredPath}${close}`;
-          });
-          await fsp4.writeFile(mdPath, updated, "utf-8");
-        }
+        pattern.lastIndex = 0;
+        const updated = content.replace(pattern, (_match, open, _target, close) => {
+          return `${open}${markdownTargetForAsset(asset)}${close}`;
+        });
+        updates.push({ mdPath, content: updated });
       } catch (err) {
-        writeFailCount++;
+        scanFailCount++;
         const msg = `redirect scan failed for ${mdPath}: ${err instanceof Error ? err.message : String(err)}`;
         log2.error(`[binary-lifecycle] ${msg}`);
         errors.push(msg);
       }
     }
-    if (matchCount > 0 && writeFailCount === 0) {
+    if (scanFailCount > 0) {
       if (!dryRun) {
-        asset.status = "redirected";
-        asset.redirectedAt = (/* @__PURE__ */ new Date()).toISOString();
+        asset.status = "error";
       }
+      log2.warn(
+        `[binary-lifecycle] redirect blocked for ${asset.originalPath}: ${scanFailCount} markdown scan failure(s)${dryRun ? "" : " \u2014 status set to error"}`
+      );
+      continue;
+    }
+    if (updates.length === 0) {
+      if (asset.status === "error") {
+        const verifyResult2 = await countRemainingLocalReferences(
+          memoryDir,
+          asset,
+          assetAbsolute,
+          mdFiles,
+          readMarkdownFile
+        );
+        if (verifyResult2.errors.length > 0 || verifyResult2.remaining > 0) {
+          if (!dryRun) {
+            asset.status = "error";
+          }
+          for (const msg of verifyResult2.errors) {
+            log2.error(`[binary-lifecycle] ${msg}`);
+            errors.push(msg);
+          }
+          if (verifyResult2.remaining > 0) {
+            const msg = `redirect verification failed for ${asset.originalPath}: ${verifyResult2.remaining} local reference(s) remain`;
+            log2.warn(`[binary-lifecycle] ${msg}`);
+            errors.push(msg);
+          }
+          continue;
+        }
+        if (asset.redirectedAt === void 0) {
+          if (!dryRun) {
+            asset.status = "mirrored";
+          }
+          log2.info(`[binary-lifecycle] preserved mirrored asset without redirected marker: ${asset.originalPath}${dryRun ? " [dry-run]" : ""}`);
+          continue;
+        }
+        if (!Number.isFinite(new Date(asset.mirroredAt).getTime())) {
+          const msg = `redirect blocked for ${asset.originalPath}: manifest mirroredAt is invalid`;
+          log2.error(`[binary-lifecycle] ${msg}`);
+          errors.push(msg);
+          if (!dryRun) {
+            asset.status = "error";
+          }
+          continue;
+        }
+        if (!dryRun) {
+          asset.status = "redirected";
+          asset.redirectedAt = (/* @__PURE__ */ new Date()).toISOString();
+        }
+        redirected++;
+        log2.info(`[binary-lifecycle] redirected: ${asset.originalPath}${dryRun ? " [dry-run]" : ""}`);
+      }
+      continue;
+    }
+    if (dryRun) {
       redirected++;
-      log2.info(`[binary-lifecycle] redirected: ${asset.originalPath}${dryRun ? " [dry-run]" : ""}`);
-    } else if (matchCount > 0 && writeFailCount > 0) {
+      log2.info(`[binary-lifecycle] redirected: ${asset.originalPath} [dry-run]`);
+      continue;
+    }
+    let writeFailCount = 0;
+    for (const update of updates) {
+      try {
+        await writeMarkdownFile(update.mdPath, update.content);
+      } catch (err) {
+        writeFailCount++;
+        const msg = `redirect write failed for ${update.mdPath}: ${err instanceof Error ? err.message : String(err)}`;
+        log2.error(`[binary-lifecycle] ${msg}`);
+        errors.push(msg);
+      }
+    }
+    if (writeFailCount > 0) {
       if (!dryRun) {
         asset.status = "error";
       }
       log2.warn(
-        `[binary-lifecycle] redirect partial failure for ${asset.originalPath}: ${matchCount} match(es), ${writeFailCount} write failure(s)${dryRun ? "" : " \u2014 status set to error"}`
+        `[binary-lifecycle] redirect write failure for ${asset.originalPath}: ${writeFailCount} write failure(s) \u2014 status set to error`
       );
+      continue;
+    }
+    const redirectedAt = (/* @__PURE__ */ new Date()).toISOString();
+    asset.redirectedAt = redirectedAt;
+    const verifyResult = await countRemainingLocalReferences(
+      memoryDir,
+      asset,
+      assetAbsolute,
+      mdFiles,
+      readMarkdownFile
+    );
+    if (verifyResult.errors.length > 0 || verifyResult.remaining > 0) {
+      asset.status = "error";
+      for (const msg of verifyResult.errors) {
+        log2.error(`[binary-lifecycle] ${msg}`);
+        errors.push(msg);
+      }
+      if (verifyResult.remaining > 0) {
+        const msg = `redirect verification failed for ${asset.originalPath}: ${verifyResult.remaining} local reference(s) remain`;
+        log2.warn(`[binary-lifecycle] ${msg}`);
+        errors.push(msg);
+      }
+      continue;
     }
+    asset.status = "redirected";
+    asset.redirectedAt = redirectedAt;
+    redirected++;
+    log2.info(`[binary-lifecycle] redirected: ${asset.originalPath}`);
   }
   return { redirected, errors };
 }
-async function stageClean(memoryDir, assets, gracePeriodDays, log2, dryRun, forceClean) {
+async function countRemainingLocalReferences(memoryDir, asset, assetAbsolute, mdFiles, readMarkdownFile) {
+  let remaining = 0;
+  const errors = [];
+  for (const mdPath of mdFiles) {
+    try {
+      const content = await readMarkdownFile(mdPath);
