@remnic/plugin-openclaw 9.54.4 → 9.54.6

package/dist/index.js

@@ -1,3 +1,6 @@
+import {
+  createOpenClawSupportPassportModelRoute
+} from "./chunk-HDTN2ZKK.js";
 import {
   __export,
   __reExport
@@ -214,6 +217,49 @@ import {
 
 // ../../src/tools.ts
 import { runMemoryGovernance } from "@remnic/core/maintenance/memory-governance";
+
+// ../../src/memory-action-target.ts
+import { isSupportPassportPrivateMemory } from "@remnic/core";
+function clampUnitInterval(value, fallback) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
+  if (value < 0) return 0;
+  if (value > 1) return 1;
+  return value;
+}
+function normalizeEligibilitySource(value) {
+  switch (value) {
+    case "extraction":
+    case "consolidation":
+    case "replay":
+    case "manual":
+      return value;
+    default:
+      return "unknown";
+  }
+}
+function deriveMemoryActionPolicyEligibility(memory) {
+  if (!memory) return void 0;
+  const frontmatter = memory.frontmatter;
+  return {
+    confidence: clampUnitInterval(frontmatter.confidence, 0),
+    lifecycleState: frontmatter.status === "archived" ? "archived" : frontmatter.lifecycleState ?? "candidate",
+    importance: clampUnitInterval(frontmatter.importance?.score, 0),
+    source: normalizeEligibilitySource(frontmatter.source)
+  };
+}
+async function readReferencedMemoryForPolicyEligibility(storage, memoryId) {
+  if (!memoryId) return void 0;
+  const direct = await storage.getMemoryById?.(memoryId);
+  if (direct) return direct;
+  const active = (await storage.readAllMemories?.())?.find((memory) => memory.frontmatter.id === memoryId);
+  if (active) return active;
+  return (await storage.readArchivedMemories?.())?.find((memory) => memory.frontmatter.id === memoryId);
+}
+function blocksSupportPassportMutation(action, memory) {
+  return (action === "update_note" || action === "discard" || action === "link_graph") && Boolean(memory && isSupportPassportPrivateMemory(memory));
+}
+
+// ../../src/tools.ts
 function toolResult(text) {
   return { content: [{ type: "text", text }], details: void 0 };
 }
@@ -232,12 +278,6 @@ function asNonEmptyString(value) {
 function normalizeToolNamespace(value) {
   return asNonEmptyString(value);
 }
-function clampUnitInterval(value, fallback) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
-  if (value < 0) return 0;
-  if (value > 1) return 1;
-  return value;
-}
 function normalizeProfilingReportLimit(value) {
   if (value === void 0) return 5;
   if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value)) {
@@ -252,43 +292,7 @@ function normalizeMemorySearchResultLimit(value) {
   }
   return Math.min(Math.max(value, 1), 50);
 }
-function normalizeMemoryActionEligibilitySource(value) {
-  switch (value) {
-    case "extraction":
-    case "consolidation":
-    case "replay":
-    case "manual":
-      return value;
-    default:
-      return "unknown";
-  }
-}
-function deriveMemoryActionPolicyEligibility(memory) {
-  if (!memory) return void 0;
-  const frontmatter = memory.frontmatter;
-  return {
-    confidence: clampUnitInterval(frontmatter.confidence, 0),
-    lifecycleState: frontmatter.status === "archived" ? "archived" : frontmatter.lifecycleState ?? "candidate",
-    importance: clampUnitInterval(frontmatter.importance?.score, 0),
-    source: normalizeMemoryActionEligibilitySource(frontmatter.source)
-  };
-}
-async function readReferencedMemoryForPolicyEligibility(storage, memoryId) {
-  if (!memoryId) return void 0;
-  if (typeof storage.getMemoryById === "function") {
-    const direct = await storage.getMemoryById(memoryId);
-    if (direct) return direct;
-  }
-  if (typeof storage.readAllMemories === "function") {
-    const active = (await storage.readAllMemories()).find((memory) => memory.frontmatter.id === memoryId);
-    if (active) return active;
-  }
-  if (typeof storage.readArchivedMemories === "function") {
-    const archived = (await storage.readArchivedMemories()).find((memory) => memory.frontmatter.id === memoryId);
-    if (archived) return archived;
-  }
-  return void 0;
-}
+var MEMORY_SEARCH_CANDIDATE_CAP = 25e3;
 var WORK_TASK_STATUSES = /* @__PURE__ */ new Set(["todo", "in_progress", "blocked", "done", "cancelled"]);
 var WORK_TASK_PRIORITIES = /* @__PURE__ */ new Set(["low", "medium", "high"]);
 var WORK_PROJECT_STATUSES = /* @__PURE__ */ new Set(["active", "on_hold", "completed", "archived"]);
@@ -568,12 +572,39 @@ Best for:
           const { query, maxResults, collection, namespace } = params;
           const namespaceFilter = namespace && namespace.length > 0 ? namespace : void 0;
           const resultLimit = normalizeMemorySearchResultLimit(maxResults);
-          const filtered = collection === "global" && !namespaceFilter ? (await orchestrator.qmd.searchGlobal(query, resultLimit)).slice(0, resultLimit) : await orchestrator.searchAcrossNamespaces({
+          const searchCandidates = async (limit) => collection === "global" && !namespaceFilter ? await orchestrator.qmd.searchGlobal(query, limit) : await orchestrator.searchAcrossNamespaces({
             query,
