@remnic/plugin-openclaw 1.0.11 → 1.0.12

package/dist/{chunk-TNH24SF6.js → chunk-7UZNLMW5.js}

@@ -3,9 +3,10 @@ import {
 } from "./chunk-6OJAU466.js";
 import {
   SecureStoreLockedError,
+  isEncryptedFile,
   readMaybeEncryptedFile,
   writeMaybeEncryptedFile
-} from "./chunk-3I7RHWYT.js";
+} from "./chunk-RKR6PTPA.js";
 import {
   log
 } from "./chunk-UFU5GGGA.js";
@@ -34,6 +35,12 @@ function setCachedEntities(baseDir, entities, version, schemaKey = "") {
     loadedAt: Date.now()
   });
 }
+function invalidateCachedEntities(baseDir) {
+  const prefix = `${baseDir}\0`;
+  for (const key of entityCacheByDir.keys()) {
+    if (key.startsWith(prefix)) entityCacheByDir.delete(key);
+  }
+}
 var episodeMapByDir = /* @__PURE__ */ new Map();
 var ruleMemoriesByDir = /* @__PURE__ */ new Map();
 function getCachedEpisodeMap(baseDir, currentVersion) {
@@ -594,25 +601,44 @@ function loadBetterSqlite3() {
   if (cachedCtor) return cachedCtor;
   const require2 = createRequire(import.meta.url);
   try {
-    const loaded = require2("better-sqlite3");
-    const ctor = typeof loaded === "function" ? loaded : loaded.default;
-    if (typeof ctor !== "function") {
-      throw new Error("module did not export a constructor");
-    }
-    cachedCtor = ctor;
-    return ctor;
+    cachedCtor = requireBetterSqlite3Ctor(require2);
+    return cachedCtor;
   } catch (error) {
-    const detail = error instanceof Error && error.message.length > 0 ? ` (${error.message})` : "";
-    throw new Error(
-      "better-sqlite3 is unavailable. Rebuild it in the plugin install with `npm rebuild better-sqlite3 --build-from-source` before using SQLite-backed Engram features" + detail,
-      { cause: error instanceof Error ? error : void 0 }
-    );
+    throw unavailableError(error);
   }
 }
 function openBetterSqlite3(file, options) {
   const Database = loadBetterSqlite3();
   return new Database(file, options);
 }
+function requireBetterSqlite3Ctor(require2) {
+  const loaded = require2("better-sqlite3");
+  const ctor = typeof loaded === "function" ? loaded : loaded.default;
+  if (typeof ctor !== "function") {
+    throw new Error("module did not export a constructor");
+  }
+  return ctor;
+}
+function isLikelyBetterSqlite3NativeBindingError(error) {
+  const detail = errorDetail(error);
+  return detail.includes("Could not locate the bindings file") || detail.includes("better_sqlite3.node") || detail.includes("node-v") && detail.includes("better-sqlite3") || detail.includes("NODE_MODULE_VERSION") && detail.includes("better-sqlite3") || detail.includes("was compiled against a different Node.js version");
+}
+function unavailableError(error) {
+  const detail = errorDetail(error);
+  const nativeBindingHint = isLikelyBetterSqlite3NativeBindingError(error) ? " This usually means the better-sqlite3 native binding was not compiled for this Node.js/platform combination. Run `node scripts/ensure-better-sqlite3.mjs` from the Remnic install directory, or run `npx node-gyp rebuild --directory=node_modules/better-sqlite3` if the verification script is unavailable." : "";
+  return new Error(
+    "better-sqlite3 is unavailable. Remnic attempted to load the native SQLite binding and could not." + nativeBindingHint + (detail ? ` Original error: ${detail}` : ""),
+    { cause: error instanceof Error ? error : void 0 }
+  );
+}
+function errorDetail(error) {
+  if (error instanceof Error) {
+    const stack = error.stack && error.stack !== error.message ? `
+${error.stack}` : "";
+    return `${error.message}${stack}`;
+  }
+  return String(error ?? "");
+}
 
 // ../remnic-core/src/memory-projection-store.ts
 var MEMORY_PROJECTION_SCHEMA_VERSION = 2;
@@ -2274,13 +2300,19 @@ var ContentHashIndex = class _ContentHashIndex {
   hashes = /* @__PURE__ */ new Set();
   dirty = false;
   filePath;
-  constructor(stateDir) {
+  secureStoreKeyProvider;
+  secureStoreWriteKeyProvider;
+  memoryDir;
+  constructor(stateDir, secureStoreKeyProvider = () => null, secureStoreWriteKeyProvider = secureStoreKeyProvider, memoryDir = path4.dirname(stateDir)) {
     this.filePath = path4.join(stateDir, "fact-hashes.txt");
+    this.secureStoreKeyProvider = secureStoreKeyProvider;
+    this.secureStoreWriteKeyProvider = secureStoreWriteKeyProvider;
+    this.memoryDir = memoryDir;
   }
   /** Load existing hashes from disk. Safe to call multiple times. */
   async load() {
     try {
-      const raw = await readFile2(this.filePath, "utf-8");
+      const raw = await readMaybeEncryptedFile(this.filePath, this.secureStoreKeyProvider(), this.memoryDir);
       for (const line of raw.split("\n")) {
         const trimmed = line.trim();
         if (trimmed.length > 0) {
@@ -2288,7 +2320,9 @@ var ContentHashIndex = class _ContentHashIndex {
         }
       }
       log.debug(`content-hash index: loaded ${this.hashes.size} hashes`);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       log.debug("content-hash index: no existing index \u2014 starting fresh");
     }
   }
@@ -2311,7 +2345,13 @@ var ContentHashIndex = class _ContentHashIndex {
   async save() {
     if (!this.dirty) return;
     await mkdir2(path4.dirname(this.filePath), { recursive: true });
-    await writeFile2(this.filePath, [...this.hashes].join("\n") + "\n", "utf-8");
+    await writeMaybeEncryptedFile(
+      this.filePath,
+      [...this.hashes].join("\n") + "\n",
+      this.secureStoreWriteKeyProvider(),
+      {},
+      this.memoryDir
+    );
     this.dirty = false;
     log.debug(`content-hash index: saved ${this.hashes.size} hashes`);
   }
@@ -3174,6 +3214,8 @@ var StorageManager = class _StorageManager {
   // 1 minute
   static artifactWriteVersionByDir = /* @__PURE__ */ new Map();
   static memoryStatusVersionByDir = /* @__PURE__ */ new Map();
+  static secureStoreEntityCacheKeyIds = /* @__PURE__ */ new WeakMap();
+  static nextSecureStoreEntityCacheKeyId = 1;
   // In-process fallback for the cold-write sentinel (used when the disk file
   // is not accessible).  The canonical source of truth is state/cold-write.log.