+      const pattern = markdownReferencePattern(asset, assetAbsolute, mdPath);
+      if (pattern.test(content)) {
+        remaining++;
+      }
+    } catch (err) {
+      errors.push(`redirect verification failed for ${mdPath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return { remaining, errors };
+}
+function markdownReferencePattern(asset, assetAbsolute, mdPath) {
+  const mdDir = path4.dirname(mdPath);
+  const candidates = /* @__PURE__ */ new Set();
+  const addCandidate = (candidate) => {
+    const normalized = candidate.split(path4.sep).join("/");
+    if (normalized.length === 0) return;
+    candidates.add(normalized);
+    const isParentTraversal = normalized === ".." || normalized.startsWith("../");
+    if (!normalized.startsWith("./") && !normalized.startsWith("/") && !isParentTraversal) {
+      candidates.add(`./${normalized}`);
+    }
+  };
+  addCandidate(path4.relative(mdDir, assetAbsolute));
+  const originalPath = asset.originalPath.split(path4.sep).join("/");
+  const originalAsFileRelative = path4.resolve(mdDir, ...originalPath.split("/"));
+  if (path4.resolve(originalAsFileRelative) === path4.resolve(assetAbsolute)) {
+    addCandidate(originalPath);
+  }
+  addCandidate(`/${originalPath}`);
+  const alternatives = [...candidates].sort((a, b) => b.length - a.length).map(escapeRegex).join("|");
+  return new RegExp(`(!?\\[[^\\]]*\\]\\()(${alternatives})(\\))`, "g");
+}
+async function stageClean(memoryDir, assets, backend, gracePeriodDays, log2, dryRun, forceClean) {
   let cleaned = 0;
   const errors = [];
   const now = Date.now();
@@ -1297,11 +1592,44 @@ async function stageClean(memoryDir, assets, gracePeriodDays, log2, dryRun, forc
   );
   for (const asset of candidates) {
     const mirroredMs = new Date(asset.mirroredAt).getTime();
+    if (!Number.isFinite(mirroredMs)) {
+      const msg = `clean blocked for ${asset.originalPath}: manifest mirroredAt is invalid`;
+      log2.error(`[binary-lifecycle] ${msg}`);
+      errors.push(msg);
+      if (!dryRun) {
+        asset.status = "error";
+      }
+      continue;
+    }
     const ageMs = now - mirroredMs;
     if (!forceClean && ageMs < graceMs) {
       continue;
     }
-    const fullPath = path4.join(memoryDir, asset.originalPath);
+    const fullPath = resolveManifestAssetPath(memoryDir, asset.originalPath);
+    if (fullPath === null) {
+      const msg = `clean blocked for ${asset.originalPath}: manifest path is outside memoryDir`;
+      log2.error(`[binary-lifecycle] ${msg}`);
+      errors.push(msg);
+      if (!dryRun) {
+        asset.status = "error";
+      }
+      continue;
+    }
+    let remoteExists;
+    try {
+      remoteExists = await backend.exists(asset.mirroredPath);
+    } catch (err) {
+      const msg = `clean blocked for ${asset.originalPath}: failed to verify mirrored copy: ${err instanceof Error ? err.message : String(err)}`;
+      log2.error(`[binary-lifecycle] ${msg}`);
+      errors.push(msg);
+      continue;
+    }
+    if (!remoteExists) {
+      const msg = `clean blocked for ${asset.originalPath}: mirrored copy is missing`;
+      log2.error(`[binary-lifecycle] ${msg}`);
+      errors.push(msg);
+      continue;
+    }
     try {
       const currentHash = await hashFile2(fullPath);
       if (currentHash !== asset.contentHash) {
@@ -1319,9 +1647,11 @@ async function stageClean(memoryDir, assets, gracePeriodDays, log2, dryRun, forc
       log2.info(`[binary-lifecycle] cleaned: ${asset.originalPath}${dryRun ? " [dry-run]" : ""}`);
     } catch (err) {
       if (err.code === "ENOENT") {
-        asset.status = "cleaned";
-        asset.cleanedAt = (/* @__PURE__ */ new Date()).toISOString();
-        cleaned++;
+        if (!dryRun) {
+          asset.status = "cleaned";
+          asset.cleanedAt = (/* @__PURE__ */ new Date()).toISOString();
+          cleaned++;
+        }
       } else {
         const msg = `clean failed for ${asset.originalPath}: ${err instanceof Error ? err.message : String(err)}`;
         log2.error(`[binary-lifecycle] ${msg}`);
@@ -1378,10 +1708,18 @@ async function runBinaryLifecyclePipeline(memoryDir, config, backend, log2, opts
     log2,
     dryRun
   );
-  const redirectResult = await stageRedirect(memoryDir, manifest.assets, log2, dryRun);
+  const redirectResult = await stageRedirect(
+    memoryDir,
+    manifest.assets,
+    log2,
+    dryRun,
+    opts?.readMarkdownFile ?? ((filePath) => fsp4.readFile(filePath, "utf-8")),
+    opts?.writeMarkdownFile ?? ((filePath, content) => fsp4.writeFile(filePath, content, "utf-8"))
+  );
   const cleanResult = await stageClean(
     memoryDir,
     manifest.assets,
+    backend,
     config.gracePeriodDays,
     log2,
     dryRun,
@@ -1407,7 +1745,7 @@ async function runBinaryLifecyclePipeline(memoryDir, config, backend, log2, opts
 }
 
 // src/projection/index.ts
-import fs2 from "fs";
+import fs from "fs";
 import path5 from "path";
 var VALID_PROJECTION_CATEGORIES = new Set(ALL_CATEGORY_KEYS);
 async function generateContextTree(options) {
@@ -1426,14 +1764,14 @@ async function generateContextTree(options) {
   const resolvedMemoryDir = path5.resolve(memoryDir);
   const resolvedOutputDir = path5.resolve(outputDir);
   const requestedCategories = validateProjectionCategories(filterCategories);
-  const realMemoryDir = fs2.realpathSync(resolvedMemoryDir);
+  const realMemoryDir = fs.realpathSync(resolvedMemoryDir);
   assertNotSymlink(resolvedOutputDir, "context tree outputDir");