             namespaces: namespaceFilter ? [namespaceFilter] : void 0,
-            maxResults: resultLimit,
+            maxResults: limit,
             mode: "search"
           });
+          let candidateLimit = resultLimit;
+          const privateVisibilityCache = /* @__PURE__ */ new Map();
+          let candidates = await searchCandidates(candidateLimit);
+          let filtered = await orchestrator.filterPrivateSearchResults(
+            candidates,
+            namespaceFilter ? [namespaceFilter] : [],
+            false,
+            privateVisibilityCache
+          );
+          while (filtered.length < resultLimit && candidates.length >= candidateLimit && candidateLimit < MEMORY_SEARCH_CANDIDATE_CAP) {
+            const nextCandidateLimit = Math.min(
+              MEMORY_SEARCH_CANDIDATE_CAP,
+              Math.max(candidateLimit + 16, candidateLimit * 2)
+            );
+            if (nextCandidateLimit === candidateLimit) break;
+            const nextCandidates = await searchCandidates(nextCandidateLimit);
+            if (nextCandidates.length <= candidates.length) break;
+            candidateLimit = nextCandidateLimit;
+            candidates = nextCandidates;
+            filtered = await orchestrator.filterPrivateSearchResults(
+              candidates,
+              namespaceFilter ? [namespaceFilter] : [],
+              false,
+              privateVisibilityCache
+            );
+          }
+          filtered = filtered.slice(0, resultLimit);
           if (filtered.length === 0) {
             return toolResult(`No memories found matching: "${query}"`);
           }
@@ -1600,6 +1631,19 @@ NOTE: You did not provide sessionKey; under concurrency this may not match your
         }
         const storage = typeof orchestrator.getStorage === "function" ? await orchestrator.getStorage(ns) : orchestrator.storage;
         const referencedMemory = await readReferencedMemoryForPolicyEligibility(storage, memoryIdValue);
+        if (blocksSupportPassportMutation(action, referencedMemory)) {
+          await orchestrator.appendMemoryActionEvent({
+            ...baseEvent,
+            outcome: "failed",
+            status: "rejected",
+            dryRun: dryRun === true,
+            outputMemoryIds: [],
+            reason: "validation: support passport records require the owner surface"
+          });
+          return toolResult(
+            "Validation failed: support passport records can only be changed through the support passport owner surface."
+          );
+        }
         const structuredEvent = {
           ...baseEvent,
           outcome: outcome ?? "applied",
@@ -3062,8 +3106,8 @@ import { registerLcmTools } from "@remnic/core/lcm/index";
 import { estimateTokens as estimateLcmTokens } from "@remnic/core/lcm/archive";
 import { registerCli } from "@remnic/core/cli";
 import {
-  FallbackLlmClient,
-  fallbackLlmRuntimeContextFromConfig
+  FallbackLlmClient as FallbackLlmClient2,
+  fallbackLlmRuntimeContextFromConfig as fallbackLlmRuntimeContextFromConfig2
 } from "@remnic/core/fallback-llm";
 
 // ../../src/objective-state.ts
@@ -3092,8 +3136,36 @@ async function probeQmdAvailability(host) {
 
 // ../../src/access-service.ts
 var access_service_exports = {};
+__export(access_service_exports, {
+  EngramAccessService: () => EngramAccessService,
+  createConfiguredSupportPassportGatewayRoute: () => createConfiguredSupportPassportGatewayRoute
+});
 __reExport(access_service_exports, access_service_star);
 import * as access_service_star from "@remnic/core/access-service";
+import { EngramAccessService as CoreEngramAccessService } from "@remnic/core/access-service";
+import { FallbackLlmClient, fallbackLlmRuntimeContextFromConfig } from "@remnic/core/fallback-llm";
+import { createOpenClawSupportPassportModelRoute as createOpenClawSupportPassportModelRoute2 } from "@remnic/plugin-openclaw/support-passport-model-route";
+function createConfiguredSupportPassportGatewayRoute(config, preferredClient) {
+  const gatewayClient = preferredClient ?? (config.gatewayConfig ? new FallbackLlmClient(
+    config.gatewayConfig,
+    fallbackLlmRuntimeContextFromConfig(config)
+  ) : null);
+  return gatewayClient ? createOpenClawSupportPassportModelRoute2(config, gatewayClient) : null;
+}
+var EngramAccessService = class extends CoreEngramAccessService {
+  supportPassportGatewayRoute;
+  constructor(orchestrator, options = {}) {
+    super(orchestrator, options);
+    const injectedRoute = super.supportPassportGatewayRouteRef;
+    this.supportPassportGatewayRoute = injectedRoute ?? createConfiguredSupportPassportGatewayRoute(
+      orchestrator.config,
+      orchestrator.fastGatewayLlm
+    );
+  }
+  get supportPassportGatewayRouteRef() {
+    return this.supportPassportGatewayRoute;
+  }
+};
 
 // ../../src/access-http.ts
 var access_http_exports = {};
@@ -5323,7 +5395,7 @@ import path8 from "path";
 import {
   renderMemoryContextPrompt
 } from "@remnic/core";
-import { log as log6 } from "@remnic/core/logger";
+import { log as log7 } from "@remnic/core/logger";
 
 // src/delegate-authorization.ts
 import { log as log2 } from "@remnic/core/logger";