   static coldWriteVersionByDir = /* @__PURE__ */ new Map();
@@ -3221,6 +3263,7 @@ var StorageManager = class _StorageManager {
   factHashIndexLoadPromise = null;
   factHashIndexAuthoritative = null;
   factHashIndexAuthoritativePromise = null;
+  secureAppendChains = /* @__PURE__ */ new Map();
   /** Optional: set by the orchestrator after construction to enable template-aware citation stripping during legacy hash rebuild. */
   citationTemplate = DEFAULT_CITATION_FORMAT;
   /** Page-versioning configuration.  Set by the orchestrator after construction. */
@@ -3264,6 +3307,17 @@ var StorageManager = class _StorageManager {
   setSecureStoreKey(key, encryptOnWrite = true) {
     this._secureStoreKey = key;
     this._secureStoreEncryptOnWrite = encryptOnWrite;
+    invalidateCachedEntities(this.baseDir);
+    this.invalidateKnowledgeIndexCache();
+  }
+  getEntityCacheSecureStoreKey() {
+    if (!this._secureStoreKey) return "secure-store:locked";
+    let id = _StorageManager.secureStoreEntityCacheKeyIds.get(this._secureStoreKey);
+    if (id === void 0) {
+      id = _StorageManager.nextSecureStoreEntityCacheKeyId++;
+      _StorageManager.secureStoreEntityCacheKeyIds.set(this._secureStoreKey, id);
+    }
+    return `secure-store:key:${id}`;
   }
   /**
    * Mark the secure-store as required for this storage instance.
@@ -3415,6 +3469,57 @@ var StorageManager = class _StorageManager {
   get entitiesDir() {
     return path4.join(this.baseDir, "entities");
   }
+  readStorageSecureFile(filePath) {
+    return readMaybeEncryptedFile(filePath, this._secureStoreKey, this.baseDir);
+  }
+  writeStorageSecureFile(filePath, content) {
+    return writeMaybeEncryptedFile(filePath, content, this.resolveWriteKey(), {}, this.baseDir);
+  }
+  createContentHashIndex() {
+    return new ContentHashIndex(
+      this.stateDir,
+      () => this._secureStoreKey,
+      () => this.resolveWriteKey(),
+      this.baseDir
+    );
+  }
+  async appendStorageSecureFile(filePath, content) {
+    const previous = this.secureAppendChains.get(filePath) ?? Promise.resolve();
+    const current = previous.catch(() => void 0).then(() => this.appendStorageSecureFileUnlocked(filePath, content));
+    const next = current.catch(() => void 0);
+    this.secureAppendChains.set(filePath, next);
+    try {
+      await current;
+    } finally {
+      if (this.secureAppendChains.get(filePath) === next) {
+        this.secureAppendChains.delete(filePath);
+      }
+    }
+  }
+  async appendStorageSecureFileUnlocked(filePath, content) {
+    const writeKey = this.resolveWriteKey();
+    await mkdir2(path4.dirname(filePath), { recursive: true });
+    if (writeKey === null) {
+      try {
+        if (isEncryptedFile(await readFile2(filePath))) {
+          const existing2 = await this.readStorageSecureFile(filePath);
+          await writeMaybeEncryptedFile(filePath, `${existing2}${content}`, null, {}, this.baseDir);
+          return;
+        }
+      } catch (err) {
+        if (!isErrnoCode(err, "ENOENT")) throw err;
+      }
+      await appendFile(filePath, content, "utf-8");
+      return;
+    }
+    let existing = "";
+    try {
+      existing = await this.readStorageSecureFile(filePath);
+    } catch (err) {
+      if (!isErrnoCode(err, "ENOENT")) throw err;
+    }
+    await writeMaybeEncryptedFile(filePath, `${existing}${content}`, writeKey, {}, this.baseDir);
+  }
   get stateDir() {
     return path4.join(this.baseDir, "state");
   }
@@ -3429,7 +3534,7 @@ var StorageManager = class _StorageManager {
       return this.factHashIndex;
     }
     if (!this.factHashIndexLoadPromise) {
-      const index = new ContentHashIndex(this.stateDir);
+      const index = this.createContentHashIndex();
       this.factHashIndexLoadPromise = index.load().then(() => {
         this.factHashIndex = index;
         return index;
@@ -3896,9 +4001,11 @@ ${sanitized.text}
       aliases: []
     };
     try {
-      const existing = await readFile2(filePath, "utf-8");
+      const existing = await this.readStorageSecureFile(filePath);
       entity = parseEntityFile(existing, this.entitySchemas);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
     }
     const timestamp = options.timestamp?.trim() || (/* @__PURE__ */ new Date()).toISOString();
     const source = options.source?.trim() || void 0;
@@ -3954,7 +4061,7 @@ ${sanitized.text}
     entity.created = entity.created || timestamp;
     entity.updated = (/* @__PURE__ */ new Date()).toISOString();
     await this.snapshotBeforeWrite(filePath, "write");
-    await writeFile2(filePath, serializeEntityFile(entity, this.entitySchemas), "utf-8");
+    await this.writeStorageSecureFile(filePath, serializeEntityFile(entity, this.entitySchemas));
     this.invalidateKnowledgeIndexCache();
     this.bumpMemoryStatusVersion();
     log.debug(`wrote entity ${normalized}`);
@@ -4585,8 +4692,10 @@ ${memory.content}
   }
