@remnic/core 9.66.10 → 9.66.11

package/dist/{chunk-ZPZLGN4Y.js → chunk-XZ7QLOTJ.js}

@@ -1,3 +1,6 @@
+import {
+  resolveNamespaceChildRoot
+} from "./chunk-3UXOZBHV.js";
 import {
   hasCodexMaterializeSentinel,
   materializeForNamespace
@@ -23,24 +26,6 @@ import {
 
 // src/connectors/codex-materialize-runner.ts
 import { existsSync } from "fs";
-
-// src/namespaces/path.ts
-import path from "path";
-function assertNamespacePathInsideRoot(root, candidate, namespace, label = "namespace path") {
-  const relative = path.relative(root, candidate);
-  if (relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative)) {
-    return;
-  }
-  throw new Error(`invalid ${label}: ${namespace}`);
-}
-function resolveNamespaceChildRoot(memoryDir, namespace, label = "namespace path") {
-  const namespaceRoot = path.resolve(memoryDir, "namespaces");
-  const candidate = path.resolve(namespaceRoot, namespace);
-  assertNamespacePathInsideRoot(namespaceRoot, candidate, namespace, label);
-  return candidate;
-}
-
-// src/connectors/codex-materialize-runner.ts
 async function runCodexMaterialize(options) {
   const cfg = options.config;
   if (!cfg.codexMaterializeMemories) {
@@ -146,8 +131,7 @@ function resolveNamespaceDir(memoryDir, namespace, cfg) {
 }
 
 export {
-  resolveNamespaceChildRoot,
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-ZPZLGN4Y.js.map
+//# sourceMappingURL=chunk-XZ7QLOTJ.js.map