-  fs2.mkdirSync(resolvedOutputDir, { recursive: true });
-  const realOutputDir = fs2.realpathSync(resolvedOutputDir);
+  fs.mkdirSync(resolvedOutputDir, { recursive: true });
+  const realOutputDir = fs.realpathSync(resolvedOutputDir);
   const allCategories = (requestedCategories ?? ALL_CATEGORY_KEYS).filter((c) => c !== "question");
   for (const category of allCategories) {
     const categoryDir = getCategoryDir(memoryDir, category);
-    if (!fs2.existsSync(categoryDir)) continue;
+    if (!fs.existsSync(categoryDir)) continue;
     assertSafeInputRoot(realMemoryDir, categoryDir, `${category} memory category`);
     categoryCounts[category] = 0;
     const files = walkR(categoryDir, realMemoryDir);
@@ -1443,7 +1781,7 @@ async function generateContextTree(options) {
         nodesSkipped++;
         continue;
       }
-      const content = fs2.readFileSync(filePath, "utf8");
+      const content = fs.readFileSync(filePath, "utf8");
       const fm = parseFrontmatter(content);
       if (!fm) {
         nodesSkipped++;
@@ -1463,7 +1801,7 @@ async function generateContextTree(options) {
   }
   if (includeEntities) {
     const entitiesDir = path5.join(memoryDir, "entities");
-    if (fs2.existsSync(entitiesDir)) {
+    if (fs.existsSync(entitiesDir)) {
       assertSafeInputRoot(realMemoryDir, entitiesDir, "entities root");
       categoryCounts["entity"] = 0;
       const entityFiles = walkR(entitiesDir, realMemoryDir);
@@ -1473,7 +1811,7 @@ async function generateContextTree(options) {
           nodesSkipped++;
           continue;
         }
-        const content = fs2.readFileSync(filePath, "utf8");
+        const content = fs.readFileSync(filePath, "utf8");
         const fileName = path5.basename(filePath, ".md");
         const node = projectEntityNode(fileName, content);
         const outputPath = resolveContainedOutputPath(realOutputDir, "entities", `${fileName}.md`);
@@ -1487,7 +1825,7 @@ async function generateContextTree(options) {
   const shouldIncludeQuestions = includeQuestions && (requestedCategories === void 0 || requestedCategories.includes("question"));
   if (shouldIncludeQuestions) {
     const questionsDir = path5.join(memoryDir, "questions");
-    if (fs2.existsSync(questionsDir)) {
+    if (fs.existsSync(questionsDir)) {
       assertSafeInputRoot(realMemoryDir, questionsDir, "questions root");
       categoryCounts["question"] = 0;
       const qFiles = walkR(questionsDir, realMemoryDir);
@@ -1497,7 +1835,7 @@ async function generateContextTree(options) {
           nodesSkipped++;
           continue;
         }
-        const content = fs2.readFileSync(filePath, "utf8");
+        const content = fs.readFileSync(filePath, "utf8");
         const fm = parseFrontmatter(content);
         if (!fm) {
           nodesSkipped++;
@@ -1532,7 +1870,7 @@ function isPathInside(root, candidate) {
 }
 function assertNotSymlink(targetPath, label) {
   try {
-    if (fs2.lstatSync(targetPath).isSymbolicLink()) {
+    if (fs.lstatSync(targetPath).isSymbolicLink()) {
       throw new Error(`${label} must not be a symlink: ${targetPath}`);
     }
   } catch (err) {
@@ -1541,14 +1879,14 @@ function assertNotSymlink(targetPath, label) {
   }
 }
 function assertSafeInputRoot(realMemoryDir, targetPath, label) {
-  const stat = fs2.lstatSync(targetPath);
+  const stat = fs.lstatSync(targetPath);
   if (stat.isSymbolicLink()) {
     throw new Error(`${label} must not be a symlink: ${targetPath}`);
   }
   if (!stat.isDirectory()) {
     throw new Error(`${label} must be a directory: ${targetPath}`);
   }
-  const realTarget = fs2.realpathSync(targetPath);
+  const realTarget = fs.realpathSync(targetPath);
   if (!isPathInside(realMemoryDir, realTarget)) {
     throw new Error(`${label} escapes memoryDir: ${targetPath}`);
   }
@@ -1562,7 +1900,7 @@ function assertSafeOutputTarget(realOutputDir, outputPath) {
   for (const segment of relative.split(path5.sep).filter(Boolean)) {
     current = path5.join(current, segment);
     try {
-      const stat = fs2.lstatSync(current);
+      const stat = fs.lstatSync(current);
       if (stat.isSymbolicLink()) {
         throw new Error(`context tree output path contains symlink: ${current}`);
       }
@@ -1599,13 +1937,13 @@ function resolveContainedOutputPath(outputRoot, ...segments) {
 }
 function writeProjectedContent(realOutputDir, outputPath, generatedContent) {
   assertSafeOutputTarget(realOutputDir, outputPath);
-  fs2.mkdirSync(path5.dirname(outputPath), { recursive: true });
-  const realParent = fs2.realpathSync(path5.dirname(outputPath));
+  fs.mkdirSync(path5.dirname(outputPath), { recursive: true });
+  const realParent = fs.realpathSync(path5.dirname(outputPath));
   if (!isPathInside(realOutputDir, realParent)) {
     throw new Error(`context tree output path escapes outputDir: ${outputPath}`);
   }
-  const existingContent = fs2.existsSync(outputPath) ? fs2.readFileSync(outputPath, "utf8") : "";
-  fs2.writeFileSync(
+  const existingContent = fs.existsSync(outputPath) ? fs.readFileSync(outputPath, "utf8") : "";
+  fs.writeFileSync(
     outputPath,
     preserveManualFencedBlocks(generatedContent, existingContent)
   );
@@ -1638,19 +1976,19 @@ function extractManualFencedBlocks(content) {
 function walkR(dir, realMemoryDir) {
   const results = [];
   function walk(directory) {
-    for (const entry of fs2.readdirSync(directory, { withFileTypes: true })) {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
       const fullPath = path5.join(directory, entry.name);