   async readEntity(name) {
     try {
-      return await readFile2(path4.join(this.entitiesDir, `${name}.md`), "utf-8");
-    } catch {
+      return await this.readStorageSecureFile(path4.join(this.entitiesDir, `${name}.md`));
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return "";
     }
   }
@@ -4767,21 +4876,23 @@ ${memory.content}
   async loadBuffer() {
     const bufferPath = path4.join(this.stateDir, "buffer.json");
     try {
-      const raw = await readFile2(bufferPath, "utf-8");
+      const raw = await this.readStorageSecureFile(bufferPath);
       return JSON.parse(raw);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return { turns: [], lastExtractionAt: null, extractionCount: 0 };
     }
   }
   async saveBuffer(state) {
     await this.ensureDirectories();
     const bufferPath = path4.join(this.stateDir, "buffer.json");
-    await writeFile2(bufferPath, JSON.stringify(state, null, 2), "utf-8");
+    await this.writeStorageSecureFile(bufferPath, JSON.stringify(state, null, 2));
   }
   async loadMeta() {
     const metaPath = path4.join(this.stateDir, "meta.json");
     try {
-      const raw = await readFile2(metaPath, "utf-8");
+      const raw = await this.readStorageSecureFile(metaPath);
       const parsed = JSON.parse(raw);
       return {
         extractionCount: typeof parsed.extractionCount === "number" ? parsed.extractionCount : 0,
@@ -4798,7 +4909,9 @@ ${memory.content}
           observedAt: entry.observedAt
         })) : []
       };
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return {
         extractionCount: 0,
         lastExtractionAt: null,
@@ -4812,7 +4925,7 @@ ${memory.content}
   async saveMeta(state) {
     await this.ensureDirectories();
     const metaPath = path4.join(this.stateDir, "meta.json");
-    await writeFile2(metaPath, JSON.stringify(state, null, 2), "utf-8");
+    await this.writeStorageSecureFile(metaPath, JSON.stringify(state, null, 2));
   }
   async appendMemoryActionEvents(events) {
     if (events.length === 0) return 0;
@@ -4826,7 +4939,7 @@ ${memory.content}
       return `${JSON.stringify(normalized)}
 `;
     }).join("");
-    await appendFile(this.memoryActionsPath, payload, "utf-8");
+    await this.appendStorageSecureFile(this.memoryActionsPath, payload);
     return events.length;
   }
   async appendMemoryLifecycleEvents(events) {
@@ -4841,7 +4954,7 @@ ${memory.content}
       return `${JSON.stringify(normalized)}
 `;
     }).join("");
-    await appendFile(this.memoryLifecycleLedgerPath, payload, "utf-8");
+    await this.appendStorageSecureFile(this.memoryLifecycleLedgerPath, payload);
     return events.length;
   }
   /**
@@ -4866,7 +4979,7 @@ ${memory.content}
       return `${JSON.stringify(normalized)}
 `;
     }).join("");
-    await appendFile(this.bufferSurpriseLedgerPath, payload, "utf-8");
+    await this.appendStorageSecureFile(this.bufferSurpriseLedgerPath, payload);
     return events.length;
   }
   /**
@@ -4903,8 +5016,9 @@ ${memory.content}
   async readBufferSurpriseEvents(options = {}) {
     let raw;
     try {
-      raw = await readFile2(this.bufferSurpriseLedgerPath, "utf-8");
+      raw = await this.readStorageSecureFile(this.bufferSurpriseLedgerPath);
     } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
       const code = err.code;
       if (code === "ENOENT") return [];
       throw err;
@@ -4939,7 +5053,7 @@ ${memory.content}
     await this.ensureDirectories();
     let existingKeys = /* @__PURE__ */ new Set();
     try {
-      const raw = await readFile2(this.behaviorSignalsPath, "utf-8");
+      const raw = await this.readStorageSecureFile(this.behaviorSignalsPath);
       const lines = raw.split("\n");
       for (const line of lines) {
         const row = line.trim();
@@ -4952,7 +5066,9 @@ ${memory.content}
         } catch {
         }
       }
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       existingKeys = /* @__PURE__ */ new Set();
     }
     const nowIso = (/* @__PURE__ */ new Date()).toISOString();
@@ -4969,7 +5085,7 @@ ${memory.content}
     if (deduped.length === 0) return 0;
     const payload = deduped.map((event) => `${JSON.stringify(event)}
 `).join("");
-    await appendFile(this.behaviorSignalsPath, payload, "utf-8");
+    await this.appendStorageSecureFile(this.behaviorSignalsPath, payload);
     return deduped.length;
   }
   async appendReextractJobs(events) {
@@ -4978,9 +5094,11 @@ ${memory.content}
     const filePath = path4.join(this.stateDir, "reextract-jobs.jsonl");
     const lines = events.map((event) => JSON.stringify(event)).join("\n") + "\n";
     try {
-      await appendFile(filePath, lines, "utf-8");
+      await this.appendStorageSecureFile(filePath, lines);
       return events.length;
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return 0;
     }
   }
@@ -4988,7 +5106,7 @@ ${memory.content}
     const safeLimit = Number.isFinite(limit) ? Math.max(1, Math.min(1e3, Math.floor(limit))) : 200;