package/dist/chunk-XZ7QLOTJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connectors/codex-materialize-runner.ts"],"sourcesContent":["/**\n * codex-materialize-runner.ts — Thin I/O bridge for the Codex materializer.\n *\n * The pure rendering logic lives in {@link ./codex-materialize.js}. This file\n * is the place callers (consolidation hooks, CLI, session-end hook) go when\n * they want the whole \"load memories from storage → render → write\" flow.\n *\n * Kept deliberately small so #378 never has to reach into orchestrator.ts /\n * importance.ts — the two files Wave 1 agents are editing concurrently.\n */\n\nimport { existsSync } from \"node:fs\";\n\nimport { log } from \"../logger.js\";\nimport { resolveNamespaceChildRoot } from \"../namespaces/path.js\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { projectProceduresToSkills } from \"../procedural/skill-projection.js\";\nimport { BUILTIN_SKILLS } from \"../skills-registry.js\";\nimport { StorageManager } from \"../storage.js\";\nimport { excludeSupportPassportPrivateMemories } from \"../support-passport/card-projection.js\";\nimport type { PluginConfig, MemoryFile } from \"../types.js\";\nimport {\n  hasCodexMaterializeSentinel,\n  materializeForNamespace,\n  type MaterializeResult,\n  type RolloutSummaryInput,\n} from \"./codex-materialize.js\";\n\n/** Options accepted by the shared post-consolidation materialize helper. */\nexport interface PostConsolidationMaterializeOptions {\n  config: PluginConfig;\n  namespace?: string;\n  memories?: MemoryFile[];\n  memoryDir?: string;\n  codexHome?: string;\n  rolloutSummaries?: RolloutSummaryInput[];\n  now?: Date;\n}\n\n/** Options accepted by the runner. */\nexport interface RunMaterializeOptions {\n  /** Remnic config — we only read the `codexMaterialize*` fields. */\n  config: PluginConfig;\n  /** Namespace to materialize. Overrides the config's `codexMaterializeNamespace`. */\n  namespace?: string;\n  /** Override the memory directory (defaults to `config.memoryDir`). */\n  memoryDir?: string;\n  /** Override `<codex_home>` (useful for tests). */\n  codexHome?: string;\n  /** Optional pre-loaded memories (bypasses disk read — used in tests). */\n  memories?: MemoryFile[];\n  /** Optional rollout summaries supplied by the caller. */\n  rolloutSummaries?: RolloutSummaryInput[];\n  /** Current time injection for deterministic runs. */\n  now?: Date;\n  /** Reason string — logged for observability. */\n  reason?: \"consolidation\" | \"session_end\" | \"manual\" | \"cli\";\n}\n\n/**\n * Run the Codex materialization end-to-end. Returns `null` when the feature\n * is disabled in config or when the user hasn't opted in via the sentinel.\n * Never throws for \"expected\" skips; only throws on schema validation or I/O\n * errors that callers actually need to surface.\n */\nexport async function runCodexMaterialize(\n  options: RunMaterializeOptions,\n): Promise<MaterializeResult | null> {\n  const cfg = options.config;\n  if (!cfg.codexMaterializeMemories) {\n    log.debug(`[codex-materialize] skipped — codexMaterializeMemories=false`);\n    return null;\n  }\n\n  // Per-trigger gate: session-end runs must honor codexMaterializeOnSessionEnd.\n  // The Codex Stop hook (remnic-codex-hook.cjs, session-end event) passes\n  // reason=\"session_end\"; when the user has turned off the session-end trigger\n  // we short-circuit here without touching disk.\n  if (options.reason === \"session_end\" && cfg.codexMaterializeOnSessionEnd === false) {\n    log.debug(\n      `[codex-materialize] skipped — session-end disabled via codexMaterializeOnSessionEnd=false`,\n    );\n    return null;\n  }\n\n  const namespace = resolveNamespace(options.namespace, cfg);\n  const memoryDir = options.memoryDir ?? cfg.memoryDir;\n  const codexHome = options.codexHome ?? cfg.codex?.codexHome ?? undefined;\n  if (!memoryDir) {\n    log.warn(`[codex-materialize] skipped — no memoryDir available`);\n    return null;\n  }\n\n  let memories: MemoryFile[];\n  if (options.memories) {\n    memories = options.memories;\n  } else {\n    if (!hasCodexMaterializeSentinel(codexHome)) {\n      return materializeForNamespace(namespace, {\n        memories: [],\n        codexHome,\n        maxSummaryTokens: cfg.codexMaterializeMaxSummaryTokens,\n        rolloutRetentionDays: cfg.codexMaterializeRolloutRetentionDays,\n        rolloutSummaries: options.rolloutSummaries,\n        now: options.now,\n      });\n    }\n    const nsDir = resolveNamespaceDir(memoryDir, namespace, cfg);\n    const storage = new StorageManager(nsDir);\n    memories = await storage.readAllMemories();\n  }\n  memories = excludeSupportPassportPrivateMemories(memories);\n\n  // Skill projection (issue #2369). Gated on `procedural.enabled` AND\n  // `procedural.skillProjection.enabled`; `maxSkills: 0` disables it too.\n  // Passing `undefined` leaves `skills/` untouched, so a disabled gate never\n  // deletes a folder the user curated.\n  const skillProjection = cfg.procedural?.skillProjection;\n  const skills =\n    cfg.procedural?.enabled === true && skillProjection?.enabled === true\n      ? projectProceduresToSkills(memories, {\n          maxSkills: skillProjection.maxSkills,\n          reservedSlugs: BUILTIN_SKILLS.map((skill) => skill.slug),\n        })\n      : undefined;\n\n  // Intentionally NOT catching here: per the JSDoc contract above,\n  // schema-validation and I/O errors from `materializeForNamespace` must\n  // surface to callers so they can exit non-zero (CLI) or log + recover\n  // (consolidation post-hook, which has its own narrower try/catch).\n  // Catching everything would make a broken MEMORY.md render look like a\n  // successful skip, and invisible failures are strictly worse than loud\n  // ones for a feature that writes to `~/.codex/memories`.