@@ -7639,8 +7711,301 @@ function registerDelegateMemoryCapability(api, options) {
   return built;
 }
 
+// src/delegate-support-passport-model.ts
+import {
+  SUPPORT_PASSPORT_MODEL_ACK_PATH,
+  SUPPORT_PASSPORT_MODEL_JOB_PATH,
+  SUPPORT_PASSPORT_MODEL_RESULT_PATH,
+  acceptsSupportPassportModelResponse,
+  parseSupportPassportModelJob
+} from "@remnic/core";
+import { log as log6 } from "@remnic/core/logger";
+var MODEL_WORKER_COUNT = 4;
+var DEFAULT_REQUEST_TIMEOUT_MS = 25e3;
+var RESULT_REQUEST_TIMEOUT_MS = 5e3;
+var RESULT_RETRY_DELAY_MS = 1e3;
+var POLL_RETRY_MAX_DELAY_MS = 3e4;
+var SHUTDOWN_RESULT_REQUEST_TIMEOUT_MS = 250;
+function supportPassportModelPollRetryDelayMs(consecutiveFailures) {
+  const exponent = Math.max(0, Math.min(30, Math.floor(consecutiveFailures) - 1));
+  return Math.min(POLL_RETRY_MAX_DELAY_MS, RESULT_RETRY_DELAY_MS * 2 ** exponent);
+}
+async function post(target, serviceId, pathname, body, signal, timeoutMs) {
+  const auth = target.resolveAuthToken();
+  const requestSignal = AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]);
+  const response = await fetch(daemonUrl(target, pathname), {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...auth.token ? { Authorization: `Bearer ${auth.token}` } : {}
+    },
+    body: JSON.stringify(body),
+    signal: requestSignal
+  });
+  if (response.status === 401 || response.status === 403) {
+    reportDaemonAuthorizationFailure(serviceId, pathname, response.status, auth.source);
+  }
+  return response;
+}
+function abortableRetryDelay(signal, delayMs = RESULT_RETRY_DELAY_MS) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const done = () => {
+      clearTimeout(timeout);
+      signal.removeEventListener("abort", done);
+      resolve();
+    };
+    const timeout = setTimeout(done, delayMs);
+    signal.addEventListener("abort", done, { once: true });
+  });
+}
+function createDelegateSupportPassportModelService(options) {
+  let controller;
+  let worker;
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  if (!Number.isInteger(requestTimeoutMs) || requestTimeoutMs < 1) {
+    throw new Error("requestTimeoutMs must be a positive integer");
+  }
+  const invoke = async (job, signal) => {
+    const timeoutSignal = AbortSignal.timeout(job.timeoutMs);
+    const modelSignal = AbortSignal.any([signal, timeoutSignal]);
+    if (modelSignal.aborted) return null;
+    let removeAbort = () => {
+    };
+    const aborted = new Promise((resolve) => {
+      const onAbort = () => resolve(null);
+      modelSignal.addEventListener("abort", onAbort, { once: true });
+      removeAbort = () => modelSignal.removeEventListener("abort", onAbort);
+    });
+    try {
+      return await Promise.race([
+        options.route.invoke(job.messages, {
+          temperature: job.temperature,
+          maxTokens: job.maxTokens,
+          timeoutMs: job.timeoutMs,
+          signal: modelSignal,
+          operation: job.operation,
+          jsonSchema: job.jsonSchema,
+          acceptResponse: (candidate) => acceptsSupportPassportModelResponse(job.operation, job.messages, candidate.content)
+        }),
+        aborted
+      ]);
+    } catch (error) {
+      if (!modelSignal.aborted) {
+        log6.warn(`delegate support passport model call failed: ${String(error)}`);
+      }
+      return null;
+    } finally {
+      removeAbort();
+    }
+  };
+  const completeDuringShutdown = async (job, deadline) => {
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) return;
+    const shutdownTimeoutMs = Math.min(SHUTDOWN_RESULT_REQUEST_TIMEOUT_MS, remainingMs);
+    const completion = await post(
+      options.target,
+      options.serviceId,
+      SUPPORT_PASSPORT_MODEL_RESULT_PATH,
+      { id: job.id, claimId: job.claimId, result: null },
+      AbortSignal.timeout(shutdownTimeoutMs),
+      shutdownTimeoutMs
+    );
+    await completion.body?.cancel();
+    if (!completion.ok && completion.status !== 404) {
+      throw new Error(`delegate support passport model completion was rejected with HTTP ${completion.status}`);
+    }
+  };
+  const complete = async (job, result, signal, deadline, serviceSignal, onAccepted) => {
+    if (signal.aborted) {
+      if (serviceSignal.aborted) await completeDuringShutdown(job, deadline);
+      return;
+    }
+    let lastFailure = "the job deadline elapsed";
+    while (!signal.aborted && Date.now() < deadline) {
+      const remainingMs = deadline - Date.now();
+      let completion;
+      try {
+        completion = await post(
+          options.target,
+          options.serviceId,
+          SUPPORT_PASSPORT_MODEL_RESULT_PATH,
+          { id: job.id, claimId: job.claimId, result },
+          signal,
+          Math.min(RESULT_REQUEST_TIMEOUT_MS, remainingMs)
+        );
+      } catch (error) {
+        if (signal.aborted) {
+          if (serviceSignal.aborted) await completeDuringShutdown(job, deadline);
+          return;
+        }
+        lastFailure = String(error);
+        const retryDelayMs2 = Math.min(RESULT_RETRY_DELAY_MS, deadline - Date.now());