     const filePath = path4.join(this.stateDir, "reextract-jobs.jsonl");
     try {
-      const raw = await readFile2(filePath, "utf-8");
+      const raw = await this.readStorageSecureFile(filePath);
       const lines = raw.split("\n").filter((line) => line.trim().length > 0);
       const parsed = [];
       for (const line of lines) {
@@ -5008,7 +5126,9 @@ ${memory.content}
         }
       }
       return parsed.slice(-safeLimit);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return [];
     }
   }
@@ -5016,7 +5136,7 @@ ${memory.content}
     const cappedLimit = Math.max(0, Math.floor(limit));
     if (cappedLimit === 0) return [];
     try {
-      const raw = await readFile2(this.behaviorSignalsPath, "utf-8");
+      const raw = await this.readStorageSecureFile(this.behaviorSignalsPath);
       const out = [];
       const lines = raw.split("\n");
       for (let i = lines.length - 1; i >= 0 && out.length < cappedLimit; i -= 1) {
@@ -5031,15 +5151,20 @@ ${memory.content}
         }
       }
       return out.reverse();
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return [];
     }
   }
   async readMemoryActionEvents(limit = 200) {
+    return (await this.readMemoryActionEventRows(limit)).map((row) => row.event);
+  }
+  async readMemoryActionEventRows(limit = 200) {
     const cappedLimit = Math.max(0, Math.floor(limit));
     if (cappedLimit === 0) return [];
     try {
-      const raw = await readFile2(this.memoryActionsPath, "utf-8");
+      const raw = await this.readStorageSecureFile(this.memoryActionsPath);
       const out = [];
       const lines = raw.split("\n");
       for (let i = lines.length - 1; i >= 0 && out.length < cappedLimit; i -= 1) {
@@ -5047,20 +5172,29 @@ ${memory.content}
         if (!line) continue;
         try {
           const parsed = JSON.parse(line);
-          if (typeof parsed.timestamp === "string" && typeof parsed.action === "string" && typeof parsed.outcome === "string") {
-            out.push(parsed);
+          const outcome = parsed.outcome === "applied" || parsed.outcome === "skipped" || parsed.outcome === "failed" ? parsed.outcome : null;
+          if (typeof parsed.timestamp === "string" && typeof parsed.action === "string" && outcome !== null) {
+            out.push({
+              line: i + 1,
+              event: {
+                ...parsed,
+                outcome
+              }
+            });
           }
         } catch {
         }
       }
       return out.reverse();
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return [];
     }
   }
   async readAllMemoryLifecycleEvents() {
     try {
-      const raw = await readFile2(this.memoryLifecycleLedgerPath, "utf-8");
+      const raw = await this.readStorageSecureFile(this.memoryLifecycleLedgerPath);
       const out = [];
       const lines = raw.split("\n");
       for (const line of lines) {
@@ -5075,7 +5209,9 @@ ${memory.content}
         }
       }
       return sortMemoryLifecycleEvents(out);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return [];
     }
   }
@@ -5087,35 +5223,39 @@ ${memory.content}
   }
   async writeCompressionGuidelines(content) {
     await this.ensureDirectories();
-    await writeFile2(this.compressionGuidelinesPath, content, "utf-8");
+    await this.writeStorageSecureFile(this.compressionGuidelinesPath, content);
   }
   async readCompressionGuidelines() {
     try {
-      return await readFile2(this.compressionGuidelinesPath, "utf-8");
-    } catch {
+      return await this.readStorageSecureFile(this.compressionGuidelinesPath);
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return null;
     }
   }
   async writeCompressionGuidelineDraft(content) {
     await this.ensureDirectories();
-    await writeFile2(this.compressionGuidelineDraftPath, content, "utf-8");
+    await this.writeStorageSecureFile(this.compressionGuidelineDraftPath, content);
   }
   async readCompressionGuidelineDraft() {
     try {
-      return await readFile2(this.compressionGuidelineDraftPath, "utf-8");
-    } catch {
+      return await this.readStorageSecureFile(this.compressionGuidelineDraftPath);
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return null;
     }
   }
   async writeCompressionGuidelineOptimizerState(state) {
     await this.ensureDirectories();
-    await writeFile2(this.compressionGuidelineStatePath, `${JSON.stringify(state, null, 2)}
-`, "utf-8");
+    await this.writeStorageSecureFile(this.compressionGuidelineStatePath, `${JSON.stringify(state, null, 2)}
+`);
   }
   async writeCompressionGuidelineDraftState(state) {
     await this.ensureDirectories();
-    await writeFile2(this.compressionGuidelineDraftStatePath, `${JSON.stringify(state, null, 2)}
-`, "utf-8");
+    await this.writeStorageSecureFile(this.compressionGuidelineDraftStatePath, `${JSON.stringify(state, null, 2)}
+`);
   }
   async readCompressionGuidelineOptimizerState() {
