@remnic/core 9.3.548 → 9.3.549

package/dist/access-cli.js

@@ -1,9 +1,9 @@
 import {
   Orchestrator
-} from "./chunk-OF46AKZC.js";
+} from "./chunk-XDMLTNIG.js";
 import "./chunk-5RIRL3XL.js";
 import "./chunk-BFBF3XEF.js";
-import "./chunk-S53PKKWK.js";
+import "./chunk-KVEVLBKC.js";
 import "./chunk-HHLLAQGZ.js";
 import "./chunk-UWK5OXUJ.js";
 import "./chunk-RLV3PQGH.js";

package/dist/access-schema.d.ts

@@ -104,9 +104,9 @@ declare const recallRequestSchema: z.ZodObject<{
     includeLowConfidence: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     query: string;
+    namespace?: string | undefined;
     sessionKey?: string | undefined;
     tags?: string[] | undefined;
-    namespace?: string | undefined;
     topK?: number | undefined;
     mode?: "no_recall" | "minimal" | "full" | "graph_mode" | "auto" | undefined;
     cwd?: string | undefined;
@@ -125,9 +125,9 @@ declare const recallRequestSchema: z.ZodObject<{
     tagMatch?: "all" | "any" | undefined;
 }, {
     query: string;
+    namespace?: string | undefined;
     sessionKey?: string | undefined;
     tags?: string[] | undefined;
-    namespace?: string | undefined;
     topK?: number | undefined;
     mode?: "no_recall" | "minimal" | "full" | "graph_mode" | "auto" | undefined;
     cwd?: string | undefined;
@@ -149,11 +149,11 @@ declare const recallExplainRequestSchema: z.ZodObject<{
     sessionKey: z.ZodOptional<z.ZodString>;
     namespace: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    sessionKey?: string | undefined;
     namespace?: string | undefined;
-}, {
     sessionKey?: string | undefined;
+}, {
     namespace?: string | undefined;
+    sessionKey?: string | undefined;
 }>;
 /**
  * Standalone "set coding context" request. Used by the HTTP endpoint
@@ -363,28 +363,28 @@ declare const memoryStoreRequestSchema: z.ZodObject<{
     sourceReason: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     content: string;
+    namespace?: string | undefined;
+    category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
+    confidence?: number | undefined;
+    ttl?: string | undefined;
     schemaVersion?: number | undefined;
     sessionKey?: string | undefined;
     tags?: string[] | undefined;
     dryRun?: boolean | undefined;
-    namespace?: string | undefined;
-    category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
-    confidence?: number | undefined;
     entityRef?: string | undefined;
-    ttl?: string | undefined;
     sourceReason?: string | undefined;
     idempotencyKey?: string | undefined;
 }, {
     content: string;
+    namespace?: string | undefined;
+    category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
+    confidence?: number | undefined;
+    ttl?: string | undefined;
     schemaVersion?: number | undefined;
     sessionKey?: string | undefined;
     tags?: string[] | undefined;
     dryRun?: boolean | undefined;
-    namespace?: string | undefined;
-    category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
-    confidence?: number | undefined;
     entityRef?: string | undefined;
-    ttl?: string | undefined;
     sourceReason?: string | undefined;
     idempotencyKey?: string | undefined;
 }>;
@@ -403,28 +403,28 @@ declare const suggestionSubmitRequestSchema: z.ZodObject<{
     sourceReason: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     content: string;
+    namespace?: string | undefined;
+    category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
+    confidence?: number | undefined;
+    ttl?: string | undefined;
     schemaVersion?: number | undefined;
     sessionKey?: string | undefined;
     tags?: string[] | undefined;
     dryRun?: boolean | undefined;
-    namespace?: string | undefined;
-    category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