+        if (retryDelayMs2 > 0) await abortableRetryDelay(signal, retryDelayMs2);
+        continue;
+      }
+      const status = completion.status;
+      if (completion.ok) {
+        onAccepted();
+        await completion.body?.cancel().catch(() => void 0);
+        return;
+      }
+      await completion.body?.cancel();
+      if (status !== 408 && status !== 425 && status !== 429 && status < 500) {
+        throw new Error(`delegate support passport model completion was rejected with HTTP ${status}`);
+      }
+      if (signal.aborted) {
+        if (serviceSignal.aborted) await completeDuringShutdown(job, deadline);
+        return;
+      }
+      lastFailure = `HTTP ${status}`;
+      const retryDelayMs = Math.min(RESULT_RETRY_DELAY_MS, deadline - Date.now());
+      if (retryDelayMs > 0) await abortableRetryDelay(signal, retryDelayMs);
+    }
+    if (signal.aborted) {
+      if (serviceSignal.aborted) await completeDuringShutdown(job, deadline);
+      return;
+    }
+    throw new Error(`delegate support passport model completion missed its deadline after ${lastFailure}`);
+  };
+  const acknowledge = async (job, signal, timeoutMs, settleOnShutdown = false) => {
+    if (!job.claimId) return true;
+    const deadline = Date.now() + Math.min(job.timeoutMs, timeoutMs);
+    while (!signal.aborted && Date.now() < deadline) {
+      const remainingMs = deadline - Date.now();
+      try {
+        const response = await post(
+          options.target,
+          options.serviceId,
+          SUPPORT_PASSPORT_MODEL_ACK_PATH,
+          { id: job.id, claimId: job.claimId },
+          signal,
+          Math.min(RESULT_REQUEST_TIMEOUT_MS, remainingMs)
+        );
+        const status = response.status;
+        await response.body?.cancel();
+        if (response.ok) return true;
+        if (status !== 408 && status !== 425 && status !== 429 && status < 500) return false;
+      } catch {
+        if (signal.aborted) {
+          if (settleOnShutdown) await completeDuringShutdown(job, deadline);
+          return false;
+        }
+      }
+      const retryDelayMs = Math.min(RESULT_RETRY_DELAY_MS, deadline - Date.now());
+      if (retryDelayMs > 0) await abortableRetryDelay(signal, retryDelayMs);
+    }
+    if (signal.aborted && settleOnShutdown) await completeDuringShutdown(job, deadline);
+    return false;
+  };
+  const maintainClaim = async (job, signal, deadline) => {
+    if (!job.claimId || !job.executionLeaseTimeoutMs) return;
+    const renewalDelayMs = Math.max(1, Math.floor(job.executionLeaseTimeoutMs / 3));
+    const renewalTimeoutMs = Math.max(1, job.executionLeaseTimeoutMs - renewalDelayMs);
+    while (!signal.aborted && Date.now() < deadline) {
+      await abortableRetryDelay(signal, Math.min(renewalDelayMs, deadline - Date.now()));
+      if (signal.aborted || Date.now() >= deadline) return;
+      if (!await acknowledge(job, signal, Math.min(renewalTimeoutMs, deadline - Date.now()))) {
+        throw new Error("delegate support passport model claim lease renewal failed");
+      }
+    }
+  };
+  const runPoller = async (signal) => {
+    let consecutiveFailures = 0;
+    const delayAfterFailure = async () => {
+      consecutiveFailures += 1;
+      await abortableRetryDelay(signal, supportPassportModelPollRetryDelayMs(consecutiveFailures));
+    };
+    while (!signal.aborted) {
+      try {
+        const response = await post(
+          options.target,
+          options.serviceId,
+          SUPPORT_PASSPORT_MODEL_JOB_PATH,
+          { timeoutMs: 2e4, claimLease: true },
+          signal,
+          requestTimeoutMs
+        );
+        if (response.status === 204) {
+          consecutiveFailures = 0;
+          continue;
+        }
+        if (!response.ok) {
+          await response.body?.cancel();
+          await delayAfterFailure();
+          continue;
+        }
+        const job = parseSupportPassportModelJob(await response.json());
+        if (!job) {
+          log6.warn("delegate support passport model bridge received an invalid job");
+          await delayAfterFailure();
+          continue;
+        }
+        consecutiveFailures = 0;
+        const deadline = Date.now() + job.timeoutMs;
+        if (!await acknowledge(job, signal, job.claimAckTimeoutMs ?? job.timeoutMs, true)) {
+          log6.warn("delegate support passport model bridge could not acknowledge a claimed job");
+          await delayAfterFailure();
+          continue;
+        }
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) continue;
+        const claimedJob = { ...job, timeoutMs: remainingMs };
+        const heartbeatController = new AbortController();
+        const workController = new AbortController();
+        const heartbeatSignal = AbortSignal.any([signal, heartbeatController.signal]);
+        const workSignal = AbortSignal.any([signal, workController.signal]);
+        let heartbeatError;
+        let completionAccepted = false;
+        const heartbeat = maintainClaim(claimedJob, heartbeatSignal, deadline).catch((error) => {
+          if (heartbeatSignal.aborted || completionAccepted) return;