     return this.readCompressionGuidelineStateFile(this.compressionGuidelineStatePath);
@@ -5163,7 +5303,7 @@ ${memory.content}
       return typeof rule.action === "string" && typeof rule.delta === "number" && Number.isFinite(rule.delta) && (rule.direction === "increase" || rule.direction === "decrease" || rule.direction === "hold") && (rule.confidence === "low" || rule.confidence === "medium" || rule.confidence === "high") && Array.isArray(rule.notes) && rule.notes.every((note) => typeof note === "string");
     };
     try {
-      const raw = await readFile2(filePath, "utf-8");
+      const raw = await this.readStorageSecureFile(filePath);
       const parsed = JSON.parse(raw);
       const sourceWindow = parsed?.sourceWindow;
       const eventCounts = parsed?.eventCounts;
@@ -5193,18 +5333,21 @@ ${memory.content}
         ...actionSummaries ? { actionSummaries } : {},
         ...ruleUpdates ? { ruleUpdates } : {}
       };
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return null;
     }
   }
   async writeIdentityAnchor(content) {
     await this.ensureDirectories();
-    await writeFile2(this.identityAnchorPath, content, "utf-8");
+    await this.writeStorageSecureFile(this.identityAnchorPath, content);
   }
   async readIdentityAnchor() {
     try {
-      return await readFile2(this.identityAnchorPath, "utf-8");
-    } catch {
+      return await this.readStorageSecureFile(this.identityAnchorPath);
+    } catch (err) {
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return null;
     }
   }
@@ -5216,7 +5359,7 @@ ${memory.content}
     const id = this.generateId("incident");
     const incident = createContinuityIncidentRecord(id, input, nowIso);
     const filePath = path4.join(this.identityIncidentsDir, `${date}-${id}.md`);
-    await writeFile2(filePath, serializeContinuityIncident(incident), "utf-8");
+    await this.writeStorageSecureFile(filePath, serializeContinuityIncident(incident));
     return { ...incident, filePath };
   }
   async readContinuityIncidents(limit = 200, state = "all") {
@@ -5230,16 +5373,19 @@ ${memory.content}
         if (incidents.length >= cappedLimit) break;
         const filePath = path4.join(this.identityIncidentsDir, file);
         try {
-          const raw = await readFile2(filePath, "utf-8");
+          const raw = await this.readStorageSecureFile(filePath);
           const parsed = parseContinuityIncident(raw);
           if (!parsed) continue;
           if (state !== "all" && parsed.state !== state) continue;
           incidents.push({ ...parsed, filePath });
-        } catch {
+        } catch (err) {
+          if (err instanceof SecureStoreLockedError) throw err;
         }
       }
       return incidents;
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return [];
     }
   }
@@ -5249,7 +5395,7 @@ ${memory.content}
     if (!target || !directFilePath) return null;
     if (target.state === "closed") return target;
     const closed = closeContinuityIncidentRecord(target, closure, (/* @__PURE__ */ new Date()).toISOString());
-    await writeFile2(directFilePath, serializeContinuityIncident(closed), "utf-8");
+    await this.writeStorageSecureFile(directFilePath, serializeContinuityIncident(closed));
     return { ...closed, filePath: directFilePath };
   }
   async writeIdentityAudit(period, key, content) {
@@ -5257,26 +5403,29 @@ ${memory.content}
     const safeKey = this.sanitizeIdentityAuditKey(key);
     const dir = period === "weekly" ? this.identityAuditsWeeklyDir : this.identityAuditsMonthlyDir;
     const filePath = path4.join(dir, `${safeKey}.md`);
-    await writeFile2(filePath, content, "utf-8");
+    await this.writeStorageSecureFile(filePath, content);
     return filePath;
   }
   async readIdentityAudit(period, key) {
     try {
       const safeKey = this.sanitizeIdentityAuditKey(key);
       const dir = period === "weekly" ? this.identityAuditsWeeklyDir : this.identityAuditsMonthlyDir;
-      return await readFile2(path4.join(dir, `${safeKey}.md`), "utf-8");
-    } catch {
+      return await this.readStorageSecureFile(path4.join(dir, `${safeKey}.md`));
+    } catch (err) {
+      if (err instanceof Error && err.message === "Invalid identity audit key") return null;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return null;
     }
   }
   async writeIdentityImprovementLoops(content) {
     await this.ensureDirectories();
-    await writeFile2(this.identityImprovementLoopsPath, content, "utf-8");
+    await this.writeStorageSecureFile(this.identityImprovementLoopsPath, content);
   }
   async readIdentityImprovementLoops() {
     try {
-      return await readFile2(this.identityImprovementLoopsPath, "utf-8");
-    } catch {
+      return await this.readStorageSecureFile(this.identityImprovementLoopsPath);
+    } catch (err) {
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return null;
     }
   }
@@ -5313,10 +5462,11 @@ ${memory.content}