-    confidence?: number | undefined;
     entityRef?: string | undefined;
-    ttl?: string | undefined;
     sourceReason?: string | undefined;
     idempotencyKey?: string | undefined;
 }, {
     content: string;
+    namespace?: string | undefined;
+    category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
+    confidence?: number | undefined;
+    ttl?: string | undefined;
     schemaVersion?: number | undefined;
     sessionKey?: string | undefined;
     tags?: string[] | undefined;
     dryRun?: boolean | undefined;
-    namespace?: string | undefined;
-    category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
-    confidence?: number | undefined;
     entityRef?: string | undefined;
-    ttl?: string | undefined;
     sourceReason?: string | undefined;
     idempotencyKey?: string | undefined;
 }>;
@@ -456,18 +456,18 @@ declare const trustZonePromoteRequestSchema: z.ZodObject<{
     recordId: string;
     targetZone: "working" | "trusted";
     promotionReason: string;
+    namespace?: string | undefined;
     recordedAt?: string | undefined;
     summary?: string | undefined;
     dryRun?: boolean | undefined;
-    namespace?: string | undefined;
 }, {
     recordId: string;
     targetZone: "working" | "trusted";
     promotionReason: string;
+    namespace?: string | undefined;
     recordedAt?: string | undefined;
     summary?: string | undefined;
     dryRun?: boolean | undefined;
-    namespace?: string | undefined;
 }>;
 declare const trustZoneDemoSeedRequestSchema: z.ZodObject<{
     scenario: z.ZodOptional<z.ZodString>;
@@ -475,14 +475,14 @@ declare const trustZoneDemoSeedRequestSchema: z.ZodObject<{
     dryRun: z.ZodOptional<z.ZodBoolean>;
     namespace: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
+    namespace?: string | undefined;
     recordedAt?: string | undefined;
     dryRun?: boolean | undefined;
-    namespace?: string | undefined;
     scenario?: string | undefined;
 }, {
+    namespace?: string | undefined;
     recordedAt?: string | undefined;
     dryRun?: boolean | undefined;
-    namespace?: string | undefined;
     scenario?: string | undefined;
 }>;
 declare const lcmSearchRequestSchema: z.ZodObject<{
@@ -493,15 +493,15 @@ declare const lcmSearchRequestSchema: z.ZodObject<{
     limit: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     query: string;
-    sessionKey?: string | undefined;
     namespace?: string | undefined;
     limit?: number | undefined;
+    sessionKey?: string | undefined;
     sessionPrefix?: string | undefined;
 }, {
     query: string;
-    sessionKey?: string | undefined;
     namespace?: string | undefined;
     limit?: number | undefined;
+    sessionKey?: string | undefined;
     sessionPrefix?: string | undefined;
 }>;
 declare const lcmCompactionFlushRequestSchema: z.ZodObject<{
@@ -535,12 +535,12 @@ declare const daySummaryRequestSchema: z.ZodObject<{
     sessionKey: z.ZodOptional<z.ZodString>;
     namespace: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    sessionKey?: string | undefined;
     namespace?: string | undefined;
+    sessionKey?: string | undefined;
     memories?: string | undefined;
 }, {
-    sessionKey?: string | undefined;
     namespace?: string | undefined;
+    sessionKey?: string | undefined;
     memories?: string | undefined;
 }>;
 declare const capsuleExportRequestSchema: z.ZodObject<{
@@ -730,11 +730,11 @@ declare const actionConfidenceRequestSchema: z.ZodObject<{
         safety: z.ZodEffects<z.ZodNullable<z.ZodOptional<z.ZodEnum<["safe", "requires-review", "blocked"]>>>, NonNullable<"safe" | "requires-review" | "blocked"> | undefined, "safe" | "requires-review" | "blocked" | null | undefined>;
         safetyReasons: z.ZodEffects<z.ZodNullable<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>, string[] | undefined, string[] | null | undefined>;