+          heartbeatError = error;
+          workController.abort();
+        });
+        try {
+          const result = await invoke(claimedJob, workSignal);
+          if (heartbeatError) throw heartbeatError;
+          await complete(claimedJob, result, workSignal, deadline, signal, () => {
+            completionAccepted = true;
+          });
+          if (heartbeatError && !completionAccepted) throw heartbeatError;
+        } catch (error) {
+          log6.warn(`delegate support passport model completion failed: ${String(error)}`);
+        } finally {
+          heartbeatController.abort();
+          workController.abort();
+          await heartbeat;
+        }
+      } catch (error) {
+        if (signal.aborted) break;
+        log6.warn(`delegate support passport model bridge failed: ${String(error)}`);
+        await delayAfterFailure();
+      }
+    }
+  };
+  const run = async (signal) => {
+    await Promise.all(Array.from({ length: MODEL_WORKER_COUNT }, () => runPoller(signal)));
+  };
+  return {
+    id: `${options.serviceId}:support-passport-model`,
+    async start() {
+      if (worker) return;
+      controller = new AbortController();
+      worker = run(controller.signal).finally(() => {
+        worker = void 0;
+        controller = void 0;
+      });
+    },
+    async stop() {
+      controller?.abort();
+      await worker;
+    }
+  };
+}
+
 // src/delegate-runtime.ts
 var DELEGATE_BATCH_FLUSH_CACHE_TTL_MS = 3e4;
+var delegatePassportServiceApiServices = /* @__PURE__ */ new WeakMap();
 function sessionKeyFrom(event, ctx) {
   const fromCtx = ctx?.sessionKey;
   if (typeof fromCtx === "string" && fromCtx.length > 0) return fromCtx;
@@ -7691,9 +8056,34 @@ function readContextComposition(response, fallbackContext) {
 function registerDelegateRuntime(api, options) {
   const { target, namespace, namespaceBindings } = options;
   const now = options.now ?? Date.now;
+  if (options.supportPassportModelRoute) {
+    const registeredServices = delegatePassportServiceApiServices.get(api);
+    if (registeredServices?.has(options.serviceId)) {
+      log7.debug(
+        `delegate register: ${options.serviceId} already has its support passport model service on this api`
+      );
+    } else if (typeof api.registerService !== "function") {
+      log7.error(
+        `[${options.serviceId}] delegate support passport gateway routing is unavailable: host exposes no service registration surface`
+      );
+    } else {
+      api.registerService(
+        createDelegateSupportPassportModelService({
+          serviceId: options.serviceId,
+          target,
+          route: options.supportPassportModelRoute
+        })
+      );
+      const services = registeredServices ?? /* @__PURE__ */ new Set();
+      services.add(options.serviceId);
+      if (registeredServices === void 0) {
+        delegatePassportServiceApiServices.set(api, services);
+      }
+    }
+  }
   if (options.passive) {
-    log6.info(
-      `[${options.serviceId}] bridge mode delegate: memory slot not owned \u2014 passive, no hooks registered`
+    log7.info(
+      `[${options.serviceId}] bridge mode delegate: memory slot not owned \u2014 passive, no memory hooks registered`
     );
     return;
   }
@@ -7761,13 +8151,13 @@ function registerDelegateRuntime(api, options) {
       const promptRemaining = () => promptDeadline - Date.now();
       try {
         if (options.shouldSkipRecall(sessionKey)) {
-          log6.debug(`delegate recall skipped: cron policy excludes ${sessionKey}`);
+          log7.debug(`delegate recall skipped: cron policy excludes ${sessionKey}`);
           return void 0;
         }
         const runtimeAgent = ctx?.runtime?.agent;
         const agentId = (typeof ctx?.agentId === "string" ? ctx.agentId : void 0) ?? (typeof runtimeAgent?.id === "string" ? runtimeAgent.id : void 0) ?? "main";
         if (await options.resolveSessionDisabled(sessionKey, agentId)) {
-          log6.debug(`delegate recall skipped: session toggle disables memory for ${sessionKey}`);
+          log7.debug(`delegate recall skipped: session toggle disables memory for ${sessionKey}`);
           return void 0;
         }
         const cwd = cwdFrom(event, ctx, options.cwd);
@@ -7814,7 +8204,7 @@ function registerDelegateRuntime(api, options) {
         }
         return { prependSystemContext: prompt };
       } catch (err) {
-        log6.warn(`delegate recall failed: ${String(err)}`);
+        log7.warn(`delegate recall failed: ${String(err)}`);
         return void 0;
       }
     };
@@ -7836,7 +8226,7 @@ function registerDelegateRuntime(api, options) {
       api.registerMemoryPromptSection(memoryBuildFn);
     }
   } else {
-    log6.info(
+    log7.info(
       `[${options.serviceId}] bridge mode delegate: prompt injection disabled by hooks policy`
     );
   }
@@ -7882,7 +8272,7 @@ function registerDelegateRuntime(api, options) {
         Math.max(1, observeRemaining())
       );
     } catch (err) {
-      log6.warn(`delegate observe failed: ${String(err)}`);
+      log7.warn(`delegate observe failed: ${String(err)}`);
     }