\n  const result = materializeForNamespace(namespace, {\n    memories,\n    codexHome,\n    maxSummaryTokens: cfg.codexMaterializeMaxSummaryTokens,\n    rolloutRetentionDays: cfg.codexMaterializeRolloutRetentionDays,\n    rolloutSummaries: options.rolloutSummaries,\n    skills,\n    now: options.now,\n  });\n  if (options.reason) {\n    log.debug(\n      `[codex-materialize] ran reason=${options.reason} wrote=${result.wrote} files=${result.filesWritten.length}`,\n    );\n  }\n  return result;\n}\n\n/**\n * Shared helper for post-consolidation materialize hooks.\n *\n * `materializeAfterSemanticConsolidation` and `materializeAfterCausalConsolidation`\n * used to be two nearly-identical copies of this logic; keeping the actual\n * body here means any future guard/logging change happens in one place.\n *\n * The only per-caller knob is `logPrefix`, which is used to tag the\n * non-fatal warning emitted when the materializer throws.\n */\nexport async function runPostConsolidationMaterialize(\n  logPrefix: string,\n  options: PostConsolidationMaterializeOptions,\n): Promise<MaterializeResult | null> {\n  if (!options.config.codexMaterializeMemories) return null;\n  if (!options.config.codexMaterializeOnConsolidation) return null;\n  try {\n    return await runCodexMaterialize({\n      config: options.config,\n      namespace: options.namespace,\n      memories: options.memories,\n      memoryDir: options.memoryDir,\n      codexHome: options.codexHome,\n      rolloutSummaries: options.rolloutSummaries,\n      now: options.now,\n      reason: \"consolidation\",\n    });\n  } catch (error) {\n    log.warn(\n      `${logPrefix} Codex materialize post-hook failed (non-fatal): ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n    );\n    return null;\n  }\n}\n\nfunction resolveNamespace(override: string | undefined, cfg: PluginConfig): string {\n  const requested = (override ?? cfg.codexMaterializeNamespace ?? \"auto\").trim();\n  const defaultNamespace = (cfg.defaultNamespace ?? \"\").trim();\n  const namespace =\n    requested.length === 0 || requested === \"auto\"\n      ? (defaultNamespace.length > 0 ? defaultNamespace : \"default\")\n      : requested;\n  if (!isSafeRouteNamespace(namespace)) {\n    throw new Error(`invalid materialize namespace: ${namespace}`);\n  }\n  return namespace;\n}\n\n/**\n * Resolve the on-disk storage root for a namespace, matching\n * `NamespaceStorageRouter` in `packages/remnic-core/src/namespaces/storage.ts`.\n *\n * Contract:\n *  - When namespaces are disabled, every namespace maps to `memoryDir` itself.\n *  - When namespaces are enabled, non-default namespaces always live under\n *    `memoryDir/namespaces/<namespace>`.\n *  - The default namespace prefers `memoryDir/namespaces/<defaultNamespace>`\n *    when that directory already exists (migrated install); otherwise it\n *    falls back to the legacy `memoryDir` root so materialization does not\n *    silently switch directories out from under an existing install.\n */\nfunction resolveNamespaceDir(\n  memoryDir: string,\n  namespace: string,\n  cfg: PluginConfig,\n): string {\n  if (!cfg.namespacesEnabled) return memoryDir;\n\n  const configuredDefaultNamespace = (cfg.defaultNamespace ?? \"\").trim();\n  const defaultNamespace =\n    configuredDefaultNamespace.length > 0 ? configuredDefaultNamespace : \"default\";\n  const ns = (namespace || defaultNamespace).trim();\n  if (!isSafeRouteNamespace(ns)) {\n    throw new Error(`invalid materialize namespace: ${ns}`);\n  }\n  const namespacedRoot = resolveNamespaceChildRoot(memoryDir, ns, \"materialize namespace path\");\n\n  if (ns === defaultNamespace) {\n    return existsSync(namespacedRoot) ? namespacedRoot : memoryDir;\n  }\n  return namespacedRoot;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,SAAS,kBAAkB;AAsD3B,eAAsB,oBACpB,SACmC;AACnC,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAI,0BAA0B;AACjC,QAAI,MAAM,mEAA8D;AACxE,WAAO;AAAA,EACT;AAMA,MAAI,QAAQ,WAAW,iBAAiB,IAAI,iCAAiC,OAAO;AAClF,QAAI;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,iBAAiB,QAAQ,WAAW,GAAG;AACzD,QAAM,YAAY,QAAQ,aAAa,IAAI;AAC3C,QAAM,YAAY,QAAQ,aAAa,IAAI,OAAO,aAAa;AAC/D,MAAI,CAAC,WAAW;AACd,QAAI,KAAK,2DAAsD;AAC/D,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,QAAQ,UAAU;AACpB,eAAW,QAAQ;AAAA,EACrB,OAAO;AACL,QAAI,CAAC,4BAA4B,SAAS,GAAG;AAC3C,aAAO,wBAAwB,WAAW;AAAA,QACxC,UAAU,CAAC;AAAA,QACX;AAAA,QACA,kBAAkB,IAAI;AAAA,QACtB,sBAAsB,IAAI;AAAA,QAC1B,kBAAkB,QAAQ;AAAA,QAC1B,KAAK,QAAQ;AAAA,MACf,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,oBAAoB,WAAW,WAAW,GAAG;AAC3D,UAAM,UAAU,IAAI,eAAe,KAAK;AACxC,eAAW,MAAM,QAAQ,gBAAgB;AAAA,EAC3C;AACA,aAAW,sCAAsC,QAAQ;AAMzD,QAAM,kBAAkB,IAAI,YAAY;AACxC,QAAM,SACJ,IAAI,YAAY,YAAY,QAAQ,iBAAiB,YAAY,OAC7D,0BAA0B,UAAU;AAAA,IAClC,WAAW,gBAAgB;AAAA,IAC3B,eAAe,eAAe,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,EACzD,CAAC,IACD;AASN,QAAM,SAAS,wBAAwB,WAAW;AAAA,IAChD;AAAA,IACA;AAAA,IACA,kBAAkB,IAAI;AAAA,IACtB,sBAAsB,IAAI;AAAA,IAC1B,kBAAkB,QAAQ;AAAA,IAC1B;AAAA,IACA,KAAK,QAAQ;AAAA,EACf,CAAC;AACD,MAAI,QAAQ,QAAQ;AAClB,QAAI;AAAA,MACF,kCAAkC,QAAQ,MAAM,UAAU,OAAO,KAAK,UAAU,OAAO,aAAa,MAAM;AAAA,IAC5G;AAAA,EACF;AACA,SAAO;AACT;AAYA,eAAsB,gCACpB,WACA,SACmC;AACnC,MAAI,CAAC,QAAQ,OAAO,yBAA0B,QAAO;AACrD,MAAI,CAAC,QAAQ,OAAO,gCAAiC,QAAO;AAC5D,MAAI;AACF,WAAO,MAAM,oBAAoB;AAAA,MAC/B,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,MACnB,kBAAkB,QAAQ;AAAA,MAC1B,KAAK,QAAQ;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI;AAAA,MACF,GAAG,SAAS,oDACV,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,UAA8B,KAA2B;AACjF,QAAM,aAAa,YAAY,IAAI,6BAA6B,QAAQ,KAAK;AAC7E,QAAM,oBAAoB,IAAI,oBAAoB,IAAI,KAAK;AAC3D,QAAM,YACJ,UAAU,WAAW,KAAK,cAAc,SACnC,iBAAiB,SAAS,IAAI,mBAAmB,YAClD;AACN,MAAI,CAAC,qBAAqB,SAAS,GAAG;AACpC,UAAM,IAAI,MAAM,kCAAkC,SAAS,EAAE;AAAA,EAC/D;AACA,SAAO;AACT;AAeA,SAAS,oBACP,WACA,WACA,KACQ;AACR,MAAI,CAAC,IAAI,kBAAmB,QAAO;AAEnC,QAAM,8BAA8B,IAAI,oBAAoB,IAAI,KAAK;AACrE,QAAM,mBACJ,2BAA2B,SAAS,IAAI,6BAA6B;AACvE,QAAM,MAAM,aAAa,kBAAkB,KAAK;AAChD,MAAI,CAAC,qBAAqB,EAAE,GAAG;AAC7B,UAAM,IAAI,MAAM,kCAAkC,EAAE,EAAE;AAAA,EACxD;AACA,QAAM,iBAAiB,0BAA0B,WAAW,IAAI,4BAA4B;AAE5F,MAAI,OAAO,kBAAkB;AAC3B,WAAO,WAAW,cAAc,IAAI,iBAAiB;AAAA,EACvD;AACA,SAAO;AACT;","names":[]}