     }, "strict", z.ZodTypeAny, {
+        confidence?: number | undefined;
         source?: string | undefined;
         stale?: boolean | undefined;
         created?: string | undefined;
         updated?: string | undefined;
-        confidence?: number | undefined;
         scope?: string | undefined;
         retrievalReason?: string | undefined;
         safety?: NonNullable<"safe" | "requires-review" | "blocked"> | undefined;
@@ -744,11 +744,11 @@ declare const actionConfidenceRequestSchema: z.ZodObject<{
         safetyReasons?: string[] | undefined;
         userContextScopes?: string[] | undefined;
     }, {
+        confidence?: number | null | undefined;
         source?: string | null | undefined;
         stale?: boolean | null | undefined;
         created?: string | null | undefined;
         updated?: string | null | undefined;
-        confidence?: number | null | undefined;
         scope?: string | null | undefined;
         retrievalReason?: string | null | undefined;
         safety?: "safe" | "requires-review" | "blocked" | null | undefined;
@@ -758,11 +758,11 @@ declare const actionConfidenceRequestSchema: z.ZodObject<{
         safetyReasons?: string[] | null | undefined;
         userContextScopes?: string[] | null | undefined;
     }>, "many">>>, {
+        confidence?: number | undefined;
         source?: string | undefined;
         stale?: boolean | undefined;
         created?: string | undefined;
         updated?: string | undefined;
-        confidence?: number | undefined;
         scope?: string | undefined;
         retrievalReason?: string | undefined;
         safety?: NonNullable<"safe" | "requires-review" | "blocked"> | undefined;
@@ -772,11 +772,11 @@ declare const actionConfidenceRequestSchema: z.ZodObject<{
         safetyReasons?: string[] | undefined;
         userContextScopes?: string[] | undefined;
     }[] | undefined, {
+        confidence?: number | null | undefined;
         source?: string | null | undefined;
         stale?: boolean | null | undefined;
         created?: string | null | undefined;
         updated?: string | null | undefined;
-        confidence?: number | null | undefined;
         scope?: string | null | undefined;
         retrievalReason?: string | null | undefined;
         safety?: "safe" | "requires-review" | "blocked" | null | undefined;
@@ -798,11 +798,11 @@ declare const actionConfidenceRequestSchema: z.ZodObject<{
         matched?: boolean | undefined;
     }[] | undefined;
     retrievedMemories?: {
+        confidence?: number | undefined;
         source?: string | undefined;
         stale?: boolean | undefined;
         created?: string | undefined;
         updated?: string | undefined;
-        confidence?: number | undefined;
         scope?: string | undefined;
         retrievalReason?: string | undefined;
         safety?: NonNullable<"safe" | "requires-review" | "blocked"> | undefined;
@@ -824,11 +824,11 @@ declare const actionConfidenceRequestSchema: z.ZodObject<{
         matched?: boolean | null | undefined;
     }[] | null | undefined;
     retrievedMemories?: {
+        confidence?: number | null | undefined;
         source?: string | null | undefined;
         stale?: boolean | null | undefined;
         created?: string | null | undefined;
         updated?: string | null | undefined;
-        confidence?: number | null | undefined;
         scope?: string | null | undefined;
         retrievalReason?: string | null | undefined;
         safety?: "safe" | "requires-review" | "blocked" | null | undefined;

package/dist/{chunk-S53PKKWK.js → chunk-KVEVLBKC.js}

@@ -80,6 +80,12 @@ function backupRoot(homeDir) {
 function defaultRollbackCommand() {
   return "remnic migrate --rollback";