       if (entry.isSymbolicLink()) {
         throw new Error(`context tree input path contains symlink: ${fullPath}`);
       }
       if (entry.isDirectory()) {
-        const realDir = fs2.realpathSync(fullPath);
+        const realDir = fs.realpathSync(fullPath);
         if (!isPathInside(realMemoryDir, realDir)) {
           throw new Error(`context tree input path escapes memoryDir: ${fullPath}`);
         }
         walk(fullPath);
       } else if (entry.name.endsWith(".md")) {
-        const realFile = fs2.realpathSync(fullPath);
+        const realFile = fs.realpathSync(fullPath);
         if (!isPathInside(realMemoryDir, realFile)) {
           throw new Error(`context tree input path escapes memoryDir: ${fullPath}`);
         }
@@ -1796,7 +2134,7 @@ function generateIndex(categoryCounts, outputDir) {
 }
 
 // src/onboarding/index.ts
-import fs3 from "fs";
+import fs2 from "fs";
 import path6 from "path";
 var LANGUAGE_RULES = [
   {
@@ -1902,7 +2240,7 @@ function onboard(options) {
   const directory = path6.resolve(options.directory ?? process.cwd());
   let rootStat;
   try {
-    rootStat = fs3.statSync(directory);
+    rootStat = fs2.statSync(directory);
   } catch (err) {
     throw new Error(`Cannot scan onboarding directory ${directory}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -1932,7 +2270,7 @@ function walkDir(root, exclude, maxDepth) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs3.readdirSync(dir, { withFileTypes: true });
+      entries = fs2.readdirSync(dir, { withFileTypes: true });
     } catch (err) {
       if (depth === 0) {
         throw new Error(`Cannot scan onboarding directory ${root}: ${err instanceof Error ? err.message : String(err)}`);
@@ -2008,7 +2346,7 @@ function detectShape(files, root) {
   );
   const rootDirs = /* @__PURE__ */ new Set();
   try {
-    for (const entry of fs3.readdirSync(root, { withFileTypes: true })) {
+    for (const entry of fs2.readdirSync(root, { withFileTypes: true })) {
       if (entry.isDirectory()) rootDirs.add(entry.name);
     }
   } catch {
@@ -2089,7 +2427,7 @@ function discoverDocs(files, root) {
     if (kind) {
       let size = 0;
       try {
-        size = fs3.statSync(filePath).size;
+        size = fs2.statSync(filePath).size;
       } catch {
       }
       docs.push({
@@ -2131,14 +2469,14 @@ function buildPlan(languages, shape, docs, _root) {
 }
 function readJsonSafe(filePath) {
   try {
-    return JSON.parse(fs3.readFileSync(filePath, "utf8"));
+    return JSON.parse(fs2.readFileSync(filePath, "utf8"));
   } catch {
     return null;
   }
 }
 function readTomlWorkspace(filePath) {
   try {
-    const content = fs3.readFileSync(filePath, "utf8");
+    const content = fs2.readFileSync(filePath, "utf8");
     return content.includes("[workspace]");
   } catch {
     return false;
@@ -2146,7 +2484,7 @@ function readTomlWorkspace(filePath) {
 }
 
 // src/curation/index.ts
-import fs4 from "fs";
+import fs3 from "fs";
 import path7 from "path";
 import crypto4 from "crypto";
 async function curate(options) {
@@ -2232,12 +2570,12 @@ async function curate(options) {
   };
 }
 function resolveTargets(targetPath) {
-  const stat = fs4.statSync(targetPath);
+  const stat = fs3.statSync(targetPath);
   if (stat.isFile()) return [targetPath];
   const results = [];
   const extensions = /* @__PURE__ */ new Set([".md", ".txt", ".mdx", ".rst"]);
   function walk(dir) {
-    for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
       const fullPath = path7.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name !== "node_modules" && entry.name !== ".git") {
@@ -2253,7 +2591,7 @@ function resolveTargets(targetPath) {
 }
 function resolveProvenanceRoot(targetPath) {
   const resolvedTarget = path7.resolve(targetPath);
-  const stat = fs4.statSync(resolvedTarget);
+  const stat = fs3.statSync(resolvedTarget);
   return stat.isFile() ? path7.dirname(resolvedTarget) : resolvedTarget;
 }
 function extractStatements(content, filePath, projectRoot, source, sourceFileHash, categoryOverride, confidence, entityRef, tags) {
@@ -2348,11 +2686,11 @@ function findContradiction(stmt, existing) {
 }
 function loadExistingMemories(memoryDir) {
   const result = /* @__PURE__ */ new Map();
-  if (!fs4.existsSync(memoryDir)) return result;
+  if (!fs3.existsSync(memoryDir)) return result;
   const dirs = ALL_CATEGORY_DIRS;
   for (const dir of dirs) {
     const fullDir = path7.join(memoryDir, dir);
-    if (!fs4.existsSync(fullDir)) continue;
+    if (!fs3.existsSync(fullDir)) continue;
     walkFiles(fullDir, (filePath) => {
       const content = readFileSafe(filePath);
       if (!content) return;
@@ -2374,7 +2712,7 @@ function writeStatement(stmt, memoryDir) {
   const dateDir = now.toISOString().split("T")[0];
   const categoryDir = getCategoryDir(memoryDir, stmt.category);
   const dir = path7.join(categoryDir, dateDir);
-  fs4.mkdirSync(dir, { recursive: true });
+  fs3.mkdirSync(dir, { recursive: true });
   const fileName = `${stmt.category}-${Date.now()}-${stmt.id.slice(0, 8)}.md`;
   const filePath = path7.join(dir, fileName);
   const frontmatter = [
@@ -2396,7 +2734,7 @@ function writeStatement(stmt, memoryDir) {
 
 ${stmt.content}
 `;
-  fs4.writeFileSync(filePath, body);
+  fs3.writeFileSync(filePath, body);
   return filePath;
 }
 function generateId() {
@@ -2413,7 +2751,7 @@ function tierFromConfidence(confidence) {
 }
 function readFileSafe(filePath) {
   try {
-    return fs4.readFileSync(filePath, "utf8");