   }
   async readContinuityIncidentFile(filePath) {
     try {
-      const raw = await readFile2(filePath, "utf-8");
+      const raw = await this.readStorageSecureFile(filePath);
       const parsed = parseContinuityIncident(raw);
       return parsed ? { ...parsed, filePath } : null;
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
       return null;
     }
   }
@@ -5515,20 +5665,22 @@ ${reflection}
   }
   async readIdentityReflections() {
     try {
-      return await readFile2(this.identityReflectionsPath, "utf-8");
-    } catch {
+      return await this.readStorageSecureFile(this.identityReflectionsPath);
+    } catch (err) {
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return null;
     }
   }
   async writeIdentityReflections(content) {
     await mkdir2(this.identityDir, { recursive: true });
-    await writeFile2(this.identityReflectionsPath, content, "utf-8");
+    await this.writeStorageSecureFile(this.identityReflectionsPath, content);
   }
   async appendIdentityReflection(reflection) {
     let existing = "";
     try {
-      existing = await readFile2(this.identityReflectionsPath, "utf-8");
-    } catch {
+      existing = await this.readStorageSecureFile(this.identityReflectionsPath);
+    } catch (err) {
+      if (!isErrnoCode(err, "ENOENT")) throw err;
     }
     if (existing.length > _StorageManager.IDENTITY_MAX_BYTES) {
       log.debug(
@@ -5553,7 +5705,7 @@ ${reflection}
 ${reflection}
 `;
     await mkdir2(this.identityDir, { recursive: true });
-    await writeFile2(this.identityReflectionsPath, `${existing.trimEnd()}${section}`, "utf-8");
+    await this.writeStorageSecureFile(this.identityReflectionsPath, `${existing.trimEnd()}${section}`);
     log.debug(`appended namespace-local reflection to ${this.identityReflectionsPath}`);
   }
   // ---------------------------------------------------------------------------
@@ -5567,9 +5719,11 @@ ${reflection}
     const filePath = path4.join(this.entitiesDir, `${name}.md`);
     let entity;
     try {
-      const content = await readFile2(filePath, "utf-8");
+      const content = await this.readStorageSecureFile(filePath);
       entity = parseEntityFile(content, this.entitySchemas);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       log.debug(`addEntityRelationship: entity file ${name}.md not found`);
       return;
     }
@@ -5579,7 +5733,7 @@ ${reflection}
     if (exists) return;
     entity.relationships.push(rel);
     entity.updated = (/* @__PURE__ */ new Date()).toISOString();
-    await writeFile2(filePath, serializeEntityFile(entity, this.entitySchemas), "utf-8");
+    await this.writeStorageSecureFile(filePath, serializeEntityFile(entity, this.entitySchemas));
     this.invalidateKnowledgeIndexCache();
   }
   /**
@@ -5590,9 +5744,11 @@ ${reflection}
     const filePath = path4.join(this.entitiesDir, `${name}.md`);
     let entity;
     try {
-      const content = await readFile2(filePath, "utf-8");
+      const content = await this.readStorageSecureFile(filePath);
       entity = parseEntityFile(content, this.entitySchemas);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       log.debug(`addEntityActivity: entity file ${name}.md not found`);
       return;
     }
@@ -5601,7 +5757,7 @@ ${reflection}
       entity.activity = entity.activity.slice(0, maxEntries);
     }
     entity.updated = (/* @__PURE__ */ new Date()).toISOString();
-    await writeFile2(filePath, serializeEntityFile(entity, this.entitySchemas), "utf-8");
+    await this.writeStorageSecureFile(filePath, serializeEntityFile(entity, this.entitySchemas));
     this.invalidateKnowledgeIndexCache();
   }
   /**
@@ -5611,16 +5767,18 @@ ${reflection}
     const filePath = path4.join(this.entitiesDir, `${name}.md`);
     let entity;
     try {
-      const content = await readFile2(filePath, "utf-8");
+      const content = await this.readStorageSecureFile(filePath);
       entity = parseEntityFile(content, this.entitySchemas);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       log.debug(`addEntityAlias: entity file ${name}.md not found`);
       return;
     }
     if (entity.aliases.includes(alias)) return;
     entity.aliases.push(alias);
     entity.updated = (/* @__PURE__ */ new Date()).toISOString();
-    await writeFile2(filePath, serializeEntityFile(entity, this.entitySchemas), "utf-8");
+    await this.writeStorageSecureFile(filePath, serializeEntityFile(entity, this.entitySchemas));
     this.invalidateKnowledgeIndexCache();
   }
   /**
@@ -5630,9 +5788,11 @@ ${reflection}
     const filePath = path4.join(this.entitiesDir, `${name}.md`);
     let entity;
     try {
-      const content = await readFile2(filePath, "utf-8");
+      const content = await this.readStorageSecureFile(filePath);
       entity = parseEntityFile(content, this.entitySchemas);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       log.debug(`updateEntitySynthesis: entity file ${name}.md not found`);