 }
+function resolveMigrationCwd(options) {
+  return path.resolve(options?.cwd ?? process.cwd());
+}
+function resolveConnectorConfigPath(candidate, cwd) {
+  return path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(cwd, candidate);
+}
 async function ensureParent(filePath) {
   await mkdir(path.dirname(filePath), { recursive: true });
 }
@@ -90,6 +96,9 @@ async function writeOwnerOnlyFile(filePath, content) {
   await writeFile(filePath, content, { encoding: "utf8", mode: TOKEN_STORE_MODE });
   await chmod(filePath, TOKEN_STORE_MODE);
 }
+async function fileContentHash(filePath) {
+  return createHash("sha256").update(await readFile(filePath)).digest("hex");
+}
 async function writeTokenStoreFile(filePath, content) {
   await writeOwnerOnlyFile(filePath, content);
 }
@@ -180,6 +189,183 @@ function parseTokenEntries(raw) {
 function isPlainJsonObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function parseRollbackManifestEntry(raw, index) {
+  if (!isPlainJsonObject(raw)) {
+    throw new Error(`rollback manifest entry ${index} must be an object`);
+  }
+  if (typeof raw.targetPath !== "string" || raw.targetPath.length === 0 || !path.isAbsolute(raw.targetPath)) {
+    throw new Error(`rollback manifest entry ${index} has an invalid targetPath`);
+  }
+  if (raw.backupPath !== void 0 && (typeof raw.backupPath !== "string" || raw.backupPath.length === 0 || !path.isAbsolute(raw.backupPath))) {
+    throw new Error(`rollback manifest entry ${index} has an invalid backupPath`);
+  }
+  if (raw.createdByMigration !== void 0 && typeof raw.createdByMigration !== "boolean") {
+    throw new Error(`rollback manifest entry ${index} has an invalid createdByMigration flag`);
+  }
+  if (raw.contentHash !== void 0 && (typeof raw.contentHash !== "string" || !/^[a-f0-9]{64}$/u.test(raw.contentHash))) {
+    throw new Error(`rollback manifest entry ${index} has an invalid contentHash`);
+  }
+  return {
+    targetPath: raw.targetPath,
+    ...raw.backupPath === void 0 ? {} : { backupPath: raw.backupPath },
+    ...raw.createdByMigration === void 0 ? {} : { createdByMigration: raw.createdByMigration },
+    ...raw.contentHash === void 0 ? {} : { contentHash: raw.contentHash }
+  };
+}
+function parseRollbackManifest(raw, manifestPath) {
+  if (!isPlainJsonObject(raw)) {
+    throw new Error(`rollback manifest must be an object: ${manifestPath}`);
+  }
+  if (raw.version !== 1) {
+    throw new Error(`rollback manifest has unsupported version: ${manifestPath}`);
+  }
+  if (typeof raw.createdAt !== "string") {
+    throw new Error(`rollback manifest has an invalid createdAt: ${manifestPath}`);
+  }
+  if (!Array.isArray(raw.entries)) {
+    throw new Error(`rollback manifest entries must be an array: ${manifestPath}`);
+  }
+  return {
+    version: 1,
+    createdAt: raw.createdAt,
+    entries: raw.entries.map(parseRollbackManifestEntry)
+  };
+}
+function isPathInside(parentPath, candidatePath) {
+  const relative = path.relative(path.resolve(parentPath), path.resolve(candidatePath));
+  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function isPathDescendant(parentPath, candidatePath) {
+  const relative = path.relative(path.resolve(parentPath), path.resolve(candidatePath));
+  return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function hasConnectorConfigShape(targetPath, homeDir) {
+  const relative = path.relative(path.resolve(homeDir), path.resolve(targetPath));
+  if (relative === ".claude.json" || relative === path.join(".claude", ".mcp.json")) {
+    return true;
+  }
+  return hasRepoConnectorConfigShape(relative);
+}
+function hasRepoConnectorConfigShape(relativePath) {
+  const parts = relativePath.split(path.sep);
+  const last = parts.at(-1);
+  const packageName = parts.at(-2);