+    return fs3.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -2442,7 +2780,7 @@ function extractBody2(content) {
   return match ? match[1].trim() : content.trim();
 }
 function walkFiles(dir, callback) {
-  for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
     const fullPath = path7.join(dir, entry.name);
     if (entry.isDirectory()) {
       walkFiles(fullPath, callback);
@@ -2453,7 +2791,7 @@ function walkFiles(dir, callback) {
 }
 
 // src/dedup/index.ts
-import fs5 from "fs";
+import fs4 from "fs";
 import path8 from "path";
 import crypto5 from "crypto";
 var DEFAULT_DEDUP_THRESHOLD = 0.85;
@@ -2592,18 +2930,18 @@ function stripNegation(text) {
 function loadMemories(memoryDir, categories, maxLoad = 1e4) {
   const result = [];
   const allCategories = categories ?? ALL_CATEGORY_DIRS;
-  if (!fs5.existsSync(memoryDir)) return result;
-  const memoryRootReal = fs5.realpathSync(memoryDir);
+  if (!fs4.existsSync(memoryDir)) return result;
+  const memoryRootReal = fs4.realpathSync(memoryDir);
   for (const category of allCategories) {
     if (result.length >= maxLoad) break;
     const dir = path8.join(memoryDir, category);
-    if (!fs5.existsSync(dir)) continue;
-    const categoryStat = fs5.lstatSync(dir);
+    if (!fs4.existsSync(dir)) continue;
+    const categoryStat = fs4.lstatSync(dir);
     if (categoryStat.isSymbolicLink()) {
       throw new Error(`Refusing to scan symlinked memory category directory: ${dir}`);
     }
     if (!categoryStat.isDirectory()) continue;
-    const categoryRootReal = fs5.realpathSync(dir);
+    const categoryRootReal = fs4.realpathSync(dir);
     assertPathInsideRoot(memoryRootReal, categoryRootReal, dir);
     walkMdFiles(dir, memoryRootReal, categoryRootReal, (filePath) => {
       if (result.length >= maxLoad) return;
@@ -2627,14 +2965,14 @@ function hashContent2(content) {
 }
 function readFileSafe2(filePath, memoryRootReal, categoryRootReal) {
   try {
-    const fileStat = fs5.lstatSync(filePath);
+    const fileStat = fs4.lstatSync(filePath);
     if (fileStat.isSymbolicLink()) {
       throw new Error(`Refusing to read symlinked memory file: ${filePath}`);
     }
-    const fileReal = fs5.realpathSync(filePath);
+    const fileReal = fs4.realpathSync(filePath);
     assertPathInsideRoot(memoryRootReal, fileReal, filePath);
     assertPathInsideRoot(categoryRootReal, fileReal, filePath);
-    return fs5.readFileSync(filePath, "utf8");
+    return fs4.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -2664,13 +3002,13 @@ function assertPathInsideRoot(rootReal, targetReal, sourcePath) {
   throw new Error(`Refusing to scan memory path outside root: ${sourcePath}`);
 }
 function walkMdFiles(dir, memoryRootReal, categoryRootReal, callback) {
-  for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
     const fullPath = path8.join(dir, entry.name);
-    const entryStat = fs5.lstatSync(fullPath);
+    const entryStat = fs4.lstatSync(fullPath);
     if (entryStat.isSymbolicLink()) {
       throw new Error(`Refusing to scan symlinked memory path: ${fullPath}`);
     }
-    const entryReal = fs5.realpathSync(fullPath);
+    const entryReal = fs4.realpathSync(fullPath);
     assertPathInsideRoot(memoryRootReal, entryReal, fullPath);
     assertPathInsideRoot(categoryRootReal, entryReal, fullPath);
     if (entryStat.isDirectory()) {
@@ -2682,14 +3020,14 @@ function walkMdFiles(dir, memoryRootReal, categoryRootReal, callback) {
 }
 
 // src/review/index.ts
-import fs6 from "fs";
+import fs5 from "fs";
 import path9 from "path";
 var DEFAULT_CONFIDENCE_THRESHOLD = 0.7;
 function realMemoryRoot(memoryDir) {
   try {
-    const stat = fs6.lstatSync(memoryDir);
+    const stat = fs5.lstatSync(memoryDir);
     if (!stat.isDirectory() || stat.isSymbolicLink()) return null;
-    return fs6.realpathSync(memoryDir);
+    return fs5.realpathSync(memoryDir);
   } catch {
     return null;
   }
@@ -2700,21 +3038,21 @@ function isPathInside2(rootReal, candidateReal) {
 }
 function isSafeDirectory(rootReal, dir) {
   try {
-    const stat = fs6.lstatSync(dir);
+    const stat = fs5.lstatSync(dir);
     if (!stat.isDirectory() || stat.isSymbolicLink()) return false;
-    return isPathInside2(rootReal, fs6.realpathSync(dir));
+    return isPathInside2(rootReal, fs5.realpathSync(dir));
   } catch {
     return false;
   }
 }
 function ensureSafeDirectory(rootReal, dir) {
-  if (fs6.existsSync(dir)) {
+  if (fs5.existsSync(dir)) {
     if (!isSafeDirectory(rootReal, dir)) {
       throw new Error(`Refusing to write through unsafe review path: ${dir}`);
     }
     return;
   }
-  fs6.mkdirSync(dir, { recursive: true });
+  fs5.mkdirSync(dir, { recursive: true });
   if (!isSafeDirectory(rootReal, dir)) {
     throw new Error(`Refusing to write through unsafe review path: ${dir}`);
   }
@@ -2740,7 +3078,7 @@ function listReviewItems(options) {
     items.push(item);
   };
   const suggestionsDir = path9.join(memoryDir, "suggestions");
-  if (!isLimitReached() && fs6.existsSync(suggestionsDir) && isSafeDirectory(rootReal, suggestionsDir)) {
+  if (!isLimitReached() && fs5.existsSync(suggestionsDir) && isSafeDirectory(rootReal, suggestionsDir)) {
     walkMd(rootReal, suggestionsDir, (filePath, content) => {
       if (isLimitReached()) return true;
       const fm = parseFrontmatter4(content);
@@ -2761,7 +3099,7 @@ function listReviewItems(options) {
     });
   }
   const reviewDir = path9.join(memoryDir, "review");