package/dist/cli.js

@@ -91,14 +91,14 @@ import {
   runWorkProductStatusCliCommand,
   runWorkProjectCliCommand,
   runWorkTaskCliCommand
-} from "./chunk-NR36NW24.js";
+} from "./chunk-UWOA5L6N.js";
 import "./chunk-MMACM5G2.js";
 import "./chunk-54BGIBCR.js";
 import "./chunk-H4CKS5B2.js";
 import "./chunk-FXZTL7F7.js";
 import "./chunk-PYHOAXTI.js";
 import "./chunk-UP6MOYCB.js";
-import "./chunk-YYDOUOYM.js";
+import "./chunk-6H7JWYTC.js";
 import "./chunk-BV2TIZ4F.js";
 import "./chunk-Z734BLO3.js";
 import "./chunk-HDDRVXX4.js";
@@ -120,7 +120,7 @@ import "./chunk-YLBE6PLR.js";
 import "./chunk-CDKHKZL5.js";
 import "./chunk-HSSERO3E.js";
 import "./chunk-NOUJNHWG.js";
-import "./chunk-M2BY5IZL.js";
+import "./chunk-PVV42HM4.js";
 import "./chunk-HDQUQBPW.js";
 import "./chunk-6FC3IZ26.js";
 import "./chunk-KWLDB64F.js";
@@ -271,7 +271,8 @@ import "./chunk-D3AUQXTJ.js";
 import "./chunk-7MOYAT4Y.js";
 import "./chunk-LTWFU6VJ.js";
 import "./chunk-UFGFMWAD.js";
-import "./chunk-ZPZLGN4Y.js";
+import "./chunk-XZ7QLOTJ.js";
+import "./chunk-3UXOZBHV.js";
 import "./chunk-ZXBTTMGZ.js";
 import "./chunk-YMOPYG3K.js";
 import "./chunk-2LSZVONP.js";

package/dist/coding/export-okf-codegraph.js

@@ -5,7 +5,7 @@ import {
   rejectSymlinkPath,
   renderFrontmatter,
   writeBundleFile
-} from "../chunk-M2BY5IZL.js";
+} from "../chunk-PVV42HM4.js";
 import {
   ACTIVE_DECISION_STATUSES,
   CodegraphRuntimeError,

package/dist/compounding/engine.js

@@ -1,7 +1,7 @@
 import {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
-} from "../chunk-VSQG4AXL.js";
+} from "../chunk-PWVRMD37.js";
 import "../chunk-VI637ILW.js";
 import "../chunk-N4F7ZSSG.js";
 import "../chunk-4PHT7KE2.js";

package/dist/connectors/codex-materialize-runner.js

@@ -1,7 +1,8 @@
 import {
   runCodexMaterialize,
   runPostConsolidationMaterialize
-} from "../chunk-ZPZLGN4Y.js";
+} from "../chunk-XZ7QLOTJ.js";
+import "../chunk-3UXOZBHV.js";
 import "../chunk-ZXBTTMGZ.js";
 import "../chunk-4PHT7KE2.js";
 import "../chunk-UHVXE24Y.js";

package/dist/connectors/index.js

@@ -33,7 +33,8 @@ import {
 import "../chunk-EMDLM3LW.js";
 import {
   runCodexMaterialize
-} from "../chunk-ZPZLGN4Y.js";
+} from "../chunk-XZ7QLOTJ.js";
+import "../chunk-3UXOZBHV.js";
 import {
   MATERIALIZE_VERSION,
   SENTINEL_FILE,

package/dist/external-wiki-access.js

@@ -47,7 +47,8 @@ import "./chunk-D3AUQXTJ.js";
 import "./chunk-7MOYAT4Y.js";
 import "./chunk-LTWFU6VJ.js";
 import "./chunk-UFGFMWAD.js";
-import "./chunk-ZPZLGN4Y.js";
+import "./chunk-XZ7QLOTJ.js";
+import "./chunk-3UXOZBHV.js";
 import "./chunk-ZXBTTMGZ.js";
 import "./chunk-YMOPYG3K.js";
 import "./chunk-2LSZVONP.js";