+  const packagesDir = parts.at(-3);
+  return last === ".mcp.json" && packagesDir === "packages" && (packageName === "plugin-claude-code" || packageName === "plugin-codex");
+}
+function connectorBackupPathForTarget(targetPath, homeDir) {
+  const digest = createHash("sha256").update(targetPath).digest("hex").slice(0, 12);
+  return path.join(backupRoot(homeDir), "mcp", `${digest}.json`);
+}
+function isRollbackTargetAllowed(entry, targetPath, homeDir, options) {
+  const resolvedTarget = path.resolve(targetPath);
+  if (isPathDescendant(remnicRoot(homeDir), resolvedTarget)) {
+    if (entry.createdByMigration && !entry.backupPath) return true;
+    return Boolean(entry.backupPath) && isRemnicTokenStorePath(resolvedTarget, homeDir);
+  }
+  if (isPathDescendant(path.join(homeDir, ".config", "remnic"), resolvedTarget)) {
+    return entry.createdByMigration === true && !entry.backupPath;
+  }
+  const serviceTargets = /* @__PURE__ */ new Set([
+    path.resolve(path.join(homeDir, "Library", "LaunchAgents", "ai.remnic.daemon.plist")),
+    path.resolve(path.join(homeDir, ".config", "systemd", "user", "remnic.service"))
+  ]);
+  if (serviceTargets.has(resolvedTarget)) return true;
+  const cwd = resolveMigrationCwd(options);
+  const allowedConnectorPaths = new Set(
+    [
+      ...defaultConnectorConfigPaths(homeDir, cwd),
+      ...options?.connectorConfigPaths ?? []
+    ].map((candidate) => resolveConnectorConfigPath(candidate, cwd))
+  );
+  if (allowedConnectorPaths.has(resolvedTarget)) return true;
+  return isPathInside(homeDir, resolvedTarget) && hasConnectorConfigShape(resolvedTarget, homeDir);
+}
+function isRollbackBackupAllowed(backupPath, homeDir) {
+  return isPathInside(backupRoot(homeDir), backupPath);
+}
+async function assertNoSymlinkPathSegments(filePath, trustedRoot, label) {
+  const resolvedPath = path.resolve(filePath);
+  const resolvedRoot = path.resolve(trustedRoot);
+  if (!isPathInside(resolvedRoot, resolvedPath)) {
+    throw new Error(`${label} is outside the trusted rollback root: ${filePath}`);
+  }
+  const segments = path.relative(resolvedRoot, resolvedPath).split(path.sep).filter(Boolean);
+  let current = resolvedRoot;
+  for (const [index, segment] of segments.entries()) {
+    current = path.join(current, segment);
+    try {
+      const currentStat = await lstat(current);
+      if (currentStat.isSymbolicLink()) {
+        throw new Error(`${label} must not contain symlink segments: ${filePath}`);
+      }
+    } catch (error) {
+      if (error.code === "ENOENT" && index === segments.length - 1) return;
+      if (error.code === "ENOENT") {
+        throw new Error(`${label} must not contain missing parent segments: ${filePath}`);
+      }
+      throw error;
+    }
+  }
+}
+function rollbackTargetSymlinkRoot(targetPath, homeDir, options) {
+  if (isPathInside(homeDir, targetPath)) return homeDir;
+  const cwd = resolveMigrationCwd(options);
+  if (isPathInside(cwd, targetPath)) return cwd;
+  return path.parse(targetPath).root;
+}
+async function validateRollbackManifestEntries(manifest, homeDir, options) {
+  const validated = [];
+  for (const entry of manifest.entries) {
+    const targetPath = path.resolve(entry.targetPath);
+    if (!isRollbackTargetAllowed(entry, targetPath, homeDir, options)) {
+      throw new Error(`rollback manifest target is outside migration-owned paths: ${entry.targetPath}`);
+    }
+    if (entry.backupPath && entry.createdByMigration) {
+      throw new Error(`rollback manifest entry cannot restore and remove the same target: ${entry.targetPath}`);
+    }
+    const targetExists = await pathExistsNoFollow(targetPath);
+    if (!entry.createdByMigration || targetExists) {
+      const targetSymlinkRoot = rollbackTargetSymlinkRoot(targetPath, homeDir, options);