   });
   let cachedBatchFlushSupport;
@@ -7936,7 +8326,7 @@ function registerDelegateRuntime(api, options) {
       const remainingBudget = () => deadline - Date.now();
       const sessionKey = lifecycleSessionKeyFrom(event, ctx);
       if (sessionKey === void 0) {
-        log6.warn("delegate flush skipped: lifecycle event has malformed session key");
+        log7.warn("delegate flush skipped: lifecycle event has malformed session key");
         return false;
       }
       const namespaces = await lifecycleSessionNamespacesFrom(
@@ -7961,7 +8351,7 @@ function registerDelegateRuntime(api, options) {
           remainingTimeoutMs: remainingBudget
         });
       } catch (err) {
-        log6.warn(`delegate flush-plan ingestion failed: ${String(err)}`);
+        log7.warn(`delegate flush-plan ingestion failed: ${String(err)}`);
       }
       const flushNamespace = async (sessionNamespace) => postJson(
         target,
@@ -8031,7 +8421,7 @@ function registerDelegateRuntime(api, options) {
       }
       return flushIndividually();
     } catch (err) {
-      log6.warn(`delegate flush failed: ${String(err)}`);
+      log7.warn(`delegate flush failed: ${String(err)}`);
       return false;
     }
   };
@@ -8041,7 +8431,7 @@ function registerDelegateRuntime(api, options) {
     api.on("before_reset", flushEndedSession);
     api.on("session_end", flushEndedSession);
   }
-  log6.info(
+  log7.info(
     `[${options.serviceId}] bridge mode delegate: memory loop backed by daemon at ${target.host}:${target.port} (embedded orchestrator skipped; tools/CLI stay daemon-side)`
   );
 }
@@ -8098,7 +8488,7 @@ function createDelegateNamespaceBindingStore(memoryDir, serviceId, isLegacyAdapt
       return previous;
     } catch (err) {
       if (current.length > 0) {
-        log6.warn(
+        log7.warn(
           `[${serviceId}] delegate legacy namespace read failed; using canonical bindings: ${String(err)}`
         );
         return [];
@@ -8129,7 +8519,7 @@ function createDelegateNamespaceBindingStore(memoryDir, serviceId, isLegacyAdapt
       try {
         await legacy.replace?.(sessionKey, []);
       } catch (err) {
-        log6.warn(`[${serviceId}] delegate legacy namespace cleanup failed: ${String(err)}`);
+        log7.warn(`[${serviceId}] delegate legacy namespace cleanup failed: ${String(err)}`);
       }
     }
     rememberMigratedLegacySession(sessionKey);
@@ -8150,7 +8540,7 @@ function createDelegateNamespaceBindingStore(memoryDir, serviceId, isLegacyAdapt
           await persistNamespaceHistory(primary, sessionKey, merged);
           await completeLegacyMigration(sessionKey);
         } catch (err) {
-          log6.warn(`[${serviceId}] delegate namespace migration failed: ${String(err)}`);
+          log7.warn(`[${serviceId}] delegate namespace migration failed: ${String(err)}`);
         }
         return merged;
       });
@@ -8178,13 +8568,13 @@ var delegateAuthorizationPreflightServices = /* @__PURE__ */ new WeakMap();
 function maybeRegisterDelegateRuntime(api, options, deps = { checkHealth: checkDaemonHealthSync }) {
   const boundServices = delegateHookApiServices.get(api);
   if (boundServices?.has(options.serviceId)) {
-    log6.debug(
+    log7.debug(
       `delegate register: ${options.serviceId} already has hooks bound on this api \u2014 skipping duplicate registration`
     );
     return true;
   }
   if (delegateEmbeddedFallbackApis.has(api)) {
-    log6.debug(
+    log7.debug(
       `delegate register: ${options.serviceId} previously fell back to embedded on this api \u2014 staying embedded to avoid stacking memory paths`
     );
     return false;
@@ -8198,11 +8588,11 @@ function maybeRegisterDelegateRuntime(api, options, deps = { checkHealth: checkD
     bridge = resolveBridgeMode(options.configBridgeMode, {
       memoryDir: options.memoryDir,
       timeoutMs: bridgeHealthTimeoutMs,
-      onSkip: (reason) => log6.info(`[${options.serviceId}] bridge mode auto: staying embedded \u2014 ${reason}`)
+      onSkip: (reason) => log7.info(`[${options.serviceId}] bridge mode auto: staying embedded \u2014 ${reason}`)
     });
   } catch (err) {
     const wantedDelegate = requestedDelegate(options.configBridgeMode);
-    log6.error(
+    log7.error(
       wantedDelegate ? `${String(err)} \u2014 falling back to the embedded runtime` : `${String(err)} \u2014 the deployment is embedded, so this only affects delegate mode`
     );
     if (!options.passive) delegateEmbeddedFallbackApis.add(api);
@@ -8210,7 +8600,7 @@ function maybeRegisterDelegateRuntime(api, options, deps = { checkHealth: checkD
   }
   if (bridge.mode !== "delegate") {
     if (delegateBoundApis.has(api)) {
-      log6.warn(
+      log7.warn(
         `[${options.serviceId}] bridge mode resolved embedded, but a sibling service already bound delegate hooks on this api \u2014 reusing them instead of stacking an embedded runtime`
       );
       return true;
@@ -8218,7 +8608,7 @@ function maybeRegisterDelegateRuntime(api, options, deps = { checkHealth: checkD
     if (!options.passive) {
       delegateEmbeddedFallbackApis.add(api);