       return;
     }
@@ -5649,7 +5809,7 @@ ${reflection}
     entity.synthesisStructuredFactDigest = synthesisStructuredFactDigest;
     entity.synthesisVersion = Math.max(0, entity.synthesisVersion ?? 0) + (options.incrementVersion === false ? 0 : 1);
     entity.updated = entityUpdatedAt;
-    await writeFile2(filePath, serializeEntityFile(entity, this.entitySchemas), "utf-8");
+    await this.writeStorageSecureFile(filePath, serializeEntityFile(entity, this.entitySchemas));
     await this.removeEntitySynthesisQueueEntries([
       .../* @__PURE__ */ new Set([name, normalizeEntityName(entity.name, entity.type)])
     ]);
@@ -5664,9 +5824,11 @@ ${reflection}
     let synthesisTimelineCount;
     try {
       const filePath = path4.join(this.entitiesDir, `${name}.md`);
-      const content = await readFile2(filePath, "utf-8");
+      const content = await this.readStorageSecureFile(filePath);
       synthesisTimelineCount = parseEntityFile(content, this.entitySchemas).timeline.length;
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       synthesisTimelineCount = void 0;
     }
     await this.updateEntitySynthesis(name, summary, {
@@ -5677,10 +5839,12 @@ ${reflection}
   }
   async readEntitySynthesisQueue() {
     try {
-      const raw = await readFile2(this.entitySynthesisQueuePath, "utf-8");
+      const raw = await this.readStorageSecureFile(this.entitySynthesisQueuePath);
       const parsed = JSON.parse(raw);
       return Array.isArray(parsed.entityNames) ? parsed.entityNames.filter((value) => typeof value === "string") : [];
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return [];
     }
   }
@@ -5702,7 +5866,7 @@ ${reflection}
       return compareEntityTimestamps(rightTs, leftTs);
     }).map(({ entityName }) => entityName);
     await mkdir2(this.stateDir, { recursive: true });
-    await writeFile2(
+    await this.writeStorageSecureFile(
       this.entitySynthesisQueuePath,
       JSON.stringify(
         {
@@ -5711,8 +5875,7 @@ ${reflection}
         },
         null,
         2
-      ) + "\n",
-      "utf-8"
+      ) + "\n"
     );
     return staleEntityNames;
   }
@@ -5723,7 +5886,7 @@ ${reflection}
     const removals = new Set(entityNames);
     const nextQueue = queue.filter((name) => !removals.has(name));
     await mkdir2(this.stateDir, { recursive: true });
-    await writeFile2(
+    await this.writeStorageSecureFile(
       this.entitySynthesisQueuePath,
       JSON.stringify(
         {
@@ -5732,8 +5895,7 @@ ${reflection}
         },
         null,
         2
-      ) + "\n",
-      "utf-8"
+      ) + "\n"
     );
   }
   async migrateEntityFilesToCompiledTruthTimeline() {
@@ -5744,7 +5906,7 @@ ${reflection}
       if (!raw) continue;
       const serialized = serializeEntityFile(parseEntityFile(raw, this.entitySchemas), this.entitySchemas);
       if (raw.trimEnd() === serialized.trimEnd()) continue;
-      await writeFile2(path4.join(this.entitiesDir, `${entityName}.md`), serialized, "utf-8");
+      await this.writeStorageSecureFile(path4.join(this.entitiesDir, `${entityName}.md`), serialized);
       migrated += 1;
     }
     if (migrated > 0) {
@@ -5766,7 +5928,8 @@ ${reflection}
   async readAllEntityFiles() {
     const currentVersion = this.getMemoryStatusVersion();
     const schemaCacheKey = buildEntitySchemaCacheKey(this.entitySchemas);
-    const cached = getCachedEntities(this.baseDir, currentVersion, schemaCacheKey);
+    const cacheKey = `${this.getEntityCacheSecureStoreKey()}\0${schemaCacheKey}`;
+    const cached = getCachedEntities(this.baseDir, currentVersion, cacheKey);
     if (cached) return cached;
     try {
       const entries = await readdir(this.entitiesDir);
@@ -5777,17 +5940,24 @@ ${reflection}
       for (let i = 0; i < mdFiles.length; i += BATCH_SIZE) {
         const batch = mdFiles.slice(i, i + BATCH_SIZE);
         const results = await Promise.all(
-          batch.map(
-            (entry) => readFile2(path4.join(this.entitiesDir, entry), "utf-8").catch(() => null)
-          )
+          batch.map(async (entry) => {
+            try {
+              return await this.readStorageSecureFile(path4.join(this.entitiesDir, entry));
+            } catch (err) {
+              if (err instanceof SecureStoreLockedError) throw err;
+              if (!isErrnoCode(err, "ENOENT")) throw err;
+              return null;
+            }
+          })
         );
         for (const content of results) {
           if (content !== null) entities.push(parseEntityFile(content, this.entitySchemas));
         }
       }
-      setCachedEntities(this.baseDir, entities, currentVersion, schemaCacheKey);
+      setCachedEntities(this.baseDir, entities, currentVersion, cacheKey);
       return entities;
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError || !isErrnoCode(err, "ENOENT")) throw err;
       return [];
     }
   }