package/dist/extraction.js

@@ -30,7 +30,8 @@ import "./chunk-NLE6TSLG.js";
 import "./chunk-IVKIODHO.js";
 import "./chunk-WKDFJXW5.js";
 import "./chunk-JUXOTY6J.js";
-import "./chunk-ZPZLGN4Y.js";
+import "./chunk-XZ7QLOTJ.js";
+import "./chunk-3UXOZBHV.js";
 import "./chunk-ZXBTTMGZ.js";
 import "./chunk-4PHT7KE2.js";
 import "./chunk-UHVXE24Y.js";

package/dist/index.js

@@ -172,7 +172,7 @@ import {
   weeklySnapshotPath,
   writeManifest,
   writeMeetingEpisodeMemory
-} from "./chunk-KWVXCRFZ.js";
+} from "./chunk-BCM6ZAJ3.js";
 import {
   WEARABLE_SOURCE_PREFIX,
   buildExtractionTurns,
@@ -271,7 +271,7 @@ import "./chunk-UXPUUL3G.js";
 import "./chunk-V5OCT34X.js";
 import "./chunk-TECVW3JP.js";
 import "./chunk-C5JF6EZ7.js";
-import "./chunk-VSQG4AXL.js";
+import "./chunk-PWVRMD37.js";
 import "./chunk-VI637ILW.js";
 import "./chunk-SEF4IOFE.js";
 import {
@@ -498,14 +498,14 @@ import {
   runOkfCliCommand,
   runWearablesCliCommand,
   screenCandidateFact
-} from "./chunk-NR36NW24.js";
+} from "./chunk-UWOA5L6N.js";
 import "./chunk-MMACM5G2.js";
 import "./chunk-54BGIBCR.js";
 import "./chunk-H4CKS5B2.js";
 import "./chunk-FXZTL7F7.js";
 import "./chunk-PYHOAXTI.js";
 import "./chunk-UP6MOYCB.js";
-import "./chunk-YYDOUOYM.js";
+import "./chunk-6H7JWYTC.js";
 import "./chunk-BV2TIZ4F.js";
 import "./chunk-Z734BLO3.js";
 import "./chunk-HDDRVXX4.js";
@@ -540,7 +540,7 @@ import {
   parseIsoTimestamp,
   validateImportTurn
 } from "./chunk-NOUJNHWG.js";
-import "./chunk-M2BY5IZL.js";
+import "./chunk-PVV42HM4.js";
 import "./chunk-HDQUQBPW.js";
 import "./chunk-6FC3IZ26.js";
 import "./chunk-KWLDB64F.js";
@@ -622,7 +622,7 @@ import {
 } from "./chunk-3I4FUAVJ.js";
 import {
   buildExtensionsBlockForConsolidation
-} from "./chunk-TXCLDIXJ.js";
+} from "./chunk-K6PWPC7O.js";
 import {
   REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT,
   discoverMemoryExtensions,
@@ -1064,7 +1064,8 @@ import {
 import {
   runCodexMaterialize,
   runPostConsolidationMaterialize
-} from "./chunk-ZPZLGN4Y.js";
+} from "./chunk-XZ7QLOTJ.js";
+import "./chunk-3UXOZBHV.js";
 import {
   MATERIALIZE_VERSION,
   SENTINEL_FILE,

package/dist/orchestrator.js

@@ -3,7 +3,7 @@ import {
   blendGraphExpandedRecallScore,
   graphPathRelativeToStorage,
   mergeGraphExpandedResults
-} from "./chunk-KWVXCRFZ.js";
+} from "./chunk-BCM6ZAJ3.js";
 import "./chunk-3TSU662L.js";
 import "./chunk-JNZSNJ43.js";
 import "./chunk-I74SUMNI.js";
@@ -29,7 +29,7 @@ import "./chunk-UXPUUL3G.js";
 import "./chunk-V5OCT34X.js";
 import "./chunk-TECVW3JP.js";
 import "./chunk-C5JF6EZ7.js";
-import "./chunk-VSQG4AXL.js";
+import "./chunk-PWVRMD37.js";
 import "./chunk-VI637ILW.js";
 import "./chunk-SEF4IOFE.js";
 import "./chunk-2OXBS2LV.js";
@@ -108,14 +108,14 @@ import "./chunk-VY47VI2T.js";
 import "./chunk-PYIR4SSB.js";
 import "./chunk-DFEODULB.js";
 import "./chunk-EG4FHU5C.js";
-import "./chunk-NR36NW24.js";
+import "./chunk-UWOA5L6N.js";
 import "./chunk-MMACM5G2.js";
 import "./chunk-54BGIBCR.js";
 import "./chunk-H4CKS5B2.js";
 import "./chunk-FXZTL7F7.js";
 import "./chunk-PYHOAXTI.js";
 import "./chunk-UP6MOYCB.js";
-import "./chunk-YYDOUOYM.js";
+import "./chunk-6H7JWYTC.js";
 import "./chunk-BV2TIZ4F.js";
 import "./chunk-Z734BLO3.js";
 import "./chunk-HDDRVXX4.js";
@@ -137,7 +137,7 @@ import "./chunk-YLBE6PLR.js";
 import "./chunk-CDKHKZL5.js";
 import "./chunk-HSSERO3E.js";
 import "./chunk-NOUJNHWG.js";
-import "./chunk-M2BY5IZL.js";
+import "./chunk-PVV42HM4.js";
 import "./chunk-HDQUQBPW.js";
 import "./chunk-6FC3IZ26.js";
 import "./chunk-KWLDB64F.js";
@@ -177,7 +177,7 @@ import "./chunk-OKTXM5H4.js";
 import "./chunk-DUAJKRR2.js";
 import "./chunk-NOB2T2FC.js";
 import "./chunk-3I4FUAVJ.js";
-import "./chunk-TXCLDIXJ.js";
+import "./chunk-K6PWPC7O.js";
 import "./chunk-5JMAGU26.js";
 import "./chunk-YBPYIAA5.js";
 import "./chunk-HK6KYIF6.js";
@@ -309,7 +309,8 @@ import "./chunk-D3AUQXTJ.js";
 import "./chunk-7MOYAT4Y.js";
 import "./chunk-LTWFU6VJ.js";
 import "./chunk-UFGFMWAD.js";
-import "./chunk-ZPZLGN4Y.js";
+import "./chunk-XZ7QLOTJ.js";
+import "./chunk-3UXOZBHV.js";
 import "./chunk-ZXBTTMGZ.js";
 import "./chunk-YMOPYG3K.js";
 import "./chunk-2LSZVONP.js";