-  if (!isLimitReached() && fs6.existsSync(reviewDir) && isSafeDirectory(rootReal, reviewDir)) {
+  if (!isLimitReached() && fs5.existsSync(reviewDir) && isSafeDirectory(rootReal, reviewDir)) {
     walkMd(rootReal, reviewDir, (filePath, content) => {
       if (isLimitReached()) return true;
       const fm = parseFrontmatter4(content);
@@ -2786,7 +3124,7 @@ function listReviewItems(options) {
   for (const category of categories) {
     if (isLimitReached()) break;
     const dir = path9.join(memoryDir, category);
-    if (!fs6.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    if (!fs5.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     walkMd(rootReal, dir, (filePath, content) => {
       if (isLimitReached()) return true;
       const fm = parseFrontmatter4(content);
@@ -2833,7 +3171,7 @@ function approveItem(memoryDir, itemId, options) {
   if (!found) {
     return { itemId, action: "approve", message: "Item not found" };
   }
-  const content = fs6.readFileSync(found.filePath, "utf8");
+  const content = fs5.readFileSync(found.filePath, "utf8");
   const fm = parseFrontmatter4(content);
   if (!fm) return { itemId, action: "approve", message: "Could not parse frontmatter" };
   const updatedContent = updateFrontmatterFields(content, {
@@ -2842,7 +3180,7 @@ function approveItem(memoryDir, itemId, options) {
     reviewDismissed: null
   });
   if (found.location === "category") {
-    fs6.writeFileSync(found.filePath, updatedContent, "utf8");
+    fs5.writeFileSync(found.filePath, updatedContent, "utf8");
     return {
       itemId,
       action: "approve",
@@ -2857,7 +3195,7 @@ function approveItem(memoryDir, itemId, options) {
   const outputPath = path9.join(targetDir, dateDir, path9.basename(found.filePath));
   ensureSafeDirectory(rootReal, path9.dirname(outputPath));
   const promotedPath = writeFileWithoutClobber(outputPath, updatedContent, itemId);
-  fs6.unlinkSync(found.filePath);
+  fs5.unlinkSync(found.filePath);
   return {
     itemId,
     action: "approve",
@@ -2871,11 +3209,11 @@ function dismissItem(memoryDir, itemId, options) {
     return { itemId, action: "dismiss", message: "Item not found" };
   }
   if (found.location === "queue") {
-    fs6.unlinkSync(found.filePath);
+    fs5.unlinkSync(found.filePath);
     return { itemId, action: "dismiss", message: "Dismissed and removed" };
   }
-  const content = fs6.readFileSync(found.filePath, "utf8");
-  fs6.writeFileSync(
+  const content = fs5.readFileSync(found.filePath, "utf8");
+  fs5.writeFileSync(
     found.filePath,
     updateFrontmatterFields(content, {
       reviewDismissed: "true",
@@ -2895,12 +3233,12 @@ function flagItem(memoryDir, itemId, options) {
   if (!found) {
     return { itemId, action: "flag", message: "Item not found" };
   }
-  const content = fs6.readFileSync(found.filePath, "utf8");
+  const content = fs5.readFileSync(found.filePath, "utf8");
   const fixed = updateFrontmatterFields(content, {
     flagged: "true",
     flaggedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
-  fs6.writeFileSync(found.filePath, fixed);
+  fs5.writeFileSync(found.filePath, fixed);
   return {
     itemId,
     action: "flag",
@@ -2913,13 +3251,13 @@ function findReviewFileById(memoryDir, id, options = {}) {
   if (!rootReal) return null;
   for (const loc of ["suggestions", "review"]) {
     const dir = path9.join(memoryDir, loc);
-    if (!fs6.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    if (!fs5.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     const found = findFileById(rootReal, dir, id);
     if (found) return { filePath: found, location: "queue" };
   }
   for (const category of ALL_CATEGORY_DIRS) {
     const dir = path9.join(memoryDir, category);
-    if (!fs6.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
+    if (!fs5.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     const found = findFileById(rootReal, dir, id, (fm) => isLowConfidenceReviewCandidate(fm, options));
     if (found) return { filePath: found, location: "category" };
   }
@@ -2985,7 +3323,7 @@ function updateFrontmatterFields(content, fields) {
 }
 function readFileSafe3(filePath) {
   try {
-    return fs6.readFileSync(filePath, "utf8");
+    return fs5.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -2999,7 +3337,7 @@ function writeFileWithoutClobber(basePath, content, discriminator) {
       `${parsed.name}-${safeDiscriminator}${attempt === 1 ? "" : `-${attempt}`}${parsed.ext || ".md"}`
     );
     try {
-      fs6.writeFileSync(candidate, content, { encoding: "utf8", flag: "wx" });
+      fs5.writeFileSync(candidate, content, { encoding: "utf8", flag: "wx" });
       return candidate;
     } catch (error) {
       if (error.code === "EEXIST") continue;
@@ -3049,7 +3387,7 @@ function extractBody4(content) {
 }
 function walkMd(rootReal, dir, callback) {
   if (!isSafeDirectory(rootReal, dir)) return false;
-  for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
     const fullPath = path9.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
@@ -3064,7 +3402,7 @@ function walkMd(rootReal, dir, callback) {
 function walkMdPaths(rootReal, dir) {
   const results = [];
   if (!isSafeDirectory(rootReal, dir)) return results;
-  for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
     const fullPath = path9.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
@@ -3077,7 +3415,7 @@ function walkMdPaths(rootReal, dir) {
 }
 
 // src/sync/index.ts
-import fs7 from "fs";
+import fs6 from "fs";
 import path10 from "path";