       if (resolveRequestedBridgeMode(options.configBridgeMode) === "auto") {
-        log6.info(
+        log7.info(
           `[${options.serviceId}] bridge mode auto: embedded hooks are bound on this api \u2014 a daemon that starts later is picked up on the next gateway restart`
         );
       }
@@ -8227,13 +8617,13 @@ function maybeRegisterDelegateRuntime(api, options, deps = { checkHealth: checkD
   }
   if (!bridge.healthVerified && !deps.checkHealth(bridge.daemonHost, bridge.daemonPort, bridgeHealthTimeoutMs)) {
     if (delegateBoundApis.has(api)) {
-      log6.warn(
+      log7.warn(
         `[${options.serviceId}] no healthy daemon at ${bridge.daemonHost}:${bridge.daemonPort}, but a sibling service already bound delegate hooks on this api \u2014 reusing them instead of stacking an embedded runtime`
       );
       return true;
     }
     delegateEmbeddedFallbackApis.add(api);
-    log6.error(
+    log7.error(
       `bridge mode delegate requested but no healthy daemon at ${bridge.daemonHost}:${bridge.daemonPort} \u2014 falling back to the embedded runtime`
     );
     return false;
@@ -8275,7 +8665,8 @@ function maybeRegisterDelegateRuntime(api, options, deps = { checkHealth: checkD
     capability: options.capability,
     recallTimeoutMs: 25e3,
     observeTimeoutMs: 12e4,
-    flushTimeoutMs: 55e3
+    flushTimeoutMs: 55e3,
+    supportPassportModelRoute: options.supportPassportModelRoute
   });
   let preflightServices = delegateAuthorizationPreflightServices.get(api);
   if (!options.passive && !preflightServices?.has(options.serviceId)) {
@@ -8290,16 +8681,16 @@ function maybeRegisterDelegateRuntime(api, options, deps = { checkHealth: checkD
     void probe(target, "", operations).then((result) => {
       if (result.state === "authorized") return;
       if (result.state === "unauthorized") {
-        log6.warn(
+        log7.warn(
           `delegate authorization preflight rejected ${operationLabel} (${result.status}; token source: ${result.tokenSource}) \u2014 runtime remains active`
         );
         return;
       }
-      log6.warn(
+      log7.warn(
         `delegate authorization preflight could not verify ${operationLabel} (token source: ${result.tokenSource}) \u2014 runtime remains active`
       );
     }).catch(() => {
-      log6.warn("delegate authorization preflight could not complete \u2014 runtime remains active");
+      log7.warn("delegate authorization preflight could not complete \u2014 runtime remains active");
     });
   }
   return true;
@@ -8403,9 +8794,11 @@ function buildTurnFingerprint(input) {
 import { planRecallMode } from "@remnic/core/intent";
 import {
   expandTildePath as expandTildePath4,
+  isSupportPassportPrivateMemory as isSupportPassportPrivateMemory2,
   renderMemoryContextPrompt as renderSharedMemoryContextPrompt,
   resolveAgentAccessAuthToken,
-  resolvePrincipal
+  resolvePrincipal,
+  searchWithGenericExclusion
 } from "@remnic/core";
 import {
   normalizeHostEmbeddingVector,
@@ -9306,6 +9699,7 @@ var pluginDefinition = {
       }
     );
     const delegateApi = api;
+    const delegateSupportPassportGatewayRoute = createConfiguredSupportPassportGatewayRoute(cfg);
     const delegateHandled = maybeRegisterDelegateRuntime(delegateApi, {
       serviceId,
       configBridgeMode: cfg.bridgeMode,
@@ -9324,6 +9718,7 @@ var pluginDefinition = {
       shouldSkipRecall: (sk) => shouldSkipRecallForSession(sk, cfg),
       cwd: getOpenClawRuntimeWorkspaceDir(api),
       flushOnResetEnabled: cfg.flushOnResetEnabled,
+      supportPassportModelRoute: delegateSupportPassportGatewayRoute ?? void 0,
       // Memory-slot capability inputs. Mirrors the embedded derivation: the
       // registration-time runtime agent owns this memory, and QMD is the
       // backend only when it is both selected and enabled.
@@ -9391,7 +9786,7 @@ var pluginDefinition = {
       globalThis.__openclawEngramTrace = void 0;
     }
     const existingAccessService = globalThis[keys.ACCESS_SERVICE];
-    const accessService = existingAccessService && existingAccessService ? existingAccessService : new access_service_exports.EngramAccessService(orchestrator, {
+    const accessService = existingAccessService && existingAccessService ? existingAccessService : new EngramAccessService(orchestrator, {
       resolveSecretRef: (ref, context) => loadOpenClawSecretRefResolver().then((resolver) => resolver ? resolver(ref, context) : void 0)
     });
     globalThis[keys.ACCESS_SERVICE] = accessService;
@@ -9637,9 +10032,9 @@ Keep the reflection grounded in the evidence below.
       let rawNarrative = "";
       try {
         if (route.kind === "gateway") {
-          const llm = new FallbackLlmClient(
+          const llm = new FallbackLlmClient2(
             cfg.gatewayConfig,
-            fallbackLlmRuntimeContextFromConfig(cfg)
+            fallbackLlmRuntimeContextFromConfig2(cfg)
           );
           if (!route.hasExplicitModel && !llm.isAvailable(route.options)) {
             logger_exports.log.debug(
@@ -10671,17 +11066,27 @@ Keep the reflection grounded in the evidence below.