+      await assertNoSymlinkPathSegments(targetPath, targetSymlinkRoot, "rollback manifest target");
+    }
+    if (entry.createdByMigration && targetExists) {
+      await assertCreatedRollbackTargetMatchesRecord(entry, targetPath);
+    }
+    let backupPath;
+    if (entry.backupPath) {
+      backupPath = path.resolve(entry.backupPath);
+      if (!isRollbackBackupAllowed(backupPath, homeDir)) {
+        throw new Error(`rollback manifest backup is outside migration backup storage: ${entry.backupPath}`);
+      }
+      if (await pathExistsNoFollow(backupPath)) {
+        await assertNoSymlinkPathSegments(backupPath, homeDir, "rollback manifest backup");
+        await assertExistingRegularFileNoFollow(backupPath, "rollback manifest backup");
+      }
+      if (backupPath !== connectorBackupPathForTarget(targetPath, homeDir)) {
+        throw new Error(`rollback manifest backup does not match target: ${entry.targetPath}`);
+      }
+    }
+    validated.push({
+      targetPath,
+      ...backupPath === void 0 ? {} : { backupPath },
+      ...entry.createdByMigration === void 0 ? {} : { createdByMigration: entry.createdByMigration },
+      ...entry.contentHash === void 0 ? {} : { contentHash: entry.contentHash }
+    });
+  }
+  return validated;
+}
+async function assertCreatedRollbackTargetMatchesRecord(entry, targetPath) {
+  const targetStat = await lstat(targetPath);
+  if (targetStat.isDirectory()) {
+    throw new Error(`rollback manifest created target must be a file path: ${entry.targetPath}`);
+  }
+  if (!targetStat.isFile() || !entry.contentHash) return false;
+  if (await fileContentHash(targetPath) !== entry.contentHash) {
+    throw new Error(`rollback manifest created target content does not match migration record: ${entry.targetPath}`);
+  }
+  return true;
+}
 async function rewriteTokensIfPresent(filePath) {
   if (!existsSync(filePath)) return 0;
   await assertExistingRegularFileNoFollow(filePath, "Remnic token store");
@@ -330,8 +516,7 @@ async function backupFile(targetPath, originalContent, homeDir, manifest, persis
   if (manifest.entries.some((entry) => entry.targetPath === targetPath && entry.backupPath)) {
     return;
   }
-  const digest = createHash("sha256").update(targetPath).digest("hex").slice(0, 12);
-  const backupPath = path.join(backupRoot(homeDir), "mcp", `${digest}.json`);
+  const backupPath = connectorBackupPathForTarget(targetPath, homeDir);
   await ensureParent(backupPath);
   if (isRemnicTokenStorePath(targetPath, homeDir)) {
     await writeOwnerOnlyFile(backupPath, originalContent);
@@ -345,7 +530,19 @@ async function backupFile(targetPath, originalContent, homeDir, manifest, persis
 }
 async function recordCreatedPath(filePath, manifest, persistManifest) {
   if (manifest.entries.some((entry) => entry.targetPath === filePath)) return;
-  manifest.entries.push({ targetPath: filePath, createdByMigration: true });
+  manifest.entries.push({
+    targetPath: filePath,
+    createdByMigration: true,
+    contentHash: await fileContentHash(filePath)
+  });
+  await persistManifest?.();
+}
+async function refreshCreatedPathHash(filePath, manifest, persistManifest) {
+  const entry = manifest.entries.find(
+    (candidate) => candidate.targetPath === filePath && candidate.createdByMigration
+  );
+  if (!entry) return;
+  entry.contentHash = await fileContentHash(filePath);
   await persistManifest?.();
 }
 function defaultConnectorConfigPaths(homeDir, cwd) {
@@ -360,8 +557,9 @@ async function updateConnectorConfigs(homeDir, cwd, options, manifest, persistMa
   const updated = [];
   const candidates = options?.connectorConfigPaths ?? defaultConnectorConfigPaths(homeDir, cwd);
   for (const targetPath of candidates) {
-    if (await rewriteJsonFile(targetPath, homeDir, manifest, persistManifest)) {