@@ -5920,7 +6090,7 @@ ${rows.join("\n")}
         for (const file of files) {
           const filePath = path4.join(this.entitiesDir, file);
           try {
-            const content = await readFile2(filePath, "utf-8");
+            const content = await this.readStorageSecureFile(filePath);
             const parsed = parseEntityFile(content, this.entitySchemas);
             if (!mergedEntity.type || mergedEntity.type === "other") {
               mergedEntity.type = parsed.type;
@@ -5997,7 +6167,9 @@ ${rows.join("\n")}
               title: section.title,
               lines: [...section.lines]
             })));
-          } catch {
+          } catch (err) {
+            if (err instanceof SecureStoreLockedError) throw err;
+            if (!isErrnoCode(err, "ENOENT")) throw err;
           }
         }
         const timelineKeys = /* @__PURE__ */ new Set();
@@ -6048,7 +6220,7 @@ ${rows.join("\n")}
         mergedEntity.created = mergedEntity.created || mergedEntity.updated || (/* @__PURE__ */ new Date()).toISOString();
         mergedEntity.updated = mergedEntity.updated || (/* @__PURE__ */ new Date()).toISOString();
         const canonicalPath = path4.join(this.entitiesDir, `${canonical}.md`);
-        await writeFile2(canonicalPath, serializeEntityFile(mergedEntity, this.entitySchemas), "utf-8");
+        await this.writeStorageSecureFile(canonicalPath, serializeEntityFile(mergedEntity, this.entitySchemas));
         for (const file of files) {
           const filePath = path4.join(this.entitiesDir, file);
           if (filePath !== canonicalPath) {
@@ -6061,7 +6233,8 @@ ${rows.join("\n")}
           }
         }
       }
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError || !isErrnoCode(err, "ENOENT")) throw err;
     }
     return merged;
   }
@@ -6115,7 +6288,7 @@ ${rows.join("\n")}
 ${memory.content}
 `;
       try {
-        await writeFile2(memory.path, fileContent, "utf-8");
+        await this.writeStorageSecureFile(memory.path, fileContent);
         updated++;
       } catch (err) {
         log.debug(`failed to update access tracking for ${entry.memoryId}: ${err}`);
@@ -6256,7 +6429,7 @@ ${sanitized.text}
     } else {
       filePath = path4.join(this.factsDir, today, `${id}.md`);
     }
-    await writeFile2(filePath, fileContent, "utf-8");
+    await this.writeStorageSecureFile(filePath, fileContent);
     log.debug(`wrote chunk ${id} (${chunkIndex + 1}/${chunkTotal}) to ${filePath}`);
     return id;
   }
@@ -6331,7 +6504,7 @@ Reason: ${reason}`, {
   async writeSummary(summary) {
     await mkdir2(this.summariesDir, { recursive: true });
     const filePath = path4.join(this.summariesDir, `${summary.id}.json`);
-    await writeFile2(filePath, JSON.stringify(summary, null, 2), "utf-8");
+    await this.writeStorageSecureFile(filePath, JSON.stringify(summary, null, 2));
     log.debug(`wrote summary ${summary.id}`);
   }
   /**
@@ -6344,11 +6517,13 @@ Reason: ${reason}`, {
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
         const filePath = path4.join(this.summariesDir, file);
-        const raw = await readFile2(filePath, "utf-8");
+        const raw = await this.readStorageSecureFile(filePath);
         summaries.push(JSON.parse(raw));
       }
       return summaries;
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return [];
     }
   }
@@ -6374,7 +6549,7 @@ Reason: ${reason}`, {
 ${memory.content}
 `;
       try {
-        await writeFile2(memory.path, fileContent, "utf-8");
+        await this.writeStorageSecureFile(memory.path, fileContent);
         await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.archiveMemories", {
           memoryId: id,
           eventType: "archived",
@@ -6404,7 +6579,7 @@ ${memory.content}
   async saveTopics(topics) {
     const metaPath = path4.join(this.stateDir, "topics.json");
     await mkdir2(this.stateDir, { recursive: true });
-    await writeFile2(metaPath, JSON.stringify({ topics, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2), "utf-8");
+    await this.writeStorageSecureFile(metaPath, JSON.stringify({ topics, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
     log.debug(`saved ${topics.length} topic scores`);
   }
   /**
@@ -6413,9 +6588,11 @@ ${memory.content}
   async loadTopics() {
     const metaPath = path4.join(this.stateDir, "topics.json");
     try {
-      const raw = await readFile2(metaPath, "utf-8");
+      const raw = await this.readStorageSecureFile(metaPath);
       return JSON.parse(raw);
-    } catch {
+    } catch (err) {
+      if (err instanceof SecureStoreLockedError) throw err;
+      if (!isErrnoCode(err, "ENOENT")) throw err;
       return { topics: [], updatedAt: null };
     }
   }
@@ -6527,7 +6704,6 @@ export {
   readProjectedGovernanceRecord,
   normalizeProjectionPreview,
   normalizeProjectionTags,
-  parseContinuityIncident,
   parseContinuityImprovementLoops,
   normalizeEntityName,
   ContentHashIndex,