 import crypto6 from "crypto";
 var DEFAULT_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".txt", ".mdx", ".rst"]);
@@ -3116,8 +3454,8 @@ function syncChanges(options) {
     for (const [relPath, hash] of Object.entries(currentFiles)) {
       newState.fileHashes[relPath] = hash;
     }
-    fs7.mkdirSync(path10.dirname(stateFilePath), { recursive: true });
-    fs7.writeFileSync(stateFilePath, JSON.stringify(newState, null, 2));
+    fs6.mkdirSync(path10.dirname(stateFilePath), { recursive: true });
+    fs6.writeFileSync(stateFilePath, JSON.stringify(newState, null, 2));
   }
   return {
     scanned: Object.keys(currentFiles).length,
@@ -3171,7 +3509,7 @@ function scanFiles(root, extensions, exclude) {
   function walk(dir, isRoot = false) {
     let entries;
     try {
-      entries = fs7.readdirSync(dir, { withFileTypes: true });
+      entries = fs6.readdirSync(dir, { withFileTypes: true });
     } catch (err) {
       if (isRoot) {
         throw new Error(
@@ -3190,7 +3528,7 @@ function scanFiles(root, extensions, exclude) {
         if (!extensions.has(ext)) continue;
         const relPath = path10.relative(root, fullPath);
         try {
-          const content = fs7.readFileSync(fullPath, "utf8");
+          const content = fs6.readFileSync(fullPath, "utf8");
           result[relPath] = hashContent3(content);
         } catch {
         }
@@ -3207,7 +3545,7 @@ function computeDiff(current, previous, sourceDir) {
     if (!(relPath in previous)) {
       let size = 0;
       try {
-        size = fs7.statSync(fullPath).size;
+        size = fs6.statSync(fullPath).size;
       } catch {
       }
       changes.push({
@@ -3220,7 +3558,7 @@ function computeDiff(current, previous, sourceDir) {
     } else if (previous[relPath] !== hash) {
       let size = 0;
       try {
-        size = fs7.statSync(fullPath).size;
+        size = fs6.statSync(fullPath).size;
       } catch {
       }
       changes.push({
@@ -3248,7 +3586,7 @@ function computeDiff(current, previous, sourceDir) {
 }
 function loadState(stateFilePath) {
   try {
-    const raw = fs7.readFileSync(stateFilePath, "utf8");
+    const raw = fs6.readFileSync(stateFilePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return {
@@ -3263,7 +3601,7 @@ function hashContent3(content) {
 }
 
 // src/spaces/index.ts
-import fs8 from "fs";
+import fs7 from "fs";
 import path11 from "path";
 import crypto7 from "crypto";
 var MANIFEST_VERSION = 1;
@@ -3279,7 +3617,7 @@ function getManifestPath(baseDir) {
 }
 function loadManifest(baseDir, memoryDirOverride) {
   const manifestPath2 = getManifestPath(baseDir);
-  if (!fs8.existsSync(manifestPath2)) {
+  if (!fs7.existsSync(manifestPath2)) {
     const personalSpace = createPersonalSpace(baseDir, memoryDirOverride);
     const manifest = {
       activeSpaceId: personalSpace.id,
@@ -3289,19 +3627,19 @@ function loadManifest(baseDir, memoryDirOverride) {
     saveManifest(manifest, baseDir);
     return manifest;
   }
-  const raw = JSON.parse(fs8.readFileSync(manifestPath2, "utf8"));
+  const raw = JSON.parse(fs7.readFileSync(manifestPath2, "utf8"));
   return raw;
 }
 function saveManifest(manifest, baseDir) {
   const manifestPath2 = getManifestPath(baseDir);
-  fs8.mkdirSync(path11.dirname(manifestPath2), { recursive: true });
-  fs8.writeFileSync(manifestPath2, JSON.stringify(manifest, null, 2) + "\n");
+  fs7.mkdirSync(path11.dirname(manifestPath2), { recursive: true });
+  fs7.writeFileSync(manifestPath2, JSON.stringify(manifest, null, 2) + "\n");
 }
 function createPersonalSpace(baseDir, memoryDirOverride) {
   const homeDir = baseDir ?? resolveHomeDir();
   const standalonePath = path11.join(homeDir, ".engram", "memory");
   const openclawPath = path11.join(homeDir, ".openclaw", "workspace", "memory", "local");
-  const memoryDir = memoryDirOverride ?? readEnvVar("REMNIC_MEMORY_DIR") ?? readEnvVar("ENGRAM_MEMORY_DIR") ?? (fs8.existsSync(standalonePath) ? standalonePath : fs8.existsSync(openclawPath) ? openclawPath : standalonePath);
+  const memoryDir = memoryDirOverride ?? readEnvVar("REMNIC_MEMORY_DIR") ?? readEnvVar("ENGRAM_MEMORY_DIR") ?? (fs7.existsSync(standalonePath) ? standalonePath : fs7.existsSync(openclawPath) ? openclawPath : standalonePath);
   const normalizedMemoryDir = normalizeSpaceMemoryDir(memoryDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   return {
@@ -3353,7 +3691,7 @@ function createSpace(options) {
     owner: readEnvVar("USER"),
     parentSpaceId: options.parentSpaceId
   };
-  fs8.mkdirSync(memoryDir, { recursive: true });
+  fs7.mkdirSync(memoryDir, { recursive: true });
   manifest.spaces.push(space);
   manifest.updatedAt = now;
   saveManifest(manifest, options.baseDir);
@@ -3528,30 +3866,30 @@ function mergeSpaces(sourceSpaceId, targetSpaceId, options) {
 }
 function getAuditLog(baseDir) {
   const auditPath = path11.join(getSpacesDir(baseDir), "audit.jsonl");
-  if (!fs8.existsSync(auditPath)) return [];
-  const lines = fs8.readFileSync(auditPath, "utf8").trim().split("\n");
+  if (!fs7.existsSync(auditPath)) return [];
+  const lines = fs7.readFileSync(auditPath, "utf8").trim().split("\n");
   return lines.filter((l) => l.trim()).map((l) => JSON.parse(l));
 }
 function appendAudit(entry, baseDir) {
   const auditPath = path11.join(getSpacesDir(baseDir), "audit.jsonl");
-  fs8.mkdirSync(path11.dirname(auditPath), { recursive: true });
+  fs7.mkdirSync(path11.dirname(auditPath), { recursive: true });
   const full = {
     id: crypto7.randomUUID(),