                 async search(query, opts) {
                   const namespace = typeof orchestrator.resolveSelfNamespace === "function" ? orchestrator.resolveSelfNamespace(opts?.sessionKey) : void 0;
                   const resolvedMode = opts?.qmdSearchModeOverride === "vsearch" ? "vector" : opts?.qmdSearchModeOverride === "query" ? "search" : opts?.qmdSearchModeOverride ?? "search";
-                  const rawResults = await orchestrator.searchAcrossNamespaces({
-                    query,
-                    maxResults: opts?.maxResults,
-                    namespaces: namespace ? [namespace] : void 0,
-                    mode: resolvedMode
+                  const requestedMaxResults = typeof opts?.maxResults === "number" && Number.isFinite(opts.maxResults) ? Math.max(0, Math.floor(opts.maxResults)) : void 0;
+                  const minScore = typeof opts?.minScore === "number" && Number.isFinite(opts.minScore) ? opts.minScore : void 0;
+                  const visibleResults = await searchWithGenericExclusion({
+                    budget: requestedMaxResults ?? Number.MAX_SAFE_INTEGER,
+                    sendInitialLimit: requestedMaxResults !== void 0,
+                    search: (limit) => orchestrator.searchAcrossNamespaces({
+                      query,
+                      ...limit !== void 0 ? { maxResults: limit } : {},
+                      namespaces: namespace ? [namespace] : void 0,
+                      mode: resolvedMode
+                    }),
+                    filterPrivate: async (results) => {
+                      const visible = await orchestrator.filterPrivateSearchResults(
+                        results,
+                        namespace ? [namespace] : []
+                      );
+                      return minScore === void 0 ? visible : visible.filter((result) => result.score >= minScore);
+                    },
+                    isExcluded: (resultPath) => isMemoryArtifactPath(resultPath)
                   });
-                  return rawResults.filter((result) => {
-                    const candidate = result;
-                    const p = typeof candidate.path === "string" ? candidate.path : typeof candidate.id === "string" ? candidate.id : "";
-                    return !isMemoryArtifactPath(p);
-                  }).map((result, index) => {
+                  return visibleResults.map((result, index) => {
                     const candidate = result;
                     const rawPath = typeof candidate.path === "string" ? candidate.path : typeof candidate.id === "string" ? candidate.id : `memory-${index + 1}`;
                     const absolutePath = readScope.absolutize(rawPath);
@@ -10697,13 +11102,20 @@ Keep the reflection grounded in the evidence below.
                       source: isSessionsMemoryPath(normalizedPath) ? "sessions" : "memory",
                       citation: normalizedPath
                     };
-                  }).filter(
-                    (result) => typeof opts?.minScore === "number" && Number.isFinite(opts.minScore) ? result.score >= opts.minScore : true
-                  );
+                  });
                 },
                 async readFile(params) {
                   const requestedPath = readScope.normalizeWorkspacePath(params.relPath);
                   const absolutePath = await readScope.resolveReadablePath(params.relPath);
+                  const visible = await orchestrator.filterPrivateSearchResults([{
+                    docid: absolutePath,
+                    path: absolutePath,
+                    snippet: "",
+                    score: 0
+                  }], [], true);
+                  if (visible.length === 0) {
+                    throw new Error(`memory read excluded (private record): ${params.relPath}`);
+                  }
                   const text = await readTextFileLater(absolutePath);
                   const allLines = text.split(/\r?\n/);
                   const from = typeof params.from === "number" ? Math.max(1, Math.floor(params.from)) : 1;
@@ -11594,17 +12006,22 @@ Keep the reflection grounded in the evidence below.
           const agentSessionKey = typeof params === "object" ? params.agentSessionKey : void 0;
           const namespace = typeof orchestrator.resolveSelfNamespace === "function" ? orchestrator.resolveSelfNamespace(agentSessionKey) : void 0;
           try {
-            const rawResults = await orchestrator.searchAcrossNamespaces({
-              query,
-              maxResults,
-              namespaces: namespace ? [namespace] : void 0,
-              mode: "search"
+            const visibleResults = await searchWithGenericExclusion({
+              budget: maxResults,
+              sendInitialLimit: true,
+              search: (limit) => orchestrator.searchAcrossNamespaces({
+                query,
+                ...limit !== void 0 ? { maxResults: limit } : {},
+                namespaces: namespace ? [namespace] : void 0,
+                mode: "search"
+              }),
+              filterPrivate: (results) => orchestrator.filterPrivateSearchResults(
+                results,
+                namespace ? [namespace] : []
+              ),
+              isExcluded: (resultPath) => isMemoryArtifactPath(resultPath)
             });
-            return rawResults.filter((result) => {
-              const candidate = result;
-              const p = typeof candidate.path === "string" ? candidate.path : typeof candidate.id === "string" ? candidate.id : "";
-              return !isMemoryArtifactPath(p);
-            }).map((result, index) => {
+            return visibleResults.map((result, index) => {
               const candidate = result;
               const lookupPath = typeof candidate.path === "string" ? candidate.path : typeof candidate.id === "string" ? candidate.id : `remnic-memory-${index + 1}`;
               const startLine = typeof candidate.startLine === "number" && Number.isFinite(candidate.startLine) ? Math.max(1, Math.floor(candidate.startLine)) : 1;
@@ -11642,7 +12059,7 @@ Keep the reflection grounded in the evidence below.
             const resolved = await readMemoryByLookup(lookup, agentSessionKey);
             if (!resolved) return null;
             const { memory, displayPath } = resolved;
-            if (isMemoryArtifactPath(displayPath) || isMemoryArtifactPath(memory.path)) {
+            if (isMemoryArtifactPath(displayPath) || isMemoryArtifactPath(memory.path) || isSupportPassportPrivateMemory2(memory)) {
               return null;
             }
             const allLines = memory.content.split(/\r?\n/);
@@ -12080,6 +12497,7 @@ var export_loadDaySummaryPrompt = day_summary_exports.loadDaySummaryPrompt;
 export {
   buildHourlySummaryCronJob,
   checkDaemonHealth,
+  createOpenClawSupportPassportModelRoute,
   src_default as default,
   detectBridgeMode,
   detectDaemonBridgeMode,