package/dist/semantic-consolidation.js

@@ -7,11 +7,12 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-TXCLDIXJ.js";
+} from "./chunk-K6PWPC7O.js";
 import {
   resolveExtensionsRoot
 } from "./chunk-5JMAGU26.js";
-import "./chunk-ZPZLGN4Y.js";
+import "./chunk-XZ7QLOTJ.js";
+import "./chunk-3UXOZBHV.js";
 import "./chunk-ZXBTTMGZ.js";
 import "./chunk-4PHT7KE2.js";
 import "./chunk-UHVXE24Y.js";

package/dist/source-agent-qualifier.js

@@ -11,7 +11,8 @@ import "./chunk-VEWZZM3H.js";
 import "./chunk-J3JEW5CT.js";
 import "./chunk-5TBO7CDR.js";
 import "./chunk-EMDLM3LW.js";
-import "./chunk-ZPZLGN4Y.js";
+import "./chunk-XZ7QLOTJ.js";
+import "./chunk-3UXOZBHV.js";
 import "./chunk-ZXBTTMGZ.js";
 import "./chunk-4PHT7KE2.js";
 import "./chunk-UHVXE24Y.js";

package/dist/support-passport/index.js

@@ -100,7 +100,8 @@ import "../chunk-D3AUQXTJ.js";
 import "../chunk-7MOYAT4Y.js";
 import "../chunk-LTWFU6VJ.js";
 import "../chunk-UFGFMWAD.js";
-import "../chunk-ZPZLGN4Y.js";
+import "../chunk-XZ7QLOTJ.js";
+import "../chunk-3UXOZBHV.js";
 import "../chunk-ZXBTTMGZ.js";
 import "../chunk-YMOPYG3K.js";
 import "../chunk-2LSZVONP.js";

package/dist/transfer/export-okf.d.ts

@@ -17,6 +17,14 @@ declare const OKF_LOG_TRUNCATION_MARKER = "<!-- okf-log-truncated -->";
 declare const DEFAULT_OKF_LOG_MAX_ENTRIES = 500;
 interface ExportOkfOptions {
     memoryDir: string;
+    /**
+     * Optional namespace segment. Resolved here, once, through the shared
+     * containment guard: both CLI entry points used to join the raw operator
+     * value onto `memoryDir/namespaces`, so `--namespace ../../..` escaped the
+     * namespace root and exported an arbitrary tree (rule 9 — one resolver, not
+     * a per-caller guard).
+     */
+    namespace?: string;
     outDir: string;
     includeStatus?: readonly string[];
     includeCategories?: readonly string[];

package/dist/transfer/export-okf.js

@@ -3,11 +3,12 @@ import {
   OKF_LOG_TRUNCATION_MARKER,
   exportOkfBundle,
   parseIncludeStatus
-} from "../chunk-YYDOUOYM.js";
+} from "../chunk-6H7JWYTC.js";
 import {
   OKF_EXPORT_VERSION
-} from "../chunk-M2BY5IZL.js";
+} from "../chunk-PVV42HM4.js";
 import "../chunk-D24OXEPB.js";
+import "../chunk-3UXOZBHV.js";
 import "../chunk-4PHT7KE2.js";
 import "../chunk-UHVXE24Y.js";
 import "../chunk-4ZWCQJNM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.66.10",
+  "version": "9.66.11",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3217,7 +3217,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.66.10"
+    "@remnic/coding-graph": "^9.66.11"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/cli/okf-commands.ts