-      updated.push(targetPath);
+    const resolvedTarget = resolveConnectorConfigPath(targetPath, cwd);
+    if (await rewriteJsonFile(resolvedTarget, homeDir, manifest, persistManifest)) {
+      updated.push(resolvedTarget);
     }
   }
   return updated;
@@ -452,12 +650,26 @@ async function writeRollbackManifest(homeDir, manifest) {
 }
 async function readRollbackManifest(homeDir) {
   const target = rollbackManifestPath(homeDir);
-  if (!existsSync(target)) return null;
+  let targetStat;
+  try {
+    targetStat = await lstat(target);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (targetStat.isSymbolicLink()) {
+    throw new Error(`rollback manifest must not be a symlink: ${target}`);
+  }
+  if (!targetStat.isFile()) {
+    throw new Error(`rollback manifest must be a regular file: ${target}`);
+  }
+  let parsed;
   try {
-    return JSON.parse(await readFile(target, "utf8"));
+    parsed = JSON.parse(await readFile(target, "utf8"));
   } catch {
     return null;
   }
+  return parseRollbackManifest(parsed, target);
 }
 async function acquireLock(homeDir) {
   const target = lockPath(homeDir);
@@ -529,6 +741,7 @@ async function rollbackFromEngramMigration(options) {
   const restored = [];
   const removed = [];
   if (!manifest) return { restored, removed };
+  const entries = await validateRollbackManifestEntries(manifest, homeDir, options);
   if (platform === "darwin") {
     const remnicPlist = path.join(homeDir, "Library", "LaunchAgents", "ai.remnic.daemon.plist");
     if (existsSync(remnicPlist)) {
@@ -544,8 +757,10 @@ async function rollbackFromEngramMigration(options) {
     } catch {
     }
   }
-  for (const entry of [...manifest.entries].reverse()) {
-    if (entry.backupPath && existsSync(entry.backupPath)) {
+  for (const entry of [...entries].reverse()) {
+    if (entry.backupPath && await pathExistsNoFollow(entry.backupPath)) {
+      await assertNoSymlinkPathSegments(entry.backupPath, homeDir, "rollback manifest backup");
+      await assertExistingRegularFileNoFollow(entry.backupPath, "rollback manifest backup");
       await ensureParent(entry.targetPath);
       await copyFile(entry.backupPath, entry.targetPath);
       if (isRemnicTokenStorePath(entry.targetPath, homeDir)) {
@@ -555,6 +770,9 @@ async function rollbackFromEngramMigration(options) {
       continue;
     }
     if (entry.createdByMigration && existsSync(entry.targetPath)) {
+      const targetSymlinkRoot = rollbackTargetSymlinkRoot(entry.targetPath, homeDir, options);
+      await assertNoSymlinkPathSegments(entry.targetPath, targetSymlinkRoot, "rollback manifest target");
+      if (!await assertCreatedRollbackTargetMatchesRecord(entry, entry.targetPath)) continue;
       await rm(entry.targetPath, { recursive: true, force: true });
       removed.push(entry.targetPath);
     }
@@ -571,7 +789,7 @@ async function rollbackFromEngramMigration(options) {
 }
 async function migrateFromEngram(options) {
   const homeDir = resolveMigrationHome(options);
-  const cwd = options?.cwd ?? process.cwd();
+  const cwd = resolveMigrationCwd(options);
   const logger = resolveLogger(options);
   const copied = [];
   let tokensRegenerated = 0;
@@ -622,6 +840,7 @@ async function migrateFromEngram(options) {
     const remnicTokens = path.join(remnicRoot(homeDir), "tokens.json");
     if (copied.includes(remnicTokens)) {
       tokensRegenerated += await rewriteTokensIfPresent(remnicTokens);
+      await refreshCreatedPathHash(remnicTokens, manifest, persistManifest);
     } else {
       tokensRegenerated += await mergeLegacyTokens(
         legacyTokens,
@@ -660,4 +879,4 @@ export {
   rollbackFromEngramMigration,
   migrateFromEngram
 };
-//# sourceMappingURL=chunk-S53PKKWK.js.map
+//# sourceMappingURL=chunk-KVEVLBKC.js.map