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     ...entry
   };
-  fs8.appendFileSync(auditPath, JSON.stringify(full) + "\n");
+  fs7.appendFileSync(auditPath, JSON.stringify(full) + "\n");
 }
 function copyMemories(sourceDir, targetDir, options) {
   let merged = 0;
   const conflicts = [];
   let skipped = 0;
-  if (!fs8.existsSync(sourceDir)) {
+  if (!fs7.existsSync(sourceDir)) {
     return { merged: 0, conflicts: [], skipped: 0 };
   }
-  const sourceRoot = fs8.realpathSync(sourceDir);
-  fs8.mkdirSync(targetDir, { recursive: true });
-  const targetRoot = fs8.realpathSync(targetDir);
+  const sourceRoot = fs7.realpathSync(sourceDir);
+  fs7.mkdirSync(targetDir, { recursive: true });
+  const targetRoot = fs7.realpathSync(targetDir);
   const sourceFiles = walkMd2(sourceRoot);
   for (const sourcePath of sourceFiles) {
     const sourceRealPath = safeRealpath(sourcePath);
@@ -3564,7 +3902,7 @@ function copyMemories(sourceDir, targetDir, options) {
       skipped++;
       continue;
     }
-    const content = fs8.readFileSync(sourcePath, "utf8");
+    const content = fs7.readFileSync(sourcePath, "utf8");
     const relativePath = path11.relative(sourceRoot, sourceRealPath);
     const targetPath = path11.resolve(targetRoot, relativePath);
     if (!isPathInsideRoot(targetPath, targetRoot)) {
@@ -3579,7 +3917,7 @@ function copyMemories(sourceDir, targetDir, options) {
         continue;
       }
     }
-    if (fs8.existsSync(targetPath)) {
+    if (fs7.existsSync(targetPath)) {
       const targetStat = safeLstat(targetPath);
       if (!targetStat?.isFile() || targetStat.isSymbolicLink()) {
         skipped++;
@@ -3591,8 +3929,8 @@ function copyMemories(sourceDir, targetDir, options) {
         continue;
       }
     }
-    if (fs8.existsSync(targetPath) && !options?.force) {
-      const targetContent = fs8.readFileSync(targetPath, "utf8");
+    if (fs7.existsSync(targetPath) && !options?.force) {
+      const targetContent = fs7.readFileSync(targetPath, "utf8");
       const targetHash = hashContent4(targetContent);
       if (sourceHash !== targetHash) {
         conflicts.push({
@@ -3608,13 +3946,13 @@ function copyMemories(sourceDir, targetDir, options) {
       skipped++;
       continue;
     }
-    fs8.mkdirSync(path11.dirname(targetPath), { recursive: true });
+    fs7.mkdirSync(path11.dirname(targetPath), { recursive: true });
     const targetParentRealPath = safeRealpath(path11.dirname(targetPath));
     if (!targetParentRealPath || !isPathInsideRoot(targetParentRealPath, targetRoot)) {
       skipped++;
       continue;
     }
-    fs8.writeFileSync(targetPath, content);
+    fs7.writeFileSync(targetPath, content);
     merged++;
   }
   return { merged, conflicts, skipped };
@@ -3625,7 +3963,7 @@ function hashContent4(content) {
 function walkMd2(dir) {
   const results = [];
   function walk(d) {
-    for (const entry of fs8.readdirSync(d, { withFileTypes: true })) {
+    for (const entry of fs7.readdirSync(d, { withFileTypes: true })) {
       const fullPath = path11.join(d, entry.name);
       if (entry.isSymbolicLink()) {
         continue;
@@ -3642,14 +3980,14 @@ function walkMd2(dir) {
 }
 function safeLstat(filePath) {
   try {
-    return fs8.lstatSync(filePath);
+    return fs7.lstatSync(filePath);
   } catch {
     return null;
   }
 }
 function safeRealpath(filePath) {
   try {
-    return fs8.realpathSync(filePath);
+    return fs7.realpathSync(filePath);
   } catch {
     return null;
   }
@@ -3775,7 +4113,7 @@ var REMNIC_RECALL_DECISION_RULES = `## When to Use Recall vs Direct Read
 `;
 
 // src/memory-extension/codex-publisher.ts
-import fs9 from "fs";
+import fs8 from "fs";
 import os from "os";
 import path12 from "path";
 var REMNIC_EXTENSION_DIR_NAME = "remnic";
@@ -3810,7 +4148,7 @@ var CodexMemoryExtensionPublisher = class {
   async isHostAvailable() {
     try {
       const home = readEnvVar("CODEX_HOME")?.trim() || path12.join(resolveHomeDir(), ".codex");
-      return fs9.existsSync(home);
+      return fs8.existsSync(home);
     } catch {
       return false;
     }
@@ -3864,18 +4202,18 @@ When running inside the Codex phase-2 consolidation sandbox:
     const filesWritten = [];
     const skipped = [];
     ctx.log.info(`Publishing Codex memory extension to ${extensionRoot}`);
-    fs9.mkdirSync(extensionRoot, { recursive: true });
+    fs8.mkdirSync(extensionRoot, { recursive: true });
     const content = await this.renderInstructions(ctx);
     const tmpPath = `${instructionsPath}.tmp-${process.pid}-${Date.now()}`;
     try {
-      fs9.writeFileSync(tmpPath, content, "utf-8");
-      fs9.renameSync(tmpPath, instructionsPath);
+      fs8.writeFileSync(tmpPath, content, "utf-8");
+      fs8.renameSync(tmpPath, instructionsPath);
       filesWritten.push(instructionsPath);
       ctx.log.info(`Wrote ${instructionsPath}`);
     } catch (err) {
       try {
-        if (fs9.existsSync(tmpPath)) {
-          fs9.unlinkSync(tmpPath);
+        if (fs8.existsSync(tmpPath)) {
+          fs8.unlinkSync(tmpPath);
         }
       } catch {
       }
@@ -3890,8 +4228,8 @@ When running inside the Codex phase-2 consolidation sandbox:
   }
   async unpublish() {
     const extensionRoot = await this.resolveExtensionRoot();
-    if (fs9.existsSync(extensionRoot)) {
-      fs9.rmSync(extensionRoot, { recursive: true, force: true });
+    if (fs8.existsSync(extensionRoot)) {
+      fs8.rmSync(extensionRoot, { recursive: true, force: true });
     }
   }
 };