@@ -1,4 +1,3 @@
-import path from "node:path";
 import type { Orchestrator } from "../orchestrator.js";
 import type { CliCommand } from "../cli.js";
 import { runOkfCliCommand } from "../okf/cli.js";
@@ -44,11 +43,9 @@ export function registerExportOkfCommand(exportCmd: CliCommand, orchestrator: Or
       if (!out) throw new Error("Missing --out");
       const includeStatus = parseIncludeStatus(options.includeStatus);
       const namespace = options.namespace ? String(options.namespace) : "";
-      const memoryDir = namespace
-        ? path.join(orchestrator.config.memoryDir, "namespaces", namespace)
-        : orchestrator.config.memoryDir;
       const result = await exportOkfBundle({
-        memoryDir,
+        memoryDir: orchestrator.config.memoryDir,
+        namespace,
         outDir: out,
         includeStatus,
         includeCategories: options.includeCategories ? String(options.includeCategories).split(",") : undefined,

package/src/okf/render.ts

@@ -9,6 +9,7 @@
  * bundles are byte-compatible in convention (rule 38 — deterministic
  * rendering discipline; rule 9 — stable seam over shared mechanics).
  */
+import { randomUUID } from "node:crypto";
 import { lstatSync, mkdirSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 
@@ -76,6 +77,7 @@ export function publishBundle(staging: string, outDir: string, force: boolean):
   try {
     const stat = lstatSync(outDir);
     if (stat.isSymbolicLink()) throw new Error(`--out must not be a symlink: ${outDir}`);
+    if (!stat.isDirectory()) throw new Error(`--out exists and is not a directory: ${outDir}`);
     exists = true;
     const entries = readdirSync(outDir).filter((name) => name !== "." && name !== "..");
     if (entries.length > 0 && !force) {
@@ -87,7 +89,12 @@ export function publishBundle(staging: string, outDir: string, force: boolean):
   }
   mkdirSync(path.dirname(outDir), { recursive: true });
   if (exists && force) {
-    const backup = `${outDir}.okf-prev`;
+    // A fixed backup name is not reusable: an earlier crash between the two
+    // renames, or an unrelated directory a user created, leaves the path
+    // occupied and every later --force export fails on the rename. Each
+    // attempt takes its own name and removes it on both the success and the
+    // rollback path.
+    const backup = `${outDir}.okf-prev-${randomUUID().slice(0, 8)}`;
     try {
       renameSync(outDir, backup);
     } catch {
@@ -100,8 +107,10 @@ export function publishBundle(staging: string, outDir: string, force: boolean):
     } catch (err) {
       try {
         renameSync(backup, outDir);
+        rmSync(staging, { recursive: true, force: true });
       } catch {
-        // Keep backup if restore fails.
+        // Keep the backup when the restore itself fails: it is the only
+        // surviving copy of the operator's previous bundle.
       }
       throw err;
     }

package/src/transfer/export-okf.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtemp, readFile, rm, writeFile, symlink } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, rm, writeFile, symlink } from "node:fs/promises";
 import { existsSync, lstatSync, readdirSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -162,3 +162,79 @@ function collectFiles(root: string): string[] {
   walk(root);
   return out.sort();
 }
+
+test("--namespace cannot escape the namespace root", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-ns-"));
+  const outDir = path.join(await mkdtemp(path.join(os.tmpdir(), "remnic-okf-nsout-")), "bundle");
+  try {
+    await seedStore(memoryDir);
+    // A raw path.join on the operator value used to resolve outside
+    // <memoryDir>/namespaces and export an arbitrary tree.
+    for (const namespace of ["../../..", "../sibling", path.resolve(memoryDir)]) {
+      await assert.rejects(
+        () => exportOkfBundle({ memoryDir, namespace, outDir }),
+        /invalid --namespace/,
+        `namespace ${namespace} must be rejected`,
+      );
+    }
+    assert.equal(existsSync(outDir), false, "a rejected namespace must not create the bundle");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("a plain --namespace still exports from the namespace subtree", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-nsok-"));
+  const outDir = path.join(root, "bundle");
+  try {
+    await seedStore(path.join(root, "namespaces", "team-a"));
+    const result = await exportOkfBundle({ memoryDir: root, namespace: "team-a", outDir });
+    assert.ok(result.exported > 0, "namespaced export must find its own memories");
+    assert.ok(existsSync(path.join(outDir, "index.md")));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("a leftover backup directory does not block a forced export", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-bk-"));
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-bkout-"));
+  const outDir = path.join(root, "bundle");
+  try {
+    await seedStore(memoryDir);
+    await exportOkfBundle({ memoryDir, outDir });
+    // Simulate a crash between the two publish renames, or any directory a
+    // user happens to own at the old fixed backup path.
+    const stale = `${outDir}.okf-prev`;
+    await mkdir(stale, { recursive: true });
+    await writeFile(path.join(stale, "keep.md"), "stale\n", "utf8");
+
+    const again = await exportOkfBundle({ memoryDir, outDir, force: true });
+    assert.ok(again.exported > 0);
+    assert.ok(existsSync(path.join(outDir, "index.md")), "forced export must republish");
+    assert.equal(existsSync(path.join(stale, "keep.md")), true, "an unrelated directory is left alone");
+    const leftovers = readdirSync(root).filter((name) => name.startsWith("bundle.okf-prev-"));
+    assert.deepEqual(leftovers, [], "each attempt removes its own backup");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("--out that is a file is rejected before anything is written", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-file-"));
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-fileout-"));
+  const outDir = path.join(root, "bundle");
+  try {
+    await seedStore(memoryDir);
+    await writeFile(outDir, "not a directory\n", "utf8");
+    await assert.rejects(
+      () => exportOkfBundle({ memoryDir, outDir, force: true }),
+      /--out exists and is not a directory/,
+    );
+    assert.equal(await readFile(outDir, "utf8"), "not a directory\n", "the file is left untouched");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/transfer/export-okf.ts

@@ -1,6 +1,5 @@
-import { rmSync } from "node:fs";
+import { mkdirSync, rmSync } from "node:fs";
 import { mkdtemp } from "node:fs/promises";
-import os from "node:os";
 import path from "node:path";
 
 import { parseOaiMemCitation } from "../citations.js";
@@ -8,6 +7,7 @@ import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
 import { normalizeProjectionPreview } from "../memory-projection-format.js";
 import { lintOkfDir } from "../okf/lint.js";
 import { okfTypeForMemory, OKF_PROFILE_TYPE } from "../okf/type-mapping.js";
+import { resolveNamespaceChildRoot } from "../namespaces/path.js";
 import {
   OKF_EXPORT_VERSION,
   publishBundle,
@@ -38,6 +38,14 @@ const MEMORY_STATUSES: readonly MemoryStatus[] = [
 
 export interface ExportOkfOptions {
   memoryDir: string;
+  /**
+   * Optional namespace segment. Resolved here, once, through the shared
+   * containment guard: both CLI entry points used to join the raw operator
+   * value onto `memoryDir/namespaces`, so `--namespace ../../..` escaped the
+   * namespace root and exported an arbitrary tree (rule 9 — one resolver, not
+   * a per-caller guard).
+   */
+  namespace?: string;
   outDir: string;
   includeStatus?: readonly string[];
   includeCategories?: readonly string[];
@@ -71,15 +79,19 @@ export function parseIncludeStatus(raw: unknown): MemoryStatus[] {
 export async function exportOkfBundle(opts: ExportOkfOptions): Promise<ExportOkfResult> {
   const outDir = path.resolve(opts.outDir);
   rejectSymlinkPath(outDir);
+  const namespace = (opts.namespace ?? "").trim();
+  const memoryDir = namespace
+    ? resolveNamespaceChildRoot(opts.memoryDir, namespace, "--namespace")
+    : opts.memoryDir;
   const includeStatus = new Set(parseIncludeStatus(opts.includeStatus));
   const includeCategories = opts.includeCategories?.length ? new Set(opts.includeCategories) : null;
   const excludeTags = new Set(opts.excludeTags ?? []);
-  const storage = new StorageManager(opts.memoryDir);
+  const storage = new StorageManager(memoryDir);
   const memories = await storage.readAllMemories();
   const included: MemoryFile[] = [];
   let excluded = 0;
   for (const memory of memories) {
-    const rel = toRel(memory.path, opts.memoryDir);
+    const rel = toRel(memory.path, memoryDir);
     if (!opts.includeWearables && rel.startsWith("wearables/")) {
       excluded += 1;
       continue;
@@ -99,17 +111,21 @@ export async function exportOkfBundle(opts: ExportOkfOptions): Promise<ExportOkf
     }
     included.push(memory);
   }
-  included.sort((a, b) => toRel(a.path, opts.memoryDir).localeCompare(toRel(b.path, opts.memoryDir)));
+  included.sort((a, b) => toRel(a.path, memoryDir).localeCompare(toRel(b.path, memoryDir)));
 
-  const staging = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-export-"));
+  // Stage inside the destination's parent, not the OS temp dir: publishBundle
+  // finishes with a rename, and a rename across filesystems fails with EXDEV
+  // whenever --out lives on a different mount than /tmp.
+  mkdirSync(path.dirname(outDir), { recursive: true });
+  const staging = await mkdtemp(path.join(path.dirname(outDir), ".remnic-okf-export-"));
   const byCategory: Record<string, number> = {};
   const idToRel = new Map<string, string>();
   for (const memory of included) {
-    const rel = toRel(memory.path, opts.memoryDir);
+    const rel = toRel(memory.path, memoryDir);
     idToRel.set(memory.frontmatter.id, rel);
   }
   for (const memory of included) {
-    const rel = toRel(memory.path, opts.memoryDir);
+    const rel = toRel(memory.path, memoryDir);
     const rendered = renderMemory(memory, rel, idToRel);
     writeBundleFile(staging, rel, rendered);
     const category = memory.frontmatter.category;
@@ -140,7 +156,7 @@ export async function exportOkfBundle(opts: ExportOkfOptions): Promise<ExportOkf
     writeBundleFile(staging, "log.md", renderLog(events, idToRel, opts.logMaxEntries ?? DEFAULT_OKF_LOG_MAX_ENTRIES));
   }
 
-  writeIndexes(staging, included, opts.memoryDir);
+  writeIndexes(staging, included, memoryDir);
   const lint = lintOkfDir(staging);
   const blocking = lint.findings.filter((f) => f.code !== "skipped_encrypted" && f.code !== "reserved_basename");
   if (blocking.length > 0) {